@sema-agent/core 7.28.1 → 7.30.0

package/dist/core/runner/run-terminal-adoption.js

@@ -1,11 +1,10 @@
 import { DEFAULT_COMPACTION_INSTRUCTIONS, maybeCompact } from "../auto-compaction.js";
-import { DEFAULT_COMPACTION_SETTINGS } from "../../internal/harness.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { emitTrace } from "../trace.js";
 import { answerSettled, errorCodeOf } from "./assemble-result.js";
 import { awaitChargeWithSlowDisclosure, discloseUnevaluableWindow } from "./clock-and-limits.js";
-import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
+import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption, legCompactionSettings, legContextOverlayOption } from "./compaction-call-options.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { compactionRestateOptions } from "./compaction-restate.js";
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
@@ -118,7 +117,7 @@ export async function runTerminalAdoption(input) {
         skipCompaction: durablyPaused || (abortedLive && settled) || compactionBreaker.failures >= MAX_CONSECUTIVE_COMPACTION_FAILURES,
         minTokens: rs.counters.compactionFloor,
         brain: compactionBrain,
-        windowSafety: windowSafetyOptions(prepared.model),
+        windowSafety: windowSafetyOptions(prepared.harness.getModel()),
         onCompactionFailed: (reason) => queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "auto", reason, ...ident() }),
         cancelled: abortedLive,
     }, runner, sessions);
@@ -132,13 +131,14 @@ async function finish(spec, prepared, opts, runner, sessions) {
                 session: prepared.session,
                 epochDeclaredSections: prepared.epochDeclaredSections,
                 ...centerAdoptionOption(prepared),
-                model: prepared.model,
+                model: prepared.harness.getModel(),
+                ...legContextOverlayOption(prepared, runner),
                 compactionModel: prepared.compModel,
                 ...forkContextOption(prepared, false),
                 brain: opts?.brain ?? runner.deps.brain,
                 getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
                 thinking: prepared.thinking,
-                settings: { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction },
+                settings: legCompactionSettings(spec, legContextOverlayOption(prepared, runner).contextOverlay),
                 customInstructions: spec.compaction?.instructions ?? DEFAULT_COMPACTION_INSTRUCTIONS,
                 minTokens: opts?.minTokens,
                 overheadTokens: prepared.promptOverheadTokens,

package/dist/core/runner/run-turn-boundary.js

@@ -1,12 +1,12 @@
+import { compactionKindOf } from "../task-notification.js";
 import { mintSystemReminder } from "../reminder-mint.js";
-import { DEFAULT_COMPACTION_SETTINGS } from "../../internal/harness.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
 import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, TOTAL_TOKENS_REMINDER_DEFAULT_MODE, attachmentEnvelopeTags, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, isIntactSource, rebaseCadenceWindows, renderAgentListingFrame, renderMcpDroppedTools, renderMcpInstructionsDelta, selectMcpDroppedBatch, renderSkillsListingFrame, renderToolsDelta } from "./turn-attachments.js";
 import { announceListingTruncation } from "../skill-listing-budget.js";
-import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
+import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption, legCompactionSettings, legContextOverlayOption } from "./compaction-call-options.js";
 import { hookSeatExpiredError, runHookSeat } from "../hooks.js";
 import { sanitizeUntrustedText, SHELLED_BODY_ENVELOPE_TAGS } from "../untrusted-text.js";
 import { droppedToolDigest, withAnnounceDigests } from "./announce-once-ledger.js";
@@ -24,7 +24,8 @@ export function createTurnBoundary(input) {
     const { prepared, stats, rs, deps } = input;
     const { spec, queue, manualCompactRef, todoToolMounted, taskToolsMounted, walltimeMonotonicDeadline, timeout, ident, postToolBatchHook, batchArgs, compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions, rapidRefill, drainManualCompact, runnerHooks, runner } = deps;
     let finalVerifySeenAtLastBoundary = 0;
-    const onTurnBoundary = async (event) => {
+    let legContinues = true;
+    const boundaryPass = async (event) => {
         let boundarySteered = false;
         const noNextRequest = () => prepared.stopRequestedRef.current || deps.loopLatch.userHalted;
         const walltimeHit = walltimeMonotonicDeadline !== undefined && performance.now() >= walltimeMonotonicDeadline;
@@ -75,6 +76,7 @@ export function createTurnBoundary(input) {
                     rs.limits.platformTerminal = asThrownError(govErr);
                     void prepared.harness.abort();
                     prepared.abortController.abort();
+                    legContinues = false;
                     return undefined;
                 }
             }
@@ -89,6 +91,7 @@ export function createTurnBoundary(input) {
             if (committed) {
                 rs.limits.turnsExceeded = false;
                 rs.limits.budgetHit = undefined;
+                legContinues = false;
                 return undefined;
             }
             const terminal = platformLimitTerminal(platformCause, platformRetryAfterMs);
@@ -100,6 +103,7 @@ export function createTurnBoundary(input) {
             }
             void prepared.harness.abort();
             prepared.abortController.abort();
+            legContinues = false;
             return undefined;
         }
         if (prepared.suspendForResource &&
@@ -123,6 +127,7 @@ export function createTurnBoundary(input) {
                 void prepared.harness.abort();
                 prepared.abortController.abort();
             }
+            legContinues = false;
             return undefined;
         }
         if (walltimeMonotonicDeadline !== undefined &&
@@ -136,6 +141,7 @@ export function createTurnBoundary(input) {
                 void prepared.harness.abort();
                 prepared.abortController.abort();
             }
+            legContinues = false;
             return undefined;
         }
         const approachCfg = spec.limits?.approachNotice;
@@ -186,6 +192,7 @@ export function createTurnBoundary(input) {
                 prepared.pausedRef.current === undefined;
             if (honorable && prepared.suspendForReview) {
                 await prepared.suspendForReview(reason);
+                legContinues = !prepared.abortController.signal.aborted && prepared.pausedRef.current === undefined;
                 return undefined;
             }
             emitTrace(rs.telemetry.tracer, () => ({ kind: "review.dropped", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
@@ -496,7 +503,7 @@ export function createTurnBoundary(input) {
             });
         }
         const forceManual = manualCompactRef.requested;
-        if ((!withinTaskCompaction && !forceManual) ||
+        if ((!withinTaskCompaction() && !forceManual) ||
             prepared.abortController.signal.aborted ||
             prepared.pausedRef.current !== undefined) {
             if (forceManual) {
@@ -504,6 +511,7 @@ export function createTurnBoundary(input) {
                 queue.push({ type: "compaction_outcome", outcome: "mooted", trigger: "manual", reason: "task_ending", ...ident() });
                 drainManualCompact("mooted");
             }
+            legContinues = !prepared.abortController.signal.aborted && prepared.pausedRef.current === undefined;
             return undefined;
         }
         if (compactionBreaker.failures >= MAX_CONSECUTIVE_COMPACTION_FAILURES) {
@@ -564,12 +572,13 @@ export function createTurnBoundary(input) {
                 epochDeclaredSections: prepared.epochDeclaredSections,
                 ...centerAdoptionOption(prepared),
                 model: event.model,
+                ...legContextOverlayOption(prepared, runner),
                 compactionModel: prepared.compModel,
                 ...forkContextOption(prepared, false),
                 brain: compactionBrain,
                 getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
                 thinking: prepared.thinking,
-                settings: { ...DEFAULT_COMPACTION_SETTINGS, ...spec.compaction },
+                settings: legCompactionSettings(spec, legContextOverlayOption(prepared, runner).contextOverlay),
                 customInstructions: manualInstructions ?? spec.compaction?.instructions ?? DEFAULT_COMPACTION_INSTRUCTIONS,
                 signal: compactionPassSignal,
                 ...(manualCancelSignal !== undefined ? { manualCancelSignal } : {}),
@@ -644,6 +653,8 @@ export function createTurnBoundary(input) {
             recordCompactionReuse(runner, prepared, comp);
             if (comp.compacted) {
                 queue.push(mintCompactedEvent(comp, passTrigger, ident()));
+                rs.counters.compactionPasses += 1;
+                rs.counters.compactionKind = compactionKindOf(passTrigger);
                 if (!forceManual && recordCompactionAndCheckRapidRefill(rapidRefill, stats.turns)) {
                     compactionBreaker.failures = MAX_CONSECUTIVE_COMPACTION_FAILURES;
                     queue.push({ type: "compaction_outcome", outcome: "disabled", trigger: passTrigger, reason: "rapid_refill: compaction disabled for the rest of this task", ...ident() });
@@ -695,5 +706,21 @@ export function createTurnBoundary(input) {
             resolveClaimedWaiters(manualOutcome);
         return undefined;
     };
+    const onTurnBoundary = async (event) => {
+        legContinues = true;
+        try {
+            return await boundaryPass(event);
+        }
+        finally {
+            const round = prepared.peerBoundaryRound;
+            if (round !== undefined) {
+                try {
+                    await round({ continues: legContinues });
+                }
+                catch {
+                }
+            }
+        }
+    };
     return onTurnBoundary;
 }

package/dist/core/runner/runtask.d.ts

@@ -4,7 +4,8 @@ import { type TaskOutcome } from "../task-outcome.js";
 import { type SwappableDeps } from "../swappable-deps.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
-import type { AgentDefinition, ModelRoles, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
+import type { AgentDefinition, ModelRef, ModelRoles, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
+import { type ContextSettings, type ContextWindowOverlay } from "../context-settings.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
 /**
@@ -77,6 +78,12 @@ export declare class Runner implements RunnerSelfSeat {
         models?: Record<string, Model>;
         roles?: ModelRoles;
     };
+    /** The deployment's per-model context-window overlay as declared ({@link RunnerDeps.contextSettings}); a fresh
+     *  read every call, the overlay objects frozen at their gate. */
+    get contextSettings(): ContextSettings | undefined;
+    /** The overlay a leg on `ref` reads RIGHT NOW — the one lookup ({@link contextOverlayFor}, tier aliases
+     *  followed) against the seat and catalog in force, so a `swapDeps` reaches legs already running. */
+    contextOverlayOf(ref: ModelRef | undefined): ContextWindowOverlay | undefined;
     /** The deployment-level gating baseline, exposed READ-ONLY so thin
      *  assemblers over the Runner (`runSpec`) can COMPOSE with it. The task-level engine semantic is a
      *  WHOLE-SLOT override (`spec.toolPolicy ?? deps.toolPolicy`, same for hooks — prepare-task), so any

package/dist/core/runner/runtask.js

@@ -21,6 +21,7 @@ import { PAUSE_REGISTRY } from "../pause-registry.js";
 import { toolPolicyNameSets } from "../tool-policy.js";
 import { PendingSessionNotifications } from "../task-notification.js";
 import { ToolDetachHub } from "../tool-detach.js";
+import { assertContextSettingsValue, assertContextSettingsWords, contextOverlayFor } from "../context-settings.js";
 import { createRunState } from "./initial-run-state.js";
 import { reconciledToolEndBody } from "./tool-end-body.js";
 import { answerFaceForRedeemedCall } from "./decide-continuation.js";
@@ -40,6 +41,7 @@ import { streamSteerVerb } from "./stream-steer-verb.js";
 import { streamLifecycleVerbs } from "./stream-lifecycle-verbs.js";
 import { streamHaltVerbs } from "./stream-halt-verbs.js";
 import { runNotificationLane } from "./run-notification-lane.js";
+import { assertNoRetiredRunnerDeps } from "./retired-runner-deps.js";
 import { runLeg } from "./run-leg.js";
 import { runTerminalAdoption } from "./run-terminal-adoption.js";
 import { runSettleAndTeardown } from "./run-settle-and-teardown.js";
@@ -69,12 +71,16 @@ export class Runner {
     static PARENT_CONSTRAINT_REGISTRY_CAP = 1024;
     depsSeat;
     constructor(deps) {
+        assertNoRetiredRunnerDeps(deps);
         const runner = this;
         this.depsSeat = { get deps() { return runner.deps; } };
         this.deps = deps;
         if (this.deps.tiers) {
             this.deps = { ...this.deps, models: expandTiers(this.deps.models, this.deps.tiers) };
         }
+        if (this.deps.contextSettings !== undefined) {
+            this.deps = { ...this.deps, contextSettings: assertContextSettingsWords(assertContextSettingsValue(this.deps.contextSettings, "RunnerDeps"), this.deps.models, "RunnerDeps") };
+        }
         if (this.deps.onError) {
             const rawOnError = this.deps.onError;
             const reportSinkFailure = (sinkErr, context) => {
@@ -121,6 +127,12 @@ export class Runner {
             ...(this.deps.models ? { models: { ...this.deps.models } } : {}), ...(this.deps.roles ? { roles: { ...this.deps.roles } } : {}),
         };
     }
+    get contextSettings() {
+        return this.deps.contextSettings;
+    }
+    contextOverlayOf(ref) {
+        return contextOverlayFor(this.deps.contextSettings, ref, this.deps);
+    }
     get gateBaseline() {
         const deps = this.deps;
         const h = deps.hooks;
@@ -232,6 +244,14 @@ export class Runner {
             else
                 delete writtenFaceSeats[seat];
         }
+        const priorContextSettings = this.deps.contextSettings;
+        if (seats.includes("contextSettings")) {
+            if (candidate.contextSettings !== undefined)
+                written.contextSettings = candidate.contextSettings;
+            else
+                delete written.contextSettings;
+        }
+        assertContextSettingsWords(written.contextSettings, written.models, "swapDeps");
         this.deps = written;
         if (catalogSwap) {
             const modelCount = Object.keys(candidate.models).length;
@@ -253,6 +273,17 @@ export class Runner {
                 });
             }
         }
+        if (seats.includes("contextSettings")) {
+            const to = candidate.contextSettings;
+            const words = to !== undefined ? Object.keys(to) : [];
+            deliverEngineNotice(this.deps.onNotice, {
+                code: "config.context_settings_swapped",
+                message: `deployment context-window settings swapped: ${words.length} model word(s) declared` +
+                    `${priorContextSettings !== undefined ? ` (was ${Object.keys(priorContextSettings).length})` : ""}` +
+                    "; unlike every other swappable seat this one is read LIVE — running legs measure their next boundary against the new windows, while their routing stays on the generation they prepared under",
+                detail: { words: words.slice(0, 8), declared: words.length, previousDeclared: priorContextSettings !== undefined ? Object.keys(priorContextSettings).length : 0, occurrenceId: uuidv7() },
+            });
+        }
         for (const seat of faceSeats) {
             const to = candidate[seat] ?? null;
             const from = priorFaces[seat] ?? null;
@@ -443,7 +474,7 @@ export class Runner {
                                 spec, queue, internals, ident, parentToolCallId, subagentName,
                                 pushContent, emitCommitted, startedToolCallIds, toolStartAt, toolProgress, writeFamilyOf,
                                 toolLabels, postToolBatchHook, batchArgs, internalsNotifier,
-                                runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info) },
+                                runnerHooks: { onError: (e, info) => this.deps.onError?.(e, info), onNotice: this.deps.onNotice },
                             },
                         });
                         const { compactionBrain, withinTaskCompaction, compactionBreaker, windowSafetyOptions } = runCompactionMachinery({ spec, prepared, rs, stats, noteUnevaluablePriceTable, runner: this.depsSeat });
@@ -476,7 +507,7 @@ export class Runner {
                                 undrainedUserAtEnd, userInputLostAtEnd, final, threw, abortedLive, userInterruptedLive, runner: this.depsSeat, sessions: this.sessions,
                                 next: ({ threw, comp, answerSettled, owedUserInput }) => runSettleAndTeardown({
                                     spec, queue, prepared, resume, internals, rs, stats, ident, parentToolCallId, subagentName, loopLatch, timeout, ownCommittedTailRef,
-                                    emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, owedUserInput,
+                                    emitDelegationLifecycle, taskIdRef, manualCompactRef, drainManualCompact, final, threw, abortedLive, userInterruptedLive, answerSettled, strandedHumanAnswers, reasoningResolution, comp, compactionBreaker, owedUserInput,
                                     setResult, onSuggestions, onSuspend, runner: this.depsSeat, sessions: this.sessions,
                                 }),
                             }),

package/dist/core/runner-deps.d.ts

@@ -6,6 +6,7 @@
  */
 import type { Model } from "../internal/llm.js";
 import type { AgentDefinition } from "./agent-definition.js";
+import type { ContextSettings } from "./context-settings.js";
 import type { BackgroundChildEvent, DelegationLifecycleEvent } from "./delegation-frames.js";
 import type { EngineNotice } from "./engine-notice.js";
 import type { HandsBandOptions } from "./hands-band.js";
@@ -113,6 +114,22 @@ export interface RunnerDeps {
     brain: Brain;
     /** Catalog used to resolve string ModelRefs to Model objects. */
     models?: Record<string, Model>;
+    /**
+     * The deployment's per-model CONTEXT-WINDOW overlay, keyed by CATALOG WORD ({@link ContextSettings}):
+     * `contextTokens` / `autoCompactTokens` / `enabled` over what the model card declares.
+     *
+     * It is the ONE hot-swappable seat an IN-FLIGHT leg re-reads. Every other seat follows the snapshot law
+     * (a running task keeps the deps object it prepared under) because those seats are the routing card —
+     * endpoint, credentials, price, fence — and a request in flight must reach what it was priced for. The
+     * usable window is not the card: it is a setting, and an operator who lowers it is asking the legs
+     * running RIGHT NOW to compact sooner, which is exactly what they were unable to do while the number
+     * lived on the model object. Read at every turn boundary, every recovery pass, the end-of-task summary
+     * and every request build; clamped to the physical window by the one resolver.
+     *
+     * A leg that was handed a `Model` OBJECT (or resolved one through a `select` criteria) has no catalog
+     * word and therefore no overlay — the pin is the caller saying "this exact model, as declared".
+     */
+    contextSettings?: ContextSettings;
     /**
      * design/338 (mid-turn MCP revocation) — the HOST's revocation ledger, probed synchronously at
      * every MCP dispatch (tool call + the three resource tools) BEFORE the transport. The engine
@@ -512,9 +529,11 @@ export interface RunnerDeps {
      * {@link InMemoryFileHistoryStore}; a deployment supplies a durable backend behind the same seam
      * (backends MUST reuse the exported env-half helpers — see the contract JSDoc). Works against ANY
      * ExecutionEnv (local or remote): bytes are read/written through the env's FileSystem face and
-     * stored host-side, so an env rebuild does not lose history.
+     * stored host-side, so an env rebuild does not lose history. `"disabled"` = the deployment DECIDED
+     * not to capture: the omitted-key semantics minus the once-per-Runner `onError` advisory an omitted
+     * key earns on a filesystem-capable run (`classification: "file-history-no-store"`).
      */
-    fileHistoryStore?: import("./file-history-store.js").FileHistoryStore;
+    fileHistoryStore?: import("./file-history-store.js").FileHistoryStore | "disabled";
     /**
      * design/381 DV-14 (终审落锤) — what an Edit/Write/NotebookEdit does when its FIRST-TOUCH history
      * record cannot be persisted (`FileHistoryStore.trackEdit` answered `{ok:false}` = NO durable
@@ -877,12 +896,12 @@ export interface RunnerDeps {
         maxConcurrent?: number;
         maxCumulativePerSession?: number;
     };
-    /** design/176 — deployment tuning for the always-on peer-message admission gate (SendMessage entry
-     *  judgment: rate/dedup/hop-chain/queue bounds). Per-field range-validated against the upstream
-     *  table with out-of-range values falling back to that field's default; there is NO off switch —
-     *  absent means the default table, not "guard off". Threaded into the auto-mounted SendMessage as
-     *  `SendMessageToolOptions.admission`; read per call (a value change governs the next message). */
-    peerAdmission?: Partial<import("../agents/peer-admission.js").PeerAdmissionConfig>;
+    /** The peer lane's ONE knob table (`PeerLaneConfig`): the always-on admission gate (rate/dedup/hop-chain/
+     *  queue bounds), the wake and per-pass delivery budgets, and the `ListAgents` freshness window. Per-field
+     *  range-validated with out-of-range values falling back to that field's default, announced once; there
+     *  is NO off switch — absent means the default table. Threaded into the auto-mounted SendMessage as
+     *  `SendMessageToolOptions.lane` and into the session-box drain; read per call / per pass. */
+    peerLane?: Partial<import("../agents/peer-admission.js").PeerLaneConfig>;
     /**
      * design/385 §2.1 / §5.1 — the peer-session DIRECTORY: the discovery truth of the cross-session
      * lane (other sessions of this engine for the same user). A HOST implements the contract (cli: the
@@ -917,6 +936,16 @@ export interface RunnerDeps {
      * {@link peerDirectory}.
      */
     crossSessionDialogExpiry?: import("../agents/peer-notices.js").CrossSessionDialogExpiry | (() => import("../agents/peer-notices.js").CrossSessionDialogExpiry | undefined);
+    /**
+     * The deployment's CAPABILITY FLOOR for durable engine frames: `true` declares that EVERY process
+     * that drains this deployment's session boxes reads `engine_frame` records (this engine's codec or
+     * newer). With it, an engine-minted task-notification frame addressed to an idle session parks in
+     * the session's durable box (`MailboxPeerMeta.kind: "engine_frame"`) and survives a process restart;
+     * without it (absent / `false`) such a frame parks in process exactly as before. A deployment flips
+     * it only after every drainer is upgraded — a pre-codec drainer reads the record as a peer's words.
+     * Inert without a cross-process-safe {@link mailboxStore}.
+     */
+    sessionBoxEngineFrames?: boolean;
     /**
      * design/164 件五 — DEPLOYMENT-level usage governance: allowances that span TASKS, evaluated per
      * principal (or once for the whole deployment when a task declares none). A different axis from
@@ -1266,11 +1295,13 @@ export interface RunnerDeps {
         phase: "compaction" | "prompt-cache" | "prompt-constitution" | "degraded" | "config" | "memory" | "mcp" | "a2a" | "interrupt-reconcile" | "suggestions" | "rewind" | "hook";
         sessionId: string;
         /**
-         * Machine-readable sub-classification when the phase has one — currently the design/31
-         * cache-break detector's root cause (`"model-switch" | "tool-schema" | "tool-set" |
-         * "system-prefix" | "server-or-ttl"`). Lets the host pick its own log level: `"server-or-ttl"`
-         * is usually benign in agentic tasks (slow tools ⇒ 5min+ request gaps expire provider caches —
-         * service[64] flag②) and warrants info/warn, while the prefix-bug causes warrant attention.
+         * Machine-readable sub-classification when the site has one (a kebab-case word naming the arm) —
+         * e.g. the design/31 cache-break detector's root cause (`"model-switch" | "tool-schema" |
+         * "tool-set" | "system-prefix" | "server-or-ttl"`), or the file-history liveness arms
+         * (`"file-history-no-store"` / `"file-history-no-env"`). Lets the host pick its own log level:
+         * `"server-or-ttl"` is usually benign in agentic tasks (slow tools ⇒ 5min+ request gaps expire
+         * provider caches — service[64] flag②) and warrants info/warn, while the prefix-bug causes
+         * warrant attention.
          */
         classification?: string;
     }) => void;

package/dist/core/side-query.d.ts

@@ -83,15 +83,16 @@ export interface SideQueryResult {
         args: unknown;
     }>;
     /** The RESOLVED pool model id the query was ROUTED to (the caller's ref resolved). See
-     *  `servedModel` for the model that actually answered. */
+     *  `servedModel` for the engine-selected id the reply came back stamped with. */
     model: string;
-    /** The model that ACTUALLY served the reply (a degrading-brain deployment may fall
-     *  back mid-query — billing/quality attribution must follow the real server, not the routing
-     *  intent). Equals `model` when no degradation occurred. */
+    /** The ENGINE-SELECTED id the reply came back stamped with (a degrading deployment may fall back
+     *  mid-query — attribution follows the entry that ran, not the routing intent); equals `model` when
+     *  nothing degraded. Still THIS catalog's id: what the PROVIDER called it is `responseModel` below. */
     servedModel: string;
     /** Structured degradation marker when a fallback model served (from/to/reason/chain). */
     degraded?: DegradationInfo;
-    /** Concrete provider-reported model when it differs (e.g. an `auto` route). */
+    /** The PROVIDER's own name for the model that answered, when it differs from `servedModel` above.
+     *  Absent ⇒ it named the same id or named none — one reading, as on `AssistantMessage.responseModel`. */
     responseModel?: string;
     /** Usage with `input` NORMALIZED to the uncached prompt quantity (the Anthropic-protocol
      *  `input_tokens` meaning) for EVERY provider family — the same gate the run loop's accounting

package/dist/core/side-query.js

@@ -1,6 +1,7 @@
 import { resolveTaskModel } from "./roles.js";
 import { readDegradation } from "../brain/degrading.js";
 import { cacheFamilyOf, uncachedInputTokensOf } from "./runner/usage-accounting.js";
+import { providerReportedModel } from "./message-utils.js";
 function normalizeSideQueryUsage(model, u) {
     const input = uncachedInputTokensOf(cacheFamilyOf(model), u);
     return input === u.input ? u : { ...u, input };
@@ -63,13 +64,14 @@ export async function runSideQuery(spec, deps) {
         .map((c) => ({ id: c.id, name: c.name, args: c.arguments }));
     const degraded = readDegradation(msg);
     const servedModel = typeof msg.model === "string" && msg.model.length > 0 ? msg.model : resolved.model.id;
+    const reportedModel = providerReportedModel(msg);
     return {
         text,
         toolCalls,
         model: resolved.model.id,
         servedModel,
         ...(degraded !== undefined ? { degraded } : {}),
-        ...(msg.responseModel !== undefined && msg.responseModel !== servedModel ? { responseModel: msg.responseModel } : {}),
+        ...(reportedModel !== undefined ? { responseModel: reportedModel } : {}),
         usage: normalizeSideQueryUsage(resolved.model, msg.usage),
         ...(msg.usageMissing === true ? { usageMissing: true } : {}),
         stopReason: msg.stopReason,

package/dist/core/swappable-deps.d.ts

@@ -12,11 +12,23 @@
  * the door refuses a key outside the set at run time (never a silent ignore — a hot-config driver
  * handing `{ brain }` must learn that the brain is not a swappable seat, not watch nothing happen).
  *
- * WHAT A SWAP MEANS — the natural snapshot, one sentence for every seat: a running task reads the deps
- * object it was handed at its prepare and holds that reference; a swap replaces the Runner's object, so
+ * WHAT A SWAP MEANS — the natural snapshot, one sentence for every ROUTING seat: a running task reads the
+ * deps object it was handed at its prepare and holds that reference; a swap replaces the Runner's object, so
  * every LATER prepare reads the new seat and every in-flight leg keeps the value it prepared under.
  * Nothing is re-routed, re-priced or re-fenced mid-run; the divergence window is exactly the in-flight
- * legs' lifetime, by design (the `swapModels` precedent, now the rule for the whole set).
+ * legs' lifetime, by design (the `swapModels` precedent).
+ *
+ * …WITH ONE SEAT OUTSIDE IT, and the boundary is the point rather than the exception: `contextSettings` is
+ * read LIVE by in-flight legs. The snapshot law protects the routing CARD — a request already in flight must
+ * reach the endpoint it was priced, credentialed and fenced for, and re-reading any of that mid-run buys
+ * nothing and breaks the request. A leg's usable WINDOW is not on that card: it is a setting about how much
+ * conversation may accumulate before the leg summarizes, the reference implementation keeps it off the model
+ * object for exactly this reason and re-reads it on every request (clamped to the model's physical window),
+ * and an operator who lowers it is asking the legs running RIGHT NOW to compact sooner — which is the whole
+ * request. So the window declarations live on their own seat (`context-settings.ts`), keyed by catalog word,
+ * and the legs read them at every boundary, every recovery pass, the end-of-task summary and every request
+ * build. Routing stays snapshotted; geometry follows the operator. The two are not the same question, and
+ * one law over both could only be wrong about one of them.
  *
  * KEY PRESENCE IS THE INSTRUCTION: a key present on the candidate is REPLACED (an explicit `undefined`
  * CLEARS an optional seat back to its engine default — `readFace: undefined` ⇒ the deployment declares
@@ -44,8 +56,11 @@ import type { RunnerDeps } from "./runner-deps.js";
  *                 deployment seat that resolution reads.
  *  - `writeFace` — the deployment's write-face declaration ({@link RunnerDeps.writeFace}); the read seat's
  *                 twin (same value gate, same in-flight snapshot rule, its own notice) and independent of it.
+ *  - `contextSettings` — the per-model context-window overlay ({@link RunnerDeps.contextSettings}); screened
+ *                 by the same value gate construction applies (`assertContextSettingsValue`). THE ONE SEAT
+ *                 IN-FLIGHT LEGS RE-READ — see the header: it carries geometry, not route.
  */
-export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace", "writeFace"];
+export declare const SWAPPABLE_DEP_SEATS: readonly ["models", "tiers", "readFace", "writeFace", "contextSettings"];
 export type SwappableDepSeat = (typeof SWAPPABLE_DEP_SEATS)[number];
 /** The candidate a swap takes: the swappable seats of {@link RunnerDeps}, each optional (presence = instruction). */
 export type SwappableDeps = Pick<RunnerDeps, SwappableDepSeat>;
@@ -61,6 +76,7 @@ export declare const SWAP_SEAT_NOTICE: {
     readonly tiers: "config.models_swapped";
     readonly readFace: "config.read_face_swapped";
     readonly writeFace: "config.write_face_swapped";
+    readonly contextSettings: "config.context_settings_swapped";
 };
 /** The fence over the notice table: `never` while every seat has a row. */
 export type SwapNoticeTableCoversEverySeat = AssertAllKeysHandled<Exclude<SwappableDepSeat, keyof typeof SWAP_SEAT_NOTICE>>;

package/dist/core/swappable-deps.js

@@ -1,5 +1,6 @@
 import { assertContainmentFaceValue } from "../tools/fs/containment-face.js";
-export const SWAPPABLE_DEP_SEATS = ["models", "tiers", "readFace", "writeFace"];
+import { assertContextSettingsValue } from "./context-settings.js";
+export const SWAPPABLE_DEP_SEATS = ["models", "tiers", "readFace", "writeFace", "contextSettings"];
 const SWAPPABLE_DEP_SEAT_SET = new Set(SWAPPABLE_DEP_SEATS);
 export function isSwappableDepSeat(k) {
     return SWAPPABLE_DEP_SEAT_SET.has(k);
@@ -9,6 +10,7 @@ export const SWAP_SEAT_NOTICE = {
     tiers: "config.models_swapped",
     readFace: "config.read_face_swapped",
     writeFace: "config.write_face_swapped",
+    contextSettings: "config.context_settings_swapped",
 };
 export function screenSwappableDeps(next) {
     if (next === null || typeof next !== "object" || Array.isArray(next)) {
@@ -49,6 +51,9 @@ export function screenSwappableDeps(next) {
             case "writeFace":
                 candidate.writeFace = assertContainmentFaceValue(v, "write", "deps");
                 break;
+            case "contextSettings":
+                candidate.contextSettings = assertContextSettingsValue(v, "swapDeps");
+                break;
             default: {
                 const _exhaustive = seat;
                 throw new Error(`swapDeps: unhandled seat ${String(_exhaustive)}`);

package/dist/core/task-event.d.ts

@@ -581,6 +581,14 @@ export type TaskEvent = ({
      *  no assistant message. Typed `string` (not the internal `StopReason`) to keep the engine's union
      *  private, but the value set is exactly those five tokens. */
     stopReason?: string;
+    /** The PROVIDER'S OWN name for the model that answered this turn, when it DIFFERS from the id the
+     *  request was sent with — a SECOND fact beside `TaskResult.model` / the trace's `brain.call.model`,
+     *  which stay the ENGINE-SELECTED pool id a resume re-seeds and a catalog resolves, never an
+     *  overwrite of either. PRESENCE: the turn's LAST assistant message carried one
+     *  (`AssistantMessage.responseModel`). ABSENT ⇒ the provider named the requested id or named nothing —
+     *  ONE reading, not two, as on the reference mismatch latch, also written only for a disagreeing pair.
+     *  A mismatch is additionally announced once per leg per pair as `route.response_model_mismatch`. */
+    responseModel?: string;
 } & TaskEventIdentity) | ({
     /** design/99 MF-18: a compaction boundary (or, since design/119 #1, mid-turn when the prompt-too-long recovery force-compacts between a failed request and its retry). `trigger` = what caused it: `"auto"` (the context-threshold
      *  auto-compaction), `"manual"` (the `TaskStream.compact` / `/compact` path), or `"forced"` (RB-398-b
@@ -621,6 +629,11 @@ export type TaskEvent = ({
     preserved_segment?: {
         firstKeptEntryId: string;
     };
+    /** Cross-session message frames that sat in the SUMMARIZED prefix of this pass — delivered
+     *  earlier and visible to the model for the turns since. A record still in the session's box is
+     *  handed over again by the engine (once; a second loss is disclosed `resupply_exhausted`), so
+     *  this counts what the summary swallowed, not what is gone. Present iff at least one. */
+    summarizedCrossSessionMessages?: number;
     /** CC post-compact file-restore parity (2026-07-03): the working files the engine
      *  re-read into the summary (attachWorkingFiles), attachment order. A shell renders CC's
      *  `Read {path} (…)` cards under the compaction divider from this. Absent when the feature is