@sema-agent/server 1.316.0 → 1.317.0

package/dist/http/server.js

@@ -1,41 +1,30 @@
 import http from "node:http";
 import { once } from "node:events";
-import { timingSafeEqual, createHash, randomBytes } from "node:crypto";
-import { sessionLogDigest, sessionLogDigestsComparable, uuidv7, sanitizePathComponent, callKeyOrdinal, isThinkingLevel, DEFAULT_EFFORT_LEVELS, expandTiers, materializeMcpTools, runWithVerification, resumeWithVerification, runCascade, CheckpointError, mintCheckpointToken, SessionPolicyError, SessionError, HAND_TOOL_EFFECTS, canonicalToolName, formatUserScope, defaultTaskRegistry, validatePendingSteer, StreamingImportValidator, getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus } from "@sema-agent/core";
+import { createHash } from "node:crypto";
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, HAND_TOOL_EFFECTS, canonicalToolName, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow } from "@sema-agent/core";
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
-import { tarHeader, tarPadding, splitTarPath, TAR_END } from "./tar.js";
 import { matchCatalogModel } from "../model-select.js";
-import { mcpForScenario } from "../sema-registry.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isUuidShape, verifyDirectDoorProof, MAX_APPROVAL_REASON_CHARS } from "../security.js";
-import { exportSession, exportSessionManifest, importSession, classifySyncRelationshipByIds, SyncConflictError, stagingIdFor } from "../session-sync.js";
-import { windowMessages, truncateMessageBlobs } from "../audit.js";
-import { parseMemorySyncRequest } from "../memory-sync.js";
-import { StringDecoder } from "node:string_decoder";
+import {} from "../sema-registry.js";
+import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof } from "../security.js";
+import { exportSession, importSession } from "../session-sync.js";
+import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { validateTaskAgents } from "../spec-fields.js";
-import { isValidCwd, cwdHonored, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
-import { mcpInjectionHonored } from "../task-mcp.js";
-import { validateBake, buildBakeArgv } from "../images/bake-validate.js";
-import { manifestToIndexEntry } from "../images/manifest.js";
-import { runInBackground, evictIfConflict, stripCheckpointToken, resumeAtHttpStatus, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
+import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { looksLikeJwt } from "../auth-bridge.js";
-import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../orchestration/workflow-agent-steer.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationFoldKey, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
+import {} from "../orchestration/workflow-agent-steer.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
-import { RateLimiter } from "../observability/rate-limit.js";
+import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
-import { projectEvents, runSummary, mapTraceEvent, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
-import { createLedgerSink } from "../trace/ledger-sink.js";
-import { cacheFamilyOfMirror } from "../budget.js";
-import { projectArtifacts } from "../trace/artifacts.js";
-import { composeSupervisorCost, infraCost, infraUsageFromEvents, hasInfraPricing } from "../observability/cost-taxonomy.js";
-import { redactSecrets, redactDeep, redactedPreview } from "../trace/redact.js";
-import { usageSummary, usageSeries, usageBreakdown } from "../usage-analytics.js";
+import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { redactSecrets } from "../trace/redact.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
-import { streamSseLog, sleep } from "./sse-log.js";
+import { streamSseLog } from "./sse-log.js";
 import { handleCapabilities } from "./routes/capabilities.js";
 import { handleObservability } from "./routes/observability.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
@@ -43,12 +32,23 @@ import { handleSessionsList } from "./routes/sessions-list.js";
 import { handleSessions, createSessionsLocal } from "./routes/sessions.js";
 import { handleSessionSync, createSessionSyncLocal } from "./routes/session-sync.js";
 import { handleAttachments } from "./routes/attachments.js";
-import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit, IMAGE_DIGEST_RE, IMAGE_PROFILE_RE, BAKE_ID_RE, BAKE_EVENTS_RE, BAKE_CANCEL_RE, BAKE_CLAIM_RE, BAKE_INGEST_RE } from "./routes/images.js";
+import { handleFleet } from "./routes/fleet.js";
+import { handleTraceUsage } from "./routes/trace-usage.js";
+import { handleWorkflows, handleWorkflowAgentSteer } from "./routes/workflows.js";
+import { handleNotifyWake } from "./routes/notify-wake.js";
+import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_PREEMPT_RE, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
+export { streamApprovals, isQuestionAnswer };
+import { handleRuns, handleRunVerbs, RUN_CANCEL_RE, RUN_STEER_RE, RUN_DETACH_RE, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleSideQuery } from "./routes/side-query.js";
+import { handleTasks } from "./routes/tasks.js";
+import { handleLeader } from "./routes/leader.js";
+import { cascadeConfig } from "./run-meta.js";
+export { cascadeConfig };
+import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit, BAKE_ID_RE, BAKE_EVENTS_RE, BAKE_CANCEL_RE, BAKE_CLAIM_RE, BAKE_INGEST_RE } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-import { sendJson, sendError, msg, sseHeaders } from "./send.js";
-import { headerStr, safeEqual, authorized, systemFor, bearerPresentedButUnverified, gatedPrincipal, explicitOperatorOk, isOperator, explicitOperator } from "./principal-gate.js";
+import { sendJson, sendError, httpErrorCode, msg } from "./send.js";
+import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator, explicitOperator } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator, explicitOperator };
-import { pgHasUnstorable } from "../plugins/pg-safe-json.js";
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
     if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
@@ -59,14 +59,6 @@ export const MAX_USER_SKILLS = 10;
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
-function runMeta(prepared, source) {
-    const obj = prepared.spec.objective ?? "";
-    return {
-        jobId: prepared.jobId ?? null,
-        source,
-        objectivePreview: obj ? redactSecrets(obj).slice(0, 120) : null,
-    };
-}
 export function validateUserSkills(skills) {
     if (skills === undefined)
         return null;
@@ -86,77 +78,37 @@ export function validateUserSkills(skills) {
     }
     return null;
 }
-export function cascadeConfig(ladder, maxCostUsd) {
-    return {
-        ladder: ladder.map((model) => ({ model })),
-        ...(maxCostUsd && maxCostUsd > 0 ? { costCeilingMicroUsd: Math.round(maxCostUsd * 1e6) } : {}),
-    };
-}
 export function clampVerifyRounds(v) {
     const n = typeof v === "number" && Number.isFinite(v) ? Math.floor(v) : 2;
     return Math.min(5, Math.max(1, n));
 }
-export function isQuestionAnswer(v) {
-    if (!v || typeof v !== "object" || Array.isArray(v))
-        return false;
-    const a = v.answers;
-    if (!Array.isArray(a) || a.length === 0)
-        return false;
-    return a.every((it) => {
-        if (!it || typeof it !== "object" || Array.isArray(it))
-            return false;
-        const { header, selected, note } = it;
-        return (typeof header === "string" &&
-            Array.isArray(selected) &&
-            selected.length > 0 &&
-            selected.every((s) => typeof s === "string") &&
-            (note === undefined || typeof note === "string"));
-    });
-}
 const MAX_BODY = 8 * 1024 * 1024;
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
-const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
-const RUN_CANCEL_RE = /^\/v1\/runs\/([^/]+)\/cancel$/;
-const RUN_STEER_RE = /^\/v1\/runs\/([^/]+)\/steer$/;
-const RUN_DETACH_RE = /^\/v1\/runs\/([^/]+)\/detach$/;
-const RUN_COMPACT_RE = /^\/v1\/runs\/([^/]+)\/compact$/;
-function runNotFoundBody(id) {
-    const aStar = /^(?:a|wa)[0-9a-f]{4,}$/i.test(id);
-    return {
-        error: aStar
-            ? `run not found — "${id}" looks like an agent handle (a*/wa* domain), which is never in the run store; use the TaskOutput tool (or the workflow journal / subagents surface) to read it, and the run's durable taskId (X-Task-Id) for this endpoint`
-            : "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)",
-    };
-}
-const ELICIT_RESPOND_RE = /^\/v1\/elicitations\/([^/]+)\/respond$/;
-const QUESTION_RESPOND_RE = /^\/v1\/questions\/([^/]+)\/respond$/;
-const TOOL_APPROVAL_RESPOND_RE = /^\/v1\/tool-approvals\/([^/]+)\/respond$/;
-const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
-const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
-const ASSISTANT_PLAN_REVIEW_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/plan_review$/;
-const TRACE_RE = /^\/v1\/tasks(?:\/([^/]+)(\/turns|\/stream|\/artifacts))?$/;
-const WORKFLOWS_RE = /^\/v1\/workflows(?:\/([^/]+)(\/stream|\/journal)?)?$/;
-const WORKFLOW_AGENT_STEER_RE = /^\/v1\/workflows\/([^/]+)\/agents\/([^/]+)\/steer$/;
-const RUN_SUBAGENT_STEER_RE = /^\/v1\/runs\/([^/]+)\/subagents\/([^/]+)\/steer$/;
-const RUN_SUBAGENT_RESUME_RE = /^\/v1\/runs\/([^/]+)\/subagents\/([^/]+)\/resume$/;
-const RUN_SUBAGENT_OUTPUT_RE = /^\/v1\/runs\/([^/]+)\/subagents\/([^/]+)\/output$/;
-const RUN_SUBAGENT_STREAM_RE = /^\/v1\/runs\/([^/]+)\/subagents\/([^/]+)\/stream$/;
-const RUN_TASK_OUTPUT_RE = /^\/v1\/runs\/([^/]+)\/tasks\/([^/]+)\/output$/;
-const RUN_TASK_STOP_RE = /^\/v1\/runs\/([^/]+)\/tasks\/([^/]+)\/stop$/;
 const HAND_TOOL_NAMES = Object.keys(HAND_TOOL_EFFECTS);
 function isCheckpointReopenedFailure(r) {
     return r.status === "failed" && (r.errorCode === "resume.env_failed" || r.errorCode === "resume.tool_unavailable");
 }
 const ROUTE_DOMAINS = [
+    handleTraceUsage,
+    handleWorkflows,
+    handleFleet,
     handleCapabilities,
+    handleSideQuery,
+    handleTasks,
+    handleRuns,
+    handleWorkflowAgentSteer,
+    handleRunVerbs,
+    handleLeader,
     handleImages,
+    handleApprovalsAssistant,
     handleObservability,
     handleMemoryPolicy,
     handleSessionsList,
     handleSessions,
     handleSessionSync,
     handleAttachments,
+    handleNotifyWake,
 ];
 void ROUTE_DOMAINS;
 export function createHttpServer(rawDeps) {
@@ -219,14 +171,14 @@ export function createHttpServer(rawDeps) {
         void handle(req, res).catch((err) => {
             if (err instanceof HttpError) {
                 if (!res.headersSent)
-                    sendJson(res, err.status, { error: err.message, ...(err.code ? { code: err.code, errorCode: err.code } : {}), ...(err.extra ?? {}) });
+                    sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.code ? { code: err.code } : {}), ...(err.extra ?? {}) });
                 else
                     res.end();
                 return;
             }
             deps.logger?.error("request_error", { method: req.method, url: req.url, err: msg(err) });
             if (!res.headersSent)
-                sendJson(res, 500, { error: "internal error" });
+                sendError(res, 500, "internal.error", "internal error");
             else
                 res.end();
         });
@@ -236,6 +188,7 @@ export function createHttpServer(rawDeps) {
         registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, leaseDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal() },
+        legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, resumePlanReview },
     };
     async function handle(req, res) {
         const startedAt = Date.now();
@@ -247,7 +200,7 @@ export function createHttpServer(rawDeps) {
             counters.admittedInflight++;
         let logged = false;
         const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
-        const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, req: reqState };
+        const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
         const record = (viaClose) => {
             if (logged)
                 return;
@@ -293,2438 +246,117 @@ export function createHttpServer(rawDeps) {
                 port: deps.config.port,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
-                ...(() => {
-                    const stuck = deps.planeDeferredState?.();
-                    return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
-                })(),
-            });
-            return;
-        }
-        if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
-            if (!deps.metrics) {
-                sendJson(res, 404, { error: "metrics disabled" });
-                return;
-            }
-            const { authToken: t, metricsToken: mt } = deps.config;
-            const anyT = Boolean(t) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-            const ok = (!anyT && !mt) || (anyT && systemFor(req, deps.config) !== undefined) || (!!mt && authorized(req, mt));
-            if (!ok) {
-                sendJson(res, 401, { error: "unauthorized" });
-                return;
-            }
-            if (url === "/metrics/summary") {
-                sendJson(res, 200, { model: deps.config.model.id, ...deps.metrics.summarize() });
-                return;
-            }
-            if (url === "/metrics/plan-cache") {
-                sendJson(res, 200, { scopes: deps.planCacheProbe?.dump() ?? {} });
-                return;
-            }
-            res.writeHead(200, { "content-type": "text/plain; version=0.0.4" });
-            res.end(deps.metrics.render());
-            return;
-        }
-        if (deps.registryJwtVerifier) {
-            const authz = req.headers.authorization ?? "";
-            const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
-            if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.registryJwtVerifier.verify(rawBearer);
-                if (v.ok) {
-                    setSsoPrincipal(req, v.identity.principal);
-                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
-                    if (v.identity.scope)
-                        setSsoScope(req, v.identity.scope);
-                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
-                }
-            }
-        }
-        if (req.method === "GET" && url === "/v1/tasks/source-summary") {
-            if (!isFleetWide(req)) {
-                sendJson(res, 401, { error: "unauthorized" });
-                return;
-            }
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "trace API requires the TiDB run store (SESSION_BACKEND=tidb)" });
-                return;
-            }
-            const q = new URL(req.url ?? "", "http://x").searchParams;
-            const sinceSec = Math.min(30 * 86_400, Math.max(60, Number(q.get("sinceSec") ?? 86_400) || 86_400));
-            sendJson(res, 200, { sinceSec, rows: await deps.runStore.sourceSummary(Date.now() - sinceSec * 1000) });
-            return;
-        }
-        const traceMatch = req.method === "GET" ? TRACE_RE.exec(url) : null;
-        if (traceMatch) {
-            const fleetWide = isFleetWide(req);
-            const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
-            if (!fleetWide && gateOwner === null) {
-                sendJson(res, 401, { error: "unauthorized" });
-                return;
-            }
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "trace API requires the TiDB run store (SESSION_BACKEND=tidb)" });
-                return;
-            }
-            const query = new URL(req.url ?? "", "http://x").searchParams;
-            const taskId = traceMatch[1];
-            const sub = traceMatch[2];
-            if (taskId && gateOwner !== null) {
-                const run = await deps.runStore.getRun(taskId);
-                if (!run || (run.owner !== null && run.owner !== gateOwner)) {
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-            }
-            if (!taskId)
-                await handleTaskList(res, deps.runStore, query, gateOwner);
-            else if (sub === "/turns")
-                await handleTaskTurns(res, deps.runStore, taskId, query);
-            else if (sub === "/stream")
-                await streamTaskTrace(req, res, deps.runStore, taskId, deps.config.runStaleSec * 1000);
-            else if (sub === "/artifacts")
-                await handleTaskArtifacts(res, deps.runStore, taskId);
-            else
-                sendJson(res, 404, { error: "not found" });
-            return;
-        }
-        if (url.startsWith("/v1/usage/") && req.method === "GET") {
-            const sub = url.slice("/v1/usage/".length).split("?")[0];
-            if (sub === "summary" || sub === "series" || sub === "breakdown") {
-                if (!deps.runStore) {
-                    sendJson(res, 501, { error: "usage analytics requires a run store" });
-                    return;
-                }
-                const fleetWide = isFleetWide(req);
-                const jwtOwner = fleetWide ? undefined : gatedPrincipal(req, deps.config);
-                if (!fleetWide && !jwtOwner) {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-                const q = new URL(req.url ?? "", "http://x").searchParams;
-                const parseT = (v, dflt) => {
-                    if (!v)
-                        return dflt;
-                    const n = /^\d+$/.test(v) ? Number(v) : Date.parse(v);
-                    return Number.isFinite(n) ? n : NaN;
-                };
-                const now = Date.now();
-                const from = parseT(q.get("from"), now - 7 * 86_400_000);
-                const to = parseT(q.get("to"), now);
-                if (Number.isNaN(from) || Number.isNaN(to) || from >= to) {
-                    sendJson(res, 400, { error: "invalid from/to (ISO-8601 or epoch-ms; from < to)" });
-                    return;
-                }
-                const owner = jwtOwner ?? (q.get("principal") ?? undefined);
-                try {
-                    const scan = await deps.runStore.usageScan(from, to, owner !== undefined ? { owner } : undefined);
-                    const base = { from: new Date(from).toISOString(), to: new Date(to).toISOString(), ...(scan.truncated ? { truncated: true } : {}) };
-                    if (sub === "summary") {
-                        sendJson(res, 200, { ...base, ...usageSummary(scan.rows) });
-                    }
-                    else if (sub === "series") {
-                        const metric = (q.get("metric") ?? "costUsd");
-                        const granularity = (q.get("granularity") ?? "day");
-                        if (!["tasks", "tokensIn", "tokensOut", "costUsd"].includes(metric) || !["hour", "day"].includes(granularity)) {
-                            sendJson(res, 400, { error: "metric=tasks|tokensIn|tokensOut|costUsd, granularity=hour|day" });
-                            return;
-                        }
-                        sendJson(res, 200, { ...base, metric, granularity, series: usageSeries(scan.rows, metric, granularity) });
-                    }
-                    else {
-                        const dimension = (q.get("dimension") ?? "principal");
-                        if (!["principal", "model"].includes(dimension)) {
-                            sendJson(res, 400, { error: "dimension=principal|model" });
-                            return;
-                        }
-                        sendJson(res, 200, { ...base, dimension, breakdown: usageBreakdown(scan.rows, dimension) });
-                    }
-                }
-                catch (err) {
-                    deps.logger?.warn?.("usage_analytics_failed", { err: String(err) });
-                    sendJson(res, 500, { error: "usage analytics failed" });
-                }
-                return;
-            }
-        }
-        const wfMatch = req.method === "GET" ? WORKFLOWS_RE.exec(url) : null;
-        if (wfMatch) {
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && !principal) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            if (!deps.workflowRunStore) {
-                sendJson(res, 501, { error: "workflow runs require self-orchestration (SELF_ORCHESTRATION_ENABLED)" });
-                return;
-            }
-            const scope = principal ?? "default";
-            const wfId = wfMatch[1];
-            const isStream = wfMatch[2] === "/stream";
-            if (!wfId) {
-                const q = new URL(req.url ?? "", "http://x").searchParams;
-                const statusFilter = q.get("status");
-                const limit = Math.min(100, Math.max(1, Number(q.get("limit") ?? 50) || 50));
-                const sessionFilter = q.get("session");
-                const sessionRuns = await deps.workflowRunStore.listByScope(scope, {
-                    ...(statusFilter ? { status: statusFilter } : {}),
-                    limit,
-                    ...(sessionFilter !== null ? { session: sessionFilter } : {}),
-                });
-                const redacted = sessionRuns.map((r) => ({
-                    ...r,
-                    ...(r.name !== undefined ? { name: redactSecrets(r.name) } : {}),
-                    ...(r.description !== undefined ? { description: redactSecrets(r.description) } : {}),
-                    ...(r.currentPhase !== undefined ? { currentPhase: redactSecrets(r.currentPhase) } : {}),
-                }));
-                sendJson(res, 200, { workflows: redacted });
-                return;
-            }
-            const run = await getWorkflowRun(deps.workflowRunStore, wfId, scope);
-            if (!run || run.scope !== scope) {
-                sendJson(res, 404, { error: "workflow not found" });
-                return;
-            }
-            if (!runSessionAcceptOk(req, res, { sessionId: run.originatingSessionId ?? null }, wfMatch[2] === "/journal" ? "workflow.journal" : isStream ? "workflow.stream" : "workflow.detail", "workflow not found"))
-                return;
-            if (wfMatch[2] === "/journal") {
-                if (!deps.workflowJournalStore) {
-                    sendJson(res, 501, { error: "workflow journal requires the journal store (SELF_ORCHESTRATION_ENABLED + a store backend)" });
-                    return;
-                }
-                const jq = new URL(req.url ?? "", "http://x").searchParams;
-                const jLimit = Math.min(50, Math.max(1, Number(jq.get("limit") ?? 20) || 20));
-                const jOffset = Math.max(0, Number(jq.get("offset") ?? 0) || 0);
-                const MAX_ROW_BYTES = 64 * 1024;
-                const firstLine = (t) => (t ? redactSecrets(t.split("\n")[0].slice(0, 300)) : undefined);
-                const projectResult = (callKey, r) => ({
-                    callKey,
-                    ordinal: callKeyOrdinal(callKey),
-                    status: r.status,
-                    ...(r.errorMessage ? { error: firstLine(r.errorMessage) } : {}),
-                    ...(r.result ? { result: redactSecrets(r.result.slice(0, 2000)) } : {}),
-                    ...(r.stats ? { tokens: r.stats.tokens, turns: r.stats.turns } : {}),
-                });
-                const js = deps.workflowJournalStore;
-                let projected;
-                if (js.loadPage) {
-                    const page = await js.loadPage(wfId, scope, { offset: jOffset, limit: jLimit, maxResultBytes: MAX_ROW_BYTES });
-                    projected = page.map((row) => {
-                        if (row.resultJson === null) {
-                            return { callKey: row.callKey, ordinal: callKeyOrdinal(row.callKey), truncated: true, resultBytes: row.resultBytes };
-                        }
-                        try {
-                            return projectResult(row.callKey, JSON.parse(row.resultJson));
-                        }
-                        catch {
-                            return { callKey: row.callKey, ordinal: callKeyOrdinal(row.callKey), truncated: true, resultBytes: row.resultBytes };
-                        }
-                    });
-                }
-                else {
-                    const entries = await deps.workflowJournalStore.load(wfId, scope);
-                    projected = entries
-                        .sort((a, b) => callKeyOrdinal(a.callKey) - callKeyOrdinal(b.callKey))
-                        .slice(jOffset, jOffset + jLimit)
-                        .map((en) => {
-                        const bytes = Buffer.byteLength(JSON.stringify(en.result));
-                        return bytes > MAX_ROW_BYTES
-                            ? { callKey: en.callKey, ordinal: callKeyOrdinal(en.callKey), truncated: true, resultBytes: bytes }
-                            : projectResult(en.callKey, en.result);
-                    });
-                }
-                sendJson(res, 200, { runId: wfId, entries: projected, ...(projected.length === jLimit ? { nextOffset: jOffset + jLimit } : {}) });
-                return;
-            }
-            if (isStream)
-                await streamWorkflowRun(req, res, wfId, scope);
-            else
-                sendJson(res, 200, summarizeWorkflowDetail(run));
-            return;
-        }
-        if (req.method === "GET" && new URL(req.url ?? "", "http://x").pathname === "/v1/fleet/stream") {
-            if (!deps.fleetBus) {
-                sendJson(res, 501, { error: "fleet stream requires self-orchestration / fleet wiring" });
-                return;
-            }
-            const { fleetWide } = sessionOwnerScope(req);
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && !principal && !fleetWide) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const fleetParams = new URL(req.url ?? "", "http://x").searchParams;
-            const callerSession = fleetParams.get("session");
-            const observeOnly = fleetParams.get("observe") === "1";
-            await streamFleet(req, res, deps.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox);
-            return;
-        }
-        let source = null;
-        const anyServiceAuth = Boolean(deps.config.authToken) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        if (anyServiceAuth) {
-            const sys = systemFor(req, deps.config);
-            if (sys === undefined) {
-                if (ssoVerifiedPrincipal(req)) {
-                    source = "sso";
-                }
-                else {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-            }
-            else {
-                source = sys;
-            }
-        }
-        reqState.source = source;
-        if (req.method === "POST" &&
-            !anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) {
-            sendJson(res, 503, {
-                error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions",
-            });
-            return;
-        }
-        if (deps.drainState?.draining && req.method === "POST" && isBillableSubmitPath(url)) {
-            res.setHeader("retry-after", "15");
-            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance" });
-            return;
-        }
-        if (deps.modelReady && !deps.modelReady() && req.method === "POST" && isBillableSubmitPath(url)) {
-            res.setHeader("retry-after", "5");
-            sendJson(res, 503, { error: "model_roster_pending", message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
-            return;
-        }
-        if (req.method === "PUT" &&
-            !anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            /^\/v1\/sessions\/[^/]+\/policy$/.test(url)) {
-            sendJson(res, 503, {
-                error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting session-policy writes",
-            });
-            return;
-        }
-        if (await handleCapabilities(req, res, url, ctx))
-            return;
-        if (req.method === "POST" && url === "/v1/side-query") {
-            const ac = new AbortController();
-            const onClose = () => ac.abort();
-            res.on("close", onClose);
-            try {
-                if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                    return;
-                const principal = gatedPrincipal(req, deps.config);
-                if (deps.config.requirePrincipal && !principal) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                let body;
-                try {
-                    const raw = await readJson(req);
-                    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
-                        throw new HttpError(400, "body must be a JSON object (SideQuerySpec shape)");
-                    body = raw;
-                }
-                catch (e) {
-                    const he = e instanceof HttpError ? e : new HttpError(400, msg(e));
-                    sendJson(res, he.status, { error: he.message });
-                    return;
-                }
-                if (!Array.isArray(body.messages) || body.messages.length === 0) {
-                    sendJson(res, 400, { error: "messages must be a non-empty array (SideQueryMessage[])" });
-                    return;
-                }
-                if (body.thinking !== undefined && !isThinkingLevel(body.thinking)) {
-                    sendJson(res, 400, { error: "invalid thinking level" });
-                    return;
-                }
-                if (ac.signal.aborted)
-                    return;
-                const spec = {
-                    messages: body.messages,
-                    ...(typeof body.model === "string" ? { model: body.model } : {}),
-                    ...(typeof body.modelRole === "string" ? { modelRole: body.modelRole } : {}),
-                    ...(isThinkingLevel(body.thinking) ? { thinking: body.thinking } : {}),
-                    ...(typeof body.systemPrompt === "string" ? { systemPrompt: body.systemPrompt } : {}),
-                    ...(Array.isArray(body.tools) ? { tools: body.tools } : {}),
-                    ...(typeof body.maxOutputTokens === "number" && Number.isFinite(body.maxOutputTokens) && body.maxOutputTokens > 0 ? { maxOutputTokens: Math.floor(body.maxOutputTokens) } : {}),
-                    signal: ac.signal,
-                };
-                try {
-                    const catalogSnapshot = Object.values(deps.runner.agentCatalog?.models ?? {}).map((m) => ({ id: m?.id, api: m?.api, params: m?.params?.promptCacheFamily ? { promptCacheFamily: m.params.promptCacheFamily } : undefined }));
-                    const result = await deps.runner.sideQuery(spec);
-                    const rr = result;
-                    const modelId = typeof rr.model === "string" ? rr.model : "unknown";
-                    const byId = catalogSnapshot.filter((m) => m.id === modelId);
-                    const families = new Set(byId.map((m) => cacheFamilyOfMirror(m)));
-                    const family = families.size === 1 ? [...families][0] : undefined;
-                    deps.sideQueryAccounting?.(principal, { model: modelId, ...(family ? { family } : {}), usage: rr.usage });
-                    deps.metrics?.inc?.("side_query_total", { result: "ok" });
-                    if (!res.writableEnded)
-                        sendJson(res, 200, result);
-                }
-                catch (e) {
-                    deps.metrics?.inc?.("side_query_total", { result: "error" });
-                    if (!res.writableEnded && !ac.signal.aborted) {
-                        const m = msg(e);
-                        const isValidation = /^Unknown model ref |^No model for role |requires a non-empty messages array/.test(m);
-                        sendJson(res, isValidation ? 400 : 500, { error: redactSecrets(m) });
-                    }
-                }
-            }
-            finally {
-                res.off("close", onClose);
-            }
-            return;
-        }
-        if (req.method === "POST" && (url === "/v1/tasks" || url === "/v1/tasks/stream")) {
-            const rawIdem = headerStr(req.headers["idempotency-key"]);
-            const idemKey = rawIdem ? scopedIdempotencyKey(rawIdem, source, gatedPrincipal(req, deps.config)) : undefined;
-            const cached = idemKey ? idemCache.peek(idemKey) : undefined;
-            if (cached) {
-                if (url === "/v1/tasks/stream") {
-                    sseHeaders(res);
-                    const hb = setInterval(() => {
-                        if (!res.writableEnded)
-                            res.write(`event: heartbeat\ndata: {}\n\n`);
-                    }, 15_000);
-                    try {
-                        const resp = await cached;
-                        if (!res.writableEnded)
-                            res.write(`data: ${JSON.stringify({ type: "done", result: resp.body, replay: true })}\n\n`);
-                    }
-                    finally {
-                        clearInterval(hb);
-                    }
-                    res.end();
-                }
-                else {
-                    const resp = await cached;
-                    sendJson(res, resp.status, resp.body);
-                }
-                return;
-            }
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                return;
-            const prepared = await prepareSpec(req, res);
-            if (!prepared)
-                return;
-            const principal = prepared.auth?.principal;
-            if (url === "/v1/tasks/stream") {
-                if (prepared.verify || prepared.cascade) {
-                    sendJson(res, 400, { error: "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs" });
-                    return;
-                }
-                const earlyDurableTid = deps.runStore && prepared.spec.sessionId ? uuidv7() : undefined;
-                const detachOnDisconnect = headerStr(req.headers["x-detach-on-disconnect"]) === "true";
-                if (detachOnDisconnect && earlyDurableTid === undefined) {
-                    sendJson(res, 400, { error: "x-detach-on-disconnect requires a durable run (a run store + sessionId) — without one the detached result would be unqueryable" });
-                    return;
-                }
-                reqState.streamTaskId = earlyDurableTid;
-                let usageKey;
-                reqState.streamDetached = detachOnDisconnect;
-                sseHeaders(res, earlyDurableTid ? { "x-task-id": earlyDurableTid } : undefined);
-                if (earlyDurableTid) {
-                    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", taskId: earlyDurableTid, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })}\n\n`);
-                }
-                const ac = new AbortController();
-                if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(ac.signal, prepared.spec.sessionId, prepared.auth?.principal);
-                let closed = false;
-                let detachLogged = false;
-                const onDisconnect = () => {
-                    if (detachOnDisconnect) {
-                        if (res.writableEnded)
-                            return;
-                        if (!detachLogged) {
-                            detachLogged = true;
-                            res.on("error", () => undefined);
-                            deps.logger?.info("stream_client_detached", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, detached: true });
-                        }
-                        return;
-                    }
-                    closed = true;
-                    ac.abort();
-                };
-                req.on("close", onDisconnect);
-                res.on("close", () => {
-                    if (!res.writableEnded)
-                        onDisconnect();
-                });
-                const hb = setInterval(() => {
-                    if (!res.writableEnded && !res.destroyed)
-                        res.write(`event: heartbeat\ndata: {}\n\n`);
-                }, 15_000);
-                let ranLive = false;
-                let resp;
-                counters.uncountedBillableInflight++;
-                try {
-                    resp = await idemCache.run(idemKey, async () => {
-                        ranLive = true;
-                        let finalResult;
-                        let runRowSettled = false;
-                        let durableTaskId;
-                        let durableHeartbeat;
-                        let userMsgEntryId;
-                        let anchorPut = false;
-                        const putRewindAnchor = () => {
-                            if (anchorPut || !userMsgEntryId || !durableTaskId || !prepared.spec.sessionId || !deps.resumeAnchorStore)
-                                return;
-                            anchorPut = true;
-                            void deps.resumeAnchorStore
-                                .put(prepared.spec.sessionId, durableTaskId, userMsgEntryId, principal ?? null)
-                                .catch(() => deps.metrics?.inc("resume_anchor_capture_failed"));
-                        };
-                        if (deps.runStore && prepared.spec.sessionId) {
-                            const tid = earlyDurableTid ?? uuidv7();
-                            const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
-                            if (created.ok)
-                                deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective);
-                            if (!created.ok) {
-                                const conflict = { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", activeTaskId: created.activeTaskId };
-                                res.write(`data: ${JSON.stringify({ type: "done", result: { status: "failed", errorMessage: conflict.error, activeTaskId: conflict.activeTaskId } })}\n\n`);
-                                return { status: 409, body: conflict };
-                            }
-                            durableTaskId = tid;
-                        }
-                        let ledgerSink;
-                        let ledgerTerminal = false;
-                        if (detachOnDisconnect && durableTaskId && deps.runStore) {
-                            const rs = deps.runStore;
-                            const tid = durableTaskId;
-                            ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking });
-                            usageKey = prepared.spec.sessionId;
-                            if (usageKey)
-                                deps.modelUsage?.register(usageKey);
-                        }
-                        if (deps.checkpointStore && prepared.spec.sessionId) {
-                            await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
-                        }
-                        if (durableTaskId && deps.runStore) {
-                            const rs = deps.runStore;
-                            const tid = durableTaskId;
-                            const owner = principal ?? null;
-                            const abortFromVerb = () => {
-                                cancelledViaVerb.add(tid);
-                                ac.abort();
-                            };
-                            durableHeartbeat = setInterval(() => {
-                                void rs.heartbeat(tid, owner).catch(() => undefined);
-                                if (!ac.signal.aborted) {
-                                    void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c)
-                                        abortFromVerb(); }).catch(() => undefined);
-                                }
-                            }, HEARTBEAT_MS);
-                            durableHeartbeat.unref?.();
-                            inflightRuns.set(tid, ac);
-                            void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !ac.signal.aborted)
-                                abortFromVerb(); }).catch(() => undefined);
-                        }
-                        let fleetPub;
-                        try {
-                            fleetPub = durableTaskId
-                                ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) })
-                                : undefined;
-                        }
-                        catch (e) {
-                            if (durableHeartbeat)
-                                clearInterval(durableHeartbeat);
-                            if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
-                                inflightRuns.delete(durableTaskId);
-                                cancelledViaVerb.delete(durableTaskId);
-                            }
-                            throw e;
-                        }
-                        let fleetSettled = false;
-                        const settleFleet = (status, residuals) => {
-                            if (fleetSettled)
-                                return;
-                            fleetSettled = true;
-                            fleetPub?.onTerminal(status, residuals);
-                        };
-                        let liveStreamRef;
-                        const subagentHandleEvictions = [];
-                        let syncLegLive = true;
-                        const syncNotifiedKeys = new NotifiedKeys();
-                        try {
-                            fleetPub?.onStart();
-                        }
-                        catch (e) {
-                            if (durableHeartbeat)
-                                clearInterval(durableHeartbeat);
-                            if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
-                                inflightRuns.delete(durableTaskId);
-                                cancelledViaVerb.delete(durableTaskId);
-                            }
-                            settleFleet("failed");
-                            throw e;
-                        }
-                        try {
-                            const streamBody = async () => {
-                                await withPrincipal(principal, async () => {
-                                    const fwdInternals = {
-                                        onForwardEvent: (e) => {
-                                            fleetPub?.onForwardEvent(e);
-                                            ledgerSink?.onForwardEvent(e);
-                                            {
-                                                const bg = e.bgAgentId;
-                                                if (bg !== undefined && defaultSubagentTailBus.hasSubscribers(bg)) {
-                                                    const f = projectTailFrame(e);
-                                                    if (f)
-                                                        defaultSubagentTailBus.publish(bg, f);
-                                                }
-                                            }
-                                            if (res.writableEnded)
-                                                return;
-                                            const t = e.type;
-                                            if (t === "task_progress") {
-                                                res.write(`data: ${JSON.stringify({ type: "task_progress", ...taskProgressEventData(e) })}\n\n`);
-                                            }
-                                            else if (t === "tool_start") {
-                                                const tsv = e;
-                                                res.write(`data: ${JSON.stringify({ type: "tool_start", ...toolStartEventData(tsv) })}\n\n`);
-                                            }
-                                            else if (t === "tool_end") {
-                                                const te = e;
-                                                res.write(`data: ${JSON.stringify({ type: "tool_end", ...toolEndEventData(te) })}\n\n`);
-                                            }
-                                            else if (t === "text_delta") {
-                                                const td = e;
-                                                res.write(`data: ${JSON.stringify({ type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) })}\n\n`);
-                                            }
-                                            else if (t === "reasoning_delta") {
-                                                const rd = e;
-                                                res.write(`data: ${JSON.stringify({ type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) })}\n\n`);
-                                            }
-                                        },
-                                        onTaskNotification: (n) => {
-                                            if (n.task_type === "workflow")
-                                                return;
-                                            if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
-                                                defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
-                                            }
-                                            const hadRow = fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false;
-                                            const deliverable = syncLegLive && !res.writableEnded && !res.destroyed;
-                                            const parked = !deliverable && Boolean(deps.workflowCompletionInbox && prepared.spec.sessionId);
-                                            deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
-                                            if (parked) {
-                                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
-                                            }
-                                            else if (deliverable) {
-                                                const key = taskNotificationStreamKey(n);
-                                                if (syncNotifiedKeys.get(key) === undefined) {
-                                                    syncNotifiedKeys.set(key, Promise.resolve(true));
-                                                    res.write(`data: ${JSON.stringify({ type: "task_notification", ...taskNotificationEventData({ notification: n }) })}\n\n`);
-                                                }
-                                            }
-                                        },
-                                        ...(deps.subagentSteerRegistry && durableTaskId
-                                            ? {
-                                                onSubagentSpawn: (handle) => {
-                                                    subagentHandleEvictions.push(deps.subagentSteerRegistry.register(durableTaskId, handle));
-                                                },
-                                            }
-                                            : {}),
-                                    };
-                                    const liveStream = deps.runner.runTaskStream({ ...prepared.spec, signal: ac.signal }, undefined, fwdInternals);
-                                    liveStreamRef = liveStream;
-                                    if (durableTaskId)
-                                        steerableRuns.set(durableTaskId, liveStream);
-                                    for await (const ev of liveStream) {
-                                        if (closed)
-                                            break;
-                                        if (ev.type === "message_committed" && ev.role === "user")
-                                            userMsgEntryId = ev.entryId;
-                                        if (ev.type === "done") {
-                                            finalResult = stripCheckpointToken(ev.result);
-                                            if (durableTaskId && finalResult)
-                                                finalResult = { ...finalResult, taskId: durableTaskId };
-                                            if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.status === "failed" && !finalResult.errorCode) {
-                                                finalResult = { ...finalResult, errorCode: "cancelled" };
-                                            }
-                                            finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
-                                            putRewindAnchor();
-                                            settleFleet(finalResult?.status ?? "completed", fleetRunResiduals(finalResult));
-                                            if (ledgerSink && finalResult) {
-                                                if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
-                                                    const rs2 = deps.runStore;
-                                                    const tid2 = durableTaskId;
-                                                    const fr = finalResult;
-                                                    finalResult = await attachModelUsage(fr, { append: ledgerSink.append, getEvents: (_id, after) => rs2.getEvents(tid2, after), modelUsage: deps.modelUsage, taskId: usageKey }).catch(() => fr);
-                                                }
-                                                await ledgerSink.onDone(finalResult);
-                                                ledgerTerminal = true;
-                                            }
-                                            res.write(`data: ${JSON.stringify({ ...ev, result: finalResult })}\n\n`);
-                                            continue;
-                                        }
-                                        if (ledgerSink) {
-                                            await ledgerSink.onEvent(ev);
-                                            if (ev.type === "turn_end" && usageKey)
-                                                await appendModelUsageDelta(ledgerSink.append, deps.modelUsage, usageKey);
-                                        }
-                                        fleetPub?.onEvent(ev);
-                                        if (ev.type === "status")
-                                            deps.metrics?.inc("brain_retry_total", { phase: String(ev.phase) });
-                                        if (ev.type === "status") {
-                                            res.write(`data: ${JSON.stringify({ type: "status", ...brainStatusEventData(ev) })}\n\n`);
-                                        }
-                                        else if (ev.type === "tool_end") {
-                                            const te = ev;
-                                            res.write(`data: ${JSON.stringify({ type: "tool_end", ...toolEndEventData(te) })}\n\n`);
-                                        }
-                                        else if (ev.type === "tool_start") {
-                                            const tsv = ev;
-                                            res.write(`data: ${JSON.stringify({ type: "tool_start", ...toolStartEventData(tsv) })}\n\n`);
-                                        }
-                                        else if (ev.type === "task_notification") {
-                                            const tnv = ev.notification;
-                                            const tnvKey = tnv?.task_id ? taskNotificationStreamKey({ task_type: tnv.task_type, task_id: tnv.task_id, status: String(tnv.status), seq: tnv.seq }) : undefined;
-                                            const tnvPrior = tnvKey !== undefined ? syncNotifiedKeys.get(tnvKey) : undefined;
-                                            if (tnvPrior === undefined || !(await tnvPrior)) {
-                                                if (tnvKey !== undefined)
-                                                    syncNotifiedKeys.set(tnvKey, Promise.resolve(true));
-                                                res.write(`data: ${JSON.stringify({ type: "task_notification", ...taskNotificationEventData(ev) })}\n\n`);
-                                            }
-                                        }
-                                        else if (ev.type === "reasoning_delta" && typeof ev.delta === "string") {
-                                            res.write(`data: ${JSON.stringify({ type: "reasoning_delta", delta: redactSecrets(ev.delta), ...(ev.eventId ? { eventId: ev.eventId } : {}), ...(ev.parentToolCallId ? { parentToolCallId: ev.parentToolCallId } : {}) })}\n\n`);
-                                        }
-                                        else if (ev.type === "task_progress") {
-                                            res.write(`data: ${JSON.stringify({ type: "task_progress", ...taskProgressEventData(ev) })}\n\n`);
-                                        }
-                                        else if (ev.type === "compacted") {
-                                            res.write(`data: ${JSON.stringify({ type: "compacted", ...compactedEventData(ev) })}\n\n`);
-                                        }
-                                        else if (ev.type === "diagnostics") {
-                                            res.write(`data: ${JSON.stringify({ type: "diagnostics", ...diagnosticsEventData(ev) })}\n\n`);
-                                        }
-                                        else if (ev.type === "steering_injected") {
-                                            res.write(`data: ${JSON.stringify({ type: "steering_injected", ...steeringInjectedEventData(ev) })}\n\n`);
-                                        }
-                                        else if (ev.type === "workspace_changed") {
-                                            res.write(`data: ${JSON.stringify({ type: "workspace_changed", ...workspaceChangedEventData(ev) })}\n\n`);
-                                        }
-                                        else if (ev.type === "text_delta" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
-                                            const e = ev;
-                                            const ident = {
-                                                ...(e.eventId !== undefined ? { eventId: e.eventId } : {}),
-                                                ...(e.parentToolCallId !== undefined ? { parentToolCallId: e.parentToolCallId } : {}),
-                                                ...(e.sourceTaskId !== undefined ? { sourceTaskId: e.sourceTaskId } : {}),
-                                                ...(e.bgAgentId !== undefined ? { bgAgentId: e.bgAgentId } : {}),
-                                            };
-                                            const arm = ev.type === "text_delta"
-                                                ? { type: "text_delta", delta: e.delta, ...ident }
-                                                : ev.type === "turn_end"
-                                                    ? { type: "turn_end", ...(e.usage !== undefined ? { usage: e.usage } : {}), ...(e.usageMissing !== undefined ? { usageMissing: e.usageMissing } : {}), ...(e.stopReason !== undefined ? { stopReason: e.stopReason } : {}), ...ident }
-                                                    : ev.type === "message_committed"
-                                                        ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
-                                                        : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
-                                            res.write(`data: ${JSON.stringify(arm)}\n\n`);
-                                        }
-                                        else {
-                                            res.write(`data: ${JSON.stringify(ev)}\n\n`);
-                                        }
-                                    }
-                                });
-                            };
-                            const askTaskId = durableTaskId ?? uuidv7();
-                            const askOwner = gatedPrincipal(req, deps.config) ?? null;
-                            const emitAsk = (frame) => {
-                                if (!res.writableEnded)
-                                    res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
-                            };
-                            await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, prepared.spec.sessionId, askOwner, (frame) => {
-                                if (closed || res.writableEnded || res.destroyed)
-                                    throw new Error("stream ended before the completion frame was written");
-                                const f = frame;
-                                if (f.type === "task_notification" && f.task_id)
-                                    syncNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), Promise.resolve(true));
-                                res.write(`data: ${JSON.stringify(frame)}\n\n`);
-                            }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
-                            const withElicit = deps.elicitation
-                                ? () => deps.elicitation.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitAsk, abortSignal: ac.signal }, streamBody)
-                                : streamBody;
-                            const withQuestion = () => deps.question
-                                ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitAsk, abortSignal: ac.signal }, withElicit)
-                                : withElicit();
-                            const emitApproval = (frame) => {
-                                if (res.writableEnded || res.destroyed)
-                                    throw new Error("live stream ended — approval card undeliverable");
-                                emitAsk(frame);
-                            };
-                            const approvalCtx = deps.toolApproval
-                                ? { taskId: askTaskId, owner: askOwner, emit: emitApproval, abortSignal: ac.signal, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) }
-                                : undefined;
-                            if (approvalCtx && deps.toolApproval) {
-                                prepared.spec.onAsk = deps.toolApproval.boundAsk({
-                                    owner: askOwner,
-                                    taskId: askTaskId,
-                                    ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
-                                });
-                            }
-                            const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                            await (deps.sendUserFile
-                                ? deps.sendUserFile.runWithContext({
-                                    taskId: askTaskId,
-                                    emit: async (f) => {
-                                        void (await emitAsk(f));
-                                        if (ledgerSink) {
-                                            const { type, ...rest } = f;
-                                            await ledgerSink.append(type, rest).catch(() => undefined);
-                                        }
-                                    },
-                                }, withApproval)
-                                : withApproval());
-                            if (durableTaskId && deps.runStore) {
-                                if (finalResult?.status === "suspended" && deps.checkpointStore)
-                                    await deps.runStore.setSuspended(durableTaskId);
-                                else if (finalResult?.status === "needs_review" && deps.checkpointStore)
-                                    await deps.runStore.setNeedsReview(durableTaskId);
-                                else if (finalResult)
-                                    await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
-                                else {
-                                    putRewindAnchor();
-                                    const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
-                                    if (pending) {
-                                        if (ledgerSink && !ledgerTerminal) {
-                                            ledgerTerminal = true;
-                                            await ledgerSink.flush().catch(() => undefined);
-                                            await ledgerSink.appendParked("suspended", {}).catch(() => undefined);
-                                        }
-                                        await deps.runStore.setSuspended(durableTaskId);
-                                        settleFleet("suspended");
-                                    }
-                                    else {
-                                        const dcErr = "stream client disconnected before completion (run aborted)";
-                                        const dc = { taskId: durableTaskId, sessionId: prepared.spec.sessionId ?? "", status: "failed", errorCode: "cancelled", errorMessage: dcErr, stats: { turns: 0, tokens: 0 } };
-                                        if (ledgerSink && !ledgerTerminal) {
-                                            ledgerTerminal = true;
-                                            await ledgerSink.flush().catch(() => undefined);
-                                            await ledgerSink.append("failed", { errorMessage: dcErr, errorCode: "cancelled" }).catch(() => undefined);
-                                        }
-                                        await deps.runStore.setTerminal(durableTaskId, "failed", dc, dcErr);
-                                        settleFleet("failed");
-                                    }
-                                }
-                                runRowSettled = true;
-                            }
-                        }
-                        finally {
-                            syncLegLive = false;
-                            if (durableHeartbeat)
-                                clearInterval(durableHeartbeat);
-                            if (durableTaskId && steerableRuns.get(durableTaskId) === liveStreamRef)
-                                steerableRuns.delete(durableTaskId);
-                            if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
-                                inflightRuns.delete(durableTaskId);
-                                cancelledViaVerb.delete(durableTaskId);
-                            }
-                            for (const evict of subagentHandleEvictions)
-                                evict();
-                            if (!runRowSettled && durableTaskId && deps.runStore) {
-                                try {
-                                    const row = await deps.runStore.getRun(durableTaskId);
-                                    if (row?.status === "running") {
-                                        const pending = prepared.spec.sessionId ? await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId) : undefined;
-                                        if (pending) {
-                                            if (ledgerSink && !ledgerTerminal) {
-                                                ledgerTerminal = true;
-                                                await ledgerSink.flush().catch(() => undefined);
-                                                await ledgerSink.appendParked("suspended", {}).catch(() => undefined);
-                                            }
-                                            await deps.runStore.setSuspended(durableTaskId);
-                                            settleFleet("suspended");
-                                        }
-                                        else if (finalResult) {
-                                            if (ledgerSink && !ledgerTerminal) {
-                                                ledgerTerminal = true;
-                                                await ledgerSink.onDone(finalResult).catch(() => undefined);
-                                            }
-                                            await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
-                                            settleFleet(finalResult.status, fleetRunResiduals(finalResult));
-                                        }
-                                        else if (ac.signal.aborted) {
-                                            const err = "stream aborted before completion (run cancelled)";
-                                            const c = { taskId: durableTaskId, sessionId: prepared.spec.sessionId ?? "", status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 } };
-                                            if (ledgerSink && !ledgerTerminal) {
-                                                ledgerTerminal = true;
-                                                await ledgerSink.flush().catch(() => undefined);
-                                                await ledgerSink.append("failed", { errorMessage: err, errorCode: "cancelled" }).catch(() => undefined);
-                                            }
-                                            await deps.runStore.setTerminal(durableTaskId, "failed", c, err);
-                                        }
-                                        else {
-                                            const err = "stream leg threw before a terminal event";
-                                            if (ledgerSink && !ledgerTerminal) {
-                                                ledgerTerminal = true;
-                                                await ledgerSink.flush().catch(() => undefined);
-                                                await ledgerSink.append("failed", { errorMessage: err }).catch(() => undefined);
-                                            }
-                                            await deps.runStore.setTerminal(durableTaskId, "failed", null, err);
-                                        }
-                                    }
-                                }
-                                catch {
-                                }
-                            }
-                            settleFleet("failed");
-                        }
-                        return { status: 200, body: finalResult };
-                    }, (r) => r.body?.status === "completed");
-                }
-                catch (e) {
-                    deps.logger?.error("stream_error", { closed, err: e instanceof Error ? e.message : String(e) });
-                    if (!closed)
-                        throw e;
-                }
-                finally {
-                    counters.uncountedBillableInflight--;
-                    clearInterval(hb);
-                    if (usageKey)
-                        deps.modelUsage?.clear(usageKey);
-                }
-                if (!ranLive && resp && !res.writableEnded) {
-                    res.write(`data: ${JSON.stringify({ type: "done", result: resp.body, replay: true })}\n\n`);
-                }
-                res.end();
-            }
-            else {
-                const resp = await idemCache.run(idemKey, async () => {
-                    let durableTaskId;
-                    let durableHeartbeat;
-                    if (deps.runStore && prepared.spec.sessionId) {
-                        const tid = uuidv7();
-                        const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
-                        if (!created.ok)
-                            return { status: 409, body: { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", activeTaskId: created.activeTaskId } };
-                        deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective);
-                        durableTaskId = tid;
-                    }
-                    if (deps.checkpointStore && prepared.spec.sessionId) {
-                        await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
-                    }
-                    const syncCancelCtrl = new AbortController();
-                    if (prepared.spec.sessionId)
-                        markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, prepared.spec.sessionId, prepared.auth?.principal);
-                    if (durableTaskId && deps.runStore) {
-                        const rs = deps.runStore;
-                        const tid = durableTaskId;
-                        const owner = principal ?? null;
-                        const abortFromVerb = () => {
-                            cancelledViaVerb.add(tid);
-                            syncCancelCtrl.abort();
-                        };
-                        durableHeartbeat = setInterval(() => {
-                            void rs.heartbeat(tid, owner).catch(() => undefined);
-                            if (!syncCancelCtrl.signal.aborted) {
-                                void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c)
-                                    abortFromVerb(); }).catch(() => undefined);
-                            }
-                        }, HEARTBEAT_MS);
-                        durableHeartbeat.unref?.();
-                        inflightRuns.set(tid, syncCancelCtrl);
-                        void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !syncCancelCtrl.signal.aborted)
-                            abortFromVerb(); }).catch(() => undefined);
-                    }
-                    else if (durableTaskId) {
-                        inflightRuns.set(durableTaskId, syncCancelCtrl);
-                    }
-                    const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal };
-                    let result;
-                    let cancelVerbLabel = false;
-                    counters.uncountedBillableInflight++;
-                    try {
-                        result = await withPrincipal(principal, () => prepared.verify
-                            ? runWithVerification(deps.runner, specWithSignal, prepared.verify)
-                            : prepared.cascade
-                                ? runCascade(deps.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.maxCostUsd))
-                                : deps.runner.runTask(specWithSignal));
-                    }
-                    finally {
-                        counters.uncountedBillableInflight--;
-                        if (durableHeartbeat)
-                            clearInterval(durableHeartbeat);
-                        if (durableTaskId && inflightRuns.get(durableTaskId) === syncCancelCtrl) {
-                            inflightRuns.delete(durableTaskId);
-                            cancelVerbLabel = cancelledViaVerb.has(durableTaskId);
-                            cancelledViaVerb.delete(durableTaskId);
-                        }
-                    }
-                    if (cancelVerbLabel && result.status === "failed" && !result.errorCode) {
-                        result = { ...result, errorCode: "cancelled" };
-                    }
-                    const resumeAtStatus = resumeAtHttpStatus(result);
-                    if (resumeAtStatus) {
-                        if (durableTaskId && deps.runStore)
-                            await deps.runStore.setTerminal(durableTaskId, "failed", stripCheckpointToken(result), result.errorMessage ?? null);
-                        return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: result.errorMessage ?? "resume-at failed" } };
-                    }
-                    if (result.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
-                        if (durableTaskId)
-                            await deps.runStore.setSuspended(durableTaskId);
-                        return { status: 200, body: { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" } };
-                    }
-                    if (result.status === "needs_review" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
-                        if (durableTaskId)
-                            await deps.runStore.setNeedsReview(durableTaskId);
-                        return { status: 200, body: { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" } };
-                    }
-                    if (durableTaskId && deps.runStore)
-                        await deps.runStore.setTerminal(durableTaskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
-                    finalizeTaskResult(result, principal, prepared.spec.objective, prepared.spec.sessionId);
-                    return { status: 200, body: stripCheckpointToken(result) };
-                }, (r) => r.status < 400);
-                sendJson(res, resp.status, resp.body);
-            }
-            return;
-        }
-        if (req.method === "POST" && url === "/v1/runs") {
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store (SESSION_BACKEND=tidb)" });
-                return;
-            }
-            const rawIdem = headerStr(req.headers["idempotency-key"]);
-            const idemKey = rawIdem ? scopedIdempotencyKey(rawIdem, source, gatedPrincipal(req, deps.config)) : undefined;
-            const cached = idemKey ? idemCache.peek(idemKey) : undefined;
-            if (cached) {
-                const resp = await cached;
-                sendJson(res, resp.status, resp.body);
-                return;
-            }
-            if (rateLimited(req, res) || quotaExceeded(req, res))
-                return;
-            const prepared = await prepareSpec(req, res);
-            if (!prepared)
-                return;
-            const runStore = deps.runStore;
-            const rawClientTaskId = prepared.body.taskId;
-            if (rawClientTaskId !== undefined && (typeof rawClientTaskId !== "string" || !isUuidV7(rawClientTaskId))) {
-                sendJson(res, 400, { error: "body.taskId must be a uuidv7 string (caller-minted idempotency key)" });
-                return;
-            }
-            const clientTaskId = rawClientTaskId;
-            if (clientTaskId) {
-                const existing = await runStore.getRun(clientTaskId);
-                if (existing) {
-                    const verified = verifiedPrincipal(req, deps.config);
-                    if (existing.owner !== null && existing.owner !== verified) {
-                        sendJson(res, 409, { error: "taskId already exists" });
-                        return;
-                    }
-                    sendJson(res, 202, { taskId: existing.taskId, sessionId: existing.sessionId, status: existing.status });
-                    return;
-                }
-            }
-            if (await leaseDenied(req, res))
-                return;
-            const resp = await idemCache.run(idemKey, async () => {
-                const sessionId = prepared.spec.sessionId ?? uuidv7();
-                const taskId = clientTaskId ?? uuidv7();
-                const created = await runStore.createRun(taskId, sessionId, prepared.auth?.principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
-                if (created.ok)
-                    deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective);
-                if (!created.ok) {
-                    if (clientTaskId && created.activeTaskId === clientTaskId) {
-                        return { status: 202, body: { taskId: clientTaskId, sessionId, status: "running" } };
-                    }
-                    return { status: 409, body: { error: "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", activeTaskId: created.activeTaskId } };
-                }
-                if (deps.checkpointStore) {
-                    await deps.checkpointStore.putCtx(sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
-                }
-                const anchorOwner = prepared.auth?.principal ?? null;
-                const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
-                    ? async (eventId) => {
-                        const leaf = await getLeafId(sessionId);
-                        if (leaf)
-                            await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
-                    }
-                    : undefined;
-                const captureUserMessageAnchor = deps.resumeAnchorStore
-                    ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-                    : undefined;
-                const fleetPub = fleetRunPublisher(deps.fleetBus, {
-                    runId: taskId,
-                    scope: gatedPrincipal(req, deps.config) ?? "default",
-                    rootTaskId: taskId,
-                    ...fleetRunLabels(prepared.spec.objective),
-                });
-                void runInBackground(deps.runner, { ...prepared.spec, sessionId }, runStore, taskId, deps.metrics, prepared.auth?.principal, prepared.verify, prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, prepared.spec.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, gatedPrincipal(req, deps.config) ?? null, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests);
-                return { status: 202, body: { taskId, sessionId, status: "running" } };
-            }, (r) => r.status === 202);
-            sendJson(res, resp.status, resp.body);
-            return;
-        }
-        const runMatch = req.method === "GET" ? RUN_ID_RE.exec(url) : null;
-        if (runMatch) {
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store" });
-                return;
-            }
-            const taskId = runMatch[1];
-            if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const run = await deps.runStore.getRun(taskId);
-            if (!run) {
-                sendJson(res, 404, runNotFoundBody(taskId));
-                return;
-            }
-            if (!runOwnerOk(req, res, run.owner))
-                return;
-            if (!runSessionAcceptOk(req, res, run, runMatch[2] ? "run.events" : "run.poll"))
-                return;
-            if (runMatch[2]) {
-                await streamRunEvents(req, res, deps.runStore, taskId, deps.config.runStaleSec * 1000);
-            }
-            else {
-                const stale = run.status === "running" && Date.now() - new Date(run.updatedAt).getTime() > deps.config.runStaleSec * 1000;
-                const infraRates = deps.config.infraCostRates;
-                const needCost = Boolean(run.result?.stats && !stale && infraRates && hasInfraPricing(infraRates));
-                const needSuggestions = !stale && run.status === "completed";
-                const events = (needCost || needSuggestions) && deps.runStore.getEvents ? await deps.runStore.getEvents(taskId, 0).catch(() => []) : undefined;
-                let supervisorCost;
-                if (needCost && events && run.result?.stats) {
-                    const durMs = new Date(run.updatedAt).getTime() - new Date(run.createdAt).getTime();
-                    const usage = infraUsageFromEvents(events, Number.isFinite(durMs) ? durMs : 0);
-                    const st = run.result.stats;
-                    supervisorCost = composeSupervisorCost(st.costBreakdown ?? null, st.costMicroUsd ?? 0, infraCost(usage, infraRates));
-                }
-                let suggestions;
-                if (needSuggestions && events) {
-                    const sug = [...events].reverse().find((e) => e.type === "suggestions");
-                    const arr = sug?.data?.suggestions;
-                    if (Array.isArray(arr))
-                        suggestions = arr.map((s) => String(s));
-                }
-                sendJson(res, 200, {
-                    taskId: run.taskId,
-                    sessionId: run.sessionId,
-                    status: stale ? "failed" : run.status,
-                    result: run.result ?? undefined,
-                    supervisorCost,
-                    suggestions,
-                    errorCode: stale ? undefined : (run.result?.errorCode ?? undefined),
-                    error: stale ? "run stalled (instance lost?)" : run.error ?? undefined,
-                    jobId: run.jobId ?? undefined,
-                    source: run.source ?? undefined,
-                });
-            }
-            return;
-        }
-        const cancelMatch = req.method === "POST" ? RUN_CANCEL_RE.exec(url) : null;
-        if (cancelMatch) {
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store" });
-                return;
-            }
-            if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const taskId = cancelMatch[1];
-            const run = await deps.runStore.getRun(taskId);
-            if (!run) {
-                sendJson(res, 404, { error: "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)" });
-                return;
-            }
-            if (!runOwnerOk(req, res, run.owner))
-                return;
-            if (!runSessionAcceptOk(req, res, run, "run.cancel"))
-                return;
-            const rs = deps.runStore;
-            const cancelSuspended = async () => {
-                const cs = deps.checkpointStore;
-                let note = "cancelled while suspended (pending approval settled)";
-                if (cs) {
-                    const token = await cs.findPendingTokenBySession(run.sessionId);
-                    if (token) {
-                        const cp = await cs.get(token);
-                        const won = cp ? await cs.expire(token, cp.scope) : false;
-                        if (!won) {
-                            const now = await rs.getRun(taskId);
-                            const st = now?.status;
-                            if (st === "suspended" || st === "needs_review" || st === "running") {
-                                sendJson(res, 409, { taskId, status: st, error: "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active" });
-                            }
-                            else {
-                                sendJson(res, 202, { taskId, status: st ?? "failed", note: "run already terminal — cancel is a no-op" });
-                            }
-                            return;
-                        }
-                    }
-                    else {
-                        const claimed = await rs.markResuming(taskId);
-                        if (!claimed) {
-                            const now = await rs.getRun(taskId);
-                            const st = now?.status;
-                            if (st === "running" || st === "suspended" || st === "needs_review") {
-                                sendJson(res, 409, { taskId, status: st, error: "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active" });
-                            }
-                            else {
-                                sendJson(res, 202, { taskId, status: st ?? "failed", note: "run already terminal — cancel is a no-op" });
-                            }
-                            return;
-                        }
-                        note = "cancelled while suspended (no pending approval found — stale park released)";
-                    }
-                }
-                else {
-                    note = "cancelled while suspended (no checkpoint store on this deployment — run row terminalized only)";
-                }
-                const err = note;
-                try {
-                    const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 } };
-                    let lastErr;
-                    for (let attempt = 0;; attempt++) {
-                        try {
-                            await rs.setTerminal(taskId, "failed", result, err);
-                            lastErr = undefined;
-                            break;
-                        }
-                        catch (e) {
-                            lastErr = e;
-                            if (attempt >= 2)
-                                break;
-                            await new Promise((r) => setTimeout(r, 100 * (attempt + 1)));
-                        }
-                    }
-                    if (lastErr !== undefined)
-                        throw lastErr;
-                }
-                catch (e) {
-                    sendJson(res, 500, { taskId, error: `cancel progressed (${note}) but could not terminalize the run row (retried) — retry cancel; a stuck row is reaped after the stale window (${e instanceof Error ? e.message : String(e)})` });
-                    return;
-                }
-                const finalRow = await rs.getRun(taskId).catch(() => undefined);
-                if (finalRow && finalRow.errorCode !== "cancelled" && (finalRow.status === "failed" || finalRow.status === "completed" || finalRow.status === "blocked" || finalRow.status === "timeout")) {
-                    sendJson(res, 202, { taskId, status: finalRow.status, errorCode: finalRow.errorCode ?? null, note: `session unlocked; the run was terminalized concurrently (${finalRow.errorCode ?? finalRow.status}) before this cancel's write — reporting the actual ledger state` });
-                    return;
-                }
-                sendJson(res, 202, { taskId, status: "failed", errorCode: "cancelled", note });
-            };
-            if (run.status === "running") {
-                const flagged = await deps.runStore.requestCancel(taskId, run.owner);
-                if (!flagged) {
-                    const now = await deps.runStore.getRun(taskId);
-                    if (now?.status === "suspended") {
-                        await cancelSuspended();
-                    }
-                    else {
-                        sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "run already terminal — cancel is a no-op" });
-                    }
-                    return;
-                }
-                if (inflightRuns.has(taskId)) {
-                    cancelledViaVerb.add(taskId);
-                    inflightRuns.get(taskId).abort();
-                }
-                sendJson(res, 202, { taskId, status: "cancelling" });
-            }
-            else if (run.status === "suspended" || run.status === "needs_review") {
-                await cancelSuspended();
-            }
-            else {
-                sendJson(res, 202, { taskId, status: run.status, note: "run already terminal — cancel is a no-op" });
-            }
-            return;
-        }
-        const steerMatch = req.method === "POST" ? RUN_STEER_RE.exec(url) : null;
-        if (steerMatch) {
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                return;
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const taskId = steerMatch[1];
-            let body;
-            try {
-                body = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            if (typeof body.text !== "string" || body.text.length === 0) {
-                sendJson(res, 400, { error: "body must be { text: string (non-empty), mode?: 'all' | 'one-at-a-time', priority?: 'now' | 'next' | 'later' }" });
-                return;
-            }
-            if (body.mode !== undefined && body.mode !== "all" && body.mode !== "one-at-a-time") {
-                sendJson(res, 400, { error: "mode must be 'all' or 'one-at-a-time' when present" });
-                return;
-            }
-            if (body.priority !== undefined && body.priority !== "now" && body.priority !== "next" && body.priority !== "later") {
-                sendJson(res, 400, { error: "priority must be 'now', 'next', or 'later' when present" });
-                return;
-            }
-            const text = body.text;
-            const priority = body.priority;
-            const messageId = uuidv7();
-            const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            try {
-                validatePendingSteer({ text, trusted });
-            }
-            catch (e) {
-                if (e instanceof CheckpointError && e.code === "steering.invalid_content") {
-                    sendError(res, 422, "steering.invalid_content", e.message);
-                    return;
-                }
-                throw e;
-            }
-            const run = await deps.runStore.getRun(taskId);
-            if (!run) {
-                sendJson(res, 404, runNotFoundBody(taskId));
-                return;
-            }
-            if (!trusted && run.owner !== null && run.owner !== principal) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            if (!runSessionAcceptOk(req, res, run, "run.steer"))
-                return;
-            const tryPark = async () => {
-                const cs = deps.checkpointStore;
-                if (!cs)
-                    return "no-store";
-                const scope = await cs.peekPendingScope(run.sessionId);
-                if (scope === null || scope === undefined)
-                    return "no-checkpoint";
-                const token = await cs.findPendingTokenBySession(run.sessionId, scope);
-                if (!token)
-                    return "no-checkpoint";
-                return (await cs.setPendingSteer(token, scope, { text, trusted })) ? "parked" : "no-checkpoint";
-            };
-            const sendParked = () => sendJson(res, 202, { taskId, status: "suspended", delivery: "queued", messageId, ...(priority ? { priority } : {}), note: "steer parked on the checkpoint — injected when the run resumes" });
-            const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
-            const live = steerableRuns.get(taskId);
-            if (live) {
-                try {
-                    await live.steer(text, { trusted });
-                    sendJson(res, 200, { taskId, status: "running", delivery: "applied", messageId, ...(priority ? { priority } : {}) });
-                    return;
-                }
-                catch (e) {
-                    const code = e.code;
-                    if (code === "steering.invalid_content") {
-                        sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
-                        return;
-                    }
-                    if (code !== "steering.not_running")
-                        throw e;
-                    if (await tryPark() === "parked") {
-                        sendParked();
-                        return;
-                    }
-                    sendNotRunning("run just finished — no longer accepting steers");
-                    return;
-                }
-            }
-            if (run.status === "suspended") {
-                const outcome = await tryPark();
-                if (outcome === "no-store") {
-                    sendJson(res, 501, { error: "steering a suspended run requires the checkpoint store" });
-                    return;
-                }
-                if (outcome === "parked") {
-                    sendParked();
-                    return;
-                }
-                sendNotRunning("run is no longer suspended (resolved or expired)");
-                return;
-            }
-            if (run.status === "running") {
-                sendNotRunning("run is active on another replica — cross-replica live-steer is not yet supported");
-                return;
-            }
-            if (deps.checkpointStore && deps.sessionStorage?.getLeafId) {
-                const activeTaskId = await deps.runStore.getActiveTaskId?.(run.sessionId).catch(() => undefined);
-                if (activeTaskId !== undefined && activeTaskId !== null && activeTaskId !== taskId) {
-                    sendNotRunning(`run is ${run.status} and its session has an ACTIVE run (${activeTaskId}) — steer that run instead`);
-                    return;
-                }
-                const prior = wakeParkMints.get(run.sessionId) ?? Promise.resolve();
-                const mintResult = { parked: false };
-                const job = prior.then(async () => {
-                    const cs = deps.checkpointStore;
-                    if (await tryPark() === "parked") {
-                        mintResult.parked = true;
-                        return;
-                    }
-                    const leafId = await Promise.resolve(deps.sessionStorage.getLeafId(run.sessionId)).catch(() => undefined);
-                    if (leafId === undefined || leafId === null)
-                        return;
-                    const cpScope = run.owner ?? "_";
-                    const wakeToken = mintCheckpointToken();
-                    await cs.put(wakeToken, {
-                        token: wakeToken,
-                        scope: cpScope,
-                        sessionId: run.sessionId,
-                        leafId,
-                        gate: { kind: "task_done" },
-                        pendingAction: { kind: "task_done" },
-                        state: { activeTools: [], nestedStats: { tokens: 0, turns: 0, tasks: 0, costUsd: 0, costMicroUsd: 0 } },
-                        status: "pending",
-                        createdAt: Date.now(),
-                        sourceTaskId: taskId,
-                    });
-                    const winner = await cs.findPendingTokenBySession(run.sessionId).catch(() => null);
-                    if (winner !== null && winner !== wakeToken) {
-                        await cs.expire(wakeToken, cpScope).catch(() => undefined);
-                        if (await cs.setPendingSteer(winner, cpScope, { text, trusted }))
-                            mintResult.parked = true;
-                        return;
-                    }
-                    if (await cs.setPendingSteer(wakeToken, cpScope, { text, trusted }))
-                        mintResult.parked = true;
-                });
-                const wrapped = job.catch(() => undefined);
-                wakeParkMints.set(run.sessionId, wrapped);
-                try {
-                    await job;
-                }
-                finally {
-                    if (wakeParkMints.get(run.sessionId) === wrapped)
-                        wakeParkMints.delete(run.sessionId);
-                }
-                if (mintResult.parked) {
-                    sendJson(res, 202, { taskId, status: run.status, delivery: "parked_for_wake", messageId, ...(priority ? { priority } : {}), note: "run already ended — steer parked on a task_done checkpoint; deliver it with POST /v1/sessions/:id/wake" });
-                    return;
-                }
-            }
-            sendNotRunning(`run is ${run.status} — not accepting steers`);
-            return;
-        }
-        const compactMatch = req.method === "POST" ? RUN_COMPACT_RE.exec(url) : null;
-        if (compactMatch) {
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                return;
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const taskId = compactMatch[1];
-            const run = await deps.runStore.getRun(taskId);
-            if (!run) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!operator && run.owner !== null && run.owner !== principal) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            if (!runSessionAcceptOk(req, res, run, "run.compact"))
-                return;
-            let compactBody;
-            try {
-                const parsed = await readJson(req);
-                if (parsed === null || typeof parsed !== "object") {
-                    sendJson(res, 400, { error: "body must be a JSON object when present" });
-                    return;
-                }
-                compactBody = parsed;
-            }
-            catch (e) {
-                if (e instanceof HttpError) {
-                    sendJson(res, e.status, { error: e.message });
-                    return;
-                }
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            if (compactBody.instructions !== undefined && (typeof compactBody.instructions !== "string" || compactBody.instructions.length === 0 || [...compactBody.instructions].length > 2_048)) {
-                sendJson(res, 400, { error: "instructions must be a non-empty string of at most 2048 characters (code points) when present — the engine caps compaction instructions there" });
-                return;
-            }
-            const compactInstructions = compactBody.instructions;
-            const live = steerableRuns.get(taskId);
-            if (!live) {
-                sendError(res, 409, "compact.not_running", run.status === "running" ? "run is active on another replica — manual compact is replica-local" : `run is ${run.status} — not accepting compaction`);
-                return;
-            }
-            void live.compact(compactInstructions !== undefined ? { instructions: compactInstructions } : undefined).then((outcome) => {
-                const level = outcome === "failed" ? "warn" : "info";
-                deps.logger?.[level]?.("manual_compact_outcome", { taskId, outcome, note: outcome === "compacted" ? "a compacted{trigger:'manual'} event rode the run stream" : `no event (see compaction.${outcome === "mooted" ? "mooted" : outcome} trace / task terminal events)` });
-            }, (e) => {
-                if (e.code !== "steering.not_running") {
-                    deps.logger?.warn?.("manual_compact_failed", { taskId, err: e instanceof Error ? e.message : String(e) });
-                }
-                else {
-                    deps.logger?.info?.("manual_compact_not_running", { taskId, note: "stream settled between lookup and compact() — benign unless systematic" });
-                }
-            });
-            sendJson(res, 202, { taskId, status: "running", delivery: "accepted", note: "compaction will run at the next turn boundary; a compacted{trigger:'manual'} event rides the run stream if anything is summarized" });
-            return;
-        }
-        const detachMatch = req.method === "POST" ? RUN_DETACH_RE.exec(url) : null;
-        if (detachMatch) {
-            if (rateLimited(req, res))
-                return;
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const taskId = detachMatch[1];
-            let body;
-            try {
-                body = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            if (typeof body.toolCallId !== "string" || body.toolCallId.length === 0 || body.toolCallId.length > 256) {
-                sendJson(res, 400, { error: "body must be { toolCallId: string (non-empty, ≤256 chars) }" });
-                return;
-            }
-            const run = await deps.runStore.getRun(taskId);
-            if (!run) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!operator && run.owner !== null && run.owner !== principal) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            if (!runSessionAcceptOk(req, res, run, "run.detach"))
-                return;
-            const live = steerableRuns.get(taskId);
-            if (!live) {
-                sendError(res, 409, "detach.not_running", run.status === "running" ? "run is active on another replica — detach is replica-local" : `run is ${run.status} — no running tool call to detach`);
-                return;
-            }
-            live.detach(body.toolCallId);
-            sendJson(res, 202, { taskId, toolCallId: body.toolCallId, delivery: "requested", note: "if the tool call is running in a detach-capable env it settles early with 'moved to background; task_id=b*'; otherwise the request is a no-op (fail-safe)" });
-            return;
-        }
-        const wfSteerMatch = req.method === "POST" ? WORKFLOW_AGENT_STEER_RE.exec(url) : null;
-        if (wfSteerMatch) {
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                return;
-            if (!deps.workflowRunStore) {
-                sendJson(res, 501, { error: "workflow runs require self-orchestration (SELF_ORCHESTRATION_ENABLED)" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const wfRunId = safeDecode(wfSteerMatch[1]);
-            const label = safeDecode(wfSteerMatch[2]);
-            if (wfRunId === null || label === null) {
-                sendJson(res, 400, { error: "malformed workflow path (invalid percent-encoding)" });
-                return;
-            }
-            let body;
-            try {
-                body = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            if (typeof body.content !== "string" || body.content.length === 0) {
-                sendJson(res, 400, { error: "body must be { content: string (non-empty) }" });
-                return;
-            }
-            if (body.content.length > STEER_IN_MAX_REQUEST_CHARS) {
-                sendError(res, 413, "steer.content_too_large", `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`);
-                return;
-            }
-            const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            const ownerScope = principal ?? "default";
-            const wfRun = await getWorkflowRun(deps.workflowRunStore, wfRunId, ownerScope);
-            if (!trusted && !wfRun) {
-                sendJson(res, 404, { error: "workflow not found" });
-                return;
-            }
-            if (wfRun && !runSessionAcceptOk(req, res, { sessionId: wfRun.originatingSessionId ?? null }, "workflow.agent-steer", "workflow not found"))
-                return;
-            const sendNotRunningWf = (error) => sendError(res, 409, "steering.not_running", error);
-            const redacted = redactSteerIn(body.content, label);
-            const resolution = deps.workflowAgentRegistry?.resolve(wfRunId, label);
-            if (resolution && resolution.count > 1) {
-                sendError(res, 409, "steering.ambiguous_label", `${resolution.count} live agents share label '${label}' in this run — steer target is ambiguous`);
-                return;
-            }
-            const handle = resolution?.handle;
-            if (handle) {
-                try {
-                    const marker = await handle.steer(redacted);
-                    sendJson(res, 200, { runId: wfRunId, label, status: "running", delivery: "applied", marker });
-                    return;
-                }
-                catch (e) {
-                    const code = e.code;
-                    if (code === "steering.not_running") {
-                        sendNotRunningWf("agent just finished — no longer accepting steers");
-                        return;
-                    }
-                    throw e;
-                }
-            }
-            sendNotRunningWf(!wfRun
-                ? "workflow agent is not running on this replica (no live handle)"
-                : wfRun.status === "running"
-                    ? "workflow agent is active on another replica — cross-replica live-steer is not yet supported"
-                    : `workflow is ${wfRun.status} — agent is not running`);
-            return;
-        }
-        const subOutputMatch = req.method === "GET" ? RUN_SUBAGENT_OUTPUT_RE.exec(url) : null;
-        if (subOutputMatch) {
-            if (!deps.runStore || !deps.subagentTaskOutput) {
-                sendJson(res, 501, { error: "subagent output reads require the run store" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const runId = safeDecode(subOutputMatch[1]);
-            const target = safeDecode(subOutputMatch[2]);
-            if (runId === null || target === null) {
-                sendJson(res, 400, { error: "malformed subagent path (invalid percent-encoding)" });
-                return;
-            }
-            const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            const run = await deps.runStore.getRun(runId);
-            if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
-            if (!trusted && run.sessionId && callerSession !== run.sessionId) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const out = await deps.subagentTaskOutput(target, { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) });
-            const details = out.details;
-            if (details?.error === "not_found" || details?.type !== "background_agent") {
-                sendJson(res, 404, { error: `no background agent "${target}" under this run (unknown handle, not this run's child, or already reaped — bg children live in the replica-local registry for the parent's lifetime; wa… workflow-agent rows are read via the workflow journal, not this verb)` });
-                return;
-            }
-            sendJson(res, 200, { taskId: runId, target, content: out.content, output: out.details });
-            return;
-        }
-        const subStreamMatch = req.method === "GET" ? RUN_SUBAGENT_STREAM_RE.exec(url) : null;
-        if (subStreamMatch) {
-            if (!deps.runStore || !deps.subagentTaskOutput) {
-                sendJson(res, 501, { error: "subagent streams require the run store" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const runId = safeDecode(subStreamMatch[1]);
-            const target = safeDecode(subStreamMatch[2]);
-            if (runId === null || target === null) {
-                sendJson(res, 400, { error: "malformed subagent path (invalid percent-encoding)" });
-                return;
-            }
-            const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            const run = await deps.runStore.getRun(runId);
-            if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const callerSession = new URL(req.url ?? "", "http://x").searchParams.get("session");
-            if (!trusted && run.sessionId && callerSession !== run.sessionId) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const it = defaultSubagentTailBus.subscribe(target);
-            const probe = await deps.subagentTaskOutput(target, { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) });
-            const probeDetails = probe.details;
-            if (probeDetails?.error === "not_found" || probeDetails?.type !== "background_agent") {
-                void it.return?.();
-                sendJson(res, 404, { error: `no background agent "${target}" under this run (unknown handle, not this run's child, or already reaped — bg children live in the replica-local registry for the parent's lifetime; wa… workflow-agent rows are read via the workflow journal, not this verb)` });
-                return;
-            }
-            sseHeaders(res);
-            res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, runId, target, status: probeDetails.status ?? "running", ...(typeof probeDetails.seq === "number" ? { seq: probeDetails.seq } : {}), live: "replica-local", replayFace: "GET /v1/runs/:id/subagents/:handle/output" })}\n\n`);
-            if (probeDetails.status !== "running" && probeDetails.status !== "pending" && probeDetails.status !== "parked") {
-                void it.return?.();
-                res.end();
-                return;
-            }
-            let closed = false;
-            const hb = setInterval(() => {
-                if (!res.writableEnded)
-                    res.write(`event: heartbeat\ndata: {}\n\n`);
-            }, 15_000);
-            if (typeof hb.unref === "function")
-                hb.unref();
-            req.on("close", () => {
-                closed = true;
-                void it.return?.();
-            });
-            try {
-                for (;;) {
-                    const n = await it.next();
-                    if (n.done || closed || res.writableEnded)
-                        break;
-                    res.write(`event: forward\ndata: ${JSON.stringify(n.value)}\n\n`);
-                    if (n.value.type === "task_settled")
-                        break;
-                }
-            }
-            finally {
-                clearInterval(hb);
-                void it.return?.();
-                if (!res.writableEnded)
-                    res.end();
-            }
-            return;
-        }
-        const taskVerbMatch = req.method === "GET" ? RUN_TASK_OUTPUT_RE.exec(url) : req.method === "POST" ? RUN_TASK_STOP_RE.exec(url) : null;
-        if (taskVerbMatch) {
-            const stopVerb = req.method === "POST";
-            if (!deps.runStore || !deps.taskHandleOutput || !deps.taskHandleStop) {
-                sendJson(res, 501, { error: "task-handle verbs require the run store + task-registry seams" });
-                return;
-            }
-            if (stopVerb && rateLimited(req, res))
-                return;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const runId = safeDecode(taskVerbMatch[1]);
-            const target = safeDecode(taskVerbMatch[2]);
-            if (runId === null || target === null) {
-                sendJson(res, 400, { error: "malformed task path (invalid percent-encoding)" });
-                return;
-            }
-            const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            const run = await deps.runStore.getRun(runId);
-            if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const q = new URL(req.url ?? "", "http://x").searchParams;
-            if (!trusted && run.sessionId && q.get("session") !== run.sessionId) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            const access = { owner: runId, scope: run.owner ?? "default", ...(run.sessionId ? { sessionId: run.sessionId } : {}) };
-            if (q.get("filter") !== null) {
-                sendJson(res, 400, { error: "filter is not accepted on the wire — fetch the output and filter client-side (note: the wire serves the clipped projection)" });
-                return;
-            }
-            const out = stopVerb
-                ? await deps.taskHandleStop(target, access)
-                : await deps.taskHandleOutput(target, access);
-            const details = out.details;
-            if (details?.error === "not_found") {
-                sendJson(res, 404, { error: `no background task "${target}" under this run (unknown handle, not this run's task, already reaped — handles live in the replica-local registry for the parent's lifetime — or a workflow handle: workflow rows read via GET /v1/workflows/:id/journal; stopping a workflow is not on this wire)` });
-                return;
-            }
-            const parkArbiterUnreachable = details?.error === "park_arbiter_unreachable";
-            const parkResumeWon = details?.error === "park_resume_won";
-            const stillParked = details?.error === "parked_pending_approval" || details?.status === "parked";
-            if (stopVerb && details?.error !== undefined && (details.status === "running" || stillParked || parkResumeWon || parkArbiterUnreachable)) {
-                const notLocal = details.error === "not_local";
-                sendError(res, 409, notLocal
-                    ? "stop.not_local"
-                    : parkArbiterUnreachable
-                        ? "stop.park_arbiter_unreachable"
-                        : parkResumeWon
-                            ? "stop.park_resume_won"
-                            : stillParked
-                                ? "stop.parked"
-                                : "stop.not_landed", notLocal
-                    ? "this task is not attached to this instance — cannot stop it here (its durable record is still marked running; if its host process is gone, the retention sweep settles it as interrupted)"
-                    : parkArbiterUnreachable
-                        ? "the approval arbitration store was unreachable — this task's row stays parked (not stopped); retry the stop"
-                        : parkResumeWon
-                            ? "the pending tool-approval was resolved (resumed) concurrently with this stop attempt — the resume won the race, so nothing was stopped; re-check the task's current status"
-                            : stillParked
-                                ? "this task is durably parked awaiting a tool-approval decision, not actively running — there is no live process to interrupt; resolve (or let expire) the pending approval instead"
-                                : `stop did not land (${details.error}) — the process may still be running`, { taskId: runId, target, content: out.content, output: out.details });
-                return;
-            }
-            const g14 = (() => {
-                const d = out.details;
-                if (!d || d.error !== undefined || d.retrieval_status === "not_ready")
-                    return {};
-                if (d.type === "background_bash")
-                    return { cursorSemantics: d.details && "bytesDroppedBeforeCursor" in d.details ? "cursor" : "full" };
-                if (d.type === "monitor" || d.type === "background_agent")
-                    return { cursorSemantics: "full" };
-                return {};
-            })();
-            sendJson(res, 200, { taskId: runId, target, content: out.content, output: out.details, ...g14 });
-            return;
-        }
-        const subVerbMatch = req.method === "POST" ? (RUN_SUBAGENT_STEER_RE.exec(url) ?? RUN_SUBAGENT_RESUME_RE.exec(url)) : null;
-        if (subVerbMatch) {
-            const verb = url.endsWith("/resume") ? "resume" : "steer";
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                return;
-            if (!deps.runStore) {
-                sendJson(res, 501, { error: "async runs require the TiDB run store" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const runId = safeDecode(subVerbMatch[1]);
-            const target = safeDecode(subVerbMatch[2]);
-            if (runId === null || target === null) {
-                sendJson(res, 400, { error: "malformed subagent path (invalid percent-encoding)" });
-                return;
-            }
-            let body;
-            try {
-                body = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            if (typeof body.content !== "string" || body.content.length === 0) {
-                sendJson(res, 400, { error: "body must be { content: string (non-empty) }" });
-                return;
-            }
-            if (body.content.length > STEER_IN_MAX_REQUEST_CHARS) {
-                sendError(res, 413, "steer.content_too_large", `content exceeds ${STEER_IN_MAX_REQUEST_CHARS} characters (got ${body.content.length}); note only the first ${STEER_IN_MAX_CHARS} are delivered anyway`);
-                return;
-            }
-            const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            const run = await deps.runStore.getRun(runId);
-            if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
-                sendJson(res, 404, { error: "run not found" });
-                return;
-            }
-            if (!runSessionAcceptOk(req, res, run, `subagent.${verb}`))
-                return;
-            const send409 = (errorCode, error) => sendError(res, 409, errorCode, error);
-            const redacted = redactSteerIn(body.content, target);
-            const resolution = deps.subagentSteerRegistry?.resolve(runId, target);
-            if (resolution && resolution.count > 1) {
-                send409("steering.ambiguous_target", `${resolution.count} sub-agents match '${target}' in this run — address by parentToolCallId`);
-                return;
-            }
-            const handle = resolution?.handle;
-            if (handle) {
-                try {
-                    if (verb === "resume") {
-                        if (!handle.resume) {
-                            send409("resume.retain_off", "the parent run did not retain sub-agent sessions (set retainSubagentSessions on the run to enable revival)");
-                            return;
-                        }
-                        const marker = await handle.resume(redacted);
-                        sendJson(res, 200, { taskId: runId, target, status: "running", delivery: "applied", marker, note: `Message queued for delivery to ${handle.agentName ?? target}; it will continue in the background.` });
-                        return;
-                    }
-                    const marker = await handle.steer(redacted);
-                    sendJson(res, 200, { taskId: runId, target, status: "running", delivery: "applied", marker, note: `Message queued for delivery to ${handle.agentName ?? target} at its next tool round.` });
-                    return;
-                }
-                catch (e) {
-                    const code = e.code;
-                    if (code === "steering.not_running") {
-                        send409(code, "sub-agent just finished — no longer accepting steers");
-                        return;
-                    }
-                    if (code === "steering.still_running") {
-                        send409(code, "sub-agent (or a prior resume) is still in flight — steer it instead, or wait for it to settle");
-                        return;
-                    }
-                    if (code === "resume.retain_off" || code === "resume.evicted" || code === "resume.cap" || code === "resume.session_not_found") {
-                        send409(code, e instanceof Error ? e.message : "resume rejected");
-                        return;
-                    }
-                    throw e;
-                }
-            }
-            send409("steering.not_running", run.status === "running"
-                ? "no sub-agent matches on this replica (it runs backgrounded, or the run is on another replica)"
-                : `run is ${run.status} — its sub-agents are no longer addressable`);
-            return;
-        }
-        const elicitMatch = req.method === "POST" ? ELICIT_RESPOND_RE.exec(url) : null;
-        if (elicitMatch) {
-            if (rateLimited(req, res))
-                return;
-            if (!deps.elicitation) {
-                sendJson(res, 501, { error: "inbound MCP elicitation is not enabled on this worker (MCP_ELICITATION_ENABLED)" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const id = elicitMatch[1];
-            let body;
-            try {
-                body = await readJson(req);
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            const { status, body: respBody } = deps.elicitation.respond(id, principal, body);
-            sendJson(res, status, respBody);
-            return;
-        }
-        const questionMatch = req.method === "POST" ? QUESTION_RESPOND_RE.exec(url) : null;
-        if (questionMatch) {
-            if (rateLimited(req, res))
-                return;
-            if (!deps.question) {
-                sendJson(res, 501, { error: "AskUserQuestion live HITL is not enabled on this worker (ASK_QUESTION_ENABLED)" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const id = questionMatch[1];
-            let body;
-            try {
-                body = await readJson(req);
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            const { status, body: respBody } = deps.question.respond(id, principal, body);
-            sendJson(res, status, respBody);
-            return;
-        }
-        const approvalMatch = req.method === "POST" ? TOOL_APPROVAL_RESPOND_RE.exec(url) : null;
-        if (approvalMatch) {
-            if (rateLimited(req, res))
-                return;
-            if (!deps.toolApproval) {
-                sendJson(res, 501, { error: "live tool-approval HITL is not enabled on this worker (TOOL_APPROVAL_ENABLED)" });
-                return;
-            }
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const id = approvalMatch[1];
-            let body;
-            try {
-                body = await readJson(req);
-            }
-            catch {
-                sendJson(res, 400, { error: "invalid JSON body" });
-                return;
-            }
-            const { status, body: respBody } = deps.toolApproval.respond(id, principal, body);
-            sendJson(res, status, respBody);
-            return;
-        }
-        if (deps.leaderEndpoint) {
-            const isLeaderPost = req.method === "POST" && url === "/v1/leader";
-            const isLeaderGet = req.method === "GET" && /^\/v1\/leader\/[^/]+$/.test(url);
-            if (isLeaderPost || isLeaderGet) {
-                if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                const requester = gatedPrincipal(req, deps.config) ?? null;
-                if (isLeaderPost) {
-                    if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                        return;
-                    let body;
-                    try {
-                        body = await readJson(req);
-                    }
-                    catch {
-                        sendJson(res, 400, { error: "invalid JSON body" });
-                        return;
-                    }
-                    const r = deps.leaderEndpoint.handle("POST", url, body, requester);
-                    if (r) {
-                        sendJson(res, r.status, r.body);
-                        return;
-                    }
-                }
-                else {
-                    const r = deps.leaderEndpoint.handle("GET", url, undefined, requester);
-                    if (r) {
-                        sendJson(res, r.status, r.body);
-                        return;
-                    }
-                }
-            }
-        }
-        if (await handleImages(req, res, url, ctx))
-            return;
-        if (deps.checkpointStore && (url.startsWith("/v1/approvals") || url.startsWith("/v1/assistant"))) {
-            const cs = deps.checkpointStore;
-            const principal = gatedPrincipal(req, deps.config);
-            const operator = isOperator(principal, deps.config.operatorPrincipals);
-            if (req.method === "GET" && url === "/v1/approvals/stream") {
-                const scope = operator
-                    ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
-                    : (principal ?? "__none__");
-                await streamApprovals(req, res, cs, scope);
-                return;
-            }
-            if (req.method === "GET" && url === "/v1/approvals") {
-                const scope = operator
-                    ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
-                    : (principal ?? "__none__");
-                sendJson(res, 200, { pending: await cs.listPending(scope) });
-                return;
-            }
-            {
-                const em = /^\/v1\/approvals\/([^/]+)\/exemptions(?:\/([^/]+))?$/.exec(url);
-                if (em && (req.method === "GET" || req.method === "DELETE")) {
-                    if (!deps.approvalExemptionStore) {
-                        sendJson(res, 501, { error: "approval exemptions need a store backend" });
-                        return;
-                    }
-                    let exSessionId;
-                    let exToolName;
-                    try {
-                        exSessionId = decodeURIComponent(em[1]);
-                        exToolName = em[2] !== undefined ? decodeURIComponent(em[2]) : undefined;
-                    }
-                    catch {
-                        sendJson(res, 400, { error: "malformed id (invalid percent-encoding)" });
-                        return;
-                    }
-                    const operators = deps.config.operatorPrincipals;
-                    const isExplicitOperator = operators.length > 0 && principal !== undefined && operators.includes(principal);
-                    if (!isExplicitOperator) {
-                        const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                        if (!ownerOf) {
-                            sendJson(res, 501, { error: "approval exemptions require a session-store backend" });
-                            return;
-                        }
-                        const owner = await ownerOf(exSessionId);
-                        if (owner === undefined || (owner !== null && owner !== principal)) {
-                            sendJson(res, 404, { error: "not found" });
-                            return;
-                        }
-                    }
-                    if (req.method === "GET") {
-                        if (exToolName !== undefined) {
-                            sendJson(res, 404, { error: "not found" });
-                            return;
-                        }
-                        sendJson(res, 200, { exemptions: await deps.approvalExemptionStore.list(exSessionId) });
-                        return;
-                    }
-                    if (exToolName === undefined) {
-                        sendJson(res, 400, { error: "DELETE needs /exemptions/:toolName" });
-                        return;
-                    }
-                    const revoked = await deps.approvalExemptionStore.revoke(exSessionId, canonicalToolName(exToolName));
-                    sendJson(res, revoked ? 200 : 404, revoked ? { revoked: true } : { error: "not found" });
-                    return;
-                }
-            }
-            if (req.method === "GET" && url === "/v1/assistant/inbox") {
-                const ownerParam = new URL(req.url ?? "", "http://x").searchParams.get("owner") || undefined;
-                const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
-                const summaries = await cs.listByScope(scope);
-                const inbox = (await Promise.all(summaries.map(async (s) => {
-                    const ctx = await cs.getCtx(s.sessionId).catch(() => null);
-                    const { token: _token, toolInput: _rawToolInput, ...safe } = s;
-                    const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
-                    return { ...safe, objective: ctx?.body?.objective ?? null, input };
-                }))).sort((a, b) => (b.severity ?? 0) - (a.severity ?? 0));
-                sendJson(res, 200, { inbox });
-                return;
-            }
-            if (req.method === "GET" && url === "/v1/assistant/tasks") {
-                const ownerParam = new URL(req.url ?? "", "http://x").searchParams.get("owner") || undefined;
-                const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
-                if (!deps.runStore) {
-                    sendJson(res, 200, { tasks: [] });
-                    return;
-                }
-                const summaries = await cs.listByScope(scope);
-                const byGate = new Map(summaries.map((s) => [s.sessionId, s]));
-                const runs = await deps.runStore.listRuns({ owner: scope, limit: 100 });
-                const tasks = runs
-                    .filter((r) => r.status === "running" || r.status === "suspended" || r.status === "needs_review")
-                    .map((r) => {
-                    const s = byGate.get(r.sessionId);
-                    const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
-                    return { taskId: r.taskId, sessionId: r.sessionId, status: r.status, needsAttention: !!gate, gate, createdAt: r.createdAt, updatedAt: r.updatedAt };
-                })
-                    .sort((a, b) => Number(b.needsAttention) - Number(a.needsAttention) || (b.gate?.severity ?? 0) - (a.gate?.severity ?? 0) || (b.gate?.spentMicroUsd ?? 0) - (a.gate?.spentMicroUsd ?? 0));
-                sendJson(res, 200, { tasks });
-                return;
-            }
-            const preemptMatch = req.method === "POST" ? ASSISTANT_PREEMPT_RE.exec(url) : null;
-            if (preemptMatch) {
-                if (rateLimited(req, res) || quotaExceeded(req, res))
-                    return;
-                if (!deps.runStore) {
-                    sendJson(res, 501, { error: "preemption requires the TiDB run store" });
-                    return;
-                }
-                if (deps.config.requirePrincipal && principal === undefined) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                if (!deps.config.resourceSuspend || !deps.checkpointStore) {
-                    sendJson(res, 501, { error: "preemption not enabled on this worker (needs RESOURCE_SUSPEND=true + a durable checkpoint store)" });
-                    return;
-                }
-                const taskId = preemptMatch[1];
-                const run = await deps.runStore.getRun(taskId);
-                if (!run) {
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-                const operators = deps.config.operatorPrincipals;
-                const explicitOperator = operators.length > 0 && principal !== undefined && operators.includes(principal);
-                if (!explicitOperator && run.owner !== null && run.owner !== principal) {
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-                if (run.status === "running") {
-                    const ownedHere = run.instanceId != null && run.instanceId === deps.instanceId;
-                    if (ownedHere && !preemptableRuns.has(taskId)) {
-                        sendJson(res, 202, { taskId, status: run.status, note: "task is not preempt-eligible (verify/cascade leg) — preempt is a no-op" });
-                        return;
-                    }
-                    const flagged = await deps.runStore.requestPreempt(taskId, run.owner);
-                    if (!flagged) {
-                        const now = await deps.runStore.getRun(taskId);
-                        sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "task no longer running — preempt is a no-op" });
-                        return;
-                    }
-                    preemptableRuns.get(taskId)?.abort();
-                    sendJson(res, 202, { taskId, status: "preempting", note: "graceful durable yield — the task suspends at the next clean turn boundary if preempt-eligible; resume via POST /v1/assistant/tasks/:id/resume" });
-                }
-                else if (run.status === "suspended") {
-                    sendJson(res, 409, { taskId, status: "suspended", error: "task is already suspended" });
-                }
-                else {
-                    sendJson(res, 202, { taskId, status: run.status, note: "task already terminal — preempt is a no-op" });
-                }
-                return;
-            }
-            const resumeMatch = req.method === "POST" ? ASSISTANT_RESUME_RE.exec(url) : null;
-            if (resumeMatch) {
-                if (rateLimited(req, res) || quotaExceeded(req, res))
-                    return;
-                if (!deps.runStore) {
-                    sendJson(res, 501, { error: "resume requires the TiDB run store" });
-                    return;
-                }
-                if (deps.config.requirePrincipal && principal === undefined) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                const taskId = resumeMatch[1];
-                const run = await deps.runStore.getRun(taskId);
-                if (!run) {
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-                const operators = deps.config.operatorPrincipals;
-                const explicitOperator = operators.length > 0 && principal !== undefined && operators.includes(principal);
-                if (!explicitOperator && run.owner !== null && run.owner !== principal) {
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-                const out = await resumePreempted(run.sessionId, req);
-                sendJson(res, out.status, out.body);
-                return;
-            }
-            const planReviewMatch = req.method === "POST" ? ASSISTANT_PLAN_REVIEW_RE.exec(url) : null;
-            if (planReviewMatch) {
-                if (rateLimited(req, res) || quotaExceeded(req, res))
-                    return;
-                if (!deps.runStore) {
-                    sendJson(res, 501, { error: "plan_review requires the TiDB run store" });
-                    return;
-                }
-                if (deps.config.requirePrincipal && principal === undefined) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                const taskId = planReviewMatch[1];
-                const body = (await readJson(req));
-                const decision = body?.decision === "approve" ? "approve" : body?.decision === "edit" ? "edit" : body?.decision === "reject" ? "reject" : undefined;
-                if (!decision) {
-                    sendJson(res, 400, { error: "body must be { decision: 'approve' | 'edit' | 'reject', editedPlan?, reason? }" });
-                    return;
-                }
-                if (decision === "edit" && (typeof body.editedPlan !== "string" || body.editedPlan.length === 0)) {
-                    sendJson(res, 400, { error: "decision 'edit' requires a non-empty editedPlan (the operator's revised plan)" });
-                    return;
-                }
-                if (decision !== "edit" && body.editedPlan !== undefined) {
-                    sendJson(res, 400, { error: `editedPlan is only valid with decision 'edit' (got '${decision}')` });
-                    return;
-                }
-                if (body.reason !== undefined && typeof body.reason !== "string") {
-                    sendJson(res, 400, { error: "reason must be a string" });
-                    return;
-                }
-                if (typeof body.reason === "string" && body.reason.length > MAX_APPROVAL_REASON_CHARS) {
-                    sendError(res, 413, "reason_too_large", `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`);
-                    return;
-                }
-                const run = await deps.runStore.getRun(taskId);
-                if (!run) {
-                    if (deps.config.directDoorActive) {
-                        sendError(res, 401, "principal_unverified", "principal proof required");
-                        return;
-                    }
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-                let deciderPrincipal = principal;
-                if (deps.config.directDoorActive) {
-                    const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                    const proof = verifyDirectDoorProof({ jwt: hdr("x-approval-principal-token"), mac: hdr("x-approval-mac"), kid: hdr("x-approval-mac-kid") }, { sessionId: run.sessionId, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config, { actionBinding: false });
-                    if (!proof.ok) {
-                        sendError(res, proof.status, proof.errorCode, proof.error);
-                        return;
-                    }
-                    deciderPrincipal = proof.principal;
-                }
-                const operators = deps.config.operatorPrincipals;
-                const explicitOperator = operators.length > 0 && deciderPrincipal !== undefined && operators.includes(deciderPrincipal);
-                if (!explicitOperator && run.owner !== null && run.owner !== deciderPrincipal) {
-                    sendJson(res, 404, { error: "task not found" });
-                    return;
-                }
-                const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req);
-                sendJson(res, out.status, out.body);
+                ...(() => {
+                    const stuck = deps.planeDeferredState?.();
+                    return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
+                })(),
+            });
+            return;
+        }
+        if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
+            if (!deps.metrics) {
+                sendError(res, 404, "feature.metrics_disabled", "metrics disabled");
                 return;
             }
-            const m = /^\/v1\/approvals\/([^/]+?)(?:\/decide)?$/.exec(url);
-            if (m && req.method === "POST") {
-                if (rateLimited(req, res) || quotaExceeded(req, res))
-                    return;
-                let sessionId;
-                try {
-                    sessionId = decodeURIComponent(m[1]);
-                }
-                catch {
-                    sendJson(res, 400, { error: "malformed approval id (invalid percent-encoding)" });
-                    return;
-                }
-                const body = (await readJson(req));
-                const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
-                if (!decision) {
-                    sendJson(res, 400, { error: "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember? }" });
-                    return;
-                }
-                if (body.reason !== undefined && typeof body.reason !== "string") {
-                    sendJson(res, 400, { error: "reason must be a string" });
-                    return;
-                }
-                if (typeof body.reason === "string" && body.reason.length > MAX_APPROVAL_REASON_CHARS) {
-                    sendError(res, 413, "reason_too_large", `reason too large (max ${MAX_APPROVAL_REASON_CHARS} chars)`);
-                    return;
-                }
-                let remember = false;
-                if (body.remember !== undefined) {
-                    if (body.remember !== "session") {
-                        sendJson(res, 400, { error: `remember must be "session"` });
-                        return;
-                    }
-                    if (decision !== "approve") {
-                        sendJson(res, 400, { error: "remember requires decision 'approve'" });
-                        return;
-                    }
-                    if (deps.config.directDoorActive) {
-                        sendError(res, 400, "remember_not_in_proof", "remember is not supported on a direct-door worker (not covered by the decision proof)");
-                        return;
-                    }
-                    if (!deps.approvalExemptionStore) {
-                        sendJson(res, 501, { error: "approval exemptions need a store backend (DB_BACKEND / LOCAL lane)" });
-                        return;
-                    }
-                    if (!body.checkpointToken && !body.boundCallId) {
-                        sendError(res, 400, "remember_requires_binding", "remember requires the decision binding (echo checkpointToken and/or boundCallId from the pending approval)");
-                        return;
-                    }
-                    remember = true;
-                }
-                let answer;
-                if (body.answer !== undefined) {
-                    if (!isQuestionAnswer(body.answer)) {
-                        sendJson(res, 400, { error: "malformed answer — expected { answers: [{ header, selected: string[], note? }] }" });
-                        return;
-                    }
-                    answer = body.answer;
-                }
-                for (const f of ["checkpointToken", "boundCallId", "boundInputHash"]) {
-                    if (body[f] !== undefined && typeof body[f] !== "string") {
-                        sendJson(res, 400, { error: `${f} must be a string (the value surfaced on the pending approval record)` });
-                        return;
-                    }
-                }
-                if (deps.config.directDoorActive && body.updatedInput !== undefined) {
-                    sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
-                    return;
-                }
-                const binding = {
-                    checkpointToken: body.checkpointToken,
-                    boundCallId: body.boundCallId,
-                    boundInputHash: body.boundInputHash,
-                    updatedInput: body.updatedInput,
-                };
-                let deciderPrincipal = principal;
-                if (deps.config.directDoorActive) {
-                    const hdr = (n) => {
-                        const h = req.headers[n];
-                        return Array.isArray(h) ? h[0] : h;
-                    };
-                    const proof = verifyDirectDoorProof({ jwt: hdr("x-approval-principal-token"), mac: hdr("x-approval-mac"), kid: hdr("x-approval-mac-kid") }, { sessionId, boundCallId: binding.boundCallId, boundInputHash: binding.boundInputHash, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config);
-                    if (!proof.ok) {
-                        sendError(res, proof.status, proof.errorCode, proof.error);
-                        return;
-                    }
-                    deciderPrincipal = proof.principal;
-                }
-                const operators = deps.config.operatorPrincipals;
-                const explicitOperator = operators.length > 0 && deciderPrincipal !== undefined && operators.includes(deciderPrincipal);
-                if (!explicitOperator) {
-                    const cpScope = await cs.peekPendingScope(sessionId);
-                    const ownsIt = cpScope == null || cpScope === "_" || cpScope === deciderPrincipal;
-                    if (!ownsIt) {
-                        sendJson(res, 404, { error: "approval not found" });
-                        return;
-                    }
-                }
-                let rememberToolName = null;
-                if (remember) {
-                    const tok = await cs.findPendingTokenBySession(sessionId);
-                    const cp0 = tok ? await cs.get(tok) : null;
-                    const pa0 = cp0?.pendingAction;
-                    const tn = pa0 && pa0.kind === "tool_approval" ? pa0.toolName : null;
-                    rememberToolName = tn && tn !== "AskUserQuestion" ? tn : null;
-                }
-                let rememberApplied = false;
-                const grantOnCommit = remember && deps.approvalExemptionStore && rememberToolName
-                    ? async (overrideSessionId) => {
-                        const grantSessionId = overrideSessionId ?? sessionId;
-                        try {
-                            const canonical = canonicalToolName(rememberToolName);
-                            await deps.approvalExemptionStore.grant(grantSessionId, canonical, deciderPrincipal ?? null);
-                            rememberApplied = true;
-                            deps.logger?.info?.("approval_exemption_granted", { sessionId: grantSessionId, toolName: canonical, grantedBy: deciderPrincipal ?? null });
-                        }
-                        catch (e) {
-                            deps.logger?.warn?.("approval_exemption_grant_failed", { sessionId: grantSessionId, toolName: rememberToolName, error: String(e).slice(0, 200) });
-                        }
-                    }
-                    : undefined;
-                const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, req, answer, binding, grantOnCommit);
-                if (remember && deps.approvalExemptionStore) {
-                    sendJson(res, out.status, { ...out.body, rememberApplied });
-                    return;
-                }
-                sendJson(res, out.status, out.body);
+            const { authToken: t, metricsToken: mt } = deps.config;
+            const anyT = Boolean(t) || Object.keys(deps.config.authTokens ?? {}).length > 0;
+            const ok = (!anyT && !mt) || (anyT && systemFor(req, deps.config) !== undefined) || (!!mt && authorized(req, mt));
+            if (!ok) {
+                sendError(res, 401, "auth.unauthorized", "unauthorized");
                 return;
             }
-            sendJson(res, 404, { error: "not found" });
-            return;
-        }
-        if (deps.approvalStore && url.startsWith("/v1/approvals")) {
-            const store = deps.approvalStore;
-            if (deps.config.directApprovalDoor) {
-                sendError(res, 503, "approval_door_unconfigured", "approvals are served by the direct door on this worker");
+            if (url === "/metrics/summary") {
+                sendJson(res, 200, { model: deps.config.model.id, ...deps.metrics.summarize() });
                 return;
             }
-            if (req.method === "GET" && url === "/v1/approvals") {
-                const principal = principalFrom(req, deps.config);
-                if (isOperator(principal, deps.config.operatorPrincipals)) {
-                    const owner = new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined;
-                    sendJson(res, 200, { pending: owner ? await store.listPending(owner, owner) : await store.listPendingAll() });
-                }
-                else {
-                    sendJson(res, 200, { pending: principal ? await store.listPending(principal, principal) : [] });
-                }
+            if (url === "/metrics/plan-cache") {
+                sendJson(res, 200, { scopes: deps.planCacheProbe?.dump() ?? {} });
                 return;
             }
-            const m = /^\/v1\/approvals\/([^/]+)$/.exec(url);
-            if (m) {
-                const id = m[1];
-                if (req.method === "GET") {
-                    const principal = principalFrom(req, deps.config);
-                    if (deps.config.requirePrincipal && !principal) {
-                        sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                        return;
-                    }
-                    const operator = isOperator(principal, deps.config.operatorPrincipals);
-                    const row = operator ? await store.getById(id) : principal != null ? await store.get(id, principal) : undefined;
-                    if (!row || (!operator && row.owner !== null && row.owner !== principal)) {
-                        sendJson(res, 404, { error: "approval not found" });
-                        return;
-                    }
-                    sendJson(res, 200, row);
-                    return;
+            res.writeHead(200, { "content-type": "text/plain; version=0.0.4" });
+            res.end(deps.metrics.render());
+            return;
+        }
+        if (deps.registryJwtVerifier) {
+            const authz = req.headers.authorization ?? "";
+            const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
+            if (rawBearer && looksLikeJwt(rawBearer)) {
+                const v = await deps.registryJwtVerifier.verify(rawBearer);
+                if (v.ok) {
+                    setSsoPrincipal(req, v.identity.principal);
+                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
+                    if (v.identity.scope)
+                        setSsoScope(req, v.identity.scope);
+                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
                 }
-                if (req.method === "POST") {
-                    const principal = principalFrom(req, deps.config);
-                    const operatorOk = deps.config.requirePrincipal
-                        ? explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals)
-                        : isOperator(principal, deps.config.operatorPrincipals);
-                    if (!operatorOk) {
-                        sendJson(res, 403, { error: "only an operator may decide an approval (set OPERATOR_PRINCIPALS)" });
-                        return;
-                    }
-                    const body = (await readJson(req));
-                    const decision = body?.decision === "approve" ? "approved" : body?.decision === "deny" ? "denied" : undefined;
-                    if (!decision) {
-                        sendJson(res, 400, { error: "body must be { decision: 'approve' | 'deny', reason? }" });
-                        return;
-                    }
-                    const target = await store.getById(id);
-                    if (!target) {
-                        sendJson(res, 409, { error: "approval already decided or not found" });
-                        return;
-                    }
-                    const applied = await store.decide(id, target.scope, decision, body.reason ?? null, principal ?? null);
-                    if (applied)
-                        sendJson(res, 200, { id, status: decision });
-                    else
-                        sendJson(res, 409, { error: "approval already decided or not found" });
+            }
+        }
+        if (await handleTraceUsage(req, res, url, ctx))
+            return;
+        if (await handleWorkflows(req, res, url, ctx))
+            return;
+        if (await handleFleet(req, res, url, ctx))
+            return;
+        let source = null;
+        const anyServiceAuth = Boolean(deps.config.authToken) || Object.keys(deps.config.authTokens ?? {}).length > 0;
+        if (anyServiceAuth) {
+            const sys = systemFor(req, deps.config);
+            if (sys === undefined) {
+                if (ssoVerifiedPrincipal(req)) {
+                    source = "sso";
+                }
+                else {
+                    sendError(res, 401, "auth.unauthorized", "unauthorized");
                     return;
                 }
             }
-            sendJson(res, 404, { error: "not found" });
+            else {
+                source = sys;
+            }
+        }
+        reqState.source = source;
+        if (req.method === "POST" &&
+            !anyServiceAuth &&
+            !deps.config.allowUnauthedWrites &&
+            (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
+            return;
+        }
+        if (deps.drainState?.draining && req.method === "POST" && isBillableSubmitPath(url)) {
+            res.setHeader("retry-after", "15");
+            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance" });
+            return;
+        }
+        if (deps.modelReady && !deps.modelReady() && req.method === "POST" && isBillableSubmitPath(url)) {
+            res.setHeader("retry-after", "5");
+            sendError(res, 503, "state.model_roster_pending", "model_roster_pending", { message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
+            return;
+        }
+        if (req.method === "PUT" &&
+            !anyServiceAuth &&
+            !deps.config.allowUnauthedWrites &&
+            /^\/v1\/sessions\/[^/]+\/policy$/.test(url)) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting session-policy writes");
             return;
         }
+        if (await handleCapabilities(req, res, url, ctx))
+            return;
+        if (await handleSideQuery(req, res, url, ctx))
+            return;
+        if (await handleTasks(req, res, url, ctx))
+            return;
+        if (await handleRuns(req, res, url, ctx))
+            return;
+        if (await handleWorkflowAgentSteer(req, res, url, ctx))
+            return;
+        if (await handleRunVerbs(req, res, url, ctx))
+            return;
+        if (await handleLeader(req, res, url, ctx))
+            return;
+        if (await handleImages(req, res, url, ctx))
+            return;
+        if (await handleApprovalsAssistant(req, res, url, ctx))
+            return;
         if (await handleObservability(req, res, url, ctx))
             return;
         if (await handleMemoryPolicy(req, res, url, ctx))
@@ -2737,193 +369,78 @@ export function createHttpServer(rawDeps) {
             return;
         if (await handleAttachments(req, res, url, ctx))
             return;
-        if (req.method === "POST" && /^\/v1\/sessions\/[^/]+\/notify$/.test(url)) {
-            if (rateLimited(req, res) || quotaExceeded(req, res))
-                return;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const notifySession = decodeURIComponent(url.split("/")[3]);
-            let nb;
-            try {
-                nb = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "body must be JSON: { task_id, status, summary, result?, seq?, source? }" });
-                return;
-            }
-            if (typeof nb.task_id !== "string" || nb.task_id.trim().length === 0 || nb.task_id.length > 190) {
-                sendJson(res, 400, { error: "task_id must be a non-empty string of at most 190 characters" });
-                return;
-            }
-            const NOTIFY_STATUSES = ["completed", "failed", "killed", "cancelled", "event"];
-            if (typeof nb.status !== "string" || !NOTIFY_STATUSES.includes(nb.status)) {
-                sendJson(res, 400, { error: `status must be one of ${NOTIFY_STATUSES.join("/")}` });
-                return;
-            }
-            if (typeof nb.summary !== "string" || nb.summary.trim().length === 0) {
-                sendJson(res, 400, { error: "summary must be a non-empty string" });
-                return;
-            }
-            if (nb.result !== undefined && typeof nb.result !== "string") {
-                sendJson(res, 400, { error: "result must be a string when present" });
-                return;
-            }
-            if (nb.seq !== undefined && (typeof nb.seq !== "number" || !Number.isInteger(nb.seq) || nb.seq < 1)) {
-                sendJson(res, 400, { error: "seq must be a positive integer when present" });
-                return;
-            }
-            if (nb.source !== undefined && (typeof nb.source !== "string" || nb.source.length > 190)) {
-                sendJson(res, 400, { error: "source must be a string of at most 190 characters when present" });
-                return;
-            }
-            if (!deps.sessionStorage?.ownerOf) {
-                sendJson(res, 501, { error: "external notify requires the session-ownership face (sessionStorage.ownerOf)" });
-                return;
-            }
-            const notifyOwner = await deps.sessionStorage.ownerOf(notifySession);
-            if (notifyOwner === undefined) {
-                sendJson(res, 404, { error: "session not found" });
-                return;
-            }
-            const notifyOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!notifyOperator && notifyOwner !== null && notifyOwner !== principal) {
-                sendJson(res, 404, { error: "session not found" });
-                return;
-            }
-            const payload = {
-                task_id: nb.task_id,
-                status: nb.status,
-                summary: nb.summary,
-                ...(nb.result !== undefined ? { result: nb.result } : {}),
-                ...(nb.seq !== undefined ? { seq: nb.seq } : {}),
-                ...(nb.source !== undefined ? { source: nb.source } : {}),
-            };
-            const liveTaskId = await deps.runStore?.getActiveTaskId?.(notifySession).catch(() => undefined);
-            const liveStream = liveTaskId !== undefined && liveTaskId !== null ? steerableRuns.get(liveTaskId) : undefined;
-            if (liveStream) {
-                try {
-                    await liveStream.notify(payload);
-                    sendJson(res, 200, { sessionId: notifySession, delivery: "live" });
-                    return;
-                }
-                catch (e) {
-                    const code = e.code;
-                    if (typeof code === "string" && code.startsWith("notify.")) {
-                        sendError(res, 400, code, e instanceof Error ? e.message : "invalid notification");
-                        return;
-                    }
-                }
-            }
-            if (!deps.workflowCompletionInbox) {
-                sendJson(res, 501, { error: "external notify park requires the workflow completion inbox (WORKFLOW_RUN_STORE)" });
-                return;
-            }
-            await deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_id: payload.task_id, task_type: "external", status: payload.status, summary: payload.summary, ...(payload.result !== undefined ? { result: payload.result } : {}), ...(payload.seq !== undefined ? { seq: payload.seq } : {}), ...(payload.source !== undefined ? { source: payload.source } : {}) }, Date.now()));
-            sendJson(res, 202, { sessionId: notifySession, delivery: "parked", note: "no live stream — parked in the session inbox; drained as a task_notification on the next stream open" });
-            return;
-        }
-        if (req.method === "POST" && /^\/v1\/sessions\/[^/]+\/wake$/.test(url)) {
-            if (!deps.checkpointStore) {
-                sendJson(res, 501, { error: "wake requires the checkpoint store" });
-                return;
-            }
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
-                return;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const wakeSession = decodeURIComponent(url.split("/")[3]);
-            let wakeBody;
-            try {
-                wakeBody = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "body must be JSON: { message?: string }" });
-                return;
-            }
-            if (wakeBody.message !== undefined && (typeof wakeBody.message !== "string" || wakeBody.message.length === 0)) {
-                sendJson(res, 400, { error: "message must be a non-empty string when present" });
-                return;
-            }
-            const out = await resumeWake(wakeSession, wakeBody.message, principal, req);
-            sendJson(res, out.status, out.body);
+        if (await handleNotifyWake(req, res, url, ctx))
             return;
-        }
-        sendJson(res, 404, { error: "not found" });
+        sendError(res, 404, "not_found.route", "not found");
     }
     async function prepareSpec(req, res) {
         const body = (await readJson(req));
         if (!body || typeof body.objective !== "string") {
-            sendJson(res, 400, { error: "missing 'objective' string" });
+            sendError(res, 400, "request.field_invalid", "missing 'objective' string");
             return null;
         }
         if (body.objective.trim().length === 0) {
-            sendJson(res, 400, { error: "objective must not be empty or whitespace-only (an empty user message poisons the session history on strict providers)" });
+            sendError(res, 400, "request.field_invalid", "objective must not be empty or whitespace-only (an empty user message poisons the session history on strict providers)");
             return null;
         }
         if (body.jobId !== undefined && (typeof body.jobId !== "string" || body.jobId.length === 0 || body.jobId.length > 64)) {
-            sendJson(res, 400, { error: "jobId must be a non-empty string of at most 64 characters" });
+            sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters");
             return null;
         }
         if (typeof body.sessionId === "string" && body.sessionId.length > 64) {
-            sendJson(res, 400, { error: "sessionId must be at most 64 characters" });
+            sendError(res, 400, "request.field_invalid", "sessionId must be at most 64 characters");
             return null;
         }
         if (typeof body.systemPrompt === "string" && body.systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-            sendJson(res, 400, { error: `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters` });
+            sendError(res, 400, "request.field_invalid", `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
             return null;
         }
         if (body.appendSystemPrompt !== undefined) {
             if (typeof body.appendSystemPrompt !== "string" || body.appendSystemPrompt.length === 0) {
-                sendJson(res, 400, { error: "appendSystemPrompt must be a non-empty string" });
+                sendError(res, 400, "request.field_invalid", "appendSystemPrompt must be a non-empty string");
                 return null;
             }
             if (body.appendSystemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-                sendJson(res, 400, { error: `appendSystemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters` });
+                sendError(res, 400, "request.field_invalid", `appendSystemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
                 return null;
             }
         }
         if (body.cwd !== undefined && !isValidCwd(body.cwd)) {
-            sendJson(res, 400, { error: "cwd must be a non-empty absolute host path" });
+            sendError(res, 400, "request.field_invalid", "cwd must be a non-empty absolute host path");
             return null;
         }
         const addDirsRaw = body.additionalDirectories;
         if (addDirsRaw !== undefined) {
             if (!Array.isArray(addDirsRaw)) {
-                sendJson(res, 400, { error: "additionalDirectories must be an array of absolute host paths" });
+                sendError(res, 400, "request.field_invalid", "additionalDirectories must be an array of absolute host paths");
                 return null;
             }
             if (addDirsRaw.length > MAX_ADDITIONAL_DIRS) {
-                sendJson(res, 400, { error: `additionalDirectories must have at most ${MAX_ADDITIONAL_DIRS} entries` });
+                sendError(res, 400, "request.field_invalid", `additionalDirectories must have at most ${MAX_ADDITIONAL_DIRS} entries`);
                 return null;
             }
             const bad = addDirsRaw.find((d) => !isValidCwd(d));
             if (bad !== undefined) {
-                sendJson(res, 400, { error: "each additionalDirectories entry must be a non-empty absolute host path (no '..' segments)" });
+                sendError(res, 400, "request.field_invalid", "each additionalDirectories entry must be a non-empty absolute host path (no '..' segments)");
                 return null;
             }
         }
         const settingsRaw = body.settings;
         if (settingsRaw !== undefined && settingsRaw !== null) {
             if (typeof settingsRaw !== "object" || Array.isArray(settingsRaw)) {
-                sendJson(res, 400, { error: "settings must be an object" });
+                sendError(res, 400, "request.field_invalid", "settings must be an object");
                 return null;
             }
             const st = settingsRaw;
             if (typeof st.outputStyle === "string" && st.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
-                sendJson(res, 400, { error: `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters` });
+                sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`);
                 return null;
             }
             if (typeof st.outputStyle === "string" &&
                 st.outputStyle.length > 0 &&
                 typeof body.appendSystemPrompt === "string" &&
                 body.appendSystemPrompt.length + 2 + st.outputStyle.length > MAX_SYSTEM_PROMPT_CHARS) {
-                sendJson(res, 400, { error: `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)` });
+                sendError(res, 400, "request.field_conflict", `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)`);
                 return null;
             }
             const perms = st.permissions;
@@ -2931,7 +448,7 @@ export function createHttpServer(rawDeps) {
                 for (const k of ["allow", "deny", "ask"]) {
                     const arr = perms[k];
                     if (Array.isArray(arr) && arr.length > MAX_SETTINGS_PERMISSION_RULES) {
-                        sendJson(res, 400, { error: `settings.permissions.${k} must have at most ${MAX_SETTINGS_PERMISSION_RULES} entries` });
+                        sendError(res, 400, "request.field_invalid", `settings.permissions.${k} must have at most ${MAX_SETTINGS_PERMISSION_RULES} entries`);
                         return null;
                     }
                 }
@@ -2939,47 +456,47 @@ export function createHttpServer(rawDeps) {
             const envRaw = st.env;
             if (envRaw !== undefined && envRaw !== null) {
                 if (typeof envRaw !== "object" || Array.isArray(envRaw)) {
-                    sendJson(res, 400, { error: "settings.env must be an object of string→string" });
+                    sendError(res, 400, "request.field_invalid", "settings.env must be an object of string→string");
                     return null;
                 }
                 const entries = Object.entries(envRaw);
                 if (entries.length > MAX_SETTINGS_ENV_VARS) {
-                    sendJson(res, 400, { error: `settings.env must have at most ${MAX_SETTINGS_ENV_VARS} variables` });
+                    sendError(res, 400, "request.field_invalid", `settings.env must have at most ${MAX_SETTINGS_ENV_VARS} variables`);
                     return null;
                 }
                 for (const [k, val] of entries) {
                     if (k.length > MAX_SETTINGS_ENV_KEY_CHARS || (typeof val === "string" && val.length > MAX_SETTINGS_ENV_VALUE_CHARS)) {
-                        sendJson(res, 400, { error: `settings.env keys must be ≤${MAX_SETTINGS_ENV_KEY_CHARS} chars and values ≤${MAX_SETTINGS_ENV_VALUE_CHARS} chars` });
+                        sendError(res, 400, "request.field_invalid", `settings.env keys must be ≤${MAX_SETTINGS_ENV_KEY_CHARS} chars and values ≤${MAX_SETTINGS_ENV_VALUE_CHARS} chars`);
                         return null;
                     }
                 }
             }
             if (st.ultracode !== undefined && typeof st.ultracode !== "boolean") {
-                sendJson(res, 400, { error: "settings.ultracode must be a boolean" });
+                sendError(res, 400, "request.field_invalid", "settings.ultracode must be a boolean");
                 return null;
             }
             if (st.hooks !== undefined && st.hooks !== null) {
                 const hooksParsed = parseHooksConfig(st.hooks);
                 if (!hooksParsed.config) {
-                    sendJson(res, 400, { error: hooksParsed.error ?? "settings.hooks: invalid shape" });
+                    sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
                     return null;
                 }
             }
         }
         const skillsErr = validateUserSkills(body.skills);
         if (skillsErr) {
-            sendJson(res, 400, { error: skillsErr });
+            sendError(res, 400, "request.field_invalid", skillsErr);
             return null;
         }
         if (Array.isArray(body.images)) {
             if (body.images.length > MAX_IMAGES_PER_REQUEST) {
-                sendJson(res, 413, { error: `at most ${MAX_IMAGES_PER_REQUEST} images per request` });
+                sendError(res, 413, "request.payload_too_large", `at most ${MAX_IMAGES_PER_REQUEST} images per request`);
                 return null;
             }
             for (const img of body.images) {
                 const data = img.data;
                 if (typeof data === "string" && Buffer.byteLength(data, "utf8") > MAX_IMAGE_BASE64_BYTES) {
-                    sendJson(res, 413, { error: `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes` });
+                    sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes`);
                     return null;
                 }
             }
@@ -2987,135 +504,135 @@ export function createHttpServer(rawDeps) {
         if (body.clientContext !== undefined) {
             const cc = body.clientContext;
             if (typeof cc !== "object" || cc === null || Array.isArray(cc)) {
-                sendJson(res, 400, { error: "clientContext must be an object" });
+                sendError(res, 400, "request.field_invalid", "clientContext must be an object");
                 return null;
             }
             if (cc.timeZone !== undefined && (typeof cc.timeZone !== "string" || cc.timeZone.length > 64)) {
-                sendJson(res, 400, { error: "clientContext.timeZone must be a string of at most 64 characters" });
+                sendError(res, 400, "request.field_invalid", "clientContext.timeZone must be a string of at most 64 characters");
                 return null;
             }
             if (cc.userEmail !== undefined && (typeof cc.userEmail !== "string" || cc.userEmail.length > 256)) {
-                sendJson(res, 400, { error: "clientContext.userEmail must be a string of at most 256 characters" });
+                sendError(res, 400, "request.field_invalid", "clientContext.userEmail must be a string of at most 256 characters");
                 return null;
             }
         }
         if (body.sandboxImageProfile !== undefined && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0 || body.sandboxImageProfile.length > 128)) {
-            sendJson(res, 400, { error: "sandboxImageProfile must be a non-empty string of at most 128 characters" });
+            sendError(res, 400, "request.field_invalid", "sandboxImageProfile must be a non-empty string of at most 128 characters");
             return null;
         }
         if (body.capabilitiesNeeded !== undefined && (!Array.isArray(body.capabilitiesNeeded) || body.capabilitiesNeeded.some((c) => typeof c !== "string"))) {
-            sendJson(res, 400, { error: "capabilitiesNeeded must be an array of strings" });
+            sendError(res, 400, "request.field_invalid", "capabilitiesNeeded must be an array of strings");
             return null;
         }
         if (Array.isArray(body.capabilitiesNeeded) && body.capabilitiesNeeded.length > 0 && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0)) {
-            sendJson(res, 400, { error: "capabilitiesNeeded requires sandboxImageProfile (it constrains the selected image)" });
+            sendError(res, 400, "request.field_conflict", "capabilitiesNeeded requires sandboxImageProfile (it constrains the selected image)");
             return null;
         }
         if (typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 && (body.cascade === true || body.verify === true)) {
-            sendJson(res, 400, { error: "sandboxImageProfile is not supported together with cascade/verify in v1 (the per-task image would not bind to the cascade rungs / verifier sub-run)" });
+            sendError(res, 400, "request.field_conflict", "sandboxImageProfile is not supported together with cascade/verify in v1 (the per-task image would not bind to the cascade rungs / verifier sub-run)");
             return null;
         }
         if (body.outputSchema !== undefined) {
             if (typeof body.outputSchema !== "object" || body.outputSchema === null || Array.isArray(body.outputSchema)) {
-                sendJson(res, 400, { error: "outputSchema must be a JSON Schema object" });
+                sendError(res, 400, "request.field_invalid", "outputSchema must be a JSON Schema object");
                 return null;
             }
             if (JSON.stringify(body.outputSchema).length > MAX_OUTPUT_SCHEMA_CHARS) {
-                sendJson(res, 400, { error: `outputSchema must serialize to at most ${MAX_OUTPUT_SCHEMA_CHARS} characters` });
+                sendError(res, 400, "request.field_invalid", `outputSchema must serialize to at most ${MAX_OUTPUT_SCHEMA_CHARS} characters`);
                 return null;
             }
         }
         if (body.reasoningEffort !== undefined && !isThinkingLevel(body.reasoningEffort)) {
-            sendJson(res, 400, { error: "reasoningEffort must be one of: off, minimal, low, medium, high, xhigh, max" });
+            sendError(res, 400, "request.field_invalid", "reasoningEffort must be one of: off, minimal, low, medium, high, xhigh, max");
             return null;
         }
         if (body.resumeAt !== undefined) {
             if (typeof body.resumeAt !== "string" || body.resumeAt.length === 0 || body.resumeAt.length > 64) {
-                sendJson(res, 400, { error: "resumeAt must be a non-empty message eventId string (≤64 chars)" });
+                sendError(res, 400, "request.field_invalid", "resumeAt must be a non-empty message eventId string (≤64 chars)");
                 return null;
             }
             if (body.verify === true || body.cascade === true) {
-                sendJson(res, 400, { error: "resumeAt is not supported with verify or cascade (those start a fresh/replaced session)" });
+                sendError(res, 400, "request.field_conflict", "resumeAt is not supported with verify or cascade (those start a fresh/replaced session)");
                 return null;
             }
         }
         if (body.resumeAtMode !== undefined) {
             if (body.resumeAtMode !== "at" && body.resumeAtMode !== "before") {
-                sendJson(res, 400, { error: 'resumeAtMode must be "at" or "before"' });
+                sendError(res, 400, "request.field_invalid", 'resumeAtMode must be "at" or "before"');
                 return null;
             }
             if (body.resumeAt === undefined) {
-                sendJson(res, 400, { error: "resumeAtMode requires resumeAt (it qualifies the rewind target)" });
+                sendError(res, 400, "request.field_conflict", "resumeAtMode requires resumeAt (it qualifies the rewind target)");
                 return null;
             }
         }
         if (body.suggestNextPrompts !== undefined && typeof body.suggestNextPrompts !== "boolean") {
             const s = body.suggestNextPrompts;
             if (typeof s !== "object" || s === null || Array.isArray(s)) {
-                sendJson(res, 400, { error: "suggestNextPrompts must be a boolean or an object { count?, role? }" });
+                sendError(res, 400, "request.field_invalid", "suggestNextPrompts must be a boolean or an object { count?, role? }");
                 return null;
             }
             const o = s;
             if (o.count !== undefined && (typeof o.count !== "number" || !Number.isFinite(o.count) || o.count < 1)) {
-                sendJson(res, 400, { error: "suggestNextPrompts.count must be a positive number" });
+                sendError(res, 400, "request.field_invalid", "suggestNextPrompts.count must be a positive number");
                 return null;
             }
             if (o.role !== undefined && typeof o.role !== "string") {
-                sendJson(res, 400, { error: "suggestNextPrompts.role must be a string (a model role name)" });
+                sendError(res, 400, "request.field_invalid", "suggestNextPrompts.role must be a string (a model role name)");
                 return null;
             }
         }
         if (body.rewindFiles !== undefined && typeof body.rewindFiles !== "boolean") {
-            sendJson(res, 400, { error: "rewindFiles must be a boolean" });
+            sendError(res, 400, "request.field_invalid", "rewindFiles must be a boolean");
             return null;
         }
         if (body.memoryWrite !== undefined && typeof body.memoryWrite !== "boolean") {
-            sendJson(res, 400, { error: "memoryWrite must be a boolean (false = pause memory writes for this run)" });
+            sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
             return null;
         }
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
-            sendJson(res, 400, { error: "requireExistingSession must be a boolean" });
+            sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");
             return null;
         }
         if (body.enableFork !== undefined && typeof body.enableFork !== "boolean") {
-            sendJson(res, 400, { error: "enableFork must be a boolean" });
+            sendError(res, 400, "request.field_invalid", "enableFork must be a boolean");
             return null;
         }
         if (body.resilience !== undefined) {
             const r = body.resilience;
             if (typeof r !== "object" || r === null || Array.isArray(r)) {
-                sendJson(res, 400, { error: "resilience must be an object { allowDegrade?, allowFailover?, bypassBreaker? } (booleans)" });
+                sendError(res, 400, "request.field_invalid", "resilience must be an object { allowDegrade?, allowFailover?, bypassBreaker? } (booleans)");
                 return null;
             }
             for (const k of ["allowDegrade", "allowFailover", "bypassBreaker"]) {
                 const v = r[k];
                 if (v !== undefined && typeof v !== "boolean") {
-                    sendJson(res, 400, { error: `resilience.${k} must be a boolean` });
+                    sendError(res, 400, "request.field_invalid", `resilience.${k} must be a boolean`);
                     return null;
                 }
             }
         }
         if (body.finalVerification !== undefined && typeof body.finalVerification !== "boolean") {
-            sendJson(res, 400, { error: "finalVerification must be a boolean" });
+            sendError(res, 400, "request.field_invalid", "finalVerification must be a boolean");
             return null;
         }
         if (body.limits !== undefined) {
             const l = body.limits;
             if (typeof l !== "object" || l === null || Array.isArray(l)) {
-                sendJson(res, 400, { error: "limits must be an object { timeoutSec?, maxOutputTokens?, maxTurns? } (positive integers)" });
+                sendError(res, 400, "request.field_invalid", "limits must be an object { timeoutSec?, maxOutputTokens?, maxTurns? } (positive integers)");
                 return null;
             }
             for (const k of ["timeoutSec", "maxOutputTokens", "maxTurns"]) {
                 const v = l[k];
                 if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {
-                    sendJson(res, 400, { error: `limits.${k} must be a positive integer` });
+                    sendError(res, 400, "request.field_invalid", `limits.${k} must be a positive integer`);
                     return null;
                 }
             }
             for (const k of ["deadlineNudge", "callCapByDeadline", "gracefulFinalize"]) {
                 const v = body.limits[k];
                 if (v !== undefined && v !== false) {
-                    sendJson(res, 400, { error: `limits.${k} accepts only literal false (it is an opt-out; omit to keep the default-on behavior)` });
+                    sendError(res, 400, "request.field_invalid", `limits.${k} accepts only literal false (it is an opt-out; omit to keep the default-on behavior)`);
                     return null;
                 }
             }
@@ -3123,88 +640,82 @@ export function createHttpServer(rawDeps) {
         if (body.agents !== undefined) {
             const agentsErr = validateTaskAgents(body.agents);
             if (agentsErr) {
-                sendJson(res, 400, { error: agentsErr });
+                sendError(res, 400, "request.field_invalid", agentsErr);
                 return null;
             }
         }
         if (body.interactiveTools !== undefined && typeof body.interactiveTools !== "boolean") {
-            sendJson(res, 400, { error: "interactiveTools must be a boolean" });
+            sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
             return null;
         }
         if (body.retainBackgroundProcesses !== undefined && typeof body.retainBackgroundProcesses !== "boolean") {
-            sendJson(res, 400, { error: "retainBackgroundProcesses must be a boolean" });
+            sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
-                sendJson(res, 400, { error: `${key} must be an array of non-empty tool-name strings` });
+                sendError(res, 400, "request.field_invalid", `${key} must be an array of non-empty tool-name strings`);
                 return null;
             }
         }
         {
             const v = body.promptProfile;
             if (v !== undefined && v !== "simple" && v !== "classic") {
-                sendJson(res, 400, { error: 'promptProfile must be "simple" or "classic"' });
+                sendError(res, 400, "request.field_invalid", 'promptProfile must be "simple" or "classic"');
                 return null;
             }
         }
         if (body.model !== undefined) {
             if (typeof body.model !== "string" || body.model.length === 0) {
-                sendJson(res, 400, { error: "model must be a non-empty string (a configured catalog name, tier word, or model id)" });
+                sendError(res, 400, "request.field_invalid", "model must be a non-empty string (a configured catalog name, tier word, or model id)");
                 return null;
             }
             const bare = deps.config.models ?? {};
             const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
             if (matchCatalogModel(body.model, catalog) === undefined) {
-                sendJson(res, 400, {
-                    error: `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`,
-                    available: Object.keys(catalog).filter((n) => n !== "default"),
-                });
+                sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: Object.keys(catalog).filter((n) => n !== "default") });
                 return null;
             }
         }
         if (body.compactionModel !== undefined) {
             if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0) {
-                sendJson(res, 400, { error: "compactionModel must be a non-empty string (a configured catalog name, tier word, or model id)" });
+                sendError(res, 400, "request.field_invalid", "compactionModel must be a non-empty string (a configured catalog name, tier word, or model id)");
                 return null;
             }
             const bare = deps.config.models ?? {};
             const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
             if (matchCatalogModel(body.compactionModel, catalog) === undefined) {
-                sendJson(res, 400, {
-                    error: `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`,
-                    available: Object.keys(catalog).filter((n) => n !== "default"),
-                });
+                sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: Object.keys(catalog).filter((n) => n !== "default") });
                 return null;
             }
         }
         if (body.attachments !== undefined) {
             const a = body.attachments;
             if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendJson(res, 400, { error: "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, planModeReminder?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }" });
+                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, planModeReminder?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
                 return null;
             }
             const rec = a;
             for (const k of ["todoReminder", "planModeReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
-                    sendJson(res, 400, { error: `attachments.${k} must be a boolean` });
+                    sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
                     return null;
                 }
             }
             if (rec.todoReminderMode !== undefined && rec.todoReminderMode !== "baseline" && rec.todoReminderMode !== "off") {
-                sendJson(res, 400, { error: 'attachments.todoReminderMode must be "baseline" | "off"' });
+                sendError(res, 400, "request.field_invalid", 'attachments.todoReminderMode must be "baseline" | "off"');
                 return null;
             }
             const cf = rec.changedFiles;
             if (cf !== undefined && typeof cf !== "boolean") {
                 if (typeof cf !== "object" || cf === null || Array.isArray(cf)) {
-                    sendJson(res, 400, { error: "attachments.changedFiles must be a boolean or { maxFiles?: number }" });
+                    sendError(res, 400, "request.field_invalid", "attachments.changedFiles must be a boolean or { maxFiles?: number }");
                     return null;
                 }
                 const mf = cf.maxFiles;
                 if (mf !== undefined && (typeof mf !== "number" || !Number.isFinite(mf) || mf < 1)) {
-                    sendJson(res, 400, { error: "attachments.changedFiles.maxFiles must be a number ≥ 1" });
+                    sendError(res, 400, "request.field_invalid", "attachments.changedFiles.maxFiles must be a number ≥ 1");
                     return null;
                 }
             }
@@ -3217,15 +728,15 @@ export function createHttpServer(rawDeps) {
             : undefined;
         const cascade = body.cascade === true;
         if (cascade && verify) {
-            sendJson(res, 400, { error: "verify and cascade are mutually exclusive (verify = adversarial gate; cascade = cheap→strong ladder)" });
+            sendError(res, 400, "request.field_conflict", "verify and cascade are mutually exclusive (verify = adversarial gate; cascade = cheap→strong ladder)");
             return null;
         }
         if (body.suggestNextPrompts && (verify || cascade)) {
-            sendJson(res, 400, { error: "suggestNextPrompts is not supported with verify or cascade (those return a result, not a streamed run)" });
+            sendError(res, 400, "request.field_conflict", "suggestNextPrompts is not supported with verify or cascade (those return a result, not a streamed run)");
             return null;
         }
         if (cascade && deps.config.cascadeLadder.length === 0) {
-            sendJson(res, 400, { error: "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)" });
+            sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
         try {
@@ -3234,7 +745,7 @@ export function createHttpServer(rawDeps) {
         }
         catch (err) {
             if (err instanceof HttpError) {
-                sendJson(res, err.status, { error: err.message, ...(err.code ? { code: err.code, errorCode: err.code } : {}), ...(err.extra ?? {}) });
+                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.code ? { code: err.code } : {}), ...(err.extra ?? {}) });
                 return null;
             }
             throw err;
@@ -3261,7 +772,7 @@ export function createHttpServer(rawDeps) {
         }
         if (!token) {
             deps.logger?.info?.("approval_decide_no_pending", { sessionId });
-            return { status: 404, body: { error: "approval not found" } };
+            return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
         }
         const cpPromise = cs.get(token);
         const ctxPromise = cs.getCtx(sessionId);
@@ -3271,10 +782,10 @@ export function createHttpServer(rawDeps) {
         }
         catch (e) {
             void ctxPromise.catch(() => { });
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e) } };
+            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp)
-            return { status: 404, body: { error: "checkpoint not found" } };
+            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
         if (req !== undefined && deps.backgroundAgentStore !== undefined && deps.parkedReviveTool !== undefined) {
             const parked = await decideParkedAgent({
                 agentStore: deps.backgroundAgentStore,
@@ -3301,10 +812,10 @@ export function createHttpServer(rawDeps) {
             ctx = await ctxPromise;
         }
         catch (e) {
-            return { status: 409, body: { error: `resume context load failed: ${e instanceof Error ? e.message : String(e)}` } };
+            return { status: 409, body: { error: `resume context load failed: ${e instanceof Error ? e.message : String(e)}`, errorCode: "conflict.resume_context_unavailable" } };
         }
         if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config" } };
+            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: cp.scope === "_" ? undefined : cp.scope, memoryScope: ctx.memoryScope };
         let spec;
         try {
@@ -3333,14 +844,14 @@ export function createHttpServer(rawDeps) {
         if (decision === "approve" && pendingToolCanon && !availableTools.has(pendingToolCanon)) {
             return {
                 status: 422,
-                body: { error: `pending action no longer satisfiable: tool "${pendingToolCanon}" is not in the current task config (scenario changed since suspend)` },
+                body: { error: `pending action no longer satisfiable: tool "${pendingToolCanon}" is not in the current task config (scenario changed since suspend)`, errorCode: "conflict.pending_action_unsatisfiable" },
             };
         }
         if (decision === "approve" && pendingTool === "AskUserQuestion" && !answer) {
-            return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })" } };
+            return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
         }
         if (answer && (decision !== "approve" || pendingTool !== "AskUserQuestion")) {
-            return { status: 400, body: { error: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")` } };
+            return { status: 400, body: { error: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, errorCode: "request.field_conflict" } };
         }
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         if (answer)
@@ -3370,7 +881,7 @@ export function createHttpServer(rawDeps) {
             const adm = await deps.fleetLease.admit(principal);
             if (!adm.ok) {
                 deps.metrics?.inc("fleet_lease_rejected_total");
-                return { status: 429, body: { error: "budget exhausted (quota lease)", retryAfterSec: adm.retryAfterSec } };
+                return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
             }
         }
         const taskId = await deps.runStore?.getActiveTaskId(sessionId);
@@ -3409,7 +920,7 @@ export function createHttpServer(rawDeps) {
         if (taskId && deps.runStore) {
             claimedRow = await deps.runStore.markResuming(taskId);
             if (!claimedRow)
-                return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)" } };
+                return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
             fleetPub?.onStart();
             const rs = deps.runStore;
             const owner = principal ?? null;
@@ -3589,7 +1100,7 @@ export function createHttpServer(rawDeps) {
                                 const st = ev;
                                 deps.metrics?.inc("brain_retry_total", { phase: String(st.phase) });
                                 await flush();
-                                await append("brain_status", brainStatusEventData(st));
+                                await append("status", brainStatusEventData(st));
                                 break;
                             }
                             case "context_usage":
@@ -3760,23 +1271,23 @@ export function createHttpServer(rawDeps) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
         if (!token)
-            return { status: 404, body: { error: "no resumable suspension for this task (already running, resumed, or expired)" } };
+            return { status: 404, body: { error: "no resumable suspension for this task (already running, resumed, or expired)", errorCode: "not_found.suspension" } };
         let cp;
         try {
             cp = await cs.get(token);
         }
         catch (e) {
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e) } };
+            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp)
-            return { status: 404, body: { error: "checkpoint not found" } };
+            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
         const gateKind = cp.gate?.kind;
         if (gateKind !== "resource_limit") {
             return { status: 409, body: { error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a resumable resource/preempt suspension — an approval gate must be decided via POST /v1/approvals/:id/decide`, errorCode: "gate_not_resumable" } };
         }
         const ctx = await cs.getCtx(sessionId).catch(() => null);
         if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config" } };
+            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: cp.scope === "_" ? undefined : cp.scope, memoryScope: ctx.memoryScope };
         const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
@@ -3792,12 +1303,12 @@ export function createHttpServer(rawDeps) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
         if (!token)
-            return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)" } };
+            return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
         const operator = explicitOperatorOk(caller, deps.config.operatorPrincipals);
         if (!operator) {
             const scope = await cs.peekPendingScope(sessionId).catch(() => undefined);
             if (scope !== null && scope !== undefined && scope !== "_" && scope !== caller) {
-                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)" } };
+                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
             }
         }
         let cp;
@@ -3805,12 +1316,12 @@ export function createHttpServer(rawDeps) {
             cp = await cs.get(token);
         }
         catch (e) {
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e) } };
+            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp)
-            return { status: 404, body: { error: "checkpoint not found" } };
+            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
         if (!operator && cp.scope !== "_" && cp.scope !== caller) {
-            return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)" } };
+            return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
         }
         const gateKind = cp.gate?.kind;
         if (gateKind !== "task_done") {
@@ -3830,7 +1341,7 @@ export function createHttpServer(rawDeps) {
         }
         const ctx = await cs.getCtx(sessionId).catch(() => null);
         if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config" } };
+            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: cp.scope === "_" ? undefined : cp.scope, memoryScope: ctx.memoryScope };
         const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
@@ -3849,16 +1360,16 @@ export function createHttpServer(rawDeps) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
         if (!token)
-            return { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)" } };
+            return { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)", errorCode: "not_found.plan_review" } };
         let cp;
         try {
             cp = await cs.get(token);
         }
         catch (e) {
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e) } };
+            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp)
-            return { status: 404, body: { error: "checkpoint not found" } };
+            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
         const gateKind = cp.gate?.kind;
         if (gateKind !== "plan_review") {
             return {
@@ -3871,7 +1382,7 @@ export function createHttpServer(rawDeps) {
         }
         const ctx = await cs.getCtx(sessionId).catch(() => null);
         if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config" } };
+            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: cp.scope === "_" ? undefined : cp.scope, memoryScope: ctx.memoryScope };
         const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
@@ -3923,12 +1434,7 @@ export function createHttpServer(rawDeps) {
             return false;
         deps.metrics?.inc("cost_quota_rejected_total");
         res.setHeader("retry-after", String(d.retryAfterSec));
-        sendJson(res, 429, {
-            error: "cost quota exceeded",
-            usedMicroUsd: d.usedMicroUsd,
-            limitMicroUsd: d.limitMicroUsd,
-            retryAfterSec: d.retryAfterSec,
-        });
+        sendError(res, 429, "limit.cost_quota_exceeded", "cost quota exceeded", { usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec });
         return true;
     }
     async function leaseDenied(req, res) {
@@ -3954,7 +1460,7 @@ export function createHttpServer(rawDeps) {
             return false;
         deps.metrics?.inc("rate_limited_total");
         res.setHeader("retry-after", String(d.retryAfterSec));
-        sendJson(res, 429, { error: "rate limit exceeded", retryAfterSec: d.retryAfterSec });
+        sendError(res, 429, "limit.rate_exceeded", "rate limit exceeded", { retryAfterSec: d.retryAfterSec });
         return true;
     }
     function safeDecode(seg) {
@@ -3985,11 +1491,11 @@ export function createHttpServer(rawDeps) {
     function runOwnerOk(req, res, owner) {
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && !principal) {
-            sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
+            sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
             return false;
         }
         if (owner !== null && principal !== owner) {
-            sendJson(res, 404, { error: "run not found" });
+            sendError(res, 404, "not_found.run", "run not found");
             return false;
         }
         return true;
@@ -4010,7 +1516,7 @@ export function createHttpServer(rawDeps) {
             return true;
         if (explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals))
             return true;
-        sendJson(res, 404, { error: notFoundError });
+        sendError(res, 404, "not_found.run", notFoundError);
         return false;
     }
     async function readJson(req) {
@@ -4077,183 +1583,6 @@ export function createHttpServer(rawDeps) {
     }
     return Object.assign(server, { denyExpiredApprovals });
 }
-function encodeCursor(c) {
-    return Buffer.from(JSON.stringify(c)).toString("base64url");
-}
-function decodeCursor(s) {
-    if (!s)
-        return undefined;
-    try {
-        const o = JSON.parse(Buffer.from(s, "base64url").toString());
-        return o.createdAt && o.taskId && !Number.isNaN(Date.parse(o.createdAt)) ? { createdAt: o.createdAt, taskId: o.taskId } : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function handleTaskList(res, runStore, query, forceOwner) {
-    const status = query.get("status") ?? undefined;
-    const jobId = query.get("jobId") ?? undefined;
-    const source = query.get("source") ?? undefined;
-    const owner = forceOwner != null ? forceOwner : (query.get("owner") ?? undefined);
-    const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
-    const cursor = decodeCursor(query.get("cursor"));
-    const rows = await runStore.listRuns({ ...(status ? { status } : {}), ...(jobId ? { jobId } : {}), ...(source ? { source } : {}), ...(owner ? { owner } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1 });
-    const hasMore = rows.length > limit;
-    const page = hasMore ? rows.slice(0, limit) : rows;
-    const tasks = page.map((r) => runSummary(r));
-    const last = page[page.length - 1];
-    const nextCursor = hasMore && last ? encodeCursor({ createdAt: last.createdAt, taskId: last.taskId }) : undefined;
-    sendJson(res, 200, { tasks, ...(nextCursor ? { nextCursor } : {}) });
-}
-async function handleTaskArtifacts(res, runStore, taskId) {
-    const run = await runStore.getRun(taskId);
-    if (!run) {
-        sendJson(res, 404, { error: "task not found" });
-        return;
-    }
-    const events = await runStore.getEvents(taskId, 0);
-    sendJson(res, 200, { artifacts: projectArtifacts(events, { taskId, jobId: run.jobId }) });
-}
-async function handleTaskTurns(res, runStore, taskId, query) {
-    const run = await runStore.getRun(taskId);
-    if (!run) {
-        sendJson(res, 404, { error: "task not found" });
-        return;
-    }
-    const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 20) || 20));
-    const cursorSeq = Number(query.get("cursor") ?? 0) || 0;
-    const [events, retainedFrom] = await Promise.all([runStore.getEvents(taskId, 0), runStore.retainedFrom(taskId)]);
-    const all = projectEvents(events);
-    const eligible = cursorSeq > 0 ? all.filter((t) => t.seq < cursorSeq) : all;
-    const turns = eligible.slice(Math.max(0, eligible.length - limit));
-    const oldest = turns[0];
-    const nextCursor = eligible.length > limit && oldest ? String(oldest.seq) : undefined;
-    sendJson(res, 200, { turns, ...(nextCursor ? { nextCursor } : {}), retainedFrom });
-}
-async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
-    const run0 = await runStore.getRun(taskId);
-    if (!run0) {
-        sendJson(res, 404, { error: "task not found" });
-        return;
-    }
-    const lastId = Number(req.headers["last-event-id"] ?? new URL(req.url ?? "", "http://x").searchParams.get("from") ?? 0);
-    let from = Number.isFinite(lastId) ? lastId : 0;
-    if (from > 0) {
-        const retainedFrom = await runStore.retainedFrom(taskId);
-        if (retainedFrom > from + 1) {
-            sendJson(res, 416, { error: "resume point evicted past retention", retainedFrom });
-            return;
-        }
-    }
-    sseHeaders(res);
-    res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, mode: "delta", resumeFrom: from })}\n\n`);
-    let closed = false;
-    req.on("close", () => {
-        closed = true;
-    });
-    const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
-    let lastBeat = Date.now();
-    const write = (events) => {
-        for (const ev of events) {
-            const out = mapTraceEvent(ev.type, ev.seq, (ev.data ?? {}));
-            if (out)
-                res.write(`id: ${ev.seq}\nevent: ${out.event}\ndata: ${JSON.stringify(out.data)}\n\n`);
-            from = ev.seq;
-        }
-    };
-    while (!closed) {
-        const [events, run] = await Promise.all([runStore.getEvents(taskId, from), runStore.getRun(taskId)]);
-        write(events);
-        if (!run)
-            break;
-        if (run.status !== "running") {
-            write(await runStore.getEvents(taskId, from));
-            break;
-        }
-        const stale = Date.now() - new Date(run.updatedAt).getTime() > staleMs;
-        if (stale && events.length === 0) {
-            res.write(`event: error\ndata: ${JSON.stringify({ code: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
-            break;
-        }
-        if (Date.now() - start > MAX_MS) {
-            res.write(`event: error\ndata: ${JSON.stringify({ code: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
-            break;
-        }
-        if (events.length === 0) {
-            if (Date.now() - lastBeat > 15_000) {
-                res.write(`event: heartbeat\ndata: {}\n\n`);
-                lastBeat = Date.now();
-            }
-            await sleep(250);
-        }
-    }
-    res.end();
-}
-const APPROVALS_STREAM_POLL_MS = 3000;
-export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_STREAM_POLL_MS) {
-    const keyOf = (p) => JSON.stringify([p.sessionId, p.toolCallId ?? null]);
-    sseHeaders(res);
-    res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
-    let closed = false;
-    req.on("close", () => { closed = true; });
-    const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
-    let lastBeat = Date.now();
-    let prev = new Map();
-    let first = true;
-    while (!closed) {
-        let pending;
-        try {
-            pending = await cs.listPending(scope);
-        }
-        catch {
-            if (!res.writableEnded)
-                res.write(`event: heartbeat\ndata: ${JSON.stringify({ type: "heartbeat" })}\n\n`);
-            await sleep(pollMs);
-            continue;
-        }
-        const cur = new Map(pending.map((p) => [keyOf(p), p]));
-        if (first) {
-            for (const p of pending)
-                res.write(`event: pending\ndata: ${JSON.stringify({ type: "pending", ...p })}\n\n`);
-            res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
-            first = false;
-        }
-        else {
-            for (const [k, p] of cur)
-                if (!prev.has(k))
-                    res.write(`event: pending\ndata: ${JSON.stringify({ type: "pending", ...p })}\n\n`);
-            for (const [k, p] of prev)
-                if (!cur.has(k))
-                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`);
-        }
-        prev = cur;
-        if (Date.now() - start > MAX_MS) {
-            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
-            break;
-        }
-        if (Date.now() - lastBeat > 15_000) {
-            res.write(`event: heartbeat\ndata: ${JSON.stringify({ type: "heartbeat" })}\n\n`);
-            lastBeat = Date.now();
-        }
-        await sleep(pollMs);
-    }
-    res.end();
-}
-async function streamRunEvents(req, res, runStore, taskId, staleMs) {
-    await streamSseLog(req, res, {
-        statusOf: async (id) => {
-            const run = await runStore.getRun(id);
-            return run ? { status: run.status, updatedAt: run.updatedAt } : undefined;
-        },
-        getEvents: (id, after) => runStore.getEvents(id, after),
-        retainedFrom: (id) => runStore.retainedFrom(id),
-        formatEvent: (ev) => ({ id: ev.seq, event: ev.type, data: { type: ev.type, ...(ev.data ?? {}) } }),
-        staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
-    }, taskId, staleMs);
-}
 function isBillableSubmitPath(url) {
     return (url === "/v1/side-query" ||
         url === "/v1/tasks" ||
@@ -4265,260 +1594,6 @@ function isBillableSubmitPath(url) {
         RUN_SUBAGENT_RESUME_RE.test(url) ||
         url.startsWith("/v1/approvals"));
 }
-function summarizeWorkflowDetail(run) {
-    const isDone = (s) => s === "completed" || s === "failed";
-    const durationOf = (a) => a.startedAt === undefined || a.endedAt === undefined ? undefined : a.endedAt - a.startedAt;
-    const runPhases = run.phases ?? [];
-    const runAgents = run.agents ?? [];
-    const runGroups = run.groups ?? [];
-    const phases = runPhases.map((p) => {
-        const inPhase = runAgents.filter((a) => a.phase === p.title);
-        return {
-            title: redactSecrets(p.title),
-            status: p.status,
-            startedAt: p.startedAt,
-            endedAt: p.endedAt,
-            durationMs: durationOf(p),
-            done: inPhase.filter((a) => isDone(a.status)).length,
-            total: inPhase.length,
-        };
-    });
-    const phaseTitleSet = new Set(runPhases.map((p) => p.title));
-    const unphased = runAgents.filter((a) => a.phase === undefined || a.phase === "" || !phaseTitleSet.has(a.phase));
-    const unphasedView = unphased.length > 0
-        ? { done: unphased.filter((a) => isDone(a.status)).length, total: unphased.length }
-        : undefined;
-    const agents = runAgents.map((a) => ({
-        label: redactSecrets(a.label),
-        status: a.status,
-        displayStatus: deriveAgentDisplayStatus(a, run.status),
-        taskStatus: a.taskStatus,
-        callKey: a.callKey,
-        groupId: a.groupId,
-        phase: a.phase !== undefined ? redactSecrets(a.phase) : undefined,
-        model: a.model,
-        tokens: a.stats?.tokens,
-        turns: a.stats?.turns,
-        toolCalls: a.toolCalls,
-        activity: a.activity,
-        lastActivityAt: a.activity && a.activity.length > 0 ? a.activity[a.activity.length - 1].at : undefined,
-        durationMs: durationOf(a),
-        queuedAt: a.queuedAt,
-        startedAt: a.startedAt,
-        endedAt: a.endedAt,
-        replayed: a.replayed,
-        prompt: a.prompt,
-        output: a.output,
-    }));
-    const byId = new Map();
-    for (const g of runGroups) {
-        byId.set(g.groupId, {
-            groupId: g.groupId,
-            parentGroupId: g.parentGroupId,
-            status: g.status,
-            startedAt: g.startedAt,
-            endedAt: g.endedAt,
-            durationMs: durationOf(g),
-            agentCallKeys: runAgents.filter((a) => a.groupId === g.groupId).map((a) => a.callKey),
-            children: [],
-        });
-    }
-    const inCycle = (start) => {
-        const seen = new Set();
-        let cur = start;
-        while (cur && cur.parentGroupId !== undefined) {
-            if (seen.has(cur.groupId))
-                return true;
-            seen.add(cur.groupId);
-            cur = byId.get(cur.parentGroupId);
-        }
-        return false;
-    };
-    const roots = [];
-    for (const node of byId.values()) {
-        const parent = node.parentGroupId !== undefined ? byId.get(node.parentGroupId) : undefined;
-        if (parent && parent !== node && !inCycle(node))
-            parent.children.push(node);
-        else
-            roots.push(node);
-    }
-    return {
-        id: run.id,
-        scope: run.scope,
-        status: run.status,
-        ...(run.name !== undefined ? { name: redactSecrets(run.name) } : {}),
-        ...(run.description !== undefined ? { description: redactSecrets(run.description) } : {}),
-        stats: run.stats,
-        ...(run.agentFailures !== undefined ? { agentFailures: run.agentFailures } : {}),
-        startedAt: run.startedAt,
-        endedAt: run.endedAt,
-        createdAt: run.createdAt,
-        durationMs: durationOf(run),
-        rev: run.rev,
-        error: run.error,
-        ...(run.result !== undefined ? { result: redactSecrets(run.result) } : {}),
-        phases,
-        ...(unphasedView ? { unphased: unphasedView } : {}),
-        agents,
-        groups: roots,
-    };
-}
-async function streamWorkflowRun(req, res, runId, scope) {
-    sseHeaders(res);
-    res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, runId })}\n\n`);
-    let closed = false;
-    const it = subscribeWorkflow(runId, scope)[Symbol.asyncIterator]();
-    const hb = setInterval(() => {
-        if (!res.writableEnded)
-            res.write(`event: heartbeat\ndata: {}\n\n`);
-    }, 15_000);
-    if (typeof hb.unref === "function")
-        hb.unref();
-    const shutdown = () => {
-        if (closed)
-            return;
-        closed = true;
-        clearInterval(hb);
-        void it.return?.(undefined);
-        if (!res.writableEnded)
-            res.end();
-    };
-    req.on("close", shutdown);
-    res.on("close", shutdown);
-    try {
-        for (let next = await it.next(); !next.done; next = await it.next()) {
-            if (closed || res.writableEnded)
-                break;
-            const ev = next.value;
-            res.write(`event: ${ev.type ?? "event"}\ndata: ${JSON.stringify(ev)}\n\n`);
-        }
-    }
-    catch {
-        if (!closed && !res.writableEnded)
-            res.write(`event: error\ndata: ${JSON.stringify({ message: "workflow stream error" })}\n\n`);
-    }
-    finally {
-        clearInterval(hb);
-        void it.return?.(undefined);
-    }
-    if (!res.writableEnded)
-        res.end();
-}
-function streamFleet(req, res, bus, callerScope, callerSession = null, completionInbox) {
-    return new Promise((resolve) => {
-        sseHeaders(res);
-        res.write(`event: meta\ndata: ${JSON.stringify({ version: 1, scoped: callerScope !== null, sessionScoped: callerSession !== null, bgNotifyFailClosed: true })}\n\n`);
-        const seenTasks = new Set();
-        const seenWf = new Set();
-        const sessionOk = (rowSession) => callerSession === null || rowSession === undefined || rowSession === callerSession;
-        const visT = (r) => (callerScope === null || r.scope === callerScope) && sessionOk(r.sessionId);
-        const visW = (r) => (callerScope === null || r.scope === callerScope) && sessionOk(r.sessionId);
-        const stripT = (r) => {
-            const { scope: _s, sessionId: _sid, ...rest } = r;
-            if (callerSession !== null && r.sessionId === undefined) {
-                const { description: _d, agentType: _at, agentName: _an, currentAction: _ca, ...keep } = rest;
-                return { ...keep, name: "(unattributed)" };
-            }
-            return rest;
-        };
-        const stripW = (r) => {
-            const { scope: _s, sessionId: _sid, ...rest } = r;
-            if (callerSession !== null && r.sessionId === undefined) {
-                const { description: _d, ...keep } = rest;
-                return { ...keep, name: "(unattributed)" };
-            }
-            return rest;
-        };
-        const send = (event, data) => { if (!res.writableEnded)
-            res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`); };
-        const snap = bus.snapshot();
-        const tasks = snap.tasks.filter(visT);
-        const workflows = snap.workflows.filter(visW);
-        tasks.forEach((r) => seenTasks.add(r.id));
-        workflows.forEach((r) => seenWf.add(r.id));
-        send("snapshot", { tasks: tasks.map(stripT), workflows: workflows.map(stripW), ts: snap.ts });
-        const unsubscribe = bus.subscribe((frame) => {
-            switch (frame.type) {
-                case "task":
-                    if (visT(frame.row)) {
-                        seenTasks.add(frame.row.id);
-                        send("task", { row: stripT(frame.row), ts: frame.ts });
-                    }
-                    break;
-                case "workflow":
-                    if (visW(frame.row)) {
-                        seenWf.add(frame.row.id);
-                        send("workflow", { row: stripW(frame.row), ts: frame.ts });
-                    }
-                    break;
-                case "task_remove":
-                    if (seenTasks.delete(frame.id))
-                        send("task_remove", { id: frame.id, ts: frame.ts });
-                    break;
-                case "workflow_remove":
-                    if (seenWf.delete(frame.id))
-                        send("workflow_remove", { id: frame.id, ts: frame.ts });
-                    break;
-                case "hook_notice": {
-                    const hn = frame.notice;
-                    const hScopeOk = callerScope === null || hn.ownerScope === callerScope;
-                    const hSessionOk = callerSession === null || hn.ownerSessionId === callerSession;
-                    if (hScopeOk && hSessionOk) {
-                        const { ownerScope: _hs, ownerSessionId: _hsid, ...wire } = hn;
-                        send("hook_notice", { type: "hook_notice", ...wire, ts: frame.ts });
-                    }
-                    break;
-                }
-                case "bg_notification": {
-                    const n = frame.notification;
-                    const scopeOk = callerScope === null || n.ownerScope === callerScope;
-                    const sessionInjectOk = callerSession === null || n.ownerSessionId === callerSession;
-                    if (scopeOk && sessionInjectOk) {
-                        const { ownerScope: _os, ownerSessionId: _osid, ...wire } = n;
-                        send("bg_notification", { type: "bg_notification", ...wire, ts: frame.ts });
-                        if (completionInbox && n.ownerSessionId && callerSession !== null && callerSession === n.ownerSessionId && !res.writableEnded) {
-                            const ownerSid = n.ownerSessionId;
-                            const family = taskNotificationFoldKey({ task_id: n.taskId, status: n.status, ...(n.seq !== undefined ? { seq: n.seq } : {}) });
-                            const familyUuid = n.sessionId !== undefined && n.sessionId !== n.taskId
-                                ? taskNotificationFoldKey({ task_id: n.sessionId, status: n.status, ...(n.seq !== undefined ? { seq: n.seq } : {}) })
-                                : undefined;
-                            const ackIfAlive = () => {
-                                if (res.writableEnded || res.socket?.destroyed)
-                                    return;
-                                void completionInbox.markTerminalServed(ownerSid, family).catch(() => undefined);
-                                if (familyUuid !== undefined)
-                                    void completionInbox.markTerminalServed(ownerSid, familyUuid).catch(() => undefined);
-                            };
-                            res.write(`: ack
-
-`, ackIfAlive);
-                        }
-                    }
-                    break;
-                }
-                default:
-                    break;
-            }
-        });
-        const hb = setInterval(() => { if (!res.writableEnded)
-            res.write(`event: heartbeat\ndata: {}\n\n`); }, 15_000);
-        if (typeof hb.unref === "function")
-            hb.unref();
-        let done = false;
-        const shutdown = () => {
-            if (done)
-                return;
-            done = true;
-            clearInterval(hb);
-            unsubscribe();
-            if (!res.writableEnded)
-                res.end();
-            resolve();
-        };
-        req.on("close", shutdown);
-        res.on("close", shutdown);
-    });
-}
 function routeLabel(_method, url) {
     if (RUN_STEER_RE.test(url))
         return "/v1/runs/:id/steer";