@sema-agent/server 1.241.0 → 1.243.0

package/dist/main.js

@@ -4,12 +4,13 @@ import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { loadRemoteExec } from "@sema-agent/registry-core/node";
+import { skillContentHash } from "@sema-agent/registry-core";
 import { Runner, TtlSessionStore, uuidv7, FileRosterStore, defaultTaskRegistry, combinePolicies, createDurableQuestionPolicy, createAllowDenyPolicy, tightenTaskSpec, isThinkingLevel, QUESTION_AWAITS_RESUME, FileWorkflowRunStore, InMemoryWorkflowRunStore, workflowsCapability, NodeLspManager, createFileWorkflowScriptStore, expandTiers, NodeExecutionEnv, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, verifyPromptArtifact } from "@sema-agent/core";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "./plugins/memory-engine-pg.js";
 import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "./plugins/memory-engine-tidb.js";
 import { PgMemoryHistoryStore, ensurePgMemoryHistorySchema, PgMemorySyncStore, ensurePgMemorySyncSchema } from "./plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, ensureTiDBMemoryHistorySchema, TiDBMemorySyncStore, ensureTiDBMemorySyncSchema } from "./plugins/memory-sync-store-tidb.js";
-import { resolveTaskModel, modelSupportsImages } from "./model-select.js";
+import { resolveTaskModel, modelSupportsImages, matchCatalogModel } from "./model-select.js";
 import { derivePkgSourceEnv, customPkgSourceFromEnv } from "./sandbox-pkg-source.js";
 import { createSessionTitler } from "./session-titler.js";
 import { SessionWatchRegistry, posIntEnv } from "./session-watch.js";
@@ -20,7 +21,7 @@ import { createSendUserFileIssuer } from "./plugins/send-user-file.js";
 import { withLedgerRecording } from "./plugins/send-file-ledger.js";
 import { basename, resolve } from "node:path";
 import { stat as fsStat, readFile as fsReadFile } from "node:fs/promises";
-import { buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, purgeScratchpadDir, sweepStaleScratchpads } from "./env-facts.js";
+import { buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, purgeScratchpadDir, sweepStaleScratchpads, resumeFactsForLane } from "./env-facts.js";
 import { normalizeSuggestNextPrompts, normalizeResilience, normalizeAttachments, normalizeResumeAtMode, resolveTaskLimits, taskAgentsSpecFragment, retainBackgroundProcessesFromBody, toolNameListFromBody, promptProfileFromBody } from "./spec-fields.js";
 import { createBrain, brainSummary } from "./brain.js";
 import { loadConfig, logConfigDiagnostics } from "./config.js";
@@ -64,22 +65,22 @@ import { createLeaderEndpoint } from "./leader/endpoint.js";
 import { buildLeaderRunner } from "./leader/wire.js";
 import { WorkflowNotifyGate, JournalingWorkflowRunStore, FileWorkflowNotifyJournalStore, } from "./orchestration/workflow-notify-journal.js";
 import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, resolveCompletionRoute, resolveServedSession, } from "./orchestration/workflow-completion-inbox.js";
-import { buildPricing, buildTracer, cappedCeiling, ModelUsageTracker, PromptManifestTracker } from "./budget.js";
+import { buildPricing, buildTracer, buildSideQueryAccountant, cappedCeiling, ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import { CostQuota } from "./observability/cost-quota.js";
 import { startOtlpExporter } from "./observability/otel-exporter.js";
 import { HEARTBEAT_MS } from "./runs.js";
 import { ElicitationCoordinator } from "./elicitation.js";
 import { QuestionCoordinator } from "./question.js";
 import { ToolApprovalCoordinator } from "./tool-approval.js";
-import { applyEffective, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, mcpForScenario, restartReasons, fetchPromptArtifact } from "./sema-registry.js";
+import { applyEffective, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, mcpForScenario, restartReasons, modelPlaneChanged, planeHasActiveTiers, fetchPromptArtifact } from "./sema-registry.js";
 import { ensureSealedKeyStore, reportExecutionPublicKey } from "./sealed-key.js";
 import { createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "./config-provider.js";
-import { validatePromptsDomain, centerPromptProvider, applyCatalogToSource, CORE_ENGINE_VERSION, withPromptArtifactBackfill } from "./capabilities/center-prompts.js";
+import { validatePromptsDomain, centerPromptProvider, centerIdentityAssembled, applyCatalogToSource, CORE_ENGINE_VERSION, withPromptArtifactBackfill } from "./capabilities/center-prompts.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "./config-lkg.js";
 import { TiDBRosterStore, PgRosterStore, ensureTiDBRosterSchema, ensurePgRosterSchema } from "./plugins/roster-store-sql.js";
 import { createPrincipalCapsClient, gateExecutionLane, scopedTokenNeedsWorker, applyObserverEnvOptIn } from "./runtime-caps-resolver.js";
 import { applyRuntimeGovernance, stripDelegationTools } from "./runtime-governance.js";
-import { parseTaskSettings, applyTaskSettings, coercePermissionMode, withPermissionMode, effectiveThinking } from "./task-settings.js";
+import { parseTaskSettings, applyTaskSettings, coercePermissionMode, withPermissionMode, effectiveThinking, acceptAppendSystemPrompt, hasConstitutionAnchors, providerDropsAppend, MAX_SETTINGS_OUTPUT_STYLE_CHARS } from "./task-settings.js";
 import { buildTaskHooks, composeHooks } from "./hooks/hook-runner.js";
 import { createHookLlm } from "./hooks/hook-llm.js";
 import { selfOrchestrationFromBody, enableForkFromBody, workflowModelAllowlistFor, normalizeRetainSubagentSessions } from "./task-workflow.js";
@@ -130,6 +131,9 @@ async function main() {
     let effective;
     let latestEffective;
     let lastRejectedCandidate;
+    let appliedPlaneEff;
+    let planeDeferredNoHandoff;
+    let bootSkillStale = false;
     let pendingRestart;
     const cc = config.configCenter;
     const localRoot = config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
@@ -239,19 +243,45 @@ async function main() {
     let bootConfigPending;
     const lkgEnabled = configProvider?.kind === "remote" && process.env.CONFIG_LKG_DISABLED !== "true";
     const lkgPath = process.env.CONFIG_LKG_PATH ?? defaultLkgPath(cc?.worker);
+    const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
     let lkgBooted = false;
     let bootLkgCandidate;
+    let lastPrewarmBodiesVerified = false;
     const persistLkgDurable = async (effectiveObj, etag) => {
+        lastPrewarmBodiesVerified = false;
+        if (configProvider?.kind === "local")
+            return true;
         if (!lkgEnabled)
-            return;
+            return false;
         try {
             if (effectiveObj.skills && config.configCenter) {
                 await applyCenterSkills([], effectiveObj.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, defaultSkillCacheDir());
             }
+            const enabledSkills = (effectiveObj.skills?.skills ?? []).filter((m) => m.enabled !== false);
+            const cacheDir = defaultSkillCacheDir();
+            for (const m of enabledSkills) {
+                const hex = m.contentHash.replace(/^sha256:/, "").toLowerCase();
+                if (!/^[0-9a-f]{64}$/.test(hex))
+                    return false;
+                try {
+                    const text = await fsReadFile(join(cacheDir, hex), "utf8");
+                    if (`sha256:${createHash("sha256").update(text, "utf8").digest("hex")}` !== `sha256:${hex}`) {
+                        logger.warn("config_lkg_skill_cache_incomplete", { skill: m.name, hash: m.contentHash, note: "cached body fails its hash — LKG NOT replaced, handoff NOT confirmed (the previous good LKG keeps serving offline boots)" });
+                        return false;
+                    }
+                }
+                catch {
+                    logger.warn("config_lkg_skill_cache_incomplete", { skill: m.name, hash: m.contentHash, note: "enabled skill body not in the cache — LKG NOT replaced, handoff NOT confirmed" });
+                    return false;
+                }
+            }
+            lastPrewarmBodiesVerified = true;
             await saveLkg(lkgPath, cc?.worker, effectiveObj, etag);
+            return lkgSurvivesRestart;
         }
         catch (err) {
             logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "durable persist failed — restart signal proceeds anyway (a dead disk + dead center double-fault can re-loop; fix the disk)" });
+            return false;
         }
     };
     if (configProvider) {
@@ -273,6 +303,7 @@ async function main() {
             await adoptCenterPrompts(lkgR.effective, "boot-lkg");
             markRosterLanded(lkgR.effective);
             effective = lkgR.effective;
+            appliedPlaneEff = lkgR.effective;
             latestEffective = lkgR.effective;
             if (lkgR.etag !== undefined)
                 ccEtag = lkgR.etag;
@@ -323,6 +354,7 @@ async function main() {
                     await adoptCenterPrompts(r.effective, "boot");
                     markRosterLanded(r.effective);
                     effective = r.effective;
+                    appliedPlaneEff = r.effective;
                     if (bootClean)
                         latestEffective = r.effective;
                     if (bootClean && !lkgBooted)
@@ -568,6 +600,7 @@ async function main() {
     const fleetUsage = config.configCenter && process.env.FLEET_ADVERTISE_ADDRESS ? new FleetUsageAccumulator() : undefined;
     const fleetLease = buildFleetLeaseFromEnv(config, { logger, metrics });
     const tracer = buildTracer(metrics, costQuota, modelUsageTracker, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1, promptManifestTracker);
+    const sideQueryAccounting = buildSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1);
     const toolResultStore = backend?.toolResult ? backend.toolResult() : undefined;
     const sessionPolicyStore = backend ? backend.sessionPolicy() : undefined;
     const fileSnapshotStore = backend ? backend.fileSnapshot() : undefined;
@@ -1023,6 +1056,7 @@ async function main() {
         },
     };
     const runner = new Runner(runnerDeps);
+    const runnerTierFrozen = Object.keys(config.tiers).length > 0;
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => keyResolver, metrics });
     const hookAgentRunner = new Runner({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) });
     const hookAgent = async ({ prompt, model, timeoutMs }) => {
@@ -1131,7 +1165,28 @@ async function main() {
         skills = await applyCenterSkills(skills, effective.skills, config.configCenter.baseUrl, config.configCenter.token, logger, undefined, process.env.CONFIG_LKG_DISABLED !== "true" ? defaultSkillCacheDir() : undefined);
     }
     if (bootLkgCandidate && lkgEnabled) {
-        await saveLkg(lkgPath, cc?.worker, bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "boot LKG persist failed — next clean candidate rewrites" }));
+        const bootPublished = await persistLkgDurable(bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => {
+            logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
+            return false;
+        });
+        {
+            const enabledManifest = (bootLkgCandidate.effective.skills?.skills ?? []).filter((m) => m.enabled !== false);
+            const canonScenarios = (a) => [...(a ?? [])].sort().join("\u0000");
+            const liveSkillMiss = enabledManifest.some((m) => !skills.some((sk) => sk.spec.name === m.name &&
+                skillContentHash(sk.spec.content) === m.contentHash &&
+                sk.spec.description === m.description &&
+                canonScenarios(sk.scenarios) === canonScenarios(m.scenarios)));
+            if (liveSkillMiss)
+                bootSkillStale = true;
+            if (liveSkillMiss && (bootPublished || (!lkgSurvivesRestart && lastPrewarmBodiesVerified))) {
+                pendingRestart = { restartRequired: true, reasons: ["skills"], version: bootLkgCandidate.effective.version, since: Date.now() };
+                logger.warn("config_boot_skill_stale_restart", { version: bootLkgCandidate.effective.version, durableHandoff: bootPublished, note: bootPublished ? "live skill application incomplete but the durable LKG carries the full candidate — skills restart published (the next boot reads the complete LKG)" : "live skill application incomplete on a non-durable deployment but every enabled body is verified in the cache — skills restart published (transient failure proven repaired; the restarted process re-pulls live)" });
+            }
+            else if (liveSkillMiss || (!bootPublished && lkgSurvivesRestart)) {
+                planeDeferredNoHandoff = { version: bootLkgCandidate.effective.version, since: Date.now(), blocked: liveSkillMiss ? ["skills"] : [], candidate: bootLkgCandidate.effective, ...(bootLkgCandidate.etag !== undefined ? { candidateEtag: bootLkgCandidate.etag } : {}) };
+                logger.warn("config_lkg_boot_publication_retained", { version: bootLkgCandidate.effective.version, liveSkillMiss, durableDeclared: lkgSurvivesRestart, note: (lkgSurvivesRestart ? "boot LKG publication incomplete on a durable-declared deployment — candidate retained; the refresh loop retries after each confirming 304" : "live skill application incomplete on a non-durable deployment and the body cache could not be verified — skills debt retained WITHOUT a restart signal (codex R37: signaling now could restart-storm; each confirming 304 re-verifies and publishes once the bodies prove fetchable)") + (liveSkillMiss && lkgSurvivesRestart ? "; this process runs skill-stale, promotion will publish a skills restart" : "") });
+            }
+        }
     }
     if (effective?.mcp)
         config.mcpServers = resolveMcpServers(effective.mcp, logger);
@@ -1243,7 +1298,29 @@ async function main() {
             refreshInFlight = true;
             try {
                 await retryPendingCatalog("refresh-retry");
+                if (planeDeferredNoHandoff) {
+                    metrics.inc("models_tiers_plane_deferred_stuck_total");
+                    logger.warn("models_tiers_deferred_no_handoff", { version: planeDeferredNoHandoff.version, since: planeDeferredNoHandoff.since, note: "candidate still retained without a next-boot handoff — mount restart-surviving LKG storage + CONFIG_LKG_DURABLE=true, or restart manually after ensuring the candidate is re-pulled at boot" });
+                }
                 const r = prefetched !== undefined ? prefetched : await configProvider.fetchEffective(ccEtag);
+                if (r === null && planeDeferredNoHandoff) {
+                    const skillsDebt = (planeDeferredNoHandoff.blocked ?? []).includes("skills");
+                    const promoted = lkgSurvivesRestart || skillsDebt ? await persistLkgDurable(planeDeferredNoHandoff.candidate, planeDeferredNoHandoff.candidateEtag) : false;
+                    const skillsProofPromotion = !promoted && !lkgSurvivesRestart && skillsDebt && lastPrewarmBodiesVerified && planeDeferredNoHandoff.planeDeferred !== true;
+                    if (skillsProofPromotion) {
+                        pendingRestart = { restartRequired: true, reasons: ["skills"], version: planeDeferredNoHandoff.version, since: Date.now() };
+                        logger.info("config_boot_skill_debt_promoted", { version: planeDeferredNoHandoff.version, note: "skill bodies verified on a source-confirmed-current candidate — the withheld skills restart is now published (non-durable lane, repair proven)" });
+                        planeDeferredNoHandoff = undefined;
+                    }
+                    else if (promoted) {
+                        const promotedReasons = [...new Set([...(planeDeferredNoHandoff.blocked ?? []), ...(planeDeferredNoHandoff.planeDeferred ? ["models-tiers"] : [])])];
+                        if (promotedReasons.length > 0) {
+                            pendingRestart = { restartRequired: true, reasons: promotedReasons, version: planeDeferredNoHandoff.version, since: Date.now() };
+                        }
+                        logger.info("models_tiers_deferred_promoted", { version: planeDeferredNoHandoff.version, reasons: promotedReasons, note: promotedReasons.length > 0 ? "handoff persistence recovered on a source-confirmed-current candidate — the withheld restart signal is now published" : "boot publication retry completed — LKG now durable, no restart needed (nothing was withheld)" });
+                        planeDeferredNoHandoff = undefined;
+                    }
+                }
                 if (r) {
                     const promptsRaw = r.effective.prompts;
                     const promptsGate = promptsRaw !== undefined ? validatePromptsDomain(promptsRaw) : { ok: true };
@@ -1274,13 +1351,50 @@ async function main() {
                         ccEtag = r.etag;
                     }
                     else {
-                        applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys });
+                        const planeDeferred = (runnerTierFrozen || planeHasActiveTiers(r.effective)) && modelPlaneChanged(appliedPlaneEff, r.effective);
+                        applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferred ? { deferModelPlane: true } : {}) });
+                        if (planeDeferred) {
+                            logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner: the changed model plane (models/roles/tiers/default) is NOT hot-applied — admission stays on the Runner's generation; restart applies the new plane (models-tiers restart signal rides /health)" });
+                        }
+                        else {
+                            appliedPlaneEff = r.effective;
+                            planeDeferredNoHandoff = undefined;
+                        }
                         await adoptCenterPrompts(r.effective, "refresh");
-                        markRosterLanded(r.effective);
+                        if (!planeDeferred)
+                            markRosterLanded(r.effective);
                         mutateInPlace(pricing, buildPricing(config.models));
                         keyResolver = buildKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-                        await persistLkgDurable(r.effective, r.etag);
+                        const lkgPersisted = await persistLkgDurable(r.effective, r.etag);
                         const reasons = restartReasons(effective, r.effective);
+                        const skillsChangeDetected = reasons.includes("skills");
+                        if (bootSkillStale && !skillsChangeDetected)
+                            reasons.push("skills");
+                        if (planeDeferred) {
+                            if (lkgPersisted) {
+                                if (!reasons.includes("models-tiers"))
+                                    reasons.push("models-tiers");
+                                planeDeferredNoHandoff = undefined;
+                            }
+                            else {
+                                const blocked = reasons.splice(0, reasons.length);
+                                planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "plane deferred but no NEXT-BOOT handoff (LKG disabled/unwritable, or storage not declared restart-surviving — set CONFIG_LKG_DURABLE=true) — the WHOLE restart signal is withheld (it would loop); the old generation keeps serving" });
+                            }
+                        }
+                        else if (lkgSurvivesRestart && !lkgPersisted) {
+                            const blocked = reasons.splice(0, reasons.length);
+                            planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                            logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "durable LKG declared but the candidate's publication is incomplete (skill bodies unverified) — restart signal withheld; retried every tick until the cache completes" });
+                        }
+                        else if (!planeDeferred && !lkgSurvivesRestart && bootSkillStale && !skillsChangeDetected && !lastPrewarmBodiesVerified) {
+                            const i = reasons.indexOf("skills");
+                            if (i >= 0) {
+                                reasons.splice(i, 1);
+                                planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked: ["skills"], candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                                logger.warn("config_boot_skill_debt_withheld", { version: r.effective.version, note: "boot skill debt still unproven on a non-durable deployment (body cache does not verify) — skills restart withheld this tick; re-verified each tick and published once the bodies prove fetchable" });
+                            }
+                        }
                         if (reasons.length === 0) {
                             pendingRestart = undefined;
                         }
@@ -1338,16 +1452,41 @@ async function main() {
                 ccEtag = r.etag;
                 return;
             }
-            applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys });
+            const planeDeferredLate = (runnerTierFrozen || planeHasActiveTiers(r.effective)) && modelPlaneChanged(appliedPlaneEff, r.effective);
+            applyEffective(config, r.effective, logger, { teamsOnly: true, sealedKeys, ...(planeDeferredLate ? { deferModelPlane: true } : {}) });
+            if (planeDeferredLate)
+                logger.warn("models_tiers_plane_deferred", { version: r.effective.version, note: "tier-frozen Runner (env tiers): the late-boot center model plane is NOT hot-applied — restart applies it" });
+            else {
+                appliedPlaneEff = r.effective;
+                planeDeferredNoHandoff = undefined;
+            }
             await adoptCenterPrompts(r.effective, "boot-deferred");
-            markRosterLanded(r.effective);
+            if (!planeDeferredLate)
+                markRosterLanded(r.effective);
             mutateInPlace(pricing, buildPricing(config.models));
             keyResolver = buildKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
             effective = r.effective;
             latestEffective = r.effective;
             ccEtag = r.etag;
-            await persistLkgDurable(r.effective, r.etag);
+            const lkgPersistedLate = await persistLkgDurable(r.effective, r.etag);
             const reasons = restartReasons(undefined, r.effective);
+            if (planeDeferredLate) {
+                if (lkgPersistedLate) {
+                    if (!reasons.includes("models-tiers"))
+                        reasons.push("models-tiers");
+                    planeDeferredNoHandoff = undefined;
+                }
+                else {
+                    const blocked = reasons.splice(0, reasons.length);
+                    planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), ...(blocked.length > 0 ? { blocked } : {}), planeDeferred: true, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                    logger.warn("models_tiers_deferred_no_handoff", { version: r.effective.version, blockedReasons: blocked, note: "late-boot plane deferred but no NEXT-BOOT handoff (see CONFIG_LKG_DURABLE) — the WHOLE restart signal is withheld (it would loop); old generation keeps serving" });
+                }
+            }
+            else if (planeDeferredLate === false && lkgSurvivesRestart && !lkgPersistedLate) {
+                const blocked = reasons.splice(0, reasons.length);
+                planeDeferredNoHandoff = { version: r.effective.version, since: planeDeferredNoHandoff?.since ?? Date.now(), blocked, candidate: r.effective, ...(r.etag !== undefined ? { candidateEtag: r.etag } : {}) };
+                logger.warn("restart_candidate_publication_incomplete", { version: r.effective.version, blockedReasons: blocked, note: "late-boot candidate publication incomplete on a durable-declared deployment — restart signal withheld; retried every tick" });
+            }
             if (reasons.length > 0)
                 pendingRestart = { restartRequired: true, reasons, version: r.effective.version, since: Date.now() };
             logger.info("config_loaded_deferred", { source: configProvider.kind, version: r.effective.version, models: (r.effective.models?.models ?? []).filter((m) => m.enabled !== false).length, ...(reasons.length > 0 ? { restartRequired: true, restartReasons: reasons } : {}) });
@@ -1534,6 +1673,7 @@ async function main() {
         rateLimiter,
         costQuota,
         ...(fleetLease ? { fleetLease } : {}),
+        sideQueryAccounting,
         ...(outcomeSink ? { outcomeSink } : {}),
         ...(memoryExportBackend ? { memoryExport: (scope) => exportMemoryScope(memoryExportBackend, scope) } : {}),
         ...(memoryExportBackend && memorySyncCursors
@@ -1545,17 +1685,29 @@ async function main() {
             pricingConfigured: Object.values(pricing).some((p) => Object.values(p).some((v) => typeof v === "number" && v > 0)),
         },
         restartState: () => pendingRestart,
+        planeDeferredState: () => planeDeferredNoHandoff,
         drainState,
         storeDegraded: storeBackendDegraded,
-        resolveSpec: async (body, _req, auth) => {
+        resolveSpec: async (body, _req, auth, opts) => {
             const requested = gateScenarioRequest(await principalCaps?.scenarioRuling(auth?.principal), body.scenario, config.defaultScenario);
             gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), config.remoteExec?.provider ?? "in-process");
             const scenarioName = scenarios[requested] ? requested : "default";
             if (scenarioName === "autonomous")
                 logger.warn("scenario_autonomous_deprecated", { alias: "code", note: "renamed by [891]; alias keeps finalVerification pinned — pass scenario:'code' (+ explicit finalVerification if wanted)" });
             const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal);
+            const centerDecls = centerPrompts?.declarations;
+            const appendLessPack = centerDecls
+                ? centerIdentityAssembled(centerDecls, scenarioName, hasConstitutionAnchors)
+                : providerDropsAppend(cap.promptProvider, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined);
+            const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }), appendLessPack);
             const objective = typeof body.objective === "string" ? body.objective : "";
             const parsedSettings = parseTaskSettings(body.settings);
+            if (opts?.leg === "fresh" && appendLessPack) {
+                const riderPresent = typeof body.appendSystemPrompt === "string" && body.appendSystemPrompt.length > 0;
+                if (riderPresent || parsedSettings.settings?.outputStyle) {
+                    throw new HttpError(400, `${riderPresent ? "appendSystemPrompt" : "settings.outputStyle"} is not supported when the effective prompt is already assembled (constitution anchors in systemPrompt, or a center assembled-identity pack for this scenario): the assembler's pass-through path cannot mount the append slot — fold it into the assembled prompt instead`);
+                }
+            }
             if (parsedSettings.deferred.length > 0) {
                 logger.warn("task_settings_deferred", { fields: parsedSettings.deferred, sessionId: auth?.sessionId ?? null });
             }
@@ -1649,6 +1801,7 @@ async function main() {
             const spec = {
                 objective: picked.cleanedObjective,
                 systemPrompt: typeof body.systemPrompt === "string" ? body.systemPrompt : undefined,
+                appendSystemPrompt: acceptedAppend,
                 sessionId: auth?.sessionId,
                 principal: auth?.principal,
                 images: body.images,
@@ -1681,6 +1834,20 @@ async function main() {
                 attachments: normalizeAttachments(body.attachments),
                 ...(taskHooks ? { hooks: composeHooks(deploymentHooks, taskHooks) } : {}),
                 model: picked.model,
+                ...((() => {
+                    if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0)
+                        return {};
+                    const cm = matchCatalogModel(body.compactionModel, wireCatalog);
+                    if (cm === undefined) {
+                        if (opts?.leg === "fresh") {
+                            throw new HttpError(400, `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
+                        }
+                        metrics.inc("task_model_unknown_fallback_total");
+                        logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
+                        return {};
+                    }
+                    return { compactionModel: cm };
+                })()),
                 thinking: effectiveThinking(body.reasoningEffort, parsedSettings.settings?.ultracode === true),
                 getApiKeyAndHeaders: keyResolver,
                 ...(() => {
@@ -1721,7 +1888,7 @@ async function main() {
                 })(cap.tools),
                 skills: mergeUserSkills(cap.skills, body.skills, logger),
                 mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger),
-                promptProvider: centerPrompts?.declarations ? centerPromptProvider(centerPrompts.declarations, scenarioName) : cap.promptProvider,
+                promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
                 toolPolicy: durableEnabled
                     ? combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({
                         requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
@@ -1771,7 +1938,17 @@ async function main() {
             const governedBase = applyRuntimeGovernance(spec, { autonomy: config.autonomy, commandPolicy: config.commandPolicy });
             let governed = governedBase;
             const bodyMode = coercePermissionMode(body.permissionMode);
-            const effectiveSettings = bodyMode ? withPermissionMode(parsedSettings.settings, bodyMode) : parsedSettings.settings;
+            let effectiveSettings = bodyMode ? withPermissionMode(parsedSettings.settings, bodyMode) : parsedSettings.settings;
+            if (appendLessPack && effectiveSettings?.outputStyle) {
+                logger.warn("output_style_dropped", { detail: "the effective prompt pack cannot mount the append slot (already-assembled systemPrompt or center assembled-identity declaration)", sessionId: auth?.sessionId ?? null });
+                const { outputStyle: _dropped, ...rest } = effectiveSettings;
+                effectiveSettings = Object.keys(rest).length > 0 ? rest : undefined;
+            }
+            if (effectiveSettings?.outputStyle && acceptedAppend && acceptedAppend.length + 2 + effectiveSettings.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
+                logger.warn("output_style_dropped", { detail: `combined append carriers exceed the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (rider ${acceptedAppend.length} + style ${effectiveSettings.outputStyle.length}) — style dropped (pre-cap stored body on a resume leg?)`, sessionId: auth?.sessionId ?? null });
+                const { outputStyle: _dropped2, ...rest2 } = effectiveSettings;
+                effectiveSettings = Object.keys(rest2).length > 0 ? rest2 : undefined;
+            }
             const hostSemanticsLane = config.remoteExec === undefined || config.remoteExec.provider === "host";
             const scratchpadDir = hostSemanticsLane && auth?.sessionId
                 ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId)
@@ -1861,6 +2038,7 @@ async function main() {
                     ...(pkgSourceLane ? { pkgSource: config.sandboxPkgSource } : {}),
                     egress: egressForRemoteExec(config.remoteExec),
                     ...(factScratchpadDir ? { scratchpadDir: factScratchpadDir } : {}),
+                    resumeFacts: resumeFactsForLane(config.remoteExec?.provider, config.remoteExec?.provider === "k8s" ? { k8sSnapshot: Boolean(config.remoteExec.s3Snapshot) } : undefined),
                 });
                 if (facts)
                     governed = { ...governed, envFacts: facts };