Run 的事实驱动执行

pub struct FactRun {
    dir: PathBuf,
    /// The Run's shared fact-log writer. Constructed here as a default and
    /// replaced by the session constructors with the instance the run's
    /// tool contexts already hold, so actor appends and Run-owned background
    /// readers serialize through one instance mutex (a second `FileLog`
    /// handle over the same directory races duplicate seqs).
    log: Arc<FileLog>,
    thread: String,
    actor: a3s_effect::Actor<CodingServices, CodingView>,
    services: Arc<CodingServices>,
    limit: Option<u32>,
    /// Tool names exposed when this run was admitted. A later posture does not rewrite them.
    admitted_tools: Vec<String>,
    /// Copied from [`crate::meta_harness::KernelPolicy::admit`]. Hosts cannot clear it.
    completion_gate: bool,
    /// Permission policy frozen at admission, including posture allow rules.
    admitted_permission: PermissionPolicy,
    /// Digest admitted for this run. Legacy opens leave this empty.
    standing_digest: Option<String>,
    current_goal: Option<crate::goal_control::DurableGoalDefinitionV1>,
    /// Host cancel for this run. Interactive sessions share [`SessionSurface::cancel`].
    cancel: tokio_util::sync::CancellationToken,
}

/// Optional host mounts for Meta Harness admission.
#[derive(Default)]
pub struct FactRunHostMounts<'a> {
    pub compose: Option<&'a crate::meta_harness::HarnessComposeOptions>,
    pub registry: Option<&'a dyn crate::meta_harness::HostHarnessRegistry>,

pub(super) fn run_execution_cycle(
    surface: &SessionSurface,
    facts: &[a3s_effect::Fact],
) -> Result<Option<receipts::ExecutionCycle>, ActorError> {
    let threshold = surface.agent.duplicate_tool_threshold();
    if surface.agent.is_child_run() {
        return Ok(receipts::child_execution_cycle(facts, threshold));
    }
    let Some(run_id) = surface.run_id.as_deref() else {
        return Ok(None);
    };
    let binding = surface
        .agent
        .checkpoint_capability_binding()
        .ok_or_else(|| {
            ActorError::Schema(
                "tool_effect_admission_missing: original Run has no capability binding".into(),
            )
        })?;
    let digest = crate::content_digest::digest_json("a3s.code.tool-admission-binding.v1", binding)
        .map_err(|error| ActorError::Schema(error.to_string()))?;
    Ok(receipts::execution_cycle(
        facts,
        &thread_for_session(&surface.session_id),
        run_id,
        &digest,
        threshold,
    ))
}

pub(super) fn interrupted_response() -> crate::llm::LlmResponse {
    crate::llm::LlmResponse {

pub enum RunControlCommand {
    /// Add a new user direction without starting a second turn.
    Steer { input: String },
    /// Stop the current run. `force` is advisory: the runtime remains
    /// cooperative and will never skip cleanup or governance boundaries.
    Interrupt {
        reason: Option<String>,
        #[serde(default)]
        force: bool,
    },
}

impl RunControlCommand {
    pub fn operation(&self) -> RunControlOperation {
        match self {
            Self::Steer { .. } => RunControlOperation::Steer,
            Self::Interrupt { .. } => RunControlOperation::Interrupt,
        }

pub(crate) fn decide_with_contracts(
    ledger: &MutationLedger,
    reports: &[VerificationReport],
    waivers: &[CompletionWaiverV1],
    allow_continuation: bool,
    observations: &[crate::external_observation::ExternalObservationV1],
    contracts: &[crate::verification::VerificationContractV1],
) -> CompletionGate {
    if let Some(error) = ToolEffectUnresolved::from_ledger(ledger) {
        return CompletionGate::Incomplete {
            message: error.to_string(),
        };
    }
    let open = crate::external_observation::still_open(observations, waivers, ledger.digest());
    if crate::external_observation::blocks_success(&open) {
        let digest = open
            .iter()
            .map(|observation| observation.digest.as_str())
            .collect::<Vec<_>>()
            .join(",");
        let message = format!(