@sema-agent/core 5.48.0 → 5.50.0

package/CHANGELOG.md

@@ -1,5 +1,117 @@
 # Changelog
 
+## 5.50.0 — 2026-08-21
+
+### Added
+- **`RunnerDeps.mcpRevocations`** (design/338, the #322 batch-3 hook — mid-turn MCP revocation):
+  the host's revocation ledger, probed synchronously at every MCP dispatch (tool call + the three
+  resource tools) BEFORE the transport. A revoked server's call settles as the coded refusal
+  `mcp.server_revoked` with known-not-executed wording; the ledger is live (revoke/un-revoke take
+  effect on the very next call, no engine-side caching); a throwing probe fails OPEN with a
+  once-per-run `mcp.revocation_probe_failed` notice. Absent seat = pre-338 semantics.
+- **Machine-readable refusal codes on the wire**: `delegation.concurrency_cap`,
+  `delegation.session_cap` and `mcp.server_revoked` now carry a `details.code` twin beside
+  `details.error` (same value; the wire errorCode lift reads `code`) — tool_end frames for these
+  refusals become classifiable. `HarvestRejectionCode` gains `"deferred"` (additive).
+- Conformance clauses **31 → 34**: the hold×applyPatches protocol (hold-unaware plain write /
+  release-replay CAS conflict carrying currentRev / snapshot faces tracking the post-UPDATE tuple)
+  and the whitewash-precedence UPDATE spelling. `MemorySessionHandle` gains a keyset gate
+  (machine face for consumer obligations).
+
+### Fixed
+- **Workflow mount batch** (merged-scan FAM-3): a generic own-nullish merger
+  (`overlayWorktreeBaseline`) replaces the per-key drop list — an overlay's own-undefined keys no
+  longer erase base governance (excludeTools/deferTools/toolPolicy/shellGate/…); new keys are safe
+  by construction (`checkpointStore: null` is the one registered exception). Host tighten-only
+  clamps (`handsReadOnly:true` / `interactiveTools:false`) now ride into workflow children at the
+  same injection point as the read-face clamp — a clamped host's workflow child can no longer
+  unclamp itself.
+- **Brain effort batch** (FAM-4): the effective-reasoning verdict is minted at the single point
+  that writes the wire and echoed back (three single-sources: the carried predicate, the wire
+  value mint, the declared-levels shape gate) — a garbled tier (`thinking:"hgih"`) now reports the
+  same fact the wire shows instead of a clamped-to-minimal or echo-garbage lie; the anthropic
+  budget arm reports its cap-wins drop; truthy non-array effortLevels no longer throw at request
+  construction. Per-call headers are case-fold deduplicated (`X-Tenant` + `x-tenant` no longer
+  ride the wire as two entries; auth carriers exempt as pinned).
+- **Memory projection write-back debt** (#366 root fix): a committed entry whose id write-back to
+  the projection file failed is now a durable DEBT row (`projection-debts.json`, write-ahead
+  staged across all four mint lanes) — the next harvest validates and re-binds the id-less file to
+  its committed identity instead of re-adopting it as a duplicate; stale rows drop, unvalidatable
+  rows defer fail-closed. The old silent swallow is loud in both directions.
+- The durable reap drops the stale terminal in-process handle after a winning row delete (#361) —
+  inside the reap-to-restart window a same-process SendMessage answered the pre-deletion "not
+  retained" text while a fresh process answered the honest no-transcript form.
+- Delegation entry ledgers get a lifecycle (reap anchor + amortized sweep) — one Map entry per
+  (scope, rootSessionId) no longer accumulates for the life of the process.
+
+### Notes
+- Conformance 31→34 is a tightening for backend implementers (a hold-unaware backend fails the
+  new cases; upgrade-order duty as before). Everything else is additive or a narrowing inside
+  existing coded families; no BREAKING changes.
+
+## 5.49.0 — 2026-08-20
+
+### Added
+- **`Runner.swapModels({models, tiers?})`** — the model-catalog hot-generation seat: switching
+  models is now a zero-restart operation. Atomic (the candidate is tier-expanded and validated
+  first; a failed swap leaves the current generation byte-identical); in-flight tasks finish on
+  their prepare-resolved models (natural snapshot — documented divergence window = exactly the
+  in-flight lifetime); `tiers` omitted keeps current bindings re-applied over the new models.
+  Announced via `config.models_swapped` (key counts only). Consumers: a deployment that deferred
+  model-catalog changes to a process restart can retire that arm.
+- design/337 (escalation/advisor mode) — the strategy repository becomes real cross-session
+  infrastructure:
+  - **`FileStrategyStore`** (persistence twin; per-strategy files under hashed scope dirs, atomic
+    writes, corrupt-entry quarantine, read-side hardening incl. symlink refusal and byte-bounded
+    reads) aggregated as `FileStorageBackend.strategyStore`.
+  - **CJK retrieval fixed**: term extraction shares the memory tokenizer (alnum runs + CJK
+    bigrams/unigrams) — a pure-CJK strategy was stored but never retrievable; old hits preserved
+    via a legacy acceptance arm.
+  - `TeacherRunResult.strategiesInjected` (id-level injection audit); store faults contained
+    (an optimization's failure no longer kills the run; disclosed via
+    `TeacherConfig.onStrategyStoreIncident`); injected strategies ride inside the untrusted
+    fence; write-side validation doors (`strategy.entry_invalid`); `seedStrategies` two-phase
+    batch install. Export surface +7, additive.
+- Conformance clause 31: an AMBIGUOUS origin representation (disagreeing carriers) is refused on
+  add and update by every backend; agreeing multi-carrier shapes stay legal (the refusal keys on
+  disagreement — serialization closure). The bundled File backend already refused; the clause is
+  the machine face proving all backends answer alike, and it caught the reference template
+  lacking the refusal the moment it landed (template fixed in the same commit).
+
+### Fixed
+- A 13-finding memory-engine hardening batch (post-release scan of the 5.47 window; all
+  externally disclosed):
+  - **Dual-root deployments regain the hold-notice family**: `mergeHarvestReports` now merges
+    `HarvestReport.containment` (booleans OR, lists concatenated) — under a two-plane scope
+    contract the entire `memory.hold_*` family and the index-rollback announce arm were
+    structurally unreachable.
+  - Hold lifecycle: a refused instruction intake finalizes its row (no resurrection by
+    reconciliation); a failed expired-hold release announces once and consumes its verdict
+    (generation-keyed — no infinite re-fire); disposal reporting rides the one signal path.
+  - Origin clearance: a foreign deletion is no longer read as "our tombstone committed"
+    (`tombstonedAt` sidecar; bare absence refuses with custody retained); a concurrent on-disk
+    edit is not overwritten by the clearance re-record (divergence guard, byte-equality
+    exemption for pristine projections); a challenged entry cannot be washed through the resume
+    path.
+  - Read side: the recall-taint judge accepts the Read tool's `path` argument spelling; the
+    marked-projection index drop judges path tokens per occurrence (an innocent clean entry
+    whose name merely contains a marked path no longer over-drops); a read-only plane under
+    carry injects the treated index text; index-drop rewrites are announced when they land.
+  - The opaque handle/search rows no longer carry a model-authored entry id verbatim (digest
+    re-mint on marked commits; the passive-face zero-model-text contract now holds).
+  - `memory_search`'s header states band order truthfully on mixed-band pages (single-band and
+    off pages byte-identical).
+- The transcript-integrity notice keys its once-latch by (scope, handle) and carries `scope` in
+  the detail — multi-tenant attribution without reverse lookup.
+
+### Notes
+- Behavior narrowings (all refusals in existing coded families, disclosed): clearEntryOrigin
+  gains three refusals (divergence / bare-absence / challenged-resume); marked adds do not adopt
+  model-supplied ids; a failed expired-hold release stops re-firing after one loud announcement;
+  refused intakes finalize. Two optional sidecar row members (`OriginClearanceRow.tombstonedAt`,
+  `HoldRow.resolvedAt`) — strict coercers accept old rows. No BREAKING changes; no export
+  removals.
+
 ## 5.48.0 — 2026-08-20
 
 ### Added

package/dist/agents/agent-transcript-tool.d.ts

@@ -31,7 +31,7 @@ export interface AgentTranscriptToolOptions {
     /** Subagent transcript persistence — the declared-durability integrity-gap disclosure sink (see
      *  the SendMessage twin): a durable row with a bound sessionId whose session store attests
      *  not_found. Announced once per (handle, process); absent ⇒ the honest per-call degrade alone. */
-    onTranscriptIntegrityGap?: (handle: string) => void;
+    onTranscriptIntegrityGap?: (handle: string, scope: string | undefined) => void;
 }
 /**
  * Residual observability (lane C) — build the MODEL-VISIBLE **AgentTranscript** tool: read the last N tool steps of a

package/dist/agents/agent-transcript-tool.js

@@ -64,7 +64,7 @@ export function createAgentTranscriptTool(opts) {
                 }
                 catch (e) {
                     if (e?.code === "not_found") {
-                        announceTranscriptIntegrityGapOnce(id, opts.onTranscriptIntegrityGap);
+                        announceTranscriptIntegrityGapOnce(id, access.scope, opts.onTranscriptIntegrityGap);
                     }
                     return undefined;
                 }

package/dist/agents/roster-store.js

@@ -110,7 +110,10 @@ export class FileRosterStore {
         if (text.trim() === "")
             return [];
         try {
-            const raw = JSON.parse(text);
+            const rawU = JSON.parse(text);
+            if (typeof rawU !== "object" || rawU === null)
+                throw new Error("roster file: not a JSON object");
+            const raw = rawU;
             if (!Array.isArray(raw.entries))
                 throw new Error("roster file: entries is not an array");
             const kept = raw.entries.filter((e) => typeof e === "object" && e !== null && typeof e.name === "string" && typeof e.agentId === "string" && typeof e.createdAt === "number");

package/dist/agents/send-message-tool.d.ts

@@ -128,12 +128,12 @@ export interface SendMessageToolOptions {
     uplinkRecipient?: PeerSelfRef;
     /**
      * Subagent transcript persistence — the "declared durability contradicted by reality" disclosure
-     * sink: called (at most once per handle per process, {@link announceTranscriptIntegrityGapOnce})
+     * sink: called (at most once per (scope, handle) per process, {@link announceTranscriptIntegrityGapOnce})
      * when a durable row with a bound sessionId meets a session store that attests `not_found`. The
      * first-party mount wires an EngineNotice (`delegation.transcript_integrity`); absent ⇒ the
      * per-call honest refusal is the only loudness (unchanged behavior).
      */
-    onTranscriptIntegrityGap?: (handle: string) => void;
+    onTranscriptIntegrityGap?: (handle: string, scope: string | undefined) => void;
 }
 /** RB-382 — max chars of the `summary` arg (the short recap label, distinct from `message`'s much
  *  larger {@link UPLINK_RESULT_MAX}) before ITS OWN truncation. Exported for direct unit-testing only

package/dist/agents/send-message-tool.js

@@ -292,7 +292,7 @@ export function createSendMessageTool(opts) {
                         catch (e) {
                             await rollbackDrain();
                             if (e?.code === "not_found") {
-                                announceTranscriptIntegrityGapOnce(handle, opts.onTranscriptIntegrityGap);
+                                announceTranscriptIntegrityGapOnce(handle, scope, opts.onTranscriptIntegrityGap);
                                 return queueFullReceipt(`No transcript found for agent ${handle}, so a revival cannot drain the backlog.`);
                             }
                             return queueFullReceipt(`Its transcript store did not answer (${e instanceof Error ? e.message : String(e)}) — this send did not start a backlog drain; a later resend will try again.`);
@@ -391,7 +391,7 @@ export function createSendMessageTool(opts) {
                     catch (e) {
                         await rollback();
                         if (e?.code === "not_found") {
-                            announceTranscriptIntegrityGapOnce(handle, opts.onTranscriptIntegrityGap);
+                            announceTranscriptIntegrityGapOnce(handle, scope, opts.onTranscriptIntegrityGap);
                             return {
                                 content: `Message not sent: no transcript found for agent ${handle} — it cannot be revived. Launch a new agent with the needed context instead.`,
                                 details: { error: "resume.session_not_found", to },

package/dist/agents/subagent.d.ts

@@ -484,6 +484,12 @@ export declare function resolveDelegationEntryCaps(caps: {
     maxConcurrent?: number;
     maxCumulativePerSession?: number;
 } | undefined): ResolvedDelegationEntryCaps;
+/** @internal — observability seam for the lifecycle pins (tests only; never a public surface):
+ *  the ledger footprint of one registry. */
+export declare function delegationEntryLedgerFootprint(registry: object): {
+    keys: number;
+    handles: number;
+};
 /**
  * Options for {@link createSubagentTool}.
  *

package/dist/agents/subagent.js

@@ -1,6 +1,7 @@
 import { Type } from "typebox";
 import { isAbsolute } from "node:path";
 import { withDelegationProvenance } from "../core/tool-policy.js";
+import { errorResult } from "../core/tools.js";
 import { isHighSurrogate, isLowSurrogate } from "../core/surrogate-safe-slice.js";
 import { newDelegationProvenanceAggregate, reduceDelegationAttestation } from "../core/memory-engine/delegation-provenance.js";
 import { registerDelegationLaunch, replayExternalSettlementEffects, settleDelegation } from "../core/memory-engine/delegation-settlement.js";
@@ -912,6 +913,125 @@ function delegationEntryLedger(registry, key) {
     }
     return set;
 }
+const delegationLedgerLifecycles = new WeakMap();
+const delegationLedgerKeyStores = new WeakMap();
+function bindDelegationLedgerKeyStore(registry, key, store) {
+    let byKey = delegationLedgerKeyStores.get(registry);
+    if (byKey === undefined) {
+        byKey = new Map();
+        delegationLedgerKeyStores.set(registry, byKey);
+    }
+    if (byKey.get(key) === null)
+        return;
+    byKey.set(key, store ?? null);
+}
+async function sweepDelegationEntryLedgerKeys(registry, keys) {
+    const byKey = delegationEntryLedgers.get(registry);
+    if (byKey === undefined)
+        return;
+    const keyStores = delegationLedgerKeyStores.get(registry);
+    const activeFace = registry.activeDelegationHandles;
+    if (typeof activeFace !== "function")
+        return;
+    for (const key of keys) {
+        const set = byKey.get(key);
+        if (set === undefined)
+            continue;
+        const store = keyStores?.get(key);
+        if (store === undefined || store === null)
+            continue;
+        let scopeK;
+        let rootK;
+        try {
+            const parsed = JSON.parse(key);
+            if (!Array.isArray(parsed) || typeof parsed[0] !== "string" || typeof parsed[1] !== "string")
+                continue;
+            scopeK = parsed[0];
+            rootK = parsed[1];
+        }
+        catch {
+            continue;
+        }
+        if (activeFace.call(registry, scopeK, rootK).length > 0)
+            continue;
+        const sizeBefore = set.size;
+        let stored;
+        try {
+            stored = (await store.listBySession(scopeK, rootK)).map((r) => r.handle);
+        }
+        catch {
+            continue;
+        }
+        if (byKey.get(key) !== set || set.size !== sizeBefore || activeFace.call(registry, scopeK, rootK).length > 0)
+            continue;
+        if (stored.length === 0) {
+            byKey.delete(key);
+            keyStores?.delete(key);
+            continue;
+        }
+        const keep = new Set(stored);
+        for (const h of [...set])
+            if (!keep.has(h))
+                set.delete(h);
+        if (set.size === 0) {
+            byKey.delete(key);
+            keyStores?.delete(key);
+        }
+    }
+}
+function armDelegationLedgerLifecycle(registry) {
+    let life = delegationLedgerLifecycles.get(registry);
+    if (life === undefined) {
+        life = { cursor: 0, subscribed: false };
+        delegationLedgerLifecycles.set(registry, life);
+    }
+    if (life.subscribed)
+        return;
+    const reapFace = registry.onSessionReap;
+    if (typeof reapFace !== "function")
+        return;
+    life.subscribed = true;
+    reapFace.call(registry, (sessionId, scope) => {
+        const byKey = delegationEntryLedgers.get(registry);
+        if (byKey === undefined)
+            return;
+        const keys = [...byKey.keys()].filter((k) => {
+            try {
+                const parsed = JSON.parse(k);
+                if (!Array.isArray(parsed) || typeof parsed[0] !== "string" || typeof parsed[1] !== "string")
+                    return false;
+                return parsed[1] === sessionId && (scope === undefined || parsed[0] === scope);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (keys.length > 0)
+            void sweepDelegationEntryLedgerKeys(registry, keys).catch(() => undefined);
+    });
+}
+function sweepDelegationLedgerRound(registry, n) {
+    const life = delegationLedgerLifecycles.get(registry);
+    const byKey = delegationEntryLedgers.get(registry);
+    if (life === undefined || byKey === undefined || byKey.size === 0)
+        return;
+    const keys = [...byKey.keys()];
+    const start = life.cursor % keys.length;
+    const slice = [];
+    for (let i = 0; i < Math.min(n, keys.length); i++)
+        slice.push(keys[(start + i) % keys.length]);
+    life.cursor = (start + slice.length) % keys.length;
+    void sweepDelegationEntryLedgerKeys(registry, slice).catch(() => undefined);
+}
+export function delegationEntryLedgerFootprint(registry) {
+    const byKey = delegationEntryLedgers.get(registry);
+    if (byKey === undefined)
+        return { keys: 0, handles: 0 };
+    let handles = 0;
+    for (const s of byKey.values())
+        handles += s.size;
+    return { keys: byKey.size, handles };
+}
 export function normalizeSubagentType(value) {
     return value.normalize("NFKC").toLowerCase().replace(/[\p{White_Space}\p{Pd}_]+/gu, "");
 }
@@ -2491,7 +2611,7 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                         dropHostAbortListener();
                         await cancelObserver();
                         const wt = await finishWorktree();
-                        return { isError: true, content: `Sub-agent not started in background: ${text}${wt ? `\n${wt}` : ""}`, details: { error: code } };
+                        return errorResult(`Sub-agent not started in background: ${text}${wt ? `\n${wt}` : ""}`, { error: code, code });
                     };
                     const activeFace = bg.registry.activeDelegationHandles;
                     const active = typeof activeFace === "function" ? activeFace.call(bg.registry, capScope, capRoot) : [];
@@ -2640,6 +2760,11 @@ function createSubagentToolNode(opts, depth, excluded, extraToolsBudget) {
                 }
                 if (capLedgerKey !== undefined && reviveRow === undefined)
                     delegationEntryLedger(bg.registry, capLedgerKey).add(taskId);
+                if (capLedgerKey !== undefined) {
+                    bindDelegationLedgerKeyStore(bg.registry, capLedgerKey, bg.agentStore);
+                    armDelegationLedgerLifecycle(bg.registry);
+                    sweepDelegationLedgerRound(bg.registry, 3);
+                }
                 childInternals.peerSelfRef?.addAxis("h", taskId);
                 if (agentName !== undefined) {
                     recordRosterSpawn(ctx.roster, { name: agentName, agentId: taskId, toolUseId: ctx.toolCallId, owner: bgOwner, scope: bgScope, ...((typeof childModel === "string" ? resolveModelDisplayLabel(childModel) : childModel?.id) !== undefined ? { model: typeof childModel === "string" ? childModel : childModel?.id } : {}), ...(reviveRow !== undefined ? ((reviveRow.rootSessionId ?? reviveRow.parentSessionId) !== undefined ? { rootSessionId: reviveRow.rootSessionId ?? reviveRow.parentSessionId } : {}) : (ctx.rootSessionId ?? ctx.sessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? ctx.sessionId } : {}), ...(sessionScopedBg ? { sessionScoped: true } : {}), createdAt: reviveRow?.spawnedAt ?? Date.now() }, (err) => opts.onObserverError?.(err, { site: "roster.recordSpawn" }));

package/dist/agents/teacher.d.ts

@@ -1,5 +1,5 @@
 import type { Runner } from "../core/runner/runtask.js";
-import type { StrategyStore } from "../core/strategy-store.js";
+import { type StrategyOrigin, type StrategyStore, type StrategyStoreIncident } from "../core/strategy-store.js";
 import type { ModelRef, TaskResult, TaskSpec } from "../core/types.js";
 /**
  * Teacher mode (escalation cascade): a cheap "student" does the work; a strong "teacher" is consulted
@@ -85,6 +85,17 @@ export interface TeacherConfig {
     minConfidenceToStore?: number;
     /** Inject retrieved strategies into the objective. Default true when a store+scope are set. */
     injectStrategies?: boolean;
+    /**
+     * Disclosure sink for a strategy-store failure this loop CONTAINED (store-fault containment): a
+     * `find` that failed injects nothing, a `save` that failed stores nothing — neither ever fails the
+     * task (the repository is an optimization; an optimization's fault must not kill the work it was
+     * optimizing) — but each is disclosed here so a broken store is discoverable. The one exception
+     * stays loud: an error carrying a `config.`-prefixed code (an illegal `retrieveK` etc.) is a
+     * PROGRAMMER error and rethrows — containing it would silence the validation door entirely.
+     * Callback faults are themselves contained (safe-notify posture); absent ⇒ `console.warn`, once
+     * per op kind.
+     */
+    onStrategyStoreIncident?: (i: StrategyStoreIncident) => void;
 }
 export type EscalationTrigger = "stuck" | "blocked" | "failed" | "verify-fail";
 export interface TeacherAdvice {
@@ -105,6 +116,19 @@ export interface EscalationRecord {
 export interface TeacherRunResult extends TaskResult {
     /** Escalations that occurred during this run (empty if the student succeeded alone). */
     escalations: EscalationRecord[];
+    /**
+     * Audit trail of the strategies retrieved into the student's objective for THIS run — id-level (the
+     * text is not copied; the id is the join key into the store), with each entry's stored timestamp and
+     * provenance stamp. Lets a host connect "what was injected" to "how the run ended" offline, which is
+     * the only way retrieval-induced degradation is ever measurable. PRESENT iff ≥1 strategy was
+     * injected; ABSENT means no store was configured, injection was disabled, retrieval matched nothing,
+     * or the find failed (a failure additionally raises `onStrategyStoreIncident`).
+     */
+    strategiesInjected?: Array<{
+        id: string;
+        ts: string;
+        origin?: StrategyOrigin;
+    }>;
     /** Usage spent on the teacher (advisor), separate from the student's `stats` (which includes the
      *  cheap helper monitor/verifier calls). `tasks` = teacher runs (escalation asks + any takeover).
      *  `humanReview` = the HITL-gate burden of the teacher's runs (notably a takeover that hit an approval

package/dist/agents/teacher.js

@@ -1,4 +1,6 @@
 import { randomUUID } from "node:crypto";
+import { MAX_STRATEGY_INJECTION_TOTAL_BYTES, MAX_STRATEGY_PROBLEM_BYTES, MAX_STRATEGY_TEXT_BYTES } from "../core/strategy-store.js";
+import { createSafeNotifier, observeThenableRejection } from "../core/safe-notify.js";
 import { mapNestedSuspend, isDurablePause } from "./suspend-guard.js";
 import { isDefineToolProduct, stampDefineToolBrand } from "../core/tools.js";
 import { delimitUntrusted, inlineUntrusted } from "../core/untrusted-text.js";
@@ -29,7 +31,10 @@ export function parseTeacherAdvice(text) {
     const end = text.lastIndexOf("}");
     if (start !== -1 && end > start) {
         try {
-            const o = JSON.parse(text.slice(start, end + 1));
+            const oU = JSON.parse(text.slice(start, end + 1));
+            if (typeof oU !== "object" || oU === null)
+                throw new Error("not an object");
+            const o = oU;
             return {
                 strategy: typeof o.strategy === "string" ? o.strategy : undefined,
                 correction: typeof o.correction === "string" ? o.correction : undefined,
@@ -46,31 +51,102 @@ export function parseTeacherAdvice(text) {
 export async function runWithTeacher(runner, studentSpec, teacher = {}) {
     const store = teacher.strategyStore;
     const scope = teacher.scope;
+    const incidentNotifier = createSafeNotifier();
+    const warnedIncidentOps = new Set();
+    const discloseStoreIncident = (i) => {
+        const seat = teacher.onStrategyStoreIncident;
+        if (seat) {
+            const site = `teacher.onStrategyStoreIncident.${i.op}`;
+            incidentNotifier.notify(() => observeThenableRejection(seat(i), incidentNotifier, site), site);
+        }
+        else if (!warnedIncidentOps.has(i.op)) {
+            warnedIncidentOps.add(i.op);
+            console.warn(`runWithTeacher: strategy store ${i.op} failed (contained — the run continues): ${i.error}`);
+        }
+    };
+    const isConfigCoded = (e) => typeof e?.code === "string" && (e.code).startsWith("config.");
     let spec = studentSpec;
+    let injected;
     if (store && scope && teacher.injectStrategies !== false) {
-        const found = await store.find(scope, studentSpec.objective, teacher.retrieveK ?? 3);
+        let found = [];
+        try {
+            const raw = await store.find(scope, studentSpec.objective, teacher.retrieveK ?? 3);
+            if (!Array.isArray(raw)) {
+                discloseStoreIncident({ op: "find", error: "store.find returned a non-array result — injecting nothing" });
+            }
+            else {
+                let dropped = 0;
+                for (const e of raw) {
+                    const c = e;
+                    const id = c?.id;
+                    const ts = c?.ts;
+                    const strategy = c?.strategy;
+                    if (typeof id !== "string" || typeof ts !== "string" || typeof strategy !== "string") {
+                        dropped++;
+                        continue;
+                    }
+                    const origin = c?.origin;
+                    found.push({ id, ts, strategy, ...(origin === "earned" || origin === "seeded" ? { origin } : {}) });
+                }
+                if (dropped > 0) {
+                    discloseStoreIncident({ op: "find", error: `${dropped} malformed retrieval entries dropped (id/ts/strategy must be strings)` });
+                }
+            }
+        }
+        catch (e) {
+            if (isConfigCoded(e))
+                throw e;
+            discloseStoreIncident({ op: "find", error: String(e?.message ?? e) });
+            found = [];
+        }
+        let budget = 0;
+        for (let i = 0; i < found.length; i++) {
+            budget += Buffer.byteLength(found[i].strategy, "utf8");
+            if (budget > MAX_STRATEGY_INJECTION_TOTAL_BYTES) {
+                discloseStoreIncident({
+                    op: "find",
+                    error: `injection truncated to ${i} of ${found.length} retrieved strategies — combined text exceeded ${MAX_STRATEGY_INJECTION_TOTAL_BYTES} bytes`,
+                });
+                found = found.slice(0, i);
+                break;
+            }
+        }
         if (found.length > 0) {
             const block = `[STRATEGIES from PAST, DIFFERENT tasks — they may NOT apply. If unsure, IGNORE them and proceed normally.]\n` +
-                found.map((s) => `- ${s.strategy}`).join("\n");
+                delimitUntrusted("PAST STRATEGIES (from DIFFERENT tasks; may NOT apply — verify before use)", found.map((s) => `- ${s.strategy}`).join("\n"));
             spec = { ...studentSpec, objective: `${block}\n\n${studentSpec.objective}` };
+            injected = found.map((s) => ({ id: s.id, ts: s.ts, ...(s.origin !== undefined ? { origin: s.origin } : {}) }));
         }
     }
     const result = await runTeacherCore(runner, spec, teacher);
     if (store && scope && result.status === "completed" && result.escalations.length > 0) {
         const advice = result.escalations[result.escalations.length - 1].teacher;
         if (advice.strategy && advice.confidence >= (teacher.minConfidenceToStore ?? 2)) {
-            await store.save({
-                id: randomUUID(),
-                problem: studentSpec.objective,
-                strategy: advice.strategy,
-                confidence: advice.confidence,
-                scope,
-                ts: new Date().toISOString(),
-                teacherModel: typeof teacher.model === "string" ? teacher.model : teacher.model?.id,
-            });
+            try {
+                const clip = (text, maxBytes) => {
+                    let out = text;
+                    while (Buffer.byteLength(out) > maxBytes)
+                        out = out.slice(0, -1);
+                    return out;
+                };
+                await store.save({
+                    id: randomUUID(),
+                    problem: clip(studentSpec.objective, MAX_STRATEGY_PROBLEM_BYTES),
+                    strategy: clip(advice.strategy, MAX_STRATEGY_TEXT_BYTES),
+                    confidence: Math.min(3, Math.max(0, advice.confidence)),
+                    scope,
+                    ts: new Date().toISOString(),
+                    teacherModel: typeof teacher.model === "string" ? teacher.model : teacher.model?.id,
+                });
+            }
+            catch (e) {
+                if (isConfigCoded(e))
+                    throw e;
+                discloseStoreIncident({ op: "save", error: String(e?.message ?? e) });
+            }
         }
     }
-    return result;
+    return injected !== undefined && injected.length > 0 ? { ...result, strategiesInjected: injected } : result;
 }
 async function runTeacherCore(runner, studentSpec, teacher) {
     const maxEscalations = teacher.maxEscalations ?? 3;

package/dist/brain/anthropic.js

@@ -5,10 +5,9 @@ import { createRepetitionPoll, parseStreamedToolArgs } from "./stream-shared.js"
 import { mintFallbackToolCallId } from "./tool-call-id.js";
 import { emitBrainTelemetry } from "./status-sink.js";
 import { errorResultMediaNote, IMAGE_OMITTED_NO_VISION, modelSupportsVision, sendableImages } from "./media-degrade.js";
-import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, stripAuthHeaders } from "./request-params.js";
-import { isThinkingLevel, reasoningBudgetShare, resolveEffort } from "./reasoning.js";
+import { ANTHROPIC_RESERVED, OUTPUT_CAP_KEYS, applyExtraBody, effectiveOutputCap, lockHeader, mergeHeaders, stripAuthHeaders, takeHeaderCasefold } from "./request-params.js";
+import { MIN_THINKING_TOKENS, budgetCapSkipsThinking, declaredEffortLevels, reasoningBudgetShare, reasoningRequestCarried, resolveEffort } from "./reasoning.js";
 import { runStreamingBrain } from "./stream-engine.js";
-const MIN_THINKING_TOKENS = 1024;
 function thinkingBudget(maxTokens, share, fixed, hardCap = false) {
     const max = hardCap ? maxTokens : Math.max(maxTokens, MIN_THINKING_TOKENS * 2);
     const want = fixed ?? Math.floor(max * share);
@@ -261,13 +260,13 @@ export function createAnthropicBrain(config = {}) {
                 if (options?.temperature !== undefined && anthCompat.supportsTemperature !== false) {
                     body.temperature = options.temperature;
                 }
-                if (model.reasoning && isThinkingLevel(options?.reasoning) && options.reasoning !== "off") {
+                if (reasoningRequestCarried(model, options?.reasoning)) {
                     if (anthCompat.thinkingMode === "adaptive") {
                         body.thinking = { type: "adaptive" };
                     }
                     else {
                         const hardCap = overrides?.maxOutputTokens !== undefined || options?.maxTokens !== undefined;
-                        if (hardCap && body.max_tokens < MIN_THINKING_TOKENS * 2) {
+                        if (budgetCapSkipsThinking(body.max_tokens, hardCap)) {
                             body.thinking = undefined;
                             delete body.thinking;
                         }
@@ -283,13 +282,9 @@ export function createAnthropicBrain(config = {}) {
                 }
                 const betas = [];
                 let sendEffortBeta = false;
-                if (anthCompat.effortLevels &&
-                    anthCompat.effortLevels.length > 0 &&
-                    model.reasoning &&
-                    options?.reasoning &&
-                    options.reasoning !== "off" &&
-                    isThinkingLevel(options.reasoning)) {
-                    const { effective } = resolveEffort(options.reasoning, anthCompat.effortLevels.filter(isThinkingLevel));
+                const declaredEffort = declaredEffortLevels(anthCompat.effortLevels);
+                if (declaredEffort !== undefined && reasoningRequestCarried(model, options?.reasoning)) {
+                    const { effective } = resolveEffort(options.reasoning, declaredEffort);
                     const wireEffort = effective === "minimal" ? "low" : effective;
                     body.output_config = { effort: wireEffort };
                     sendEffortBeta = true;
@@ -303,23 +298,19 @@ export function createAnthropicBrain(config = {}) {
                 if (anthCompat.interleavedThinking) {
                     betas.push("interleaved-thinking-2025-05-14");
                 }
-                const headers = {
-                    ...model.headers,
-                    ...config.headers,
-                    ...options?.headers,
-                };
+                const headers = mergeHeaders(model.headers, config.headers, options?.headers);
                 if (options?.apiKey !== undefined)
                     stripAuthHeaders(headers);
                 if (betas.length > 0) {
-                    const existing = (headers["anthropic-beta"] ?? "").split(",").map((b) => b.trim()).filter(Boolean);
+                    const existing = (takeHeaderCasefold(headers, "anthropic-beta") ?? "").split(",").map((b) => b.trim()).filter(Boolean);
                     for (const beta of betas) {
                         if (!existing.includes(beta))
                             existing.push(beta);
                     }
                     headers["anthropic-beta"] = existing.join(",");
                 }
-                headers["content-type"] = "application/json";
-                headers["anthropic-version"] = config.version ?? "2023-06-01";
+                lockHeader(headers, "content-type", "application/json");
+                lockHeader(headers, "anthropic-version", config.version ?? "2023-06-01");
                 if (apiKey)
                     headers["x-api-key"] = apiKey;
                 const builtThinkingRequested = body.thinking !== undefined;