fix: bound safe-boundary pause escalation

fix: confirm bash cancellation cleanup
feat: own cancellable tool execution lifecycle
2026-08-27 23:57:20 +09:00 · 2026-08-27 23:01:06 +09:00 · 2026-08-27 23:01:00 +09:00 · 2026-08-27 21:48:59 +09:00 · 2026-08-27 21:30:04 +09:00 · 2026-08-27 20:54:13 +09:00
71 changed files with 5784 additions and 1019 deletions
@@ -21,20 +21,21 @@ agen = { version = "0.2.1", features = ["codex"] }

 ## Quick start

-Supply an implementation of [`LlmClient`](https://docs.rs/agen/latest/agen/llm_client/trait.LlmClient.html), then run a turn. The first call consumes the mutable engine and returns a cache-locked engine for later turns.
+Supply an implementation of [`LlmClient`](https://docs.rs/agen/latest/agen/llm_client/trait.LlmClient.html), keep conversation history in your application, then run a turn. The first call consumes the mutable engine and returns a cache-locked engine for later turns.

 ```no_run
-use agen::{Engine, EngineError};
+use agen::{Engine, EngineError, History};
 use agen::llm_client::LlmClient;

 async fn conversation<C: LlmClient>(client: C) -> Result<(), EngineError> {
+    let mut history = History::new();
    let output = Engine::new(client)
        .system_prompt("You are a concise assistant.")
-        .run("Explain typed state in one sentence.")
-        .await?;
+        .run(&mut history, "Explain typed state in one sentence.")
+        .await;

    let mut engine = output.engine;
-    let _result = engine.run("Give a Rust example.").await?;
+    let _result = engine.run(&mut history, "Give a Rust example.").await;
    Ok(())
 }
 ```
@@ -4,7 +4,7 @@

 use agen::llm_client::scheme::{Scheme, anthropic::AnthropicScheme};
 use agen::llm_client::transport::{HttpTransport, ResolvedAuth};
-use agen::{Engine, EngineResult};
+use agen::{Engine, EngineRunExit, StopReason};
 use std::time::Duration;

 #[tokio::main]
@@ -29,6 +29,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let base_url = scheme.default_base_url().to_string();
    let client = HttpTransport::new(scheme, model, base_url, ResolvedAuth::ApiKey(api_key), cap);
    let engine = Engine::new(client);
+    let mut history = agen::History::new();

    println!("🚀 Starting Engine...");
    println!("💡 Will cancel after 2 seconds\n");
@@ -45,16 +46,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {

    println!("📡 Sending request to LLM...");

-    match engine.run("Tell me a very long story about a brave knight. Make it as detailed as possible with many paragraphs.").await {
-        Ok(out) => match out.result {
-            EngineResult::Finished => println!("✅ Task completed normally"),
-            EngineResult::Paused => println!("⏸️  Task paused"),
-            EngineResult::LimitReached => println!("🔒 Turn limit reached"),
-            EngineResult::Yielded => println!("↩️  Task yielded"),
-        },
-        Err(e) => {
-            println!("❌ Task error: {}", e);
+    let output = engine.run(&mut history, "Tell me a very long story about a brave knight. Make it as detailed as possible with many paragraphs.").await;
+    match output.result {
+        EngineRunExit::Finished => println!("✅ Task completed normally"),
+        EngineRunExit::Paused => println!("⏸️  Task paused"),
+        EngineRunExit::Yielded => println!("↩️  Task yielded"),
+        EngineRunExit::Interrupted(StopReason::LimitReached) => {
+            println!("🔒 Turn limit reached")
        }
+        EngineRunExit::Interrupted(reason) => println!("❌ Task interrupted: {reason:?}"),
    }

    println!("\n✨ Demo complete!");
@@ -39,7 +39,7 @@ use tracing::info;
 use tracing_subscriber::EnvFilter;

 use agen::{
-    Engine,
+    Engine, EngineRunExit, StopReason,
    interceptor::{Interceptor, PostToolAction, ToolResultInfo},
    llm_client::{
        LlmClient,
@@ -451,6 +451,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {

    // Create Engine
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    let tool_call_names = Arc::new(Mutex::new(HashMap::new()));

@@ -476,12 +477,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {

    // One-shot mode
    if let Some(prompt) = args.prompt {
-        match engine.run(&prompt).await {
-            Ok(_) => {}
-            Err(e) => {
-                eprintln!("\n❌ Error: {}", e);
-                std::process::exit(1);
-            }
+        let output = engine.run(&mut history, &prompt).await;
+        if let EngineRunExit::Interrupted(StopReason::Unexpected(error)) = output.result {
+            eprintln!("\n❌ Error: {error}");
        }

        return Ok(());
@@ -500,13 +498,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
        return Ok(());
    }

-    let mut locked = match engine.run(first_input).await {
-        Ok(out) => out.engine,
-        Err(e) => {
-            eprintln!("\n❌ Error: {}", e);
-            return Ok(());
-        }
-    };
+    let output = engine.run(&mut history, first_input).await;
+    let mut locked = output.engine;

    loop {
        print!("\n👤 You: ");
@@ -525,11 +518,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
            break;
        }

-        match locked.run(input).await {
-            Ok(_) => {}
-            Err(e) => {
-                eprintln!("\n❌ Error: {}", e);
-            }
+        if let EngineRunExit::Interrupted(StopReason::Unexpected(error)) =
+            locked.run(&mut history, input).await
+        {
+            eprintln!("\n❌ Error: {error}");
        }
    }

@@ -0,0 +1,199 @@
+//! Typed conversation history containers.
+//!
+//! Agen keeps provider-visible [`Item`](crate::Item) values separate from any
+//! host-domain provenance. The host chooses the annotation type `A`, while Agen
+//! preserves each item and annotation as one entry for clone/truncate/restore
+//! style history operations.
+
+use serde::{Deserialize, Serialize};
+
+use crate::Item;
+
+/// One conversation-history entry with host-owned annotation.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct HistoryEntry<A = ()> {
+    /// Provider/model-visible conversation item.
+    pub item: Item,
+    /// Host-domain metadata kept with the item and never projected to providers.
+    pub annotation: A,
+}
+
+impl<A> HistoryEntry<A> {
+    /// Build an entry from an item and its annotation.
+    pub fn new(item: Item, annotation: A) -> Self {
+        Self { item, annotation }
+    }
+
+    /// Split the entry into its item and annotation.
+    pub fn into_parts(self) -> (Item, A) {
+        (self.item, self.annotation)
+    }
+}
+
+impl HistoryEntry<()> {
+    /// Build a unit-annotated entry.
+    pub fn from_item(item: Item) -> Self {
+        Self {
+            item,
+            annotation: (),
+        }
+    }
+}
+
+/// Conversation history with one annotation per item.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct History<A = ()> {
+    entries: Vec<HistoryEntry<A>>,
+}
+
+impl<A> History<A> {
+    /// Create an empty history.
+    pub fn new() -> Self {
+        Self {
+            entries: Vec::new(),
+        }
+    }
+
+    /// Build history from already annotated entries, preserving order.
+    pub fn from_entries(entries: Vec<HistoryEntry<A>>) -> Self {
+        Self { entries }
+    }
+
+    /// Replace all entries as one restore/rebuild operation and return the old entries.
+    pub fn replace_entries(&mut self, entries: Vec<HistoryEntry<A>>) -> Vec<HistoryEntry<A>> {
+        std::mem::replace(&mut self.entries, entries)
+    }
+
+    /// Borrow annotated entries.
+    pub fn entries(&self) -> &[HistoryEntry<A>] {
+        &self.entries
+    }
+
+    /// Mutably borrow annotated entries for host-owned rebuild operations.
+    pub fn entries_mut(&mut self) -> &mut [HistoryEntry<A>] {
+        &mut self.entries
+    }
+
+    /// Consume the history into annotated entries.
+    pub fn into_entries(self) -> Vec<HistoryEntry<A>> {
+        self.entries
+    }
+
+    /// Number of entries.
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    /// Whether the history is empty.
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// Iterate over annotated entries.
+    pub fn iter(&self) -> impl ExactSizeIterator<Item = &HistoryEntry<A>> {
+        self.entries.iter()
+    }
+
+    /// Iterate over provider-visible items only.
+    pub fn items(&self) -> impl ExactSizeIterator<Item = &Item> {
+        self.entries.iter().map(|entry| &entry.item)
+    }
+
+    /// Clone provider-visible items into a request-local projection.
+    pub fn items_cloned(&self) -> Vec<Item> {
+        self.items().cloned().collect()
+    }
+
+    /// Append an already annotated entry.
+    pub fn push_entry(&mut self, entry: HistoryEntry<A>) {
+        self.entries.push(entry);
+    }
+
+    /// Append many already annotated entries.
+    pub fn extend_entries(&mut self, entries: impl IntoIterator<Item = HistoryEntry<A>>) {
+        self.entries.extend(entries);
+    }
+
+    /// Commit one item through a trusted annotation callback before it becomes live.
+    ///
+    /// The callback may durably persist the item and returns the annotation that
+    /// must be stored with it. If the callback fails, the history is left unchanged.
+    pub fn append_with(
+        &mut self,
+        item: Item,
+        annotate: &mut impl FnMut(&Item) -> Result<A, String>,
+    ) -> Result<(), String> {
+        let annotation = annotate(&item)?;
+        self.entries.push(HistoryEntry { item, annotation });
+        Ok(())
+    }
+
+    /// Commit items through a trusted annotation callback before they become live.
+    ///
+    /// Items before a failure remain appended; the failing item and later items do
+    /// not enter history. This mirrors append-only durable logs where each accepted
+    /// item is already committed before the next item is attempted.
+    pub fn extend_with(
+        &mut self,
+        items: impl IntoIterator<Item = Item>,
+        annotate: &mut impl FnMut(&Item) -> Result<A, String>,
+    ) -> Result<(), String> {
+        for item in items {
+            self.append_with(item, annotate)?;
+        }
+        Ok(())
+    }
+
+    /// Truncate entries, preserving item+annotation pairing for retained entries.
+    pub fn truncate(&mut self, len: usize) {
+        self.entries.truncate(len);
+    }
+
+    /// Clear all entries.
+    pub fn clear(&mut self) {
+        self.entries.clear();
+    }
+}
+
+impl History<()> {
+    /// Build unit-annotated history from provider-visible items.
+    pub fn from_items(items: Vec<Item>) -> Self {
+        Self {
+            entries: items.into_iter().map(HistoryEntry::from_item).collect(),
+        }
+    }
+
+    /// Replace history from provider-visible items using unit annotations.
+    pub fn replace_items(&mut self, items: Vec<Item>) -> Vec<HistoryEntry<()>> {
+        self.replace_entries(items.into_iter().map(HistoryEntry::from_item).collect())
+    }
+
+    /// Append one item with unit annotation.
+    pub fn push(&mut self, item: Item) {
+        self.entries.push(HistoryEntry::from_item(item));
+    }
+
+    /// Append items with unit annotations.
+    pub fn extend_items(&mut self, items: impl IntoIterator<Item = Item>) {
+        self.entries
+            .extend(items.into_iter().map(HistoryEntry::from_item));
+    }
+}
+
+impl<A> IntoIterator for History<A> {
+    type Item = HistoryEntry<A>;
+    type IntoIter = std::vec::IntoIter<HistoryEntry<A>>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.entries.into_iter()
+    }
+}
+
+impl<'a, A> IntoIterator for &'a History<A> {
+    type Item = &'a HistoryEntry<A>;
+    type IntoIter = std::slice::Iter<'a, HistoryEntry<A>>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.entries.iter()
+    }
+}
@@ -2,6 +2,7 @@

 mod engine;
 mod handler;
+mod history;
 mod message;

 pub(crate) mod callback;
@@ -20,13 +21,18 @@ pub mod usage_record;
 pub use agen_macros::{description, tool, tool_registry};
 pub use callback::{TextBlockScope, ThinkingBlockScope, ToolUseBlockScope};
 pub use engine::{
-    Engine, EngineConfig, EngineError, EngineResult, EngineRunOutput, LlmRetryNotice,
-    ToolRegistryError,
+    Engine, EngineConfig, EngineError, EngineResult, EngineRunExit, EngineRunOutput,
+    LlmRetryNotice, StopReason, ToolRegistryError,
 };
 pub use handler::ToolUseBlockStart;
+pub use history::{History, HistoryEntry};
 pub use interceptor::Interceptor;
 pub use message::{ContentPart, Item, Message, Role};
-pub use tool::{ToolCall, ToolExecutionContext, ToolOutputLimits, ToolResult};
+pub use tool::{
+    ToolCall, ToolExecutionContext, ToolExecutionHandle, ToolExecutionPolicy,
+    ToolExecutionTerminal, ToolExecutionTerminalFuture, ToolOutputLimits, ToolResult,
+    ToolResultDisposition,
+};
 pub use usage_record::UsageRecord;

 /// Implementation dependencies used by code generated from `agen` macros.
@@ -18,6 +18,9 @@ pub enum ClientError {
        message: String,
        retry_after: Option<Duration>,
    },
+    /// The provider rejected the request because it exceeded the model context window.
+    /// Classified only from a structured provider error code, never message text.
+    ContextWindowExceeded,
    /// A request lifecycle phase exceeded its hard timeout.
    Timeout {
        phase: &'static str,
@@ -48,6 +51,7 @@ impl fmt::Display for ClientError {
                }
                write!(f, ": {}", message)
            }
+            ClientError::ContextWindowExceeded => write!(f, "Model context window reached"),
            ClientError::Timeout { phase, timeout } => {
                write!(f, "{phase} timed out after {}s", timeout.as_secs())
            }
@@ -112,7 +116,10 @@ pub fn is_retryable(error: &ClientError) -> bool {
        ClientError::Api { status: None, .. } => false,
        ClientError::Timeout { .. } => true,
        ClientError::Http(e) => e.is_connect() || e.is_timeout(),
-        ClientError::Json(_) | ClientError::Sse(_) | ClientError::Config(_) => false,
+        ClientError::ContextWindowExceeded
+        | ClientError::Json(_)
+        | ClientError::Sse(_)
+        | ClientError::Config(_) => false,
    }
 }

@@ -431,13 +431,7 @@ fn api_error_code(error: &ClientError) -> Option<&str> {
 }

 fn is_context_length_exceeded(error: &ClientError) -> bool {
-    match error {
-        ClientError::Api { code, message, .. } => {
-            code.as_deref() == Some("context_length_exceeded")
-                || message.contains("context_length_exceeded")
-        }
-        _ => false,
-    }
+    matches!(error, ClientError::ContextWindowExceeded)
 }

 async fn response_with_timeout(
@@ -487,6 +481,9 @@ async fn classify_error_response(resp: reqwest::Response) -> ClientError {
            .and_then(|v| v.as_str())
            .unwrap_or(&text)
            .to_string();
+        if code.as_deref() == Some("context_length_exceeded") {
+            return ClientError::ContextWindowExceeded;
+        }
        ClientError::Api {
            status: Some(status),
            code,
@@ -9,7 +9,7 @@

 use std::{fmt, sync::Arc};

-use crate::tool::Attachment;
+use crate::tool::{Attachment, ToolResultDisposition};
 use base64::Engine as _;
 use serde::{Deserialize, Serialize};

@@ -121,6 +121,9 @@ pub enum Item {
        /// Detailed output (removed by pruning when old enough)
        #[serde(default, skip_serializing_if = "Option::is_none")]
        content: Option<String>,
+        /// Typed terminal state used for replay and recovery.
+        #[serde(default, skip_serializing_if = "ToolResultDisposition::is_success")]
+        disposition: ToolResultDisposition,
        /// Whether the tool result represents an execution error.
        #[serde(default, skip_serializing_if = "is_false")]
        is_error: bool,
@@ -261,7 +264,17 @@ impl Item {
        content: Option<String>,
        is_error: bool,
    ) -> Self {
-        Self::tool_result_item_with_attachments(call_id, summary, content, is_error, Vec::new())
+        Self::tool_result_item_with_disposition_and_attachments(
+            call_id,
+            summary,
+            content,
+            if is_error {
+                ToolResultDisposition::Error
+            } else {
+                ToolResultDisposition::Success
+            },
+            Vec::new(),
+        )
    }

    /// Create a tool result item with durable, prunable structured attachments.
@@ -272,11 +285,33 @@ impl Item {
        is_error: bool,
        attachments: Vec<Attachment>,
    ) -> Self {
+        Self::tool_result_item_with_disposition_and_attachments(
+            call_id,
+            summary,
+            content,
+            if is_error {
+                ToolResultDisposition::Error
+            } else {
+                ToolResultDisposition::Success
+            },
+            attachments,
+        )
+    }
+
+    pub fn tool_result_item_with_disposition_and_attachments(
+        call_id: impl Into<String>,
+        summary: impl Into<String>,
+        content: Option<String>,
+        disposition: ToolResultDisposition,
+        attachments: Vec<Attachment>,
+    ) -> Self {
+        let is_error = !disposition.is_success();
        Self::ToolResult {
            id: None,
            call_id: call_id.into(),
            summary: summary.into(),
            content,
+            disposition,
            is_error,
            attachments,
        }
@@ -19,7 +19,7 @@ mod private {
 /// - Editing message history (add, delete, clear)
 /// - Registering tools and hooks
 ///
-/// Can transition to [`Locked`] state via `Engine::lock()`.
+/// Can transition to [`Locked`] state via `Engine::lock(&history)`.
 ///
 /// # Examples
 ///
@@ -3,7 +3,14 @@
 //! Traits for defining tools callable by LLM.
 //! Usually auto-implemented using the `#[tool]` macro.

-use std::{collections::HashMap, fmt, sync::Arc};
+use std::{
+    collections::HashMap,
+    fmt,
+    future::Future,
+    pin::Pin,
+    sync::Arc,
+    task::{Context, Poll},
+};

 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::STANDARD};
@@ -23,6 +30,12 @@ pub enum ToolError {
    /// Internal error
    #[error("Internal error: {0}")]
    Internal(String),
+    /// Cooperative cancellation completed with bounded terminal output.
+    #[error("Tool execution cancelled")]
+    Cancelled(ToolOutput),
+    /// Execution was interrupted with a confirmed bounded terminal output.
+    #[error("Tool execution interrupted")]
+    Interrupted(ToolOutput),
 }

 // =============================================================================
@@ -158,6 +171,28 @@ pub enum Attachment {
    Image(ImageAttachment),
 }

+/// Terminal disposition of one started tool call.
+///
+/// `Cancelled` means the tool confirmed cancellation. `OutcomeUnknown` means
+/// execution stopped without confirmation, so neither completion nor side
+/// effects may be inferred.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum ToolResultDisposition {
+    #[default]
+    Success,
+    Error,
+    Interrupted,
+    Cancelled,
+    OutcomeUnknown,
+}
+
+impl ToolResultDisposition {
+    pub const fn is_success(&self) -> bool {
+        matches!(self, Self::Success)
+    }
+}
+
 /// Tool execution result.
 ///
 /// Every output has a mandatory `summary` (1-2 lines) that persists in
@@ -322,6 +357,12 @@ impl ToolExecutionContext {
        }
    }

+    /// Identifies one live execution attempt without making the batch id a durable
+    /// replay or idempotency authority.
+    pub fn execution_id(&self) -> String {
+        format!("{}:{}", self.batch_id, self.call_id)
+    }
+
    /// Context for direct, non-engine calls in unit tests and low-level callers.
    pub fn direct() -> Self {
        Self::new("direct", "direct", 0)
@@ -334,6 +375,142 @@ impl Default for ToolExecutionContext {
    }
 }

+/// The provider-confirmed terminal result of one started tool execution.
+///
+/// `OutcomeUnknown` is reserved for an execution task that had to be force-closed
+/// or failed before the provider could confirm its terminal result.
+#[derive(Debug)]
+pub enum ToolExecutionTerminal {
+    Confirmed(Result<ToolOutput, ToolError>),
+    OutcomeUnknown,
+}
+
+/// The completion future paired with a [`ToolExecutionHandle`]. Dropping this
+/// future does not drop the provider execution: the spawned execution remains
+/// owned by its handle until it completes or is explicitly force-closed.
+pub struct ToolExecutionTerminalFuture {
+    task: tokio::task::JoinHandle<Result<ToolOutput, ToolError>>,
+}
+
+impl Future for ToolExecutionTerminalFuture {
+    type Output = ToolExecutionTerminal;
+
+    fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
+        match Pin::new(&mut self.task).poll(cx) {
+            Poll::Ready(Ok(result)) => Poll::Ready(ToolExecutionTerminal::Confirmed(result)),
+            Poll::Ready(Err(_)) => Poll::Ready(ToolExecutionTerminal::OutcomeUnknown),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+}
+
+/// Live ownership and control for one started tool execution.
+///
+/// Execution, cancellation, and terminal confirmation remain provider-owned:
+/// this handle starts `Tool::execute`, delegates cooperative cancellation to
+/// `Tool::cancel_execution`, and treats execution-future completion as the
+/// provider's terminal confirmation. Agen may force-close only after its caller's
+/// deadline expires, at which point the outcome is necessarily unknown.
+#[derive(Clone)]
+pub struct ToolExecutionHandle {
+    inner: Arc<ToolExecutionHandleInner>,
+}
+
+struct ToolExecutionHandleInner {
+    tool: Arc<dyn Tool>,
+    context: ToolExecutionContext,
+    abort: tokio::task::AbortHandle,
+}
+
+impl Drop for ToolExecutionHandleInner {
+    fn drop(&mut self) {
+        // Losing the final live owner is an explicit forced close, never a
+        // best-effort detached provider future.
+        self.abort.abort();
+    }
+}
+
+impl fmt::Debug for ToolExecutionHandle {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ToolExecutionHandle")
+            .field("call_id", &self.inner.context.call_id)
+            .field("batch_id", &self.inner.context.batch_id)
+            .finish_non_exhaustive()
+    }
+}
+
+impl ToolExecutionHandle {
+    pub fn start(
+        tool: Arc<dyn Tool>,
+        input_json: String,
+        context: ToolExecutionContext,
+    ) -> (Self, ToolExecutionTerminalFuture) {
+        let execution_tool = Arc::clone(&tool);
+        let execution_context = context.clone();
+        let task =
+            tokio::spawn(
+                async move { execution_tool.execute(&input_json, execution_context).await },
+            );
+        let abort = task.abort_handle();
+        (
+            Self {
+                inner: Arc::new(ToolExecutionHandleInner {
+                    tool,
+                    context,
+                    abort,
+                }),
+            },
+            ToolExecutionTerminalFuture { task },
+        )
+    }
+
+    pub fn context(&self) -> &ToolExecutionContext {
+        &self.inner.context
+    }
+
+    pub async fn cancel_before(&self, deadline: tokio::time::Instant) -> Result<(), ToolError> {
+        match tokio::time::timeout_at(
+            deadline,
+            self.inner.tool.cancel_execution(&self.inner.context),
+        )
+        .await
+        {
+            Ok(result) => result,
+            Err(_) => Err(ToolError::Internal(format!(
+                "tool cancellation request exceeded its deadline for call {}",
+                self.inner.context.call_id
+            ))),
+        }
+    }
+
+    pub fn force_close(&self) {
+        self.inner.abort.abort();
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ToolExecutionPolicy {
+    /// Time a pause waits for already-started providers to reach a natural safe
+    /// boundary before escalating to explicit cooperative cancellation.
+    pub pause_safe_boundary_timeout: std::time::Duration,
+    /// Maximum time allowed for a provider to accept one cooperative
+    /// cancellation request.
+    pub cancellation_request_timeout: std::time::Duration,
+    /// Maximum time allowed for all providers to confirm terminal results after
+    /// cancellation has been requested.
+    pub terminal_confirmation_timeout: std::time::Duration,
+}
+
+impl Default for ToolExecutionPolicy {
+    fn default() -> Self {
+        Self {
+            pause_safe_boundary_timeout: std::time::Duration::from_millis(100),
+            cancellation_request_timeout: std::time::Duration::from_millis(100),
+            terminal_confirmation_timeout: std::time::Duration::from_millis(500),
+        }
+    }
+}
+
 // =============================================================================
 // Tool trait
 // =============================================================================
@@ -402,6 +579,26 @@ pub trait Tool: Send + Sync {
        input_json: &str,
        ctx: ToolExecutionContext,
    ) -> Result<ToolOutput, ToolError>;
+
+    /// Request cooperative cancellation for one started call.
+    ///
+    /// Implementations that own cancellable provider operations should signal
+    /// every live execution identified by `call_id`, then let `execute` return
+    /// the confirmed bounded terminal output. Direct callers may use this
+    /// compatibility surface; Agen uses [`Tool::cancel_execution`] so providers
+    /// can bind cancellation to one exact live attempt.
+    async fn cancel(&self, _call_id: &str) -> Result<(), ToolError> {
+        Ok(())
+    }
+
+    /// Request cooperative cancellation for one exact started execution.
+    ///
+    /// The default preserves existing tools by delegating to `cancel(call_id)`.
+    /// Providers with their own execution registry should override this method
+    /// and key cancellation by [`ToolExecutionContext::execution_id`].
+    async fn cancel_execution(&self, ctx: &ToolExecutionContext) -> Result<(), ToolError> {
+        self.cancel(&ctx.call_id).await
+    }
 }

 // =============================================================================
@@ -429,6 +626,9 @@ pub struct ToolCall {
 pub struct ToolResult {
    /// Corresponding tool call ID
    pub tool_use_id: String,
+    /// Typed terminal state.
+    #[serde(default, skip_serializing_if = "ToolResultDisposition::is_success")]
+    pub disposition: ToolResultDisposition,
    /// Short summary (always kept in history)
    pub summary: String,
    /// Detailed output (prunable)
@@ -445,11 +645,20 @@ pub struct ToolResult {
 impl ToolResult {
    /// Create a success result from a [`ToolOutput`].
    pub fn from_output(tool_use_id: impl Into<String>, output: ToolOutput) -> Self {
+        Self::from_output_with_disposition(tool_use_id, output, ToolResultDisposition::Success)
+    }
+
+    pub fn from_output_with_disposition(
+        tool_use_id: impl Into<String>,
+        output: ToolOutput,
+        disposition: ToolResultDisposition,
+    ) -> Self {
        Self {
            tool_use_id: tool_use_id.into(),
+            disposition,
            summary: output.summary,
            content: output.content,
-            is_error: false,
+            is_error: !disposition.is_success(),
            attachments: output.attachments,
        }
    }
@@ -458,12 +667,28 @@ impl ToolResult {
    pub fn error(tool_use_id: impl Into<String>, message: impl Into<String>) -> Self {
        Self {
            tool_use_id: tool_use_id.into(),
+            disposition: ToolResultDisposition::Error,
            summary: message.into(),
            content: None,
            is_error: true,
            attachments: Vec::new(),
        }
    }
+
+    /// Close an execution whose completion and side effects cannot be confirmed.
+    pub fn outcome_unknown(tool_use_id: impl Into<String>) -> Self {
+        Self {
+            tool_use_id: tool_use_id.into(),
+            disposition: ToolResultDisposition::OutcomeUnknown,
+            summary: "Tool execution outcome unknown".to_string(),
+            content: Some(
+                "Execution was interrupted before completion could be confirmed. Completion and side effects are unknown."
+                    .to_string(),
+            ),
+            is_error: true,
+            attachments: Vec::new(),
+        }
+    }
 }

 #[cfg(test)]
@@ -0,0 +1,84 @@
+mod common;
+
+use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
+use agen::{Engine, EngineError, History, HistoryEntry, Item, Role};
+use common::MockLlmClient;
+
+fn completed_text_events(text: &str) -> Vec<Event> {
+    vec![
+        Event::text_block_start(0),
+        Event::text_delta(0, text),
+        Event::text_block_stop(0, None),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]
+}
+
+#[tokio::test]
+async fn run_preserves_item_annotations_without_projecting_them() {
+    let client = MockLlmClient::new(completed_text_events("assistant reply"));
+    let engine = Engine::<_, agen::state::Mutable, String>::new_annotated(client);
+    let mut history = History::<String>::new();
+    let mut next = 0usize;
+    let mut annotate = |item: &Item| {
+        next += 1;
+        let kind = match item {
+            Item::Message { role, .. } => match role {
+                Role::User => "user",
+                Role::Assistant => "assistant",
+                Role::System => "system",
+            },
+            Item::ToolCall { .. } => "tool_call",
+            Item::ToolResult { .. } => "tool_result",
+            Item::Reasoning { .. } => "reasoning",
+        };
+        Ok(format!("{next}:{kind}"))
+    };
+
+    let output = engine
+        .run_with_annotation(&mut history, "hello", &mut annotate)
+        .await;
+
+    assert!(matches!(output.result, agen::EngineRunExit::Finished));
+    assert_eq!(history.len(), 2);
+    assert_eq!(history.entries()[0].annotation, "1:user");
+    assert_eq!(history.entries()[1].annotation, "2:assistant");
+    assert_eq!(history.items_cloned().len(), 2);
+}
+
+#[test]
+fn append_failure_does_not_make_item_live() {
+    let client = MockLlmClient::new(vec![]);
+    let mut engine = Engine::<_, agen::state::Mutable, usize>::new_annotated(client);
+    let mut history = History::<usize>::new();
+    let mut fail = |_item: &Item| Err("commit failed".to_string());
+
+    let err = engine
+        .append_history_with(&mut history, [Item::user_message("uncommitted")], &mut fail)
+        .unwrap_err();
+
+    assert!(matches!(err, EngineError::HistoryAppend(message) if message == "commit failed"));
+    assert!(history.is_empty());
+}
+
+#[test]
+fn replacement_keeps_items_and_annotations_together() {
+    let mut history = History::from_entries(vec![
+        HistoryEntry::new(Item::user_message("old"), "old-ann".to_string()),
+        HistoryEntry::new(Item::user_message("second"), "second-ann".to_string()),
+    ]);
+
+    history.truncate(1);
+    assert_eq!(history.entries()[0].item.as_text(), Some("old"));
+    assert_eq!(history.entries()[0].annotation, "old-ann");
+
+    let previous = history.replace_entries(vec![HistoryEntry::new(
+        Item::user_message("restored"),
+        "restored-ann".to_string(),
+    )]);
+
+    assert_eq!(previous.len(), 1);
+    assert_eq!(history.entries()[0].item.as_text(), Some("restored"));
+    assert_eq!(history.entries()[0].annotation, "restored-ann");
+}
@@ -58,6 +58,7 @@ async fn test_callback_llm_retry_event() {
        max_attempts: 2,
        total_timeout: Duration::from_secs(1),
    });
+    let mut history = agen::History::new();

    let notices = Arc::new(Mutex::new(Vec::new()));
    let sink = notices.clone();
@@ -65,8 +66,11 @@ async fn test_callback_llm_retry_event() {
        sink.lock().unwrap().push((llm_call, notice.clone()));
    });

-    let result = engine.run("retry once").await;
-    assert!(result.is_ok(), "engine should succeed after one retry");
+    let result = engine.run(&mut history, "retry once").await;
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "engine should succeed after one retry"
+    );

    let notices = notices.lock().unwrap();
    assert_eq!(notices.len(), 1);
@@ -91,6 +95,7 @@ async fn test_callback_text_block_events() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    let text_deltas = Arc::new(Mutex::new(Vec::new()));
    let text_completes = Arc::new(Mutex::new(Vec::new()));
@@ -108,9 +113,12 @@ async fn test_callback_text_block_events() {
        });
    });

-    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let result = engine.run("Greet me").await;
-    assert!(result.is_ok(), "Engine should complete");
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
+    let result = engine.run(&mut history, "Greet me").await;
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete"
+    );

    let deltas = text_deltas.lock().unwrap();
    assert_eq!(deltas.len(), 2);
@@ -137,6 +145,7 @@ async fn test_callback_tool_call_complete() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    let tool_starts = Arc::new(Mutex::new(Vec::<(String, String)>::new()));
    let tool_completes = Arc::new(Mutex::new(Vec::new()));
@@ -154,8 +163,8 @@ async fn test_callback_tool_call_complete() {
        });
    });

-    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let _ = engine.run("Weather please").await;
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
+    let _ = engine.run(&mut history, "Weather please").await;

    let starts = tool_starts.lock().unwrap();
    assert_eq!(starts.len(), 1);
@@ -183,6 +192,7 @@ async fn test_callback_turn_events() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    let turn_starts = Arc::new(Mutex::new(Vec::new()));
    let turn_ends = Arc::new(Mutex::new(Vec::new()));
@@ -197,9 +207,9 @@ async fn test_callback_turn_events() {
        ends.lock().unwrap().push(turn);
    });

-    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let result = engine.run("Do something").await;
-    assert!(result.is_ok());
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
+    let result = engine.run(&mut history, "Do something").await;
+    assert!(matches!(result.result, agen::EngineRunExit::Finished));

    let starts = turn_starts.lock().unwrap();
    let ends = turn_ends.lock().unwrap();
@@ -254,6 +264,7 @@ async fn test_callback_tool_result_events() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    engine.register_tool(fixed_tool(
        "fixed",
@@ -276,7 +287,7 @@ async fn test_callback_tool_result_events() {
        ));
    });

-    let _ = engine.run("call it").await;
+    let _ = engine.run(&mut history, "call it").await;

    let observed = captured.lock().unwrap();
    assert_eq!(observed.len(), 1);
@@ -330,6 +341,7 @@ async fn test_callback_tool_result_error_path() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    engine.register_tool(erroring_tool("erroring", "boom"));

@@ -345,7 +357,7 @@ async fn test_callback_tool_result_error_path() {
        ));
    });

-    let _ = engine.run("fail it").await;
+    let _ = engine.run(&mut history, "fail it").await;

    let observed = captured.lock().unwrap();
    assert_eq!(observed.len(), 1);
@@ -374,6 +386,7 @@ async fn test_callback_usage_events() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    let usage_events = Arc::new(Mutex::new(Vec::new()));

@@ -382,8 +395,8 @@ async fn test_callback_usage_events() {
        usages.lock().unwrap().push(event.clone());
    });

-    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let _ = engine.run("Hello").await;
+    // Mutable::run consumes self, returns (Locked, EngineRunExit)
+    let _ = engine.run(&mut history, "Hello").await;

    let usages = usage_events.lock().unwrap();
    assert_eq!(usages.len(), 1);
@@ -19,6 +19,7 @@ use std::sync::atomic::{AtomicUsize, Ordering};
 pub struct MockLlmClient {
    responses: Arc<Vec<Vec<Event>>>,
    call_count: Arc<AtomicUsize>,
+    requests: Arc<Mutex<Vec<Request>>>,
 }

 impl MockLlmClient {
@@ -30,6 +31,7 @@ impl MockLlmClient {
        Self {
            responses: Arc::new(responses),
            call_count: Arc::new(AtomicUsize::new(0)),
+            requests: Arc::new(Mutex::new(Vec::new())),
        }
    }

@@ -41,6 +43,10 @@ impl MockLlmClient {
    pub fn event_count(&self) -> usize {
        self.responses.iter().map(|v| v.len()).sum()
    }
+
+    pub fn requests(&self) -> Vec<Request> {
+        self.requests.lock().unwrap().clone()
+    }
 }

 #[async_trait]
@@ -51,8 +57,9 @@ impl LlmClient for MockLlmClient {

    async fn stream(
        &self,
-        _request: Request,
+        request: Request,
    ) -> Result<Pin<Box<dyn Stream<Item = Result<Event, ClientError>> + Send>>, ClientError> {
+        self.requests.lock().unwrap().push(request);
        let count = self.call_count.fetch_add(1, Ordering::SeqCst);
        if count >= self.responses.len() {
            return Err(ClientError::Api {
@@ -134,11 +134,15 @@ async fn test_engine_simple_text_response() {

    let client = MockLlmClient::from_fixture(&fixture_path).unwrap();
    let engine = Engine::new(client);
+    let mut history = agen::History::new();

    // Send a simple message (Mutable::run consumes self, returns tuple)
-    let result = engine.run("Hello").await;
+    let result = engine.run(&mut history, "Hello").await;

-    assert!(result.is_ok(), "Engine should complete successfully");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete successfully"
+    );
 }

 /// Verify that Engine can correctly process responses containing tool calls
@@ -156,6 +160,7 @@ async fn test_engine_tool_call() {

    let client = MockLlmClient::from_fixture(&fixture_path).unwrap();
    let mut engine = Engine::new(client);
+    let mut history = agen::History::new();

    // Register tool
    let weather_tool = MockWeatherTool::new();
@@ -163,7 +168,9 @@ async fn test_engine_tool_call() {
    engine.register_tool(weather_tool.definition());

    // Send message (Mutable::run consumes self, returns tuple)
-    let _result = engine.run("What's the weather in Tokyo?").await;
+    let _result = engine
+        .run(&mut history, "What's the weather in Tokyo?")
+        .await;

    // Verify tool was called
    // Note: max_turns=1 so no request is sent after tool result
@@ -195,11 +202,15 @@ async fn test_engine_with_programmatic_events() {

    let client = MockLlmClient::new(events);
    let engine = Engine::new(client);
+    let mut history = agen::History::new();

    // Mutable::run consumes self, returns tuple
-    let result = engine.run("Greet me").await;
+    let result = engine.run(&mut history, "Greet me").await;

-    assert!(result.is_ok(), "Engine should complete successfully");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete successfully"
+    );
 }

 /// Verify that ToolCallCollector correctly collects ToolCall from ToolUse block events
@@ -14,7 +14,7 @@ use agen::interceptor::{
 };
 use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
-use agen::{Engine, EngineError, EngineResult};
+use agen::{Engine, EngineError, EngineRunExit, History, StopReason};
 use async_trait::async_trait;
 use common::MockLlmClient;

@@ -42,36 +42,37 @@ fn test_mutable_set_system_prompt() {
 fn test_mutable_history_manipulation() {
    let client = MockLlmClient::new(vec![]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();

    // Initial state is empty
-    assert!(engine.history().is_empty());
+    assert!(history.is_empty());

    // Add to history
    engine
-        .append_history(vec![Item::user_message("Hello")])
+        .append_history(&mut history, vec![Item::user_message("Hello")])
        .unwrap();
    engine
-        .append_history(vec![Item::assistant_message("Hi there!")])
+        .append_history(&mut history, vec![Item::assistant_message("Hi there!")])
        .unwrap();
-    assert_eq!(engine.history().len(), 2);
+    assert_eq!(history.len(), 2);

    // Append to history via the callback-aware API.
    engine
-        .append_history(vec![Item::user_message("How are you?")])
+        .append_history(&mut history, vec![Item::user_message("How are you?")])
        .unwrap();
-    assert_eq!(engine.history().len(), 3);
+    assert_eq!(history.len(), 3);

    // Clear history
-    engine.clear_history();
-    assert!(engine.history().is_empty());
+    engine.clear_history(&mut history);
+    assert!(history.is_empty());

    // Set history
    let items = vec![
        Item::user_message("Test"),
        Item::assistant_message("Response"),
    ];
-    engine.set_history(items);
-    assert_eq!(engine.history().len(), 2);
+    engine.set_history(&mut history, items);
+    assert_eq!(history.len(), 2);
 }

 /// Verify that Engine can be constructed using builder pattern
@@ -79,9 +80,10 @@ fn test_mutable_history_manipulation() {
 fn test_mutable_builder_pattern() {
    let client = MockLlmClient::new(vec![]);
    let engine = Engine::new(client).system_prompt("System prompt");
+    let history: History = History::new();

    assert_eq!(engine.get_system_prompt(), Some("System prompt"));
-    assert!(engine.history().is_empty());
+    assert!(history.is_empty());
 }

 /// Verify that multiple items can be added with append_history and callbacks fire.
@@ -91,6 +93,7 @@ fn test_mutable_append_history() {
    let observed = Arc::new(Mutex::new(Vec::new()));
    let observed_for_callback = Arc::clone(&observed);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    engine.on_history_append(move |item| {
        if let Some(text) = item.as_text() {
            observed_for_callback.lock().unwrap().push(text.to_string());
@@ -99,18 +102,21 @@ fn test_mutable_append_history() {
    });

    engine
-        .append_history(vec![Item::user_message("First")])
+        .append_history(&mut history, vec![Item::user_message("First")])
        .unwrap();

    engine
-        .append_history(vec![
-            Item::assistant_message("Response 1"),
-            Item::user_message("Second"),
-            Item::assistant_message("Response 2"),
-        ])
+        .append_history(
+            &mut history,
+            vec![
+                Item::assistant_message("Response 1"),
+                Item::user_message("Second"),
+                Item::assistant_message("Response 2"),
+            ],
+        )
        .unwrap();

-    assert_eq!(engine.history().len(), 4);
+    assert_eq!(history.len(), 4);
    assert_eq!(
        observed.lock().unwrap().as_slice(),
        ["First", "Response 1", "Second", "Response 2"]
@@ -185,6 +191,7 @@ async fn history_append_failure_stops_before_tool_execution() {
    ]);
    let tool = CountingTool::new("count_tool");
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    engine.register_tool(tool.definition());
    engine.on_history_append(|item| {
        if item.is_tool_call() {
@@ -194,15 +201,15 @@ async fn history_append_failure_stops_before_tool_execution() {
        }
    });

-    let mut engine = engine.lock();
-    let error = engine.run("use the tool").await.unwrap_err();
+    let mut engine = engine.lock(&history);
+    let exit = engine.run(&mut history, "use the tool").await;

    assert!(
-        matches!(error, EngineError::HistoryAppend(ref message) if message == "simulated ENOSPC")
+        matches!(exit, EngineRunExit::Interrupted(StopReason::Unexpected(EngineError::HistoryAppend(ref message))) if message == "simulated ENOSPC")
    );
    assert_eq!(tool.call_count(), 0);
-    assert_eq!(engine.history().len(), 1);
-    assert_eq!(engine.history()[0].as_text(), Some("use the tool"));
+    assert_eq!(history.len(), 1);
+    assert_eq!(history.entries()[0].item.as_text(), Some("use the tool"));
 }

 // =============================================================================
@@ -214,21 +221,22 @@ async fn history_append_failure_stops_before_tool_execution() {
 fn test_lock_transition() {
    let client = MockLlmClient::new(vec![]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();

    engine.set_system_prompt("System");
    engine
-        .append_history(vec![Item::user_message("Hello")])
+        .append_history(&mut history, vec![Item::user_message("Hello")])
        .unwrap();
    engine
-        .append_history(vec![Item::assistant_message("Hi")])
+        .append_history(&mut history, vec![Item::assistant_message("Hi")])
        .unwrap();

    // Lock
-    let locked_engine = engine.lock();
+    let locked_engine = engine.lock(&history);

    // History and system prompt are still accessible in Locked state
    assert_eq!(locked_engine.get_system_prompt(), Some("System"));
-    assert_eq!(locked_engine.history().len(), 2);
+    assert_eq!(history.len(), 2);
    assert_eq!(locked_engine.locked_prefix_len(), 2);
 }

@@ -237,21 +245,22 @@ fn test_lock_transition() {
 fn test_unlock_transition() {
    let client = MockLlmClient::new(vec![]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();

    engine
-        .append_history(vec![Item::user_message("Hello")])
+        .append_history(&mut history, vec![Item::user_message("Hello")])
        .unwrap();
-    let locked_engine = engine.lock();
+    let locked_engine = engine.lock(&history);

    // Unlock
    let mut engine = locked_engine.unlock();

    // History operations are available again in Mutable state
    engine
-        .append_history(vec![Item::assistant_message("Hi")])
+        .append_history(&mut history, vec![Item::assistant_message("Hi")])
        .unwrap();
-    engine.clear_history();
-    assert!(engine.history().is_empty());
+    engine.clear_history(&mut history);
+    assert!(history.is_empty());
 }

 // =============================================================================
@@ -272,20 +281,20 @@ async fn test_mutable_run_updates_history() -> Result<(), EngineError> {

    let client = MockLlmClient::new(events);
    let engine = Engine::new(client);
+    let mut history: History = History::new();

    // Execute (Mutable::run consumes self, returns EngineRunOutput)
-    let out = engine.run("Hi there").await?;
-    let engine = out.engine;
+    let _out = engine.run(&mut history, "Hi there").await;

    // History is updated
-    let history = engine.history();
+    let entries = history.entries();
    assert_eq!(history.len(), 2); // user + assistant

    // User message
-    assert_eq!(history[0].as_text(), Some("Hi there"));
+    assert_eq!(entries[0].item.as_text(), Some("Hi there"));

    // Assistant message
-    assert_eq!(history[1].as_text(), Some("Hello, I'm an assistant!"));
+    assert_eq!(entries[1].item.as_text(), Some("Hello, I'm an assistant!"));

    Ok(())
 }
@@ -316,35 +325,36 @@ async fn test_locked_multi_turn_history_accumulation() {
    ]);

    let engine = Engine::new(client).system_prompt("You are helpful.");
+    let mut history: History = History::new();

    // Lock (after setting system prompt)
-    let mut locked_engine = engine.lock();
+    let mut locked_engine = engine.lock(&history);
    assert_eq!(locked_engine.locked_prefix_len(), 0); // No items yet

    // Turn 1
-    let result1 = locked_engine.run("Hello!").await;
-    assert!(result1.is_ok());
-    assert_eq!(locked_engine.history().len(), 2); // user + assistant
+    let result1 = locked_engine.run(&mut history, "Hello!").await;
+    assert!(matches!(result1, EngineRunExit::Finished));
+    assert_eq!(history.len(), 2); // user + assistant

    // Turn 2
-    let result2 = locked_engine.run("Can you help me?").await;
-    assert!(result2.is_ok());
-    assert_eq!(locked_engine.history().len(), 4); // 2 * (user + assistant)
+    let result2 = locked_engine.run(&mut history, "Can you help me?").await;
+    assert!(matches!(result2, EngineRunExit::Finished));
+    assert_eq!(history.len(), 4); // 2 * (user + assistant)

    // Verify history contents
-    let history = locked_engine.history();
+    let entries = history.entries();

    // Turn 1 user message
-    assert_eq!(history[0].as_text(), Some("Hello!"));
+    assert_eq!(entries[0].item.as_text(), Some("Hello!"));

    // Turn 1 assistant message
-    assert_eq!(history[1].as_text(), Some("Nice to meet you!"));
+    assert_eq!(entries[1].item.as_text(), Some("Nice to meet you!"));

    // Turn 2 user message
-    assert_eq!(history[2].as_text(), Some("Can you help me?"));
+    assert_eq!(entries[2].item.as_text(), Some("Can you help me?"));

    // Turn 2 assistant message
-    assert_eq!(history[3].as_text(), Some("I can help with that."));
+    assert_eq!(entries[3].item.as_text(), Some("I can help with that."));
 }

 /// Verify that locked_prefix_len correctly records history length at lock time
@@ -370,26 +380,33 @@ async fn test_locked_prefix_len_tracking() {
    ]);

    let mut engine = Engine::new(client);
+    let mut history: History = History::new();

    // Add items beforehand
    engine
-        .append_history(vec![Item::user_message("Pre-existing message 1")])
+        .append_history(
+            &mut history,
+            vec![Item::user_message("Pre-existing message 1")],
+        )
        .unwrap();
    engine
-        .append_history(vec![Item::assistant_message("Pre-existing response 1")])
+        .append_history(
+            &mut history,
+            vec![Item::assistant_message("Pre-existing response 1")],
+        )
        .unwrap();

-    assert_eq!(engine.history().len(), 2);
+    assert_eq!(history.len(), 2);

    // Lock
-    let mut locked_engine = engine.lock();
+    let mut locked_engine = engine.lock(&history);
    assert_eq!(locked_engine.locked_prefix_len(), 2); // 2 items at lock time

    // Execute turn
-    locked_engine.run("New message").await.unwrap();
+    locked_engine.run(&mut history, "New message").await;

    // History grows but locked_prefix_len remains unchanged
-    assert_eq!(locked_engine.history().len(), 4); // 2 + 2
+    assert_eq!(history.len(), 4); // 2 + 2
    assert_eq!(locked_engine.locked_prefix_len(), 2); // Unchanged
 }

@@ -416,18 +433,22 @@ async fn test_turn_count_increment() -> Result<(), EngineError> {
    ]);

    let engine = Engine::new(client);
+    let mut history: History = History::new();

    assert_eq!(engine.turn_count(), 0);
    assert_eq!(engine.llm_call_count(), 0);

    // First run consumes Mutable, returns EngineRunOutput
-    let mut engine = engine.run("First").await?.engine;
+    let mut engine = engine.run(&mut history, "First").await.engine;
    assert_eq!(engine.turn_count(), 1);
    // Retry not yet implemented → AgentTurn:LlmCall is 1:1.
    assert_eq!(engine.llm_call_count(), 1);

    // Subsequent runs on Locked take &mut self
-    engine.run("Second").await?;
+    assert!(matches!(
+        engine.run(&mut history, "Second").await,
+        EngineRunExit::Finished
+    ));
    assert_eq!(engine.turn_count(), 2);
    assert_eq!(engine.llm_call_count(), 2);

@@ -447,28 +468,29 @@ async fn test_unlock_edit_relock() {
    ]]);

    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    engine
-        .append_history(vec![
-            Item::user_message("Hello"),
-            Item::assistant_message("Hi"),
-        ])
+        .append_history(
+            &mut history,
+            vec![Item::user_message("Hello"), Item::assistant_message("Hi")],
+        )
        .unwrap();

    // Lock -> Unlock
-    let locked = engine.lock();
+    let locked = engine.lock(&history);
    assert_eq!(locked.locked_prefix_len(), 2);

    let mut unlocked = locked.unlock();

    // Edit history
-    unlocked.clear_history();
+    unlocked.clear_history(&mut history);
    unlocked
-        .append_history(vec![Item::user_message("Fresh start")])
+        .append_history(&mut history, vec![Item::user_message("Fresh start")])
        .unwrap();

    // Re-lock
-    let relocked = unlocked.lock();
-    assert_eq!(relocked.history().len(), 1);
+    let relocked = unlocked.lock(&history);
+    assert_eq!(history.len(), 1);
    assert_eq!(relocked.locked_prefix_len(), 1);
 }

@@ -511,19 +533,26 @@ async fn test_lock_unlock_relock_tools_remain_effective() {
    ]);

    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    let tool_a = CountingTool::new("tool_a");
    engine.register_tool(tool_a.definition());

-    let mut locked = engine.lock();
-    locked.run("first").await.expect("first run");
+    let mut locked = engine.lock(&history);
+    assert!(matches!(
+        locked.run(&mut history, "first").await,
+        EngineRunExit::Finished
+    ));
    assert_eq!(tool_a.call_count(), 1, "tool_a should be called once");

    let mut unlocked = locked.unlock();
    let tool_b = CountingTool::new("tool_b");
    unlocked.register_tool(tool_b.definition());

-    let mut relocked = unlocked.lock();
-    relocked.run("second").await.expect("second run");
+    let mut relocked = unlocked.lock(&history);
+    assert!(matches!(
+        relocked.run(&mut history, "second").await,
+        EngineRunExit::Finished
+    ));

    assert_eq!(tool_a.call_count(), 1, "tool_a should not be called again");
    assert_eq!(tool_b.call_count(), 1, "tool_b should be called once");
@@ -538,8 +567,9 @@ async fn test_lock_unlock_relock_tools_remain_effective() {
 fn test_system_prompt_preserved_in_locked_state() {
    let client = MockLlmClient::new(vec![]);
    let engine = Engine::new(client).system_prompt("Important system prompt");
+    let history: History = History::new();

-    let locked = engine.lock();
+    let locked = engine.lock(&history);
    assert_eq!(locked.get_system_prompt(), Some("Important system prompt"));

    let unlocked = locked.unlock();
@@ -554,14 +584,15 @@ fn test_system_prompt_preserved_in_locked_state() {
 fn test_system_prompt_change_after_unlock() {
    let client = MockLlmClient::new(vec![]);
    let engine = Engine::new(client).system_prompt("Original prompt");
+    let history: History = History::new();

-    let locked = engine.lock();
+    let locked = engine.lock(&history);
    let mut unlocked = locked.unlock();

    unlocked.set_system_prompt("New prompt");
    assert_eq!(unlocked.get_system_prompt(), Some("New prompt"));

-    let relocked = unlocked.lock();
+    let relocked = unlocked.lock(&history);
    assert_eq!(relocked.get_system_prompt(), Some("New prompt"));
 }

@@ -623,40 +654,55 @@ impl Interceptor for ContinueTurnOnce {

 #[tokio::test]
 async fn max_turns_is_scoped_to_each_fresh_run() {
+    let mut history: History = History::new();
    let responses = vec![completed_text_events(), completed_text_events()];
    let mut engine = Engine::new(MockLlmClient::with_responses(responses));
    engine.set_max_turns(Some(1));
-    let mut engine = engine.lock();
+    let mut engine = engine.lock(&history);

-    assert_eq!(engine.run("first").await.unwrap(), EngineResult::Finished);
+    assert!(matches!(
+        engine.run(&mut history, "first").await,
+        EngineRunExit::Finished
+    ));
    assert_eq!(engine.turn_count(), 1);
    assert_eq!(engine.active_run_turn_count(), None);

-    assert_eq!(engine.run("second").await.unwrap(), EngineResult::Finished);
+    assert!(matches!(
+        engine.run(&mut history, "second").await,
+        EngineRunExit::Finished
+    ));
    assert_eq!(engine.turn_count(), 2);
    assert_eq!(engine.active_run_turn_count(), None);
 }

 #[tokio::test]
 async fn yielded_resume_keeps_the_same_unspent_turn_budget() {
+    let mut history: History = History::new();
    let mut engine = Engine::new(MockLlmClient::new(completed_text_events()));
    engine.set_max_turns(Some(1));
    engine.set_interceptor(YieldOnce {
        calls: AtomicUsize::new(0),
    });
-    let mut engine = engine.lock();
+    let mut engine = engine.lock(&history);

-    assert_eq!(engine.run("start").await.unwrap(), EngineResult::Yielded);
+    assert!(matches!(
+        engine.run(&mut history, "start").await,
+        EngineRunExit::Yielded
+    ));
    assert_eq!(engine.turn_count(), 0);
    assert_eq!(engine.active_run_turn_count(), Some(0));

-    assert_eq!(engine.resume().await.unwrap(), EngineResult::Finished);
+    assert!(matches!(
+        engine.resume(&mut history).await,
+        EngineRunExit::Finished
+    ));
    assert_eq!(engine.turn_count(), 1);
    assert_eq!(engine.active_run_turn_count(), None);
 }

 #[tokio::test]
 async fn paused_tool_resume_does_not_reset_the_consumed_turn_budget() {
+    let mut history: History = History::new();
    let events = vec![
        Event::tool_use_start(0, "call_1", "count_tool"),
        Event::tool_input_delta(0, "{}"),
@@ -672,14 +718,20 @@ async fn paused_tool_resume_does_not_reset_the_consumed_turn_budget() {
    engine.set_interceptor(PauseToolOnce {
        calls: AtomicUsize::new(0),
    });
-    let mut engine = engine.lock();
+    let mut engine = engine.lock(&history);

-    assert_eq!(engine.run("call it").await.unwrap(), EngineResult::Paused);
+    assert!(matches!(
+        engine.run(&mut history, "call it").await,
+        EngineRunExit::Paused
+    ));
    assert_eq!(engine.turn_count(), 1);
    assert_eq!(engine.active_run_turn_count(), Some(1));
    assert_eq!(tool.call_count(), 0);

-    assert_eq!(engine.resume().await.unwrap(), EngineResult::LimitReached);
+    assert!(matches!(
+        engine.resume(&mut history).await,
+        EngineRunExit::Interrupted(StopReason::LimitReached)
+    ));
    assert_eq!(engine.turn_count(), 1);
    assert_eq!(engine.active_run_turn_count(), None);
    assert_eq!(tool.call_count(), 1, "the consumed turn's tool still runs");
@@ -687,6 +739,7 @@ async fn paused_tool_resume_does_not_reset_the_consumed_turn_budget() {

 #[tokio::test]
 async fn fresh_input_abandons_a_paused_run_and_starts_a_new_budget() {
+    let mut history: History = History::new();
    let tool_events = vec![
        Event::tool_use_start(0, "call_1", "count_tool"),
        Event::tool_input_delta(0, "{}"),
@@ -703,12 +756,18 @@ async fn fresh_input_abandons_a_paused_run_and_starts_a_new_budget() {
    engine.set_interceptor(PauseToolOnce {
        calls: AtomicUsize::new(0),
    });
-    let mut engine = engine.lock();
+    let mut engine = engine.lock(&history);

-    assert_eq!(engine.run("pause").await.unwrap(), EngineResult::Paused);
+    assert!(matches!(
+        engine.run(&mut history, "pause").await,
+        EngineRunExit::Paused
+    ));
    assert_eq!(engine.active_run_turn_count(), Some(1));

-    assert_eq!(engine.run("replace").await.unwrap(), EngineResult::Finished);
+    assert!(matches!(
+        engine.run(&mut history, "replace").await,
+        EngineRunExit::Finished
+    ));
    assert_eq!(engine.turn_count(), 2);
    assert_eq!(engine.active_run_turn_count(), None);
    assert_eq!(tool.call_count(), 1, "pending-tool semantics are unchanged");
@@ -716,17 +775,18 @@ async fn fresh_input_abandons_a_paused_run_and_starts_a_new_budget() {

 #[tokio::test]
 async fn interceptor_continuation_consumes_the_logical_run_budget() {
+    let mut history: History = History::new();
    let mut engine = Engine::new(MockLlmClient::new(completed_text_events()));
    engine.set_max_turns(Some(1));
    engine.set_interceptor(ContinueTurnOnce {
        calls: AtomicUsize::new(0),
    });
-    let mut engine = engine.lock();
+    let mut engine = engine.lock(&history);

-    assert_eq!(
-        engine.run("start").await.unwrap(),
-        EngineResult::LimitReached
-    );
+    assert!(matches!(
+        engine.run(&mut history, "start").await,
+        EngineRunExit::Interrupted(StopReason::LimitReached)
+    ));
    assert_eq!(engine.turn_count(), 1);
    assert_eq!(engine.llm_call_count(), 1);
    assert_eq!(engine.active_run_turn_count(), None);
@@ -734,14 +794,17 @@ async fn interceptor_continuation_consumes_the_logical_run_budget() {

 #[tokio::test]
 async fn restored_active_run_budget_is_enforced_before_another_llm_call() {
+    let mut history: History = History::new();
    let mut engine = Engine::new(MockLlmClient::new(completed_text_events()));
    engine.set_max_turns(Some(1));
    engine.set_turn_count(7);
-    engine.set_last_run_interrupted(true);
    engine.set_active_run_turn_count(Some(1));
-    let mut engine = engine.lock();
+    let mut engine = engine.lock(&history);

-    assert_eq!(engine.resume().await.unwrap(), EngineResult::LimitReached);
+    assert!(matches!(
+        engine.resume(&mut history).await,
+        EngineRunExit::Interrupted(StopReason::LimitReached)
+    ));
    assert_eq!(engine.turn_count(), 7);
    assert_eq!(engine.llm_call_count(), 0);
    assert_eq!(engine.active_run_turn_count(), None);
@@ -6,12 +6,13 @@ use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};

-use agen::Engine;
 use agen::interceptor::{Interceptor, PostToolAction, PreToolAction, ToolCallInfo, ToolResultInfo};
 use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
 use agen::tool::{
    Tool, ToolDefinition, ToolError, ToolExecutionContext, ToolMeta, ToolOutput, ToolResult,
+    ToolResultDisposition,
 };
+use agen::{Engine, History, Item, ToolExecutionPolicy};
 use async_trait::async_trait;

 mod common;
@@ -70,6 +71,144 @@ impl Tool for SlowTool {
    }
 }

+#[derive(Clone)]
+struct FirstAttemptHangsTool {
+    calls: Arc<AtomicUsize>,
+}
+
+impl FirstAttemptHangsTool {
+    fn new() -> Self {
+        Self {
+            calls: Arc::new(AtomicUsize::new(0)),
+        }
+    }
+
+    fn definition(&self) -> ToolDefinition {
+        let tool = self.clone();
+        Arc::new(move || {
+            let meta = ToolMeta::new("hang_once")
+                .description("Hangs on the first execution attempt")
+                .input_schema(serde_json::json!({"type": "object"}));
+            (meta, Arc::new(tool.clone()) as Arc<dyn Tool>)
+        })
+    }
+
+    fn call_count(&self) -> usize {
+        self.calls.load(Ordering::SeqCst)
+    }
+}
+
+#[async_trait]
+impl Tool for FirstAttemptHangsTool {
+    async fn execute(
+        &self,
+        _input_json: &str,
+        _ctx: ToolExecutionContext,
+    ) -> Result<ToolOutput, ToolError> {
+        let attempt = self.calls.fetch_add(1, Ordering::SeqCst);
+        if attempt == 0 {
+            std::future::pending::<()>().await;
+        }
+        Ok("completed on retry".to_string().into())
+    }
+}
+
+#[derive(Clone)]
+struct CooperativeCancelTool {
+    calls: Arc<AtomicUsize>,
+    cancelled: Arc<tokio::sync::Notify>,
+}
+
+impl CooperativeCancelTool {
+    fn new() -> Self {
+        Self {
+            calls: Arc::new(AtomicUsize::new(0)),
+            cancelled: Arc::new(tokio::sync::Notify::new()),
+        }
+    }
+
+    fn definition(&self) -> ToolDefinition {
+        let tool = self.clone();
+        Arc::new(move || {
+            let meta = ToolMeta::new("cooperative")
+                .description("Returns bounded progress after cancellation")
+                .input_schema(serde_json::json!({"type": "object"}));
+            (meta, Arc::new(tool.clone()) as Arc<dyn Tool>)
+        })
+    }
+}
+
+#[async_trait]
+impl Tool for CooperativeCancelTool {
+    async fn execute(
+        &self,
+        _input_json: &str,
+        _ctx: ToolExecutionContext,
+    ) -> Result<ToolOutput, ToolError> {
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        self.cancelled.notified().await;
+        Err(ToolError::Cancelled(ToolOutput {
+            summary: "cooperative command cancelled".to_string(),
+            content: Some("stdout before cancellation\nstderr before cancellation".to_string()),
+            attachments: Vec::new(),
+        }))
+    }
+
+    async fn cancel(&self, _call_id: &str) -> Result<(), ToolError> {
+        self.cancelled.notify_one();
+        Ok(())
+    }
+}
+
+#[derive(Clone)]
+struct SafePauseTool {
+    calls: Arc<AtomicUsize>,
+    cancellations: Arc<AtomicUsize>,
+    release: Arc<tokio::sync::Notify>,
+}
+
+impl SafePauseTool {
+    fn new() -> Self {
+        Self {
+            calls: Arc::new(AtomicUsize::new(0)),
+            cancellations: Arc::new(AtomicUsize::new(0)),
+            release: Arc::new(tokio::sync::Notify::new()),
+        }
+    }
+
+    fn definition(&self) -> ToolDefinition {
+        let tool = self.clone();
+        Arc::new(move || {
+            let meta = ToolMeta::new("safe_pause")
+                .description("Waits for a safe-boundary release")
+                .input_schema(serde_json::json!({"type": "object"}));
+            (meta, Arc::new(tool.clone()) as Arc<dyn Tool>)
+        })
+    }
+}
+
+#[async_trait]
+impl Tool for SafePauseTool {
+    async fn execute(
+        &self,
+        _input_json: &str,
+        _ctx: ToolExecutionContext,
+    ) -> Result<ToolOutput, ToolError> {
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        self.release.notified().await;
+        Ok(ToolOutput {
+            summary: "safe-boundary complete".to_string(),
+            content: Some("safe-boundary complete".to_string()),
+            attachments: Vec::new(),
+        })
+    }
+
+    async fn cancel(&self, _call_id: &str) -> Result<(), ToolError> {
+        self.cancellations.fetch_add(1, Ordering::SeqCst);
+        Ok(())
+    }
+}
+
 #[derive(Clone)]
 struct ContextRecordingTool {
    name: String,
@@ -145,6 +284,7 @@ async fn test_parallel_tool_execution() {
        ],
    ]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    let tool1 = SlowTool::new("slow_tool_1", 100);
    let tool2 = SlowTool::new("slow_tool_2", 100);
    let tool3 = SlowTool::new("slow_tool_3", 100);
@@ -159,7 +299,7 @@ async fn test_parallel_tool_execution() {

    let start = Instant::now();
    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let _result = engine.run("Run all tools").await;
+    let _result = engine.run(&mut history, "Run all tools").await;
    let elapsed = start.elapsed();

    // Verify all tools were called
@@ -178,6 +318,450 @@ async fn test_parallel_tool_execution() {
    println!("Parallel execution completed in {:?}", elapsed);
 }

+#[tokio::test]
+async fn completed_results_commit_before_publish_without_waiting_for_siblings() {
+    let client = MockLlmClient::with_responses(vec![
+        vec![
+            Event::tool_use_start(0, "call_slow", "slow_first"),
+            Event::tool_input_delta(0, r#"{}"#),
+            Event::tool_use_stop(0),
+            Event::tool_use_start(1, "call_fast", "fast_second"),
+            Event::tool_input_delta(1, r#"{}"#),
+            Event::tool_use_stop(1),
+            Event::Status(StatusEvent {
+                status: ResponseStatus::Completed,
+            }),
+        ],
+        vec![
+            Event::text_block_start(0),
+            Event::text_delta(0, "Done"),
+            Event::text_block_stop(0, None),
+            Event::Status(StatusEvent {
+                status: ResponseStatus::Completed,
+            }),
+        ],
+    ]);
+    let client_probe = client.clone();
+    let mut engine = Engine::new(client);
+    engine.register_tool(SlowTool::new("slow_first", 100).definition());
+    engine.register_tool(SlowTool::new("fast_second", 5).definition());
+
+    let observed = Arc::new(Mutex::new(Vec::<String>::new()));
+    let published = observed.clone();
+    engine.on_tool_result(move |result| {
+        published
+            .lock()
+            .unwrap()
+            .push(format!("publish:{}", result.tool_use_id));
+    });
+
+    let committed = observed.clone();
+    let mut annotate = move |item: &Item| {
+        if let Item::ToolResult { call_id, .. } = item {
+            committed.lock().unwrap().push(format!("commit:{call_id}"));
+        }
+        Ok(())
+    };
+    let mut history = History::new();
+    let _ = engine
+        .run_with_annotation(&mut history, "run both", &mut annotate)
+        .await;
+    observed.lock().unwrap().push("run-returned".to_string());
+
+    assert_eq!(
+        observed.lock().unwrap().as_slice(),
+        [
+            "commit:call_fast",
+            "publish:call_fast",
+            "commit:call_slow",
+            "publish:call_slow",
+            "run-returned",
+        ]
+    );
+
+    let committed_order: Vec<_> = history
+        .iter()
+        .filter_map(|entry| match &entry.item {
+            Item::ToolResult { call_id, .. } => Some(call_id.as_str()),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(committed_order, ["call_fast", "call_slow"]);
+
+    let requests = client_probe.requests();
+    let projected_order: Vec<_> = requests[1]
+        .items
+        .iter()
+        .filter_map(|item| match item {
+            Item::ToolResult { call_id, .. } => Some(call_id.as_str()),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(projected_order, ["call_slow", "call_fast"]);
+}
+
+#[tokio::test]
+async fn cancellation_preserves_completed_results_and_resume_skips_them() {
+    let client = MockLlmClient::with_responses(vec![
+        vec![
+            Event::tool_use_start(0, "call_hang", "hang_once"),
+            Event::tool_input_delta(0, r#"{}"#),
+            Event::tool_use_stop(0),
+            Event::tool_use_start(1, "call_fast_a", "fast_a"),
+            Event::tool_input_delta(1, r#"{}"#),
+            Event::tool_use_stop(1),
+            Event::tool_use_start(2, "call_fast_b", "fast_b"),
+            Event::tool_input_delta(2, r#"{}"#),
+            Event::tool_use_stop(2),
+            Event::Status(StatusEvent {
+                status: ResponseStatus::Completed,
+            }),
+        ],
+        vec![
+            Event::text_block_start(0),
+            Event::text_delta(0, "Recovered"),
+            Event::text_block_stop(0, None),
+            Event::Status(StatusEvent {
+                status: ResponseStatus::Completed,
+            }),
+        ],
+    ]);
+    let mut engine = Engine::new(client);
+    let hanging = FirstAttemptHangsTool::new();
+    let fast_a = SlowTool::new("fast_a", 1);
+    let fast_b = SlowTool::new("fast_b", 2);
+    engine.register_tool(hanging.definition());
+    engine.register_tool(fast_a.definition());
+    engine.register_tool(fast_b.definition());
+
+    let cancel = engine.cancel_sender();
+    let cancel_task = tokio::spawn(async move {
+        tokio::time::sleep(Duration::from_millis(30)).await;
+        cancel.send(()).await.unwrap();
+    });
+    let mut history = History::new();
+    let output = engine.run(&mut history, "start").await;
+    let mut engine = output.engine;
+    cancel_task.await.unwrap();
+
+    let completed_before_resume = history
+        .iter()
+        .filter(|entry| {
+            matches!(
+                &entry.item,
+                Item::ToolResult { call_id, .. }
+                    if call_id == "call_fast_a" || call_id == "call_fast_b"
+            )
+        })
+        .count();
+    let unknown_before_resume = history
+        .iter()
+        .filter(|entry| {
+            matches!(
+                &entry.item,
+                Item::ToolResult {
+                    call_id,
+                    disposition: ToolResultDisposition::OutcomeUnknown,
+                    ..
+                } if call_id == "call_hang"
+            )
+        })
+        .count();
+    assert_eq!(completed_before_resume, 2);
+    assert_eq!(unknown_before_resume, 1);
+    assert_eq!(fast_a.call_count(), 1);
+    assert_eq!(fast_b.call_count(), 1);
+    assert_eq!(hanging.call_count(), 1);
+
+    let _ = engine.resume(&mut history).await;
+
+    assert_eq!(
+        fast_a.call_count(),
+        1,
+        "completed call must not be re-executed"
+    );
+    assert_eq!(
+        fast_b.call_count(),
+        1,
+        "completed call must not be re-executed"
+    );
+    assert_eq!(
+        hanging.call_count(),
+        1,
+        "OutcomeUnknown is terminal and must not be re-executed"
+    );
+    let completed_after_resume = history
+        .iter()
+        .filter(|entry| {
+            matches!(
+                &entry.item,
+                Item::ToolResult { call_id, .. }
+                    if call_id == "call_fast_a" || call_id == "call_fast_b"
+            )
+        })
+        .count();
+    assert_eq!(completed_after_resume, 2);
+    assert_eq!(
+        history
+            .iter()
+            .filter(|entry| {
+                matches!(
+                    &entry.item,
+                    Item::ToolResult {
+                        call_id,
+                        disposition: ToolResultDisposition::OutcomeUnknown,
+                        ..
+                    } if call_id == "call_hang"
+                )
+            })
+            .count(),
+        1
+    );
+}
+
+#[tokio::test]
+async fn cooperative_cancellation_commits_bounded_terminal_output() {
+    let client = MockLlmClient::with_responses(vec![vec![
+        Event::tool_use_start(0, "call_cooperative", "cooperative"),
+        Event::tool_input_delta(0, r#"{}"#),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]]);
+    let mut engine = Engine::new(client);
+    let tool = CooperativeCancelTool::new();
+    engine.register_tool(tool.definition());
+    let observed = Arc::new(Mutex::new(Vec::<&'static str>::new()));
+    let published = observed.clone();
+    engine.on_tool_result(move |_| published.lock().unwrap().push("published"));
+    let committed = observed.clone();
+    let mut annotate = move |item: &Item| {
+        if matches!(item, Item::ToolResult { .. }) {
+            committed.lock().unwrap().push("committed");
+        }
+        Ok(())
+    };
+
+    let cancel = engine.cancel_sender();
+    let cancel_task = tokio::spawn(async move {
+        tokio::time::sleep(Duration::from_millis(30)).await;
+        cancel.send(()).await.unwrap();
+    });
+    let mut history = History::new();
+    let output = engine
+        .run_with_annotation(&mut history, "start", &mut annotate)
+        .await;
+    observed.lock().unwrap().push("run-returned");
+    cancel_task.await.unwrap();
+
+    assert_eq!(
+        observed.lock().unwrap().as_slice(),
+        ["committed", "published", "run-returned"]
+    );
+    assert_eq!(tool.calls.load(Ordering::SeqCst), 1);
+    let terminal: Vec<_> = history
+        .iter()
+        .filter_map(|entry| match &entry.item {
+            Item::ToolResult {
+                call_id,
+                disposition,
+                content,
+                ..
+            } if call_id == "call_cooperative" => Some((*disposition, content.as_deref())),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(terminal.len(), 1);
+    assert_eq!(terminal[0].0, ToolResultDisposition::Cancelled);
+    assert_eq!(
+        terminal[0].1,
+        Some("stdout before cancellation\nstderr before cancellation")
+    );
+    assert!(matches!(
+        output.result,
+        agen::EngineRunExit::Interrupted(agen::StopReason::Cancelled)
+    ));
+}
+
+#[tokio::test]
+async fn pause_waits_for_started_tool_terminal_without_cancelling_provider() {
+    let client = MockLlmClient::with_responses(vec![vec![
+        Event::tool_use_start(0, "call_safe_pause", "safe_pause"),
+        Event::tool_input_delta(0, r#"{}"#),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]]);
+    let mut engine = Engine::new(client);
+    let tool = SafePauseTool::new();
+    engine.register_tool(tool.definition());
+
+    let pause = engine.pause_sender();
+    let calls = Arc::clone(&tool.calls);
+    let release = Arc::clone(&tool.release);
+    let control = tokio::spawn(async move {
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while calls.load(Ordering::SeqCst) == 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("tool execution starts");
+        pause.send(()).await.unwrap();
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        release.notify_one();
+    });
+
+    let started_at = std::time::Instant::now();
+    let mut history = History::new();
+    let output = engine.run(&mut history, "pause safely").await;
+    control.await.unwrap();
+
+    assert!(started_at.elapsed() >= Duration::from_millis(50));
+    assert_eq!(tool.calls.load(Ordering::SeqCst), 1);
+    assert_eq!(tool.cancellations.load(Ordering::SeqCst), 0);
+    assert!(matches!(output.result, agen::EngineRunExit::Paused));
+    assert!(history.iter().any(|entry| matches!(
+        &entry.item,
+        Item::ToolResult {
+            call_id,
+            disposition: ToolResultDisposition::Success,
+            ..
+        } if call_id == "call_safe_pause"
+    )));
+}
+
+#[tokio::test]
+async fn pause_escalates_to_explicit_cancel_and_confirm_after_safe_boundary_deadline() {
+    let client = MockLlmClient::with_responses(vec![vec![
+        Event::tool_use_start(0, "call_pause_cancel", "cooperative"),
+        Event::tool_input_delta(0, r#"{}"#),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]]);
+    let mut engine = Engine::new(client);
+    engine.set_tool_execution_policy(ToolExecutionPolicy {
+        pause_safe_boundary_timeout: Duration::from_millis(20),
+        cancellation_request_timeout: Duration::from_millis(50),
+        terminal_confirmation_timeout: Duration::from_millis(100),
+    });
+    let tool = CooperativeCancelTool::new();
+    engine.register_tool(tool.definition());
+
+    let pause = engine.pause_sender();
+    let calls = Arc::clone(&tool.calls);
+    let control = tokio::spawn(async move {
+        tokio::time::timeout(Duration::from_secs(1), async {
+            while calls.load(Ordering::SeqCst) == 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .expect("tool execution starts");
+        pause.send(()).await.unwrap();
+    });
+
+    let mut history = History::new();
+    let output = engine.run(&mut history, "pause with escalation").await;
+    control.await.unwrap();
+
+    assert!(matches!(output.result, agen::EngineRunExit::Paused));
+    assert!(history.iter().any(|entry| matches!(
+        &entry.item,
+        Item::ToolResult {
+            call_id,
+            disposition: ToolResultDisposition::Cancelled,
+            ..
+        } if call_id == "call_pause_cancel"
+    )));
+}
+
+#[tokio::test]
+async fn cancellation_completion_race_commits_one_terminal_output() {
+    for iteration in 0..24u64 {
+        let client = MockLlmClient::with_responses(vec![
+            vec![
+                Event::tool_use_start(0, "call_racy", "racy"),
+                Event::tool_input_delta(0, r#"{}"#),
+                Event::tool_use_stop(0),
+                Event::Status(StatusEvent {
+                    status: ResponseStatus::Completed,
+                }),
+            ],
+            vec![Event::Status(StatusEvent {
+                status: ResponseStatus::Completed,
+            })],
+        ]);
+        let mut engine = Engine::new(client);
+        let delay = 2 + iteration % 3;
+        let tool = SlowTool::new("racy", delay);
+        engine.register_tool(tool.definition());
+        let cancel = engine.cancel_sender();
+        let cancel_task = tokio::spawn(async move {
+            tokio::time::sleep(Duration::from_millis(delay)).await;
+            let _ = cancel.send(()).await;
+        });
+
+        let mut history = History::new();
+        let _ = engine.run(&mut history, "race").await;
+        cancel_task.await.unwrap();
+        let terminal_count = history
+            .iter()
+            .filter(|entry| {
+                matches!(
+                    &entry.item,
+                    Item::ToolResult { call_id, .. } if call_id == "call_racy"
+                )
+            })
+            .count();
+        assert_eq!(terminal_count, 1, "iteration {iteration}");
+        assert_eq!(tool.call_count(), 1, "iteration {iteration}");
+    }
+}
+
+#[tokio::test]
+async fn tool_result_commit_failure_prevents_publication() {
+    let client = MockLlmClient::with_responses(vec![vec![
+        Event::tool_use_start(0, "call_fast", "fast"),
+        Event::tool_input_delta(0, r#"{}"#),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]]);
+    let mut engine = Engine::new(client);
+    engine.register_tool(SlowTool::new("fast", 1).definition());
+
+    let published = Arc::new(AtomicUsize::new(0));
+    let published_probe = published.clone();
+    engine.on_tool_result(move |_| {
+        published_probe.fetch_add(1, Ordering::SeqCst);
+    });
+
+    let mut history = History::new();
+    let mut reject_tool_result = |item: &Item| {
+        if matches!(item, Item::ToolResult { .. }) {
+            Err("session log unavailable".to_string())
+        } else {
+            Ok(())
+        }
+    };
+    let _ = engine
+        .run_with_annotation(&mut history, "start", &mut reject_tool_result)
+        .await;
+
+    assert_eq!(published.load(Ordering::SeqCst), 0);
+    assert!(
+        history
+            .iter()
+            .all(|entry| !matches!(entry.item, Item::ToolResult { .. }))
+    );
+}
+
 #[tokio::test]
 async fn test_tool_execution_context_order_and_batch_id() {
    let client = MockLlmClient::with_responses(vec![
@@ -205,13 +789,14 @@ async fn test_tool_execution_context_order_and_batch_id() {
        ],
    ]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    let contexts = Arc::new(Mutex::new(Vec::new()));

    engine.register_tool(ContextRecordingTool::new("record_a", contexts.clone()).definition());
    engine.register_tool(ContextRecordingTool::new("record_b", contexts.clone()).definition());
    engine.register_tool(ContextRecordingTool::new("record_c", contexts.clone()).definition());

-    let _ = engine.run("record contexts").await;
+    let _ = engine.run(&mut history, "record contexts").await;

    let mut contexts = contexts.lock().unwrap().clone();
    contexts.sort_by_key(|ctx| ctx.call_index);
@@ -256,11 +841,12 @@ async fn test_tool_execution_context_batch_id_changes_between_batches() {
        ],
    ]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    let contexts = Arc::new(Mutex::new(Vec::new()));

    engine.register_tool(ContextRecordingTool::new("record", contexts.clone()).definition());

-    let _ = engine.run("record batches").await;
+    let _ = engine.run(&mut history, "record batches").await;

    let contexts = contexts.lock().unwrap().clone();
    assert_eq!(contexts.len(), 2);
@@ -298,6 +884,7 @@ async fn test_tool_execution_context_for_skipped_and_synthetic_paths() {
        ],
    ]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    let executed_contexts = Arc::new(Mutex::new(Vec::new()));
    let pre_contexts = Arc::new(Mutex::new(Vec::new()));
    let post_contexts = Arc::new(Mutex::new(Vec::new()));
@@ -344,7 +931,9 @@ async fn test_tool_execution_context_for_skipped_and_synthetic_paths() {
        post_contexts: post_contexts.clone(),
    });

-    let _ = engine.run("record skipped and synthetic contexts").await;
+    let _ = engine
+        .run(&mut history, "record skipped and synthetic contexts")
+        .await;

    let mut pre_contexts = pre_contexts.lock().unwrap().clone();
    pre_contexts.sort_by_key(|ctx| ctx.call_index);
@@ -389,6 +978,7 @@ async fn test_before_tool_call_skip() {

    let client = MockLlmClient::new(events);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();

    let allowed_tool = SlowTool::new("allowed_tool", 10);
    let blocked_tool = SlowTool::new("blocked_tool", 10);
@@ -416,7 +1006,7 @@ async fn test_before_tool_call_skip() {
    engine.set_interceptor(BlockingPolicy);

    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let _result = engine.run("Test hook").await;
+    let _result = engine.run(&mut history, "Test hook").await;

    // allowed_tool is called, but blocked_tool is not
    assert_eq!(
@@ -457,6 +1047,7 @@ async fn test_post_tool_call_modification() {
    ]);

    let mut engine = Engine::new(client);
+    let mut history: History = History::new();

    #[derive(Clone)]
    struct SimpleTool;
@@ -503,9 +1094,12 @@ async fn test_post_tool_call_modification() {
    });

    // Mutable::run consumes self, returns (Locked, EngineResult)
-    let result = engine.run("Test modification").await;
+    let result = engine.run(&mut history, "Test modification").await;

-    assert!(result.is_ok(), "Engine should complete");
+    assert!(
+        matches!(result.result, agen::EngineRunExit::Finished),
+        "Engine should complete"
+    );

    // Verify hook was called and content was modified
    let content = modified_content.lock().unwrap().clone();
@@ -540,6 +1134,7 @@ async fn test_before_tool_call_synthetic_result_committed() {
        ],
    ]);
    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    let blocked_tool = SlowTool::new("blocked_tool", 10);
    let blocked_clone = blocked_tool.clone();
    engine.register_tool(blocked_tool.definition());
@@ -558,10 +1153,10 @@ async fn test_before_tool_call_synthetic_result_committed() {

    engine.set_interceptor(SyntheticPolicy);

-    let result = engine.run("Test synthetic result").await.unwrap();
+    let _result = engine.run(&mut history, "Test synthetic result").await;

    assert_eq!(blocked_clone.call_count(), 0, "Blocked tool should not run");
-    assert!(result.engine.history().iter().any(|item| matches!(
+    assert!(history.items().any(|item| matches!(
        item,
        agen::Item::ToolResult {
            call_id,
@@ -571,3 +1166,76 @@ async fn test_before_tool_call_synthetic_result_committed() {
        } if call_id == "call_1" && summary == "permission denied"
    )));
 }
+
+#[tokio::test]
+async fn post_tool_abort_commits_confirmed_result_before_stopping_run() {
+    let client = MockLlmClient::new(vec![
+        Event::tool_use_start(0, "call_confirmed", "confirmed"),
+        Event::tool_input_delta(0, r#"{}"#),
+        Event::tool_use_stop(0),
+        Event::Status(StatusEvent {
+            status: ResponseStatus::Completed,
+        }),
+    ]);
+    let mut engine = Engine::new(client);
+    let tool = SlowTool::new("confirmed", 1);
+    engine.register_tool(tool.definition());
+
+    struct AbortAfterResult;
+    #[async_trait]
+    impl Interceptor for AbortAfterResult {
+        async fn post_tool_call(&self, _info: &mut ToolResultInfo) -> PostToolAction {
+            PostToolAction::Abort("policy stopped the run".to_string())
+        }
+    }
+    engine.set_interceptor(AbortAfterResult);
+
+    let observed = Arc::new(Mutex::new(Vec::<&'static str>::new()));
+    let published = observed.clone();
+    engine.on_tool_result(move |_| published.lock().unwrap().push("published"));
+    let committed = observed.clone();
+    let mut annotate = move |item: &Item| {
+        if matches!(item, Item::ToolResult { .. }) {
+            committed.lock().unwrap().push("committed");
+        }
+        Ok(())
+    };
+
+    let mut history = History::new();
+    let output = engine
+        .run_with_annotation(&mut history, "run confirmed tool", &mut annotate)
+        .await;
+    observed.lock().unwrap().push("run-returned");
+
+    assert_eq!(tool.call_count(), 1);
+    assert_eq!(
+        observed.lock().unwrap().as_slice(),
+        ["committed", "published", "run-returned"]
+    );
+    assert!(matches!(
+        output.result,
+        agen::EngineRunExit::Interrupted(agen::StopReason::Unexpected(
+            agen::EngineError::Aborted(ref reason)
+        )) if reason == "policy stopped the run"
+    ));
+    let terminal: Vec<_> = history
+        .iter()
+        .filter_map(|entry| match &entry.item {
+            Item::ToolResult {
+                call_id,
+                disposition,
+                ..
+            } if call_id == "call_confirmed" => Some(*disposition),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(terminal, [ToolResultDisposition::Success]);
+    assert!(!history.iter().any(|entry| matches!(
+        &entry.item,
+        Item::ToolResult {
+            call_id,
+            disposition: ToolResultDisposition::OutcomeUnknown,
+            ..
+        } if call_id == "call_confirmed"
+    )));
+}
@@ -13,12 +13,12 @@

 mod common;

-use agen::Engine;
 use agen::Item;
 use agen::llm_client::event::{
    BlockMetadata, BlockStart, BlockStop, BlockType, Event, ReasoningBlockData, ResponseStatus,
    StatusEvent,
 };
+use agen::{Engine, History};
 use common::MockLlmClient;

 fn reasoning_block(text: impl Into<String>, data: ReasoningBlockData) -> Vec<Event> {
@@ -65,15 +65,15 @@ async fn anthropic_thinking_round_trips_signature_into_history() {
    ]);
    let client = MockLlmClient::new(events);
    let engine = Engine::new(client);
-    let out = engine.run("question?").await.expect("run ok");
-    let engine = out.engine;
+    let mut history: History = History::new();
+    let _out = engine.run(&mut history, "question?").await;

-    let history = engine.history();
+    let entries = history.entries();
    // user / reasoning / assistant_message
    assert_eq!(history.len(), 3, "history: {history:?}");

-    assert!(matches!(history[0], Item::Message { .. }));
-    match &history[1] {
+    assert!(matches!(entries[0].item, Item::Message { .. }));
+    match &entries[1].item {
        Item::Reasoning {
            text, signature, ..
        } => {
@@ -82,7 +82,7 @@ async fn anthropic_thinking_round_trips_signature_into_history() {
        }
        other => panic!("expected Reasoning, got {other:?}"),
    }
-    assert_eq!(history[2].as_text(), Some("Here's the answer"));
+    assert_eq!(entries[2].item.as_text(), Some("Here's the answer"));
 }

 /// OpenAI Responses 風: encrypted_content + summary を持った reasoning が
@@ -109,11 +109,11 @@ async fn openai_reasoning_round_trips_encrypted_and_summary() {
    ]);
    let client = MockLlmClient::new(events);
    let engine = Engine::new(client);
-    let out = engine.run("q").await.expect("run ok");
-    let engine = out.engine;
+    let mut history: History = History::new();
+    let _out = engine.run(&mut history, "q").await;

-    let history = engine.history();
-    match &history[1] {
+    let entries = history.entries();
+    match &entries[1].item {
        Item::Reasoning {
            text,
            summary,
@@ -155,13 +155,13 @@ async fn reasoning_precedes_text_in_assistant_burst() {
    }));
    let client = MockLlmClient::new(events);
    let engine = Engine::new(client);
-    let out = engine.run("q").await.expect("run ok");
-    let engine = out.engine;
+    let mut history: History = History::new();
+    let _out = engine.run(&mut history, "q").await;

-    let history = engine.history();
+    let entries = history.entries();
    // user / reasoning(先頭) / assistant_message
-    assert!(matches!(history[1], Item::Reasoning { .. }));
-    assert_eq!(history[2].as_text(), Some("intermediate"));
+    assert!(matches!(entries[1].item, Item::Reasoning { .. }));
+    assert_eq!(entries[2].item.as_text(), Some("intermediate"));
 }

 /// resume シナリオ: history.json 由来の Item::Reasoning(signature) を Engine に
@@ -207,14 +207,18 @@ async fn injected_reasoning_survives_into_outgoing_request() {
    };

    let mut engine = Engine::new(client);
+    let mut history: History = History::new();
    // resume: 既存 history を流し込む
-    engine.set_history(vec![
-        Item::user_message("prior question"),
-        Item::reasoning("prior thinking").with_signature("SIG-PRIOR"),
-        Item::assistant_message("prior answer"),
-    ]);
+    engine.set_history(
+        &mut history,
+        vec![
+            Item::user_message("prior question"),
+            Item::reasoning("prior thinking").with_signature("SIG-PRIOR"),
+            Item::assistant_message("prior answer"),
+        ],
+    );

-    let _ = engine.run("follow up").await.expect("run ok");
+    let _ = engine.run(&mut history, "follow up").await;

    let req = captured
        .lock()
@@ -1,4 +1,4 @@
-use agen::Engine;
+use agen::{Engine, History};
 use agen::llm_client::capability::{
    CacheStrategy, ModelCapability, StructuredOutput, ToolCallingSupport,
 };
@@ -22,7 +22,8 @@ fn main() {
        cap,
    );
    let engine = Engine::new(client);
-    let mut locked = engine.lock();
+    let history = History::new();
+    let mut locked = engine.lock(&history);
    let def: agen::tool::ToolDefinition = Arc::new(|| panic!("unused"));
    let _ = locked.register_tool(def);
 }
@@ -1,8 +1,8 @@
 error[E0599]: no method named `register_tool` found for struct `Engine<HttpTransport<AnthropicScheme>, Locked>` in the current scope
-  --> tests/ui/locked_register_tool.rs:27:20
+  --> tests/ui/locked_register_tool.rs:28:20
   |
-27 |     let _ = locked.register_tool(def);
+28 |     let _ = locked.register_tool(def);
   |                    ^^^^^^^^^^^^^ method not found in `Engine<HttpTransport<AnthropicScheme>, Locked>`
   |
   = note: the method was found for
-           - `Engine<C>`
+           - `Engine<C, Mutable, A>`
@@ -9,7 +9,7 @@
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};

-use crate::schema::{EvidenceKind, SourceEvidenceRef, SourceRef};
+use crate::schema::{EvidenceKind, EvidenceOrigin, SourceEvidenceRef, SourceRef};

 /// Current flat staging schema version.
 pub const STAGING_SCHEMA_VERSION: u32 = 2;
@@ -80,6 +80,8 @@ pub struct StagingEvidence {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub entry_range: Option<[u64; 2]>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub origin: Option<EvidenceOrigin>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub excerpt: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub summary: Option<String>,
@@ -159,6 +161,7 @@ mod tests {
            id: "E001".into(),
            kind: EvidenceKind::new(EvidenceKind::MESSAGE),
            entry_range: Some([10, 12]),
+            origin: None,
            excerpt: Some("extract candidate taxonomy".into()),
            summary: Some("User and assistant discussed staging kinds".into()),
        };
@@ -67,6 +67,40 @@ impl EvidenceKind {
    }
 }

+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum EvidenceOriginKind {
+    HumanInput,
+    WorkerInput,
+    FlowInstruction,
+    BackendInstruction,
+    ModelOutput,
+    ToolOutput,
+    DerivedSummary,
+    LegacyUnknown,
+}
+
+/// Bounded origin snapshot attached to extraction evidence. This is audit
+/// metadata only and cannot authorize Workspace operations.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub struct EvidenceOrigin {
+    pub kind: EvidenceOriginKind,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub account_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub workspace_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub runtime_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub worker_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub flow_selector: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub flow_definition_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub flow_definition_revision: Option<u64>,
+}
+
 /// Host-resolved source/evidence metadata for an individual staging claim.
 ///
 /// This deliberately stores only bounded anchor metadata: stable ids, entry
@@ -86,6 +120,9 @@ pub struct SourceEvidenceRef {
    /// Host-assigned evidence id within the referenced evidence set.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub evidence_id: Option<String>,
+    /// Trusted typed origin snapshot for this logical evidence entry.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub origin: Option<EvidenceOrigin>,
    /// Extensible evidence kind tag.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub evidence_kind: Option<EvidenceKind>,
@@ -10,7 +10,10 @@ mod decision;
 mod request;
 mod summary;

-pub use common::{EvidenceKind, Frontmatter, SourceEvidenceRef, SourceRef, split_frontmatter};
+pub use common::{
+    EvidenceKind, EvidenceOrigin, EvidenceOriginKind, Frontmatter, SourceEvidenceRef, SourceRef,
+    split_frontmatter,
+};
 pub use decision::{DecisionFrontmatter, DecisionStatus};
 pub use request::RequestFrontmatter;
 pub use summary::SummaryFrontmatter;
@@ -352,6 +352,18 @@ pub struct InternalWorkerSnapshot {
    pub internal_workers: Vec<InternalWorkerSnapshot>,
 }

+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
+#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
+#[serde(rename_all = "snake_case")]
+pub enum ToolResultDisposition {
+    #[default]
+    Success,
+    Error,
+    Interrupted,
+    Cancelled,
+    OutcomeUnknown,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 #[serde(tag = "event", content = "data", rename_all = "snake_case")]
@@ -501,6 +513,8 @@ pub enum Event {
        /// summary-only, or when the result was pruned.
        #[serde(default, skip_serializing_if = "Option::is_none")]
        output: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        disposition: Option<ToolResultDisposition>,
        #[serde(default)]
        is_error: bool,
    },
@@ -923,6 +937,7 @@ pub enum WorkerStatus {
    Idle,
    Running,
    Paused,
+    Stopped,
 }

 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -1838,6 +1853,7 @@ mod tests {
            id: "call_1".into(),
            summary: "Read 128 bytes".into(),
            output: Some("hello world".into()),
+            disposition: Some(ToolResultDisposition::Success),
            is_error: false,
        };
        let json = serde_json::to_string(&event).unwrap();
@@ -1854,11 +1870,13 @@ mod tests {
                id,
                summary,
                output,
+                disposition,
                is_error,
            } => {
                assert_eq!(id, "call_1");
                assert_eq!(summary, "Read 128 bytes");
                assert_eq!(output.as_deref(), Some("hello world"));
+                assert_eq!(disposition, Some(ToolResultDisposition::Success));
                assert!(!is_error);
            }
            other => panic!("expected ToolResult, got {other:?}"),
@@ -1871,6 +1889,7 @@ mod tests {
            id: "call_2".into(),
            summary: "ok".into(),
            output: None,
+            disposition: Some(ToolResultDisposition::Success),
            is_error: false,
        };
        let json = serde_json::to_string(&event).unwrap();
@@ -1886,6 +1905,7 @@ mod tests {
            id: "call_3".into(),
            summary: "invalid argument".into(),
            output: None,
+            disposition: Some(ToolResultDisposition::Error),
            is_error: true,
        };
        let json = serde_json::to_string(&event).unwrap();
@@ -8,7 +8,7 @@ use crate::{
    CompletionKind, ErrorCode, Event, Greeting, InFlightBlock, InFlightSnapshot,
    InFlightToolCallState, InternalWorkerKind, InternalWorkerRef, InternalWorkerSnapshot,
    InvokeKind, MemoryWorkerEvent, Method, Permission, RewindSummary, RewindTarget, RewindTargetId,
-    RunResult, ScopeRule, Segment, TurnResult, WorkerEvent, WorkerStatus,
+    RunResult, ScopeRule, Segment, ToolResultDisposition, TurnResult, WorkerEvent, WorkerStatus,
    subscription::{
        EventSubscriptionSelector, SubscriptionEvent, SubscriptionEventPayload, SubscriptionFrame,
        SubscriptionFramePayload, SubscriptionId, SubscriptionRejectionCode, SubscriptionRequest,
@@ -45,6 +45,7 @@ pub fn generated_protocol_types() -> String {
    push_decl::<TurnResult>(&cfg, &mut output);
    push_decl::<InvokeKind>(&cfg, &mut output);
    push_decl::<RunResult>(&cfg, &mut output);
+    push_decl::<ToolResultDisposition>(&cfg, &mut output);
    push_decl::<ErrorCode>(&cfg, &mut output);
    push_decl::<Permission>(&cfg, &mut output);
    push_decl::<InFlightToolCallState>(&cfg, &mut output);
@@ -0,0 +1,180 @@
+//! Serializable history entries with restore-authoritative logical identity and origin.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{LoggedItem, SessionId};
+
+/// Stable logical identity of one model-visible history entry.
+///
+/// This value is generated at the trusted Worker session boundary and copied
+/// unchanged across fork, rewind, compaction retention, restore, and reboot.
+#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct LoggedSessionHistoryEntryId(pub String);
+
+impl LoggedSessionHistoryEntryId {
+    pub fn new() -> Self {
+        Self(uuid::Uuid::now_v7().to_string())
+    }
+}
+
+impl Default for LoggedSessionHistoryEntryId {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Bounded subject snapshot. It is evidence, not a live authorization handle.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LoggedWorkerSubject {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub workspace_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub runtime_id: Option<String>,
+    pub worker_id: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum LoggedSessionHistoryOrigin {
+    HumanInput {
+        account_id: String,
+    },
+    WorkerInput {
+        actor: LoggedWorkerSubject,
+    },
+    FlowInstruction {
+        selector: String,
+        definition_id: String,
+        definition_revision: u64,
+        instance_id: String,
+        state_id: String,
+    },
+    BackendInstruction {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        operation_id: Option<String>,
+    },
+    ModelOutput {
+        worker: LoggedWorkerSubject,
+    },
+    ToolOutput {
+        worker: LoggedWorkerSubject,
+    },
+    DerivedSummary,
+    LegacyUnknown,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LoggedHistoryDerivation {
+    pub sources: Vec<LoggedSessionHistoryEntryId>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LoggedSessionHistoryMetadata {
+    pub entry_id: LoggedSessionHistoryEntryId,
+    pub origin: LoggedSessionHistoryOrigin,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub derivation: Option<LoggedHistoryDerivation>,
+}
+
+impl LoggedSessionHistoryMetadata {
+    pub fn legacy_unknown() -> Self {
+        Self {
+            entry_id: LoggedSessionHistoryEntryId::new(),
+            origin: LoggedSessionHistoryOrigin::LegacyUnknown,
+            derivation: None,
+        }
+    }
+}
+
+/// Persisted item and metadata are one value so transforms cannot reorder or
+/// truncate one without the other.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct LoggedHistoryEntry {
+    pub item: LoggedItem,
+    pub metadata: LoggedSessionHistoryMetadata,
+}
+
+/// Typed system-item history record. The typed system event remains available
+/// to client replay while its model-visible projection carries the same stable
+/// metadata used by live history.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LoggedSystemHistoryEntry {
+    pub item: crate::SystemItem,
+    pub metadata: LoggedSessionHistoryMetadata,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::LoggedRole;
+    use agen::llm_client::RequestConfig;
+
+    #[test]
+    fn logged_history_entry_round_trip_preserves_id_origin_and_derivation() {
+        let source_id = LoggedSessionHistoryEntryId::new();
+        let entry = LoggedHistoryEntry {
+            item: LoggedItem::Message {
+                role: LoggedRole::User,
+                content: vec![crate::LoggedContentPart::Text {
+                    text: "preference".into(),
+                }],
+            },
+            metadata: LoggedSessionHistoryMetadata {
+                entry_id: LoggedSessionHistoryEntryId::new(),
+                origin: LoggedSessionHistoryOrigin::HumanInput {
+                    account_id: "account-1".into(),
+                },
+                derivation: Some(LoggedHistoryDerivation {
+                    sources: vec![source_id.clone()],
+                }),
+            },
+        };
+        let encoded = serde_json::to_vec(&entry).unwrap();
+        let decoded: LoggedHistoryEntry = serde_json::from_slice(&encoded).unwrap();
+        assert_eq!(decoded, entry);
+        assert_eq!(
+            decoded.metadata.derivation.unwrap().sources,
+            vec![source_id]
+        );
+    }
+
+    #[test]
+    fn annotated_segment_start_is_restore_visible_without_projecting_metadata() {
+        let session_id = uuid::Uuid::now_v7();
+        let history_entry = legacy_logged_history(LoggedItem::Message {
+            role: LoggedRole::Assistant,
+            content: vec![crate::LoggedContentPart::Text {
+                text: "answer".into(),
+            }],
+        });
+        let state = crate::collect_state(&[crate::LogEntry::AnnotatedSegmentStart {
+            ts: 1,
+            session_id,
+            system_prompt: None,
+            config: RequestConfig::default(),
+            history: vec![history_entry],
+            forked_from: None,
+            compacted_from: None,
+        }]);
+        assert_eq!(state.history[0].as_text(), Some("answer"));
+    }
+}
+
+/// Legacy Session Logs did not persist annotations. Decode helpers explicitly
+/// create `LegacyUnknown`; they never infer Human/System authority from role or
+/// plaintext.
+pub fn legacy_logged_history(item: LoggedItem) -> LoggedHistoryEntry {
+    LoggedHistoryEntry {
+        item,
+        metadata: LoggedSessionHistoryMetadata::legacy_unknown(),
+    }
+}
+
+pub fn legacy_segment_history(
+    session_id: SessionId,
+    items: impl IntoIterator<Item = LoggedItem>,
+) -> Vec<LoggedHistoryEntry> {
+    let _ = session_id;
+    items.into_iter().map(legacy_logged_history).collect()
+}
@@ -32,6 +32,7 @@

 pub mod event_trace;
 pub mod fs_store;
+pub mod history;
 pub mod logged_item;
 pub mod segment;
 pub mod segment_log;
@@ -44,6 +45,11 @@ pub use agen::UsageRecord;
 pub use agen::llm_client::types::{ContentPart, Item, Role};
 pub use event_trace::{TraceEntry, TracePayload};
 pub use fs_store::FsStore;
+pub use history::{
+    LoggedHistoryDerivation, LoggedHistoryEntry, LoggedSessionHistoryEntryId,
+    LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin, LoggedSystemHistoryEntry,
+    LoggedWorkerSubject, legacy_logged_history, legacy_segment_history,
+};
 pub use logged_item::{LoggedContentPart, LoggedItem, LoggedRole, from_logged, to_logged};
 pub use segment::{
    SegmentStartState, append_entry, append_system_item, classify_history_item,
@@ -14,7 +14,7 @@

 use agen::{
    llm_client::types::{ContentPart, Item, Role},
-    tool::{Attachment, ImageAttachment},
+    tool::{Attachment, ImageAttachment, ToolResultDisposition},
 };
 use base64::{Engine as _, engine::general_purpose::STANDARD};
 use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as _};
@@ -61,6 +61,8 @@ pub enum LoggedItem {
        content: Option<String>,
        #[serde(default, skip_serializing_if = "Vec::is_empty")]
        attachments: Vec<LoggedAttachment>,
+        #[serde(default, skip_serializing_if = "ToolResultDisposition::is_success")]
+        disposition: ToolResultDisposition,
        #[serde(default, skip_serializing_if = "is_false")]
        is_error: bool,
    },
@@ -128,6 +130,7 @@ impl From<&Item> for LoggedItem {
                summary,
                content,
                attachments,
+                disposition,
                is_error,
                ..
            } => Self::ToolResult {
@@ -135,6 +138,7 @@ impl From<&Item> for LoggedItem {
                summary: summary.clone(),
                content: content.clone(),
                attachments: attachments.iter().map(LoggedAttachment::from).collect(),
+                disposition: *disposition,
                is_error: *is_error,
            },
            Item::Reasoning {
@@ -184,15 +188,24 @@ impl From<LoggedItem> for Item {
                summary,
                content,
                attachments,
+                disposition,
                is_error,
-            } => Item::ToolResult {
-                id: None,
-                call_id,
-                summary,
-                content,
-                is_error,
-                attachments: attachments.into_iter().map(Attachment::from).collect(),
-            },
+            } => {
+                let disposition = if is_error && disposition.is_success() {
+                    ToolResultDisposition::Error
+                } else {
+                    disposition
+                };
+                Item::ToolResult {
+                    id: None,
+                    call_id,
+                    summary,
+                    content,
+                    disposition,
+                    is_error,
+                    attachments: attachments.into_iter().map(Attachment::from).collect(),
+                }
+            }
            LoggedItem::Reasoning {
                text,
                summary,
@@ -430,6 +443,42 @@ mod tests {
        }
    }

+    #[test]
+    fn outcome_unknown_tool_result_round_trips_as_terminal() {
+        let original = Item::tool_result_item_with_disposition_and_attachments(
+            "call_unknown",
+            "outcome unknown",
+            Some("bounded progress".to_string()),
+            ToolResultDisposition::OutcomeUnknown,
+            Vec::new(),
+        );
+        let logged: LoggedItem = (&original).into();
+        let json = serde_json::to_string(&logged).unwrap();
+        assert!(json.contains(r#""disposition":"outcome_unknown""#));
+        match Item::from(serde_json::from_str::<LoggedItem>(&json).unwrap()) {
+            Item::ToolResult {
+                disposition,
+                is_error,
+                ..
+            } => {
+                assert_eq!(disposition, ToolResultDisposition::OutcomeUnknown);
+                assert!(is_error);
+            }
+            other => panic!("unexpected variant: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn legacy_error_tool_result_infers_error_disposition() {
+        let legacy = r#"{"kind":"tool_result","call_id":"call_old","summary":"failed","content":null,"is_error":true}"#;
+        match Item::from(serde_json::from_str::<LoggedItem>(legacy).unwrap()) {
+            Item::ToolResult { disposition, .. } => {
+                assert_eq!(disposition, ToolResultDisposition::Error)
+            }
+            other => panic!("unexpected variant: {other:?}"),
+        }
+    }
+
    #[test]
    fn tool_result_persistence_round_trips_binary_attachments() {
        let original = Item::tool_result_item_with_attachments(
@@ -14,6 +14,7 @@ use agen::{EngineResult, UsageRecord};
 use protocol::{InvokeKind, Segment};
 use serde::{Deserialize, Serialize};

+use crate::history::{LoggedHistoryEntry, LoggedSystemHistoryEntry};
 use crate::logged_item::LoggedItem;
 use crate::system_item::SystemItem;

@@ -70,6 +71,20 @@ pub enum LogEntry {
        compacted_from: Option<SegmentOrigin>,
    },

+    /// Schema-v2 segment seed. Retained entries keep their stable logical
+    /// identity and origin across fork/compaction/restore.
+    AnnotatedSegmentStart {
+        ts: u64,
+        session_id: crate::SessionId,
+        system_prompt: Option<String>,
+        config: RequestConfig,
+        history: Vec<LoggedHistoryEntry>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        forked_from: Option<SegmentOrigin>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        compacted_from: Option<SegmentOrigin>,
+    },
+
    /// IDLE → active marker. Records the start of a new self-driving
    /// cycle (Invoke range). The range extends implicitly until the
    /// next `Invoke` entry; this entry carries the trigger only — the
@@ -105,14 +120,37 @@ pub enum LogEntry {
        extensions: Vec<SessionExtension>,
    },

+    /// Schema-v2 user submission with its exact model-visible entries. Typed
+    /// Flow instructions and caller-attributed input remain separate entries.
+    AnnotatedUserInput {
+        ts: u64,
+        segments: Vec<Segment>,
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        extensions: Vec<SessionExtension>,
+        history: Vec<LoggedHistoryEntry>,
+    },
+
+    /// Schema-v2 model output and metadata committed as one journal record.
+    AnnotatedAssistantItem { ts: u64, entry: LoggedHistoryEntry },
+
    /// One assistant-side item appended to history — assistant message,
    /// reasoning, or tool call. Singular: one entry per history item so
    /// the wire-side `Event::*` lane and on-disk LogEntry stay 1:1.
    AssistantItem { ts: u64, item: LoggedItem },

+    /// Schema-v2 tool output and metadata committed as one journal record.
+    AnnotatedToolResult { ts: u64, entry: LoggedHistoryEntry },
+
    /// One tool-execution result appended to history.
    ToolResult { ts: u64, item: LoggedItem },

+    /// Schema-v2 typed system event and model-visible metadata committed
+    /// together.
+    AnnotatedSystemItem {
+        ts: u64,
+        entry: LoggedSystemHistoryEntry,
+    },
+
    /// One typed agent-injected system item: notification, child-Worker
    /// lifecycle event, `@<path>` / `/<slug>` resolution payload. Each
    /// `SystemItem` carries kind metadata that the LLM
@@ -278,6 +316,22 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                state.config = config.clone();
                state.history = history.iter().cloned().map(Item::from).collect();
            }
+            LogEntry::AnnotatedSegmentStart {
+                session_id,
+                system_prompt,
+                config,
+                history,
+                ..
+            } => {
+                state.session_id = Some(*session_id);
+                state.system_prompt = system_prompt.clone();
+                state.config = config.clone();
+                state.history = history
+                    .iter()
+                    .cloned()
+                    .map(|entry| Item::from(entry.item))
+                    .collect();
+            }
            LogEntry::Invoke { .. } => {
                // A terminal run record below clears or refines this. If the
                // log ends first, restore must treat the turn as interrupted.
@@ -298,6 +352,29 @@ pub fn collect_state(entries: &[LogEntry]) -> RestoredState {
                        .map(|extension| (extension.domain.clone(), extension.payload.clone())),
                );
            }
+            LogEntry::AnnotatedUserInput {
+                segments,
+                extensions,
+                history,
+                ..
+            } => {
+                state
+                    .history
+                    .extend(history.iter().cloned().map(|entry| Item::from(entry.item)));
+                state.user_segments.push(segments.clone());
+                state.extensions.extend(
+                    extensions
+                        .iter()
+                        .map(|extension| (extension.domain.clone(), extension.payload.clone())),
+                );
+            }
+            LogEntry::AnnotatedAssistantItem { entry, .. }
+            | LogEntry::AnnotatedToolResult { entry, .. } => {
+                state.history.push(Item::from(entry.item.clone()));
+            }
+            LogEntry::AnnotatedSystemItem { entry, .. } => {
+                state.history.push(entry.item.to_history_item());
+            }
            LogEntry::AssistantItem { item, .. } => {
                state.history.push(Item::from(item.clone()));
            }
@@ -20,7 +20,8 @@ use std::path::{Path, PathBuf};
 use std::sync::{Arc, Mutex};
 use std::time::SystemTime;

-const SESSION_SCHEMA_VERSION: u32 = 1;
+const SESSION_SCHEMA_VERSION: u32 = 2;
+const LEGACY_SESSION_SCHEMA_VERSION: u32 = 1;
 const SESSION_FILE: &str = "session.json";
 const SEGMENTS_DIR: &str = "segments";

@@ -44,15 +45,22 @@ impl WorkerSessionStore {
        fs::create_dir_all(root.join(SEGMENTS_DIR))?;
        let session_id = match fs::read(root.join(SESSION_FILE)) {
            Ok(bytes) => {
-                let manifest: SessionManifest = serde_json::from_slice(&bytes)?;
-                if manifest.schema_version != SESSION_SCHEMA_VERSION {
-                    return Err(StoreError::Corrupt {
-                        line: 0,
-                        message: format!(
-                            "unsupported Worker Session schema version {}, expected {}",
-                            manifest.schema_version, SESSION_SCHEMA_VERSION
-                        ),
-                    });
+                let mut manifest: SessionManifest = serde_json::from_slice(&bytes)?;
+                match manifest.schema_version {
+                    SESSION_SCHEMA_VERSION => {}
+                    LEGACY_SESSION_SCHEMA_VERSION => {
+                        validate_legacy_segment_logs(&root)?;
+                        manifest.schema_version = SESSION_SCHEMA_VERSION;
+                        atomic_write_json(&root.join(SESSION_FILE), &manifest)?;
+                    }
+                    version => {
+                        return Err(StoreError::Corrupt {
+                            line: 0,
+                            message: format!(
+                                "unsupported Worker Session schema version {version}, expected {SESSION_SCHEMA_VERSION}"
+                            ),
+                        });
+                    }
                }
                Some(manifest.session_id)
            }
@@ -278,6 +286,37 @@ impl Store for WorkerSessionStore {
    }
 }

+fn validate_legacy_segment_logs(root: &Path) -> Result<(), StoreError> {
+    let segments = root.join(SEGMENTS_DIR);
+    if !segments.exists() {
+        return Ok(());
+    }
+    for entry in fs::read_dir(&segments)? {
+        let entry = entry?;
+        let path = entry.path();
+        let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+            continue;
+        };
+        if !name.ends_with(".jsonl") || name.ends_with(".trace.jsonl") {
+            continue;
+        }
+        let contents = fs::read_to_string(&path)?;
+        for (line_index, line) in contents.lines().enumerate() {
+            if line.trim().is_empty() {
+                continue;
+            }
+            serde_json::from_str::<LogEntry>(line).map_err(|error| StoreError::Corrupt {
+                line: line_index + 1,
+                message: format!(
+                    "cannot migrate legacy Worker Session log {}: {error}",
+                    path.display()
+                ),
+            })?;
+        }
+    }
+    Ok(())
+}
+
 fn atomic_write_json<T: Serialize>(path: &Path, value: &T) -> Result<(), StoreError> {
    let mut bytes = serde_json::to_vec_pretty(value)?;
    bytes.push(b'\n');
@@ -405,6 +444,54 @@ mod tests {
        assert_eq!(store.list_sessions().unwrap(), vec![session_id]);
    }

+    #[test]
+    fn schema_v1_logs_are_validated_and_promoted_to_v2() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let segment_id = new_segment_id();
+        WorkerSessionStore::new(root.path())
+            .unwrap()
+            .create_segment(session_id, segment_id, &[])
+            .unwrap();
+        let manifest_path = root.path().join(SESSION_FILE);
+        let mut manifest: SessionManifest =
+            serde_json::from_slice(&fs::read(&manifest_path).unwrap()).unwrap();
+        manifest.schema_version = LEGACY_SESSION_SCHEMA_VERSION;
+        atomic_write_json(&manifest_path, &manifest).unwrap();
+
+        let reopened = WorkerSessionStore::new(root.path()).unwrap();
+        assert_eq!(reopened.session_id().unwrap(), Some(session_id));
+        let migrated: SessionManifest =
+            serde_json::from_slice(&fs::read(&manifest_path).unwrap()).unwrap();
+        assert_eq!(migrated.schema_version, SESSION_SCHEMA_VERSION);
+    }
+
+    #[test]
+    fn schema_v1_migration_rejects_corrupt_log_before_manifest_update() {
+        let root = tempfile::tempdir().unwrap();
+        let session_id = new_session_id();
+        let manifest = SessionManifest {
+            schema_version: LEGACY_SESSION_SCHEMA_VERSION,
+            session_id,
+        };
+        atomic_write_json(&root.path().join(SESSION_FILE), &manifest).unwrap();
+        fs::create_dir_all(root.path().join(SEGMENTS_DIR)).unwrap();
+        fs::write(
+            root.path().join(SEGMENTS_DIR).join("broken.jsonl"),
+            "{not-json}\n",
+        )
+        .unwrap();
+
+        let error = match WorkerSessionStore::new(root.path()) {
+            Ok(_) => panic!("corrupt legacy Session log must reject migration"),
+            Err(error) => error,
+        };
+        assert!(matches!(error, StoreError::Corrupt { .. }));
+        let persisted: SessionManifest =
+            serde_json::from_slice(&fs::read(root.path().join(SESSION_FILE)).unwrap()).unwrap();
+        assert_eq!(persisted.schema_version, LEGACY_SESSION_SCHEMA_VERSION);
+    }
+
    #[test]
    fn reopen_preserves_session_and_segment_ids() {
        let root = tempfile::tempdir().unwrap();
@@ -1,12 +1,13 @@
 mod common;

+use std::ops::{Deref, DerefMut};
 use std::sync::Arc;

-use agen::Engine;
 use agen::interceptor::{Interceptor, TurnEndAction};
 use agen::llm_client::event::{Event, ResponseStatus, StatusEvent};
 use agen::llm_client::types::{Item, RequestConfig};
 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
+use agen::{Engine, History};
 use async_trait::async_trait;
 use common::MockLlmClient;
 use session_store::{FsStore, LogEntry, SegmentStartState, Store, collect_state};
@@ -94,15 +95,47 @@ fn make_store() -> (tempfile::TempDir, FsStore) {
    (dir, store)
 }

+struct TestWorker {
+    engine: Engine<MockLlmClient>,
+    history: History,
+}
+
+impl TestWorker {
+    fn new(engine: Engine<MockLlmClient>) -> Self {
+        Self {
+            engine,
+            history: History::new(),
+        }
+    }
+
+    fn history(&self) -> Vec<Item> {
+        self.history.items_cloned()
+    }
+}
+
+impl Deref for TestWorker {
+    type Target = Engine<MockLlmClient>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.engine
+    }
+}
+
+impl DerefMut for TestWorker {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.engine
+    }
+}
+
 /// Run a worker turn and persist via session-store functions.
 /// Takes ownership of the worker (needed for lock/unlock) and returns it.
 async fn run_and_persist(
-    worker: Engine<MockLlmClient>,
+    mut worker: TestWorker,
    store: &FsStore,
    session_id: session_store::SessionId,
    segment_id: session_store::SegmentId,
    input: &str,
-) -> (Engine<MockLlmClient>, agen::EngineResult) {
+) -> (TestWorker, agen::EngineRunExit) {
    // Mirror Worker's run-entry contract: log the user input as segments
    // before the worker pushes its flattened user_message; save_delta
    // skips the resulting user_message item to avoid double-write.
@@ -114,42 +147,61 @@ async fn run_and_persist(
    )
    .unwrap();

-    let history_before = worker.history().len();
+    let history_before = worker.history.len();

-    let mut locked = worker.lock();
-    let result = locked.run(input).await;
-    let worker = locked.unlock();
+    let mut locked = worker.engine.lock(&worker.history);
+    let result = locked.run(&mut worker.history, input).await;
+    worker.engine = locked.unlock();

-    let new_items = &worker.history()[history_before..];
+    let projected = worker.history();
+    let new_items = &projected[history_before..];
    session_store::save_delta(store, session_id, segment_id, new_items).unwrap();
    session_store::save_turn_end(store, session_id, segment_id, worker.turn_count()).unwrap();

    match &result {
-        Ok(r) => {
+        agen::EngineRunExit::Finished
+        | agen::EngineRunExit::Paused
+        | agen::EngineRunExit::Yielded => {
+            let (legacy_result, interrupted) = match &result {
+                agen::EngineRunExit::Finished => (agen::EngineResult::Finished, false),
+                agen::EngineRunExit::Paused => (agen::EngineResult::Paused, true),
+                agen::EngineRunExit::Yielded => (agen::EngineResult::Yielded, true),
+                agen::EngineRunExit::Interrupted(_) => unreachable!(),
+            };
            session_store::save_run_completed(
                store,
                session_id,
                segment_id,
-                r.clone(),
-                worker.last_run_interrupted(),
+                legacy_result,
+                interrupted,
                worker.active_run_turn_count(),
            )
            .unwrap();
        }
-        Err(e) => {
+        agen::EngineRunExit::Interrupted(agen::StopReason::LimitReached) => {
+            session_store::save_run_completed(
+                store,
+                session_id,
+                segment_id,
+                agen::EngineResult::LimitReached,
+                false,
+                worker.active_run_turn_count(),
+            )
+            .unwrap();
+        }
+        agen::EngineRunExit::Interrupted(reason) => {
            session_store::save_run_errored(
                store,
                session_id,
                segment_id,
-                e.to_string(),
-                worker.last_run_interrupted(),
+                format!("{reason:?}"),
+                true,
            )
            .unwrap();
        }
    }

-    let r = result.unwrap();
-    (worker, r)
+    (worker, result)
 }

 // =============================================================================
@@ -160,14 +212,14 @@ async fn run_and_persist(
 async fn session_run_logs_entries() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::new(simple_text_events());
-    let worker = Engine::new(client);
+    let worker = TestWorker::new(Engine::new(client));

    let (sid, segid) = session_store::create_segment(
        &store,
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -204,7 +256,7 @@ async fn session_run_logs_entries() {
 async fn session_restore_round_trip() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::new(simple_text_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
    worker.set_system_prompt("You are helpful.");

    let (sid, segid) = session_store::create_segment(
@@ -212,7 +264,7 @@ async fn session_restore_round_trip() {
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -243,7 +295,7 @@ async fn session_restore_round_trip() {
 async fn session_run_with_tool_call() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::with_responses(tool_call_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
    worker.register_tool(weather_tool_definition());

    let (sid, segid) = session_store::create_segment(
@@ -251,7 +303,7 @@ async fn session_run_with_tool_call() {
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -277,7 +329,7 @@ async fn session_resume_after_pause() {

    // First run: tool call with pause policy → Paused
    let client = MockLlmClient::with_responses(tool_call_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
    worker.register_tool(weather_tool_definition());
    worker.set_interceptor(PausePolicy);

@@ -286,13 +338,13 @@ async fn session_resume_after_pause() {
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();

    let (_worker, result) = run_and_persist(worker, &store, sid, segid, "Weather?").await;
-    assert!(matches!(result, agen::EngineResult::Paused));
+    assert!(matches!(result, agen::EngineRunExit::Paused));

    // Check RunCompleted is Paused
    let entries = store.read_all(sid, segid).unwrap();
@@ -317,7 +369,7 @@ async fn session_resume_after_pause() {
 async fn session_fork_creates_new_session() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::new(simple_text_events());
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));
    worker.set_system_prompt("System prompt");

    let (sid, segid) = session_store::create_segment(
@@ -325,7 +377,7 @@ async fn session_fork_creates_new_session() {
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -338,7 +390,7 @@ async fn session_fork_creates_new_session() {
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -359,14 +411,14 @@ async fn session_fork_creates_new_session() {
 async fn session_fork_at_truncates_within_session() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::new(simple_text_events());
-    let worker = Engine::new(client);
+    let worker = TestWorker::new(Engine::new(client));

    let (sid, segid) = session_store::create_segment(
        &store,
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -404,14 +456,14 @@ async fn session_fork_at_truncates_within_session() {
 async fn session_config_changed_logged() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::new(vec![]);
-    let mut worker = Engine::new(client);
+    let mut worker = TestWorker::new(Engine::new(client));

    let (sid, segid) = session_store::create_segment(
        &store,
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -437,14 +489,14 @@ async fn session_auto_forks_on_conflict() {

    // Create a segment
    let client_a = MockLlmClient::new(simple_text_events());
-    let worker_a = Engine::new(client_a);
+    let worker_a = TestWorker::new(Engine::new(client_a));

    let (sid, original_segid) = session_store::create_segment(
        &store,
        SegmentStartState {
            system_prompt: worker_a.get_system_prompt(),
            config: worker_a.request_config(),
-            history: worker_a.history(),
+            history: &worker_a.history(),
        },
    )
    .unwrap();
@@ -470,7 +522,7 @@ async fn session_auto_forks_on_conflict() {
        SegmentStartState {
            system_prompt: worker_a.get_system_prompt(),
            config: worker_a.request_config(),
-            history: worker_a.history(),
+            history: &worker_a.history(),
        },
    )
    .unwrap();
@@ -522,14 +574,14 @@ async fn session_auto_forks_on_conflict() {
 async fn nested_past_fork_leaves_ancestors_immutable() {
    let (_dir, store) = make_store();
    let client = MockLlmClient::new(simple_text_events());
-    let worker = Engine::new(client);
+    let worker = TestWorker::new(Engine::new(client));

    let (sid, root_segid) = session_store::create_segment(
        &store,
        SegmentStartState {
            system_prompt: worker.get_system_prompt(),
            config: worker.request_config(),
-            history: worker.history(),
+            history: &worker.history(),
        },
    )
    .unwrap();
@@ -1223,10 +1223,17 @@ impl Tool for TicketQueueTool {
    ) -> Result<ToolOutput, ToolError> {
        let params: TicketQueueParams = parse_input("TicketQueue", input_json)?;
        let queued_by = default_author();
-        let outcome = self
+        let mut outcome = self
            .backend
            .queue_ready(TicketIdOrSlug::Query(params.ticket.clone()), &queued_by)
            .map_err(|error| backend_error("TicketQueue", error))?;
+        outcome.requested_ticket =
+            model_ticket_reference(&self.backend, &outcome.requested_ticket, "TicketQueue")?;
+        outcome.queued_tickets = outcome
+            .queued_tickets
+            .into_iter()
+            .map(|ticket| model_ticket_reference(&self.backend, &ticket, "TicketQueue"))
+            .collect::<Result<Vec<_>, _>>()?;
        Ok(json_output(
            format!(
                "Queued {} ticket(s) for Orchestrator",
@@ -1264,15 +1271,17 @@ impl Tool for TicketWorkflowStateTool {
        self.backend
            .set_workflow_state(TicketIdOrSlug::Query(params.ticket.clone()), change)
            .map_err(|error| backend_error("TicketWorkflowState", error))?;
+        let ticket_ref =
+            model_ticket_reference(&self.backend, &params.ticket, "TicketWorkflowState")?;
        Ok(json_output(
            format!(
                "Transitioned ticket {} state {} -> {}",
-                params.ticket,
+                ticket_ref,
                from.as_str(),
                to.as_str()
            ),
            json!({
-                "ticket": params.ticket,
+                "ticket": ticket_ref,
                "from": from.as_str(),
                "to": to.as_str(),
                "state": to.as_str(),
@@ -1296,9 +1305,10 @@ impl Tool for TicketCloseTool {
                MarkdownText::new(params.resolution),
            )
            .map_err(|error| backend_error("TicketClose", error))?;
+        let ticket_ref = model_ticket_reference(&self.backend, &params.ticket, "TicketClose")?;
        Ok(json_output(
-            format!("Closed ticket {}", params.ticket),
-            json!({ "ticket": params.ticket, "state": "closed", "ok": true }),
+            format!("Closed ticket {ticket_ref}"),
+            json!({ "ticket": ticket_ref, "state": "closed", "ok": true }),
        ))
    }
 }
@@ -1525,6 +1535,29 @@ impl Tool for TicketDependencyCheckTool {
    }
 }

+fn model_ticket_reference(
+    backend: &TicketToolBackend,
+    reference: &str,
+    tool_name: &str,
+) -> Result<String, ToolError> {
+    let ticket = backend
+        .show(TicketIdOrSlug::Id(reference.to_string()))
+        .map_err(|error| backend_error(tool_name, error))?;
+    match ticket.meta.resource_key {
+        Some(resource_key) if is_canonical_ticket_resource_key(&resource_key) => Ok(resource_key),
+        Some(_) => Err(ToolError::ExecutionFailed(format!(
+            "{tool_name} failed: required Ticket human key is unavailable"
+        ))),
+        None => Ok(ticket.meta.id),
+    }
+}
+
+fn is_canonical_ticket_resource_key(resource_key: &str) -> bool {
+    resource_key.strip_prefix("T-").is_some_and(|sequence| {
+        !sequence.is_empty() && sequence.bytes().all(|byte| byte.is_ascii_digit())
+    })
+}
+
 fn parse_input<T: for<'de> Deserialize<'de>>(tool: &str, input_json: &str) -> Result<T, ToolError> {
    serde_json::from_str(input_json)
        .map_err(|error| ToolError::InvalidArgument(format!("invalid {tool} input: {error}")))
@@ -1922,6 +1955,12 @@ mod tests {
            .with_target_authority(Arc::new(TestTargetAuthority))
    }

+    fn sqlite_backend(temp: &TempDir) -> crate::SqliteTicketBackend {
+        crate::SqliteTicketBackend::open(temp.path().join("tickets.db"), "workspace")
+            .unwrap()
+            .with_target_authority(Arc::new(TestTargetAuthority))
+    }
+
    fn tool(definition: ToolDefinition) -> Arc<dyn Tool> {
        let (_, tool) = definition();
        tool
@@ -2549,6 +2588,101 @@ mod tests {
        );
    }

+    #[tokio::test]
+    async fn queue_workflow_and_close_project_internal_inputs_to_ticket_keys() {
+        let temp = TempDir::new().unwrap();
+        let inner = sqlite_backend(&temp);
+        let mut dependency_input = NewTicket::new("Dependency");
+        dependency_input.repository_id = Some("main".to_string());
+        let dependency = inner.create(dependency_input).unwrap();
+        let mut target_input = NewTicket::new("Target");
+        target_input.repository_id = Some("main".to_string());
+        let target = inner.create(target_input).unwrap();
+        inner
+            .add_ticket_relation(
+                TicketIdOrSlug::Id(target.id.clone()),
+                NewTicketRelation {
+                    kind: TicketRelationKind::DependsOn,
+                    target: dependency.id.clone(),
+                    note: None,
+                    author: None,
+                },
+            )
+            .unwrap();
+        for id in [&dependency.id, &target.id] {
+            inner
+                .mark_ready(
+                    TicketIdOrSlug::Id(id.clone()),
+                    TicketMarkReady {
+                        operation_key: format!("ready-{id}"),
+                        reason: None,
+                        author: None,
+                        intake_summary: None,
+                    },
+                )
+                .unwrap();
+        }
+        let target_key = target.resource_key.clone().unwrap();
+        let dependency_key = dependency.resource_key.clone().unwrap();
+        let backend = inner;
+        let queue = tool_by_name(TicketToolBackend::new(backend.clone()), "TicketQueue");
+        let workflow = tool_by_name(
+            TicketToolBackend::new(backend.clone()),
+            "TicketWorkflowState",
+        );
+        let close = tool_by_name(TicketToolBackend::new(backend), "TicketClose");
+
+        let queued = queue
+            .execute(
+                &json!({"ticket": target.id.clone()}).to_string(),
+                Default::default(),
+            )
+            .await
+            .unwrap();
+        assert!(queued.summary.contains("2 ticket(s)"));
+        let queued_content = queued.content.unwrap();
+        assert!(queued_content.contains(&target_key));
+        assert!(queued_content.contains(&dependency_key));
+        assert!(!queued_content.contains(&target.id));
+        assert!(!queued_content.contains(&dependency.id));
+
+        for (from, to) in [("queued", "inprogress"), ("inprogress", "done")] {
+            let transitioned = workflow
+                .execute(
+                    &json!({
+                        "ticket": target.id.clone(),
+                        "from": from,
+                        "to": to,
+                        "reason": "test_transition",
+                        "body": "transitioned",
+                        "author": "tester"
+                    })
+                    .to_string(),
+                    Default::default(),
+                )
+                .await
+                .unwrap();
+            assert!(transitioned.summary.contains(&target_key));
+            assert!(!transitioned.summary.contains(&target.id));
+            let content = transitioned.content.unwrap();
+            assert!(content.contains(&target_key));
+            assert!(!content.contains(&target.id));
+        }
+
+        let closed = close
+            .execute(
+                &json!({"ticket": target.id.clone(), "resolution": "Done"}).to_string(),
+                Default::default(),
+            )
+            .await
+            .unwrap();
+        assert!(closed.summary.contains(&target_key));
+        assert!(!closed.summary.contains(&target.id));
+        let content = closed.content.unwrap();
+        assert!(content.contains(&target_key));
+        assert!(!content.contains(&target.id));
+    }
+
    #[tokio::test]
    async fn ticket_workflow_tools_mark_ready_and_transition_state() {
        let temp = TempDir::new().unwrap();
@@ -1,5 +1,6 @@
+use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};

 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
 use async_trait::async_trait;
@@ -20,21 +21,65 @@ struct BashParams {

 pub(crate) struct BashTool {
    session: WorkdirSessionHandle,
+    state: Arc<Mutex<BashExecutionState>>,
+}
+
+#[derive(Clone)]
+struct ActiveCommand {
+    call_id: String,
+    execution_nonce: u64,
+    handle: CommandHandle,
+}
+
+#[derive(Default)]
+struct BashExecutionState {
+    active: HashMap<String, ActiveCommand>,
+    cancellation_requested: HashSet<String>,
+    legacy_cancellation_requested: HashSet<String>,
+    next_execution_nonce: u64,
 }

 struct CommandGuard {
    session: WorkdirSessionHandle,
+    state: Arc<Mutex<BashExecutionState>>,
+    execution_id: String,
+    execution_nonce: u64,
    handle: Option<CommandHandle>,
 }

 impl Drop for CommandGuard {
    fn drop(&mut self) {
-        if let Some(handle) = self.handle.take() {
-            let workdir = self.session.clone();
-            tokio::spawn(async move {
-                let _ = workdir.cancel_command(handle).await;
-            });
-        }
+        let Some(handle) = self.handle.take() else {
+            return;
+        };
+        let workdir = self.session.clone();
+        let state = Arc::clone(&self.state);
+        let execution_id = self.execution_id.clone();
+        let execution_nonce = self.execution_nonce;
+        // A dropped provider future is not terminal confirmation. Keep the live
+        // execution registered until cleanup has both requested cancellation and
+        // observed terminal command output, so cancellation/session teardown
+        // cannot race with an apparently empty registry.
+        tokio::spawn(async move {
+            let _ = workdir.cancel_command(handle.clone()).await;
+            let _ = workdir
+                .command_output(CommandOutputRequest {
+                    handle,
+                    cursor: 0,
+                    limit: INLINE_BYTE_BUDGET,
+                    wait: true,
+                })
+                .await;
+            let mut state = state.lock().unwrap();
+            if state
+                .active
+                .get(&execution_id)
+                .is_some_and(|active| active.execution_nonce == execution_nonce)
+            {
+                state.active.remove(&execution_id);
+                state.cancellation_requested.remove(&execution_id);
+            }
+        });
    }
 }

@@ -52,20 +97,50 @@ impl Tool for BashTool {
            .unwrap_or(DEFAULT_TIMEOUT_SECS)
            .clamp(1, MAX_TIMEOUT_SECS);
        let cmd_summary = truncate_for_summary(&params.command);
+        let execution_id = ctx.execution_id();
+        let call_id = ctx.call_id;
+        let execution_nonce = {
+            let mut state = self.state.lock().unwrap();
+            state.next_execution_nonce = state.next_execution_nonce.wrapping_add(1);
+            state.next_execution_nonce
+        };
+        let mut guard = CommandGuard {
+            session: self.session.clone(),
+            state: self.state.clone(),
+            execution_id: execution_id.clone(),
+            execution_nonce,
+            handle: None,
+        };
        let handle = self
            .session
            .start_command(CommandRequest {
                command: params.command,
                timeout_secs,
                output_limit: INLINE_BYTE_BUDGET,
-                tool_call_id: Some(ctx.call_id),
+                tool_call_id: Some(call_id.clone()),
            })
            .await
            .map_err(crate::ToolsError::from)?;
-        let mut guard = CommandGuard {
-            session: self.session.clone(),
-            handle: Some(handle.clone()),
+        let cancel_after_start = {
+            let mut state = self.state.lock().unwrap();
+            state.active.insert(
+                execution_id.clone(),
+                ActiveCommand {
+                    call_id: call_id.clone(),
+                    execution_nonce,
+                    handle: handle.clone(),
+                },
+            );
+            state.cancellation_requested.contains(&execution_id)
+                || state.legacy_cancellation_requested.contains(&call_id)
        };
+        guard.handle = Some(handle.clone());
+        if cancel_after_start {
+            self.session
+                .cancel_command(handle.clone())
+                .await
+                .map_err(crate::ToolsError::from)?;
+        }
        let output = self
            .session
            .command_output(CommandOutputRequest {
@@ -76,9 +151,27 @@ impl Tool for BashTool {
            })
            .await
            .map_err(crate::ToolsError::from)?;
+        let cancellation_requested = {
+            let mut state = self.state.lock().unwrap();
+            let owns_registration = state
+                .active
+                .get(&execution_id)
+                .is_some_and(|active| active.execution_nonce == execution_nonce);
+            let exact = if owns_registration {
+                state.active.remove(&execution_id);
+                state.cancellation_requested.remove(&execution_id)
+            } else {
+                false
+            };
+            let legacy = state.legacy_cancellation_requested.remove(&call_id);
+            exact || legacy
+        };
        guard.handle = None;

-        let summary = if output.timed_out {
+        let timed_out = output.timed_out;
+        let summary = if cancellation_requested {
+            format!("$ {cmd_summary} (cancelled)")
+        } else if output.timed_out {
            format!("$ {cmd_summary} (timed out after {timeout_secs}s)")
        } else {
            match output.exit_code {
@@ -97,11 +190,62 @@ impl Tool for BashTool {
        } else {
            Some(output.content)
        };
-        Ok(ToolOutput {
+        let output = ToolOutput {
            summary,
            content,
            attachments: Vec::new(),
-        })
+        };
+        if cancellation_requested {
+            Err(ToolError::Cancelled(output))
+        } else if timed_out {
+            Err(ToolError::Interrupted(output))
+        } else {
+            Ok(output)
+        }
+    }
+
+    async fn cancel(&self, call_id: &str) -> Result<(), ToolError> {
+        let handles = {
+            let mut state = self.state.lock().unwrap();
+            state
+                .legacy_cancellation_requested
+                .insert(call_id.to_string());
+            state
+                .active
+                .values()
+                .filter(|active| active.call_id == call_id)
+                .map(|active| active.handle.clone())
+                .collect::<Vec<_>>()
+        };
+        for handle in handles {
+            self.session
+                .cancel_command(handle)
+                .await
+                .map_err(crate::ToolsError::from)?;
+        }
+        Ok(())
+    }
+
+    async fn cancel_execution(
+        &self,
+        ctx: &agen::tool::ToolExecutionContext,
+    ) -> Result<(), ToolError> {
+        let execution_id = ctx.execution_id();
+        let handle = {
+            let mut state = self.state.lock().unwrap();
+            state.cancellation_requested.insert(execution_id.clone());
+            state
+                .active
+                .get(&execution_id)
+                .map(|active| active.handle.clone())
+        };
+        if let Some(handle) = handle {
+            self.session
+                .cancel_command(handle)
+                .await
+                .map_err(crate::ToolsError::from)?;
+        }
+        Ok(())
    }
 }

@@ -123,6 +267,7 @@ pub fn bash_tool(session: WorkdirSessionHandle, _output_dir: PathBuf) -> ToolDef
            .input_schema(serde_json::to_value(schema).expect("Bash schema serialization"));
        let tool: Arc<dyn Tool> = Arc::new(BashTool {
            session: session.clone(),
+            state: Arc::new(Mutex::new(BashExecutionState::default())),
        });
        (meta, tool)
    })
@@ -7,7 +7,10 @@
 use std::path::Path;
 use std::sync::Arc;

-use agen::tool::{Tool, ToolDefinition, ToolMeta};
+use agen::tool::{
+    Tool, ToolDefinition, ToolError, ToolExecutionContext, ToolExecutionHandle,
+    ToolExecutionTerminal, ToolMeta,
+};
 use manifest::{Permission, Scope, ScopeConfig, ScopeRule};
 use serde_json::json;
 use tempfile::TempDir;
@@ -401,5 +404,84 @@ async fn bash_provider_output_does_not_expose_internal_paths() {
    assert_eq!(std::fs::read_dir(spill.path()).unwrap().count(), 0);
 }

+#[tokio::test]
+async fn bash_cancellation_returns_bounded_progress_as_terminal_output() {
+    let (dir, _spill, reg) = setup();
+    let marker = dir.path().join("must-not-run-after-cancel");
+    let command = format!(
+        "printf 'before\\n'; printf 'err-before\\n' >&2; sleep 1; touch {}; printf 'after\\n'",
+        marker.display()
+    );
+    let input = serde_json::to_string(&json!({ "command": command })).unwrap();
+    let context = ToolExecutionContext::new("call-heavy", "attempt-heavy", 0);
+    let bash = reg.get("Bash");
+    let executing = bash.clone();
+    let execution_context = context.clone();
+    let execution = tokio::spawn(async move { executing.execute(&input, execution_context).await });
+
+    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+    bash.cancel_execution(&context)
+        .await
+        .expect("signal exact execution cancellation");
+    let error = tokio::time::timeout(std::time::Duration::from_secs(2), execution)
+        .await
+        .expect("cancelled Bash should terminate inside the Engine grace budget")
+        .expect("Bash task join");
+
+    let ToolError::Cancelled(output) = error.expect_err("cancelled command is non-success") else {
+        panic!("expected typed cancellation result");
+    };
+    let content = output.content.expect("bounded progress output");
+    assert!(
+        content.contains("before"),
+        "missing pre-cancel stdout: {content}"
+    );
+    assert!(
+        content.contains("err-before"),
+        "missing pre-cancel stderr: {content}"
+    );
+    assert!(
+        !content.contains("after"),
+        "post-cancel output leaked: {content}"
+    );
+    assert!(content.len() <= 16 * 1024, "output must remain bounded");
+
+    tokio::time::sleep(std::time::Duration::from_millis(1_100)).await;
+    assert!(
+        !marker.exists(),
+        "the cancelled command continued executing after terminal confirmation"
+    );
+}
+
+#[tokio::test]
+async fn bash_force_close_cleanup_stops_command_and_keeps_session_reusable() {
+    let (dir, _spill, reg) = setup();
+    let marker = dir.path().join("must-not-survive-force-close");
+    let command = format!("sleep 1; touch {}", marker.display());
+    let input = serde_json::to_string(&json!({ "command": command })).unwrap();
+    let bash = reg.get("Bash");
+    let context = ToolExecutionContext::new("call-force", "attempt-force", 0);
+    let (handle, terminal) = ToolExecutionHandle::start(bash.clone(), input, context);
+
+    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+    handle.force_close();
+    assert!(matches!(
+        terminal.await,
+        ToolExecutionTerminal::OutcomeUnknown
+    ));
+
+    tokio::time::sleep(std::time::Duration::from_millis(1_100)).await;
+    assert!(
+        !marker.exists(),
+        "CommandGuard cleanup allowed a force-closed command to continue"
+    );
+
+    let output = bash
+        .execute(r#"{"command":"printf 'reused'"}"#, Default::default())
+        .await
+        .expect("workdir session remains reusable after cleanup");
+    assert_eq!(output.content.as_deref(), Some("reused"));
+}
+
 // Sanity: unused Path import guard
 const _: fn() -> &'static Path = || Path::new("/");
@@ -1244,6 +1244,7 @@ impl App {
                id,
                summary,
                output,
+                disposition: _,
                is_error,
            } => {
                self.latest_llm_wait_event = None;
@@ -1016,7 +1016,7 @@ fn handle_key(app: &mut App, key: KeyEvent) -> Option<Method> {
                app.clear_queued_inputs();
                Some(Method::Cancel)
            }
-            WorkerStatus::Idle => Some(Method::Shutdown),
+            WorkerStatus::Idle | WorkerStatus::Stopped => Some(Method::Shutdown),
        }),
        KeyCode::Char('d') if ctrl => {
            app.quit = true;
@@ -5200,6 +5200,7 @@ fn row_status_label(entry: &WorkerListEntry) -> (&'static str, Style) {
                    .fg(Color::Cyan)
                    .add_modifier(Modifier::BOLD),
            ),
+            Some(WorkerStatus::Stopped) => ("live stopped", Style::default().fg(Color::DarkGray)),
            None => ("live", Style::default().fg(Color::DarkGray)),
        };
    }
@@ -1530,6 +1530,7 @@ fn worker_status_label(entry: &WorkerListEntry) -> &'static str {
            Some(WorkerStatus::Idle) => "live idle",
            Some(WorkerStatus::Running) => "live running",
            Some(WorkerStatus::Paused) => "live paused",
+            Some(WorkerStatus::Stopped) => "live stopped",
            None => "live",
        };
    }
@@ -2742,6 +2742,7 @@ impl RuntimeState {
                protocol::WorkerStatus::Running => Some(WorkerStatus::Running),
                protocol::WorkerStatus::Idle => Some(WorkerStatus::Idle),
                protocol::WorkerStatus::Paused => Some(WorkerStatus::Paused),
+                protocol::WorkerStatus::Stopped => Some(WorkerStatus::Stopped),
            },
            protocol::Event::RunEnd { result } => match result {
                protocol::RunResult::Finished | protocol::RunResult::RolledBack => {
@@ -3104,7 +3105,7 @@ mod tests {
            &mut activity,
            &internal_worker_status_event(
                internal_worker_ref("child-b", None),
-                protocol::WorkerStatus::Idle,
+                protocol::WorkerStatus::Stopped,
            ),
        ));
    }
@@ -38,9 +38,7 @@ use crate::working_directory::{
 };
 use async_trait::async_trait;
 use protocol::{Event, Method, Segment, WorkerStatus};
-use session_store::{
-    CombinedStore, LogEntry, WorkerAggregateStore, WorkerSessionStore, collect_state,
-};
+use session_store::{CombinedStore, LogEntry, WorkerAggregateStore, WorkerSessionStore};
 #[cfg(test)]
 use session_store::{FsStore, FsWorkerStore};
 use tokio::runtime::Runtime;
@@ -68,8 +66,10 @@ const RUNTIME_TASK_TIMEOUT: Duration = Duration::from_secs(10);
 const USER_INPUT_COMMIT_TIMEOUT: Duration = Duration::from_secs(9);

 fn user_input_has_submission(entry: &LogEntry, submission_id: &str) -> bool {
-    let LogEntry::UserInput { extensions, .. } = entry else {
-        return false;
+    let extensions = match entry {
+        LogEntry::UserInput { extensions, .. }
+        | LogEntry::AnnotatedUserInput { extensions, .. } => extensions,
+        _ => return false,
    };
    extensions.iter().any(|extension| {
        extension.domain == WORKER_INPUT_SUBMISSION_EXTENSION_DOMAIN
@@ -212,11 +212,11 @@ impl WorkerObservationProvider for RuntimeGrantedWorkerObservationProvider {
            return Err(WorkerObservationError::NotFound);
        }
        let entries = sink.subscribe_with_snapshot().0;
-        let state = collect_state(&entries);
-        Ok(WorkerSessionCapture {
-            segment_id: format!("runtime:{runtime_id}:worker:{worker_id}"),
-            items: state.history,
-        })
+        WorkerSessionCapture::from_log_entries(
+            format!("runtime:{runtime_id}:worker:{worker_id}"),
+            &entries,
+        )
+        .map_err(WorkerObservationError::Unavailable)
    }
 }

@@ -1546,7 +1546,9 @@ fn accepted_notify_run_state(status: WorkerStatus, auto_run: bool) -> WorkerExec
    match status {
        WorkerStatus::Running => WorkerExecutionRunState::Busy,
        WorkerStatus::Idle if auto_run => WorkerExecutionRunState::Busy,
-        WorkerStatus::Idle | WorkerStatus::Paused => WorkerExecutionRunState::Idle,
+        WorkerStatus::Idle | WorkerStatus::Paused | WorkerStatus::Stopped => {
+            WorkerExecutionRunState::Idle
+        }
    }
 }

@@ -2505,7 +2507,9 @@ mod tests {
            let scope = Scope::writable(&scope_root).map_err(|err| err.to_string())?;
            let worker = Worker::new(
                manifest,
-                Engine::new(self.client.clone()),
+                Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(
+                    self.client.clone(),
+                ),
                store,
                workspace_context,
                filesystem_authority,
@@ -3241,14 +3245,17 @@ mod tests {
            matches!(
                entry,
                LogEntry::UserInput { segments, .. }
+                | LogEntry::AnnotatedUserInput { segments, .. }
                    if segments == &vec![Segment::text("start the ticket")]
            )
        }));
        let submission_id = entries
            .iter()
            .find_map(|entry| {
-                let LogEntry::UserInput { extensions, .. } = entry else {
-                    return None;
+                let extensions = match entry {
+                    LogEntry::UserInput { extensions, .. }
+                    | LogEntry::AnnotatedUserInput { extensions, .. } => extensions,
+                    _ => return None,
                };
                extensions
                    .iter()
@@ -66,11 +66,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
        WorkerRunResult::Finished => println!("(finished)"),
        WorkerRunResult::Paused => println!("(paused)"),
        WorkerRunResult::LimitReached => println!("(turn limit reached)"),
+        WorkerRunResult::Interrupted { message, .. } => println!("(interrupted: {message})"),
        WorkerRunResult::RolledBack => println!("(empty turn rolled back)"),
    }

    // 5. Extract the assistant's reply from history
-    let history = worker.engine().history();
+    let history = worker.history();
    if let Some(text) = history
        .iter()
        .rev()
@@ -22,7 +22,7 @@ use crate::compact::token_counter::{
    EstimateSource, savings_for_prune_impl, token_estimates_for_prune_impl,
 };

-impl<C: LlmClient, St: Store> Worker<C, St> {
+impl<C: LlmClient + 'static, St: Store> Worker<C, St> {
    /// Enable prune projection on the underlying Engine.
    ///
    /// Registers the config and token/savings-estimator closures on the Engine.
@@ -242,13 +242,13 @@ pub(crate) fn savings_for_prune_impl(

 // ── Worker に生やす公開 API ───────────────────────────────────────────────

-impl<C: LlmClient, St: Store> Worker<C, St> {
+impl<C: LlmClient + 'static, St: Store> Worker<C, St> {
    /// 現在の history 全体の推定トークン数。
    ///
    /// 最後の measurement と、その後に追加された未測定分の byte/4 外挿。
    pub fn total_tokens(&self) -> TokenEstimate {
        let usage = self.usage_history();
-        agen::token_counter::total_tokens(self.history(), &usage)
+        agen::token_counter::total_tokens(&self.history(), &usage)
    }

    /// 任意の history index 時点でのプロンプト全長推定。
@@ -259,7 +259,7 @@ impl<C: LlmClient, St: Store> Worker<C, St> {
    /// pointer 以降に増えたプロンプト長を測るのに使う。
    pub fn total_tokens_at(&self, history_len: usize) -> TokenEstimate {
        let usage = self.usage_history();
-        agen::token_counter::total_tokens_at(self.history(), &usage, history_len)
+        agen::token_counter::total_tokens_at(&self.history(), &usage, history_len)
    }

    /// 末尾から `retained` トークン以上を残すための分割位置。
@@ -267,7 +267,7 @@ impl<C: LlmClient, St: Store> Worker<C, St> {
    /// `history[..cut.index]` が要約／破棄される側、`history[cut.index..]` が残る側。
    pub fn split_for_retained(&self, retained: u64) -> SplitPoint {
        let usage = self.usage_history();
-        split_for_retained_impl(self.history(), &usage, retained)
+        split_for_retained_impl(&self.history(), &usage, retained)
    }
 }

@@ -485,6 +485,7 @@ impl WorkerController {
        // into the controller task so the in-flight turn can be reached
        // via these handles while worker itself is borrowed by drive_turn.
        let cancel_tx = worker.engine_mut().cancel_sender();
+        let pause_tx = worker.engine_mut().pause_sender();
        let notify_buffer = worker.notify_buffer_handle();

        tokio::spawn(controller_loop(
@@ -494,6 +495,7 @@ impl WorkerController {
            shared_state,
            runtime_dir,
            cancel_tx,
+            pause_tx,
            notify_buffer,
            self_parent_socket,
            spawner_name,
@@ -763,6 +765,19 @@ pub(crate) fn wire_event_bridges_on_engine<C, St>(
            id: result.tool_use_id.clone(),
            summary: result.summary.clone(),
            output: result.content.clone(),
+            disposition: Some(match result.disposition {
+                agen::ToolResultDisposition::Success => protocol::ToolResultDisposition::Success,
+                agen::ToolResultDisposition::Error => protocol::ToolResultDisposition::Error,
+                agen::ToolResultDisposition::Interrupted => {
+                    protocol::ToolResultDisposition::Interrupted
+                }
+                agen::ToolResultDisposition::Cancelled => {
+                    protocol::ToolResultDisposition::Cancelled
+                }
+                agen::ToolResultDisposition::OutcomeUnknown => {
+                    protocol::ToolResultDisposition::OutcomeUnknown
+                }
+            }),
            is_error: result.is_error,
        });
    });
@@ -1123,6 +1138,7 @@ async fn controller_loop<C, St>(
    shared_state: Arc<WorkerSharedState>,
    runtime_dir: Arc<RuntimeDir>,
    cancel_tx: mpsc::Sender<()>,
+    pause_tx: mpsc::Sender<()>,
    notify_buffer: NotifyBuffer,
    self_parent_socket: Option<PathBuf>,
    spawner_name: String,
@@ -1169,22 +1185,35 @@ async fn controller_loop<C, St>(
            // clear at run start prevents stale partial output left by an older
            // interrupted/error turn from being carried into the next snapshot.
            worker.clear_in_flight_events();
-            set_controller_status(
-                &shared_state,
-                &runtime_dir,
-                &event_tx,
-                WorkerStatus::Running,
-            )
-            .await;
            let parent_originated = run.is_parent_originated();
+            let user_input_run = matches!(&run, PendingRun::Run(_) | PendingRun::RunTracked { .. });
+            if !user_input_run {
+                set_controller_status(
+                    &shared_state,
+                    &runtime_dir,
+                    &event_tx,
+                    WorkerStatus::Running,
+                )
+                .await;
+            }
            let (mut new_status, shutdown) = match run {
                PendingRun::Run(input) => {
+                    let (input_commit_tx, input_commit_rx) = oneshot::channel();
                    drive_turn(
-                        worker.run(input),
+                        worker.run_with_input_extensions_and_commit_hook(
+                            input,
+                            Vec::new(),
+                            move || {
+                                let _ = input_commit_tx.send(());
+                            },
+                        ),
                        &mut method_rx,
                        &event_tx,
                        &cancel_tx,
+                        &pause_tx,
                        &shared_state,
+                        &runtime_dir,
+                        Some(input_commit_rx),
                        &notify_buffer,
                        self_parent_socket.as_ref(),
                        &spawner_name,
@@ -1194,12 +1223,22 @@ async fn controller_loop<C, St>(
                    .await
                }
                PendingRun::RunTracked { input, extension } => {
+                    let (input_commit_tx, input_commit_rx) = oneshot::channel();
                    drive_turn(
-                        worker.run_with_input_extensions(input, vec![extension]),
+                        worker.run_with_input_extensions_and_commit_hook(
+                            input,
+                            vec![extension],
+                            move || {
+                                let _ = input_commit_tx.send(());
+                            },
+                        ),
                        &mut method_rx,
                        &event_tx,
                        &cancel_tx,
+                        &pause_tx,
                        &shared_state,
+                        &runtime_dir,
+                        Some(input_commit_rx),
                        &notify_buffer,
                        self_parent_socket.as_ref(),
                        &spawner_name,
@@ -1214,7 +1253,10 @@ async fn controller_loop<C, St>(
                        &mut method_rx,
                        &event_tx,
                        &cancel_tx,
+                        &pause_tx,
                        &shared_state,
+                        &runtime_dir,
+                        None,
                        &notify_buffer,
                        self_parent_socket.as_ref(),
                        &spawner_name,
@@ -1229,7 +1271,10 @@ async fn controller_loop<C, St>(
                        &mut method_rx,
                        &event_tx,
                        &cancel_tx,
+                        &pause_tx,
                        &shared_state,
+                        &runtime_dir,
+                        None,
                        &notify_buffer,
                        self_parent_socket.as_ref(),
                        &spawner_name,
@@ -1354,7 +1399,7 @@ async fn controller_loop<C, St>(
                        });
                    }
                },
-                WorkerStatus::Idle => {
+                WorkerStatus::Idle | WorkerStatus::Stopped => {
                    let _ = event_tx.send(Event::Error {
                        code: ErrorCode::NotRunning,
                        message: "Worker is not running".into(),
@@ -1395,7 +1440,7 @@ async fn controller_loop<C, St>(
                            .into(),
                    });
                }
-                WorkerStatus::Running => {
+                WorkerStatus::Running | WorkerStatus::Stopped => {
                    let _ = event_tx.send(Event::Error {
                        code: ErrorCode::AlreadyRunning,
                        message:
@@ -1409,7 +1454,7 @@ async fn controller_loop<C, St>(
                WorkerStatus::Idle | WorkerStatus::Paused => {
                    emit_rewind_targets(&worker, &event_tx)
                }
-                WorkerStatus::Running => {
+                WorkerStatus::Running | WorkerStatus::Stopped => {
                    let _ = event_tx.send(Event::Error {
                        code: ErrorCode::AlreadyRunning,
                        message: "Worker is already executing a turn; rewind can only run while idle or paused"
@@ -1438,7 +1483,7 @@ async fn controller_loop<C, St>(
                            .into(),
                    });
                }
-                WorkerStatus::Running => {
+                WorkerStatus::Running | WorkerStatus::Stopped => {
                    let _ = event_tx.send(Event::Error {
                        code: ErrorCode::AlreadyRunning,
                        message: "Worker is already executing a turn; rewind can only run while idle or paused"
@@ -1626,7 +1671,10 @@ async fn drive_turn<F>(
    method_rx: &mut mpsc::Receiver<Method>,
    event_tx: &broadcast::Sender<Event>,
    cancel_tx: &mpsc::Sender<()>,
+    pause_tx: &mpsc::Sender<()>,
    shared_state: &Arc<WorkerSharedState>,
+    runtime_dir: &RuntimeDir,
+    mut input_commit_rx: Option<oneshot::Receiver<()>>,
    notify_buffer: &NotifyBuffer,
    parent_socket: Option<&PathBuf>,
    self_name: &str,
@@ -1642,14 +1690,58 @@ where

    loop {
        tokio::select! {
+            // If input commit and provider completion become ready together, expose
+            // Running only after processing the commit fence. This makes the
+            // Running snapshot contract deterministic even for immediate clients.
+            biased;
+            committed = async {
+                input_commit_rx
+                    .as_mut()
+                    .expect("input commit receiver guarded by select condition")
+                    .await
+            }, if input_commit_rx.is_some() => {
+                input_commit_rx = None;
+                if committed.is_ok() {
+                    set_controller_status(
+                        shared_state,
+                        runtime_dir,
+                        event_tx,
+                        WorkerStatus::Running,
+                    )
+                    .await;
+                }
+            }
            result = &mut worker_future => {
                return match result {
                    Ok(r) => {
                        let (status, run_result) = match r {
+                            WorkerRunResult::Finished if pause_requested => {
+                                (WorkerStatus::Paused, RunResult::Paused)
+                            }
                            WorkerRunResult::Finished => (WorkerStatus::Idle, RunResult::Finished),
                            WorkerRunResult::Paused => (WorkerStatus::Paused, RunResult::Paused),
                            WorkerRunResult::LimitReached => (WorkerStatus::Idle, RunResult::LimitReached),
                            WorkerRunResult::RolledBack => (WorkerStatus::Idle, RunResult::RolledBack),
+                            WorkerRunResult::Interrupted { .. } if pause_requested => {
+                                let _ = event_tx.send(Event::RunEnd { result: RunResult::Paused });
+                                return (WorkerStatus::Paused, shutdown_requested);
+                            }
+                            WorkerRunResult::Interrupted { code, message } => {
+                                let _ = event_tx.send(Event::Error {
+                                    code,
+                                    message: message.clone(),
+                                });
+                                if parent_originated {
+                                    crate::ipc::event::fire_and_forget(
+                                        parent_socket.cloned(),
+                                        protocol::WorkerEvent::Errored {
+                                            worker_name: self_name.to_string(),
+                                            message,
+                                        },
+                                    );
+                                }
+                                return (WorkerStatus::Idle, shutdown_requested);
+                            }
                        };
                        let _ = event_tx.send(Event::RunEnd { result: run_result });
                        if parent_originated && matches!(run_result, RunResult::Finished) {
@@ -1698,7 +1790,7 @@ where
                    }
                    Some(Method::Pause) => {
                        pause_requested = true;
-                        let _ = cancel_tx.try_send(());
+                        let _ = pause_tx.try_send(());
                    }
                    Some(Method::Shutdown) => {
                        shutdown_requested = true;
@@ -1760,7 +1852,7 @@ where

 fn emit_rewind_targets<C, St>(worker: &Worker<C, St>, event_tx: &broadcast::Sender<Event>)
 where
-    C: LlmClient,
+    C: LlmClient + 'static,
    St: Store,
 {
    match worker.list_rewind_targets() {
@@ -1786,7 +1878,7 @@ fn apply_rewind<C, St>(
    expected_head_entries: usize,
 ) -> bool
 where
-    C: LlmClient,
+    C: LlmClient + 'static,
    St: Store,
 {
    match worker.rewind_to(target, expected_head_entries) {
@@ -1834,7 +1926,7 @@ fn model_supports_image_attachments(model: &manifest::ModelManifest) -> bool {

 fn build_greeting<C, St>(worker: &Worker<C, St>) -> protocol::Greeting
 where
-    C: LlmClient,
+    C: LlmClient + 'static,
    St: Store,
 {
    let manifest = worker.manifest();
@@ -1950,11 +2042,13 @@ mod tests {
        event_tx: broadcast::Sender<Event>,
        cancel_tx: mpsc::Sender<()>,
        _cancel_rx: mpsc::Receiver<()>,
+        pause_tx: mpsc::Sender<()>,
+        _pause_rx: mpsc::Receiver<()>,
        shared_state: Arc<WorkerSharedState>,
        notify_buffer: NotifyBuffer,
        spawned_registry: Arc<SpawnedWorkerRegistry>,
        parent_socket_path: PathBuf,
-        _runtime_dir: Arc<RuntimeDir>,
+        runtime_dir: Arc<RuntimeDir>,
        _temp: TempDir,
    }

@@ -1968,6 +2062,7 @@ mod tests {
        let (method_tx, method_rx) = mpsc::channel::<Method>(16);
        let (event_tx, _) = broadcast::channel::<Event>(16);
        let (cancel_tx, cancel_rx) = mpsc::channel::<()>(1);
+        let (pause_tx, pause_rx) = mpsc::channel::<()>(1);
        let shared_state = Arc::new(WorkerSharedState::new(
            "child-worker".to_string(),
            session_store::new_segment_id(),
@@ -1993,11 +2088,13 @@ mod tests {
            event_tx,
            cancel_tx,
            _cancel_rx: cancel_rx,
+            pause_tx,
+            _pause_rx: pause_rx,
            shared_state,
            notify_buffer,
            spawned_registry,
            parent_socket_path,
-            _runtime_dir: runtime_dir,
+            runtime_dir,
            _temp: temp,
        }
    }
@@ -2050,7 +2147,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "child-worker",
@@ -2071,6 +2171,44 @@ mod tests {
        }
    }

+    #[tokio::test]
+    async fn pause_waits_for_run_boundary_and_uses_safe_pause_channel() {
+        let mut env = make_env().await;
+        let method_tx = env._method_tx.clone();
+        tokio::spawn(async move {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+            method_tx.send(Method::Pause).await.expect("send pause");
+        });
+
+        let worker_future = async {
+            tokio::time::sleep(Duration::from_millis(100)).await;
+            Ok::<_, WorkerError>(WorkerRunResult::Finished)
+        };
+        let started_at = std::time::Instant::now();
+        let (status, shutdown) = drive_turn(
+            worker_future,
+            &mut env.method_rx,
+            &env.event_tx,
+            &env.cancel_tx,
+            &env.pause_tx,
+            &env.shared_state,
+            &env.runtime_dir,
+            None,
+            &env.notify_buffer,
+            None,
+            "child-worker",
+            &env.spawned_registry,
+            true,
+        )
+        .await;
+
+        assert_eq!(status, WorkerStatus::Paused);
+        assert!(!shutdown);
+        assert!(started_at.elapsed() >= Duration::from_millis(100));
+        assert!(env._pause_rx.try_recv().is_ok());
+        assert!(env._cancel_rx.try_recv().is_err());
+    }
+
    #[tokio::test]
    async fn non_parent_originated_finished_stays_silent() {
        let mut env = make_env().await;
@@ -2082,7 +2220,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "child-worker",
@@ -2117,7 +2258,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "child-worker",
@@ -2158,7 +2302,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "child-worker",
@@ -2197,7 +2344,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "parent",
@@ -2233,7 +2383,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "parent",
@@ -2267,7 +2420,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "parent",
@@ -2300,7 +2456,10 @@ mod tests {
            &mut env.method_rx,
            &env.event_tx,
            &env.cancel_tx,
+            &env.pause_tx,
            &env.shared_state,
+            &env.runtime_dir,
+            None,
            &env.notify_buffer,
            Some(&env.parent_socket_path),
            "child-worker",
@@ -1795,9 +1795,9 @@ impl FeatureRegistryBuilder {
    }

    /// Install modules into the existing Engine tool path and hook builder.
-    pub(crate) fn install_into_engine<C: LlmClient>(
+    pub(crate) fn install_into_engine<C: LlmClient, A>(
        self,
-        worker: &mut Engine<C, Mutable>,
+        worker: &mut Engine<C, Mutable, A>,
        hook_builder: &mut HookRegistryBuilder,
    ) -> FeatureRegistryInstallReport {
        let mut pending_tools = Vec::new();
@@ -6,7 +6,9 @@ use memory::backend::{
    MemoryBackendOperation, MemoryBackendOperationResult, MemoryStageCandidateOperation,
 };
 use memory::extract::{CandidateKind, ExtractedCandidate, StagingEvidence};
-use memory::schema::{EvidenceKind, SourceEvidenceRef, SourceRef};
+use memory::schema::{
+    EvidenceKind, EvidenceOrigin, EvidenceOriginKind, SourceEvidenceRef, SourceRef,
+};
 use schemars::JsonSchema;
 use serde::Deserialize;

@@ -174,17 +176,29 @@ impl Tool for StageMemoryCandidateTool {
                "StageMemoryCandidate requires at least one entry_ref".to_string(),
            ));
        }
-        let mut evidence = Vec::with_capacity(params.entry_refs.len());
-        let mut source_refs = Vec::with_capacity(params.entry_refs.len());
+        let mut entries = Vec::with_capacity(params.entry_refs.len());
        for entry_ref in &params.entry_refs {
-            let projection = self.state.view.evidence_for(entry_ref).ok_or_else(|| {
+            entries.push(self.state.view.evidence_for(entry_ref).ok_or_else(|| {
                ToolError::InvalidArgument(format!(
                    "unknown SessionEntryRef {entry_ref:?} for this extraction capture"
                ))
-            })?;
-            evidence.push(staging_evidence(&projection));
-            source_refs.push(source_evidence_ref(&projection));
+            })?);
        }
+        if matches!(params.kind, CandidateKind::Preference)
+            && entries.iter().any(|entry| {
+                !matches!(
+                    entry.origin,
+                    crate::WorkerHistoryProvenance::HumanInput { .. }
+                )
+            })
+        {
+            return Err(ToolError::InvalidArgument(
+                "preference candidates require exclusively HumanInput evidence; model, Worker, Flow, backend, derived, and legacy-unknown origins are not preference authority"
+                    .to_string(),
+            ));
+        }
+        let evidence = entries.iter().map(staging_evidence).collect();
+        let source_refs = entries.iter().map(source_evidence_ref).collect();
        let candidate = ExtractedCandidate {
            kind: params.kind,
            claim: params.claim,
@@ -310,11 +324,65 @@ fn evidence_kind(entry: &SessionEntryEvidence) -> EvidenceKind {
    }
 }

+fn evidence_origin(origin: &crate::WorkerHistoryProvenance) -> EvidenceOrigin {
+    use crate::WorkerHistoryProvenance as Origin;
+    let mut evidence = EvidenceOrigin {
+        kind: EvidenceOriginKind::LegacyUnknown,
+        account_id: None,
+        workspace_id: None,
+        runtime_id: None,
+        worker_id: None,
+        flow_selector: None,
+        flow_definition_id: None,
+        flow_definition_revision: None,
+    };
+    match origin {
+        Origin::HumanInput { account_id } => {
+            evidence.kind = EvidenceOriginKind::HumanInput;
+            evidence.account_id = Some(account_id.clone());
+        }
+        Origin::WorkerInput { actor } => {
+            evidence.kind = EvidenceOriginKind::WorkerInput;
+            evidence.workspace_id = actor.workspace_id.clone();
+            evidence.runtime_id = actor.runtime_id.clone();
+            evidence.worker_id = Some(actor.worker_id.clone());
+        }
+        Origin::FlowInstruction {
+            selector,
+            definition_id,
+            definition_revision,
+            ..
+        } => {
+            evidence.kind = EvidenceOriginKind::FlowInstruction;
+            evidence.flow_selector = Some(selector.clone());
+            evidence.flow_definition_id = Some(definition_id.clone());
+            evidence.flow_definition_revision = Some(*definition_revision);
+        }
+        Origin::BackendInstruction { .. } => evidence.kind = EvidenceOriginKind::BackendInstruction,
+        Origin::ModelOutput { worker } => {
+            evidence.kind = EvidenceOriginKind::ModelOutput;
+            evidence.workspace_id = worker.workspace_id.clone();
+            evidence.runtime_id = worker.runtime_id.clone();
+            evidence.worker_id = Some(worker.worker_id.clone());
+        }
+        Origin::ToolOutput { worker } => {
+            evidence.kind = EvidenceOriginKind::ToolOutput;
+            evidence.workspace_id = worker.workspace_id.clone();
+            evidence.runtime_id = worker.runtime_id.clone();
+            evidence.worker_id = Some(worker.worker_id.clone());
+        }
+        Origin::DerivedSummary => evidence.kind = EvidenceOriginKind::DerivedSummary,
+        Origin::LegacyUnknown => evidence.kind = EvidenceOriginKind::LegacyUnknown,
+    }
+    evidence
+}
+
 fn staging_evidence(entry: &SessionEntryEvidence) -> StagingEvidence {
    StagingEvidence {
        id: entry.entry_ref.to_string(),
        kind: evidence_kind(entry),
        entry_range: Some(entry.entry_range),
+        origin: Some(evidence_origin(&entry.origin)),
        excerpt: Some(entry.excerpt.clone()),
        summary: Some(entry.summary.clone()),
    }
@@ -325,6 +393,7 @@ fn source_evidence_ref(entry: &SessionEntryEvidence) -> SourceEvidenceRef {
        segment_id: Some(entry.segment_id.clone()),
        entry_range: Some(entry.entry_range),
        evidence_id: Some(entry.entry_ref.to_string()),
+        origin: Some(evidence_origin(&entry.origin)),
        evidence_kind: Some(evidence_kind(entry)),
        label: Some(entry.label.clone()),
        summary: Some(entry.summary.clone()),
@@ -432,6 +501,15 @@ mod tests {
        assert!(input.contains("StageMemoryCandidate.entry_refs"));
    }

+    #[test]
+    fn human_origin_projects_account_authority_into_evidence() {
+        let origin = evidence_origin(&crate::WorkerHistoryProvenance::HumanInput {
+            account_id: "account-1".into(),
+        });
+        assert_eq!(origin.kind, EvidenceOriginKind::HumanInput);
+        assert_eq!(origin.account_id.as_deref(), Some("account-1"));
+    }
+
    #[test]
    fn backend_input_failures_remain_invalid_argument_tool_errors() {
        let backend = map_memory_stage_error(WorkspaceMemoryBackendError::Backend(
@@ -445,6 +523,19 @@ mod tests {
        assert!(matches!(http, ToolError::InvalidArgument(_)));
    }

+    #[tokio::test]
+    async fn preference_rejects_legacy_unknown_before_backend_mutation() {
+        let tool = StageMemoryCandidateTool { state: state() };
+        let error = tool
+            .execute(
+                r#"{"kind":"preference","claim":"claim","why_useful":"useful","entry_refs":["E00000000"]}"#,
+                agen::tool::ToolExecutionContext::direct(),
+            )
+            .await
+            .unwrap_err();
+        assert!(format!("{error:?}").contains("exclusively HumanInput evidence"));
+    }
+
    #[tokio::test]
    async fn stage_rejects_entry_ref_outside_capture_before_backend_mutation() {
        let tool = StageMemoryCandidateTool { state: state() };
@@ -62,8 +62,9 @@ impl WorkspaceHttpObjectiveBackend {
        .await
        .map_err(backend_error)?;
        let response = project_objective_detail(response).map_err(ToolError::ExecutionFailed)?;
+        let objective_ref = response.objective_ref().to_string();
        Ok(ToolOutput {
-            summary: format!("Read objective {id}"),
+            summary: format!("Read objective {objective_ref}"),
            content: Some(serde_json::to_string_pretty(&response).map_err(decode_error)?),
            attachments: Vec::new(),
        })
@@ -710,6 +711,58 @@ mod tests {
        assert_eq!(link["required"], json!(["id", "ticket_id"]));
    }

+    #[tokio::test(flavor = "multi_thread")]
+    async fn objective_show_summary_uses_projected_human_key() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        let base_url = format!("http://{}", listener.local_addr().unwrap());
+        let server = thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            let mut buffer = [0_u8; 8192];
+            let len = stream.read(&mut buffer).unwrap();
+            let request = String::from_utf8_lossy(&buffer[..len]);
+            assert!(
+                request.starts_with("POST /api/w/workspace/objectives/00001INTERNAL/show HTTP/1.1")
+            );
+            let body = serde_json::json!({
+                "id": "00001INTERNAL",
+                "resource_key": "O-3",
+                "title": "Objective",
+                "body": "Body",
+                "state": "active",
+                "created_at": null,
+                "updated_at": null,
+                "linked_ticket_summaries": [],
+                "events": [],
+                "event_page": {"next_cursor": null, "has_more": false}
+            })
+            .to_string();
+            write!(
+                stream,
+                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+                body.len(),
+                body
+            )
+            .unwrap();
+        });
+        let backend = WorkspaceHttpObjectiveBackend::new(Arc::new(
+            crate::worker::TestWorkspaceHttpClient::new("workspace", base_url),
+        ));
+
+        let output = backend
+            .show(ShowObjectiveInput {
+                id: "00001INTERNAL".to_string(),
+                event_limit: None,
+                event_cursor: None,
+            })
+            .await
+            .unwrap();
+
+        server.join().unwrap();
+        assert_eq!(output.summary, "Read objective O-3");
+        assert!(!output.summary.contains("00001INTERNAL"));
+        assert!(!output.content.unwrap().contains("00001INTERNAL"));
+    }
+
    #[tokio::test(flavor = "multi_thread")]
    async fn objective_link_summaries_resolve_internal_ticket_ids_to_human_keys() {
        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
@@ -63,7 +63,7 @@ pub(super) struct ModelObjectiveQueryResponse {
 struct ModelObjectiveQueryItem {
    objective: String,
    title: String,
-    summary: String,
+    summary: Option<String>,
    state: String,
    created_at: Option<String>,
    updated_at: Option<String>,
@@ -84,6 +84,12 @@ pub(super) struct ModelObjectiveDetail {
    event_page: ModelObjectiveEventPage,
 }

+impl ModelObjectiveDetail {
+    pub(super) fn objective_ref(&self) -> &str {
+        &self.objective
+    }
+}
+
 #[derive(Debug, Serialize)]
 struct ModelWorkerSummary {
    worker: String,
@@ -331,7 +337,7 @@ fn project_objective_query_item(value: &Value) -> Result<ModelObjectiveQueryItem
    Ok(ModelObjectiveQueryItem {
        objective: human_ref(item, "resource_key", "O-")?,
        title: string_field(item, "title")?,
-        summary: string_field(item, "snippet")?,
+        summary: optional_string(item, "snippet")?,
        state: string_field(item, "state")?,
        created_at: optional_string(item, "created_at")?,
        updated_at: optional_string(item, "updated_at")?,
@@ -757,7 +763,7 @@ mod tests {
                "created_at": null,
                "updated_at": null,
                "matched_fields": [],
-                "snippet": "Objective summary",
+                "snippet": null,
                "linked_ticket_count": 1,
                "linked_tickets": ["00001TICKETINTERNAL"],
                "linked_ticket_keys": ["T-543"]
@@ -767,6 +773,7 @@ mod tests {
        let objective_json = serde_json::to_string(&objective).expect("serialize Objective query");
        assert!(objective_json.contains("O-6"));
        assert!(objective_json.contains("T-543"));
+        assert!(objective_json.contains("\"summary\":null"));
        assert!(!objective_json.contains("00001OBJECTIVEINTERNAL"));
        assert!(!objective_json.contains("00001TICKETINTERNAL"));
    }
@@ -193,6 +193,7 @@ impl Tool for ShowOverviewTool {
            .map(|entry| {
                serde_json::json!({
                    "entry_ref": entry.id,
+                    "origin": entry.origin,
                    "entry_range": entry.entry_range,
                    "kind": entry.kind.as_str(),
                    "label": entry.label,
@@ -234,15 +235,16 @@ impl Tool for SearchEntriesTool {
            .transpose()?;
        let from = params.from.as_deref().map(parse_entry_ref).transpose()?;
        let through = params.through.as_deref().map(parse_entry_ref).transpose()?;
+        let view = self.state.view();
        if let (Some(from), Some(through)) = (&from, &through) {
-            if from.source_index() > through.source_index() {
+            if view.source_index_for_ref(from) > view.source_index_for_ref(through) {
                return Err(ToolError::InvalidArgument(
                    "SearchEntries from must not be after through".to_string(),
                ));
            }
        }
        let limit = bounded_limit(params.limit, DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT);
-        let hits = self.state.view().search(&SearchOptions {
+        let hits = view.search(&SearchOptions {
            query: params.query,
            kind,
            tool_part,
@@ -318,6 +320,7 @@ impl Tool for ReadEntryTool {
            .map(|entry| {
                serde_json::json!({
                    "entry_ref": entry.id,
+                    "origin": entry.origin,
                    "entry_range": entry.entry_range,
                    "kind": entry.kind.as_str(),
                    "tool_part": entry.tool_part.map(|part| format!("{part:?}").to_lowercase()),
@@ -876,12 +876,22 @@ impl WorkspaceHttpTicketBackend {
                Ok(TicketBackendOperationResult::Tickets(tickets))
            }
            TicketBackendOperation::Show { id } => {
-                let ticket = Self::request(
+                let ticket: Ticket = Self::request(
                    client,
                    WorkspaceRequestMethod::Get,
                    format!("{base}/{}/record", Self::ticket_path(&id)),
                    None,
                )?;
+                if !ticket
+                    .meta
+                    .resource_key
+                    .as_deref()
+                    .is_some_and(is_canonical_ticket_resource_key)
+                {
+                    return Err(TicketError::Conflict(
+                        "required Ticket human key is unavailable".to_string(),
+                    ));
+                }
                Ok(TicketBackendOperationResult::Ticket(ticket))
            }
            TicketBackendOperation::Create { input } => {
@@ -1,11 +1,12 @@
 use std::sync::Arc;

+#[cfg(test)]
 use agen::Item;
 use agen::tool::{Tool, ToolDefinition, ToolError, ToolMeta, ToolOutput};
 use async_trait::async_trait;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
-use session_store::collect_state;
+use session_store::{LogEntry, collect_state};

 use super::manage_worker::{WORKER_CONTROL_SERVICE_ID, WorkerControlService};
 use crate::feature::{
@@ -60,7 +61,27 @@ pub struct WorkerObservationSubject {
 #[derive(Debug, Clone)]
 pub struct WorkerSessionCapture {
    pub segment_id: String,
-    pub items: Vec<Item>,
+    pub entries: Vec<agen::HistoryEntry<crate::SessionHistoryMetadata>>,
+}
+
+impl WorkerSessionCapture {
+    pub fn from_log_entries(
+        segment_id: impl Into<String>,
+        log_entries: &[LogEntry],
+    ) -> Result<Self, String> {
+        let segment_id = segment_id.into();
+        let state = collect_state(log_entries);
+        let parsed_segment_id = segment_id.parse().unwrap_or_default();
+        let entries = crate::session_history::restore_history_entries(
+            state.session_id.unwrap_or_default(),
+            parsed_segment_id,
+            log_entries,
+        )?;
+        Ok(Self {
+            segment_id,
+            entries,
+        })
+    }
 }

 #[derive(Debug, thiserror::Error)]
@@ -161,9 +182,17 @@ impl WorkerObservationProvider for WorkspaceClientWorkerObservationProvider {
            })
            .collect::<Result<Vec<session_store::LogEntry>, _>>()?;
        let state = collect_state(&entries);
+        let segment_id = response.segment_id;
+        let parsed_segment_id = segment_id.parse().unwrap_or_default();
+        let typed_entries = crate::session_history::restore_history_entries(
+            state.session_id.unwrap_or_default(),
+            parsed_segment_id,
+            &entries,
+        )
+        .map_err(WorkerObservationError::Unavailable)?;
        Ok(WorkerSessionCapture {
-            segment_id: response.segment_id,
-            items: state.history,
+            segment_id,
+            entries: typed_entries,
        })
    }
 }
@@ -392,9 +421,15 @@ impl WorkerObservationProvider for SpawnedSubWorkerObservationProvider {
            .ok_or(WorkerObservationError::NotFound)?;
        let entries = record.session.entries();
        let state = collect_state(&entries);
+        let typed_entries = crate::session_history::restore_history_entries(
+            state.session_id.unwrap_or_default(),
+            Default::default(),
+            &entries,
+        )
+        .map_err(WorkerObservationError::Unavailable)?;
        Ok(WorkerSessionCapture {
            segment_id: format!("subworker:{name}"),
-            items: state.history,
+            entries: typed_entries,
        })
    }
 }
@@ -508,6 +543,7 @@ impl Tool for ViewSessionOverviewTool {
            .map(|entry| {
                serde_json::json!({
                    "entry_ref": entry.id,
+                    "origin": entry.origin,
                    "entry_range": entry.entry_range,
                    "kind": entry.kind.as_str(),
                    "label": entry.label,
@@ -547,7 +583,7 @@ impl Tool for SearchSessionEntriesTool {
        let from = params.from.as_deref().map(parse_entry_ref).transpose()?;
        let through = params.through.as_deref().map(parse_entry_ref).transpose()?;
        if let (Some(from), Some(through)) = (&from, &through) {
-            if from.source_index() > through.source_index() {
+            if view.source_index_for_ref(from) > view.source_index_for_ref(through) {
                return Err(ToolError::InvalidArgument(
                    "SearchSessionEntries from must not be after through".to_string(),
                ));
@@ -573,6 +609,7 @@ impl Tool for SearchSessionEntriesTool {
            .map(|entry| {
                serde_json::json!({
                    "entry_ref": entry.id,
+                    "origin": entry.origin,
                    "entry_range": entry.entry_range,
                    "kind": entry.kind.as_str(),
                    "tool_part": entry.tool_part.map(|part| format!("{part:?}").to_lowercase()),
@@ -628,6 +665,7 @@ impl Tool for ReadSessionEntryTool {
            .map(|entry| {
                serde_json::json!({
                    "entry_ref": entry.id,
+                    "origin": entry.origin,
                    "entry_range": entry.entry_range,
                    "kind": entry.kind.as_str(),
                    "tool_part": entry.tool_part.map(|part| format!("{part:?}").to_lowercase()),
@@ -661,7 +699,10 @@ async fn latest_view(
        .capture_worker_session(subject)
        .await
        .map_err(tool_error)?;
-    Ok(SessionCapture::new(capture.segment_id, capture.items))
+    Ok(SessionCapture::from_history_entries(
+        capture.segment_id,
+        capture.entries,
+    ))
 }

 fn parse_input<T: serde::de::DeserializeOwned>(
@@ -751,9 +792,23 @@ mod tests {
            if subject != &granted_subject() {
                return Err(WorkerObservationError::NotFound);
            }
+            let entries = self
+                .captures
+                .lock()
+                .unwrap()
+                .clone()
+                .into_iter()
+                .enumerate()
+                .map(|(index, item)| {
+                    let mut metadata = crate::SessionHistoryMetadata::legacy_unknown();
+                    metadata.entry_id =
+                        session_store::LoggedSessionHistoryEntryId(format!("fake-{index:08}"));
+                    agen::HistoryEntry::new(item, metadata)
+                })
+                .collect();
            Ok(WorkerSessionCapture {
                segment_id: "segment".to_string(),
-                items: self.captures.lock().unwrap().clone(),
+                entries,
            })
        }
    }
@@ -796,7 +851,7 @@ mod tests {
        let read = read_definition(provider.clone())().1;
        let hidden = read
            .execute(
-                r#"{"subject":{"kind":"runtime_worker","runtime_id":"runtime-1","worker_id":"unauthorized"},"entry_ref":"E00000000"}"#,
+                r#"{"subject":{"kind":"runtime_worker","runtime_id":"runtime-1","worker_id":"unauthorized"},"entry_ref":"Efake-00000000"}"#,
                agen::tool::ToolExecutionContext::direct(),
            )
            .await
@@ -810,7 +865,7 @@ mod tests {
            .push(message("a1", Role::Assistant, "second"));
        let output = read
            .execute(
-                r#"{"subject":{"kind":"runtime_worker","runtime_id":"runtime-1","worker_id":"granted"},"entry_ref":"E00000000"}"#,
+                r#"{"subject":{"kind":"runtime_worker","runtime_id":"runtime-1","worker_id":"granted"},"entry_ref":"Efake-00000000"}"#,
                agen::tool::ToolExecutionContext::direct(),
            )
            .await
@@ -819,7 +874,7 @@ mod tests {

        let output = read
            .execute(
-                r#"{"subject":{"kind":"runtime_worker","runtime_id":"runtime-1","worker_id":"granted"},"entry_ref":"E00000001"}"#,
+                r#"{"subject":{"kind":"runtime_worker","runtime_id":"runtime-1","worker_id":"granted"},"entry_ref":"Efake-00000001"}"#,
                agen::tool::ToolExecutionContext::direct(),
            )
            .await
@@ -10,7 +10,7 @@ use std::collections::HashMap;
 use std::sync::{Arc, Mutex};

 use agen::timeline::event::UsageEvent;
-use agen::{Engine, llm_client::LlmClient};
+use agen::{Engine, EngineError, llm_client::LlmClient};
 use manifest::{Scope, WorkerManifest};
 use protocol::{Event, InFlightSnapshot, WorkerStatus};
 use session_store::{LogEntry, SegmentId, SessionId, Store, StoreError, TraceEntry};
@@ -55,7 +55,17 @@ pub(crate) struct InternalWorkerSpec {
    pub input: String,
    pub cache_key: Option<String>,
    pub max_turns: Option<u32>,
-    pub engine_configurator: Option<Box<dyn FnOnce(&mut Engine<Box<dyn LlmClient>>) + Send>>,
+    pub engine_configurator: Option<
+        Box<
+            dyn FnOnce(
+                    &mut Engine<
+                        Box<dyn LlmClient>,
+                        agen::state::Mutable,
+                        crate::SessionHistoryMetadata,
+                    >,
+                ) + Send,
+        >,
+    >,
    pub features: FeatureRegistryBuilder,
    pub required_tools: &'static [&'static str],
    pub authority: InternalWorkerAuthority,
@@ -124,7 +134,9 @@ where

    let last_usage = Arc::new(Mutex::new(None::<UsageEvent>));
    let usage_slot = last_usage.clone();
-    let mut engine = Engine::new(client).system_prompt(system_prompt);
+    let mut engine =
+        Engine::<_, agen::state::Mutable, crate::SessionHistoryMetadata>::new_annotated(client)
+            .system_prompt(system_prompt);
    engine.on_usage(move |usage| {
        if let Ok(mut slot) = usage_slot.lock() {
            *slot = Some(usage.clone());
@@ -199,12 +211,28 @@ where
    on_cancel_sender(worker.engine_mut().cancel_sender());

    match worker.run_text(&input).await {
-        Ok(lifecycle) => Ok(InternalWorkerResult {
+        Ok(lifecycle @ WorkerRunResult::Finished)
+        | Ok(lifecycle @ WorkerRunResult::Paused)
+        | Ok(lifecycle @ WorkerRunResult::RolledBack) => Ok(InternalWorkerResult {
            usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
            identity,
            lifecycle,
            history_entries: store.entries_count(session_id, segment_id),
        }),
+        Ok(WorkerRunResult::LimitReached) => Err(InternalWorkerError {
+            source: WorkerError::Engine(EngineError::Aborted(
+                "internal Worker reached its turn limit".to_string(),
+            )),
+            usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
+            identity,
+            history_entries: store.entries_count(session_id, segment_id),
+        }),
+        Ok(WorkerRunResult::Interrupted { message, .. }) => Err(InternalWorkerError {
+            source: WorkerError::Engine(EngineError::Aborted(message)),
+            usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
+            identity,
+            history_entries: store.entries_count(session_id, segment_id),
+        }),
        Err(source) => Err(InternalWorkerError {
            source,
            usage: last_usage.lock().ok().and_then(|slot| slot.clone()),
@@ -232,6 +260,7 @@ impl Default for InternalWorkerVisibility {
 pub(crate) enum InternalWorkerSessionStatus {
    Idle,
    Running,
+    Paused,
    Stopping,
    Stopped,
    Failed,
@@ -242,9 +271,10 @@ impl InternalWorkerSessionStatus {
        match self {
            Self::Idle => 0,
            Self::Running => 1,
-            Self::Stopping => 2,
-            Self::Stopped => 3,
-            Self::Failed => 4,
+            Self::Paused => 2,
+            Self::Stopping => 3,
+            Self::Stopped => 4,
+            Self::Failed => 5,
        }
    }

@@ -252,13 +282,35 @@ impl InternalWorkerSessionStatus {
        match value {
            0 => Self::Idle,
            1 => Self::Running,
-            2 => Self::Stopping,
-            3 => Self::Stopped,
+            2 => Self::Paused,
+            3 => Self::Stopping,
+            4 => Self::Stopped,
            _ => Self::Failed,
        }
    }
 }

+fn classify_internal_turn_result(
+    result: Result<WorkerRunResult, WorkerError>,
+) -> (InternalWorkerSessionStatus, Option<String>) {
+    match result {
+        Ok(WorkerRunResult::Finished) => (InternalWorkerSessionStatus::Idle, None),
+        Ok(WorkerRunResult::Paused) => (InternalWorkerSessionStatus::Paused, None),
+        Ok(WorkerRunResult::LimitReached) => (
+            InternalWorkerSessionStatus::Stopped,
+            Some("internal Worker reached its turn limit".to_string()),
+        ),
+        Ok(WorkerRunResult::Interrupted { message, .. }) => {
+            (InternalWorkerSessionStatus::Stopped, Some(message))
+        }
+        Ok(WorkerRunResult::RolledBack) => (
+            InternalWorkerSessionStatus::Stopped,
+            Some("internal Worker run was cancelled before AI output".to_string()),
+        ),
+        Err(error) => (InternalWorkerSessionStatus::Failed, Some(error.to_string())),
+    }
+}
+
 #[derive(Debug, thiserror::Error)]
 pub(crate) enum InternalWorkerSessionError {
    #[error("failed to build internal Worker session: {message}")]
@@ -353,10 +405,11 @@ impl InternalWorkerSessionHandle {
            entries,
            status: match self.status() {
                InternalWorkerSessionStatus::Running => WorkerStatus::Running,
+                InternalWorkerSessionStatus::Paused => WorkerStatus::Paused,
                InternalWorkerSessionStatus::Idle => WorkerStatus::Idle,
                InternalWorkerSessionStatus::Stopping
                | InternalWorkerSessionStatus::Stopped
-                | InternalWorkerSessionStatus::Failed => WorkerStatus::Paused,
+                | InternalWorkerSessionStatus::Failed => WorkerStatus::Stopped,
            },
            error: self.last_error.lock().unwrap().clone(),
            in_flight,
@@ -388,6 +441,7 @@ impl InternalWorkerSessionHandle {
            .map_err(
                |current| match InternalWorkerSessionStatus::decode(current) {
                    InternalWorkerSessionStatus::Running
+                    | InternalWorkerSessionStatus::Paused
                    | InternalWorkerSessionStatus::Stopping => InternalWorkerSessionError::Busy,
                    InternalWorkerSessionStatus::Stopped | InternalWorkerSessionStatus::Failed => {
                        InternalWorkerSessionError::Stopped
@@ -494,7 +548,9 @@ pub(crate) async fn spawn_internal_worker_session(

    let last_usage = Arc::new(Mutex::new(None::<UsageEvent>));
    let usage_slot = last_usage.clone();
-    let mut engine = Engine::new(client).system_prompt(system_prompt);
+    let mut engine =
+        Engine::<_, agen::state::Mutable, crate::SessionHistoryMetadata>::new_annotated(client)
+            .system_prompt(system_prompt);
    engine.on_usage(move |usage| {
        if let Ok(mut slot) = usage_slot.lock() {
            *slot = Some(usage.clone());
@@ -591,7 +647,9 @@ pub(crate) fn prepare_internal_worker_from_spec(
        manifest.compaction = None;
        manifest.memory = None;

-        let mut engine = Engine::new(client).system_prompt(system_prompt);
+        let mut engine =
+            Engine::<_, agen::state::Mutable, crate::SessionHistoryMetadata>::new_annotated(client)
+                .system_prompt(system_prompt);
        engine.set_cache_key(cache_key);
        engine.set_max_turns(max_turns);
        if let Some(configure) = engine_configurator {
@@ -733,13 +791,7 @@ pub(crate) async fn prepare_internal_worker_session(
                    loop {
                        tokio::select! {
                            result = &mut run => {
-                                let (turn_status, error) = match result {
-                                    Ok(_) => (InternalWorkerSessionStatus::Idle, None),
-                                    Err(error) => (
-                                        InternalWorkerSessionStatus::Failed,
-                                        Some(error.to_string()),
-                                    ),
-                                };
+                                let (turn_status, error) = classify_internal_turn_result(result);
                                actor_in_flight.clear();
                                status.store(turn_status.encode(), std::sync::atomic::Ordering::Release);
                                if let Some(message) = error {
@@ -748,11 +800,20 @@ pub(crate) async fn prepare_internal_worker_session(
                                        code: protocol::ErrorCode::Internal,
                                        message,
                                    });
-                                } else {
-                                    let _ = event_tx.send(Event::Status {
-                                        status: WorkerStatus::Idle,
-                                    });
                                }
+                                let protocol_status = match turn_status {
+                                    InternalWorkerSessionStatus::Idle => WorkerStatus::Idle,
+                                    InternalWorkerSessionStatus::Paused => WorkerStatus::Paused,
+                                    InternalWorkerSessionStatus::Stopped
+                                    | InternalWorkerSessionStatus::Failed => WorkerStatus::Stopped,
+                                    InternalWorkerSessionStatus::Running
+                                    | InternalWorkerSessionStatus::Stopping => {
+                                        unreachable!("run completion cannot remain active")
+                                    }
+                                };
+                                let _ = event_tx.send(Event::Status {
+                                    status: protocol_status,
+                                });
                                if let Some(callback) = &on_turn_end {
                                    callback(turn_status);
                                }
@@ -766,7 +827,7 @@ pub(crate) async fn prepare_internal_worker_session(
                                        let _ = (&mut run).await;
                                        actor_in_flight.clear();
                                        status.store(InternalWorkerSessionStatus::Stopped.encode(), std::sync::atomic::Ordering::Release);
-                                        let _ = event_tx.send(Event::Status { status: WorkerStatus::Paused });
+                                        let _ = event_tx.send(Event::Status { status: WorkerStatus::Stopped });
                                        let _ = event_tx.send(Event::Shutdown);
                                        state_changed.notify_waiters();
                                        let _ = done.send(());
@@ -792,7 +853,7 @@ pub(crate) async fn prepare_internal_worker_session(
                        std::sync::atomic::Ordering::Release,
                    );
                    let _ = event_tx.send(Event::Status {
-                        status: WorkerStatus::Paused,
+                        status: WorkerStatus::Stopped,
                    });
                    let _ = event_tx.send(Event::Shutdown);
                    state_changed.notify_waiters();
@@ -1102,6 +1163,26 @@ mod tests {
        }
    }

+    #[derive(Clone)]
+    struct FailingClient;
+
+    #[async_trait]
+    impl LlmClient for FailingClient {
+        fn clone_boxed(&self) -> Box<dyn LlmClient> {
+            Box::new(self.clone())
+        }
+
+        async fn stream(
+            &self,
+            _request: Request,
+        ) -> Result<Pin<Box<dyn Stream<Item = Result<LlmEvent, ClientError>> + Send>>, ClientError>
+        {
+            Err(ClientError::Config(
+                "intentional internal failure".to_string(),
+            ))
+        }
+    }
+
    #[derive(Clone)]
    struct CancelBeforeAiClient {
        calls: Arc<AtomicUsize>,
@@ -1215,6 +1296,77 @@ permission = "write"
        assert_eq!(result.identity.kind, "test");
    }

+    #[test]
+    fn internal_turn_result_mapping_is_exhaustive() {
+        let cases = [
+            (
+                WorkerRunResult::Finished,
+                InternalWorkerSessionStatus::Idle,
+                false,
+            ),
+            (
+                WorkerRunResult::Paused,
+                InternalWorkerSessionStatus::Paused,
+                false,
+            ),
+            (
+                WorkerRunResult::LimitReached,
+                InternalWorkerSessionStatus::Stopped,
+                true,
+            ),
+            (
+                WorkerRunResult::Interrupted {
+                    code: protocol::ErrorCode::Internal,
+                    message: "cancelled".to_string(),
+                },
+                InternalWorkerSessionStatus::Stopped,
+                true,
+            ),
+            (
+                WorkerRunResult::RolledBack,
+                InternalWorkerSessionStatus::Stopped,
+                true,
+            ),
+        ];
+
+        for (result, expected_status, expects_error) in cases {
+            let (status, error) = classify_internal_turn_result(Ok(result));
+            assert_eq!(status, expected_status);
+            assert_eq!(error.is_some(), expects_error);
+        }
+
+        let (status, error) = classify_internal_turn_result(Err(WorkerError::Engine(
+            EngineError::Aborted("fatal".to_string()),
+        )));
+        assert_eq!(status, InternalWorkerSessionStatus::Failed);
+        assert!(error.is_some_and(|message| message.contains("fatal")));
+    }
+
+    #[tokio::test]
+    async fn fatal_internal_run_transitions_to_stopped_protocol_status() {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let mut internal_spec = spec(calls, &[]);
+        internal_spec.client = Box::new(FailingClient);
+
+        let handle = spawn_internal_worker_session(internal_spec)
+            .await
+            .expect("spawn failing Internal Worker session");
+        assert_eq!(
+            handle.wait_until_idle().await,
+            InternalWorkerSessionStatus::Stopped
+        );
+        assert_eq!(handle.status(), InternalWorkerSessionStatus::Stopped);
+        assert_eq!(handle.protocol_snapshot().status, WorkerStatus::Stopped);
+        assert!(
+            handle
+                .last_error
+                .lock()
+                .unwrap()
+                .as_ref()
+                .is_some_and(|message| message.contains("intentional internal failure"))
+        );
+    }
+
    #[tokio::test]
    async fn session_accepts_follow_up_turns_and_stops_without_runtime_registration() {
        let calls = Arc::new(AtomicUsize::new(0));
@@ -13,7 +13,7 @@

 #[cfg(test)]
 use crate::prompt::catalog::PromptCatalog;
-use agen::Item;
+use agen::{Item, ToolResultDisposition};

 /// Build synthetic `Item::ToolResult` items for every unanswered
 /// `Item::ToolCall` in `history`, preserving order.
@@ -28,7 +28,16 @@ pub(crate) fn orphan_tool_result_closures(history: &[Item], summary: &str) -> Ve
    for item in history {
        if let Item::ToolCall { call_id, .. } = item {
            if !answered.contains(call_id.as_str()) {
-                out.push(Item::tool_result(call_id.clone(), summary));
+                out.push(Item::tool_result_item_with_disposition_and_attachments(
+                    call_id.clone(),
+                    summary,
+                    Some(
+                        "Execution ended before completion could be confirmed. Completion and side effects are unknown."
+                            .to_string(),
+                    ),
+                    ToolResultDisposition::OutcomeUnknown,
+                    Vec::new(),
+                ));
            }
        }
    }
@@ -77,10 +86,12 @@ mod tests {
            Item::ToolResult {
                call_id,
                summary: got,
+                disposition,
                ..
            } => {
                assert_eq!(call_id, "c1");
                assert_eq!(got, &summary);
+                assert_eq!(*disposition, ToolResultDisposition::OutcomeUnknown);
            }
            other => panic!("expected ToolResult, got {other:?}"),
        }
@@ -8,6 +8,7 @@
 //! decisions (continue / skip / abort / pause).

 use std::borrow::Cow;
+use std::collections::VecDeque;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};

@@ -33,7 +34,9 @@ use crate::hook::{
 };
 use crate::ipc::notify_buffer::{NotifyBuffer, build_system_item_with_provenance};
 use crate::prompt::catalog::PromptCatalog;
+use crate::session_history::SessionHistoryMetadata;
 use crate::worker::SystemItemCommitter;
+use agen::HistoryEntry;
 use agen::token_counter::total_tokens;

 /// Maximum number of bytes copied into `TurnEndInfo::final_text_preview`.
@@ -73,6 +76,7 @@ pub(crate) struct WorkerInterceptor {
    /// worker. `None` in tests / `Worker::new` paths where no writer is
    /// attached.
    log_writer: Option<Arc<dyn SystemItemCommitter>>,
+    pending_committed_history: Arc<Mutex<VecDeque<HistoryEntry<SessionHistoryMetadata>>>>,
    /// Next turn index assigned by `on_prompt_submit`.
    next_turn_index: AtomicUsize,
    /// Tool calls observed in the current turn (reset on each new prompt).
@@ -80,6 +84,7 @@ pub(crate) struct WorkerInterceptor {
 }

 impl WorkerInterceptor {
+    #[cfg(test)]
    pub(crate) fn new(
        registry: Arc<HookRegistry>,
        compact_state: Option<Arc<CompactState>>,
@@ -88,6 +93,28 @@ impl WorkerInterceptor {
        pending_attachments: Arc<Mutex<Vec<SystemItem>>>,
        prompts: Arc<ArcSwap<PromptCatalog>>,
        log_writer: Option<Arc<dyn SystemItemCommitter>>,
+    ) -> Self {
+        Self::new_with_history_queue(
+            registry,
+            compact_state,
+            usage_history,
+            pending_notifies,
+            pending_attachments,
+            prompts,
+            log_writer,
+            Arc::new(Mutex::new(VecDeque::new())),
+        )
+    }
+
+    pub(crate) fn new_with_history_queue(
+        registry: Arc<HookRegistry>,
+        compact_state: Option<Arc<CompactState>>,
+        usage_history: Option<Arc<Mutex<Vec<UsageRecord>>>>,
+        pending_notifies: NotifyBuffer,
+        pending_attachments: Arc<Mutex<Vec<SystemItem>>>,
+        prompts: Arc<ArcSwap<PromptCatalog>>,
+        log_writer: Option<Arc<dyn SystemItemCommitter>>,
+        pending_committed_history: Arc<Mutex<VecDeque<HistoryEntry<SessionHistoryMetadata>>>>,
    ) -> Self {
        Self {
            registry,
@@ -99,6 +126,7 @@ impl WorkerInterceptor {
            prompts,
            prompt_workspace_id: None,
            log_writer,
+            pending_committed_history,
            next_turn_index: AtomicUsize::new(0),
            tool_calls_this_turn: AtomicUsize::new(0),
        }
@@ -125,7 +153,11 @@ impl WorkerInterceptor {
            return Ok(());
        };
        for item in items {
-            writer.commit_system_item(item.clone())?;
+            let entry = writer.commit_system_item(item.clone())?;
+            self.pending_committed_history
+                .lock()
+                .expect("pending committed history poisoned")
+                .push_back(entry);
        }
        Ok(())
    }
@@ -507,7 +539,12 @@ mod tests {
            &self,
            entry: session_store::LogEntry,
        ) -> Result<(), session_store::StoreError> {
-            if let session_store::LogEntry::SystemItem { item, .. } = entry {
+            let item = match entry {
+                session_store::LogEntry::SystemItem { item, .. } => Some(item),
+                session_store::LogEntry::AnnotatedSystemItem { entry, .. } => Some(entry.item),
+                _ => None,
+            };
+            if let Some(item) = item {
                self.committed
                    .lock()
                    .expect("committed system-item list poisoned")
@@ -29,15 +29,21 @@ pub fn subscribe_worker_protocol_session(handle: &WorkerHandle) -> WorkerProtoco

 pub fn live_log_entry_event(entry: LogEntry) -> Option<Event> {
    match entry {
-        LogEntry::SegmentStart { .. } => {
+        entry @ (LogEntry::SegmentStart { .. } | LogEntry::AnnotatedSegmentStart { .. }) => {
            let value = serde_json::to_value(&entry).expect("LogEntry is Serialize");
            Some(Event::SegmentRotated { entry: value })
        }
-        LogEntry::UserInput { segments, .. } => Some(Event::UserMessage { segments }),
+        LogEntry::UserInput { segments, .. } | LogEntry::AnnotatedUserInput { segments, .. } => {
+            Some(Event::UserMessage { segments })
+        }
        LogEntry::SystemItem { item, .. } => {
            let value = serde_json::to_value(&item).expect("SystemItem is Serialize");
            Some(Event::SystemItem { item: value })
        }
+        LogEntry::AnnotatedSystemItem { entry, .. } => {
+            let value = serde_json::to_value(&entry.item).expect("SystemItem is Serialize");
+            Some(Event::SystemItem { item: value })
+        }
        LogEntry::Invoke { trigger, .. } => Some(Event::InvokeStart { kind: trigger }),
        other => {
            // `SegmentLogSink::is_live_relevant` keeps non-live-relevant
@@ -12,6 +12,7 @@ pub mod prompt;
 pub mod runtime;
 pub mod segment_log_sink;
 mod session_capture;
+mod session_history;
 pub mod shared_state;
 mod shutdown_after_idle;
 pub mod skill;
@@ -42,6 +43,10 @@ pub use prompt::system::{SystemPromptContext, SystemPromptError, SystemPromptTem
 pub use protocol::{ErrorCode, Event, Method, TurnResult, WorkerStatus};
 pub use runtime::dir::RuntimeDir;
 pub use segment_log_sink::SegmentLogSink;
+pub use session_history::{
+    SessionHistoryDerivation, SessionHistoryEntryId, SessionHistoryMetadata,
+    WorkerHistoryProvenance, WorkerSubjectSnapshot,
+};
 pub use shared_state::WorkerSharedState;
 pub use worker::{
    LocalWorkingDirectory, WORKER_INPUT_SUBMISSION_EXTENSION_DOMAIN, Worker, WorkerError,
@@ -34,7 +34,7 @@ impl PermissionHook {
    }
 }

-impl<C: LlmClient, St: Store> Worker<C, St> {
+impl<C: LlmClient + 'static, St: Store> Worker<C, St> {
    pub(crate) fn apply_permissions_from_manifest(&mut self) {
        let Some(permissions) = self.manifest().permissions.clone() else {
            return;
@@ -121,8 +121,11 @@ impl SegmentLogSink {
        matches!(
            entry,
            LogEntry::SegmentStart { .. }
+                | LogEntry::AnnotatedSegmentStart { .. }
                | LogEntry::UserInput { .. }
+                | LogEntry::AnnotatedUserInput { .. }
                | LogEntry::SystemItem { .. }
+                | LogEntry::AnnotatedSystemItem { .. }
                | LogEntry::Invoke { .. }
        )
    }
@@ -6,7 +6,8 @@

 use std::sync::Arc;

-use agen::{Item, Role};
+use crate::session_history::{SessionHistoryMetadata, WorkerHistoryProvenance};
+use agen::{HistoryEntry, Item, Role};
 use serde::{Deserialize, Serialize};

 const DEFAULT_SEARCH_LIMIT: usize = 20;
@@ -21,14 +22,21 @@ const OVERVIEW_ANCHOR_STRIDE: usize = 8;
 pub(crate) struct SessionEntryRef(String);

 impl SessionEntryRef {
-    pub(crate) fn new(source_index: usize) -> Self {
-        Self(format!("E{source_index:08}"))
+    pub(crate) fn from_history_entry_id(entry_id: &crate::SessionHistoryEntryId) -> Self {
+        Self(format!("E{}", entry_id.0))
    }

    pub(crate) fn parse(value: &str) -> Option<Self> {
-        let reference = Self(value.to_string());
-        reference.source_index()?;
-        Some(reference)
+        let suffix = value.strip_prefix('E')?;
+        if suffix.is_empty()
+            || suffix.len() > 64
+            || !suffix
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
+        {
+            return None;
+        }
+        Some(Self(value.to_string()))
    }

    pub(crate) fn as_str(&self) -> &str {
@@ -97,6 +105,7 @@ impl ToolPart {
 #[derive(Debug, Clone)]
 pub(crate) struct OverviewItem {
    pub id: SessionEntryRef,
+    pub origin: WorkerHistoryProvenance,
    pub entry_range: [u64; 2],
    pub kind: ReferenceKind,
    pub label: String,
@@ -107,6 +116,7 @@ pub(crate) struct OverviewItem {
 #[derive(Debug, Clone)]
 pub(crate) struct ReferenceEntry {
    pub id: SessionEntryRef,
+    pub origin: WorkerHistoryProvenance,
    pub entry_range: [u64; 2],
    pub kind: ReferenceKind,
    pub tool_part: Option<ToolPart>,
@@ -132,6 +142,7 @@ pub(crate) struct SearchOptions {
 #[derive(Debug, Clone)]
 pub(crate) struct SearchHit {
    pub id: SessionEntryRef,
+    pub origin: WorkerHistoryProvenance,
    pub kind: ReferenceKind,
    pub tool_part: Option<ToolPart>,
    pub tool_name: Option<String>,
@@ -177,6 +188,7 @@ impl Default for ReadOptions {
 #[derive(Debug, Clone)]
 pub(crate) struct ReadEntry {
    pub id: SessionEntryRef,
+    pub origin: WorkerHistoryProvenance,
    pub kind: ReferenceKind,
    pub tool_part: Option<ToolPart>,
    pub tool_name: Option<String>,
@@ -195,6 +207,7 @@ pub(crate) struct ReadResult {
 pub(crate) struct SessionEntryEvidence {
    pub segment_id: String,
    pub entry_ref: SessionEntryRef,
+    pub origin: WorkerHistoryProvenance,
    pub entry_range: [u64; 2],
    pub kind: ReferenceKind,
    pub tool_part: Option<ToolPart>,
@@ -206,26 +219,42 @@ pub(crate) struct SessionEntryEvidence {
 #[derive(Debug, Clone)]
 pub(crate) struct SessionCapture {
    segment_id: String,
-    items: Arc<Vec<Item>>,
+    entries: Arc<Vec<HistoryEntry<SessionHistoryMetadata>>>,
    overview: Vec<OverviewItem>,
    index: Vec<ReferenceEntry>,
 }

 impl SessionCapture {
    pub(crate) fn new(segment_id: impl Into<String>, items: Vec<Item>) -> Self {
+        let entries = items
+            .into_iter()
+            .enumerate()
+            .map(|(index, item)| {
+                let mut metadata = SessionHistoryMetadata::legacy_unknown();
+                metadata.entry_id =
+                    session_store::LoggedSessionHistoryEntryId(format!("{index:08}"));
+                HistoryEntry::new(item, metadata)
+            })
+            .collect();
+        Self::from_history_entries(segment_id, entries)
+    }
+
+    pub(crate) fn from_history_entries(
+        segment_id: impl Into<String>,
+        entries: Vec<HistoryEntry<SessionHistoryMetadata>>,
+    ) -> Self {
        let segment_id = segment_id.into();
-        let items = Arc::new(items);
+        let entries = Arc::new(entries);
        let mut overview = Vec::new();
        let mut index = Vec::new();

-        for (idx, item) in items.iter().enumerate() {
+        for (idx, entry) in entries.iter().enumerate() {
+            let item = &entry.item;
            let entry_range = [idx as u64, idx as u64];
            match item {
                Item::Message { role, content, .. } => {
-                    let kind = match role {
-                        Role::User => ReferenceKind::User,
-                        Role::Assistant => ReferenceKind::Assistant,
-                        Role::System => continue,
+                    let Some(kind) = message_reference_kind(&entry.annotation.origin, role) else {
+                        continue;
                    };
                    let text = content
                        .iter()
@@ -234,9 +263,10 @@ impl SessionCapture {
                        .join("");
                    let label = format!("{} message", kind.as_str());
                    let summary = truncate_chars(&text, 240);
-                    let id = SessionEntryRef::new(idx);
+                    let id = SessionEntryRef::from_history_entry_id(&entry.annotation.entry_id);
                    index.push(ReferenceEntry {
                        id: id.clone(),
+                        origin: entry.annotation.origin.clone(),
                        entry_range,
                        kind,
                        tool_part: None,
@@ -248,6 +278,7 @@ impl SessionCapture {
                    if matches!(kind, ReferenceKind::User | ReferenceKind::Assistant) {
                        overview.push(OverviewItem {
                            id: id.clone(),
+                            origin: entry.annotation.origin.clone(),
                            entry_range,
                            kind,
                            label,
@@ -261,7 +292,8 @@ impl SessionCapture {
                } => {
                    let text = format!("{name}\n{arguments}");
                    index.push(ReferenceEntry {
-                        id: SessionEntryRef::new(idx),
+                        id: SessionEntryRef::from_history_entry_id(&entry.annotation.entry_id),
+                        origin: entry.annotation.origin.clone(),
                        entry_range,
                        kind: ReferenceKind::Tool,
                        tool_part: Some(ToolPart::Input),
@@ -287,7 +319,8 @@ impl SessionCapture {
                        content.as_deref().unwrap_or_default(),
                    );
                    index.push(ReferenceEntry {
-                        id: SessionEntryRef::new(idx),
+                        id: SessionEntryRef::from_history_entry_id(&entry.annotation.entry_id),
+                        origin: entry.annotation.origin.clone(),
                        entry_range,
                        kind: ReferenceKind::Tool,
                        tool_part: Some(ToolPart::Output),
@@ -327,7 +360,7 @@ impl SessionCapture {

        Self {
            segment_id,
-            items,
+            entries,
            overview,
            index,
        }
@@ -337,6 +370,14 @@ impl SessionCapture {
        &self.overview
    }

+    pub(crate) fn source_index_for_ref(&self, reference: &SessionEntryRef) -> Option<u64> {
+        self.index
+            .iter()
+            .find(|entry| entry.id == *reference)
+            .map(|entry| entry.entry_range[0])
+            .or_else(|| reference.source_index())
+    }
+
    pub(crate) fn search(&self, options: &SearchOptions) -> Vec<SearchHit> {
        let query = options.query.trim().to_lowercase();
        let limit = options
@@ -347,12 +388,12 @@ impl SessionCapture {
        let min_entry_index = options
            .from
            .as_ref()
-            .and_then(SessionEntryRef::source_index)
+            .and_then(|reference| self.source_index_for_ref(reference))
            .unwrap_or_else(|| options.min_entry_index.unwrap_or(0));
        let max_entry_index = options
            .through
            .as_ref()
-            .and_then(SessionEntryRef::source_index)
+            .and_then(|reference| self.source_index_for_ref(reference))
            .unwrap_or(u64::MAX);
        let mut skipped = 0usize;
        let mut hits = Vec::new();
@@ -391,6 +432,7 @@ impl SessionCapture {
            }
            hits.push(SearchHit {
                id: entry.id.clone(),
+                origin: entry.origin.clone(),
                kind: entry.kind,
                tool_part: entry.tool_part,
                tool_name: entry.tool_name.clone(),
@@ -442,13 +484,18 @@ impl SessionCapture {
                    }
                }
            }
-            let Some(item) = self.items.get(entry.entry_range[0] as usize) else {
+            let Some(item) = self
+                .entries
+                .get(entry.entry_range[0] as usize)
+                .map(|entry| &entry.item)
+            else {
                continue;
            };
            let text = render_item(item, entry, options.detail, max_bytes.saturating_sub(bytes));
            bytes = bytes.saturating_add(text.len());
            entries.push(ReadEntry {
                id: entry.id.clone(),
+                origin: entry.origin.clone(),
                kind: entry.kind,
                tool_part: entry.tool_part,
                tool_name: entry.tool_name.clone(),
@@ -485,6 +532,7 @@ impl SessionCapture {
        Some(SessionEntryEvidence {
            segment_id: self.segment_id.clone(),
            entry_ref: entry.id.clone(),
+            origin: entry.origin.clone(),
            entry_range: entry.entry_range,
            kind: entry.kind,
            tool_part: entry.tool_part,
@@ -495,6 +543,28 @@ impl SessionCapture {
    }
 }

+fn message_reference_kind(
+    origin: &WorkerHistoryProvenance,
+    provider_role: &Role,
+) -> Option<ReferenceKind> {
+    match origin {
+        WorkerHistoryProvenance::HumanInput { .. }
+        | WorkerHistoryProvenance::WorkerInput { .. } => Some(ReferenceKind::User),
+        WorkerHistoryProvenance::ModelOutput { .. } => Some(ReferenceKind::Assistant),
+        WorkerHistoryProvenance::ToolOutput { .. } => Some(ReferenceKind::Tool),
+        WorkerHistoryProvenance::LegacyUnknown => match provider_role {
+            Role::User => Some(ReferenceKind::User),
+            Role::Assistant => Some(ReferenceKind::Assistant),
+            Role::System => None,
+        },
+        // Flow/backend/system content remains out of the observation surface
+        // even when represented with a provider user/system role.
+        WorkerHistoryProvenance::FlowInstruction { .. }
+        | WorkerHistoryProvenance::BackendInstruction { .. }
+        | WorkerHistoryProvenance::DerivedSummary => None,
+    }
+}
+
 fn render_item(
    item: &Item,
    entry: &ReferenceEntry,
@@ -563,6 +633,60 @@ fn truncate_chars(text: &str, max_chars: usize) -> String {
 mod tests {
    use super::*;

+    #[test]
+    fn flow_user_role_is_excluded_while_explicit_human_origin_remains_evidence() {
+        let entries = vec![
+            crate::session_history::history_entry(
+                Item::user_message("trusted flow instruction"),
+                WorkerHistoryProvenance::FlowInstruction {
+                    selector: "builtin:coder-review".into(),
+                    definition_id: "coder-review".into(),
+                    definition_revision: 3,
+                    instance_id: "instance".into(),
+                    state_id: "implement".into(),
+                },
+            ),
+            crate::session_history::history_entry(
+                Item::user_message("remember my preference"),
+                WorkerHistoryProvenance::HumanInput {
+                    account_id: "account-1".into(),
+                },
+            ),
+        ];
+        let capture = SessionCapture::from_history_entries("segment", entries);
+        let overview = capture.overview();
+        assert_eq!(overview.len(), 1);
+        assert!(matches!(
+            overview[0].origin,
+            WorkerHistoryProvenance::HumanInput { .. }
+        ));
+        let evidence = capture.evidence_for(overview[0].id.as_str()).unwrap();
+        assert!(evidence.excerpt.ends_with("remember my preference"));
+        assert!(matches!(
+            evidence.origin,
+            WorkerHistoryProvenance::HumanInput { .. }
+        ));
+    }
+
+    #[test]
+    fn stable_logical_ref_survives_retention_and_restore_projection() {
+        let retained = crate::session_history::history_entry(
+            Item::assistant_message("retained"),
+            WorkerHistoryProvenance::ModelOutput {
+                worker: crate::session_history::worker_subject(Default::default()),
+            },
+        );
+        let expected_ref = SessionEntryRef::from_history_entry_id(&retained.annotation.entry_id);
+        let before = SessionCapture::from_history_entries("old", vec![retained.clone()]);
+        let after = SessionCapture::from_history_entries("new", vec![retained]);
+        assert_eq!(before.overview()[0].id, expected_ref);
+        assert_eq!(after.overview()[0].id, expected_ref);
+        assert_eq!(
+            after.evidence_for(expected_ref.as_str()).unwrap().entry_ref,
+            expected_ref
+        );
+    }
+
    #[test]
    fn overview_contains_user_and_assistant_only() {
        let view = SessionCapture::new(
@@ -0,0 +1,219 @@
+//! Restore-authoritative metadata for model-visible Worker history.
+//!
+//! Agen transports this annotation without interpreting it. Session Log v2
+//! stores each item and metadata in one typed record; legacy records are
+//! retained only as explicit `LegacyUnknown` entries.
+
+use agen::{HistoryEntry, Item};
+use protocol::Segment;
+use session_store::{
+    LogEntry, LoggedHistoryDerivation, LoggedHistoryEntry, LoggedSessionHistoryEntryId,
+    LoggedSessionHistoryMetadata, LoggedSessionHistoryOrigin, LoggedWorkerSubject, SegmentId,
+    SessionId,
+};
+
+pub type SessionHistoryEntryId = LoggedSessionHistoryEntryId;
+pub type SessionHistoryMetadata = LoggedSessionHistoryMetadata;
+pub type WorkerHistoryProvenance = LoggedSessionHistoryOrigin;
+pub type SessionHistoryDerivation = LoggedHistoryDerivation;
+pub type WorkerSubjectSnapshot = LoggedWorkerSubject;
+
+pub(crate) fn worker_subject(session_id: SessionId) -> WorkerSubjectSnapshot {
+    WorkerSubjectSnapshot {
+        workspace_id: None,
+        runtime_id: None,
+        worker_id: session_id.to_string(),
+    }
+}
+
+pub(crate) fn metadata(
+    origin: WorkerHistoryProvenance,
+    derivation: Option<SessionHistoryDerivation>,
+) -> SessionHistoryMetadata {
+    SessionHistoryMetadata {
+        entry_id: SessionHistoryEntryId::new(),
+        origin,
+        derivation,
+    }
+}
+
+pub(crate) fn history_entry(
+    item: Item,
+    origin: WorkerHistoryProvenance,
+) -> HistoryEntry<SessionHistoryMetadata> {
+    HistoryEntry::new(item, metadata(origin, None))
+}
+
+pub(crate) fn to_logged_history_entry(
+    entry: &HistoryEntry<SessionHistoryMetadata>,
+) -> LoggedHistoryEntry {
+    LoggedHistoryEntry {
+        item: entry.item.clone().into(),
+        metadata: entry.annotation.clone(),
+    }
+}
+
+fn legacy_entry(item: Item) -> HistoryEntry<SessionHistoryMetadata> {
+    HistoryEntry::new(item, SessionHistoryMetadata::legacy_unknown())
+}
+
+fn from_logged(entry: &LoggedHistoryEntry) -> HistoryEntry<SessionHistoryMetadata> {
+    HistoryEntry::new(Item::from(entry.item.clone()), entry.metadata.clone())
+}
+
+/// Rebuild typed Worker history directly from the append-only Session Log.
+/// Missing legacy metadata is never inferred from role or plaintext.
+pub(crate) fn restore_history_entries(
+    _session_id: SessionId,
+    _segment_id: SegmentId,
+    entries: &[LogEntry],
+) -> Result<Vec<HistoryEntry<SessionHistoryMetadata>>, String> {
+    let mut history = Vec::new();
+    for entry in entries {
+        match entry {
+            LogEntry::AnnotatedSegmentStart { history: seed, .. } => {
+                history = seed.iter().map(from_logged).collect();
+            }
+            LogEntry::SegmentStart { history: seed, .. } => {
+                history = seed
+                    .iter()
+                    .cloned()
+                    .map(Item::from)
+                    .map(legacy_entry)
+                    .collect();
+            }
+            LogEntry::AnnotatedUserInput { history: input, .. } => {
+                history.extend(input.iter().map(from_logged))
+            }
+            LogEntry::UserInput { segments, .. } => history.push(legacy_entry(Item::user_message(
+                Segment::flatten_to_text(segments),
+            ))),
+            LogEntry::AnnotatedAssistantItem { entry, .. }
+            | LogEntry::AnnotatedToolResult { entry, .. } => history.push(from_logged(entry)),
+            LogEntry::AssistantItem { item, .. } | LogEntry::ToolResult { item, .. } => {
+                history.push(legacy_entry(Item::from(item.clone())));
+            }
+            LogEntry::AnnotatedSystemItem { entry, .. } => history.push(HistoryEntry::new(
+                entry.item.to_history_item(),
+                entry.metadata.clone(),
+            )),
+            LogEntry::SystemItem { item, .. } => {
+                history.push(legacy_entry(item.to_history_item()));
+            }
+            _ => {}
+        }
+    }
+    Ok(history)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use agen::llm_client::RequestConfig;
+    use session_store::LogEntry;
+
+    #[test]
+    fn legacy_user_role_is_not_inferred_as_human_authority() {
+        let entries = vec![LogEntry::UserInput {
+            ts: 1,
+            segments: vec![Segment::text("legacy")],
+            extensions: Vec::new(),
+        }];
+        let restored =
+            restore_history_entries(SessionId::now_v7(), SegmentId::now_v7(), &entries).unwrap();
+        assert!(matches!(
+            restored[0].annotation.origin,
+            WorkerHistoryProvenance::LegacyUnknown
+        ));
+    }
+
+    #[test]
+    fn typed_flow_and_unknown_caller_input_round_trip_without_role_inference() {
+        let session_id = SessionId::now_v7();
+        let projected = vec![
+            history_entry(
+                Item::user_message("flow instructions"),
+                WorkerHistoryProvenance::FlowInstruction {
+                    selector: "builtin:coder-review".to_string(),
+                    definition_id: "coder-review".to_string(),
+                    definition_revision: 7,
+                    instance_id: "flow-instance".to_string(),
+                    state_id: "implement".to_string(),
+                },
+            ),
+            history_entry(
+                Item::user_message("implement"),
+                WorkerHistoryProvenance::LegacyUnknown,
+            ),
+        ];
+        let entries = vec![
+            LogEntry::AnnotatedSegmentStart {
+                ts: 0,
+                session_id,
+                system_prompt: None,
+                config: RequestConfig::default(),
+                history: Vec::new(),
+                forked_from: None,
+                compacted_from: None,
+            },
+            LogEntry::AnnotatedUserInput {
+                ts: 1,
+                segments: vec![
+                    Segment::Flow {
+                        selector: "builtin:coder-review".to_string(),
+                    },
+                    Segment::text("implement"),
+                ],
+                extensions: Vec::new(),
+                history: projected.iter().map(to_logged_history_entry).collect(),
+            },
+        ];
+        let restored = restore_history_entries(session_id, SegmentId::now_v7(), &entries).unwrap();
+        assert_eq!(restored, projected);
+    }
+
+    #[test]
+    fn annotated_restore_preserves_logical_ids_across_reboot() {
+        let session_id = SessionId::now_v7();
+        let entry = history_entry(
+            Item::assistant_message("persisted"),
+            WorkerHistoryProvenance::ModelOutput {
+                worker: worker_subject(session_id),
+            },
+        );
+        let log = vec![LogEntry::AnnotatedSegmentStart {
+            ts: 0,
+            session_id,
+            system_prompt: None,
+            config: RequestConfig::default(),
+            history: vec![to_logged_history_entry(&entry)],
+            forked_from: None,
+            compacted_from: None,
+        }];
+        let first = restore_history_entries(session_id, SegmentId::now_v7(), &log).unwrap();
+        let second = restore_history_entries(session_id, SegmentId::now_v7(), &log).unwrap();
+        assert_eq!(first[0].annotation.entry_id, entry.annotation.entry_id);
+        assert_eq!(second[0].annotation.entry_id, entry.annotation.entry_id);
+    }
+
+    #[test]
+    fn compacted_derivation_uses_stable_logical_entry_ids() {
+        let source = history_entry(
+            Item::user_message("source"),
+            WorkerHistoryProvenance::LegacyUnknown,
+        );
+        let summary = HistoryEntry::new(
+            Item::system_message("summary"),
+            metadata(
+                WorkerHistoryProvenance::DerivedSummary,
+                Some(SessionHistoryDerivation {
+                    sources: vec![source.annotation.entry_id.clone()],
+                }),
+            ),
+        );
+        assert_eq!(
+            summary.annotation.derivation.unwrap().sources,
+            vec![source.annotation.entry_id]
+        );
+    }
+}
@@ -499,7 +499,10 @@ impl Tool for SubWorkerSpawnTool {
            InternalWorkerVisibility::ParentClient,
            Some(child_registry.clone()),
            Some(Arc::new(move |status| {
-                if status == InternalWorkerSessionStatus::Failed {
+                if matches!(
+                    status,
+                    InternalWorkerSessionStatus::Failed | InternalWorkerSessionStatus::Stopped
+                ) {
                    if let Some(registry) = registry.upgrade() {
                        if let Err(error) = registry.reclaim_internal_scope(&child_name) {
                            tracing::warn!(
@@ -1249,7 +1252,7 @@ extract_threshold = 4000
        )
        .await
        .unwrap();
-        assert!(first_capture.items.iter().any(|item| {
+        assert!(first_capture.entries.iter().map(|entry| &entry.item).any(|item| {
            matches!(item, Item::Message { role: Role::Assistant, content, .. } if content.iter().any(|part| matches!(part, ContentPart::Text { text } if text.contains("reviewed"))))
        }));

@@ -1271,7 +1274,7 @@ extract_threshold = 4000
        )
        .await
        .unwrap();
-        assert!(latest_capture.items.len() > first_capture.items.len());
+        assert!(latest_capture.entries.len() > first_capture.entries.len());

        fail_requests.store(true, Ordering::SeqCst);
        send.execute(
@@ -1282,16 +1285,16 @@ extract_threshold = 4000
        .unwrap();
        assert_eq!(
            record.session.wait_until_idle().await,
-            InternalWorkerSessionStatus::Failed
+            InternalWorkerSessionStatus::Stopped
        );
        assert_eq!(calls.load(Ordering::SeqCst), 3);
        assert!(
            spawner_scope.snapshot().is_writable(&workspace_root),
-            "Failed terminal child must release its delegated Workdir session"
+            "Stopped terminal child must release its delegated Workdir session"
        );
        assert!(
            !record.workdir_delegation.is_active(),
-            "failed child must revoke cloned scoped sessions"
+            "stopped child must revoke cloned scoped sessions"
        );
        assert!(registry.get_internal("reviewer-child").is_some());

@@ -163,7 +163,8 @@ async fn make_worker_with_manifest(
    let scope = worker::Scope::writable(&pwd).unwrap();
    std::mem::forget(pwd_tmp);

-    let worker = Engine::new(client);
+    let worker =
+        Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(client);
    let mut worker = Worker::new(
        manifest,
        worker,
@@ -204,28 +205,34 @@ fn system_texts_in_sink_session_start(
 ) -> Vec<String> {
    let (entries, _rx) = worker.sink().subscribe_with_snapshot();
    for entry in entries.into_iter().rev() {
-        if let session_store::LogEntry::SegmentStart { history, .. } = entry {
-            return history
+        let history = match entry {
+            session_store::LogEntry::AnnotatedSegmentStart { history, .. } => history
                .into_iter()
-                .filter_map(|logged| {
-                    let item: Item = logged.into();
-                    match item {
-                        Item::Message {
-                            role: agen::Role::System,
-                            content,
-                            ..
-                        } => Some(
-                            content
-                                .iter()
-                                .map(|p| p.as_text().to_owned())
-                                .collect::<Vec<_>>()
-                                .join(""),
-                        ),
-                        _ => None,
-                    }
-                })
-                .collect();
-        }
+                .map(|entry| entry.item)
+                .collect::<Vec<_>>(),
+            session_store::LogEntry::SegmentStart { history, .. } => history,
+            _ => continue,
+        };
+        return history
+            .into_iter()
+            .filter_map(|logged| {
+                let item: Item = logged.into();
+                match item {
+                    Item::Message {
+                        role: agen::Role::System,
+                        content,
+                        ..
+                    } => Some(
+                        content
+                            .iter()
+                            .map(|p| p.as_text().to_owned())
+                            .collect::<Vec<_>>()
+                            .join(""),
+                    ),
+                    _ => None,
+                }
+            })
+            .collect();
    }
    Vec::new()
 }
@@ -337,7 +344,12 @@ permission = "write"
    // New segment records forked_from pointing at the source.
    let new_entries = store.read_all(session_id, new_segment_id).unwrap();
    match &new_entries[0] {
-        LogEntry::SegmentStart {
+        LogEntry::AnnotatedSegmentStart {
+            session_id: seg_session,
+            forked_from: Some(origin),
+            ..
+        }
+        | LogEntry::SegmentStart {
            session_id: seg_session,
            forked_from: Some(origin),
            ..
@@ -32,16 +32,29 @@ fn history_from_sink(handle: &WorkerHandle) -> Vec<Item> {
    let mut items = Vec::new();
    for entry in entries {
        match entry {
+            LogEntry::AnnotatedSegmentStart { history, .. } => {
+                items.extend(history.into_iter().map(|entry| Item::from(entry.item)));
+            }
            LogEntry::SegmentStart { history, .. } => {
                items.extend(history.into_iter().map(Item::from));
            }
+            LogEntry::AnnotatedUserInput { history, .. } => {
+                items.extend(history.into_iter().map(|entry| Item::from(entry.item)));
+            }
            LogEntry::UserInput { segments, .. } => {
                let text = protocol::Segment::flatten_to_text(&segments);
                items.push(Item::user_message(text));
            }
+            LogEntry::AnnotatedAssistantItem { entry, .. }
+            | LogEntry::AnnotatedToolResult { entry, .. } => {
+                items.push(Item::from(entry.item));
+            }
            LogEntry::AssistantItem { item, .. } | LogEntry::ToolResult { item, .. } => {
                items.push(Item::from(item));
            }
+            LogEntry::AnnotatedSystemItem { entry, .. } => {
+                items.push(entry.item.to_history_item());
+            }
            LogEntry::SystemItem { item, .. } => {
                items.push(item.to_history_item());
            }
@@ -51,6 +64,14 @@ fn history_from_sink(handle: &WorkerHandle) -> Vec<Item> {
    items
 }

+fn system_item(entry: &LogEntry) -> Option<&session_store::SystemItem> {
+    match entry {
+        LogEntry::AnnotatedSystemItem { entry, .. } => Some(&entry.item),
+        LogEntry::SystemItem { item, .. } => Some(item),
+        _ => None,
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Mock LLM Client
 // ---------------------------------------------------------------------------
@@ -192,7 +213,8 @@ async fn make_worker_with_pwd_and_manifest(
    let scope = manifest::Scope::writable(&pwd).unwrap();
    std::mem::forget(pwd_tmp);

-    let worker = Engine::new(client);
+    let worker =
+        Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(client);
    let authority = WorkerFilesystemAuthority::local(pwd.clone(), pwd.clone());
    let worker = Worker::new(
        manifest,
@@ -784,13 +806,30 @@ async fn snapshot_includes_user_input_for_in_flight_turn() {
    let client = MockClient::sequential(vec![MockResponse::Hang(simple_text_events())]);
    let worker = make_worker(client).await;
    let handle = spawn_controller(worker).await;
+    let mut events = handle.subscribe();

    handle
        .send(Method::run_text("hello in-flight"))
        .await
        .unwrap();
-    wait_for_status(&handle, WorkerStatus::Running).await;
+    tokio::time::timeout(std::time::Duration::from_secs(2), async {
+        loop {
+            if matches!(
+                events.recv().await,
+                Ok(Event::Status {
+                    status: WorkerStatus::Running,
+                })
+            ) {
+                break;
+            }
+        }
+    })
+    .await
+    .expect("running status event");

+    // The Running event is the in-flight visibility fence: the committed
+    // annotated input must already be available to an immediately attaching
+    // subscriber rather than racing behind this status transition.
    let stream = tokio::net::UnixStream::connect(handle.runtime_dir.socket_path())
        .await
        .unwrap();
@@ -804,10 +843,12 @@ async fn snapshot_includes_user_input_for_in_flight_turn() {
                // Walk the entries, find a `LogEntry::UserInput` and
                // confirm its segments flatten to our submitted text.
                let mut found = false;
-                for value in entries {
+                for value in &entries {
                    let entry: session_store::LogEntry =
-                        serde_json::from_value(value).expect("LogEntry deserialise");
-                    if let session_store::LogEntry::UserInput { segments, .. } = entry {
+                        serde_json::from_value(value.clone()).expect("LogEntry deserialise");
+                    if let session_store::LogEntry::UserInput { segments, .. }
+                    | session_store::LogEntry::AnnotatedUserInput { segments, .. } = entry
+                    {
                        let text = protocol::Segment::flatten_to_text(&segments);
                        if text == "hello in-flight" {
                            found = true;
@@ -815,7 +856,10 @@ async fn snapshot_includes_user_input_for_in_flight_turn() {
                        }
                    }
                }
-                assert!(found, "snapshot must carry the in-flight UserInput entry");
+                assert!(
+                    found,
+                    "snapshot must carry the in-flight UserInput entry: {entries:?}"
+                );
                return;
            }
            Event::Alert(_) => continue,
@@ -1086,7 +1130,7 @@ async fn run_with_paste_segment_inlines_content_and_emits_typed_user_message() {
                _ => {}
            },
            entry = entry_rx.recv() => match entry {
-                Ok(session_store::LogEntry::UserInput { segments, .. }) => {
+                Ok(session_store::LogEntry::UserInput { segments, .. } | session_store::LogEntry::AnnotatedUserInput { segments, .. }) => {
                    user_input_segments = Some(segments);
                    if saw_turn_end {
                        break;
@@ -1317,11 +1361,8 @@ async fn notify_while_idle_auto_starts_turn_and_injects_system_message() {
    let (entries, _) = handle.sink.subscribe_with_snapshot();
    let saw_notify_in_mirror = entries.iter().any(|e| {
        matches!(
-            e,
-            session_store::LogEntry::SystemItem {
-                item: session_store::SystemItem::Notification { message, .. },
-                ..
-            } if message == "turn finished"
+            system_item(e),
+            Some(session_store::SystemItem::Notification { message, .. }) if message == "turn finished"
        )
    });
    assert!(
@@ -1463,14 +1504,11 @@ async fn worker_event_turn_ended_while_idle_auto_starts_turn_and_injects_system_
    let (entries, _) = handle.sink.subscribe_with_snapshot();
    let saw_worker_event_in_mirror = entries.iter().any(|e| {
        matches!(
-            e,
-            session_store::LogEntry::SystemItem {
-                item: session_store::SystemItem::WorkerEvent {
-                    event: protocol::WorkerEvent::TurnEnded { worker_name },
-                    ..
-                },
+            system_item(e),
+            Some(session_store::SystemItem::WorkerEvent {
+                event: protocol::WorkerEvent::TurnEnded { worker_name },
                ..
-            } if worker_name == "child"
+            }) if worker_name == "child"
        )
    });
    assert!(
@@ -1552,14 +1590,11 @@ async fn worker_event_scope_sub_delegated_while_idle_stays_control_plane_only()
    let (entries, _) = handle.sink.subscribe_with_snapshot();
    let saw_scope_event_in_mirror = entries.iter().any(|entry| {
        matches!(
-            entry,
-            session_store::LogEntry::SystemItem {
-                item: session_store::SystemItem::WorkerEvent {
-                    event: protocol::WorkerEvent::ScopeSubDelegated { .. },
-                    ..
-                },
+            system_item(entry),
+            Some(session_store::SystemItem::WorkerEvent {
+                event: protocol::WorkerEvent::ScopeSubDelegated { .. },
                ..
-            }
+            })
        )
    });
    assert!(
@@ -2134,9 +2169,13 @@ async fn paused_then_run_closes_orphan_tool_use_for_next_request() {
    for item in items {
        match item {
            agen::Item::ToolResult {
-                call_id, summary, ..
+                call_id,
+                summary,
+                disposition,
+                ..
            } if call_id == "call_orphan" => {
-                assert_eq!(summary, "[Interrupted by user]");
+                assert_eq!(summary, "Tool execution outcome unknown");
+                assert_eq!(*disposition, agen::ToolResultDisposition::OutcomeUnknown);
                saw_synthetic_tool_result = true;
            }
            agen::Item::Message { role, content, .. } if *role == agen::Role::System => {
@@ -2327,8 +2366,11 @@ async fn paused_cancel_abandons_resume_and_next_input_is_fresh_run() {
    assert!(
        items.iter().any(|item| matches!(
            item,
-            agen::Item::ToolResult { call_id, summary, .. }
-                if call_id == "call_cancelled" && summary == "[Interrupted by user]"
+            agen::Item::ToolResult {
+                call_id,
+                disposition: agen::ToolResultDisposition::OutcomeUnknown,
+                ..
+            } if call_id == "call_cancelled"
        )),
        "paused cancel should close orphan tool_use before future requests: {items:?}"
    );
@@ -2373,7 +2415,8 @@ async fn snapshot_contains_user_input(handle: &WorkerHandle, needle: &str) -> bo
                    let entry: session_store::LogEntry =
                        serde_json::from_value(value).expect("LogEntry deserialise");
                    match entry {
-                        session_store::LogEntry::UserInput { segments, .. } => {
+                        session_store::LogEntry::UserInput { segments, .. }
+                        | session_store::LogEntry::AnnotatedUserInput { segments, .. } => {
                            protocol::Segment::flatten_to_text(&segments).contains(needle)
                        }
                        _ => false,
@@ -188,7 +188,8 @@ async fn make_worker(
    let pwd = pwd_tmp.path().to_path_buf();
    let scope = worker::Scope::writable(&pwd).unwrap();

-    let mut worker = Engine::new(client);
+    let mut worker =
+        Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(client);
    worker.register_tool(big_content_tool_definition(tool_name));

    let worker = Worker::new(
@@ -460,7 +461,8 @@ async fn metric_write_failure_emits_warn_alert_and_does_not_abort_run() {
    // protected token budget covers the only user message). That is enough to drive
    // the failure path: at least one metric attempts to write.
    let client = MockClient::new(vec![text_response_with_cache("hi", 0, 0)]);
-    let worker = Engine::new(client);
+    let worker =
+        Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(client);
    let mut worker = Worker::new(
        manifest,
        worker,
@@ -536,7 +538,8 @@ permission = "write"
    let pwd_tmp = tempfile::tempdir().unwrap();
    let pwd = pwd_tmp.path().to_path_buf();
    let scope = worker::Scope::writable(&pwd).unwrap();
-    let worker = Engine::new(client);
+    let worker =
+        Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(client);
    let mut worker = Worker::new(
        manifest,
        worker,
@@ -130,7 +130,8 @@ async fn make_worker_with_body(
        EffectivePromptCatalog::new(templates, 1, "test-schema", "test-toolchain").unwrap();
    let loader = PromptCatalogSource::builtins_only().with_effective_catalog(projection);

-    let worker = Engine::new(client);
+    let worker =
+        Engine::<_, agen::state::Mutable, worker::SessionHistoryMetadata>::new_annotated(client);
    let mut worker = Worker::new(
        manifest,
        worker,
@@ -8,7 +8,7 @@ export type AlertSource = "worker" | "engine" | "compactor" | "agents_md";

 export type CompletionKind = "file";

-export type WorkerStatus = "idle" | "running" | "paused";
+export type WorkerStatus = "idle" | "running" | "paused" | "stopped";

 export type TurnResult = "finished" | "paused";

@@ -16,6 +16,8 @@ export type InvokeKind = "user_send" | "notify" | "worker_event" | "system_remin

 export type RunResult = "finished" | "paused" | "limit_reached" | "rolled_back";

+export type ToolResultDisposition = "success" | "error" | "interrupted" | "cancelled" | "outcome_unknown";
+
 export type ErrorCode = "already_running" | "not_running" | "not_paused" | "provider_error" | "tool_error" | "invalid_request" | "internal";

 export type Permission = "read" | "write";
@@ -191,7 +193,7 @@ summary: string,
 * Full tool output. Absent when the tool chose to return
 * summary-only, or when the result was pruned.
 */
-output?: string | null, is_error: boolean, } } | { "event": "usage", "data": { input_tokens: number | null, output_tokens: number | null, cache_read_input_tokens?: number | null, } } | { "event": "run_end", "data": { result: RunResult, } } | { "event": "error", "data": { code: ErrorCode, message: string, } } | { "event": "snapshot", "data": { entries: Array<unknown>, greeting: Greeting, status: WorkerStatus,
+output?: string | null, disposition?: ToolResultDisposition | null, is_error: boolean, } } | { "event": "usage", "data": { input_tokens: number | null, output_tokens: number | null, cache_read_input_tokens?: number | null, } } | { "event": "run_end", "data": { result: RunResult, } } | { "event": "error", "data": { code: ErrorCode, message: string, } } | { "event": "snapshot", "data": { entries: Array<unknown>, greeting: Greeting, status: WorkerStatus,
 /**
 * Unfinished model output that has already streamed in the current
 * run but is not yet represented by committed snapshot entries.
@@ -5,7 +5,7 @@
    workspaceWorkersStore,
    type SidebarWorker,
  } from './worker-subscription';
-  import { canShowWorkerInSidebar } from './workers';
+  import { canShowWorkerInSidebar, sidebarWorkerActivity } from './workers';

  const COLLAPSED_WORKER_COUNT = 6;

@@ -69,6 +69,7 @@
    <ul class="nav-list" aria-label="Workers">
      {#each visibleWorkers as worker (`${worker.runtime_id}:${worker.worker_id}`)}
        {@const href = workerConsoleHref(worker, workspaceId)}
+        {@const activity = sidebarWorkerActivity(worker)}
        <li>
          <a
            href={href}
@@ -77,11 +78,11 @@
            aria-current={currentPath === href ? 'page' : undefined}
          >
            <span class="worker-status-indicator">
-              {#if worker.state === 'running'}
+              {#if activity === 'worker-running'}
                <span class="worker-status-spinner"><Spinner label="Running" /></span>
-              {:else if worker.has_running_internal_workers}
+              {:else if activity === 'subworker-running'}
                <span class="worker-status-spinner is-subworker"><Spinner label="SubWorker running" /></span>
-              {:else if worker.state === 'idle'}
+              {:else if activity === 'idle'}
                <span class="worker-status-dot" aria-label="Idle"></span>
              {/if}
            </span>
@@ -14,13 +14,18 @@ declare const Deno: {
  test(name: string, fn: () => void | Promise<void>): void;
 };

-function worker(runtimeId: string, workerId: string, revision: number): SubscriptionWorker {
+function worker(
+  runtimeId: string,
+  workerId: string,
+  revision: number,
+  hasRunningInternalWorkers = false,
+): SubscriptionWorker {
  return {
    worker_id: workerId,
    runtime_id: runtimeId,
    subject_revision: revision,
    state: 'idle',
-    has_running_internal_workers: false,
+    has_running_internal_workers: hasRunningInternalWorkers,
    workspace_id: 'workspace-test',
    display_name: null,
    profile: null,
@@ -88,3 +93,28 @@ Deno.test('workspace Worker reducer ignores stale events and removes composite s
  assertEquals(projection.workers.size, 0);
  assertEquals(projection.revisions.get('runtime-a:1'), 4);
 });
+
+Deno.test('fatal child stop replaces the running-child sidebar projection', () => {
+  const projection = createWorkspaceWorkersProjection();
+  projection.workers.set('runtime-a:1', worker('runtime-a', '1', 1, true));
+  projection.revisions.set('runtime-a:1', 1);
+
+  applyWorkspaceWorkersFrame(projection, {
+    protocol_version: 1,
+    frame: 'event',
+    message: {
+      event: 'event',
+      data: {
+        subscription_id: 'subscription-1',
+        subject_revision: 2,
+        payload: {
+          event: 'worker_upserted',
+          data: { worker: worker('runtime-a', '1', 2, false) },
+        },
+      },
+    },
+  });
+
+  assertEquals(projection.workers.get('runtime-a:1')?.has_running_internal_workers, false);
+  assertEquals(projection.revisions.get('runtime-a:1'), 2);
+});
@@ -2,6 +2,7 @@ import {
  canOpenWorkerConsole,
  canShowWorkerInSidebar,
  compareWorkersForSidebar,
+  sidebarWorkerActivity,
 } from "./workers.ts";
 import type { Worker } from "./types.ts";

@@ -77,3 +78,21 @@ Deno.test("sidebar workers sort running then idle then stopped", () => {
  workers.sort(compareWorkersForSidebar);
  assertEquals(workers.map((candidate) => candidate.worker_id).join(","), "2,1,4,3");
 });
+
+Deno.test("fatal child stop clears the sidebar SubWorker spinner activity", () => {
+  const parent = { state: "idle", has_running_internal_workers: true };
+  assertEquals(sidebarWorkerActivity(parent), "subworker-running");
+
+  parent.has_running_internal_workers = false;
+  assertEquals(sidebarWorkerActivity(parent), "idle");
+});
+
+Deno.test("stopped parents do not fall back to the idle indicator", () => {
+  assertEquals(
+    sidebarWorkerActivity({
+      state: "stopped",
+      has_running_internal_workers: false,
+    }),
+    "none",
+  );
+});
@@ -1,5 +1,24 @@
 import type { Worker } from './types';

+export type SidebarWorkerActivity =
+  | 'worker-running'
+  | 'subworker-running'
+  | 'idle'
+  | 'none';
+
+type WorkerActivitySource = Pick<Worker, 'state'> & {
+  has_running_internal_workers: boolean;
+};
+
+export function sidebarWorkerActivity(
+  worker: WorkerActivitySource,
+): SidebarWorkerActivity {
+  if (worker.state === 'running') return 'worker-running';
+  if (worker.has_running_internal_workers) return 'subworker-running';
+  if (worker.state === 'idle') return 'idle';
+  return 'none';
+}
+
 export function canShowWorkerInSidebar(worker: Worker): boolean {
  return worker.implementation.kind !== 'backend_worker_registry';
 }
Author	SHA1	Message	Date
Hare	62ada5eaa4	fix: bound safe-boundary pause escalation	2026-08-27 23:57:20 +09:00
Hare	f5ff0b7c13	fix: confirm bash cancellation cleanup	2026-08-27 23:01:06 +09:00
Hare	3337cafcdf	feat: own cancellable tool execution lifecycle	2026-08-27 23:01:00 +09:00
Hare	e87784118b	fix: preserve resumable paused tool calls	2026-08-27 21:48:59 +09:00
Hare	40fada28ea	fix: preserve confirmed output on interceptor abort	2026-08-27 21:30:04 +09:00
Hare	58cc94d4b7	fix: terminalize interrupted tool executions	2026-08-27 20:54:13 +09:00
Hare	ccabea59c9	fix: terminalize parallel tool outputs on completion	2026-08-27 19:16:49 +09:00
Hare	183c37446e	fix: fence running snapshots on input commit	2026-08-27 15:42:20 +09:00
Hare	7aa06afc45	chore: preserve reviewed source lineage # Conflicts: # crates/agen/README.md # crates/agen/examples/engine_cancel_demo.rs # crates/agen/examples/engine_cli.rs # crates/agen/src/engine.rs # crates/agen/tests/annotated_history_test.rs # crates/agen/tests/callback_test.rs # crates/agen/tests/engine_fixtures.rs # crates/agen/tests/engine_state_test.rs # crates/agen/tests/parallel_execution_test.rs # crates/agen/tests/reasoning_round_trip_test.rs # crates/session-store/tests/session_test.rs # crates/worker/src/worker.rs	2026-08-27 15:13:27 +09:00
Hare	1515a2fb86	fix: reconcile typed history with run exits	2026-08-27 15:12:05 +09:00
Hare	ec798c58d7	fix: preserve annotated history through rewind	2026-08-27 14:54:24 +09:00
Hare	e365189276	feat: add provenance-aware worker history	2026-08-27 14:54:24 +09:00
Hare	116d610ad0	fix: project Ticket mutation outputs to human keys	2026-08-27 14:18:48 +09:00
Hare	75c570962d	Merge commit '7edc588202dfbfd4c834f677f510ddda7f3d6451' into work/00001M10HW6BV-model-facing-resource-projection	2026-08-27 13:46:19 +09:00
Hare	cae8ac1799	fix: allow missing Objective query snippets	2026-08-27 13:46:10 +09:00
Hare	7edc588202	chore: refresh T-528 after T-541	2026-08-27 13:09:44 +09:00
Hare	374449e663	feat: add provenance-aware worker history	2026-08-27 12:51:01 +09:00
Hare	2b33b9158d	chore: refresh T-528 against develop	2026-08-27 12:45:01 +09:00
Hare	3a7a3307ef	fix: map internal worker terminal lifecycles	2026-08-27 12:27:55 +09:00
Hare	975b4fa700	feat: add typed engine run exits	2026-08-27 11:42:49 +09:00