feat(journal): execute frozen body inputs with durable delivery and erasure fences

Project alias, cwd, scope and command ceilings from actual sessions. Bind initial attachment cwd once in the shared broker/router while keeping root-relative delegation and detach generations. Preserve caller coordinates across reads, searches, checked checkout and commands; keep provider authorization and symlink boundaries.

Connect real SubWorkers, all filesystem Tools, scoped aliases, HTTP providers and limited Host grants in permanent regressions. Validated related normal suites (workdir http-client, tools, worker, worker-runtime, server-api typescript, fs-operation), workspace-server normal suite (1272 passed, 3 existing ignores), root check, product binary builds, rustdoc/doctests, generated contract checks, format and state-contract names. Test roots are checkout-local; Git parent discovery requires GIT_CEILING_DIRECTORIES at TMPDIR, confirmed against exact b860 baseline.

Cargo.lock

@@ -3990,6 +3990,7 @@ dependencies = [
  "protocol",
  "serde",
  "serde_json",
+ "session-store",
  "tokio",
  "workdir",
 ]
@@ -4783,12 +4784,14 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "feature-storage",
+ "job",
  "manifest",
  "memory",
  "rusqlite",
  "serde",
  "serde_json",
  "server-api",
+ "session-store",
  "sha2 0.11.0",
  "tempfile",
  "thiserror 2.0.18",
@@ -6497,6 +6500,7 @@ name = "workdir"
 version = "0.1.0"
 dependencies = [
  "async-trait",
+ "axum",
  "fs-operation",
  "libc",
  "manifest",
@@ -6520,7 +6524,6 @@ dependencies = [
  "axum",
  "base64 0.22.1",
  "chrono",
- "clap",
  "client",
  "config-source",
  "dotenv",
@@ -6558,6 +6561,7 @@ dependencies = [
  "toml",
  "tools",
  "tracing",
+ "tracing-subscriber",
  "tungstenite 0.28.0",
  "uuid",
  "wip-client",
@@ -6597,6 +6601,7 @@ dependencies = [
  "tokio",
  "tokio-tungstenite 0.29.0",
  "toml",
+ "tools",
  "tower",
  "tracing",
  "tracing-subscriber",
@@ -6684,6 +6689,7 @@ dependencies = [
  "futures",
  "manifest",
  "project-record",
+ "protocol",
  "reqwest",
  "serde",
  "serde_json",
@@ -6699,7 +6705,6 @@ dependencies = [
  "tui",
  "uuid",
  "workdir",
- "worker",
 ]
 
 [[package]]

crates/manifest/src/paths.rs

@@ -100,21 +100,6 @@ pub fn worker_allocation_path() -> Option<PathBuf> {
     worker_allocation_path_from_runtime_dir(runtime_dir())
 }
 
-/// `<runtime_dir>/<worker_name>/` — per-Worker runtime directory.
-pub fn worker_runtime_dir(worker_name: &str) -> Option<PathBuf> {
-    worker_runtime_dir_from_runtime_dir(runtime_dir(), worker_name)
-}
-
-/// `<runtime_dir>/<worker_name>/sock` — Worker's Unix socket path.
-///
-/// The `worker` crate's `RuntimeDir::socket_path()` creates the socket inside the
-/// Worker process. This function **predicts** the path for external callers that
-/// know the Worker name, such as the TUI attach flow. Both should return the same
-/// path.
-pub fn worker_socket_path(worker_name: &str) -> Option<PathBuf> {
-    worker_socket_path_from_runtime_dir(runtime_dir(), worker_name)
-}
-
 // ---- internals --------------------------------------------------------------
 
 fn resolve_config_dir_from_parts(
@@ -204,20 +189,6 @@ fn worker_allocation_path_from_runtime_dir(runtime_dir: Option<PathBuf>) -> Opti
     Some(runtime_dir?.join("workers.json"))
 }
 
-fn worker_runtime_dir_from_runtime_dir(
-    runtime_dir: Option<PathBuf>,
-    worker_name: &str,
-) -> Option<PathBuf> {
-    Some(runtime_dir?.join(worker_name))
-}
-
-fn worker_socket_path_from_runtime_dir(
-    runtime_dir: Option<PathBuf>,
-    worker_name: &str,
-) -> Option<PathBuf> {
-    Some(worker_runtime_dir_from_runtime_dir(runtime_dir, worker_name)?.join("sock"))
-}
-
 /// Treats empty environment values as unset. `std::env::var` distinguishes
 /// `Ok("")` from `Err(NotPresent)`, but path resolution treats both as unset
 /// for intuitive behavior.
@@ -455,16 +426,8 @@ mod tests {
             PathBuf::from("/sand/sessions")
         );
         assert_eq!(
-            worker_allocation_path_from_runtime_dir(runtime_dir.clone()).unwrap(),
+            worker_allocation_path_from_runtime_dir(runtime_dir).unwrap(),
             PathBuf::from("/sand/run/workers.json")
         );
-        assert_eq!(
-            worker_runtime_dir_from_runtime_dir(runtime_dir.clone(), "foo").unwrap(),
-            PathBuf::from("/sand/run/foo")
-        );
-        assert_eq!(
-            worker_socket_path_from_runtime_dir(runtime_dir, "foo").unwrap(),
-            PathBuf::from("/sand/run/foo/sock")
-        );
     }
 }

crates/protocol/src/lib.rs

@@ -52,7 +52,7 @@ pub enum AuthenticatedInputSource {
     /// Assigned whenever a serialized tracked method crosses an untrusted
     /// protocol boundary. Receivers must handle it exactly like public input.
     UntrustedWire,
-    /// Stamped only by the operator-owned standalone in-process transport.
+    /// Stamped only by the operator-owned Standalone Host after local admission.
     /// This is not a Backend Account or authority accepted from wire fields.
     LocalOperator,
     Account {
@@ -399,15 +399,12 @@ pub enum Method {
 
 /// Typed lifecycle events sent from a child Worker to its parent.
 ///
-/// Delivered as `Method::WorkerEvent` over the parent's Unix socket. The
-/// parent Controller always applies variant-specific side effects
-/// (registry / worker-allocation updates). Agent-visible variants are also
-/// queued into the notification buffer; control-plane-only variants are
-/// not injected into the parent's LLM context.
+/// Delivered in-process to the parent Controller's protocol intake. Agent-visible variants
+/// are queued into the notification buffer. Reports are advisory: receivers must check the
+/// actual child session before treating its work as complete.
 ///
-/// Transport is fire-and-forget; receivers must tolerate out-of-order
-/// delivery (e.g. `TurnEnded` arriving after `ShutDown` for the same
-/// child Worker).
+/// Retained legacy control-only variants can be decoded from saved history, but do not
+/// register live children, delegate scope, or establish a socket callback.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 #[cfg_attr(feature = "json-schema", derive(schemars::JsonSchema))]
@@ -429,16 +426,8 @@ pub enum WorkerEvent {
     /// Child has stopped (controller loop is exiting).
     ShutDown { worker_name: String },
 
-    /// Child SubWorker sub-delegated scope to a grandchild SubWorker via `SubWorkerSpawn`.
-    ///
-    /// Control-plane only: receivers apply registry side effects and
-    /// propagate upward, but do not expose this as an agent notification.
-    ///
-    /// The parent uses this to add the grandchild to its own
-    /// `spawned_workers.json` so it can manage the grandchild directly
-    /// even if the intermediate child dies. The parent then re-fires
-    /// this event upward (if it has a parent of its own) to maintain
-    /// the chain to root.
+    /// Legacy process-child scope report retained for saved Session decoding only.
+    /// Live Controllers ignore it; only the Host-owned Internal registry grants child scope.
     ScopeSubDelegated {
         /// Sub-delegating Worker (= the sender itself).
         parent_worker: String,

crates/runtime-api/Cargo.toml

@@ -9,6 +9,7 @@ license.workspace = true
 api-macros = { workspace = true, features = ["reqwest", "axum"] }
 manifest.workspace = true
 protocol.workspace = true
+session-store.workspace = true
 serde = { workspace = true, features = ["derive"] }
 workdir.workspace = true
 

crates/runtime-api/src/lib.rs

@@ -836,6 +836,34 @@ pub struct SessionMaterialPinResponse {
     pub pin_id: String,
 }
 
+/// One body-bearing immutable slice. The byte budget includes slice metadata,
+/// but not the enclosing availability enum or the caller's durable Job envelope.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRecordingCaptureRequest {
+    pub workspace_id: String,
+    pub source: SessionPublicSource,
+    pub expected_session_id: String,
+    pub start: session_store::capture::RecordingPosition,
+    pub max_entries: usize,
+    pub max_serialized_bytes: usize,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "availability", rename_all = "snake_case")]
+pub enum SessionRecordingCaptureAvailability {
+    NotMaterialized {
+        session_id: String,
+    },
+    Captured {
+        slice: session_store::capture::RecordingCaptureSlice,
+    },
+    Unavailable {
+        reason: SessionPublicUnavailableReason,
+        message: String,
+    },
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct SessionMaterialCatalogRequest {
@@ -1246,6 +1274,16 @@ pub trait RuntimeApi {
         #[body] request: SessionMaterialPinRequest,
     ) -> Result<SessionMaterialPinResponse, RuntimeApiError>;
 
+    #[post(
+        "/v1/session-public/recording-capture",
+        status = 200,
+        error_status = 400
+    )]
+    async fn session_recording_capture(
+        &self,
+        #[body] request: SessionRecordingCaptureRequest,
+    ) -> Result<SessionRecordingCaptureAvailability, RuntimeApiError>;
+
     #[post(
         "/v1/session-public/material/catalog",
         status = 200,
@@ -1730,6 +1768,13 @@ mod tests {
             Err(test_error(501))
         }
 
+        async fn session_recording_capture(
+            &self,
+            _request: SessionRecordingCaptureRequest,
+        ) -> Result<SessionRecordingCaptureAvailability, RuntimeApiError> {
+            Err(test_error(501))
+        }
+
         async fn session_material_catalog(
             &self,
             _request: SessionMaterialCatalogRequest,

crates/server-api/src/lib.rs

@@ -125,6 +125,8 @@ pub struct WorkdirOperationApiError {
     pub message: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub diagnostics: Option<Vec<Diagnostic>>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub audit_failures: Vec<workdir::http::WorkdirAuditFailure>,
     #[serde(skip, default = "default_repository_error_status")]
     status: u16,
     /// Server-local metadata retained by generated error response extensions, never the wire body.
@@ -132,6 +134,8 @@ pub struct WorkdirOperationApiError {
     pub workdir_log: Option<WorkdirOperationLogContext>,
     #[serde(skip)]
     pub denial_reason: Option<workdir::WorkdirDenialReason>,
+    #[serde(skip)]
+    pub failure_reason: Option<workdir::WorkdirFailureReason>,
 }
 
 /// Internal operational correlation. Producers supply fixed-length ID fingerprints and
@@ -154,9 +158,11 @@ impl WorkdirOperationApiError {
             code: None,
             message: error.message,
             diagnostics: Some(error.diagnostics),
+            audit_failures: Vec::new(),
             status: error.status,
             workdir_log: None,
             denial_reason: None,
+            failure_reason: None,
         }
     }
 
@@ -167,9 +173,11 @@ impl WorkdirOperationApiError {
             code: Some(error.code),
             message: error.message,
             diagnostics: None,
+            audit_failures: Vec::new(),
             status,
             workdir_log: None,
             denial_reason: error.denial_reason,
+            failure_reason: error.failure_reason,
         }
     }
 }
@@ -7506,6 +7514,9 @@ pub struct CurrentWorkerWorkdirAttachmentResponse {
     pub alias: String,
     pub working_directory_id: String,
     pub capabilities: workdir::WorkdirSessionCapabilities,
+    /// Present for attachment responses, absent after detach.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub environment: Option<workdir::WorkdirSessionEnvironment>,
     pub attached: bool,
 }
 
@@ -7518,7 +7529,9 @@ pub struct CurrentWorkerWorkdirOperationRequest {
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, JsonSchema)]
 #[serde(transparent)]
-pub struct CurrentWorkerWorkdirOperationResponse(pub workdir::http::WorkdirSessionOperationResult);
+pub struct CurrentWorkerWorkdirOperationResponse(
+    pub workdir::http::WorkdirSessionOperationResponse,
+);
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, JsonSchema)]
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
@@ -13276,6 +13289,7 @@ mod tests {
             alias: "checkout".to_string(),
             working_directory_id: "workdir".to_string(),
             capabilities: workdir::WorkdirSessionCapabilities::EMPTY,
+            environment: None,
             attached: false,
         };
         let value = serde_json::to_value(&response).unwrap();
@@ -15047,10 +15061,12 @@ mod workdir_error_diagnostic_tests {
     #[test]
     fn workdir_internal_diagnostics_never_enter_public_error_body_or_schema() {
         let mut error = WorkdirOperationApiError::provider(workdir::http::WorkdirTransportError {
+            failure_reason: None,
             code: workdir::http::WorkdirTransportErrorCode::Denied,
             message: "Workdir operation was denied".to_string(),
             denial_reason: Some(workdir::WorkdirDenialReason::OsPermissionDenied),
         });
+        error.failure_reason = Some(workdir::WorkdirFailureReason::HttpTimeout);
         error.workdir_log = Some(WorkdirOperationLogContext {
             operation: "write",
             workspace_id_hash: "internal-workspace-fingerprint".to_string(),
@@ -15064,10 +15080,12 @@ mod workdir_error_diagnostic_tests {
         assert_eq!(api_macros::HttpError::status_code(&error), 403);
         let decoded: WorkdirOperationApiError = serde_json::from_value(wire).unwrap();
         assert!(decoded.denial_reason.is_none());
+        assert!(decoded.failure_reason.is_none());
         assert!(decoded.workdir_log.is_none());
         let schema = serde_json::to_value(schemars::schema_for!(WorkdirOperationApiError)).unwrap();
         assert!(schema["properties"].get("workdir_log").is_none());
         assert!(schema["properties"].get("denial_reason").is_none());
+        assert!(schema["properties"].get("failure_reason").is_none());
     }
 }
 

crates/session-store/README.md

@@ -11,5 +11,7 @@ checks or Runtime catalog lifecycle management.
 - [`worker_session_store`]: storage boundary for a Session bound to a Worker
 - [`worker_metadata`]: current Worker state and active Segment switching
 - [`system_item`]: records of system input presented to the model
+- [`capture`]: Worker-independent immutable public values and bounded body transport;
+  authorization, source I/O, and delivery lifecycle stay with the Host
 - [`public_snapshot`] / [`public_index`]: public projections of stored history
 - [`event_trace`]: diagnostic records independent of history replay

crates/session-store/src/capture.rs

@@ -0,0 +1,967 @@
+//! Exploration domain for immutable Session captures, with no Workspace/Memory mutation capability.
+//!
+//! A capture is an ordered projection of committed entries; exploration excludes reasoning and
+//! system prompts, including Host compaction summaries and other derived context. Full inherited
+//! summary input belongs to compaction, not public observation or Memory evidence. Overview,
+//! search, bounded reads, and evidence conversion share `SessionEntryRef`.
+//! `SessionEntryRef` is a contextual UI reference. `ScopedSessionEntryRef` additionally binds
+//! the Session and exact immutable capture, and is required for portable checked operations.
+//! Appends preserve existing entry identities. Sparse real user/assistant anchors and intervening
+//! entry counts index long histories. Search with an empty filter also provides bounded range lists.
+//!
+//! Host-fixed snapshot exploration, Memory candidate evidence validation, and current Worker
+//! observation share only this domain; they do not enable or modify each other's Features.
+//! The provider owns authorization to recapture a current Worker. A capture itself proves neither
+//! completion nor approval and grants no business-mutation authority.
+//!
+//! Recording Hosts use the common committed replay through the guarded APIs below.
+//! [`recording_catalog_worker_guarded`] and [`recording_catalog_fs_guarded`] expose
+//! descriptors only to an admission callback under the caller's existing publication/
+//! erasure guard and persisted active selector, without allocating a full body DTO.
+//! [`capture_recording_slice_worker_guarded`] and [`capture_recording_slice_fs_guarded`]
+//! separately construct bounded body-bearing inputs. Admission descriptors are not
+//! sufficient Job inputs; saved recording DTOs are read/sliced without live storage.
+
+use std::sync::Arc;
+
+use crate::{
+    LoggedSessionHistoryMetadata as SessionHistoryMetadata,
+    LoggedSessionHistoryOrigin as HistoryOrigin,
+};
+mod body;
+mod recording;
+use agen::{HistoryEntry, Item, Role};
+pub use body::*;
+use protocol::{
+    SessionContentPart, SessionEntryProvenance, SessionMessageRole, SessionSnapshot,
+    SessionSnapshotEntryData,
+};
+pub use recording::*;
+use serde::{Deserialize, Serialize};
+
+const DEFAULT_SEARCH_LIMIT: usize = 20;
+const MAX_SEARCH_LIMIT: usize = 50;
+const DEFAULT_READ_MAX_ITEMS: usize = 40;
+const MAX_READ_MAX_ITEMS: usize = 80;
+const DEFAULT_READ_MAX_BYTES: usize = 32 * 1024;
+const OVERVIEW_ANCHOR_STRIDE: usize = 8;
+
+/// Append-stable contextual UI reference derived from a logical entry identity.
+/// Portable consumers must bind it with `SessionCapture::scoped_ref` before use.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct SessionEntryRef(String);
+
+impl SessionEntryRef {
+    pub fn from_history_entry_id(entry_id: &crate::LoggedSessionHistoryEntryId) -> Self {
+        Self(format!("E{}", entry_id.0))
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        let suffix = value.strip_prefix('E')?;
+        if suffix.is_empty()
+            // Legacy Host boundary identities contain both Session and Segment UUIDs.
+            || suffix.len() > 256
+            || !suffix
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+        {
+            return None;
+        }
+        Some(Self(value.to_string()))
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Display for SessionEntryRef {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(&self.0)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ReferenceKind {
+    User,
+    Assistant,
+    System,
+    Tool,
+}
+
+impl ReferenceKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::User => "user",
+            Self::Assistant => "assistant",
+            Self::System => "system",
+            Self::Tool => "tool",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "user" => Some(Self::User),
+            "assistant" | "agent" => Some(Self::Assistant),
+            "system" => Some(Self::System),
+            "tool" => Some(Self::Tool),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ToolPart {
+    Input,
+    Output,
+    Both,
+}
+
+impl ToolPart {
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "input" => Some(Self::Input),
+            "output" => Some(Self::Output),
+            "both" => Some(Self::Both),
+            _ => None,
+        }
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Input => "input",
+            Self::Output => "output",
+            Self::Both => "both",
+        }
+    }
+
+    pub fn matches(self, actual: ToolPart) -> bool {
+        matches!(self, ToolPart::Both) || self == actual
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct OverviewItem {
+    pub id: SessionEntryRef,
+    pub origin: SessionEntryProvenance,
+    pub entry_range: [u64; 2],
+    pub kind: ReferenceKind,
+    pub label: String,
+    pub text: String,
+    pub intervening_entries: usize,
+}
+
+#[derive(Debug, Clone)]
+pub struct ReferenceEntry {
+    pub attachment_count: usize,
+    use_policy: Option<protocol::SessionEntryUsePolicy>,
+    pub id: SessionEntryRef,
+    pub origin: SessionEntryProvenance,
+    pub entry_range: [u64; 2],
+    pub kind: ReferenceKind,
+    pub tool_part: Option<ToolPart>,
+    pub tool_name: Option<String>,
+    pub label: String,
+    pub summary: String,
+    search_text: String,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct SearchOptions {
+    pub query: String,
+    pub kind: Option<ReferenceKind>,
+    pub tool_part: Option<ToolPart>,
+    pub tool_name: Option<String>,
+    pub limit: Option<usize>,
+    pub min_entry_index: Option<u64>,
+    pub from: Option<SessionEntryRef>,
+    pub through: Option<SessionEntryRef>,
+    pub offset: usize,
+}
+
+#[derive(Debug, Clone)]
+pub struct SearchHit {
+    pub id: SessionEntryRef,
+    pub origin: SessionEntryProvenance,
+    pub kind: ReferenceKind,
+    pub tool_part: Option<ToolPart>,
+    pub tool_name: Option<String>,
+    pub entry_range: [u64; 2],
+    pub label: String,
+    pub summary: String,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum ReadSelector<'a> {
+    Id(&'a str),
+    EntryRange([u64; 2]),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ReadDetail {
+    Compact,
+    Full,
+}
+
+#[derive(Debug, Clone)]
+pub struct ReadOptions {
+    pub include_tools: bool,
+    pub tool_part: ToolPart,
+    pub detail: ReadDetail,
+    pub max_items: usize,
+    pub max_bytes: usize,
+}
+
+impl Default for ReadOptions {
+    fn default() -> Self {
+        Self {
+            include_tools: true,
+            tool_part: ToolPart::Both,
+            detail: ReadDetail::Compact,
+            max_items: DEFAULT_READ_MAX_ITEMS,
+            max_bytes: DEFAULT_READ_MAX_BYTES,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct ReadEntry {
+    pub id: SessionEntryRef,
+    pub origin: SessionEntryProvenance,
+    pub kind: ReferenceKind,
+    pub tool_part: Option<ToolPart>,
+    pub tool_name: Option<String>,
+    pub entry_range: [u64; 2],
+    pub label: String,
+    pub text: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct ReadResult {
+    pub entries: Vec<ReadEntry>,
+    pub truncated: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct SessionEntryEvidence {
+    pub segment_id: String,
+    pub entry_ref: SessionEntryRef,
+    pub origin: SessionEntryProvenance,
+    /// Inclusive original-source positions in `segment_id`, not view/UI order.
+    pub entry_range: [u64; 2],
+    pub kind: ReferenceKind,
+    pub tool_part: Option<ToolPart>,
+    pub label: String,
+    pub summary: String,
+    pub excerpt: String,
+}
+
+#[derive(Debug, Clone)]
+struct CapturedHistoryEntry {
+    use_policy: Option<protocol::SessionEntryUsePolicy>,
+    item: Item,
+    entry_id: crate::LoggedSessionHistoryEntryId,
+    origin: SessionEntryProvenance,
+    dto: CaptureEntryDto,
+}
+
+#[derive(Debug, Clone)]
+pub struct SessionCapture {
+    session_id: String,
+    segment_id: String,
+    capture_id: String,
+    view_entry_count: u64,
+    entries: Arc<Vec<CapturedHistoryEntry>>,
+    overview: Vec<OverviewItem>,
+    index: Vec<ReferenceEntry>,
+}
+
+impl SessionCapture {
+    pub fn from_session_snapshot(
+        session_id: impl Into<String>,
+        segment_id: impl Into<String>,
+        snapshot: SessionSnapshot,
+    ) -> Self {
+        let segment_id = segment_id.into();
+        let view_entry_count = snapshot.entries.len() as u64;
+        let entries = snapshot
+            .entries
+            .into_iter()
+            .enumerate()
+            .filter_map(|(index, entry)| {
+                let policy = CaptureUsePolicy {
+                    recording_material: false,
+                    memory_evidence: entry.use_policy.is_none_or(|p| p.memory_evidence),
+                    observation_readable: entry.use_policy.is_none_or(|p| p.observation_readable),
+                };
+                let explicit = entry.use_policy.is_some();
+                let item = match entry.data {
+                    SessionSnapshotEntryData::UserInput { segments } => {
+                        Item::user_message(protocol::Segment::flatten_to_text(&segments))
+                    }
+                    SessionSnapshotEntryData::Message { role, content } => Item::Message {
+                        id: None,
+                        status: None,
+                        role: match role {
+                            SessionMessageRole::User => Role::User,
+                            SessionMessageRole::Assistant => Role::Assistant,
+                        },
+                        content: content
+                            .into_iter()
+                            .map(|part| match part {
+                                SessionContentPart::Text { text } => {
+                                    agen::ContentPart::Text { text }
+                                }
+                                SessionContentPart::Refusal { refusal } => {
+                                    agen::ContentPart::Refusal { refusal }
+                                }
+                            })
+                            .collect(),
+                    },
+                    SessionSnapshotEntryData::ToolCall {
+                        call_id,
+                        name,
+                        arguments,
+                    } => Item::tool_call(call_id, name, arguments),
+                    SessionSnapshotEntryData::ToolResult {
+                        call_id,
+                        summary,
+                        content,
+                        is_error,
+                        ..
+                    } => Item::tool_result_item(call_id, summary, content, is_error),
+                    SessionSnapshotEntryData::SystemItem { content, .. } if explicit => {
+                        Item::system_message(content)
+                    }
+                    _ => return None,
+                };
+                let body = CaptureBody::project(&item, &entry.provenance, explicit)?;
+                if !policy.any() {
+                    return None;
+                }
+                Some(CaptureEntryDto {
+                    entry_id: entry.entry_id,
+                    order: index as u64,
+                    source: CaptureSource {
+                        segment_id: segment_id.clone(),
+                        entry_index: index as u64,
+                        provenance: entry.provenance,
+                        history_origin: None,
+                        derived_from: entry.derived_from,
+                    },
+                    policy,
+                    body,
+                })
+            })
+            .collect();
+        Self::from_projected(session_id.into(), segment_id, view_entry_count, entries)
+    }
+
+    pub fn new(
+        session_id: impl Into<String>,
+        segment_id: impl Into<String>,
+        items: Vec<Item>,
+    ) -> Self {
+        let segment_id = segment_id.into();
+        let view_entry_count = items.len() as u64;
+        let entries = items
+            .into_iter()
+            .enumerate()
+            .filter_map(|(index, item)| {
+                let origin = SessionEntryProvenance::LegacyUnknown;
+                let body = CaptureBody::project(&item, &origin, false)?;
+                Some(CaptureEntryDto {
+                    entry_id: format!("{index:08}"),
+                    order: index as u64,
+                    source: CaptureSource {
+                        segment_id: segment_id.clone(),
+                        entry_index: index as u64,
+                        provenance: origin,
+                        history_origin: None,
+                        derived_from: Vec::new(),
+                    },
+                    policy: CaptureUsePolicy::PUBLIC,
+                    body,
+                })
+            })
+            .collect();
+        Self::from_projected(session_id.into(), segment_id, view_entry_count, entries)
+    }
+
+    /// Project a complete Host-fixed history whose source positions start at zero.
+    /// Select a suffix with `select_order_range` on the resulting value instead
+    /// of passing a rebased history vector: annotations do not carry source positions.
+    pub fn from_complete_history(
+        session_id: impl Into<String>,
+        segment_id: impl Into<String>,
+        entries: Vec<HistoryEntry<SessionHistoryMetadata>>,
+    ) -> Self {
+        let segment_id = segment_id.into();
+        let view_entry_count = entries.len() as u64;
+        let entries = entries
+            .into_iter()
+            .enumerate()
+            .filter_map(|(index, entry)| {
+                let origin = public_provenance(&entry.annotation.origin);
+                let mut item = entry.item;
+                let mut explicit = false;
+                let policy = if let Some(input) = entry.annotation.input_metadata {
+                    explicit = true;
+                    if matches!(
+                        item,
+                        Item::Message {
+                            role: Role::System,
+                            ..
+                        }
+                    ) {
+                        // Only the explicit public projection crosses this boundary.
+                        let public = input.public_item()?;
+                        item = Item::system_message(public.body.clone());
+                    } else if input.feature_payload().is_some() || input.public_item().is_some() {
+                        return None;
+                    }
+                    CaptureUsePolicy::from(input.usage())
+                } else {
+                    if matches!(entry.annotation.origin, HistoryOrigin::Provided { .. }) {
+                        return None;
+                    }
+                    CaptureUsePolicy::PUBLIC
+                };
+                if !policy.any() {
+                    return None;
+                }
+                let body = CaptureBody::project(&item, &origin, explicit)?;
+                Some(CaptureEntryDto {
+                    entry_id: entry.annotation.entry_id.0,
+                    order: index as u64,
+                    source: CaptureSource {
+                        segment_id: segment_id.clone(),
+                        entry_index: index as u64,
+                        provenance: origin,
+                        history_origin: Some(entry.annotation.origin),
+                        derived_from: entry
+                            .annotation
+                            .derivation
+                            .map(|d| d.sources.into_iter().map(|id| id.0).collect())
+                            .unwrap_or_default(),
+                    },
+                    policy,
+                    body,
+                })
+            })
+            .collect();
+        Self::from_projected(session_id.into(), segment_id, view_entry_count, entries)
+    }
+
+    fn from_projected(
+        session_id: String,
+        segment_id: String,
+        view_entry_count: u64,
+        dtos: Vec<CaptureEntryDto>,
+    ) -> Self {
+        let dto = CaptureDto {
+            version: CAPTURE_VERSION,
+            session_id: session_id.clone(),
+            segment_id: segment_id.clone(),
+            view_entry_count,
+            entries: dtos,
+        };
+        let capture_id = dto.fingerprint();
+        let entries: Vec<_> = dto
+            .entries
+            .into_iter()
+            .map(|dto| CapturedHistoryEntry {
+                use_policy: Some(protocol::SessionEntryUsePolicy {
+                    observation_readable: dto.policy.observation_readable,
+                    memory_evidence: dto.policy.memory_evidence,
+                }),
+                item: dto.body.to_item(),
+                entry_id: crate::LoggedSessionHistoryEntryId(dto.entry_id.clone()),
+                origin: dto.source.provenance.clone(),
+                dto,
+            })
+            .collect();
+        let mut overview = Vec::new();
+        let mut index = Vec::new();
+
+        for entry in &entries {
+            let item = &entry.item;
+            let entry_range = [entry.dto.order; 2];
+            let attachment_count = match entry.dto.body {
+                CaptureBody::ToolResult {
+                    attachment_count, ..
+                } => attachment_count,
+                _ => 0,
+            };
+            match item {
+                Item::Message { role, content, .. } => {
+                    let Some(kind) = message_reference_kind(&entry.origin, role, entry.use_policy)
+                    else {
+                        continue;
+                    };
+                    let text = content
+                        .iter()
+                        .map(|p| p.as_text())
+                        .collect::<Vec<_>>()
+                        .join("");
+                    let label = format!("{} message", kind.as_str());
+                    let summary = truncate_chars(&text, 240);
+                    let id = SessionEntryRef::from_history_entry_id(&entry.entry_id);
+                    index.push(ReferenceEntry {
+                        use_policy: entry.use_policy,
+                        attachment_count,
+                        id: id.clone(),
+                        origin: entry.origin.clone(),
+                        entry_range,
+                        kind,
+                        tool_part: None,
+                        tool_name: None,
+                        label: label.clone(),
+                        summary: summary.clone(),
+                        search_text: text.clone(),
+                    });
+                    if entry.use_policy.is_none_or(|p| p.observation_readable)
+                        && matches!(kind, ReferenceKind::User | ReferenceKind::Assistant)
+                    {
+                        overview.push(OverviewItem {
+                            id: id.clone(),
+                            origin: entry.origin.clone(),
+                            entry_range,
+                            kind,
+                            label,
+                            text,
+                            intervening_entries: 0,
+                        });
+                    }
+                }
+                Item::ToolCall {
+                    name, arguments, ..
+                } => {
+                    let text = format!("{name}\n{arguments}");
+                    index.push(ReferenceEntry {
+                        use_policy: entry.use_policy,
+                        attachment_count,
+                        id: SessionEntryRef::from_history_entry_id(&entry.entry_id),
+                        origin: entry.origin.clone(),
+                        entry_range,
+                        kind: ReferenceKind::Tool,
+                        tool_part: Some(ToolPart::Input),
+                        tool_name: Some(name.clone()),
+                        label: format!("tool input: {name}"),
+                        summary: format!("Tool call {name}"),
+                        search_text: text,
+                    });
+                }
+                Item::ToolResult {
+                    summary,
+                    content,
+                    attachments: _,
+                    ..
+                } => {
+                    let attachment_marker = if attachment_count == 0 {
+                        String::new()
+                    } else {
+                        format!("\n[{} image attachment(s)]", attachment_count)
+                    };
+                    let text = format!(
+                        "{summary}\n{}{attachment_marker}",
+                        content.as_deref().unwrap_or_default(),
+                    );
+                    index.push(ReferenceEntry {
+                        use_policy: entry.use_policy,
+                        attachment_count,
+                        id: SessionEntryRef::from_history_entry_id(&entry.entry_id),
+                        origin: entry.origin.clone(),
+                        entry_range,
+                        kind: ReferenceKind::Tool,
+                        tool_part: Some(ToolPart::Output),
+                        tool_name: None,
+                        label: "tool output".to_string(),
+                        summary: truncate_chars(summary, 240),
+                        search_text: text,
+                    });
+                }
+                Item::AssistantResponseBoundary { .. } | Item::Reasoning { .. } => {}
+            }
+        }
+
+        if overview.len() > 2 {
+            let last = overview.len() - 1;
+            overview = overview
+                .into_iter()
+                .enumerate()
+                .filter_map(|(index, entry)| {
+                    (index == 0 || index == last || index % OVERVIEW_ANCHOR_STRIDE == 0)
+                        .then_some(entry)
+                })
+                .collect();
+        }
+
+        for overview_index in 0..overview.len().saturating_sub(1) {
+            let current_entry = overview[overview_index].entry_range[0];
+            let next_entry = overview[overview_index + 1].entry_range[0];
+            overview[overview_index].intervening_entries = index
+                .iter()
+                .filter(|entry| {
+                    let entry_index = entry.entry_range[0];
+                    entry_index > current_entry && entry_index < next_entry
+                })
+                .count();
+        }
+
+        Self {
+            session_id,
+            segment_id,
+            capture_id,
+            view_entry_count,
+            entries: Arc::new(entries),
+            overview,
+            index,
+        }
+    }
+
+    /// Public source entries are immutable; callers retain their own business decisions.
+    pub fn entries(&self) -> impl ExactSizeIterator<Item = &CaptureEntryDto> {
+        self.entries.iter().map(|entry| &entry.dto)
+    }
+
+    pub fn overview(&self) -> &[OverviewItem] {
+        &self.overview
+    }
+
+    /// Capture-local UI position, not the original source position used by evidence.
+    pub fn view_order_for_ref(&self, reference: &SessionEntryRef) -> Option<u64> {
+        self.index
+            .iter()
+            .find(|entry| entry.id == *reference)
+            .map(|entry| entry.entry_range[0])
+    }
+
+    pub fn search(&self, options: &SearchOptions) -> Vec<SearchHit> {
+        if self.validate_search(options).is_err() {
+            return Vec::new();
+        }
+        let query = options.query.trim().to_lowercase();
+        let limit = options
+            .limit
+            .unwrap_or(DEFAULT_SEARCH_LIMIT)
+            .clamp(1, MAX_SEARCH_LIMIT);
+        let tool_name = options.tool_name.as_deref();
+        let min_entry_index = options
+            .from
+            .as_ref()
+            .and_then(|reference| self.view_order_for_ref(reference))
+            .unwrap_or_else(|| options.min_entry_index.unwrap_or(0));
+        let max_entry_index = options
+            .through
+            .as_ref()
+            .and_then(|reference| self.view_order_for_ref(reference))
+            .unwrap_or(u64::MAX);
+        let mut skipped = 0usize;
+        let mut hits = Vec::new();
+
+        for entry in &self.index {
+            if entry.use_policy.is_some_and(|p| !p.observation_readable) {
+                continue;
+            }
+            if entry.entry_range[0] < min_entry_index || entry.entry_range[0] > max_entry_index {
+                continue;
+            }
+            if let Some(kind) = options.kind {
+                if entry.kind != kind {
+                    continue;
+                }
+            }
+            if let Some(part) = options.tool_part {
+                if entry.kind != ReferenceKind::Tool {
+                    continue;
+                }
+                let Some(actual) = entry.tool_part else {
+                    continue;
+                };
+                if !part.matches(actual) {
+                    continue;
+                }
+            }
+            if let Some(name) = tool_name {
+                if entry.tool_name.as_deref() != Some(name) {
+                    continue;
+                }
+            }
+            if !query.is_empty() && !entry.search_text.to_lowercase().contains(&query) {
+                continue;
+            }
+            if skipped < options.offset {
+                skipped += 1;
+                continue;
+            }
+            hits.push(SearchHit {
+                id: entry.id.clone(),
+                origin: entry.origin.clone(),
+                kind: entry.kind,
+                tool_part: entry.tool_part,
+                tool_name: entry.tool_name.clone(),
+                entry_range: entry.entry_range,
+                label: entry.label.clone(),
+                summary: entry.summary.clone(),
+            });
+            if hits.len() >= limit {
+                break;
+            }
+        }
+
+        hits
+    }
+
+    pub fn read(&self, selector: ReadSelector<'_>, options: ReadOptions) -> ReadResult {
+        let max_items = options.max_items.clamp(1, MAX_READ_MAX_ITEMS);
+        let max_bytes = options.max_bytes.max(1);
+        let mut entries = Vec::new();
+        let mut bytes = 0usize;
+        let mut truncated = false;
+
+        let selected: Vec<&ReferenceEntry> = match selector {
+            ReadSelector::Id(id) => self
+                .index
+                .iter()
+                .filter(|entry| entry.id.as_str() == id)
+                .collect(),
+            ReadSelector::EntryRange([start, end]) => self
+                .index
+                .iter()
+                .filter(|entry| entry.entry_range[0] >= start && entry.entry_range[0] <= end)
+                .collect(),
+        };
+
+        for entry in selected {
+            if entry.use_policy.is_some_and(|p| !p.observation_readable) {
+                continue;
+            }
+            if entries.len() >= max_items {
+                truncated = true;
+                break;
+            }
+            if entry.kind == ReferenceKind::Tool {
+                if !options.include_tools {
+                    continue;
+                }
+                if let Some(actual) = entry.tool_part {
+                    if !options.tool_part.matches(actual) {
+                        continue;
+                    }
+                }
+            }
+            let Some(item) = self
+                .entries
+                .iter()
+                .find(|captured| captured.dto.order == entry.entry_range[0])
+                .map(|entry| &entry.item)
+            else {
+                continue;
+            };
+            let remaining = max_bytes.saturating_sub(bytes);
+            if remaining == 0 {
+                truncated = true;
+                break;
+            }
+            let rendered = render_item(item, entry, options.detail, usize::MAX);
+            truncated |= rendered.len() > remaining;
+            let text = truncate_bytes(&rendered, remaining);
+            bytes = bytes.saturating_add(text.len());
+            entries.push(ReadEntry {
+                id: entry.id.clone(),
+                origin: entry.origin.clone(),
+                kind: entry.kind,
+                tool_part: entry.tool_part,
+                tool_name: entry.tool_name.clone(),
+                entry_range: entry.entry_range,
+                label: entry.label.clone(),
+                text,
+            });
+            if truncated {
+                break;
+            }
+        }
+
+        ReadResult { entries, truncated }
+    }
+
+    /// Resolves the committed tool-call input for a provider call id. This is
+    /// used by explicit-memory receipts only after the containing run is durable,
+    /// so a model-authored claim can cite its own committed tool invocation
+    /// without inventing a SessionEntryRef.
+    pub fn evidence_for_tool_call(&self, call_id: &str) -> Option<SessionEntryEvidence> {
+        let captured = self.entries.iter().find(|entry| {
+            matches!(
+                &entry.item,
+                Item::ToolCall {
+                    call_id: stored_call_id,
+                    ..
+                } if stored_call_id == call_id
+            )
+        })?;
+        let reference = self.index.iter().find(|entry| {
+            entry.entry_range[0] == captured.dto.order
+                && entry.kind == ReferenceKind::Tool
+                && entry.tool_part == Some(ToolPart::Input)
+        })?;
+        self.evidence_for(reference.id.as_str())
+    }
+
+    pub fn evidence_for(&self, id: &str) -> Option<SessionEntryEvidence> {
+        let entry = self.index.iter().find(|entry| entry.id.as_str() == id)?;
+        if entry.use_policy.is_some_and(|p| !p.memory_evidence) {
+            return None;
+        }
+        let captured = self
+            .entries
+            .iter()
+            .find(|captured| captured.dto.order == entry.entry_range[0])?;
+        let excerpt = render_item(&captured.item, entry, ReadDetail::Compact, 2 * 1024);
+        Some(SessionEntryEvidence {
+            segment_id: captured.dto.source.segment_id.clone(),
+            entry_ref: entry.id.clone(),
+            origin: entry.origin.clone(),
+            entry_range: [captured.dto.source.entry_index; 2],
+            kind: entry.kind,
+            tool_part: entry.tool_part,
+            label: entry.label.clone(),
+            summary: entry.summary.clone(),
+            excerpt,
+        })
+    }
+}
+
+pub(crate) fn public_provenance(origin: &HistoryOrigin) -> SessionEntryProvenance {
+    match origin {
+        HistoryOrigin::HumanInput { .. } | HistoryOrigin::LocalHumanInput => {
+            SessionEntryProvenance::HumanInput
+        }
+        HistoryOrigin::WorkerInput { .. } => SessionEntryProvenance::WorkerInput,
+        HistoryOrigin::FlowInstruction { .. } => SessionEntryProvenance::FlowInstruction,
+        HistoryOrigin::BackendInstruction { .. } | HistoryOrigin::Provided { .. } => {
+            SessionEntryProvenance::BackendInstruction
+        }
+        HistoryOrigin::ModelOutput { .. } => SessionEntryProvenance::ModelOutput,
+        HistoryOrigin::ToolOutput { .. } => SessionEntryProvenance::ToolOutput,
+        HistoryOrigin::CompactionSummary
+        | HistoryOrigin::DerivedSummary
+        | HistoryOrigin::JournalContext => SessionEntryProvenance::DerivedSummary,
+        HistoryOrigin::LegacyUnknown => SessionEntryProvenance::LegacyUnknown,
+    }
+}
+
+fn message_reference_kind(
+    origin: &SessionEntryProvenance,
+    provider_role: &Role,
+    use_policy: Option<protocol::SessionEntryUsePolicy>,
+) -> Option<ReferenceKind> {
+    if use_policy.is_some() {
+        return match provider_role {
+            Role::System => Some(ReferenceKind::System),
+            Role::User => Some(ReferenceKind::User),
+            Role::Assistant => Some(ReferenceKind::Assistant),
+        };
+    }
+    match origin {
+        SessionEntryProvenance::HumanInput | SessionEntryProvenance::WorkerInput => {
+            Some(ReferenceKind::User)
+        }
+        SessionEntryProvenance::ModelOutput => Some(ReferenceKind::Assistant),
+        SessionEntryProvenance::ToolOutput => Some(ReferenceKind::Tool),
+        SessionEntryProvenance::LegacyUnknown => match provider_role {
+            Role::User => Some(ReferenceKind::User),
+            Role::Assistant => Some(ReferenceKind::Assistant),
+            Role::System => None,
+        },
+        // Flow/backend/system content remains out of the observation surface
+        // even when represented with a provider user/system role.
+        SessionEntryProvenance::FlowInstruction
+        | SessionEntryProvenance::BackendInstruction
+        | SessionEntryProvenance::DerivedSummary => None,
+    }
+}
+
+fn render_item(
+    item: &Item,
+    entry: &ReferenceEntry,
+    detail: ReadDetail,
+    max_bytes: usize,
+) -> String {
+    let text = match item {
+        Item::Message { role, content, .. } => {
+            let text = content
+                .iter()
+                .map(|p| p.as_text())
+                .collect::<Vec<_>>()
+                .join("");
+            format!("[{} {:?}] {text}", entry.id, role)
+        }
+        Item::ToolCall {
+            name, arguments, ..
+        } => match detail {
+            ReadDetail::Compact => format!("[{} ToolInput {name}] (arguments omitted)", entry.id),
+            ReadDetail::Full => format!("[{} ToolInput {name}]\narguments: {arguments}", entry.id),
+        },
+        Item::ToolResult {
+            summary,
+            content,
+            attachments: _,
+            is_error,
+            ..
+        } => {
+            let attachment_line = if entry.attachment_count == 0 {
+                String::new()
+            } else {
+                format!("\nattachments: {} image(s)", entry.attachment_count)
+            };
+            match detail {
+                ReadDetail::Compact => format!(
+                    "[{} ToolOutput{}]\nsummary: {summary}\ncontent: (omitted){attachment_line}",
+                    entry.id,
+                    if *is_error { " error" } else { "" },
+                ),
+                ReadDetail::Full => format!(
+                    "[{} ToolOutput{}]\nsummary: {summary}\ncontent: {}{attachment_line}",
+                    entry.id,
+                    if *is_error { " error" } else { "" },
+                    content.as_deref().unwrap_or_default(),
+                ),
+            }
+        }
+        Item::AssistantResponseBoundary { .. } => {
+            format!("[{} Assistant response boundary omitted]", entry.id)
+        }
+        Item::Reasoning { .. } => format!("[{} Reasoning omitted]", entry.id),
+    };
+    truncate_bytes(&text, max_bytes)
+}
+
+fn truncate_chars(text: &str, max_chars: usize) -> String {
+    if max_chars == 0 {
+        return "… [truncated]".to_string();
+    }
+    if text.chars().count() <= max_chars {
+        return text.to_string();
+    }
+    let mut out = text.chars().take(max_chars).collect::<String>();
+    out.push_str("… [truncated]");
+    out
+}
+
+fn truncate_bytes(text: &str, max_bytes: usize) -> String {
+    if text.len() <= max_bytes {
+        return text.to_owned();
+    }
+    let marker = "… [truncated]";
+    let mut end = max_bytes.saturating_sub(marker.len());
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    let mut out = text[..end].to_owned();
+    if max_bytes >= marker.len() {
+        out.push_str(marker);
+    }
+    out
+}

crates/session-store/src/capture/recording.rs

@@ -0,0 +1,425 @@
+//! Host capture and pure canonical slicing. No Job state or live-reader fallback lives here.
+
+use super::*;
+use crate::committed_replay::CommittedPublicReplay;
+use crate::public_material::{
+    PublicMaterialDescriptor, PublicMaterialError, PublicMaterialLimits, PublicMaterialUse,
+};
+use crate::retention::SessionRetentionStore;
+use crate::{SegmentId, SessionId};
+use std::path::Path;
+
+/// Continuation in canonical Journal order, not an observation/Memory view cursor.
+/// A Host must reconcile the descriptor at this position with its saved checkpoint.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RecordingPosition {
+    pub canonical_order: u64,
+    pub byte_offset: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RecordingCaptureSlice {
+    pub capture: CaptureDto,
+    pub next: Option<RecordingPosition>,
+}
+
+/// Inspect recording admission descriptors without constructing a body-bearing DTO.
+///
+/// The Host must authorize the source and hold the **same** Session publication/erasure
+/// guard from before reading its persisted active pointer until this function returns
+/// (including the callback). Pass that pointer's Segment, not a filename/mtime-derived
+/// selector. This function verifies the guard and stored Session identities but does
+/// not authorize the caller or establish that the supplied guard fences this root.
+/// No lock is recursively acquired, no active pointer is reread, and no replay handle
+/// or body-read capability is exposed to `inspect`.
+///
+/// The common committed recording replay fixes per-file ends before decoding. It
+/// retains only descriptors/locations, decoding one record at a time and streaming
+/// canonical bodies into their digests. `replay_limits` bound record allocation,
+/// aggregate storage extent, entries and Segments; there is no full-capture text/JSON
+/// allocation or `CaptureLimits` ceiling. The callback receives only descriptors in
+/// canonical order and may return a Host-specific mapping (including a `Result`). It
+/// runs once on success and not at all on replay/identity/resource errors.
+///
+/// This catalog is for Host admission, **not** a descriptor-only Job input. Construct
+/// the Job's bounded body input with the guarded slice API at its own authorized
+/// boundary; after saving it, execute only that immutable value. Neither descriptors
+/// nor a completed callback authorize delayed adoption after erasure.
+///
+/// ```no_run
+/// # use std::path::Path;
+/// # use session_store::{SessionId, SegmentId};
+/// # use session_store::retention::SessionRetentionGuard;
+/// # use session_store::public_material::PublicMaterialError;
+/// # fn admit(root: &Path, session: SessionId, active: SegmentId,
+/// #          guard: &SessionRetentionGuard) -> Result<Vec<u64>, PublicMaterialError> {
+/// // `active` was resolved from persisted Host metadata while holding `guard`.
+/// session_store::capture::recording_catalog_worker_guarded(
+///     root, session, active, Default::default(), guard,
+///     |descriptors| descriptors.iter().map(|d| d.total_bytes).collect(),
+/// )
+/// # }
+/// ```
+pub fn recording_catalog_worker_guarded<T>(
+    session_root: &Path,
+    expected_session: SessionId,
+    active_segment: SegmentId,
+    replay_limits: PublicMaterialLimits,
+    guard: &crate::retention::SessionRetentionGuard,
+    inspect: impl FnOnce(&[PublicMaterialDescriptor]) -> T,
+) -> Result<T, PublicMaterialError> {
+    if guard.session_id() != expected_session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    let replay = CommittedPublicReplay::open_worker_guarded(
+        session_root,
+        active_segment,
+        replay_limits,
+        None,
+        PublicMaterialUse::Recording,
+    )?;
+    if replay.session_id() != expected_session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    Ok(inspect(&replay.into_recording_descriptors()))
+}
+
+/// FsStore-layout counterpart of [`recording_catalog_worker_guarded`].
+///
+/// `sessions_root` is the directory containing per-Session directories. Invoke this
+/// inside the Host's `with_recording_boundary` callback, passing **its existing guard
+/// and persisted active Segment**. That same external retention control store must
+/// fence publishers, pointer changes, archive moves and erasure. Do not reacquire the
+/// guard or use a separately opened legacy public reader inside the boundary.
+/// All descriptor-only, allocation and callback guarantees of the Worker variant
+/// apply; this function does not construct an unbounded transient `CaptureDto`.
+pub fn recording_catalog_fs_guarded<T>(
+    sessions_root: &Path,
+    session: SessionId,
+    active_segment: SegmentId,
+    replay_limits: PublicMaterialLimits,
+    guard: &crate::retention::SessionRetentionGuard,
+    inspect: impl FnOnce(&[PublicMaterialDescriptor]) -> T,
+) -> Result<T, PublicMaterialError> {
+    if guard.session_id() != session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    let replay = CommittedPublicReplay::open_fs_guarded(
+        sessions_root,
+        session,
+        active_segment,
+        replay_limits,
+    )?;
+    Ok(inspect(&replay.into_recording_descriptors()))
+}
+
+/// Capture the selected original lineage, including typed Host run boundaries.
+/// The caller must hold the Session publication/erasure guard while selecting the
+/// active pointer and through this call. Runtime publishers use this same lock
+/// for appends and Segment creation. No lock is recursively acquired here.
+pub fn capture_recording_worker_guarded(
+    session_root: &Path,
+    expected_session: SessionId,
+    active_segment: SegmentId,
+    replay_limits: PublicMaterialLimits,
+    capture_limits: CaptureLimits,
+    guard: &crate::retention::SessionRetentionGuard,
+) -> Result<CaptureDto, PublicMaterialError> {
+    if guard.session_id() != expected_session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    let replay = CommittedPublicReplay::open_worker_guarded(
+        session_root,
+        active_segment,
+        replay_limits,
+        None,
+        PublicMaterialUse::Recording,
+    )?;
+    if replay.session_id() != expected_session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    replay.into_recording_dto(capture_limits)
+}
+
+/// Standalone convenience entry; Hosts resolving a mutable active pointer should
+/// instead hold the fence while resolving it and call the guarded entry.
+pub fn capture_recording_worker(
+    session_root: &Path,
+    expected_session: SessionId,
+    active_segment: SegmentId,
+    retention: &SessionRetentionStore,
+    replay_limits: PublicMaterialLimits,
+    capture_limits: CaptureLimits,
+) -> Result<CaptureDto, PublicMaterialError> {
+    let guard = retention
+        .lock_live(expected_session)
+        .map_err(|error| match error {
+            crate::StoreError::SessionErased(_) => PublicMaterialError::Erased,
+            _ => PublicMaterialError::Unavailable,
+        })?;
+    capture_recording_worker_guarded(
+        session_root,
+        expected_session,
+        active_segment,
+        replay_limits,
+        capture_limits,
+        &guard,
+    )
+}
+
+/// Bounded construction for one Job input: descriptor replay is bounded separately;
+/// only at most the requested body budget is materialized from the fixed files.
+pub fn capture_recording_slice_worker_guarded(
+    session_root: &Path,
+    expected_session: SessionId,
+    active_segment: SegmentId,
+    replay_limits: PublicMaterialLimits,
+    start: RecordingPosition,
+    max_entries: usize,
+    max_serialized_bytes: usize,
+    guard: &crate::retention::SessionRetentionGuard,
+) -> Result<RecordingCaptureSlice, PublicMaterialError> {
+    if guard.session_id() != expected_session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    let replay = CommittedPublicReplay::open_worker_guarded(
+        session_root,
+        active_segment,
+        replay_limits,
+        None,
+        PublicMaterialUse::Recording,
+    )?;
+    if replay.session_id() != expected_session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    replay.recording_slice(start, max_entries, max_serialized_bytes)
+}
+
+/// The standalone FsStore layout uses the same committed replay and fixed values.
+pub fn capture_recording_fs_guarded(
+    sessions_root: &Path,
+    session: SessionId,
+    active_segment: SegmentId,
+    replay_limits: PublicMaterialLimits,
+    capture_limits: CaptureLimits,
+    guard: &crate::retention::SessionRetentionGuard,
+) -> Result<CaptureDto, PublicMaterialError> {
+    if guard.session_id() != session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    CommittedPublicReplay::open_fs_guarded(sessions_root, session, active_segment, replay_limits)?
+        .into_recording_dto(capture_limits)
+}
+
+/// Bounded standalone capture; the caller holds its FsStore retention fence.
+pub fn capture_recording_slice_fs_guarded(
+    sessions_root: &Path,
+    session: SessionId,
+    active_segment: SegmentId,
+    replay_limits: PublicMaterialLimits,
+    start: RecordingPosition,
+    max_entries: usize,
+    max_serialized_bytes: usize,
+    guard: &crate::retention::SessionRetentionGuard,
+) -> Result<RecordingCaptureSlice, PublicMaterialError> {
+    if guard.session_id() != session {
+        return Err(PublicMaterialError::Inconsistent);
+    }
+    CommittedPublicReplay::open_fs_guarded(sessions_root, session, active_segment, replay_limits)?
+        .recording_slice(start, max_entries, max_serialized_bytes)
+}
+
+impl CaptureDto {
+    /// Select the oldest canonical prefix fitting both budgets, including JSON
+    /// escaping, metadata and continuation. Only immutable owned bytes are read.
+    /// A later Job can recapture at `next`; never combine live pages into this value.
+    pub fn recording_slice(
+        &self,
+        start: RecordingPosition,
+        max_entries: usize,
+        max_serialized_bytes: usize,
+    ) -> Result<RecordingCaptureSlice, CaptureError> {
+        if max_entries == 0 {
+            return Err(CaptureError::BudgetTooSmall);
+        }
+        if start.canonical_order > self.view_entry_count {
+            return Err(CaptureError::InvalidRange);
+        }
+        let mut result = RecordingCaptureSlice {
+            capture: CaptureDto {
+                version: self.version,
+                session_id: self.session_id.clone(),
+                segment_id: self.segment_id.clone(),
+                view_entry_count: self.view_entry_count,
+                entries: Vec::new(),
+            },
+            next: (start.canonical_order < self.view_entry_count).then_some(start),
+        };
+        if body::json_size(&result, max_serialized_bytes).is_err() {
+            return Err(CaptureError::BudgetTooSmall);
+        }
+        if start.canonical_order == self.view_entry_count {
+            if start.byte_offset != 0 {
+                return Err(CaptureError::InvalidRange);
+            }
+            result.capture.validate(CaptureLimits {
+                max_bytes: max_serialized_bytes,
+                max_text_bytes: max_serialized_bytes,
+                max_entries,
+                ..Default::default()
+            })?;
+            return Ok(result);
+        }
+        let first = self
+            .entries
+            .iter()
+            .position(|entry| entry.order == start.canonical_order)
+            .ok_or(CaptureError::InvalidRange)?;
+        let mut expected_order = start.canonical_order;
+        for entry in self.entries.iter().skip(first).take(max_entries) {
+            if entry.order != expected_order {
+                return Err(CaptureError::InvalidRange);
+            }
+            let CaptureBody::CanonicalPublic {
+                descriptor,
+                byte_offset,
+                text,
+                boundary,
+            } = &entry.body
+            else {
+                return Err(CaptureError::Invalid("not a recording capture"));
+            };
+            if !entry.policy.recording_material {
+                return Err(CaptureError::PolicyDenied);
+            }
+            let offset = if entry.order == start.canonical_order {
+                start.byte_offset
+            } else {
+                *byte_offset
+            };
+            let local = offset
+                .checked_sub(*byte_offset)
+                .and_then(|o| usize::try_from(o).ok())
+                .ok_or(CaptureError::InvalidRange)?;
+            if local > text.len()
+                || !text.is_char_boundary(local)
+                || offset >= descriptor.total_bytes
+            {
+                return Err(CaptureError::InvalidRange);
+            }
+            let item = CaptureEntryDto {
+                entry_id: entry.entry_id.clone(),
+                order: entry.order,
+                source: entry.source.clone(),
+                policy: entry.policy,
+                body: CaptureBody::CanonicalPublic {
+                    descriptor: descriptor.clone(),
+                    byte_offset: offset,
+                    text: String::new(),
+                    boundary: *boundary,
+                },
+            };
+            result.capture.entries.push(item);
+            // At most budget bytes are considered before allocating a trial fragment.
+            let mut low = 0;
+            let mut high = text.len().saturating_sub(local).min(max_serialized_bytes);
+            let prior_next = result.next;
+            while low < high {
+                let mid = low + (high - low).div_ceil(2);
+                let mut end = local + mid;
+                while !text.is_char_boundary(end) {
+                    end -= 1;
+                }
+                if let CaptureBody::CanonicalPublic { text: fragment, .. } =
+                    &mut result.capture.entries.last_mut().unwrap().body
+                {
+                    *fragment = text[local..end].to_owned();
+                }
+                let next_offset = offset + (end - local) as u64;
+                result.next = if next_offset < descriptor.total_bytes {
+                    Some(RecordingPosition {
+                        canonical_order: entry.order,
+                        byte_offset: next_offset,
+                    })
+                } else {
+                    (entry.order + 1 < self.view_entry_count).then_some(RecordingPosition {
+                        canonical_order: entry.order + 1,
+                        byte_offset: 0,
+                    })
+                };
+                if body::json_size(&result, max_serialized_bytes).is_ok() {
+                    low = mid;
+                } else {
+                    high = mid - 1;
+                }
+            }
+            let mut end = local + low;
+            while !text.is_char_boundary(end) {
+                end -= 1;
+            }
+            if end == local {
+                result.capture.entries.pop();
+                result.next = prior_next;
+                if result.capture.entries.is_empty() {
+                    return Err(CaptureError::BudgetTooSmall);
+                }
+                break;
+            }
+            if let CaptureBody::CanonicalPublic { text: fragment, .. } =
+                &mut result.capture.entries.last_mut().unwrap().body
+            {
+                *fragment = text[local..end].to_owned();
+            }
+            let next_offset = offset + (end - local) as u64;
+            result.next = if next_offset < descriptor.total_bytes {
+                Some(RecordingPosition {
+                    canonical_order: entry.order,
+                    byte_offset: next_offset,
+                })
+            } else {
+                (entry.order + 1 < self.view_entry_count).then_some(RecordingPosition {
+                    canonical_order: entry.order + 1,
+                    byte_offset: 0,
+                })
+            };
+            if next_offset < descriptor.total_bytes {
+                break;
+            }
+            expected_order = entry.order + 1;
+        }
+        body::json_size(&result, max_serialized_bytes).map_err(|_| CaptureError::BudgetTooSmall)?;
+        result.capture.validate(CaptureLimits {
+            max_bytes: max_serialized_bytes,
+            max_text_bytes: max_serialized_bytes,
+            max_entries,
+            ..Default::default()
+        })?;
+        Ok(result)
+    }
+
+    /// Resolve canonical text already in the value. No original storage is consulted.
+    pub fn recording_text(
+        &self,
+        order: u64,
+    ) -> Result<(&crate::public_material::PublicMaterialDescriptor, u64, &str), CaptureError> {
+        let entry = self
+            .entries
+            .iter()
+            .find(|entry| entry.order == order)
+            .ok_or(CaptureError::UnknownReference)?;
+        if !entry.policy.recording_material {
+            return Err(CaptureError::PolicyDenied);
+        }
+        match &entry.body {
+            CaptureBody::CanonicalPublic {
+                descriptor,
+                byte_offset,
+                text,
+                ..
+            } => Ok((descriptor, *byte_offset, text)),
+            _ => Err(CaptureError::Invalid("not canonical recording text")),
+        }
+    }
+}

crates/session-store/src/lib.rs

@@ -38,6 +38,8 @@ pub(crate) fn read_without_atime_bounded(path: &Path, max_bytes: u64) -> io::Res
     }
 }
 
+pub mod capture;
+mod committed_replay;
 pub mod event_trace;
 pub mod fs_store;
 pub mod history;

crates/session-store/src/retention.rs

@@ -46,6 +46,13 @@ pub struct SessionRetentionStore {
 /// Do not recursively acquire the same Session lock inside a guarded callback.
 pub struct SessionRetentionGuard {
     _file: File,
+    session_id: SessionId,
+}
+
+impl SessionRetentionGuard {
+    pub fn session_id(&self) -> SessionId {
+        self.session_id
+    }
 }
 
 impl SessionRetentionStore {
@@ -71,7 +78,10 @@ impl SessionRetentionStore {
         }
         let file = options.open(self.root.join(format!("{session}.lock")))?;
         FileExt::lock_exclusive(&file)?;
-        Ok(SessionRetentionGuard { _file: file })
+        Ok(SessionRetentionGuard {
+            _file: file,
+            session_id: session,
+        })
     }
 
     fn read(&self, session: SessionId) -> Result<RetentionState, StoreError> {

crates/session-store/tests/capture_contract.rs

@@ -0,0 +1,711 @@
+//! Public consumer boundary: real capture adapters, checked DTO codec and pure readers.
+//! No Worker, persistence, live Session provider, or substituted capture implementation.
+
+use agen::{HistoryEntry, Item};
+use protocol::{
+    SessionEntryProvenance, SessionSnapshot, SessionSnapshotEntry, SessionSnapshotEntryData,
+};
+use session_store::capture::*;
+use session_store::{
+    FeatureInputPayload, HistoryInputMetadata, HistoryInputUsePolicy, InputCompactionUse,
+    InputEvidenceUse, InputObservationUse, LoggedHistoryDerivation, LoggedSessionHistoryEntryId,
+    LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin, PublicSystemItem,
+    PublicSystemPresentation,
+};
+
+fn history(
+    id: &str,
+    item: Item,
+    input_metadata: Option<HistoryInputMetadata>,
+) -> HistoryEntry<LoggedSessionHistoryMetadata> {
+    HistoryEntry::new(
+        item,
+        LoggedSessionHistoryMetadata {
+            entry_id: LoggedSessionHistoryEntryId(id.into()),
+            origin: LoggedSessionHistoryOrigin::LocalHumanInput,
+            derivation: Some(LoggedHistoryDerivation {
+                sources: vec![LoggedSessionHistoryEntryId("earlier-entry".into())],
+            }),
+            input_metadata,
+        },
+    )
+}
+
+fn usage(recording: bool, memory: bool, observation: bool) -> HistoryInputUsePolicy {
+    HistoryInputUsePolicy {
+        recording_material: if recording {
+            InputEvidenceUse::Include
+        } else {
+            InputEvidenceUse::Exclude
+        },
+        memory_evidence: if memory {
+            InputEvidenceUse::Include
+        } else {
+            InputEvidenceUse::Exclude
+        },
+        observation: if observation {
+            InputObservationUse::Readable
+        } else {
+            InputObservationUse::Hidden
+        },
+        compaction: InputCompactionUse::Retain,
+    }
+}
+
+fn reference(capture: &SessionCapture, id: &str) -> ScopedSessionEntryRef {
+    capture
+        .scoped_ref(&SessionEntryRef::parse(id).unwrap())
+        .unwrap()
+}
+
+#[test]
+fn public_consumer_roundtrip_retains_body_original_source_order_origin_and_independent_policy() {
+    let entries = vec![
+        history(
+            "recording",
+            Item::user_message("record-only"),
+            Some(HistoryInputMetadata::new(usage(true, false, false), None, None).unwrap()),
+        ),
+        history(
+            "memory",
+            Item::user_message("memory-only"),
+            Some(HistoryInputMetadata::new(usage(false, true, false), None, None).unwrap()),
+        ),
+        history(
+            "observation",
+            Item::user_message("observation-only"),
+            Some(HistoryInputMetadata::new(usage(false, false, true), None, None).unwrap()),
+        ),
+    ];
+    let capture = SessionCapture::from_complete_history("synthetic-session", "selected", entries);
+    let mut dto = capture.to_dto();
+    // The checked boundary also accepts entries retained from different original segments.
+    dto.entries[0].source.segment_id = "original-a".into();
+    dto.entries[0].source.entry_index = 80;
+    dto.entries[1].source.segment_id = "original-b".into();
+    dto.entries[1].source.entry_index = 3;
+    let capture = SessionCapture::try_from_dto(dto.clone(), CaptureLimits::default()).unwrap();
+    let encoded = capture.encode(CaptureLimits::default()).unwrap();
+    let restored = SessionCapture::decode(&encoded, CaptureLimits::default()).unwrap();
+    assert_eq!(restored.to_dto(), dto);
+    assert_eq!(restored.capture_id(), capture.capture_id());
+    for (id, allowed) in [
+        ("Erecording", CapturePurpose::Recording),
+        ("Ememory", CapturePurpose::MemoryEvidence),
+        ("Eobservation", CapturePurpose::Observation),
+    ] {
+        let reference = reference(&capture, id);
+        assert_eq!(
+            restored.resolve_ref(&reference, allowed).unwrap(),
+            capture.resolve_ref(&reference, allowed).unwrap()
+        );
+        for purpose in [
+            CapturePurpose::Recording,
+            CapturePurpose::MemoryEvidence,
+            CapturePurpose::Observation,
+        ] {
+            assert_eq!(
+                restored.resolve_ref(&reference, purpose).is_ok(),
+                purpose == allowed
+            );
+        }
+    }
+    assert_eq!(restored.overview().len(), 1);
+    assert_eq!(restored.search(&SearchOptions::default()).len(), 1);
+    assert!(restored.evidence_for("Erecording").is_none());
+    let evidence = restored.evidence_for("Ememory").unwrap();
+    assert_eq!(evidence.segment_id, "original-b");
+    assert_eq!(evidence.entry_range, [3, 3]);
+    assert!(evidence.excerpt.contains("memory-only"));
+    let recorded = restored
+        .slice(CapturePurpose::Recording, None, 10, 16_000)
+        .unwrap();
+    assert_eq!(recorded.slice().items.len(), 1);
+    assert_eq!(recorded.slice().items[0].text, "record-only");
+    for (purpose, expected) in [
+        (CapturePurpose::MemoryEvidence, "memory-only"),
+        (CapturePurpose::Observation, "observation-only"),
+    ] {
+        let slice = restored.slice(purpose, None, 10, 16_000).unwrap();
+        assert_eq!(slice.slice().items.len(), 1);
+        assert_eq!(slice.slice().items[0].text, expected);
+        assert!(
+            restored
+                .read_raw(
+                    &reference(&restored, "Erecording"),
+                    purpose,
+                    RawField::MessagePart(0),
+                    0,
+                    100
+                )
+                .is_err()
+        );
+    }
+}
+
+#[test]
+fn common_data_drops_reasoning_raw_system_and_private_payload_even_when_unindexed() {
+    let payload = FeatureInputPayload::encode(
+        "capture-test",
+        1,
+        &serde_json::json!({"secret": "PRIVATE-PAYLOAD"}),
+    )
+    .unwrap();
+    let public = PublicSystemItem {
+        kind: "notice".into(),
+        body: "public notice".into(),
+        presentation: PublicSystemPresentation::Ignored,
+    };
+    let system =
+        HistoryInputMetadata::new(usage(true, true, true), Some(payload.clone()), Some(public))
+            .unwrap();
+    let private = HistoryInputMetadata::new(usage(true, true, true), Some(payload), None).unwrap();
+    let capture = SessionCapture::from_complete_history(
+        "s",
+        "segment",
+        vec![
+            history("raw", Item::system_message("RAW-SYSTEM-PROMPT"), None),
+            history("reasoning", Item::reasoning("HIDDEN-REASONING"), None),
+            history(
+                "private",
+                Item::system_message("PRIVATE-SYSTEM-BODY"),
+                Some(private),
+            ),
+            history(
+                "public",
+                Item::system_message("MODEL-SYSTEM-BODY"),
+                Some(system),
+            ),
+            history("ordinary", Item::user_message("ordinary"), None),
+        ],
+    );
+    let encoded = String::from_utf8(capture.encode(CaptureLimits::default()).unwrap()).unwrap();
+    let retained_debug = format!("{capture:?}");
+    for secret in [
+        "RAW-SYSTEM-PROMPT",
+        "HIDDEN-REASONING",
+        "PRIVATE-SYSTEM-BODY",
+        "MODEL-SYSTEM-BODY",
+        "PRIVATE-PAYLOAD",
+    ] {
+        assert!(!encoded.contains(secret));
+        assert!(!retained_debug.contains(secret));
+    }
+    assert_eq!(capture.to_dto().entries.len(), 2);
+    assert!(encoded.contains("public notice"));
+    // Filtered entries do not renumber the public source positions.
+    assert_eq!(capture.to_dto().entries[0].order, 3);
+    assert_eq!(
+        capture.view_order_for_ref(&SessionEntryRef::parse("Eordinary").unwrap()),
+        Some(4)
+    );
+}
+
+#[test]
+fn protocol_projection_does_not_invent_recording_permission() {
+    let capture = SessionCapture::from_session_snapshot(
+        "s",
+        "seg",
+        SessionSnapshot {
+            pending_submissions: Default::default(),
+            entries: vec![SessionSnapshotEntry {
+                entry_id: "projected".into(),
+                timestamp: 0,
+                provenance: SessionEntryProvenance::HumanInput,
+                derived_from: vec!["source".into()],
+                use_policy: Some(protocol::SessionEntryUsePolicy {
+                    observation_readable: true,
+                    memory_evidence: false,
+                }),
+                data: SessionSnapshotEntryData::Message {
+                    role: protocol::SessionMessageRole::User,
+                    content: vec![protocol::SessionContentPart::Text {
+                        text: "projected".into(),
+                    }],
+                },
+            }],
+        },
+    );
+    let reference = reference(&capture, "Eprojected");
+    assert!(matches!(
+        capture.resolve_ref(&reference, CapturePurpose::Recording),
+        Err(CaptureError::PolicyDenied)
+    ));
+    assert!(
+        capture
+            .resolve_ref(&reference, CapturePurpose::Observation)
+            .is_ok()
+    );
+    assert!(capture.evidence_for("Eprojected").is_none());
+}
+
+#[test]
+fn malformed_dtos_and_oversized_representations_are_rejected() {
+    let capture = SessionCapture::new("s", "seg", vec![Item::user_message("body")]);
+    let original = serde_json::to_value(capture.to_dto()).unwrap();
+    let mut invalids = Vec::new();
+    let mut value = original.clone();
+    value["version"] = 999.into();
+    invalids.push(value);
+    let mut value = original.clone();
+    value["unexpected"] = true.into();
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["policy"]["recording_material"] = "include".into();
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["policy"]
+        .as_object_mut()
+        .unwrap()
+        .remove("memory_evidence");
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["body"] = serde_json::json!({"kind":"reasoning","text":"secret"});
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["body"]["feature_payload"] = serde_json::json!({"private":true});
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["body"]["role"] = "system".into();
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["source"]["unknown"] = true.into();
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["source"]["history_origin"] =
+        serde_json::json!({"kind":"legacy_unknown","unknown":true});
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"][0]["entry_id"] = "bad/id".into();
+    invalids.push(value);
+    let mut value = original.clone();
+    value["entries"]
+        .as_array_mut()
+        .unwrap()
+        .push(original["entries"][0].clone());
+    invalids.push(value);
+    for invalid in invalids {
+        let bytes = serde_json::to_vec(&invalid).unwrap();
+        assert!(
+            SessionCapture::decode(&bytes, CaptureLimits::default()).is_err(),
+            "accepted {invalid}"
+        );
+    }
+    let bytes = capture.encode(CaptureLimits::default()).unwrap();
+    assert!(
+        SessionCapture::decode(
+            &bytes,
+            CaptureLimits {
+                max_bytes: bytes.len() - 1,
+                ..CaptureLimits::default()
+            }
+        )
+        .is_err()
+    );
+    assert!(
+        capture
+            .encode(CaptureLimits {
+                max_entries: 0,
+                ..CaptureLimits::default()
+            })
+            .is_err()
+    );
+    assert!(
+        capture
+            .encode(CaptureLimits {
+                max_text_bytes: 3,
+                ..CaptureLimits::default()
+            })
+            .is_err()
+    );
+    let mut reversed = capture.to_dto();
+    reversed.view_entry_count = 2;
+    let mut second = reversed.entries[0].clone();
+    second.entry_id = "second".into();
+    second.source.entry_index = 4;
+    second.order = 0;
+    reversed.entries[0].order = 1;
+    reversed.entries.push(second);
+    assert!(SessionCapture::try_from_dto(reversed, CaptureLimits::default()).is_err());
+    let mut duplicate_source = capture.to_dto();
+    duplicate_source.view_entry_count = 2;
+    let mut second = duplicate_source.entries[0].clone();
+    second.entry_id = "distinct-id".into();
+    second.order = 1;
+    duplicate_source.entries.push(second);
+    assert!(matches!(
+        SessionCapture::try_from_dto(duplicate_source, CaptureLimits::default()),
+        Err(CaptureError::Invalid("duplicate source position"))
+    ));
+}
+
+#[test]
+fn raw_utf8_tool_input_and_result_are_lossless_without_preview_markers() {
+    let arguments = "\"quoted\"\\path\n日本語🙂".repeat(300);
+    let result = "result\n\t\\\"λ🙂".repeat(400);
+    let capture = SessionCapture::new(
+        "s",
+        "seg",
+        vec![
+            Item::tool_call("call", "tool", arguments.clone()),
+            Item::tool_result_item("call", "summary", Some(result.clone()), false),
+        ],
+    );
+    for (id, field, expected) in [
+        ("E00000000", RawField::ToolArguments, arguments),
+        ("E00000001", RawField::ToolContent, result),
+    ] {
+        let reference = reference(&capture, id);
+        let mut offset = 0;
+        let mut actual = String::new();
+        loop {
+            let part = capture
+                .read_raw(&reference, CapturePurpose::Observation, field, offset, 17)
+                .unwrap();
+            assert!(part.text.len() <= 17);
+            assert_eq!(part.offset, offset);
+            actual.push_str(&part.text);
+            match part.next_offset {
+                Some(next) => {
+                    assert!(next > offset);
+                    offset = next;
+                }
+                None => break,
+            }
+        }
+        assert_eq!(actual, expected);
+    }
+    let unicode = SessionCapture::new("s", "seg", vec![Item::tool_call("call", "tool", "🙂")]);
+    let reference = reference(&unicode, "E00000000");
+    assert!(matches!(
+        unicode.read_raw(
+            &reference,
+            CapturePurpose::Observation,
+            RawField::ToolArguments,
+            1,
+            8
+        ),
+        Err(CaptureError::InvalidRange)
+    ));
+    assert!(matches!(
+        unicode.read_raw(
+            &reference,
+            CapturePurpose::Observation,
+            RawField::ToolArguments,
+            0,
+            3
+        ),
+        Err(CaptureError::BudgetTooSmall)
+    ));
+    assert!(matches!(
+        unicode.read_raw(
+            &reference,
+            CapturePurpose::Observation,
+            RawField::ToolArguments,
+            5,
+            8
+        ),
+        Err(CaptureError::InvalidRange)
+    ));
+}
+
+#[test]
+fn escaped_json_slice_budget_includes_metadata_and_bound_continuation() {
+    let body = "\"\\\n\t🙂日本語".repeat(500);
+    let capture = SessionCapture::new(
+        "synthetic-session",
+        "segment",
+        vec![Item::tool_call("call", "tool", body.clone())],
+    );
+    let other_session = SessionCapture::new(
+        "other-session",
+        "segment",
+        vec![Item::tool_call("call", "tool", body.clone())],
+    );
+    let changed = SessionCapture::new(
+        "synthetic-session",
+        "segment",
+        vec![Item::tool_call("call", "tool", "changed")],
+    );
+    let mut cursor = None;
+    let mut actual = String::new();
+    let budget = 1400;
+    loop {
+        let part = capture
+            .slice(CapturePurpose::Recording, cursor.as_ref(), 1, budget)
+            .unwrap();
+        assert!(part.encoded_len() <= budget);
+        assert_eq!(part.encoded_len(), part.as_json().len());
+        assert_eq!(serde_json::to_vec(part.slice()).unwrap(), part.as_json());
+        assert_eq!(part.slice().items.len(), 1);
+        let item = &part.slice().items[0];
+        assert_eq!(item.offset, actual.len());
+        actual.push_str(&item.text);
+        cursor = part.slice().next_cursor.clone();
+        if let Some(cursor) = &cursor {
+            assert!(matches!(
+                other_session.slice(CapturePurpose::Recording, Some(cursor), 1, budget),
+                Err(CaptureError::ForeignReference)
+            ));
+            assert!(matches!(
+                changed.slice(CapturePurpose::Recording, Some(cursor), 1, budget),
+                Err(CaptureError::ForeignReference)
+            ));
+            assert!(matches!(
+                capture.slice(CapturePurpose::Observation, Some(cursor), 1, budget),
+                Err(CaptureError::ForeignReference)
+            ));
+        } else {
+            break;
+        }
+    }
+    assert_eq!(actual, body);
+    assert!(matches!(
+        capture.slice(CapturePurpose::Recording, None, 1, 8),
+        Err(CaptureError::BudgetTooSmall)
+    ));
+    assert!(matches!(
+        capture.slice(CapturePurpose::Recording, None, 0, budget),
+        Err(CaptureError::BudgetTooSmall)
+    ));
+}
+
+#[test]
+fn snapshot_immutability_and_scoped_operations_reject_foreign_or_unknown_refs_and_bad_ranges() {
+    let mut source = vec![
+        Item::user_message("before"),
+        Item::assistant_message("answer"),
+    ];
+    let capture = SessionCapture::new("s", "seg", source.clone());
+    let fixed_bytes = capture.encode(CaptureLimits::default()).unwrap();
+    let first = reference(&capture, "E00000000");
+    let second = reference(&capture, "E00000001");
+    source.push(Item::user_message("appended"));
+    source[0] = Item::user_message("compacted");
+    source.clear();
+    assert_eq!(
+        capture.encode(CaptureLimits::default()).unwrap(),
+        fixed_bytes
+    );
+    assert_eq!(
+        capture.clone().encode(CaptureLimits::default()).unwrap(),
+        fixed_bytes
+    );
+    let foreign = SessionCapture::new(
+        "different",
+        "seg",
+        vec![
+            Item::user_message("before"),
+            Item::assistant_message("answer"),
+        ],
+    );
+    assert!(matches!(
+        foreign.resolve_ref(&first, CapturePurpose::Observation),
+        Err(CaptureError::ForeignReference)
+    ));
+    assert!(matches!(
+        capture.checked_range(&second, &first, CapturePurpose::Observation),
+        Err(CaptureError::InvalidRange)
+    ));
+    assert_eq!(
+        capture
+            .checked_range(&first, &second, CapturePurpose::Observation)
+            .unwrap()
+            .len(),
+        2
+    );
+    let unknown = SessionEntryRef::parse("E99999999").unwrap();
+    assert_eq!(capture.view_order_for_ref(&unknown), None);
+    assert!(matches!(
+        capture.scoped_ref(&unknown),
+        Err(CaptureError::UnknownReference)
+    ));
+    assert!(
+        capture
+            .search_checked(&SearchOptions {
+                from: Some(unknown.clone()),
+                ..Default::default()
+            })
+            .is_err()
+    );
+    assert!(
+        capture
+            .search(&SearchOptions {
+                through: Some(unknown),
+                ..Default::default()
+            })
+            .is_empty()
+    );
+    assert!(
+        capture
+            .read_checked(ReadSelector::EntryRange([1, 0]), ReadOptions::default())
+            .is_err()
+    );
+    assert!(
+        capture
+            .read_checked(ReadSelector::EntryRange([0, 99]), ReadOptions::default())
+            .is_err()
+    );
+}
+
+#[test]
+fn slices_preserve_empty_and_long_result_fields_under_item_and_metadata_budgets() {
+    let summary = "summary\n\"🙂".repeat(100);
+    let content = "content\t\\日本語".repeat(200);
+    let capture = SessionCapture::new(
+        "s",
+        "seg",
+        vec![
+            Item::tool_result_item("first", summary.clone(), Some(content.clone()), true),
+            Item::tool_result_item("empty", "", Some(String::new()), false),
+        ],
+    );
+    let mut cursor = None;
+    let mut fields: Vec<(String, RawField, String)> = Vec::new();
+    loop {
+        let part = capture
+            .slice(CapturePurpose::Recording, cursor.as_ref(), 2, 1500)
+            .unwrap();
+        assert!(part.slice().items.len() <= 2);
+        assert!(serde_json::to_vec(part.slice()).unwrap().len() <= 1500);
+        for item in &part.slice().items {
+            let id = item.reference.entry_ref.to_string();
+            if let Some((last_id, last_field, text)) = fields.last_mut() {
+                if *last_id == id && *last_field == item.field {
+                    assert_eq!(text.len(), item.offset);
+                    text.push_str(&item.text);
+                    continue;
+                }
+            }
+            assert_eq!(item.offset, 0);
+            fields.push((id, item.field, item.text.clone()));
+        }
+        cursor = part.slice().next_cursor.clone();
+        if cursor.is_none() {
+            break;
+        }
+    }
+    assert_eq!(
+        fields,
+        vec![
+            ("E00000000".into(), RawField::ToolSummary, summary),
+            ("E00000000".into(), RawField::ToolContent, content),
+            ("E00000001".into(), RawField::ToolSummary, String::new()),
+            ("E00000001".into(), RawField::ToolContent, String::new()),
+        ]
+    );
+    let metadata_heavy = SessionCapture::new(
+        "s",
+        "seg",
+        vec![Item::tool_call("call", "name".repeat(200), "x")],
+    );
+    assert!(matches!(
+        metadata_heavy.slice(CapturePurpose::Recording, None, 1, 700),
+        Err(CaptureError::BudgetTooSmall)
+    ));
+}
+
+#[test]
+fn evidence_uses_original_segment_positions_after_roundtrip_and_view_selection() {
+    let full = SessionCapture::new(
+        "s",
+        "selected",
+        vec![
+            Item::user_message("first"),
+            Item::assistant_message("second"),
+        ],
+    );
+    let mut dto = full.to_dto();
+    dto.entries[0].source.segment_id = "original-a".into();
+    dto.entries[0].source.entry_index = 80;
+    dto.entries[1].source.segment_id = "original-b".into();
+    dto.entries[1].source.entry_index = 3;
+    let encoded = dto.encode(CaptureLimits::default()).unwrap();
+    let restored = SessionCapture::decode(&encoded, CaptureLimits::default()).unwrap();
+    for (id, segment, index, order) in [
+        ("E00000000", "original-a", 80, 0),
+        ("E00000001", "original-b", 3, 1),
+    ] {
+        let evidence = restored.evidence_for(id).unwrap();
+        assert_eq!(evidence.segment_id, segment);
+        assert_eq!(evidence.entry_range, [index; 2]);
+        let read = restored.read(ReadSelector::Id(id), ReadOptions::default());
+        assert_eq!(read.entries[0].entry_range, [order; 2]);
+    }
+    let selected = restored.select_order_range(1..2).unwrap();
+    assert_eq!(selected.overview()[0].entry_range, [0, 0]);
+    let evidence = selected.evidence_for("E00000001").unwrap();
+    assert_eq!(evidence.segment_id, "original-b");
+    assert_eq!(evidence.entry_range, [3, 3]);
+    let roundtrip = SessionCapture::decode(
+        &selected.encode(CaptureLimits::default()).unwrap(),
+        CaptureLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(roundtrip.to_dto(), selected.to_dto());
+    assert_eq!(
+        roundtrip.evidence_for("E00000001").unwrap().entry_range,
+        [3, 3]
+    );
+}
+
+#[test]
+fn fixed_history_selection_preserves_original_coordinates_and_checks_private_position_bounds() {
+    let history = vec![
+        history("old", Item::user_message("old"), None),
+        history("hidden", Item::reasoning("PRIVATE"), None),
+        history("selected", Item::user_message("selected"), None),
+        history("private-tail", Item::system_message("PRIVATE"), None),
+    ];
+    let full = SessionCapture::from_complete_history("s", "seg", history);
+    let suffix = full.select_order_range(1..4).unwrap();
+    let original = full
+        .entries()
+        .find(|entry| entry.entry_id == "selected")
+        .unwrap();
+    let selected = suffix.entries().next().unwrap();
+    assert_eq!(selected.entry_id, original.entry_id);
+    assert_eq!(selected.source, original.source);
+    assert_eq!(selected.body, original.body);
+    assert_eq!(selected.policy, original.policy);
+    assert!(suffix.evidence_for("Eold").is_none());
+    assert_eq!(suffix.search(&SearchOptions::default()).len(), 1);
+    assert_eq!(
+        suffix.view_order_for_ref(&SessionEntryRef::parse("Eselected").unwrap()),
+        Some(1)
+    );
+    assert_eq!(selected.source.entry_index, 2);
+    assert_eq!(selected.order, 1);
+    assert_eq!(suffix.to_dto().view_entry_count, 3);
+    assert_eq!(
+        suffix.evidence_for("Eselected").unwrap().entry_range,
+        [2, 2]
+    );
+    let nested = suffix.select_order_range(1..2).unwrap();
+    assert_eq!(nested.entries().next().unwrap().order, 0);
+    assert_eq!(nested.entries().next().unwrap().source, original.source);
+    let restored = SessionCapture::decode(
+        &suffix.encode(CaptureLimits::default()).unwrap(),
+        CaptureLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(restored.to_dto(), suffix.to_dto());
+    assert!(full.select_order_range(4..5).is_err());
+    let reversed = std::ops::Range { start: 3, end: 2 };
+    assert!(full.select_order_range(reversed).is_err());
+    let hidden_only = full.select_order_range(3..4).unwrap();
+    assert_eq!(hidden_only.entries().len(), 0);
+    assert_eq!(hidden_only.to_dto().view_entry_count, 1);
+    let mut invalid = full.to_dto();
+    invalid.view_entry_count = 2; // the selected entry's view order is outside this extent
+    assert!(SessionCapture::try_from_dto(invalid, CaptureLimits::default()).is_err());
+    assert_eq!(
+        full.retain_entries(|entry| entry.entry_id == "selected")
+            .entries()
+            .next()
+            .unwrap()
+            .source,
+        original.source
+    );
+    assert_eq!(full.to_dto().view_entry_count, 4);
+}

crates/standalone/Cargo.toml

@@ -23,7 +23,7 @@ serde.workspace = true
 serde_json.workspace = true
 session-store.workspace = true
 thiserror.workspace = true
-tokio = { workspace = true, features = ["rt", "sync", "time"] }
+tokio = { workspace = true, features = ["rt", "sync", "time", "net", "io-util", "io-std", "signal"] }
 uuid = { workspace = true, features = ["v7"] }
 worker.workspace = true
 

crates/standalone/README.md

@@ -4,7 +4,8 @@ A Host that starts existing Workers in the same process. Assembles interactive W
 
 ## Reference index
 
-- [`host`] — bootstrap and confirmed shutdown.
+- [`host`] — bootstrap and confirmed shutdown, with or without a TUI.
+- [`unix`] — optional operator transport; disconnect does not release execution ownership.
 - [`launch`] — Profile, cwd, and Subject validation before launch.
 - [`store`] — Worker records and leases.
 - [`jobs`] — Job execution and independent result and cleanup lifetimes.

crates/standalone/src/host.rs

@@ -24,7 +24,6 @@ use session_store::{
 };
 use thiserror::Error;
 use worker::bootstrap::{WorkerBootstrap, WorkerBootstrapError, WorkerBootstrapLayout};
-use worker::controller::WorkerControllerTransport;
 use worker::ipc::protocol_session::{
     WorkerProtocolSessionStreams, dispatch_worker_protocol_method, live_log_entry_event,
     subscribe_worker_protocol_session,
@@ -222,7 +221,6 @@ impl StandaloneHost {
             workspace_context,
             filesystem_authority,
             WorkerBootstrapLayout::Direct { runtime_base },
-            WorkerControllerTransport::InProcess,
         );
         if let Some(subject) = &subject {
             bootstrap = bootstrap.with_subjektiv_host(subject.host.clone());
@@ -430,7 +428,6 @@ impl StandaloneHost {
             workspace_context,
             filesystem_authority,
             WorkerBootstrapLayout::Direct { runtime_base },
-            WorkerControllerTransport::InProcess,
         );
         if let Some(subject) = &subject {
             bootstrap = bootstrap.with_subjektiv_host(subject.host.clone());
@@ -520,10 +517,7 @@ impl StandaloneHost {
     /// Working events, committed session entries, alert snapshots, and the
     /// initial history snapshot are merged behind the client boundary.
     pub fn connect(&self) -> Client<InProcessSocket> {
-        let streams = subscribe_worker_protocol_session(&self.handle);
-        let (socket, peer) = InProcessSocket::pair();
-        tokio::spawn(run_protocol_session(self.handle.clone(), streams, peer));
-        Client::new(socket)
+        Client::new(connect_protocol(self.handle.clone()))
     }
 
     /// Logical Subject disconnection, not Worker shutdown or completion of its represented work.
@@ -565,6 +559,35 @@ impl StandaloneHost {
         }
     }
 
+    /// Run without a TUI until an admitted protocol Shutdown, controller exit, or process signal.
+    /// Client EOF only disconnects that client. All exits confirm the same production shutdown
+    /// and lease release as the in-process UI; an unconfirmed shutdown retains the lease.
+    pub async fn serve_unix(
+        self,
+        endpoint: crate::unix::UnixEndpoint,
+    ) -> Result<(), crate::HeadlessError> {
+        let mut adapter = crate::unix::UnixAdapter::start(endpoint, self.handle.clone());
+        let signal = async {
+            let mut terminate =
+                tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())?;
+            tokio::select! {
+                result = tokio::signal::ctrl_c() => result,
+                _ = terminate.recv() => Ok(()),
+            }
+        };
+        let result = tokio::select! {
+            _ = self.handle.protocol_closed() => Ok(()),
+            result = signal => result,
+            result = adapter.ended() => result,
+        };
+        // Reclaim the public entry and every connection before releasing execution ownership.
+        let transport = adapter.shutdown().await;
+        self.shutdown().await?;
+        result?;
+        transport?;
+        Ok(())
+    }
+
     pub fn with_shutdown_timeout(mut self, shutdown_timeout: Duration) -> Self {
         self.shutdown_timeout = shutdown_timeout;
         self
@@ -647,9 +670,8 @@ impl Drop for StandaloneHost {
     }
 }
 
-// The in-process channel is owned by the local operator's Host, not an
-// arbitrary socket or Backend account. decode_method discards wire provenance;
-// only this boundary can stamp accepted local human input.
+// Both in-process views and credential-checked Unix clients are admitted by this operator's
+// Host. decode_method discards wire provenance; only this boundary stamps local human input.
 fn authorize_local_input(method: protocol::Method) -> protocol::Method {
     use protocol::{AuthenticatedInputSource, Method};
     match method {
@@ -692,6 +714,13 @@ fn authorize_local_input(method: protocol::Method) -> protocol::Method {
     }
 }
 
+pub(crate) fn connect_protocol(handle: worker::WorkerHandle) -> InProcessSocket {
+    let streams = subscribe_worker_protocol_session(&handle);
+    let (socket, peer) = InProcessSocket::pair();
+    tokio::spawn(run_protocol_session(handle, streams, peer));
+    socket
+}
+
 async fn run_protocol_session(
     handle: worker::WorkerHandle,
     streams: WorkerProtocolSessionStreams,

crates/standalone/src/job_store.rs

@@ -25,7 +25,46 @@ use thiserror::Error;
 #[path = "job_store/legacy_migrations.rs"]
 mod legacy_migrations;
 
-const SCHEMA_VERSION: i64 = 4;
+const SCHEMA_VERSION: i64 = 5;
+
+/// Availability of the immutable input body, independent of execution outcome.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum JobInputDisposition {
+    Available,
+    Reclaimed,
+    Erased,
+    Invalidated,
+}
+
+impl JobInputDisposition {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Available => "available",
+            Self::Reclaimed => "reclaimed",
+            Self::Erased => "erased",
+            Self::Invalidated => "invalidated",
+        }
+    }
+}
+
+/// Host-authorized retirement; erasure and legacy invalidation do not change outcomes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum JobInputRetirementReason {
+    Completed,
+    ExplicitErasure,
+    LegacyInvalidation,
+}
+
+impl JobInputRetirementReason {
+    pub fn disposition(self) -> JobInputDisposition {
+        match self {
+            Self::Completed => JobInputDisposition::Reclaimed,
+            Self::ExplicitErasure => JobInputDisposition::Erased,
+            Self::LegacyInvalidation => JobInputDisposition::Invalidated,
+        }
+    }
+}
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
@@ -67,7 +106,11 @@ impl JobAttemptState {
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct JobSnapshot {
+    /// Receipt metadata. After retirement `input` is null; use the verified loader to execute.
     pub request: JobRequest,
+    pub input_digest: String,
+    pub intent_fingerprint: String,
+    pub input_disposition: JobInputDisposition,
     /// Durable Host-issued domain delegation, not model input or Profile identity.
     pub domain_grant: Option<Value>,
     pub state: JobState,
@@ -77,14 +120,27 @@ pub struct JobSnapshot {
 }
 
 impl JobSnapshot {
+    /// Load only the original available body, checking both content and immutable intent.
+    pub fn load_executable_request(&self) -> Result<&JobRequest, JobStoreError> {
+        if self.input_disposition != JobInputDisposition::Available {
+            return Err(JobStoreError::InvalidTransition("Job input is retired"));
+        }
+        self.request.validate()?;
+        if self.request.input_digest()? != self.input_digest
+            || self.request.fingerprint()? != self.intent_fingerprint
+        {
+            return Err(JobStoreError::Corrupt(
+                "immutable input or intent fingerprint mismatch".into(),
+            ));
+        }
+        Ok(&self.request)
+    }
+
     /// Shared Feature-facing read contract; no Workspace or execution identity leaks.
     pub fn outcome(&self) -> job::JobOutcome {
         job::JobOutcome {
             job_id: self.request.job_id.clone(),
-            input_digest: self
-                .request
-                .input_digest()
-                .expect("validated immutable Job input"),
+            input_digest: self.input_digest.clone(),
             attempt_id: self.attempt.attempt_id.clone(),
             attempt: self.attempt.number,
             state: match self.state {
@@ -204,9 +260,23 @@ impl JobStore {
                 tx.execute_batch(RECONCILIATION_SCHEMA)?;
                 tx.pragma_update(None, "user_version", SCHEMA_VERSION)?;
             }
-            SCHEMA_VERSION => {}
+            4 | SCHEMA_VERSION => {}
             other => return Err(JobStoreError::UnsupportedSchema(other)),
         }
+        if version < 5 {
+            tx.execute_batch(INPUT_RETENTION_SCHEMA)?;
+            let has_legacy_archive: bool = tx.query_row("SELECT EXISTS(SELECT 1 FROM sqlite_schema WHERE type='table' AND name='legacy_job_archive')", [], |r| r.get(0))?;
+            if has_legacy_archive {
+                tx.execute_batch("DROP TRIGGER legacy_job_archive_immutable;
+                    CREATE TRIGGER legacy_job_archive_immutable BEFORE UPDATE OF job_id,fingerprint,attempts_json ON legacy_job_archive
+                    BEGIN SELECT RAISE(ABORT, 'immutable legacy Job archive'); END;
+                    CREATE TRIGGER legacy_job_archive_input_retirement BEFORE UPDATE OF request_json ON legacy_job_archive
+                    WHEN NOT EXISTS (SELECT 1 FROM job_intents WHERE job_id=OLD.job_id AND input_disposition<>'available')
+                      OR (json_remove(NEW.request_json,'$.input') = json_remove(OLD.request_json,'$.input') AND json_type(NEW.request_json,'$.input')='null') IS NOT TRUE
+                    BEGIN SELECT RAISE(ABORT, 'immutable legacy Job input'); END;")?;
+            }
+            tx.pragma_update(None, "user_version", SCHEMA_VERSION)?;
+        }
         // An accepted result is the only evidence of success. Reserved attempts
         // were never started and remain pending; cancelled attempts never resume.
         tx.execute_batch(
@@ -249,10 +319,7 @@ impl JobStore {
                 [&request.job_id],
                 |row| row.get(0),
             )?;
-            if stored != fingerprint
-                || snapshot.request != request
-                || snapshot.domain_grant != grant
-            {
+            if stored != fingerprint || snapshot.domain_grant != grant {
                 return Err(JobStoreError::IntentConflict(request.job_id));
             }
             tx.commit()?;
@@ -334,6 +401,7 @@ impl JobStore {
             .conn
             .transaction_with_behavior(TransactionBehavior::Immediate)?;
         let previous = require_snapshot(&tx, job_id)?;
+        previous.load_executable_request()?;
         if previous.state != JobState::Failed || previous.attempt.state != JobAttemptState::Failed {
             return Err(JobStoreError::InvalidTransition(
                 "retry requires known failure",
@@ -354,6 +422,81 @@ impl JobStore {
         Ok(snapshot)
     }
 
+    /// Historical snapshots for one domain Session, including terminal and retired Jobs.
+    pub(crate) fn list_session_snapshots(
+        &self,
+        session_id: &str,
+        after: Option<&str>,
+        limit: usize,
+    ) -> Result<Vec<JobSnapshot>, JobStoreError> {
+        let mut stmt = self.conn.prepare("SELECT i.job_id FROM job_intents i JOIN job_domain_grants g ON g.job_id=i.job_id WHERE json_extract(g.grant_json,'$.session_id')=?1 AND (?2 IS NULL OR i.job_id>?2) ORDER BY i.job_id LIMIT ?3")?;
+        let ids = stmt
+            .query_map(
+                params![session_id, after, limit.clamp(1, 100) as i64],
+                |r| r.get::<_, String>(0),
+            )?
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        ids.into_iter()
+            .map(|id| require_snapshot(&self.conn, &id))
+            .collect()
+    }
+
+    /// The Host must fence domain mutation and delivery before erasure/invalidation.
+    /// This atomically prevents dispatch/retry/result acceptance, without rewriting outcome.
+    pub(crate) fn reclaim_input(
+        &mut self,
+        job_id: &str,
+        expected_input_digest: &str,
+        reason: JobInputRetirementReason,
+    ) -> Result<JobSnapshot, JobStoreError> {
+        let tx = self
+            .conn
+            .transaction_with_behavior(TransactionBehavior::Immediate)?;
+        let snapshot = require_snapshot(&tx, job_id)?;
+        if snapshot.input_digest != expected_input_digest {
+            return Err(JobStoreError::DigestMismatch);
+        }
+        let desired = reason.disposition();
+        if snapshot.input_disposition == desired {
+            tx.commit()?;
+            reclaim_retired_input_storage(&self.conn)?;
+            return Ok(snapshot);
+        }
+        if reason == JobInputRetirementReason::Completed
+            && (snapshot.state != JobState::Completed
+                || snapshot.attempt.state != JobAttemptState::Completed
+                || snapshot.result.is_none())
+        {
+            return Err(JobStoreError::InvalidTransition(
+                "reclaim requires known completed result",
+            ));
+        }
+        if snapshot.input_disposition != JobInputDisposition::Available
+            && reason != JobInputRetirementReason::ExplicitErasure
+        {
+            return Err(JobStoreError::InvalidTransition(
+                "retired input cannot be restored or reclassified",
+            ));
+        }
+        if reason == JobInputRetirementReason::Completed {
+            snapshot.load_executable_request()?;
+        }
+        let mut metadata = snapshot.request.clone();
+        metadata.input = Value::Null;
+        tx.execute(
+            "UPDATE job_intents SET request_json=?2, input_disposition=?3 WHERE job_id=?1",
+            params![job_id, serde_json::to_string(&metadata)?, desired.as_str()],
+        )?;
+        let has_legacy_archive: bool = tx.query_row("SELECT EXISTS(SELECT 1 FROM sqlite_schema WHERE type='table' AND name='legacy_job_archive')", [], |r| r.get(0))?;
+        if has_legacy_archive {
+            tx.execute("UPDATE legacy_job_archive SET request_json=json_set(request_json,'$.input',json('null')) WHERE job_id=?1", [job_id])?;
+        }
+        let snapshot = require_snapshot(&tx, job_id)?;
+        tx.commit()?;
+        reclaim_retired_input_storage(&self.conn)?;
+        Ok(snapshot)
+    }
+
     pub(crate) fn get(&self, job_id: &str) -> Result<JobSnapshot, JobStoreError> {
         require_snapshot(&self.conn, job_id)
     }
@@ -383,7 +526,7 @@ impl JobStore {
         let mut statement = self.conn.prepare(
             "SELECT i.job_id FROM job_intents i JOIN job_attempts a
              ON a.job_id = i.job_id AND a.number = i.current_attempt
-             WHERE i.state = 'pending' AND a.state = 'reserved' ORDER BY i.rowid",
+             WHERE i.state = 'pending' AND i.input_disposition='available' AND a.state = 'reserved' ORDER BY i.rowid",
         )?;
         let ids = statement
             .query_map([], |row| row.get::<_, String>(0))?
@@ -406,6 +549,7 @@ impl JobStore {
             .transaction_with_behavior(TransactionBehavior::Immediate)?;
         let snapshot = require_snapshot(&tx, job_id)?;
         check_attempt(&snapshot, attempt_id)?;
+        snapshot.load_executable_request()?;
         if snapshot.state != JobState::Pending
             || snapshot.attempt.state != JobAttemptState::Reserved
         {
@@ -447,7 +591,7 @@ impl JobStore {
             .transaction_with_behavior(TransactionBehavior::Immediate)?;
         let snapshot = require_snapshot(&tx, &bound.job_id)?;
         check_attempt(&snapshot, &bound.attempt_id)?;
-        if snapshot.request.input_digest()? != bound.input_digest {
+        if snapshot.input_digest != bound.input_digest {
             return Err(JobStoreError::DigestMismatch);
         }
         let (digest, encoded) =
@@ -466,6 +610,7 @@ impl JobStore {
             tx.commit()?;
             return Ok(snapshot);
         }
+        snapshot.load_executable_request()?;
         if snapshot.state != JobState::Pending
             || snapshot.attempt.state != JobAttemptState::Dispatched
         {
@@ -649,7 +794,7 @@ fn read_snapshot(conn: &Connection, job_id: &str) -> Result<Option<JobSnapshot>,
     let row = conn
         .query_row(
             "SELECT i.request_json, i.state, i.acknowledged, a.attempt_id, a.number,
-         a.state, a.failure, a.result_json FROM job_intents i JOIN job_attempts a
+         a.state, a.failure, a.result_json, a.input_digest, i.fingerprint, i.input_disposition FROM job_intents i JOIN job_attempts a
          ON a.job_id = i.job_id AND a.number = i.current_attempt WHERE i.job_id = ?1",
             [job_id],
             |row| {
@@ -662,12 +807,27 @@ fn read_snapshot(conn: &Connection, job_id: &str) -> Result<Option<JobSnapshot>,
                     row.get::<_, String>(5)?,
                     row.get::<_, Option<String>>(6)?,
                     row.get::<_, Option<String>>(7)?,
+                    row.get::<_, String>(8)?,
+                    row.get::<_, String>(9)?,
+                    row.get::<_, String>(10)?,
                 ))
             },
         )
         .optional()?;
     row.map(
-        |(request, state, acknowledged, attempt_id, number, attempt_state, failure, result)| {
+        |(
+            request,
+            state,
+            acknowledged,
+            attempt_id,
+            number,
+            attempt_state,
+            failure,
+            result,
+            input_digest,
+            intent_fingerprint,
+            disposition,
+        )| {
             let state = match state.as_str() {
                 "pending" => JobState::Pending,
                 "completed" => JobState::Completed,
@@ -693,8 +853,17 @@ fn read_snapshot(conn: &Connection, job_id: &str) -> Result<Option<JobSnapshot>,
                     )));
                 }
             };
+            let request_value: Value = serde_json::from_str(&request)?;
+            if request_value.get("input").is_none() {
+                return Err(JobStoreError::Corrupt(
+                    "stored Job input field is missing".into(),
+                ));
+            }
             Ok(JobSnapshot {
-                request: serde_json::from_str(&request)?,
+                request: serde_json::from_value(request_value)?,
+                input_digest,
+                intent_fingerprint,
+                input_disposition: serde_json::from_value(Value::String(disposition))?,
                 domain_grant: conn
                     .query_row(
                         "SELECT grant_json FROM job_domain_grants WHERE job_id = ?1",
@@ -719,6 +888,37 @@ fn read_snapshot(conn: &Connection, job_id: &str) -> Result<Option<JobSnapshot>,
     .transpose()
 }
 
+// Retirement is already durable before this maintenance step. Failure must be
+// retried with the same Job/digest/reason; it must never restore input. VACUUM
+// removes historical free-page copies, including stores written before secure_delete.
+fn reclaim_retired_input_storage(conn: &Connection) -> Result<(), JobStoreError> {
+    conn.execute_batch("PRAGMA secure_delete=ON; VACUUM;")?;
+    let busy: i64 = conn.query_row("PRAGMA wal_checkpoint(TRUNCATE)", [], |r| r.get(0))?;
+    if busy != 0 {
+        return Err(JobStoreError::InvalidTransition(
+            "input retired; SQLite body cleanup blocked by a reader, retry retirement",
+        ));
+    }
+    Ok(())
+}
+
+const INPUT_RETENTION_SCHEMA: &str = "
+ALTER TABLE job_intents ADD COLUMN input_disposition TEXT NOT NULL DEFAULT 'available'
+    CHECK (input_disposition IN ('available','reclaimed','erased','invalidated'));
+DROP TRIGGER job_intent_immutable;
+CREATE TRIGGER job_intent_immutable BEFORE UPDATE OF
+    job_id, fingerprint, serialization_key, max_concurrent ON job_intents
+BEGIN SELECT RAISE(ABORT, 'immutable Job intent'); END;
+CREATE TRIGGER job_input_retirement BEFORE UPDATE OF request_json, input_disposition ON job_intents
+WHEN (
+    ((OLD.input_disposition = 'available' AND NEW.input_disposition IN ('reclaimed','erased','invalidated'))
+      OR (OLD.input_disposition IN ('reclaimed','invalidated') AND NEW.input_disposition = 'erased'))
+    AND json_remove(NEW.request_json,'$.input') = json_remove(OLD.request_json,'$.input')
+    AND json_type(NEW.request_json,'$.input') = 'null'
+) IS NOT TRUE
+BEGIN SELECT RAISE(ABORT, 'immutable Job input retirement'); END;
+";
+
 const RECONCILIATION_SCHEMA: &str = "
 DROP INDEX job_serialization_singleflight;
 CREATE UNIQUE INDEX job_serialization_singleflight ON job_intents(serialization_key)
@@ -885,7 +1085,11 @@ mod tests {
                 Some("unconfirmed"),
             )
             .unwrap();
-        store.conn.execute_batch("DROP TRIGGER job_reconciliation_immutable; DROP TRIGGER job_reconciliation_retained; DROP TABLE job_domain_reconciliations; DROP INDEX job_serialization_singleflight; CREATE UNIQUE INDEX job_serialization_singleflight ON job_intents(serialization_key) WHERE serialization_key IS NOT NULL AND state IN ('pending','unknown'); PRAGMA user_version=3;").unwrap();
+        store.conn.execute_batch("DROP TRIGGER job_input_retirement; DROP TRIGGER job_intent_immutable;
+            ALTER TABLE job_intents DROP COLUMN input_disposition;
+            CREATE TRIGGER job_intent_immutable BEFORE UPDATE OF job_id,request_json,fingerprint,serialization_key,max_concurrent ON job_intents
+            BEGIN SELECT RAISE(ABORT, 'immutable Job intent'); END;
+            DROP TRIGGER job_reconciliation_immutable; DROP TRIGGER job_reconciliation_retained; DROP TABLE job_domain_reconciliations; DROP INDEX job_serialization_singleflight; CREATE UNIQUE INDEX job_serialization_singleflight ON job_intents(serialization_key) WHERE serialization_key IS NOT NULL AND state IN ('pending','unknown'); PRAGMA user_version=3;").unwrap();
         drop(store);
         let mut reopened = JobStore::open(&dir.path().join("jobs.sqlite3")).unwrap();
         assert_eq!(reopened.get("first").unwrap(), unknown);
@@ -911,10 +1115,7 @@ mod tests {
         JobResultSubmission {
             job_id: snapshot.request.job_id.clone(),
             attempt_id: snapshot.attempt.attempt_id.clone(),
-            input_digest: snapshot
-                .request
-                .input_digest()
-                .expect("validated immutable Job input"),
+            input_digest: snapshot.input_digest.clone(),
             result,
         }
     }
@@ -926,6 +1127,314 @@ mod tests {
             .unwrap()
     }
 
+    #[test]
+    fn input_reclaim_reopens_as_receipt_and_exact_replay_never_rehydrates() {
+        let (dir, mut store) = fixture();
+        let original = request("retained");
+        let grant = Some(json!({"session_id":"session-a", "consumer":"fixture"}));
+        let reserved = store
+            .reserve_granted(original.clone(), grant.clone())
+            .unwrap();
+        let running = store
+            .dispatch("retained", &reserved.attempt.attempt_id, 8)
+            .unwrap();
+        let result = submission(&running, json!({"saved":true}));
+        let completed = store.accept(&result).unwrap();
+        store.ack("retained").unwrap();
+        let retired = store
+            .reclaim_input(
+                "retained",
+                &completed.input_digest,
+                JobInputRetirementReason::Completed,
+            )
+            .unwrap();
+        assert_eq!(retired.input_disposition, JobInputDisposition::Reclaimed);
+        assert!(retired.request.input.is_null());
+        assert!(retired.load_executable_request().is_err());
+        assert_eq!(
+            retired.outcome().input_digest,
+            original.input_digest().unwrap()
+        );
+        assert_eq!(retired.result, completed.result);
+        drop(store);
+        let mut reopened = JobStore::open(&dir.path().join("jobs.sqlite3")).unwrap();
+        assert_eq!(
+            reopened
+                .reserve_granted(original.clone(), grant.clone())
+                .unwrap(),
+            retired
+        );
+        assert_eq!(reopened.accept(&result).unwrap(), retired);
+        assert_eq!(
+            reopened
+                .list_session_snapshots("session-a", None, 1)
+                .unwrap(),
+            vec![retired.clone()]
+        );
+        assert!(
+            reopened
+                .list_session_snapshots("session-b", None, 100)
+                .unwrap()
+                .is_empty()
+        );
+        assert!(
+            reopened
+                .list_session_snapshots("session-a", Some("retained"), 100)
+                .unwrap()
+                .is_empty()
+        );
+        let mut changed = original.clone();
+        changed.input = json!({"changed":true});
+        assert!(matches!(
+            reopened.reserve_granted(changed, grant),
+            Err(JobStoreError::IntentConflict(_))
+        ));
+        assert!(reopened.retry("retained").is_err());
+        assert!(
+            reopened
+                .dispatch("retained", &retired.attempt.attempt_id, 8)
+                .is_err()
+        );
+        assert!(reopened.conn.execute("UPDATE job_intents SET request_json=?1,input_disposition='available' WHERE job_id='retained'", [serde_json::to_string(&original).unwrap()]).is_err());
+        let erased = reopened
+            .reclaim_input(
+                "retained",
+                &retired.input_digest,
+                JobInputRetirementReason::ExplicitErasure,
+            )
+            .unwrap();
+        assert_eq!(erased.input_disposition, JobInputDisposition::Erased);
+        assert_eq!(erased.state, JobState::Completed);
+        assert!(erased.acknowledged);
+        assert_eq!(
+            reopened
+                .reserve_granted(original, erased.domain_grant.clone())
+                .unwrap(),
+            erased
+        );
+    }
+
+    #[test]
+    fn unfinished_unknown_and_failed_inputs_are_kept_until_explicit_invalidation() {
+        let (_dir, mut store) = fixture();
+        for (id, state) in [
+            ("pending", None),
+            ("unknown", Some(JobAttemptState::Unknown)),
+            ("failed", Some(JobAttemptState::Failed)),
+        ] {
+            let original = request(id);
+            let snapshot = store.reserve(original.clone()).unwrap();
+            if let Some(state) = state {
+                store.dispatch(id, &snapshot.attempt.attempt_id, 8).unwrap();
+                store
+                    .finish(
+                        id,
+                        &snapshot.attempt.attempt_id,
+                        state,
+                        Some("not complete"),
+                    )
+                    .unwrap();
+            }
+            let before = store.get(id).unwrap();
+            assert!(
+                store
+                    .reclaim_input(
+                        id,
+                        &before.input_digest,
+                        JobInputRetirementReason::Completed
+                    )
+                    .is_err()
+            );
+            assert_eq!(store.get(id).unwrap(), before);
+            assert_eq!(before.load_executable_request().unwrap(), &original);
+            assert!(
+                store
+                    .reclaim_input(id, "wrong", JobInputRetirementReason::ExplicitErasure)
+                    .is_err()
+            );
+            let retired = store
+                .reclaim_input(
+                    id,
+                    &before.input_digest,
+                    JobInputRetirementReason::LegacyInvalidation,
+                )
+                .unwrap();
+            assert_eq!(retired.state, before.state);
+            assert_eq!(retired.attempt, before.attempt);
+            assert_eq!(retired.input_disposition, JobInputDisposition::Invalidated);
+            assert!(store.retry(id).is_err());
+            assert!(store.dispatch(id, &before.attempt.attempt_id, 8).is_err());
+            assert_eq!(store.reserve(original).unwrap(), retired);
+        }
+    }
+
+    #[test]
+    fn erased_dispatched_input_refuses_delayed_result_without_rewriting_unknown() {
+        let (dir, mut store) = fixture();
+        let running = dispatched(&mut store, request("erase-running"));
+        let result = submission(&running, json!({"late":true}));
+        let erased = store
+            .reclaim_input(
+                "erase-running",
+                &running.input_digest,
+                JobInputRetirementReason::ExplicitErasure,
+            )
+            .unwrap();
+        assert!(store.accept(&result).is_err());
+        assert_eq!(erased.state, JobState::Pending);
+        drop(store);
+        let mut reopened = JobStore::open(&dir.path().join("jobs.sqlite3")).unwrap();
+        let recovered = reopened.get("erase-running").unwrap();
+        assert_eq!(recovered.state, JobState::Unknown);
+        assert_eq!(recovered.input_disposition, JobInputDisposition::Erased);
+        assert_eq!(recovered.input_digest, running.input_digest);
+        assert!(reopened.accept(&result).is_err());
+        assert!(reopened.retry("erase-running").is_err());
+    }
+
+    #[test]
+    fn available_input_loader_refuses_tamper_missing_body_and_envelope_changes() {
+        for mutation in [
+            "json_set(request_json,'$.input',json('{\"tampered\":true}'))",
+            "json_remove(request_json,'$.input')",
+            "json_set(request_json,'$.instruction','changed')",
+        ] {
+            let (_dir, mut store) = fixture();
+            store.reserve(request("tamper")).unwrap();
+            // Simulate external corruption bypassing SQLite's normal write guard.
+            store
+                .conn
+                .execute_batch("DROP TRIGGER job_input_retirement")
+                .unwrap();
+            store
+                .conn
+                .execute_batch(&format!("UPDATE job_intents SET request_json={mutation}"))
+                .unwrap();
+            match store.get("tamper") {
+                Ok(snapshot) => {
+                    assert!(snapshot.load_executable_request().is_err());
+                    assert!(
+                        store
+                            .dispatch("tamper", &snapshot.attempt.attempt_id, 8)
+                            .is_err()
+                    );
+                }
+                Err(JobStoreError::Json(_) | JobStoreError::Corrupt(_)) => {}
+                other => panic!("unexpected corrupt input read: {other:?}"),
+            }
+        }
+    }
+
+    #[test]
+    fn input_retirement_cleanup_failure_is_durable_and_exact_retry_finishes_without_rehydration() {
+        let (dir, mut store) = fixture();
+        let mut original = request("physical-erasure");
+        let private_body = "private-input-retirement-original-bytes".repeat(1000);
+        original.input = json!({"body":private_body});
+        let reserved = store.reserve(original.clone()).unwrap();
+        // A reader retaining the old SQLite snapshot prevents truncation of the old WAL.
+        let reader = Connection::open(dir.path().join("jobs.sqlite3")).unwrap();
+        reader
+            .execute_batch("BEGIN; SELECT request_json FROM job_intents;")
+            .unwrap();
+        store.conn.busy_timeout(std::time::Duration::ZERO).unwrap();
+        assert!(
+            store
+                .reclaim_input(
+                    "physical-erasure",
+                    &reserved.input_digest,
+                    JobInputRetirementReason::ExplicitErasure
+                )
+                .is_err()
+        );
+        let retired = store.get("physical-erasure").unwrap();
+        assert_eq!(retired.input_disposition, JobInputDisposition::Erased);
+        assert!(retired.load_executable_request().is_err());
+        reader.execute_batch("ROLLBACK").unwrap();
+        drop(reader);
+        let replay = store
+            .reclaim_input(
+                "physical-erasure",
+                &reserved.input_digest,
+                JobInputRetirementReason::ExplicitErasure,
+            )
+            .unwrap();
+        assert_eq!(replay, retired);
+        assert_eq!(store.reserve(original).unwrap(), retired);
+        let needle = b"private-input-retirement-original-bytes";
+        for entry in std::fs::read_dir(dir.path()).unwrap() {
+            let path = entry.unwrap().path();
+            if path.is_file() {
+                let bytes = std::fs::read(&path).unwrap();
+                assert!(
+                    !bytes.windows(needle.len()).any(|bytes| bytes == needle),
+                    "retired body remained in {}",
+                    path.display()
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn missing_original_null_input_is_not_treated_as_available_null() {
+        let (_dir, mut store) = fixture();
+        let mut original = request("null-original");
+        original.input = Value::Null;
+        let reserved = store.reserve(original).unwrap();
+        assert!(reserved.load_executable_request().is_ok());
+        store.conn.execute_batch("DROP TRIGGER job_input_retirement; UPDATE job_intents SET request_json=json_remove(request_json,'$.input')").unwrap();
+        assert!(store.get("null-original").is_err());
+    }
+
+    #[test]
+    fn input_retirement_migration_preserves_receipts_and_rolls_back_failed_ddl() {
+        let (dir, mut store) = fixture();
+        let original = store.reserve(request("upgrade")).unwrap();
+        store.conn.execute_batch("DROP TRIGGER job_input_retirement; DROP TRIGGER job_intent_immutable;
+            ALTER TABLE job_intents DROP COLUMN input_disposition;
+            CREATE TRIGGER job_intent_immutable BEFORE UPDATE OF job_id,request_json,fingerprint,serialization_key,max_concurrent ON job_intents
+            BEGIN SELECT RAISE(ABORT, 'immutable Job intent'); END;
+            PRAGMA user_version=4;
+            CREATE TRIGGER job_input_retirement BEFORE UPDATE ON job_attempts BEGIN SELECT RAISE(ABORT,'collision'); END;").unwrap();
+        drop(store);
+        let path = dir.path().join("jobs.sqlite3");
+        assert!(JobStore::open(&path).is_err());
+        let conn = Connection::open(&path).unwrap();
+        let version: i64 = conn
+            .pragma_query_value(None, "user_version", |r| r.get(0))
+            .unwrap();
+        assert_eq!(version, 4);
+        let present: bool = conn.query_row("SELECT EXISTS(SELECT 1 FROM pragma_table_info('job_intents') WHERE name='input_disposition')",[],|r|r.get(0)).unwrap();
+        assert!(!present);
+        conn.execute_batch("DROP TRIGGER job_input_retirement")
+            .unwrap();
+        drop(conn);
+        let mut reopened = JobStore::open(&path).unwrap();
+        assert_eq!(reopened.get("upgrade").unwrap(), original);
+        assert_eq!(
+            reopened
+                .get("upgrade")
+                .unwrap()
+                .load_executable_request()
+                .unwrap(),
+            &request("upgrade")
+        );
+        let retired = reopened
+            .reclaim_input(
+                "upgrade",
+                &original.input_digest,
+                JobInputRetirementReason::ExplicitErasure,
+            )
+            .unwrap();
+        assert_eq!(retired.state, JobState::Pending);
+        assert!(
+            reopened
+                .conn
+                .execute_batch("UPDATE job_intents SET input_disposition='available'")
+                .is_err()
+        );
+    }
+
     #[test]
     fn database_configuration_schema_and_identity_constraints() {
         let (_dir, mut store) = fixture();

crates/standalone/src/job_store/legacy_migrations.rs

@@ -143,6 +143,42 @@ mod tests {
         (original, receipt, grant)
     }
 
+    #[test]
+    fn legacy_archive_input_erasure_preserves_fingerprints_and_attempt_receipts() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("jobs.sqlite3");
+        seed(&path, 2);
+        let mut store = JobStore::open(&path).unwrap();
+        let before: (String, String) = store
+            .conn
+            .query_row(
+                "SELECT fingerprint,attempts_json FROM legacy_job_archive WHERE job_id='done'",
+                [],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        let snapshot = store.get("done").unwrap();
+        store
+            .reclaim_input(
+                "done",
+                &snapshot.input_digest,
+                JobInputRetirementReason::ExplicitErasure,
+            )
+            .unwrap();
+        let (body, fingerprint, attempts): (String,String,String) = store.conn.query_row("SELECT request_json,fingerprint,attempts_json FROM legacy_job_archive WHERE job_id='done'",[],|r|Ok((r.get(0)?,r.get(1)?,r.get(2)?))).unwrap();
+        assert!(serde_json::from_str::<Value>(&body).unwrap()["input"].is_null());
+        assert_eq!((fingerprint, attempts), before);
+        assert!(store.conn.execute_batch("UPDATE legacy_job_archive SET request_json=json_set(request_json,'$.input','restored') WHERE job_id='done'").is_err());
+        drop(store);
+        let mut reopened = JobStore::open(&path).unwrap();
+        let receipt = reopened
+            .reserve_granted(request("done"), snapshot.domain_grant)
+            .unwrap();
+        assert_eq!(receipt.state, JobState::Completed);
+        assert_eq!(receipt.input_disposition, JobInputDisposition::Erased);
+        assert!(receipt.load_executable_request().is_err());
+    }
+
     #[test]
     fn legacy_versions_preserve_intent_receipts_attempts_grants_and_replay() {
         for version in [1, 2] {

crates/standalone/src/jobs.rs

@@ -26,7 +26,10 @@ use job::{JobRequest, JobResultSubmission};
 use tokio::sync::watch;
 
 use crate::job_store::JobStore;
-pub use crate::job_store::{JobAttempt, JobAttemptState, JobSnapshot, JobState, JobStoreError};
+pub use crate::job_store::{
+    JobAttempt, JobAttemptState, JobInputDisposition, JobInputRetirementReason, JobSnapshot,
+    JobState, JobStoreError,
+};
 
 #[derive(Debug, thiserror::Error)]
 pub enum JobServiceError {
@@ -40,6 +43,8 @@ pub enum JobServiceError {
     Capacity,
     #[error("standalone Job cleanup failed: {0}")]
     Cleanup(String),
+    #[error("standalone Job shutdown is incomplete; execution resources are still owned")]
+    ShutdownIncomplete,
 }
 
 pub(crate) trait JobAttemptFence: Send + Sync {
@@ -173,6 +178,36 @@ impl StandaloneJobs {
         Ok(self.with_store(|store| store.reserve(request))?)
     }
 
+    /// Enumerate historical domain snapshots for a Session, including retired input receipts.
+    pub fn list_session_snapshots(
+        &self,
+        session_id: &str,
+        after: Option<&str>,
+        limit: usize,
+    ) -> Result<Vec<JobSnapshot>, JobServiceError> {
+        self.with_store(|store| store.list_session_snapshots(session_id, after, limit))
+    }
+
+    /// Retire body only. The caller fences domain effects/delivered snapshots before erasure.
+    /// Normal reclamation also requires that execution cleanup has finished.
+    pub fn reclaim_input(
+        &self,
+        job_id: &str,
+        expected_input_digest: &str,
+        reason: JobInputRetirementReason,
+    ) -> Result<JobSnapshot, JobServiceError> {
+        let executions = self.executions.lock().expect("Job executions poisoned");
+        if reason == JobInputRetirementReason::Completed
+            && executions
+                .jobs
+                .get(job_id)
+                .is_some_and(|execution| !execution.task.is_finished())
+        {
+            return Err(JobServiceError::Capacity);
+        }
+        self.with_store(|store| store.reclaim_input(job_id, expected_input_digest, reason))
+    }
+
     pub fn get(&self, job_id: &str) -> Result<JobSnapshot, JobServiceError> {
         Ok(self.with_store(|store| store.get(job_id))?)
     }
@@ -274,6 +309,12 @@ impl StandaloneJobs {
         job_id: &str,
         client: Option<Box<dyn LlmClient>>,
     ) -> Result<(), JobServiceError> {
+        // Preparation owns copies of the immutable input and domain adapter too. Exclude
+        // owner shutdown before creating them, not only before publishing the task.
+        let mut executions = self.executions.lock().expect("Job executions poisoned");
+        if executions.closed {
+            return Err(JobServiceError::Closed);
+        }
         let client = client.or_else(|| {
             self.model_client
                 .lock()
@@ -282,16 +323,14 @@ impl StandaloneJobs {
                 .map(|c| c.clone_boxed())
         });
         let snapshot = self.get(job_id)?;
+        snapshot.load_executable_request()?;
         let timeout = Duration::from_secs(u64::from(snapshot.request.limits.timeout_seconds));
         let deadline = tokio::time::Instant::now() + timeout;
         let fence: Arc<dyn JobAttemptFence> = Arc::new(BoundAttemptFence {
             store: self.store.clone(),
             job_id: job_id.into(),
             attempt_id: snapshot.attempt.attempt_id.clone(),
-            input_digest: snapshot
-                .request
-                .input_digest()
-                .map_err(JobStoreError::from)?,
+            input_digest: snapshot.input_digest.clone(),
             deadline,
         });
         let grant = match (
@@ -311,10 +350,6 @@ impl StandaloneJobs {
         let prepared =
             worker::job::prepare_job_with_grant(&snapshot.request, &self.cwd, client, grant)
                 .map_err(|error| JobServiceError::Configuration(error.to_string()))?;
-        let mut executions = self.executions.lock().expect("Job executions poisoned");
-        if executions.closed {
-            return Err(JobServiceError::Closed);
-        }
         executions.jobs.retain(|_, run| {
             !(run.task.is_finished() && matches!(run.complete.borrow().as_ref(), Some(Ok(()))))
         });
@@ -367,10 +402,7 @@ impl StandaloneJobs {
             store: store.clone(),
             job_id: id.clone(),
             attempt_id: attempt_id.clone(),
-            input_digest: snapshot
-                .request
-                .input_digest()
-                .map_err(JobStoreError::from)?,
+            input_digest: snapshot.input_digest.clone(),
             deadline,
         });
         let (cancel, mut cancellation) = watch::channel(false);
@@ -446,23 +478,25 @@ impl StandaloneJobs {
                 .clone()
                 .expect("completion");
             result.map_err(JobServiceError::Cleanup)?;
-            let task = {
-                let mut executions = self.executions.lock().expect("Job executions poisoned");
-                if executions
-                    .jobs
-                    .get(job_id)
-                    .is_some_and(|run| run.attempt_id == attempt)
-                {
-                    executions.jobs.remove(job_id)
-                } else {
-                    None
-                }
-            };
-            if let Some(execution) = task {
-                execution
-                    .task
-                    .await
-                    .map_err(|error| JobServiceError::Cleanup(error.to_string()))??;
+            // Completion is published immediately before the task returns. Do not remove
+            // its ownership record until the runtime confirms that return (and future drop).
+            while self
+                .executions
+                .lock()
+                .expect("Job executions poisoned")
+                .jobs
+                .get(job_id)
+                .is_some_and(|run| run.attempt_id == attempt && !run.task.is_finished())
+            {
+                tokio::task::yield_now().await;
+            }
+            let mut executions = self.executions.lock().expect("Job executions poisoned");
+            if executions
+                .jobs
+                .get(job_id)
+                .is_some_and(|run| run.attempt_id == attempt)
+            {
+                executions.jobs.remove(job_id);
             }
         }
         self.get(job_id)
@@ -476,33 +510,63 @@ impl StandaloneJobs {
         }
     }
 
-    pub(crate) async fn shutdown(&self) -> Result<(), JobServiceError> {
+    /// Initiate owner shutdown without blocking a synchronous caller. Success confirms all
+    /// local executions have returned, including request/history and Feature cleanup. An
+    /// incomplete/error result retains the service resources and must retain the Host lease.
+    pub(crate) fn try_shutdown(&self) -> Result<(), JobServiceError> {
         self.close();
-        let tasks = {
-            let mut executions = self.executions.lock().expect("Job executions poisoned");
-            std::mem::take(&mut executions.jobs)
-        };
-        let mut error = None;
-        for execution in tasks.into_values() {
-            match execution.task.await {
-                Ok(Ok(())) => {}
-                Ok(Err(failure)) => {
-                    error = Some(failure);
-                }
-                Err(failure) => {
-                    error = Some(JobServiceError::Cleanup(failure.to_string()));
+        let mut executions = self.executions.lock().expect("Job executions poisoned");
+        for execution in executions.jobs.values() {
+            if !execution.task.is_finished() {
+                return Err(JobServiceError::ShutdownIncomplete);
+            }
+            match execution.complete.borrow().as_ref() {
+                Some(Ok(())) => {}
+                Some(Err(error)) => return Err(JobServiceError::Cleanup(error.clone())),
+                None => {
+                    return Err(JobServiceError::Cleanup(
+                        "Internal Worker ended without cleanup confirmation".into(),
+                    ));
                 }
             }
         }
-        // Close SQLite before the Host releases its lease. Cloned handles may
-        // outlive the Host but cannot mutate or retain the live connection.
+        executions.jobs.clear();
+        // Retained external handles share these slots; they cannot retain a live store,
+        // provider or model client after successful owner shutdown.
         self.store.lock().expect("Job store poisoned").take();
         self.domain.lock().expect("Job domain poisoned").take();
         self.model_client
             .lock()
             .expect("Job model transport poisoned")
             .take();
-        error.map_or(Ok(()), Err)
+        Ok(())
+    }
+
+    pub(crate) async fn shutdown(&self) -> Result<(), JobServiceError> {
+        self.close();
+        let completions: Vec<_> = self
+            .executions
+            .lock()
+            .expect("Job executions poisoned")
+            .jobs
+            .values()
+            .map(|execution| execution.complete.clone())
+            .collect();
+        // Never take execution ownership out of the shared service across an await: a
+        // cancelled shutdown future or a concurrent close must still see the barrier.
+        for mut completion in completions {
+            completion
+                .wait_for(Option::is_some)
+                .await
+                .map_err(|error| JobServiceError::Cleanup(error.to_string()))?;
+        }
+        loop {
+            match self.try_shutdown() {
+                // Only the task's final return follows its completion notification.
+                Err(JobServiceError::ShutdownIncomplete) => tokio::task::yield_now().await,
+                result => return result,
+            }
+        }
     }
 }
 
@@ -574,7 +638,8 @@ impl JobAttemptFence for BoundAttemptFence {
         if snapshot.state != JobState::Pending
             || snapshot.attempt.state != JobAttemptState::Dispatched
             || snapshot.attempt.attempt_id != self.attempt_id
-            || snapshot.request.input_digest().map_err(|e| e.to_string())? != self.input_digest
+            || snapshot.input_digest != self.input_digest
+            || snapshot.input_disposition != JobInputDisposition::Available
         {
             return Err("Job domain grant is not bound to the current live attempt".into());
         }

crates/standalone/src/jobs/tests.rs

@@ -468,3 +468,104 @@ async fn cleanup_cannot_reclassify_success_or_durable_cancellation_and_stale_han
         assert!(matches!(operation, Err(JobServiceError::Closed)));
     }
 }
+
+#[tokio::test]
+async fn cancelled_shutdown_future_keeps_execution_barrier_and_unknown_input() {
+    // Actual generic runner + SQLite; only the provider stream is scripted/blocked.
+    let temp = tempfile::tempdir().unwrap();
+    let path = temp.path().join("jobs.sqlite3");
+    let jobs = StandaloneJobs::open(&path, temp.path().into()).unwrap();
+    let reserved = jobs.request(request("cancel-shutdown-wait")).unwrap();
+    let model = DomainTestClient {
+        stall: true,
+        ..Default::default()
+    };
+    jobs.start_with_model_client(&reserved.request.job_id, model.clone())
+        .await
+        .unwrap();
+    await_model(&model).await;
+    {
+        let shutdown = jobs.shutdown();
+        tokio::pin!(shutdown);
+        assert!(futures::poll!(shutdown.as_mut()).is_pending());
+        // Drop the caller's waiter while cancellation/cleanup is still pending.
+    }
+    assert!(matches!(
+        jobs.try_shutdown(),
+        Err(JobServiceError::ShutdownIncomplete)
+    ));
+    assert!(jobs.store.lock().unwrap().is_some());
+    assert!(matches!(
+        jobs.request(request("after-shutdown")),
+        Err(JobServiceError::Closed)
+    ));
+    tokio::time::timeout(Duration::from_secs(5), jobs.shutdown())
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(jobs.store.lock().unwrap().is_none());
+    let reopened = StandaloneJobs::open(&path, temp.path().into()).unwrap();
+    let unknown = reopened.get(&reserved.request.job_id).unwrap();
+    assert_eq!(unknown.attempt.state, JobAttemptState::Unknown);
+    assert_eq!(unknown.input_disposition, JobInputDisposition::Available);
+    assert_eq!(unknown.request, reserved.request);
+    assert_eq!(unknown.input_digest, reserved.input_digest);
+    assert!(reopened.retry(&unknown.request.job_id).is_err());
+    reopened.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn input_retirement_service_fences_live_attempt_and_preserves_session_receipts() {
+    // Production service + SQLite + attempt/result fences, without a model or Worker fixture.
+    let temp = tempfile::tempdir().unwrap();
+    let path = temp.path().join("jobs.sqlite3");
+    let jobs = StandaloneJobs::open(&path, temp.path().to_path_buf()).unwrap();
+    let original = request("input-retirement");
+    let grant = json!({"session_id":"session-a"});
+    let reserved = jobs
+        .request_granted(original.clone(), grant.clone())
+        .unwrap();
+    jobs.with_store(|store| store.dispatch("input-retirement", &reserved.attempt.attempt_id, 8))
+        .unwrap();
+    let fence = BoundAttemptFence {
+        store: jobs.store.clone(),
+        job_id: "input-retirement".into(),
+        attempt_id: reserved.attempt.attempt_id.clone(),
+        input_digest: reserved.input_digest.clone(),
+        deadline: tokio::time::Instant::now() + Duration::from_secs(10),
+    };
+    assert!(fence.ensure_live().is_ok());
+    assert!(
+        jobs.reclaim_input(
+            "input-retirement",
+            &reserved.input_digest,
+            JobInputRetirementReason::Completed
+        )
+        .is_err()
+    );
+    let erased = jobs
+        .reclaim_input(
+            "input-retirement",
+            &reserved.input_digest,
+            JobInputRetirementReason::ExplicitErasure,
+        )
+        .unwrap();
+    assert!(fence.ensure_live().is_err());
+    assert!(
+        sink(&jobs, "input-retirement", &reserved.attempt.attempt_id)
+            .submit(result("input-retirement", &reserved.attempt.attempt_id))
+            .is_err()
+    );
+    assert!(jobs.start("input-retirement").await.is_err());
+    assert_eq!(
+        jobs.list_session_snapshots("session-a", None, 100).unwrap(),
+        vec![erased.clone()]
+    );
+    assert!(
+        jobs.list_session_snapshots("session-b", None, 100)
+            .unwrap()
+            .is_empty()
+    );
+    assert_eq!(jobs.request_granted(original, grant).unwrap(), erased);
+    jobs.shutdown().await.unwrap();
+}

crates/standalone/src/lib.rs

@@ -7,6 +7,44 @@ pub mod launch;
 pub mod store;
 pub mod subjektiv;
 mod subjektiv_sessions;
+pub mod unix;
+
+pub use unix::{UnixEndpoint, relay_unix_client, run_unix_client};
+
+/// Restore reads the saved cwd and Profile, not a newly resolved launch recipe.
+pub enum HeadlessLaunch {
+    Fresh(ResolvedStandaloneLaunch),
+    Restore {
+        state_dir: std::path::PathBuf,
+        worker_id: WorkerId,
+    },
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum HeadlessError {
+    #[error(transparent)]
+    Transport(#[from] std::io::Error),
+    #[error(transparent)]
+    Startup(#[from] StandaloneStartupError),
+    #[error(transparent)]
+    Shutdown(#[from] StandaloneShutdownError),
+}
+
+/// Reserve the optional public transport before creating or restoring execution state.
+pub async fn run_headless(
+    launch: HeadlessLaunch,
+    endpoint: std::path::PathBuf,
+) -> Result<(), HeadlessError> {
+    let endpoint = UnixEndpoint::bind(endpoint)?;
+    let host = match launch {
+        HeadlessLaunch::Fresh(launch) => StandaloneHost::start(launch).await?,
+        HeadlessLaunch::Restore {
+            state_dir,
+            worker_id,
+        } => StandaloneHost::restore(state_dir, worker_id).await?,
+    };
+    host.serve_unix(endpoint).await
+}
 
 pub use host::{
     StandaloneHost, StandaloneShutdownError, StandaloneStartupError,

crates/standalone/src/subjektiv.rs

@@ -54,6 +54,8 @@ pub enum SubjectError {
     Journal(#[from] subjektiv::journal::JournalError),
     #[error(transparent)]
     Storage(#[from] feature_storage::FeatureStorageError),
+    #[error("local Subject Job shutdown: {0}")]
+    JobShutdown(#[from] crate::jobs::JobServiceError),
     #[error("local Subject storage metadata: {0}")]
     Json(#[from] serde_json::Error),
     #[error("local Subject storage permission or identity is invalid: {0}")]
@@ -338,8 +340,16 @@ impl SubjectConnection {
         }
     }
     pub fn close(&mut self) -> Result<(), SubjectError> {
-        self.host.jobs.lock().expect("Subject Jobs poisoned").take();
         self.host.live.store(false, Ordering::Release);
+        {
+            let mut jobs = self.host.jobs.lock().expect("Subject Jobs poisoned");
+            if let Some(service) = jobs.as_ref() {
+                // Signal cancellation, but retain the handle and exclusive lease until
+                // the generic owner confirms local request/history/resource teardown.
+                service.try_shutdown()?;
+            }
+            jobs.take();
+        }
         self.host.catalog.manager.shutdown()?;
         if let Some(file) = &self.lease {
             file.unlock()?;

crates/standalone/src/subjektiv/journal.rs

@@ -5,9 +5,12 @@
 //! recovery authority; shutdown does not delete either original Sessions or pending requests.
 
 use super::*;
-use crate::jobs::{JobAttemptState, JobSnapshot, JobState};
+use crate::jobs::{
+    JobAttemptState, JobInputDisposition, JobInputRetirementReason, JobSnapshot, JobState,
+};
+use session_store::capture::{CaptureDto, CaptureLimits, RecordingPosition};
 use subjektiv::api::JobAttemptBinding;
-use subjektiv::journal::recording::JournalMaterial;
+use subjektiv::journal::recording::JournalInput;
 use subjektiv::journal::transport::*;
 use subjektiv::journal::*;
 use worker::subjektiv::{JournalJobFinalizer, JournalJobHost, JournalJobToolsFeature};
@@ -16,7 +19,6 @@ use worker::subjektiv::{JournalJobFinalizer, JournalJobHost, JournalJobToolsFeat
 mod tests;
 
 pub(super) const PURPOSE: &str = "subjektiv_journal";
-const INPUT_BUDGET: usize = 48 * 1024;
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -27,6 +29,7 @@ struct LocalJournalGrant {
     session_id: String,
     journal_id: String,
     ranges: Vec<JournalSourceRange>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
     origins: Vec<SourceOrigin>,
 }
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -35,11 +38,6 @@ struct SourceOrigin {
     pointer: JournalSourcePointer,
     origin: session_store::public_material::PublicMaterialOrigin,
 }
-impl LocalJournalGrant {
-    fn input(&self) -> serde_json::Value {
-        serde_json::json!({"selected_ranges": self.ranges, "origins": self.origins})
-    }
-}
 
 impl StandaloneSubjects {
     /// Explicit operator erasure, separate from ordinary Worker removal. Requires the
@@ -84,32 +82,29 @@ impl StandaloneSubjects {
             self.state_root.clone(),
         )
         .map_err(|error| SubjectError::InvalidScope(error.to_string()))?;
-        for snapshot in jobs
-            .pending()
-            .map_err(|e| SubjectError::InvalidScope(e.to_string()))?
-            .into_iter()
-            .chain(
-                jobs.unknown_granted()
-                    .map_err(|e| SubjectError::InvalidScope(e.to_string()))?,
-            )
-        {
-            if snapshot.domain_grant.as_ref().is_some_and(|grant| {
-                grant.get("session_id").and_then(|v| v.as_str()) == Some(session_id)
-            }) {
+        let mut after = None;
+        loop {
+            let page = jobs
+                .list_session_snapshots(session_id, after.as_deref(), 100)
+                .map_err(|e| SubjectError::InvalidScope(e.to_string()))?;
+            if page.is_empty() {
+                break;
+            }
+            for snapshot in &page {
                 jobs.cancel(&snapshot.request.job_id)
                     .map_err(|e| SubjectError::InvalidScope(e.to_string()))?;
+                jobs.reclaim_input(
+                    &snapshot.request.job_id,
+                    &snapshot.input_digest,
+                    JobInputRetirementReason::ExplicitErasure,
+                )
+                .map_err(|e| SubjectError::InvalidScope(e.to_string()))?;
+                if snapshot.state == JobState::Completed && !snapshot.acknowledged {
+                    jobs.acknowledge(&snapshot.request.job_id)
+                        .map_err(|e| SubjectError::InvalidScope(e.to_string()))?;
+                }
             }
-        }
-        for snapshot in jobs
-            .unacknowledged_results()
-            .map_err(|e| SubjectError::InvalidScope(e.to_string()))?
-        {
-            if snapshot.domain_grant.as_ref().is_some_and(|grant| {
-                grant.get("session_id").and_then(|v| v.as_str()) == Some(session_id)
-            }) {
-                jobs.acknowledge(&snapshot.request.job_id)
-                    .map_err(|e| SubjectError::InvalidScope(e.to_string()))?;
-            }
+            after = page.last().map(|job| job.request.job_id.clone());
         }
         session_store::FsStore::new_with_retention(
             path,
@@ -590,17 +585,28 @@ impl LocalSubjectHost {
         self.ensure_live()?;
         let jobs = self.jobs()?;
         for saved in jobs.unacknowledged_results().map_err(service_error)? {
-            if self.journal_grant(&saved).is_ok() {
+            if self.journal_grant_scope(&saved).is_ok() {
                 self.complete_journal_job(&jobs, &saved)?;
             }
         }
         for pending in jobs.pending().map_err(service_error)? {
-            if self.journal_grant(&pending).is_ok() {
+            if pending.request.purpose != PURPOSE {
+                continue;
+            }
+            self.journal_grant_scope(&pending)?;
+            if pending.request.input.get("capture").is_some() {
+                self.journal_grant(&pending)?;
                 return Ok(Some((jobs, pending.request.job_id)));
             }
+            // Old descriptor jobs never acquire new execution authority. Their immutable
+            // identity/input is retired, not upgraded in place; saved checkpoint wins.
+            let replacement = self.replace_legacy_journal_job(&jobs, &pending)?;
+            if let Some(id) = replacement {
+                return Ok(Some((jobs, id)));
+            }
         }
         for unknown in jobs.unknown_granted().map_err(service_error)? {
-            let Ok(grant) = self.journal_grant(&unknown) else {
+            let Ok(grant) = self.journal_grant_scope(&unknown) else {
                 continue;
             };
             let context = authority(self, &grant.session_id)?;
@@ -685,32 +691,96 @@ impl LocalSubjectHost {
                         }
                     }
                 }
-                let materials = self.select_journal_materials(&context, &journal.id)?;
-                if materials.is_empty() {
+                let mut retained = None;
+                // Saved body snapshots always win over descriptor migration. In particular,
+                // a failed continuation must not recapture its original text even if an
+                // invalidated legacy grant still bounds a larger unprocessed suffix.
+                for legacy_pass in [false, true] {
+                    let mut after_job = None;
+                    loop {
+                        let page = jobs
+                            .list_session_snapshots(
+                                &journal.source_session_id,
+                                after_job.as_deref(),
+                                100,
+                            )
+                            .map_err(service_error)?;
+                        if page.is_empty() {
+                            break;
+                        }
+                        for saved in &page {
+                            if saved.request.purpose != PURPOSE {
+                                continue;
+                            }
+                            let legacy = saved.input_disposition
+                                == JobInputDisposition::Invalidated
+                                || (saved.input_disposition == JobInputDisposition::Available
+                                    && saved.request.input.get("capture").is_none());
+                            if legacy != legacy_pass
+                                || (!legacy
+                                    && saved.input_disposition != JobInputDisposition::Available)
+                            {
+                                continue;
+                            }
+                            let saved_grant = self.journal_grant_scope(saved)?;
+                            if saved_grant.journal_id != journal.id {
+                                continue;
+                            }
+                            if legacy {
+                                if let Some(id) = self.replace_legacy_journal_job(&jobs, saved)? {
+                                    return Ok(Some((jobs, id)));
+                                }
+                                continue;
+                            }
+                            self.journal_grant(saved)?;
+                            let original = JournalInput::decode(&saved.request.input)
+                                .map_err(journal_error)?;
+                            let continuation = self.build_journal_input(
+                                &context,
+                                &journal.id,
+                                Some(&original.capture),
+                            )?;
+                            if !continuation.selected_ranges.is_empty() {
+                                retained = Some(continuation);
+                                break;
+                            }
+                            if saved.state == JobState::Completed && saved.acknowledged {
+                                // Recover the acknowledgement-before-reclamation gap without
+                                // turning a retained receipt into an executable empty input.
+                                jobs.reclaim_input(
+                                    &saved.request.job_id,
+                                    &saved.input_digest,
+                                    JobInputRetirementReason::Completed,
+                                )
+                                .map_err(service_error)?;
+                            }
+                        }
+                        if retained.is_some() {
+                            break;
+                        }
+                        after_job = page.last().map(|job| job.request.job_id.clone());
+                    }
+                    if retained.is_some() {
+                        break;
+                    }
+                }
+                let input = match retained {
+                    Some(input) => input,
+                    None => self.build_journal_input(&context, &journal.id, None)?,
+                };
+
+                if input.selected_ranges.is_empty() {
                     continue;
                 }
-                let ranges = materials
-                    .into_iter()
-                    .map(|material| material.range)
-                    .collect::<Vec<_>>();
-                let origins = self.journal_origins(&ranges)?;
                 let grant = LocalJournalGrant {
                     writer_binding_id: Some(self.writer.binding_id.clone()),
                     binding: self.binding.clone(),
                     session_id: journal.source_session_id,
                     journal_id: journal.id.clone(),
-                    ranges,
-                    origins,
-                };
-                let request = job::JobRequest {
-                    job_id: format!("subjektiv-journal:{}", uuid::Uuid::now_v7()),
-                    purpose: PURPOSE.into(), input_ref: format!("subjektiv://{}/journal/{}", self.binding.subject_id, journal.id),
-                    input: grant.input(),
-                    instruction: "ReadJournalState first. Input descriptors are the frozen canonical public ranges authorized for this Job, not already read material. Read every selected source byte with bounded ReadJournalText before recording; then read initial/current position and open text in bounded pages. Reconcile saved operation receipts before new creates. Save sequential Create/Rewrite/Fix and UpdateJournalPosition operations, then CheckpointJournal backed by saved record/no-change receipts for all selected input. Do not fix an ongoing event just because this Job/turn ended. SubmitJobResult with result: {} only after the entire selected prefix is reflected. Never infer tool success or user intent not evidenced by public input.".into(),
-                    profile: "builtin:subjektiv-journal-recording".into(),
-                    serialization_key: Some(format!("subjektiv-journal:{}", journal.id)),
-                    limits: job::JobLimits { timeout_seconds: 600, ..Default::default() },
+                    ranges: input.selected_ranges.clone(),
+                    origins: vec![],
                 };
+                let request = self.journal_request(&journal.id, &input)?;
                 let saved = jobs
                     .request_granted(
                         request,
@@ -727,6 +797,138 @@ impl LocalSubjectHost {
         }
     }
 
+    fn replace_legacy_journal_job(
+        &self,
+        jobs: &crate::jobs::StandaloneJobs,
+        old: &JobSnapshot,
+    ) -> Result<Option<String>, SubjektivHostError> {
+        let grant = self.journal_grant_scope(old)?;
+        if old.input_disposition == JobInputDisposition::Available {
+            old.load_executable_request()
+                .map_err(|e| SubjektivHostError::InvalidArgument(e.to_string()))?;
+            if old.request.input
+                != serde_json::json!({"selected_ranges":grant.ranges,"origins":grant.origins})
+            {
+                return Err(SubjektivHostError::InvalidArgument(
+                    "invalid legacy Journal descriptor input".into(),
+                ));
+            }
+        } else if old.input_disposition != JobInputDisposition::Invalidated {
+            return Err(SubjektivHostError::InvalidArgument(
+                "legacy Journal input is unavailable".into(),
+            ));
+        }
+        let context = authority(self, &grant.session_id)?;
+        if let Some(active) = self
+            .catalog
+            .store
+            .active_journal_generation(&context, &grant.journal_id)
+            .map_err(journal_error)?
+        {
+            if active.job.job_id != old.request.job_id {
+                return Err(SubjektivHostError::InvalidArgument(
+                    "another generation owns legacy migration".into(),
+                ));
+            }
+            self.catalog
+                .store
+                .close_journal_generation(&context, &active.id, &active.job)
+                .map_err(journal_error)?;
+        }
+        jobs.cancel(&old.request.job_id).map_err(service_error)?;
+        let current = self
+            .catalog
+            .store
+            .read_journal(&context, &grant.journal_id)
+            .map_err(journal_error)?;
+        let end = grant
+            .ranges
+            .last()
+            .ok_or_else(|| SubjektivHostError::InvalidArgument("empty legacy selection".into()))?;
+        let end_position = if end.bytes.end == end.source.total_bytes {
+            (end.source.order + 1, 0)
+        } else {
+            (end.source.order, end.bytes.end)
+        };
+        let replacement = if (current.process_order, current.process_byte) >= end_position {
+            None
+        } else {
+            let mut capture = self.recording_capture(&grant.session_id)?;
+            capture
+                .entries
+                .retain(|entry| grant.ranges.iter().any(|r| r.source.order == entry.order));
+            for entry in &mut capture.entries {
+                let range = grant
+                    .ranges
+                    .iter()
+                    .find(|r| r.source.order == entry.order)
+                    .unwrap();
+                let session_store::capture::CaptureBody::CanonicalPublic {
+                    descriptor,
+                    byte_offset,
+                    text,
+                    ..
+                } = &mut entry.body
+                else {
+                    unreachable!()
+                };
+                if source_descriptor(&grant.session_id, descriptor) != range.source
+                    || !grant.origins.iter().any(|origin| {
+                        origin.pointer == range.source.pointer && origin.origin == descriptor.origin
+                    })
+                    || !text.is_char_boundary(range.bytes.start as usize)
+                    || !text.is_char_boundary(range.bytes.end as usize)
+                {
+                    return Err(SubjektivHostError::InvalidArgument(
+                        "legacy original source identity/range changed".into(),
+                    ));
+                }
+                *text = text[range.bytes.start as usize..range.bytes.end as usize].to_owned();
+                *byte_offset = range.bytes.start;
+            }
+            let input = self.build_journal_input(&context, &grant.journal_id, Some(&capture))?;
+            let request = self.journal_request(&grant.journal_id, &input)?;
+            let next_grant = LocalJournalGrant {
+                ranges: input.selected_ranges.clone(),
+                origins: vec![],
+                ..grant
+            };
+            Some(
+                jobs.request_granted(
+                    request,
+                    serde_json::to_value(next_grant)
+                        .map_err(|e| SubjektivHostError::Unavailable(e.to_string()))?,
+                )
+                .map_err(service_error)?
+                .request
+                .job_id,
+            )
+        };
+        jobs.reclaim_input(
+            &old.request.job_id,
+            &old.input_digest,
+            JobInputRetirementReason::LegacyInvalidation,
+        )
+        .map_err(service_error)?;
+        Ok(replacement)
+    }
+
+    fn journal_request(
+        &self,
+        journal_id: &str,
+        input: &JournalInput,
+    ) -> Result<job::JobRequest, SubjektivHostError> {
+        Ok(job::JobRequest {
+            job_id: format!("subjektiv-journal:{}", uuid::Uuid::now_v7()), purpose: PURPOSE.into(),
+            input_ref: format!("subjektiv://{}/journal/{journal_id}", self.binding.subject_id),
+            input: serde_json::to_value(input).map_err(|e| SubjektivHostError::Unavailable(e.to_string()))?,
+            instruction: "Input contains the frozen canonical public source bodies, provenance and byte ranges. Use only this saved input, never re-fetch Source. ReadJournalState first and read initial/current Journal position/open text in bounded pages if needed. Reconcile saved operation receipts before new creates. Save sequential Create/Rewrite/Fix and UpdateJournalPosition operations, then CheckpointJournal backed by saved record/no-change receipts for all selected input. Do not fix an ongoing event just because this Job/turn ended. SubmitJobResult with result: {} only after the entire selected prefix is reflected. Never infer tool success or user intent not evidenced by public input.".into(),
+            profile: "builtin:subjektiv-journal-recording".into(),
+            serialization_key: Some(format!("subjektiv-journal:{journal_id}")),
+            limits: job::JobLimits { timeout_seconds: 600, ..Default::default() },
+        })
+    }
+
     fn pin_journal_session(&self, session: &str) -> Result<(), SubjektivHostError> {
         let path = crate::subjektiv_sessions::authorized_sessions_path(
             &self.catalog.state_root,
@@ -869,11 +1071,16 @@ impl LocalSubjectHost {
         Ok(())
     }
 
-    fn material_reader(
+    fn with_recording_boundary<T>(
         &self,
         session: &str,
-    ) -> Result<session_store::public_material::SessionPublicMaterialReader, SubjektivHostError>
-    {
+        read: impl FnOnce(
+            &Path,
+            session_store::SessionId,
+            session_store::SegmentId,
+            &session_store::retention::SessionRetentionGuard,
+        ) -> Result<T, SubjektivHostError>,
+    ) -> Result<T, SubjektivHostError> {
         let sessions = crate::subjektiv_sessions::authorized_sessions_path(
             &self.catalog.state_root,
             &self.binding.scope_id,
@@ -906,6 +1113,11 @@ impl LocalSubjectHost {
             .ok_or_else(|| SubjektivHostError::InvalidArgument("invalid Session storage".into()))?
             .join("worker")
             .join(&record.storage_key);
+        let session_id = session
+            .parse()
+            .map_err(|_| SubjektivHostError::InvalidArgument("invalid Session".into()))?;
+        let retention = crate::store::session_retention(&self.catalog.state_root);
+        let guard = retention.lock_live(session_id).map_err(source_error)?;
         // This is the persisted active selector, not the newest filename/mtime or a model claim.
         let metadata =
             session_store::WorkerAggregateStore::open_read_only(metadata_root, &record.storage_key)
@@ -933,154 +1145,203 @@ impl LocalSubjectHost {
                     "no attested active lineage for the retained Session".into(),
                 )
             })?;
-        session_store::public_material::SessionPublicMaterialReader::open_fs_with_retention(
-            &sessions,
-            session
-                .parse()
-                .map_err(|_| SubjektivHostError::InvalidArgument("invalid Session".into()))?,
-            active,
-            session_store::public_material::PublicMaterialLimits {
-                max_segments: 256,
-                max_entries: 100_000,
-                max_record_bytes: 64 * 1024 * 1024,
-            },
-            crate::store::session_retention(&self.catalog.state_root),
-        )
-        .map_err(|error| SubjektivHostError::Unavailable(error.to_string()))
+        read(&sessions, session_id, active, &guard)
+    }
+
+    fn recording_capture(&self, session: &str) -> Result<CaptureDto, SubjektivHostError> {
+        self.with_recording_boundary(session, |sessions, session_id, active, guard| {
+            session_store::capture::capture_recording_fs_guarded(
+                sessions,
+                session_id,
+                active,
+                session_store::public_material::PublicMaterialLimits::default(),
+                CaptureLimits {
+                    max_bytes: 128 * 1024 * 1024,
+                    max_entries: 100_000,
+                    max_text_bytes: 64 * 1024 * 1024,
+                    ..Default::default()
+                },
+                guard,
+            )
+            .map_err(|e| SubjektivHostError::Unavailable(e.to_string()))
+        })
     }
 
     fn journal_sources(
         &self,
         session: &str,
     ) -> Result<Vec<JournalSourceRange>, SubjektivHostError> {
-        let reader = self.material_reader(session)?;
-        Ok(reader
-            .descriptors()
-            .map(|descriptor| JournalSourceRange {
-                source: source_descriptor(session, descriptor),
-                bytes: JournalByteRange {
-                    start: 0,
-                    end: descriptor.total_bytes,
+        self.with_recording_boundary(session, |sessions, session_id, active, guard| {
+            session_store::capture::recording_catalog_fs_guarded(
+                sessions,
+                session_id,
+                active,
+                session_store::public_material::PublicMaterialLimits::default(),
+                guard,
+                |descriptors| {
+                    descriptors
+                        .iter()
+                        .map(|descriptor| JournalSourceRange {
+                            source: source_descriptor(session, descriptor),
+                            bytes: JournalByteRange {
+                                start: 0,
+                                end: descriptor.total_bytes,
+                            },
+                        })
+                        .collect()
                 },
-            })
-            .collect())
-    }
-
-    fn source_reader(
-        &self,
-        source: &JournalSource,
-    ) -> Result<session_store::public_material::SessionPublicMaterialReader, SubjektivHostError>
-    {
-        let sessions = crate::subjektiv_sessions::authorized_sessions_path(
-            &self.catalog.state_root,
-            &self.binding.scope_id,
-            &self.binding.subject_id,
-            &self.catalog.store,
-            &source.session_id,
-        )?;
-        // Frozen, already admitted original pointers do not follow the Worker's later active
-        // Session/Segment. This reads that original lineage and still checks descriptor identity,
-        // canonical order and digest below; the shared service enforces the frozen byte range.
-        session_store::public_material::SessionPublicMaterialReader::open_fs_with_retention(
-            &sessions,
-            source
-                .session_id
-                .parse()
-                .map_err(|_| SubjektivHostError::InvalidArgument("invalid Session".into()))?,
-            source.pointer.segment_id,
-            session_store::public_material::PublicMaterialLimits {
-                max_segments: 256,
-                max_entries: 100_000,
-                max_record_bytes: 64 * 1024 * 1024,
-            },
-            crate::store::session_retention(&self.catalog.state_root),
-        )
-        .map_err(|error| SubjektivHostError::Unavailable(error.to_string()))
-    }
-
-    fn journal_origins(
-        &self,
-        ranges: &[JournalSourceRange],
-    ) -> Result<Vec<SourceOrigin>, SubjektivHostError> {
-        if ranges.is_empty() {
-            return Err(SubjektivHostError::InvalidArgument(
-                "empty material selection".into(),
-            ));
-        }
-        ranges
-            .iter()
-            .map(|range| {
-                let reader = self.source_reader(&range.source)?;
-                reader
-                    .descriptors()
-                    .find(|descriptor| {
-                        source_descriptor(&range.source.session_id, descriptor) == range.source
-                    })
-                    .map(|descriptor| SourceOrigin {
-                        pointer: range.source.pointer.clone(),
-                        origin: descriptor.origin.clone(),
-                    })
-                    .ok_or_else(|| {
-                        SubjektivHostError::InvalidArgument(
-                            "source provenance/identity changed".into(),
-                        )
-                    })
-            })
-            .collect()
-    }
-
-    fn journal_source_window(
-        &self,
-        source: &JournalSource,
-        offset: u64,
-        max_bytes: usize,
-    ) -> Result<String, SubjektivHostError> {
-        let reader = self.source_reader(source)?;
-        let descriptor = reader.descriptors().find(|descriptor| source_descriptor(&source.session_id, descriptor) == *source)
-            .ok_or_else(|| SubjektivHostError::InvalidArgument("canonical source identity/order/digest changed or is outside the authorized Session".into()))?;
-        reader
-            .read_content(descriptor, offset, max_bytes)
-            .map(|window| window.content)
-            .map_err(|error| SubjektivHostError::Unavailable(error.to_string()))
-    }
-
-    fn journal_source_material(
-        &self,
-        source: &JournalSource,
-        start: u64,
-        limit: usize,
-    ) -> JournalResult<JournalMaterial> {
-        let text = self
-            .journal_source_window(source, start, limit.max(4))
-            .map_err(|error| JournalError::Conflict(error.to_string()))?;
-        Ok(JournalMaterial {
-            range: JournalSourceRange {
-                source: source.clone(),
-                bytes: JournalByteRange {
-                    start,
-                    end: start + text.len() as u64,
-                },
-            },
-            text,
+            )
+            .map_err(|e| SubjektivHostError::Unavailable(e.to_string()))
         })
     }
 
-    fn select_journal_materials(
+    fn build_journal_input(
         &self,
         context: &JournalHostContext,
         id: &str,
-    ) -> Result<Vec<JournalMaterial>, SubjektivHostError> {
-        subjektiv::journal::recording::select_materials_bounded(
-            &self.catalog.store,
-            context,
-            id,
-            INPUT_BUDGET,
-            |source, start, limit| self.journal_source_material(source, start, limit),
-        )
+        saved: Option<&CaptureDto>,
+    ) -> Result<JournalInput, SubjektivHostError> {
+        let session = self
+            .catalog
+            .store
+            .read_journal(context, id)
+            .map_err(journal_error)?
+            .source_session_id;
+        JournalInput::build(&self.catalog.store, context, id, |order, offset, budget| {
+            let capture = match saved {
+                Some(capture) => capture.clone(),
+                None => {
+                    let capture = self
+                        .with_recording_boundary(&session, |sessions, session_id, active, guard| {
+                            session_store::capture::capture_recording_slice_fs_guarded(
+                                sessions,
+                                session_id,
+                                active,
+                                session_store::public_material::PublicMaterialLimits::default(),
+                                RecordingPosition {
+                                    canonical_order: order,
+                                    byte_offset: offset,
+                                },
+                                MAX_JOURNAL_RANGES,
+                                budget,
+                                guard,
+                            )
+                            .map(|slice| slice.capture)
+                            .map_err(|e| SubjektivHostError::Unavailable(e.to_string()))
+                        })
+                        .map_err(|e| JournalError::Conflict(e.to_string()))?;
+                    // Admission and capture are separate saves. An append between them
+                    // may be in replay but has not yet been accepted for this Journal.
+                    return self.accepted_capture_prefix(context, id, capture);
+                }
+            };
+            let end = capture
+                .entries
+                .last()
+                .map(|entry| {
+                    capture
+                        .recording_text(entry.order)
+                        .map(|(descriptor, start, text)| {
+                            if start + text.len() as u64 == descriptor.total_bytes {
+                                RecordingPosition {
+                                    canonical_order: entry.order + 1,
+                                    byte_offset: 0,
+                                }
+                            } else {
+                                RecordingPosition {
+                                    canonical_order: entry.order,
+                                    byte_offset: start + text.len() as u64,
+                                }
+                            }
+                        })
+                })
+                .transpose()
+                .map_err(|e| JournalError::Conflict(e.to_string()))?;
+            if end.is_none_or(|end| (order, offset) >= (end.canonical_order, end.byte_offset)) {
+                return Ok(CaptureDto {
+                    entries: vec![],
+                    ..capture
+                });
+            }
+            capture
+                .recording_slice(
+                    RecordingPosition {
+                        canonical_order: order,
+                        byte_offset: offset,
+                    },
+                    MAX_JOURNAL_RANGES,
+                    budget,
+                )
+                .map(|slice| slice.capture)
+                .map_err(|e| JournalError::Conflict(e.to_string()))
+        })
         .map_err(journal_error)
     }
 
-    fn journal_grant(
+    fn accepted_capture_prefix(
+        &self,
+        context: &JournalHostContext,
+        id: &str,
+        mut capture: CaptureDto,
+    ) -> JournalResult<CaptureDto> {
+        let mut selected = Vec::new();
+        for mut entry in capture.entries {
+            let status = match self
+                .catalog
+                .store
+                .read_journal_source(context, id, entry.order)
+            {
+                Ok(status) => status,
+                Err(JournalError::NotFound(_)) => break,
+                Err(error) => return Err(error),
+            };
+            let session_store::capture::CaptureBody::CanonicalPublic {
+                descriptor,
+                byte_offset,
+                text,
+                ..
+            } = &mut entry.body
+            else {
+                return Err(JournalError::InvalidInput("non-recording capture".into()));
+            };
+            if source_descriptor(&capture.session_id, descriptor) != status.source {
+                return Err(JournalError::Conflict(
+                    "captured source differs from admitted identity".into(),
+                ));
+            }
+            let Some(accepted) = status
+                .accepted
+                .iter()
+                .find(|range| range.start <= *byte_offset && *byte_offset < range.end)
+            else {
+                break;
+            };
+            let end = status
+                .unavailable
+                .iter()
+                .filter(|range| range.end > *byte_offset)
+                .fold(accepted.end, |end, range| {
+                    end.min(range.start.max(*byte_offset))
+                });
+            let mut length = text.len().min(end.saturating_sub(*byte_offset) as usize);
+            while !text.is_char_boundary(length) {
+                length -= 1;
+            }
+            if length == 0 {
+                break;
+            }
+            text.truncate(length);
+            let partial = *byte_offset + (text.len() as u64) < descriptor.total_bytes;
+            selected.push(entry);
+            if partial {
+                break;
+            }
+        }
+        capture.entries = selected;
+        Ok(capture)
+    }
+
+    fn journal_grant_scope(
         &self,
         snapshot: &JobSnapshot,
     ) -> Result<LocalJournalGrant, SubjektivHostError> {
@@ -1097,7 +1358,6 @@ impl LocalSubjectHost {
             || snapshot.request.purpose != PURPOSE
             || snapshot.request.serialization_key.as_deref()
                 != Some(&format!("subjektiv-journal:{}", grant.journal_id))
-            || snapshot.request.input != grant.input()
         {
             return Err(SubjektivHostError::InvalidArgument(
                 "Job input/grant does not match this Journal capability".into(),
@@ -1135,12 +1395,33 @@ impl LocalSubjectHost {
         Ok(grant)
     }
 
+    fn journal_grant(
+        &self,
+        snapshot: &JobSnapshot,
+    ) -> Result<LocalJournalGrant, SubjektivHostError> {
+        snapshot
+            .load_executable_request()
+            .map_err(|e| SubjektivHostError::InvalidArgument(e.to_string()))?;
+        let grant = self.journal_grant_scope(snapshot)?;
+        let input = JournalInput::decode(&snapshot.request.input).map_err(journal_error)?;
+        if input.subject_id != self.binding.subject_id
+            || input.journal_id != grant.journal_id
+            || input.capture.session_id != grant.session_id
+            || input.selected_ranges != grant.ranges
+        {
+            return Err(SubjektivHostError::InvalidArgument(
+                "saved Journal body identity/ranges differ from grant".into(),
+            ));
+        }
+        Ok(grant)
+    }
+
     fn complete_journal_job(
         &self,
         jobs: &crate::jobs::StandaloneJobs,
         snapshot: &JobSnapshot,
     ) -> Result<(), SubjektivHostError> {
-        let grant = self.journal_grant(snapshot)?;
+        let grant = self.journal_grant_scope(snapshot)?;
         let context = authority(self, &grant.session_id)?;
         let completion: JournalJobCompletion =
             serde_json::from_value(snapshot.result.clone().ok_or_else(|| {
@@ -1174,6 +1455,12 @@ impl LocalSubjectHost {
         }
         jobs.acknowledge(&snapshot.request.job_id)
             .map_err(service_error)?;
+        jobs.reclaim_input(
+            &snapshot.request.job_id,
+            &snapshot.input_digest,
+            JobInputRetirementReason::Completed,
+        )
+        .map_err(service_error)?;
         if let Err(error) = self.prune_retained_workers() {
             // Pruning is independent of a successful checkpoint/result. Keep the originals
             // and continue draining other saved prefixes; a retention error is not model failure.
@@ -1192,47 +1479,18 @@ pub(super) fn grant(
         .journal_grant(snapshot)
         .map_err(|error| error.to_string())?;
     let context = authority(&host, &grant.session_id).map_err(|error| error.to_string())?;
-    // Re-fetch selected identities before opening mutation authority. Only descriptors are
-    // retained in Job storage; the model must fetch actual source bytes with bounded tools.
-    for range in &grant.ranges {
-        let length = usize::try_from(
-            range
-                .bytes
-                .end
-                .checked_sub(range.bytes.start)
-                .ok_or("invalid source range")?,
-        )
-        .map_err(|_| "source range overflow")?;
-        if length > INPUT_BUDGET {
-            return Err("source range exceeds frozen input budget".into());
-        }
-        let text = host
-            .journal_source_window(&range.source, range.bytes.start, length.max(4))
-            .map_err(|error| error.to_string())?;
-        if text.len() != length {
-            return Err("frozen Journal source byte range changed".into());
-        }
-    }
-    if host
-        .journal_origins(&grant.ranges)
-        .map_err(|error| error.to_string())?
-        != grant.origins
-    {
-        return Err(
-            "frozen Journal provenance does not match the authorized original Session".into(),
-        );
-    }
+    let input = JournalInput::decode(&snapshot.request.input).map_err(|e| e.to_string())?;
+    let input_digest = snapshot.input_digest.clone();
     let generation = host
         .catalog
         .store
-        .prepare_journal_generation(
+        .prepare_journal_input(
             &context,
-            &grant.journal_id,
+            &input,
             JobAttemptBinding {
                 job_id: snapshot.request.job_id.clone(),
                 attempt_id: snapshot.attempt.attempt_id.clone(),
             },
-            grant.ranges.clone(),
         )
         .map_err(|error| error.to_string())?;
     let job_context = JournalJobContext::validated(
@@ -1242,12 +1500,17 @@ pub(super) fn grant(
         generation.job.clone(),
     )
     .map_err(|error| error.to_string())?;
+    input
+        .validate_generation(&generation)
+        .map_err(|e| e.to_string())?;
     let adapter = Arc::new(LocalJournalHost {
         host,
         grant,
         context,
         job_context,
+        #[cfg(test)]
         generation,
+        input_digest,
         fence,
     });
     Ok(worker::job::JobFeatureGrant {
@@ -1263,7 +1526,9 @@ struct LocalJournalHost {
     grant: LocalJournalGrant,
     context: JournalHostContext,
     job_context: JournalJobContext,
+    #[cfg(test)]
     generation: JournalGeneration,
+    input_digest: String,
     fence: Arc<dyn crate::jobs::JobAttemptFence>,
 }
 impl LocalJournalHost {
@@ -1296,18 +1561,20 @@ impl JournalJobHost for LocalJournalHost {
         request: JournalJobRequest,
     ) -> Result<JournalJobResponse, SubjektivHostError> {
         let context = self.live()?;
-        subjektiv::journal::service::execute_bounded(
+        // The generic runner has supplied this exact immutable input before it can
+        // invoke this bound tool. Preparation alone is not evidence of delivery.
+        subjektiv::journal::service::attest_input_delivery(
             &self.host.catalog.store,
             &context,
+            &self.input_digest,
+            &self.grant.ranges,
+        )
+        .map_err(journal_error)?;
+        subjektiv::journal::service::execute_snapshot(
+            &self.host.catalog.store,
+            &context,
+            &self.input_digest,
             request,
-            |source, start, limit| {
-                if source.session_id != self.generation.initial_journal.source_session_id {
-                    return Err(JournalError::PermissionDenied(
-                        "foreign original Session".into(),
-                    ));
-                }
-                self.host.journal_source_material(source, start, limit)
-            },
         )
         .map_err(journal_error)
     }

crates/standalone/src/subjektiv/journal/tests.rs

@@ -1,6 +1,6 @@
 //! Integration of standalone attribution, original FsStore material, shared Journal storage
 //! and the local Job adapter. Only the outer model/execution lease is replaced in these cases.
-//! The generic Job runner is exercised separately by the standalone Jobs integration suite.
+//! The scripted model also exercises saved direct input through the actual generic Job runner.
 
 use super::*;
 use crate::store::{StaleLeasePolicy, StandaloneWorkerAllocation, StandaloneWorkerStore};
@@ -144,8 +144,8 @@ impl Fixture {
                 .unwrap()
                 .contains(sentinel)
         );
-        // Include SQLite/WAL/journal files: immutable request/grant storage must never hold
-        // original text, even in freed pages left behind by explicit source erasure.
+        // Include SQLite/WAL/journal files: erasure must scrub retired original bodies,
+        // including any freed pages or journal left by the immutable request store.
         for entry in fs::read_dir(self.connection.jobs_path.parent().unwrap()).unwrap() {
             let entry = entry.unwrap();
             if entry.file_type().unwrap().is_file() {
@@ -194,9 +194,9 @@ impl Fixture {
             context,
             job_context,
             generation,
+            input_digest: snapshot.input_digest.clone(),
             fence: fence.clone(),
         };
-        adapter.read_all_sources();
         (adapter, fence, snapshot)
     }
 }
@@ -220,37 +220,6 @@ fn message(id: &str, text: &str) -> session_store::LoggedHistoryEntry {
     }
 }
 impl LocalJournalHost {
-    fn read_all_sources(&self) {
-        for range in &self.generation.selected_ranges {
-            let mut offset = range.bytes.start as usize;
-            let mut content_token = None;
-            loop {
-                let response = self
-                    .execute(JournalJobRequest::ReadText {
-                        read: JournalTextRead {
-                            target: JournalTextTarget::Source {
-                                pointer: range.source.pointer.clone(),
-                            },
-                            offset,
-                            limit: MAX_JOURNAL_READ_BYTES,
-                            content_token: content_token.clone(),
-                        },
-                    })
-                    .unwrap();
-                let JournalJobResponse::Text(text) = response else {
-                    panic!()
-                };
-                match text.next_byte {
-                    Some(next) => {
-                        assert!(next > offset);
-                        offset = next;
-                        content_token = Some(text.content_token);
-                    }
-                    None => break,
-                }
-            }
-        }
-    }
     fn state(&self) -> Result<JournalJobState, SubjektivHostError> {
         match self.execute(JournalJobRequest::ReadState)? {
             JournalJobResponse::State(state) => Ok(state),
@@ -362,8 +331,8 @@ fn duplicate_admission_reserves_one_job_and_excludes_private_prompt() {
     assert_eq!(jobs.pending().unwrap().len(), 1);
     let input = jobs.get(&id).unwrap().request.input.to_string();
     assert!(
-        !input.contains("short request"),
-        "Job storage retains descriptors, never a second copy of original text"
+        input.contains("short request"),
+        "Job storage supplies the canonical body directly"
     );
     assert!(!input.contains("PRIVATE PROMPT"));
     let foreign = SubjektivHostContext {
@@ -498,14 +467,16 @@ fn generation_input_stays_frozen_and_next_prefix_includes_last_input() {
             &adapter.generation.job,
         )
         .unwrap();
-    let materials = fixture
+    let next = fixture
         .host()
-        .select_journal_materials(&adapter.context, &adapter.grant.journal_id)
+        .build_journal_input(&adapter.context, &adapter.grant.journal_id, None)
         .unwrap();
-    assert_eq!(materials[0].range.source.pointer.entry_ref, "Elast");
+    assert_eq!(next.selected_ranges[0].source.pointer.entry_ref, "Elast");
     assert!(
-        materials[0]
-            .text
+        next.capture
+            .recording_text(next.selected_ranges[0].source.order)
+            .unwrap()
+            .2
             .contains("last input while generation runs")
     );
 }
@@ -547,7 +518,7 @@ fn large_original_is_chunked_without_claiming_unread_suffix() {
     let (adapter, _, _) = fixture.adapter();
     let range = &adapter.grant.ranges[0];
     assert!(range.bytes.end < range.source.total_bytes);
-    assert!(range.bytes.end - range.bytes.start < INPUT_BUDGET as u64);
+    assert!(range.bytes.end - range.bytes.start < job::MAX_JOB_INPUT_BYTES as u64);
     let snapshot = fixture
         .host()
         .jobs()
@@ -557,7 +528,7 @@ fn large_original_is_chunked_without_claiming_unread_suffix() {
         .pop()
         .unwrap();
     assert!(serde_json::to_vec(&snapshot.request.input).unwrap().len() < 128 * 1024);
-    assert!(!snapshot.request.input.to_string().contains("漢字"));
+    assert!(snapshot.request.input.to_string().contains("漢字"));
     assert!(adapter.finish().is_err());
 }
 
@@ -628,43 +599,35 @@ impl JournalScript {
             )
         } else if let Some(state) = result("state") {
             let state = &state["value"];
-            for (index, range) in state["selected_ranges"]
-                .as_array()
-                .unwrap()
+            let input: serde_json::Value = request
+                .items
                 .iter()
-                .enumerate()
-            {
-                let mut offset = range["bytes"]["start"].as_u64().unwrap();
-                let mut token = Value::Null;
-                loop {
-                    let id = format!("source-{index}-{offset}");
-                    if let Some(page) = result(&id) {
-                        let page = &page["value"];
-                        let key = format!("{}:{id}", state["generation_id"].as_str().unwrap());
-                        let text = page["text"].as_str().unwrap().to_owned();
-                        if let Some(previous) =
-                            self.source_reads.lock().unwrap().insert(key, text.clone())
-                        {
-                            assert_eq!(
-                                previous, text,
-                                "frozen source read changed within a generation"
-                            );
-                        }
-                        if let Some(next) = page["next_byte"].as_u64() {
-                            assert!(next > offset);
-                            offset = next;
-                            token = page["content_token"].clone();
-                        } else {
-                            break;
-                        }
-                    } else {
-                        let input = json!({"target":{"target":"source","pointer":range["source"]["pointer"]},"offset":offset,"limit":MAX_JOURNAL_READ_BYTES,"content_token":token});
-                        return vec![
-                            Event::tool_use_start(0, &id, "ReadJournalText"),
-                            Event::tool_input_delta(0, input.to_string()),
-                            Event::tool_use_stop(0),
-                        ];
-                    }
+                .filter_map(Item::as_text)
+                .find_map(|text| {
+                    text.lines()
+                        .find_map(|line| line.strip_prefix("input_json: "))
+                })
+                .map(|json| serde_json::from_str(json).unwrap())
+                .expect("direct saved Journal input");
+            let input = JournalInput::decode(&input).unwrap();
+            assert_eq!(
+                serde_json::to_value(&input.selected_ranges).unwrap(),
+                state["selected_ranges"]
+            );
+            for entry in &input.capture.entries {
+                let (_, offset, text) = input.capture.recording_text(entry.order).unwrap();
+                let key = format!(
+                    "{}:{}:{offset}",
+                    state["generation_id"].as_str().unwrap(),
+                    entry.order
+                );
+                if let Some(previous) = self
+                    .source_reads
+                    .lock()
+                    .unwrap()
+                    .insert(key, text.to_owned())
+                {
+                    assert_eq!(previous, text, "saved source changed within generation");
                 }
             }
             let (name, action) = if state["current_open"].is_null() {
@@ -1166,6 +1129,11 @@ async fn shutdown_reopen_reconciles_partial_saved_operations_without_duplicate_c
         .items;
     assert_eq!(entries.len(), 1);
     let saved_entry = entries[0].id.clone();
+    let original_input = jobs.get(&id).unwrap().request.input;
+    fixture.append(
+        "newer-than-snapshot",
+        "NEW INPUT MUST NOT MIX INTO RESUMED SNAPSHOT",
+    );
     jobs.shutdown().await.unwrap();
     fixture.connection.close().unwrap();
     let mut reopened = StandaloneSubjects::open_existing(&state)
@@ -1176,8 +1144,29 @@ async fn shutdown_reopen_reconciles_partial_saved_operations_without_duplicate_c
         .unwrap();
     reopened.host.bind_jobs(jobs.clone()).unwrap();
     assert_eq!(jobs.get(&id).unwrap().state, JobState::Unknown);
-    // Domain reconciliation inspects the now-fenced prior attempt and preserves its receipts.
+    // Deny every original-source read while preparing and running the replacement.
+    let source_path = fixture
+        .sessions
+        .root_dir()
+        .join(&fixture.context.session_id);
+    let denied = fixture
+        ._temp
+        .path()
+        .join("temporarily-unavailable-original");
+    fs::rename(&source_path, &denied).unwrap();
     let (_, replacement) = reopened.host.next_journal_job().unwrap().unwrap();
+    let replacement_input = jobs.get(&replacement).unwrap().request.input;
+    assert_eq!(replacement_input["capture"], original_input["capture"]);
+    assert!(
+        !replacement_input
+            .to_string()
+            .contains("NEW INPUT MUST NOT MIX")
+    );
+    assert_eq!(jobs.get(&id).unwrap().request.input, original_input);
+    assert_eq!(
+        jobs.get(&id).unwrap().input_disposition,
+        JobInputDisposition::Available
+    );
     assert_ne!(
         replacement, id,
         "unknown external execution is not blindly replayed"
@@ -1205,8 +1194,26 @@ async fn shutdown_reopen_reconciles_partial_saved_operations_without_duplicate_c
         .items;
     assert_eq!(entries.len(), 1);
     assert_eq!(entries[0].id, saved_entry);
+    fs::rename(&denied, &source_path).unwrap();
+    let journal = reopened
+        .host
+        .catalog
+        .store
+        .read_journal(&context, &journal_id)
+        .unwrap();
+    let original = JournalInput::decode(&original_input).unwrap();
+    let end = original.selected_ranges.last().unwrap();
+    assert_eq!(
+        (journal.process_order, journal.process_byte),
+        if end.bytes.end == end.source.total_bytes {
+            (end.source.order + 1, 0)
+        } else {
+            (end.source.order, end.bytes.end)
+        }
+    );
+    assert!(reopened.host.admit_journal(&fixture.context).unwrap());
     assert!(
-        reopened
+        !reopened
             .host
             .session_fully_reflected(&fixture.context.session_id)
             .unwrap()
@@ -1302,9 +1309,9 @@ fn missing_original_material_blocks_worker_removal_without_erasing_state() {
 }
 
 #[test]
-fn frozen_original_remains_readable_after_worker_switches_its_active_session() {
+fn frozen_input_survives_active_session_change_and_source_tool_remains_refused() {
     let fixture = Fixture::new("old Session original");
-    let (adapter, _, _) = fixture.adapter();
+    let (adapter, _, snapshot) = fixture.adapter();
     let workers = StandaloneWorkerStore::open_existing(&fixture.host().catalog.state_root).unwrap();
     let worker = fixture._allocation.as_ref().unwrap().worker_id();
     let record = workers.load(worker).unwrap();
@@ -1318,22 +1325,30 @@ fn frozen_original_remains_readable_after_worker_switches_its_active_session() {
             )),
         ))
         .unwrap();
-    let response = adapter
-        .execute(JournalJobRequest::ReadText {
-            read: JournalTextRead {
-                target: JournalTextTarget::Source {
-                    pointer: adapter.generation.selected_ranges[0].source.pointer.clone(),
-                },
-                offset: 0,
-                limit: MAX_JOURNAL_READ_BYTES,
-                content_token: None,
-            },
-        })
-        .unwrap();
-    let JournalJobResponse::Text(page) = response else {
-        panic!()
-    };
-    assert!(page.text.contains("old Session original"));
+    assert!(
+        adapter
+            .execute(JournalJobRequest::ReadText {
+                read: JournalTextRead {
+                    target: JournalTextTarget::Source {
+                        pointer: adapter.generation.selected_ranges[0].source.pointer.clone()
+                    },
+                    offset: 0,
+                    limit: MAX_JOURNAL_READ_BYTES,
+                    content_token: None
+                }
+            })
+            .is_err(),
+        "original Source lookup is explicitly unavailable"
+    );
+    let input = JournalInput::decode(&snapshot.request.input).unwrap();
+    assert!(
+        input
+            .capture
+            .recording_text(0)
+            .unwrap()
+            .2
+            .contains("old Session original")
+    );
     assert!(
         fixture
             .host()
@@ -1512,14 +1527,18 @@ fn relocated_erasure_fences_old_and_retained_readers_publishers_and_late_pins()
     const SENTINEL: &str = "original-plaintext-sentinel-must-never-enter-immutable-job-storage";
     let mut fixture = Fixture::new(SENTINEL);
     let (_, _, snapshot) = fixture.adapter();
-    fixture.assert_job_storage_excludes(&snapshot, SENTINEL);
+    assert!(snapshot.request.input.to_string().contains(SENTINEL));
     let state = fixture.host().catalog.state_root.clone();
     let binding = fixture.connection.binding.clone();
     let session: session_store::SessionId = fixture.context.session_id.parse().unwrap();
-    let old_reader = fixture
-        .host()
-        .material_reader(&fixture.context.session_id)
-        .unwrap();
+    let old_reader = SessionPublicMaterialReader::open_fs_with_retention(
+        fixture.sessions.root_dir(),
+        session,
+        fixture.segment,
+        PublicMaterialLimits::default(),
+        crate::store::session_retention(&state),
+    )
+    .unwrap();
     let descriptor = old_reader.descriptors().next().unwrap().clone();
     let (worker, workers) = fixture.stop_worker();
     assert!(workers.delete(worker).is_err());
@@ -1759,14 +1778,12 @@ async fn late_terminal_boundary_after_reflected_task_prefix_is_read_by_next_job(
     let snapshot = jobs.get(&next).unwrap();
     let grant = fixture.host().journal_grant(&snapshot).unwrap();
     assert_eq!(grant.ranges.len(), 1);
-    assert_eq!(
-        grant.origins[0].origin,
-        PublicMaterialOrigin::HostRunBoundary
-    );
-    let content = fixture
-        .host()
-        .journal_source_window(&grant.ranges[0].source, 0, 4096)
+    let input = JournalInput::decode(&snapshot.request.input).unwrap();
+    let (descriptor, _, content) = input
+        .capture
+        .recording_text(grant.ranges[0].source.order)
         .unwrap();
+    assert_eq!(descriptor.origin, PublicMaterialOrigin::HostRunBoundary);
     let value: serde_json::Value = serde_json::from_str(&content).unwrap();
     assert_eq!(value["kind"], "run_boundary");
     assert_eq!(value["boundary"]["kind"], "errored");
@@ -1791,3 +1808,621 @@ async fn late_terminal_boundary_after_reflected_task_prefix_is_read_by_next_job(
     assert!(fixture.host().next_journal_job().unwrap().is_none());
     jobs.shutdown().await.unwrap();
 }
+
+/// Original FsStore -> bounded common capture -> persisted Job -> actual generic runner ->
+/// sequential Journal tools. Only the LLM transport is scripted. Source files are deliberately
+/// unavailable after persistence, and input bodies are inspected in the provider request.
+#[tokio::test]
+async fn saved_body_jobs_process_over_a_hundred_entries_and_utf8_without_live_source_reads() {
+    let fixture = Fixture::new("oldest original");
+    for index in 0..115 {
+        fixture.append(
+            &format!("entry-{index}"),
+            &format!("public original {index}"),
+        );
+    }
+    fixture.append("long-utf8", &"漢字🙂\n\"".repeat(24_000));
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    let expected = fixture
+        .host()
+        .recording_capture(&fixture.context.session_id)
+        .unwrap();
+    let source_path = fixture
+        .sessions
+        .root_dir()
+        .join(&fixture.context.session_id);
+    let denied = fixture._temp.path().join("denied-original-source");
+    let mut seen: std::collections::BTreeMap<u64, String> = Default::default();
+    let mut jobs_processed = 0;
+    loop {
+        let Some((jobs, id)) = fixture.host().next_journal_job().unwrap() else {
+            break;
+        };
+        let saved = jobs.get(&id).unwrap();
+        let input = JournalInput::decode(&saved.request.input).unwrap();
+        assert!(
+            serde_json::to_vec(&saved.request.input).unwrap().len() <= job::MAX_JOB_INPUT_BYTES
+        );
+        assert!(input.capture.entries.len() <= MAX_JOURNAL_RANGES);
+        for entry in &input.capture.entries {
+            let (_, offset, text) = input.capture.recording_text(entry.order).unwrap();
+            let previous = seen.entry(entry.order).or_default();
+            assert_eq!(
+                previous.len() as u64,
+                offset,
+                "no gap, preview or duplicate prefix"
+            );
+            previous.push_str(text);
+        }
+        // Deny all catalogs/reads, including grant preparation. The model still receives
+        // exactly the persisted body, and the Host must not follow the active pointer.
+        fs::rename(&source_path, &denied).unwrap();
+        let model = JournalScript::default();
+        jobs.start_with_model_client(&id, model.clone())
+            .await
+            .unwrap();
+        let result = tokio::time::timeout(std::time::Duration::from_secs(20), jobs.wait(&id))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(result.state, JobState::Completed);
+        assert!(
+            !model.source_reads.lock().unwrap().is_empty(),
+            "provider saw saved source bodies"
+        );
+        fixture.host().complete_journal_job(&jobs, &result).unwrap();
+        assert_eq!(
+            jobs.get(&id).unwrap().input_disposition,
+            JobInputDisposition::Reclaimed
+        );
+        fs::rename(&denied, &source_path).unwrap();
+        jobs_processed += 1;
+        assert!(jobs_processed < 20, "bounded prefix drain must progress");
+    }
+    assert!(
+        jobs_processed > 2,
+        "entry count and long text both require continuation"
+    );
+    assert_eq!(seen.len(), expected.entries.len());
+    for entry in &expected.entries {
+        assert_eq!(
+            seen[&entry.order],
+            expected.recording_text(entry.order).unwrap().2
+        );
+    }
+    fixture.host().jobs().unwrap().shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn descriptor_job_migrates_to_new_identity_preserving_input_and_successful_records() {
+    let fixture = Fixture::new("original descriptor-only input");
+    let (adapter, _, modern) = fixture.adapter();
+    let jobs = fixture.host().jobs().unwrap();
+    fixture
+        .host()
+        .catalog
+        .store
+        .close_journal_generation(
+            &adapter.context,
+            &adapter.generation.id,
+            &adapter.generation.job,
+        )
+        .unwrap();
+    jobs.cancel(&modern.request.job_id).unwrap();
+    let input = JournalInput::decode(&modern.request.input).unwrap();
+    let origins: Vec<_> = input
+        .capture
+        .entries
+        .iter()
+        .map(|entry| {
+            let (descriptor, _, _) = input.capture.recording_text(entry.order).unwrap();
+            SourceOrigin {
+                pointer: source_descriptor(&fixture.context.session_id, descriptor).pointer,
+                origin: descriptor.origin.clone(),
+            }
+        })
+        .collect();
+    let mut old_grant = adapter.grant.clone();
+    old_grant.origins = origins;
+    old_grant.writer_binding_id = None;
+    let mut request = modern.request.clone();
+    request.job_id = format!("legacy-descriptor:{}", uuid::Uuid::now_v7());
+    request.input =
+        serde_json::json!({"selected_ranges":old_grant.ranges,"origins":old_grant.origins});
+    let old = jobs
+        .request_granted(request, serde_json::to_value(&old_grant).unwrap())
+        .unwrap();
+    assert!(
+        fixture.host().journal_grant(&old).is_err(),
+        "descriptor jobs must not execute as snapshots"
+    );
+    let generation = fixture
+        .host()
+        .catalog
+        .store
+        .prepare_journal_generation(
+            &adapter.context,
+            &old_grant.journal_id,
+            JobAttemptBinding {
+                job_id: old.request.job_id.clone(),
+                attempt_id: old.attempt.attempt_id.clone(),
+            },
+            old_grant.ranges.clone(),
+        )
+        .unwrap();
+    let context = JournalJobContext::validated(
+        &fixture.host().catalog.store,
+        &adapter.context,
+        &generation.id,
+        generation.job.clone(),
+    )
+    .unwrap();
+    let saved = fixture
+        .host()
+        .catalog
+        .store
+        .execute_journal(
+            &context,
+            JournalOperation {
+                request_id: "legacy-record-success-response-lost".into(),
+                expected_state: generation.initial_journal.state_token.clone(),
+                action: JournalAction::Create {
+                    title: "already saved".into(),
+                    body: "legacy successful operation".into(),
+                    ongoing: "unfinished".into(),
+                    state: JournalEntryState::Open,
+                    source_end: None,
+                    correction_refs: vec![],
+                },
+                covered_ranges: generation.selected_ranges.clone(),
+            },
+        )
+        .unwrap();
+    fixture.append(
+        "new-not-selected",
+        "LATEST SOURCE MUST WAIT UNTIL OLD INPUT FINISHES",
+    );
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    let (_, next) = fixture.host().next_journal_job().unwrap().unwrap();
+    assert_ne!(next, old.request.job_id);
+    let replacement = jobs.get(&next).unwrap();
+    let replacement_input = JournalInput::decode(&replacement.request.input).unwrap();
+    assert!(
+        !replacement
+            .request
+            .input
+            .to_string()
+            .contains("LATEST SOURCE MUST WAIT")
+    );
+    assert_eq!(replacement_input.selected_ranges, old_grant.ranges);
+    let retired = jobs.get(&old.request.job_id).unwrap();
+    assert_eq!(retired.input_disposition, JobInputDisposition::Invalidated);
+    assert_eq!(retired.input_digest, old.input_digest);
+    assert_eq!(retired.intent_fingerprint, old.intent_fingerprint);
+    assert!(retired.request.input.is_null());
+    assert!(
+        fixture
+            .host()
+            .catalog
+            .store
+            .execute_journal(
+                &context,
+                JournalOperation {
+                    request_id: "legacy-delayed".into(),
+                    expected_state: saved.state_token,
+                    action: JournalAction::ConfirmUnchanged,
+                    covered_ranges: old_grant.ranges,
+                }
+            )
+            .is_err()
+    );
+    jobs.start_with_model_client(&next, JournalScript::default())
+        .await
+        .unwrap();
+    let completed = tokio::time::timeout(std::time::Duration::from_secs(20), jobs.wait(&next))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(completed.state, JobState::Completed);
+    fixture
+        .host()
+        .complete_journal_job(&jobs, &completed)
+        .unwrap();
+    let entries = fixture
+        .host()
+        .catalog
+        .store
+        .list_journal_entries(&adapter.context, &adapter.grant.journal_id, None, 32)
+        .unwrap();
+    assert_eq!(entries.items.len(), 1);
+    assert_eq!(entries.items[0].id, saved.entry_id.unwrap());
+    jobs.shutdown().await.unwrap();
+}
+
+#[test]
+fn explicit_erase_retires_every_historical_body_across_job_history_pages() {
+    const SENTINEL: &str = "historical-input-erasure-sentinel-781";
+    let mut fixture = Fixture::new("ordinary original");
+    let (adapter, _, first) = fixture.adapter();
+    let jobs = fixture.host().jobs().unwrap();
+    for index in 0..105 {
+        let mut request = first.request.clone();
+        request.job_id = format!("historical-{index:03}");
+        request.purpose = "historical-other-domain-job".into();
+        request.serialization_key = None;
+        request.input = serde_json::json!({"body":SENTINEL, "index":index});
+        let saved = jobs
+            .request_granted(
+                request,
+                serde_json::json!({"session_id":fixture.context.session_id}),
+            )
+            .unwrap();
+        jobs.cancel(&saved.request.job_id).unwrap();
+    }
+    let state = fixture.host().catalog.state_root.clone();
+    let subject = fixture.connection.binding.subject_id.clone();
+    fixture.connection.close().unwrap();
+    StandaloneSubjects::open_existing(&state)
+        .unwrap()
+        .erase_session_completely(&subject, &fixture.context.session_id, "erase-all-history")
+        .unwrap();
+    let jobs = crate::jobs::StandaloneJobs::open(
+        &fixture.connection.jobs_path,
+        fixture._temp.path().into(),
+    )
+    .unwrap();
+    let mut after = None;
+    let mut count = 0;
+    loop {
+        let page = jobs
+            .list_session_snapshots(&fixture.context.session_id, after.as_deref(), 100)
+            .unwrap();
+        if page.is_empty() {
+            break;
+        }
+        for saved in &page {
+            assert_eq!(saved.input_disposition, JobInputDisposition::Erased);
+            assert!(saved.request.input.is_null());
+            assert!(saved.load_executable_request().is_err());
+        }
+        count += page.len();
+        after = page.last().map(|job| job.request.job_id.clone());
+    }
+    assert_eq!(count, 106);
+    assert!(
+        adapter.execute(JournalJobRequest::ReadState).is_err(),
+        "prepared local adapter is invalidated"
+    );
+    fixture.assert_job_storage_excludes(&jobs.get(&first.request.job_id).unwrap(), SENTINEL);
+}
+
+#[test]
+fn saved_snapshot_missing_tampered_foreign_or_changed_initial_state_is_not_recaptured() {
+    let fixture = Fixture::new("saved immutable original");
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    let (jobs, id) = fixture.host().next_journal_job().unwrap().unwrap();
+    let saved = jobs.get(&id).unwrap();
+    for changed in [serde_json::Value::Null, serde_json::json!({"capture":{}})] {
+        let mut malformed = saved.clone();
+        malformed.request.input = changed;
+        assert!(fixture.host().journal_grant(&malformed).is_err());
+    }
+    let original = JournalInput::decode(&saved.request.input).unwrap();
+    for field in ["subject_id", "journal_id", "initial_state_token"] {
+        let mut changed = saved.request.clone();
+        changed.job_id = format!("changed-{field}");
+        changed.serialization_key = None;
+        changed.input[field] = serde_json::json!("foreign-or-altered");
+        // Even a separately reserved immutable Job may not adopt the original capability.
+        let changed = jobs
+            .request_granted(changed, saved.domain_grant.clone().unwrap())
+            .unwrap();
+        assert!(
+            grant(
+                fixture.host().clone(),
+                &changed,
+                Arc::new(TestFence(AtomicBool::new(true)))
+            )
+            .is_err()
+        );
+    }
+    let mut generation = fixture
+        .host()
+        .catalog
+        .store
+        .prepare_journal_generation(
+            &authority(fixture.host(), &fixture.context.session_id).unwrap(),
+            &original.journal_id,
+            JobAttemptBinding {
+                job_id: id,
+                attempt_id: saved.attempt.attempt_id.clone(),
+            },
+            original.selected_ranges.clone(),
+        )
+        .unwrap();
+    generation.initial_journal.state_token = "changed-after-snapshot".into();
+    assert!(original.validate_generation(&generation).is_err());
+    assert_eq!(
+        saved.request.input,
+        jobs.get(&saved.request.job_id).unwrap().request.input
+    );
+}
+
+#[tokio::test]
+async fn append_between_admission_and_body_capture_does_not_publish_unaccepted_input() {
+    let fixture = Fixture::new("accepted oldest prefix");
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    fixture.append("not-yet-admitted", "newly saved but not accepted");
+    let (jobs, id) = fixture.host().next_journal_job().unwrap().unwrap();
+    let input = jobs.get(&id).unwrap().request.input;
+    assert!(input.to_string().contains("accepted oldest prefix"));
+    assert!(!input.to_string().contains("newly saved but not accepted"));
+    jobs.start_with_model_client(&id, JournalScript::default())
+        .await
+        .unwrap();
+    let completed = tokio::time::timeout(std::time::Duration::from_secs(20), jobs.wait(&id))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(completed.state, JobState::Completed);
+    fixture
+        .host()
+        .complete_journal_job(&jobs, &completed)
+        .unwrap();
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    let (_, next) = fixture.host().next_journal_job().unwrap().unwrap();
+    let remaining = jobs.get(&next).unwrap().request.input;
+    assert!(
+        remaining
+            .to_string()
+            .contains("newly saved but not accepted")
+    );
+    assert!(!remaining.to_string().contains("accepted oldest prefix"));
+    jobs.shutdown().await.unwrap();
+}
+
+/// Generic Job preparation must not attest delivery. The saved body is supplied by the
+/// runner before a bound Journal tool may execute; no model-provided digest is trusted.
+#[tokio::test]
+async fn actual_bound_tool_attests_delivery_but_prepared_blocked_job_does_not() {
+    let fixture = Fixture::new("body delivered through generic runner");
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    let (jobs, id) = fixture.host().next_journal_job().unwrap().unwrap();
+    let saved = jobs.get(&id).unwrap();
+    let model = JournalScript {
+        gate_first: true,
+        pause_after_record: true,
+        ..Default::default()
+    };
+    jobs.start_with_model_client(&id, model.clone())
+        .await
+        .unwrap();
+    tokio::time::timeout(std::time::Duration::from_secs(20), model.entered.notified())
+        .await
+        .unwrap();
+    let host_context = authority(fixture.host(), &fixture.context.session_id).unwrap();
+    let journal_id = fixture
+        .host()
+        .catalog
+        .store
+        .journal_for_session(&host_context)
+        .unwrap()
+        .unwrap();
+    let generation = fixture
+        .host()
+        .catalog
+        .store
+        .active_journal_generation(&host_context, &journal_id)
+        .unwrap()
+        .unwrap();
+    let context = JournalJobContext::validated(
+        &fixture.host().catalog.store,
+        &host_context,
+        &generation.id,
+        generation.job.clone(),
+    )
+    .unwrap();
+    let undelivered = subjektiv::journal::service::execute_snapshot(
+        &fixture.host().catalog.store,
+        &context,
+        &saved.input_digest,
+        JournalJobRequest::ReadState,
+    )
+    .unwrap_err();
+    assert!(
+        undelivered.to_string().contains("delivery"),
+        "prepared grant must not satisfy delivery gate: {undelivered}"
+    );
+    let before = fixture
+        .host()
+        .catalog
+        .store
+        .read_journal(&host_context, &journal_id)
+        .unwrap();
+    assert_eq!((before.process_order, before.process_byte), (0, 0));
+    model.release.notify_one();
+    tokio::time::timeout(
+        std::time::Duration::from_secs(20),
+        model.record_saved.notified(),
+    )
+    .await
+    .unwrap();
+    assert!(
+        subjektiv::journal::service::execute_snapshot(
+            &fixture.host().catalog.store,
+            &context,
+            &saved.input_digest,
+            JournalJobRequest::ReadState
+        )
+        .is_ok(),
+        "actual bound tool execution attests exact saved input"
+    );
+    model.release.notify_one();
+    let completed = tokio::time::timeout(std::time::Duration::from_secs(20), jobs.wait(&id))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(completed.state, JobState::Completed);
+    fixture
+        .host()
+        .complete_journal_job(&jobs, &completed)
+        .unwrap();
+    jobs.shutdown().await.unwrap();
+}
+
+#[derive(Clone, Default)]
+struct BlockedJournalRequest {
+    entered: Arc<tokio::sync::Notify>,
+    dropped: Arc<tokio::sync::Notify>,
+    request_dropped: Arc<AtomicBool>,
+}
+struct OwnedBlockedJournalRequest {
+    // A local request copy, including the saved input, must be dropped before erasure
+    // can acquire the lease. This does not claim remote/provider bytes are retractable.
+    _request: agen::llm_client::Request,
+    model: BlockedJournalRequest,
+}
+impl Drop for OwnedBlockedJournalRequest {
+    fn drop(&mut self) {
+        self.model.request_dropped.store(true, Ordering::Release);
+        self.model.dropped.notify_one();
+    }
+}
+#[async_trait::async_trait]
+impl agen::llm_client::LlmClient for BlockedJournalRequest {
+    async fn stream(
+        &self,
+        request: agen::llm_client::Request,
+    ) -> Result<
+        std::pin::Pin<
+            Box<
+                dyn futures::Stream<
+                        Item = Result<
+                            agen::llm_client::event::Event,
+                            agen::llm_client::error::ClientError,
+                        >,
+                    > + Send,
+            >,
+        >,
+        agen::llm_client::error::ClientError,
+    > {
+        let owned = OwnedBlockedJournalRequest {
+            _request: request,
+            model: self.clone(),
+        };
+        assert!(
+            owned
+                ._request
+                .items
+                .iter()
+                .filter_map(agen::llm_client::types::Item::as_text)
+                .any(|text| text.contains("local blocked source body"))
+        );
+        self.entered.notify_one();
+        std::future::pending::<()>().await;
+        drop(owned);
+        unreachable!()
+    }
+    fn clone_boxed(&self) -> Box<dyn agen::llm_client::LlmClient> {
+        Box::new(self.clone())
+    }
+}
+
+/// Real generic Jobs and a retained public handle, with only the provider transport blocked.
+/// Connection close must initiate cancellation and preserve the exclusive lease until local
+/// request/history ownership is gone (or return an explicit incomplete barrier).
+#[tokio::test]
+async fn close_cancels_retained_local_job_before_erase_can_acquire_exclusive_lease() {
+    let mut fixture = Fixture::new("local blocked source body");
+    fixture.host().admit_journal(&fixture.context).unwrap();
+    let (jobs, id) = fixture.host().next_journal_job().unwrap().unwrap();
+    let retained = jobs.clone();
+    let model = BlockedJournalRequest::default();
+    retained
+        .start_with_model_client(&id, model.clone())
+        .await
+        .unwrap();
+    tokio::time::timeout(std::time::Duration::from_secs(20), model.entered.notified())
+        .await
+        .unwrap();
+    let state = fixture.host().catalog.state_root.clone();
+    let subject = fixture.connection.binding.subject_id.clone();
+    let close_error = fixture.connection.close().unwrap_err();
+    assert!(matches!(
+        close_error,
+        SubjectError::JobShutdown(crate::jobs::JobServiceError::ShutdownIncomplete)
+    ));
+    assert!(fixture.connection.lease.is_some());
+    assert!(fixture.host().jobs.lock().unwrap().is_some());
+    assert!(matches!(
+        retained.start(&id).await,
+        Err(crate::jobs::JobServiceError::Closed)
+    ));
+    let locally_dropped_before_erase = model.request_dropped.load(Ordering::Acquire);
+    let early_erasure = StandaloneSubjects::open_existing(&state)
+        .unwrap()
+        .erase_session_completely(
+            &subject,
+            &fixture.context.session_id,
+            "erase-blocked-local-run",
+        );
+    let early_lease_was_retained = matches!(early_erasure, Err(SubjectError::Active(_)));
+    let teardown_from_close = model.request_dropped.load(Ordering::Acquire)
+        || tokio::time::timeout(std::time::Duration::from_secs(5), model.dropped.notified())
+            .await
+            .is_ok();
+    // Always tear down before asserting the observed violation, so a failed regression
+    // cannot leak the blocked model future into another test.
+    let _ = retained.shutdown().await;
+    assert!(model.request_dropped.load(Ordering::Acquire));
+    fixture.connection.close().unwrap();
+    assert!(fixture.connection.lease.is_none());
+    assert!(fixture.host().jobs.lock().unwrap().is_none());
+    // Cancellation is not completion/erasure. Reopening retains the same unknown
+    // attempt's immutable body until the explicit erasure transaction retires it.
+    let reopened = crate::jobs::StandaloneJobs::open(
+        &fixture.connection.jobs_path,
+        fixture._temp.path().into(),
+    )
+    .unwrap();
+    let unknown = reopened.get(&id).unwrap();
+    assert_eq!(unknown.attempt.state, crate::jobs::JobAttemptState::Unknown);
+    assert_eq!(unknown.input_disposition, JobInputDisposition::Available);
+    assert!(
+        unknown
+            .request
+            .input
+            .to_string()
+            .contains("local blocked source body")
+    );
+    reopened.shutdown().await.unwrap();
+    StandaloneSubjects::open_existing(&state)
+        .unwrap()
+        .erase_session_completely(
+            &subject,
+            &fixture.context.session_id,
+            "erase-blocked-local-run",
+        )
+        .unwrap();
+    let erased_store = crate::jobs::StandaloneJobs::open(
+        &fixture.connection.jobs_path,
+        fixture._temp.path().into(),
+    )
+    .unwrap();
+    let erased = erased_store.get(&id).unwrap();
+    assert_eq!(erased.input_disposition, JobInputDisposition::Erased);
+    fixture.assert_job_storage_excludes(&erased, "local blocked source body");
+    erased_store.shutdown().await.unwrap();
+    assert!(
+        locally_dropped_before_erase || early_lease_was_retained,
+        "close released exclusive lease while a retained generic Job still owned local input/history"
+    );
+    assert!(
+        teardown_from_close,
+        "connection close did not initiate cancellation of the externally retained local Job"
+    );
+    assert!(
+        retained.get(&id).is_err(),
+        "retained handles are closed after teardown"
+    );
+}

crates/standalone/src/subjektiv/journal/tests/connected_compaction.rs

@@ -127,7 +127,6 @@ async fn local_host_compaction_freezes_pending_journal_through_request_and_durab
             worker::WorkerWorkspaceContext::no_workspace(),
             worker::WorkerFilesystemAuthority::None,
             worker::WorkerBootstrapLayout::Direct { runtime_base: fixture._temp.path().join("runtime") },
-            worker::WorkerControllerTransport::InProcess,
         ).with_model_client(model.clone()).with_subjektiv_host(fixture.host().clone()).prepare_restored("journal-test").await.unwrap();
         assert_eq!(prepared.worker().session_id().to_string(), fixture.context.session_id);
         let source_segment = prepared.worker().segment_id();

crates/standalone/src/unix.rs

@@ -0,0 +1,296 @@
+//! Optional operator transport owned by the Standalone Host, never by a Worker.
+//!
+//! The endpoint's existing parent must be private to the current Unix user. Binding never
+//! removes an existing entry, including stale sockets. Recovery is an explicit operator action.
+//! Peers must have that same uid; admitted methods still cross the normal local protocol
+//! authorization boundary. Disconnect only drops a view, not the Host or its execution lease.
+
+use std::io;
+use std::os::unix::fs::{FileTypeExt, MetadataExt, PermissionsExt};
+use std::path::{Path, PathBuf};
+
+use client::transport::Socket;
+use protocol::stream::{JsonLineWriter, decode_event, decode_method};
+use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::net::{UnixListener, UnixStream};
+use tokio::sync::oneshot;
+use tokio::task::{JoinHandle, JoinSet};
+
+/// A bound endpoint reservation. Drop removes only the exact socket created by this bind.
+/// It can be reserved before starting a Host, so bind failures do not allocate Workers.
+pub struct UnixEndpoint {
+    listener: UnixListener,
+    path: PathBuf,
+    device: u64,
+    inode: u64,
+}
+
+impl UnixEndpoint {
+    pub fn bind(path: impl AsRef<Path>) -> io::Result<Self> {
+        let path = path.as_ref();
+        let name = path.file_name().ok_or_else(|| {
+            io::Error::new(io::ErrorKind::InvalidInput, "endpoint requires a filename")
+        })?;
+        let parent = std::fs::canonicalize(
+            path.parent()
+                .filter(|p| !p.as_os_str().is_empty())
+                .unwrap_or(Path::new(".")),
+        )?;
+        let metadata = std::fs::metadata(&parent)?;
+        // SAFETY: geteuid has no preconditions and does not mutate process identity.
+        let uid = unsafe { libc::geteuid() };
+        if !metadata.is_dir() || metadata.uid() != uid || metadata.mode() & 0o077 != 0 {
+            return Err(io::Error::new(
+                io::ErrorKind::PermissionDenied,
+                "endpoint parent must be a current-user-owned private directory (mode 0700)",
+            ));
+        }
+        let path = parent.join(name);
+        let listener = UnixListener::bind(&path)?;
+        let metadata = std::fs::symlink_metadata(&path)?;
+        let endpoint = Self {
+            listener,
+            path,
+            device: metadata.dev(),
+            inode: metadata.ino(),
+        };
+        std::fs::set_permissions(&endpoint.path, std::fs::Permissions::from_mode(0o600))?;
+        Ok(endpoint)
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+}
+
+impl Drop for UnixEndpoint {
+    fn drop(&mut self) {
+        if let Ok(current) = std::fs::symlink_metadata(&self.path)
+            && current.file_type().is_socket()
+            && current.dev() == self.device
+            && current.ino() == self.inode
+        {
+            let _ = std::fs::remove_file(&self.path);
+        }
+    }
+}
+
+pub(crate) struct UnixAdapter {
+    task: Option<JoinHandle<io::Result<()>>>,
+    stop: Option<oneshot::Sender<()>>,
+}
+
+impl UnixAdapter {
+    pub(crate) fn start(endpoint: UnixEndpoint, handle: worker::WorkerHandle) -> Self {
+        let (stop, mut stopped) = oneshot::channel();
+        let task = tokio::spawn(async move {
+            let mut connections = JoinSet::new();
+            let result = loop {
+                tokio::select! {
+                    _ = &mut stopped => break Ok(()),
+                    accepted = endpoint.listener.accept(), if connections.len() < 64 => {
+                        match accepted {
+                            Ok((stream, _)) => {
+                                // The filesystem gate protects connection establishment; credentials
+                                // also fence open connections to the Host's operator identity.
+                                let allowed = stream.peer_cred().is_ok_and(|cred| {
+                                    // SAFETY: geteuid has no preconditions.
+                                    cred.uid() == unsafe { libc::geteuid() }
+                                });
+                                if allowed {
+                                    let socket = crate::host::connect_protocol(handle.clone());
+                                    connections.spawn(bridge(stream, socket));
+                                }
+                            }
+                            Err(error) => break Err(error),
+                        }
+                    }
+                    _ = connections.join_next(), if !connections.is_empty() => {}
+                }
+            };
+            connections.shutdown().await;
+            // Keep the bound endpoint alive until every connection has been reclaimed.
+            drop(endpoint);
+            result
+        });
+        Self {
+            task: Some(task),
+            stop: Some(stop),
+        }
+    }
+
+    pub(crate) async fn ended(&mut self) -> io::Result<()> {
+        let result = self.task.as_mut().expect("adapter task").await;
+        self.task.take();
+        result.map_err(io::Error::other)?
+    }
+
+    pub(crate) async fn shutdown(mut self) -> io::Result<()> {
+        if let Some(stop) = self.stop.take() {
+            let _ = stop.send(());
+        }
+        if self.task.is_some() {
+            self.ended().await?;
+        }
+        Ok(())
+    }
+}
+
+impl Drop for UnixAdapter {
+    fn drop(&mut self) {
+        if let Some(stop) = self.stop.take() {
+            let _ = stop.send(());
+        }
+        // Sending stop lets the task join its connection set and drop its endpoint.
+        // A Host dropped without confirmed shutdown keeps the production execution lease.
+    }
+}
+
+async fn bridge(
+    stream: UnixStream,
+    mut socket: client::transport::in_process::Socket,
+) -> io::Result<()> {
+    let (reader, writer) = stream.into_split();
+    let mut reader = BufReader::new(reader).lines();
+    let mut writer = JsonLineWriter::new(writer);
+    loop {
+        tokio::select! {
+            line = reader.next_line() => {
+                let Some(message) = line? else { return Ok(()); };
+                if message.trim().is_empty() { continue; }
+                socket.send(message).await.map_err(io::Error::other)?;
+            }
+            event = socket.next() => {
+                let Some(message) = event.map_err(io::Error::other)? else { return Ok(()); };
+                let event = decode_event(&message).map_err(io::Error::other)?;
+                writer.write_event(&event).await?;
+            }
+        }
+    }
+}
+
+/// Connect a JSONL operator client. EOF disconnects without issuing Shutdown.
+/// Input is decoded as Worker Methods and output contains Worker Events only.
+pub async fn run_unix_client(endpoint: PathBuf) -> io::Result<()> {
+    relay_unix_client(endpoint, tokio::io::stdin(), tokio::io::stdout()).await
+}
+
+/// The CLI's stream relay, also usable by embedders that own their input/output streams.
+pub async fn relay_unix_client<R, W>(endpoint: PathBuf, input: R, output: W) -> io::Result<()>
+where
+    R: tokio::io::AsyncRead + Unpin,
+    W: tokio::io::AsyncWrite + Unpin,
+{
+    let stream = UnixStream::connect(endpoint).await?;
+    let (reader, writer) = stream.into_split();
+    let mut input = BufReader::new(input).lines();
+    let mut to_host = JsonLineWriter::new(writer);
+    let mut from_host = BufReader::new(reader).lines();
+    let mut output = JsonLineWriter::new(output);
+    loop {
+        tokio::select! {
+            line = input.next_line() => {
+                let Some(line) = line? else { return Ok(()); };
+                if line.trim().is_empty() { continue; }
+                let method = decode_method(&line).map_err(io::Error::other)?;
+                to_host.write(&method).await?;
+            }
+            line = from_host.next_line() => {
+                let Some(line) = line? else { return Ok(()); };
+                let event = decode_event(&line).map_err(io::Error::other)?;
+                output.write_event(&event).await?;
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn endpoint_requires_private_parent_and_is_owner_only() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("host.sock");
+        std::fs::set_permissions(directory.path(), std::fs::Permissions::from_mode(0o755)).unwrap();
+        let error = UnixEndpoint::bind(&path)
+            .err()
+            .expect("public parent rejected");
+        assert_eq!(error.kind(), io::ErrorKind::PermissionDenied);
+        assert!(!path.exists());
+        std::fs::set_permissions(directory.path(), std::fs::Permissions::from_mode(0o700)).unwrap();
+        let endpoint = UnixEndpoint::bind(&path).unwrap();
+        assert_eq!(
+            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
+            0o600
+        );
+        let client = UnixStream::connect(&path).await.unwrap();
+        let (server, _) = endpoint.listener.accept().await.unwrap();
+        assert_eq!(
+            client.peer_cred().unwrap().uid(),
+            server.peer_cred().unwrap().uid()
+        );
+        drop(endpoint);
+        assert!(!path.exists());
+    }
+
+    #[tokio::test]
+    async fn bind_failure_precedes_worker_state_and_startup_failure_releases_only_its_endpoint() {
+        let directory = tempfile::tempdir().unwrap();
+        std::fs::set_permissions(directory.path(), std::fs::Permissions::from_mode(0o700)).unwrap();
+        let path = directory.path().join("host.sock");
+        let owner = UnixEndpoint::bind(&path).unwrap();
+        let state_dir = directory.path().join("must-not-be-opened");
+        let error = crate::run_headless(
+            crate::HeadlessLaunch::Restore {
+                state_dir: state_dir.clone(),
+                worker_id: protocol::WorkerId::now_v7(),
+            },
+            path.clone(),
+        )
+        .await
+        .unwrap_err();
+        assert!(matches!(error, crate::HeadlessError::Transport(_)));
+        assert!(!state_dir.exists());
+        assert!(path.exists());
+        drop(owner);
+        let error = crate::run_headless(
+            crate::HeadlessLaunch::Restore {
+                state_dir,
+                worker_id: protocol::WorkerId::now_v7(),
+            },
+            path.clone(),
+        )
+        .await
+        .unwrap_err();
+        assert!(matches!(error, crate::HeadlessError::Startup(_)));
+        assert!(
+            !path.exists(),
+            "a failed Host startup must release its own bind"
+        );
+    }
+
+    #[tokio::test]
+    async fn bind_failure_and_old_endpoint_drop_preserve_another_owner() {
+        let directory = tempfile::tempdir().unwrap();
+        std::fs::set_permissions(directory.path(), std::fs::Permissions::from_mode(0o700)).unwrap();
+        let path = directory.path().join("host.sock");
+        let first = UnixEndpoint::bind(&path).unwrap();
+        let first_inode = std::fs::metadata(&path).unwrap().ino();
+        assert_eq!(
+            UnixEndpoint::bind(&path).err().unwrap().kind(),
+            io::ErrorKind::AddrInUse
+        );
+        assert_eq!(std::fs::metadata(&path).unwrap().ino(), first_inode);
+        std::fs::rename(&path, directory.path().join("retained.sock")).unwrap();
+        let second = UnixEndpoint::bind(&path).unwrap();
+        let second_inode = std::fs::metadata(&path).unwrap().ino();
+        assert_ne!(first_inode, second_inode);
+        drop(first);
+        assert_eq!(std::fs::metadata(&path).unwrap().ino(), second_inode);
+        let _client = UnixStream::connect(&path).await.unwrap();
+        let _connection = second.listener.accept().await.unwrap();
+        drop(second);
+        assert!(!path.exists());
+    }
+}

crates/standalone/tests/host.rs

@@ -608,6 +608,239 @@ async fn standalone_metadata_fails_closed_on_incomplete_or_newer_records() -> Te
     Ok(())
 }
 
+#[tokio::test]
+async fn headless_unix_client_uses_production_history_lease_and_local_authority() -> TestResult {
+    use protocol::stream::{JsonLineReader, encode_method};
+    use std::os::unix::fs::PermissionsExt;
+    use tokio::io::AsyncWriteExt;
+
+    let temp = tempfile::tempdir()?;
+    // Shorten only the owned endpoint's components, preserving the harness TMPDIR
+    // even when it is checkout-local. No process-global cwd or external /tmp fallback.
+    let socket_dir = tempfile::Builder::new()
+        .prefix("")
+        .rand_bytes(4)
+        .tempdir()?;
+    std::fs::set_permissions(socket_dir.path(), std::fs::Permissions::from_mode(0o700))?;
+    let endpoint_path = socket_dir.path().join("s");
+    let endpoint = standalone::UnixEndpoint::bind(&endpoint_path)?;
+    let state_dir = temp.path().join("state");
+    let launch = StandaloneLaunchConfig::new(
+        temp.path(),
+        &state_dir,
+        manifest::ProfileSelector::Default,
+        "headless-operator",
+    )
+    .resolve()?;
+    let model = ScriptedClient::new(vec![vec![
+        LlmEvent::text_block_start(0),
+        LlmEvent::text_delta(0, "headless production response"),
+        LlmEvent::text_block_stop(0, Some(StopReason::EndTurn)),
+    ]]);
+    let inspection = model.clone();
+    let host = StandaloneHost::start_with_model_client(launch, model).await?;
+    let worker_id = host.worker_id();
+    let session_id = host.record().active_session_id;
+    let profile = host.record().manifest.clone();
+    let serve = tokio::spawn(host.serve_unix(endpoint));
+
+    // Exercise the real external client's stdin/stdout relay over the actual Unix adapter.
+    let (mut input, relay_input) = tokio::io::duplex(64 * 1024);
+    let (relay_output, output) = tokio::io::duplex(64 * 1024);
+    let relay = tokio::spawn(standalone::relay_unix_client(
+        endpoint_path.clone(),
+        relay_input,
+        relay_output,
+    ));
+    let mut events = JsonLineReader::new(output);
+    let snapshot = tokio::time::timeout(Duration::from_secs(10), events.next::<Event>())
+        .await??
+        .expect("snapshot");
+    assert!(matches!(snapshot, Event::Snapshot { .. }));
+    let request = Method::SubmitTracked {
+        submission_request_id: protocol::new_submission_request_id(),
+        input: vec![protocol::Segment::text("headless production input")],
+        source: protocol::AuthenticatedInputSource::Backend {
+            operation_id: "forged-backend-source".into(),
+        },
+    };
+    let wire = encode_method(&request)?;
+    println!("headless input: {wire}");
+    input.write_all(wire.as_bytes()).await?;
+    input.write_all(b"\n").await?;
+    let mut saw_user = false;
+    let mut saw_response = false;
+    let mut saw_state = false;
+    tokio::time::timeout(Duration::from_secs(20), async {
+        loop {
+            let event = events.next::<Event>().await?.expect("live event");
+            match &event {
+                Event::UserMessage { segments, .. } => {
+                    saw_user |= format!("{segments:?}").contains("headless production input");
+                }
+                Event::TextDelta { text } => {
+                    saw_response |= text == "headless production response";
+                }
+                Event::WorkerState { .. } => saw_state = true,
+                Event::RunEnd { .. } => break,
+                _ => {}
+            }
+            println!(
+                "headless output: {}",
+                protocol::stream::encode_event(&event)?
+            );
+        }
+        Ok::<_, Box<dyn std::error::Error>>(())
+    })
+    .await??;
+    assert!(saw_user && saw_response && saw_state);
+    assert_eq!(inspection.requests().len(), 1);
+    assert!(matches!(
+        StandaloneHost::restore_with_model_client(
+            state_dir.clone(),
+            worker_id,
+            ScriptedClient::new(vec![])
+        )
+        .await,
+        Err(StandaloneStartupError::WorkerActive)
+    ));
+
+    // EOF is a disconnect, not a shutdown; another view can reconnect to the same history.
+    drop(input);
+    tokio::time::timeout(Duration::from_secs(10), relay).await???;
+    assert!(!serve.is_finished());
+    let mut malformed = tokio::net::UnixStream::connect(&endpoint_path).await?;
+    malformed.write_all(b"not-json\n").await?;
+    let mut discarded = Vec::new();
+    use tokio::io::AsyncReadExt;
+    tokio::time::timeout(
+        Duration::from_secs(10),
+        malformed.read_to_end(&mut discarded),
+    )
+    .await??;
+    assert!(
+        !serve.is_finished(),
+        "invalid client input must not stop the Host"
+    );
+    let mut socket_client =
+        Client::new(client::transport::unix_socket::Socket::connect(&endpoint_path).await?);
+    let snapshot = tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            let event = socket_client.next_event().await?.expect("reconnect event");
+            if matches!(event, Event::Snapshot { .. }) {
+                break Ok::<_, Box<dyn std::error::Error>>(event);
+            }
+        }
+    })
+    .await??;
+    let snapshot_text = format!("{snapshot:?}");
+    assert!(
+        snapshot_text.contains("headless production input"),
+        "{snapshot_text}"
+    );
+    assert!(
+        snapshot_text.contains("headless production response"),
+        "{snapshot_text}"
+    );
+    socket_client
+        .send(&Method::Shutdown {
+            command: protocol::WorkerCommandEnvelope::new(0),
+        })
+        .await?;
+    tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            if let Some(Event::CommandAcknowledged { acknowledgement }) =
+                socket_client.next_event().await?
+            {
+                assert_eq!(
+                    acknowledgement.disposition,
+                    protocol::WorkerCommandDisposition::StaleCommandId
+                );
+                break;
+            }
+        }
+        Ok::<_, Box<dyn std::error::Error>>(())
+    })
+    .await??;
+    assert!(
+        !serve.is_finished(),
+        "stale Shutdown must not bypass Controller admission"
+    );
+    socket_client
+        .send(&Method::Shutdown {
+            command: protocol::WorkerCommandEnvelope::new(100),
+        })
+        .await?;
+    tokio::time::timeout(Duration::from_secs(15), serve).await???;
+    assert!(!endpoint_path.exists());
+    let store = StandaloneWorkerStore::open(&state_dir)?;
+    let saved = store.load(worker_id)?;
+    assert_eq!(saved.status, StandaloneWorkerStatus::Stopped);
+    use session_store::Store;
+    let history = session_store::FsStore::new(store.sessions_dir(worker_id))?.read_all(
+        saved.active_session_id,
+        saved.active_segment_id.expect("active segment"),
+    )?;
+    let origins = history
+        .iter()
+        .filter_map(|entry| match entry {
+            session_store::LogEntry::AnnotatedUserInput { history, .. } => Some(history),
+            _ => None,
+        })
+        .flatten()
+        .map(|entry| &entry.metadata.origin)
+        .collect::<Vec<_>>();
+    assert!(origins.contains(&&session_store::LoggedSessionHistoryOrigin::LocalHumanInput));
+    assert!(!format!("{origins:?}").contains("forged-backend-source"));
+
+    // This is the same restoration path called by the TUI, not a headless catalog/import.
+    let restored = StandaloneHost::restore_with_model_client(
+        state_dir.clone(),
+        worker_id,
+        ScriptedClient::new(vec![]),
+    )
+    .await?;
+    assert_eq!(restored.worker_id(), worker_id);
+    assert_eq!(restored.record().active_session_id, session_id);
+    assert_eq!(
+        serde_json::to_value(&restored.record().manifest)?,
+        serde_json::to_value(&profile)?
+    );
+    assert_eq!(
+        restored.record().cwd.canonical_path,
+        temp.path().canonicalize()?
+    );
+    let mut in_process = restored.connect();
+    let snapshot = tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            let event = in_process
+                .next_event()
+                .await?
+                .expect("in-process restored event");
+            if matches!(event, Event::Snapshot { .. }) {
+                break Ok::<_, Box<dyn std::error::Error>>(event);
+            }
+        }
+    })
+    .await??;
+    assert!(format!("{snapshot:?}").contains("headless production response"));
+    assert!(
+        !endpoint_path.exists(),
+        "in-process restore must not recreate the adapter"
+    );
+    let runtime = state_dir
+        .join(worker_id.to_string())
+        .join("runtime")
+        .join(format!("standalone-{worker_id}"));
+    assert!(!runtime.join("sock").exists());
+    assert!(!runtime.join("pid").exists());
+    restored.shutdown().await?;
+    println!(
+        "verdict: input/state/response/disconnect/explicit shutdown, shared production restore and concurrent lease exclusion passed for {worker_id}"
+    );
+    Ok(())
+}
+
 async fn wait_for_run_end(client: &mut Client<InProcessSocket>) -> TestResult {
     tokio::time::timeout(Duration::from_secs(10), async {
         loop {

crates/standalone/tests/subjektiv.rs

@@ -479,38 +479,28 @@ fn journal_response(request: &Request) -> Vec<LlmEvent> {
             }),
         );
     }
-    for (index, range) in state["selected_ranges"]
-        .as_array()
-        .unwrap()
+    let input: Value = request
+        .items
         .iter()
-        .enumerate()
-    {
-        let mut offset = range["bytes"]["start"].as_u64().unwrap();
-        let mut token = Value::Null;
-        loop {
-            let id = format!("journal-source-{index}-{offset}");
-            match result(&id) {
-                Some(page) => match page["value"]["next_byte"].as_u64() {
-                    Some(next) => {
-                        assert!(next > offset);
-                        offset = next;
-                        token = page["value"]["content_token"].clone();
-                    }
-                    None => break,
-                },
-                None => {
-                    return tool(
-                        &id,
-                        "ReadJournalText",
-                        json!({
-                            "target":{"target":"source","pointer":range["source"]["pointer"]},
-                            "offset":offset,"limit":subjektiv::journal::MAX_JOURNAL_READ_BYTES,"content_token":token
-                        }),
-                    );
-                }
-            }
-        }
-    }
+        .filter_map(Item::as_text)
+        .find_map(|text| {
+            text.lines()
+                .find_map(|line| line.strip_prefix("input_json: "))
+        })
+        .map(|json| serde_json::from_str(json).unwrap())
+        .expect("saved direct Journal input");
+    let input = subjektiv::journal::recording::JournalInput::decode(&input).unwrap();
+    assert_eq!(
+        serde_json::to_value(&input.selected_ranges).unwrap(),
+        state["selected_ranges"]
+    );
+    assert!(
+        input
+            .capture
+            .entries
+            .iter()
+            .all(|entry| input.capture.recording_text(entry.order).is_ok())
+    );
     let (name, action) = if state["current_open"].is_null() {
         (
             "CreateJournalEntry",

crates/subjektiv/Cargo.toml

@@ -15,6 +15,8 @@ serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 sha2.workspace = true
 server-api.workspace = true
+session-store.workspace = true
+job.workspace = true
 thiserror.workspace = true
 uuid = { workspace = true, features = ["v7"] }
 

crates/subjektiv/src/journal/recording.rs

@@ -5,8 +5,221 @@
 //! original canonical identity while streaming and return only the requested bounded fragment.
 
 use super::*;
+use session_store::capture::{CaptureDto, CaptureLimits};
 use sha2::{Digest, Sha256};
 
+/// A Job owns only this bounded original-body prefix. The initial content condition binds
+/// the separate generation snapshot (whose potentially large Journal text remains paged).
+/// Neither possessing these bytes nor delivering them is a processing checkpoint.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct JournalInput {
+    pub version: u32,
+    pub subject_id: String,
+    pub journal_id: String,
+    pub initial_state_token: String,
+    pub initial_open_id: Option<String>,
+    pub previous_fixed_end: Option<JournalSourcePointer>,
+    pub selected_ranges: Vec<JournalSourceRange>,
+    pub capture: CaptureDto,
+}
+
+impl JournalInput {
+    /// Capture callback runs once for this immutable Job, never once per page. Fitting uses
+    /// only that captured value and measures the complete serialized input, including the
+    /// initial Journal condition and ranges duplicated beside the capture's descriptors.
+    pub fn build(
+        store: &SubjektivStore,
+        host: &JournalHostContext,
+        journal_id: &str,
+        capture_once: impl FnOnce(u64, u64, usize) -> JournalResult<CaptureDto>,
+    ) -> JournalResult<Self> {
+        let (journal, open, previous_fixed_end) = store.database.try_with_connection(|tx| {
+            super::store::check_host(store, tx, host, true)?;
+            Ok::<_, JournalError>((
+                super::store::journal(tx, host, journal_id, true)?,
+                super::store::open(tx, journal_id)?,
+                super::store::previous_fixed(tx, journal_id)?.map(|p| p.0),
+            ))
+        })?;
+        let mut input = Self {
+            version: 1,
+            subject_id: journal.subject_id.clone(),
+            journal_id: journal_id.into(),
+            initial_state_token: journal.state_token,
+            initial_open_id: open.map(|e| e.id),
+            previous_fixed_end,
+            selected_ranges: Vec::new(),
+            capture: CaptureDto {
+                version: 1,
+                session_id: journal.source_session_id,
+                segment_id: "pending".into(),
+                view_entry_count: 0,
+                entries: Vec::new(),
+            },
+        };
+        let envelope = serde_json::to_vec(&input)?.len();
+        // Capture once at a fixed storage boundary. Any adjustment for the Journal envelope
+        // below operates on this value only, never by making another live capture request.
+        let budget = job::MAX_JOB_INPUT_BYTES.saturating_sub(envelope);
+        input.capture = capture_once(journal.process_order, journal.process_byte, budget)?;
+        input.selected_ranges = capture_ranges(&input.capture)?;
+        if input.selected_ranges.is_empty() {
+            return Ok(input);
+        }
+        input.fit()?;
+        let value = serde_json::to_value(&input)?;
+        Self::decode(&value)
+    }
+
+    fn fit(&mut self) -> JournalResult<()> {
+        let original = self.capture.clone();
+        let first = self
+            .selected_ranges
+            .first()
+            .ok_or_else(|| invalid("empty recording selection"))?;
+        let start = session_store::capture::RecordingPosition {
+            canonical_order: first.source.order,
+            byte_offset: first.bytes.start,
+        };
+        let mut budget = serde_json::to_vec(&original)?.len();
+        loop {
+            let bytes = serde_json::to_vec(self)?.len();
+            if bytes <= job::MAX_JOB_INPUT_BYTES {
+                return Ok(());
+            }
+            budget = budget
+                .checked_sub(bytes - job::MAX_JOB_INPUT_BYTES)
+                .ok_or_else(|| invalid("Journal envelope cannot fit source bytes"))?;
+            self.capture = original
+                .recording_slice(start, MAX_JOURNAL_RANGES, budget)
+                .map_err(|e| invalid(&e.to_string()))?
+                .capture;
+            self.selected_ranges = capture_ranges(&self.capture)?;
+            if self.selected_ranges.is_empty() {
+                return Err(invalid("Journal envelope cannot fit one source scalar"));
+            }
+        }
+    }
+
+    pub fn decode(value: &serde_json::Value) -> JournalResult<Self> {
+        if serde_json::to_vec(value)?.len() > job::MAX_JOB_INPUT_BYTES {
+            return Err(invalid(
+                "Journal input exceeds whole serialized Job input limit",
+            ));
+        }
+        let input: Self = serde_json::from_value(value.clone())?;
+        input
+            .capture
+            .validate(CaptureLimits {
+                max_bytes: job::MAX_JOB_INPUT_BYTES,
+                max_entries: MAX_JOURNAL_RANGES,
+                max_text_bytes: job::MAX_JOB_INPUT_BYTES,
+                ..CaptureLimits::default()
+            })
+            .map_err(|e| invalid(&e.to_string()))?;
+        if input.version != 1
+            || input.subject_id.is_empty()
+            || input.journal_id.is_empty()
+            || input.initial_state_token.is_empty()
+            || input.selected_ranges.is_empty()
+            || input.selected_ranges.len() > MAX_JOURNAL_RANGES
+            || input
+                .selected_ranges
+                .iter()
+                .any(|r| r.source.session_id != input.capture.session_id)
+        {
+            return Err(invalid("invalid Journal input identity or selection"));
+        }
+        if capture_ranges(&input.capture)? != input.selected_ranges {
+            return Err(conflict(
+                "Journal body snapshot does not match selected canonical ranges",
+            ));
+        }
+        Ok(input)
+    }
+
+    pub fn validate_generation(&self, generation: &JournalGeneration) -> JournalResult<()> {
+        if generation.journal_id != self.journal_id
+            || generation.initial_journal.subject_id != self.subject_id
+            || generation.initial_journal.source_session_id != self.capture.session_id
+            || generation.initial_journal.state_token != self.initial_state_token
+            || generation.initial_open.as_ref().map(|e| &e.id) != self.initial_open_id.as_ref()
+            || generation.previous_fixed_end != self.previous_fixed_end
+            || generation.selected_ranges != self.selected_ranges
+        {
+            return Err(conflict(
+                "saved Journal input differs from its initial generation snapshot",
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// Converts the shared recording projection into Journal's coverage language without
+/// interpreting model text or constructing a second capture representation.
+pub fn capture_ranges(capture: &CaptureDto) -> JournalResult<Vec<JournalSourceRange>> {
+    use session_store::capture::CaptureBody;
+    let mut ranges = Vec::new();
+    for entry in &capture.entries {
+        let CaptureBody::CanonicalPublic {
+            descriptor,
+            byte_offset,
+            text,
+            ..
+        } = &entry.body
+        else {
+            return Err(invalid(
+                "Journal requires canonical original recording capture",
+            ));
+        };
+        if !entry.policy.recording_material
+            || text.is_empty()
+            || descriptor.identity.segment_id.to_string() != entry.source.segment_id
+            || descriptor.identity.entry_ref != format!("E{}", entry.entry_id)
+            || descriptor.canonical_order != entry.order
+            || byte_offset
+                .checked_add(text.len() as u64)
+                .is_none_or(|end| end > descriptor.total_bytes)
+        {
+            return Err(conflict(
+                "recording body identity, policy or range mismatch",
+            ));
+        }
+        let source = JournalSource {
+            session_id: capture.session_id.clone(),
+            pointer: JournalSourcePointer {
+                segment_id: descriptor.identity.segment_id,
+                entry_ref: descriptor.identity.entry_ref.clone(),
+            },
+            order: descriptor.canonical_order,
+            content_sha256: descriptor.sha256.clone(),
+            total_bytes: descriptor.total_bytes,
+        };
+        if *byte_offset == 0 && text.len() as u64 == descriptor.total_bytes {
+            verify_canonical_text(&source, text)?;
+        }
+        ranges.push(JournalSourceRange {
+            source,
+            bytes: JournalByteRange {
+                start: *byte_offset,
+                end: *byte_offset + text.len() as u64,
+            },
+        });
+    }
+    for pair in ranges.windows(2) {
+        if pair[0].source.order.checked_add(1) != Some(pair[1].source.order)
+            || pair[0].bytes.end != pair[0].source.total_bytes
+            || pair[1].bytes.start != 0
+        {
+            return Err(conflict(
+                "recording capture is not an oldest contiguous prefix",
+            ));
+        }
+    }
+    Ok(ranges)
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct JournalMaterial {

crates/subjektiv/src/journal/service.rs

@@ -66,8 +66,8 @@ fn text_page(
     })
 }
 
-/// Adapter for Host captures bounded by their storage contract. Production source reads should
-/// use [`execute_bounded`] to avoid allocating an entire source for one small read.
+/// Legacy adapter for Host captures bounded by their storage contract.
+/// Production Hosts use [`attest_input_delivery`] and [`execute_snapshot`] instead.
 pub fn execute(
     store: &SubjektivStore,
     context: &JournalJobContext,
@@ -101,23 +101,149 @@ pub fn execute(
     })
 }
 
-/// Reads are delivered through this service before mutation authority is enabled. The durable
-/// delivery ledger stores byte ranges only: Jobs may retain immutable descriptors without
-/// accumulating a permanent second copy of the original Session in their request ledgers.
-/// The Host verifies original provenance/digest/length and returns a bounded UTF-8 fragment.
+pub(crate) fn migrate_input_delivery(
+    tx: &rusqlite::Transaction<'_>,
+) -> feature_storage::Result<()> {
+    tx.execute_batch(
+        "CREATE TABLE journal_generation_input_deliveries (
+            generation_id TEXT PRIMARY KEY NOT NULL REFERENCES journal_generations(id) ON DELETE CASCADE,
+            input_digest TEXT NOT NULL CHECK(length(input_digest)=71 AND substr(input_digest,1,7)='sha256:' AND substr(input_digest,8) NOT GLOB '*[^0-9a-f]*')
+        );
+        CREATE TRIGGER journal_generation_input_delivery_no_update
+        BEFORE UPDATE ON journal_generation_input_deliveries
+        BEGIN SELECT RAISE(ABORT, 'Journal input delivery bindings are immutable'); END;",
+    )?;
+    Ok(())
+}
+
+fn validate_input_digest(input_digest: &str) -> JournalResult<()> {
+    // Preserve JobRequest::input_digest() verbatim, including its algorithm prefix.
+    if input_digest.strip_prefix("sha256:").is_none_or(|hex| {
+        hex.len() != 64
+            || !hex
+                .bytes()
+                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    }) {
+        return Err(JournalError::InvalidInput(
+            "immutable Job input digest must be sha256: followed by 64 lowercase hex digits".into(),
+        ));
+    }
+    Ok(())
+}
+
+/// Trusted Host-only delivery evidence, never a model tool or a claim of understanding.
+/// Before calling, the Host must validate the saved, immutable body-bearing input against the
+/// bound Job's input digest, its Session/provenance/ranges, and the actual dispatch plan that
+/// supplies that exact input. The service cannot verify bytes it does not own. This transaction
+/// stores only the digest bound to the generation's immutable selection; it neither copies the
+/// body nor changes records, position, reflection or checkpoint. Exact replay is allowed only
+/// while the same generation and writer binding remain active; changed digests/ranges conflict.
+pub fn attest_input_delivery(
+    store: &SubjektivStore,
+    context: &JournalJobContext,
+    input_digest: &str,
+    selected_ranges: &[JournalSourceRange],
+) -> JournalResult<()> {
+    validate_input_digest(input_digest)?;
+    store.database.try_transaction(|tx| {
+        super::lifecycle::reject_erased(tx, &context.host)?;
+        let generation = super::store::job(store, tx, context, true)?;
+        if generation.selected_ranges != selected_ranges {
+            return Err(JournalError::Conflict(
+                "immutable Job input selection differs from generation".into(),
+            ));
+        }
+        let saved: Option<String> = tx.query_row(
+            "SELECT input_digest FROM journal_generation_input_deliveries WHERE generation_id=?1",
+            [&generation.id], |row| row.get(0),
+        ).optional()?;
+        if let Some(saved) = saved {
+            if saved != input_digest {
+                return Err(JournalError::Conflict(
+                    "generation is bound to a different immutable Job input digest".into(),
+                ));
+            }
+        } else {
+            tx.execute(
+                "INSERT INTO journal_generation_input_deliveries(generation_id,input_digest) VALUES(?1,?2)",
+                params![generation.id, input_digest],
+            )?;
+        }
+        Ok(())
+    })
+}
+
+fn require_input_delivery(
+    tx: &rusqlite::Connection,
+    context: &JournalJobContext,
+    input_digest: &str,
+) -> JournalResult<()> {
+    validate_input_digest(input_digest)?;
+    let saved: Option<String> = tx
+        .query_row(
+            "SELECT input_digest FROM journal_generation_input_deliveries WHERE generation_id=?1",
+            [&context.generation_id],
+            |row| row.get(0),
+        )
+        .optional()?;
+    if saved.as_deref() != Some(input_digest) {
+        return Err(JournalError::Conflict(
+            "trusted Host delivery of this immutable Job input is required".into(),
+        ));
+    }
+    Ok(())
+}
+
+/// Production sequential execution over Journal state and the Host-attested immutable input.
+/// The digest is taken from the bound saved Job by the Host, not from model arguments. Every
+/// request requires the matching delivery binding and an active generation/writer. Source text
+/// is already in immutable input: Source targets fail explicitly, with no Session reader or
+/// fallback. Receipt-backed record, position and checkpoint constraints remain unchanged.
+pub fn execute_snapshot(
+    store: &SubjektivStore,
+    context: &JournalJobContext,
+    input_digest: &str,
+    request: JournalJobRequest,
+) -> JournalResult<JournalJobResponse> {
+    execute_inner(store, context, request, Some(input_digest), |_, _, _| {
+        Err(JournalError::PermissionDenied(
+            "Source reads are unavailable for immutable Journal input".into(),
+        ))
+    })
+}
+
+/// Legacy/test source-read adapter. Production Hosts must use [`execute_snapshot`].
+/// This ledger attests bounded Source responses only and cannot satisfy the input-digest gate.
 pub fn execute_bounded(
     store: &SubjektivStore,
     context: &JournalJobContext,
     request: JournalJobRequest,
+    read_source: impl FnMut(&JournalSource, u64, usize) -> JournalResult<recording::JournalMaterial>,
+) -> JournalResult<JournalJobResponse> {
+    execute_inner(store, context, request, None, read_source)
+}
+
+fn execute_inner(
+    store: &SubjektivStore,
+    context: &JournalJobContext,
+    request: JournalJobRequest,
+    input_digest: Option<&str>,
     mut read_source: impl FnMut(&JournalSource, u64, usize) -> JournalResult<recording::JournalMaterial>,
 ) -> JournalResult<JournalJobResponse> {
-    let generation = store
-        .database
-        .try_with_connection(|tx| super::store::job(store, tx, context, true))?;
+    let generation = store.database.try_with_connection(|tx| {
+        super::lifecycle::reject_erased(tx, &context.host)?;
+        let generation = super::store::job(store, tx, context, true)?;
+        if let Some(input_digest) = input_digest {
+            require_input_delivery(tx, context, input_digest)?;
+        }
+        Ok::<_, JournalError>(generation)
+    })?;
     let mut delivered = None;
     let response = match request {
         JournalJobRequest::Execute { operation } => {
-            require_delivery(store, context, &generation.selected_ranges)?;
+            if input_digest.is_none() {
+                require_delivery(store, context, &generation.selected_ranges)?;
+            }
             let receipt = if matches!(operation.action, JournalAction::Checkpoint { .. }) {
                 crate::api::checkpoint_journal(store, context, operation)?
             } else {
@@ -197,6 +323,11 @@ pub fn execute_bounded(
         JournalJobRequest::ReadText { read } => {
             let text = match &read.target {
                 JournalTextTarget::Source { pointer } => {
+                    if input_digest.is_some() {
+                        return Err(JournalError::PermissionDenied(
+                            "Source target is unavailable: raw source bodies are in immutable Job input".into(),
+                        ));
+                    }
                     let range = generation
                         .selected_ranges
                         .iter()

crates/subjektiv/src/journal/store.rs

@@ -202,7 +202,7 @@ pub(super) fn open(tx: &Connection, journal_id: &str) -> JournalResult<Option<Jo
         .optional()?;
     id.map(|id| entry(tx, journal_id, &id)).transpose()
 }
-fn previous_fixed(
+pub(super) fn previous_fixed(
     tx: &Connection,
     journal_id: &str,
 ) -> JournalResult<Option<(JournalSourcePointer, u64)>> {
@@ -569,6 +569,60 @@ impl SubjektivStore {
             Ok(snapshot)
         })
     }
+    /// Rebind a saved body input to a new attempt without resampling its initial state.
+    /// The first binding freezes the full initial Journal snapshot; retries reuse it and
+    /// retain operation receipts. Different Jobs cannot borrow that snapshot as authority.
+    pub fn prepare_journal_input(
+        &self,
+        host: &JournalHostContext,
+        input: &super::recording::JournalInput,
+        binding: JobAttemptBinding,
+    ) -> JournalResult<JournalGeneration> {
+        label(&binding.job_id)?;
+        label(&binding.attempt_id)?;
+        self.database.try_transaction(|tx| {
+            check_host(self, tx, host, false)?;
+            check_session_host(self, tx, host)?;
+            let current = journal(tx, host, &input.journal_id, true)?;
+            let existing: Option<String> = tx.query_row(
+                "SELECT snapshot_json FROM journal_generations WHERE journal_id=?1 AND job_id=?2 AND attempt_id=?3",
+                params![input.journal_id, binding.job_id, binding.attempt_id], |r| r.get(0)).optional()?;
+            if let Some(raw) = existing {
+                let g = serde_json::from_str(&raw)?;
+                input.validate_generation(&g)?;
+                return Ok(g);
+            }
+            // Retained receipt lookup does not reacquire writer authority. Only a new
+            // generation requires the current active Subject/Session writer lifetime.
+            check_host(self, tx, host, true)?;
+            if tx.query_row("SELECT EXISTS(SELECT 1 FROM journal_generations WHERE journal_id=?1 AND active=1)", [&input.journal_id], |r| r.get::<_, bool>(0))? {
+                return Err(conflict("another active generation owns this Journal"));
+            }
+            let prior: Option<String> = tx.query_row(
+                "SELECT snapshot_json FROM journal_generations WHERE journal_id=?1 AND job_id=?2 ORDER BY rowid LIMIT 1",
+                params![input.journal_id, binding.job_id], |r| r.get(0)).optional()?;
+            let mut g = if let Some(raw) = prior {
+                serde_json::from_str::<JournalGeneration>(&raw)?
+            } else {
+                JournalGeneration { id: String::new(), journal_id: input.journal_id.clone(), job: binding.clone(),
+                    selected_ranges: input.selected_ranges.clone(), initial_journal: current.clone(),
+                    initial_open: open(tx, &input.journal_id)?, previous_fixed_end: previous_fixed(tx, &input.journal_id)?.map(|p| p.0) }
+            };
+            input.validate_generation(&g)?;
+            check_ranges(tx, &current, &input.selected_ranges, true)?;
+            let end = prefix(&g.initial_journal, &input.selected_ranges)?;
+            let cursor = (current.process_order, current.process_byte);
+            if cursor < (g.initial_journal.process_order, g.initial_journal.process_byte) || cursor > end {
+                return Err(conflict("saved input no longer owns the current processing cursor"));
+            }
+            g.id = issued_id("journal-generation");
+            g.job = binding;
+            tx.execute("INSERT INTO journal_generations(id,journal_id,job_id,attempt_id,request_json,snapshot_json,active) VALUES(?1,?2,?3,?4,?5,?6,1)",
+                params![g.id,g.journal_id,g.job.job_id,g.job.attempt_id,serde_json::to_string(&g.selected_ranges)?,serde_json::to_string(&g)?])?;
+            Ok(g)
+        })
+    }
+
     pub(super) fn validate_journal_job(&self, ctx: &JournalJobContext) -> JournalResult<()> {
         self.database.try_with_connection(|tx| {
             job(self, tx, ctx, true)?;

crates/subjektiv/src/journal/transport.rs

@@ -1,8 +1,10 @@
 //! Bounded, Host-bound Journal recording and sequential Job transport.
 //!
 //! Subject, Journal and generation authority never come from these model inputs.
-//! Hosts validate live execution and public source bytes before selection; reading a
-//! preview must not select the enclosing entry. Operation retries retain the entire
+//! Hosts validate live execution and public source bytes before selection, save body-bearing
+//! immutable Job input, and attest its exact digest and dispatch plan through the service.
+//! Model requests cannot attest input delivery; Source targets are rejected by snapshot execution.
+//! Initial/current Journal reads remain separate from input delivery. Operation retries retain the entire
 //! JournalOperation, including its original expected_state and covered_ranges.
 
 use serde::{Deserialize, Serialize};
@@ -50,8 +52,8 @@ pub struct JournalJobState {
     pub current_journal: JournalMetadata,
     pub current_open: Option<JournalEntrySummary>,
     pub previous_fixed_end: Option<JournalSourcePointer>,
-    /// Frozen permission to fetch this prefix, not evidence of delivery or reflection.
-    /// The sequential service gates mutations on its durable Source-read delivery ledger.
+    /// Frozen source selection delivered in immutable Job input, not evidence of reflection.
+    /// Production execution requires the trusted Host's matching input-digest attestation.
     pub selected_ranges: Vec<JournalSourceRange>,
 }
 
@@ -83,7 +85,8 @@ pub enum JournalTextTarget {
     OpenOngoing {
         snapshot: JournalSnapshot,
     },
-    /// The Host restricts this pointer to this Job's frozen public source input.
+    /// Legacy source-read adapter only. Production snapshot execution rejects this target;
+    /// raw source bodies must already be present in the immutable Job input.
     Source {
         pointer: JournalSourcePointer,
     },

crates/subjektiv/src/lib.rs

@@ -639,6 +639,11 @@ static MIGRATIONS: &[FeatureMigration] = &[
         "add explicit Subject permission sources and immutable child execution grants",
         permissions::migrate,
     ),
+    FeatureMigration::new(
+        13,
+        "bind Journal generation delivery to immutable Job input digest",
+        journal::service::migrate_input_delivery,
+    ),
 ];
 
 pub const REGISTRATION: FeatureRegistration =

crates/tools/src/bash.rs

@@ -19,6 +19,8 @@ use workdir::{
     WorkdirSessionRouter,
 };
 
+mod cleanup;
+
 const DEFAULT_TIMEOUT_SECS: u64 = 120;
 const MAX_TIMEOUT_SECS: u64 = 600;
 const INLINE_BYTE_BUDGET: usize = 12 * 1024;
@@ -28,7 +30,9 @@ struct BashParams {
     /// Worker-local alias of the Workdir attachment to use.
     #[serde(default)]
     target_workdir: Option<String>,
-    /// Workdir-relative directory in which to execute the command.
+    /// Directory in which to execute the command.
+    // Keep provider path-coordinate documentation out of the model-facing schema.
+    #[schemars(with = "String")]
     cwd: WorkdirPath,
     command: String,
     #[serde(default)]
@@ -72,80 +76,19 @@ impl Drop for CommandGuard {
         let Some(handle) = self.handle.take() else {
             return;
         };
-        let workdir = self.session.clone();
-        let state = Arc::clone(&self.state);
-        let execution_id = self.execution_id.clone();
-        let execution_nonce = self.execution_nonce;
-        let mut retained = self.retained.take();
-        let cursor = self.cursor;
-        // A dropped provider future is not terminal confirmation. Keep the live
-        // execution registered until cleanup has both requested cancellation and
-        // observed terminal command output, so cancellation/session teardown
-        // cannot race with an apparently empty registry.
-        tokio::spawn(async move {
-            let result = tokio::time::timeout(std::time::Duration::from_secs(10), async {
-                let _ = workdir.cancel_command(handle.clone()).await;
-                let mut cursor = cursor;
-                loop {
-                    let page = command_page(
-                        &workdir,
-                        CommandOutputRequest {
-                            handle: handle.clone(),
-                            cursor,
-                            limit: workdir::MAX_COMMAND_READ_BYTES,
-                            wait: true,
-                        },
-                    )
-                    .await?;
-                    if let Some(writer) = &mut retained {
-                        let mut next = cursor;
-                        for chunk in &page.chunks {
-                            if chunk.sequence != next {
-                                return Err(workdir::WorkdirError::Unavailable(
-                                    "command cleanup sequence gap".into(),
-                                ));
-                            }
-                            writer
-                                .append_chunk(chunk)
-                                .map_err(workdir::WorkdirError::Unavailable)?;
-                            next = next.checked_add(chunk.bytes.len() as u64).ok_or_else(|| {
-                                workdir::WorkdirError::Unavailable(
-                                    "command cleanup cursor overflow".into(),
-                                )
-                            })?;
-                        }
-                        if page.next_cursor != next {
-                            return Err(workdir::WorkdirError::Unavailable(
-                                "command cleanup cursor gap".into(),
-                            ));
-                        }
-                    }
-                    cursor = page.next_cursor;
-                    if let Some(terminal) = page.terminal {
-                        if let Some(writer) = &mut retained {
-                            writer
-                                .finish_transport(&terminal)
-                                .map_err(workdir::WorkdirError::Unavailable)?;
-                        }
-                        return Ok::<(), workdir::WorkdirError>(());
-                    }
-                }
-            })
-            .await;
-            // Bounded cleanup can end with an unknown provider outcome. The writer then
-            // terminalizes partial evidence on drop; retaining a dead collector in `active`
-            // would leak registrations and falsely suggest it could still collect output.
-            let _ = result;
-            let mut state = state.lock().unwrap();
-            if state
-                .active
-                .get(&execution_id)
-                .is_some_and(|active| active.execution_nonce == execution_nonce)
-            {
-                state.active.remove(&execution_id);
-                state.cancellation_requested.remove(&execution_id);
-            }
-        });
+        let cleanup = cleanup::Cleanup {
+            session: self.session.clone(),
+            state: Arc::clone(&self.state),
+            execution_id: self.execution_id.clone(),
+            execution_nonce: self.execution_nonce,
+            handle,
+            cursor: self.cursor,
+            retained: self
+                .retained
+                .take()
+                .expect("started command owns output writer"),
+        };
+        tokio::spawn(cleanup.run());
     }
 }
 
@@ -158,11 +101,15 @@ async fn command_page(
 ) -> Result<workdir::CommandOutput, workdir::WorkdirError> {
     for attempt in 0..3 {
         match session.command_output(request.clone()).await {
-            Err(
-                workdir::WorkdirError::Transport(_)
-                | workdir::WorkdirError::Unavailable(_)
-                | workdir::WorkdirError::OutcomeUnknown(_),
-            ) if attempt < 2 => {
+            Err(error)
+                if attempt < 2
+                    && matches!(
+                        error.classification_source(),
+                        workdir::WorkdirError::Transport(_)
+                            | workdir::WorkdirError::Unavailable(_)
+                            | workdir::WorkdirError::OutcomeUnknown(_)
+                    ) =>
+            {
                 tokio::time::sleep(std::time::Duration::from_millis(100 << attempt)).await;
             }
             result => return result,
@@ -363,7 +310,7 @@ impl BashTool {
         guard.handle = None;
 
         let timed_out = terminal.status == workdir::CommandStatus::TimedOut;
-        let summary =
+        let mut summary =
             if cancellation_requested || terminal.status == workdir::CommandStatus::Cancelled {
                 format!("$ {cmd_summary} (cancelled)")
             } else if timed_out {
@@ -375,6 +322,12 @@ impl BashTool {
                     None => format!("$ {cmd_summary} (terminated)"),
                 }
             };
+        if matches!(
+            terminal.output_collection,
+            workdir::CommandOutputCollection::Incomplete { .. }
+        ) {
+            summary.push_str(" (output incomplete)");
+        }
         Ok(BashResult {
             summary,
             stdout_preview: String::from_utf8_lossy(&stdout_preview).into_owned(),

crates/tools/src/bash/cleanup.rs

@@ -0,0 +1,121 @@
+//! Finite Drop cleanup. A cancel acknowledgement is not termination evidence; only a
+//! validated terminal fence confirms the process result. No provider text is logged.
+
+use super::*;
+use crate::bash_output::{
+    CleanupCancel, CleanupDiagnostics, CleanupDrain, CleanupFailure, CleanupProviderFailure,
+    CleanupRegistration,
+};
+use std::time::Duration;
+
+const CLEANUP_TIMEOUT: Duration = Duration::from_secs(10);
+// Reserve time for independent terminal observation even if cancel never responds.
+const CANCEL_TIMEOUT: Duration = Duration::from_secs(2);
+
+pub(super) struct Cleanup {
+    pub session: WorkdirSessionHandle,
+    pub state: Arc<Mutex<BashExecutionState>>,
+    pub execution_id: String,
+    pub execution_nonce: u64,
+    pub handle: CommandHandle,
+    pub cursor: u64,
+    pub retained: BashOutputWriter,
+}
+
+impl Cleanup {
+    pub async fn run(mut self) {
+        let deadline = tokio::time::Instant::now() + CLEANUP_TIMEOUT;
+        let cancel = match tokio::time::timeout(
+            CANCEL_TIMEOUT,
+            self.session.cancel_command(self.handle.clone()),
+        )
+        .await
+        {
+            Ok(Ok(())) => CleanupCancel::Acknowledged,
+            Ok(Err(error)) => CleanupCancel::Failed {
+                reason: CleanupProviderFailure::from(&error),
+            },
+            Err(_) => CleanupCancel::DeadlineExceeded,
+        };
+        let drain = match tokio::time::timeout_at(deadline, self.drain()).await {
+            Ok(Ok(())) => CleanupDrain::TerminalConfirmed,
+            Ok(Err(reason)) => CleanupDrain::Failed { reason },
+            Err(_) => CleanupDrain::DeadlineExceeded,
+        };
+        let deadline_expired = matches!(drain, CleanupDrain::DeadlineExceeded);
+        // Finalize evidence before exposing an empty registry. Keep the lock through
+        // publication so an older cleanup can never remove a newer generation.
+        let mut state = self.state.lock().unwrap();
+        let registration = if state
+            .active
+            .get(&self.execution_id)
+            .is_some_and(|active| active.execution_nonce == self.execution_nonce)
+        {
+            state.active.remove(&self.execution_id);
+            state.cancellation_requested.remove(&self.execution_id);
+            CleanupRegistration::Released
+        } else {
+            CleanupRegistration::Superseded
+        };
+        let diagnostics = CleanupDiagnostics {
+            execution_nonce: self.execution_nonce,
+            cancel,
+            drain,
+            deadline_expired,
+            registration,
+        };
+        tracing::info!(
+            output_id = %self.retained.id(),
+            cleanup = ?diagnostics,
+            "Bash Drop cleanup finished; cancellation and terminal observation are independent"
+        );
+        self.retained.finish_cleanup(diagnostics);
+        drop(self.retained);
+    }
+
+    async fn drain(&mut self) -> Result<(), CleanupFailure> {
+        loop {
+            let page = command_page(
+                &self.session,
+                CommandOutputRequest {
+                    handle: self.handle.clone(),
+                    cursor: self.cursor,
+                    limit: workdir::MAX_COMMAND_READ_BYTES,
+                    wait: true,
+                },
+            )
+            .await
+            .map_err(|error| CleanupFailure::Provider {
+                reason: CleanupProviderFailure::from(&error),
+            })?;
+            let mut next = self.cursor;
+            for chunk in &page.chunks {
+                if chunk.sequence != next {
+                    return Err(CleanupFailure::SequenceGap);
+                }
+                next = next
+                    .checked_add(chunk.bytes.len() as u64)
+                    .filter(|next| *next <= crate::bash_output::COMMAND_BYTES as u64)
+                    .ok_or(CleanupFailure::DeliveryBudgetExceeded)?;
+                self.retained
+                    .append_chunk(chunk)
+                    .map_err(|_| CleanupFailure::RetainedChunkInvalid)?;
+            }
+            if page.next_cursor != next {
+                return Err(CleanupFailure::CursorGap);
+            }
+            self.cursor = next;
+            if let Some(terminal) = page.terminal {
+                self.retained
+                    .finish_transport(&terminal)
+                    .map_err(|_| CleanupFailure::TerminalMetadataInvalid)?;
+                return Ok(());
+            }
+            // An immediately-ready provider must not starve the cleanup deadline.
+            tokio::task::yield_now().await;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/tools/src/bash/cleanup/tests.rs

@@ -0,0 +1,397 @@
+//! Component tests enter through the production CommandGuard Drop, cleanup, page
+//! validation and retained store. Only the Workdir provider is replaced; paused time
+//! and a cancel barrier make faults/deadlines deterministic without OS timing.
+
+use super::*;
+use std::sync::atomic::{AtomicBool, Ordering};
+use workdir::*;
+
+const PRIVATE: &str = "SECRET command /private/host/path output password=poison";
+
+#[derive(Clone, Copy, Debug)]
+enum Fault {
+    Cancel,
+    CancelHang,
+    Drain,
+    TerminalTimeout,
+    Sequence,
+    Cursor,
+    RetainedChunk,
+    TerminalMetadata,
+    CollectionIncomplete,
+    Complete,
+}
+
+#[derive(Debug)]
+struct Provider {
+    local: LocalWorkdirSession,
+    fault: Fault,
+    cancelling: tokio::sync::Notify,
+    allow_drain: AtomicBool,
+}
+
+#[async_trait]
+impl WorkdirSession for Provider {
+    fn workdir(&self) -> &Workdir {
+        self.local.workdir()
+    }
+    fn capabilities(&self) -> WorkdirSessionCapabilities {
+        WorkdirSessionCapabilities::ALL
+    }
+    async fn stat(&self, _: StatRequest) -> Result<StatResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn read(&self, _: ReadRequest) -> Result<ReadResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn write(&self, _: WriteRequest) -> Result<WriteResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn edit(&self, _: EditRequest) -> Result<EditResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn list(&self, _: ListRequest) -> Result<ListResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn glob(&self, _: GlobRequest) -> Result<GlobResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn grep(&self, _: GrepRequest) -> Result<GrepResult, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn start_command(&self, _: CommandRequest) -> Result<CommandHandle, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+    async fn command_status(&self, _: CommandHandle) -> Result<CommandStatus, WorkdirError> {
+        Err(WorkdirError::OperationFailed)
+    }
+
+    async fn command_output(
+        &self,
+        request: CommandOutputRequest,
+    ) -> Result<CommandOutput, WorkdirError> {
+        assert_eq!(request.cursor, 3);
+        while !self.allow_drain.load(Ordering::Acquire) {
+            tokio::task::yield_now().await;
+        }
+        match self.fault {
+            Fault::Drain => {
+                return Err(WorkdirError::Transport(PRIVATE.into())
+                    .with_failure_reason(WorkdirFailureReason::HttpTransfer));
+            }
+            Fault::TerminalTimeout => return std::future::pending().await,
+            _ => {}
+        }
+        let mut chunk = CommandByteChunk {
+            sequence: 3,
+            offset: 3,
+            stream: CommandStream::Stdout,
+            bytes: b"tail".to_vec(),
+        };
+        if matches!(self.fault, Fault::Sequence) {
+            chunk.sequence = 4;
+        }
+        if matches!(self.fault, Fault::RetainedChunk) {
+            chunk.offset = 42;
+        }
+        let mut terminal = terminal();
+        if matches!(self.fault, Fault::TerminalMetadata) {
+            terminal.stdout_delivered_bytes = 6;
+        }
+        if matches!(self.fault, Fault::CollectionIncomplete) {
+            terminal.output_collection = CommandOutputCollection::Incomplete {
+                failure: CommandFailure {
+                    stage: CommandFailureStage::StdoutDrain,
+                    reason: CommandIoErrorKind::Other,
+                    os_code: None,
+                },
+            };
+        }
+        Ok(CommandOutput {
+            chunks: vec![chunk],
+            next_cursor: if matches!(self.fault, Fault::Cursor) {
+                8
+            } else {
+                7
+            },
+            terminal: Some(terminal),
+        })
+    }
+
+    async fn cancel_command(&self, _: CommandHandle) -> Result<(), WorkdirError> {
+        self.cancelling.notify_one();
+        match self.fault {
+            Fault::Cancel => Err(WorkdirError::Unavailable(PRIVATE.into())),
+            Fault::CancelHang => std::future::pending().await,
+            _ => Ok(()),
+        }
+    }
+    async fn close(&self) -> Result<(), WorkdirError> {
+        Ok(())
+    }
+}
+
+fn terminal() -> CommandTerminal {
+    CommandTerminal {
+        status: CommandStatus::Completed,
+        exit_code: Some(0),
+        process_failure: None,
+        output_collection: CommandOutputCollection::Complete,
+        stdout_bytes: 7,
+        stderr_bytes: 0,
+        stdout_delivered_bytes: 7,
+        stderr_delivered_bytes: 0,
+        truncation_reason: None,
+    }
+}
+
+struct Fixture {
+    _root: tempfile::TempDir,
+    provider: Arc<Provider>,
+    state: Arc<Mutex<BashExecutionState>>,
+    view: BashOutputView,
+    id: String,
+}
+
+impl Fixture {
+    fn start(fault: Fault) -> (Self, CommandGuard) {
+        let base =
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../target/cleanup-fixtures");
+        std::fs::create_dir_all(&base).unwrap();
+        let root = tempfile::tempdir_in(base).unwrap();
+        let provider = Arc::new(Provider {
+            local: LocalWorkdirSession::new(
+                manifest::Scope::writable(root.path()).unwrap(),
+                root.path().into(),
+            ),
+            fault,
+            cancelling: Default::default(),
+            allow_drain: AtomicBool::new(false),
+        });
+        let view = BashOutputView::new();
+        let mut retained = view.begin().unwrap();
+        retained.append(CommandStream::Stdout, b"pre");
+        let id = retained.id();
+        let state = Arc::new(Mutex::new(BashExecutionState::default()));
+        let handle = CommandHandle(PRIVATE.into());
+        state.lock().unwrap().active.insert(
+            PRIVATE.into(),
+            ActiveCommand {
+                call_id: PRIVATE.into(),
+                execution_nonce: 1,
+                session: provider.clone(),
+                handle: handle.clone(),
+            },
+        );
+        state
+            .lock()
+            .unwrap()
+            .cancellation_requested
+            .insert(PRIVATE.into());
+        let guard = CommandGuard {
+            session: provider.clone(),
+            state: state.clone(),
+            execution_id: PRIVATE.into(),
+            execution_nonce: 1,
+            handle: Some(handle),
+            cursor: 3,
+            retained: Some(retained),
+        };
+        (
+            Self {
+                _root: root,
+                provider,
+                state,
+                view,
+                id,
+            },
+            guard,
+        )
+    }
+
+    async fn finish(&self) -> BashOutputMetadata {
+        self.provider.allow_drain.store(true, Ordering::Release);
+        // The provider's read retry backoff and cleanup deadlines are virtual time.
+        for _ in 0..4 {
+            tokio::task::yield_now().await;
+            tokio::time::advance(Duration::from_secs(3)).await;
+        }
+        for _ in 0..1000 {
+            if let Some(metadata) = self.view.metadata(&self.id) {
+                return metadata;
+            }
+            tokio::task::yield_now().await;
+        }
+        panic!("finite cleanup did not publish partial evidence");
+    }
+
+    fn assert_evidence(&self, m: &BashOutputMetadata, terminal: bool, bytes: &[u8]) {
+        assert_eq!(
+            self.view
+                .read(&self.id, CommandStream::Stdout, 0, 64)
+                .unwrap(),
+            bytes
+        );
+        assert_eq!(m.stdout_saved, bytes.len());
+        assert_eq!(m.stdout_delivered, bytes.len() as u64);
+        assert_eq!(m.stdout_seen, bytes.len() as u64);
+        assert_eq!(
+            m.terminal.status,
+            terminal.then_some(CommandStatus::Completed)
+        );
+        assert_eq!(m.terminal.exit_code, terminal.then_some(0));
+        if !terminal {
+            assert!(m.terminal.output_collection.is_none());
+            assert!(m.terminal.process_failure.is_none());
+            assert!(!m.terminal.transport_complete);
+        }
+        let diagnostics = m.cleanup.as_ref().unwrap();
+        assert_eq!(diagnostics.execution_nonce, 1);
+        let json = serde_json::to_string(diagnostics).unwrap();
+        let debug = format!("{diagnostics:?}");
+        for forbidden in [
+            PRIVATE, "SECRET", "/private", "password", "poison", "tail", "pre",
+        ] {
+            assert!(!json.contains(forbidden), "diagnostics leaked data: {json}");
+            assert!(
+                !debug.contains(forbidden),
+                "tracing payload leaked data: {debug}"
+            );
+        }
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn cancel_failure_does_not_preclude_confirmed_terminal() {
+    let (f, guard) = Fixture::start(Fault::Cancel);
+    drop(guard);
+    f.provider.cancelling.notified().await;
+    assert!(f.state.lock().unwrap().active.contains_key(PRIVATE));
+    let m = f.finish().await;
+    f.assert_evidence(&m, true, b"pretail");
+    assert!(m.terminal.transport_complete);
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().cancel,
+        CleanupCancel::Failed { .. }
+    ));
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().drain,
+        CleanupDrain::TerminalConfirmed
+    ));
+    assert!(!m.cleanup.as_ref().unwrap().deadline_expired);
+    assert!(f.state.lock().unwrap().active.is_empty());
+    assert!(f.state.lock().unwrap().cancellation_requested.is_empty());
+}
+
+#[tokio::test(start_paused = true)]
+async fn acknowledged_cancel_drain_faults_keep_distinct_reasons_and_partial_bytes() {
+    for (fault, reason, bytes) in [
+        (Fault::Drain, "provider", b"pre".as_slice()),
+        (Fault::Sequence, "sequence_gap", b"pre"),
+        (Fault::Cursor, "cursor_gap", b"pretail"),
+        (Fault::RetainedChunk, "retained_chunk_invalid", b"pre"),
+        (
+            Fault::TerminalMetadata,
+            "terminal_metadata_invalid",
+            b"pretail",
+        ),
+    ] {
+        let (f, guard) = Fixture::start(fault);
+        drop(guard);
+        f.provider.cancelling.notified().await;
+        let m = f.finish().await;
+        f.assert_evidence(&m, false, bytes);
+        let diagnostic = serde_json::to_value(m.cleanup.as_ref().unwrap()).unwrap();
+        assert_eq!(diagnostic["cancel"]["outcome"], "acknowledged");
+        assert_eq!(diagnostic["drain"]["outcome"], "failed");
+        assert_eq!(diagnostic["drain"]["reason"]["kind"], reason);
+        assert_eq!(diagnostic["registration"], "released");
+        assert_eq!(diagnostic["deadline_expired"], false);
+        assert!(f.state.lock().unwrap().active.is_empty());
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn terminal_deadline_never_claims_stop_or_leaves_active_collector() {
+    let (f, guard) = Fixture::start(Fault::TerminalTimeout);
+    drop(guard);
+    f.provider.cancelling.notified().await;
+    let m = f.finish().await;
+    f.assert_evidence(&m, false, b"pre");
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().cancel,
+        CleanupCancel::Acknowledged
+    ));
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().drain,
+        CleanupDrain::DeadlineExceeded
+    ));
+    assert!(m.cleanup.as_ref().unwrap().deadline_expired);
+    assert!(f.state.lock().unwrap().active.is_empty());
+}
+
+#[tokio::test(start_paused = true)]
+async fn cancel_deadline_still_attempts_independent_terminal_observation() {
+    let (f, guard) = Fixture::start(Fault::CancelHang);
+    drop(guard);
+    f.provider.cancelling.notified().await;
+    let m = f.finish().await;
+    f.assert_evidence(&m, true, b"pretail");
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().cancel,
+        CleanupCancel::DeadlineExceeded
+    ));
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().drain,
+        CleanupDrain::TerminalConfirmed
+    ));
+    assert!(!m.cleanup.as_ref().unwrap().deadline_expired);
+    assert!(f.state.lock().unwrap().active.is_empty());
+}
+
+#[tokio::test(start_paused = true)]
+async fn old_cleanup_preserves_new_execution_and_cancellation_registration() {
+    let (f, guard) = Fixture::start(Fault::Complete);
+    drop(guard);
+    f.provider.cancelling.notified().await;
+    f.state
+        .lock()
+        .unwrap()
+        .active
+        .get_mut(PRIVATE)
+        .unwrap()
+        .execution_nonce = 2;
+    let m = f.finish().await;
+    f.assert_evidence(&m, true, b"pretail");
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().registration,
+        CleanupRegistration::Superseded
+    ));
+    assert_eq!(f.state.lock().unwrap().active[PRIVATE].execution_nonce, 2);
+    assert!(
+        f.state
+            .lock()
+            .unwrap()
+            .cancellation_requested
+            .contains(PRIVATE)
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn terminal_confirmation_is_independent_of_output_collection_completeness() {
+    let (f, guard) = Fixture::start(Fault::CollectionIncomplete);
+    drop(guard);
+    f.provider.cancelling.notified().await;
+    let m = f.finish().await;
+    f.assert_evidence(&m, true, b"pretail");
+    assert!(!m.terminal.transport_complete);
+    assert!(matches!(
+        m.terminal.output_collection,
+        Some(CommandOutputCollection::Incomplete { .. })
+    ));
+    assert!(matches!(
+        m.cleanup.as_ref().unwrap().drain,
+        CleanupDrain::TerminalConfirmed
+    ));
+    assert!(f.state.lock().unwrap().active.is_empty());
+}

crates/tools/src/bash_output.rs

@@ -19,7 +19,7 @@ use std::time::{Duration, Instant};
 use serde::Serialize;
 use workdir::{CommandStatus, CommandStream};
 
-const COMMAND_BYTES: usize = 4 * 1024 * 1024;
+pub(crate) const COMMAND_BYTES: usize = 4 * 1024 * 1024;
 const STORE_BYTES: usize = 32 * 1024 * 1024;
 const STORE_COUNT: usize = 64;
 const ORDER_COUNT: usize = 4096;
@@ -55,6 +55,7 @@ struct Record {
     transport_counts: Option<(u64, u64)>,
     transport_truncation: Option<workdir::CommandOutputTruncation>,
     terminal: Option<OutputTerminal>,
+    cleanup: Option<CleanupDiagnostics>,
 }
 
 #[derive(Clone, Debug, Serialize)]
@@ -68,8 +69,10 @@ pub struct OutputRange {
 pub struct OutputTerminal {
     pub status: Option<CommandStatus>,
     pub exit_code: Option<i32>,
-    /// False on a forcibly dropped collector or failed transport: received bytes are retained,
-    /// but they are not a claim about the unobserved process tail.
+    pub process_failure: Option<workdir::CommandFailure>,
+    pub output_collection: Option<workdir::CommandOutputCollection>,
+    /// True only for confirmed EOF collection (quota is reported separately). A terminal
+    /// fence or exit zero alone does not confirm the unobserved process tail.
     pub transport_complete: bool,
 }
 
@@ -93,10 +96,72 @@ pub struct BashOutputMetadata {
     pub transport_truncation: Option<workdir::CommandOutputTruncation>,
     pub storage_truncated: bool,
     pub terminal: OutputTerminal,
+    pub cleanup: Option<CleanupDiagnostics>,
     pub text_encoding: &'static str,
     pub ordering: &'static str,
 }
 
+/// Drop cleanup observations, not assertions that cancellation stopped a process.
+/// Correlate with the enclosing output UUID and this host-assigned execution generation;
+/// caller identifiers, provider handles, commands and error text are deliberately excluded.
+#[derive(Clone, Debug, Serialize)]
+pub struct CleanupDiagnostics {
+    pub execution_nonce: u64,
+    pub cancel: CleanupCancel,
+    pub drain: CleanupDrain,
+    pub deadline_expired: bool,
+    pub registration: CleanupRegistration,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(tag = "outcome", rename_all = "snake_case")]
+pub enum CleanupCancel {
+    Acknowledged,
+    Failed { reason: CleanupProviderFailure },
+    DeadlineExceeded,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(tag = "outcome", rename_all = "snake_case")]
+pub enum CleanupDrain {
+    TerminalConfirmed,
+    Failed { reason: CleanupFailure },
+    DeadlineExceeded,
+}
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum CleanupFailure {
+    Provider { reason: CleanupProviderFailure },
+    SequenceGap,
+    CursorGap,
+    DeliveryBudgetExceeded,
+    RetainedChunkInvalid,
+    TerminalMetadataInvalid,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct CleanupProviderFailure {
+    pub failure_reason: Option<workdir::WorkdirFailureReason>,
+    pub denial_reason: Option<workdir::WorkdirDenialReason>,
+}
+
+impl From<&workdir::WorkdirError> for CleanupProviderFailure {
+    fn from(error: &workdir::WorkdirError) -> Self {
+        Self {
+            failure_reason: error.failure_reason(),
+            denial_reason: error.denial_reason(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CleanupRegistration {
+    Released,
+    Superseded,
+}
+
 /// A bounded reservation acquired before command start. Drop terminalizes partial evidence.
 pub struct BashOutputWriter {
     record: Arc<Mutex<Record>>,
@@ -212,6 +277,7 @@ impl BashOutputView {
             transport_counts: None,
             transport_truncation: None,
             terminal: None,
+            cleanup: None,
         }));
         store.records.push_back(record.clone());
         store.reserved += COMMAND_BYTES;
@@ -311,6 +377,7 @@ impl Record {
             transport_truncation: self.transport_truncation.clone(),
             storage_truncated: self.truncated || self.transport_truncation.is_some(),
             terminal: self.terminal.clone().expect("finalized record"),
+            cleanup: self.cleanup.clone(),
             text_encoding: "utf8_lossy",
             ordering: "provider_read_observation",
         }
@@ -340,6 +407,14 @@ async fn reap(weak: Weak<Mutex<Store>>, mut shutdown: tokio::sync::watch::Receiv
 }
 
 impl BashOutputWriter {
+    pub(crate) fn id(&self) -> String {
+        self.record.lock().unwrap().id.clone()
+    }
+
+    pub(crate) fn finish_cleanup(&mut self, diagnostics: CleanupDiagnostics) {
+        self.record.lock().unwrap().cleanup = Some(diagnostics);
+    }
+
     pub fn append_chunk(&mut self, chunk: &workdir::CommandByteChunk) -> Result<(), String> {
         let expected = {
             let r = self.record.lock().unwrap();
@@ -405,12 +480,9 @@ impl BashOutputWriter {
         terminal: &workdir::CommandTerminal,
     ) -> Result<BashOutputMetadata, String> {
         let mut r = self.record.lock().unwrap();
-        if terminal.stdout_delivered_bytes != r.stdout_seen
+        if !terminal.metadata_valid()
+            || terminal.stdout_delivered_bytes != r.stdout_seen
             || terminal.stderr_delivered_bytes != r.stderr_seen
-            || terminal.stdout_bytes < r.stdout_seen
-            || terminal.stderr_bytes < r.stderr_seen
-            || ((terminal.stdout_bytes != r.stdout_seen || terminal.stderr_bytes != r.stderr_seen)
-                != terminal.truncation_reason.is_some())
         {
             return Err("command terminal counts do not fence delivered bytes".into());
         }
@@ -419,7 +491,12 @@ impl BashOutputWriter {
         r.terminal = Some(OutputTerminal {
             status: Some(terminal.status),
             exit_code: terminal.exit_code,
-            transport_complete: true,
+            transport_complete: matches!(
+                terminal.output_collection,
+                workdir::CommandOutputCollection::Complete
+            ),
+            process_failure: terminal.process_failure,
+            output_collection: Some(terminal.output_collection),
         });
         Ok(r.metadata())
     }
@@ -439,6 +516,8 @@ impl Drop for BashOutputWriter {
                 status: None,
                 exit_code: None,
                 transport_complete: false,
+                process_failure: None,
+                output_collection: None,
             });
         }
     }
@@ -456,6 +535,8 @@ mod tests {
                 status: Some(CommandStatus::Completed),
                 exit_code: Some(0),
                 transport_complete: true,
+                process_failure: None,
+                output_collection: Some(workdir::CommandOutputCollection::Complete),
             })
             .id
     }
@@ -514,6 +595,8 @@ mod tests {
             status: Some(CommandStatus::Completed),
             exit_code: Some(0),
             transport_complete: true,
+            process_failure: None,
+            output_collection: Some(workdir::CommandOutputCollection::Complete),
         });
         assert!(root.metadata(&metadata.id).is_some());
         let _replacement = sibling.begin().unwrap();
@@ -582,7 +665,7 @@ mod tests {
         let root = BashOutputView::new();
         let mut writer = root.begin().unwrap();
         writer.append(CommandStream::Stdout, b"abc");
-        let mut terminal = serde_json::json!({"status":"completed","exit_code":0,"stdout_bytes":9,"stderr_bytes":0,"stdout_delivered_bytes":4,"stderr_delivered_bytes":0,"truncation_reason":"byte_budget"});
+        let mut terminal = serde_json::json!({"status":"completed","exit_code":0,"process_failure":null,"output_collection":{"state":"complete"},"stdout_bytes":9,"stderr_bytes":0,"stdout_delivered_bytes":4,"stderr_delivered_bytes":0,"truncation_reason":"byte_budget"});
         assert!(
             writer
                 .finish_transport(&serde_json::from_value(terminal.clone()).unwrap())
@@ -602,4 +685,41 @@ mod tests {
             Some(workdir::CommandOutputTruncation::ByteBudget)
         );
     }
+
+    #[test]
+    fn incomplete_collection_with_quota_retains_both_causes_without_claiming_complete_output() {
+        let root = BashOutputView::new();
+        let mut writer = root.begin().unwrap();
+        writer.append(CommandStream::Stdout, b"abc");
+        let terminal: workdir::CommandTerminal = serde_json::from_value(serde_json::json!({
+            "status":"completed", "exit_code":0, "process_failure":null,
+            "output_collection":{"state":"incomplete","failure":{"stage":"stdout_drain","reason":"other","os_code":null}},
+            "stdout_bytes":9, "stderr_bytes":0, "stdout_delivered_bytes":3, "stderr_delivered_bytes":0,
+            "truncation_reason":"byte_budget"
+        })).unwrap();
+        let metadata = writer.finish_transport(&terminal).unwrap();
+        assert!(!metadata.terminal.transport_complete);
+        assert_eq!(metadata.terminal.exit_code, Some(0));
+        assert_eq!(
+            metadata.terminal.output_collection,
+            Some(terminal.output_collection)
+        );
+        assert_eq!(
+            metadata.transport_truncation,
+            Some(workdir::CommandOutputTruncation::ByteBudget)
+        );
+        assert_eq!(metadata.stdout_seen, 9);
+        assert_eq!(metadata.stdout_saved, 3);
+        assert!(metadata.storage_truncated);
+        assert!(metadata.retention_limit.is_none());
+        assert_eq!(
+            root.read(&metadata.id, CommandStream::Stdout, 0, 100)
+                .unwrap(),
+            b"abc"
+        );
+        assert_eq!(
+            serde_json::to_value(root.metadata(&metadata.id).unwrap()).unwrap(),
+            serde_json::to_value(metadata).unwrap()
+        );
+    }
 }

crates/tools/src/edit.rs

@@ -21,7 +21,7 @@ pub(crate) struct EditParams {
     /// Worker-local alias of the Workdir attachment to use.
     #[serde(default)]
     pub target_workdir: Option<String>,
-    /// Logical path relative to the bound Workdir root.
+    /// Existing file in which to replace text.
     pub file_path: String,
     #[serde(flatten)]
     pub edit: fs_operation::text::EditArgs,

crates/tools/src/file_target.rs

@@ -147,7 +147,9 @@ impl FileTarget {
 pub(crate) fn checked_error(error: workdir::WorkdirError) -> ToolError {
     use workdir::WorkdirError;
     let code = match error.classification_source() {
-        WorkdirError::DenialContext { .. } => unreachable!("diagnostic context unwrapped"),
+        WorkdirError::DenialContext { .. } | WorkdirError::FailureContext { .. } => {
+            unreachable!("diagnostic context unwrapped")
+        }
         WorkdirError::Conflict(_) | WorkdirError::NotFound(_) => "checkout_stale",
         WorkdirError::Denied { .. }
         | WorkdirError::OutOfScope { .. }
@@ -165,6 +167,7 @@ pub(crate) fn checked_error(error: workdir::WorkdirError) -> ToolError {
         | WorkdirError::IsDirectory { .. }
         | WorkdirError::InvalidGlob { .. }
         | WorkdirError::InvalidRegex { .. } => "checkout_invalid",
+        WorkdirError::NotDispatched => "checkout_not_dispatched",
         WorkdirError::Unavailable { .. } | WorkdirError::SessionClosed => "checkout_unavailable",
         // IO/transport failures may arrive after effects have begun. Do not infer
         // no-effects from their text or strip explicit OutcomeUnknown evidence.

crates/tools/src/glob.rs

@@ -17,7 +17,7 @@ pub(crate) struct GlobParams {
     pub target_workdir: Option<String>,
     /// Glob pattern, for example `**/*.rs` or `src/**/test_*.py`.
     pub pattern: String,
-    /// Logical Workdir-relative directory. Defaults to the Workdir root.
+    /// Directory to search. Defaults to `.`.
     #[serde(default)]
     pub path: Option<String>,
 }
@@ -106,7 +106,7 @@ pub(crate) fn routed_glob_tool(router: Arc<WorkdirSessionRouter>) -> ToolDefinit
     Arc::new(move || {
         let schema = schemars::schema_for!(GlobParams);
         let meta = ToolMeta::new("Glob")
-            .description("Find files matching a glob pattern inside the selected Workdir. Results are sorted and capped at 1000 entries. Paths are Workdir-relative.")
+            .description("Find files matching a glob pattern inside the selected Workdir. Results are sorted and capped at 1000 entries.")
             .input_schema(serde_json::to_value(schema).expect("Glob schema serialization"));
         let tool: Arc<dyn Tool> = Arc::new(GlobTool {
             router: router.clone(),

crates/tools/src/grep.rs

@@ -27,7 +27,7 @@ pub(crate) struct GrepParams {
     #[serde(default)]
     target_workdir: Option<String>,
     pattern: String,
-    /// Workdir-relative path, or an absolute path covered by readable scope. Defaults to the Workdir root.
+    /// File or directory to search. Defaults to `.`.
     #[serde(default)]
     pub path: Option<String>,
     #[serde(default)]
@@ -160,7 +160,7 @@ pub(crate) fn routed_grep_tool(router: Arc<WorkdirSessionRouter>) -> ToolDefinit
     Arc::new(move || {
         let schema = schemars::schema_for!(GrepParams);
         let meta = ToolMeta::new("Grep")
-            .description("Search a file or directory in the selected Workdir with a regex. Content results group lines by file; `>` marks matching lines and unmarked lines are context. Directory traversal executes inside the WorkdirSession provider. Results are bounded and Workdir-relative.")
+            .description("Search a file or directory in the selected Workdir with a regex. Content results group lines by file; `>` marks matching lines and unmarked lines are context. Directory traversal executes inside the WorkdirSession provider. Results are bounded.")
             .input_schema(serde_json::to_value(schema).expect("Grep schema serialization"));
         let tool: Arc<dyn Tool> = Arc::new(GrepTool {
             router: router.clone(),

crates/tools/src/read.rs

@@ -13,7 +13,7 @@ use workdir::{WorkdirPath, WorkdirSessionHandle, WorkdirSessionRouter};
 const DESCRIPTION: &str = "Read a text file from a Workdir attachment selected by its Worker-local alias. \
 Supports offset/limit for large files. Returns line-numbered output (1-based). \
 Directories cannot be read. The file must be read before Write or Edit can \
-modify it. Paths are Workdir-relative unless an absolute path is explicitly readable. \
+modify it. \
 When exactly one Workdir is attached, target_workdir may be omitted.";
 
 const DEFAULT_LIMIT: usize = 2000;
@@ -24,7 +24,7 @@ pub(crate) struct ReadParams {
     /// Worker-local alias of the Workdir attachment to use.
     #[serde(default)]
     pub target_workdir: Option<String>,
-    /// Workdir-relative path, or an absolute path covered by readable scope.
+    /// Text file to read; directories are not supported.
     pub file_path: String,
     #[serde(flatten)]
     pub read: fs_operation::text::LineReadArgs,

crates/tools/src/view_image.rs

@@ -20,7 +20,7 @@ pub const MAX_IMAGE_BYTES: usize = 10 * 1024 * 1024;
 const IMAGE_READ_CHUNK_BYTES: usize = 1024 * 1024;
 
 const DESCRIPTION: &str = "Attach an image from the selected Workdir attachment to the next model request. \
-The path must be logical and Workdir-relative. Supported formats: PNG, JPEG, GIF, and WebP. \
+Supported formats: PNG, JPEG, GIF, and WebP. \
 When exactly one Workdir is attached, target_workdir may be omitted.";
 
 #[derive(Debug, Deserialize, schemars::JsonSchema)]
@@ -28,7 +28,7 @@ struct ViewImageParams {
     /// Worker-local alias of the Workdir attachment to use.
     #[serde(default)]
     target_workdir: Option<String>,
-    /// Logical path relative to the bound Workdir root.
+    /// Image file to attach to the next model request.
     path: String,
 }
 

crates/tools/src/write.rs

@@ -20,7 +20,7 @@ pub(crate) struct WriteParams {
     /// Worker-local alias of the Workdir attachment to use.
     #[serde(default)]
     pub target_workdir: Option<String>,
-    /// Logical path relative to the bound Workdir root.
+    /// File to create or overwrite.
     pub file_path: String,
     #[serde(flatten)]
     pub write: fs_operation::text::WriteArgs,

crates/tools/tests/integration.rs

@@ -3,6 +3,11 @@
 //! `ToolServerHandle::register_tool` / `flush_pending` are `pub(crate)` in
 //! agen, so from here we exercise the factories directly — the same
 //! code path that `flush_pending()` runs at production time.
+//!
+//! Scoped routing cases connect real LocalWorkdirSession, WorkdirToolBroker::scope,
+//! attachment router and Tool factories without replacing their permission or path checks.
+//! They use RAII temporary roots and existing image fixtures; command cases require the
+//! same local shell as the Bash suite and run in the normal `tools --test integration` target.
 
 use std::path::Path;
 use std::sync::Arc;
@@ -80,6 +85,101 @@ fn setup_routed() -> (TempDir, TempDir, Arc<WorkdirSessionRouter>, Registry) {
     (left, right, router, Registry::new(definitions))
 }
 
+const READ_SAME_FILE: &str = "IFS= read -r line < same.txt && printf '%s\\n' \"$line\"";
+
+struct ScopedRegistry {
+    roots: Vec<TempDir>,
+    directories: Vec<std::path::PathBuf>,
+    brokers: Vec<WorkdirToolBroker>,
+    leases: Vec<workdir::WorkdirScopeLease>,
+    router: Arc<WorkdirSessionRouter>,
+    reg: Registry,
+}
+
+impl ScopedRegistry {
+    // Cwd and scope targets here are delegation declarations in provider coordinates.
+    async fn new(attachments: &[(&str, &str, bool)]) -> Self {
+        let router = Arc::new(WorkdirSessionRouter::new());
+        let mut roots = Vec::new();
+        let mut directories = Vec::new();
+        let mut brokers = Vec::new();
+        let mut leases = Vec::new();
+        for &(alias, cwd, command) in attachments {
+            let root = TempDir::new().unwrap();
+            let directory = root.path().join(cwd);
+            std::fs::create_dir_all(directory.join("subdir")).unwrap();
+            std::fs::write(directory.join("same.txt"), format!("{alias} original\n")).unwrap();
+            std::fs::write(
+                directory.join("subdir/same.txt"),
+                format!("{alias} nested needle\n"),
+            )
+            .unwrap();
+            std::fs::write(
+                directory.join("image.png"),
+                include_bytes!("fixtures/view-image/valid.png"),
+            )
+            .unwrap();
+            if cwd != "." {
+                // Decoys make accidental root-based resolution observable.
+                std::fs::write(root.path().join("same.txt"), "root decoy\n").unwrap();
+                std::fs::write(root.path().join("image.png"), "not an image").unwrap();
+            }
+            let source: WorkdirSessionHandle = Arc::new(LocalWorkdirSession::new(
+                Scope::writable(root.path()).unwrap(),
+                root.path().to_path_buf(),
+            ));
+            let broker = WorkdirToolBroker::new(source);
+            let lease = broker
+                .scope(WorkdirToolScope {
+                    rules: vec![WorkdirToolScopeRule {
+                        target: WorkdirPath::new(cwd).unwrap(),
+                        permission: WorkdirToolScopePermission::Write,
+                        recursive: true,
+                        symlink_policy: Default::default(),
+                    }],
+                    cwd: WorkdirPath::new(cwd).unwrap(),
+                    command,
+                })
+                .await
+                .unwrap();
+            router
+                .attach(
+                    WorkdirAttachmentAlias::new(alias).unwrap(),
+                    lease.tool_session(),
+                )
+                .unwrap();
+            roots.push(root);
+            directories.push(directory);
+            brokers.push(broker);
+            leases.push(lease);
+        }
+        let mut definitions = routed_builtin_tools(
+            router.clone(),
+            Tracker::new(),
+            tools::bash_output::BashOutputView::new(),
+        );
+        definitions.push(routed_view_image_tool(router.clone()));
+        Self {
+            roots,
+            directories,
+            brokers,
+            leases,
+            router,
+            reg: Registry::new(definitions),
+        }
+    }
+
+    async fn close(self) {
+        self.router.close_all().await.unwrap();
+        for lease in &self.leases {
+            lease.close().await.unwrap();
+        }
+        for broker in &self.brokers {
+            broker.close().await.unwrap();
+        }
+    }
+}
+
 fn valid_gif_with_len(target_len: usize) -> Vec<u8> {
     let fixture = include_bytes!("fixtures/view-image/valid.gif");
     assert_eq!(
@@ -156,6 +256,71 @@ fn routed_tool_schemas_share_optional_target_workdir() {
     }
 }
 
+#[test]
+fn routed_tool_help_does_not_override_session_path_coordinates() {
+    fn assert_no_root_coordinates(tool: &str, description: &str) {
+        let normalized = description
+            .split_whitespace()
+            .collect::<Vec<_>>()
+            .join(" ")
+            .to_ascii_lowercase();
+        for obsolete in ["workdir-relative", "workdir root", "root-relative"] {
+            assert!(
+                !normalized.contains(obsolete),
+                "{tool} help overrides session path coordinates: {description}"
+            );
+        }
+    }
+
+    fn check_schema_descriptions(tool: &str, schema: &serde_json::Value) {
+        match schema {
+            serde_json::Value::Object(object) => {
+                if let Some(description) = object.get("description").and_then(|v| v.as_str()) {
+                    assert_no_root_coordinates(tool, description);
+                }
+                for value in object.values() {
+                    check_schema_descriptions(tool, value);
+                }
+            }
+            serde_json::Value::Array(array) => {
+                for value in array {
+                    check_schema_descriptions(tool, value);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    let router = Arc::new(WorkdirSessionRouter::new());
+    let mut definitions = routed_builtin_tools(
+        router.clone(),
+        Tracker::new(),
+        tools::bash_output::BashOutputView::new(),
+    );
+    definitions.push(routed_view_image_tool(router));
+    for definition in definitions {
+        let (meta, _) = definition();
+        assert_no_root_coordinates(&meta.name, &meta.description);
+        // Referenced type definitions are model-visible too, not just properties.
+        check_schema_descriptions(&meta.name, &meta.input_schema);
+
+        let path_parameter = match meta.name.as_str() {
+            "Read" | "Write" | "Edit" => "file_path",
+            "Glob" | "Grep" | "ViewImage" => "path",
+            "Bash" => "cwd",
+            other => panic!("missing path parameter contract for {other}"),
+        };
+        let help = meta.input_schema["properties"][path_parameter]["description"]
+            .as_str()
+            .unwrap_or_default();
+        assert!(
+            !help.trim().is_empty(),
+            "{}.{path_parameter} must retain argument-specific help",
+            meta.name
+        );
+    }
+}
+
 #[tokio::test]
 async fn routed_tools_require_alias_only_when_attachment_set_is_ambiguous() {
     let (_left, _right, router, reg) = setup_routed();
@@ -284,6 +449,427 @@ async fn target_alias_routes_each_tool_and_isolates_read_before_edit() {
     router.close_all().await.unwrap();
 }
 
+#[tokio::test]
+async fn scoped_cwd_file_search_and_image_tools_share_reusable_paths() {
+    for cwd in [".", "work"] {
+        let fixture = ScopedRegistry::new(&[("checkout", cwd, false)]).await;
+        let read = fixture.reg.get("Read");
+        let original = call(&read, json!({ "file_path": "same.txt" })).await;
+        assert!(original.content.unwrap().contains("checkout original"));
+        call(
+            &fixture.reg.get("Write"),
+            json!({ "file_path": "same.txt", "content": "written marker\n" }),
+        )
+        .await;
+        call(
+            &fixture.reg.get("Edit"),
+            json!({ "file_path": "same.txt", "old_string": "written", "new_string": "edited" }),
+        )
+        .await;
+        let edited = call(&read, json!({ "file_path": "same.txt" })).await;
+        assert!(edited.content.unwrap().contains("edited marker"));
+        assert_eq!(
+            std::fs::read_to_string(fixture.directories[0].join("same.txt")).unwrap(),
+            "edited marker\n"
+        );
+
+        // Omitted search paths start at cwd, not at the underlying provider root.
+        for (name, input) in [
+            ("Glob", json!({ "pattern": "same.txt" })),
+            (
+                "Grep",
+                json!({ "pattern": "edited marker", "output_mode": "files_with_matches" }),
+            ),
+        ] {
+            let result = call(&fixture.reg.get(name), input).await;
+            assert_eq!(
+                result.content.unwrap().trim(),
+                "same.txt",
+                "{name}, cwd={cwd}"
+            );
+        }
+
+        // A search rooted below cwd still returns cwd-relative reusable paths.
+        for (name, input) in [
+            ("Glob", json!({ "pattern": "*.txt", "path": "subdir" })),
+            (
+                "Grep",
+                json!({ "pattern": "needle", "path": "subdir", "output_mode": "files_with_matches" }),
+            ),
+        ] {
+            let result = call(&fixture.reg.get(name), input).await;
+            let body = result.content.unwrap();
+            let paths: Vec<_> = body.lines().collect();
+            assert_eq!(paths, ["subdir/same.txt"], "{name}, cwd={cwd}");
+            let path = paths[0];
+            let found = call(&read, json!({ "file_path": path })).await;
+            assert!(found.content.unwrap().contains("checkout nested needle"));
+            call(
+                &fixture.reg.get("Edit"),
+                json!({ "file_path": path, "old_string": "needle", "new_string": format!("needle-{name}") }),
+            )
+            .await;
+        }
+        assert_eq!(
+            std::fs::read_to_string(fixture.directories[0].join("subdir/same.txt")).unwrap(),
+            "checkout nested needle-Grep-Glob\n"
+        );
+        let image = call(
+            &fixture.reg.get("ViewImage"),
+            json!({ "path": "image.png" }),
+        )
+        .await;
+        assert_eq!(image.attachments.len(), 1);
+        let agen::tool::Attachment::Image(image) = &image.attachments[0];
+        assert_eq!(image.mime_type(), "image/png");
+        assert_eq!(
+            image.data(),
+            include_bytes!("fixtures/view-image/valid.png")
+        );
+        if cwd != "." {
+            assert_eq!(
+                std::fs::read_to_string(fixture.roots[0].path().join("same.txt")).unwrap(),
+                "root decoy\n"
+            );
+        }
+        fixture.close().await;
+    }
+}
+
+#[tokio::test]
+async fn scoped_bash_relative_cwd_and_cd_do_not_change_later_tool_cwd() {
+    for cwd in [".", "work"] {
+        let fixture = ScopedRegistry::new(&[("checkout", cwd, true)]).await;
+        for (command_cwd, command, expected) in [
+            (".", READ_SAME_FILE, "checkout original\n"),
+            ("subdir", READ_SAME_FILE, "checkout nested needle\n"),
+            ("./subdir//.", READ_SAME_FILE, "checkout nested needle\n"),
+            (
+                ".",
+                "cd subdir && IFS= read -r line < same.txt && printf '%s\\n' \"$line\"",
+                "checkout nested needle\n",
+            ),
+            (".", READ_SAME_FILE, "checkout original\n"),
+        ] {
+            let output = call(
+                &fixture.reg.get("Bash"),
+                json!({ "cwd": command_cwd, "command": command, "timeout": 5 }),
+            )
+            .await;
+            let body: serde_json::Value = serde_json::from_str(&output.content.unwrap()).unwrap();
+            assert_eq!(body["output"]["terminal"]["exit_code"], 0, "{body}");
+            assert_eq!(body["stdout_preview"], expected, "cwd={cwd}, {command}");
+            let subsequent =
+                call(&fixture.reg.get("Read"), json!({ "file_path": "same.txt" })).await;
+            assert!(subsequent.content.unwrap().contains("checkout original"));
+        }
+        fixture.close().await;
+    }
+}
+
+#[tokio::test]
+async fn scoped_aliases_with_different_cwds_keep_paths_and_observations_separate() {
+    let fixture =
+        ScopedRegistry::new(&[("left", "work", true), ("right", "other/deep", true)]).await;
+    let read = fixture.reg.get("Read");
+    let edit = fixture.reg.get("Edit");
+    call(
+        &read,
+        json!({ "target_workdir": "left", "file_path": "same.txt" }),
+    )
+    .await;
+    let unread = call_err(
+        &edit,
+        json!({ "target_workdir": "right", "file_path": "same.txt", "old_string": "original", "new_string": "wrong" }),
+    )
+    .await;
+    assert!(unread.to_string().contains("has not been read"), "{unread}");
+    call(
+        &read,
+        json!({ "target_workdir": "right", "file_path": "same.txt" }),
+    )
+    .await;
+    call(
+        &fixture.reg.get("Write"),
+        json!({ "target_workdir": "right", "file_path": "same.txt", "content": "right written\n" }),
+    )
+    .await;
+    call(
+        &edit,
+        json!({ "target_workdir": "right", "file_path": "same.txt", "old_string": "written", "new_string": "edited" }),
+    )
+    .await;
+    assert_eq!(
+        std::fs::read_to_string(fixture.directories[0].join("same.txt")).unwrap(),
+        "left original\n"
+    );
+    assert_eq!(
+        std::fs::read_to_string(fixture.directories[1].join("same.txt")).unwrap(),
+        "right edited\n"
+    );
+
+    // Different valid bytes make cross-alias image reads observable too.
+    let png: &[u8] = include_bytes!("fixtures/view-image/valid.png");
+    let gif: &[u8] = include_bytes!("fixtures/view-image/valid.gif");
+    std::fs::write(fixture.directories[1].join("image.png"), gif).unwrap();
+    for (alias, expected, image_bytes, mime) in [
+        ("left", "left original", png, "image/png"),
+        ("right", "right edited", gif, "image/gif"),
+    ] {
+        let output = call(
+            &read,
+            json!({ "target_workdir": alias, "file_path": "same.txt" }),
+        )
+        .await;
+        assert!(output.content.unwrap().contains(expected));
+        for (name, input) in [
+            (
+                "Glob",
+                json!({ "target_workdir": alias, "pattern": "*.txt", "path": "subdir" }),
+            ),
+            (
+                "Grep",
+                json!({ "target_workdir": alias, "pattern": alias, "path": "subdir", "output_mode": "files_with_matches" }),
+            ),
+        ] {
+            let output = call(&fixture.reg.get(name), input).await;
+            let path = output.content.unwrap();
+            let path = path.trim();
+            assert_eq!(path, "subdir/same.txt", "{alias}: {name}");
+            let found = call(&read, json!({ "target_workdir": alias, "file_path": path })).await;
+            assert!(
+                found
+                    .content
+                    .unwrap()
+                    .contains(&format!("{alias} nested needle"))
+            );
+        }
+        let image = call(
+            &fixture.reg.get("ViewImage"),
+            json!({ "target_workdir": alias, "path": "image.png" }),
+        )
+        .await;
+        let agen::tool::Attachment::Image(image) = &image.attachments[0];
+        assert_eq!(image.mime_type(), mime);
+        assert_eq!(image.data(), image_bytes);
+        let output = call(
+            &fixture.reg.get("Bash"),
+            json!({ "target_workdir": alias, "cwd": ".", "command": READ_SAME_FILE, "timeout": 5 }),
+        )
+        .await;
+        let body: serde_json::Value = serde_json::from_str(&output.content.unwrap()).unwrap();
+        assert_eq!(body["output"]["terminal"]["exit_code"], 0, "{body}");
+        assert_eq!(body["stdout_preview"], format!("{expected}\n"));
+    }
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn scoped_command_false_rejects_bash_without_fallback_to_another_alias() {
+    let fixture =
+        ScopedRegistry::new(&[("enabled", "work", true), ("disabled", "other", false)]).await;
+    for cwd in [".", "subdir"] {
+        let error = call_err(
+            &fixture.reg.get("Bash"),
+            json!({ "target_workdir": "disabled", "cwd": cwd, "command": "printf forbidden > blocked.txt", "timeout": 5 }),
+        )
+        .await;
+        assert!(
+            error.to_string().contains("does not support Command"),
+            "{error}"
+        );
+    }
+    // Write permission remains usable, but does not imply command permission.
+    call(
+        &fixture.reg.get("Write"),
+        json!({ "target_workdir": "disabled", "file_path": "created.txt", "content": "allowed write\n" }),
+    )
+    .await;
+    assert_eq!(
+        std::fs::read_to_string(fixture.directories[1].join("created.txt")).unwrap(),
+        "allowed write\n"
+    );
+    for (root, directory) in fixture.roots.iter().zip(&fixture.directories) {
+        for path in [
+            root.path().to_path_buf(),
+            directory.clone(),
+            directory.join("subdir"),
+        ] {
+            assert!(!path.join("blocked.txt").exists());
+        }
+    }
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn scoped_normalized_paths_share_read_before_mutation_history() {
+    let fixture = ScopedRegistry::new(&[("checkout", "work", false)]).await;
+    let read = call(
+        &fixture.reg.get("Read"),
+        json!({ "file_path": "./subdir//./same.txt" }),
+    )
+    .await;
+    assert!(read.content.unwrap().contains("checkout nested needle"));
+    call(
+        &fixture.reg.get("Write"),
+        json!({ "file_path": "subdir/same.txt", "content": "normalized write\n" }),
+    )
+    .await;
+    call(
+        &fixture.reg.get("Edit"),
+        json!({ "file_path": "./subdir/same.txt", "old_string": "write", "new_string": "edit" }),
+    )
+    .await;
+    assert_eq!(
+        std::fs::read_to_string(fixture.directories[0].join("subdir/same.txt")).unwrap(),
+        "normalized edit\n"
+    );
+    for (name, input) in [
+        ("Glob", json!({ "pattern": "*.txt", "path": "./subdir//." })),
+        (
+            "Grep",
+            json!({ "pattern": "normalized edit", "path": "./subdir//.", "output_mode": "files_with_matches" }),
+        ),
+    ] {
+        let result = call(&fixture.reg.get(name), input).await;
+        assert_eq!(result.content.unwrap().trim(), "subdir/same.txt", "{name}");
+    }
+    let image = call(
+        &fixture.reg.get("ViewImage"),
+        json!({ "path": "././image.png" }),
+    )
+    .await;
+    let agen::tool::Attachment::Image(image) = &image.attachments[0];
+    assert_eq!(
+        image.data(),
+        include_bytes!("fixtures/view-image/valid.png")
+    );
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn scoped_tools_reject_parent_traversal_and_paths_outside_the_grant() {
+    let fixture = ScopedRegistry::new(&[("checkout", "work", true)]).await;
+    let outside = fixture.roots[0].path().join("outside");
+    std::fs::create_dir(&outside).unwrap();
+    std::fs::write(outside.join("secret.txt"), "private needle\n").unwrap();
+    for invalid in [
+        "../outside/secret.txt",
+        "subdir/../../outside/secret.txt",
+        "subdir\\same.txt",
+    ] {
+        for (name, input) in [
+            ("Read", json!({ "file_path": invalid })),
+            (
+                "Write",
+                json!({ "file_path": invalid, "content": "forbidden" }),
+            ),
+            (
+                "Edit",
+                json!({ "file_path": invalid, "old_string": "needle", "new_string": "forbidden" }),
+            ),
+            ("Glob", json!({ "path": invalid, "pattern": "*" })),
+            ("Grep", json!({ "path": invalid, "pattern": "needle" })),
+            ("ViewImage", json!({ "path": invalid })),
+            (
+                "Bash",
+                json!({ "cwd": invalid, "command": "printf forbidden > blocked.txt", "timeout": 5 }),
+            ),
+        ] {
+            let error = call_err(&fixture.reg.get(name), input).await;
+            assert!(
+                error.to_string().contains("path"),
+                "{name}: {invalid}: {error}"
+            );
+        }
+    }
+    // These paths are inside the provider's grant, but outside the child's grant.
+    // Absolute readable paths must not bypass the delegated scope after cwd rebasing.
+    for (name, input) in [
+        ("Read", json!({ "file_path": outside.join("secret.txt") })),
+        ("Grep", json!({ "path": outside, "pattern": "needle" })),
+        (
+            "Bash",
+            json!({ "cwd": outside, "command": "printf forbidden > blocked.txt", "timeout": 5 }),
+        ),
+    ] {
+        let error = call_err(&fixture.reg.get(name), input).await;
+        let message = error.to_string();
+        assert!(
+            matches!(error, ToolError::InvalidArgument(_)),
+            "{name}: {message}"
+        );
+        assert!(
+            message.contains("scope") || message.contains("path"),
+            "{name}: {message}"
+        );
+    }
+    assert_eq!(
+        std::fs::read_to_string(outside.join("secret.txt")).unwrap(),
+        "private needle\n"
+    );
+    assert!(!outside.join("blocked.txt").exists());
+    assert!(!fixture.directories[0].join("blocked.txt").exists());
+    assert!(!fixture.roots[0].path().join("blocked.txt").exists());
+    fixture.close().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn scoped_cwd_tools_reject_resolved_symlink_escape_after_a_read() {
+    use std::os::unix::fs::symlink;
+
+    let fixture = ScopedRegistry::new(&[("checkout", "work", true)]).await;
+    let outside = fixture.roots[0].path().join("outside");
+    std::fs::create_dir(&outside).unwrap();
+    // Equal bytes avoid disguising an authority failure as a stale-hash rejection.
+    std::fs::write(outside.join("secret.txt"), "checkout original\n").unwrap();
+    let png = include_bytes!("fixtures/view-image/valid.png");
+    std::fs::write(outside.join("image.png"), png).unwrap();
+    call(&fixture.reg.get("Read"), json!({ "file_path": "same.txt" })).await;
+    std::fs::remove_file(fixture.directories[0].join("same.txt")).unwrap();
+    symlink(
+        "../outside/secret.txt",
+        fixture.directories[0].join("same.txt"),
+    )
+    .unwrap();
+    symlink("../outside", fixture.directories[0].join("escape")).unwrap();
+
+    for (name, input) in [
+        ("Read", json!({ "file_path": "same.txt" })),
+        (
+            "Write",
+            json!({ "file_path": "escape/created.txt", "content": "forbidden" }),
+        ),
+        (
+            "Edit",
+            json!({ "file_path": "same.txt", "old_string": "original", "new_string": "forbidden" }),
+        ),
+        ("Glob", json!({ "path": "escape", "pattern": "*" })),
+        ("Grep", json!({ "path": "escape", "pattern": "original" })),
+        ("ViewImage", json!({ "path": "escape/image.png" })),
+        (
+            "Bash",
+            json!({ "cwd": "escape", "command": "printf forbidden > blocked.txt", "timeout": 5 }),
+        ),
+    ] {
+        let error = call_err(&fixture.reg.get(name), input).await;
+        let message = error.to_string();
+        assert!(
+            message.contains("scope") || message.contains("symlink"),
+            "{name}: {message}"
+        );
+    }
+    assert_eq!(
+        std::fs::read_to_string(outside.join("secret.txt")).unwrap(),
+        "checkout original\n"
+    );
+    assert_eq!(std::fs::read(outside.join("image.png")).unwrap(), png);
+    assert!(!outside.join("created.txt").exists());
+    assert!(!outside.join("blocked.txt").exists());
+    fixture.close().await;
+}
+
 #[tokio::test]
 async fn selected_attachment_capability_is_checked_without_fallback() {
     let left = TempDir::new().unwrap();
@@ -416,6 +1002,7 @@ struct ExternalValidatingSession {
     truncate_first_binary_response: bool,
     command_response_losses: std::sync::atomic::AtomicUsize,
     lose_terminal_only: bool,
+    collection_override: Option<workdir::CommandOutputCollection>,
     mutate_after_first_binary_response: Option<std::path::PathBuf>,
 }
 
@@ -534,7 +1121,11 @@ impl workdir::WorkdirSession for ExternalValidatingSession {
         &self,
         request: workdir::CommandOutputRequest,
     ) -> Result<workdir::CommandOutput, workdir::WorkdirError> {
-        let output = self.inner.command_output(request).await?;
+        let mut output = self.inner.command_output(request).await?;
+        if let (Some(collection), Some(terminal)) = (self.collection_override, &mut output.terminal)
+        {
+            terminal.output_collection = collection;
+        }
         if (!self.lose_terminal_only || output.terminal.is_some())
             && self
                 .command_response_losses
@@ -546,9 +1137,10 @@ impl workdir::WorkdirSession for ExternalValidatingSession {
                 .is_ok()
         {
             // The production provider has committed a page, but its response is lost.
-            return Err(workdir::WorkdirError::Transport(
-                "injected lost response".into(),
-            ));
+            return Err(
+                workdir::WorkdirError::Transport("injected lost response".into())
+                    .with_failure_reason(workdir::WorkdirFailureReason::HttpTimeout),
+            );
         }
         Ok(output)
     }
@@ -574,6 +1166,7 @@ async fn external_view_image_uses_a_protocol_bounded_request() {
         truncate_first_binary_response: false,
         command_response_losses: std::sync::atomic::AtomicUsize::new(0),
         lose_terminal_only: false,
+        collection_override: None,
         mutate_after_first_binary_response: None,
     });
     let png = include_bytes!("fixtures/view-image/valid.png");
@@ -599,6 +1192,7 @@ async fn external_view_image_rejects_truncated_and_cross_version_chunks() {
         truncate_first_binary_response: true,
         command_response_losses: std::sync::atomic::AtomicUsize::new(0),
         lose_terminal_only: false,
+        collection_override: None,
         mutate_after_first_binary_response: None,
     });
     let (_meta, tool) = view_image_tool(truncated)();
@@ -617,6 +1211,7 @@ async fn external_view_image_rejects_truncated_and_cross_version_chunks() {
         truncate_first_binary_response: false,
         command_response_losses: std::sync::atomic::AtomicUsize::new(0),
         lose_terminal_only: false,
+        collection_override: None,
         mutate_after_first_binary_response: Some(image_path),
     });
     let (_meta, tool) = view_image_tool(changing)();
@@ -1103,7 +1698,20 @@ async fn bash_cancellation_returns_bounded_progress_as_terminal_output() {
     let execution = tokio::spawn(async move {
         executing.execute(r#"{"command":"printf 'before'; printf 'err-before' >&2; while :; do :; done","cwd":"."}"#, execution_context).await
     });
-    await_command_output(&mut events).await;
+    // Cancellation must follow both writes, not merely the first stdout chunk.
+    tokio::time::timeout(std::time::Duration::from_secs(5), async {
+        let mut ready = [false; 2];
+        while !ready.iter().all(|seen| *seen) {
+            if let workdir::CommandEvent::Output { stream, .. } = events.recv().await.unwrap() {
+                ready[match stream {
+                    workdir::CommandStream::Stdout => 0,
+                    workdir::CommandStream::Stderr => 1,
+                }] = true;
+            }
+        }
+    })
+    .await
+    .expect("both streams written before cancellation");
     bash.cancel_execution(&context).await.unwrap();
     let ToolError::Cancelled(output) =
         tokio::time::timeout(std::time::Duration::from_secs(5), execution)
@@ -1280,6 +1888,7 @@ async fn lost_page_and_terminal_responses_replay_without_restarting_or_double_ap
             mutate_after_first_binary_response: None,
             command_response_losses: std::sync::atomic::AtomicUsize::new(1),
             lose_terminal_only,
+            collection_override: None,
         });
         let view = tools::bash_output::BashOutputView::new();
         let definitions = core_builtin_tools(session.clone(), Tracker::new(), view.clone());
@@ -1314,3 +1923,80 @@ async fn lost_page_and_terminal_responses_replay_without_restarting_or_double_ap
         session.close().await.unwrap();
     }
 }
+
+// Provider metadata is the fixture here; actual read/drain injection and HTTP
+// forwarding are tested by workdir's production-supervisor suite.
+#[tokio::test]
+async fn exit_zero_with_incomplete_output_keeps_partial_bytes_and_safe_failure_in_retained_evidence()
+ {
+    use workdir::{
+        CommandFailure, CommandFailureStage as Stage, CommandIoErrorKind, CommandOutputCollection,
+    };
+    for stage in [
+        Stage::StdoutRead,
+        Stage::StderrRead,
+        Stage::StdoutDrain,
+        Stage::StderrDrain,
+        Stage::OutputDelivery,
+    ] {
+        let root = TempDir::new().unwrap();
+        let failure = CommandFailure {
+            stage,
+            reason: CommandIoErrorKind::PermissionDenied,
+            os_code: None,
+        };
+        let collection = CommandOutputCollection::Incomplete { failure };
+        let session: WorkdirSessionHandle = Arc::new(ExternalValidatingSession {
+            inner: LocalWorkdirSession::new(
+                Scope::writable(root.path()).unwrap(),
+                root.path().into(),
+            ),
+            truncate_first_binary_response: false,
+            mutate_after_first_binary_response: None,
+            command_response_losses: std::sync::atomic::AtomicUsize::new(0),
+            lose_terminal_only: false,
+            collection_override: Some(collection),
+        });
+        let view = tools::bash_output::BashOutputView::new();
+        let (_, bash) = tools::bash_tool(session.clone(), view.clone())();
+        let out = call(
+            &bash,
+            json!({"cwd":".","command":"printf partial; printf err >&2"}),
+        )
+        .await;
+        assert!(out.summary.ends_with("(output incomplete)"));
+        let body: serde_json::Value = serde_json::from_str(&out.content.unwrap()).unwrap();
+        let metadata = &body["output"];
+        assert_eq!(body["stdout_preview"], "partial");
+        assert_eq!(body["stderr_preview"], "err");
+        assert_eq!(body["preview_omitted"], false);
+        assert_eq!(metadata["terminal"]["exit_code"], 0);
+        assert_eq!(metadata["terminal"]["status"], "completed");
+        assert_eq!(metadata["terminal"]["transport_complete"], false);
+        assert_eq!(
+            metadata["terminal"]["output_collection"],
+            serde_json::to_value(collection).unwrap()
+        );
+        assert_eq!(metadata["storage_truncated"], false);
+        assert_eq!(metadata["transport_truncation"], serde_json::Value::Null);
+        assert_eq!(metadata["stdout_seen"], 7);
+        assert_eq!(metadata["stdout_delivered"], 7);
+        let id = metadata["id"].as_str().unwrap();
+        assert_eq!(
+            serde_json::to_value(view.metadata(id).unwrap()).unwrap(),
+            *metadata
+        );
+        assert_eq!(
+            view.read(id, workdir::CommandStream::Stdout, 0, 100)
+                .unwrap(),
+            b"partial"
+        );
+        assert_eq!(
+            view.read(id, workdir::CommandStream::Stderr, 0, 100)
+                .unwrap(),
+            b"err"
+        );
+        assert!(!metadata.to_string().contains(root.path().to_str().unwrap()));
+        session.close().await.unwrap();
+    }
+}

crates/workdir/Cargo.toml

@@ -23,5 +23,6 @@ thiserror.workspace = true
 tokio = { workspace = true, features = ["io-util", "process", "rt", "sync", "time"] }
 
 [dev-dependencies]
+axum.workspace = true
 serde_json.workspace = true
 tempfile.workspace = true

crates/workdir/src/checkout.rs

@@ -6,7 +6,7 @@
 //! hashes alone do not accept same-content inode replacements. Callers own Read line numbering
 //! and per-attachment read history.
 //!
-//! Create paths are checkout-root-relative and must be strict descendants of the observed target
+//! Create paths use the target's session coordinates and must be strict descendants of the observed target
 //! directory. Existing destinations are never overwritten; results return the updated observation
 //! of the retained target directory, not the created file. Read results also return the validator
 //! of the state actually read, never a replacement from a later independent stat.
@@ -18,7 +18,8 @@
 //!
 //! Search delegates to shared List/Glob/Grep engines. Scope rules form unions within layers and
 //! intersections across layers, provider authority, and output roots. Wrappers transform coordinates
-//! once; returned paths and Grep content are relative to the final session's logical root.
+//! once; returned paths and Grep content are relative to the composed output root (the caller's
+//! cwd by default).
 //! Paths are not reverse-parsed from rendered filenames; non-UTF-8 names are not lossily aliased.
 //! Unsupported providers reject search rather than fall back to broader trait searches. Search is
 //! live traversal, not an atomic snapshot of all descendants or exclusion of external editors.
@@ -556,15 +557,13 @@ mod tests {
         ));
     }
     #[tokio::test]
-    async fn checkout_hardlink_save_isolates_alias_and_rejects_symlinks_special_files() {
+    async fn checkout_hardlink_save_isolates_alias_and_rejects_symlinks() {
         let root = tempfile::tempdir().unwrap();
         std::fs::write(root.path().join("a"), "original").unwrap();
         std::fs::hard_link(root.path().join("a"), root.path().join("alias")).unwrap();
         std::os::unix::fs::symlink("a", root.path().join("link")).unwrap();
-        let _socket = std::os::unix::net::UnixListener::bind(root.path().join("socket")).unwrap();
         let session = session(root.path());
         assert!(session.checkout_observe(path("link")).await.is_err());
-        assert!(session.checkout_observe(path("socket")).await.is_err());
         let read = checked_read(&session, session.checkout_observe(path("a")).await.unwrap()).await;
         session
             .checkout_execute(CheckoutRequest {

crates/workdir/src/environment.rs

@@ -0,0 +1,68 @@
+//! Model-facing session coordinates, separate from provider paths and authority.
+
+use crate::{WorkdirPath, WorkdirSessionCapabilities, WorkdirToolScopeRule};
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+
+/// A snapshot of the environment actually used by a session's operations.
+///
+/// Cwd is a logical Workdir-root coordinate. Scope targets use that root or
+/// explicit absolute provider paths. Scope is an additional allow ceiling, not
+/// a replacement for provider checks. Providers
+/// may retain further restrictions (including deny rules); this projection
+/// never authorizes an operation.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct WorkdirSessionEnvironment {
+    #[serde(deserialize_with = "deserialize_cwd")]
+    pub cwd: WorkdirPath,
+    pub scope: Option<Vec<WorkdirToolScopeRule>>,
+    pub capabilities: WorkdirSessionCapabilities,
+    pub restrictions: Vec<String>,
+}
+
+fn deserialize_cwd<'de, D: serde::Deserializer<'de>>(
+    deserializer: D,
+) -> Result<WorkdirPath, D::Error> {
+    let path = String::deserialize(deserializer)?;
+    WorkdirPath::new(path).map_err(serde::de::Error::custom)
+}
+
+impl WorkdirSessionEnvironment {
+    pub fn root(capabilities: WorkdirSessionCapabilities) -> Self {
+        Self {
+            cwd: WorkdirPath::root(),
+            scope: None,
+            capabilities,
+            restrictions: Vec::new(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn wire_cwd_is_normalized_and_cannot_claim_an_absolute_or_parent_base() {
+        let mut wire = serde_json::to_value(WorkdirSessionEnvironment::root(
+            WorkdirSessionCapabilities::READ_ONLY,
+        ))
+        .unwrap();
+        for invalid in [
+            "/absolute",
+            "../parent",
+            "nested/../parent",
+            "nested\\other",
+        ] {
+            wire["cwd"] = invalid.into();
+            assert!(
+                serde_json::from_value::<WorkdirSessionEnvironment>(wire.clone()).is_err(),
+                "{invalid}"
+            );
+        }
+        wire["cwd"] = "./nested//child".into();
+        let decoded: WorkdirSessionEnvironment = serde_json::from_value(wire).unwrap();
+        assert_eq!(decoded.cwd.as_str(), "nested/child");
+    }
+}

crates/workdir/src/environment_tests.rs

@@ -0,0 +1,175 @@
+//! Real Local/scoped/read-only/router sessions across loopback HTTP. Only the
+//! HTTP authentication boundary is a fixture; coordinate and scope checks are
+//! production implementations. Runs in the normal http-client library suite.
+#![cfg(all(feature = "http-client", target_os = "linux"))]
+
+use crate::http::*;
+use crate::*;
+use axum::{
+    Json, Router,
+    extract::State,
+    routing::{delete, post},
+};
+use std::sync::Arc;
+
+struct Server(tokio::task::JoinHandle<()>);
+impl Drop for Server {
+    fn drop(&mut self) {
+        self.0.abort();
+    }
+}
+
+async fn open(State(session): State<WorkdirSessionHandle>) -> Json<OpenWorkdirSessionResponse> {
+    Json(OpenWorkdirSessionResponse {
+        session_id: WorkdirSessionId::new("environment-session").unwrap(),
+        workdir_id: session.workdir().id().clone(),
+        capabilities: session.capabilities(),
+        environment: session.environment(),
+    })
+}
+async fn operation(
+    State(session): State<WorkdirSessionHandle>,
+    Json(request): Json<WorkdirSessionOperationRequest>,
+) -> Result<
+    Json<WorkdirSessionOperationResult>,
+    (axum::http::StatusCode, Json<WorkdirTransportError>),
+> {
+    dispatch_workdir_session_operation(session.as_ref(), request.operation)
+        .await
+        .map(Json)
+        .map_err(|error| {
+            (
+                axum::http::StatusCode::FORBIDDEN,
+                Json(WorkdirTransportError::from_workdir_error(&error)),
+            )
+        })
+}
+
+#[tokio::test]
+async fn remote_environment_matches_scoped_readonly_operations_without_rebasing_twice() {
+    let root = tempfile::tempdir().unwrap();
+    std::fs::create_dir(root.path().join("nested")).unwrap();
+    std::fs::write(root.path().join("nested/file.txt"), "nested marker").unwrap();
+    std::fs::write(root.path().join("file.txt"), "root decoy").unwrap();
+    let broker = WorkdirToolBroker::new(Arc::new(LocalWorkdirSession::new(
+        manifest::Scope::writable(root.path()).unwrap(),
+        root.path().to_path_buf(),
+    )));
+    let lease = broker
+        .scope(WorkdirToolScope {
+            cwd: WorkdirPath::new("nested").unwrap(),
+            rules: vec![WorkdirToolScopeRule {
+                target: WorkdirPath::new("nested").unwrap(),
+                permission: WorkdirToolScopePermission::Write,
+                recursive: true,
+                symlink_policy: Default::default(),
+            }],
+            command: true,
+        })
+        .await
+        .unwrap();
+    let session: WorkdirSessionHandle = Arc::new(ReadOnlyWorkdirSession::new(lease.tool_session()));
+    let expected = session.environment();
+    let app = Router::new()
+        .route("/v1/working-directories/{id}/sessions", post(open))
+        .route("/v1/workdir-sessions/{id}/operations", post(operation))
+        .route(
+            "/v1/workdir-sessions/{id}",
+            delete(|| async { axum::http::StatusCode::NO_CONTENT }),
+        )
+        .with_state(session.clone());
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    let _server = Server(tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    }));
+    let remote: WorkdirSessionHandle = Arc::new(
+        RemoteWorkdirSession::open(
+            reqwest::Client::builder().no_proxy().build().unwrap(),
+            format!("http://{address}").parse().unwrap(),
+            "fixture",
+            session.workdir().id().clone(),
+            OpenWorkdirSessionRequest::default(),
+        )
+        .await
+        .unwrap(),
+    );
+    let router = WorkdirSessionRouter::new();
+    router
+        .attach(WorkdirAttachmentAlias::new("remote").unwrap(), remote)
+        .unwrap();
+    let selected = router.resolve(Some("remote")).unwrap().session;
+    assert_eq!(selected.environment(), expected);
+    assert_eq!(expected.cwd, WorkdirPath::new("nested").unwrap());
+    assert!(
+        !expected
+            .capabilities
+            .supports(WorkdirSessionCapability::Command)
+    );
+    assert!(
+        expected
+            .scope
+            .unwrap()
+            .iter()
+            .all(|rule| rule.permission == WorkdirToolScopePermission::Read)
+    );
+    let found = selected
+        .glob(GlobRequest {
+            path: WorkdirPath::root(),
+            pattern: "*.txt".into(),
+            limit: 10,
+        })
+        .await
+        .unwrap();
+    assert_eq!(found.paths, vec![WorkdirPath::new("file.txt").unwrap()]);
+    let path = found.paths[0].clone();
+    let read = selected
+        .read(ReadRequest {
+            path: path.clone(),
+            offset: 0,
+            limit: 10,
+            max_bytes: 100,
+        })
+        .await
+        .unwrap();
+    assert_eq!(read.path, path);
+    assert_eq!(read.bytes, b"nested marker");
+    assert!(
+        selected
+            .write(WriteRequest {
+                path,
+                content: b"denied".to_vec(),
+                expected_hash: Some(read.content_hash)
+            })
+            .await
+            .is_err()
+    );
+    assert!(
+        selected
+            .read(ReadRequest {
+                path: WorkdirPath::new_scoped(root.path().join("file.txt").to_str().unwrap())
+                    .unwrap(),
+                offset: 0,
+                limit: 10,
+                max_bytes: 100
+            })
+            .await
+            .is_err()
+    );
+    assert!(
+        selected
+            .start_command(CommandRequest {
+                command: "touch escaped".into(),
+                cwd: WorkdirPath::root(),
+                timeout_secs: 5,
+                transport_byte_budget: 100,
+                tool_call_id: None
+            })
+            .await
+            .is_err()
+    );
+    assert!(!root.path().join("nested/escaped").exists());
+    router.close_all().await.unwrap();
+    lease.close().await.unwrap();
+    broker.close().await.unwrap();
+}

crates/workdir/src/external.rs

@@ -525,6 +525,8 @@ pub struct ExternalWorkdirOperationError {
     code: crate::http::WorkdirTransportErrorCode,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     denial_reason: Option<crate::WorkdirDenialReason>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    failure_reason: Option<crate::WorkdirFailureReason>,
 }
 
 impl ExternalWorkdirOperationError {
@@ -534,11 +536,13 @@ impl ExternalWorkdirOperationError {
         Self {
             code: error.code,
             denial_reason: error.denial_reason,
+            failure_reason: error.failure_reason,
         }
     }
 
     pub fn into_transport_error(self) -> WorkdirTransportError {
         WorkdirTransportError {
+            failure_reason: self.failure_reason,
             code: self.code,
             denial_reason: self.denial_reason,
             message: format!("External Workdir provider reported {}", self.code.as_str()),
@@ -762,6 +766,7 @@ mod tests {
         ] {
             let external =
                 ExternalWorkdirOperationError::from_transport_error(WorkdirTransportError {
+                    failure_reason: None,
                     code: Code::Denied,
                     message: "/home/operator/private provider-secret".repeat(4096),
                     denial_reason: reason,
@@ -788,6 +793,7 @@ mod tests {
     #[test]
     fn provider_failures_are_closed_and_drop_provider_authored_diagnostics() {
         let error = ExternalWorkdirOperationError::from_transport_error(WorkdirTransportError {
+            failure_reason: None,
             code: crate::http::WorkdirTransportErrorCode::Internal,
             denial_reason: None,
             message: "/home/operator/private provider-secret\ncontrol".to_string(),
@@ -918,6 +924,8 @@ mod tests {
                     chunks: vec![],
                     next_cursor: 0,
                     terminal: Some(crate::CommandTerminal {
+                        process_failure: None,
+                        output_collection: crate::CommandOutputCollection::Complete,
                         status: crate::CommandStatus::Completed,
                         exit_code: Some(0),
                         stdout_bytes: 0,
@@ -1076,6 +1084,8 @@ mod tests {
                 }],
                 next_cursor: 3,
                 terminal: Some(crate::CommandTerminal {
+                    process_failure: None,
+                    output_collection: crate::CommandOutputCollection::Complete,
                     status: crate::CommandStatus::Completed,
                     exit_code: Some(0),
                     stdout_bytes: 100 * 1024 * 1024,

crates/workdir/src/http.rs

@@ -54,6 +54,7 @@ pub struct OpenWorkdirSessionResponse {
     pub session_id: WorkdirSessionId,
     pub workdir_id: WorkdirId,
     pub capabilities: WorkdirSessionCapabilities,
+    pub environment: crate::WorkdirSessionEnvironment,
 }
 
 /// One provider-side Workdir operation.
@@ -119,6 +120,51 @@ pub enum WorkdirSessionOperationResult {
     CommandCancel,
 }
 
+/// Audit persistence is independent of the provider result and never authorizes a resend.
+/// Only server-generated correlation and closed classifications cross this boundary.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct WorkdirAuditFailure {
+    pub operation_id: String,
+    pub stage: WorkdirAuditStage,
+    pub operation_outcome: WorkdirAuditOperationOutcome,
+    pub reason: WorkdirAuditFailureReason,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum WorkdirAuditStage {
+    BeforeDispatch,
+    DispatchRejected,
+    ResponseReceived,
+    ResponseUnknown,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum WorkdirAuditOperationOutcome {
+    NotDispatched,
+    Succeeded,
+    Failed { code: WorkdirTransportErrorCode },
+    Unknown,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum WorkdirAuditFailureReason {
+    AuditStoreUnavailable,
+}
+
+/// A successful operation can still have failed audit persistence. Consumers must
+/// surface that degradation separately, without discarding the result or resending.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct WorkdirSessionOperationResponse {
+    #[serde(flatten)]
+    pub result: WorkdirSessionOperationResult,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub audit_failures: Vec<WorkdirAuditFailure>,
+}
+
 /// Dispatch one typed operation against any provider-neutral Workdir session.
 ///
 /// Runtime HTTP handlers, outbound External providers, and Backend brokers can
@@ -208,6 +254,7 @@ pub enum WorkdirTransportErrorCode {
     NotFound,
     Conflict,
     OutcomeUnknown,
+    NotDispatched,
     Unsupported,
     InvalidRequest,
     Denied,
@@ -231,6 +278,7 @@ impl WorkdirTransportErrorCode {
             Self::NotFound => "not_found",
             Self::Conflict => "conflict",
             Self::OutcomeUnknown => "outcome_unknown",
+            Self::NotDispatched => "not_dispatched",
             Self::Unsupported => "unsupported",
             Self::InvalidRequest => "invalid_request",
             Self::Denied => "denied",
@@ -261,7 +309,7 @@ impl WorkdirTransportErrorCode {
             | Self::SymlinkTargetIsDirectory
             | Self::IsDirectory
             | Self::SymlinkDirectoryNotTraversed => 400,
-            Self::Unavailable => 503,
+            Self::Unavailable | Self::NotDispatched => 503,
             Self::Io | Self::Internal | Self::OutcomeUnknown => 500,
             Self::Transport => 502,
         }
@@ -275,6 +323,8 @@ pub struct WorkdirTransportError {
     /// Internal provider diagnostics. Public response boundaries may omit this.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub denial_reason: Option<crate::WorkdirDenialReason>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub failure_reason: Option<crate::WorkdirFailureReason>,
 }
 
 impl WorkdirTransportError {
@@ -282,6 +332,11 @@ impl WorkdirTransportError {
     pub fn from_workdir_error(error: &WorkdirError) -> Self {
         use WorkdirTransportErrorCode as Code;
         let (code, message) = match error {
+            WorkdirError::FailureContext { reason, source } => {
+                let mut transport = Self::from_workdir_error(source);
+                transport.failure_reason = Some(*reason);
+                return transport;
+            }
             WorkdirError::DenialContext { reason, source } => {
                 let mut transport = Self::from_workdir_error(source);
                 transport.denial_reason = Some(*reason);
@@ -291,6 +346,9 @@ impl WorkdirTransportError {
                 Code::OutcomeUnknown,
                 "Workdir operation may have effects; inspect before retrying",
             ),
+            WorkdirError::NotDispatched => {
+                (Code::NotDispatched, "Workdir operation was not dispatched")
+            }
             WorkdirError::NotFound(_) => (Code::NotFound, "Workdir path was not found"),
             WorkdirError::Conflict(_) => (
                 Code::Conflict,
@@ -301,6 +359,7 @@ impl WorkdirTransportError {
                     code: Code::Unsupported,
                     message: format!("Workdir capability {capability:?} is not available"),
                     denial_reason: None,
+                    failure_reason: None,
                 };
             }
             WorkdirError::UnsupportedOperation(_) => {
@@ -359,6 +418,7 @@ impl WorkdirTransportError {
             code,
             message: message.to_string(),
             denial_reason: error.denial_reason(),
+            failure_reason: error.failure_reason(),
         }
     }
 
@@ -366,12 +426,14 @@ impl WorkdirTransportError {
         use WorkdirTransportErrorCode as Code;
         let error = match self.code {
             Code::NotFound => WorkdirError::NotFound("<remote>".into()),
-            Code::Conflict => WorkdirError::Conflict(self.message),
+            Code::Conflict => WorkdirError::Conflict(
+                "The target file's content or existence changed since it was last observed; read the file again before retrying".into(),
+            ),
             Code::OutcomeUnknown => WorkdirError::OutcomeUnknown(
                 "Workdir operation may have effects; inspect before retrying".into(),
             ),
-            Code::Unsupported => WorkdirError::UnsupportedOperation(self.message),
-            Code::InvalidRequest => WorkdirError::InvalidArgument(self.message),
+            Code::Unsupported => WorkdirError::UnsupportedOperation("Workdir operation is not supported".into()),
+            Code::InvalidRequest => WorkdirError::InvalidArgument("Workdir operation request is invalid".into()),
             Code::Denied => WorkdirError::Denied(crate::WorkdirDenial {
                 reason: self.denial_reason,
                 // Provider-authored text is not trusted diagnostic data.
@@ -400,14 +462,20 @@ impl WorkdirTransportError {
                 target: "<remote-target>".into(),
             },
             Code::UnknownCommand => WorkdirError::UnknownCommand("<remote>".to_string()),
-            Code::Unavailable => WorkdirError::Unavailable(self.message),
+            Code::Unavailable => WorkdirError::Unavailable("Workdir session is unavailable".into()),
+            Code::NotDispatched => WorkdirError::NotDispatched,
             Code::Io => WorkdirError::Io {
                 path: "<remote>".into(),
-                source: std::io::Error::other(self.message),
+                source: std::io::Error::other("Workdir I/O operation failed"),
             },
-            Code::Transport => WorkdirError::Transport(self.message),
+            Code::Transport => WorkdirError::Transport("Workdir transport failed".into()),
             Code::Internal => WorkdirError::OperationFailed,
         };
+        let error = if let Some(reason) = self.failure_reason {
+            error.with_failure_reason(reason)
+        } else {
+            error
+        };
         // Preserve any supplied reason independently of the public classification.
         // Without a reason, retain the existing classification's deliberate fallback.
         if let Some(reason) = self.denial_reason {
@@ -486,6 +554,7 @@ mod client {
         workdir: Workdir,
         session_id: WorkdirSessionId,
         capabilities: WorkdirSessionCapabilities,
+        environment: crate::WorkdirSessionEnvironment,
         closed: AtomicBool,
     }
 
@@ -535,7 +604,8 @@ mod client {
             if opened.workdir_id.as_str() != workdir_id.as_str() {
                 return Err(WorkdirError::Unavailable(
                     "Runtime opened a session for a different Workdir".to_string(),
-                ));
+                )
+                .with_failure_reason(crate::WorkdirFailureReason::SessionIdentityMismatch));
             }
             Ok(Self {
                 client,
@@ -544,6 +614,7 @@ mod client {
                 workdir: Workdir::new(opened.workdir_id.as_str()),
                 session_id: opened.session_id,
                 capabilities: opened.capabilities,
+                environment: opened.environment,
                 closed: AtomicBool::new(false),
             })
         }
@@ -557,9 +628,10 @@ mod client {
             operation: WorkdirSessionOperation,
         ) -> Result<WorkdirSessionOperationResult, WorkdirError> {
             if self.closed.load(Ordering::Acquire) {
-                return Err(WorkdirError::Unavailable(
-                    "Workdir session is closed".to_string(),
-                ));
+                return Err(
+                    WorkdirError::Unavailable("Workdir session is closed".to_string())
+                        .with_failure_reason(crate::WorkdirFailureReason::SessionClosed),
+                );
             }
             let url = endpoint(
                 &self.base_url,
@@ -593,6 +665,7 @@ mod client {
             WorkdirError::Unavailable(format!(
                 "Runtime returned a mismatched Workdir operation result; expected {expected}"
             ))
+            .with_failure_reason(crate::WorkdirFailureReason::OperationResultMismatch)
         }
     }
 
@@ -606,6 +679,12 @@ mod client {
             self.capabilities
         }
 
+        fn environment(&self) -> crate::WorkdirSessionEnvironment {
+            let mut environment = self.environment.clone();
+            environment.capabilities = self.capabilities();
+            environment
+        }
+
         async fn authorize_scope_path(
             &self,
             request: WorkdirScopeAuthorizationRequest,
@@ -755,7 +834,8 @@ mod client {
                 }
                 Ok(_) if mutation => Err(WorkdirError::OutcomeUnknown(
                     "mismatched response after checkout mutation".into(),
-                )),
+                )
+                .with_failure_reason(crate::WorkdirFailureReason::OperationResultMismatch)),
                 Ok(_) => Err(Self::mismatch("checkout_execute")),
                 Err(error)
                     if mutation
@@ -767,6 +847,10 @@ mod client {
                     let outcome = WorkdirError::OutcomeUnknown(
                         "checkout transport failed; effects may have occurred".into(),
                     );
+                    let outcome = match error.failure_reason() {
+                        Some(reason) => outcome.with_failure_reason(reason),
+                        None => outcome,
+                    };
                     Err(match error.denial_reason() {
                         Some(reason) => WorkdirError::DenialContext {
                             reason,
@@ -879,34 +963,43 @@ mod client {
                     "command byte limit is outside transport bounds".into(),
                 ));
             }
-            let wait = request.wait;
-            match self
-                .operate(WorkdirSessionOperation::CommandOutput(request.clone()))
-                .await?
-            {
-                WorkdirSessionOperationResult::CommandOutput(result) => {
-                    let size = result
-                        .chunks
-                        .iter()
-                        .try_fold(0usize, |size, chunk| size.checked_add(chunk.bytes.len()));
-                    if !result.transport_bounds_valid()
-                        || size.is_none_or(|size| {
-                            size > request.limit
-                                || request.cursor.checked_add(size as u64)
-                                    != Some(result.next_cursor)
-                        })
-                    {
-                        return Err(Self::mismatch("bounded command byte page"));
+            loop {
+                let started = tokio::time::Instant::now();
+                match self
+                    .operate(WorkdirSessionOperation::CommandOutput(request.clone()))
+                    .await?
+                {
+                    WorkdirSessionOperationResult::CommandOutput(result) => {
+                        let size = result
+                            .chunks
+                            .iter()
+                            .try_fold(0usize, |size, chunk| size.checked_add(chunk.bytes.len()));
+                        if !result.transport_bounds_valid()
+                            || size.is_none_or(|size| {
+                                size > request.limit
+                                    || request.cursor.checked_add(size as u64)
+                                        != Some(result.next_cursor)
+                            })
+                        {
+                            return Err(Self::mismatch("bounded command byte page"));
+                        }
+                        if request.wait && result.chunks.is_empty() && result.terminal.is_none() {
+                            // A normal long-poll expiry is not a transport failure.
+                            // Continue at the same cursor, without spending the caller's
+                            // error retry budget or acknowledging any bytes. Pace peers
+                            // that return empty pages immediately; a real long poll has
+                            // already consumed this delay. The caller owns cancellation
+                            // and the overall deadline.
+                            tokio::time::sleep_until(
+                                started + std::time::Duration::from_millis(100),
+                            )
+                            .await;
+                            continue;
+                        }
+                        return Ok(result);
                     }
-                    if wait && result.chunks.is_empty() && result.terminal.is_none() {
-                        // A waiting request must block at the provider. Never spin HTTP
-                        // requests against an immediate empty response. A caller may retry
-                        // this exact cursor with its own bounded transport retry policy.
-                        return Err(Self::mismatch("waiting command byte page"));
-                    }
-                    return Ok(result);
+                    _ => return Err(Self::mismatch("command_output")),
                 }
-                _ => return Err(Self::mismatch("command_output")),
             }
         }
 
@@ -966,8 +1059,10 @@ mod client {
     ) -> Result<T, WorkdirError> {
         if response.status().is_success() {
             let bytes = bounded_response_bytes(response).await?;
-            serde_json::from_slice(&bytes)
-                .map_err(|_| WorkdirError::Transport("Runtime Workdir response was invalid".into()))
+            serde_json::from_slice(&bytes).map_err(|_| {
+                WorkdirError::Transport("Runtime Workdir response was invalid".into())
+                    .with_failure_reason(crate::WorkdirFailureReason::HttpResponseInvalid)
+            })
         } else {
             Err(decode_error(response).await)
         }
@@ -983,14 +1078,16 @@ mod client {
         {
             return Err(WorkdirError::Transport(
                 "Runtime Workdir response exceeded transport bound".into(),
-            ));
+            )
+            .with_failure_reason(crate::WorkdirFailureReason::HttpResponseTooLarge));
         }
         let mut bytes = Vec::new();
         while let Some(chunk) = response.chunk().await.map_err(http_unavailable)? {
             if chunk.len() > MAX_RESPONSE_BYTES.saturating_sub(bytes.len()) {
                 return Err(WorkdirError::Transport(
                     "Runtime Workdir response exceeded transport bound".into(),
-                ));
+                )
+                .with_failure_reason(crate::WorkdirFailureReason::HttpResponseTooLarge));
             }
             bytes.extend_from_slice(&chunk);
         }
@@ -1003,13 +1100,22 @@ mod client {
                 .map(WorkdirTransportError::into_workdir_error)
                 .unwrap_or_else(|_| {
                     WorkdirError::Transport("Runtime Workdir error response was invalid".into())
+                        .with_failure_reason(crate::WorkdirFailureReason::HttpResponseInvalid)
                 }),
             Err(error) => error,
         }
     }
 
-    fn http_unavailable(_error: reqwest::Error) -> WorkdirError {
+    fn http_unavailable(error: reqwest::Error) -> WorkdirError {
+        let reason = if error.is_timeout() {
+            crate::WorkdirFailureReason::HttpTimeout
+        } else if error.is_connect() {
+            crate::WorkdirFailureReason::HttpConnect
+        } else {
+            crate::WorkdirFailureReason::HttpTransfer
+        };
         WorkdirError::Transport("Runtime Workdir HTTP request failed".to_string())
+            .with_failure_reason(reason)
     }
 
     #[cfg(test)]
@@ -1017,6 +1123,40 @@ mod client {
         use super::*;
         use std::sync::Mutex;
 
+        #[tokio::test]
+        async fn http_failure_reasons_do_not_copy_urls_or_credentials() {
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let address = listener.local_addr().unwrap();
+            let client = Client::builder().no_proxy().build().unwrap();
+            // A listening socket that never replies makes a real HTTP timeout.
+            let error = client
+                .get(format!("http://{address}/private?token=secret"))
+                .timeout(std::time::Duration::from_millis(25))
+                .send()
+                .await
+                .unwrap_err();
+            assert!(error.is_timeout());
+            let error = http_unavailable(error);
+            assert_eq!(
+                error.failure_reason(),
+                Some(crate::WorkdirFailureReason::HttpTimeout)
+            );
+            assert!(!format!("{error:?}").contains("secret"));
+            assert!(!format!("{error:?}").contains("/private"));
+            drop(listener);
+            let error = client
+                .get(format!("http://{address}/private?token=secret"))
+                .timeout(std::time::Duration::from_secs(2))
+                .send()
+                .await
+                .unwrap_err();
+            assert!(error.is_connect());
+            assert_eq!(
+                http_unavailable(error).failure_reason(),
+                Some(crate::WorkdirFailureReason::HttpConnect)
+            );
+        }
+
         #[derive(Debug, Default)]
         struct RejectAuthorization {
             requests: Arc<Mutex<Vec<(String, String, Vec<u8>)>>>,
@@ -1078,6 +1218,9 @@ mod client {
                 workdir,
                 session_id: WorkdirSessionId::new("s").unwrap(),
                 capabilities: WorkdirSessionCapabilities::EMPTY,
+                environment: crate::WorkdirSessionEnvironment::root(
+                    WorkdirSessionCapabilities::EMPTY,
+                ),
                 closed: AtomicBool::new(false),
             };
             let stat = StatRequest {
@@ -1135,6 +1278,37 @@ pub use client::{
 mod tests {
     use super::*;
 
+    #[test]
+    fn operation_response_keeps_success_and_independent_audit_failure() {
+        let original =
+            WorkdirSessionOperationResult::CommandStart(crate::CommandHandle("command-a".into()));
+        let response = WorkdirSessionOperationResponse {
+            result: original.clone(),
+            audit_failures: vec![WorkdirAuditFailure {
+                operation_id: "op-00000000-0000-7000-8000-000000000001".into(),
+                stage: WorkdirAuditStage::ResponseReceived,
+                operation_outcome: WorkdirAuditOperationOutcome::Succeeded,
+                reason: WorkdirAuditFailureReason::AuditStoreUnavailable,
+            }],
+        };
+        let json = serde_json::to_value(&response).unwrap();
+        assert_eq!(json["operation"], "command_start");
+        assert_eq!(json["result"], "command-a");
+        assert_eq!(
+            json["audit_failures"][0]["operation_outcome"]["kind"],
+            "succeeded"
+        );
+        assert_eq!(
+            serde_json::from_value::<WorkdirSessionOperationResponse>(json).unwrap(),
+            response
+        );
+        let normal = serde_json::to_value(&original).unwrap();
+        let decoded: WorkdirSessionOperationResponse =
+            serde_json::from_value(normal.clone()).unwrap();
+        assert!(decoded.audit_failures.is_empty());
+        assert_eq!(serde_json::to_value(decoded).unwrap(), normal);
+    }
+
     #[test]
     fn transport_error_round_trip_keeps_public_classification() {
         for (code, expected_status, expected_error) in [
@@ -1154,6 +1328,11 @@ mod tests {
                 409,
                 "The target file's content or existence changed since it was last observed",
             ),
+            (
+                WorkdirTransportErrorCode::NotDispatched,
+                503,
+                "not dispatched",
+            ),
             (WorkdirTransportErrorCode::Unsupported, 400, "unsupported"),
             (WorkdirTransportErrorCode::Denied, 403, "denied"),
             (
@@ -1193,6 +1372,7 @@ mod tests {
             (WorkdirTransportErrorCode::Internal, 500, "operation failed"),
         ] {
             let transport = WorkdirTransportError {
+                failure_reason: None,
                 code,
                 denial_reason: None,
                 message: if code == WorkdirTransportErrorCode::Conflict {

crates/workdir/src/lib.rs

@@ -5,6 +5,8 @@ pub use checkout::{
     CheckoutObservation, CheckoutOperation, CheckoutOutput, CheckoutRequest, CheckoutResult,
     CheckoutSearchOperation, CheckoutSearchRequest, CheckoutSearchResult,
 };
+mod environment;
+pub use environment::WorkdirSessionEnvironment;
 pub mod external;
 pub mod http;
 mod local;
@@ -16,6 +18,8 @@ pub mod workspace;
 #[cfg(test)]
 mod checkout_search_tests;
 #[cfg(test)]
+mod environment_tests;
+#[cfg(test)]
 mod external_local_tests;
 
 use std::path::{Path, PathBuf};
@@ -185,6 +189,9 @@ pub type WriteOutcome = WriteResult;
 /// Worker-bound operation session for a persistent [`Workdir`].
 ///
 /// Filesystem search and commands run on the host owning materialization.
+/// Relative operation paths and reusable search results use the session's cwd;
+/// root-coordinate providers are adapted once at attachment, not by each Tool.
+/// Scope declarations retain their own root-coordinate authority contract.
 /// Session closure is terminal but does not delete the Workdir or files.
 /// Unsupported checkout/search implementations explicitly reject requests, with no ambient
 /// filesystem fallback. Providers own identity validators; callers own read hash history
@@ -194,6 +201,13 @@ pub trait WorkdirSession: std::fmt::Debug + Send + Sync {
     fn workdir(&self) -> &Workdir;
     fn capabilities(&self) -> WorkdirSessionCapabilities;
 
+    /// Describe the coordinates used by this session, not a caller's Profile
+    /// or filesystem authority. Root-coordinate providers use the default;
+    /// coordinate and authority wrappers must project their effective view.
+    fn environment(&self) -> WorkdirSessionEnvironment {
+        WorkdirSessionEnvironment::root(self.capabilities())
+    }
+
     /// Validate an attenuated filesystem rule at the provider boundary without
     /// exposing the resolved host path. Providers that cannot resolve symbolic
     /// links must reject resolved-policy checks rather than downgrade them.
@@ -401,8 +415,163 @@ impl From<&str> for WorkdirDenial {
     }
 }
 
+/// Bounded operational diagnostics, never provider text, paths or credentials.
+/// Reasons describe an observation, not retry permission or proof of no effects.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum WorkdirFailureReason {
+    SessionClosed,
+    ProviderUnavailable,
+    ProviderGrantExpired,
+    ProviderAdmissionClosed,
+    ProviderDispatchRejected,
+    ProviderResponseLost,
+    ProviderOperationTimeout,
+    CommandTerminalMissing,
+    AuditStoreUnavailable,
+    HttpTimeout,
+    HttpConnect,
+    HttpTransfer,
+    HttpResponseInvalid,
+    HttpResponseTooLarge,
+    OperationResultMismatch,
+    SessionIdentityMismatch,
+    SessionOpenTaskFailed,
+    SessionOpenFailed,
+    AuthorizationMissing,
+    AuthorizationStale,
+    AuthorizationUnavailable,
+    SigningIdentityUnavailable,
+    AuthorizationSignFailed,
+    RuntimeStopped,
+    RuntimeStateUnavailable,
+    RuntimeBackendUnavailable,
+    RuntimeOwnerMismatch,
+    RuntimeInvalidRequest,
+    WorkingDirectoryNotFound,
+    WorkingDirectoryNotActive,
+    WorkingDirectoryRecordInvalid,
+    WorkingDirectoryAccessUnavailable,
+}
+
+impl WorkdirFailureReason {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::SessionClosed => "session_closed",
+            Self::ProviderUnavailable => "provider_unavailable",
+            Self::ProviderGrantExpired => "provider_grant_expired",
+            Self::ProviderAdmissionClosed => "provider_admission_closed",
+            Self::ProviderDispatchRejected => "provider_dispatch_rejected",
+            Self::ProviderResponseLost => "provider_response_lost",
+            Self::ProviderOperationTimeout => "provider_operation_timeout",
+            Self::CommandTerminalMissing => "command_terminal_missing",
+            Self::AuditStoreUnavailable => "audit_store_unavailable",
+            Self::HttpTimeout => "http_timeout",
+            Self::HttpConnect => "http_connect",
+            Self::HttpTransfer => "http_transfer",
+            Self::HttpResponseInvalid => "http_response_invalid",
+            Self::HttpResponseTooLarge => "http_response_too_large",
+            Self::OperationResultMismatch => "operation_result_mismatch",
+            Self::SessionIdentityMismatch => "session_identity_mismatch",
+            Self::SessionOpenTaskFailed => "session_open_task_failed",
+            Self::SessionOpenFailed => "session_open_failed",
+            Self::AuthorizationMissing => "authorization_missing",
+            Self::AuthorizationStale => "authorization_stale",
+            Self::AuthorizationUnavailable => "authorization_unavailable",
+            Self::SigningIdentityUnavailable => "signing_identity_unavailable",
+            Self::AuthorizationSignFailed => "authorization_sign_failed",
+            Self::RuntimeStopped => "runtime_stopped",
+            Self::RuntimeStateUnavailable => "runtime_state_unavailable",
+            Self::RuntimeBackendUnavailable => "runtime_backend_unavailable",
+            Self::RuntimeOwnerMismatch => "runtime_owner_mismatch",
+            Self::RuntimeInvalidRequest => "runtime_invalid_request",
+            Self::WorkingDirectoryNotFound => "working_directory_not_found",
+            Self::WorkingDirectoryNotActive => "working_directory_not_active",
+            Self::WorkingDirectoryRecordInvalid => "working_directory_record_invalid",
+            Self::WorkingDirectoryAccessUnavailable => "working_directory_access_unavailable",
+        }
+    }
+
+    /// The observed failing boundary, not a dispatch or effects assertion.
+    pub const fn stage(self) -> WorkdirFailureStage {
+        use WorkdirFailureStage as Stage;
+        match self {
+            Self::SessionClosed => Stage::Session,
+            Self::ProviderUnavailable => Stage::Provider,
+            Self::ProviderGrantExpired | Self::ProviderAdmissionClosed => Stage::ProviderAdmission,
+            Self::ProviderDispatchRejected => Stage::ProviderDispatch,
+            Self::ProviderResponseLost | Self::ProviderOperationTimeout => Stage::ProviderResponse,
+            Self::AuditStoreUnavailable => Stage::Audit,
+            Self::CommandTerminalMissing => Stage::Command,
+            Self::HttpTimeout | Self::HttpConnect | Self::HttpTransfer => Stage::Http,
+            Self::HttpResponseInvalid
+            | Self::HttpResponseTooLarge
+            | Self::OperationResultMismatch => Stage::ResponseValidation,
+            Self::SessionIdentityMismatch
+            | Self::SessionOpenTaskFailed
+            | Self::SessionOpenFailed
+            | Self::WorkingDirectoryNotFound
+            | Self::WorkingDirectoryNotActive
+            | Self::WorkingDirectoryRecordInvalid
+            | Self::WorkingDirectoryAccessUnavailable => Stage::SessionOpen,
+            Self::AuthorizationMissing
+            | Self::AuthorizationStale
+            | Self::AuthorizationUnavailable
+            | Self::SigningIdentityUnavailable
+            | Self::AuthorizationSignFailed => Stage::AuthorizationPreparation,
+            Self::RuntimeStopped
+            | Self::RuntimeStateUnavailable
+            | Self::RuntimeBackendUnavailable
+            | Self::RuntimeOwnerMismatch
+            | Self::RuntimeInvalidRequest => Stage::Runtime,
+        }
+    }
+}
+
+/// Internal operational boundary derived only from a bounded reason.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum WorkdirFailureStage {
+    Session,
+    Provider,
+    ProviderAdmission,
+    ProviderDispatch,
+    ProviderResponse,
+    Audit,
+    Command,
+    Http,
+    ResponseValidation,
+    SessionOpen,
+    AuthorizationPreparation,
+    Runtime,
+}
+
+impl WorkdirFailureStage {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Session => "session",
+            Self::Provider => "provider",
+            Self::ProviderAdmission => "provider_admission",
+            Self::ProviderDispatch => "provider_dispatch",
+            Self::ProviderResponse => "provider_response",
+            Self::Audit => "audit",
+            Self::Command => "command",
+            Self::Http => "http",
+            Self::ResponseValidation => "response_validation",
+            Self::SessionOpen => "session_open",
+            Self::AuthorizationPreparation => "authorization_preparation",
+            Self::Runtime => "runtime",
+        }
+    }
+}
+
 #[derive(Debug, thiserror::Error)]
 pub enum WorkdirError {
+    #[error("{source}")]
+    FailureContext {
+        reason: WorkdirFailureReason,
+        #[source]
+        source: Box<WorkdirError>,
+    },
     #[error("Workdir operation denied: {0}")]
     Denied(WorkdirDenial),
 
@@ -430,6 +599,10 @@ pub enum WorkdirError {
     #[error("Workdir session is unavailable: {0}")]
     Unavailable(String),
 
+    /// The broker has proof that this operation never reached the provider.
+    #[error("Workdir operation was not dispatched")]
+    NotDispatched,
+
     #[error("Workdir operation failed")]
     OperationFailed,
 
@@ -521,12 +694,29 @@ impl WorkdirError {
     /// and `denial_reason`: enrichment must not alter behavior or retry policy.
     pub fn classification_source(&self) -> &Self {
         let mut error = self;
-        while let Self::DenialContext { source, .. } = error {
+        while let Self::DenialContext { source, .. } | Self::FailureContext { source, .. } = error {
             error = source;
         }
         error
     }
 
+    pub fn with_failure_reason(self, reason: WorkdirFailureReason) -> Self {
+        Self::FailureContext {
+            reason,
+            source: Box::new(self),
+        }
+    }
+
+    pub fn failure_reason(&self) -> Option<WorkdirFailureReason> {
+        match self {
+            Self::FailureContext { reason, .. } => Some(*reason),
+            Self::DenialContext { source, .. } => source.failure_reason(),
+            Self::SessionClosed => Some(WorkdirFailureReason::SessionClosed),
+            Self::Unavailable(_) => Some(WorkdirFailureReason::ProviderUnavailable),
+            _ => None,
+        }
+    }
+
     pub fn denied(reason: WorkdirDenialReason, message: impl Into<String>) -> Self {
         Self::Denied(WorkdirDenial {
             reason: Some(reason),
@@ -540,6 +730,7 @@ impl WorkdirError {
         match self {
             Self::Denied(denial) => denial.reason,
             Self::DenialContext { reason, .. } => Some(*reason),
+            Self::FailureContext { source, .. } => source.denial_reason(),
             Self::OutOfScope(_) => Some(Reason::PathOutOfScope),
             Self::SymlinkOutOfScope { .. } => Some(Reason::SymlinkTargetOutOfScope),
             Self::ReadOnly(_) => Some(Reason::PathReadOnly),

crates/workdir/src/local.rs

@@ -1210,7 +1210,8 @@ impl LocalWorkdirSession {
             Err(WorkdirError::Unavailable(format!(
                 "Workdir session for {} is closed",
                 self.inner.workdir.id()
-            )))
+            ))
+            .with_failure_reason(crate::WorkdirFailureReason::SessionClosed))
         } else {
             Ok(())
         }
@@ -1339,6 +1340,52 @@ impl WorkdirSession for LocalWorkdirSession {
         self.inner.capabilities
     }
 
+    fn environment(&self) -> crate::WorkdirSessionEnvironment {
+        let scope = self.inner.scope.snapshot();
+        let project = |rule: manifest::ScopeRule| -> Option<crate::WorkdirToolScopeRule> {
+            let target = if self.inner.root.starts_with(&rule.target) && rule.recursive {
+                WorkdirPath::root()
+            } else {
+                let path = rule
+                    .target
+                    .strip_prefix(&self.inner.root)
+                    .unwrap_or(&rule.target);
+                WorkdirPath::new_scoped(path.to_str()?).ok()?
+            };
+            Some(crate::WorkdirToolScopeRule {
+                target,
+                permission: match rule.permission {
+                    Permission::Read => WorkdirToolScopePermission::Read,
+                    Permission::Write => WorkdirToolScopePermission::Write,
+                },
+                recursive: rule.recursive,
+                symlink_policy: rule.symlink_policy,
+            })
+        };
+        crate::WorkdirSessionEnvironment {
+            cwd: WorkdirPath::root(),
+            scope: Some(
+                scope
+                    .allow_rules()
+                    .into_iter()
+                    .filter_map(project)
+                    .collect(),
+            ),
+            capabilities: self.capabilities(),
+            restrictions: scope
+                .deny_rules()
+                .into_iter()
+                .map(|rule| {
+                    project(rule)
+                        .map(|rule| format!("Deny: {rule:?}"))
+                        .unwrap_or_else(|| {
+                            "Unrepresentable provider deny rule remains enforced".into()
+                        })
+                })
+                .collect(),
+        }
+    }
+
     async fn authorize_scope_path(
         &self,
         request: WorkdirScopeAuthorizationRequest,
@@ -2546,11 +2593,18 @@ mod tests {
             .expect("close should wake command output waiters")
             .unwrap()
             .unwrap_err();
-        assert!(matches!(waiter_error, WorkdirError::Unavailable(_)));
+        assert!(matches!(
+            waiter_error.classification_source(),
+            WorkdirError::Unavailable(_)
+        ));
+        assert_eq!(
+            waiter_error.failure_reason(),
+            Some(crate::WorkdirFailureReason::SessionClosed)
+        );
 
         assert!(matches!(
             WorkdirSession::command_status(&session, command).await,
-            Err(WorkdirError::Unavailable(_))
+            Err(ref error) if matches!(error.classification_source(), WorkdirError::Unavailable(_))
         ));
         assert!(matches!(
             WorkdirSession::read(
@@ -2563,7 +2617,7 @@ mod tests {
                 },
             )
             .await,
-            Err(WorkdirError::Unavailable(_))
+            Err(ref error) if matches!(error.classification_source(), WorkdirError::Unavailable(_))
         ));
 
         let restored = LocalWorkdirSession::materialized_bound(
@@ -3531,7 +3585,7 @@ mod tests {
                 .await
                 .unwrap()
                 .unwrap(),
-            Err(WorkdirError::Unavailable(message)) if message.contains("is closed")
+            Err(ref error) if matches!(error.classification_source(), WorkdirError::Unavailable(message) if message.contains("is closed"))
         ));
         assert!(
             session.command_snapshot().is_empty(),

crates/workdir/src/local/command_transport.rs

@@ -3,6 +3,7 @@
 //! A replay page survives a lost HTTP response until its next cursor is sent.
 
 use super::*;
+use crate::{CommandFailure, CommandFailureStage, CommandIoErrorKind, CommandOutputCollection};
 use tokio::io::{AsyncRead, AsyncReadExt};
 use tokio::sync::mpsc;
 
@@ -113,6 +114,7 @@ impl Transport {
                         WorkdirError::Unavailable(
                             "command transport ended before terminal fence".into(),
                         )
+                        .with_failure_reason(crate::WorkdirFailureReason::CommandTerminalMissing)
                     })?;
                     self.terminal = Some(terminal.clone());
                     page.terminal = Some(terminal);
@@ -145,6 +147,33 @@ pub(super) fn start(
     telemetry: CommandTelemetry,
     environment: BTreeMap<String, String>,
     resources: Vec<Arc<dyn WorkdirSessionResource>>,
+) -> LocalCommand {
+    let execution_id = command_id.clone();
+    let execution_telemetry = telemetry.clone();
+    start_with(
+        command_id,
+        telemetry,
+        resources,
+        move |cancel, sender| async move {
+            execute(
+                cwd,
+                request,
+                &execution_id,
+                &execution_telemetry,
+                environment,
+                cancel,
+                &sender,
+            )
+            .await
+        },
+    )
+}
+
+fn start_with<F: std::future::Future<Output = crate::CommandTerminal> + Send + 'static>(
+    command_id: String,
+    telemetry: CommandTelemetry,
+    resources: Vec<Arc<dyn WorkdirSessionResource>>,
+    execution: impl FnOnce(watch::Receiver<bool>, mpsc::Sender<Message>) -> F + Send + 'static,
 ) -> LocalCommand {
     let (sender, receiver) = mpsc::channel(QUEUE_CHUNKS);
     let (cancel, cancel_rx) = watch::channel(false);
@@ -159,16 +188,7 @@ pub(super) fn start(
     }));
     let task = tokio::spawn(async move {
         let _resources = resources;
-        let terminal = execute(
-            cwd,
-            request,
-            &command_id,
-            &telemetry,
-            environment,
-            cancel_rx,
-            &sender,
-        )
-        .await;
+        let terminal = execution(cancel_rx, sender.clone()).await;
         telemetry.terminal(&command_id, terminal.status, terminal.exit_code);
         // Closing the byte queue fences this already-published terminal, without
         // requiring spare queue capacity or a receiver to release task resources.
@@ -191,10 +211,18 @@ struct ByteAccounting {
 }
 
 impl ByteAccounting {
-    fn terminal(&self, status: CommandStatus, exit_code: Option<i32>) -> crate::CommandTerminal {
+    fn terminal(
+        &self,
+        status: CommandStatus,
+        exit_code: Option<i32>,
+        process_failure: Option<CommandFailure>,
+        output_collection: CommandOutputCollection,
+    ) -> crate::CommandTerminal {
         crate::CommandTerminal {
             status,
             exit_code,
+            process_failure,
+            output_collection,
             stdout_bytes: self.stdout,
             stderr_bytes: self.stderr,
             stdout_delivered_bytes: self.stdout_delivered,
@@ -214,7 +242,7 @@ async fn pump<R: AsyncRead + Unpin>(
     command_id: &str,
     mut remaining: u64,
     accounting: &mut ByteAccounting,
-) -> std::io::Result<()> {
+) -> Result<(), CommandFailure> {
     let mut stdout_done = false;
     let mut stderr_done = false;
     let mut stdout_decoder = CommandOutputDecoder::default();
@@ -227,7 +255,11 @@ async fn pump<R: AsyncRead + Unpin>(
         // Before quota, reserve first to retain bounded pipe backpressure.
         let permit = if remaining > 0 {
             let Ok(permit) = sender.reserve().await else {
-                return Ok(());
+                return Err(CommandFailure {
+                    stage: CommandFailureStage::OutputDelivery,
+                    reason: CommandIoErrorKind::Unknown,
+                    os_code: None,
+                });
             };
             Some(permit)
         } else {
@@ -241,7 +273,15 @@ async fn pump<R: AsyncRead + Unpin>(
             CommandStream::Stdout => &stdout_buffer,
             CommandStream::Stderr => &stderr_buffer,
         };
-        let count = result?;
+        let count = result.map_err(|error| {
+            CommandFailure::io(
+                match stream {
+                    CommandStream::Stdout => CommandFailureStage::StdoutRead,
+                    CommandStream::Stderr => CommandFailureStage::StderrRead,
+                },
+                &error,
+            )
+        })?;
         let decoder = match stream {
             CommandStream::Stdout => &mut stdout_decoder,
             CommandStream::Stderr => &mut stderr_decoder,
@@ -287,7 +327,7 @@ async fn execute(
     command_id: &str,
     telemetry: &CommandTelemetry,
     environment: BTreeMap<String, String>,
-    mut cancel: watch::Receiver<bool>,
+    cancel: watch::Receiver<bool>,
     sender: &mpsc::Sender<Message>,
 ) -> crate::CommandTerminal {
     telemetry.started(command_id, request.tool_call_id);
@@ -303,74 +343,159 @@ async fn execute(
         .kill_on_drop(true);
     #[cfg(unix)]
     command.as_std_mut().process_group(0);
-    let mut accounting = ByteAccounting::default();
-    let Ok(mut child) = command.spawn() else {
-        return accounting.terminal(CommandStatus::Failed, None);
+    let mut child = match command.spawn() {
+        Ok(child) => child,
+        Err(error) => {
+            return ByteAccounting::default().terminal(
+                CommandStatus::Failed,
+                None,
+                Some(CommandFailure::io(CommandFailureStage::Spawn, &error)),
+                CommandOutputCollection::NotStarted,
+            );
+        }
     };
-    let mut process_group = CommandProcessGroupGuard::new(child.id());
     let stdout = child.stdout.take().expect("piped stdout");
     let stderr = child.stderr.take().expect("piped stderr");
-    let (status, exit_code) = {
+    supervise(
+        child,
+        stdout,
+        stderr,
+        request.timeout_secs,
+        request.transport_byte_budget,
+        command_id,
+        telemetry,
+        cancel,
+        sender,
+    )
+    .await
+}
+
+// Substitute only syscalls and readers: injected faults run the production supervisor.
+trait CommandProcess: Send {
+    fn id(&self) -> Option<u32>;
+    fn start_kill(&mut self);
+    fn wait(
+        &mut self,
+    ) -> impl std::future::Future<Output = std::io::Result<std::process::ExitStatus>> + Send;
+}
+
+impl CommandProcess for tokio::process::Child {
+    fn id(&self) -> Option<u32> {
+        self.id()
+    }
+    fn start_kill(&mut self) {
+        let _ = self.start_kill();
+    }
+    async fn wait(&mut self) -> std::io::Result<std::process::ExitStatus> {
+        self.wait().await
+    }
+}
+
+fn process_result(
+    result: std::io::Result<std::process::ExitStatus>,
+) -> (CommandStatus, Option<i32>, Option<CommandFailure>) {
+    match result {
+        Ok(exit) => (
+            if exit.success() {
+                CommandStatus::Completed
+            } else {
+                CommandStatus::Failed
+            },
+            exit.code(),
+            None,
+        ),
+        Err(error) => (
+            CommandStatus::Failed,
+            None,
+            Some(CommandFailure::io(CommandFailureStage::Wait, &error)),
+        ),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn supervise(
+    mut child: impl CommandProcess,
+    stdout: impl AsyncRead + Unpin,
+    stderr: impl AsyncRead + Unpin,
+    timeout_secs: u64,
+    byte_budget: u64,
+    command_id: &str,
+    telemetry: &CommandTelemetry,
+    mut cancel: watch::Receiver<bool>,
+    sender: &mpsc::Sender<Message>,
+) -> crate::CommandTerminal {
+    let mut process_group = CommandProcessGroupGuard::new(child.id());
+    let mut accounting = ByteAccounting::default();
+    let (status, exit_code, process_failure, output_collection) = {
         let output = pump(
             stdout,
             stderr,
             sender,
             telemetry,
             command_id,
-            request.transport_byte_budget,
+            byte_budget,
             &mut accounting,
         );
         tokio::pin!(output);
-        let mut drained = false;
-        let timeout = tokio::time::sleep(Duration::from_secs(request.timeout_secs.max(1)));
+        let mut collected = None;
+        let timeout = tokio::time::sleep(Duration::from_secs(timeout_secs.max(1)));
         tokio::pin!(timeout);
         let terminal = loop {
             tokio::select! {
-                result = &mut output, if !drained => {
-                    drained = true;
-                    if result.is_err() || sender.is_closed() {
+                result = &mut output, if collected.is_none() => {
+                    let failed = result.is_err();
+                    collected = Some(result);
+                    if failed {
                         process_group.terminate();
-                        let _ = child.start_kill();
-                        let _ = child.wait().await;
-                        break (CommandStatus::Failed, None);
+                        child.start_kill();
+                        break process_result(child.wait().await);
                     }
                 }
                 exit = child.wait() => {
                     process_group.terminate();
-                    break match exit {
-                        Ok(exit) => (if exit.success() { CommandStatus::Completed } else { CommandStatus::Failed }, exit.code()),
-                        Err(_) => (CommandStatus::Failed, None),
-                    };
+                    break process_result(exit);
                 }
                 _ = &mut timeout => {
                     process_group.terminate();
-                    let _ = child.start_kill();
-                    let code = child.wait().await.ok().and_then(|exit| exit.code());
-                    break (CommandStatus::TimedOut, code);
+                    child.start_kill();
+                    let (_, code, failure) = process_result(child.wait().await);
+                    break (CommandStatus::TimedOut, code, failure);
                 }
                 _ = sender.closed() => {
                     process_group.terminate();
-                    let _ = child.start_kill();
-                    let _ = child.wait().await;
-                    break (CommandStatus::Cancelled, None);
+                    child.start_kill();
+                    let (_, code, failure) = process_result(child.wait().await);
+                    break (CommandStatus::Cancelled, code, failure);
                 }
                 changed = cancel.changed() => {
                     if changed.is_err() || *cancel.borrow() {
                         process_group.terminate();
-                        let _ = child.start_kill();
-                        let code = child.wait().await.ok().and_then(|exit| exit.code());
-                        break (CommandStatus::Cancelled, code);
+                        child.start_kill();
+                        let (_, code, failure) = process_result(child.wait().await);
+                        break (CommandStatus::Cancelled, code, failure);
                     }
                 }
             }
         };
-        // Even after kill, preserve the bounded pipe tail before publishing terminal.
-        if !drained {
-            let _ = output.await;
-        }
-        terminal
+        // Exit is not pipe EOF. Retain read failures first observed during drain.
+        let result = match collected {
+            Some(result) => result,
+            None => output.await.map_err(|mut failure| {
+                failure.stage = match failure.stage {
+                    CommandFailureStage::StdoutRead => CommandFailureStage::StdoutDrain,
+                    CommandFailureStage::StderrRead => CommandFailureStage::StderrDrain,
+                    stage => stage,
+                };
+                failure
+            }),
+        };
+        let collection = match result {
+            Ok(()) => CommandOutputCollection::Complete,
+            Err(failure) => CommandOutputCollection::Incomplete { failure },
+        };
+        (terminal.0, terminal.1, terminal.2, collection)
     };
-    accounting.terminal(status, exit_code)
+    accounting.terminal(status, exit_code, process_failure, output_collection)
 }
 
 #[cfg(test)]

crates/workdir/src/local/command_transport/tests.rs

@@ -4,6 +4,38 @@
 use super::*;
 use tempfile::TempDir;
 
+#[tokio::test]
+async fn missing_terminal_is_diagnosed_without_changing_error_classification() {
+    let (sender, receiver) = mpsc::channel(1);
+    let (_status, terminal_status) = watch::channel(None);
+    drop(sender);
+    let mut transport = Transport {
+        receiver,
+        pending: None,
+        cursor: 0,
+        replay: None,
+        terminal: None,
+        terminal_status,
+    };
+    let error = transport
+        .read(&CommandOutputRequest {
+            handle: CommandHandle("diagnostic-test".into()),
+            cursor: 0,
+            limit: 16,
+            wait: true,
+        })
+        .await
+        .unwrap_err();
+    assert_eq!(
+        error.failure_reason(),
+        Some(crate::WorkdirFailureReason::CommandTerminalMissing)
+    );
+    assert!(matches!(
+        error.classification_source(),
+        WorkdirError::Unavailable(_)
+    ));
+}
+
 struct Harness {
     session: LocalWorkdirSession,
     _root: TempDir,
@@ -488,3 +520,349 @@ async fn slow_receiver_backpressures_before_quota_but_full_queue_does_not_block_
         assert_eq!(queued_bytes, QUEUE_CHUNKS * COMMAND_EVENT_CHUNK_BYTES);
     }
 }
+
+#[derive(Clone, Default)]
+struct Gate(Arc<std::sync::Mutex<(bool, Option<std::task::Waker>)>>);
+
+impl Gate {
+    fn open(&self) {
+        let mut state = self.0.lock().unwrap();
+        state.0 = true;
+        if let Some(waker) = state.1.take() {
+            waker.wake();
+        }
+    }
+
+    fn poll(&self, cx: &mut std::task::Context<'_>) -> std::task::Poll<()> {
+        let mut state = self.0.lock().unwrap();
+        if state.0 {
+            std::task::Poll::Ready(())
+        } else {
+            state.1 = Some(cx.waker().clone());
+            std::task::Poll::Pending
+        }
+    }
+}
+
+struct FaultProcess {
+    ready: Gate,
+    exited: Gate,
+    wait_error: Option<std::io::ErrorKind>,
+}
+
+impl CommandProcess for FaultProcess {
+    fn id(&self) -> Option<u32> {
+        None
+    }
+    fn start_kill(&mut self) {
+        self.ready.open();
+    }
+    async fn wait(&mut self) -> std::io::Result<std::process::ExitStatus> {
+        std::future::poll_fn(|cx| self.ready.poll(cx)).await;
+        self.exited.open();
+        match self.wait_error {
+            Some(kind) => Err(std::io::Error::new(
+                kind,
+                "/private/path TOKEN=secret command-body",
+            )),
+            None => Ok(std::process::ExitStatus::default()),
+        }
+    }
+}
+
+struct FaultReader {
+    prefix: &'static [u8],
+    prefix_read: Gate,
+    fail_ready: Gate,
+}
+
+impl AsyncRead for FaultReader {
+    fn poll_read(
+        mut self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buffer: &mut tokio::io::ReadBuf<'_>,
+    ) -> std::task::Poll<std::io::Result<()>> {
+        if !self.prefix.is_empty() {
+            let count = self.prefix.len().min(buffer.remaining());
+            buffer.put_slice(&self.prefix[..count]);
+            self.prefix = &self.prefix[count..];
+            self.prefix_read.open();
+            return std::task::Poll::Ready(Ok(()));
+        }
+        std::task::ready!(self.fail_ready.poll(cx));
+        std::task::Poll::Ready(Err(std::io::Error::new(
+            std::io::ErrorKind::PermissionDenied,
+            "/private/path TOKEN=secret command-body",
+        )))
+    }
+}
+
+// Faults replace only OS wait/read boundaries, not collection or finalization.
+#[tokio::test]
+async fn read_and_post_exit_drain_faults_keep_prefix_exit_and_safe_original_reason() {
+    for stream in [CommandStream::Stdout, CommandStream::Stderr] {
+        for after_exit in [false, true] {
+            let ready = Gate::default();
+            let exited = Gate::default();
+            let fail_ready = if after_exit {
+                exited.clone()
+            } else {
+                let gate = Gate::default();
+                gate.open();
+                gate
+            };
+            let reader = FaultReader {
+                prefix: b"partial",
+                prefix_read: if after_exit {
+                    ready.clone()
+                } else {
+                    Gate::default()
+                },
+                fail_ready,
+            };
+            let process = FaultProcess {
+                ready,
+                exited,
+                wait_error: None,
+            };
+            let (sender, mut receiver) = mpsc::channel(QUEUE_CHUNKS);
+            let (_cancel, cancel_rx) = watch::channel(false);
+            let telemetry = CommandTelemetry::new();
+            let terminal = tokio::time::timeout(Duration::from_secs(5), async {
+                match stream {
+                    CommandStream::Stdout => {
+                        supervise(
+                            process,
+                            reader,
+                            &b""[..],
+                            10,
+                            100,
+                            "fault",
+                            &telemetry,
+                            cancel_rx,
+                            &sender,
+                        )
+                        .await
+                    }
+                    CommandStream::Stderr => {
+                        supervise(
+                            process,
+                            &b""[..],
+                            reader,
+                            10,
+                            100,
+                            "fault",
+                            &telemetry,
+                            cancel_rx,
+                            &sender,
+                        )
+                        .await
+                    }
+                }
+            })
+            .await
+            .unwrap();
+            let Message::Bytes(chunk) = receiver.recv().await.unwrap();
+            assert_eq!(chunk.bytes, b"partial");
+            assert_eq!(chunk.stream, stream);
+            assert_eq!(chunk.sequence, 0);
+            assert_eq!(chunk.offset, 0);
+            assert!(receiver.try_recv().is_err());
+            assert_eq!(terminal.status, CommandStatus::Completed);
+            assert_eq!(terminal.exit_code, Some(0));
+            assert_eq!(terminal.process_failure, None);
+            assert_eq!(terminal.stdout_bytes + terminal.stderr_bytes, 7);
+            assert_eq!(
+                terminal.stdout_delivered_bytes + terminal.stderr_delivered_bytes,
+                7
+            );
+            assert_eq!(terminal.truncation_reason, None);
+            assert_eq!(
+                terminal.output_collection,
+                CommandOutputCollection::Incomplete {
+                    failure: CommandFailure {
+                        stage: match (stream, after_exit) {
+                            (CommandStream::Stdout, false) => CommandFailureStage::StdoutRead,
+                            (CommandStream::Stdout, true) => CommandFailureStage::StdoutDrain,
+                            (CommandStream::Stderr, false) => CommandFailureStage::StderrRead,
+                            (CommandStream::Stderr, true) => CommandFailureStage::StderrDrain,
+                        },
+                        reason: CommandIoErrorKind::PermissionDenied,
+                        os_code: None
+                    },
+                }
+            );
+            let wire = serde_json::to_string(&terminal).unwrap();
+            for secret in ["/private", "TOKEN", "secret", "command-body"] {
+                assert!(!wire.contains(secret));
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn wait_fault_keeps_collected_bytes_and_does_not_invent_exit_information() {
+    let ready = Gate::default();
+    ready.open();
+    let process = FaultProcess {
+        ready,
+        exited: Gate::default(),
+        wait_error: Some(std::io::ErrorKind::InvalidData),
+    };
+    let (sender, mut receiver) = mpsc::channel(QUEUE_CHUNKS);
+    let (_cancel, cancel_rx) = watch::channel(false);
+    let terminal = supervise(
+        process,
+        &b"out"[..],
+        &b"err"[..],
+        10,
+        100,
+        "wait-fault",
+        &CommandTelemetry::new(),
+        cancel_rx,
+        &sender,
+    )
+    .await;
+    assert_eq!(terminal.status, CommandStatus::Failed);
+    assert_eq!(terminal.exit_code, None);
+    assert_eq!(
+        terminal.process_failure,
+        Some(CommandFailure {
+            stage: CommandFailureStage::Wait,
+            reason: CommandIoErrorKind::InvalidData,
+            os_code: None
+        })
+    );
+    assert_eq!(
+        terminal.output_collection,
+        CommandOutputCollection::Complete
+    );
+    assert_eq!(terminal.stdout_bytes, 3);
+    assert_eq!(terminal.stderr_bytes, 3);
+    let mut chunks = Vec::new();
+    while let Ok(Message::Bytes(chunk)) = receiver.try_recv() {
+        chunks.push(chunk);
+    }
+    assert_eq!(stream_bytes(&chunks, CommandStream::Stdout), b"out");
+    assert_eq!(stream_bytes(&chunks, CommandStream::Stderr), b"err");
+    assert!(!serde_json::to_string(&terminal).unwrap().contains("secret"));
+}
+
+#[tokio::test]
+async fn spawn_fault_retains_safe_reason_without_claiming_output_collection() {
+    let root = TempDir::new().unwrap();
+    let (sender, _receiver) = mpsc::channel(QUEUE_CHUNKS);
+    let (_cancel, cancel_rx) = watch::channel(false);
+    let terminal = execute(
+        root.path().join("missing-secret-path"),
+        Harness::request("secret-command", 10, 100),
+        "spawn-fault",
+        &CommandTelemetry::new(),
+        BTreeMap::new(),
+        cancel_rx,
+        &sender,
+    )
+    .await;
+    assert_eq!(
+        terminal.process_failure,
+        Some(CommandFailure {
+            stage: CommandFailureStage::Spawn,
+            reason: CommandIoErrorKind::NotFound,
+            os_code: Some(libc::ENOENT)
+        })
+    );
+    assert_eq!(
+        terminal.output_collection,
+        CommandOutputCollection::NotStarted
+    );
+    assert_eq!(terminal.exit_code, None);
+    assert_eq!(terminal.status, CommandStatus::Failed);
+    assert_eq!(terminal.stdout_bytes + terminal.stderr_bytes, 0);
+    assert!(!serde_json::to_string(&terminal).unwrap().contains("secret"));
+}
+
+#[cfg(feature = "http-client")]
+mod http;
+
+#[tokio::test]
+async fn drain_failure_and_byte_budget_keep_independent_loss_diagnostics() {
+    for stream in [CommandStream::Stdout, CommandStream::Stderr] {
+        let ready = Gate::default();
+        let exited = Gate::default();
+        let process = FaultProcess {
+            ready: ready.clone(),
+            exited: exited.clone(),
+            wait_error: None,
+        };
+        let reader = FaultReader {
+            prefix: b"partial",
+            prefix_read: ready,
+            fail_ready: exited,
+        };
+        let (sender, mut receiver) = mpsc::channel(QUEUE_CHUNKS);
+        let (_cancel, cancel_rx) = watch::channel(false);
+        let telemetry = CommandTelemetry::new();
+        let terminal = tokio::time::timeout(Duration::from_secs(5), async {
+            match stream {
+                CommandStream::Stdout => {
+                    supervise(
+                        process,
+                        reader,
+                        &b""[..],
+                        10,
+                        3,
+                        "quota-fault",
+                        &telemetry,
+                        cancel_rx,
+                        &sender,
+                    )
+                    .await
+                }
+                CommandStream::Stderr => {
+                    supervise(
+                        process,
+                        &b""[..],
+                        reader,
+                        10,
+                        3,
+                        "quota-fault",
+                        &telemetry,
+                        cancel_rx,
+                        &sender,
+                    )
+                    .await
+                }
+            }
+        })
+        .await
+        .unwrap();
+        let Message::Bytes(chunk) = receiver.recv().await.unwrap();
+        assert_eq!(chunk.stream, stream);
+        assert_eq!(chunk.bytes, b"par");
+        assert!(receiver.try_recv().is_err());
+        assert_eq!(terminal.exit_code, Some(0));
+        assert_eq!(terminal.stdout_bytes + terminal.stderr_bytes, 7);
+        assert_eq!(
+            terminal.stdout_delivered_bytes + terminal.stderr_delivered_bytes,
+            3
+        );
+        assert_eq!(
+            terminal.truncation_reason,
+            Some(crate::CommandOutputTruncation::ByteBudget)
+        );
+        assert_eq!(
+            terminal.output_collection,
+            CommandOutputCollection::Incomplete {
+                failure: CommandFailure {
+                    stage: match stream {
+                        CommandStream::Stdout => CommandFailureStage::StdoutDrain,
+                        CommandStream::Stderr => CommandFailureStage::StderrDrain,
+                    },
+                    reason: CommandIoErrorKind::PermissionDenied,
+                    os_code: None,
+                },
+            }
+        );
+        assert!(terminal.metadata_valid());
+    }
+}

crates/workdir/src/local/command_transport/tests/http.rs

@@ -0,0 +1,241 @@
+//! Loopback integration of the real supervisor, byte queue/replay, local session,
+//! HTTP dispatcher/client. OS wait/read are
+//! deterministic faults; session open and start bind that injected process fixture.
+//! Authorization is not asserted here (Runtime's signed HTTP suite owns it).
+
+use super::*;
+use crate::http::*;
+use axum::{Json, Router, extract::State, routing::post};
+
+struct Server(tokio::task::JoinHandle<()>);
+impl Drop for Server {
+    fn drop(&mut self) {
+        self.0.abort();
+    }
+}
+
+async fn operation(
+    State(session): State<Arc<LocalWorkdirSession>>,
+    Json(request): Json<WorkdirSessionOperationRequest>,
+) -> Json<WorkdirSessionOperationResult> {
+    if matches!(request.operation, WorkdirSessionOperation::CommandStart(_)) {
+        return Json(WorkdirSessionOperationResult::CommandStart(CommandHandle(
+            "injected".into(),
+        )));
+    }
+    Json(
+        dispatch_workdir_session_operation(session.as_ref(), request.operation)
+            .await
+            .unwrap(),
+    )
+}
+
+#[tokio::test]
+async fn pipe_and_wait_faults_cross_real_http_with_prefix_and_terminal_replay() {
+    tokio::time::timeout(Duration::from_secs(20), async {
+        for (stream, after_exit, wait_fault) in [
+            (CommandStream::Stdout, false, false),
+            (CommandStream::Stderr, false, false),
+            (CommandStream::Stdout, true, false),
+            (CommandStream::Stderr, true, false),
+            (CommandStream::Stdout, false, true),
+        ] {
+            let root = TempDir::new().unwrap();
+            let session = Arc::new(LocalWorkdirSession::new(
+                Scope::writable(root.path()).unwrap(),
+                root.path().into(),
+            ));
+            let ready = Gate::default();
+            let exited = Gate::default();
+            if wait_fault {
+                ready.open();
+            }
+            let process = FaultProcess {
+                ready: ready.clone(),
+                exited: exited.clone(),
+                wait_error: wait_fault.then_some(std::io::ErrorKind::InvalidData),
+            };
+            let fail_ready = if after_exit {
+                exited
+            } else {
+                let gate = Gate::default();
+                gate.open();
+                gate
+            };
+            let reader = FaultReader {
+                prefix: b"partial",
+                prefix_read: if after_exit { ready } else { Gate::default() },
+                fail_ready,
+            };
+            let command = start_with(
+                "injected".into(),
+                CommandTelemetry::new(),
+                vec![],
+                move |cancel, sender| async move {
+                    let telemetry = CommandTelemetry::new();
+                    if wait_fault {
+                        supervise(
+                            process,
+                            &b"partial"[..],
+                            &b""[..],
+                            10,
+                            100,
+                            "injected",
+                            &telemetry,
+                            cancel,
+                            &sender,
+                        )
+                        .await
+                    } else {
+                        match stream {
+                            CommandStream::Stdout => {
+                                supervise(
+                                    process,
+                                    reader,
+                                    &b""[..],
+                                    10,
+                                    100,
+                                    "injected",
+                                    &telemetry,
+                                    cancel,
+                                    &sender,
+                                )
+                                .await
+                            }
+                            CommandStream::Stderr => {
+                                supervise(
+                                    process,
+                                    &b""[..],
+                                    reader,
+                                    10,
+                                    100,
+                                    "injected",
+                                    &telemetry,
+                                    cancel,
+                                    &sender,
+                                )
+                                .await
+                            }
+                        }
+                    }
+                },
+            );
+            session
+                .inner
+                .commands
+                .lock()
+                .await
+                .insert("injected".into(), command);
+            let app = Router::new()
+                .route(
+                    "/v1/working-directories/{id}/sessions",
+                    post(|| async {
+                        Json(OpenWorkdirSessionResponse {
+                            session_id: WorkdirSessionId::new("fault-session").unwrap(),
+                            workdir_id: crate::Workdir::new("fault-workdir").id().clone(),
+                            capabilities: crate::WorkdirSessionCapabilities::ALL,
+                            environment: crate::WorkdirSessionEnvironment::root(
+                                crate::WorkdirSessionCapabilities::ALL,
+                            ),
+                        })
+                    }),
+                )
+                .route("/v1/workdir-sessions/{id}/operations", post(operation))
+                .with_state(session.clone());
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let base = format!("http://{}", listener.local_addr().unwrap());
+            let _server = Server(tokio::spawn(async move {
+                axum::serve(listener, app).await.unwrap();
+            }));
+            let remote: crate::WorkdirSessionHandle = Arc::new(
+                RemoteWorkdirSession::open(
+                    reqwest::Client::builder().no_proxy().build().unwrap(),
+                    base.parse().unwrap(),
+                    "fixture-token",
+                    crate::Workdir::new("fault-workdir").id().clone(),
+                    OpenWorkdirSessionRequest::default(),
+                )
+                .await
+                .unwrap(),
+            );
+            let handle = CommandHandle("injected".into());
+            let mut request = CommandOutputRequest {
+                handle,
+                cursor: 0,
+                limit: 1,
+                wait: true,
+            };
+            let mut bytes = Vec::new();
+            let terminal = loop {
+                let page = remote.command_output(request.clone()).await.unwrap();
+                assert_eq!(remote.command_output(request.clone()).await.unwrap(), page);
+                for chunk in &page.chunks {
+                    assert_eq!(chunk.sequence, request.cursor);
+                    assert_eq!(chunk.offset, request.cursor);
+                    assert_eq!(chunk.stream, stream);
+                    bytes.extend_from_slice(&chunk.bytes);
+                    request.cursor += chunk.bytes.len() as u64;
+                }
+                assert_eq!(page.next_cursor, request.cursor);
+                if let Some(terminal) = page.terminal {
+                    break terminal;
+                }
+            };
+            assert_eq!(bytes, b"partial");
+            assert_eq!(terminal.truncation_reason, None);
+            assert_eq!(terminal.stdout_bytes + terminal.stderr_bytes, 7);
+            assert_eq!(
+                terminal.stdout_delivered_bytes + terminal.stderr_delivered_bytes,
+                7
+            );
+            if wait_fault {
+                assert_eq!(terminal.status, CommandStatus::Failed);
+                assert_eq!(terminal.exit_code, None);
+                assert_eq!(
+                    terminal.process_failure,
+                    Some(CommandFailure {
+                        stage: CommandFailureStage::Wait,
+                        reason: CommandIoErrorKind::InvalidData,
+                        os_code: None
+                    })
+                );
+                assert_eq!(
+                    terminal.output_collection,
+                    CommandOutputCollection::Complete
+                );
+            } else {
+                assert_eq!(terminal.status, CommandStatus::Completed);
+                assert_eq!(terminal.exit_code, Some(0));
+                let stage = match (stream, after_exit) {
+                    (CommandStream::Stdout, false) => CommandFailureStage::StdoutRead,
+                    (CommandStream::Stderr, false) => CommandFailureStage::StderrRead,
+                    (CommandStream::Stdout, true) => CommandFailureStage::StdoutDrain,
+                    (CommandStream::Stderr, true) => CommandFailureStage::StderrDrain,
+                };
+                assert_eq!(
+                    terminal.output_collection,
+                    CommandOutputCollection::Incomplete {
+                        failure: CommandFailure {
+                            stage,
+                            reason: CommandIoErrorKind::PermissionDenied,
+                            os_code: None
+                        }
+                    }
+                );
+            }
+            let wire = serde_json::to_string(&terminal).unwrap();
+            for secret in [
+                "/private",
+                "TOKEN",
+                "secret",
+                "command-body",
+                "fixture-token",
+            ] {
+                assert!(!wire.contains(secret));
+            }
+            session.close().await.unwrap();
+        }
+    })
+    .await
+    .expect("bounded loopback fault projection");
+}

crates/workdir/src/operation.rs

@@ -132,12 +132,151 @@ pub enum CommandOutputTruncation {
     ByteBudget,
 }
 
-/// Raw totals include discarded pipe bytes. Delivered totals count only prefixes
-/// admitted to the transport queue, not page reads or retries by a consumer.
+/// Closed diagnostic vocabulary: never serialize OS messages, paths, or errno text.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum CommandIoErrorKind {
+    NotFound,
+    PermissionDenied,
+    ConnectionRefused,
+    ConnectionReset,
+    ConnectionAborted,
+    NotConnected,
+    BrokenPipe,
+    AlreadyExists,
+    WouldBlock,
+    InvalidInput,
+    InvalidData,
+    TimedOut,
+    WriteZero,
+    Interrupted,
+    UnexpectedEof,
+    OutOfMemory,
+    HostUnreachable,
+    NetworkUnreachable,
+    AddrInUse,
+    AddrNotAvailable,
+    NetworkDown,
+    NotADirectory,
+    IsADirectory,
+    DirectoryNotEmpty,
+    ReadOnlyFilesystem,
+    StaleNetworkFileHandle,
+    StorageFull,
+    NotSeekable,
+    QuotaExceeded,
+    FileTooLarge,
+    ResourceBusy,
+    ExecutableFileBusy,
+    Deadlock,
+    CrossesDevices,
+    TooManyLinks,
+    InvalidFilename,
+    ArgumentListTooLong,
+    Unsupported,
+    Other,
+    Unknown,
+}
+
+impl From<std::io::ErrorKind> for CommandIoErrorKind {
+    fn from(kind: std::io::ErrorKind) -> Self {
+        use std::io::ErrorKind as Io;
+        match kind {
+            Io::NotFound => Self::NotFound,
+            Io::PermissionDenied => Self::PermissionDenied,
+            Io::ConnectionRefused => Self::ConnectionRefused,
+            Io::ConnectionReset => Self::ConnectionReset,
+            Io::ConnectionAborted => Self::ConnectionAborted,
+            Io::NotConnected => Self::NotConnected,
+            Io::BrokenPipe => Self::BrokenPipe,
+            Io::AlreadyExists => Self::AlreadyExists,
+            Io::WouldBlock => Self::WouldBlock,
+            Io::InvalidInput => Self::InvalidInput,
+            Io::InvalidData => Self::InvalidData,
+            Io::TimedOut => Self::TimedOut,
+            Io::WriteZero => Self::WriteZero,
+            Io::Interrupted => Self::Interrupted,
+            Io::UnexpectedEof => Self::UnexpectedEof,
+            Io::OutOfMemory => Self::OutOfMemory,
+            Io::HostUnreachable => Self::HostUnreachable,
+            Io::NetworkUnreachable => Self::NetworkUnreachable,
+            Io::AddrInUse => Self::AddrInUse,
+            Io::AddrNotAvailable => Self::AddrNotAvailable,
+            Io::NetworkDown => Self::NetworkDown,
+            Io::NotADirectory => Self::NotADirectory,
+            Io::IsADirectory => Self::IsADirectory,
+            Io::DirectoryNotEmpty => Self::DirectoryNotEmpty,
+            Io::ReadOnlyFilesystem => Self::ReadOnlyFilesystem,
+            Io::StaleNetworkFileHandle => Self::StaleNetworkFileHandle,
+            Io::StorageFull => Self::StorageFull,
+            Io::NotSeekable => Self::NotSeekable,
+            Io::QuotaExceeded => Self::QuotaExceeded,
+            Io::FileTooLarge => Self::FileTooLarge,
+            Io::ResourceBusy => Self::ResourceBusy,
+            Io::ExecutableFileBusy => Self::ExecutableFileBusy,
+            Io::Deadlock => Self::Deadlock,
+            Io::CrossesDevices => Self::CrossesDevices,
+            Io::TooManyLinks => Self::TooManyLinks,
+            Io::InvalidFilename => Self::InvalidFilename,
+            Io::ArgumentListTooLong => Self::ArgumentListTooLong,
+            Io::Unsupported => Self::Unsupported,
+            Io::Other => Self::Other,
+            _ => Self::Unknown,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum CommandFailureStage {
+    Spawn,
+    Wait,
+    StdoutRead,
+    StderrRead,
+    StdoutDrain,
+    StderrDrain,
+    OutputDelivery,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct CommandFailure {
+    pub stage: CommandFailureStage,
+    pub reason: CommandIoErrorKind,
+    /// Observed numeric OS code, if supplied by the source. Never inferred from text.
+    pub os_code: Option<i32>,
+}
+
+impl CommandFailure {
+    pub(crate) fn io(stage: CommandFailureStage, error: &std::io::Error) -> Self {
+        Self {
+            stage,
+            reason: error.kind().into(),
+            os_code: error.raw_os_error(),
+        }
+    }
+}
+
+/// EOF collection is independent of exit status and the explicit byte budget.
+/// Incomplete counts are lower bounds on bytes actually produced by the process.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(tag = "state", rename_all = "snake_case", deny_unknown_fields)]
+pub enum CommandOutputCollection {
+    NotStarted,
+    Complete,
+    Incomplete { failure: CommandFailure },
+}
+
+/// Raw totals include discarded *observed* pipe bytes, not an unknown failed tail.
+/// Delivered totals count only prefixes admitted to the transport queue, not page
+/// reads or retries. Neither terminal arrival nor exit zero implies EOF collection.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
 pub struct CommandTerminal {
     pub status: CommandStatus,
     pub exit_code: Option<i32>,
+    pub process_failure: Option<CommandFailure>,
+    pub output_collection: CommandOutputCollection,
     pub stdout_bytes: u64,
     pub stderr_bytes: u64,
     pub stdout_delivered_bytes: u64,
@@ -145,6 +284,54 @@ pub struct CommandTerminal {
     pub truncation_reason: Option<CommandOutputTruncation>,
 }
 
+impl CommandTerminal {
+    /// Validate provider-authored metadata before publishing it as collected evidence.
+    pub fn metadata_valid(&self) -> bool {
+        let truncated = self.stdout_bytes > self.stdout_delivered_bytes
+            || self.stderr_bytes > self.stderr_delivered_bytes;
+        if self.status == CommandStatus::Running
+            || self.stdout_delivered_bytes > self.stdout_bytes
+            || self.stderr_delivered_bytes > self.stderr_bytes
+            || self.truncation_reason != truncated.then_some(CommandOutputTruncation::ByteBudget)
+        {
+            return false;
+        }
+        match self.process_failure {
+            Some(CommandFailure {
+                stage: CommandFailureStage::Spawn,
+                ..
+            }) => {
+                self.status == CommandStatus::Failed
+                    && self.exit_code.is_none()
+                    && self.output_collection == CommandOutputCollection::NotStarted
+                    && self.stdout_bytes == 0
+                    && self.stderr_bytes == 0
+            }
+            Some(CommandFailure {
+                stage: CommandFailureStage::Wait,
+                ..
+            }) => {
+                self.status != CommandStatus::Completed
+                    && self.exit_code.is_none()
+                    && self.collection_started()
+            }
+            Some(_) => false,
+            None => self.collection_started(),
+        }
+    }
+
+    fn collection_started(&self) -> bool {
+        match self.output_collection {
+            CommandOutputCollection::NotStarted => false,
+            CommandOutputCollection::Complete => true,
+            CommandOutputCollection::Incomplete { failure } => !matches!(
+                failure.stage,
+                CommandFailureStage::Spawn | CommandFailureStage::Wait
+            ),
+        }
+    }
+}
+
 /// Sending next_cursor acknowledges this page. Only the current page may be
 /// retried; acknowledged bytes expire. Terminal fences all captured bytes,
 /// including on timeout/cancel. Consumers must pull while the process runs.
@@ -186,19 +373,13 @@ impl CommandOutput {
         self.next_cursor <= MAX_COMMAND_TRANSPORT_BYTES
             && end.is_none_or(|end| end == self.next_cursor)
             && self.terminal.as_ref().is_none_or(|terminal| {
-                let truncated = terminal.stdout_bytes > terminal.stdout_delivered_bytes
-                    || terminal.stderr_bytes > terminal.stderr_delivered_bytes;
-                stream_ends[0].is_none_or(|end| end == terminal.stdout_delivered_bytes)
+                terminal.metadata_valid()
+                    && stream_ends[0].is_none_or(|end| end == terminal.stdout_delivered_bytes)
                     && stream_ends[1].is_none_or(|end| end == terminal.stderr_delivered_bytes)
-                    && terminal.status != CommandStatus::Running
-                    && terminal.stdout_delivered_bytes <= terminal.stdout_bytes
-                    && terminal.stderr_delivered_bytes <= terminal.stderr_bytes
                     && terminal
                         .stdout_delivered_bytes
                         .checked_add(terminal.stderr_delivered_bytes)
                         == Some(self.next_cursor)
-                    && terminal.truncation_reason
-                        == truncated.then_some(CommandOutputTruncation::ByteBudget)
             })
     }
 }
@@ -262,4 +443,70 @@ mod tests {
                 .contains(&serde_json::json!("transport_byte_budget"))
         );
     }
+
+    #[test]
+    fn failure_wire_is_closed_and_does_not_infer_os_codes_from_custom_messages() {
+        let error = std::io::Error::new(
+            std::io::ErrorKind::Other,
+            "/host/private TOKEN=secret EACCES command",
+        );
+        let failure = CommandFailure::io(CommandFailureStage::Wait, &error);
+        assert_eq!(
+            serde_json::to_value(failure).unwrap(),
+            serde_json::json!({"stage":"wait","reason":"other","os_code":null})
+        );
+        let os_error = std::io::Error::from_raw_os_error(libc::EIO);
+        let actual = CommandFailure::io(CommandFailureStage::StdoutDrain, &os_error);
+        assert_eq!(actual.os_code, Some(libc::EIO));
+        for invalid in [
+            serde_json::json!({"stage":"wait","reason":"/host/private TOKEN=secret"}),
+            serde_json::json!({"stage":"/host/private","reason":"other"}),
+            serde_json::json!({"stage":"wait","reason":"other","message":"secret"}),
+        ] {
+            assert!(serde_json::from_value::<CommandFailure>(invalid).is_err());
+        }
+    }
+
+    #[test]
+    fn provider_terminal_rejects_inconsistent_failure_domains_and_unstarted_byte_claims() {
+        let wire = serde_json::json!({"status":"completed","exit_code":0,"process_failure":null,"output_collection":{"state":"incomplete","failure":{"stage":"stdout_drain","reason":"other","os_code":null}},"stdout_bytes":3,"stderr_bytes":0,"stdout_delivered_bytes":3,"stderr_delivered_bytes":0,"truncation_reason":null});
+        let terminal: CommandTerminal = serde_json::from_value(wire.clone()).unwrap();
+        assert!(terminal.metadata_valid());
+        for (field, value) in [
+            (
+                "output_collection",
+                serde_json::json!({"state":"not_started"}),
+            ),
+            (
+                "output_collection",
+                serde_json::json!({"state":"incomplete","failure":{"stage":"wait","reason":"other"}}),
+            ),
+            (
+                "process_failure",
+                serde_json::json!({"stage":"stdout_read","reason":"other"}),
+            ),
+            (
+                "process_failure",
+                serde_json::json!({"stage":"spawn","reason":"not_found"}),
+            ),
+            ("truncation_reason", serde_json::json!("byte_budget")),
+        ] {
+            let mut invalid = wire.clone();
+            invalid[field] = value;
+            assert!(
+                !serde_json::from_value::<CommandTerminal>(invalid)
+                    .unwrap()
+                    .metadata_valid()
+            );
+        }
+        let mut unclassified = wire.clone();
+        unclassified
+            .as_object_mut()
+            .unwrap()
+            .remove("output_collection");
+        assert!(serde_json::from_value::<CommandTerminal>(unclassified).is_err());
+        let mut raw = wire;
+        raw["message"] = serde_json::json!("/private TOKEN=secret");
+        assert!(serde_json::from_value::<CommandTerminal>(raw).is_err());
+    }
 }

crates/workdir/src/router.rs

@@ -225,16 +225,27 @@ impl Drop for ActiveOperation<'_> {
 #[derive(Debug, Clone)]
 pub struct RoutedWorkdirSession {
     state: Arc<RoutedSessionState>,
+    view: Option<WorkdirSessionHandle>,
+}
+
+impl RoutedWorkdirSession {
+    fn inner(&self) -> &WorkdirSessionHandle {
+        self.view.as_ref().unwrap_or(&self.state.session)
+    }
 }
 
 #[async_trait]
 impl WorkdirSession for RoutedWorkdirSession {
     fn workdir(&self) -> &Workdir {
-        self.state.session.workdir()
+        self.inner().workdir()
     }
 
     fn capabilities(&self) -> WorkdirSessionCapabilities {
-        self.state.session.capabilities()
+        self.inner().capabilities()
+    }
+
+    fn environment(&self) -> crate::WorkdirSessionEnvironment {
+        self.inner().environment()
     }
 
     async fn authorize_scope_path(
@@ -242,7 +253,7 @@ impl WorkdirSession for RoutedWorkdirSession {
         request: WorkdirScopeAuthorizationRequest,
     ) -> Result<(), WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.authorize_scope_path(request).await
+        self.inner().authorize_scope_path(request).await
     }
 
     async fn scope_rules_overlap(
@@ -250,7 +261,7 @@ impl WorkdirSession for RoutedWorkdirSession {
         request: WorkdirScopeOverlapRequest,
     ) -> Result<bool, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.scope_rules_overlap(request).await
+        self.inner().scope_rules_overlap(request).await
     }
 
     async fn checkout_search(
@@ -258,7 +269,7 @@ impl WorkdirSession for RoutedWorkdirSession {
         request: crate::CheckoutSearchRequest,
     ) -> Result<crate::CheckoutSearchResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.checkout_search(request).await
+        self.inner().checkout_search(request).await
     }
 
     async fn checkout_observe(
@@ -266,59 +277,59 @@ impl WorkdirSession for RoutedWorkdirSession {
         path: crate::WorkdirPath,
     ) -> Result<crate::CheckoutObservation, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.checkout_observe(path).await
+        self.inner().checkout_observe(path).await
     }
     async fn checkout_execute(
         &self,
         request: crate::CheckoutRequest,
     ) -> Result<crate::CheckoutResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.checkout_execute(request).await
+        self.inner().checkout_execute(request).await
     }
 
     async fn stat(&self, request: StatRequest) -> Result<StatResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.stat(request).await
+        self.inner().stat(request).await
     }
 
     async fn read(&self, request: ReadRequest) -> Result<ReadResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.read(request).await
+        self.inner().read(request).await
     }
 
     async fn read_bytes(&self, request: ReadBytesRequest) -> Result<ReadBytesResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.read_bytes(request).await
+        self.inner().read_bytes(request).await
     }
 
     async fn write(&self, request: WriteRequest) -> Result<WriteResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.write(request).await
+        self.inner().write(request).await
     }
 
     async fn edit(&self, request: EditRequest) -> Result<EditResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.edit(request).await
+        self.inner().edit(request).await
     }
 
     async fn list(&self, request: ListRequest) -> Result<ListResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.list(request).await
+        self.inner().list(request).await
     }
 
     async fn glob(&self, request: GlobRequest) -> Result<GlobResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.glob(request).await
+        self.inner().glob(request).await
     }
 
     async fn grep(&self, request: GrepRequest) -> Result<GrepResult, WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.grep(request).await
+        self.inner().grep(request).await
     }
 
     async fn start_command(&self, request: CommandRequest) -> Result<CommandHandle, WorkdirError> {
         let _active = self.state.enter()?;
-        let handle = self.state.session.start_command(request).await?;
+        let handle = self.inner().start_command(request).await?;
         self.state
             .active_commands
             .lock()
@@ -329,7 +340,7 @@ impl WorkdirSession for RoutedWorkdirSession {
 
     async fn command_status(&self, handle: CommandHandle) -> Result<CommandStatus, WorkdirError> {
         let _active = self.state.enter()?;
-        let status = self.state.session.command_status(handle.clone()).await?;
+        let status = self.inner().command_status(handle.clone()).await?;
         self.state.mark_terminal(&handle, status);
         Ok(status)
     }
@@ -340,7 +351,7 @@ impl WorkdirSession for RoutedWorkdirSession {
     ) -> Result<CommandOutput, WorkdirError> {
         let _active = self.state.enter()?;
         let handle = request.handle.clone();
-        let output = self.state.session.command_output(request).await?;
+        let output = self.inner().command_output(request).await?;
         if let Some(terminal) = &output.terminal {
             self.state.mark_terminal(&handle, terminal.status);
         }
@@ -349,7 +360,7 @@ impl WorkdirSession for RoutedWorkdirSession {
 
     async fn cancel_command(&self, handle: CommandHandle) -> Result<(), WorkdirError> {
         let _active = self.state.enter()?;
-        self.state.session.cancel_command(handle.clone()).await?;
+        self.inner().cancel_command(handle.clone()).await?;
         self.state
             .active_commands
             .lock()
@@ -359,11 +370,11 @@ impl WorkdirSession for RoutedWorkdirSession {
     }
 
     fn subscribe_command_events(&self) -> Option<broadcast::Receiver<CommandEvent>> {
-        self.state.session.subscribe_command_events()
+        self.inner().subscribe_command_events()
     }
 
     fn command_snapshot(&self) -> Vec<CommandSnapshot> {
-        let snapshots = self.state.session.command_snapshot();
+        let snapshots = self.inner().command_snapshot();
         self.state.reconcile_terminal_commands(&snapshots);
         snapshots
     }
@@ -374,7 +385,7 @@ impl WorkdirSession for RoutedWorkdirSession {
                 "Workdir attachment has active operations or commands".to_string(),
             ));
         }
-        self.state.session.close().await
+        self.inner().close().await
     }
 }
 
@@ -387,6 +398,7 @@ impl WorkdirSession for RoutedWorkdirSession {
 pub struct WorkdirSessionRouter {
     sessions: RwLock<BTreeMap<WorkdirAttachmentAlias, Arc<RoutedSessionState>>>,
     next_generation: AtomicU64,
+    coordinate_brokers: RwLock<BTreeMap<WorkdirAttachmentAlias, (u64, crate::WorkdirToolBroker)>>,
 }
 
 impl WorkdirSessionRouter {
@@ -473,9 +485,9 @@ impl WorkdirSessionRouter {
             }
         };
         Ok(ResolvedWorkdirSession {
+            session: self.routed(&selected.0, selected.1.clone()),
             alias: selected.0,
             generation: selected.1.generation,
-            session: Arc::new(RoutedWorkdirSession { state: selected.1 }),
         })
     }
 
@@ -483,13 +495,22 @@ impl WorkdirSessionRouter {
         &self,
         alias: WorkdirAttachmentAlias,
         session: WorkdirSessionHandle,
+    ) -> Result<WorkdirSessionHandle, WorkdirError> {
+        self.attach_with_cwd(alias, session, None)
+    }
+
+    fn attach_with_cwd(
+        &self,
+        alias: WorkdirAttachmentAlias,
+        session: WorkdirSessionHandle,
+        cwd: Option<crate::WorkdirPath>,
     ) -> Result<WorkdirSessionHandle, WorkdirError> {
         let mut sessions = self.sessions.write().map_err(|_| {
-            WorkdirError::Unavailable("Workdir attachment router is poisoned".to_string())
+            WorkdirError::Unavailable("Workdir attachment router is poisoned".into())
         })?;
         if sessions.contains_key(&alias) {
             return Err(WorkdirError::Conflict(format!(
-                "Workdir attachment alias `{alias}` already exists"
+                "Workdir attachment alias \u{0060}{alias}\u{0060} already exists"
             )));
         }
         let state = Arc::new(RoutedSessionState {
@@ -499,8 +520,61 @@ impl WorkdirSessionRouter {
             active_operations: AtomicUsize::new(0),
             active_commands: Mutex::new(HashSet::new()),
         });
+        let view = if let Some(cwd) = cwd {
+            let source = Arc::new(RoutedWorkdirSession {
+                state: state.clone(),
+                view: None,
+            });
+            let broker = crate::WorkdirToolBroker::at_cwd(source, cwd)?;
+            let view = broker.tool_session();
+            self.coordinate_brokers
+                .write()
+                .map_err(|_| {
+                    WorkdirError::Unavailable("Workdir coordinate broker map is poisoned".into())
+                })?
+                .insert(alias.clone(), (state.generation, broker));
+            Some(view)
+        } else {
+            None
+        };
         sessions.insert(alias, state.clone());
-        Ok(Arc::new(RoutedWorkdirSession { state }))
+        Ok(Arc::new(RoutedWorkdirSession { state, view }))
+    }
+
+    fn routed(
+        &self,
+        alias: &WorkdirAttachmentAlias,
+        state: Arc<RoutedSessionState>,
+    ) -> Arc<RoutedWorkdirSession> {
+        let view = self
+            .coordinate_broker(alias, state.generation)
+            .map(|broker| broker.tool_session());
+        Arc::new(RoutedWorkdirSession { state, view })
+    }
+
+    pub(crate) fn coordinate_broker(
+        &self,
+        alias: &WorkdirAttachmentAlias,
+        generation: u64,
+    ) -> Option<crate::WorkdirToolBroker> {
+        self.coordinate_brokers
+            .read()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(alias)
+            .filter(|(current, _)| *current == generation)
+            .map(|(_, broker)| broker.clone())
+    }
+
+    /// Bind tool coordinates once while retaining root-coordinate delegation
+    /// and provider authorization. Both views share the route's detach fence.
+    pub fn attach_at_cwd(
+        &self,
+        alias: WorkdirAttachmentAlias,
+        source: WorkdirSessionHandle,
+        cwd: crate::WorkdirPath,
+    ) -> Result<WorkdirSessionHandle, WorkdirError> {
+        let cwd = crate::WorkdirPath::new(cwd.as_str())?;
+        self.attach_with_cwd(alias, source, Some(cwd))
     }
 
     pub fn session(&self, alias: &WorkdirAttachmentAlias) -> Option<WorkdirSessionHandle> {
@@ -509,7 +583,7 @@ impl WorkdirSessionRouter {
             .ok()?
             .get(alias)
             .cloned()
-            .map(|state| Arc::new(RoutedWorkdirSession { state }) as WorkdirSessionHandle)
+            .map(|state| self.routed(alias, state) as WorkdirSessionHandle)
     }
 
     /// Compatibility projection used only while filesystem tool schemas have no
@@ -521,10 +595,8 @@ impl WorkdirSessionRouter {
             return None;
         }
         sessions
-            .values()
-            .next()
-            .cloned()
-            .map(|state| Arc::new(RoutedWorkdirSession { state }) as WorkdirSessionHandle)
+            .first_key_value()
+            .map(|(alias, state)| self.routed(alias, state.clone()) as WorkdirSessionHandle)
     }
 
     pub fn can_detach(&self, alias: &WorkdirAttachmentAlias) -> Result<(), WorkdirError> {
@@ -620,6 +692,10 @@ impl WorkdirSessionRouter {
             .is_some_and(|current| Arc::ptr_eq(current, &state))
         {
             sessions.remove(alias);
+            self.coordinate_brokers
+                .write()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .remove(alias);
         }
         Ok(state.session.clone())
     }
@@ -661,6 +737,10 @@ impl WorkdirSessionRouter {
                 .is_some_and(|current| Arc::ptr_eq(current, &state))
             {
                 sessions.remove(&alias);
+                self.coordinate_brokers
+                    .write()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .remove(&alias);
             }
         }
         Ok(())
@@ -684,6 +764,131 @@ mod tests {
         ))
     }
 
+    #[tokio::test]
+    async fn cwd_views_share_root_delegation_leases_and_attachment_fences() {
+        use crate::{
+            WorkdirPath as P, WorkdirToolBrokerRouter, WorkdirToolScope,
+            WorkdirToolScopePermission as Permission, WorkdirToolScopeRule,
+        };
+        let root = TempDir::new().unwrap();
+        for directory in ["work", "other", "other/inside"] {
+            std::fs::create_dir_all(root.path().join(directory)).unwrap();
+            std::fs::write(root.path().join(directory).join("marker"), directory).unwrap();
+        }
+        let router = Arc::new(WorkdirSessionRouter::new());
+        let alias = WorkdirAttachmentAlias::new("source").unwrap();
+        let parent = router
+            .attach_at_cwd(alias.clone(), session("wd", &root), P::new("work").unwrap())
+            .unwrap();
+        assert_eq!(parent.environment().cwd, P::new("work").unwrap());
+        let request = |cwd: &str| WorkdirToolScope {
+            rules: vec![WorkdirToolScopeRule {
+                target: P::new(cwd).unwrap(),
+                permission: Permission::Write,
+                recursive: true,
+                symlink_policy: Default::default(),
+            }],
+            cwd: P::new(cwd).unwrap(),
+            command: false,
+        };
+        let brokers = WorkdirToolBrokerRouter::new(router.clone());
+        // Declarations stay root-relative, not work/other.
+        let child = brokers
+            .scope(vec![(alias.clone(), request("other"))])
+            .await
+            .unwrap();
+        let grandchild = child
+            .broker_router()
+            .scope(vec![(alias.clone(), request("other/inside"))])
+            .await
+            .unwrap();
+        for (session, cwd) in [
+            (parent.clone(), "work"),
+            (
+                child.session_router().resolve(None).unwrap().session,
+                "other",
+            ),
+            (
+                grandchild.session_router().resolve(None).unwrap().session,
+                "other/inside",
+            ),
+        ] {
+            assert_eq!(session.environment().cwd, P::new(cwd).unwrap());
+            let result = session
+                .read(ReadRequest {
+                    path: P::new("marker").unwrap(),
+                    offset: 0,
+                    limit: 10,
+                    max_bytes: 100,
+                })
+                .await
+                .unwrap();
+            assert_eq!(result.bytes, cwd.as_bytes());
+            assert_eq!(result.path, P::new("marker").unwrap());
+            assert_eq!(
+                session
+                    .stat(StatRequest {
+                        path: P::new("marker").unwrap()
+                    })
+                    .await
+                    .unwrap()
+                    .path,
+                P::new("marker").unwrap()
+            );
+        }
+        // The model's tool view and delegation view share write-lease exclusion.
+        let absolute = P::new_scoped(root.path().join("other/marker").to_str().unwrap()).unwrap();
+        let denied = parent
+            .write(WriteRequest {
+                path: absolute,
+                content: b"forbidden".to_vec(),
+                expected_hash: None,
+            })
+            .await
+            .unwrap_err();
+        assert_eq!(
+            denied.denial_reason(),
+            Some(crate::WorkdirDenialReason::ChildWriteLeaseConflict)
+        );
+        let old_child = child.session_router().resolve(None).unwrap().session;
+        router.begin_detach(&alias).await.unwrap();
+        assert!(
+            old_child
+                .read(ReadRequest {
+                    path: P::new("marker").unwrap(),
+                    offset: 0,
+                    limit: 10,
+                    max_bytes: 100
+                })
+                .await
+                .is_err()
+        );
+        router.cancel_detach(&alias);
+        grandchild.close().await.unwrap();
+        child.close().await.unwrap();
+        router.detach(&alias).await.unwrap();
+        router
+            .attach_at_cwd(
+                alias,
+                session("replacement", &root),
+                P::new("other").unwrap(),
+            )
+            .unwrap();
+        assert_eq!(
+            router.resolve(None).unwrap().session.environment().cwd,
+            P::new("other").unwrap()
+        );
+        assert!(
+            old_child
+                .stat(StatRequest {
+                    path: P::new("marker").unwrap()
+                })
+                .await
+                .is_err()
+        );
+        router.close_all().await.unwrap();
+    }
+
     #[tokio::test]
     async fn checkout_routes_use_active_operation_detach_fence_and_old_handles_stay_closed() {
         let root = TempDir::new().unwrap();
@@ -842,7 +1047,7 @@ mod tests {
         assert!(router.is_empty());
         assert!(matches!(
             underlying.command_status(handle).await,
-            Err(WorkdirError::Unavailable(_))
+            Err(ref error) if matches!(error.classification_source(), WorkdirError::Unavailable(_))
         ));
     }
 

crates/workdir/src/scope.rs

@@ -108,17 +108,34 @@ impl WorkdirToolBroker {
         Self::with_capabilities(source, capabilities)
     }
 
+    /// Set the tool coordinate base without changing provider authority.
+    /// The input is relative to the source session's coordinates; delegation
+    /// declarations retain their existing coordinate contract.
+    pub fn at_cwd(source: WorkdirSessionHandle, cwd: FsPath) -> Result<Self, WorkdirError> {
+        let cwd = FsPath::new(cwd.as_str())?;
+        let capabilities = source.capabilities();
+        Ok(Self::with_capabilities_and_cwd(source, capabilities, cwd))
+    }
+
     /// Own a session behind an additional Backend-authored capability ceiling.
     /// The ceiling can only attenuate provider capabilities; it can never add one.
     pub fn with_capabilities(
         source: WorkdirSessionHandle,
         capabilities: WorkdirSessionCapabilities,
+    ) -> Self {
+        Self::with_capabilities_and_cwd(source, capabilities, FsPath::root())
+    }
+
+    fn with_capabilities_and_cwd(
+        source: WorkdirSessionHandle,
+        capabilities: WorkdirSessionCapabilities,
+        cwd: FsPath,
     ) -> Self {
         let capabilities = source.capabilities().intersection(capabilities);
         let (command_events, _) = broadcast::channel(64);
         let authority = Arc::new(ScopedWorkdirSession {
             source,
-            cwd: FsPath::new("").expect("empty Workdir path is valid"),
+            cwd,
             scope: None,
             capabilities,
             validity: SessionValidity::root(),
@@ -416,6 +433,9 @@ impl WorkdirToolBrokerRouter {
             .sessions
             .resolve(Some(alias.as_str()))
             .map_err(|error| WorkdirError::InvalidArgument(error.to_string()))?;
+        if let Some(broker) = self.sessions.coordinate_broker(alias, selected.generation) {
+            return Ok(broker);
+        }
         let mut brokers = self.brokers.lock().map_err(|_| {
             WorkdirError::Unavailable("Workdir tool broker router is poisoned".to_string())
         })?;
@@ -684,7 +704,7 @@ impl ScopedWorkdirSession {
     }
 
     fn resolve_path(&self, path: &FsPath) -> Result<FsPath, WorkdirError> {
-        if self.cwd.as_str().is_empty() {
+        if self.cwd.as_str().is_empty() || Path::new(path.as_str()).is_absolute() {
             return Ok(path.clone());
         }
         let joined = Path::new(self.cwd.as_str()).join(path.as_str());
@@ -1085,6 +1105,43 @@ impl WorkdirSession for ScopedWorkdirSession {
         self.capabilities
     }
 
+    fn environment(&self) -> crate::WorkdirSessionEnvironment {
+        let mut environment = self.source.environment();
+        let source_cwd = environment.cwd.clone();
+        environment.cwd = FsPath::new(
+            Path::new(source_cwd.as_str())
+                .join(self.cwd.as_str())
+                .to_str()
+                .expect("validated UTF-8 paths"),
+        )
+        .expect("validated session cwd");
+        if let Some(scope) = &self.scope {
+            if let Some(inherited) = environment.scope.take() {
+                environment
+                    .restrictions
+                    .push(format!("Provider allow ceiling: {inherited:?}"));
+            }
+            environment.scope = Some(
+                scope
+                    .iter()
+                    .cloned()
+                    .map(|mut rule| {
+                        rule.target = FsPath::new(
+                            Path::new(source_cwd.as_str())
+                                .join(rule.target.as_str())
+                                .to_str()
+                                .expect("validated UTF-8 paths"),
+                        )
+                        .expect("validated scope target");
+                        rule
+                    })
+                    .collect(),
+            );
+        }
+        environment.capabilities = self.capabilities();
+        environment
+    }
+
     async fn authorize_scope_path(
         &self,
         mut request: WorkdirScopeAuthorizationRequest,
@@ -1273,8 +1330,11 @@ impl WorkdirSession for ScopedWorkdirSession {
             .resolve_operation_path(&request.path, WorkdirToolScopePermission::Read)
             .await?;
         self.ensure_read(&path, WorkdirSessionCapability::Read)?;
+        let caller_path = request.path.clone();
         request.path = path;
-        self.source.stat(request).await
+        let mut result = self.source.stat(request).await?;
+        result.path = caller_path;
+        Ok(result)
     }
 
     async fn read(&self, mut request: ReadRequest) -> Result<ReadResult, WorkdirError> {
@@ -1282,8 +1342,11 @@ impl WorkdirSession for ScopedWorkdirSession {
             .resolve_operation_path(&request.path, WorkdirToolScopePermission::Read)
             .await?;
         self.ensure_read(&path, WorkdirSessionCapability::Read)?;
+        let caller_path = request.path.clone();
         request.path = path;
-        self.source.read(request).await
+        let mut result = self.source.read(request).await?;
+        result.path = caller_path;
+        Ok(result)
     }
 
     async fn read_bytes(
@@ -1422,9 +1485,10 @@ impl WorkdirSession for ScopedWorkdirSession {
             )));
         }
         let tool_call_id = request.tool_call_id.clone();
-        if self.scope.is_some() {
-            request.cwd = self.resolve_path(&request.cwd)?;
-        }
+        request.cwd = self
+            .resolve_operation_path(&request.cwd, WorkdirToolScopePermission::Read)
+            .await?;
+        self.ensure_path(&request.cwd, WorkdirToolScopePermission::Read)?;
         if let Some(tool_call_id) = &tool_call_id {
             self.starting_tool_calls
                 .lock()
@@ -1601,7 +1665,20 @@ impl WorkdirSession for ReadOnlyWorkdirSession {
     }
 
     fn capabilities(&self) -> WorkdirSessionCapabilities {
-        WorkdirSessionCapabilities::READ_ONLY
+        self.inner
+            .capabilities()
+            .intersection(WorkdirSessionCapabilities::READ_ONLY)
+    }
+
+    fn environment(&self) -> crate::WorkdirSessionEnvironment {
+        let mut environment = self.inner.environment();
+        environment.capabilities = self.capabilities();
+        if let Some(scope) = &mut environment.scope {
+            for rule in scope {
+                rule.permission = WorkdirToolScopePermission::Read;
+            }
+        }
+        environment
     }
 
     async fn authorize_scope_path(

crates/workdir/tests/failure_diagnostics.rs

@@ -0,0 +1,116 @@
+use workdir::external::ExternalWorkdirOperationError;
+use workdir::http::{WorkdirTransportError, WorkdirTransportErrorCode as Code};
+use workdir::{WorkdirError, WorkdirFailureReason as Reason};
+
+#[test]
+fn failure_reasons_survive_internal_transports_without_provider_text() {
+    for reason in [
+        Reason::SessionClosed,
+        Reason::ProviderUnavailable,
+        Reason::CommandTerminalMissing,
+        Reason::HttpTimeout,
+        Reason::HttpConnect,
+        Reason::HttpTransfer,
+        Reason::HttpResponseInvalid,
+        Reason::HttpResponseTooLarge,
+    ] {
+        let source = WorkdirError::Unavailable("secret-token /private/path".into())
+            .with_failure_reason(reason);
+        let transport = WorkdirTransportError::from_workdir_error(&source);
+        let wire = serde_json::to_string(&transport).unwrap();
+        assert!(!wire.contains("secret-token"));
+        assert!(!wire.contains("/private/path"));
+        assert_eq!(transport.code, Code::Unavailable);
+        assert_eq!(transport.code.http_status(), 503);
+        assert_eq!(transport.message, "Workdir session is unavailable");
+        assert_eq!(serde_json::to_value(reason).unwrap(), reason.as_str());
+        let decoded: WorkdirTransportError = serde_json::from_str(&wire).unwrap();
+        let external = ExternalWorkdirOperationError::from_transport_error(decoded);
+        let external_wire = serde_json::to_string(&external).unwrap();
+        let external: ExternalWorkdirOperationError = serde_json::from_str(&external_wire).unwrap();
+        let error = external.into_transport_error().into_workdir_error();
+        assert_eq!(error.failure_reason(), Some(reason));
+        assert!(matches!(
+            error.classification_source(),
+            WorkdirError::Unavailable(_)
+        ));
+        assert_eq!(
+            WorkdirTransportError::from_workdir_error(&error).failure_reason,
+            Some(reason)
+        );
+    }
+}
+
+#[test]
+fn legacy_errors_and_nested_context_preserve_classification() {
+    let wire = r#"{"code":"unavailable","message":"Workdir session is unavailable"}"#;
+    let old: WorkdirTransportError = serde_json::from_str(wire).unwrap();
+    assert!(old.failure_reason.is_none());
+    assert!(matches!(
+        old.into_workdir_error(),
+        WorkdirError::Unavailable(_)
+    ));
+    let closed = WorkdirTransportError::from_workdir_error(&WorkdirError::SessionClosed);
+    assert_eq!(closed.failure_reason, Some(Reason::SessionClosed));
+    // Reason-looking text never becomes a typed diagnosis.
+    let generic = WorkdirError::Unavailable("http_timeout".into());
+    assert_eq!(generic.failure_reason(), Some(Reason::ProviderUnavailable));
+    let error = WorkdirError::DenialContext {
+        reason: workdir::WorkdirDenialReason::OsPermissionDenied,
+        source: Box::new(
+            WorkdirError::OutcomeUnknown("do not retry".into())
+                .with_failure_reason(Reason::HttpTransfer),
+        ),
+    };
+    let error = WorkdirTransportError::from_workdir_error(&error).into_workdir_error();
+    assert!(matches!(
+        error.classification_source(),
+        WorkdirError::OutcomeUnknown(_)
+    ));
+    assert_eq!(
+        error.denial_reason(),
+        Some(workdir::WorkdirDenialReason::OsPermissionDenied)
+    );
+    assert_eq!(error.failure_reason(), Some(Reason::HttpTransfer));
+}
+
+#[test]
+fn provider_cannot_inject_free_text_failure_reason() {
+    assert!(
+        serde_json::from_str::<WorkdirTransportError>(
+            r#"{"code":"unavailable","message":"x","failure_reason":"secret /path"}"#
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn provider_authored_operational_messages_never_enter_error_display_or_debug() {
+    for code in [
+        Code::Conflict,
+        Code::OutcomeUnknown,
+        Code::Unsupported,
+        Code::InvalidRequest,
+        Code::Unavailable,
+        Code::Io,
+        Code::Transport,
+        Code::Internal,
+    ] {
+        let wire = serde_json::json!({
+            "code": code, "message":"/host/private command-secret body-secret proof-secret key-secret Authorization: Bearer bearer-secret",
+            "failure_reason": "session_open_task_failed"
+        });
+        let decoded: WorkdirTransportError = serde_json::from_value(wire).unwrap();
+        let error = decoded.into_workdir_error();
+        for text in [
+            format!("{error}"),
+            format!("{error:?}"),
+            serde_json::to_string(&WorkdirTransportError::from_workdir_error(&error)).unwrap(),
+        ] {
+            assert!(!text.contains("secret"), "{text}");
+            assert!(!text.contains("/host/private"), "{text}");
+        }
+        assert_eq!(error.failure_reason(), Some(Reason::SessionOpenTaskFailed));
+        assert_eq!(WorkdirTransportError::from_workdir_error(&error).code, code);
+    }
+}

crates/workdir/tests/remote_denial_reasons.rs

@@ -14,6 +14,18 @@ use workdir::{
     },
 };
 
+fn opened(workdir_id: &str) -> String {
+    serde_json::to_string(&workdir::http::OpenWorkdirSessionResponse {
+        session_id: workdir::http::WorkdirSessionId::new("s").unwrap(),
+        workdir_id: Workdir::new(workdir_id).id().clone(),
+        capabilities: workdir::WorkdirSessionCapabilities::ALL,
+        environment: workdir::WorkdirSessionEnvironment::root(
+            workdir::WorkdirSessionCapabilities::ALL,
+        ),
+    })
+    .unwrap()
+}
+
 fn reply(listener: &TcpListener, status: &str, body: &str) {
     listener.set_nonblocking(true).unwrap();
     let deadline = Instant::now() + Duration::from_secs(5);
@@ -73,11 +85,7 @@ async fn remote_http_denials_forward_only_typed_reasons_and_old_missing_reason()
             error["denial_reason"] = serde_json::to_value(reason).unwrap();
         }
         let server = thread::spawn(move || {
-            reply(
-                &listener,
-                "200 OK",
-                r#"{"session_id":"s","workdir_id":"w","capabilities":{"bits":63}}"#,
-            );
+            reply(&listener, "200 OK", &opened("w"));
             reply(&listener, "403 Forbidden", &error.to_string());
         });
         let remote = RemoteWorkdirSession::open(
@@ -163,11 +171,7 @@ async fn remote_checkout_diagnostics_preserve_mutation_outcome_and_read_failures
                 let address = listener.local_addr().unwrap();
                 let error = serde_json::json!({"code":code, "message":"/secret/host provider-secret", "denial_reason":reason});
                 let server = thread::spawn(move || {
-                    reply(
-                        &listener,
-                        "200 OK",
-                        r#"{"session_id":"s","workdir_id":"w","capabilities":{"bits":63}}"#,
-                    );
+                    reply(&listener, "200 OK", &opened("w"));
                     reply(
                         &listener,
                         &format!("{} Fixture failure", code.http_status()),
@@ -216,3 +220,106 @@ async fn remote_checkout_diagnostics_preserve_mutation_outcome_and_read_failures
         }
     }
 }
+
+#[tokio::test]
+async fn mismatched_http_results_keep_cause_and_mutation_uncertainty() {
+    use workdir::{
+        CheckoutOperation, CheckoutRequest, CommandHandle, CommandOutputRequest,
+        WorkdirFailureReason as Failure,
+    };
+    for case in ["variant", "bytes", "mutation", "identity"] {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = thread::spawn(move || {
+            reply(
+                &listener,
+                "200 OK",
+                &opened(if case == "identity" {
+                    "wrong-secret"
+                } else {
+                    "w"
+                }),
+            );
+            if case != "identity" {
+                let result = if case == "bytes" {
+                    serde_json::json!({"operation":"command_output","result":{
+                        "chunks": [], "next_cursor": 123, "terminal": null
+                    }})
+                } else {
+                    serde_json::to_value(
+                        workdir::http::WorkdirSessionOperationResult::CommandCancel,
+                    )
+                    .unwrap()
+                };
+                reply(&listener, "200 OK", &result.to_string());
+            }
+        });
+        let opened = RemoteWorkdirSession::open(
+            reqwest::Client::builder()
+                .no_proxy()
+                .timeout(Duration::from_secs(5))
+                .build()
+                .unwrap(),
+            format!("http://{address}").parse().unwrap(),
+            "request-secret",
+            Workdir::new("w").id().clone(),
+            OpenWorkdirSessionRequest::default(),
+        )
+        .await;
+        let error = if case == "identity" {
+            opened.unwrap_err()
+        } else {
+            let remote = opened.unwrap();
+            match case {
+                "variant" => remote
+                    .stat(StatRequest {
+                        path: WorkdirPath::new("file-secret").unwrap(),
+                    })
+                    .await
+                    .unwrap_err(),
+                "bytes" => remote
+                    .command_output(CommandOutputRequest {
+                        handle: CommandHandle("command-secret".into()),
+                        cursor: 0,
+                        limit: 16,
+                        wait: false,
+                    })
+                    .await
+                    .unwrap_err(),
+                "mutation" => remote
+                    .checkout_execute(CheckoutRequest {
+                        target: WorkdirPath::new("file-secret").unwrap(),
+                        validator: vec![1],
+                        operation: CheckoutOperation::Write {
+                            content: b"body-secret".to_vec(),
+                            expected_hash: [0; 32],
+                        },
+                    })
+                    .await
+                    .unwrap_err(),
+                _ => unreachable!(),
+            }
+        };
+        server.join().unwrap();
+        let expected = if case == "identity" {
+            Failure::SessionIdentityMismatch
+        } else {
+            Failure::OperationResultMismatch
+        };
+        assert_eq!(error.failure_reason(), Some(expected), "{case}: {error:?}");
+        let transport = WorkdirTransportError::from_workdir_error(&error);
+        assert_eq!(
+            transport.code,
+            if case == "mutation" {
+                Code::OutcomeUnknown
+            } else {
+                Code::Unavailable
+            }
+        );
+        let wire = serde_json::to_string(&transport).unwrap();
+        assert!(!wire.contains("secret"), "{wire}");
+        assert!(!format!("{error:?}").contains("secret"));
+        let forwarded = transport.into_workdir_error();
+        assert_eq!(forwarded.failure_reason(), Some(expected));
+    }
+}

crates/worker-runtime/Cargo.toml

@@ -56,6 +56,7 @@ server-api = { path = "../server-api" }
 workdir.workspace = true
 
 [dev-dependencies]
+tools.workspace = true
 workdir = { workspace = true, features = ["http-client"] }
 futures.workspace = true
 agen.workspace = true

crates/worker-runtime/src/http_server.rs

@@ -869,6 +869,7 @@ async fn open_workdir_session(
         session_id: session_id.clone(),
         workdir_id: session.workdir().id().clone(),
         capabilities: session.capabilities(),
+        environment: session.environment(),
     };
     state
         .workdir_sessions
@@ -2146,6 +2147,7 @@ impl RuntimeHttpWorkdirError {
         Self {
             status,
             payload: WorkdirTransportError {
+                failure_reason: None,
                 denial_reason: None,
                 code,
                 message: message.into(),
@@ -2186,7 +2188,25 @@ impl RuntimeHttpWorkdirError {
     }
 
     fn runtime(error: RuntimeError) -> Self {
-        match error {
+        use workdir::WorkdirFailureReason as Reason;
+        let reason = match &error {
+            RuntimeError::WorkingDirectory(diagnostic) => match diagnostic.code.as_str() {
+                "working_directory_not_found" => Reason::WorkingDirectoryNotFound,
+                "working_directory_not_active" => Reason::WorkingDirectoryNotActive,
+                "working_directory_record_invalid" => Reason::WorkingDirectoryRecordInvalid,
+                "working_directory_repository_access_unavailable" => {
+                    Reason::WorkingDirectoryAccessUnavailable
+                }
+                _ => Reason::SessionOpenFailed,
+            },
+            RuntimeError::RuntimeStopped => Reason::RuntimeStopped,
+            RuntimeError::StatePoisoned => Reason::RuntimeStateUnavailable,
+            RuntimeError::ExecutionBackendUnavailable { .. } => Reason::RuntimeBackendUnavailable,
+            RuntimeError::WorkspaceOwnerMismatch { .. } => Reason::RuntimeOwnerMismatch,
+            RuntimeError::InvalidRequest(_) => Reason::RuntimeInvalidRequest,
+            _ => Reason::SessionOpenFailed,
+        };
+        let mut response = match error {
             RuntimeError::WorkingDirectory(diagnostic)
                 if diagnostic.code == "working_directory_not_found" =>
             {
@@ -2199,7 +2219,9 @@ impl RuntimeHttpWorkdirError {
                 WorkdirTransportErrorCode::Unavailable,
                 "Workdir session is unavailable",
             ),
-        }
+        };
+        response.payload.failure_reason = Some(reason);
+        response
     }
 }
 
@@ -2214,6 +2236,17 @@ impl From<workdir::WorkdirError> for RuntimeHttpWorkdirError {
 
 impl IntoResponse for RuntimeHttpWorkdirError {
     fn into_response(self) -> Response {
+        if let Some(reason) = self.payload.failure_reason {
+            tracing::warn!(
+                target: "worker_runtime::workdir",
+                event = "workdir_provider_failure",
+                status = self.status.as_u16(),
+                code = self.payload.code.as_str(),
+                failure_reason = reason.as_str(),
+                failure_stage = reason.stage().as_str(),
+                "Workdir provider operation failed"
+            );
+        }
         (self.status, Json(self.payload)).into_response()
     }
 }
@@ -2423,6 +2456,7 @@ pub enum RuntimeHttpServerError {
 #[cfg(test)]
 mod tests {
     mod command_transport_tests;
+    mod runtime_workdir_failure_tests;
     #[cfg(feature = "fs-store")]
     mod session_material_tests;
 
@@ -3195,9 +3229,13 @@ mod tests {
             .await
             .expect_err("close must be terminal");
         assert!(matches!(
-            closed_error,
+            closed_error.classification_source(),
             workdir::WorkdirError::Unavailable(_)
         ));
+        assert_eq!(
+            closed_error.failure_reason(),
+            Some(workdir::WorkdirFailureReason::SessionClosed)
+        );
         assert!(
             state
                 .workdir_sessions

crates/worker-runtime/src/http_server/runtime_management_api.rs

@@ -444,6 +444,31 @@ impl runtime_api::RuntimeApi for RuntimeManagementApi {
         material_pin(&self.state, request, true)
     }
 
+    async fn session_recording_capture(
+        &self,
+        request: runtime_api::SessionRecordingCaptureRequest,
+    ) -> Result<runtime_api::SessionRecordingCaptureAvailability, runtime_api::RuntimeApiError>
+    {
+        let scope = material_scope(&self.state, &request.workspace_id)?;
+        #[cfg(feature = "fs-store")]
+        {
+            Ok(self
+                .state
+                .runtime
+                .session_recording_capture_scoped(&scope, &request))
+        }
+        #[cfg(not(feature = "fs-store"))]
+        {
+            let _ = scope;
+            Ok(
+                runtime_api::SessionRecordingCaptureAvailability::Unavailable {
+                    reason: runtime_api::SessionPublicUnavailableReason::StorageUnavailable,
+                    message: "Committed Session storage unavailable".into(),
+                },
+            )
+        }
+    }
+
     async fn session_material_catalog(
         &self,
         request: runtime_api::SessionMaterialCatalogRequest,

crates/worker-runtime/src/http_server/tests/command_transport_tests.rs

@@ -3,6 +3,7 @@
 //! pre-seeded session is a fixture; no Runtime Worker/materializer is claimed here.
 
 use super::*;
+use std::collections::BTreeMap;
 use std::time::Duration;
 use workdir::http::{
     RemoteWorkdirSession, WorkdirHttpAuthorization, WorkdirHttpAuthorizationFuture,
@@ -70,14 +71,23 @@ impl Harness {
     }
 
     async fn new() -> Self {
-        let root = tempfile::tempdir().unwrap();
-        let session: WorkdirSessionHandle = Arc::new(LocalWorkdirSession::materialized_bound(
-            Workdir::new("wd-transport"),
-            root.path().to_path_buf(),
-            root.path().to_path_buf(),
-            SharedScope::new(Scope::writable(root.path()).unwrap()),
-            WorkdirSessionCapabilities::ALL,
-        ));
+        Self::with_environment(tempfile::tempdir().unwrap(), BTreeMap::new()).await
+    }
+
+    async fn with_environment(
+        root: tempfile::TempDir,
+        command_environment: BTreeMap<String, String>,
+    ) -> Self {
+        let session: WorkdirSessionHandle =
+            Arc::new(LocalWorkdirSession::materialized_bound_with_environment(
+                Workdir::new("wd-transport"),
+                root.path().to_path_buf(),
+                root.path().to_path_buf(),
+                SharedScope::new(Scope::writable(root.path()).unwrap()),
+                WorkdirSessionCapabilities::ALL,
+                command_environment,
+                Vec::new(),
+            ));
         let identity = RuntimeIdentityMaterial::generate("transport-key").unwrap();
         let trust = workspace_trust(&identity);
         let state = RuntimeHttpState {
@@ -101,6 +111,9 @@ impl Harness {
                         session_id: WorkdirSessionId::new("session-transport").unwrap(),
                         workdir_id: Workdir::new("wd-transport").id().clone(),
                         capabilities: WorkdirSessionCapabilities::ALL,
+                        environment: workdir::WorkdirSessionEnvironment::root(
+                            WorkdirSessionCapabilities::ALL,
+                        ),
                     })
                 }),
             )
@@ -156,6 +169,336 @@ impl Harness {
     }
 }
 
+#[tokio::test]
+async fn real_http_waiting_command_survives_long_poll_expiry() {
+    tokio::time::timeout(Duration::from_secs(45), async {
+        let harness = Harness::new().await;
+        let handle = harness
+            .remote
+            .start_command(CommandRequest {
+                transport_byte_budget: 1024,
+                command: "printf ready; while [ ! -e release ]; do sleep 0.05; done; printf after; printf err >&2; exit 7".into(),
+                timeout_secs: 40,
+                cwd: WorkdirPath::root(),
+                tool_call_id: None,
+            })
+            .await
+            .unwrap();
+        let mut request = CommandOutputRequest {
+            handle,
+            cursor: 0,
+            limit: 1024,
+            wait: true,
+        };
+        let ready = harness.remote.command_output(request.clone()).await.unwrap();
+        assert_eq!(ready.chunks.iter().flat_map(|c| c.bytes.iter().copied()).collect::<Vec<_>>(), b"ready");
+        assert!(ready.terminal.is_none());
+        request.cursor = ready.next_cursor;
+
+        // Keep the command silent until the production HTTP handler has expired
+        // its 20-second long poll. The client must keep waiting, not fail or
+        // expose an empty page as completed output.
+        let waiting = harness.remote.command_output(request.clone());
+        tokio::pin!(waiting);
+        tokio::select! {
+            result = &mut waiting => panic!("waiting read ended before release: {result:?}"),
+            _ = tokio::time::sleep(Duration::from_secs(21)) => {}
+        }
+        std::fs::write(harness._root.path().join("release"), b"").unwrap();
+        let mut page = waiting.await.unwrap();
+        let mut stdout = Vec::new();
+        let mut stderr = Vec::new();
+        let terminal = loop {
+            // The retry cursor still replays the exact nonempty/terminal page.
+            assert_eq!(harness.remote.command_output(request.clone()).await.unwrap(), page);
+            for chunk in &page.chunks {
+                assert_eq!(chunk.sequence, request.cursor);
+                request.cursor += chunk.bytes.len() as u64;
+                match chunk.stream {
+                    CommandStream::Stdout => stdout.extend_from_slice(&chunk.bytes),
+                    CommandStream::Stderr => stderr.extend_from_slice(&chunk.bytes),
+                }
+            }
+            assert_eq!(page.next_cursor, request.cursor);
+            if let Some(terminal) = page.terminal {
+                break terminal;
+            }
+            page = harness.remote.command_output(request.clone()).await.unwrap();
+        };
+        assert_eq!(stdout, b"after");
+        assert_eq!(stderr, b"err");
+        assert_eq!(terminal.status, workdir::CommandStatus::Failed);
+        assert_eq!(terminal.exit_code, Some(7));
+        harness.remote.close().await.unwrap();
+    })
+    .await
+    .expect("bounded long-poll continuation over HTTP");
+}
+
+#[tokio::test]
+async fn real_http_spawn_failure_preserves_safe_cause_counts_and_terminal_replay() {
+    tokio::time::timeout(Duration::from_secs(10), async {
+        let root = tempfile::tempdir().unwrap();
+        let missing_path = root.path().join("private-spawn-path-must-not-exist");
+        assert!(!missing_path.exists());
+        let private_path = missing_path.to_str().unwrap().to_owned();
+        let environment_secret = "spawn-environment-secret-must-not-leak";
+        let command_secret = "spawn-command-secret-must-not-leak";
+        let tool_call_secret = "spawn-tool-call-secret-must-not-leak";
+        // This is an OS spawn failure in the production local provider, not a
+        // fabricated terminal: PATH contains no bash. The test process environment
+        // is untouched, so parallel command tests retain their normal PATH.
+        let harness = Harness::with_environment(
+            root,
+            BTreeMap::from([
+                ("PATH".into(), private_path.clone()),
+                ("PRIVATE_AUTH_TOKEN".into(), environment_secret.into()),
+            ]),
+        )
+        .await;
+        let command = format!("printf '{command_secret}'; printf ran > must-not-run");
+        let handle = harness
+            .remote
+            .start_command(CommandRequest {
+                transport_byte_budget: 1024,
+                command: command.clone(),
+                timeout_secs: 5,
+                cwd: WorkdirPath::root(),
+                tool_call_id: Some(tool_call_secret.into()),
+            })
+            .await
+            .unwrap();
+        let request = CommandOutputRequest {
+            handle,
+            cursor: 0,
+            limit: 16,
+            wait: true,
+        };
+        let page = harness.remote.command_output(request.clone()).await.unwrap();
+        assert!(page.chunks.is_empty());
+        assert_eq!(page.next_cursor, 0);
+        let terminal = page.terminal.as_ref().expect("spawn failure is terminal");
+        assert_eq!(terminal.status, workdir::CommandStatus::Failed);
+        assert_eq!(terminal.exit_code, None);
+        assert_eq!(
+            terminal.process_failure,
+            Some(workdir::CommandFailure {
+                stage: workdir::CommandFailureStage::Spawn,
+                reason: workdir::CommandIoErrorKind::NotFound,
+                os_code: Some(libc::ENOENT),
+            })
+        );
+        assert_eq!(
+            terminal.output_collection,
+            workdir::CommandOutputCollection::NotStarted
+        );
+        assert_eq!(terminal.stdout_bytes, 0);
+        assert_eq!(terminal.stderr_bytes, 0);
+        assert_eq!(terminal.stdout_delivered_bytes, 0);
+        assert_eq!(terminal.stderr_delivered_bytes, 0);
+        assert_eq!(terminal.truncation_reason, None);
+
+        // A zero-byte terminal page remains replayable at its unchanged cursor;
+        // neither a retry nor a smaller nonwaiting read changes its accounting.
+        assert_eq!(
+            harness.remote.command_output(request.clone()).await.unwrap(),
+            page
+        );
+        let replay_request = CommandOutputRequest {
+            wait: false,
+            limit: 1,
+            ..request
+        };
+        assert_eq!(
+            harness
+                .remote
+                .command_output(replay_request.clone())
+                .await
+                .unwrap(),
+            page
+        );
+        let response = harness
+            .raw_operation(
+                serde_json::to_value(WorkdirSessionOperation::CommandOutput(
+                    replay_request.clone(),
+                ))
+                .unwrap(),
+            )
+            .await;
+        assert_eq!(response.status(), reqwest::StatusCode::OK);
+        let body = response.text().await.unwrap();
+        for secret in [
+            private_path.as_str(),
+            harness._root.path().to_str().unwrap(),
+            "private-spawn-path-must-not-exist",
+            "PRIVATE_AUTH_TOKEN",
+            environment_secret,
+            command_secret,
+            command.as_str(),
+            tool_call_secret,
+        ] {
+            assert!(
+                !body.contains(secret),
+                "private input leaked into HTTP terminal"
+            );
+        }
+        let wire: serde_json::Value = serde_json::from_str(&body).unwrap();
+        assert_eq!(
+            wire,
+            serde_json::json!({
+                "operation": "command_output",
+                "result": {
+                    "chunks": [],
+                    "next_cursor": 0,
+                    "terminal": {
+                        "status": "failed",
+                        "exit_code": null,
+                        "process_failure": {"stage": "spawn", "reason": "not_found", "os_code": libc::ENOENT},
+                        "output_collection": {"state": "not_started"},
+                        "stdout_bytes": 0,
+                        "stderr_bytes": 0,
+                        "stdout_delivered_bytes": 0,
+                        "stderr_delivered_bytes": 0,
+                        "truncation_reason": null
+                    }
+                }
+            })
+        );
+        assert_eq!(
+            harness.remote.command_output(replay_request).await.unwrap(),
+            page
+        );
+        // Exercise the same real spawn failure through Bash, not a terminal
+        // fixture. Opening another remote client reuses the pre-seeded provider
+        // session and still passes through the signed HTTP middleware.
+        let bash_remote: WorkdirSessionHandle = Arc::new(
+            RemoteWorkdirSession::open_with_authorization(
+                harness.client.clone(),
+                harness.operation_url.join("/").unwrap(),
+                harness.authorization.clone(),
+                Workdir::new("wd-transport").id().clone(),
+                OpenWorkdirSessionRequest::default(),
+            )
+            .await
+            .unwrap(),
+        );
+        let view = tools::bash_output::BashOutputView::new();
+        let (_, bash) = tools::bash_tool(bash_remote, view.clone())();
+        let input = serde_json::json!({
+            "command": command,
+            "cwd": ".",
+            "timeout": 5
+        })
+        .to_string();
+        let output = bash
+            .execute(
+                &input,
+                agen::tool::ToolExecutionContext::new(tool_call_secret, "http-spawn-attempt", 0),
+            )
+            .await
+            .expect("Bash returns a structured failed-command result");
+        let content = output.content.as_deref().expect("Bash ToolOutput body");
+        let tool_body: serde_json::Value = serde_json::from_str(content).unwrap();
+        assert_eq!(tool_body["stdout_preview"], "");
+        assert_eq!(tool_body["stderr_preview"], "");
+        assert_eq!(tool_body["preview_omitted"], false);
+        assert_eq!(
+            tool_body["output"]["terminal"],
+            serde_json::json!({
+                "status": "failed",
+                "exit_code": null,
+                "process_failure": {"stage": "spawn", "reason": "not_found", "os_code": libc::ENOENT},
+                "output_collection": {"state": "not_started"},
+                "transport_complete": false
+            })
+        );
+        let output_id = tool_body["output"]["id"].as_str().unwrap();
+        let retained = view.metadata(output_id).expect("retained spawn failure");
+        assert_eq!(retained.terminal.status, Some(workdir::CommandStatus::Failed));
+        assert_eq!(retained.terminal.exit_code, None);
+        assert_eq!(retained.terminal.process_failure, terminal.process_failure);
+        assert_eq!(
+            retained.terminal.output_collection,
+            Some(workdir::CommandOutputCollection::NotStarted)
+        );
+        assert!(!retained.terminal.transport_complete);
+        assert_eq!(retained.stdout_saved, 0);
+        assert_eq!(retained.stderr_saved, 0);
+        assert_eq!(retained.stdout_seen, 0);
+        assert_eq!(retained.stderr_seen, 0);
+        assert_eq!(retained.stdout_delivered, 0);
+        assert_eq!(retained.stderr_delivered, 0);
+        assert!(!retained.storage_truncated);
+        assert!(retained.retention_limit.is_none());
+        assert_eq!(retained.transport_truncation, None);
+        let retained_wire = serde_json::to_value(&retained).unwrap();
+        assert_eq!(retained_wire, tool_body["output"]);
+        for stream in [CommandStream::Stdout, CommandStream::Stderr] {
+            assert_eq!(view.read(output_id, stream, 0, 1), Some(Vec::new()));
+        }
+        for secret in [
+            private_path.as_str(),
+            harness._root.path().to_str().unwrap(),
+            "private-spawn-path-must-not-exist",
+            "PRIVATE_AUTH_TOKEN",
+            environment_secret,
+            command_secret,
+            command.as_str(),
+            tool_call_secret,
+        ] {
+            assert!(
+                !content.contains(secret),
+                "private input leaked into Bash ToolOutput body"
+            );
+        }
+        assert!(!harness._root.path().join("must-not-run").exists());
+        harness.remote.close().await.unwrap();
+        assert!(harness.session.command_snapshot().is_empty());
+        assert_eq!(
+            serde_json::to_value(view.metadata(output_id).unwrap()).unwrap(),
+            retained_wire
+        );
+    })
+    .await
+    .expect("bounded real spawn failure over signed HTTP");
+}
+
+#[tokio::test]
+async fn real_http_closed_session_retains_failure_reason() {
+    let harness = Harness::new().await;
+    let handle = harness
+        .remote
+        .start_command(CommandRequest {
+            transport_byte_budget: 1024,
+            command: "printf done".into(),
+            timeout_secs: 5,
+            cwd: WorkdirPath::root(),
+            tool_call_id: None,
+        })
+        .await
+        .unwrap();
+    // Keep the HTTP session identity registered, but close the underlying provider.
+    harness.session.close().await.unwrap();
+    let error = harness
+        .remote
+        .command_output(CommandOutputRequest {
+            handle,
+            cursor: 0,
+            limit: 16,
+            wait: true,
+        })
+        .await
+        .unwrap_err();
+    assert_eq!(
+        error.failure_reason(),
+        Some(workdir::WorkdirFailureReason::SessionClosed)
+    );
+    assert!(matches!(
+        error.classification_source(),
+        workdir::WorkdirError::Unavailable(_)
+    ));
+}
+
 #[tokio::test]
 async fn real_http_command_pages_preserve_binary_streams_replay_and_nonzero_exit() {
     tokio::time::timeout(Duration::from_secs(20), async {
@@ -189,6 +532,11 @@ async fn real_http_command_pages_preserve_binary_streams_replay_and_nonzero_exit
         assert_eq!(stderr, b"stderr\xe6\x97\xa5");
         assert_eq!(terminal.status, workdir::CommandStatus::Failed);
         assert_eq!(terminal.exit_code, Some(9));
+        assert_eq!(terminal.process_failure, None);
+        assert_eq!(
+            terminal.output_collection,
+            workdir::CommandOutputCollection::Complete
+        );
         assert!(harness.remote.command_output(CommandOutputRequest { handle, cursor: 0, limit: 1, wait: false }).await.is_err());
         harness.remote.close().await.unwrap();
         assert!(harness.session.command_snapshot().is_empty());
@@ -333,6 +681,11 @@ async fn real_http_command_budget_bounds_unique_payload_and_reports_larger_seen_
             );
             assert_eq!(terminal.status, workdir::CommandStatus::Failed);
             assert_eq!(terminal.exit_code, Some(9));
+            assert_eq!(terminal.process_failure, None);
+            assert_eq!(
+                terminal.output_collection,
+                workdir::CommandOutputCollection::Complete
+            );
             assert!(
                 harness
                     .remote

crates/worker-runtime/src/http_server/tests/runtime_workdir_failure_tests.rs

@@ -0,0 +1,528 @@
+//! Session-open integration through the production signed router, Runtime owner/binding
+//! checks, HTTP DTO and tracing boundary. Only the execution backend is replaced
+//! for deterministic lookup/open faults and inert owner-binding Worker fixtures;
+//! no handler, middleware or grant is replaced. Runs in the normal http-server lib
+//! suite with isolated loopback sockets.
+
+use super::*;
+use crate::working_directory::WorkingDirectoryDiagnostic;
+use std::io::{self, Write};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::Duration;
+
+const OPEN_PATH: &str = "/v1/working-directories/private-workdir-marker/sessions";
+const PRIVATE_DIAGNOSTIC: &str = concat!(
+    "raw-runtime-error-marker /private/host-path-marker ",
+    "command=private-command-marker contents=private-file-marker ",
+    "proof=private-proof-marker Authorization: Bearer private-header-marker ",
+    "working_directory_not_found authorization_stale runtime_stopped",
+);
+const PRIVATE_MARKERS: &[&str] = &[
+    "raw-runtime-error-marker",
+    "/private/host-path-marker",
+    "private-command-marker",
+    "private-file-marker",
+    "private-proof-marker",
+    "private-header-marker",
+    "private-workdir-marker",
+    "private-owner-marker",
+];
+
+#[derive(Clone, Default)]
+struct LogCapture(Arc<Mutex<Vec<u8>>>);
+
+impl Write for LogCapture {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        self.0.lock().unwrap().extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+impl LogCapture {
+    fn subscriber(&self) -> impl tracing::Subscriber + Send + Sync + 'static {
+        let writer = self.clone();
+        tracing_subscriber::fmt()
+            .with_ansi(false)
+            .without_time()
+            .with_max_level(tracing::Level::WARN)
+            .with_writer(move || writer.clone())
+            .finish()
+    }
+
+    fn take(&self) -> String {
+        String::from_utf8(std::mem::take(&mut *self.0.lock().unwrap())).unwrap()
+    }
+}
+
+fn assert_private_absent(text: &str) {
+    for marker in PRIVATE_MARKERS {
+        assert!(
+            !text.contains(marker),
+            "private input escaped error boundary"
+        );
+    }
+}
+
+fn assert_failure_log(log: &str, status: StatusCode, code: &str, reason: &str, stage: &str) {
+    let events: Vec<_> = log
+        .lines()
+        .filter(|line| line.contains("workdir_provider_failure"))
+        .collect();
+    assert_eq!(events.len(), 1, "one diagnostic per failed request: {log}");
+    let event = events[0];
+    for field in [
+        "WARN".to_string(),
+        "worker_runtime::workdir".to_string(),
+        format!("status={}", status.as_u16()),
+        format!("code=\"{code}\""),
+        format!("failure_reason=\"{reason}\""),
+        format!("failure_stage=\"{stage}\""),
+    ] {
+        assert!(event.contains(&field), "missing {field}: {event}");
+    }
+    assert_private_absent(log);
+}
+
+fn assert_failure_body(body: &str, code: &str, message: &str, reason: &str) {
+    assert_private_absent(body);
+    // Exact safe transport vocabulary; raw diagnostics and stage are not wire fields.
+    assert_eq!(
+        serde_json::from_str::<serde_json::Value>(body).unwrap(),
+        serde_json::json!({"code": code, "message": message, "failure_reason": reason}),
+    );
+}
+
+struct Harness {
+    server: tokio::task::JoinHandle<()>,
+    client: reqwest::Client,
+    base: String,
+    identity: RuntimeIdentityMaterial,
+    trust: WorkspaceIssuerTrustRecord,
+}
+
+impl Drop for Harness {
+    fn drop(&mut self) {
+        self.server.abort();
+    }
+}
+
+impl Harness {
+    async fn new(runtime: Runtime) -> Self {
+        let identity = RuntimeIdentityMaterial::generate("runtime-failure-test-key").unwrap();
+        let trust = workspace_trust(&identity);
+        let app = runtime_http_router_with_workspace_auth(
+            runtime,
+            None,
+            workspace_test_auth(vec![trust.clone()]),
+        );
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let base = format!("http://{}", listener.local_addr().unwrap());
+        let server = tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+        Self {
+            server,
+            client: reqwest::Client::builder()
+                .no_proxy()
+                .timeout(Duration::from_secs(5))
+                .build()
+                .unwrap(),
+            base,
+            identity,
+            trust,
+        }
+    }
+
+    async fn send(
+        &self,
+        claims: &WorkspaceCapabilityClaims,
+        body: Vec<u8>,
+        workspace: &str,
+    ) -> (StatusCode, String, String) {
+        let token = issue_workspace_capability_token(&self.identity.signing_key().unwrap(), claims)
+            .unwrap();
+        let response = self
+            .client
+            .post(format!("{}{OPEN_PATH}", self.base))
+            .bearer_auth(&token)
+            .header(header::CONTENT_TYPE, "application/json")
+            .header(RUNTIME_WORKSPACE_SCOPE_HEADER, workspace)
+            .header("x-private-test-header", "private-header-marker")
+            .body(body)
+            .send()
+            .await
+            .unwrap();
+        let status = StatusCode::from_u16(response.status().as_u16()).unwrap();
+        let headers = format!("{:?}", response.headers());
+        let body = response.text().await.unwrap();
+        assert_private_absent(&headers);
+        for output in [&body, &headers] {
+            assert!(!output.contains(&token), "signed bearer token leaked");
+            assert!(
+                !output.contains(&self.identity.private_key),
+                "signing key leaked"
+            );
+        }
+        (status, body, token)
+    }
+
+    async fn open(&self) -> (StatusCode, String, String) {
+        let body = serde_json::to_vec(&OpenWorkdirSessionRequest::default()).unwrap();
+        let claims = signed_claims(&self.trust, "POST", OPEN_PATH, &body);
+        self.send(&claims, body, "workspace-a").await
+    }
+}
+
+#[derive(Clone, Copy)]
+enum FailureAt {
+    Lookup,
+    Open,
+}
+
+struct FailingBackend {
+    at: FailureAt,
+    code: &'static str,
+    lookups: AtomicUsize,
+    opens: AtomicUsize,
+}
+
+impl FailingBackend {
+    fn runtime(at: FailureAt, code: &'static str) -> (Runtime, Arc<Self>) {
+        let backend = Arc::new(Self {
+            at,
+            code,
+            lookups: AtomicUsize::new(0),
+            opens: AtomicUsize::new(0),
+        });
+        let runtime =
+            Runtime::with_execution_backend(RuntimeOptions::default(), backend.clone()).unwrap();
+        (runtime, backend)
+    }
+
+    fn failure(&self) -> WorkingDirectoryDiagnostic {
+        WorkingDirectoryDiagnostic::rejected(self.code, PRIVATE_DIAGNOSTIC)
+    }
+}
+
+impl WorkerExecutionBackend for FailingBackend {
+    fn backend_id(&self) -> &str {
+        "runtime-failure-test"
+    }
+
+    fn spawn_worker(&self, request: WorkerExecutionSpawnRequest) -> WorkerExecutionSpawnResult {
+        AcceptingBackend.spawn_worker(request)
+    }
+
+    fn dispatch_input(&self, worker: &WorkerRef, input: WorkerInput) -> WorkerExecutionResult {
+        AcceptingBackend.dispatch_input(worker, input)
+    }
+
+    fn stop_worker(&self, worker: &WorkerRef) -> WorkerExecutionResult {
+        AcceptingBackend.stop_worker(worker)
+    }
+
+    fn working_directory(
+        &self,
+        id: &str,
+    ) -> Result<WorkingDirectoryStatus, WorkingDirectoryDiagnostic> {
+        self.lookups.fetch_add(1, Ordering::SeqCst);
+        match self.at {
+            FailureAt::Lookup => Err(self.failure()),
+            FailureAt::Open => Ok(WorkingDirectoryStatus {
+                summary: crate::catalog::WorkingDirectorySummary {
+                    working_directory_id: id.into(),
+                    display_name: None,
+                    repository_id: "repository-test".into(),
+                    creation_selector: None,
+                    creation_ref: None,
+                    creation_tree: None,
+                    current_selector: None,
+                    current_ref: None,
+                    current_tree: None,
+                    observed_at_epoch_seconds: None,
+                    materializer_kind: crate::catalog::MaterializerKind::RuntimeGitClone,
+                    cleanup_target: None,
+                    status: crate::catalog::WorkingDirectoryStatusKind::Active,
+                    cleanliness: None,
+                    occupied_by: None,
+                },
+            }),
+        }
+    }
+
+    fn open_workdir_session(
+        &self,
+        _: &str,
+    ) -> Result<WorkdirSessionHandle, WorkingDirectoryDiagnostic> {
+        self.opens.fetch_add(1, Ordering::SeqCst);
+        Err(self.failure())
+    }
+}
+
+// Current-thread execution keeps the server tasks inside the thread-local tracing
+// capture across awaits, without replacing the process-global subscriber.
+#[tokio::test(flavor = "current_thread")]
+async fn signed_http_session_open_preserves_runtime_availability_and_owner_failures() {
+    let capture = LogCapture::default();
+    let _guard = tracing::subscriber::set_default(capture.subscriber());
+    tracing::callsite::rebuild_interest_cache();
+    tokio::time::timeout(Duration::from_secs(15), async {
+        let stopped = Runtime::new_memory();
+        stopped.stop_runtime().unwrap();
+        let (owned, backend) = FailingBackend::runtime(FailureAt::Lookup, "must_not_reach_backend");
+        let mut request = task_request("bind owner");
+        request.config_bundle = None;
+        request.memory_settings.as_mut().unwrap().workspace_id = "workspace-a".into();
+        owned
+            .create_worker_scoped(
+                &RuntimeWorkspaceScope::new("workspace-a", "private-owner-marker"),
+                request,
+            )
+            .unwrap();
+        for (runtime, status, code, message, reason) in [
+            (
+                stopped,
+                StatusCode::SERVICE_UNAVAILABLE,
+                "unavailable",
+                "Workdir session is unavailable",
+                "runtime_stopped",
+            ),
+            (
+                Runtime::new_memory(),
+                StatusCode::SERVICE_UNAVAILABLE,
+                "unavailable",
+                "Workdir session is unavailable",
+                "runtime_backend_unavailable",
+            ),
+            (
+                owned,
+                StatusCode::NOT_FOUND,
+                "not_found",
+                "Workdir session was not found",
+                "runtime_owner_mismatch",
+            ),
+        ] {
+            let harness = Harness::new(runtime).await;
+            capture.take();
+            let (actual, body, token) = harness.open().await;
+            assert_eq!(actual, status);
+            assert_failure_body(&body, code, message, reason);
+            let log = capture.take();
+            assert_failure_log(&log, status, code, reason, "runtime");
+            assert!(!log.contains(&token));
+            assert!(!log.contains(&harness.identity.private_key));
+        }
+        assert_eq!(backend.lookups.load(Ordering::SeqCst), 0);
+        assert_eq!(backend.opens.load(Ordering::SeqCst), 0);
+    })
+    .await
+    .expect("bounded Runtime failure HTTP requests");
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn signed_http_session_open_allowlists_diagnostic_codes_without_guessing_unknown_causes() {
+    let capture = LogCapture::default();
+    let _guard = tracing::subscriber::set_default(capture.subscriber());
+    tracing::callsite::rebuild_interest_cache();
+    tokio::time::timeout(Duration::from_secs(20), async {
+        for (diagnostic, reason) in [
+            ("working_directory_not_found", "working_directory_not_found"),
+            (
+                "working_directory_not_active",
+                "working_directory_not_active",
+            ),
+            (
+                "working_directory_record_invalid",
+                "working_directory_record_invalid",
+            ),
+            (
+                "working_directory_repository_access_unavailable",
+                "working_directory_access_unavailable",
+            ),
+            // Plausible provider text/code is not evidence of a typed cause.
+            ("authorization_stale", "session_open_failed"),
+            (
+                "working_directory_not_found_private-proof-marker",
+                "session_open_failed",
+            ),
+        ] {
+            for at in [FailureAt::Lookup, FailureAt::Open] {
+                let (runtime, backend) = FailingBackend::runtime(at, diagnostic);
+                let harness = Harness::new(runtime).await;
+                capture.take();
+                let (status, body, token) = harness.open().await;
+                let (expected, code, message) = if diagnostic == "working_directory_not_found" {
+                    (
+                        StatusCode::NOT_FOUND,
+                        "not_found",
+                        "Workdir session was not found",
+                    )
+                } else {
+                    (
+                        StatusCode::SERVICE_UNAVAILABLE,
+                        "unavailable",
+                        "Workdir session is unavailable",
+                    )
+                };
+                assert_eq!(status, expected, "{diagnostic}");
+                assert_failure_body(&body, code, message, reason);
+                let log = capture.take();
+                assert_failure_log(&log, status, code, reason, "session_open");
+                assert!(!log.contains(&token));
+                assert!(!log.contains(&harness.identity.private_key));
+                assert_eq!(backend.lookups.load(Ordering::SeqCst), 1, "no hidden retry");
+                assert_eq!(
+                    backend.opens.load(Ordering::SeqCst),
+                    usize::from(matches!(at, FailureAt::Open)),
+                );
+            }
+        }
+    })
+    .await
+    .expect("bounded diagnostic fault matrix");
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn signed_http_session_open_rejects_bad_capability_scope_and_owner_binding_before_backend() {
+    let capture = LogCapture::default();
+    let _guard = tracing::subscriber::set_default(capture.subscriber());
+    tracing::callsite::rebuild_interest_cache();
+    tokio::time::timeout(Duration::from_secs(15), async {
+        let (runtime, backend) =
+            FailingBackend::runtime(FailureAt::Open, "working_directory_record_invalid");
+        let mut request = task_request("foreign workspace binding");
+        request.config_bundle = None;
+        request.memory_settings.as_mut().unwrap().workspace_id = "other-workspace".into();
+        let foreign_worker = runtime
+            .create_worker_scoped(
+                &RuntimeWorkspaceScope::new("other-workspace", "https://backend.test"),
+                request,
+            )
+            .unwrap()
+            .worker_ref;
+        let harness = Harness::new(runtime).await;
+        for case in ["permission", "body", "workspace", "owner_binding"] {
+            let body = if case == "owner_binding" {
+                serde_json::to_vec(&OpenWorkdirSessionRequest {
+                    owner_worker_id: Some(foreign_worker.worker_id.to_string()),
+                })
+                .unwrap()
+            } else {
+                b"{}".to_vec()
+            };
+            let mut claims = signed_claims(&harness.trust, "POST", OPEN_PATH, &body);
+            if case == "permission" {
+                claims.operation = "workers:read".into();
+            }
+            if case == "workspace" {
+                claims.issuer_workspace_id = "other-workspace".into();
+            }
+            let sent = if case == "body" {
+                b"{ }".to_vec()
+            } else {
+                body
+            };
+            capture.take();
+            let (status, body, token) = harness.send(&claims, sent, "workspace-a").await;
+            assert_eq!(
+                status,
+                if case == "owner_binding" {
+                    StatusCode::NOT_FOUND
+                } else {
+                    StatusCode::UNAUTHORIZED
+                },
+                "{case}",
+            );
+            assert_private_absent(&body);
+            let log = capture.take();
+            assert_private_absent(&log);
+            assert!(!log.contains(&token));
+            assert!(!log.contains(&harness.identity.private_key));
+            if case == "owner_binding" {
+                assert_failure_body(
+                    &body,
+                    "not_found",
+                    "Workdir session was not found",
+                    "working_directory_not_found",
+                );
+                assert_failure_log(
+                    &log,
+                    status,
+                    "not_found",
+                    "working_directory_not_found",
+                    "session_open",
+                );
+            } else {
+                let wire: serde_json::Value = serde_json::from_str(&body).unwrap();
+                assert_eq!(wire["error"]["code"], "unauthorized");
+                assert!(
+                    !log.contains("workdir_provider_failure"),
+                    "auth rejection is not a provider fault",
+                );
+            }
+        }
+        assert_eq!(backend.lookups.load(Ordering::SeqCst), 0);
+        assert_eq!(backend.opens.load(Ordering::SeqCst), 0);
+    })
+    .await
+    .expect("bounded authorization rejection requests");
+}
+
+#[tokio::test(flavor = "current_thread")]
+async fn runtime_error_response_keeps_raw_details_private_and_unclassified_causes_generic() {
+    let capture = LogCapture::default();
+    let _guard = tracing::subscriber::set_default(capture.subscriber());
+    tracing::callsite::rebuild_interest_cache();
+    for (error, status, code, message, reason, stage) in [
+        (
+            RuntimeError::ExecutionBackendUnavailable {
+                message: PRIVATE_DIAGNOSTIC.into(),
+            },
+            StatusCode::SERVICE_UNAVAILABLE,
+            "unavailable",
+            "Workdir session is unavailable",
+            "runtime_backend_unavailable",
+            "runtime",
+        ),
+        (
+            RuntimeError::StatePoisoned,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "unavailable",
+            "Workdir session is unavailable",
+            "runtime_state_unavailable",
+            "runtime",
+        ),
+        (
+            RuntimeError::InvalidRequest(PRIVATE_DIAGNOSTIC.into()),
+            StatusCode::BAD_REQUEST,
+            "invalid_request",
+            "Workdir operation request is invalid",
+            "runtime_invalid_request",
+            "runtime",
+        ),
+        (
+            RuntimeError::StoreCorrupt {
+                operation: "session_open",
+                path: PathBuf::from("/private/host-path-marker"),
+                message: PRIVATE_DIAGNOSTIC.into(),
+            },
+            StatusCode::SERVICE_UNAVAILABLE,
+            "unavailable",
+            "Workdir session is unavailable",
+            "session_open_failed",
+            "session_open",
+        ),
+    ] {
+        capture.take();
+        let response = RuntimeHttpWorkdirError::runtime(error).into_response();
+        assert_eq!(response.status(), status);
+        let bytes = to_bytes(response.into_body(), 16384).await.unwrap();
+        let body = std::str::from_utf8(&bytes).unwrap();
+        assert_failure_body(body, code, message, reason);
+        assert_failure_log(&capture.take(), status, code, reason, stage);
+    }
+}

crates/worker-runtime/src/http_server/tests/session_material_tests.rs

@@ -150,6 +150,27 @@ impl Fixture {
             limit: 1,
         }
     }
+    fn recording_request(&self) -> runtime_api::SessionRecordingCaptureRequest {
+        runtime_api::SessionRecordingCaptureRequest {
+            workspace_id: self.scope.workspace_id.clone(),
+            source: self.source(),
+            expected_session_id: self.session.to_string(),
+            start: Default::default(),
+            max_entries: 1000,
+            max_serialized_bytes: 128 * 1024,
+        }
+    }
+    fn capture(&self, source: Source) -> session_store::capture::RecordingCaptureSlice {
+        let mut request = self.recording_request();
+        request.source = source;
+        match self
+            .runtime
+            .session_recording_capture_scoped(&self.scope, &request)
+        {
+            runtime_api::SessionRecordingCaptureAvailability::Captured { slice } => slice,
+            other => panic!("{other:?}"),
+        }
+    }
     fn catalog(&self) -> runtime_api::SessionMaterialCatalogPage {
         match self
             .runtime
@@ -226,6 +247,9 @@ fn pending_session_proof_is_not_missing_material_and_pin_release_allows_empty_ar
             .is_err(),
         "retention intent is not source availability"
     );
+    assert!(
+        matches!(f.runtime.session_recording_capture_scoped(&f.scope, &f.recording_request()), runtime_api::SessionRecordingCaptureAvailability::NotMaterialized { session_id } if session_id == f.session.to_string())
+    );
     // A missing committed source is never the same fact as a pending pointer.
     metadata
         .write(
@@ -479,6 +503,7 @@ fn source_scope_session_and_active_pointer_mismatches_never_return_material() {
 #[test]
 fn pinned_stopped_worker_archives_before_removal_and_job_reads_archived_source() {
     let f = Fixture::new();
+    let frozen = f.capture(f.source());
     let original: Vec<_> = f.reader(&f.source()).descriptors().cloned().collect();
     let pin = SessionRetentionPin(uuid::Uuid::now_v7());
     f.runtime
@@ -516,6 +541,7 @@ fn pinned_stopped_worker_archives_before_removal_and_job_reads_archived_source()
     let archived = Source::Archived {
         archive_id: "canonical-archive".into(),
     };
+    assert_eq!(f.capture(archived.clone()), frozen);
     let reader = f.reader(&archived);
     assert_eq!(reader.descriptors().cloned().collect::<Vec<_>>(), original);
     let body = reader.read_content(&original[0], 0, 16384).unwrap();
@@ -951,11 +977,52 @@ async fn signed_generated_client_reads_canonical_pages_and_pins_with_real_router
             .authorizer(SignedAuthorizer { identity, trust })
             .build()
             .unwrap();
+        let frozen = match client
+            .session_recording_capture(f.recording_request())
+            .await
+            .unwrap()
+        {
+            runtime_api::SessionRecordingCaptureAvailability::Captured { slice } => slice,
+            other => panic!("{other:?}"),
+        };
+        frozen.capture.validate(Default::default()).unwrap();
+        assert!(frozen.next.is_none());
+        assert!(
+            serde_json::to_vec(&frozen).unwrap().len()
+                <= f.recording_request().max_serialized_bytes
+        );
+        let snapshot = serde_json::to_vec(&frozen).unwrap();
+        assert!(!String::from_utf8_lossy(&snapshot).contains("private-system-prompt"));
+        f.store
+            .append(
+                f.session,
+                f.segment,
+                &LogEntry::AnnotatedAssistantItem {
+                    ts: 6,
+                    entry: message("late-answer", LoggedRole::Assistant, "not in frozen input"),
+                },
+            )
+            .unwrap();
+        assert_eq!(serde_json::to_vec(&frozen).unwrap(), snapshot);
         let page = match client.session_material_catalog(f.request()).await.unwrap() {
             Catalog::Page { page } => page,
             other => panic!("{other:?}"),
         };
         let descriptor = page.descriptors[0].clone();
+        assert_eq!(
+            frozen
+                .capture
+                .recording_text(0)
+                .unwrap()
+                .0
+                .identity
+                .entry_ref,
+            descriptor.entry_ref
+        );
+        assert_eq!(
+            frozen.capture.recording_text(0).unwrap().0.sha256,
+            descriptor.sha256
+        );
         let read = client
             .session_material_read(runtime_api::SessionMaterialReadRequest {
                 workspace_id: "workspace-a".into(),
@@ -1019,6 +1086,13 @@ async fn signed_generated_client_reads_canonical_pages_and_pins_with_real_router
             );
         }
         assert!(!f.root().exists());
+        assert!(matches!(
+            client
+                .session_recording_capture(f.recording_request())
+                .await
+                .unwrap(),
+            runtime_api::SessionRecordingCaptureAvailability::Unavailable { .. }
+        ));
         assert!(matches!(
             client.session_material_catalog(f.request()).await.unwrap(),
             Catalog::Unavailable { .. }
@@ -1050,41 +1124,54 @@ async fn canonical_http_rejects_replay_tampered_body_and_workspace_mismatch() {
         None,
         workspace_test_auth(vec![trust.clone()]),
     );
-    let path = "/v1/session-public/material/catalog";
-    let body = serde_json::to_vec(&f.request()).unwrap();
-    let claims = signed_claims(&trust, "POST", path, &body);
-    let first = signed_request(app.clone(), &identity, &claims, body.clone(), "workspace-a").await;
-    assert_eq!(first.status(), StatusCode::OK);
-    let replay = signed_request(app.clone(), &identity, &claims, body.clone(), "workspace-a").await;
-    assert_eq!(replay.status(), StatusCode::UNAUTHORIZED);
-    let claims = signed_claims(&trust, "POST", path, &body);
-    let changed = signed_request(
-        app.clone(),
-        &identity,
-        &claims,
-        b"{}".to_vec(),
-        "workspace-a",
-    )
-    .await;
-    assert_eq!(changed.status(), StatusCode::UNAUTHORIZED);
-    let mut wrong_scope = f.request();
-    wrong_scope.workspace_id = "other-workspace".into();
-    let wrong_body = serde_json::to_vec(&wrong_scope).unwrap();
-    let claims = signed_claims(&trust, "POST", path, &wrong_body);
-    let response = signed_request(app.clone(), &identity, &claims, wrong_body, "workspace-a").await;
-    assert_eq!(response.status(), StatusCode::FORBIDDEN);
-    let unsigned = app
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri(path)
-                .header(header::CONTENT_TYPE, "application/json")
-                .body(Body::from(body))
-                .unwrap(),
+    for (path, body) in [
+        (
+            "/v1/session-public/material/catalog",
+            serde_json::to_vec(&f.request()).unwrap(),
+        ),
+        (
+            "/v1/session-public/recording-capture",
+            serde_json::to_vec(&f.recording_request()).unwrap(),
+        ),
+    ] {
+        let claims = signed_claims(&trust, "POST", path, &body);
+        let first =
+            signed_request(app.clone(), &identity, &claims, body.clone(), "workspace-a").await;
+        assert_eq!(first.status(), StatusCode::OK);
+        let replay =
+            signed_request(app.clone(), &identity, &claims, body.clone(), "workspace-a").await;
+        assert_eq!(replay.status(), StatusCode::UNAUTHORIZED);
+        let claims = signed_claims(&trust, "POST", path, &body);
+        let changed = signed_request(
+            app.clone(),
+            &identity,
+            &claims,
+            b"{}".to_vec(),
+            "workspace-a",
         )
-        .await
-        .unwrap();
-    assert_eq!(unsigned.status(), StatusCode::UNAUTHORIZED);
+        .await;
+        assert_eq!(changed.status(), StatusCode::UNAUTHORIZED);
+        let mut wrong_scope: serde_json::Value = serde_json::from_slice(&body).unwrap();
+        wrong_scope["workspace_id"] = "other-workspace".into();
+        let wrong_body = serde_json::to_vec(&wrong_scope).unwrap();
+        let claims = signed_claims(&trust, "POST", path, &wrong_body);
+        let response =
+            signed_request(app.clone(), &identity, &claims, wrong_body, "workspace-a").await;
+        assert_eq!(response.status(), StatusCode::FORBIDDEN);
+        let unsigned = app
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri(path)
+                    .header(header::CONTENT_TYPE, "application/json")
+                    .body(Body::from(body))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(unsigned.status(), StatusCode::UNAUTHORIZED);
+    }
 }
 
 #[tokio::test]
@@ -1170,3 +1257,152 @@ async fn explicit_material_erasure_requires_delete_capability_and_matching_scope
     );
     assert!(f.root().exists());
 }
+
+#[test]
+fn recording_capture_rejects_scope_session_cursor_and_budget_without_returning_bodies() {
+    use runtime_api::SessionRecordingCaptureAvailability as Capture;
+    let f = Fixture::new();
+    let request = f.recording_request();
+    let frozen = f.capture(f.source());
+    assert_eq!(frozen.capture.entries.len(), 3);
+    let mut request = request;
+    for invalid in 0..5 {
+        let mut bad = request.clone();
+        match invalid {
+            0 => bad.workspace_id = "other".into(),
+            1 => bad.expected_session_id = session_store::new_session_id().to_string(),
+            2 => bad.start.canonical_order = 100,
+            3 => bad.max_entries = 0,
+            4 => bad.max_serialized_bytes = 4 * 1024 * 1024 + 1,
+            _ => unreachable!(),
+        }
+        assert!(matches!(
+            f.runtime.session_recording_capture_scoped(&f.scope, &bad),
+            Capture::Unavailable { .. }
+        ));
+    }
+    let text = frozen.capture.recording_text(1).unwrap().2;
+    request.start = session_store::capture::RecordingPosition {
+        canonical_order: 1,
+        byte_offset: text.find('🍎').unwrap() as u64 + 1,
+    };
+    assert!(matches!(
+        f.runtime
+            .session_recording_capture_scoped(&f.scope, &request),
+        Capture::Unavailable {
+            reason: Reason::InvalidCursor,
+            ..
+        }
+    ));
+    request.start = Default::default();
+    request.max_entries = 1;
+    let Capture::Captured { slice } = f
+        .runtime
+        .session_recording_capture_scoped(&f.scope, &request)
+    else {
+        panic!()
+    };
+    assert_eq!(slice.capture.entries.len(), 1);
+    assert_eq!(slice.next.unwrap().canonical_order, 1);
+}
+
+#[test]
+fn recording_capture_compaction_preserves_original_descriptors_and_excludes_summary_and_new_tail() {
+    let f = Fixture::new();
+    let old = f.capture(f.source());
+    let compact = session_store::new_segment_id();
+    let mut summary = message(
+        "summary",
+        LoggedRole::System,
+        "derived summary is not original",
+    );
+    summary.metadata.input_metadata = Some(
+        session_store::HistoryInputMetadata::new(
+            session_store::HistoryInputUsePolicy {
+                recording_material: session_store::InputEvidenceUse::Exclude,
+                memory_evidence: session_store::InputEvidenceUse::Exclude,
+                observation: session_store::InputObservationUse::Hidden,
+                compaction: session_store::InputCompactionUse::OpeningSummary,
+            },
+            None,
+            None,
+        )
+        .unwrap(),
+    );
+    summary.metadata.derivation = Some(session_store::LoggedHistoryDerivation {
+        sources: vec![
+            LoggedSessionHistoryEntryId("user-1".into()),
+            LoggedSessionHistoryEntryId("answer-1".into()),
+        ],
+    });
+    f.store
+        .create_segment(
+            f.session,
+            compact,
+            &[
+                LogEntry::AnnotatedSegmentStart {
+                    ts: 6,
+                    session_id: f.session,
+                    system_prompt: Some("private".into()),
+                    config: Default::default(),
+                    history: vec![summary],
+                    forked_from: None,
+                    compacted_from: Some(session_store::SegmentOrigin {
+                        segment_id: f.segment,
+                        at_turn_index: 0,
+                    }),
+                },
+                LogEntry::AnnotatedAssistantItem {
+                    ts: 7,
+                    entry: message(
+                        "new-answer",
+                        LoggedRole::Assistant,
+                        "new original after compaction",
+                    ),
+                },
+            ],
+        )
+        .unwrap();
+    WorkerAggregateStore::new(
+        f.root().parent().unwrap(),
+        format!("worker-runtime-{}", f.worker.worker_id),
+    )
+    .unwrap()
+    .set_active(
+        &format!("worker-runtime-{}", f.worker.worker_id),
+        Some(session_store::WorkerActiveSegmentRef::active_segment(
+            f.session, compact,
+        )),
+        None,
+    )
+    .unwrap();
+    let frozen = f.capture(f.source());
+    assert_eq!(frozen.capture.entries.len(), old.capture.entries.len() + 1);
+    for entry in &old.capture.entries {
+        assert_eq!(
+            frozen.capture.recording_text(entry.order).unwrap(),
+            old.capture.recording_text(entry.order).unwrap()
+        );
+    }
+    assert!(
+        !serde_json::to_string(&frozen)
+            .unwrap()
+            .contains("derived summary is not original")
+    );
+    let bytes = serde_json::to_vec(&frozen).unwrap();
+    f.store
+        .append(
+            f.session,
+            compact,
+            &LogEntry::AnnotatedAssistantItem {
+                ts: 8,
+                entry: message("tail", LoggedRole::Assistant, "next Job only"),
+            },
+        )
+        .unwrap();
+    assert_eq!(serde_json::to_vec(&frozen).unwrap(), bytes);
+    assert_eq!(
+        f.capture(f.source()).capture.entries.len(),
+        frozen.capture.entries.len() + 1
+    );
+}

crates/worker-runtime/src/retention/runtime_v5_tests.rs

@@ -682,8 +682,10 @@ fn runtime_v5_rejects_broken_or_future_source_without_rewriting_evidence() {
 #[cfg(unix)]
 #[test]
 fn current_runtime_session_migration_still_rejects_live_worker_sockets() {
-    let temp = tempfile::tempdir().unwrap();
-    let root = temp.path().join("runtime");
+    // Relative socket names keep this fixture independent of the checkout/TMPDIR
+    // length. The TempDir still owns the same tree; no process cwd is changed.
+    let temp = tempfile::tempdir_in(".").unwrap();
+    let root = Path::new(temp.path().file_name().unwrap()).join("runtime");
     let (worker, _, _) = runtime_fixture(&root, 12);
     let before = tree_bytes(&root);
     let runs = root.join("workers").join(worker.to_string()).join("runs");

crates/worker-runtime/src/runtime.rs

@@ -4949,6 +4949,133 @@ impl Runtime {
             .map_err(crate::retention::retention_error)
     }
 
+    /// Freeze committed original public bodies once; no catalog/read pagination
+    /// or restored Worker is involved. Publication and erasure share this fence.
+    #[cfg(feature = "fs-store")]
+    pub fn session_recording_capture_scoped(
+        &self,
+        scope: &RuntimeWorkspaceScope,
+        request: &runtime_api::SessionRecordingCaptureRequest,
+    ) -> runtime_api::SessionRecordingCaptureAvailability {
+        use crate::worker_backend::SessionMaterialSourceError as Error;
+        use runtime_api::{
+            SessionPublicUnavailableReason as R, SessionRecordingCaptureAvailability as A,
+        };
+        use session_store::public_material::{PublicMaterialError as E, PublicMaterialLimits};
+        let result = (|| -> Result<_, Error> {
+            if scope.workspace_id != request.workspace_id {
+                return Err("Session Workspace scope mismatch".into());
+            }
+            if !(1..=4096).contains(&request.max_entries)
+                || !(1024..=4 * 1024 * 1024).contains(&request.max_serialized_bytes)
+            {
+                return Err(E::ResourceLimit.into());
+            }
+            let session = request
+                .expected_session_id
+                .parse::<session_store::SessionId>()
+                .map_err(|_| "Invalid Session identity")?;
+            // Resolve attribution without reading archive bodies. Do not acquire
+            // the Runtime mutex under the Session lock: archive execution takes
+            // those locks in the opposite order.
+            let (root, archive) = self
+                .resolve_session_public_source_with_validation(scope, &request.source, false)
+                .map_err(|e| e.to_string())?;
+            let runtime_dir = {
+                let state = self.lock().map_err(|e| e.to_string())?;
+                state
+                    .fs_store()
+                    .ok_or("Session storage unavailable")?
+                    .runtime_dir()
+                    .to_path_buf()
+            };
+            // This is the storage append fence used by live Runtime publishers,
+            // also fencing archive transfer and erase. Resolve the pointer under it.
+            let retention = crate::retention::runtime_session_retention(&runtime_dir);
+            let guard = retention.lock_live(session).map_err(|error| match error {
+                session_store::StoreError::SessionErased(_) => E::Erased,
+                _ => E::Unavailable,
+            })?;
+            let mut archive_to_verify = None;
+            let active = match (&request.source, archive) {
+                (runtime_api::SessionPublicSource::Retained { worker_id }, None) => {
+                    let metadata = session_store::worker_metadata::WorkerAggregateStore::open_read_only(
+                        root.parent().ok_or("Session root is unavailable")?,
+                        crate::worker_backend::ProfileRuntimeWorkerFactory::runtime_worker_name_for_ref(&WorkerRef::new(*worker_id)),
+                    ).and_then(|store| store.read_read_only()).map_err(|e| e.to_string())?.ok_or("Session metadata missing")?;
+                    if metadata.workspace_id.as_deref() != Some(scope.workspace_id.as_str()) {
+                        return Err("Session Workspace mismatch".into());
+                    }
+                    let active = metadata.active.ok_or("Session active pointer missing")?;
+                    if active.session_id != session {
+                        return Err("Session identity mismatch".into());
+                    }
+                    match active.segment_id {
+                        Some(segment) => segment,
+                        None if request.start
+                            == session_store::capture::RecordingPosition::default()
+                            && crate::retention::unmaterialized_session(
+                                root.parent().ok_or("Session root unavailable")?,
+                                &scope.workspace_id,
+                            )
+                            .map_err(|e| e.to_string())?
+                                == Some(session) =>
+                        {
+                            return Ok(A::NotMaterialized {
+                                session_id: session.to_string(),
+                            });
+                        }
+                        None => return Err("Session active Segment missing".into()),
+                    }
+                }
+                (runtime_api::SessionPublicSource::Archived { archive_id }, Some(manifest)) => {
+                    archive_to_verify = Some((archive_id, manifest.clone()));
+                    if manifest.source_session_id != request.expected_session_id {
+                        return Err("Archive Session identity mismatch".into());
+                    }
+                    manifest
+                        .source_active_segment_id
+                        .ok_or("Archive active Segment missing")?
+                }
+                _ => return Err("Session source unavailable".into()),
+            };
+            let slice = session_store::capture::capture_recording_slice_worker_guarded(
+                &root,
+                session,
+                active,
+                PublicMaterialLimits::default(),
+                request.start,
+                request.max_entries,
+                request.max_serialized_bytes,
+                &guard,
+            )?;
+            if let Some((archive_id, manifest)) = archive_to_verify {
+                // Validate archive checksums only after capture froze every file
+                // end, still under the same publication/erase fence.
+                let (verified, verified_root) = FsWorkerRetentionProvider::new(&runtime_dir)
+                    .session_archive(archive_id)
+                    .map_err(|e| e.to_string())?;
+                if verified != manifest || verified_root != root {
+                    return Err(E::Changed.into());
+                }
+            }
+            Ok(A::Captured { slice })
+        })();
+        match result {
+            Ok(availability) => availability,
+            Err(error) => A::Unavailable {
+                reason: match error {
+                    Error::Material(E::ResourceLimit) => R::ResourceLimit,
+                    Error::Material(E::InvalidOffset | E::Changed) => R::InvalidCursor,
+                    Error::Material(E::Missing | E::Erased) => R::RetentionMissing,
+                    Error::Material(E::Inconsistent | E::Record(_)) => R::CorruptLog,
+                    _ => R::StorageUnavailable,
+                },
+                message: "Committed Session recording capture unavailable".into(),
+            },
+        }
+    }
+
     #[cfg(feature = "fs-store")]
     pub fn session_material_catalog_scoped(
         &self,

crates/worker-runtime/src/runtime/workdir_session.rs

@@ -55,6 +55,10 @@ impl WorkdirSession for RetainedWorkdirSession {
         self.inner.capabilities()
     }
 
+    fn environment(&self) -> workdir::WorkdirSessionEnvironment {
+        self.inner.environment()
+    }
+
     async fn authorize_scope_path(
         &self,
         request: WorkdirScopeAuthorizationRequest,

crates/worker-runtime/src/worker_backend.rs

@@ -146,9 +146,9 @@ use worker::feature::builtin::{
 use worker::ipc::protocol_session::{WorkerProtocolSessionStreams, live_log_entry_event};
 use worker::{
     PreparedWorker, PromptCatalogSource, SegmentLogSink, SubjektivSessionAttributionLifecycle,
-    Worker, WorkerBootstrap, WorkerBootstrapError, WorkerBootstrapLayout,
-    WorkerControllerTransport, WorkerError, WorkerFilesystemAuthority, WorkerHandle,
-    WorkerSharedState, WorkerWorkspaceContext, WorkspaceClient, WorkspaceId,
+    Worker, WorkerBootstrap, WorkerBootstrapError, WorkerBootstrapLayout, WorkerError,
+    WorkerFilesystemAuthority, WorkerHandle, WorkerSharedState, WorkerWorkspaceContext,
+    WorkspaceClient, WorkspaceId,
 };
 
 #[cfg(feature = "ws-server")]
@@ -508,7 +508,6 @@ pub struct ProfileRuntimeWorkerFactory {
     worker_mutation_identity: Option<RuntimeIdentityMaterial>,
     workspace_request_clients: Arc<HashMap<String, RuntimeWorkspaceRequestClient>>,
     embedded_worker_mutation_dispatcher: Option<Arc<dyn EmbeddedWorkerMutationDispatcher>>,
-    controller_transport: WorkerControllerTransport,
     failed_restore_sessions: Arc<
         Mutex<
             HashMap<
@@ -536,7 +535,6 @@ impl ProfileRuntimeWorkerFactory {
             worker_mutation_identity: None,
             workspace_request_clients: Arc::new(HashMap::new()),
             embedded_worker_mutation_dispatcher: None,
-            controller_transport: WorkerControllerTransport::InProcess,
             failed_restore_sessions: Arc::new(Mutex::new(HashMap::new())),
         }
     }
@@ -585,14 +583,6 @@ impl ProfileRuntimeWorkerFactory {
         self
     }
 
-    pub fn with_controller_transport(
-        mut self,
-        controller_transport: WorkerControllerTransport,
-    ) -> Self {
-        self.controller_transport = controller_transport;
-        self
-    }
-
     pub fn with_runtime_store_dir(mut self, runtime_store_dir: impl Into<PathBuf>) -> Self {
         self.worker_aggregate_root = Some(runtime_store_dir.into().join("workers"));
         self
@@ -740,7 +730,7 @@ impl ProfileRuntimeWorkerFactory {
             .map_err(|error| format!("failed to clean restore run artifacts: {error}"))
     }
 
-    fn runtime_worker_name_for_ref(worker_ref: &crate::identity::WorkerRef) -> String {
+    pub(crate) fn runtime_worker_name_for_ref(worker_ref: &crate::identity::WorkerRef) -> String {
         format!("worker-runtime-{}", worker_ref.worker_id)
     }
 
@@ -1137,8 +1127,17 @@ fn runtime_local_workdir_router(
             ),
             None => source,
         };
+        let cwd = binding
+            .cwd()
+            .strip_prefix(binding.root())
+            .map_err(|_| format!("Workdir attachment `{alias}` cwd is outside its logical root"))?;
+        let cwd = workdir::WorkdirPath::new(
+            cwd.to_str()
+                .ok_or_else(|| format!("Workdir attachment `{alias}` cwd is not UTF-8"))?,
+        )
+        .map_err(|error| error.to_string())?;
         router
-            .attach(alias.clone(), source)
+            .attach_at_cwd(alias.clone(), source, cwd)
             .map_err(|error| format!("bind Workdir attachment `{alias}`: {error}"))?;
     }
     Ok(router)
@@ -1598,13 +1597,13 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
                 .resolve_profile(selector, &worker_root, &worker_name)
                 .map_err(|err| format!("failed to resolve profile source archive: {err}"))?;
             if has_local_filesystem {
-                worker::entrypoint::resolve_runtime_profile_manifest_from_manifest(
+                worker::profile_manifest::resolve_runtime_profile_manifest_from_manifest(
                     manifest,
                     &worker_root,
                     &worker_name,
                 )?
             } else {
-                worker::entrypoint::resolve_runtime_profile_manifest_from_manifest_without_filesystem(
+                worker::profile_manifest::resolve_runtime_profile_manifest_from_manifest_without_filesystem(
                     manifest,
                     &worker_root,
                     &worker_name,
@@ -1651,7 +1650,6 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
             WorkerBootstrapLayout::RuntimeManagedRun {
                 run_dir: run_dir.clone(),
             },
-            self.controller_transport,
         );
         let bootstrap = match &self.spawn_model_client_factory {
             Some(factory) => bootstrap.with_model_client(factory()),
@@ -2004,7 +2002,6 @@ impl RuntimeWorkerFactory for ProfileRuntimeWorkerFactory {
             WorkerBootstrapLayout::RuntimeManagedRun {
                 run_dir: run_dir.clone(),
             },
-            self.controller_transport,
         )
         .start()
         .await
@@ -6515,8 +6512,7 @@ mod tests {
         let backend = WorkerRuntimeExecutionBackend::new(
             ProfileRuntimeWorkerFactory::new(root.path().join("missing-profiles"))
                 .with_runtime_store_dir(&store)
-                .with_runtime_id("runtime-subjektiv-test")
-                .with_controller_transport(WorkerControllerTransport::InProcess),
+                .with_runtime_id("runtime-subjektiv-test"),
         )
         .unwrap();
         backend.preflight_restore(&request).unwrap();
@@ -9132,17 +9128,6 @@ mod tests {
         assert!(error.contains("replacement Worker is required"), "{error}");
     }
 
-    #[test]
-    fn profile_runtime_factory_defaults_to_in_process_controller_transport() {
-        let root = tempfile::tempdir().unwrap();
-        let factory = ProfileRuntimeWorkerFactory::new(root.path());
-
-        assert!(matches!(
-            factory.controller_transport,
-            WorkerControllerTransport::InProcess
-        ));
-    }
-
     #[tokio::test]
     #[serial_test::serial(worker_allocation)]
     async fn in_process_restore_does_not_bind_unix_socket_under_overlong_store_path() {
@@ -9205,7 +9190,6 @@ mod tests {
 
         let controller = ProfileRuntimeWorkerFactory::new(root.path())
             .with_runtime_store_dir(&runtime_store_dir)
-            .with_controller_transport(WorkerControllerTransport::InProcess)
             .restore_controller(WorkerExecutionRestoreRequest {
                 operation_id: crate::execution::WorkerLifecycleOperationId::new(),
                 worker_ref: worker_ref.clone(),
@@ -9914,12 +9898,25 @@ mod tests {
                         })
                         .await;
                     session.close().await.unwrap();
-                    Ok(result.unwrap_err().to_string())
+                    Ok(result.unwrap_err())
                 })
                 .unwrap();
+            // The String-returning opener cannot safely classify its raw cause. The
+            // deferred boundary must preserve its typed stage without exposing that text.
+            assert_eq!(
+                error.failure_reason(),
+                Some(workdir::WorkdirFailureReason::SessionOpenFailed),
+                "{damage}: {error:?}"
+            );
             assert!(
-                error.contains("working_directory_cleanup_"),
-                "{damage}: {error}"
+                matches!(error.classification_source(), workdir::WorkdirError::Unavailable(message)
+                    if message == "Workdir session could not be opened"),
+                "{damage}: {error:?}"
+            );
+            assert_eq!(
+                error.denial_reason(),
+                None,
+                "{damage}: no guessed denial cause"
             );
             assert_eq!(
                 observed.lock().unwrap().len(),
@@ -9932,6 +9929,13 @@ mod tests {
                 "damaged checkout must be retained"
             );
             assert!(backend.stop_worker(&request.worker_ref).is_accepted());
+            println!(
+                "damage={damage}; reason={:?}; classification={:?}; cwd_bind_count={}; retained_files={}; retained_data_unchanged=true; stopped=true",
+                error.failure_reason(),
+                error.classification_source(),
+                observed.lock().unwrap().len(),
+                before.len(),
+            );
         }
     }
 
@@ -10555,6 +10559,60 @@ mod tests {
         assert!(!binding.working_directory_root().exists());
     }
 
+    #[cfg(target_os = "linux")]
+    #[tokio::test]
+    async fn local_attachment_router_keeps_each_binding_cwd_and_capability_ceiling() {
+        let runtime_base = tempfile::tempdir().unwrap();
+        let repo = create_clean_repo();
+        let materializer = RuntimeGitMaterializer::new(runtime_base.path());
+        let root_binding = materializer
+            .create(&working_directory_request(repo.path()))
+            .unwrap();
+        std::fs::create_dir(root_binding.root().join("nested")).unwrap();
+        std::fs::write(root_binding.root().join("marker"), "root").unwrap();
+        std::fs::write(root_binding.root().join("nested/marker"), "nested").unwrap();
+        let mut nested_binding = root_binding.clone();
+        nested_binding.cwd = root_binding.root().join("nested");
+        let root_alias = WorkdirAttachmentAlias::new("root").unwrap();
+        let nested_alias = WorkdirAttachmentAlias::new("nested").unwrap();
+        let attachments = BTreeMap::from([
+            (root_alias.clone(), root_binding),
+            (nested_alias.clone(), nested_binding),
+        ]);
+        let ceilings = BTreeMap::from([
+            (root_alias, WorkdirSessionCapabilities::ALL),
+            (nested_alias, WorkdirSessionCapabilities::READ_ONLY),
+        ]);
+        let router = runtime_local_workdir_router(&attachments, &ceilings, None).unwrap();
+        assert!(router.resolve(None).is_err());
+        for (alias, cwd, content, command) in [
+            ("root", "", "root", true),
+            ("nested", "nested", "nested", false),
+        ] {
+            let selected = router.resolve(Some(alias)).unwrap().session;
+            let environment = selected.environment();
+            assert_eq!(environment.cwd.as_str(), cwd);
+            assert_eq!(
+                environment
+                    .capabilities
+                    .supports(workdir::WorkdirSessionCapability::Command),
+                command
+            );
+            let read = selected
+                .read(workdir::ReadRequest {
+                    path: workdir::WorkdirPath::new("marker").unwrap(),
+                    offset: 0,
+                    limit: 10,
+                    max_bytes: 100,
+                })
+                .await
+                .unwrap();
+            assert_eq!(read.bytes, content.as_bytes());
+            assert_eq!(read.path.as_str(), "marker");
+        }
+        router.close_all().await.unwrap();
+    }
+
     #[test]
     fn spawn_failure_with_existing_working_directory_preserves_workdir() {
         let runtime_base = tempfile::tempdir().unwrap();

crates/worker-runtime/src/worker_backend/deferred_workdir.rs

@@ -66,13 +66,32 @@ impl DeferredWorkdirSession {
         let open = self.open.clone();
         let session = tokio::task::spawn_blocking(move || open())
             .await
-            .map_err(|_| WorkdirError::Unavailable("Workdir session opener failed".into()))?
-            .map_err(WorkdirError::Unavailable)?;
+            .map_err(|_| {
+                WorkdirError::Unavailable("Workdir session opener failed".into())
+                    .with_failure_reason(WorkdirFailureReason::SessionOpenTaskFailed)
+            })?
+            .map_err(|_| {
+                // The opener's string contract cannot prove a more specific cause.
+                WorkdirError::Unavailable("Workdir session could not be opened".into())
+                    .with_failure_reason(WorkdirFailureReason::SessionOpenFailed)
+            })?;
         if session.workdir().id() != self.workdir.id() {
-            session.close().await?;
-            return Err(WorkdirError::Unavailable(
-                "Workdir session identity mismatch".into(),
-            ));
+            if let Err(error) = session.close().await {
+                // Retain a failed-close owner for explicit close; never use it.
+                state.closed = true;
+                state.session = Some(session);
+                tracing::warn!(
+                    target: "worker_runtime::workdir",
+                    event = "workdir_session_identity_cleanup_failed",
+                    failure_reason = error.failure_reason().map(WorkdirFailureReason::as_str),
+                    denial_reason = error.denial_reason().map(WorkdirDenialReason::as_str),
+                    "Mismatched Workdir session cleanup failed"
+                );
+            }
+            return Err(
+                WorkdirError::Unavailable("Workdir session identity mismatch".into())
+                    .with_failure_reason(WorkdirFailureReason::SessionIdentityMismatch),
+            );
         }
         if let Some(mut source) = session.subscribe_command_events() {
             let events = self.events.clone();
@@ -105,6 +124,18 @@ macro_rules! impl_deferred_session {
                 self.capabilities
             }
 
+            fn environment(&self) -> WorkdirSessionEnvironment {
+                let mut environment = self.state.try_lock().ok().and_then(|state| {
+                    state.session.as_ref().map(|session| session.environment())
+                }).unwrap_or_else(|| {
+                    let mut environment = WorkdirSessionEnvironment::root(self.capabilities);
+                    environment.restrictions.push("Deferred provider: scope is checked on connection and every operation".into());
+                    environment
+                });
+                environment.capabilities = self.capabilities;
+                environment
+            }
+
             $(
                 async fn $method(&self, $request: $request_type) -> Result<$result, WorkdirError> {
                     self.session().await?.$method($request).await
@@ -224,10 +255,16 @@ mod tests {
             },
         );
         assert_eq!(attempts.load(Ordering::SeqCst), 0);
+        let failed = session.read(read_request()).await.unwrap_err();
         assert!(matches!(
-            session.read(read_request()).await,
-            Err(WorkdirError::Unavailable(_))
+            failed.classification_source(),
+            WorkdirError::Unavailable(_)
         ));
+        assert_eq!(
+            failed.failure_reason(),
+            Some(WorkdirFailureReason::SessionOpenFailed)
+        );
+        assert_eq!(attempts.load(Ordering::SeqCst), 1);
         assert_eq!(
             session.read(read_request()).await.unwrap().bytes,
             b"restored"
@@ -253,4 +290,126 @@ mod tests {
         );
         session.close().await.unwrap();
     }
+
+    #[tokio::test]
+    async fn opener_task_and_open_errors_keep_distinct_safe_causes() {
+        for panic in [false, true] {
+            let attempts = Arc::new(AtomicUsize::new(0));
+            let observed = attempts.clone();
+            let session = DeferredWorkdirSession::handle(
+                "saved",
+                WorkdirSessionCapabilities::READ_ONLY,
+                move || {
+                    observed.fetch_add(1, Ordering::SeqCst);
+                    if panic {
+                        panic!(
+                            "/host/private bearer-secret command-secret proof-secret key-secret"
+                        );
+                    }
+                    Err("/host/private bearer-secret command-secret proof-secret key-secret".into())
+                },
+            );
+            let error = session.read(read_request()).await.unwrap_err();
+            assert_eq!(attempts.load(Ordering::SeqCst), 1);
+            let reason = if panic {
+                WorkdirFailureReason::SessionOpenTaskFailed
+            } else {
+                WorkdirFailureReason::SessionOpenFailed
+            };
+            assert_eq!(error.failure_reason(), Some(reason));
+            assert_eq!(reason.stage().as_str(), "session_open");
+            let transport = workdir::http::WorkdirTransportError::from_workdir_error(&error);
+            assert_eq!(transport.code.http_status(), 503);
+            assert!(
+                !serde_json::to_string(&transport)
+                    .unwrap()
+                    .contains("secret")
+            );
+            assert!(!format!("{error:?}").contains("secret"));
+            session.close().await.unwrap();
+            assert_eq!(attempts.load(Ordering::SeqCst), 1);
+        }
+    }
+
+    #[derive(Debug)]
+    struct MismatchedSession {
+        workdir: Workdir,
+        closes: Arc<AtomicUsize>,
+        fail_close: bool,
+    }
+
+    macro_rules! mismatched_session {
+        ($( $method:ident($request:ident: $request_type:ty) -> $result:ty; )*) => {
+            #[async_trait]
+            impl WorkdirSession for MismatchedSession {
+                fn workdir(&self) -> &Workdir { &self.workdir }
+                fn capabilities(&self) -> WorkdirSessionCapabilities { WorkdirSessionCapabilities::READ_ONLY }
+                $(async fn $method(&self, _: $request_type) -> Result<$result, WorkdirError> {
+                    panic!("mismatched session must never be used");
+                })*
+                async fn close(&self) -> Result<(), WorkdirError> {
+                    let attempt = self.closes.fetch_add(1, Ordering::SeqCst);
+                    if self.fail_close && attempt == 0 {
+                        Err(WorkdirError::Transport("/host/private key-secret".into())
+                            .with_failure_reason(WorkdirFailureReason::HttpTransfer))
+                    } else { Ok(()) }
+                }
+            }
+        };
+    }
+    mismatched_session! {
+        stat(request: StatRequest) -> StatResult;
+        read(request: ReadRequest) -> ReadResult;
+        write(request: WriteRequest) -> WriteResult;
+        edit(request: EditRequest) -> EditResult;
+        list(request: ListRequest) -> ListResult;
+        glob(request: GlobRequest) -> GlobResult;
+        grep(request: GrepRequest) -> GrepResult;
+        start_command(request: CommandRequest) -> CommandHandle;
+        command_status(handle: CommandHandle) -> CommandStatus;
+        command_output(request: CommandOutputRequest) -> CommandOutput;
+        cancel_command(handle: CommandHandle) -> ();
+    }
+
+    #[tokio::test]
+    async fn identity_mismatch_preserves_primary_cause_and_failed_close_owner() {
+        for fail_close in [false, true] {
+            let closes = Arc::new(AtomicUsize::new(0));
+            let raw: WorkdirSessionHandle = Arc::new(MismatchedSession {
+                workdir: Workdir::new("wrong-secret"),
+                closes: closes.clone(),
+                fail_close,
+            });
+            let attempts = Arc::new(AtomicUsize::new(0));
+            let observed = attempts.clone();
+            let session = DeferredWorkdirSession::handle(
+                "saved",
+                WorkdirSessionCapabilities::READ_ONLY,
+                move || {
+                    observed.fetch_add(1, Ordering::SeqCst);
+                    Ok(raw.clone())
+                },
+            );
+            let error = session.read(read_request()).await.unwrap_err();
+            assert_eq!(
+                error.failure_reason(),
+                Some(WorkdirFailureReason::SessionIdentityMismatch)
+            );
+            assert!(!format!("{error:?}").contains("secret"));
+            assert_eq!(closes.load(Ordering::SeqCst), 1);
+            if fail_close {
+                assert!(matches!(
+                    session.read(read_request()).await,
+                    Err(WorkdirError::SessionClosed)
+                ));
+                assert_eq!(attempts.load(Ordering::SeqCst), 1);
+            }
+            session.close().await.unwrap();
+            assert_eq!(
+                closes.load(Ordering::SeqCst),
+                if fail_close { 2 } else { 1 }
+            );
+            assert_eq!(attempts.load(Ordering::SeqCst), 1);
+        }
+    }
 }

crates/worker-runtime/src/working_directory.rs

@@ -3677,7 +3677,11 @@ mod tests {
     #[test]
     fn bound_ssh_workdir_uses_attachment_scoped_agent_and_cleans_it_up() {
         let repo = create_clean_repo();
-        let runtime_root = tempfile::tempdir().unwrap();
+        // ssh-agent and the broker receive relative socket paths in this owned
+        // fixture tree, so the test does not depend on checkout/TMPDIR length.
+        // Neither this process nor its peers change cwd.
+        let runtime_root = tempfile::tempdir_in(".").unwrap();
+        let runtime_path = Path::new(runtime_root.path().file_name().unwrap());
         let key_root = tempfile::tempdir().unwrap();
         let key_path = key_root.path().join("id_ed25519");
         let fallback_key_path = key_root.path().join("id_ed25519_fallback");
@@ -3689,7 +3693,7 @@ mod tests {
                 .unwrap();
             assert!(status.success());
         }
-        let materializer = RuntimeGitMaterializer::new(runtime_root.path());
+        let materializer = RuntimeGitMaterializer::new(runtime_path);
         let mut request = request(repo.path());
         request.materialization = Some(crate::catalog::RepositoryMaterializationContext {
             workspace_id: "workspace-1".to_string(),
@@ -3731,7 +3735,7 @@ mod tests {
             kind: server_api::RepositorySourceKind::Ssh,
             uri: "ssh://git@example.test/repo.git".to_string(),
         };
-        let command_access = RepositoryCommandAccess::prepare(runtime_root.path(), &ssh_operation)
+        let command_access = RepositoryCommandAccess::prepare(runtime_path, &ssh_operation)
             .unwrap()
             .unwrap();
         assert!(!command_access.root.join("identity").exists());
@@ -3873,18 +3877,17 @@ mod tests {
             .unwrap();
         // Restore preflight must validate without consuming this one-shot SSH
         // delivery or creating agent/session resources needed by actual bind.
-        let record_before =
-            fs::read(runtime_root.path().join(&id).join(MATERIALIZATION_RECORD)).unwrap();
+        let record_before = fs::read(runtime_path.join(&id).join(MATERIALIZATION_RECORD)).unwrap();
         materializer
             .preflight_bind_working_directory(&id, None)
             .unwrap();
         assert_eq!(
-            fs::read(runtime_root.path().join(&id).join(MATERIALIZATION_RECORD)).unwrap(),
+            fs::read(runtime_path.join(&id).join(MATERIALIZATION_RECORD)).unwrap(),
             record_before
         );
         assert_eq!(materializer.list_working_directories().unwrap().len(), 1);
         assert_eq!(
-            fs::read_dir(runtime_root.path().join(".repository-agents"))
+            fs::read_dir(runtime_path.join(".repository-agents"))
                 .map(|entries| entries.count())
                 .unwrap_or_default(),
             0
@@ -3898,7 +3901,7 @@ mod tests {
         assert!(ssh_policy.contains("__repository-ssh"));
         assert!(!ssh_policy.contains("SSH_AUTH_SOCK"));
         assert_eq!(
-            fs::read_dir(runtime_root.path().join(".repository-agents"))
+            fs::read_dir(runtime_path.join(".repository-agents"))
                 .map(|entries| entries.count())
                 .unwrap_or_default(),
             1
@@ -3916,7 +3919,7 @@ mod tests {
             "consumed delivery expiry must not revoke a live Workdir session"
         );
         assert_eq!(
-            fs::read_dir(runtime_root.path().join(".repository-agents"))
+            fs::read_dir(runtime_path.join(".repository-agents"))
                 .map(|entries| entries.count())
                 .unwrap_or_default(),
             1,
@@ -3925,7 +3928,7 @@ mod tests {
         drop(binding);
         assert!(!ssh_command.exists());
         assert_eq!(
-            fs::read_dir(runtime_root.path().join(".repository-agents"))
+            fs::read_dir(runtime_path.join(".repository-agents"))
                 .map(|entries| entries.count())
                 .unwrap_or_default(),
             0
@@ -3971,7 +3974,7 @@ mod tests {
             ],
             &read_only_command_policy,
         ));
-        let broker_socket = fs::read_dir(runtime_root.path().join(REPOSITORY_ACCESS_DIR))
+        let broker_socket = fs::read_dir(runtime_path.join(REPOSITORY_ACCESS_DIR))
             .unwrap()
             .filter_map(Result::ok)
             .map(|entry| entry.path().join("b.sock"))
@@ -4104,7 +4107,7 @@ mod tests {
                 .code,
             "working_directory_repository_access_expired"
         );
-        let restored = RuntimeGitMaterializer::new(runtime_root.path());
+        let restored = RuntimeGitMaterializer::new(runtime_path);
         assert_eq!(
             restored.bind_working_directory(&id, None).unwrap_err().code,
             "working_directory_remote_repository_access_required"

crates/worker/Cargo.toml

@@ -11,7 +11,6 @@ default = []
 
 [dependencies]
 async-trait = { workspace = true }
-clap = { version = "4.6.0", features = ["derive"] }
 agen = { workspace = true, features = ["codex"] }
 session-store = { workspace = true }
 secrets = { workspace = true }
@@ -58,6 +57,7 @@ wip-protocol = { workspace = true }
 wip-text-view = { workspace = true }
 
 [dev-dependencies]
+tracing-subscriber.workspace = true
 axum = { workspace = true }
 workdir = { workspace = true, features = ["http-client"] }
 dotenv = "0.15.0"

crates/worker/src/authorized_workdir.rs

@@ -206,26 +206,36 @@ impl AuthorizedWorkdirSession {
                         .map(CheckoutSearchResult::Grep),
                 };
             };
-            scoped
-                .authorize_scope_path(WorkdirScopeAuthorizationRequest {
-                    rules: vec![WorkdirToolScopeRule {
-                        target: WorkdirPath::root(),
-                        ..rule.clone()
-                    }],
-                    path: relative_path(&root, operation.path())?,
-                    permission: WorkdirToolScopePermission::Read,
-                })
-                .await?;
-            // Lease cwd rebases paths. Use the same provider scoped-traversal contract
-            // with attachment output_root instead, retaining typed paths, cursors and
-            // Grep's rendered filenames without parsing or post-filtering output.
-            let mut request = CheckoutSearchRequest::new(operation);
-            request.scope_layers.push(vec![rule]);
-            self.session.checkout_search(request).await
+            self.search_with_scope(scoped, root, rule, CheckoutSearchRequest::new(operation))
+                .await
         })
         .await
     }
 
+    async fn search_with_scope(
+        &self,
+        scoped: WorkdirSessionHandle,
+        root: WorkdirPath,
+        rule: WorkdirToolScopeRule,
+        mut request: CheckoutSearchRequest,
+    ) -> Result<CheckoutSearchResult, WorkdirError> {
+        scoped
+            .authorize_scope_path(WorkdirScopeAuthorizationRequest {
+                rules: vec![WorkdirToolScopeRule {
+                    target: WorkdirPath::root(),
+                    ..rule.clone()
+                }],
+                path: relative_path(&root, request.operation.path())?,
+                permission: WorkdirToolScopePermission::Read,
+            })
+            .await?;
+        // Preserve the caller's coordinate root, cursors and all existing
+        // attenuation layers. The provider applies the Host ceiling during
+        // traversal, not by filtering already-rendered filenames afterward.
+        request.scope_layers.push(vec![rule]);
+        self.session.checkout_search(request).await
+    }
+
     fn authorize_command(&self) -> Result<(), WorkdirError> {
         // cwd is not a sandbox: arbitrary shell can access the entire attachment.
         self.authorize(COMMAND, &WorkdirPath::root(), true)
@@ -261,6 +271,12 @@ impl WorkdirSession for AuthorizedWorkdirSession {
         self.session.capabilities()
     }
 
+    fn environment(&self) -> workdir::WorkdirSessionEnvironment {
+        let mut environment = self.session.environment();
+        environment.capabilities = environment.capabilities.intersection(self.capabilities());
+        environment
+    }
+
     async fn authorize_scope_path(
         &self,
         mut request: WorkdirScopeAuthorizationRequest,
@@ -296,8 +312,14 @@ impl WorkdirSession for AuthorizedWorkdirSession {
         &self,
         request: CheckoutSearchRequest,
     ) -> Result<CheckoutSearchResult, WorkdirError> {
-        self.require_legacy(READ)?;
-        self.session.checkout_search(request).await
+        let path = request.operation.path().clone();
+        self.with_authorized(READ, &path, true, |scoped, root, rule| async move {
+            match rule {
+                Some(rule) => self.search_with_scope(scoped, root, rule, request).await,
+                None => self.session.checkout_search(request).await,
+            }
+        })
+        .await
     }
 
     async fn checkout_observe(
@@ -490,6 +512,8 @@ mod tests {
     //! Component tests connect this adapter to the real LocalWorkdirSession.
     //! Only the Host authorization transport/policy is replaced; these are not E2E tests.
 
+    mod environment;
+
     use super::*;
     use crate::{WorkspaceClientError, WorkspaceRequest, WorkspaceResponse};
     use server_api::authorization::ScopedPermission;
@@ -842,18 +866,6 @@ mod tests {
                 .await,
             Err(WorkdirError::Denied(_))
         ));
-        assert!(matches!(
-            session
-                .checkout_search(CheckoutSearchRequest::new(CheckoutSearchOperation::List(
-                    ListRequest {
-                        path: WorkdirPath::root(),
-                        after: None,
-                        limit: 10,
-                    }
-                )))
-                .await,
-            Err(WorkdirError::Denied(_))
-        ));
         let rule = WorkdirToolScopeRule {
             target: WorkdirPath::root(),
             permission: WorkdirToolScopePermission::Read,

crates/worker/src/authorized_workdir/tests/environment.rs

@@ -0,0 +1,198 @@
+//! Normal lib tests connecting live Host-grant checks to real provider traversal
+//! and router cwd projection. Only the Host transport is replaced by the parent
+//! module's grant fixture; no commands, network or ambient Workspace state are used.
+
+use super::*;
+
+#[tokio::test]
+async fn authorization_wrapper_preserves_inner_environment_and_capability_ceiling() {
+    let root = tempfile::tempdir().unwrap();
+    std::fs::create_dir(root.path().join("src")).unwrap();
+    let provider = Arc::new(LocalWorkdirSession::materialized(
+        root.path().to_path_buf(),
+        root.path().to_path_buf(),
+        manifest::SharedScope::new(manifest::Scope::writable(root.path()).unwrap()),
+        WorkdirSessionCapabilities::READ_ONLY,
+    ));
+    let broker = WorkdirToolBroker::at_cwd(provider, WorkdirPath::new("src").unwrap()).unwrap();
+    let inner = broker.tool_session();
+    let expected = inner.environment();
+    let client = AuthorizationClient::new(vec![permission(READ, "src", true)]);
+    let wrapped = authorized_workdir_session(inner, client.clone(), "attachment-id".into());
+    assert_eq!(wrapped.environment(), expected);
+    assert_eq!(wrapped.environment().cwd.as_str(), "src");
+    assert_eq!(
+        wrapped.environment().capabilities,
+        WorkdirSessionCapabilities::READ_ONLY
+    );
+    assert!(
+        client.requests.lock().unwrap().is_empty(),
+        "environment is metadata, not a cached grant decision"
+    );
+    wrapped.close().await.unwrap();
+}
+
+#[tokio::test]
+async fn nonroot_routed_search_retains_host_grants_output_coordinates_and_cursors() {
+    let root = tempfile::tempdir().unwrap();
+    std::fs::create_dir(root.path().join("src")).unwrap();
+    std::fs::create_dir(root.path().join("private")).unwrap();
+    for name in ["a.txt", "b.txt"] {
+        std::fs::write(root.path().join("src").join(name), "needle public marker").unwrap();
+    }
+    std::fs::write(
+        root.path().join("private/secret.txt"),
+        "needle private marker",
+    )
+    .unwrap();
+    let client = AuthorizationClient::new(vec![permission(READ, "src", true)]);
+    let authorized = session(&root, client.clone());
+    let router = workdir::WorkdirSessionRouter::new();
+    let alias = workdir::WorkdirAttachmentAlias::new("checkout").unwrap();
+    router
+        .attach_at_cwd(alias.clone(), authorized, WorkdirPath::new("src").unwrap())
+        .unwrap();
+    let routed = router.resolve(Some("checkout")).unwrap().session;
+    assert_eq!(routed.environment().cwd.as_str(), "src");
+    let paths = routed
+        .glob(GlobRequest {
+            path: WorkdirPath::root(),
+            pattern: "**/*.txt".into(),
+            limit: 100,
+        })
+        .await
+        .unwrap()
+        .paths;
+    assert_eq!(
+        paths,
+        vec![
+            WorkdirPath::new("a.txt").unwrap(),
+            WorkdirPath::new("b.txt").unwrap()
+        ]
+    );
+    // Search output is reusable as a path without adding src/ at the caller.
+    assert_eq!(
+        routed.read(read(paths[0].as_str())).await.unwrap().bytes,
+        b"needle public marker"
+    );
+    for output_mode in [
+        workdir::GrepOutputMode::Content,
+        workdir::GrepOutputMode::FilesWithMatches,
+        workdir::GrepOutputMode::Count,
+    ] {
+        let result = routed
+            .grep(GrepRequest {
+                path: WorkdirPath::root(),
+                pattern: "needle".into(),
+                glob: None,
+                file_type: None,
+                case_insensitive: false,
+                before_context: 0,
+                after_context: 0,
+                multiline: false,
+                output_mode,
+                limit: 100,
+                offset: 0,
+            })
+            .await
+            .unwrap();
+        let mut grep_paths = result.paths;
+        grep_paths.sort_by(|left, right| left.as_str().cmp(right.as_str()));
+        assert_eq!(grep_paths, paths);
+        assert!(result.output.contains("a.txt"));
+        assert!(!result.output.contains("src/"));
+        assert!(!result.output.contains("secret"));
+    }
+    let first = routed
+        .list(ListRequest {
+            path: WorkdirPath::root(),
+            after: None,
+            limit: 1,
+        })
+        .await
+        .unwrap();
+    assert_eq!(first.entries[0].path.as_str(), "a.txt");
+    assert_eq!(first.next_after.as_ref().unwrap().path.as_str(), "a.txt");
+    let second = routed
+        .list(ListRequest {
+            path: WorkdirPath::root(),
+            after: first.next_after,
+            limit: 1,
+        })
+        .await
+        .unwrap();
+    assert_eq!(second.entries[0].path.as_str(), "b.txt");
+    assert!(second.next_after.is_none());
+
+    // An existing caller ceiling must survive the extra Host layer. An empty
+    // layer is invalid and cannot silently turn into the broader Host grant.
+    let mut denied = CheckoutSearchRequest::new(CheckoutSearchOperation::Glob(GlobRequest {
+        path: WorkdirPath::root(),
+        pattern: "**/*.txt".into(),
+        limit: 100,
+    }));
+    denied.scope_layers.push(Vec::new());
+    assert!(routed.checkout_search(denied).await.is_err());
+    assert!(client.requests.lock().unwrap().iter().all(|request| {
+        matches!(&request.resource, PermissionResource::Workdir { path, .. } if path == "src" || path == "src/a.txt")
+    }));
+    client.revoked.store(true, Ordering::SeqCst);
+    assert!(
+        routed
+            .glob(GlobRequest {
+                path: WorkdirPath::root(),
+                pattern: "**/*.txt".into(),
+                limit: 100,
+            })
+            .await
+            .is_err()
+    );
+    router.detach(&alias).await.unwrap();
+}
+
+#[cfg(target_os = "linux")]
+#[tokio::test]
+async fn scoped_checkout_search_preserves_caller_layer_and_rejects_resolved_escape() {
+    let root = tempfile::tempdir().unwrap();
+    std::fs::create_dir_all(root.path().join("src/nested")).unwrap();
+    std::fs::create_dir(root.path().join("private")).unwrap();
+    std::fs::write(root.path().join("src/public.txt"), "needle public").unwrap();
+    std::fs::write(root.path().join("src/nested/hidden.txt"), "needle hidden").unwrap();
+    std::fs::write(root.path().join("private/secret.txt"), "needle secret").unwrap();
+    std::os::unix::fs::symlink("../private", root.path().join("src/escape")).unwrap();
+    std::os::unix::fs::symlink("../private/secret.txt", root.path().join("src/alias.txt")).unwrap();
+    let client = AuthorizationClient::new(vec![permission(READ, "src", true)]);
+    let authorized = session(&root, client);
+    let request = CheckoutSearchRequest {
+        operation: CheckoutSearchOperation::Glob(GlobRequest {
+            path: WorkdirPath::new("src").unwrap(),
+            pattern: "**/*.txt".into(),
+            limit: 100,
+        }),
+        output_root: WorkdirPath::new("src").unwrap(),
+        scope_layers: vec![vec![WorkdirToolScopeRule {
+            target: WorkdirPath::new("src").unwrap(),
+            recursive: false,
+            permission: WorkdirToolScopePermission::Read,
+            symlink_policy: manifest::SymlinkPolicy::Resolved,
+        }]],
+    };
+    let result = authorized.checkout_search(request).await.unwrap();
+    let CheckoutSearchResult::Glob(result) = result else {
+        panic!("expected Glob result")
+    };
+    assert_eq!(result.paths, vec![WorkdirPath::new("public.txt").unwrap()]);
+    assert!(
+        authorized
+            .checkout_search(CheckoutSearchRequest::new(CheckoutSearchOperation::Glob(
+                GlobRequest {
+                    path: WorkdirPath::new("private").unwrap(),
+                    pattern: "**/*.txt".into(),
+                    limit: 100,
+                }
+            )))
+            .await
+            .is_err()
+    );
+    authorized.close().await.unwrap();
+}

crates/worker/src/bootstrap.rs

@@ -6,9 +6,7 @@ use thiserror::Error;
 use workdir::WorkdirSessionHandle;
 
 use crate::PromptCatalogSource;
-use crate::controller::{
-    ShutdownReceiver, WorkerController, WorkerControllerTransport, WorkerHandle,
-};
+use crate::controller::{ShutdownReceiver, WorkerController, WorkerHandle};
 use crate::worker::{Worker, WorkerError, WorkerFilesystemAuthority, WorkerWorkspaceContext};
 use manifest::WorkerManifest;
 
@@ -30,7 +28,6 @@ pub struct WorkerBootstrap<St> {
     workspace_context: WorkerWorkspaceContext,
     filesystem_authority: WorkerFilesystemAuthority,
     layout: WorkerBootstrapLayout,
-    transport: WorkerControllerTransport,
     model_client: Option<Box<dyn LlmClient>>,
     workdir_session: Option<WorkdirSessionHandle>,
     subjektiv_host: Option<std::sync::Arc<dyn crate::subjektiv::SubjektivHost>>,
@@ -41,7 +38,6 @@ pub struct WorkerBootstrap<St> {
 pub struct PreparedWorker<C: LlmClient, St: Store> {
     worker: Worker<C, St>,
     layout: WorkerBootstrapLayout,
-    transport: WorkerControllerTransport,
 }
 
 /// Live controller returned only after Worker construction and feature
@@ -68,7 +64,6 @@ impl<St> WorkerBootstrap<St>
 where
     St: Store + WorkerMetadataStore + Clone + Send + Sync + 'static,
 {
-    #[allow(clippy::too_many_arguments)]
     pub fn new(
         manifest: WorkerManifest,
         store: St,
@@ -76,7 +71,6 @@ where
         workspace_context: WorkerWorkspaceContext,
         filesystem_authority: WorkerFilesystemAuthority,
         layout: WorkerBootstrapLayout,
-        transport: WorkerControllerTransport,
     ) -> Self {
         Self {
             manifest,
@@ -85,7 +79,6 @@ where
             workspace_context,
             filesystem_authority,
             layout,
-            transport,
             model_client: None,
             workdir_session: None,
             subjektiv_host: None,
@@ -165,7 +158,7 @@ where
                 )
                 .map_err(WorkerBootstrapError::Worker)?;
         }
-        Ok(PreparedWorker::new(worker, self.layout, self.transport))
+        Ok(PreparedWorker::new(worker, self.layout))
     }
 
     pub async fn prepare_restored(
@@ -206,7 +199,7 @@ where
                 )
                 .map_err(WorkerBootstrapError::Worker)?;
         }
-        Ok(PreparedWorker::new(worker, self.layout, self.transport))
+        Ok(PreparedWorker::new(worker, self.layout))
     }
 
     pub async fn start(self) -> Result<BootstrappedWorker, WorkerBootstrapError> {
@@ -221,16 +214,8 @@ where
 {
     /// Wrap a restored Worker in the same pre-exposure lifecycle used by fresh
     /// bootstraps.
-    pub fn new(
-        worker: Worker<C, St>,
-        layout: WorkerBootstrapLayout,
-        transport: WorkerControllerTransport,
-    ) -> Self {
-        Self {
-            worker,
-            layout,
-            transport,
-        }
+    pub fn new(worker: Worker<C, St>, layout: WorkerBootstrapLayout) -> Self {
+        Self { worker, layout }
     }
 
     pub fn worker(&self) -> &Worker<C, St> {
@@ -242,7 +227,7 @@ where
     }
 
     pub async fn start(self) -> Result<BootstrappedWorker, WorkerBootstrapError> {
-        start_worker_controller(self.worker, self.layout, self.transport).await
+        start_worker_controller(self.worker, self.layout).await
     }
 }
 
@@ -252,7 +237,6 @@ where
 pub async fn start_worker_controller<C, St>(
     worker: Worker<C, St>,
     layout: WorkerBootstrapLayout,
-    transport: WorkerControllerTransport,
 ) -> Result<BootstrappedWorker, WorkerBootstrapError>
 where
     C: LlmClient + Clone + 'static,
@@ -261,13 +245,10 @@ where
     let cleanup_sessions = worker.workdir_sessions();
     let controller = match layout {
         WorkerBootstrapLayout::Direct { runtime_base } => {
-            WorkerController::spawn_with_transport_owned(worker, &runtime_base, transport).await
+            WorkerController::spawn_owned(worker, &runtime_base).await
         }
         WorkerBootstrapLayout::RuntimeManagedRun { run_dir } => {
-            WorkerController::spawn_runtime_managed_run_with_transport_owned(
-                worker, &run_dir, transport,
-            )
-            .await
+            WorkerController::spawn_runtime_managed_run_owned(worker, &run_dir).await
         }
     };
 

crates/worker/src/checkout_http_tests.rs

@@ -57,6 +57,7 @@ impl ProviderState {
             return Err((
                 StatusCode::UNAUTHORIZED,
                 AxumJson(WorkdirTransportError {
+                    failure_reason: None,
                     denial_reason: None,
                     code: WorkdirTransportErrorCode::Denied,
                     message: "provider authorization denied".into(),
@@ -120,6 +121,7 @@ async fn open_session(
         session_id: WorkdirSessionId::new(SESSION).unwrap(),
         workdir_id: state.session.workdir().id().clone(),
         capabilities: state.session.capabilities(),
+        environment: state.session.environment(),
     })
     .into_response()
 }
@@ -250,6 +252,10 @@ impl Drop for HttpFixture {
 
 impl HttpFixture {
     async fn new(capabilities: WorkdirSessionCapabilities) -> Self {
+        Self::at_cwd(capabilities, "").await
+    }
+
+    async fn at_cwd(capabilities: WorkdirSessionCapabilities, cwd: &str) -> Self {
         let dir = TempDir::new().unwrap();
         std::fs::create_dir_all(dir.path().join("src/deep")).unwrap();
         std::fs::write(
@@ -263,6 +269,13 @@ impl HttpFixture {
             manifest::SharedScope::new(manifest::Scope::writable(dir.path()).unwrap()),
             capabilities,
         ));
+        let session: WorkdirSessionHandle = if cwd.is_empty() {
+            session
+        } else {
+            workdir::WorkdirToolBroker::at_cwd(session, WorkdirPath::new(cwd).unwrap())
+                .unwrap()
+                .tool_session()
+        };
         let state = Arc::new(ProviderState {
             session,
             requests: Mutex::new(Vec::new()),
@@ -348,6 +361,31 @@ impl HttpFixture {
     }
 }
 
+#[tokio::test]
+async fn remote_open_keeps_provider_environment_and_nonroot_operation_coordinates() {
+    let fixture = HttpFixture::at_cwd(WorkdirSessionCapabilities::READ_ONLY, "src/deep").await;
+    let remote = fixture.open(TOKEN).await.unwrap();
+    assert_eq!(remote.environment(), fixture.state.session.environment());
+    assert_eq!(remote.environment().cwd.as_str(), "src/deep");
+    assert_eq!(
+        remote.environment().capabilities,
+        WorkdirSessionCapabilities::READ_ONLY
+    );
+    let result = remote
+        .read(workdir::ReadRequest {
+            path: WorkdirPath::new("a.txt").unwrap(),
+            offset: 0,
+            limit: 10,
+            max_bytes: 4096,
+        })
+        .await
+        .unwrap();
+    assert_eq!(result.bytes, b"first\nneedle needle\nlast\n");
+    fixture.public_output(&serde_json::to_string(&remote.environment()).unwrap());
+    remote.close().await.unwrap();
+    fixture.assert_endpoints();
+}
+
 fn native_runtime(remote: Arc<RemoteWorkdirSession>) -> (WipRuntime, Arc<WorkdirSessionRouter>) {
     let router = Arc::new(WorkdirSessionRouter::new());
     router
@@ -885,21 +923,32 @@ async fn remote_native_bash_retains_streams_quota_and_replays_lost_terminal_thro
 }
 
 #[tokio::test]
-async fn waiting_remote_command_rejects_empty_response_without_http_busy_loop() {
+async fn waiting_remote_command_paces_empty_responses_and_keeps_cursor_until_output() {
     watchdog(async {
         let f = HttpFixture::new(WorkdirSessionCapabilities::ALL).await;
         let remote = f.open(TOKEN).await.unwrap();
-        *f.state.command_fault.lock().unwrap() = Some(CommandResponseFault::EmptyWaiting);
-        let error = remote
-            .command_output(workdir::CommandOutputRequest {
-                handle: workdir::CommandHandle("unused".into()),
-                cursor: 0,
-                limit: 1024,
-                wait: true,
+        let handle = remote
+            .start_command(workdir::CommandRequest {
+                command: "printf done; exit 7".into(),
+                cwd: WorkdirPath::root(),
+                timeout_secs: 5,
+                transport_byte_budget: 1024,
+                tool_call_id: None,
             })
             .await
-            .unwrap_err();
-        assert!(matches!(error, WorkdirError::Unavailable(_)));
+            .unwrap();
+        *f.state.command_fault.lock().unwrap() = Some(CommandResponseFault::EmptyWaiting);
+        let mut request = workdir::CommandOutputRequest {
+            handle,
+            cursor: 0,
+            limit: 1024,
+            wait: false,
+        };
+        // Nonwaiting polls still return their empty page after one HTTP request.
+        let page = remote.command_output(request.clone()).await.unwrap();
+        assert!(page.chunks.is_empty());
+        assert!(page.terminal.is_none());
+        assert_eq!(page.next_cursor, 0);
         assert_eq!(
             f.state
                 .operations
@@ -910,6 +959,57 @@ async fn waiting_remote_command_rejects_empty_response_without_http_busy_loop()
                 .count(),
             1
         );
+        f.state.operations.lock().unwrap().clear();
+
+        request.wait = true;
+        // Repeated immediate empty responses remain pending, are paced rather
+        // than spun, and can still be stopped by the caller's deadline.
+        assert!(
+            tokio::time::timeout(
+                Duration::from_millis(350),
+                remote.command_output(request.clone()),
+            )
+            .await
+            .is_err()
+        );
+        let operations = f.state.operations.lock().unwrap().clone();
+        assert!(
+            (1..=4).contains(&operations.len()),
+            "empty polls were not paced: {}",
+            operations.len()
+        );
+        for operation in &operations {
+            let WorkdirSessionOperation::CommandOutput(output) = operation else {
+                panic!("unexpected operation: {operation:?}");
+            };
+            assert_eq!(output, &request);
+        }
+        tokio::time::sleep(Duration::from_millis(150)).await;
+        assert_eq!(
+            f.state.operations.lock().unwrap().len(),
+            operations.len(),
+            "dropped waiting read kept polling"
+        );
+
+        // After the empty replies stop, the exact same cursor still retrieves
+        // the bytes and terminal from the original command, without a restart.
+        *f.state.command_fault.lock().unwrap() = None;
+        let mut bytes = Vec::new();
+        loop {
+            let page = remote.command_output(request.clone()).await.unwrap();
+            assert_eq!(remote.command_output(request.clone()).await.unwrap(), page);
+            for chunk in page.chunks {
+                assert_eq!(chunk.sequence, request.cursor);
+                request.cursor += chunk.bytes.len() as u64;
+                bytes.extend(chunk.bytes);
+            }
+            assert_eq!(page.next_cursor, request.cursor);
+            if let Some(terminal) = page.terminal {
+                assert_eq!(terminal.exit_code, Some(7));
+                break;
+            }
+        }
+        assert_eq!(bytes, b"done");
         remote.close().await.unwrap();
     })
     .await;

crates/worker/src/checkout_race_tests.rs

@@ -78,6 +78,12 @@ impl WorkdirSession for HookedSession {
         self.local.capabilities()
     }
 
+    fn environment(&self) -> workdir::WorkdirSessionEnvironment {
+        let mut environment = self.local.environment();
+        environment.capabilities = environment.capabilities.intersection(self.capabilities());
+        environment
+    }
+
     async fn authorize_scope_path(
         &self,
         request: WorkdirScopeAuthorizationRequest,
@@ -201,11 +207,10 @@ async fn checkout_wip_file_operations_share_core_and_keep_prior_read_boundary()
     let dir = TempDir::new().unwrap();
     std::fs::write(dir.path().join("text.txt"), "旧 旧\n").unwrap();
     let router = Arc::new(WorkdirSessionRouter::new());
+    let hooked = HookedSession::new(&dir);
+    assert_eq!(hooked.environment(), hooked.local.environment());
     router
-        .attach(
-            WorkdirAttachmentAlias::new("main").unwrap(),
-            HookedSession::new(&dir),
-        )
+        .attach(WorkdirAttachmentAlias::new("main").unwrap(), hooked)
         .unwrap();
     let provider = provider(router);
     let route = format!("{}/text.txt", checkout_root("main"));

crates/worker/src/controller_subject_release_tests.rs

@@ -65,7 +65,6 @@ async fn prepared(
         WorkerBootstrapLayout::Direct {
             runtime_base: temp.path().join("runtime"),
         },
-        WorkerControllerTransport::InProcess,
     )
     .with_model_client(client)
     .prepare()

crates/worker/src/feature/builtin.rs

@@ -4,6 +4,7 @@
 //! same descriptor-approved registry path used by feature modules. They are not
 //! an external plugin-loading surface.
 
+mod backend_diagnostic;
 pub mod backend_job_result;
 pub(crate) mod bash;
 

crates/worker/src/feature/builtin/backend_diagnostic.rs

@@ -0,0 +1,195 @@
+//! Internal adapter diagnostics are independent of public failure classifications.
+//!
+//! Only closed vocabularies, numeric status and opaque correlation tokens cross this boundary.
+//! In particular, a transport error's Display/Debug and server-controlled text are never recorded.
+use sha2::{Digest, Sha256};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Adapter {
+    Drive,
+    WorkspaceConfig,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Stage {
+    Request,
+    Response,
+    Completion,
+    Reconcile,
+    Attach,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Reason {
+    Deadline,
+    TaskJoin,
+    TransportUnavailable,
+    InvalidPath,
+    Communication,
+    Decode,
+    RequestSize,
+    ResponseSize,
+    ResponseLength,
+    Identity,
+    InvalidMetadata,
+    BackendRejected,
+    AccessCeiling,
+    AttachConversion,
+    BackendUnknown,
+    UnrecognizedResponse,
+    NotCommittedSnapshot,
+    IncompleteReceipt,
+    Reconciled,
+}
+
+/// One logical call, including its original-request reconciliation. Request identities are hashed
+/// rather than logged verbatim: callers and responses need not contain safe log text.
+#[derive(Clone)]
+pub(super) struct Diagnostic {
+    adapter: Adapter,
+    operation: &'static str,
+    mutation: bool,
+    correlation: String,
+    dispatch: tracing::Dispatch,
+    stage_override: Option<Stage>,
+}
+
+impl Diagnostic {
+    pub(super) fn new(
+        adapter: Adapter,
+        operation: &'static str,
+        mutation: bool,
+        request_id: Option<&str>,
+    ) -> Self {
+        Self {
+            adapter,
+            operation,
+            mutation,
+            correlation: request_id
+                .map(|id| {
+                    let hash: String = Sha256::digest(id.as_bytes())
+                        .iter()
+                        .map(|b| format!("{b:02x}"))
+                        .collect();
+                    format!("request:{hash}")
+                })
+                .unwrap_or_else(|| uuid::Uuid::now_v7().to_string()),
+            dispatch: tracing::dispatcher::get_default(Clone::clone),
+            stage_override: None,
+        }
+    }
+
+    pub(super) fn at_stage(&self, stage: Stage) -> Self {
+        let mut diagnostic = self.clone();
+        diagnostic.stage_override = Some(stage);
+        diagnostic
+    }
+
+    pub(super) fn record(&self, stage: Stage, reason: Reason, status: Option<u16>) {
+        let stage = self.stage_override.unwrap_or(stage);
+        tracing::dispatcher::with_default(&self.dispatch, || {
+            tracing::warn!(
+                target: "worker::backend_diagnostic",
+                adapter = ?self.adapter,
+                operation = self.operation,
+                mutation = self.mutation,
+                correlation = %self.correlation,
+                stage = ?stage,
+                reason = ?reason,
+                status,
+                "Workspace adapter diagnostic"
+            );
+        });
+    }
+
+    pub(super) fn transport(&self, error: &crate::worker::WorkspaceClientError) {
+        use crate::worker::WorkspaceClientError;
+        self.record(
+            Stage::Request,
+            match error {
+                WorkspaceClientError::Unavailable(_) => Reason::TransportUnavailable,
+                WorkspaceClientError::InvalidPath(_) => Reason::InvalidPath,
+                WorkspaceClientError::Request(_) => Reason::Communication,
+            },
+            None,
+        );
+    }
+}
+
+#[cfg(test)]
+pub(super) mod tests {
+    use super::{Adapter, Diagnostic, Reason, Stage};
+    use std::sync::{Arc, Mutex};
+    use tracing::{Event, Metadata, Subscriber, field::Visit, span};
+
+    #[test]
+    fn unsafe_request_identity_is_correlated_without_logging_its_value() {
+        let capture = Capture::default();
+        tracing::dispatcher::with_default(&capture.dispatch(), || {
+            for id in [
+                "secret /host/path\ncredential",
+                "secret /host/path\ncredential",
+                "different",
+            ] {
+                Diagnostic::new(Adapter::Drive, "mutate", true, Some(id)).record(
+                    Stage::Request,
+                    Reason::Communication,
+                    None,
+                );
+            }
+        });
+        let text = capture.text();
+        for secret in ["secret", "/host/path", "credential", "different"] {
+            assert!(!text.contains(secret));
+        }
+        let correlations: Vec<_> = text
+            .lines()
+            .map(|line| {
+                line.split("correlation=")
+                    .nth(1)
+                    .unwrap()
+                    .split(';')
+                    .next()
+                    .unwrap()
+            })
+            .collect();
+        assert_eq!(correlations.len(), 3);
+        assert_eq!(correlations[0], correlations[1]);
+        assert_ne!(correlations[0], correlations[2]);
+    }
+
+    #[derive(Clone, Default)]
+    pub(crate) struct Capture(pub(crate) Arc<Mutex<Vec<String>>>);
+    impl Capture {
+        pub(crate) fn dispatch(&self) -> tracing::Dispatch {
+            tracing::Dispatch::new(self.clone())
+        }
+        pub(crate) fn text(&self) -> String {
+            self.0.lock().unwrap().join("\n")
+        }
+    }
+    struct Fields(String);
+    impl Visit for Fields {
+        fn record_debug(&mut self, field: &tracing::field::Field, value: &dyn std::fmt::Debug) {
+            use std::fmt::Write;
+            write!(&mut self.0, "{}={value:?};", field.name()).unwrap();
+        }
+    }
+    impl Subscriber for Capture {
+        fn enabled(&self, metadata: &Metadata<'_>) -> bool {
+            metadata.target() == "worker::backend_diagnostic"
+        }
+        fn new_span(&self, _: &span::Attributes<'_>) -> span::Id {
+            span::Id::from_u64(1)
+        }
+        fn record(&self, _: &span::Id, _: &span::Record<'_>) {}
+        fn record_follows_from(&self, _: &span::Id, _: &span::Id) {}
+        fn event(&self, event: &Event<'_>) {
+            let mut fields = Fields(String::new());
+            event.record(&mut fields);
+            self.0.lock().unwrap().push(fields.0);
+        }
+        fn enter(&self, _: &span::Id) {}
+        fn exit(&self, _: &span::Id) {}
+    }
+}

crates/worker/src/feature/builtin/drive/backend.rs

@@ -11,6 +11,8 @@
 //! cases retain an unknown outcome with the original request ID. Never blindly resend with a new ID.
 use std::{sync::Arc, time::Duration};
 
+use super::super::backend_diagnostic::{Adapter, Diagnostic, Reason, Stage};
+
 use crate::worker::{
     WorkspaceBinaryRequest, WorkspaceClient, WorkspaceRequest, WorkspaceRequestMethod,
 };
@@ -23,6 +25,7 @@ const RESPONSE_LIMIT: usize = 2 * 1024 * 1024;
 #[derive(Clone)]
 pub struct DriveBackend {
     client: Arc<dyn WorkspaceClient>,
+    deadline: Duration,
 }
 
 #[derive(Debug, Clone, thiserror::Error)]
@@ -49,7 +52,10 @@ pub enum DriveError {
 
 impl DriveBackend {
     pub fn new(client: Arc<dyn WorkspaceClient>) -> Self {
-        Self { client }
+        Self {
+            client,
+            deadline: DEADLINE,
+        }
     }
     pub fn workspace(&self) -> Result<&str, DriveError> {
         self.client
@@ -61,15 +67,28 @@ impl DriveBackend {
         Ok(format!("/api/w/{}/drive", encode(self.workspace()?)))
     }
     pub(super) fn validate_entry(&self, entry: &DriveEntry) -> Result<(), DriveError> {
-        self.validate_ref(&entry.entry)?;
+        self.validate_entry_at(
+            entry,
+            &Diagnostic::new(Adapter::Drive, "validate_entry", false, None),
+        )
+    }
+    fn validate_entry_at(
+        &self,
+        entry: &DriveEntry,
+        diagnostic: &Diagnostic,
+    ) -> Result<(), DriveError> {
+        self.validate_ref(&entry.entry)
+            .inspect_err(|_| diagnostic.record(Stage::Completion, Reason::Identity, None))?;
         if let Some(parent) = &entry.parent {
-            self.validate_ref(parent)?;
+            self.validate_ref(parent)
+                .inspect_err(|_| diagnostic.record(Stage::Completion, Reason::Identity, None))?;
         }
         if (entry.last_mutation_id.len() > 128
             || entry.last_mutation_id.chars().any(char::is_control)
             || (entry.parent.is_some() && entry.last_mutation_id.is_empty()))
             || entry.size.is_some_and(|n| n > DRIVE_FILE_MAX_BYTES)
         {
+            diagnostic.record(Stage::Completion, Reason::InvalidMetadata, None);
             return Err(DriveError::Unavailable);
         }
         Ok(())
@@ -90,11 +109,13 @@ impl DriveBackend {
         request: WorkspaceRequest,
         mutation: bool,
         request_id: &str,
+        diagnostic: &Diagnostic,
     ) -> Result<T, DriveError> {
         let client = self.client.clone();
+        let deadline = self.deadline;
         let response = tokio::time::timeout(
-            DEADLINE,
-            tokio::task::spawn_blocking(move || client.execute_with_timeout(request, DEADLINE)),
+            deadline,
+            tokio::task::spawn_blocking(move || client.execute_with_timeout(request, deadline)),
         )
         .await;
         let unknown = || {
@@ -105,10 +126,20 @@ impl DriveBackend {
             }
         };
         let response = response
-            .map_err(|_| unknown())?
-            .map_err(|_| unknown())?
-            .map_err(|_| unknown())?;
+            .map_err(|_| {
+                diagnostic.record(Stage::Request, Reason::Deadline, None);
+                unknown()
+            })?
+            .map_err(|_| {
+                diagnostic.record(Stage::Request, Reason::TaskJoin, None);
+                unknown()
+            })?
+            .map_err(|error| {
+                diagnostic.transport(&error);
+                unknown()
+            })?;
         if response.body.len() > RESPONSE_LIMIT {
+            diagnostic.record(Stage::Response, Reason::ResponseSize, None);
             return Err(if mutation {
                 unknown()
             } else {
@@ -121,42 +152,57 @@ impl DriveBackend {
                 response.body.as_bytes(),
                 mutation,
                 request_id,
+                diagnostic,
             ));
         }
-        serde_json::from_str(&response.body).map_err(|_| unknown())
+        serde_json::from_str(&response.body).map_err(|_| {
+            diagnostic.record(Stage::Response, Reason::Decode, None);
+            unknown()
+        })
     }
     async fn get<T: DeserializeOwned + Send + 'static, Q: Serialize>(
         &self,
-        suffix: &str,
+        suffix: &'static str,
         query: &Q,
+        diagnostic: &Diagnostic,
     ) -> Result<T, DriveError> {
         let query = query_string(query)?;
         self.json(
             WorkspaceRequest::get(format!("{}{suffix}{query}", self.base()?)),
             false,
             "",
+            diagnostic,
         )
         .await
     }
     pub async fn capabilities(&self) -> Result<DriveCapabilities, DriveError> {
-        self.get("/capabilities", &serde_json::json!({})).await
+        self.get(
+            "/capabilities",
+            &serde_json::json!({}),
+            &Diagnostic::new(Adapter::Drive, "capabilities", false, None),
+        )
+        .await
     }
     pub async fn root(&self) -> Result<DriveEntry, DriveError> {
+        let diagnostic = Diagnostic::new(Adapter::Drive, "root", false, None);
         let entry: DriveEntry = self
             .json(
                 WorkspaceRequest::get(format!("{}/root", self.base()?)),
                 false,
                 "",
+                &diagnostic,
             )
             .await?;
-        self.validate_entry(&entry)?;
+        self.validate_entry_at(&entry, &diagnostic)?;
         if entry.kind != DriveEntryKind::Folder || entry.parent.is_some() {
+            diagnostic.record(Stage::Completion, Reason::InvalidMetadata, None);
             return Err(DriveError::Unavailable);
         }
         Ok(entry)
     }
     pub async fn metadata(&self, entry: &DriveEntryRef) -> Result<DriveEntry, DriveError> {
         self.validate_ref(entry)?;
+        let diagnostic = Diagnostic::new(Adapter::Drive, "metadata", false, None);
         let result: DriveEntry = self
             .get(
                 "/metadata",
@@ -164,10 +210,12 @@ impl DriveBackend {
                     entry_workspace_id: entry.workspace_id.clone(),
                     id: entry.node_id.clone(),
                 },
+                &diagnostic,
             )
             .await?;
-        self.validate_entry(&result)?;
+        self.validate_entry_at(&result, &diagnostic)?;
         if result.entry != *entry {
+            diagnostic.record(Stage::Completion, Reason::Identity, None);
             return Err(DriveError::Unavailable);
         }
         Ok(result)
@@ -179,6 +227,7 @@ impl DriveBackend {
         after: Option<String>,
     ) -> Result<DriveListResponse, DriveError> {
         self.validate_ref(parent)?;
+        let diagnostic = Diagnostic::new(Adapter::Drive, "list", false, None);
         let result: DriveListResponse = self
             .get(
                 "/list",
@@ -188,6 +237,7 @@ impl DriveBackend {
                     limit,
                     after,
                 },
+                &diagnostic,
             )
             .await?;
         self.validate_page(
@@ -195,33 +245,43 @@ impl DriveBackend {
             limit
                 .unwrap_or(DRIVE_PAGE_MAX_LIMIT)
                 .min(DRIVE_PAGE_MAX_LIMIT),
+            &diagnostic,
         )?;
         if result
             .entries
             .iter()
             .any(|entry| entry.parent.as_ref() != Some(parent))
         {
+            diagnostic.record(Stage::Completion, Reason::Identity, None);
             return Err(DriveError::Unavailable);
         }
         Ok(result)
     }
     pub async fn search(&self, query: DriveSearchQuery) -> Result<DriveListResponse, DriveError> {
-        let result: DriveListResponse = self.get("/search", &query).await?;
+        let diagnostic = Diagnostic::new(Adapter::Drive, "search", false, None);
+        let result: DriveListResponse = self.get("/search", &query, &diagnostic).await?;
         self.validate_page(
             &result,
             query
                 .limit
                 .unwrap_or(DRIVE_SEARCH_MAX_LIMIT)
                 .min(DRIVE_SEARCH_MAX_LIMIT),
+            &diagnostic,
         )?;
         Ok(result)
     }
-    fn validate_page(&self, page: &DriveListResponse, limit: u32) -> Result<(), DriveError> {
+    fn validate_page(
+        &self,
+        page: &DriveListResponse,
+        limit: u32,
+        diagnostic: &Diagnostic,
+    ) -> Result<(), DriveError> {
         if page.entries.len() > limit as usize {
+            diagnostic.record(Stage::Completion, Reason::ResponseSize, None);
             return Err(DriveError::Limit);
         }
         for entry in &page.entries {
-            self.validate_entry(entry)?;
+            self.validate_entry_at(entry, diagnostic)?;
         }
         Ok(())
     }
@@ -231,6 +291,7 @@ impl DriveBackend {
         max_bytes: u32,
     ) -> Result<DriveReadTextResponse, DriveError> {
         self.validate_ref(entry)?;
+        let diagnostic = Diagnostic::new(Adapter::Drive, "read_text", false, None);
         let result: DriveReadTextResponse = self
             .get(
                 "/read-text",
@@ -239,10 +300,16 @@ impl DriveBackend {
                     id: entry.node_id.clone(),
                     max_bytes,
                 },
+                &diagnostic,
             )
             .await?;
-        self.validate_entry(&result.entry)?;
-        if result.entry.entry != *entry || result.text.len() > max_bytes as usize {
+        self.validate_entry_at(&result.entry, &diagnostic)?;
+        if result.entry.entry != *entry {
+            diagnostic.record(Stage::Completion, Reason::Identity, None);
+            return Err(DriveError::Unavailable);
+        }
+        if result.text.len() > max_bytes as usize {
+            diagnostic.record(Stage::Completion, Reason::ResponseSize, None);
             return Err(DriveError::Unavailable);
         }
         Ok(result)
@@ -255,6 +322,7 @@ impl DriveBackend {
         if total as usize > limit {
             return Err(DriveError::Limit);
         }
+        let diagnostic = Diagnostic::new(Adapter::Drive, "read_chunk", false, None);
         let mut bytes = Vec::with_capacity(total as usize);
         // Even an empty file gets a read bound to the observed committed mutation and current authorization.
         loop {
@@ -274,21 +342,42 @@ impl DriveBackend {
                 max_response_bytes: DRIVE_CHUNK_MAX_BYTES as usize,
             };
             let client = self.client.clone();
+            let deadline = self.deadline;
             let response = tokio::time::timeout(
-                DEADLINE,
+                deadline,
                 tokio::task::spawn_blocking(move || {
-                    client.execute_binary_with_timeout(request, DEADLINE)
+                    client.execute_binary_with_timeout(request, deadline)
                 }),
             )
             .await
-            .map_err(|_| DriveError::Unavailable)?
-            .map_err(|_| DriveError::Unavailable)?
-            .map_err(|_| DriveError::Unavailable)?;
+            .map_err(|_| {
+                diagnostic.record(Stage::Request, Reason::Deadline, None);
+                DriveError::Unavailable
+            })?
+            .map_err(|_| {
+                diagnostic.record(Stage::Request, Reason::TaskJoin, None);
+                DriveError::Unavailable
+            })?
+            .map_err(|error| {
+                diagnostic.transport(&error);
+                DriveError::Unavailable
+            })?;
+            if response.body.len() > DRIVE_CHUNK_MAX_BYTES as usize {
+                diagnostic.record(Stage::Response, Reason::ResponseSize, None);
+                return Err(DriveError::Unavailable);
+            }
             if !(200..300).contains(&response.status) {
-                return Err(classify(response.status, &response.body, false, ""));
+                return Err(classify(
+                    response.status,
+                    &response.body,
+                    false,
+                    "",
+                    &diagnostic,
+                ));
             }
             let expected = total.saturating_sub(offset).min(length) as usize;
             if response.body.len() != expected {
+                diagnostic.record(Stage::Response, Reason::ResponseLength, None);
                 return Err(DriveError::Unavailable);
             }
             bytes.extend_from_slice(&response.body);
@@ -301,22 +390,40 @@ impl DriveBackend {
         &self,
         id: &str,
         result: Result<DriveMutationResponse, DriveError>,
+        diagnostic: &Diagnostic,
     ) -> Result<DriveMutationResponse, DriveError> {
         // A parseable success can still be an invalid completion. Classify it
         // before reconciliation so it also gets one original-request inquiry.
         let result = result.and_then(|response| {
-            self.validate_completion(id, &response)
+            self.validate_completion(id, &response, diagnostic)
                 .map_err(|_| DriveError::OutcomeUnknown(id.into()))?;
             Ok(response)
         });
         match result {
-            Err(DriveError::OutcomeUnknown(_)) => match self.status(id).await {
+            Err(DriveError::OutcomeUnknown(_)) => match self
+                .status_with_diagnostic(id, &diagnostic.at_stage(Stage::Reconcile))
+                .await
+            {
                 Ok(DriveRequestStatusResponse {
                     state: DriveRequestState::Committed,
                     response: Some(response),
                     ..
-                }) => Ok(response), // status validates both IDs and entry metadata
-                _ => Err(DriveError::OutcomeUnknown(id.into())),
+                }) => {
+                    diagnostic.record(Stage::Reconcile, Reason::Reconciled, None);
+                    Ok(response) // status validates both IDs and entry metadata
+                }
+                Ok(status) => {
+                    diagnostic.record(
+                        Stage::Reconcile,
+                        match status.state {
+                            DriveRequestState::Uncommitted => Reason::NotCommittedSnapshot,
+                            DriveRequestState::Committed => Reason::IncompleteReceipt,
+                        },
+                        None,
+                    );
+                    Err(DriveError::OutcomeUnknown(id.into()))
+                }
+                Err(_) => Err(DriveError::OutcomeUnknown(id.into())),
             },
             other => other,
         }
@@ -325,12 +432,14 @@ impl DriveBackend {
         &self,
         id: &str,
         response: &DriveMutationResponse,
+        diagnostic: &Diagnostic,
     ) -> Result<(), DriveError> {
         if response.request_id != id {
+            diagnostic.record(Stage::Completion, Reason::Identity, None);
             return Err(DriveError::Unavailable);
         }
         if let Some(entry) = &response.entry {
-            self.validate_entry(entry)?;
+            self.validate_entry_at(entry, diagnostic)?;
         }
         Ok(())
     }
@@ -338,9 +447,11 @@ impl DriveBackend {
         &self,
         request: DriveMutationRequest,
     ) -> Result<DriveMutationResponse, DriveError> {
+        let diagnostic = Diagnostic::new(Adapter::Drive, "mutate", true, Some(&request.request_id));
         let body = serde_json::to_string(&request)
             .map_err(|_| DriveError::Invalid("invalid mutation".into()))?;
         if body.len() > 512 * 1024 {
+            diagnostic.record(Stage::Request, Reason::RequestSize, None);
             return Err(DriveError::Limit);
         }
         let result = self
@@ -352,16 +463,20 @@ impl DriveBackend {
                 ),
                 true,
                 &request.request_id,
+                &diagnostic,
             )
             .await;
-        self.reconcile(&request.request_id, result).await
+        self.reconcile(&request.request_id, result, &diagnostic)
+            .await
     }
     pub async fn upload(
         &self,
         query: DriveUploadQuery,
         bytes: Vec<u8>,
     ) -> Result<DriveMutationResponse, DriveError> {
+        let diagnostic = Diagnostic::new(Adapter::Drive, "upload", true, Some(&query.request_id));
         if bytes.len() > DRIVE_FILE_MAX_BYTES as usize {
+            diagnostic.record(Stage::Request, Reason::RequestSize, None);
             return Err(DriveError::Limit);
         }
         let path = format!("{}/upload{}", self.base()?, query_string(&query)?);
@@ -372,29 +487,56 @@ impl DriveBackend {
             max_response_bytes: RESPONSE_LIMIT,
         };
         let client = self.client.clone();
+        let deadline = self.deadline;
         let result = tokio::time::timeout(
-            DEADLINE,
+            deadline,
             tokio::task::spawn_blocking(move || {
-                client.execute_binary_with_timeout(request, DEADLINE)
+                client.execute_binary_with_timeout(request, deadline)
             }),
         )
         .await;
         let result = match result {
+            Ok(Ok(Ok(response))) if response.body.len() > RESPONSE_LIMIT => {
+                diagnostic.record(Stage::Response, Reason::ResponseSize, None);
+                Err(DriveError::OutcomeUnknown(query.request_id.clone()))
+            }
             Ok(Ok(Ok(response))) if (200..300).contains(&response.status) => {
-                serde_json::from_slice(&response.body)
-                    .map_err(|_| DriveError::OutcomeUnknown(query.request_id.clone()))
+                serde_json::from_slice(&response.body).map_err(|_| {
+                    diagnostic.record(Stage::Response, Reason::Decode, None);
+                    DriveError::OutcomeUnknown(query.request_id.clone())
+                })
             }
             Ok(Ok(Ok(response))) => Err(classify(
                 response.status,
                 &response.body,
                 true,
                 &query.request_id,
+                &diagnostic,
             )),
-            _ => Err(DriveError::OutcomeUnknown(query.request_id.clone())),
+            Err(_) => {
+                diagnostic.record(Stage::Request, Reason::Deadline, None);
+                Err(DriveError::OutcomeUnknown(query.request_id.clone()))
+            }
+            Ok(Err(_)) => {
+                diagnostic.record(Stage::Request, Reason::TaskJoin, None);
+                Err(DriveError::OutcomeUnknown(query.request_id.clone()))
+            }
+            Ok(Ok(Err(error))) => {
+                diagnostic.transport(&error);
+                Err(DriveError::OutcomeUnknown(query.request_id.clone()))
+            }
         };
-        self.reconcile(&query.request_id, result).await
+        self.reconcile(&query.request_id, result, &diagnostic).await
     }
     pub async fn status(&self, request_id: &str) -> Result<DriveRequestStatusResponse, DriveError> {
+        let diagnostic = Diagnostic::new(Adapter::Drive, "request_status", false, Some(request_id));
+        self.status_with_diagnostic(request_id, &diagnostic).await
+    }
+    async fn status_with_diagnostic(
+        &self,
+        request_id: &str,
+        diagnostic: &Diagnostic,
+    ) -> Result<DriveRequestStatusResponse, DriveError> {
         if request_id.is_empty() || request_id.len() > 256 {
             return Err(DriveError::Invalid("invalid request ID".into()));
         }
@@ -403,13 +545,15 @@ impl DriveBackend {
                 WorkspaceRequest::get(format!("{}/requests/{}", self.base()?, encode(request_id))),
                 false,
                 "",
+                diagnostic,
             )
             .await?;
         if response.request_id != request_id {
+            diagnostic.record(Stage::Reconcile, Reason::Identity, None);
             return Err(DriveError::Unavailable);
         }
         if let Some(result) = &response.response {
-            self.validate_completion(request_id, result)?;
+            self.validate_completion(request_id, result, diagnostic)?;
         }
         Ok(response)
     }
@@ -463,11 +607,21 @@ fn query_string<T: Serialize>(value: &T) -> Result<String, DriveError> {
         format!("?{}", pairs.join("&"))
     })
 }
-fn classify(status: u16, body: &[u8], mutation: bool, id: &str) -> DriveError {
+fn classify(
+    status: u16,
+    body: &[u8],
+    mutation: bool,
+    id: &str,
+    diagnostic: &Diagnostic,
+) -> DriveError {
     if let Ok(error) = serde_json::from_slice::<DriveApiError>(body) {
-        if error.classification == DriveFailureClassification::Unknown {
+        if error.classification == DriveFailureClassification::Unknown
+            || error.code == DriveApiErrorCode::OutcomeUnknown
+        {
+            diagnostic.record(Stage::Response, Reason::BackendUnknown, Some(status));
             return DriveError::OutcomeUnknown(id.into());
         }
+        diagnostic.record(Stage::Response, Reason::BackendRejected, Some(status));
         return match error.code {
             DriveApiErrorCode::Denied => DriveError::Denied,
             DriveApiErrorCode::NotFound => DriveError::NotFound,
@@ -478,6 +632,7 @@ fn classify(status: u16, body: &[u8], mutation: bool, id: &str) -> DriveError {
             DriveApiErrorCode::OutcomeUnknown => DriveError::OutcomeUnknown(id.into()),
         };
     }
+    diagnostic.record(Stage::Response, Reason::UnrecognizedResponse, Some(status));
     if matches!(status, 401 | 403) {
         DriveError::Denied
     } else if mutation {
@@ -486,3 +641,7 @@ fn classify(status: u16, body: &[u8], mutation: bool, id: &str) -> DriveError {
         DriveError::Unavailable
     }
 }
+
+#[cfg(test)]
+#[path = "backend_tests.rs"]
+mod tests;

crates/worker/src/feature/builtin/drive/backend_tests.rs

@@ -0,0 +1,644 @@
+//! Production Drive adapter fault injection. Only the Workspace transport boundary is substituted;
+//! retained fixture effects and original-request inquiries are inspected independently of replies.
+//! The HTTP case additionally connects the adapter to reqwest and an isolated loopback router.
+use super::*;
+use crate::feature::builtin::backend_diagnostic::{Reason, tests::Capture};
+use crate::worker::{WorkspaceBinaryResponse, WorkspaceClientError, WorkspaceResponse};
+use std::sync::{Condvar, Mutex};
+use tracing::instrument::WithSubscriber;
+
+const SECRET: &str = "secret-token /private/drive credential=unsafe";
+const ID: &str = "host-request-1";
+
+fn entry() -> DriveEntry {
+    DriveEntry {
+        entry: DriveEntryRef {
+            workspace_id: "workspace".into(),
+            node_id: "2".into(),
+        },
+        parent: Some(DriveEntryRef {
+            workspace_id: "workspace".into(),
+            node_id: "1".into(),
+        }),
+        name: SECRET.into(),
+        kind: DriveEntryKind::File,
+        last_mutation_id: "old-request".into(),
+        size: Some(5),
+        content_type: Some("text/plain".into()),
+        updated_by: SECRET.into(),
+        updated_at: SECRET.into(),
+        latest_url: SECRET.into(),
+    }
+}
+fn mutation() -> DriveMutationRequest {
+    DriveMutationRequest {
+        request_id: ID.into(),
+        mutation: DriveMutation::UpdateText {
+            id: entry().entry,
+            expected_mutation_id: "old-request".into(),
+            text: SECRET.into(),
+            content_type: "text/plain".into(),
+        },
+    }
+}
+fn json(value: impl Serialize) -> WorkspaceResponse {
+    WorkspaceResponse {
+        status: 200,
+        body: serde_json::to_string(&value).unwrap(),
+    }
+}
+#[derive(Clone, Copy, Debug)]
+enum Fault {
+    Communication,
+    Unavailable,
+    InvalidPath,
+    Decode,
+    Size,
+    Length,
+    Identity,
+    Metadata,
+    Rejected,
+    Unknown,
+    Unrecognized,
+    Incomplete,
+    Panic,
+    Deadline,
+    None,
+}
+#[derive(Debug, Default)]
+struct State {
+    mutations: usize,
+    saved: Option<String>,
+    requests: Vec<WorkspaceRequest>,
+    binary: Vec<WorkspaceBinaryRequest>,
+    released: bool,
+    started: bool,
+    finished: bool,
+}
+#[derive(Debug)]
+struct Client {
+    fault: Fault,
+    receipt: Fault,
+    state: Mutex<State>,
+    changed: Condvar,
+    started: tokio::sync::Notify,
+}
+impl Client {
+    fn new(fault: Fault, receipt: Fault) -> Arc<Self> {
+        Arc::new(Self {
+            fault,
+            receipt,
+            state: Mutex::new(State::default()),
+            changed: Condvar::new(),
+            started: tokio::sync::Notify::new(),
+        })
+    }
+    fn fail(
+        &self,
+        fault: Fault,
+        success: WorkspaceResponse,
+    ) -> Result<WorkspaceResponse, WorkspaceClientError> {
+        match fault {
+            Fault::Communication => Err(WorkspaceClientError::Request(SECRET.into())),
+            Fault::Unavailable => Err(WorkspaceClientError::Unavailable(SECRET.into())),
+            Fault::InvalidPath => Err(WorkspaceClientError::InvalidPath(SECRET.into())),
+            Fault::Panic => panic!("injected adapter task panic"),
+            Fault::Decode => Ok(WorkspaceResponse {
+                status: 200,
+                body: SECRET.into(),
+            }),
+            Fault::Size => Ok(WorkspaceResponse {
+                status: 200,
+                body: SECRET.repeat(RESPONSE_LIMIT / SECRET.len() + 1),
+            }),
+            Fault::Rejected | Fault::Unknown => Ok(WorkspaceResponse {
+                status: 409,
+                body: serde_json::to_string(&DriveApiError {
+                    code: DriveApiErrorCode::Conflict,
+                    message: SECRET.into(),
+                    classification: if matches!(fault, Fault::Unknown) {
+                        DriveFailureClassification::Unknown
+                    } else {
+                        DriveFailureClassification::NotCommitted
+                    },
+                })
+                .unwrap(),
+            }),
+            Fault::Unrecognized => Ok(WorkspaceResponse {
+                status: 503,
+                body: SECRET.into(),
+            }),
+            _ => Ok(success),
+        }
+    }
+    fn release(&self) {
+        self.state.lock().unwrap().released = true;
+        self.changed.notify_all();
+    }
+    fn wait(&self, finished: bool) {
+        let (state, timeout) = self
+            .changed
+            .wait_timeout_while(self.state.lock().unwrap(), Duration::from_secs(5), |s| {
+                if finished { !s.finished } else { !s.started }
+            })
+            .unwrap();
+        assert!(!timeout.timed_out());
+        assert!(if finished {
+            state.finished
+        } else {
+            state.started
+        });
+    }
+}
+struct Release(Arc<Client>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        self.0.release();
+    }
+}
+impl WorkspaceClient for Client {
+    fn workspace_id(&self) -> Option<&str> {
+        Some("workspace")
+    }
+    fn kind(&self) -> &str {
+        "drive-diagnostic-fixture"
+    }
+    fn is_available(&self) -> bool {
+        true
+    }
+    fn execute(
+        &self,
+        request: WorkspaceRequest,
+    ) -> Result<WorkspaceResponse, WorkspaceClientError> {
+        let is_status = request.path.contains("/requests/");
+        let fault = if is_status { self.receipt } else { self.fault };
+        let mutation = request.method == WorkspaceRequestMethod::Post;
+        {
+            let mut state = self.state.lock().unwrap();
+            if mutation
+                && !matches!(
+                    fault,
+                    Fault::Rejected | Fault::InvalidPath | Fault::Unavailable
+                )
+            {
+                let input: DriveMutationRequest =
+                    serde_json::from_str(request.body.as_ref().unwrap()).unwrap();
+                assert_eq!(input, super::tests::mutation());
+                state.mutations += 1;
+                if let DriveMutation::UpdateText { text, .. } = input.mutation {
+                    state.saved = Some(text);
+                }
+            }
+            state.requests.push(request);
+            state.started = true;
+            self.started.notify_one();
+            self.changed.notify_all();
+            if matches!(fault, Fault::Deadline) {
+                let (_state, timeout) = self
+                    .changed
+                    .wait_timeout_while(state, Duration::from_secs(5), |s| !s.released)
+                    .unwrap();
+                assert!(
+                    !timeout.timed_out(),
+                    "transport must be explicitly released"
+                );
+            }
+        }
+        let mut metadata = entry();
+        if matches!(fault, Fault::Identity) {
+            metadata.entry.node_id = "3".into();
+        }
+        if matches!(fault, Fault::Metadata) {
+            metadata.size = Some(DRIVE_FILE_MAX_BYTES + 1);
+        }
+        let completion = DriveMutationResponse {
+            request_id: if matches!(fault, Fault::Identity) {
+                "other-request"
+            } else {
+                ID
+            }
+            .into(),
+            entry: Some(metadata.clone()),
+        };
+        let value = if is_status {
+            json(DriveRequestStatusResponse {
+                request_id: if matches!(fault, Fault::Identity) {
+                    "other-request"
+                } else {
+                    ID
+                }
+                .into(),
+                state: if matches!(
+                    fault,
+                    Fault::None | Fault::Identity | Fault::Metadata | Fault::Incomplete
+                ) {
+                    DriveRequestState::Committed
+                } else {
+                    DriveRequestState::Uncommitted
+                },
+                response: if matches!(fault, Fault::None | Fault::Identity | Fault::Metadata) {
+                    Some(completion)
+                } else {
+                    None
+                },
+            })
+        } else if mutation {
+            json(completion)
+        } else {
+            json(metadata)
+        };
+        if !is_status {
+            self.state.lock().unwrap().finished = true;
+        }
+        self.changed.notify_all();
+        self.fail(fault, value)
+    }
+    fn execute_binary(
+        &self,
+        request: WorkspaceBinaryRequest,
+    ) -> Result<WorkspaceBinaryResponse, WorkspaceClientError> {
+        let upload = request.method == WorkspaceRequestMethod::Put;
+        {
+            let mut state = self.state.lock().unwrap();
+            if upload {
+                state.mutations += 1;
+                state.saved = Some(SECRET.into());
+            }
+            state.binary.push(request);
+        }
+        let success = if upload {
+            json(DriveMutationResponse {
+                request_id: ID.into(),
+                entry: Some(entry()),
+            })
+        } else {
+            WorkspaceResponse {
+                status: 200,
+                body: if matches!(self.fault, Fault::Length) {
+                    "x"
+                } else {
+                    "12345"
+                }
+                .into(),
+            }
+        };
+        self.fail(self.fault, success)
+            .map(|r| WorkspaceBinaryResponse {
+                status: r.status,
+                body: r.body.into_bytes(),
+            })
+    }
+}
+fn safe(capture: &Capture, reason: Reason, public: &str) {
+    let text = capture.text();
+    assert!(text.contains(&format!("reason={reason:?}")), "{text}");
+    assert!(text.contains("adapter=Drive"), "{text}");
+    assert!(text.contains("correlation="), "{text}");
+    for secret in [
+        SECRET,
+        "secret-token",
+        "/private/drive",
+        "credential=unsafe",
+    ] {
+        assert!(!text.contains(secret), "internal diagnostic leaked content");
+        assert!(!public.contains(secret), "public error leaked content");
+    }
+}
+fn reason(fault: Fault) -> Reason {
+    match fault {
+        Fault::Communication => Reason::Communication,
+        Fault::Unavailable => Reason::TransportUnavailable,
+        Fault::InvalidPath => Reason::InvalidPath,
+        Fault::Decode => Reason::Decode,
+        Fault::Size => Reason::ResponseSize,
+        Fault::Length => Reason::ResponseLength,
+        Fault::Identity => Reason::Identity,
+        Fault::Metadata => Reason::InvalidMetadata,
+        Fault::Rejected => Reason::BackendRejected,
+        Fault::Unknown => Reason::BackendUnknown,
+        Fault::Unrecognized => Reason::UnrecognizedResponse,
+        Fault::Panic => Reason::TaskJoin,
+        Fault::Deadline => Reason::Deadline,
+        Fault::Incomplete => Reason::IncompleteReceipt,
+        Fault::None => panic!("no fault"),
+    }
+}
+#[tokio::test]
+async fn production_read_failures_retain_public_classification_and_safe_cause() {
+    for fault in [
+        Fault::Communication,
+        Fault::Unavailable,
+        Fault::InvalidPath,
+        Fault::Decode,
+        Fault::Size,
+        Fault::Identity,
+        Fault::Metadata,
+        Fault::Rejected,
+        Fault::Unknown,
+        Fault::Unrecognized,
+        Fault::Panic,
+    ] {
+        let client = Client::new(fault, Fault::None);
+        let backend = DriveBackend::new(client.clone());
+        let capture = Capture::default();
+        let error = backend
+            .metadata(&entry().entry)
+            .with_subscriber(capture.dispatch())
+            .await
+            .unwrap_err();
+        match fault {
+            Fault::Size => assert!(matches!(error, DriveError::Limit)),
+            Fault::Rejected => assert!(matches!(error, DriveError::Conflict)),
+            Fault::Unknown => assert!(matches!(error, DriveError::OutcomeUnknown(_))),
+            _ => assert!(matches!(error, DriveError::Unavailable)),
+        }
+        safe(&capture, reason(fault), &error.to_string());
+        let state = client.state.lock().unwrap();
+        assert_eq!(state.requests.len(), 1);
+        assert_eq!(state.mutations, 0);
+    }
+}
+#[tokio::test]
+async fn production_mutation_loss_reconciles_only_original_identity_and_never_resends() {
+    for fault in [
+        Fault::Communication,
+        Fault::Decode,
+        Fault::Size,
+        Fault::Identity,
+        Fault::Metadata,
+        Fault::Unknown,
+        Fault::Unrecognized,
+        Fault::Panic,
+    ] {
+        for receipt in [
+            Fault::None,
+            Fault::Identity,
+            Fault::Metadata,
+            Fault::Decode,
+            Fault::Communication,
+            Fault::Unrecognized,
+            Fault::Length,
+            Fault::Incomplete,
+        ] {
+            let client = Client::new(fault, receipt);
+            let backend = DriveBackend::new(client.clone());
+            let capture = Capture::default();
+            let result = backend
+                .mutate(mutation())
+                .with_subscriber(capture.dispatch())
+                .await;
+            if matches!(receipt, Fault::None) {
+                assert_eq!(result.unwrap().request_id, ID);
+            } else {
+                assert!(matches!(result, Err(DriveError::OutcomeUnknown(ref id)) if id == ID));
+            }
+            safe(&capture, reason(fault), "");
+            let text = capture.text();
+            if matches!(receipt, Fault::Length | Fault::Incomplete) {
+                safe(
+                    &capture,
+                    if matches!(receipt, Fault::Length) {
+                        Reason::NotCommittedSnapshot
+                    } else {
+                        Reason::IncompleteReceipt
+                    },
+                    "",
+                );
+            }
+            assert!(text.contains("stage=Reconcile"), "{text}");
+            let correlations: std::collections::BTreeSet<_> = text
+                .lines()
+                .filter_map(|l| l.split("correlation=").nth(1))
+                .filter_map(|l| l.split(';').next())
+                .collect();
+            assert_eq!(
+                correlations.len(),
+                1,
+                "original loss and inquiry must correlate"
+            );
+            assert!(
+                !text.contains(ID),
+                "request identity must be opaque in logs"
+            );
+            let state = client.state.lock().unwrap();
+            assert_eq!(state.mutations, 1);
+            assert_eq!(state.saved.as_deref(), Some(SECRET));
+            assert_eq!(state.requests.len(), 2);
+            assert_eq!(state.requests[1].method, WorkspaceRequestMethod::Get);
+            assert!(state.requests[1].path.ends_with(&format!("/requests/{ID}")));
+        }
+    }
+}
+#[tokio::test]
+async fn production_rejection_has_no_effect_or_status_inquiry() {
+    let client = Client::new(Fault::Rejected, Fault::None);
+    let backend = DriveBackend::new(client.clone());
+    let capture = Capture::default();
+    let error = backend
+        .mutate(mutation())
+        .with_subscriber(capture.dispatch())
+        .await
+        .unwrap_err();
+    assert!(matches!(error, DriveError::Conflict));
+    safe(&capture, Reason::BackendRejected, &error.to_string());
+    let state = client.state.lock().unwrap();
+    assert_eq!(state.mutations, 0);
+    assert_eq!(state.requests.len(), 1);
+}
+#[tokio::test]
+async fn production_binary_length_transport_and_upload_loss_are_diagnosed() {
+    for fault in [
+        Fault::Length,
+        Fault::Communication,
+        Fault::Unavailable,
+        Fault::Panic,
+    ] {
+        let client = Client::new(fault, Fault::None);
+        let backend = DriveBackend::new(client.clone());
+        let capture = Capture::default();
+        let error = backend
+            .bytes(&entry(), 5)
+            .with_subscriber(capture.dispatch())
+            .await
+            .unwrap_err();
+        assert!(matches!(error, DriveError::Unavailable));
+        safe(&capture, reason(fault), &error.to_string());
+        assert_eq!(client.state.lock().unwrap().binary.len(), 1);
+    }
+    for fault in [Fault::Decode, Fault::Communication, Fault::Size] {
+        let client = Client::new(fault, Fault::Unrecognized);
+        let backend = DriveBackend::new(client.clone());
+        let capture = Capture::default();
+        let query = DriveUploadQuery {
+            operation: DriveUploadOperation::Update,
+            request_id: ID.into(),
+            entry_workspace_id: "workspace".into(),
+            parent_id: None,
+            name: None,
+            id: Some("2".into()),
+            expected_mutation_id: Some("old-request".into()),
+            content_type: "text/plain".into(),
+            size: 5,
+            sha256: "hash".into(),
+        };
+        let error = backend
+            .upload(query, b"12345".to_vec())
+            .with_subscriber(capture.dispatch())
+            .await
+            .unwrap_err();
+        assert!(matches!(error, DriveError::OutcomeUnknown(ref id) if id == ID));
+        safe(&capture, reason(fault), &error.to_string());
+        let state = client.state.lock().unwrap();
+        assert_eq!(state.mutations, 1);
+        assert_eq!(state.binary.len(), 1);
+        assert_eq!(state.requests.len(), 1);
+        assert!(state.requests[0].path.ends_with(&format!("/requests/{ID}")));
+    }
+}
+#[tokio::test]
+async fn production_deadline_does_not_cancel_effect_or_infer_uncommitted_from_snapshot() {
+    for mutation_call in [false, true] {
+        let client = Client::new(Fault::Deadline, Fault::Unrecognized);
+        let release = Release(client.clone());
+        let mut backend = DriveBackend::new(client.clone());
+        backend.deadline = Duration::from_secs(1);
+        let capture = Capture::default();
+        let request = async {
+            if mutation_call {
+                backend.mutate(mutation()).await.map(|_| ())
+            } else {
+                backend.metadata(&entry().entry).await.map(|_| ())
+            }
+        }
+        .with_subscriber(capture.dispatch());
+        tokio::pin!(request);
+        tokio::select! {
+            biased;
+            _ = client.started.notified() => {},
+            _ = &mut request => panic!("request must start before timeout"),
+        }
+        {
+            let state = client.state.lock().unwrap();
+            assert_eq!(state.mutations, usize::from(mutation_call));
+            assert!(!state.released && !state.finished);
+        }
+        let result = request.await;
+        let error = result.unwrap_err();
+        assert!(if mutation_call {
+            matches!(error, DriveError::OutcomeUnknown(ref id) if id == ID)
+        } else {
+            matches!(error, DriveError::Unavailable)
+        });
+        safe(&capture, Reason::Deadline, &error.to_string());
+        drop(release);
+        let waiting = client.clone();
+        tokio::task::spawn_blocking(move || waiting.wait(true))
+            .await
+            .unwrap();
+        let state = client.state.lock().unwrap();
+        assert_eq!(state.mutations, usize::from(mutation_call));
+        assert_eq!(state.saved.is_some(), mutation_call);
+        assert_eq!(state.requests.len(), if mutation_call { 2 } else { 1 });
+    }
+}
+
+#[tokio::test]
+async fn http_reply_loss_keeps_original_receipt_and_retained_effect_without_reexecution() {
+    use axum::{
+        Router,
+        extract::State as HttpState,
+        routing::{get, post},
+    };
+    #[derive(Default)]
+    struct Stored {
+        updates: usize,
+        content: String,
+        ids: Vec<String>,
+    }
+    struct Server(tokio::task::JoinHandle<()>);
+    impl Drop for Server {
+        fn drop(&mut self) {
+            self.0.abort();
+        }
+    }
+    let stored = Arc::new(Mutex::new(Stored::default()));
+    let router = Router::new()
+        .route("/api/w/workspace/drive/metadata", get(|| async { SECRET }))
+        .route(
+            "/api/w/workspace/drive/mutate",
+            post(
+                |HttpState(state): HttpState<Arc<Mutex<Stored>>>,
+                 body: axum::body::Bytes| async move {
+                    let request: DriveMutationRequest = serde_json::from_slice(&body).unwrap();
+                    let mut state = state.lock().unwrap();
+                    state.ids.push(request.request_id);
+                    if let DriveMutation::UpdateText {
+                        text,
+                        expected_mutation_id,
+                        ..
+                    } = request.mutation
+                    {
+                        assert_eq!(expected_mutation_id, "old-request");
+                        state.content = text;
+                        state.updates += 1;
+                    } else {
+                        panic!("unexpected mutation");
+                    }
+                    // The effect is retained; only the success response is malformed.
+                    SECRET
+                },
+            ),
+        )
+        .route(
+            "/api/w/workspace/drive/requests/{id}",
+            get(
+                |HttpState(state): HttpState<Arc<Mutex<Stored>>>,
+                 axum::extract::Path(id): axum::extract::Path<String>| async move {
+                    let state = state.lock().unwrap();
+                    assert_eq!(state.ids, [id.clone()]);
+                    axum::Json(DriveRequestStatusResponse {
+                        request_id: id.clone(),
+                        state: DriveRequestState::Committed,
+                        response: Some(DriveMutationResponse {
+                            request_id: id,
+                            entry: Some(entry()),
+                        }),
+                    })
+                },
+            ),
+        )
+        .with_state(stored.clone());
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    let server = Server(tokio::spawn(async move {
+        axum::serve(listener, router).await.unwrap();
+    }));
+    let client = Arc::new(crate::worker::TestWorkspaceHttpClient::new(
+        "workspace",
+        format!("http://{address}"),
+    ));
+    let backend = DriveBackend::new(client);
+    let capture = Capture::default();
+    let error = backend
+        .metadata(&entry().entry)
+        .with_subscriber(capture.dispatch())
+        .await
+        .unwrap_err();
+    assert!(matches!(error, DriveError::Unavailable));
+    safe(&capture, Reason::Decode, &error.to_string());
+    let capture = Capture::default();
+    let response = backend
+        .mutate(mutation())
+        .with_subscriber(capture.dispatch())
+        .await
+        .unwrap();
+    assert_eq!(response.request_id, ID);
+    safe(&capture, Reason::Decode, "");
+    assert!(capture.text().contains("reason=Reconciled"));
+    let state = stored.lock().unwrap();
+    assert_eq!(state.updates, 1);
+    assert_eq!(state.content, SECRET);
+    assert_eq!(state.ids, [ID]);
+    drop(state);
+    drop(server);
+}

crates/worker/src/feature/builtin/flow_transition.rs

@@ -26,7 +26,7 @@ use flow::{
 use manifest::{Scope, WorkerManifest};
 use schemars::JsonSchema;
 use serde::Deserialize;
-use session_store::{SegmentId, SessionId, Store, collect_state};
+use session_store::{SegmentId, SessionId, Store};
 use uuid::Uuid;
 
 use crate::feature::builtin::session_explore::{SessionExploreFeature, SessionExploreState};
@@ -469,10 +469,15 @@ where
             .store
             .read_all(self.session_id, self.segment_id)
             .map_err(|error| format!("read committed parent session: {error}"))?;
-        let restored = collect_state(&entries);
-        Ok(SessionCapture::new(
+        let history = crate::session_history::restore_history_entries(
+            self.session_id,
+            self.segment_id,
+            &entries,
+        )?;
+        Ok(SessionCapture::from_complete_history(
+            self.session_id.to_string(),
             self.segment_id.to_string(),
-            restored.history,
+            history,
         ))
     }
 }

crates/worker/src/feature/builtin/journal.rs

@@ -59,6 +59,53 @@ impl JournalReadStatus {
     }
 }
 
+// Only bounded classifications cross into diagnostics. Host messages/codes and
+// io::Error payloads can contain Journal text, credentials, proofs or host paths.
+// These diagnostics belong to the Feature, not persisted/model-visible input.
+enum JournalCompactionFailure {
+    Connection(std::io::ErrorKind),
+    SnapshotConflict,
+    SnapshotInvalidArgument,
+    SnapshotUnavailable,
+    Serialization,
+    ByteBudget,
+}
+
+impl JournalCompactionFailure {
+    fn snapshot(error: SubjektivHostError) -> Self {
+        match error {
+            SubjektivHostError::Conflict { .. } => Self::SnapshotConflict,
+            SubjektivHostError::InvalidArgument(_) => Self::SnapshotInvalidArgument,
+            SubjektivHostError::Unavailable(_) => Self::SnapshotUnavailable,
+        }
+    }
+
+    fn stage(&self) -> &'static str {
+        match self {
+            Self::Connection(_) => "connection",
+            Self::SnapshotConflict | Self::SnapshotInvalidArgument | Self::SnapshotUnavailable => {
+                "snapshot"
+            }
+            Self::Serialization => "serialization",
+            Self::ByteBudget => "byte_budget",
+        }
+    }
+
+    fn reason(&self) -> &'static str {
+        match self {
+            Self::Connection(std::io::ErrorKind::PermissionDenied) => "permission_denied",
+            Self::Connection(std::io::ErrorKind::InvalidInput) => "invalid_input",
+            Self::Connection(std::io::ErrorKind::NotConnected) => "not_connected",
+            Self::Connection(_) => "io_error",
+            Self::SnapshotConflict => "host_conflict",
+            Self::SnapshotInvalidArgument => "host_invalid_argument",
+            Self::SnapshotUnavailable => "host_unavailable",
+            Self::Serialization => "json_serialization_failed",
+            Self::ByteBudget => "startup_max_bytes_exceeded",
+        }
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct JournalCompactionInput {
@@ -203,33 +250,46 @@ pub(crate) fn freeze_compaction_journal(
             .and_then(|connection| connection.host.workspace_id())
     });
     let read = match connection {
-        Ok(Some(connection)) if connection.host.journal_compaction_granted() => {
-            Some(connection.journal_compaction_context().map_err(|_| ()))
-        }
+        Ok(Some(connection)) if connection.host.journal_compaction_granted() => Some(
+            connection
+                .journal_compaction_context()
+                .map_err(JournalCompactionFailure::snapshot),
+        ),
         Ok(_) => None,
-        Err(_) => Some(Err(())),
+        Err(error) => Some(Err(JournalCompactionFailure::Connection(error.kind()))),
     };
     let snapshot = read.as_ref().and_then(|read| read.as_ref().ok()).cloned();
-    let (status, json) = match read {
-        None => (Disabled, String::new()),
+    let prepared = match read {
+        None => Ok((Disabled, String::new())),
         Some(Ok(snapshot)) => {
             let status = if snapshot.journals.is_empty() {
                 Absent
             } else {
                 Available
             };
-            match serde_json::to_string(&snapshot) {
-                Ok(json) if json.len() <= subjektiv::journal::startup::STARTUP_MAX_BYTES => {
-                    (status, json)
-                }
-                _ => (Unavailable, String::new()),
-            }
+            // The current snapshot has only derived, JSON-safe fields (strings,
+            // integers, vectors, enums and a UUID). There is no known serialization
+            // failure fixture; retain this guard if the domain type changes.
+            serde_json::to_string(&snapshot)
+                .map_err(|_| JournalCompactionFailure::Serialization)
+                .and_then(|json| {
+                    if json.len() <= subjektiv::journal::startup::STARTUP_MAX_BYTES {
+                        Ok((status, json))
+                    } else {
+                        Err(JournalCompactionFailure::ByteBudget)
+                    }
+                })
         }
-        Some(Err(())) => (Unavailable, String::new()),
+        Some(Err(failure)) => Err(failure),
     };
-    if status == Unavailable {
-        tracing::warn!("Journal compaction snapshot unavailable; continuing without Journal");
-    }
+    let (status, json) = prepared.unwrap_or_else(|failure| {
+        tracing::warn!(
+            stage = failure.stage(),
+            reason = failure.reason(),
+            "Journal compaction snapshot unavailable; continuing without Journal"
+        );
+        (Unavailable, String::new())
+    });
     use sha2::{Digest, Sha256};
     let snapshot_sha256: Option<String> = (!json.is_empty()).then(|| {
         Sha256::digest(json.as_bytes())
@@ -726,12 +786,72 @@ fn tool_schema(name: &str) -> Value {
     }
 }
 
+#[cfg(test)]
+#[path = "../../../tests/common/diagnostics.rs"]
+mod diagnostic_test_support;
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use std::sync::Mutex;
     use subjektiv::journal::JournalReceipt;
 
+    #[test]
+    fn compaction_connection_failure_keeps_safe_reason_without_exposing_error_or_changing_input() {
+        let prompts = crate::prompt::catalog::PromptCatalog::builtins_only().unwrap();
+        for (kind, reason) in [
+            (std::io::ErrorKind::PermissionDenied, "permission_denied"),
+            (std::io::ErrorKind::InvalidInput, "invalid_input"),
+            (std::io::ErrorKind::NotConnected, "not_connected"),
+            (std::io::ErrorKind::Other, "io_error"),
+        ] {
+            let logs = diagnostic_test_support::CapturedWarnings::default();
+            let input = tracing::subscriber::with_default(logs.subscriber(), || {
+                freeze_compaction_journal(
+                    Err(std::io::Error::new(
+                        kind,
+                        "PRIVATE_JOURNAL_BODY /private/host/path proof=PRIVATE_PROOF credential=PRIVATE_CREDENTIAL raw_error=PRIVATE_ERROR",
+                    )),
+                    &prompts,
+                )
+                .unwrap()
+            });
+            let log = logs.text();
+            assert!(log.contains("stage=\"connection\""), "{log}");
+            assert!(log.contains(&format!("reason=\"{reason}\"")), "{log}");
+            assert_eq!(log.matches("continuing without Journal").count(), 1);
+            assert!(!log.contains("PRIVATE_"));
+            assert!(!log.contains("/private/host/path"));
+            assert!(input.body().contains("Journal read status: unavailable."));
+            let persisted = serde_json::to_string(&input).unwrap();
+            assert!(!persisted.contains("PRIVATE_"));
+            assert!(!persisted.contains("/private/host/path"));
+            assert!(!persisted.contains(reason));
+            let payload: JournalCompactionInput = input
+                .metadata()
+                .feature_payload()
+                .unwrap()
+                .decode("journal:compaction", 1)
+                .unwrap();
+            assert!(payload.snapshot.is_none());
+            assert!(payload.snapshot_sha256.is_none());
+            assert_eq!(
+                payload.prompt_provenance.source_digest,
+                prompts.projection().source_digest
+            );
+            assert_eq!(
+                payload.prompt_provenance.projection_digest,
+                prompts.projection().catalog_digest
+            );
+        }
+        let logs = diagnostic_test_support::CapturedWarnings::default();
+        let input = tracing::subscriber::with_default(logs.subscriber(), || {
+            freeze_compaction_journal(Ok(None), &prompts).unwrap()
+        });
+        assert!(input.body().contains("Journal read status: disabled."));
+        assert!(logs.text().is_empty());
+    }
+
     #[derive(Default)]
     struct Host {
         requests: Mutex<Vec<JournalJobRequest>>,

crates/worker/src/feature/builtin/manage_workdir.rs

@@ -226,6 +226,7 @@ pub struct WorkspaceAttachedWorkdirSession {
     target_workdir: String,
     workdir: Workdir,
     capabilities: WorkdirSessionCapabilities,
+    environment: workdir::WorkdirSessionEnvironment,
 }
 
 impl WorkspaceAttachedWorkdirSession {
@@ -249,17 +250,38 @@ impl WorkspaceAttachedWorkdirSession {
         )
     }
 
+    /// Bind a known root-coordinate attachment. Opened provider sessions must
+    /// instead pass their metadata to [`Self::handle_for_workdir_with_environment`].
     pub fn handle_for_workdir_with_capabilities(
         client: Arc<dyn WorkspaceClient>,
         target_workdir: impl Into<String>,
         workdir_id: impl Into<String>,
         capabilities: WorkdirSessionCapabilities,
+    ) -> WorkdirSessionHandle {
+        Self::handle_for_workdir_with_environment(
+            client,
+            target_workdir,
+            workdir_id,
+            capabilities,
+            workdir::WorkdirSessionEnvironment::root(capabilities),
+        )
+    }
+
+    /// Bind provider-authored coordinates without allowing metadata to expand
+    /// the Backend attachment capability ceiling.
+    pub fn handle_for_workdir_with_environment(
+        client: Arc<dyn WorkspaceClient>,
+        target_workdir: impl Into<String>,
+        workdir_id: impl Into<String>,
+        capabilities: WorkdirSessionCapabilities,
+        environment: workdir::WorkdirSessionEnvironment,
     ) -> WorkdirSessionHandle {
         Arc::new(Self {
             client,
             target_workdir: target_workdir.into(),
             workdir: Workdir::new(workdir_id),
-            capabilities,
+            capabilities: capabilities.intersection(environment.capabilities),
+            environment,
         })
     }
 
@@ -291,6 +313,11 @@ impl WorkspaceAttachedWorkdirSession {
             .execute(request)
             .map_err(workspace_workdir_error)?;
         if !response.is_success() {
+            if let Ok(error) =
+                serde_json::from_str::<server_api::WorkdirOperationApiError>(&response.body)
+            {
+                notify_workdir_audit_failures(&error.audit_failures);
+            }
             return Err(
                 serde_json::from_str::<workdir::http::WorkdirTransportError>(&response.body)
                     .map(workdir::http::WorkdirTransportError::into_workdir_error)
@@ -302,11 +329,14 @@ impl WorkspaceAttachedWorkdirSession {
                     }),
             );
         }
-        serde_json::from_str(&response.body).map_err(|error| {
-            WorkdirError::Transport(format!(
-                "failed to decode Workspace Workdir operation result: {error}"
-            ))
-        })
+        let response: workdir::http::WorkdirSessionOperationResponse =
+            serde_json::from_str(&response.body).map_err(|_| {
+                WorkdirError::Transport(
+                    "failed to decode Workspace Workdir operation result".into(),
+                )
+            })?;
+        notify_workdir_audit_failures(&response.audit_failures);
+        Ok(response.result)
     }
 
     fn mismatch(expected: &str) -> WorkdirError {
@@ -316,6 +346,27 @@ impl WorkspaceAttachedWorkdirSession {
     }
 }
 
+// Notification is separate from the operation return: callers retain successful command
+// handles, checkout observations and original failures, and must not resend for audit loss.
+fn notify_workdir_audit_failures(failures: &[workdir::http::WorkdirAuditFailure]) {
+    use sha2::Digest;
+    for failure in failures {
+        // Response strings are untrusted. Never copy them into the receiving process log.
+        let operation_id_hash = sha2::Sha256::digest(failure.operation_id.as_bytes())
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect::<String>();
+        tracing::error!(
+            event = "external_workdir_audit_failed",
+            operation_id_hash,
+            audit_stage = ?failure.stage,
+            audit_reason = ?failure.reason,
+            operation_outcome = ?failure.operation_outcome,
+            "External Workdir audit persistence failed; operation result is independent; do not resend"
+        );
+    }
+}
+
 fn workspace_workdir_error(error: WorkspaceClientError) -> WorkdirError {
     match error {
         WorkspaceClientError::Unavailable(message) => WorkdirError::Unavailable(message),
@@ -333,6 +384,12 @@ impl WorkdirSession for WorkspaceAttachedWorkdirSession {
         self.capabilities
     }
 
+    fn environment(&self) -> workdir::WorkdirSessionEnvironment {
+        let mut environment = self.environment.clone();
+        environment.capabilities = environment.capabilities.intersection(self.capabilities());
+        environment
+    }
+
     async fn authorize_scope_path(
         &self,
         request: WorkdirScopeAuthorizationRequest,
@@ -409,10 +466,20 @@ impl WorkdirSession for WorkspaceAttachedWorkdirSession {
                 "mismatched checkout mutation response".into(),
             )),
             Ok(_) => Err(Self::mismatch("checkout_execute")),
-            Err(WorkdirError::Transport(_) | WorkdirError::Unavailable(_)) if mutation => {
-                Err(WorkdirError::OutcomeUnknown(
+            Err(error)
+                if mutation
+                    && matches!(
+                        error.classification_source(),
+                        WorkdirError::Transport(_) | WorkdirError::Unavailable(_)
+                    ) =>
+            {
+                let outcome = WorkdirError::OutcomeUnknown(
                     "checkout mutation response lost; inspect effects before retry".into(),
-                ))
+                );
+                Err(match error.failure_reason() {
+                    Some(reason) => outcome.with_failure_reason(reason),
+                    None => outcome,
+                })
             }
             Err(error) => Err(error),
         }
@@ -645,11 +712,12 @@ impl WorkspaceHttpWorkdirBackend {
         let response = self.attach_response(alias, working_directory_id)?;
         if let Err(error) = self.session_router.attach(
             alias_key.clone(),
-            WorkspaceAttachedWorkdirSession::handle_for_workdir_with_capabilities(
+            WorkspaceAttachedWorkdirSession::handle_for_workdir_with_environment(
                 self.client.clone(),
                 alias,
                 working_directory_id,
-                response.capabilities,
+                response.attachment.capabilities,
+                response.environment.clone(),
             ),
         ) {
             let _ = self.detach(alias);
@@ -667,9 +735,9 @@ impl WorkspaceHttpWorkdirBackend {
         &self,
         alias: &str,
         working_directory_id: &str,
-    ) -> Result<WorkdirAttachmentResponse, ToolError> {
+    ) -> Result<WorkdirSessionAttachmentResponse, ToolError> {
         let workspace_id = encode_path_segment(self.workspace_id()?);
-        self.execute_json::<WorkdirAttachmentResponse>(WorkspaceRequest::json(
+        self.execute_json::<WorkdirSessionAttachmentResponse>(WorkspaceRequest::json(
             WorkspaceRequestMethod::Post,
             format!("/api/w/{workspace_id}/workers/self/workdir-attachments"),
             serde_json::to_string(&WorkdirAttachRequest {
@@ -1153,6 +1221,13 @@ struct WorkdirAttachmentResponse {
     attached: bool,
 }
 
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+struct WorkdirSessionAttachmentResponse {
+    #[serde(flatten)]
+    attachment: WorkdirAttachmentResponse,
+    environment: workdir::WorkdirSessionEnvironment,
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct WorkdirDeleteInput {
@@ -1230,6 +1305,7 @@ mod tests {
         WorkspaceResponse {
             status,
             body: serde_json::to_string(&workdir::http::WorkdirTransportError {
+                failure_reason: None,
                 denial_reason: None,
                 code,
                 message: message.to_string(),
@@ -1462,6 +1538,7 @@ mod tests {
                 "alias": "checkout",
                 "working_directory_id": "wd-created",
                 "capabilities": {"bits": 63},
+                "environment": workdir::WorkdirSessionEnvironment::root(WorkdirSessionCapabilities::ALL),
                 "attached": true
             })),
             response(json!({
@@ -1642,6 +1719,67 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn attached_session_keeps_operation_results_when_audit_persistence_failed() {
+        let failure = json!({
+            "operation_id":"op-safe-id", "stage":"response_received",
+            "reason":"audit_store_unavailable", "operation_outcome":{"kind":"succeeded"}
+        });
+        let mut responses = vec![response(json!({
+            "operation":"command_start", "result":"retained-command",
+            "audit_failures":[failure]
+        }))];
+        for (code, status, outcome) in [
+            ("denied", 403, json!({"kind":"failed","code":"denied"})),
+            ("outcome_unknown", 500, json!({"kind":"unknown"})),
+            ("not_dispatched", 503, json!({"kind":"not_dispatched"})),
+        ] {
+            let mut failure = failure.clone();
+            failure["operation_outcome"] = outcome;
+            responses.push(WorkspaceResponse { status, body: json!({
+                "code":code, "message":"safe provider classification", "audit_failures":[failure]
+            }).to_string() });
+        }
+        let client = Arc::new(RecordingWorkspaceClient::new(responses));
+        let session = WorkspaceAttachedWorkdirSession::handle(client.clone(), "checkout");
+        let handle = session
+            .start_command(CommandRequest {
+                command: "true".into(),
+                timeout_secs: 1,
+                transport_byte_budget: workdir::MAX_COMMAND_TRANSPORT_BYTES,
+                cwd: workdir::WorkdirPath::root(),
+                tool_call_id: None,
+            })
+            .await
+            .unwrap();
+        assert_eq!(handle.0, "retained-command");
+        let request = workdir::CheckoutRequest {
+            target: workdir::WorkdirPath::new("file.txt").unwrap(),
+            validator: vec![1],
+            operation: workdir::CheckoutOperation::Write {
+                content: b"new".to_vec(),
+                expected_hash: [0; 32],
+            },
+        };
+        assert!(matches!(
+            session.checkout_execute(request.clone()).await,
+            Err(WorkdirError::Denied(_))
+        ));
+        assert!(matches!(
+            session.checkout_execute(request.clone()).await,
+            Err(WorkdirError::OutcomeUnknown(_))
+        ));
+        assert!(matches!(
+            session.checkout_execute(request).await,
+            Err(WorkdirError::NotDispatched)
+        ));
+        assert_eq!(
+            client.requests().len(),
+            4,
+            "audit loss must not trigger a resend"
+        );
+    }
+
     #[tokio::test]
     async fn attached_session_does_not_send_worker_local_bash_spill_path() {
         let client = Arc::new(RecordingWorkspaceClient::new(vec![response(json!({
@@ -1903,6 +2041,7 @@ mod tests {
                 "alias": "checkout",
                 "working_directory_id": "wd-attached",
                 "capabilities": {"bits": 63},
+                "environment": workdir::WorkdirSessionEnvironment::root(WorkdirSessionCapabilities::ALL),
                 "attached": true
             })),
             response(json!({
@@ -1962,16 +2101,29 @@ mod tests {
         );
     }
 
-    #[test]
-    fn attach_propagates_provider_read_only_capabilities_to_the_alias_session() {
+    #[tokio::test]
+    async fn attach_projects_provider_environment_without_expanding_capability_ceiling() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir(dir.path().join("src")).unwrap();
+        let provider = Arc::new(workdir::LocalWorkdirSession::materialized(
+            dir.path().to_path_buf(),
+            dir.path().to_path_buf(),
+            manifest::SharedScope::new(manifest::Scope::writable(dir.path()).unwrap()),
+            WorkdirSessionCapabilities::ALL,
+        ));
+        let broker =
+            workdir::WorkdirToolBroker::at_cwd(provider, workdir::WorkdirPath::new("src").unwrap())
+                .unwrap();
+        let mut environment = broker.tool_session().environment();
         let client = Arc::new(RecordingWorkspaceClient::new(vec![response(json!({
             "workspace_id": "workspace/test",
             "alias": "external",
             "working_directory_id": "external-workdir",
             "capabilities": {"bits": 25},
+            "environment": environment,
             "attached": true
         }))]));
-        let backend = WorkspaceHttpWorkdirBackend::new(client);
+        let backend = WorkspaceHttpWorkdirBackend::new(client.clone());
         backend
             .attach(WorkdirAttachInput {
                 alias: "external".to_string(),
@@ -1983,10 +2135,33 @@ mod tests {
             .session_router
             .session(&workdir::WorkdirAttachmentAlias::new("external").unwrap())
             .unwrap();
+        environment.capabilities = WorkdirSessionCapabilities::READ_ONLY;
+        assert_eq!(session.environment(), environment);
         assert_eq!(
             session.capabilities(),
             WorkdirSessionCapabilities::READ_ONLY
         );
+        assert!(matches!(
+            session
+                .checkout_execute(workdir::CheckoutRequest {
+                    target: workdir::WorkdirPath::root(),
+                    validator: vec![1],
+                    operation: workdir::CheckoutOperation::Create {
+                        path: workdir::WorkdirPath::new("new.txt").unwrap(),
+                        content: b"denied".to_vec(),
+                    },
+                })
+                .await,
+            Err(WorkdirError::Unsupported(
+                workdir::WorkdirSessionCapability::Write
+            ))
+        ));
+        assert_eq!(
+            client.requests().len(),
+            1,
+            "denied mutation must not reach the Backend"
+        );
+        broker.tool_session().close().await.unwrap();
     }
 
     #[tokio::test]
@@ -1996,6 +2171,7 @@ mod tests {
             "alias": "checkout",
             "working_directory_id": "wd-attached",
             "capabilities": {"bits": 63},
+            "environment": workdir::WorkdirSessionEnvironment::root(WorkdirSessionCapabilities::ALL),
             "attached": true
         }))]));
         let reopen_calls = Arc::new(AtomicUsize::new(0));

crates/worker/src/feature/builtin/manage_workdir/wip.rs

@@ -1253,7 +1253,7 @@ pub(crate) mod tests {
                     state.generation += 1;
                     let raw = json!({"alias":body["alias"], "working_directory_id":body["working_directory_id"], "connection_id":format!("connection-{}", state.generation), "capabilities":{"bits":63}});
                     state.attachments.push(raw);
-                    json!({"workspace_id":"test-workspace", "alias":body["alias"], "working_directory_id":body["working_directory_id"], "capabilities":{"bits":63}, "attached":true})
+                    json!({"workspace_id":"test-workspace", "alias":body["alias"], "working_directory_id":body["working_directory_id"], "capabilities":{"bits":63}, "environment":workdir::WorkdirSessionEnvironment::root(workdir::WorkdirSessionCapabilities::ALL), "attached":true})
                 }
                 (WorkspaceRequestMethod::Delete, p)
                     if p.starts_with("workers/self/workdir-attachments/") =>

crates/worker/src/feature/builtin/memory_lifecycle.rs

@@ -456,10 +456,13 @@ impl MemoryLifecycleTask {
                 .await;
             return Ok(());
         }
-        let view = SessionCapture::from_history_entries(
+        let view = SessionCapture::from_complete_history(
+            capture.session_id.clone(),
             capture.segment_id.clone(),
-            capture.history[history_start..history_end].to_vec(),
-        );
+            capture.history.clone(),
+        )
+        .select_order_range(history_start as u64..history_end as u64)
+        .map_err(hook_internal)?;
         let start_entry = pointer
             .as_ref()
             .map(|pointer| pointer.processed_through_entry + 1)
@@ -1556,11 +1559,14 @@ permission = "write"
     #[tokio::test]
     async fn run_committed_background_task_stages_non_empty_extraction_and_commits_pointer() {
         let source = capture(2, 250);
-        let entry_ref =
-            SessionCapture::from_history_entries(source.segment_id.clone(), source.history.clone())
-                .overview()[0]
-                .id
-                .to_string();
+        let entry_ref = SessionCapture::from_complete_history(
+            source.session_id.clone(),
+            source.segment_id.clone(),
+            source.history.clone(),
+        )
+        .overview()[0]
+            .id
+            .to_string();
         let client = ScriptClient::new(vec![
             stage_candidate_events("stage-1", &entry_ref),
             finish_events("finish-1", 1),
@@ -1606,14 +1612,102 @@ permission = "write"
         );
     }
 
+    // Real background extraction -> common fixed selection -> StageMemoryCandidate
+    // -> typed backend operation and pointer write. Only model/backend transport
+    // are replaced; the second extraction uses the first run's saved pointer.
+    #[tokio::test]
+    async fn second_extraction_preserves_original_evidence_positions_after_nonzero_pointer() {
+        let first = capture(2, 250);
+        let mut second = capture(4, 750);
+        second.history[..2].clone_from_slice(&first.history);
+        second
+            .usage_history
+            .insert(0, first.usage_history[0].clone());
+        let selected_ref =
+            crate::SessionEntryRef::from_history_entry_id(&second.history[2].annotation.entry_id)
+                .to_string();
+        let extension_writes = Arc::new(Mutex::new(Vec::new()));
+        let workspace_client = Arc::new(RecordingWorkspaceClient::default());
+        let (event_tx, _) = broadcast::channel(64);
+        run_background_task(test_task(
+            first,
+            Box::new(ScriptClient::new(vec![
+                finish_empty_events("first-empty"),
+                completed_events(),
+            ])),
+            extension_writes.clone(),
+            event_tx.clone(),
+            workspace_client.clone(),
+        ))
+        .await;
+        {
+            let writes = extension_writes.lock().unwrap();
+            assert_eq!(writes.len(), 1);
+            let pointer: memory::ExtractPointerPayload =
+                serde_json::from_value(writes[0].2.clone()).unwrap();
+            assert_eq!(pointer.processed_through_history_len, 2);
+            second
+                .extensions
+                .push((writes[0].1.clone(), writes[0].2.clone()));
+        }
+        run_background_task(test_task(
+            second,
+            Box::new(ScriptClient::new(vec![
+                stage_candidate_events("second-stage", &selected_ref),
+                finish_events("second-finish", 1),
+                completed_events(),
+            ])),
+            extension_writes.clone(),
+            event_tx,
+            workspace_client.clone(),
+        ))
+        .await;
+        let operations = workspace_client
+            .requests
+            .lock()
+            .unwrap()
+            .iter()
+            .filter_map(|request| {
+                request.body.as_deref().and_then(|body| {
+                    serde_json::from_str::<memory::backend::MemoryBackendOperation>(body).ok()
+                })
+            })
+            .filter_map(|operation| match operation {
+                memory::backend::MemoryBackendOperation::StageCandidate(operation) => {
+                    Some(operation)
+                }
+                _ => None,
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(operations.len(), 1);
+        let operation = &operations[0];
+        assert_eq!(operation.source.range, [2, 3]);
+        assert_eq!(operation.evidence[0].id, selected_ref);
+        assert_eq!(operation.evidence[0].entry_range, Some([2, 2]));
+        assert_eq!(
+            operation.source_refs[0].segment_id.as_deref(),
+            Some("segment-1")
+        );
+        assert_eq!(operation.source_refs[0].entry_range, Some([2, 2]));
+        let writes = extension_writes.lock().unwrap();
+        assert_eq!(writes.len(), 2);
+        let pointer: memory::ExtractPointerPayload =
+            serde_json::from_value(writes[1].2.clone()).unwrap();
+        assert_eq!(pointer.processed_through_history_len, 4);
+        assert_eq!(pointer.processed_through_entry, 3);
+    }
+
     #[tokio::test]
     async fn subjektiv_extraction_stages_once_and_commits_its_independent_pointer() {
         let source = capture(2, 250);
-        let entry_ref =
-            SessionCapture::from_history_entries(source.segment_id.clone(), source.history.clone())
-                .overview()[0]
-                .id
-                .to_string();
+        let entry_ref = SessionCapture::from_complete_history(
+            source.session_id.clone(),
+            source.segment_id.clone(),
+            source.history.clone(),
+        )
+        .overview()[0]
+            .id
+            .to_string();
         let client = ScriptClient::new(vec![
             stage_candidate_events("stage-1", &entry_ref),
             finish_events("finish-1", 1),
@@ -1715,11 +1809,14 @@ permission = "write"
     #[tokio::test]
     async fn subjektiv_candidate_remains_staged_when_later_extraction_fails_without_pointer() {
         let source = capture(2, 250);
-        let entry_ref =
-            SessionCapture::from_history_entries(source.segment_id.clone(), source.history.clone())
-                .overview()[0]
-                .id
-                .to_string();
+        let entry_ref = SessionCapture::from_complete_history(
+            source.session_id.clone(),
+            source.segment_id.clone(),
+            source.history.clone(),
+        )
+        .overview()[0]
+            .id
+            .to_string();
         let client = ScriptClient::new(vec![stage_candidate_events("stage-1", &entry_ref)]);
         let extension_writes = Arc::new(Mutex::new(Vec::new()));
         let (event_tx, _) = broadcast::channel(32);

crates/worker/src/feature/builtin/memory_staging_output.rs

@@ -510,7 +510,11 @@ mod tests {
 
     fn state() -> MemoryStagingOutputState {
         MemoryStagingOutputState::new(
-            SessionCapture::new("segment-1", vec![Item::user_message("durable decision")]),
+            SessionCapture::new(
+                "session",
+                "segment-1",
+                vec![Item::user_message("durable decision")],
+            ),
             crate::worker::marker_workspace_client(None, "test-backend"),
             SourceRef {
                 segment_id: "segment-1".to_string(),
@@ -537,6 +541,7 @@ mod tests {
     #[test]
     fn render_input_uses_session_entry_refs_and_new_tool_names() {
         let view = SessionCapture::new(
+            "session",
             "segment-1",
             vec![
                 Item::user_message("preference"),
@@ -586,7 +591,11 @@ mod tests {
     async fn subjektiv_destination_sends_committed_session_without_subject_scope() {
         let client = Arc::new(RecordingSubjektivClient::default());
         let state = MemoryStagingOutputState::new_subjektiv(
-            SessionCapture::new("segment-1", vec![Item::user_message("durable decision")]),
+            SessionCapture::new(
+                "session",
+                "segment-1",
+                vec![Item::user_message("durable decision")],
+            ),
             {
                 let mut host = crate::subjektiv::test_connection(client.clone());
                 host.context.session_id = "session-committed".into();
@@ -630,4 +639,53 @@ mod tests {
             .unwrap_err();
         assert!(format!("{error:?}").contains("unknown SessionEntryRef"));
     }
+    #[tokio::test]
+    async fn staging_roundtripped_mixed_sources_uses_original_evidence_ranges_not_view_order() {
+        let client = Arc::new(RecordingSubjektivClient::default());
+        let mut dto = SessionCapture::new(
+            "session",
+            "view",
+            vec![
+                Item::user_message("first"),
+                Item::assistant_message("second"),
+            ],
+        )
+        .to_dto();
+        dto.entries[0].source.segment_id = "original-a".into();
+        dto.entries[0].source.entry_index = 80;
+        dto.entries[1].source.segment_id = "original-b".into();
+        dto.entries[1].source.entry_index = 3;
+        let limits = crate::session_capture::CaptureLimits::default();
+        let view = SessionCapture::decode(&dto.encode(limits).unwrap(), limits).unwrap();
+        let state = MemoryStagingOutputState::new_subjektiv(
+            view,
+            crate::subjektiv::test_connection(client.clone()),
+            SourceRef {
+                segment_id: "view".into(),
+                range: [0, 1],
+            },
+            "run".into(),
+        );
+        StageMemoryCandidateTool { state }.execute(
+            r#"{"kind":"decision","claim":"claim","why_useful":"useful","entry_refs":["E00000000","E00000001"]}"#,
+            agen::tool::ToolExecutionContext::direct(),
+        ).await.unwrap();
+        let requests = client.requests.lock().unwrap();
+        let request: server_api::SubjektivStageCandidateRequest =
+            serde_json::from_str(requests[0].body.as_deref().unwrap()).unwrap();
+        for (index, segment, position) in [(0, "original-a", 80), (1, "original-b", 3)] {
+            assert_eq!(
+                request.operation.evidence[index].entry_range,
+                Some([position; 2])
+            );
+            assert_eq!(
+                request.operation.source_refs[index].segment_id.as_deref(),
+                Some(segment)
+            );
+            assert_eq!(
+                request.operation.source_refs[index].entry_range,
+                Some([position; 2])
+            );
+        }
+    }
 }

crates/worker/src/feature/builtin/session_explore.rs

@@ -17,14 +17,14 @@ use crate::feature::{
     ToolDeclaration,
 };
 use crate::session_capture::{
-    ReadDetail, ReadOptions, ReadSelector, ReferenceKind, SearchOptions, SessionCapture,
-    SessionEntryRef, ToolPart,
+    CapturePurpose, RawField, ReadDetail, ReadOptions, ReadSelector, ReferenceKind, SearchOptions,
+    SessionCapture, SessionEntryRef, ToolPart,
 };
 
 const SHOW_OVERVIEW_DESCRIPTION: &str =
     "Show a sparse, bounded index of real user and assistant session entries.";
 const SEARCH_ENTRIES_DESCRIPTION: &str = "Search or compactly list a bounded range of committed session entries. Reasoning entries are never exposed.";
-const READ_ENTRY_DESCRIPTION: &str = "Read one committed session entry by stable SessionEntryRef. Compact mode is the default; full mode includes bounded tool input or output.";
+const READ_ENTRY_DESCRIPTION: &str = "Read one committed session entry by stable SessionEntryRef. Compact mode is the default; full mode is a bounded rendering, not raw source. Raw mode requires raw_field and supports UTF-8 byte_offset/next_offset without omission; use capture_id to bind continuation to this exact capture.";
 const DEFAULT_PAGE_LIMIT: usize = 20;
 const MAX_PAGE_LIMIT: usize = 100;
 const DEFAULT_READ_ITEMS: usize = 10;
@@ -173,6 +173,38 @@ struct ReadEntryParams {
     mode: String,
     #[serde(default)]
     max_items: Option<usize>,
+    #[serde(default)]
+    raw_field: Option<RawEntryField>,
+    #[serde(default)]
+    part_index: Option<usize>,
+    #[serde(default)]
+    byte_offset: Option<usize>,
+    #[serde(default)]
+    max_bytes: Option<usize>,
+    #[serde(default)]
+    capture_id: Option<String>,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+enum RawEntryField {
+    MessagePart,
+    PublicSystem,
+    ToolArguments,
+    ToolSummary,
+    ToolContent,
+}
+
+impl RawEntryField {
+    fn into_common(self, part_index: usize) -> RawField {
+        match self {
+            Self::MessagePart => RawField::MessagePart(part_index),
+            Self::PublicSystem => RawField::PublicSystem,
+            Self::ToolArguments => RawField::ToolArguments,
+            Self::ToolSummary => RawField::ToolSummary,
+            Self::ToolContent => RawField::ToolContent,
+        }
+    }
 }
 
 fn default_read_mode() -> String {
@@ -243,25 +275,20 @@ impl Tool for SearchEntriesTool {
         let from = params.from.as_deref().map(parse_entry_ref).transpose()?;
         let through = params.through.as_deref().map(parse_entry_ref).transpose()?;
         let view = self.state.view();
-        if let (Some(from), Some(through)) = (&from, &through) {
-            if view.source_index_for_ref(from) > view.source_index_for_ref(through) {
-                return Err(ToolError::InvalidArgument(
-                    "SearchEntries from must not be after through".to_string(),
-                ));
-            }
-        }
         let limit = bounded_limit(params.limit, DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT);
-        let hits = view.search(&SearchOptions {
-            query: params.query,
-            kind,
-            tool_part,
-            tool_name: params.tool_name,
-            limit: Some(limit),
-            min_entry_index: None,
-            from,
-            through,
-            offset: params.offset,
-        });
+        let hits = view
+            .search_checked(&SearchOptions {
+                query: params.query,
+                kind,
+                tool_part,
+                tool_name: params.tool_name,
+                limit: Some(limit),
+                min_entry_index: None,
+                from,
+                through,
+                offset: params.offset,
+            })
+            .map_err(|error| ToolError::InvalidArgument(error.to_string()))?;
         let entries = hits
             .iter()
             .map(|hit| {
@@ -272,6 +299,7 @@ impl Tool for SearchEntriesTool {
                     "tool_name": hit.tool_name,
                     "label": hit.label,
                     "text": hit.summary,
+                    "text_kind": "preview",
                 })
             })
             .collect::<Vec<_>>();
@@ -299,12 +327,62 @@ impl Tool for ReadEntryTool {
     ) -> Result<ToolOutput, ToolError> {
         let params: ReadEntryParams = parse_input("ReadEntry", input_json)?;
         let entry_ref = parse_entry_ref(&params.entry_ref)?;
+        let view = self.state.view();
+        if params
+            .capture_id
+            .as_deref()
+            .is_some_and(|id| id != view.capture_id())
+        {
+            return Err(ToolError::InvalidArgument(
+                "capture identity does not match".into(),
+            ));
+        }
+        if params.mode == "raw" {
+            let field = params
+                .raw_field
+                .ok_or_else(|| ToolError::InvalidArgument("raw mode requires raw_field".into()))?;
+            if params.part_index.is_some() && !matches!(field, RawEntryField::MessagePart) {
+                return Err(ToolError::InvalidArgument(
+                    "part_index is only valid for message_part".into(),
+                ));
+            }
+            let reference = view
+                .scoped_ref(&entry_ref)
+                .map_err(|error| ToolError::InvalidArgument(error.to_string()))?;
+            let raw = view
+                .read_raw(
+                    &reference,
+                    CapturePurpose::Observation,
+                    field.into_common(params.part_index.unwrap_or(0)),
+                    params.byte_offset.unwrap_or(0),
+                    params
+                        .max_bytes
+                        .unwrap_or(MAX_READ_BYTES)
+                        .clamp(1, MAX_READ_BYTES),
+                )
+                .map_err(|error| ToolError::InvalidArgument(error.to_string()))?;
+            return json_output(
+                "Read raw session source bytes.".into(),
+                serde_json::json!({
+                    "text_kind": "raw", "raw": raw,
+                }),
+            );
+        }
+        if params.raw_field.is_some()
+            || params.part_index.is_some()
+            || params.byte_offset.is_some()
+            || params.max_bytes.is_some()
+        {
+            return Err(ToolError::InvalidArgument(
+                "raw fields require raw mode".into(),
+            ));
+        }
         let detail = match params.mode.as_str() {
             "compact" => ReadDetail::Compact,
             "full" => ReadDetail::Full,
             other => {
                 return Err(ToolError::InvalidArgument(format!(
-                    "invalid ReadEntry mode {other:?}; expected compact or full"
+                    "invalid ReadEntry mode {other:?}; expected compact, full, or raw"
                 )));
             }
         };
@@ -347,6 +425,7 @@ impl Tool for ReadEntryTool {
             serde_json::json!({
                 "entries": entries,
                 "truncated": read.truncated,
+                "text_kind": "rendered",
             }),
         )
     }
@@ -408,6 +487,7 @@ mod tests {
 
     fn state() -> SessionExploreState {
         SessionExploreState::new(SessionCapture::new(
+            "session",
             "segment-1",
             vec![
                 Item::user_message("first"),
@@ -479,4 +559,64 @@ mod tests {
             .unwrap();
         assert!(output.content.unwrap().contains("second"));
     }
+    #[tokio::test]
+    async fn search_rejects_unknown_or_reversed_capture_endpoints() {
+        let search = search_entries_definition(state())().1;
+        for input in [
+            r#"{"from":"E99999999"}"#,
+            r#"{"through":"E99999999"}"#,
+            r#"{"from":"E00000003","through":"E00000000"}"#,
+        ] {
+            assert!(
+                search
+                    .execute(input, agen::tool::ToolExecutionContext::direct())
+                    .await
+                    .is_err()
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn raw_tool_arguments_reassemble_without_preview_or_utf8_loss() {
+        let arguments = "日本語\n\"\\".repeat(100);
+        let state = SessionExploreState::new(SessionCapture::new(
+            "session",
+            "segment",
+            vec![Item::tool_call("call", "Read", arguments.clone())],
+        ));
+        let capture_id = state.view().capture_id().to_owned();
+        let tool = read_entry_definition(state)().1;
+        let mut offset = 0;
+        let mut assembled = String::new();
+        loop {
+            let input = serde_json::json!({
+                "entry_ref": "E00000000", "mode": "raw", "raw_field": "tool_arguments",
+                "byte_offset": offset, "max_bytes": 17, "capture_id": capture_id,
+            });
+            let output = tool
+                .execute(
+                    &input.to_string(),
+                    agen::tool::ToolExecutionContext::direct(),
+                )
+                .await
+                .unwrap();
+            let value: serde_json::Value = serde_json::from_str(&output.content.unwrap()).unwrap();
+            assert_eq!(value["text_kind"], "raw");
+            let raw = &value["raw"];
+            assert_eq!(raw["offset"], offset);
+            let text = raw["text"].as_str().unwrap();
+            assert!(text.len() <= 17);
+            assembled.push_str(text);
+            match raw["next_offset"].as_u64() {
+                Some(next) => {
+                    assert!(next > offset as u64);
+                    offset = next as usize;
+                }
+                None => break,
+            }
+        }
+        assert_eq!(assembled, arguments);
+        assert!(tool.execute(r#"{"entry_ref":"E00000000","mode":"raw","raw_field":"tool_arguments","capture_id":"other"}"#,
+            agen::tool::ToolExecutionContext::direct()).await.is_err());
+    }
 }

crates/worker/src/feature/builtin/subjektiv_memory.rs

@@ -39,13 +39,66 @@ use crate::hook::{
     HookErrorCategory, HookExecutionPolicy, HookFailurePolicy, HookPreRequestAction, PreLlmRequest,
     PreRequestContext, RunCommitted, RunCommittedContext,
 };
-use crate::session_capture::{SessionCapture, SessionEntryEvidence};
+use crate::session_capture::{CaptureBody, SessionCapture, SessionEntryEvidence};
 use crate::subjektiv::SubjektivHostConnection;
 #[cfg(test)]
 use crate::worker::WorkspaceClient;
 #[cfg(test)]
 use server_api::SubjektivMemoryBackendRequest;
 
+// Pending-commit receipt interpretation belongs to Memory, not the shared capture.
+struct CommittedMemoryCall {
+    call_id: String,
+    name: String,
+    arguments: String,
+    evidence: SessionEntryEvidence,
+}
+
+fn committed_pending_tool_calls(view: &SessionCapture, names: &[&str]) -> Vec<CommittedMemoryCall> {
+    let pending: HashSet<_> = view
+        .entries()
+        .filter_map(|entry| {
+            let CaptureBody::ToolResult {
+                call_id,
+                content: Some(content),
+                is_error: false,
+                ..
+            } = &entry.body
+            else {
+                return None;
+            };
+            (serde_json::from_str::<serde_json::Value>(content)
+                .ok()
+                .and_then(|value| value.get("status").cloned())
+                .as_ref()
+                .and_then(serde_json::Value::as_str)
+                == Some("pending_commit"))
+            .then_some(call_id.as_str())
+        })
+        .collect();
+    view.entries()
+        .filter_map(|entry| {
+            let CaptureBody::ToolCall {
+                call_id,
+                name,
+                arguments,
+            } = &entry.body
+            else {
+                return None;
+            };
+            if !names.contains(&name.as_str()) || !pending.contains(call_id.as_str()) {
+                return None;
+            }
+            Some(CommittedMemoryCall {
+                call_id: call_id.clone(),
+                name: name.clone(),
+                arguments: arguments.clone(),
+                evidence: view.evidence_for_tool_call(call_id)?,
+            })
+        })
+        .collect()
+}
+
 const QUERY_TOOL: &str = "SubjektivMemoryQuery";
 const READ_TOOL: &str = "SubjektivMemoryRead";
 const LIST_CHANGES_TOOL: &str = "SubjektivMemoryListChanges";
@@ -518,14 +571,18 @@ impl SubjektivMemoryState {
                 .capture()
                 .map_err(|error| ToolError::ExecutionFailed(error.to_string()))?;
             let session_id = capture.session_id.clone();
-            let view = SessionCapture::from_history_entries(capture.segment_id, capture.history);
-            let committed = view
-                .committed_pending_tool_calls(&[REMEMBER_TOOL, PROPOSE_CHANGE_TOOL])
-                .into_iter()
-                .any(|call| {
-                    receipt_id(&session_id, &call.call_id)
-                        .is_ok_and(|committed_receipt| committed_receipt == expected_receipt_id)
-                });
+            let view = SessionCapture::from_complete_history(
+                capture.session_id.clone(),
+                capture.segment_id,
+                capture.history,
+            );
+            let committed =
+                committed_pending_tool_calls(&view, &[REMEMBER_TOOL, PROPOSE_CHANGE_TOOL])
+                    .into_iter()
+                    .any(|call| {
+                        receipt_id(&session_id, &call.call_id)
+                            .is_ok_and(|committed_receipt| committed_receipt == expected_receipt_id)
+                    });
             if committed {
                 status.status = SubjektivMemoryReceiptStatus::PendingCommit;
             }
@@ -623,10 +680,13 @@ fn replay_pending_committed_memory_with_policy(
         .capture
         .capture()
         .map_err(|error| HookError::new(HookErrorCategory::Dependency, error.to_string()))?;
-    let view =
-        SessionCapture::from_history_entries(capture.segment_id.clone(), capture.history.clone());
+    let view = SessionCapture::from_complete_history(
+        capture.session_id.clone(),
+        capture.segment_id.clone(),
+        capture.history.clone(),
+    );
     let mut failures = Vec::new();
-    for call in view.committed_pending_tool_calls(&[REMEMBER_TOOL, PROPOSE_CHANGE_TOOL]) {
+    for call in committed_pending_tool_calls(&view, &[REMEMBER_TOOL, PROPOSE_CHANGE_TOOL]) {
         let receipt_id = match receipt_id(&capture.session_id, &call.call_id) {
             Ok(value) => value,
             Err(error) => {
@@ -755,8 +815,11 @@ fn resolve_entry_refs(
     capture: &crate::feature::session::CommittedSessionCapture,
     entry_refs: &[String],
 ) -> Result<Vec<SessionEntryEvidence>, ToolError> {
-    let view =
-        SessionCapture::from_history_entries(capture.segment_id.clone(), capture.history.clone());
+    let view = SessionCapture::from_complete_history(
+        capture.session_id.clone(),
+        capture.segment_id.clone(),
+        capture.history.clone(),
+    );
     let mut seen = HashSet::new();
     entry_refs
         .iter()