• Sequential: occupies a single-element wave. Safe default; file/shell side effects never race.
• Parallel: may share a wave with adjacent Parallel calls.
• Exclusive: forms a barrier before and after; never shares a wave.

• session_id / run_id always identify the Run that issued the call, including compact (compact is host-driven but still scoped to a Run).
• effect_id is Some iff the call executes a reducer-allocated CallModel effect; it is None for compact, which is not an effect. Hosts that propagate cancellation key in-flight model calls by this id, mirroring the tool side's EffectContext.effect_id.
• pressure is Some only where posoco has a reading worth sharing (the compact path); ports treat it as advisory read-only input.

• on_compose: called once, synchronously, after every composition gate has passed (catalog atomic snapshot, model cardinality, collision checks) and before the Agent is ready. This is where the composed capabilities declared in the manifest's requires are delivered via CompositionView. Sync on purpose: ModelPort::chat and UiPort::request are async, so a sync composition point cannot use what it wires — the type system enforces "wire, don't act". Raise CompositionError::ExtensionComposeFailed to fail the composition loudly; no partial Agent is produced.
• on_start: called once per Agent lifetime, inside the first run_turn (an async context), before the first TurnStarted is projected. This is the legitimate birth point for loading persisted state or spawning background loops — construction time has no async root. Not re-fired after Suspended resumes. Like other async slots the body may raise; the Agent wraps a raised error loudly and the first turn fails before any terminal event is emitted.
• on_shutdown: resource cleanup hook, called once on agent shutdown in reverse registration order; cleanup failure propagates (loud).

• Buffered: the sink accepted the record; it may still live only in memory.
• Written: the sink completed its normal write path.
• Durable: the sink crossed its durability barrier before returning.

• SystemMessage / UserMessage never carry tool calls.
• AssistantMessage is the ONLY variant that carries tool calls, the ONLY variant that carries reasoning.
• ToolMessage is the ONLY variant that carries a call_id correlation and a ToolOutcome. It never carries tool calls.

• UnknownTool: the requested tool name is not present in the catalog operation snapshot.
• NotOffered: the name exists, but its captured exposure does not allow this entry point. No provider was called, including after hook rewrites.
• OwnerNotAllowed: the caller manifest did not declare the target owner.
• InvocationLimit: a child would exceed the shared call budget or depth.
• PolicyConflict: a child needs stronger isolation than its parent's slot.
• SchemaMismatch: the arguments parsed successfully but failed validation against the tool's input schema. The diagnostic carries a safe JSON path and type expectation; it never includes the raw argument payload.
• RejectedByHook: a PipelineHook::before_tool returned Reject; the call was never dispatched and reason is the hook's steering text fed back to the model.
• Revoked: the target is still present in the caller's captured catalog, but the contributing version that supplied it was hard-withdrawn. The provider was never entered, so this is neither an unknown tool nor a business failure.

• on_turn_begin: async turn-start slot. Dispatched once per run_single_turn, after the TurnStarted observer projection and before the pump's first before_model. Symmetric with on_turn_end: pre-turn failures (agent-shutdown guard, lifecycle on_start raises) dispatch nothing — the turn never began. A raise is a secondary failure — reported to observers, never failing the turn — and later hooks still run; cancellation is not a defect.
• before_model: invoked before the model is called. Can rewrite messages or raise HookAbort. Multiple hooks form a chained rewrite pipeline — each hook sees the previous hook's output.
• before_tool: invoked before every tool execution. Every hook is evaluated; merge precedence on ToolDecision (consent beats Reject; Defer still aborts the run).
• on_post_event: read-only, non-raising notification with the committing run's EventScope. Hooks run in registration order; interception belongs in before_model or before_tool.
• on_turn_end: async turn-end slot, no payload. The terminal outcome already lives on the Observer channel — TurnCompleted / TurnFailed(String) — and an extension typically implements Observer and PipelineHook as two views over one shared struct, so a hook that needs the outcome reads its own observer-side state instead of a second payload type. Dispatched once per run_turn, after the terminal observer projection (TurnCompleted / TurnFailed) and before the call returns — on both the completed and the failed path. This is the slot for side effects that must finish by turn end, such as committing buffered writes to an external system. Implementations must carry their own timeout budget and may not block the turn's return indefinitely. Division of labor with Observer::on_event(TurnCompleted): the observer slot is sync, read-only and fires first; on_turn_end may await. A raise from on_turn_end is a secondary failure — reported to observers, never replacing the turn's primary outcome — and cancellation is not a defect.

• Success: tool ran and returned structured data. content is the plain-text result sent to the model by the built-in adapters and used for transcripts. structured is an optional machine-readable payload preserved in the kernel transcript, TurnEvent::ToolCallSucceeded, and session snapshots for observers/UIs; the built-in adapters do not send it to the model. Structured objects follow a reserved summary : String field convention for one-line UI summaries.
• SuccessWithAttachments: like Success, plus media attachments (images today) carried as content blocks. Adapters that cannot express attachments on the wire downgrade them explicitly — never a silent drop.
• ToolReportedError: tool ran and reported a business-level failure. The Run continues; the failure is fed back to the model as a normal tool message.
• RuntimeFailure: tool did not run to completion — adapter raised a RuntimeError. Still non-terminal for the Run.
• NotExecuted: model requested a tool that was not executed (unknown name, parseable-but-schema-invalid args, or a before_tool hook rejection). The original call id is preserved so the model can correlate the feedback.

ToolCallPending            (entered the pipeline, awaiting hook chain)
  ├─ ToolCallApproved      (chain finalized executable; consent audit)
  │    └─ ToolCallStarted  (wave launched)
  │         ├─ ToolCallSucceeded / ToolCallFailed
  ├─ ToolCallRejected      (a decision resolved the call: hook reject,
  │                         validation reject; run continues)
  └─ ToolCallAbandoned     (no outcome exists: cancelled mid-wave,
                            terminal hook failure, run ended)