@sema-agent/server 7.79.0 → 7.79.2

package/dist/http/server.js

@@ -1,95 +1,33 @@
 import http from "node:http";
-import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
-import { once } from "node:events";
-import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
-import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
-import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
+import { redactHead } from "../observability/run-terminal-log.js";
+import { validatePendingSteer, terminalProjection } from "@sema-agent/core";
 import {} from "../config-center/facade.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
-import { verifyDirectDoorProof } from "../principal-jwt.js";
+import { HttpError } from "../security.js";
 import {} from "../memory-sync.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, parseTaskSettings, skillListingBudgetFractionOk, skillListingMaxDescOk, taskSettingsKeyIssue } from "../task-settings.js";
-import { taskBodyKeyIssue } from "../request-key-closure.js";
-import { selfOrchestrationDenial } from "../task-workflow.js";
-import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
-import { parseHooksConfig } from "../hooks/hook-runner.js";
-import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
-import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
-import { runInBackground, evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
-import { failureCodeOf, nestedPauseOf, stripResumeToken } from "../terminal.js";
-import { mintCancelledResult } from "../run-cancel-context.js";
-import { personDecision } from "../host-decision.js";
-import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
-import { recordResumeResourceWindow } from "../resource-window.js";
-import { publicStoreProbeError } from "../store-live-probe.js";
-import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { evictIfConflict } from "../runs.js";
 import {} from "../orchestration/workflow-agent-steer.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
-import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
-import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
-import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
-import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
+import {} from "../orchestration/workflow-completion-inbox.js";
+import {} from "../fleet/fleet-bus.js";
+import {} from "../tool-approval.js";
 import {} from "../observability/rate-limit.js";
-import { withPrincipal } from "../observability/principal-context.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
-import { redactSecrets } from "../trace/redact.js";
-import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
-import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
-import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
-import { errorText } from "../observability/err-text.js";
-import { recordFailOpen } from "../observability/fail-open.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
-import { streamSseLog } from "./sse-log.js";
-import { verifyRoundsFromBody } from "./verify-rounds.js";
-import { acceptedResumingReceipt } from "./route-ctx.js";
-import { mintAndDriveDurableRun } from "./durable-run-leg.js";
-import { RUN_NOT_FOUND_MESSAGE } from "./route-ctx.js";
-import { handleCapabilities } from "./routes/capabilities.js";
-import { handleObservability } from "./routes/observability.js";
-import { handleDiagnostics } from "./routes/diagnostics.js";
-import { handleAdoption } from "./routes/adoption.js";
-import { handleRetention } from "./routes/retention-ops.js";
-import { handleAdminDrain } from "./routes/admin-drain.js";
-import { handleDevices } from "./routes/devices.js";
-import { handleAdminConfigRefresh } from "./routes/admin-config-refresh.js";
-import { handleConfigCatalog } from "./routes/config-catalog.js";
-import { handleMemoryOptOut } from "./routes/admin-memory-optout.js";
-import { handleMemoryPolicy } from "./routes/memory-policy.js";
-import { handleMemoryBundle } from "./routes/memory-bundle.js";
-import { handleMemoryCompliance } from "./routes/memory-compliance.js";
-import { handleMemoryOrigin } from "./routes/memory-origin.js";
-import { handleMemoryConsolidation } from "./routes/memory-consolidation.js";
-import { handleSharedMemory } from "./routes/shared-memory.js";
-import { handleRules } from "./routes/rules.js";
-import { handleSessionsList } from "./routes/sessions-list.js";
-import { handleAgentRoster } from "./routes/agents-roster.js";
-import { handleSessions, createSessionsLocal } from "./routes/sessions.js";
-import { handleSessionSync, createSessionSyncLocal } from "./routes/session-sync.js";
-import { handleAttachments } from "./routes/attachments.js";
-import { handleFleet } from "./routes/fleet.js";
-import { handleA2aServe, handleA2a } from "./routes/a2a-serve.js";
-import { handleTraceUsage } from "./routes/trace-usage.js";
-import { handleWorkflows, handleWorkflowAgentSteer } from "./routes/workflows.js";
-import { handleNotifyWake, SESSION_WAKE_RE } from "./routes/notify-wake.js";
-import { handleApprovalsAssistant, streamApprovals, isQuestionAnswer, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
+import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
-import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
-import { handleRunMemoryCapture } from "./routes/run-memory-capture.js";
-import { handleSideQuery } from "./routes/side-query.js";
-import { handleTasks } from "./routes/tasks.js";
-import { handleLeader } from "./routes/leader.js";
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
-import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
+import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-import { sendJson, sendError, httpErrorCode, msg, isSseResponse } from "./send.js";
-import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
-import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
-import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
+import { sendError, httpErrorCode, msg } from "./send.js";
+import { createRequestGuards } from "./request-guards.js";
+import { createAdmission, MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills } from "./admission.js";
+import { createResumeLegs } from "./resume-legs.js";
+import { createDispatch, hasServiceAuth } from "./dispatch.js";
+import { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath } from "./route-table.js";
+import { createApprovalSweeps } from "./approval-sweeps.js";
+export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, hasServiceAuth };
+export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
+import { explicitOperatorOk, isOperator } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator };
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
@@ -97,84 +35,6 @@ export function flattenServiceDeps(deps) {
         return deps;
     return { ...stores, ...coordinators, ...seams, ...observability, ...governance, ...deployment, ...knobs, ...flat };
 }
-export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
-export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
-export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
-export function validateUserSkills(skills) {
-    if (skills === undefined)
-        return null;
-    if (!Array.isArray(skills))
-        return "skills must be an array of { name, description, content }";
-    for (const s of skills) {
-        if (s === null || typeof s !== "object")
-            return "each skill must be an object { name, description, content }";
-        if (typeof s["name"] !== "string" || s["name"].length === 0)
-            return "skill.name must be a non-empty string";
-        if (typeof s["description"] !== "string")
-            return "skill.description must be a string";
-        if (typeof s["content"] !== "string" || s["content"].length === 0 || s["content"].length > MAX_SKILL_CONTENT_CHARS)
-            return `skill.content must be a non-empty string of at most ${MAX_SKILL_CONTENT_CHARS} characters (the engine rejects skills over this size outright at load time)`;
-    }
-    return null;
-}
-const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
-const MAX_BODY = 8 * 1024 * 1024;
-const MAX_IMAGES_PER_REQUEST = 20;
-const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
-function mentionableNames(config, catalog) {
-    const allowlist = config.atModelAllowlist ?? [];
-    return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
-}
-function isCheckpointReopenedFailure(r) {
-    const code = failureCodeOf(r.terminal);
-    return code === "resume.env_failed" || code === "resume.tool_unavailable" || code === "resume.tool_contract_mismatch";
-}
-function nestedParkStatusOf(r) {
-    const paused = nestedPauseOf(r.terminal);
-    if (paused === undefined)
-        return undefined;
-    return PAUSE_REGISTRY[paused.gate.kind].taskStatus;
-}
-const ROUTE_DOMAINS = [
-    handleTraceUsage,
-    handleWorkflows,
-    handleFleet,
-    handleA2aServe,
-    handleCapabilities,
-    handleSideQuery,
-    handleTasks,
-    handleRuns,
-    handleA2a,
-    handleWorkflowAgentSteer,
-    handleRunVerbs,
-    handleRunMemoryCapture,
-    handleLeader,
-    handleImages,
-    handleApprovalsAssistant,
-    handleObservability,
-    handleDiagnostics,
-    handleAdoption,
-    handleRetention,
-    handleAdminDrain,
-    handleDevices,
-    handleAdminConfigRefresh,
-    handleConfigCatalog,
-    handleMemoryOptOut,
-    handleMemoryPolicy,
-    handleMemoryBundle,
-    handleMemoryCompliance,
-    handleMemoryOrigin,
-    handleMemoryConsolidation,
-    handleRules,
-    handleSharedMemory,
-    handleSessionsList,
-    handleAgentRoster,
-    handleSessions,
-    handleSessionSync,
-    handleAttachments,
-    handleNotifyWake,
-];
-void ROUTE_DOMAINS;
 export function createHttpServer(rawDeps) {
     const deps = flattenServiceDeps(rawDeps);
     const idemCache = new IdempotencyCache();
@@ -194,18 +54,6 @@ export function createHttpServer(rawDeps) {
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
-    const openResponses = new Set();
-    let lastAttachEndedAt = 0;
-    if (deps.drainState) {
-        deps.drainState.attachedStreams = () => {
-            let n = 0;
-            for (const r of openResponses)
-                if (isSseResponse(r))
-                    n++;
-            return n;
-        };
-        deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
-    }
     if (deps.hookWakeBus) {
         deps.hookWakeBus.deliver = async (sessionId, text) => {
             try {
@@ -243,6 +91,11 @@ export function createHttpServer(rawDeps) {
             }
         };
     }
+    const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
+    const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, resumePlanReview } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
+    const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {
         void handle(req, res).catch((err) => {
             if (err instanceof HttpError) {
@@ -260,1934 +113,9 @@ export function createHttpServer(rawDeps) {
         });
     });
     deps.deviceHub?.attach(server);
-    const routeCtxBase = {
-        deps,
-        registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
-        local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal() },
-        legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, resumePlanReview },
-    };
-    async function handle(req, res) {
-        const startedAt = Date.now();
-        const method = req.method ?? "GET";
-        const url = (req.url ?? "/").split("?")[0];
-        noteActivity(url);
-        const admitted = method !== "OPTIONS" && url !== "/health" && !url.startsWith("/metrics");
-        if (admitted)
-            counters.admittedInflight++;
-        if (admitted)
-            openResponses.add(res);
-        let logged = false;
-        const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
-        const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
-        const record = (viaClose) => {
-            if (logged)
-                return;
-            logged = true;
-            if (admitted)
-                counters.admittedInflight--;
-            if (openResponses.delete(res) && isSseResponse(res))
-                lastAttachEndedAt = performance.now();
-            const route = routeLabel(method, url);
-            const seconds = (Date.now() - startedAt) / 1000;
-            const aborted = viaClose && !res.writableEnded;
-            const status = aborted ? "499" : String(res.statusCode);
-            deps.metrics?.inc("http_requests_total", { route, method, status });
-            deps.metrics?.observe("http_request_duration_seconds", seconds, { route });
-            const log = route === "/health" || route === "/metrics" ? deps.logger?.debug : deps.logger?.info;
-            log?.call(deps.logger, "request", { method, route, status, ms: Date.now() - startedAt, ...(reqState.runStatus !== undefined ? { runStatus: reqState.runStatus } : {}), ...(reqState.runErrorCode !== undefined ? { errorCode: reqState.runErrorCode } : {}), ...(aborted ? { aborted: true, ...(reqState.streamTaskId ? { taskId: reqState.streamTaskId } : {}), ...(reqState.streamDetached ? { detached: true } : {}) } : {}) });
-        };
-        res.on("finish", () => record(false));
-        res.on("close", () => record(true));
-        cors(res, req, deps.config.corsOrigins, deps.config.principalHeader);
-        if (req.method === "OPTIONS") {
-            res.writeHead(204);
-            res.end();
-            return;
-        }
-        if (req.method === "GET" && url === "/health") {
-            const restart = deps.restartState?.();
-            const configHash = createHash("sha256")
-                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
-                .digest("hex")
-                .slice(0, 16);
-            sendJson(res, 200, {
-                status: "ok",
-                ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
-                ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
-                ...(deps.storeDegraded ? { durable: false, storeDegraded: true } : {}),
-                ...(deps.modelReady && !deps.modelReady() ? { ready: false, readyReason: "model roster pending (first effective-config pull)" } : {}),
-                model: deps.config.model.id,
-                sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
-                sessions: deps.runner.sessions.size,
-                ...(deps.instanceId ? { instanceId: deps.instanceId } : {}),
-                ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
-                configHash,
-                pid: process.pid,
-                startedAt: PROCESS_STARTED_AT_MS,
-                port: deps.config.port,
-                ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
-                ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
-                ...(() => {
-                    const stuck = deps.planeDeferredState?.();
-                    return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
-                })(),
-                ...(() => {
-                    const gen = deps.configApplyState?.();
-                    if (!gen)
-                        return {};
-                    return {
-                        configTargetVersion: gen.configTargetVersion,
-                        configAppliedVersion: gen.configAppliedVersion,
-                        configTargetOrdinal: gen.configTargetOrdinal,
-                        configAppliedOrdinal: gen.configAppliedOrdinal,
-                        ...(gen.configApplyStaleMs !== undefined ? { configApplyStaleMs: gen.configApplyStaleMs } : {}),
-                    };
-                })(),
-                ...(() => {
-                    const probe = deps.storeLiveState?.();
-                    if (!probe)
-                        return {};
-                    return {
-                        ...(probe.live ? {} : { storeLive: false }),
-                        storeProbe: { live: probe.live, ageMs: probe.ageMs, ...(probe.error !== undefined ? { error: publicStoreProbeError(probe.error) } : {}) },
-                    };
-                })(),
-            });
-            return;
-        }
-        if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
-            if (!deps.metrics) {
-                sendError(res, 404, "feature.metrics_disabled", "metrics disabled");
-                return;
-            }
-            const { authToken: t, metricsToken: mt } = deps.config;
-            const anyT = Boolean(t) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-            const devOpen = !anyT && !mt && !deps.config.requirePrincipal;
-            const ok = devOpen || (anyT && systemFor(req, deps.config) !== undefined) || (!!mt && authorized(req, mt));
-            if (!ok) {
-                sendError(res, 401, "auth.unauthorized", "unauthorized");
-                return;
-            }
-            if (url === "/metrics/summary") {
-                sendJson(res, 200, { model: deps.config.model.id, ...deps.metrics.summarize() });
-                return;
-            }
-            if (url === "/metrics/plan-cache") {
-                sendJson(res, 200, { scopes: deps.planCacheProbe?.dump() ?? {} });
-                return;
-            }
-            res.writeHead(200, { "content-type": "text/plain; version=0.0.4" });
-            res.end(deps.metrics.render());
-            return;
-        }
-        if (deps.registryJwtVerifier) {
-            const authz = req.headers.authorization ?? "";
-            const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
-            if (rawBearer && looksLikeJwt(rawBearer)) {
-                const v = await deps.registryJwtVerifier.verify(rawBearer);
-                if (v.ok) {
-                    setSsoPrincipal(req, v.identity.principal);
-                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
-                    if (v.identity.scope)
-                        setSsoScope(req, v.identity.scope);
-                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
-                }
-            }
-        }
-        if (await handleTraceUsage(req, res, url, ctx))
-            return;
-        if (await handleWorkflows(req, res, url, ctx))
-            return;
-        if (await handleFleet(req, res, url, ctx))
-            return;
-        if (await handleA2aServe(req, res, url, ctx))
-            return;
-        let source = null;
-        const anyServiceAuth = hasServiceAuth(deps.config);
-        if (anyServiceAuth) {
-            const sys = systemFor(req, deps.config);
-            if (sys === undefined) {
-                if (ssoVerifiedPrincipal(req)) {
-                    source = "sso";
-                }
-                else {
-                    sendError(res, 401, "auth.unauthorized", "unauthorized");
-                    return;
-                }
-            }
-            else {
-                source = sys;
-            }
-        }
-        reqState.source = source;
-        if (!anyServiceAuth &&
-            !deps.config.allowUnauthedWrites &&
-            ((req.method === "POST" && (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) ||
-                isCredentialGatedRewrite(req.method ?? "", url))) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
-            return;
-        }
-        if (deps.drainState?.draining && req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
-            res.setHeader("retry-after", "15");
-            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance", ...(deps.drainState.reason ? { reason: deps.drainState.reason } : {}) });
-            return;
-        }
-        if (deps.modelReady && !deps.modelReady() && req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
-            res.setHeader("retry-after", "5");
-            sendError(res, 503, "state.model_roster_pending", "model_roster_pending", { message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
-            return;
-        }
-        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
-            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
-            return;
-        }
-        if (await handleCapabilities(req, res, url, ctx))
-            return;
-        if (await handleSideQuery(req, res, url, ctx))
-            return;
-        if (await handleTasks(req, res, url, ctx))
-            return;
-        if (await handleRuns(req, res, url, ctx))
-            return;
-        if (await handleA2a(req, res, url, ctx))
-            return;
-        if (await handleWorkflowAgentSteer(req, res, url, ctx))
-            return;
-        if (await handleRunVerbs(req, res, url, ctx))
-            return;
-        if (await handleRunMemoryCapture(req, res, url, ctx))
-            return;
-        if (await handleLeader(req, res, url, ctx))
-            return;
-        if (await handleImages(req, res, url, ctx))
-            return;
-        if (await handleApprovalsAssistant(req, res, url, ctx))
-            return;
-        if (await handleObservability(req, res, url, ctx))
-            return;
-        if (await handleDiagnostics(req, res, url, ctx))
-            return;
-        if (await handleAdoption(req, res, url, ctx))
-            return;
-        if (await handleRetention(req, res, url, ctx))
-            return;
-        if (await handleAdminDrain(req, res, url, ctx))
-            return;
-        if (await handleDevices(req, res, url, ctx))
-            return;
-        if (await handleAdminConfigRefresh(req, res, url, ctx))
-            return;
-        if (await handleConfigCatalog(req, res, url, ctx))
-            return;
-        if (await handleMemoryOptOut(req, res, url, ctx))
-            return;
-        if (await handleMemoryPolicy(req, res, url, ctx))
-            return;
-        if (await handleMemoryBundle(req, res, url, ctx))
-            return;
-        if (await handleMemoryCompliance(req, res, url, ctx))
-            return;
-        if (await handleMemoryOrigin(req, res, url, ctx))
-            return;
-        if (deps.memoryConsolidation && (await handleMemoryConsolidation(req, res, url, ctx)))
-            return;
-        if (await handleRules(req, res, url, ctx))
-            return;
-        if (deps.sharedMemoryStore && deps.orgMemoryDirectory && (await handleSharedMemory(req, res, url, ctx)))
-            return;
-        if (await handleSessionsList(req, res, url, ctx))
-            return;
-        if (await handleAgentRoster(req, res, url, ctx))
-            return;
-        if (await handleSessions(req, res, url, ctx))
-            return;
-        if (await handleSessionSync(req, res, url, ctx))
-            return;
-        if (await handleAttachments(req, res, url, ctx))
-            return;
-        if (await handleNotifyWake(req, res, url, ctx))
-            return;
-        sendError(res, 404, "not_found.route", "not found");
-    }
     function runnerFor(spec) {
         return deps.runnerFor?.(spec) ?? deps.runner;
     }
-    async function prepareSpec(req, res, bodyIn, onTypedFailure, legFacts) {
-        const body = bodyIn ?? (await readJson(req));
-        if (!body || typeof body.objective !== "string") {
-            sendError(res, 400, "request.field_invalid", "missing 'objective' string");
-            return null;
-        }
-        if (body.objective.trim().length === 0) {
-            sendError(res, 400, "request.field_invalid", "objective must not be empty or whitespace-only (an empty user message poisons the session history on strict providers)");
-            return null;
-        }
-        {
-            const bodyKeyIssue = taskBodyKeyIssue(body);
-            if (bodyKeyIssue) {
-                sendError(res, 400, "request.body_shape", bodyKeyIssue.message, { unknownKeys: bodyKeyIssue.unknownKeys, unsupportedKeys: bodyKeyIssue.unsupportedKeys });
-                return null;
-            }
-        }
-        if (body.jobId !== undefined && (typeof body.jobId !== "string" || body.jobId.length === 0 || body.jobId.length > 64)) {
-            sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters");
-            return null;
-        }
-        if (typeof body.sessionId === "string" && body.sessionId.length > 64) {
-            sendError(res, 400, "request.field_invalid", "sessionId must be at most 64 characters");
-            return null;
-        }
-        if (typeof body.systemPrompt === "string" && body.systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-            sendError(res, 400, "request.field_invalid", `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
-            return null;
-        }
-        if (body.appendSystemPrompt !== undefined) {
-            if (typeof body.appendSystemPrompt !== "string" || body.appendSystemPrompt.length === 0) {
-                sendError(res, 400, "request.field_invalid", "appendSystemPrompt must be a non-empty string");
-                return null;
-            }
-            if (body.appendSystemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-                sendError(res, 400, "request.field_invalid", `appendSystemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
-                return null;
-            }
-        }
-        if (body.cwd !== undefined && !isValidCwd(body.cwd)) {
-            sendError(res, 400, "request.field_invalid", "cwd must be a non-empty absolute host path");
-            return null;
-        }
-        const addDirsRaw = body.additionalDirectories;
-        if (addDirsRaw !== undefined) {
-            if (!Array.isArray(addDirsRaw)) {
-                sendError(res, 400, "request.field_invalid", "additionalDirectories must be an array of absolute host paths");
-                return null;
-            }
-            if (addDirsRaw.length > MAX_ADDITIONAL_DIRS) {
-                sendError(res, 400, "request.field_invalid", `additionalDirectories must have at most ${MAX_ADDITIONAL_DIRS} entries`);
-                return null;
-            }
-            const bad = addDirsRaw.find((d) => !isValidCwd(d));
-            if (bad !== undefined) {
-                sendError(res, 400, "request.field_invalid", "each additionalDirectories entry must be a non-empty absolute host path (no '..' segments)");
-                return null;
-            }
-        }
-        const addReadDirsRaw = body.additionalReadDirectories;
-        if (addReadDirsRaw !== undefined) {
-            if (!Array.isArray(addReadDirsRaw)) {
-                sendError(res, 400, "request.field_invalid", "additionalReadDirectories must be an array of absolute host paths");
-                return null;
-            }
-            if (addReadDirsRaw.length > MAX_ADDITIONAL_DIRS) {
-                sendError(res, 400, "request.field_invalid", `additionalReadDirectories must have at most ${MAX_ADDITIONAL_DIRS} entries`);
-                return null;
-            }
-            const badRead = addReadDirsRaw.find((d) => !isValidCwd(d));
-            if (badRead !== undefined) {
-                sendError(res, 400, "request.field_invalid", "each additionalReadDirectories entry must be a non-empty absolute host path (no '..' segments)");
-                return null;
-            }
-        }
-        const settingsRaw = body.settings;
-        if (settingsRaw !== undefined && settingsRaw !== null) {
-            if (typeof settingsRaw !== "object" || Array.isArray(settingsRaw)) {
-                sendError(res, 400, "request.field_invalid", "settings must be an object");
-                return null;
-            }
-            const st = settingsRaw;
-            {
-                const keyIssue = taskSettingsKeyIssue(st);
-                if (keyIssue) {
-                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
-                    return null;
-                }
-            }
-            if (typeof st.outputStyle === "string" && st.outputStyle.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
-                sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`);
-                return null;
-            }
-            if (typeof st.outputStyle === "string" &&
-                st.outputStyle.length > 0 &&
-                typeof body.appendSystemPrompt === "string" &&
-                body.appendSystemPrompt.length + 2 + st.outputStyle.length > MAX_SYSTEM_PROMPT_CHARS) {
-                sendError(res, 400, "request.field_conflict", `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)`);
-                return null;
-            }
-            const perms = st.permissions;
-            if (perms !== undefined && perms !== null && (typeof perms !== "object" || Array.isArray(perms))) {
-                sendError(res, 400, "request.field_invalid", "settings.permissions must be an object");
-                return null;
-            }
-            if (perms !== null && typeof perms === "object" && !Array.isArray(perms)) {
-                for (const k of ["allow", "deny", "ask"]) {
-                    const arr = perms[k];
-                    if (Array.isArray(arr) && arr.length > MAX_SETTINGS_PERMISSION_RULES) {
-                        sendError(res, 400, "request.field_invalid", `settings.permissions.${k} must have at most ${MAX_SETTINGS_PERMISSION_RULES} entries`);
-                        return null;
-                    }
-                }
-            }
-            const envRaw = st.env;
-            if (envRaw !== undefined && envRaw !== null) {
-                if (typeof envRaw !== "object" || Array.isArray(envRaw)) {
-                    sendError(res, 400, "request.field_invalid", "settings.env must be an object of string→string");
-                    return null;
-                }
-                const entries = Object.entries(envRaw);
-                if (entries.length > MAX_SETTINGS_ENV_VARS) {
-                    sendError(res, 400, "request.field_invalid", `settings.env must have at most ${MAX_SETTINGS_ENV_VARS} variables`);
-                    return null;
-                }
-                for (const [k, val] of entries) {
-                    if (k.length > MAX_SETTINGS_ENV_KEY_CHARS || (typeof val === "string" && val.length > MAX_SETTINGS_ENV_VALUE_CHARS)) {
-                        sendError(res, 400, "request.field_invalid", `settings.env keys must be ≤${MAX_SETTINGS_ENV_KEY_CHARS} chars and values ≤${MAX_SETTINGS_ENV_VALUE_CHARS} chars`);
-                        return null;
-                    }
-                }
-            }
-            if (st.ultracode !== undefined && typeof st.ultracode !== "boolean") {
-                sendError(res, 400, "request.field_invalid", "settings.ultracode must be a boolean");
-                return null;
-            }
-            if (st.skillListingBudgetFraction !== undefined && !skillListingBudgetFractionOk(st.skillListingBudgetFraction)) {
-                sendError(res, 400, "request.field_invalid", "settings.skillListingBudgetFraction must be a number greater than 0 and at most 1");
-                return null;
-            }
-            if (st.skillListingMaxDescChars !== undefined && !skillListingMaxDescOk(st.skillListingMaxDescChars)) {
-                sendError(res, 400, "request.field_invalid", "settings.skillListingMaxDescChars must be a positive integer");
-                return null;
-            }
-            if (st.hooks !== undefined && st.hooks !== null) {
-                const hooksParsed = parseHooksConfig(st.hooks);
-                if (!hooksParsed.config) {
-                    sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
-                    return null;
-                }
-            }
-        }
-        const skillsErr = validateUserSkills(body.skills);
-        if (skillsErr) {
-            sendError(res, 400, "request.field_invalid", skillsErr);
-            return null;
-        }
-        if (Array.isArray(body.images)) {
-            if (body.images.length > MAX_IMAGES_PER_REQUEST) {
-                sendError(res, 413, "request.payload_too_large", `at most ${MAX_IMAGES_PER_REQUEST} images per request`);
-                return null;
-            }
-            for (const img of body.images) {
-                const data = img.data;
-                if (typeof data === "string" && Buffer.byteLength(data, "utf8") > MAX_IMAGE_BASE64_BYTES) {
-                    sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes`);
-                    return null;
-                }
-            }
-        }
-        if (body.clientContext !== undefined) {
-            const cc = body.clientContext;
-            if (typeof cc !== "object" || cc === null || Array.isArray(cc)) {
-                sendError(res, 400, "request.field_invalid", "clientContext must be an object");
-                return null;
-            }
-            if (cc.timeZone !== undefined && (typeof cc.timeZone !== "string" || cc.timeZone.length > 64)) {
-                sendError(res, 400, "request.field_invalid", "clientContext.timeZone must be a string of at most 64 characters");
-                return null;
-            }
-            if (cc.userEmail !== undefined && (typeof cc.userEmail !== "string" || cc.userEmail.length > 256)) {
-                sendError(res, 400, "request.field_invalid", "clientContext.userEmail must be a string of at most 256 characters");
-                return null;
-            }
-        }
-        if (body.sandboxImageProfile !== undefined && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0 || body.sandboxImageProfile.length > 128)) {
-            sendError(res, 400, "request.field_invalid", "sandboxImageProfile must be a non-empty string of at most 128 characters");
-            return null;
-        }
-        if (body.capabilitiesNeeded !== undefined && (!Array.isArray(body.capabilitiesNeeded) || body.capabilitiesNeeded.some((c) => typeof c !== "string"))) {
-            sendError(res, 400, "request.field_invalid", "capabilitiesNeeded must be an array of strings");
-            return null;
-        }
-        if (Array.isArray(body.capabilitiesNeeded) && body.capabilitiesNeeded.length > 0 && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0)) {
-            sendError(res, 400, "request.field_conflict", "capabilitiesNeeded requires sandboxImageProfile (it constrains the selected image)");
-            return null;
-        }
-        if (typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 && (body.cascade === true || body.verify === true)) {
-            sendError(res, 400, "request.field_conflict", "sandboxImageProfile is not supported together with cascade/verify in v1 (the per-task image would not bind to the cascade rungs / verifier sub-run)");
-            return null;
-        }
-        if (body.outputSchema !== undefined) {
-            if (typeof body.outputSchema !== "object" || body.outputSchema === null || Array.isArray(body.outputSchema)) {
-                sendError(res, 400, "request.field_invalid", "outputSchema must be a JSON Schema object");
-                return null;
-            }
-            if (JSON.stringify(body.outputSchema).length > MAX_OUTPUT_SCHEMA_CHARS) {
-                sendError(res, 400, "request.field_invalid", `outputSchema must serialize to at most ${MAX_OUTPUT_SCHEMA_CHARS} characters`);
-                return null;
-            }
-        }
-        if (body.reasoningEffort !== undefined && !isThinkingLevel(body.reasoningEffort)) {
-            sendError(res, 400, "request.field_invalid", "reasoningEffort must be one of: off, minimal, low, medium, high, xhigh, max");
-            return null;
-        }
-        if (body.resumeAt !== undefined) {
-            if (typeof body.resumeAt !== "string" || body.resumeAt.length === 0 || body.resumeAt.length > 64) {
-                sendError(res, 400, "request.field_invalid", "resumeAt must be a non-empty message eventId string (≤64 chars)");
-                return null;
-            }
-            if (body.verify === true || body.cascade === true) {
-                sendError(res, 400, "request.field_conflict", "resumeAt is not supported with verify or cascade (those start a fresh/replaced session)");
-                return null;
-            }
-        }
-        if (body.resumeAtMode !== undefined) {
-            if (body.resumeAtMode !== "at" && body.resumeAtMode !== "before") {
-                sendError(res, 400, "request.field_invalid", 'resumeAtMode must be "at" or "before"');
-                return null;
-            }
-            if (body.resumeAt === undefined) {
-                sendError(res, 400, "request.field_conflict", "resumeAtMode requires resumeAt (it qualifies the rewind target)");
-                return null;
-            }
-        }
-        if (body.suggestNextPrompts !== undefined && typeof body.suggestNextPrompts !== "boolean") {
-            const s = body.suggestNextPrompts;
-            if (typeof s !== "object" || s === null || Array.isArray(s)) {
-                sendError(res, 400, "request.field_invalid", "suggestNextPrompts must be a boolean or an object { count?, role? }");
-                return null;
-            }
-            const o = s;
-            if (o.count !== undefined && (typeof o.count !== "number" || !Number.isFinite(o.count) || o.count < 1)) {
-                sendError(res, 400, "request.field_invalid", "suggestNextPrompts.count must be a positive number");
-                return null;
-            }
-            if (o.role !== undefined && typeof o.role !== "string") {
-                sendError(res, 400, "request.field_invalid", "suggestNextPrompts.role must be a string (a model role name)");
-                return null;
-            }
-        }
-        if (body.rewindFiles !== undefined && typeof body.rewindFiles !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "rewindFiles must be a boolean");
-            return null;
-        }
-        if (body.restoreFiles !== undefined && typeof body.restoreFiles !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "restoreFiles must be a boolean");
-            return null;
-        }
-        if (body.acceptPartialRestore !== undefined && typeof body.acceptPartialRestore !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "acceptPartialRestore must be a boolean");
-            return null;
-        }
-        if (body.memoryWrite !== undefined && typeof body.memoryWrite !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
-            return null;
-        }
-        if (body.memoryCapture !== undefined && body.memoryCapture !== "off") {
-            sendError(res, 400, "request.field_invalid", "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)");
-            return null;
-        }
-        if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");
-            return null;
-        }
-        if (body.enableFork !== undefined && typeof body.enableFork !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "enableFork must be a boolean");
-            return null;
-        }
-        if (body.selfOrchestration !== undefined && typeof body.selfOrchestration !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "selfOrchestration must be a boolean");
-            return null;
-        }
-        {
-            const denial = selfOrchestrationDenial({ selfOrchestrationEnabled: deps.config.selfOrchestrationEnabled, requirePrincipal: deps.config.requirePrincipal }, centerEntitlementSourceWired(deps.config));
-            const wantsSelfOrchestration = body.selfOrchestration === true
-                || parseTaskSettings(body.settings).settings?.ultracode === true;
-            if (denial !== null && wantsSelfOrchestration) {
-                sendError(res, 501, "capability.self_orchestration_required", "self-orchestration is enabled on this worker (SELF_ORCHESTRATION_ENABLED) but it is multi-tenant (REQUIRE_PRINCIPAL) and wires NO per-principal entitlement source, so the engine's allowWorkflows gate — which is tighten-only, meaning an absent resolver leaves it UNGATED — is fail-closed for every principal: no request can ever get the workflow engine here (GET /v1/capabilities reports workflows:false with workflowsGate.denial \"entitlement_resolver_absent\"). Wire a config center (SEMA_REGISTRY_URL + token, not dry-run) to gate it per principal, or set SELF_ORCHESTRATION_ENABLED=false — the honest posture for a worker that cannot grant it. To submit this task without the workflow engine, drop selfOrchestration / settings.ultracode; ultracode's other half (the max thinking tier) is available as reasoningEffort: \"max\"");
-                return null;
-            }
-        }
-        if (body.resilience !== undefined) {
-            const r = body.resilience;
-            if (typeof r !== "object" || r === null || Array.isArray(r)) {
-                sendError(res, 400, "request.field_invalid", "resilience must be an object { allowDegrade?, allowFailover?, bypassBreaker? } (booleans)");
-                return null;
-            }
-            for (const k of ["allowDegrade", "allowFailover", "bypassBreaker"]) {
-                const v = r[k];
-                if (v !== undefined && typeof v !== "boolean") {
-                    sendError(res, 400, "request.field_invalid", `resilience.${k} must be a boolean`);
-                    return null;
-                }
-            }
-        }
-        if (body.finalVerification !== undefined && typeof body.finalVerification !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "finalVerification must be a boolean");
-            return null;
-        }
-        if (body.limits !== undefined) {
-            const l = body.limits;
-            if (typeof l !== "object" || l === null || Array.isArray(l)) {
-                sendError(res, 400, "request.field_invalid", "limits must be an object { maxWalltimeMs?, maxOutputTokens?, maxTurns? } (positive integers)");
-                return null;
-            }
-            if (l.timeoutSec !== undefined) {
-                sendError(res, 400, "request.field_invalid", "limits.timeoutSec was retired in core 5.8.0 — use limits.maxWalltimeMs (milliseconds; opt-in wall clock)");
-                return null;
-            }
-            if (l.deadlineNudge !== undefined) {
-                sendError(res, 400, "request.field_invalid", "limits.deadlineNudge was retired in core 5.8.0 — use limits.approachNotice (default on at 80%/95%; false turns it off, {at: [r1, r2]} tunes thresholds)");
-                return null;
-            }
-            for (const k of ["callCapByDeadline", "gracefulFinalize"]) {
-                if (l[k] !== undefined) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} was retired in core 5.8.0 (the deadline-pacing mechanism family is gone; there is no replacement key — remove it)`);
-                    return null;
-                }
-            }
-            for (const k of ["maxCostUsd", "maxTokens"]) {
-                if (l[k] !== undefined) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} is not read from limits here — send it at the request body top level (${k}); it is capped by the operator ceiling ${k === "maxCostUsd" ? "MAX_TASK_COST_USD" : "MAX_TASK_TOKENS"}`);
-                    return null;
-                }
-            }
-            if (l.degrade !== undefined) {
-                sendError(res, 400, "request.field_invalid", "limits.degrade is operator-controlled (env MODEL_DEGRADE_TO / MODEL_DEGRADE_AT_COST_FRACTION), not caller-settable — remove it");
-                return null;
-            }
-            if (l.budgetStreamCancel !== undefined) {
-                sendError(res, 400, "request.field_invalid", "limits.budgetStreamCancel is not caller-settable here — the engine default applies (armed whenever a cost budget is present); remove it");
-                return null;
-            }
-            for (const k of ["maxWalltimeMs", "maxOutputTokens", "maxTurns"]) {
-                const v = l[k];
-                if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} must be a positive integer${k === "maxWalltimeMs" ? " (milliseconds)" : ""}`);
-                    return null;
-                }
-            }
-            {
-                const v = l.approachNotice;
-                if (v !== undefined && normalizeApproachNotice(v) === undefined) {
-                    sendError(res, 400, "request.field_invalid", "limits.approachNotice accepts false (turn off) or {at?: [r1, r2]} with fractions in (0, 1], r1 <= r2 (default on at 80%/95%)");
-                    return null;
-                }
-            }
-        }
-        if (body.agents !== undefined) {
-            const agentsErr = validateTaskAgents(body.agents);
-            if (agentsErr) {
-                sendError(res, 400, "request.field_invalid", agentsErr);
-                return null;
-            }
-            const agentsBare = deps.config.models ?? {};
-            const agentsCatalog = expandTiers(agentsBare, deps.config.tiers ?? {}) ?? agentsBare;
-            const um = unknownTaskAgentModelRef(body.agents, agentsCatalog);
-            if (um !== undefined) {
-                sendError(res, 400, "request.unknown_reference", `unknown agents[${um.index}].model "${um.ref.slice(0, 120)}" — not in the configured catalog (a catalog name or tier word)`, { available: mentionableNames(deps.config, agentsCatalog) });
-                return null;
-            }
-        }
-        if (body.interactiveTools !== undefined && typeof body.interactiveTools !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
-            return null;
-        }
-        if (body.oneShot !== undefined && typeof body.oneShot !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "oneShot must be a boolean");
-            return null;
-        }
-        if (body.retainBackgroundProcesses !== undefined && typeof body.retainBackgroundProcesses !== "boolean") {
-            sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
-            return null;
-        }
-        for (const key of ["excludeTools", "deferTools"]) {
-            const v = body[key];
-            if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
-                sendError(res, 400, "request.field_invalid", `${key} must be an array of non-empty tool-name strings`);
-                return null;
-            }
-        }
-        {
-            const v = body.promptProfile;
-            if (v !== undefined && v !== "simple" && v !== "classic") {
-                sendError(res, 400, "request.field_invalid", 'promptProfile must be "simple" or "classic"');
-                return null;
-            }
-        }
-        {
-            const v = body.toolMaterializeStrategy;
-            if (v !== undefined && v !== "static" && v !== "swap") {
-                sendError(res, 400, "request.field_invalid", 'toolMaterializeStrategy must be "static" or "swap"');
-                return null;
-            }
-        }
-        {
-            const v = body.permissionMode;
-            if (v !== undefined && v !== "default" && v !== "acceptEdits" && v !== "plan" && v !== "bypassPermissions" && v !== "auto") {
-                sendError(res, 400, "request.field_invalid", 'permissionMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
-                return null;
-            }
-        }
-        {
-            const s = body.settings;
-            if (s !== null && typeof s === "object" && !Array.isArray(s)) {
-                const p = s.permissions;
-                if (p !== null && typeof p === "object" && !Array.isArray(p)) {
-                    const m = p.defaultMode;
-                    if (m !== undefined && m !== "default" && m !== "acceptEdits" && m !== "plan" && m !== "bypassPermissions" && m !== "auto") {
-                        sendError(res, 400, "request.field_invalid", 'settings.permissions.defaultMode must be one of "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto"');
-                        return null;
-                    }
-                    const d = p.disableAutoMode;
-                    if (d !== undefined && d !== "disable" && d !== true && d !== false) {
-                        sendError(res, 400, "request.field_invalid", 'settings.permissions.disableAutoMode must be the literal "disable" or a boolean when present (omit it to leave auto mode available)');
-                        return null;
-                    }
-                }
-            }
-        }
-        if (body.model !== undefined) {
-            if (typeof body.model !== "string" || body.model.length === 0) {
-                sendError(res, 400, "request.field_invalid", "model must be a non-empty string (a configured catalog name, tier word, or model id)");
-                return null;
-            }
-            const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.model, catalog) === undefined) {
-                sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
-                return null;
-            }
-        }
-        if (body.compactionModel !== undefined) {
-            if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0) {
-                sendError(res, 400, "request.field_invalid", "compactionModel must be a non-empty string (a configured catalog name, tier word, or model id)");
-                return null;
-            }
-            const bare = deps.config.models ?? {};
-            const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
-            if (matchCatalogModel(body.compactionModel, catalog) === undefined) {
-                sendError(res, 400, "request.unknown_reference", `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
-                return null;
-            }
-        }
-        if (body.attachments !== undefined) {
-            const a = body.attachments;
-            if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, planModeReminder?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
-                return null;
-            }
-            const rec = a;
-            for (const k of ["todoReminder", "planModeReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
-                if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
-                    sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
-                    return null;
-                }
-            }
-            if (rec.todoReminderMode !== undefined && rec.todoReminderMode !== "baseline" && rec.todoReminderMode !== "off") {
-                sendError(res, 400, "request.field_invalid", 'attachments.todoReminderMode must be "baseline" | "off"');
-                return null;
-            }
-            const cf = rec.changedFiles;
-            if (cf !== undefined && typeof cf !== "boolean") {
-                if (typeof cf !== "object" || cf === null || Array.isArray(cf)) {
-                    sendError(res, 400, "request.field_invalid", "attachments.changedFiles must be a boolean or { maxFiles?: number }");
-                    return null;
-                }
-                const mf = cf.maxFiles;
-                if (mf !== undefined && (typeof mf !== "number" || !Number.isFinite(mf) || mf < 1)) {
-                    sendError(res, 400, "request.field_invalid", "attachments.changedFiles.maxFiles must be a number ≥ 1");
-                    return null;
-                }
-            }
-        }
-        const verify = verifyRoundsFromBody(body);
-        const cascade = body.cascade === true;
-        if (cascade && verify) {
-            sendError(res, 400, "request.field_conflict", "verify and cascade are mutually exclusive (verify = adversarial gate; cascade = cheap→strong ladder)");
-            return null;
-        }
-        if (body.suggestNextPrompts && (verify || cascade)) {
-            sendError(res, 400, "request.field_conflict", "suggestNextPrompts is not supported with verify or cascade (those return a result, not a streamed run)");
-            return null;
-        }
-        if (cascade && deps.config.cascadeLadder.length === 0) {
-            sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
-            return null;
-        }
-        try {
-            const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
-            const engineNotices = [];
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body, ...(engineNotices.length > 0 ? { engineNotices } : {}) };
-        }
-        catch (err) {
-            if (err instanceof HttpError) {
-                if (onTypedFailure) {
-                    onTypedFailure(err);
-                    return null;
-                }
-                sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
-                return null;
-            }
-            throw err;
-        }
-    }
-    const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
-    async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
-        const cs = deps.checkpointStore;
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
-        if (binding?.checkpointToken && binding.checkpointToken !== token) {
-            let seenUnreadable = false;
-            const seen = await cs.get(binding.checkpointToken).catch((e) => {
-                seenUnreadable = true;
-                recordFailOpen("server.approvals.stale-echoed-token-unreadable", `session=${sessionId} err=${e instanceof Error ? e.message : String(e)}`);
-                return null;
-            });
-            const attributable = seen !== null && seen.sessionId === sessionId;
-            if (!attributable && seen !== null) {
-                deps.logger?.warn?.("approval_stale_token_foreign", { sessionId, tokenSession: seen.sessionId ?? null });
-            }
-            if (!token && !attributable && !seenUnreadable) {
-                deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true });
-                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-            }
-            let currentPending;
-            if (token && decider !== undefined) {
-                const cur = await cs.get(token).catch((e) => {
-                    recordFailOpen("server.approvals.stale-current-pending-unreadable", `session=${sessionId} err=${e instanceof Error ? e.message : String(e)}`);
-                    return null;
-                });
-                const curPa = cur?.pendingAction;
-                const curOwner = cur ? decodeCheckpointScope(cur.scope) : undefined;
-                const scopeOk = cur !== null && (decider.explicitOperator || curOwner === undefined || curOwner === decider.principal);
-                if (cur && cur.sessionId === sessionId && !scopeOk) {
-                    deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true, foreignCurrentSuppressed: true });
-                    return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-                }
-                if (cur && cur.status === "pending" && cur.sessionId === sessionId && scopeOk && curPa?.kind === "tool_approval" && curPa.toolCallId) {
-                    currentPending = {
-                        toolName: curPa.toolName,
-                        boundCallId: curPa.toolCallId,
-                        ...(curPa.boundInputHash ? { boundInputHash: curPa.boundInputHash } : {}),
-                    };
-                }
-            }
-            return {
-                status: 409,
-                body: {
-                    error: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
-                    errorCode: "approval_stale",
-                    ...(attributable ? { terminal: "resolved" } : {}),
-                    ...(currentPending ? { currentPending } : {}),
-                },
-            };
-        }
-        if (!token) {
-            deps.logger?.info?.("approval_decide_no_pending", { sessionId });
-            return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-        }
-        const cpPromise = cs.get(token);
-        const ctxPromise = cs.getCtx(sessionId);
-        void ctxPromise.catch(() => { });
-        const noApproval = { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-        let cp;
-        try {
-            cp = await cpPromise;
-        }
-        catch (e) {
-            void ctxPromise.catch(() => { });
-            if (!(await mayDiscloseRowError(cs, token, decider))) {
-                deps.logger?.warn?.("approval_decide_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
-                return noApproval;
-            }
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
-        }
-        if (!cp) {
-            if (!(await mayDiscloseRowError(cs, token, decider)))
-                return noApproval;
-            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        }
-        if (decider !== undefined && !decider.explicitOperator) {
-            const cpOwner = decodeCheckpointScope(cp.scope);
-            if (cpOwner !== undefined && cpOwner !== decider.principal) {
-                deps.logger?.warn?.("approval_decide_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
-                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-            }
-        }
-        const decideGateKind = cp.gate?.kind;
-        if (!isApprovalGateKind(decideGateKind)) {
-            const activeForPath = decideGateKind
-                ? await deps.runStore?.getActiveTaskId(sessionId).catch(() => undefined)
-                : undefined;
-            const gnPath = decideGateKind && activeForPath
-                ? resumeEntryForGate(decideGateKind, { sessionId, taskId: activeForPath })
-                : null;
-            return {
-                status: 409,
-                body: {
-                    error: `task is suspended on a '${decideGateKind ?? "unknown"}' gate, not a tool approval — a plan_review gate is resolved via POST /v1/assistant/tasks/:id/plan_review, a resource_limit suspension via POST /v1/assistant/tasks/:id/resume`,
-                    errorCode: "gate_not_tool_approval",
-                    ...(decideGateKind ? { pendingGate: { kind: decideGateKind, ...(gnPath ? { decidePath: gnPath } : {}) } } : {}),
-                },
-            };
-        }
-        if (req !== undefined && !binding?.checkpointToken && !binding?.boundCallId) {
-            return {
-                status: 400,
-                body: {
-                    error: "decide requires the decision-action binding — echo checkpointToken and/or boundCallId from the pending approval (GET /v1/approvals)",
-                    errorCode: "decide_requires_binding",
-                    bindingEnforced: true,
-                },
-            };
-        }
-        const s57RowCallId = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.toolCallId : undefined;
-        if (binding?.boundCallId !== undefined && s57RowCallId && binding.boundCallId !== s57RowCallId) {
-            let s57CurrentPending;
-            if (decider !== undefined && cp.status === "pending" && cp.sessionId === sessionId && cp.pendingAction.kind === "tool_approval") {
-                s57CurrentPending = {
-                    toolName: cp.pendingAction.toolName,
-                    boundCallId: s57RowCallId,
-                    ...(cp.pendingAction.boundInputHash ? { boundInputHash: cp.pendingAction.boundInputHash } : {}),
-                };
-            }
-            return {
-                status: 409,
-                body: {
-                    error: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
-                    errorCode: "approval_stale",
-                    ...(s57CurrentPending ? { currentPending: s57CurrentPending } : {}),
-                },
-            };
-        }
-        const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
-        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME
-            ? paForGrant.toolName
-            : null;
-        const boundGrant = onResumeCommitted
-            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
-            : undefined;
-        const lateSettleSink = deps.approvalLateSettle;
-        const lateSettleAnchor = lateSettleSink !== undefined && req !== undefined && token
-            ? {
-                sessionId: cp.sessionId,
-                ...(paForGrant?.toolCallId !== undefined ? { toolCallId: paForGrant.toolCallId } : {}),
-                checkpointTokenHash: buildCheckpointAnchorHash(token),
-            }
-            : undefined;
-        const noteLateSettleIfAccepted = (out) => {
-            if (lateSettleSink === undefined || lateSettleAnchor === undefined || out.status !== 200)
-                return;
-            if (out.body?.errorCode === "cancelled")
-                return;
-            try {
-                lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
-            }
-            catch (e) {
-                recordFailOpen("server.approval-ask-audit.append-failed", `kind=late_settle err=${e instanceof Error ? e.message : String(e)}`);
-            }
-        };
-        const parkedForkQuotaDenial = req !== undefined ? ownerCostQuotaDenied(decodeCheckpointScope(cp.scope)) : undefined;
-        if (parkedForkQuotaDenial)
-            return parkedForkQuotaDenial;
-        const parkedForkLeaseDenial = req !== undefined ? await ownerFleetLeaseDenied(decodeCheckpointScope(cp.scope)) : undefined;
-        if (parkedForkLeaseDenial)
-            return parkedForkLeaseDenial;
-        const ownerLeaseAdmittedHere = req !== undefined;
-        if (req !== undefined) {
-            const parkedAgentStore = deps.backgroundAgentStore;
-            const parkedTool = deps.parkedReviveTool;
-            const parkWarn = (event, fields) => deps.logger?.warn?.(event, fields);
-            const origin = await findParkOrigin({
-                ...(parkedAgentStore !== undefined && parkedTool !== undefined ? { agentStore: parkedAgentStore } : {}),
-                ...(deps.workflowAgentSessionIndex !== undefined && deps.workflowRunStore !== undefined
-                    ? { workflowIndex: deps.workflowAgentSessionIndex, workflowRunStore: deps.workflowRunStore }
-                    : {}),
-                ...(deps.logger ? { warn: parkWarn } : {}),
-            }, { token, scope: cp.scope, sessionId: cp.sessionId });
-            const parkedReq = {
-                token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
-                decision, hostDecision, ...(reason !== undefined ? { reason } : {}),
-                ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
-                ...(answer !== undefined ? { answer } : {}),
-                ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
-            };
-            if (origin?.kind === "background" && parkedAgentStore !== undefined && parkedTool !== undefined) {
-                const parked = await withPrincipal(decodeCheckpointScope(cp.scope), () => decideParkedAgent({
-                    agentStore: parkedAgentStore,
-                    checkpointStore: cs,
-                    registry: defaultTaskRegistry,
-                    reviveTool: parkedTool,
-                    ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
-                    ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
-                    ...(deps.logger ? { warn: parkWarn } : {}),
-                }, parkedReq, { handle: origin.handle, row: origin.row }));
-                void ctxPromise.catch(() => { });
-                noteLateSettleIfAccepted(parked);
-                return parked;
-            }
-            if (origin?.kind === "workflow_parks_unreadable") {
-                void ctxPromise.catch(() => { });
-                return denyWorkflowParksUnreadable(origin);
-            }
-            if (origin?.kind === "workflow") {
-                void ctxPromise.catch(() => { });
-                const plan = planWorkflowParkedDecide(origin, parkedReq);
-                if (!plan.ok)
-                    return plan.deny;
-                const parkedResume = { workflowParkedResume: [{ runId: plan.runId, token, outcome: plan.outcome }] };
-                const hostToken = await cs
-                    .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
-                    .catch(() => undefined);
-                const admittedPayer = decodeCheckpointScope(cp.scope);
-                return hostToken
-                    ? await resumeWake(plan.hostSessionId, plan.message, decider?.principal, req, acceptEarly, parkedResume.workflowParkedResume, admittedPayer)
-                    : await startFreshHostTurn(plan.hostSessionId, plan.message, admittedPayer, req, parkedResume, plan.runId);
-            }
-        }
-        let ctx;
-        try {
-            ctx = await ctxPromise;
-        }
-        catch (e) {
-            return { status: 409, body: { error: `resume context load failed: ${e instanceof Error ? e.message : String(e)}`, errorCode: "conflict.resume_context_unavailable" } };
-        }
-        if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return {
-                    status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
-                };
-            }
-            throw e;
-        }
-        const pendingTool = cp.pendingAction.toolName;
-        if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
-            return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
-        }
-        if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
-            return { status: 400, body: { error: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, errorCode: "request.field_conflict" } };
-        }
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const pa = cp.pendingAction;
-        const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
-        const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-        const outcome = {
-            gate: "policy_ask",
-            boundCallId: binding?.boundCallId ?? persistedCallId,
-            boundInputHash: binding?.boundInputHash ?? persistedHash,
-            decision: decision === "approve" ? "allow" : "deny",
-            ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
-            ...(reason ? { reason } : {}),
-            ...(answer !== undefined ? { answer } : {}),
-            hostDecision,
-        };
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
-        noteLateSettleIfAccepted(driven);
-        return driven;
-    }
-    const ONE_SHOT_HISTORY_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles"];
-    const ONE_SHOT_HISTORY_STRIP = Object.fromEntries(ONE_SHOT_HISTORY_KEYS.map((k) => [k, undefined]));
-    const resolveResumeSpec = async (body, req, auth) => {
-        const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
-        return { spec, engineNotices };
-    };
-    async function driveResumeIntoRunLog(args) {
-        if (args.acceptEarly !== true)
-            return await driveResumeLeg(args);
-        let settleAccepted;
-        let wasAccepted = false;
-        const accepted = new Promise((resolve) => { settleAccepted = resolve; });
-        const leg = driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); });
-        void leg.then((out) => {
-            if (wasAccepted && out.status >= 400) {
-                deps.logger?.warn?.("resume_leg_failed_after_accept", { sessionId: args.sessionId, status: out.status, body: out.body });
-                deps.metrics?.inc("resume_post_accept_failed_total");
-            }
-        }, (err) => {
-            if (!wasAccepted)
-                return;
-            deps.logger?.error?.("resume_leg_threw_after_accept", { sessionId: args.sessionId, err: redactHead(err instanceof Error ? err.message : String(err), 2000) });
-            deps.metrics?.inc("resume_post_accept_failed_total");
-        });
-        return await Promise.race([accepted, leg]);
-    }
-    async function driveResumeLeg(args, onAccepted) {
-        const resumeLegStartedAt = Date.now();
-        const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds } = args;
-        const legKey = createHash("sha256").update(String(token)).digest("hex");
-        const streamApprovalOn = resolveStreamApprovalGate({
-            toolApprovalEnabled: Boolean(deps.toolApproval),
-            streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
-            backend: deps.backend,
-            parkFacility: deps.checkpointStore !== undefined,
-        }).active;
-        const approvalLeg = resolveApprovalLeg({
-            streamApprovalOn,
-            windowMs: deps.config.streamApproval?.windowMs,
-            windowMarginMs: deps.config.streamAskWindowMarginMs,
-            ...(typeof taskConfig.limits?.maxWalltimeMs === "number" ? { legWalltimeMs: taskConfig.limits.maxWalltimeMs } : {}),
-            nowMonotonicMs: performance.now(),
-        });
-        const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-        const ownerQuotaDenial = args.callerInitiated === true ? ownerCostQuotaDenied(principal) : undefined;
-        if (ownerQuotaDenial)
-            return ownerQuotaDenial;
-        const ownerLeaseDenial = args.callerInitiated === true && args.ownerLeaseAdmitted !== true ? await ownerFleetLeaseDenied(principal) : undefined;
-        if (ownerLeaseDenial)
-            return ownerLeaseDenial;
-        let taskId = await deps.runStore?.getActiveTaskId(sessionId);
-        let freshRunClaimed = false;
-        if (args.mintFreshRun && taskId && deps.runStore) {
-            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, taskId) };
-        }
-        if (!taskId && args.mintFreshRun && deps.runStore) {
-            const freshId = uuidv7();
-            const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
-                source: args.mintFreshRun.source,
-                objectivePreview: resumeObjective ? redactSecrets(resumeObjective).slice(0, 120) : null,
-            });
-            if (!created.ok) {
-                return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
-            }
-            taskId = freshId;
-            freshRunClaimed = true;
-        }
-        const fleetPub = taskId && deps.fleetBus
-            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, ...fleetRunLabels(resumeObjective) })
-            : undefined;
-        const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
-        if (deps.toolApproval && taskId) {
-            const toolApproval = deps.toolApproval;
-            resumeTaskConfig.onAsk = approvalLeg.windowZero
-                ? (askReq) => Promise.resolve(toolApproval.unattendedAskOutcome({ taskId, owner: principal ?? null, toolName: askReq.toolName }))
-                : toolApproval.boundAsk({
-                    owner: principal ?? null,
-                    taskId,
-                    sessionId,
-                    ...(approvalLeg.active ? { legKey, ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
-                });
-        }
-        if (taskId && resumeTaskConfig.resourceSuspend)
-            recordResumeResourceWindow(taskId, resumeTaskConfig.resourceSuspend);
-        let fleetSettled = false;
-        const settleFleet = (status, residuals) => {
-            if (fleetSettled)
-                return;
-            fleetSettled = true;
-            fleetPub?.onTerminal(status, residuals);
-        };
-        let result;
-        let reopenConfirmedPark = false;
-        const confirmCheckpointReopened = async () => {
-            const store = deps.checkpointStore;
-            if (!store)
-                return true;
-            try {
-                return (await store.get(token))?.status === "pending";
-            }
-            catch {
-                return true;
-            }
-        };
-        let resumeHeartbeat;
-        let resumeManifestLease = 0;
-        let resumeStreamRef;
-        let resumeLegLive = false;
-        const subagentHandleEvictions = [];
-        let claimedRow = false;
-        const cancelCtrl = new AbortController();
-        const preemptCtrl = new AbortController();
-        if (taskId && deps.runStore) {
-            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
-            if (!claimedRow)
-                return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
-            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
-            fleetPub?.onStart();
-            const rs = deps.runStore;
-            const owner = principal ?? null;
-            inflightRuns.set(taskId, cancelCtrl);
-            preemptableRuns.set(taskId, preemptCtrl);
-            resumeHeartbeat = setInterval(() => {
-                void rs.heartbeat(taskId, owner).catch(() => undefined);
-                if (!cancelCtrl.signal.aborted) {
-                    void rs.isCancelRequested(taskId, owner).then((c) => { if (c)
-                        cancelCtrl.abort(); }).catch(() => undefined);
-                }
-                if (!preemptCtrl.signal.aborted) {
-                    void rs.isPreemptRequested(taskId, owner).then((p) => { if (p)
-                        preemptCtrl.abort(); }).catch(() => undefined);
-                }
-            }, HEARTBEAT_MS);
-            resumeHeartbeat.unref?.();
-            deps.modelUsage?.register(taskId);
-            resumeManifestLease = deps.promptManifests?.register(taskId) ?? 0;
-        }
-        if (args.onResumeCommitted)
-            await args.onResumeCommitted();
-        let unregisterEngineNotice;
-        try {
-            result = await withPrincipal(principal, async () => {
-                const resumeNotifiedKeys = new NotifiedKeys();
-                if (deps.runStore && taskId) {
-                    const rs0 = deps.runStore;
-                    let drainSeq = (await rs0.maxSeq(taskId)) + 1;
-                    await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, sessionId, principal ?? null, (frame) => {
-                        const { type, ...rest } = frame;
-                        const f = frame;
-                        const write = rs0.appendEvent(taskId, drainSeq++, type, rest);
-                        if (f.type === "task_notification" && f.task_id)
-                            resumeNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
-                        return write;
-                    }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
-                }
-                if (verifyRounds !== undefined) {
-                    const rsV = deps.runStore;
-                    const vSeqBase = rsV && taskId ? await rsV.maxSeq(taskId) : 0;
-                    const verifySink = createLedgerSink({
-                        appendEvent: (seq, type, data) => (rsV && taskId ? rsV.appendEvent(taskId, vSeqBase + seq, type, data) : Promise.resolve()),
-                        persistThinking: deps.config.traceThinking,
-                        notifiedKeys: resumeNotifiedKeys,
-                        ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
-                    });
-                    const vAppend = (type, data) => verifySink.append(type, data);
-                    const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
-                    const verifyInternals = {
-                        ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
-                        onForwardEvent: (e) => {
-                            fleetPub?.onForwardEvent(e);
-                            {
-                                const bg = e.bgAgentId;
-                                if (bg !== undefined)
-                                    defaultSubagentTailBus.onForwardFrame(bg, verifyTailContentMode, e);
-                            }
-                            if (rsV && taskId)
-                                verifySink.onForwardEvent(e);
-                        },
-                        onStatusEvent: (e) => {
-                            deps.metrics?.inc("brain_retry_total", { phase: String(e.phase) });
-                            if (rsV && taskId) {
-                                void verifySink.appendStatus(e).catch((err) => deps.logger?.warn?.("status_event_append_failed", { route: "resume-verify", taskId, err: err instanceof Error ? err.message : String(err) }));
-                            }
-                        },
-                        onTaskNotification: (n, opts) => {
-                            if (n.task_type === "workflow")
-                                return;
-                            defaultSubagentTailBus.forgetHandle(n.task_id);
-                            if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
-                                defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
-                            }
-                            const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
-                            const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
-                            deps.logger?.info?.("task_notification_observed", { route: "resume-verify", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
-                            if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
-                            }
-                            else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
-                                if (resumeNotifiedKeys.get(key) === undefined) {
-                                    resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
-                                }
-                            }
-                        },
-                        ...(deps.subagentSteerRegistry && taskId
-                            ? {
-                                onSubagentSpawn: (handle) => {
-                                    subagentHandleEvictions.push(deps.subagentSteerRegistry.register(taskId, handle));
-                                },
-                            }
-                            : {}),
-                    };
-                    resumeLegLive = true;
-                    const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
-                    let safe = stripResumeToken(vr);
-                    const vrNested = nestedPauseOf(vr.terminal);
-                    const reParkStatus = nestedParkStatusOf(vr);
-                    const reSuspended = vrNested !== undefined;
-                    const vrReopened = isCheckpointReopenedFailure(vr) && (await confirmCheckpointReopened());
-                    if (vrReopened)
-                        reopenConfirmedPark = true;
-                    if (taskId && deps.runStore) {
-                        const rs2 = deps.runStore;
-                        try {
-                            const ap = vAppend;
-                            await appendPromptManifest(ap, deps.promptManifests, taskId);
-                            if (reSuspended || vrReopened) {
-                                await appendModelUsageDelta(ap, deps.modelUsage, taskId);
-                                const vrParkCallId = vrNested !== undefined ? await parkToolCallId({ terminal: vrNested }, deps.checkpointStore) : undefined;
-                                await ap(reParkStatus ?? "suspended", { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
-                            }
-                            else {
-                                safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
-                                await ap("done", { result: safe });
-                            }
-                        }
-                        catch (e) {
-                            if (!vrReopened)
-                                throw e;
-                        }
-                    }
-                    if (vrNested !== undefined)
-                        return { ...safe, terminal: vrNested };
-                    if (vr.verification?.verdict)
-                        deps.metrics?.inc("verifications_total", { verdict: vr.verification.verdict });
-                    return safe;
-                }
-                const rs = deps.runStore;
-                const startSeq = rs && taskId ? await rs.maxSeq(taskId) : 0;
-                let text = "";
-                let reasoning = "";
-                let reasoningEventId;
-                const persistThinking = deps.config.traceThinking;
-                const serialAppend = createSerialLedgerAppend((s, type, data) => rs.appendEvent(taskId, s, type, data), startSeq);
-                const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
-                unregisterEngineNotice = registerEngineNoticeLeg({
-                    sessionId,
-                    ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
-                    durable: (row) => void append("engine_notice", row).catch((err) => {
-                        recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
-                        deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
-                    }),
-                });
-                const anchorOwner = principal ?? null;
-                const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
-                    ? async (eventId) => { const leaf = await getLeafId(sessionId); if (leaf)
-                        await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
-                    : undefined;
-                const captureUserMessageAnchor = deps.resumeAnchorStore && taskId
-                    ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-                    : undefined;
-                const anchor = new TurnAnchorCapture(captureTurnAnchor, () => deps.metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
-                const flush = async () => {
-                    if (reasoning) {
-                        await append("reasoning", modelTextEventData({ text: reasoning, eventId: reasoningEventId }));
-                        reasoning = "";
-                        reasoningEventId = undefined;
-                    }
-                    if (text) {
-                        await append("text", modelTextEventData({ text, eventId: anchor.firstTextEventId }));
-                        text = "";
-                    }
-                };
-                const driveResume = async () => {
-                    resumeLegLive = true;
-                    const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
-                    const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
-                        ...(args.workflowParkedResume !== undefined ? { workflowParkedResume: args.workflowParkedResume } : {}),
-                        onForwardEvent: (e) => {
-                            fleetPub?.onForwardEvent(e);
-                            {
-                                const bg = e.bgAgentId;
-                                if (bg !== undefined)
-                                    defaultSubagentTailBus.onForwardFrame(bg, tailContentMode, e);
-                            }
-                            if (!rs || !taskId)
-                                return;
-                            const t = e.type;
-                            const warnAppend = (kind) => (err) => deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
-                            if (t === "task_progress") {
-                                void append("task_progress", taskProgressEventData(e)).catch(warnAppend(t));
-                            }
-                            else if (t === "tool_start") {
-                                void append("tool_start", toolStartEventData(e)).catch(warnAppend(t));
-                            }
-                            else if (t === "tool_end") {
-                                void append("tool_end", toolEndEventData(e)).catch(warnAppend(t));
-                            }
-                        },
-                        onTaskNotification: (n, opts) => {
-                            if (n.task_type === "workflow")
-                                return;
-                            defaultSubagentTailBus.forgetHandle(n.task_id);
-                            if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
-                                defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
-                            }
-                            const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
-                            const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
-                            deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
-                            if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
-                            }
-                            else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
-                                if (resumeNotifiedKeys.get(key) === undefined) {
-                                    resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
-                                }
-                            }
-                        },
-                        ...(deps.subagentSteerRegistry && taskId
-                            ? {
-                                onSubagentSpawn: (handle) => {
-                                    subagentHandleEvictions.push(deps.subagentSteerRegistry.register(taskId, handle));
-                                },
-                            }
-                            : {}),
-                    });
-                    resumeStreamRef = stream;
-                    if (taskId)
-                        steerableRuns.set(taskId, stream);
-                    if (!taskId || !rs)
-                        return await stream.result();
-                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
-                    for await (const ev of stream) {
-                        recordTurnActivity(taskId);
-                        fleetPub?.onEvent(ev);
-                        await appendPromptManifest(append, deps.promptManifests, taskId);
-                        switch (ev.type) {
-                            case "text_delta":
-                                text += ev.delta;
-                                anchor.onText(ev.eventId);
-                                break;
-                            case "reasoning_delta": {
-                                const rb = reasoningDeltaBytes(ev);
-                                if (persistThinking && rb !== undefined) {
-                                    reasoning += rb;
-                                    reasoningEventId ??= reasoningSegmentEventId(ev.eventId);
-                                }
-                                break;
-                            }
-                            case "tool_start":
-                                anchor.onTool();
-                                await flush();
-                                await append("tool_start", toolStartEventData(ev));
-                                break;
-                            case "tool_end":
-                                await flush();
-                                await append("tool_end", toolEndEventData(ev));
-                                break;
-                            case "status": {
-                                const st = ev;
-                                deps.metrics?.inc("brain_retry_total", { phase: String(st.phase) });
-                                await flush();
-                                await append("status", brainStatusEventData(st));
-                                break;
-                            }
-                            case "context_usage":
-                                await flush();
-                                await append("context_usage", contextUsageEventData(ev));
-                                break;
-                            case "compacted":
-                                await flush();
-                                await append("compacted", compactedEventData(ev));
-                                break;
-                            case "diagnostics":
-                                await flush();
-                                await append("diagnostics", diagnosticsEventData(ev));
-                                break;
-                            case "steering_injected":
-                                await flush();
-                                await append("steering_injected", steeringInjectedEventData(ev));
-                                break;
-                            case "compaction_outcome":
-                                await flush();
-                                await append("compaction_outcome", compactionOutcomeEventData(ev));
-                                break;
-                            case "workspace_changed":
-                                await flush();
-                                await append("workspace_changed", workspaceChangedEventData(ev));
-                                break;
-                            case "wiring_manifest":
-                                await flush();
-                                await append("wiring_manifest", wiringManifestEventData(ev));
-                                break;
-                            case "tool_roster_delta": {
-                                await flush();
-                                const rosterDelta = toolRosterDeltaEventData(ev);
-                                if (rosterDelta !== undefined)
-                                    await append("tool_roster_delta", rosterDelta);
-                                break;
-                            }
-                            case "tool_disclosure": {
-                                await flush();
-                                const disclosure = toolDisclosureEventData(ev);
-                                if (disclosure !== undefined)
-                                    await append("tool_disclosure", disclosure);
-                                break;
-                            }
-                            case "human_input":
-                                await flush();
-                                await append("human_input", humanInputEventData(ev));
-                                break;
-                            case "message_committed":
-                                await anchor.onMessageCommitted(ev.role, ev.entryId);
-                                break;
-                            case "task_progress":
-                                await append("task_progress", taskProgressEventData(ev));
-                                break;
-                            case "task_notification": {
-                                await flush();
-                                const tnr = ev.notification;
-                                const tnrKey = tnr?.task_id ? taskNotificationStreamKey({ task_type: tnr.task_type, task_id: tnr.task_id, status: String(tnr.status), seq: tnr.seq }) : undefined;
-                                const tnrPrior = tnrKey !== undefined ? resumeNotifiedKeys.get(tnrKey) : undefined;
-                                if (tnrPrior === undefined || !(await tnrPrior)) {
-                                    const write = append("task_notification", taskNotificationEventData(ev));
-                                    if (tnrKey !== undefined)
-                                        resumeNotifiedKeys.set(tnrKey, write.then(() => true, () => false));
-                                    await write;
-                                }
-                                break;
-                            }
-                            case "turn_end": {
-                                await flush();
-                                await append("turn_end", turnEndEventData(ev));
-                                await appendModelUsageDelta(append, deps.modelUsage, taskId);
-                                await anchor.onTurnEnd();
-                                break;
-                            }
-                        }
-                    }
-                    await flush();
-                    const r = await stream.result();
-                    const rPark = r.terminal.kind === "paused" ? terminalProjection(r.terminal).status : undefined;
-                    if (rPark === "suspended") {
-                        const parkCallId = await parkToolCallId(r, deps.checkpointStore);
-                        await append("suspended", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
-                        await appendModelUsageDelta(append, deps.modelUsage, taskId);
-                        return r;
-                    }
-                    if (rPark === "needs_review") {
-                        await append("needs_review", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null });
-                        await appendModelUsageDelta(append, deps.modelUsage, taskId);
-                        return r;
-                    }
-                    if (isCheckpointReopenedFailure(r) && (await confirmCheckpointReopened())) {
-                        reopenConfirmedPark = true;
-                        try {
-                            await append("suspended", { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
-                            await appendModelUsageDelta(append, deps.modelUsage, taskId);
-                        }
-                        catch {
-                        }
-                        return r;
-                    }
-                    const safe = await attachModelUsage(stripResumeToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
-                    await append("done", { result: safe });
-                    if (taskConfig.suggestNextPrompts && safe.terminal.kind === "completed") {
-                        const suggestions = await stream.suggestions().catch(() => []);
-                        if (suggestions.length)
-                            await append("suggestions", { suggestions: suggestions.map((s) => redactSecrets(s)) });
-                    }
-                    return safe;
-                };
-                const approvalEmit = (frame) => {
-                    const { type, ...rest } = frame;
-                    return append(type, rest);
-                };
-                const withApproval = () => deps.toolApproval && taskId && approvalLeg.active && !approvalLeg.windowZero
-                    ? deps.toolApproval.runWithContext({
-                        taskId,
-                        owner: principal ?? null,
-                        emit: approvalEmit,
-                        abortSignal: cancelCtrl.signal,
-                        sessionId,
-                        emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),
-                        emitRevoke: (f) => approvalEmit(f),
-                        legKey,
-                        ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
-                    }, driveResume)
-                    : driveResume();
-                const withElicitation = () => deps.elicitation && taskId
-                    ? deps.elicitation.runWithContext({ taskId, owner: principal ?? null, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); }, abortSignal: cancelCtrl.signal }, withApproval)
-                    : withApproval();
-                return await (deps.sendUserFile && taskId
-                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
-                    : withElicitation());
-            });
-        }
-        catch (e) {
-            if (e instanceof CheckpointError) {
-                if (e.code === "checkpoint.resume_aborted") {
-                    const cs2 = deps.checkpointStore;
-                    if (cs2) {
-                        try {
-                            const live = await cs2.get(token);
-                            if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
-                                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
-                            }
-                        }
-                        catch (cancelSettleErr) {
-                            deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
-                                taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
-                            });
-                        }
-                    }
-                    if (claimedRow && taskId && deps.runStore) {
-                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: e.message });
-                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch(() => undefined);
-                    }
-                    settleFleet("failed");
-                    return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
-                }
-                const retriable = e.code === "checkpoint.invalid_outcome" ||
-                    e.code === "checkpoint.reopen_revote" ||
-                    e.code === "checkpoint.reopened_concurrently" ||
-                    e.code === "resume.parent_constraint_missing" ||
-                    e.code === "resume.parent_constraint_mismatch" ||
-                    e.code === "resume.constraint_rejected" ||
-                    e.code === "resume.constraint_unprojectable" ||
-                    e.code === "resume.usage_window_exhausted" ||
-                    e.code === "resume.principal_mismatch" ||
-                    e.code === "resume.placement_mismatch" ||
-                    e.code === "resume.preflight_rejected" ||
-                    e.code.startsWith("wake.") ||
-                    (e.code === "checkpoint.unsupported_version" && checkpointRowRedeemableElsewhere(e.detail?.reason));
-                if (claimedRow && taskId && deps.runStore) {
-                    if (retriable && freshRunClaimed) {
-                        const c = { taskId, sessionId, terminal: { kind: "failed", code: e.code, message: e.message }, stats: { turns: 0, tokens: 0, usageMissing: true } };
-                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch((err) => {
-                            deps.logger?.warn?.("wake_synthetic_run_release_failed", { taskId, sessionId, errorCode: e.code, error: err instanceof Error ? err.message : String(err), note: "the synthetic run row for this refused fresh-run resume could not be settled — its task_active claim is still held and the next attempt on this session will 409 conflict.session_active_run until reapStale collects it (runStaleSec)" });
-                        });
-                        settleFleet("failed");
-                    }
-                    else if (retriable) {
-                        await (outcome.gate === "plan_review" ? deps.runStore.setNeedsReview(taskId) : deps.runStore.setSuspended(taskId)).catch(() => undefined);
-                        settleFleet(outcome.gate === "plan_review" ? "needs_review" : "suspended");
-                    }
-                    else {
-                        await deps.runStore.setTerminal(taskId, "failed", null, e.message).catch(() => undefined);
-                        settleFleet("failed");
-                    }
-                }
-                const status = e.code === "checkpoint.not_found" ? 404 : 409;
-                return {
-                    status,
-                    body: {
-                        ...(taskId !== undefined ? { taskId } : {}),
-                        error: e.message,
-                        errorCode: e.code === "checkpoint.invalid_outcome"
-                            ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
-                            : e.code,
-                        ...(e.detail?.field ? { field: e.detail.field } : {}),
-                        ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0
-                            ? { retryAfterSec: Math.max(1, Math.ceil(e.detail.retryAfterMs / 1000)) }
-                            : {}),
-                        ...(retriable ? { retriable: true } : {}),
-                    },
-                };
-            }
-            if (cancelCtrl.signal.aborted) {
-                if (taskId && deps.runStore) {
-                    const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user" });
-                    await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
-                }
-                settleFleet("failed");
-                return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
-            }
-            if (claimedRow && taskId && deps.runStore) {
-                await deps.runStore.setTerminal(taskId, "failed", null, errorText(e)).catch(() => undefined);
-            }
-            settleFleet("failed");
-            throw e;
-        }
-        finally {
-            unregisterEngineNotice?.();
-            if (taskId) {
-                if (inflightRuns.get(taskId) === cancelCtrl)
-                    inflightRuns.delete(taskId);
-                if (preemptableRuns.get(taskId) === preemptCtrl)
-                    preemptableRuns.delete(taskId);
-                if (resumeStreamRef !== undefined && steerableRuns.get(taskId) === resumeStreamRef)
-                    steerableRuns.delete(taskId);
-                for (const evict of subagentHandleEvictions)
-                    evict();
-                deps.modelUsage?.clear(taskId);
-                deps.promptManifests?.clear(taskId, resumeManifestLease);
-            }
-            if (resumeHeartbeat)
-                clearInterval(resumeHeartbeat);
-            resumeLegLive = false;
-        }
-        evictIfConflict(deps.runner, sessionId, result);
-        const checkpointReopened = reopenConfirmedPark;
-        const resumePlane = terminalProjection(result.terminal);
-        if (taskId && deps.runStore) {
-            if (resumePlane.status === "suspended" || checkpointReopened)
-                await deps.runStore.setSuspended(taskId);
-            else if (resumePlane.status === "needs_review")
-                await deps.runStore.setNeedsReview(taskId);
-            else
-                await deps.runStore.setTerminal(taskId, resumePlane.status, stripResumeToken(result), resumePlane.errorMessage ?? null);
-        }
-        settleFleet(checkpointReopened ? "suspended" : resumePlane.status, fleetRunResiduals(result));
-        return {
-            status: 200,
-            body: {
-                taskId, sessionId, status: resumePlane.status,
-                bindingEnforced: true,
-                ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
-                ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
-                ...(checkpointReopened ? { retriable: true } : {}),
-            },
-        };
-    }
-    async function mayDiscloseRowError(cs, token, decider) {
-        if (decider === undefined || decider.explicitOperator)
-            return true;
-        let scope;
-        try {
-            scope = await cs.peekScopeByToken(token);
-        }
-        catch (e) {
-            deps.logger?.warn?.("checkpoint_owner_probe_unreadable", { note: "peekScopeByToken failed — row-error disclosure withheld (fail-closed)", err: e instanceof Error ? e.message : String(e) });
-            return false;
-        }
-        if (scope === undefined)
-            return false;
-        const owner = decodeCheckpointScope(scope ?? CHECKPOINT_PUBLIC_SCOPE);
-        return owner === undefined || owner === decider.principal;
-    }
-    async function resumePreempted(sessionId, req, acceptEarly, decider) {
-        const cs = deps.checkpointStore;
-        const RESUMABLE_GATE_KIND = "resource_limit";
-        const preemptBinding = { gateKinds: [RESUMABLE_GATE_KIND] };
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, preemptBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
-        const noSuspension = { status: 404, body: { error: "no resumable suspension for this task (already running, resumed, or expired)", errorCode: "not_found.suspension" } };
-        if (!token)
-            return noSuspension;
-        if (decider !== undefined && !decider.explicitOperator) {
-            const peeked = await cs
-                .peekPendingScope(sessionId, preemptBinding)
-                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId) : sc))
-                .catch(() => undefined);
-            const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
-            if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
-                deps.logger?.warn?.("assistant_resume_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
-                return noSuspension;
-            }
-        }
-        let cp;
-        try {
-            cp = await cs.get(token);
-        }
-        catch (e) {
-            if (!(await mayDiscloseRowError(cs, token, decider))) {
-                deps.logger?.warn?.("assistant_resume_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
-                return noSuspension;
-            }
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
-        }
-        if (!cp) {
-            if (!(await mayDiscloseRowError(cs, token, decider)))
-                return noSuspension;
-            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        }
-        if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
-            deps.logger?.warn?.("assistant_resume_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
-            return noSuspension;
-        }
-        const gateKind = cp.gate?.kind;
-        if (gateKind !== RESUMABLE_GATE_KIND) {
-            return { status: 409, body: { error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a resumable resource/preempt suspension — an approval gate must be decided via POST /v1/approvals/:id/decide`, errorCode: "gate_not_resumable" } };
-        }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
-    }
-    async function startFreshHostTurn(sessionId, objective, principal, req, trustedInternals, runId) {
-        const cs = deps.checkpointStore;
-        if (!deps.runStore) {
-            return { status: 501, body: { error: "delivering a workflow decision on the host's next turn requires a durable run store (DB_BACKEND=mysql|pg|local)", errorCode: "capability.run_store_required" } };
-        }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx) {
-            return {
-                status: 409,
-                body: {
-                    error: "the workflow's originating session no longer has the rebuild inputs for a new turn: a session's resume context is garbage-collected once it is stale AND that session itself has no pending checkpoint and no active run (REAP_RUN_STALE_SEC, default 120s) — a workflow CHILD's park does not hold the HOST session's row open. Raise REAP_RUN_STALE_SEC to cover how long approvals may sit before someone decides them, or resume the workflow run yourself with the runId below",
-                    errorCode: "conflict.resume_context_unavailable",
-                    runId,
-                },
-            };
-        }
-        const windowDenial = await usageWindowDenialFor(principal || GLOBAL_USAGE_KEY);
-        if (windowDenial)
-            return { status: windowDenial.status, body: windowDenial.body };
-        const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return { status: 409, body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) } };
-            }
-            throw e;
-        }
-        const hostSpec = { ...spec, objective, sessionId };
-        const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
-            fleetScope: resumeFleetScope(req, auth),
-            elicitOwner: principal ?? null,
-            source: "workflow_parked_decide",
-            trustedInternals,
-        });
-        if (out.status !== 202)
-            return { status: out.status, body: out.body };
-        const minted = out.body;
-        return acceptedResumingReceipt(minted.taskId, minted.sessionId);
-    }
-    async function resumeWake(sessionId, message, caller, req, acceptEarly, workflowParkedResume, ownerLeaseAdmittedFor) {
-        const cs = deps.checkpointStore;
-        const wakeBinding = { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" };
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, wakeBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
-        if (!token)
-            return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
-        const operator = explicitOperatorOk(caller, deps.config.operatorPrincipals);
-        if (!operator) {
-            const scope = await cs.peekPendingScope(sessionId, wakeBinding).then((s) => (s === undefined ? cs.peekPendingScope(sessionId) : s)).catch(() => undefined);
-            const decodedScope = scope != null ? decodeCheckpointScope(scope) : undefined;
-            if (decodedScope !== undefined && decodedScope !== caller) {
-                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
-            }
-        }
-        let cp;
-        try {
-            cp = await cs.get(token);
-        }
-        catch (e) {
-            if (!(await mayDiscloseRowError(cs, token, { principal: caller, explicitOperator: operator }))) {
-                deps.logger?.warn?.("wake_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
-                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
-            }
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
-        }
-        if (!cp) {
-            if (!(await mayDiscloseRowError(cs, token, { principal: caller, explicitOperator: operator }))) {
-                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
-            }
-            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        }
-        if (!operator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== caller) {
-            return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
-        }
-        const gateKind = cp.gate?.kind;
-        if (gateKind !== "task_done") {
-            return { status: 409, body: { error: `cannot wake: this checkpoint awaits a pending gate decision (gate "${gateKind ?? "unknown"}") — resolve it through its own decide entry`, errorCode: "wake.gate_pending" } };
-        }
-        const trusted = operator;
-        if (message !== undefined) {
-            try {
-                validatePendingSteer({ text: message, trusted });
-            }
-            catch (e) {
-                if (e instanceof CheckpointError && e.code === "steering.invalid_content") {
-                    return { status: 422, body: { errorCode: "steering.invalid_content", error: e.message } };
-                }
-                throw e;
-            }
-        }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        return driveResumeIntoRunLog({
-            runner: runnerFor(spec),
-            token,
-            sessionId: cp.sessionId,
-            principal: auth.principal,
-            fleetScope: resumeFleetScope(req, auth),
-            taskConfig,
-            resumeObjective,
-            outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
-            verifyRounds: undefined,
-            mintFreshRun: { source: "wake" },
-            ...(engineNotices.length > 0 ? { engineNotices } : {}),
-            ...(acceptEarly === true ? { acceptEarly: true } : {}),
-            ...(req !== undefined ? { callerInitiated: true } : {}),
-            ...(workflowParkedResume !== undefined ? { workflowParkedResume } : {}),
-            ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
-        });
-    }
-    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log, acceptEarly, decider) {
-        const cs = deps.checkpointStore;
-        const log404 = (r) => deps.logger?.info?.("decide_404", {
-            reason: r,
-            ...(log?.taskId !== undefined ? { taskId: log.taskId } : { sessionId }),
-            ...(log?.principalPresent !== undefined ? { principalPresent: log.principalPresent } : {}),
-        });
-        const PLAN_REVIEW_GATE_KIND = "plan_review";
-        const planReviewBinding = { gateKinds: [PLAN_REVIEW_GATE_KIND] };
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, planReviewBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
-        const noPending = { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)", errorCode: "not_found.plan_review" } };
-        if (!token) {
-            log404("no-pending-checkpoint");
-            return noPending;
-        }
-        if (decider !== undefined && !decider.explicitOperator) {
-            const peeked = await cs
-                .peekPendingScope(sessionId, planReviewBinding)
-                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId) : sc))
-                .catch(() => undefined);
-            const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
-            if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
-                deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
-                return noPending;
-            }
-        }
-        let cp;
-        try {
-            cp = await cs.get(token);
-        }
-        catch (e) {
-            if (!(await mayDiscloseRowError(cs, token, decider))) {
-                deps.logger?.warn?.("plan_review_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
-                return noPending;
-            }
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
-        }
-        if (!cp) {
-            log404("checkpoint-missing");
-            if (!(await mayDiscloseRowError(cs, token, decider)))
-                return noPending;
-            return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        }
-        if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
-            deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
-            return noPending;
-        }
-        const gateKind = cp.gate?.kind;
-        if (gateKind !== PLAN_REVIEW_GATE_KIND) {
-            return {
-                status: 409,
-                body: {
-                    error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a plan_review — a tool approval must be decided via POST /v1/approvals/:id/decide`,
-                    errorCode: "gate_not_plan_review",
-                },
-            };
-        }
-        const ctx = await cs.getCtx(sessionId).catch(() => null);
-        if (!ctx)
-            return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const outcome = {
-            gate: "plan_review",
-            decision,
-            ...(editedPlan !== undefined ? { editedPlan } : {}),
-            ...(reason ? { reason } : {}),
-        };
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
-    }
     function recordTaskResult(result) {
         const plane = terminalProjection(result.terminal);
         deps.metrics?.inc("tasks_total", { status: plane.status });
@@ -2212,500 +140,7 @@ export function createHttpServer(rawDeps) {
         deps.planCacheProbe?.record(principal, objective, result.terminal.kind === "completed");
         evictIfConflict(deps.runner, sessionId, result);
     }
-    function quotaExceeded(req, res) {
-        if (!deps.costQuota)
-            return false;
-        const principal = gatedPrincipal(req, deps.config);
-        if (!principal)
-            return false;
-        const d = deps.costQuota.check(principal);
-        if (d.allowed)
-            return false;
-        deps.metrics?.inc("cost_quota_rejected_total");
-        res.setHeader("retry-after", String(d.retryAfterSec));
-        sendError(res, 429, "limit.cost_quota_exceeded", "cost quota exceeded", { usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec });
-        return true;
-    }
-    function ownerCostQuotaDenied(principal) {
-        if (!deps.costQuota || !principal)
-            return undefined;
-        const d = deps.costQuota.check(principal);
-        if (d.allowed)
-            return undefined;
-        deps.metrics?.inc("cost_quota_rejected_total");
-        return { status: 429, body: { error: "cost quota exceeded", errorCode: "limit.cost_quota_exceeded", usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec } };
-    }
-    async function ownerFleetLeaseDenied(owner) {
-        if (!deps.fleetLease || !owner)
-            return undefined;
-        const adm = await deps.fleetLease.admit(owner);
-        if (adm.ok)
-            return undefined;
-        deps.metrics?.inc("fleet_lease_rejected_total");
-        return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
-    }
-    async function ownerLeaseDenied(res, owner) {
-        if (!deps.fleetLease || !owner)
-            return false;
-        const adm = await deps.fleetLease.admit(owner);
-        if (adm.ok)
-            return false;
-        deps.metrics?.inc("fleet_lease_rejected_total");
-        res.setHeader("retry-after", String(adm.retryAfterSec));
-        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
-        return true;
-    }
-    function ownerQuotaDenied(res, owner) {
-        const denial = ownerCostQuotaDenied(owner);
-        if (!denial)
-            return false;
-        const { errorCode, error, ...extras } = denial.body;
-        res.setHeader("retry-after", String(extras.retryAfterSec));
-        sendError(res, denial.status, errorCode, error, extras);
-        return true;
-    }
-    async function leaseDenied(req, res) {
-        if (!deps.fleetLease)
-            return false;
-        const principal = gatedPrincipal(req, deps.config);
-        if (!principal)
-            return false;
-        const adm = await deps.fleetLease.admit(principal);
-        if (adm.ok)
-            return false;
-        deps.metrics?.inc("fleet_lease_rejected_total");
-        res.setHeader("retry-after", String(adm.retryAfterSec));
-        sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
-        return true;
-    }
-    async function usageWindowDenialFor(key) {
-        const store = deps.usageWindowStore;
-        const windows = deps.config.usageWindows;
-        if (!store || !windows || windows.length === 0)
-            return undefined;
-        let retryAfterMs;
-        try {
-            retryAfterMs = usageRetryAfterMs(await store.read(key, windows, Date.now()));
-        }
-        catch (e) {
-            deps.logger?.warn?.("usage_window_admission_read_failed", { error: e instanceof Error ? e.message : String(e) });
-            return undefined;
-        }
-        if (retryAfterMs === undefined)
-            return undefined;
-        deps.metrics?.inc("usage_window_rejected_total");
-        deps.logger?.info?.("usage_window_exhausted", { hasPrincipal: key !== GLOBAL_USAGE_KEY, retryAfterMs });
-        const retryAfterSec = Math.max(1, Math.ceil(retryAfterMs / 1000));
-        return { status: 429, body: { error: "usage window exhausted (deployment token governance)", errorCode: "usage.window_exhausted", retryAfterSec }, retryAfterSec };
-    }
-    async function usageWindowDenied(req, res) {
-        const denial = await usageWindowDenialFor(gatedPrincipal(req, deps.config) || GLOBAL_USAGE_KEY);
-        if (!denial)
-            return false;
-        res.setHeader("retry-after", String(denial.retryAfterSec));
-        sendError(res, denial.status, denial.body.errorCode, denial.body.error, { retryAfterSec: denial.retryAfterSec });
-        return true;
-    }
-    function rateLimited(req, res) {
-        if (!deps.rateLimiter)
-            return false;
-        const key = (deps.config.directDoorActive ? undefined : principalFrom(req, deps.config)) ?? req.socket.remoteAddress ?? "anon";
-        const d = deps.rateLimiter.check(key);
-        if (d.allowed)
-            return false;
-        deps.metrics?.inc("rate_limited_total");
-        res.setHeader("retry-after", String(d.retryAfterSec));
-        sendError(res, 429, "limit.rate_exceeded", "rate limit exceeded", { retryAfterSec: d.retryAfterSec });
-        return true;
-    }
-    function safeDecode(seg) {
-        try {
-            return decodeURIComponent(seg);
-        }
-        catch {
-            return null;
-        }
-    }
-    function isFleetWide(req) {
-        const { authToken: at, traceToken: tt } = deps.config;
-        const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        return (!anyAt && !tt && !deps.config.requirePrincipal) || (anyAt && systemFor(req, deps.config) !== undefined) || (!!tt && authorized(req, tt));
-    }
-    function sessionOwnerScope(req) {
-        const fleetWide = isFleetWide(req);
-        const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
-        return { fleetWide, gateOwner };
-    }
-    function sessionOwnerScopeForWrite(req) {
-        const { authToken: at, traceToken: tt } = deps.config;
-        const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-        const fleetWide = (!anyAt && !tt && !deps.config.requirePrincipal) || (anyAt && systemFor(req, deps.config) !== undefined);
-        const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
-        return { fleetWide, gateOwner };
-    }
-    function runOwnerOk(req, res, owner, notFoundForm = "run") {
-        const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && !principal) {
-            sendPrincipalRefusal(res, req, deps.config);
-            return false;
-        }
-        if (!runOwnerReadable(principal, owner, deps.config)) {
-            if (notFoundForm === "session")
-                sendError(res, 404, "not_found.session", "session not found");
-            else
-                sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
-            return false;
-        }
-        return true;
-    }
-    const sessionAssertAbsentWarned = new Set();
-    function runSessionAcceptOk(req, res, run, face, notFoundError = RUN_NOT_FOUND_MESSAGE) {
-        if (!run.sessionId)
-            return true;
-        const asserted = new URL(req.url ?? "", "http://x").searchParams.get("session");
-        if (asserted === null) {
-            if (!sessionAssertAbsentWarned.has(face)) {
-                sessionAssertAbsentWarned.add(face);
-                console.warn(JSON.stringify({ ts: new Date().toISOString(), level: "warn", msg: "run_face_session_assert_absent", face, note: "caller sent no ?session= on a session-bound run — allowed in the accept phase; the enforcement train will 404 this ([1498]⑥/[1499])" }));
-            }
-            return true;
-        }
-        if (asserted === run.sessionId)
-            return true;
-        if (explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals))
-            return true;
-        sendError(res, 404, "not_found.run", notFoundError);
-        return false;
-    }
-    async function readJson(req) {
-        const chunks = [];
-        let size = 0;
-        for await (const c of req) {
-            size += c.length;
-            if (size > MAX_BODY)
-                throw new HttpError(413, "request body too large");
-            chunks.push(c);
-        }
-        if (chunks.length === 0)
-            return {};
-        try {
-            return JSON.parse(Buffer.concat(chunks).toString("utf8")) ?? {};
-        }
-        catch {
-            throw new HttpError(400, "invalid JSON body");
-        }
-    }
-    async function readRawBody(req, max) {
-        const chunks = [];
-        let size = 0;
-        for await (const c of req) {
-            size += c.length;
-            if (size > max)
-                throw new HttpError(413, "blob too large");
-            chunks.push(c);
-        }
-        return Buffer.concat(chunks);
-    }
-    const denySweepClockGuard = createWallClockJumpGuard({
-        slaMs: deps.config.approvalTimeoutSec > 0 ? deps.config.approvalTimeoutSec * 1000 : undefined,
-        onJump: ({ jumpMs, graceMs }) => deps.logger?.warn?.("deny_sweep_wall_clock_jump", {
-            jumpMs,
-            graceMs,
-            note: jumpMs > 0
-                ? "the wall clock stepped FORWARD relative to the monotonic clock; the approval SLA deny-sweep stands down for graceMs of MONOTONIC time so no pending gate is denied earlier than one full SLA of REAL time ([4232]①/[4235]). The checkpoint terminal_at_ms backstop is unaffected — nothing can hang forever."
-                : "the wall clock stepped BACKWARD relative to the monotonic clock; the deny-sweep needs no grace for this direction (a receding deadline only DELAYS a deny) but the step itself is an operational fact worth recording.",
-        }),
-        onSuppressed: ({ remainingMs }) => deps.logger?.info?.("deny_sweep_clock_grace", { remainingMs }),
-        onGraceCapped: ({ totalGraceMs }) => deps.logger?.warn?.("deny_sweep_clock_grace_capped", {
-            totalGraceMs,
-            note: "the wall clock kept stepping forward; the approval SLA deny-sweep has stood down for the maximum cumulative grace and now RESUMES on a demonstrably unstable clock — a fail-closed leg that never runs is worse than one running on a bad clock. Fix NTP on this host.",
-        }),
-    });
-    async function denyExpiredApprovals(now) {
-        const cs = deps.checkpointStore;
-        if (!cs)
-            return;
-        if (!denySweepClockGuard.admit(now))
-            return;
-        const expired = await cs.listExpiredApprovalGates(now).catch(() => []);
-        const isParkedOwned = async (sessionId) => {
-            if (deps.backgroundAgentStore === undefined && deps.workflowAgentSessionIndex === undefined)
-                return false;
-            try {
-                const token = await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS });
-                if (!token)
-                    return false;
-                const cp = await cs.get(token);
-                if (!cp)
-                    return false;
-                return (await findParkOrigin({
-                    ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
-                    ...(deps.workflowAgentSessionIndex !== undefined && deps.workflowRunStore !== undefined
-                        ? { workflowIndex: deps.workflowAgentSessionIndex, workflowRunStore: deps.workflowRunStore }
-                        : {}),
-                }, { token, scope: cp.scope, sessionId: cp.sessionId })) !== undefined;
-            }
-            catch {
-                return false;
-            }
-        };
-        let parkedSkipped = 0;
-        for (const { sessionId } of expired) {
-            if (await isParkedOwned(sessionId)) {
-                parkedSkipped += 1;
-                continue;
-            }
-            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
-                deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, errorCode: r.body?.errorCode }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
-        }
-        if (parkedSkipped > 0)
-            deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
-    }
-    async function redeemParkedAsk(req) {
-        const cs = deps.checkpointStore;
-        if (!cs) {
-            return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-        }
-        if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
-            return { status: 503, body: { error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions", errorCode: "auth.service_token_required" } };
-        }
-        if (deps.drainState?.draining) {
-            return {
-                status: 503,
-                body: {
-                    error: "draining",
-                    errorCode: "draining",
-                    message: "this instance is draining for shutdown/upgrade — retry against the replacement instance",
-                    ...(deps.drainState.reason ? { reason: deps.drainState.reason } : {}),
-                },
-            };
-        }
-        if (deps.modelReady && !deps.modelReady()) {
-            return {
-                status: 503,
-                body: {
-                    error: "model_roster_pending",
-                    errorCode: "state.model_roster_pending",
-                    message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly",
-                },
-            };
-        }
-        if (deps.costQuota && req.httpReq) {
-            const quotaPrincipal = gatedPrincipal(req.httpReq, deps.config);
-            if (quotaPrincipal !== undefined) {
-                const d = deps.costQuota.check(quotaPrincipal);
-                if (!d.allowed) {
-                    deps.metrics?.inc("cost_quota_rejected_total");
-                    return {
-                        status: 429,
-                        body: { error: "cost quota exceeded", errorCode: "limit.cost_quota_exceeded", usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec },
-                    };
-                }
-            }
-        }
-        let cp;
-        try {
-            cp = await cs.get(req.gateToken);
-        }
-        catch (e) {
-            if (!(await mayDiscloseRowError(cs, req.gateToken, { principal: req.principal, explicitOperator: false }))) {
-                deps.logger?.warn?.("parked_late_decision_unreadable_row_withheld", { askId: req.askId });
-                return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-            }
-            return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
-        }
-        if (!cp) {
-            return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-        }
-        const cpPrincipal = decodeCheckpointScope(cp.scope);
-        if (cpPrincipal !== undefined && cpPrincipal !== req.principal) {
-            deps.logger?.warn?.("parked_late_decision_scope_mismatch", { askId: req.askId });
-            return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
-        }
-        const binding = {
-            checkpointToken: req.gateToken,
-            ...(req.gateBoundCallId !== null ? { boundCallId: req.gateBoundCallId } : {}),
-            ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
-            ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
-        };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, personDecision(req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
-        return { status: out.status, body: out.body };
-    }
     const isRunLiveOnThisReplica = (taskId) => inflightRuns.has(taskId) || steerableRuns.has(taskId);
     return Object.assign(server, { denyExpiredApprovals, isRunLiveOnThisReplica, redeemParkedAsk });
 }
-const WORKER_SWAP_REDEEMABLE = {
-    version_newer: true,
-    env_factory_missing: true,
-    governed_unwired: true,
-    origin_missing: true,
-    seat_retired: true,
-    ledger_event_unknown: true,
-    real_approval_damaged: false,
-    real_approval_forged: false,
-    read_face_damaged: false,
-    read_face_forged: false,
-    write_face_damaged: false,
-    constraint_chain_missing: false,
-};
-function checkpointRowRedeemableElsewhere(reason) {
-    return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
-}
-export function isMethodDispatchedSubmitPath(url) {
-    return url === "/v1/a2a";
-}
-export function hasServiceAuth(config) {
-    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-}
-export function isBillableSubmitPath(url) {
-    return (url === "/v1/side-query" ||
-        url === "/v1/tasks" ||
-        url === "/v1/tasks/stream" ||
-        url === "/v1/runs" ||
-        url === "/v1/leader" ||
-        url === "/v1/a2a" ||
-        url === "/v1/admin/memory/consolidation/run" ||
-        ASSISTANT_RESUME_RE.test(url) ||
-        ASSISTANT_PLAN_REVIEW_RE.test(url) ||
-        RUN_SUBAGENT_RESUME_RE.test(url) ||
-        SESSION_WAKE_RE.test(url) ||
-        url.startsWith("/v1/approvals"));
-}
-export function isCredentialGatedRewrite(method, url) {
-    const m = method.toUpperCase();
-    if (m === "POST") {
-        return (url === "/v1/adoption" ||
-            url.startsWith("/v1/rules/cc-import/") ||
-            url.startsWith("/v1/rules/local-import/") ||
-            url === "/v1/memory/import" ||
-            url === "/v1/memory/export" ||
-            url === "/v1/memory/erase" ||
-            url.startsWith("/v1/memory/origin/entries/") ||
-            url.startsWith("/v1/devices/"));
-    }
-    if (m === "PUT")
-        return url === "/v1/admin/memory-optout" || url.startsWith("/v1/admin/memory-optout/");
-    if (m === "DELETE")
-        return url === "/v1/rules" || url.startsWith("/v1/admin/memory-optout/");
-    if (m === "GET") {
-        return (/^\/v1\/memory\/entries\/[^/]+\/provenance$/.test(url) ||
-            url === "/v1/memory/origin/external" ||
-            url === "/v1/memory/origin/clearances" ||
-            url === "/v1/admin/memory-optout" ||
-            url === "/v1/devices" ||
-            /^\/v1\/devices\/sessions\/[^/]+$/.test(url));
-    }
-    return false;
-}
-const ROUTE_LABEL_PATTERNS = [
-    [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
-    [/^\/v1\/runs\/[^/]+\/memory\/capture-optout$/, "/v1/runs/:id/memory/capture-optout"],
-    [/^\/v1\/runs\/[^/]+\/interrupt$/, "/v1/runs/:id/interrupt"],
-    [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
-    [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
-    [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
-    [/^\/v1\/runs\/[^/]+\/events$/, "/v1/runs/:id/events"],
-    [/^\/v1\/runs\/[^/]+\/subagents\/[^/]+\/(steer|resume|output|stream)$/, "/v1/runs/:id/subagents/:sub/*"],
-    [/^\/v1\/runs\/[^/]+\/tasks\/[^/]+\/(output|stop)$/, "/v1/runs/:id/tasks/:tid/*"],
-    [/^\/v1\/runs\/[^/]+$/, "/v1/runs/:id"],
-    [/^\/v1\/images\/bakes\/[^/]+\/events$/, "/v1/images/bakes/:id/events"],
-    [/^\/v1\/images\/bakes\/[^/]+\/cancel$/, "/v1/images/bakes/:id/cancel"],
-    [/^\/v1\/images\/bakes\/[^/]+\/claim$/, "/v1/images/bakes/:id/claim"],
-    [/^\/v1\/images\/bakes\/[^/]+\/ingest$/, "/v1/images/bakes/:id/ingest"],
-    [/^\/v1\/images\/bakes\/[^/]+$/, "/v1/images/bakes/:id"],
-    [/^\/v1\/images\/digests\/[^/]+$/, "/v1/images/digests/:digest"],
-    [/^\/v1\/images\/[^/]+$/, "/v1/images/:profile"],
-    [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
-    [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
-    [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|a2a|policy|settings)$/, "/v1/sessions/:id/$verb"],
-    [/^\/v1\/admin\/memory-optout\/[^/]+$/, "/v1/admin/memory-optout/:principal"],
-    [/^\/v1\/sessions\/[^/]+\/memory\/erase$/, "/v1/sessions/:id/memory/erase"],
-    [/^\/v1\/sessions\/[^/]+\/memory-status$/, "/v1/sessions/:id/memory-status"],
-    [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
-    [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
-    [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
-    [/^\/v1\/sessions\/[^/]+\/sync\/history\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/history/blobs/:hash"],
-    [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
-    [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
-    [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
-    [/^\/v1\/assistant\/tasks\/[^/]+\/resume$/, "/v1/assistant/tasks/:id/resume"],
-    [/^\/v1\/assistant\/tasks\/[^/]+\/plan_review$/, "/v1/assistant/tasks/:id/plan_review"],
-    [/^\/v1\/elicitations\/[^/]+\/respond$/, "/v1/elicitations/:id/respond"],
-    [/^\/v1\/questions\/[^/]+\/respond$/, "/v1/questions/:id/respond"],
-    [/^\/v1\/tool-approvals\/[^/]+\/respond$/, "/v1/tool-approvals/:id/respond"],
-    [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
-    [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
-    [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],
-    [/^\/v1\/tasks\/[^/]+\/asks\/[^/]+\/decision$/, "/v1/tasks/:id/asks/:askId/decision"],
-    [/^\/v1\/tasks\/[^/]+\/tool-results\/[^/]+$/, "/v1/tasks/:id/tool-results/:ref"],
-    [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
-    [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
-    [/^\/v1\/devices\/sessions\/[^/]+\/rebind$/, "/v1/devices/sessions/:id/rebind"],
-    [/^\/v1\/devices\/sessions\/[^/]+$/, "/v1/devices/sessions/:id"],
-    [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
-    [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
-    [/^\/v1\/adoption\/[^/]+$/, "/v1/adoption/:id"],
-    [/^\/v1\/ops\/retention\/holds\/[^/]*$/, "/v1/ops/retention/holds/:domain"],
-    [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
-    [/^\/v1\/memory\/entries\/[^/]+\/provenance$/, "/v1/memory/entries/:entryId/provenance"],
-    [/^\/v1\/memory\/origin\/entries\/[^/]+\/clear$/, "/v1/memory/origin/entries/:entryId/clear"],
-    [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
-    [/^\/v1\/shared-memory\/stores\/[^/]+\/documents$/, "/v1/shared-memory/stores/:store/documents"],
-    [/^\/v1\/shared-memory\/stores\/[^/]+\/document$/, "/v1/shared-memory/stores/:store/document"],
-];
-const ROUTE_LABEL_LITERALS = new Set([
-    "/health", "/metrics", "/metrics/summary", "/metrics/plan-cache",
-    "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/tasks/source-summary",
-    "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/approvals/stream",
-    "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities",
-    "/v1/images", "/v1/images/bakes", "/v1/images/bakes/claim", "/v1/images/select", "/v1/images/register",
-    "/v1/workflows", "/v1/attachments", "/v1/leader", "/v1/outcomes", "/v1/side-query",
-    "/v1/devices",
-    "/v1/fleet/stream",
-    "/v1/memory/export", "/v1/sendfile-links",
-    "/v1/memory/import",
-    "/v1/memory/erase",
-    "/v1/memory/origin/external", "/v1/memory/origin/clearances",
-    "/v1/shared-memory/stores",
-    "/v1/diagnostics/wiring",
-    "/v1/adoption",
-    "/v1/admin/drain",
-    "/v1/admin/config/refresh",
-    "/v1/config/catalog",
-    "/v1/admin/memory-optout",
-    "/v1/admin/memory/consolidation/run", "/v1/admin/memory/consolidation",
-    "/v1/rules/cc-import/prepare", "/v1/rules/cc-import/redeem",
-    "/v1/rules/local-import/prepare", "/v1/rules/local-import/redeem",
-    "/v1/rules",
-    "/.well-known/agent-card.json", "/v1/a2a",
-    "/v1/agents/roster",
-    "/v1/ops/retention/audit",
-]);
-export function routeLabel(_method, url) {
-    if (ROUTE_LABEL_LITERALS.has(url))
-        return url;
-    for (const [re, label] of ROUTE_LABEL_PATTERNS)
-        if (re.test(url))
-            return label;
-    return "other";
-}
-function cors(res, req, origins, principalHeader) {
-    if (!origins || origins.length === 0)
-        return;
-    let allow;
-    if (origins.length === 1) {
-        allow = origins[0];
-    }
-    else {
-        res.setHeader("vary", "Origin");
-        const reqOrigin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
-        allow = reqOrigin !== undefined && origins.includes(reqOrigin) ? reqOrigin : undefined;
-    }
-    if (allow === undefined)
-        return;
-    res.setHeader("access-control-allow-origin", allow);
-    res.setHeader("access-control-allow-methods", "GET, POST, PUT, DELETE, OPTIONS");
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
-    res.setHeader("access-control-expose-headers", "x-task-id, retry-after");
-}
 //# sourceMappingURL=server.js.map