diff --git a/apps/desktop/src/main/__tests__/fixtures/renderer-barrel-node-boundary-child.ts b/apps/desktop/src/main/__tests__/fixtures/renderer-barrel-node-boundary-child.ts
new file mode 100644
index 0000000000..bbf91f56f2
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/fixtures/renderer-barrel-node-boundary-child.ts
@@ -0,0 +1,16 @@
+// Child process for renderer-core-barrel-node-boundary.test.ts. Registers the
+// throwing loader hook, then imports the built @maka/core barrel. Prints
+// `barrel-ok` and exits 0 only if the barrel evaluates without touching any
+// `node:*` module.
+import { register } from 'node:module';
+
+register(new URL('./throw-on-node-import-hook.js', import.meta.url));
+
+import('@maka/core')
+  .then(() => {
+    console.log('barrel-ok');
+  })
+  .catch((error: unknown) => {
+    console.error(error);
+    process.exitCode = 1;
+  });
diff --git a/apps/desktop/src/main/__tests__/fixtures/throw-on-node-import-hook.ts b/apps/desktop/src/main/__tests__/fixtures/throw-on-node-import-hook.ts
new file mode 100644
index 0000000000..98bde1acad
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/fixtures/throw-on-node-import-hook.ts
@@ -0,0 +1,15 @@
+// Loader hook used by renderer-core-barrel-node-boundary.test.ts. It enforces
+// the structural invariant under test: a `node:*` import cannot resolve in the
+// renderer's browser-like environment, so the moment the @maka/core barrel
+// graph reaches Node-only code this hook throws and the child process fails.
+
+export async function resolve(
+  specifier: string,
+  context: unknown,
+  nextResolve: (specifier: string, context: unknown) => Promise<{ url: string }>,
+): Promise<{ url: string }> {
+  if (specifier.startsWith('node:')) {
+    throw new Error(`renderer core barrel evaluated Node-only module: ${specifier}`);
+  }
+  return nextResolve(specifier, context);
+}
diff --git a/apps/desktop/src/main/__tests__/renderer-core-barrel-node-boundary.test.ts b/apps/desktop/src/main/__tests__/renderer-core-barrel-node-boundary.test.ts
new file mode 100644
index 0000000000..eb04ddf216
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/renderer-core-barrel-node-boundary.test.ts
@@ -0,0 +1,67 @@
+/**
+ * Executable regression guard for the renderer-facing `@maka/core` barrel.
+ *
+ * This test intentionally enforces a stronger structural invariant than the
+ * current tree-shaking behavior: the renderer-facing root barrel must remain
+ * loadable without evaluating any Node built-ins. The Electron renderer runs
+ * in a browser-like environment where `node:*` modules cannot resolve (Vite
+ * externalizes them; today they happen to be tree-shaken out of the renderer
+ * graph, but nothing about that is guaranteed). This test spawns a child Node
+ * process whose loader throws on every `node:*` import and then imports the
+ * built barrel; the child exits non-zero the moment the barrel graph evaluates
+ * Node-only code.
+ *
+ * This is the executable form of the source-regex contract that #1727 pruned
+ * (the previous form asserted on `packages/core/src/index.ts` text; this one
+ * asserts on the built artifact the renderer actually consumes).
+ */
+
+import { strict as assert } from 'node:assert';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { describe, it } from 'node:test';
+
+const DESKTOP_ROOT = fileURLToPath(new URL('../../../', import.meta.url));
+
+function runChild(
+  args: string[],
+  timeoutMs = 30_000,
+): Promise<{ code: number | null; stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, args, {
+      cwd: DESKTOP_ROOT,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk: Buffer) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.on('data', (chunk: Buffer) => {
+      stderr += chunk.toString();
+    });
+    const timer = setTimeout(() => {
+      child.kill('SIGKILL');
+      reject(new Error(`child process timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    child.once('error', (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.once('close', (code) => {
+      clearTimeout(timer);
+      resolve({ code, stdout, stderr });
+    });
+  });
+}
+
+describe('renderer core barrel node boundary contract', () => {
+  it('importing @maka/core evaluates no node:* module', async () => {
+    const childPath = fileURLToPath(
+      new URL('./fixtures/renderer-barrel-node-boundary-child.js', import.meta.url),
+    );
+    const { code, stdout, stderr } = await runChild([childPath]);
+    assert.equal(code, 0, `child process failed:\n${stderr}`);
+    assert.match(stdout, /barrel-ok/);
+  });
+});
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index aade53f3a7..5e46bdc2c3 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -268,14 +268,6 @@ export type {
   ToolLedgerTransitionKind,
   ToolLedgerTransitionValidation,
 } from './tool-ledger-scanner.js';
-export {
-  ToolLedgerCorruptionError,
-  ToolLedgerRejectionError,
-  scanToolLedger,
-  validateGenericToolLedgerAppend,
-  validateToolLedgerEventLane,
-  validateToolLedgerTransition,
-} from './tool-ledger-scanner.js';
 export type {
   ToolReconcileObservation,
   ToolReconcileResultFact,
@@ -300,21 +292,7 @@ export type {
   ToolRecoveryEventBundle,
   ToolRecoveryOperationIdentity,
 } from './tool-recovery-bundle.js';
-export {
-  ToolRecoveryBundleValidationError,
-  assertToolRecoveryEventBundle,
-  interpretScannedToolRecovery,
-  validateToolRecoveryEventBundle,
-} from './tool-recovery-bundle.js';
-export {
-  canonicalToolArgsHash,
-  stableJsonStringify,
-  stripUndefinedDeep,
-} from './tool-args-identity.js';
-export {
-  encodeCanonicalRuntimeEvent,
-  type CanonicalRuntimeEventEncoding,
-} from './canonical-runtime-event.js';
+export type { CanonicalRuntimeEventEncoding } from './canonical-runtime-event.js';
 export type {
   ContinuationClaimV1,
   ImmutableRuntimePrefixV1,
@@ -325,16 +303,15 @@ export type {
   RuntimePrefixSegmentV1,
   RuntimeBoundaryDigest,
 } from './runtime-boundary.js';
-export {
-  buildImmutableRuntimePrefix,
-  createRuntimeBoundaryCursor,
-  decodeContinuationClaim,
-  decodeRuntimeBoundaryCursor,
-  decodeRuntimePrefixSegment,
-  digestRuntimeBoundaryManifest,
-  digestRuntimePrefix,
-  runtimePrefixSegment,
-} from './runtime-boundary.js';
+// The following modules are intentionally type-only (or absent) in this
+// browser-consumed barrel: their value implementations depend on node:* (e.g.
+// runtime-boundary.ts and tool-args-identity.ts use node:crypto, tool-
+// ledger-scanner.ts and canonical-runtime-event.ts use node:util), which the
+// renderer cannot evaluate. Runtime code must import their values from the
+// explicit subpaths (`@maka/core/runtime-boundary`, `@maka/core/tool-args-
+// identity`, `@maka/core/tool-ledger-scanner`, `@maka/core/canonical-runtime-
+// event`, `@maka/core/tool-recovery-bundle`) so renderer imports of `@maka/core`
+// never evaluate Node-only modules before React can mount.
 
 // session.ts
 export type {
diff --git a/packages/core/src/shell-run.ts b/packages/core/src/shell-run.ts
index 2eae201386..51e7c93698 100644
--- a/packages/core/src/shell-run.ts
+++ b/packages/core/src/shell-run.ts
@@ -1,5 +1,3 @@
-import * as nodeUtil from 'node:util';
-
 export const SHELL_RUN_STATUSES = [
   'starting',
   'running',
@@ -410,7 +408,7 @@ export function nextShellRunRecord(current: ShellRunRecord, patch: ShellRunPatch
   ) {
     throw new Error(`ShellRun terminal outcome is immutable: ${current.status}`);
   }
-  if (nodeUtil.isDeepStrictEqual(candidate, current)) return current;
+  if (shellRunRecordsEqual(candidate, current)) return current;
   return normalizeShellRunRecord(
     { ...candidate, revision: current.revision + 1 },
     sessionId,
@@ -418,6 +416,42 @@ export function nextShellRunRecord(current: ShellRunRecord, patch: ShellRunPatch
   );
 }
 
+/**
+ * Structural equality for normalized ShellRun records. Records are plain
+ * JSON-safe data (string/number/boolean/null/arrays/objects), so a small
+ * recursive comparison is sufficient and keeps this module free of node:*
+ * imports so the renderer-facing `@maka/core` barrel stays browser-safe.
+ */
+function shellRunRecordsEqual(left: unknown, right: unknown): boolean {
+  if (left === right) return true;
+  if (typeof left !== 'object' || typeof right !== 'object' || left === null || right === null) {
+    return false;
+  }
+  if (Array.isArray(left) !== Array.isArray(right)) return false;
+  if (Array.isArray(left)) {
+    if (left.length !== (right as unknown[]).length) return false;
+    for (let index = 0; index < left.length; index += 1) {
+      if (!shellRunRecordsEqual(left[index], (right as unknown[])[index])) return false;
+    }
+    return true;
+  }
+  const leftKeys = Object.keys(left as Record<string, unknown>);
+  const rightKeys = Object.keys(right as Record<string, unknown>);
+  if (leftKeys.length !== rightKeys.length) return false;
+  for (const key of leftKeys) {
+    if (!Object.prototype.hasOwnProperty.call(right, key)) return false;
+    if (
+      !shellRunRecordsEqual(
+        (left as Record<string, unknown>)[key],
+        (right as Record<string, unknown>)[key],
+      )
+    ) {
+      return false;
+    }
+  }
+  return true;
+}
+
 function isShellRunSandboxExecution(value: unknown): boolean {
   if (value === undefined) return true;
   if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
diff --git a/packages/runtime-host/src/__tests__/client-capability-recovery.test.ts b/packages/runtime-host/src/__tests__/client-capability-recovery.test.ts
index 455e1d0278..24c6953db4 100644
--- a/packages/runtime-host/src/__tests__/client-capability-recovery.test.ts
+++ b/packages/runtime-host/src/__tests__/client-capability-recovery.test.ts
@@ -1,11 +1,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import {
-  canonicalToolArgsHash,
-  TOOL_BOUNDARY_PROTOCOL_V1,
-  type RuntimeEvent,
-  type ToolRecoveryMode,
-} from '@maka/core';
+import { TOOL_BOUNDARY_PROTOCOL_V1, type RuntimeEvent, type ToolRecoveryMode } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import { createSqliteRuntimeStore } from '@maka/storage';
 import { recoverClientCapabilityOutcomes } from '../server/client-capability-recovery.js';
 
diff --git a/packages/runtime-host/src/__tests__/execution-host-message.test.ts b/packages/runtime-host/src/__tests__/execution-host-message.test.ts
index f66cc5c296..66729c79d0 100644
--- a/packages/runtime-host/src/__tests__/execution-host-message.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-host-message.test.ts
@@ -16,7 +16,8 @@ import { connect, type Socket } from 'node:net';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test } from 'node:test';
-import { canonicalToolArgsHash, TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 import type { MessageContent } from '@maka/core/events';
 import type { ConnectionCatalogEntry } from '@maka/core/runtime-policy';
diff --git a/packages/runtime-host/src/__tests__/execution-host-queue.test.ts b/packages/runtime-host/src/__tests__/execution-host-queue.test.ts
index 28cfc2dc22..f491d04967 100644
--- a/packages/runtime-host/src/__tests__/execution-host-queue.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-host-queue.test.ts
@@ -16,7 +16,8 @@ import { connect, type Socket } from 'node:net';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test } from 'node:test';
-import { canonicalToolArgsHash, TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 import type { MessageContent } from '@maka/core/events';
 import type { ConnectionCatalogEntry } from '@maka/core/runtime-policy';
diff --git a/packages/runtime-host/src/__tests__/execution-host-recovery.test.ts b/packages/runtime-host/src/__tests__/execution-host-recovery.test.ts
index e52e989911..50cce19335 100644
--- a/packages/runtime-host/src/__tests__/execution-host-recovery.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-host-recovery.test.ts
@@ -7,7 +7,8 @@ import { connect, type Socket } from 'node:net';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { test } from 'node:test';
-import { canonicalToolArgsHash, TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 import type { MessageContent } from '@maka/core/events';
 import type { ConnectionCatalogEntry } from '@maka/core/runtime-policy';
diff --git a/packages/runtime-host/src/__tests__/execution-host.test.ts b/packages/runtime-host/src/__tests__/execution-host.test.ts
index 9e71f4eb69..1267e1cd5d 100644
--- a/packages/runtime-host/src/__tests__/execution-host.test.ts
+++ b/packages/runtime-host/src/__tests__/execution-host.test.ts
@@ -16,7 +16,8 @@ import { connect, type Socket } from 'node:net';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test } from 'node:test';
-import { canonicalToolArgsHash, TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 import type { MessageContent } from '@maka/core/events';
 import type { ConnectionCatalogEntry } from '@maka/core/runtime-policy';
diff --git a/packages/runtime-host/src/__tests__/fixtures/execution-host-suite.ts b/packages/runtime-host/src/__tests__/fixtures/execution-host-suite.ts
index 07d72c93e7..96d05b3bfc 100644
--- a/packages/runtime-host/src/__tests__/fixtures/execution-host-suite.ts
+++ b/packages/runtime-host/src/__tests__/fixtures/execution-host-suite.ts
@@ -16,7 +16,8 @@ import { connect, type Socket } from 'node:net';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { test } from 'node:test';
-import { canonicalToolArgsHash, TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { TOOL_BOUNDARY_PROTOCOL_V1 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 import { normalizeMessageContent, type MessageContent } from '@maka/core/events';
 import type { ConnectionCatalogEntry } from '@maka/core/runtime-policy';
diff --git a/packages/runtime/src/__tests__/ai-sdk-backend.test.ts b/packages/runtime/src/__tests__/ai-sdk-backend.test.ts
index 907949a02f..8b58e40ed2 100644
--- a/packages/runtime/src/__tests__/ai-sdk-backend.test.ts
+++ b/packages/runtime/src/__tests__/ai-sdk-backend.test.ts
@@ -13,7 +13,7 @@ import type {
   SessionHeader,
   StorageRef,
 } from '@maka/core';
-import { encodeCanonicalRuntimeEvent } from '@maka/core';
+import { encodeCanonicalRuntimeEvent } from '@maka/core/canonical-runtime-event';
 import type { SessionEvent } from '@maka/core/events';
 import type { RuntimeEvent } from '@maka/core/runtime-event';
 import { createSessionEventMapMemory, mapSessionEventToRuntimeEvent } from '../ai-sdk-flow.js';
diff --git a/packages/runtime/src/__tests__/context-budget.test.ts b/packages/runtime/src/__tests__/context-budget.test.ts
index e1b6f44224..e85b1a09a9 100644
--- a/packages/runtime/src/__tests__/context-budget.test.ts
+++ b/packages/runtime/src/__tests__/context-budget.test.ts
@@ -2,7 +2,7 @@ import assert from 'node:assert/strict';
 import { Buffer } from 'node:buffer';
 import { createHash } from 'node:crypto';
 import { describe, test } from 'node:test';
-import { encodeCanonicalRuntimeEvent } from '@maka/core';
+import { encodeCanonicalRuntimeEvent } from '@maka/core/canonical-runtime-event';
 import type { RuntimeEvent } from '@maka/core/runtime-event';
 import {
   ARCHIVED_TOOL_RESULT_PLACEHOLDER_KIND,
diff --git a/packages/runtime/src/__tests__/continuation-replay.test.ts b/packages/runtime/src/__tests__/continuation-replay.test.ts
index fd38edf9c7..1625ffbd9c 100644
--- a/packages/runtime/src/__tests__/continuation-replay.test.ts
+++ b/packages/runtime/src/__tests__/continuation-replay.test.ts
@@ -1,10 +1,10 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import { type RuntimeEvent } from '@maka/core';
 import {
   buildImmutableRuntimePrefix,
-  type RuntimeEvent,
   type RuntimePrefixIdentityV1,
-} from '@maka/core';
+} from '@maka/core/runtime-boundary';
 import {
   buildContinuationReplayPlan,
   buildContinuationReplaySegment,
diff --git a/packages/runtime/src/__tests__/conversation-copy.test.ts b/packages/runtime/src/__tests__/conversation-copy.test.ts
index 2173a47c5d..aea569f219 100644
--- a/packages/runtime/src/__tests__/conversation-copy.test.ts
+++ b/packages/runtime/src/__tests__/conversation-copy.test.ts
@@ -11,11 +11,8 @@ import type {
   RuntimeEventStore,
   StoredMessage,
 } from '@maka/core';
-import {
-  canonicalToolArgsHash,
-  decodeCanonicalToolResultContent,
-  isSessionInlineRun,
-} from '@maka/core';
+import { decodeCanonicalToolResultContent, isSessionInlineRun } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import {
   createSqliteAgentRunStore,
   createSqliteRuntimeStore,
diff --git a/packages/runtime/src/__tests__/pre-dispatch-refusal-ledger.test.ts b/packages/runtime/src/__tests__/pre-dispatch-refusal-ledger.test.ts
index 1ba5c647e6..498d25e5f2 100644
--- a/packages/runtime/src/__tests__/pre-dispatch-refusal-ledger.test.ts
+++ b/packages/runtime/src/__tests__/pre-dispatch-refusal-ledger.test.ts
@@ -2,12 +2,12 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 
 import {
-  scanToolLedger,
   type LlmConnection,
   type RuntimeEvent,
   type SessionEvent,
   type SessionHeader,
 } from '@maka/core';
+import { scanToolLedger } from '@maka/core/tool-ledger-scanner';
 import { z } from 'zod';
 
 import { createSessionEventMapMemory, mapSessionEventToRuntimeEvent } from '../ai-sdk-flow.js';
diff --git a/packages/runtime/src/__tests__/recovery-authority-equivalence.test.ts b/packages/runtime/src/__tests__/recovery-authority-equivalence.test.ts
index 4f301428e4..1fa91cfec3 100644
--- a/packages/runtime/src/__tests__/recovery-authority-equivalence.test.ts
+++ b/packages/runtime/src/__tests__/recovery-authority-equivalence.test.ts
@@ -3,7 +3,8 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, it } from 'node:test';
-import { canonicalToolArgsHash, type RuntimeEvent } from '@maka/core';
+import type { RuntimeEvent } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import { createSqliteRuntimeStore } from '@maka/storage';
 import { resolveRuntimeRecovery } from '../recovery-resolver.js';
 import { buildResumePlanFromRuntimeEvents } from '../runtime-resume.js';
diff --git a/packages/runtime/src/__tests__/recovery-resolver.test.ts b/packages/runtime/src/__tests__/recovery-resolver.test.ts
index e44629a5f9..4a16863aa9 100644
--- a/packages/runtime/src/__tests__/recovery-resolver.test.ts
+++ b/packages/runtime/src/__tests__/recovery-resolver.test.ts
@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
-import { canonicalToolArgsHash } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { RuntimeEvent } from '@maka/core/runtime-event';
 import {
   buildInterruptedCodeModeOutcomeCommits,
diff --git a/packages/runtime/src/__tests__/runtime-resume.test.ts b/packages/runtime/src/__tests__/runtime-resume.test.ts
index a9a95597fb..c7b404ffc4 100644
--- a/packages/runtime/src/__tests__/runtime-resume.test.ts
+++ b/packages/runtime/src/__tests__/runtime-resume.test.ts
@@ -5,7 +5,7 @@ import {
   buildImmutableRuntimePrefix,
   type ImmutableRuntimePrefixV1,
 } from '@maka/core/runtime-boundary';
-import { canonicalToolArgsHash } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import type { RuntimeEvent } from '@maka/core/runtime-event';
 import type { AgentRunHeader } from '@maka/core/agent-run';
 
diff --git a/packages/runtime/src/__tests__/session-manager-terminal-ledger.test.ts b/packages/runtime/src/__tests__/session-manager-terminal-ledger.test.ts
index 79017dfe80..ae64087c4c 100644
--- a/packages/runtime/src/__tests__/session-manager-terminal-ledger.test.ts
+++ b/packages/runtime/src/__tests__/session-manager-terminal-ledger.test.ts
@@ -1,13 +1,11 @@
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';
 import { setTimeout as timerDelay } from 'node:timers/promises';
+import { deriveTurnRecords, DurableStoreWriteError, isTerminalRuntimeEvent } from '@maka/core';
 import {
-  deriveTurnRecords,
-  DurableStoreWriteError,
-  isTerminalRuntimeEvent,
   ToolLedgerCorruptionError,
   ToolLedgerRejectionError,
-} from '@maka/core';
+} from '@maka/core/tool-ledger-scanner';
 import type { SandboxBoundaryResponse } from '@maka/core/sandbox-boundary';
 import type {
   AgentRunEvent,
diff --git a/packages/runtime/src/__tests__/session-manager.test.ts b/packages/runtime/src/__tests__/session-manager.test.ts
index c17abae357..b6457dab5e 100644
--- a/packages/runtime/src/__tests__/session-manager.test.ts
+++ b/packages/runtime/src/__tests__/session-manager.test.ts
@@ -6,17 +6,16 @@ import {
   applySandboxBoundaryExpansion,
   createGenesisExecutionBoundary,
   createWorkspaceWritePermissionProfile,
-  canonicalToolArgsHash,
   DEEP_RESEARCH_SESSION_LABEL,
   SIDE_CONVERSATION_SESSION_LABEL,
   RUNTIME_CONTINUATION_AUTHORITY_V1,
-  buildImmutableRuntimePrefix,
-  decodeContinuationClaim,
   deriveTurnRecords,
   isSandboxBoundaryRestartClosure,
   isSessionInlineRun,
   isTerminalRuntimeEvent,
 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
+import { buildImmutableRuntimePrefix, decodeContinuationClaim } from '@maka/core/runtime-boundary';
 import type {
   CreateSandboxBoundaryRequest,
   SandboxBoundaryRequest,
diff --git a/packages/runtime/src/__tests__/shell-run-tool-result.test.ts b/packages/runtime/src/__tests__/shell-run-tool-result.test.ts
index 12b76fa8a9..78e2f55bd4 100644
--- a/packages/runtime/src/__tests__/shell-run-tool-result.test.ts
+++ b/packages/runtime/src/__tests__/shell-run-tool-result.test.ts
@@ -3,12 +3,8 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, test } from 'node:test';
-import {
-  encodeCanonicalRuntimeEvent,
-  type PtyShellOutput,
-  type RuntimeEvent,
-  type ShellRunRecord,
-} from '@maka/core';
+import { type PtyShellOutput, type RuntimeEvent, type ShellRunRecord } from '@maka/core';
+import { encodeCanonicalRuntimeEvent } from '@maka/core/canonical-runtime-event';
 import { createSessionStore } from '@maka/storage';
 
 import {
diff --git a/packages/runtime/src/agent-run.ts b/packages/runtime/src/agent-run.ts
index fb4a8a06ad..7d7f1ad966 100644
--- a/packages/runtime/src/agent-run.ts
+++ b/packages/runtime/src/agent-run.ts
@@ -7,12 +7,8 @@ import type {
   RuntimeEventStore,
   ToolBoundaryProtocol,
 } from '@maka/core';
-import {
-  DurableStoreWriteError,
-  ToolLedgerRejectionError,
-  isSessionInlineRun,
-  isTerminalRuntimeEvent,
-} from '@maka/core';
+import { DurableStoreWriteError, isSessionInlineRun, isTerminalRuntimeEvent } from '@maka/core';
+import { ToolLedgerRejectionError } from '@maka/core/tool-ledger-scanner';
 import { Buffer } from 'node:buffer';
 import { isDeepStrictEqual } from 'node:util';
 import { redactSecrets } from '@maka/core/redaction';
diff --git a/packages/runtime/src/ai-sdk-backend.ts b/packages/runtime/src/ai-sdk-backend.ts
index 51d91bdd77..d502f5217e 100644
--- a/packages/runtime/src/ai-sdk-backend.ts
+++ b/packages/runtime/src/ai-sdk-backend.ts
@@ -80,8 +80,8 @@ import type { AttachmentByteReader } from '@maka/core/attachments';
 import {
   MAX_PROVIDER_IMAGE_REQUEST_BYTES,
   PROVIDER_IMAGE_BUDGET_EXCEEDED_MESSAGE,
-  stripUndefinedDeep,
 } from '@maka/core';
+import { stripUndefinedDeep } from '@maka/core/tool-args-identity';
 import type {
   LlmCallRecord,
   PricingConfig,
diff --git a/packages/runtime/src/continuation-replay.ts b/packages/runtime/src/continuation-replay.ts
index 38e239eca4..dd7d35d1e0 100644
--- a/packages/runtime/src/continuation-replay.ts
+++ b/packages/runtime/src/continuation-replay.ts
@@ -1,14 +1,14 @@
 import { createHash } from 'node:crypto';
+import type { RuntimeEvent } from '@maka/core';
+import { stableJsonStringify } from '@maka/core/tool-args-identity';
 import {
   createRuntimeBoundaryCursor,
   runtimePrefixSegment,
-  stableJsonStringify,
   type ImmutableRuntimePrefixV1,
   type RuntimeBoundaryCursorV1,
   type RuntimeBoundaryDigest,
-  type RuntimeEvent,
   type RuntimePrefixSegmentV1,
-} from '@maka/core';
+} from '@maka/core/runtime-boundary';
 import type { RuntimeEventModelReplayItem, RuntimeEventReplayDiagnostic } from './model-history.js';
 import {
   buildRuntimeEventModelReplayPlan,
diff --git a/packages/runtime/src/runtime-commit-sink.ts b/packages/runtime/src/runtime-commit-sink.ts
index d5c0560b56..58ba945f56 100644
--- a/packages/runtime/src/runtime-commit-sink.ts
+++ b/packages/runtime/src/runtime-commit-sink.ts
@@ -1,9 +1,6 @@
 import { createHash } from 'node:crypto';
-import {
-  canonicalToolArgsHash as canonicalToolArgsHashCore,
-  type RuntimeEvent,
-  type ToolRecoveryMode,
-} from '@maka/core';
+import type { RuntimeEvent, ToolRecoveryMode } from '@maka/core';
+import { canonicalToolArgsHash as canonicalToolArgsHashCore } from '@maka/core/tool-args-identity';
 
 export type { ToolRecoveryMode } from '@maka/core';
 
diff --git a/packages/storage/src/__tests__/fixtures/sqlite-recovery-concurrency-child.ts b/packages/storage/src/__tests__/fixtures/sqlite-recovery-concurrency-child.ts
index ddf6b2097b..59efdf98e2 100644
--- a/packages/storage/src/__tests__/fixtures/sqlite-recovery-concurrency-child.ts
+++ b/packages/storage/src/__tests__/fixtures/sqlite-recovery-concurrency-child.ts
@@ -1,12 +1,11 @@
 import { existsSync, writeSync } from 'node:fs';
 import { dirname } from 'node:path';
 import {
-  createRuntimeBoundaryCursor,
-  runtimePrefixSegment,
   type RuntimeEvent,
   type ToolRecoveryFactEnvelope,
   type WorkspaceBaselineAuthorityInput,
 } from '@maka/core';
+import { createRuntimeBoundaryCursor, runtimePrefixSegment } from '@maka/core/runtime-boundary';
 import { createSqliteRuntimeStore } from '../../sqlite-runtime-store.js';
 import { acquireOperationalStateDatabase } from '../../operational-state-store.js';
 import {
diff --git a/packages/storage/src/__tests__/recovery-persistence-authority.test.ts b/packages/storage/src/__tests__/recovery-persistence-authority.test.ts
index 0c3db58d1f..50a4e95875 100644
--- a/packages/storage/src/__tests__/recovery-persistence-authority.test.ts
+++ b/packages/storage/src/__tests__/recovery-persistence-authority.test.ts
@@ -4,11 +4,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { describe, it } from 'node:test';
-import {
-  TOOL_RECOVERY_BUNDLE_CAPABILITY_V1,
-  canonicalToolArgsHash,
-  type RuntimeEvent,
-} from '@maka/core';
+import { TOOL_RECOVERY_BUNDLE_CAPABILITY_V1, type RuntimeEvent } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import { createSqliteRuntimeStore } from '../sqlite-runtime-store.js';
 import type { SqliteRuntimeStoreFailpoint } from '../sqlite-runtime-store.js';
 
diff --git a/packages/storage/src/__tests__/sqlite-recovery-concurrency.test.ts b/packages/storage/src/__tests__/sqlite-recovery-concurrency.test.ts
index 3474864f5c..028118d2b2 100644
--- a/packages/storage/src/__tests__/sqlite-recovery-concurrency.test.ts
+++ b/packages/storage/src/__tests__/sqlite-recovery-concurrency.test.ts
@@ -7,7 +7,9 @@ import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { describe, it } from 'node:test';
 import { fileURLToPath } from 'node:url';
-import { canonicalToolArgsHash, scanToolLedger, type RuntimeEvent } from '@maka/core';
+import type { RuntimeEvent } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
+import { scanToolLedger } from '@maka/core/tool-ledger-scanner';
 import {
   SQLITE_RUNTIME_SCHEMA_VERSION,
   createSqliteRuntimeStore,
diff --git a/packages/storage/src/__tests__/sqlite-runtime-crash.test.ts b/packages/storage/src/__tests__/sqlite-runtime-crash.test.ts
index 59a29c8ae9..487ce03214 100644
--- a/packages/storage/src/__tests__/sqlite-runtime-crash.test.ts
+++ b/packages/storage/src/__tests__/sqlite-runtime-crash.test.ts
@@ -6,11 +6,8 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, it } from 'node:test';
 import { fileURLToPath } from 'node:url';
-import {
-  canonicalToolArgsHash,
-  type RuntimeEvent,
-  type WorkspaceBaselineAuthorityInput,
-} from '@maka/core';
+import { type RuntimeEvent, type WorkspaceBaselineAuthorityInput } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import {
   createSqliteRuntimeStore,
   type SqliteRuntimeStoreFailpoint,
diff --git a/packages/storage/src/__tests__/sqlite-runtime-store.test.ts b/packages/storage/src/__tests__/sqlite-runtime-store.test.ts
index c24e1a38ae..14b2a75008 100644
--- a/packages/storage/src/__tests__/sqlite-runtime-store.test.ts
+++ b/packages/storage/src/__tests__/sqlite-runtime-store.test.ts
@@ -4,17 +4,19 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 import { describe, it } from 'node:test';
+import type { RuntimeEvent } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import {
   buildImmutableRuntimePrefix,
-  canonicalToolArgsHash,
   createRuntimeBoundaryCursor,
   runtimePrefixSegment,
-  ToolLedgerCorruptionError,
-  ToolLedgerRejectionError,
   type ContinuationClaimV1,
   type ImmutableRuntimePrefixV1,
-  type RuntimeEvent,
-} from '@maka/core';
+} from '@maka/core/runtime-boundary';
+import {
+  ToolLedgerCorruptionError,
+  ToolLedgerRejectionError,
+} from '@maka/core/tool-ledger-scanner';
 import {
   SQLITE_RUNTIME_SCHEMA_VERSION,
   createSqliteRuntimeStore,
diff --git a/packages/storage/src/__tests__/workspace-version-authority-persistence.test.ts b/packages/storage/src/__tests__/workspace-version-authority-persistence.test.ts
index ad3d32cc22..7436c2864e 100644
--- a/packages/storage/src/__tests__/workspace-version-authority-persistence.test.ts
+++ b/packages/storage/src/__tests__/workspace-version-authority-persistence.test.ts
@@ -7,11 +7,11 @@ import { describe, it } from 'node:test';
 import {
   WORKSPACE_AUTHORITY_SESSION_ID,
   buildWorkspaceBaselineAuthorityEvents,
-  canonicalToolArgsHash,
   workspaceAuthorityIdentity,
   type RuntimeEvent,
   type WorkspaceBaselineAuthorityInput,
 } from '@maka/core';
+import { canonicalToolArgsHash } from '@maka/core/tool-args-identity';
 import { createConversationOperationalStateStore } from '../conversation-operational-state.js';
 import {
   createSqliteRuntimeStore,
diff --git a/packages/storage/src/agent-run-store.ts b/packages/storage/src/agent-run-store.ts
index ef8375d344..4b193580df 100644
--- a/packages/storage/src/agent-run-store.ts
+++ b/packages/storage/src/agent-run-store.ts
@@ -24,15 +24,11 @@ import {
   aggregateMessageContents,
   decodeAgentGraphIntentClaim,
   decodeMessageContent,
-  encodeCanonicalRuntimeEvent,
   isCanonicalAttachmentRef,
   isTerminalRuntimeEvent,
   MAX_ATTACHMENT_BYTES,
   MAX_ATTACHMENT_COUNT,
   messageContentsEqual,
-  scanToolLedger,
-  validateGenericToolLedgerAppend,
-  validateToolLedgerTransition,
   type AgentRunEvent,
   type AgentRunEventType,
   type AgentRunHeader,
@@ -44,11 +40,17 @@ import {
   type RuntimeEvent,
   type RuntimeEventStore,
 } from '@maka/core';
+import { encodeCanonicalRuntimeEvent } from '@maka/core/canonical-runtime-event';
 import {
   isOrchestrationMode,
   isTurnOrchestrationSource,
   type TurnOrchestration,
 } from '@maka/core/orchestration';
+import {
+  scanToolLedger,
+  validateGenericToolLedgerAppend,
+  validateToolLedgerTransition,
+} from '@maka/core/tool-ledger-scanner';
 
 const SAFE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 export const ROOT_TURN_ADMISSION_SCHEMA_VERSION = 1 as const;
diff --git a/packages/storage/src/sqlite-runtime-store.ts b/packages/storage/src/sqlite-runtime-store.ts
index 5d0ca71d43..f1d5fbb116 100644
--- a/packages/storage/src/sqlite-runtime-store.ts
+++ b/packages/storage/src/sqlite-runtime-store.ts
@@ -5,33 +5,19 @@ import { dirname } from 'node:path';
 import type { DatabaseSync, SQLInputValue } from 'node:sqlite';
 import { isDeepStrictEqual } from 'node:util';
 import {
-  canonicalToolArgsHash,
   buildWorkspaceBaselineAuthorityEvents,
-  buildImmutableRuntimePrefix,
-  decodeContinuationClaim,
   decodeRuntimeEvent,
-  encodeCanonicalRuntimeEvent,
   isPartialRuntimeEvent,
   isTerminalRuntimeEvent,
   RUNTIME_CONTINUATION_AUTHORITY_V1,
   scanWorkspaceBaselineAuthority,
-  scanToolLedger,
-  stableJsonStringify,
   TOOL_BOUNDARY_PROTOCOL_V1,
   TOOL_RECOVERY_BUNDLE_CAPABILITY_V1,
-  ToolLedgerCorruptionError,
-  ToolLedgerRejectionError,
   WORKSPACE_AUTHORITY_SESSION_ID,
   WORKSPACE_VERSION_AUTHORITY_CAPABILITY_V1,
-  validateGenericToolLedgerAppend,
-  validateToolLedgerEventLane,
-  validateToolLedgerTransition,
   type ContinuationClaimResult,
   type ContinuationClaimStateV1,
-  type ContinuationClaimV1,
   type RuntimeEvent,
-  type ImmutableRuntimePrefixV1,
-  type RuntimeBoundaryDigest,
   type RuntimeContinuationAuthorityStore,
   type RuntimeRecoveryBundleCommit,
   type RuntimeRecoveryBundleStore,
@@ -47,6 +33,23 @@ import {
   type WorkspaceProjectionRebuildResult,
   type WorkspaceVersionRecordV1,
 } from '@maka/core';
+import { canonicalToolArgsHash, stableJsonStringify } from '@maka/core/tool-args-identity';
+import { encodeCanonicalRuntimeEvent } from '@maka/core/canonical-runtime-event';
+import {
+  scanToolLedger,
+  ToolLedgerCorruptionError,
+  ToolLedgerRejectionError,
+  validateGenericToolLedgerAppend,
+  validateToolLedgerEventLane,
+  validateToolLedgerTransition,
+} from '@maka/core/tool-ledger-scanner';
+import {
+  buildImmutableRuntimePrefix,
+  decodeContinuationClaim,
+  type ContinuationClaimV1,
+  type ImmutableRuntimePrefixV1,
+  type RuntimeBoundaryDigest,
+} from '@maka/core/runtime-boundary';
 import {
   assertToolRecoveryEventBundle,
   interpretScannedToolRecovery,