@sema-agent/client-core 0.38.0 → 0.39.0

package/CHANGELOG.md

@@ -23,11 +23,86 @@
 > 既有行)⇒ 标题**不回改、且永远不会被改**(`b165f3f` 那个 commit 的字节是历史,任何未来提交
 > 都改不到它)⇒ 这条勘误与门侧窄豁免(`run-integration-doc-freshness-test.mjs` ④b
 > `KNOWN_HEADING_ERRATA`,登记 `version: '0.36.0', releasedAt: 'b165f3f'`)**都是永久的**,不是
-> 「下一版删掉」的临时态(codex 复审 finding①:那样写会让豁免一删,门在**任何**后续版本上
+> 「下一版删掉」的临时态(对抗复审 finding①:那样写会让豁免一删,门在**任何**后续版本上
 > 都会重新对这个永久冻结的标题判红,退休条件不可能被满足)。门侧核验两件事把这条勘误钉死、
 > 不许悄悄漂:豁免登记的 `releasedAt` 与 `FROZEN` 账上 0.36.0 那一行逐字相等;本段(点名版本号
 > `0.36.0` + 关键字「勘误」)必须还在这份头注里 —— 删掉本段而不同批把门侧豁免一起处理,门当场红。
 
+## 0.39.0(2026-08-21)
+
+**minor:tool_approval 帧窗三键过境 + 三新错误码消费件(0.38.0 已知局限「delegation.* 无机器可读载体」自本版解除)。**
+
+- **🆕 tool_approval 帧窗三键过境([4851] cli 请托;[4845] 假死案的包层半场)**:`ToolApprovalFrame`
+  声明 + 键镜像表 + `ApprovalCardRequest` 三处补 `expiresInMs` / `expiresAtMs` / `serverNowMs`
+  (server ≥7.34 在 durable `tool_approval` 帧上 stamp;0.38.1 及更早的白名单投影把三键**丢在包
+  边界外** —— 正是「审批卡 TTL 到点转 park 后屏幕零反应像活的」的直接成因之一)。铸卡点按
+  **有限数才 stamp** 收(坏形降缺席,三键独立判不互相湮灭);对账门 `run-approval-frame-keys`
+  以 AHEAD_OF_ANCHOR 登记三条领先(sdk 7.2.0 锚尚无三键,SDK 追平当天登记自红逼删)。
+- **🆕 三新错误码消费件(0.38.0 件④ 的下半场,载体已核实到货)**:core 5.50.0 兑现上游诉求 ——
+  `capRefusal` 铸 `{ error: code, code }` **孪生拼法**(`dist/agents/subagent.js`,node 直读实证),
+  抬升腿 `toolEndBodyFrom` 读 `details.code` 后 stamp 帧顶层 ⇒ `delegation.concurrency_cap` /
+  `delegation.session_cap` 自 core ≥5.50.0 起**真出现在 `tool_end.errorCode`**。本版接上判定半场:
+  ① `delegationCapDispositionOf`:两码处置不对称的机器可读形(`wait-for-slot` /
+  `reuse-existing-or-await-reap`),未知 `delegation.*` 码 ⇒ `undefined`(开集纪律:不认得就不给
+  处置,不替引擎指路);文案归端。🔴 **勘误(异源对抗复审命中)**:0.38.0 段曾把累计帽写成
+  「等也没用,这条会话这辈子的配额用完了」——**错**。core 实现在计数前先把不在 stored/active 的
+  handle 从 ledger 剪掉,计数是 **retained-window 帐**,行被 retention 回收后配额**会回来**,core
+  文案的推荐出路即 "Continue an existing agent (SendMessage)"。以本版语义为准(0.38.0 段已冻结
+  不回改)。
+  ② `MCP_SERVER_REVOKED`(`mcp.server_revoked`,core 5.50.0 `dist/core/mcp.js` 三铸点同码):
+  操作员 mid-session 吊销 MCP server 后的**工具面本地闸**(请求没发出去;不是故障;同 server
+  重试无意义直到重新批准)。🔴 **哪个 server 被吊销今天 wire 上拿不到**(异源复审命中):core
+  detail 的 `server` 键是进程内位,抬升腿只 lift `code`、该 detail 无 `type` 进不了 `structured`
+  ⇒ 端只有码没有名;归因渲染候 core 补 typed detail / tool_end 字段(发布帖点名,表态制)。
+  ③ print 车道读形 `ToolEndResultArmLike` 补 `errorCode?: unknown`(与 `settledBy`/`approver`
+  同款「臂带、卡不带」姿势;typeshape unknown 出境棘轮 252→253 同批登记)。
+  ④ **载体门**:`run-engine-vocab-floor-test` 新增 G3 腿(+7 checks,门 73→80)锚 core dist 铸点
+  与抬升腿口径,devDep core ^5.43.0→^5.50.0(实装 5.52.0),CORE_FLOOR 5.43→5.50 —— 5.45.0 实装物
+  上 G3-a 实测红(红先绿后留证),孪生拼法哪天被 core 重构删掉本门当场红。
+  ⑤ `engineErrorCodes.ts` 0.38.0 那条「载体如实登记」注按现势改写(旧注描述的是 5.50 修孪生前
+  的 core;旧引擎 5.48/5.49 上两码仍只在模型面文案里,消费点拿不到码就什么都别渲)。
+- **跟修**:pure 套 B7 两处 `TOOL_APPROVAL_FRAME_KEYS_MIRROR` 计数钉 18→21(三键过境批漏跑 pure
+  套的存量红,本批认领);public-export 基线 764→766。
+
+- **🔴 收敛式扫码+异源复审收编(两 P1 三 P2 修复,发包前置)**:
+  ① **重放腿假倒计时(P1)**:durable 账本 tail 会把旧 `tool_approval` 行连冻结三键逐字重放,
+  此前铸卡点无条件 stamp ⇒ 早已过期的 ask 在屏上拿到精确但完全错误的倒计时(比 [4845]「卡挂着
+  像活的」更坏)。修 = `ToolApprovalFrameLaneOpts` 新增 `windowIsCurrent` 席位,三键**只在
+  `=== true`(live 流)时过境**;缺席 fail-closed 不 stamp(老宿主行为 = 0.38.1,零回归),
+  各端 live 腿随自家提货批接线 `true`。
+  ② **stamp 零门看守(P1)**:变异实证删掉三行 stamp 全门照绿。修 = pure 套新增端到端卡口断言
+  七条(live 逐值过境 / 重放三形缺席 / 负数坏形闸 / 0 合法)。
+  ③ **负数放行(P2)**:铸卡注承诺「负数=坏形降缺席」而实现是裸 `Number.isFinite`。修 =
+  `isNonNegativeFinite`(0 合法 = 窗恰好到点,SDK 契约 `max(0,…)` 可产 0)。
+  ④ **缺本地收帧锚(P2)**:卡口串行阻塞下排队靠后的卡按「呈现那一刻」起算 = 窗被整段还回去。
+  修 = live 腿 stamp 任一窗键时同拍盖 `ApprovalCardRequest.receivedAtMs`(壳读器明文优先它)。
+  ⑤ **G3 载体门判据收紧(P2)**:铸点判据改「每个含 `mcp.server_revoked` 的 details 对象都带
+  `code` 键」全称断言(顺序无关 —— 装饰性 key 重排不再误红,单铸点退化单键不再被计数下限漏过);
+  capRefusal 体内判据同步放宽到 shorthand 等价形;判别器全员合成样本正控。
+
+### 已知局限(本版新增)
+
+- **三新码的渲染半场在端**:本包只出判定(处置轴/常量),cli 壳的指路文案腿(Task 卡拒因 +
+  mcp 吊销卡)随壳 0.39.0 提货批做;web/desktop 同理。旧引擎(core <5.50.0)上 `tool_end.errorCode`
+  不带这三码 —— 缺席 ≠ 没拒过,端别按缺席反推。
+- **窗三键的 live 腿要各端接线才点亮**:`windowIsCurrent` 缺席 = 三键不 stamp(fail-closed)——
+  cli 壳 live 腿随 1.0.88 提货补 `true`;web/desktop 接线前行为 = 0.38.1(卡无倒计时,无假窗)。
+- **seatContract 的 `ToolPermissionRequest` 未跟窗三键**:desktop/web 座位 IPC 面上窗仍停在包内
+  这一格 —— 座位面倒计时随两端提货批与 IPC 契约(B18 单源)同窗补,不在本批贸然扩 IPC 键。
+- **park(durable)腿仍无窗投影**:富行 `PendingCheckpoint.deadline` 是重放面读数,与
+  `windowIsCurrent` 同一条闸;投影候 7.40 park 转态帧带当下余量([4846] server 已认领),
+  未投影登记(`run-durable-card-display-keys-test.mjs`)理由已按本批换代。
+
+## 0.38.1(2026-08-21)
+
+**patch:纯出包卫生版,零 API/行为变化。**
+
+- **出包面词汇消毒**:dist 注释(tsc 编译保留注释)与随包 Markdown 全量按发布词汇规范清理;
+  历史 CHANGELOG 段同批词面映射(零语义改动),冻结账按消毒纪元(commit `a0488b2`)重钉,
+  `run-integration-doc-freshness` ④a2s 新增消毒等价核 —— 借消毒偷加行/改语义照样红。
+- **新门 `run-package-hygiene`**:`package.json` `files` 全实体(dist js/d.ts + 随包 md)逐行过
+  发布词汇禁表(自检 + allow 双向),gates-manifest 32 套。
+
 ## 0.38.0(2026-08-21)
 
 **#318 四件合批 + SDK 7.2.0 提货跟车。行为面五条**:一条新投影臂(additive)、一条超时预算收窄
@@ -40,7 +115,7 @@
 > `isDelegationCapCode` · `wireCycleSeq` / `wireRetiredBy`。
 > 🔴 **peer 地板抬到 `>=7.2.0`**(见下「SDK 7.2.0 提货」);装 <7.2.0 SDK 的端提货前先抬依赖。
 
-- **🆕 件① `engine_notice` 投影臂(additive,server ≥7.36 / #310;黑板 [4679] 发布、[4682] cli 认领)**:
+- **🆕 件① `engine_notice` 投影臂(additive,server ≥7.36 / #310;协作板 [4679] 发布、[4682] cli 认领)**:
   引擎的结构化通告里被 server 判为面向**本会话终端用户**的那一小撮,现在有了投影口 ——
   `eventToSdkMessage` → 中性内部臂 `engine_notice` → `adapt()` → chrome 臂
   `{ kind:'engine_notice', code, message, detail, sessionId?, ts?, eventId? }`。**不铸 transcript 行**
@@ -54,7 +129,7 @@
   消费纪律五条(按 code+detail 渲 / message 仅 fallback / 未知码不许丢 / durable 重放幂等 /
   `harvest_quarantined` 的 `moved` 与 `escalated` **不可相减**)写在 `seam.ts` 臂注释与
   `docs/INTEGRATION-CLIENTS.md` §3f。**壳渲染半场不在本批**(cli 0.38.0 提货时做)。
-  🔴 **重放身份两个键(codex 对抗复审 [medium] 采纳,当窗修)**:首版只带 `eventId`,于是 body 不带
+  🔴 **重放身份两个键(对抗复审 [medium] 采纳,当窗修)**:首版只带 `eventId`,于是 body 不带
   它时留给端的唯一去重口是 `code+ts` —— 而 `ts` 是 **server 观察时刻(ms)**,同毫秒同码的两条真通告
   会被折成一条、跨重连的同一条又可能重复。而 SDK 的 SSE parser **本来就把 durable `id:`
   (= `task_event.seq`)stamp 到 `ev.id` 上**(`dist/sse.js`),本包也早有规范访问口
@@ -82,7 +157,7 @@
   🔴 **两条残余同步形如实登记**(收窄不等于长调用消失了,[4687] 逐字):终局形仍存在于 ①pre-7.37
   的 server、②≥7.37 但没有 durable run 行可跟的部署。本包是三端共用件,故重试环保留、总窗不设 0;
   这两形上窗尽的代价是**重呈臂**(同一张卡重交用户)而不是把 turn 判死。
-  🔴 **「至少重试一次」改由发数保证(codex 对抗复审 [medium] 采纳,当窗修)**:per-attempt 帽是
+  🔴 **「至少重试一次」改由发数保证(对抗复审 [medium] 采纳,当窗修)**:per-attempt 帽是
   **宿主构造 client 时**定的(本桥吃注入 client,`HitlClientLike` 根本不暴露 `timeoutMs`)⇒
   「总窗 ÷ 帽 = 发数」这条推导只在 SDK **缺省值**上成立,不能当本共用件的性质 —— 一个 120s client
   的宿主在首发超时那一刻 elapsed 已 ≥ 窗,**一次重试都拿不到**,而上面那两条残余同步形恰恰最需要
@@ -217,7 +292,7 @@
   `settleByBase`(`engineCapsSettled` 的语义是「等**当前这一次**探测落地」,抽走在途 promise 会让
   await 方拿到假「已落地」);空串 ⇒ no-op,从没探过也没失效过的 base ⇒ **真 no-op 不留代际条目**;
   绝不 throw。**per-base**,不连坐别的 base。
-  🔴 **代际计数 `genByBase`(codex 对抗复审 [high] 采纳,同批修)**:失效口清了 `inFlight` 之后同
+  🔴 **代际计数 `genByBase`(对抗复审 [high] 采纳,同批修)**:失效口清了 `inFlight` 之后同
   base 立刻可以再 kick ⇒ **两次探测并发跑在同一份无版本共享态上**。没有代际时两个真后果,都发生在
   「重启撞上一次慢 capabilities 请求」这个最该正确的时刻 —— ①旧引擎那次**后**落地会把 caps 覆盖回
   旧引擎的位(失效等于没做);②旧探测的 `finally` 删掉的是**新 run** 的 `inFlight`/`settleByBase`
@@ -290,7 +365,7 @@
   判死是三条出路里唯一不可逆的,只配给引擎答了且拒了的语义失败。引擎真死时失败尽快显形:下一轮
   approvals.list 当场失败走既有诚实红。门:`run-hitl-gate-honesty-test.mjs` 新 F6 组(红先绿后 +
   四变异各自抓红);耗尽错 message 有负控钉「不落 isAlreadyResolvedGateReason 词表」。
-  ⚠️ **请托 SDK 半场(候黑板)**:decide 的 per-call 面今天无 timeout 旋钮(只有 signal,合流只能
+  ⚠️ **请托 SDK 半场(候协作板)**:decide 的 per-call 面今天无 timeout 旋钮(只有 signal,合流只能
   收短)—— 若 SDK 给 decide 开 per-call timeoutMs(或对 HITL 面单列长缺省),超时类重试环可整段
   收敛成一发长等待;#316(快速 ack)落地后总窗亦可回收。
 - **🔴 P0b:Session busy 幽灵 running 的三选卡半场(存活对账 + 已呈现登记)**。病(案卷车2):
@@ -316,7 +391,7 @@
   [4664] 四个洞(park 态不在 reapStale 射程 / updated_at 误杀窗 / 409 与 poll 口径短暂相左 /
   LOCAL 无周期腿)在 `ActiveRunBusySignal.activeTaskStatus` 与存活对账腿的注释上逐条引用 ——
   409 的 `running` 不是绝对真值。
-  ④ **codex 对抗复审跟修(同批,真病三件)**:[high] 对账读回**终态词**(completed/failed/blocked/
+  ④ **对抗复审跟修(同批,真病三件)**:[high] 对账读回**终态词**(completed/failed/blocked/
   timeout)不再落 not-parked(其默认文案对已终结的 run 说「wait for it to finish」= 永远等不到的
   假话)—— 专属结局 **`running-settled`**(诚实说 claim 陈旧/释放中 + 重发指引);[medium] 对账
   期间用户 Esc ⇒ 探测归来后零派臂/零出卡/零登记(零动作现状行收口);[medium 轻形] 登记表 FIFO
@@ -508,7 +583,7 @@
 
 ## 0.34.0(2026-08-17)
 
-**#292 P1(cli 黑板 [4285]/[4309] 定谳)——`REQUEST_FIELD_MATRIX` 的 `settings.<resolved>` 行补
+**#292 P1(cli 协作板 [4285]/[4309] 定谳)——`REQUEST_FIELD_MATRIX` 的 `settings.<resolved>` 行补
 `print` 车道、撤 `gap:true`。行为面**一条**:print 车道的 `buildTaskRequest` 从此会把端给的
 `input.settings.resolved` 摊开上 wire(端不给值 ⇒ 仍零 stamp,不会凭空出现)。**
 
@@ -562,7 +637,7 @@
   留痕(腿名 `subagent-steer`,每 (腿,taskId) 至多一条 warn),绝不回落在飞 run;**没指名行**
   (既有两参调用)⇒ 才回落在飞 run。⚠️ 端侧收益要**端传了 `childTaskId` 才到达用户**:壳/web/桌面
   凡有行上下文的 steer 调用点(壳 `REPL.tsx` 的 `onAgentSubmit` 已持 `task.id`)应跟一行把它传下来。
-  **会话参数同批改二态**(codex 复审 medium):行登记时捕到了会话 ⇒ 用**行的会话**(与行的 runId
+  **会话参数同批改二态**(对抗复审 medium):行登记时捕到了会话 ⇒ 用**行的会话**(与行的 runId
   同源同拍,是唯一自洽的组合;旧形「台账 run + 现势 session」在 session-bound run 上是确定性
   404,等于修好了 run 定位却仍然 steer 不到);行没有随行会话(`recordBgParentRun` 只写 run,
   今天 bg 行多数是这一格)⇒ 退现势会话。刻意**不**跟 resume 腿的「没捕到就干脆不带」——本腿遵
@@ -580,14 +655,14 @@
   `'server_fail_closed' | 'own_root' | 'own_parent' | 'absent_parent'`,按**实际命中的放行臂**铸值
   (臂序 = 放行判据求值序,多臂同时成立报第一条)。旧签名把四条**强度不同**的臂压成一个「已放行」
   布尔事实,端因此无法分级处置。
-  🔴 **三档强度,不是四档递减**(codex 复审 high 采纳;首版注把中间一格写成「硬证据」是过度声称):
+  🔴 **三档强度,不是四档递减**(对抗复审 high 采纳;首版注把中间一格写成「硬证据」是过度声称):
   **会话级证明** = `server_fail_closed` / `own_root`;**进程级成员证明** = `own_parent` —— own-run 台账是
   进程级 `Set`、按会话零分区,`/clear` 或换会话后**旧会话**的 run 仍命中(= 在册局限 **P-13** 在
   通知面的同一张脸),端**不得**把它读成「属于当前会话」;**非证据** = `absent_parent`(通知没带
   `parentTaskId`;老引擎/老帧形不带该键,fail-closed 会把自家通知整批吞掉)。端拿归属做有副作用的事
   (落库/跨会话搬运/翻别人的卡)时,后两格都应自裁为「未证明当前会话归属」。
   两参消费方(0.31.0 形)零改动照旧;接入说明见 `docs/INTEGRATION-CLIENTS.md` §6d。
-- **#284 尾件 / `parentTaskId` 脏形 fail-closed(行为面收紧,codex 复审第四轮 high)**:
+- **#284 尾件 / `parentTaskId` 脏形 fail-closed(行为面收紧,对抗复审第四轮 high)**:
   own/foreign 隔离门写成 `typeof === 'string' ∧ length>0 ∧ !isOwnEngineRun(…)` —— 对 number /
   object / array / boolean 这类脏值**整条不成立**,门不响、外来通知照收(还会被新 evidence 标成
   `absent_parent`,而那一格的语义是「老引擎**没带**这个键」= 谎报)。fleet 帧从 wire 上来、SDK 只
@@ -615,7 +690,7 @@
 
 ## 0.31.0(2026-08-16)
 
-**#242 批 3 fleet belt 对账承重批(design-242 §3 批 3;黑板 [4000] Q2=A / Q3=B 裁定执行)。
+**#242 批 3 fleet belt 对账承重批(design-242 §3 批 3;协作板 [4000] Q2=A / Q3=B 裁定执行)。
 🔴 BREAKING(行为面翻面两处,见下);公开面 additive 三件。**
 
 - 🔴 **BREAKING②/Q3 三腿翻面**:`getBgParentRun(x) ?? activeEngineRunId()` 的无条件回落**全部
@@ -787,7 +862,7 @@
 
 - **#244 F4 族D:配置/模型表单源化(A-028.17/.18/.20 三件单源上收 + A-028.19 对账钉,additive,
   零 BREAKING)**(2026-08-15;公开导出 707 → 724,+17 全 additive;常驻钉 = pure 门 F4D 段 35
-  checks + F4D-seat-catalog-pin 条件腿 4 checks(红先绿后:壳钉落地前该腿以断言红留证;codex
+  checks + F4D-seat-catalog-pin 条件腿 4 checks(红先绿后:壳钉落地前该腿以断言红留证;复审
   复审两处 [medium] 采纳 —— 腿剥注释锚初始化式防「删钉留注释」假绿、钉补精确等型轴防
   readonly/any 漂移,后者以 d.ts 变异 readonly 化 → 壳 typecheck 红实证)):
   - **件1 `model/providerCatalog.ts`(A-028.17)**:46 家 provider 表的**规范折表层** ——
@@ -823,7 +898,7 @@
 - **#280 移交两件:probeCause 随卡透传 + tail meta 帧发布口(additive,零 BREAKING)**(2026-08-15;
   红先绿后,常驻钉 = durable-card-display-keys ⑧ 段 10 checks + pure B7 probeCause 八钉 / B6
   tail-meta 六钉(含 fail-soft 两钉:sink 同步抛错不撕裂 tail / async 拒绝有界观察零
-  unhandledRejection —— codex 复审 [high] 采纳);壳 #280 围栏 T6 现状锁候本批包透传落地
+  unhandledRejection —— 对抗复审 [high] 采纳);壳 #280 围栏 T6 现状锁候本批包透传落地
   翻红接线):
   - **件1 `ApprovalCardRequest.probeCause` 透传**(server ≥7.21.0-rc #253 的结构化探针因由,
     `{code, roots:{shown,total}, further?}`):0.30.3 的两处「帧→卡入参」显式挑键把上游键丢弃 ——
@@ -892,7 +967,7 @@
     缺省读法留壳)· `RulesFailure` + `classifyRulesFailure`(处置分类,404 两支绝不共用一格)·
     `listAllPersistedRules` + `RulesFacade`(keyset 翻页收口:显式 limit 200 / 游标失效丢游标
     重列一次 / 页数硬帽,绝不交半份清单)· `classifySkippedReason`(散文前缀分类)。
-    ⚠️ 相对 cli 源形收紧两处(codex F2 两轮,各有门回归钉):
+    ⚠️ 相对 cli 源形收紧两处(复审 F2 两轮,各有门回归钉):
     ① `listAllPersistedRules` 的 params **不收调用方 cursor**(类型 `Omit<…,'cursor'>` + 运行期
     剥除留痕)—— 源形的 `...params` 会把外来 cursor 原样送出,「列全」从中途起步却报完整清单;
     ② 页体 **fail-closed 窄化** —— 源形把坏形 2xx 页(`{rev:9}` 无 rules 数组 / rev 非有限数 /
@@ -945,7 +1020,7 @@
   镜像脏值的正面证据 ⇒ 不 stand down 放行真分诊;>0 / 抛错 / 读口缺席 ⇒ 保守维持(存量装配零影响)。
   另导出 `INTERACTIVE_WAY_OUT`(默认出路串单源 —— 宿主 resume 对账腿等失败半场要说同一句真出路,
   各写一份必漂;覆盖语义照旧走 `ActiveRunSelfHealCopy.wayOut`)。
-- **#244 F1 · 复审跟修批**(2026-08-14;同窗 codex 轮一三条 + cli 换装批 G-c 尾竞态,红先绿后
+- **#244 F1 · 复审跟修批**(2026-08-14;同窗 复审 轮一三条 + cli 换装批 G-c 尾竞态,红先绿后
   G9⑥/⑦ 四断言):① `waitForClaimRelease` 被**窗自己的截止**掐断的探测不再作废上一发完成读数
   (404/传输错是「回答了不知道」才作废;不区分则 `confirmedHeld` 在窗尾随机翻 false,同输入两跑
   两种文案);② 假死锁复核读口加 **4s 有界窗**并合流 `deps.signal`(probe 恒不落地时整棵分诊树
@@ -972,7 +1047,7 @@
 
 ## 0.30.0 — 2026-08-14
 
-> 发车门清账完成:0.30.0 发版扫描 36 条 confirmed 全处置(codex 八轮终轮零新),
+> 发车门清账完成:0.30.0 发版扫描 36 条 confirmed 全处置(复审 八轮终轮零新),
 > 最后一门 P-30(`findPendingForTask` 门种闸)红先绿后闭环,29/29 门绿后发布。
 
 - **P-30:`findPendingForTask` 门种闸**(2026-08-14;**行为面** + 1 新导出;0.30.0 发车前最后一门):

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.38.0
+**Version:** 0.39.0
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -249,6 +249,7 @@ public-surface guard checks that last one).
 | `scripts/run-catalog-loader-gates-test.mjs` | The model-catalog candidate chain (`loadCatalogWithSources`) and the provider device-code seam: offline ⇒ `bundled` with an honest `online.reason`, a good source ⇒ `online` plus a cache write, a second offline run ⇒ `cacheHit`; the three hostile source shapes (malformed JSON, `schemaVersion: 99`, off-domain `http`) each fall through to the bundled table, and an off-allowlist target is **never dialled** — including a `302` to another host, proven by a real loopback server's hit counter staying at zero; a one-byte edit to `catalog.sha256` drops that source while an unavailable sidecar only warns; and the device-code poller's `pending → ok` / `expired` arms run against a real loopback HTTP server with an injected clock |
 | `scripts/run-abortable-sleep-test.mjs` | The shared `abortableSleep(ms, signal)` leaf (consumed by `workflowClient.ts` and `agentSession/backgroundView.ts`'s poll backoff): normal timeout resolution, immediate wake-up on `abort` mid-wait, `clearTimeout` really firing on that path, and a post-resolve late abort staying a no-op |
 | `scripts/run-durable-card-display-keys-test.mjs` | The durable approval row's two display keys survive the row→card recast in `surfaceFsApprovalAndDecide`: `governanceForced` stamps on strict `true` only (absence is "no evidence", never `false`), `ruleSuggestions` passes through the same shape-narrowing reader as the live-frame leg and lands on the **read-only** card key — plus a standing pin that the durable leg never stamps the redeemable `ruleSuggestions` card position (the `/decide` body has no rule slot; offering a "don't ask again" option there would be an affordance nothing can honour) |
+| `scripts/run-package-hygiene-test.mjs` | Everything `package.json` `files` ships — dist JS/typings and the Markdown docs — is screened line-by-line against a deny-list of strings that must never appear in a published artefact. The guard first proves each pattern still bites on a constructed sample (a screen that cannot fail is worse than none) and honours a per-pattern allow-list for legitimate product vocabulary, so the verdict is "clean surface", not "quiet grep". |
 | `scripts/run-integration-doc-freshness-test.mjs` | The **integration contract** (`docs/INTEGRATION-CLIENTS.md`) and the **changelog** (`CHANGELOG.md`) checked against the code, because a document with no guard rots — this one had a whole nest of drift found on it within a day of being written. Five directions, each a claim a machine can actually evaluate. (1) *Counting discipline*: the version-anchor row for the guard count may no longer carry a hand-copied number at all — it changes every time a guard is added, and writing it down is planting a timer; the export counts that are still hand-copied (the surface total, the test-hook count, the sentence describing the surface's internal composition, the sum of the sixteen domain rows, and the three sub-counts) are each compared against a value **derived** from `public-export-baseline.json`, which is the drift a human reviewer caught last time. (2) *Coordinates alive*: every `src/` `scripts/` `docs/` path the doc quotes must be on disk **and tracked by git** — on disk is not in the repo, and a doc that points readers at a file living only in its author's working tree sends every clone to nothing. A file landing in the same commit takes a named carve-out that **stops applying** the moment the file is really tracked (it can no longer let anything through, and the guard prints a line asking for it to be deleted) — deliberately not a red, since turning red on the very commit that lands the file would just manufacture a break that only a follow-up commit could clear. (3) *Arm tables*: the `hitl_out_of_slice` row and the `not_in_slice` fenced list must equal, name for name and in **both** directions, the case labels that really fall into those two buckets — read through the **TypeScript AST**, since which bucket an arm lands in is decided by the argument to `nothing(...)` and by nothing a comment says. The extractor is anchored to the one production projector: exactly one function named `eventToSdkMessage`, exactly one `switch (ev.type)` inside it, and no repeated case label — anything else is a broken anchor rather than a verdict, because a second same-shaped switch elsewhere in the file would otherwise overwrite the real one's conclusions and leave the doc agreeing with a switch nobody runs. The list is delimited by a machine-readable fence rather than by section headings, because the same section also names the terminal arms as a counter-example and prose boundaries cannot tell a member from a foil. (4) *Released sections are frozen*: an **append-only ledger** carries every version ever published — its number, the commit it was published from, and the sha256 of its section — and each one is checked, not just the current release, since pinning only the latest would set every earlier version free the moment the next one ships. The ledger cannot vouch for itself either: each recorded hash is **re-derived from that release commit** through git, so editing an old section and its constant together no longer passes — and the commit the row names is in turn checked against the `gitHead` npm recorded at publish time, which is the one value this repository cannot rewrite, so pointing an old version at a freshly written commit does not pass either. The *set* of versions that must be frozen comes from the registry too, so deleting an old row together with its section — which would otherwise remove that version from every set the guard looks at — is red rather than invisible. A failed registry call is classified rather than swallowed, and the classification consults the registry's own status code *before* it considers connection-level symptoms, so an auth refusal whose body happens to mention the network is still red rather than a skip. The version set is compared as full SemVer including prereleases — matching only `x.y.z` would silently drop a published `0.30.0-beta.1` and reopen the very hole this direction closes — and section headings are matched on a whole-version boundary so a stable release cannot bind itself to the release-candidate section sitting above it. Publishing itself is a two-phase protocol rather than a paradox: before a release, exactly one row may be marked pending and must name the current `package.json` version, exempt from the checks whose inputs do not exist yet; once the registry has that version the row must be promoted, so the temporary state cannot survive its own release. And because the pending exemption rests entirely on "this version is not out yet," it is refused outright when the registry cannot be reached to confirm that — an unverifiable premise is not a licence. Three reverse directions close the rest: a section claiming to be released but absent from the ledger, a ledger entry whose section has vanished, and a `package.json` version that was never frozen. Publishing appends a row; it never rewrites one. (6) *Sentinels*: the readers §5a hands hosts for "is this port installed" are checked against what the source actually declares it returns — `hasXxx()` is a `boolean`, the card port / HITL surface / wire target return `T | null`, the `installHost` family returns `T | undefined`. Testing a `null`-returning reader for `!== undefined` is *always true*, and a self-check that passes whether or not the port is installed is worse than none, because hosts retire their own fallback on the strength of it. Both directions are red: an implementation that changes its sentinel without the doc following, and a doc that names the wrong one. The roster covers the zero-argument readers and their `*For` variants alike — a multi-session host reads the variants, so leaving them off would let exactly the surface desktop depends on drift unwatched — and the §5a table and the §8-B checklist line are each checked against the source, because hosts tick the checklist, and a guard that only watches the prose table misses the line people actually follow. (5) *Packaging*: the README ships with the package and opens by pointing hosts at the integration doc, and the checklist names two more files as required reading before an upgrade — all three must really appear in the `npm pack` manifest, or an npm consumer follows a relative link that npmjs rewrites onto a private repository. Missing tooling never takes the whole verdict down with it: when git, npm or the registry is unreachable those legs print the `SKIPPED-SECTION` marker and the rest still judges, while a release commit the ledger names but git cannot resolve is red rather than skipped. The guard says in its own header what it does **not** do: it judges counts, coordinates, arm sets, released bytes and the packing list — whether a sentence is *right* is still for review and for the hosts to report |
 | `scripts/run-type-superset-ledger-test.mjs` | The type/wire **superset ledger** (`docs/type-superset.json`): positions this package adds on top of a CC-shaped contract, each carrying the evidence for what CC's own type surface does or does not have there. Completeness is deliberately uneven and the ledger says so. The `_sema_*` private-key class is checked in **both** directions (a key in the source that never entered the ledger is red, naming key and file; a ledger row whose key left the source is red) — but only for keys written as literals, which is the convention the ledger mandates. A key assembled by string arithmetic is beyond what any static rule can enumerate, so the guard fails closed on every shape it *can* decide (a bare `_sema_` prefix is red wherever it appears, save one pinned guard site) and leaves the rest as a convention violation for review to catch, rather than claiming a completeness it does not have. The two hand-surveyed classes are only checked for coordinate and evidence integrity, never discovered. Both directions read the source through the **TypeScript AST**, not a text scan, and they read two different sets out of it. A *key site* is an identifier, or a string whose whole value is the key — so `'_sema_decision-v2'` is carried whole rather than truncated at the first non-identifier character into some *other* key that happens to be registered. A *mention* is the key appearing inside a longer string, which is prose, not usage. The staleness direction counts key sites only: a comment or a doc sentence left behind after the last real mint site is deleted must not keep the row alive (mutation-proven — with both the comment and the prose string untouched, removing the one real site turns the guard red). And because a prefix can be concatenated or interpolated into a key no static set will ever see, the bare `_sema_` literal is refused outright rather than traced: every occurrence is red except the single inline `startsWith` guard the sanitizer needs, because the set of expressions a bare prefix can travel through on its way to a concatenation is open-ended and enumerating it is always one form behind. Every row's `host` must still resolve, with the key being a real **member of that declaration** rather than a string occurring somewhere in the same file — `governanceForced`/`delegation` each live on two different shapes in one file, and a member commented out is a member deleted, which a text-shaped check happily reads as still present. And the direction worth the most: each machine-form `ccAbsenceEvidence` is re-derived from the row's own `key` — the ledger's recorded string must match that derivation verbatim, since a row quietly witnessing `\bnever_present\b` is green forever while watching nothing (mutation-proven: the same edit passes the unbound form and is caught by the bound one) — and the check runs against the names the installed `@sema-agent/agent-types` `.d.ts` set actually declares, parsed with the TypeScript AST rather than grepped, so a name CC merely mentions in a comment cannot force the row into the manual escape hatch and thereby retire the very witness that was supposed to fire the day CC declares that name for real. That escape hatch is gated by an allowlist living **in the guard**, not the ledger, so claiming it costs a reviewed diff. Missing material never reads as a pass, and the verdict splits by *why* it is missing: no TypeScript parser skips the suite before it starts; a missing `agent-types` still runs and prints the first three directions, then exits **1** when `package.json` declares the mirror but it is not installed — a broken install must not retire the repository's only "the day CC declares this name" alarm, and reporting it as a skip would leave "never evaluated" and "evaluated, no drift" indistinguishable to the runner — and exits 3 only when nothing declares the mirror at all, which is the one case where the direction genuinely does not apply. Either way a run that evaluated no witness is never counted as one that did. When the mirror *is* present its **installed version** is witnessed too (the two declared floors must agree with each other and the installed copy must meet them), since four preflight probes are satisfied by an arbitrarily stale mirror — they prove the extractor speaks, not that it is current. Every direction carries a positive control — known-present CC symbols, a comment-only sample proving the extractor distinguishes declaration from mention, and synthetic corpora fed through the **same** discriminator function the real verdict uses, so a verdict quietly rewritten to return nothing takes its own control down with it |
 | `scripts/run-rules-side-test.mjs` | The persisted-permission-rules lane's shared decision half. The two capability bits are checked as **two independent gates** — a worker can honestly advertise the rules lane while predating the revoke routes, and that shape must *hide* the governance surface rather than render a dead entry. Failure classification is by **disposition, not cause**: the two 404s (route missing vs. dead ticket) never share a bucket, a 503 `rule_import_retry` means *the ticket is still alive* (the opposite handling of a dead one), and a stale-cursor 400 drops the cursor and re-lists from the top exactly once — never resuming a stale keyset, never surfacing a partial governance list, and never paging past the hard cap. The persist-ack reader is **merged into** `readToolApprovalRespondAck`: the three-state verdict (`persisted` / `refused` / `unknown`) is derived only from an ack that passed the package's structural narrowing, and a half-shaped object such as `{rulePersisted: true}` with no `delivery` reads as `unknown` — the pre-merge shell read would have said `persisted`, which is precisely the double-ledger drift this file closes, so that case is pinned in reverse. The local-allow-rule skeleton pins all five narrowings (whole-tool, tool-name match, literal anchor with the escaped-star counter-example, bare interpreter prefix consulted only for Bash, and the canonical dangerous-pattern overlay) **with their refusal strings byte-for-byte** — the cli's 128-assertion suite anchors the same strings, so a one-character edit here changes observable behaviour on three clients — and asserts the parse is a pure function of its input, because the same call backs both "render the option" and "resolve the selected value" |

package/dist/adapter/activeRunSelfHeal.d.ts

@@ -256,7 +256,7 @@ export type SelfHealOutcome =
     taskId: string;
 }
 /**
- * 存活对账腿(codex 对抗复审 [high] 采纳,2026-08-19):wire 409 说这条 run `running`,而出卡前的
+ * 存活对账腿(对抗复审 [high] 采纳,2026-08-19):wire 409 说这条 run `running`,而出卡前的
  * `runs.get` 读回**终态词**({@link CLAIM_RELEASED_STATES})—— run 已终结,claim 是陈旧/释放中的
  * 投影([4664] 洞③:409 与 poll 口径短暂相左)。三选卡不呈(steer/cancel 对已终结的 run 全是假
  * affordance),也**不自动重发**(claim 可能尚未真正落地释放)—— 如实说 + 「再发一次」真出路。

package/dist/adapter/activeRunSelfHeal.js

@@ -219,7 +219,7 @@ const RUNNING_LIVENESS_RECHECK_TIMEOUT_MS = 4_000;
 //     走 {@link clearRunningChoiceOffer}。
 // run 身份变化天然换键(taskId 不同);同 run 状态迁移到 park 态会走别的臂,登记不拦。
 const runningChoiceDeclined = new Set();
-/** 登记表上限(codex 复审轻形采纳):超限 FIFO 驱逐最老条目 —— 驱逐代价 = 卡重弹一次(修前行为)。 */
+/** 登记表上限(对抗复审轻形采纳):超限 FIFO 驱逐最老条目 —— 驱逐代价 = 卡重弹一次(修前行为)。 */
 const RUNNING_CHOICE_LEDGER_CAP = 512;
 function runningChoiceDeclineKey(sessionId, taskId) {
     // NUL 分隔：两段都是外来串，可打印分隔符在「sessionId 里恰有它」时会串键。
@@ -378,7 +378,7 @@ export async function attemptActiveRunSelfHeal(signal, runs, deps) {
         // [3892]-[3899] 假死锁防御(deps.listOwnedPendingApprovals 头注全案):镜像说有卡 ⇒ 向引擎
         // 复核一次属主 pending 行数。恰 0 = 镜像脏值的**正面证据**(引擎侧没有任何等这个用户的决定)
         // ⇒ 放行真分诊;抛错/非 0 ⇒ 保守维持(真卡在屏时 stand down 是对的)。
-        // 🔴 复核必须**有界且可回收**(codex #244 F1 轮一 [high] + 轮二 [medium]×2):
+        // 🔴 复核必须**有界且可回收**(复审 #244 F1 轮一 [high] + 轮二 [medium]×2):
         //   · probe 恒不落地(引擎挂死且读口无自带超时)不许把整棵分诊树挂死 —— 假死锁防御自己变成
         //     真死锁;窗尽/调用方中止 = 分不出真卡与幽灵,与抛错同臂保守 stand down;
         //   · 合流 signal **真交到 probe 上**(超时/中止掐的是底层请求,不是只掐调用方的 await);
@@ -553,7 +553,7 @@ async function runningChoiceArm(taskId, status, busy, statusFromWire, runs, deps
         }
         if (ghost)
             return { kind: 'running-not-found', taskId };
-        // (codex 复审 [medium] 采纳)对账期间用户中止 ⇒ 后续一切动作(派臂/出卡/登记)都不做 ——
+        // (对抗复审 [medium] 采纳)对账期间用户中止 ⇒ 后续一切动作(派臂/出卡/登记)都不做 ——
         // Esc 之后还弹卡/重开 = 用户说停还在动。零动作现状行收口(与呈卡腿抛错同一条诚实收口)。
         if (probeCallerAborted())
             return notParked;
@@ -562,7 +562,7 @@ async function runningChoiceArm(taskId, status, busy, statusFromWire, runs, deps
                 return planReviewArm(taskId, busy, deps);
             if (ASK_PARK_STATES.includes(fresh))
                 return askParkArm(taskId, busy, deps);
-            // (codex 复审 [high] 采纳)终态词 ⇒ 专属结局:not-parked 的「wait for it to finish」对一条
+            // (对抗复审 [high] 采纳)终态词 ⇒ 专属结局:not-parked 的「wait for it to finish」对一条
             // 已终结的 run 是永远等不到的假话。表外的未知词仍落 not-parked 如实说(不替引擎断言终结)。
             if (CLAIM_RELEASED_STATES.includes(fresh))
                 return { kind: 'running-settled', taskId, status: fresh };
@@ -590,7 +590,7 @@ async function runningChoiceArm(taskId, status, busy, statusFromWire, runs, deps
     if (choice === 'wait') {
         if (offerDelivered) {
             runningChoiceDeclined.add(declineKey);
-            // (codex 复审 [medium] 轻形采纳)FIFO 有界:长命桌面/多会话宿主不许无界长住。驱逐最老条目的
+            // (对抗复审 [medium] 轻形采纳)FIFO 有界:长命桌面/多会话宿主不许无界长住。驱逐最老条目的
             // 代价 = 那条 run 的卡重弹一次(= 修前行为,方向安全);Set 按插入序迭代,首项即最老。
             if (runningChoiceDeclined.size > RUNNING_CHOICE_LEDGER_CAP) {
                 const oldest = runningChoiceDeclined.values().next().value;
@@ -961,7 +961,7 @@ function activeRunSelfHealBaseRow(outcome, signal, wayOut) {
                 `longer exists). sema did not offer to steer or cancel it: there is nothing left to act on. ` +
                 `Your message was NOT sent; send it again (if the session really is free it will just run), or ${wayOut}.`);
         case 'running-settled':
-            // codex 复审 [high] 采纳:run 已终结而 claim 仍报 running([4664] 洞③的窗口形)——
+            // 对抗复审 [high] 采纳:run 已终结而 claim 仍报 running([4664] 洞③的窗口形)——
             // 「wait for it to finish」对它是永远等不到的假话;真出路 = 再发一次(claim 落地即跑)。
             return (`Run ${outcome.taskId} has already finished (status ${outcome.status}), but the engine still ` +
                 `reported it as holding this session — that claim looks stale or mid-release. sema did not offer ` +

package/dist/adapter/downstream/eventToSdkMessage.js

@@ -632,7 +632,7 @@ function engineNoticeProjection(ev, ctx) {
         //  · `eventSeq` —— **SDK 从 SSE `id:` 字段 stamp 上来的 durable 序号**(= `task_event.seq`,
         //    见 sdk `dist/sse.js` 的 `ev.id = frame.id`;本包的规范访问口就是 `adapter/types.eventSeq`)。
         //    它对「同一条账本行」是稳定的,重放会带同一个值。
-        // 🔴 codex 对抗复审 [medium] 采纳(2026-08-21):首版只带 `eventId`,于是 body 不带它时本臂
+        // 🔴 对抗复审 [medium] 采纳(2026-08-21):首版只带 `eventId`,于是 body 不带它时本臂
         //    给消费端留的唯一去重口是 `code+ts` —— 而 `ts` 是**server 观察时刻(ms)**,同一毫秒里同码
         //    的两条不同通告会被折成一条(真事实丢失),跨重连的同一条又可能因为观察时刻不同而重复。
         //    明明有一个稳定序号在手却不带,是本层自己把可靠性降级了。

package/dist/agentSession/backgroundView.d.ts

@@ -26,7 +26,7 @@
  *     能探则探:`GET /v1/capabilities` 的 **`approvals`** 位为 false ⇒ 'not-configured';
  *     caps 面自己不可达 ⇒ 判别缺席,**如实回 'ok'**(绝不编造判别)。
  *
- *     🔴 件 3 考据(读错键的定谳,协作板 [C33]③.3 → server [C34],server 3.13.0 已把辖域写进
+ *     🔴 件 3 取证(读错键的定谳,协作板 [C33]③.3 → server [C34],server 3.13.0 已把辖域写进
  *     代码注与 ARCHITECTURE):本实现此前读 `scheduler`,那是**错的键**。
  *       · `/v1/assistant/*` 的挂载条件是 `checkpointStore`(server `routes/approvals-assistant.ts:67`
  *         的分支头:`if (deps.checkpointStore && (url.startsWith("/v1/approvals") ||

package/dist/agentSession/backgroundView.js

@@ -169,7 +169,7 @@ export function createBackgroundView(client, opts) {
         }
     }
     /** caps 只需探到一次;失败保持 null 下轮重试(caps 面挂 ≠ assistant 面挂,判别缺席不编造)。
-     *  🔴 读的是 `approvals` 不是 `scheduler` —— 考据见头注「'not-configured' 判别」节件 3。 */
+     *  🔴 读的是 `approvals` 不是 `scheduler` —— 取证见头注「'not-configured' 判别」节件 3。 */
     async function probeCaps() {
         if (capsApprovals !== null)
             return;

package/dist/engineErrorCodes.d.ts

@@ -76,14 +76,44 @@ export declare const CONFIG_REFUSAL_CODES: ReadonlySet<string>;
 /** 并发帽:这棵树此刻活着的委派席位已达 `delegationEntryCaps.maxConcurrent`(CC 对齐缺省 20)。
  *  🔴 处置 = **可等**(兄弟结束即有位),别渲成「配置要改」。 */
 export declare const DELEGATION_CONCURRENCY_CAP = "delegation.concurrency_cap";
-/** 会话累计帽:这棵树累计创建的委派席位已达 `maxCumulativePerSession`(CC 对齐缺省 200)。
- *  🔴 处置 = **等也没用**(配额是这条会话这辈子的),别渲成「稍后重试」。 */
+/** 累计帽:这棵树在 **retained window** 内创建的委派席位已达 `maxCumulativePerSession`
+ *  (CC 对齐缺省 200)。🔴 处置 = **复用既有 agent(SendMessage)或候 retention 回收**(行被
+ *  reap 后配额恢复 —— core 计数前先剪 ledger,见族注),别渲成「换会话」或「改配置」。 */
 export declare const DELEGATION_SESSION_CAP = "delegation.session_cap";
 /** 委派席位到限码识别表(**开集**:core 可能再加第三根轴)。两员处置不对称,消费点禁合并分支。 */
 export declare const DELEGATION_CAP_CODES: ReadonlySet<string>;
 /** `delegation.` 前缀谓词 —— **开集**判别(与 {@link isConfigRefusalCode} 同款)。缺席/空串 ⇒ false。
- *  🔴 它只回答「这是不是一条委派席位拒绝」;**该等还是该换会话**必须按成员分,见两码各自的注释。 */
+ *  🔴 它只回答「这是不是一条委派席位拒绝」;**该等新槽还是该复用既有 agent**必须按成员分
+ *  ({@link delegationCapDispositionOf}),见两码各自的注释。 */
 export declare function isDelegationCapCode(code: string | undefined): boolean;
+/**
+ * 委派席位到限的**处置轴**(0.39.0 消费件:两员处置不对称的机器可读形)。单源在本包 ——
+ * 「哪个码该等、哪个码等也没用」是判定不是文案,端各自再抄一份就回到本文件要根除的散抄病。
+ */
+export type DelegationCapDisposition = 
+/** 可等:活着的兄弟结束就有位,同一条命令过一会儿照样成(别渲成「配置要改」)。 */
+'wait-for-slot'
+/** 复用而不是新开:retained-window 计数满了 —— 用 SendMessage 续既有 agent(core 文案的
+ *  推荐出路),或候 retention 回收行后配额恢复(别渲成「换会话」/「永久耗尽」)。 */
+ | 'reuse-existing-or-await-reap';
+/** 两成员各归各格;未知 `delegation.*` 码(core 的第三根轴)⇒ `undefined` —— 开集纪律:不认得
+ *  就不给处置,消费点必须留「只报码不指路」的 default 臂,绝不塌进任何一格替引擎指路。 */
+export declare function delegationCapDispositionOf(code: string | undefined): DelegationCapDisposition | undefined;
+/**
+ * 已吊销 MCP server 上的调用被拒。core `dist/core/mcp.js` **三个铸点同码**(远端工具调用 /
+ * 资源读取 / 目录列举)。载体与 `delegation.*` 两码同批:`{ error, code }` 双键同值 ⇒
+ * `tool_end.errorCode`(core ≥5.50.0;载体门 = engine-vocab G3 腿)。
+ * 🔴 **哪个 server 被吊销,今天 wire 上拿不到**(异源对抗复审命中,如实登记):core 的
+ * detail 确有 `server` 键,但它是**进程内** result 体 —— 抬升腿只 lift `code`,且该 detail 无
+ * `type` 进不了 `structured` ⇒ 端只有码没有名。**别按 output 文案抠 server 名当机器判据**
+ * (文案是模型面散文,不是契约);归因渲染候上游补 typed detail / tool_end 字段(诉求已
+ * 随 0.39.0 发布帖点名 core,表态制)。
+ * 🔴 语义三条,一条都别渲错:
+ *   · **请求没发出去**(core 文案原话 "The request was NOT sent")—— 是本地闸,不是远端失败;
+ *   · 这不是故障也不是配置坏了,是**操作员的治理动作** —— 别渲成「服务器错误,稍后重试」;
+ *   · 同 server 重试**无意义**,直到它被重新批准;工具表在下一 turn 更新(core 文案原话)。
+ */
+export declare const MCP_SERVER_REVOKED = "mcp.server_revoked";
 /** `config.` 前缀谓词 —— **开集**判别:5.10.0 之后每一波「不许静默折叠」都会往这一族加词,
  *  按前缀判的消费点不必跟车,按成员判的必须跟车。缺席/空串 ⇒ false。 */
 export declare function isConfigRefusalCode(code: string | undefined): boolean;

package/dist/engineErrorCodes.js

@@ -89,27 +89,35 @@ export const CONFIG_REFUSAL_CODES = new Set([
 ]);
 // ── 委派席位到限族(core 5.48.0 design/323,[4743] @cli 点名的「两新 coded 拒绝」)──────────────
 //
-// 语义:一次 Task/SendMessage 委派因为**席位帽**被拒 —— 不是配置坏了(那是上面的
-// `config.delegation_entry_caps`),也不是失败了,而是「现在不行」。两码**处置不同,禁合并**:
+// 语义:一次**新开委派**(Task 铸新席位)因为**席位帽**被拒 —— 不是配置坏了(那是上面的
+// `config.delegation_entry_caps`),也不是失败了,而是「现在不行」。SendMessage **复活**走
+// revive 短路:core 只对它查并发帽、**跳过**累计帽(dist/agents/subagent.js:累计检查包在
+// `reviveRow === undefined` 里)—— 这正是累计帽处置指向「复用」的机器面依据。两码**处置不同,
+// 禁合并**:
 //   · 并发帽 ⇒ **等**:活着的兄弟结束就有位,同一条命令过一会儿照样成;
-//   · 会话累计帽 ⇒ **等也没用**:这棵树这辈子的配额用完了,要么换会话要么抬 deps 旋钮。
-// 把两者渲成同一句「委派失败」会让第一种情形的用户去改配置,第二种情形的用户去干等。
+//   · 累计帽 ⇒ **复用而不是新开**:计数是 **retained-window 帐**(core 计数前先把不在
+//     stored/active 里的 handle 从 ledger 剪掉 —— 行被 retention 回收后配额**会回来**),core
+//     文案原话即 "in its retained window … Continue an existing agent (SendMessage) instead of
+//     launching new ones"。渲成「这条会话这辈子的配额用完了」是**错的**(0.38.0 段曾这么写,
+//     0.39.0 勘误;异源对抗复审命中):会把一个「换 SendMessage 姿势就能继续」的用户赶去换会话。
+// 把两者渲成同一句「委派失败」会让第一种情形的用户去改配置,第二种情形的用户去白等新槽。
 //
-// 🔴 **载体如实登记(2026-08-21 亲验,别按 `tool_end.errorCode` 写消费码)**:core 把这两码铸进
-//    Task 工具结果体的 `details.error`(`subagent.ts` 的 `capRefusal`),而 core 的 `errorCode`
-//    抬升腿(`runner/runtask.ts`)只读 `details.code` → `details.errorKind` **两个拼法**,
-//    `structuredFrom` 又要求 `details.type` 落在 `CC_DETAIL_TYPES` 里(这条 detail 连 `type` 都没有)
-//    ⇒ **今天这两码在 wire 上既不在 `tool_end.errorCode`、也不在 `structured`**,只剩模型面文案
-//    ("Sub-agent not started in background: …")。
-//    ⇒ 本词表**先立词、不落消费分支**:按文案反解正是本文件存在的理由要根除的东西
-//    ([cross-repo-fix-at-source-constitution]:载体缺口在 core,下游不许侧路补救)。
-//    上游诉求已登记(见 CHANGELOG 0.38.0 段):core 补 `details.code` 孪生拼法(或抬升腿兼读
-//    `details.error`)之后,消费分支在本包同批接上,**判定归本包、文案归端**。
+// 🔴 **载体现势(2026-08-21 二次亲验,core 5.50.0 dist node 直读)**:0.38.0 曾如实登记「这两码
+//    只铸进 Task 工具结果体的 `details.error`,而 core 的 `errorCode` 抬升腿只读 `details.code` →
+//    `details.errorKind` 两个拼法 ⇒ wire 上拿不到」,故先立词、消费分支候载体(上游诉求随
+//    0.38.0 发布登记)。core 5.50.0 已兑现:`capRefusal` 铸 `{ error: code, code }` **孪生拼法**
+//    (`dist/agents/subagent.js`),抬升腿(`dist/core/runner/runtask.js` `toolEndBodyFrom`)读
+//    `details.code` 后 stamp 帧顶层 ⇒ **两码自 core ≥5.50.0 起真出现在 `tool_end.errorCode`**。
+//    消费分支 0.39.0 同批接上:**判定归本包**({@link delegationCapDispositionOf}),文案归端。
+//    载体门 = `run-engine-vocab-floor-test.mjs` G3 腿(锚 dist 铸点与抬升腿口径,孪生消失当场红,
+//    不许安静绿回去)。旧引擎(5.48/5.49)上两码仍只在模型面文案里 —— 消费点拿不到码就什么都
+//    别渲,**绝不按文案反解**([cross-repo-fix-at-source-constitution] 依旧适用)。
 /** 并发帽:这棵树此刻活着的委派席位已达 `delegationEntryCaps.maxConcurrent`(CC 对齐缺省 20)。
  *  🔴 处置 = **可等**(兄弟结束即有位),别渲成「配置要改」。 */
 export const DELEGATION_CONCURRENCY_CAP = 'delegation.concurrency_cap';
-/** 会话累计帽:这棵树累计创建的委派席位已达 `maxCumulativePerSession`(CC 对齐缺省 200)。
- *  🔴 处置 = **等也没用**(配额是这条会话这辈子的),别渲成「稍后重试」。 */
+/** 累计帽:这棵树在 **retained window** 内创建的委派席位已达 `maxCumulativePerSession`
+ *  (CC 对齐缺省 200)。🔴 处置 = **复用既有 agent(SendMessage)或候 retention 回收**(行被
+ *  reap 后配额恢复 —— core 计数前先剪 ledger,见族注),别渲成「换会话」或「改配置」。 */
 export const DELEGATION_SESSION_CAP = 'delegation.session_cap';
 /** 委派席位到限码识别表(**开集**:core 可能再加第三根轴)。两员处置不对称,消费点禁合并分支。 */
 export const DELEGATION_CAP_CODES = new Set([
@@ -117,10 +125,36 @@ export const DELEGATION_CAP_CODES = new Set([
     DELEGATION_SESSION_CAP,
 ]);
 /** `delegation.` 前缀谓词 —— **开集**判别(与 {@link isConfigRefusalCode} 同款)。缺席/空串 ⇒ false。
- *  🔴 它只回答「这是不是一条委派席位拒绝」;**该等还是该换会话**必须按成员分,见两码各自的注释。 */
+ *  🔴 它只回答「这是不是一条委派席位拒绝」;**该等新槽还是该复用既有 agent**必须按成员分
+ *  ({@link delegationCapDispositionOf}),见两码各自的注释。 */
 export function isDelegationCapCode(code) {
     return typeof code === 'string' && code.startsWith('delegation.');
 }
+/** 两成员各归各格;未知 `delegation.*` 码(core 的第三根轴)⇒ `undefined` —— 开集纪律:不认得
+ *  就不给处置,消费点必须留「只报码不指路」的 default 臂,绝不塌进任何一格替引擎指路。 */
+export function delegationCapDispositionOf(code) {
+    if (code === DELEGATION_CONCURRENCY_CAP)
+        return 'wait-for-slot';
+    if (code === DELEGATION_SESSION_CAP)
+        return 'reuse-existing-or-await-reap';
+    return undefined;
+}
+// ── MCP 吊销族(core 5.50.0;操作员 mid-session 吊销 server 后的工具面拒绝)────────────────────
+/**
+ * 已吊销 MCP server 上的调用被拒。core `dist/core/mcp.js` **三个铸点同码**(远端工具调用 /
+ * 资源读取 / 目录列举)。载体与 `delegation.*` 两码同批:`{ error, code }` 双键同值 ⇒
+ * `tool_end.errorCode`(core ≥5.50.0;载体门 = engine-vocab G3 腿)。
+ * 🔴 **哪个 server 被吊销,今天 wire 上拿不到**(异源对抗复审命中,如实登记):core 的
+ * detail 确有 `server` 键,但它是**进程内** result 体 —— 抬升腿只 lift `code`,且该 detail 无
+ * `type` 进不了 `structured` ⇒ 端只有码没有名。**别按 output 文案抠 server 名当机器判据**
+ * (文案是模型面散文,不是契约);归因渲染候上游补 typed detail / tool_end 字段(诉求已
+ * 随 0.39.0 发布帖点名 core,表态制)。
+ * 🔴 语义三条,一条都别渲错:
+ *   · **请求没发出去**(core 文案原话 "The request was NOT sent")—— 是本地闸,不是远端失败;
+ *   · 这不是故障也不是配置坏了,是**操作员的治理动作** —— 别渲成「服务器错误,稍后重试」;
+ *   · 同 server 重试**无意义**,直到它被重新批准;工具表在下一 turn 更新(core 文案原话)。
+ */
+export const MCP_SERVER_REVOKED = 'mcp.server_revoked';
 /** `config.` 前缀谓词 —— **开集**判别:5.10.0 之后每一波「不许静默折叠」都会往这一族加词,
  *  按前缀判的消费点不必跟车,按成员判的必须跟车。缺席/空串 ⇒ false。 */
 export function isConfigRefusalCode(code) {

package/dist/fleet/fleetLedger.d.ts

@@ -121,7 +121,7 @@ export type HookNoticeFrame = Extract<FleetFrame, {
  * 端因此无法对不同强度的证据分级处置(强证据可直接落库/翻卡,弱证据宜先渲染、别拿它当归属结论)。
  * 判据锚在**实际命中的那条臂**上,不是锚在「有没有 parentTaskId」这类前置条件上。
  *
- * 🔴 **每个词命名的是「放行臂」,不是「归属结论」**(codex 复审两轮收紧:首版把 `own_parent` 写成
+ * 🔴 **每个词命名的是「放行臂」,不是「归属结论」**(对抗复审两轮收紧:首版把 `own_parent` 写成
  *    「硬证据」、二版只给 `own_root` 挂了会话锚警告,都是过度声称)。强度分档如下 —— 前两格的
  *    会话级读法**带前提**,第三格永远只是进程级,第四格根本不是证据。
  *

package/dist/fleet/fleetLedger.js

@@ -214,7 +214,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                 for (const row of frame.tasks) {
                     taskMap.set(row.id, row);
                     rowMeta.set(row.id, { receivedAtMs });
-                    // #242 批 3(codex P-F1,红先绿后=B3-G4b):snapshot(重连 REPLACE)腿与增量 task 帧腿
+                    // #242 批 3(复审 P-F1,红先绿后=B3-G4b):snapshot(重连 REPLACE)腿与增量 task 帧腿
                     // 的复活语义**同权** —— snapshot 带回的非终态行,其全部别名(同尾段)的 belt 退休条目
                     // 一并清,否则重连别名切换(裸 id 退休 → 复合 id running 回归)会产出「复合 running +
                     // 裸 completed(带标)」双影。终态行不清(与增量腿同判);snapshot 里**没有**的任务,
@@ -350,7 +350,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
             debug('[fleet-frame] MALFORMED bg_notification dropped(taskId 或 status 缺席/非串)');
             return;
         }
-        // 🔴 #284 尾件(codex 复审第四轮 high,红先绿后=B3-DIRTY):`parentTaskId` 是**隔离判据的锚**,
+        // 🔴 #284 尾件(对抗复审第四轮 high,红先绿后=B3-DIRTY):`parentTaskId` 是**隔离判据的锚**,
         //    它的脏形必须先于判据处置。下面那道 own/foreign 门写成
         //    `typeof === 'string' && length > 0 && !isOwnEngineRun(…)` —— 对 number/object/boolean
         //    这类脏值**整条不成立** ⇒ 门不响、通知照收,而新的 evidence 还会把它标成 `absent_parent`
@@ -400,7 +400,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
         //    `parentTaskId` 在不在分开(走到这里且带非空 parentTaskId ⇒ 它必然 ∈ own-run 台账,
         //    否则上面已丢弃)。多臂同时成立报第一条 —— 报的是「这一帧**实际**靠哪条过的门」,
         //    不是「最强的那条理论上也成立」。
-        // 🔴 非默认 sessionKey 封顶(0.32.0 发包前扫码采 codex 折中,P-31 的诚实半步):前两格的
+        // 🔴 非默认 sessionKey 封顶(0.32.0 发包前扫码采 复审 折中,P-31 的诚实半步):前两格的
         //    会话级读法前提=「这条流是按本 ledger 的会话开的」,而开流参数只认默认槽 ⇒ keyed ledger
         //    上该前提**无法成立也无法校验**。封顶词=`session_anchor_untrusted`(不降到 own_parent:
         //    经 serverFailClosed/ownByRoot 放行的帧,其 parentTaskId 可能是 foreign——标进程成员是

package/dist/hitl/armedGateRegistry.d.ts

@@ -43,7 +43,7 @@ export declare function waitForGateArmedFor(sessionKey: string, keys: readonly s
 /** 宿主呈现面登记口:收到可渲染 question 帧即记(键归一见 gateIdentity;坏形静默忽略 ——
  *  id 是 wire/合成位,入参按边界收 unknown,本函数就是窄化动作本身)。
  *
- *  尝试级回执(#250 codex 轮二 [medium]):原始帧 id 自带 `#reopen-*` 尝试序号,是现成的
+ *  尝试级回执(#250 复审 轮二 [medium]):原始帧 id 自带 `#reopen-*` 尝试序号,是现成的
  *  attempt token —— 归一键之外**事件级**再发一枪原始 id(不入 Set,台账词汇保持归一键)。
  *  重开臂锚它,同 gate 两次在飞重开时一次真入队只唤对应那次尝试,不再同键互唤。 */
 export declare function registerArmedGateFromQuestionId(questionId: unknown): void;

package/dist/hitl/armedGateRegistry.js

@@ -231,7 +231,7 @@ function armedKeyForQuestionIdFor(sessionKey, questionId) {
 /** 宿主呈现面登记口:收到可渲染 question 帧即记(键归一见 gateIdentity;坏形静默忽略 ——
  *  id 是 wire/合成位,入参按边界收 unknown,本函数就是窄化动作本身)。
  *
- *  尝试级回执(#250 codex 轮二 [medium]):原始帧 id 自带 `#reopen-*` 尝试序号,是现成的
+ *  尝试级回执(#250 复审 轮二 [medium]):原始帧 id 自带 `#reopen-*` 尝试序号,是现成的
  *  attempt token —— 归一键之外**事件级**再发一枪原始 id(不入 Set,台账词汇保持归一键)。
  *  重开臂锚它,同 gate 两次在飞重开时一次真入队只唤对应那次尝试,不再同键互唤。 */
 export function registerArmedGateFromQuestionId(questionId) {
@@ -241,7 +241,7 @@ export function registerArmedGateFromQuestionId(questionId) {
 export function registerArmedGateFromQuestionIdFor(sessionKey, questionId) {
     if (typeof questionId !== 'string' || questionId.length === 0)
         return;
-    // 🔴 canonical 复用的去重记号过期(codex #244 F1 轮一 [medium]):arm 臂对同 run 每只 plan gate
+    // 🔴 canonical 复用的去重记号过期(复审 #244 F1 轮一 [medium]):arm 臂对同 run 每只 plan gate
     // 都复用 `plan-review:<taskId>` 这个 canonical id —— 决断记账按完整 questionId 去重,若记号不随
     // 卡换代过期,第二只 canonical 卡的决断会撞上第一只留下的记号 ⇒ 不推代 ⇒ 第三只门的重开又谎报
     // 「被关过」。**新 canonical 卡的呈现**就是「上一张同 id 卡已消解、这是新实例」的宿主侧可见时刻,