@sema-agent/server 7.100.0 → 7.101.1

package/dist/server-secret-env.js

@@ -15,4 +15,13 @@ export function scrubServerSecrets(env, findings) {
     }
     return out;
 }
+export function allowlistedEnv(names, env) {
+    const out = {};
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined)
+            out[name] = value;
+    }
+    return out;
+}
 //# sourceMappingURL=server-secret-env.js.map

package/dist/tool-approval.d.ts

@@ -124,7 +124,8 @@ export interface StandingAnswerFacts {
  * **自己**的位 —— core 每一次过闸(含 failover / 重启后的重入)都由 `runGateLanes` 里的 `stampAskOrigin`
  * 重新盖、经同一处的 `carryOf` 带上 `AskRequest`,读侧手里的 `req` 恒是这一次过闸的真值。`governanceForced`
  * 需要行读,是因为它来自本仓的**进程内**治理标表:failover / 重启后幂等命中既有行时本地表恒空,行上的卡才
- * 存着落库那一刻的判定。何况行上本来就没有 `mandated`(耐久面不造孪生座)—— 读了也读不到。
+ * 存着落库那一刻的判定。(那张「行」是本仓的 ask 账本行,不是 core 的 park 行;core 7.31.0 #1079 起 park 行上的
+ * `mandated` 孪生座由**耐久** `/decide` 腿读,见 {@link parkRowStandingAnswerFacts}。)
  */
 export declare function standingAnswerMayRetire(facts: StandingAnswerFacts): boolean;
 /**
@@ -138,19 +139,19 @@ export declare function standingAnswerMayRetire(facts: StandingAnswerFacts): boo
  *    本读者这里只**收窄**(失真两个方向的代价登记在 `governanceMandatesShellGateAlways` 顶注)。⚠️ 它**只覆盖 shell 门的
  *    `always` 档** —— live 腿的治理标来自进程内标记表(敏感写路径 / `commandPolicy` / `AUTONOMY` 内层策略 / shellGate 各档),
  *    park 行上唯一的取证格只有 `riskDescriptor.shellGateDoctrine`(见下方 🚧);
- *  · `requiresRealApproval` —— 行上 core 铸的那一位,经 `approval-card.ts` 的 {@link readRequiresRealApprovalSeat}(与运维
+ *  · `requiresRealApproval` —— 行上 core 铸的那一位,经 `approval-card.ts` 的 {@link readParkRowTrueSeat}(与运维
  *    队列 `parkRowFacts` 同一只读法,`=== true`)。刻意**不**经 `parkRowFacts` 本身:那只展示投影顺手对 `ruleOffersAbsence`
  *    的集外词计展示面 F 类 tag,而本读者对同一格是 fail-closed(S-663 codex r1 钉「权限面不计展示面 tag」);
- *  · `mandated` —— 行上**没有**这一位(core 7.30.1 `PendingAction` 无 `mandated`,#1079 候 7.31.0),只读得到强制的子集:
- *    `ruleOffersAbsence` 经三态窄读 {@link readRuleOffersAbsenceSeat},`"mandated"` **或读不出**(集外词 / 非串值,世代差)
- *    ⇒ `true`(fail-closed 不变:一个本仓不认识的新词可能正是一种强制因由)。
+ *  · `mandated` —— **S-663 二段(core #1079,7.31.0 / S-723)**:行上 core 铸的孪生座 `PendingAction.tool_approval.mandated`,经
+ *    **同一只** {@link readParkRowTrueSeat}(`=== true`);**或**强制子集 `ruleOffersAbsence` 经三态窄读
+ *    {@link readRuleOffersAbsenceSeat} 读成 `"mandated"` / 读不出(集外词 / 非串值,世代差)⇒ `true`。两臂是**两个事实**的析取,
+ *    不是同一个事实的新旧两种读法:core 对 `"mandated"` 这一词的定义就是「no persisted rule could ever clear this ask」(强制的
+ *    充分条件),而 #1079 之前铸的行(7.30.x 引擎 park、升级后才被 `/decide`)没有孪生座 —— 只读孪生座会让这类在飞行照旧落豁免,
+ *    是对上一版的回归;读不出按强制是 fail-closed(一个本仓不认识的新词可能正是一种强制因由)。
  *
- * 🚧 **剩余不对称两处**(耐久腿读得到的事实比 live 腿少,读不到的一律照旧可记):
- *  ① **`mandated` 孪生位(候 core #1079)**:一张强制卡若行上词为 `shadowed` / 缺席、又无 `requiresRealApproval` 与治理出身
- *    (非 Bash 工具 / 车道未武装 / 匿名部署上的规则强制 —— core 只在「车道武装 ∧ `Bash` ∧ 有 principal」时铸那一词,且
- *    `ruleClearanceOf` 的词序让 `persistedRuleShadowed` / `matchedAskRule` 先得 `"shadowed"`),本折法读不到它的强制。#1079 到货后
- *    改的**只是 `mandated` 这一格**(改读行上那一位),谓词与调用点零改(`test/approval-exemption-http.test.ts` 的 🚧 格按 #1079
- *    行形钉着);
+ * 🚧 **剩余不对称一处**(耐久腿读得到的事实比 live 腿少,读不到的一律照旧可记):
+ *  ① (已关,S-663 二段)`mandated` 孪生位 —— core #1079 到货,行上词为 `shadowed` / 缺席的强制卡由孪生座读到
+ *    (`test/approval-exemption-http.test.ts` 原 🚧 格已按钉翻成「false + 零行」);
  *  ② **非 shell 治理(候 S-707)**:治理位经 `governanceOriginOf` 只覆盖 shell 门 `always` 档;敏感写路径
  *    (`SENSITIVE_WRITE_PATTERNS`)、`commandPolicy`、`AUTONOMY` 内层策略产的门与 shellGate `classify` 档,park 行上没有取证格
  *    (live 腿靠进程内标记表,跨副本 / 重启后够不着),本折法读不到它们的治理出身。
@@ -224,16 +225,19 @@ export interface ToolApprovalFrame {
      * 车道**有什么可给,而那条车道对它不说话的工具、**没接规则店的部署**(本仓的 live-only 形)、装不下规则的
      * 任务都是结构性沉默 —— 它的缺席**不是**断言。本键是这一问**自己**的属性,凡强制皆在场。读错的代价 core
      * 实测过:同一条根外读命令在 shell 工具上是强制问、在 monitor 工具上看起来是普通问。
-     * (唯一例外是**手里没有本键**的那条腿:耐久 `/decide` 腿只有 park 行,S-663 / NP-1 只读那一词的**在场**、从不读它的
-     * 缺席 —— 见 {@link parkRowStandingAnswerFacts},子集与剩余不对称写在那里。live 腿恒读本键。)
+     * (耐久 `/decide` 腿手里只有 park 行:core 7.31.0 #1079 起行上有本键的孪生座 `PendingAction.tool_approval.mandated`,
+     * S-663 二段读它;#1079 之前铸的行没有孪生座,那条腿仍读那一词的**在场**(`"mandated"` ⇒ 强制)、从不读它的缺席 —— 见
+     * {@link parkRowStandingAnswerFacts}。live 腿恒读本键。)
      *
      * 🔴 **它不是 `requiresRealApproval`**:强制只说「没有规则能清掉」,**不**说「没有应答者可以答」——
      * 一个人、一只 hook、一张一揽子 `onAsk:"allow"` 席照常答得了强制卡。两键别互推。
      *
-     * 🔴 **真才带,缺席绝不编 `false`**(`governanceForced` / `requiresRealApproval` 同形)。缺席同时覆盖
-     * 「不是强制」「老引擎」「这是一张从 park 行上重铸的耐久卡」三形 —— **耐久面上本仓不造孪生座**:core 的
-     * 寄存行(`PendingAction`)没有这一位(KL-997a 亲读登记),行上强制表现为 `ruleOffersAbsence:"mandated"`
-     * 且无 `ruleOffers`;在 `card_json` 侧自铸一个就是本仓成了这个事实的第二个源(而 park 那侧根本没有输入)。
+     * 🔴 **真才带,缺席绝不编 `false`**(`governanceForced` / `requiresRealApproval` 同形)。缺席覆盖「不是强制」「老引擎」
+     * 两形。**本仓从不自铸本键**:活卡帧(与 `livePending` 行顶层,T4①)只读 `AskRequest.mandated`;耐久面(运维队列行 / inbox 行)
+     * 自 core 7.31.0 #1079 起读 core 在 park 行上铸的孪生座(`PendingAction.tool_approval.mandated` / `CheckpointSummary.mandated`,
+     * S-663 二段),同样只投 core 给的那一位 —— 自铸一个就是本仓成了这个事实的第二个源。⚠️ **`card_json` 卡面不带本键**
+     * (`ApprovalCardSchema` 没有这一位,`.strict()`)⇒ 断连重放的 `approval_request` 帧(`buildReplayFrame` 只回放卡)上它恒缺席,
+     * 消费方读队列行 / 活卡帧 / `livePending` 行(8D-6:此前这里写的「`card_json` 只读 `AskRequest.mandated`」是错句,T4② 车OC 改真)。
      * 🔴 **server 不判「是不是强制」**(判定属主在 core 的闸站),只**读**闸站盖好的这一位 —— 读者恰一个:
      * S-660 起的会话级放行判据 {@link standingAnswerMayRetire}(会话授权是**上一次**应答记下的站着的答案,
      * 不是对这一次调用的应答 ⇒ 强制卡上既不被既有 grant 代答、也不铸 grant)。上一段「一揽子 `onAsk:"allow"`
@@ -522,6 +526,10 @@ export interface LivePendingRow {
     sessionId?: string;
     requiresRealApproval?: true;
     governanceForced?: true;
+    /** T4①(八病审计 8D-5,车OC / 7.101.0):强制位([ref],`AskRequest.mandated`)—— 与上两位**同层同形**(真才带,缺席不编 false),
+     *  值 = 条目上那一位(`askBroadcast` 铸条目时取自这一次过闸的 `req.mandated`,与 {@link frame} 上的同名键同源)。此前只在
+     *  `frame` 里:同一个 `GET /v1/approvals` 响应的 durable `pending[]` 行顶层带它(S-663 二段),live 行却要进帧里读。 */
+    mandated?: true;
     /** 发起者为委派子代(originTaskId 在场)。 */
     fromSubagent?: true;
     /** [ref] C2(additive):委派子代的 **canonical taskId**。值域精确成文(codex R1-F3 问询后按 core dist
@@ -1086,19 +1094,23 @@ export declare class ToolApprovalCoordinator {
      * 的终局会取决于「谁赢了那把 CAS」「重试没重试」—— 比残余更坏的不可解释性。人的**真决议**(回放出
      * `true`/`false`)当然不过这个口:那不是「无人可答」。
      *
-     * 🔴 **不**归它管的一类(刻意,不是遗漏):`ensureAsk` **身份未定 / 坏行**两臂 —— 那里的 park 路由是对
-     * **身份不确定**的处置(与「有没有人」无关),且背后可能正躺着一条真行。于是 `deny` 部署上仍可能落
-     * 极少数 park(店抖动期),已知且有意的残余,成文在 config-types 的域注。
+     * **`ensureAsk` 的两条兜底臂也归它管**(S-702,7.100.0 合并复审 opus 腿 E1;此前两臂直接交裸 `"unavailable"`,是这句
+     * 「唯一成形口」的例外):行不可用(`persisted_row_unusable`:信封形不合 / deadline 越界)与身份不定(`ensure_indeterminate`:
+     * ensure 失败且复核读全失败)。两臂的**处置**不变 —— 不编造 wire 身份、不在身份未定时呈卡收人决(fail-closed)—— 变的只是
+     * 「不呈卡之后交什么」:它们同样是「这只 ask 没有人能答」,于是同样过这个口(park ⇒ `"unavailable"` 逐字不变;deny ⇒
+     * 部署政策拒对象),交出去的是**结算**时再经 {@link landUnattendedOutcome} 把同一个结算落在行上。修前 deny 部署在这两形下
+     * 仍 durable park(与「不积压挂起 run」的自声明相反)。
      *
      * 🔴 **`deny` 部署上政策结算当场落行**(NP-2,7.100.0 合并复审 [ref] 交叉表 #4;codex R1-F1 当年**不采纳**的那一半
      * 「给 deny 造一条原子 deny 终态转移」在这里收了):窗到期 / emit 全灭两臂在 deny 政策下的终局 claim 是
-     * `refuse` 意图(见 {@link unattendedClaimIntent})—— STREAM_PENDING→DECIDED(deny) + `settled_by = "policy"`,**按 ask
+     * `refuse` 意图(政策→意图的唯一映射在 `approval-policy-settlement.ts` 的 `settleByPolicy`)—— STREAM_PENDING→DECIDED(deny) + `settled_by = "policy"`,**按 ask
      * 作用域**(不碰批、不连坐兄弟)。落的来源词与本口交给 core 的是**同一个常量**(`POLICY_REFUSAL_DECISION`),于是
      * 同 ask 重入 / 收敛后重入由 `outcomeOfDecidedRow` 读回同一个对象。当年「危害为零」的论证(PARKING 行绑不上、
      * 自行收敛成 DENIED/VOID)在 S-689 之后不再成立:首判交 `{allow:false, settledBy:"policy"}`,行停 PARKING 的回放
      * 却交裸 `false`(收敛后 DENIED 无来源)—— core 当成人拒、可停批,两次判决第一次可被观测地分家。
-     * 仍按 PARKING 记账的只剩两形(都不是本进程这一次政策结算):别的写者(park 政策副本 / 切换政策之前)推进过的行,
-     * 与崩溃后收敛器孤儿腿代打 expire 的行 —— 前者重入走本口(`replayed_parked`),后者登记在收车档的未闭环项。
+     * S-702 / S-706 把同一只 claim 接到了另外三处:两条兜底臂({@link landUnattendedOutcome})与崩溃恢复腿(收敛器孤儿段,
+     * 它是窗到期竞争者在崩溃后的补位)—— 四处调的是**一只** `settleByPolicy`,谁也不自己挑意图。deny 部署上仍按 PARKING
+     * 记账的只剩一形:别的写者(park 政策副本 / 切换政策之前)推进过的行,重入走本口(`replayed_parked`)。
      * deny 政策下批仍是**单 ask 批**(见 {@link batchIdFor}):`refuse` 本来就不碰批,单 ask 批让新行与存量整腿批行
      * 的差别只剩「批 id 是谁」,结算语义一致。
      */
@@ -1117,14 +1129,6 @@ export declare class ToolApprovalCoordinator {
      * 读的是政策**读**口(不落遥测)。
      */
     private batchIdFor;
-    /**
-     * 窗到期 / emit 全灭两臂的**终局 claim 意图**(NP-2)—— 与 {@link batchIdFor} 读同一个政策读口:
-     *  · park 路由 ⇒ `expire`(行进投递面、批转 ROUTING_UNBOUND、兄弟连坐,core 随后 park);
-     *  · deny 政策 ⇒ `refuse`(按 ask 作用域当场落 DECIDED(deny) + `settled_by="policy"`,与 {@link unattendedOutcome}
-     *    交给 core 的那一只同一个来源词 —— 回放 / 收敛后重入读回同一个对象;不碰批、不连坐兄弟,存量整腿批行同判)。
-     * 两臂之外的终局 claim(取消臂 `cancel`)与政策无关,不读本口。
-     */
-    private get unattendedClaimIntent();
     /** {@link unattendedOutcome} 的**公开**口:`windowZero` 的 immediate-unavailable 闭包长在装配层
      *  (`http/routes/tasks.ts` 的 sync 腿),它必须与协调器内五臂读**同一个**旋钮值,而不是各算一遍。
      *  出处随调用方给(那条腿知道自己是哪一只 ask)。 */
@@ -1133,6 +1137,29 @@ export declare class ToolApprovalCoordinator {
         owner?: string | null;
         toolName?: string;
     }): UnattendedAskOutcome;
+    /**
+     * S-702 —— 两条兜底臂的「无人可答」终局的**落行**半场。交给 core 的值已由 {@link unattendedOutcome} 一处铸好,这里只回答
+     * 「这条持久行上落什么」,判据是「交出去的是不是**结算**」(行 = 真源:交出去的结算必须同时是行上的结算,否则同 ask 重入 /
+     * 收敛后重入回放出来的是另一个答案 —— NP-2 在 live 腿上收掉的同一种分家):
+     *  · park 路由(`"unavailable"`)不是结算 ⇒ 行**不动**:它留在 STREAM_PENDING,投递面由既有机器接(崩溃恢复腿按政策代打),
+     *    与两臂修前逐字同形 —— park 部署行为不变;
+     *  · 部署政策拒(deny)是结算 ⇒ 经 {@link settleByPolicy}(live 腿 / 崩溃恢复腿同一只政策感知终态 claim)把同一个结算落在行上。
+     *
+     * 🔴 **只对「本次调用插下的」行调用**(调用方的义务;codex 对抗复审 F1 + R2-2 / [ref] 件2 同一条纪律「放弃收尾只许动本次插入的
+     * 行」):兜底臂发生在**窗开之前** —— 一条幂等命中的 STREAM_PENDING 行此刻可能正被别的登记(另一副本 / 另一版本 / 重入)呈卡、
+     * 有人正要按;当场 refuse 等于把一张活卡在它自己的窗走完之前作废。所以归属证不出(幂等命中、ensure 报错、迟到结果
+     * `inserted:false`)⇒ 本方法不被调用、行不动:它的属主按自己的窗收场,属主不在了由收敛器孤儿段(同一只 claim,S-706)在
+     * 窗过 + 宽限之后落同一个政策结算。`row.batchId` 恒取**行上**的批(claim 的 scope;本地派生的批可能与存量行不同,
+     * 错 scope 的 claim 答 absent,不证明「行上没有决议」—— codex F1)。
+     *
+     * 答案处置(律 1 答案自足,与 live 腿同一个分类器 {@link classifyClaimLoss} + 同一个同 askId 分发口 {@link dispatchClaimTruth}):
+     *  - 赢 ⇒ 交政策拒;同 askId 的其余本地登记随行收尾(与 live 腿赢臂同形:park 路由口,deny 下它们同样成形为政策拒);
+     *  - 输 ⇒ 行真相:真决议 ⇒ 交它并分发给同 askId 的其余登记(codex F2:此前只交本调用方,另一条登记可按自己的店错落成相反终局);
+     *    行已进投递面(别的写者推进的 PARKING/PARKED)⇒ 分发 park 路由、本调用交政策拒本身(与 `replayed_parked` 在 deny 下同答);
+     *  - absent / 编辑在飞 / 店抛错 ⇒ 交政策拒本身(fail-closed 方向不变);迟到回来的 claim 答案同样分发(赢 ⇒ park 路由口;输 ⇒ 真相)。
+     * 本方法从不抛错(店错只进 `noteStoreError`)—— 迟到落盘行的收尾对它 fire-and-forget。
+     */
+    private landUnattendedOutcome;
     /**
      * [ref] 车3 刀 3b —— [ref] §3.3 / 设计稿 §0 X-2 的**写侧准入门**。
      *
@@ -1307,6 +1334,13 @@ export declare class ToolApprovalCoordinator {
      */
     private hasOtherSuspendedOwner;
     private settleSameAskIdParkRoute;
+    /**
+     * claim 败方真相的**同 askId 分发口**(codex [ref] R6-2 / R7-1 立在 live 腿的闭包里;S-702 codex F2 起两条兜底臂的落行半场
+     * {@link landUnattendedOutcome} 也调它 —— 一个分发口,不写第二份):真相是**行**的,不是某一条登记的 ⇒ 真决议经
+     * {@link notifyExternalDecision}、投递面经 {@link settleSameAskIdParkRoute} 交给同 askId 的全部本地登记;各登记的 settle 自带
+     * 单赢者卫兵,对已落的恒无操作。absent / 编辑在飞没有可分发的真相。
+     */
+    private dispatchClaimTruth;
     /** [ref]:落一条 park 墓碑(容量帽按**插入序**逐出最旧,与 `allowAllSessions` 同款有界纪律)。
      *  调用点唯一 = `settle` 里的 park 路由支(见那处注);真终局绝不调它。
      *
@@ -1554,6 +1588,15 @@ export declare class ToolApprovalCoordinator {
      *  宁少列不超范围;`"__none__"` 未鉴权哨兵自然恒空)。行的 `approvalId` 就是 `respond()` 收的 id
      *  (同源可达,[ref] 判据);`expiresAtMs` 照抄登记时单点铸定的窗死线([ref] 三键同一个数)。 */
     listLivePending(scope: string | undefined): LivePendingRow[];
+    /**
+     * S-751:某只委派子代此刻有没有**待决**的活卡 —— fleet 对账腿「子代活性由属主说了算」的属主②读口(另一只是
+     * bg registry 账)。子代卡在一张没人答的卡上时当然不出帧,只看「静默」就会把它当孤儿扫下面板(报案的真形)。
+     * 只答是非、不交出 Map(与 `isRunLiveOnThisReplica` 同姿势);纯读,零锁零结算语义。
+     * 键 = ask 发起者域(`originTaskId` = core `AskRequest.sourceTaskId` = 子代自己的 core session id),**不是**
+     * fleet 行 id —— 换算在 `FleetEventBus.childOwnerKeys`。只看本副本的内存登记:子代跑在本副本,它的活卡就登记在
+     * 本副本;耐久 park 的卡由 bg registry 的 `parked` 态作保(见 fleet-reconciler.ts `bgAgentVouches`)。
+     */
+    hasLivePendingFrom(originTaskId: string): boolean;
     /**
      * 🔴 [ref](案A)追记 F4 —— **跨副本决议的执行通知**(悬挂行的一次终态轮询)。
      *

package/dist/tool-approval.js

@@ -8,8 +8,9 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readRequiresRealApprovalSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
+import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
 const defaultLogger = createLogger();
@@ -87,8 +88,8 @@ export function parkRowStandingAnswerFacts(pending, gate, governance) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
     return {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
-        requiresRealApproval: readRequiresRealApprovalSeat(pending),
-        mandated: mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
+        requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
+        mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
     };
 }
 function mandatedFromSeat(seat) {
@@ -377,9 +378,6 @@ export class ToolApprovalCoordinator {
     batchIdFor(askId, sourceTaskId, runId, legKey) {
         return this.unattendedRoutesToPark ? deriveBatchId(sourceTaskId, runId, legKey) : deriveAskScopedBatchId(askId);
     }
-    get unattendedClaimIntent() {
-        return this.unattendedRoutesToPark ? "expire" : "refuse";
-    }
     unattendedAskOutcome(site) {
         return this.unattendedOutcome({
             arm: "window_zero",
@@ -388,6 +386,32 @@ export class ToolApprovalCoordinator {
             ...(site.toolName !== undefined ? { toolName: site.toolName } : {}),
         });
     }
+    async landUnattendedOutcome(outcome, row) {
+        const store = this.askStore;
+        if (outcome === "unavailable" || !store)
+            return outcome;
+        const dispatch = (res, where) => {
+            if (res.claimed) {
+                this.settleSameAskIdParkRoute(row.askId);
+                return undefined;
+            }
+            const read = this.classifyClaimLoss(row.askId, res.current, where);
+            this.dispatchClaimTruth(row.askId, read);
+            return read;
+        };
+        let res;
+        try {
+            res = await this.withStoreDeadline(settleByPolicy(store, row, this.unattendedPolicy), "claimTerminal(unattended-fallback)", DURABLE_CALL_TIMEOUT_MS, (late) => {
+                dispatch(late, "late:unattended-fallback");
+            });
+        }
+        catch (err) {
+            this.noteStoreError(err, "claimTerminal(unattended-fallback)");
+            return outcome;
+        }
+        const read = dispatch(res, "claim:unattended-fallback");
+        return read?.kind === "decided" ? read.outcome : outcome;
+    }
     admit(taskId, owner) {
         if (!this.askStore)
             return () => undefined;
@@ -701,6 +725,23 @@ export class ToolApprovalCoordinator {
         for (const entry of [...entries])
             entry.settleParkRoute();
     }
+    dispatchClaimTruth(askId, read) {
+        switch (read.kind) {
+            case "decided":
+                this.notifyExternalDecision(askId, read.outcome);
+                return;
+            case "parked":
+                this.settleSameAskIdParkRoute(askId);
+                return;
+            case "absent":
+            case "edit-in-flight":
+                return;
+            default: {
+                const unreachable = read;
+                throw new Error(`dispatchClaimTruth: unknown recovery read ${String(unreachable)}`);
+            }
+        }
+    }
     recordParkTombstone(approvalId, tomb) {
         const existing = this.parkTombstones.get(approvalId);
         if (existing !== undefined) {
@@ -945,16 +986,31 @@ export class ToolApprovalCoordinator {
         let wireApprovalId = id;
         let cardForFrame = card;
         let persistedExpiresAtMs = expiresAtMs;
-        let lateEnsuredAskId;
-        let abandonedEnsure = false;
+        let lateEnsuredRow;
+        let lateTerminalRow;
+        let abandonedAs;
         const attemptCreatedAtMs = Date.now();
-        const voidAbandonedRow = (orphanAskId) => {
+        const finishAbandonedRow = (orphan) => {
             const store = this.askStore;
-            if (!store)
-                return;
-            void store
-                .transitionAsk(orphanAskId, "STREAM_PENDING", "VOID", { updatedAtMs: Date.now() })
-                .catch((err) => this.noteStoreError(err, "transitionAsk(abandon-late-ensure)"));
+            if (!store || abandonedAs === undefined)
+                return undefined;
+            if (abandonedAs === "void") {
+                void store
+                    .transitionAsk(orphan.askId, "STREAM_PENDING", "VOID", { updatedAtMs: Date.now() })
+                    .catch((err) => this.noteStoreError(err, "transitionAsk(abandon-late-ensure)"));
+                return undefined;
+            }
+            return this.landUnattendedOutcome(abandonedAs, orphan);
+        };
+        const abandonRow = (handed) => {
+            abandonedAs = handed === undefined || handed === "unavailable" ? "void" : handed;
+            return lateEnsuredRow !== undefined ? finishAbandonedRow(lateEnsuredRow) : undefined;
+        };
+        const replayTerminalRow = (row) => {
+            const replayed = replayTerminalAskRow(row);
+            return replayed === "unavailable"
+                ? this.unattendedOutcome({ arm: "replayed_parked", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability })
+                : replayed;
         };
         if (this.askStore && card) {
             const sourceTaskId = req.sourceTaskId ?? origin.taskId;
@@ -980,17 +1036,19 @@ export class ToolApprovalCoordinator {
                     expiresAtMs,
                     createdAtMs: attemptCreatedAtMs,
                 }), "ensureAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
-                    lateEnsuredAskId = late.inserted && late.row.state === "STREAM_PENDING" ? late.row.askId : undefined;
-                    if (abandonedEnsure && lateEnsuredAskId !== undefined)
-                        voidAbandonedRow(lateEnsuredAskId);
+                    if (late.row.state !== "STREAM_PENDING") {
+                        lateTerminalRow = late.row;
+                        this.dispatchClaimTruth(late.row.askId, this.classifyClaimLoss(late.row.askId, projectAskTerminalClaimTruth(late.row), "late:ensureAsk"));
+                        return;
+                    }
+                    lateEnsuredRow = late.inserted ? { askId: late.row.askId, batchId: late.row.batchId } : undefined;
+                    if (lateEnsuredRow !== undefined)
+                        void finishAbandonedRow(lateEnsuredRow);
                 });
                 batchId = existingOrCreated.row.batchId;
                 if (existingOrCreated.row.state !== "STREAM_PENDING") {
                     releaseAdmission();
-                    const replayed = replayTerminalAskRow(existingOrCreated.row);
-                    return replayed === "unavailable"
-                        ? this.unattendedOutcome({ arm: "replayed_parked", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability })
-                        : replayed;
+                    return replayTerminalRow(existingOrCreated.row);
                 }
                 const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.row.cardJson);
                 const maxMintableWindowMs = Math.max(effectiveWindowMs, this.unreachedTtlMs);
@@ -999,7 +1057,8 @@ export class ToolApprovalCoordinator {
                     this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope.success}, deadlineOk=${sanePersistedDeadline}, ` +
                         `origin=${existingOrCreated.inserted ? "row-this-call-just-inserted" : "row-hit-idempotently"})`), "ensureAsk(persisted-row-unusable)");
                     releaseAdmission();
-                    return "unavailable";
+                    const unattended = this.unattendedOutcome({ arm: "persisted_row_unusable", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                    return existingOrCreated.inserted ? this.landUnattendedOutcome(unattended, existingOrCreated.row) : unattended;
                 }
                 persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
                 wireApprovalId = persistedEnvelope.data.approvalId;
@@ -1059,23 +1118,26 @@ export class ToolApprovalCoordinator {
                             await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
                     }
                 }
+                if (lateTerminalRow !== undefined) {
+                    releaseAdmission();
+                    return replayTerminalRow(lateTerminalRow);
+                }
                 if (indeterminate) {
-                    abandonedEnsure = true;
-                    if (lateEnsuredAskId !== undefined)
-                        voidAbandonedRow(lateEnsuredAskId);
+                    const unattended = this.unattendedOutcome({ arm: "ensure_indeterminate", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                    const landed = abandonRow(unattended);
                     releaseAdmission();
-                    return "unavailable";
+                    return landed ?? unattended;
                 }
                 if (!confirmedRowExists) {
                     askId = undefined;
                     batchId = undefined;
-                    abandonedEnsure = true;
-                    if (lateEnsuredAskId !== undefined)
-                        voidAbandonedRow(lateEnsuredAskId);
                     if (reachability === "unreached") {
+                        const unattended = this.unattendedOutcome({ arm: "unreached_no_row", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                        const landed = abandonRow(unattended);
                         releaseAdmission();
-                        return this.unattendedOutcome({ arm: "unreached_no_row", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                        return landed ?? unattended;
                     }
+                    void abandonRow(undefined);
                 }
             }
         }
@@ -1151,21 +1213,7 @@ export class ToolApprovalCoordinator {
         const broadcastClaimTruth = (read) => {
             if (askId === undefined)
                 return;
-            switch (read.kind) {
-                case "decided":
-                    this.notifyExternalDecision(askId, read.outcome);
-                    return;
-                case "parked":
-                    this.settleSameAskIdParkRoute(askId);
-                    return;
-                case "absent":
-                case "edit-in-flight":
-                    return;
-                default: {
-                    const unreachable = read;
-                    throw new Error(`broadcastClaimTruth: unknown recovery read ${String(unreachable)}`);
-                }
-            }
+            this.dispatchClaimTruth(askId, read);
         };
         const settleFromClaimLoss = (read) => {
             switch (read.kind) {
@@ -1315,11 +1363,10 @@ export class ToolApprovalCoordinator {
                 const store = this.askStore;
                 const pinnedAskId = askId;
                 const pinnedBatchId = batchId;
-                const claimIntent = this.unattendedClaimIntent;
                 await resolveLocalOutcome({
                     intent: "expire",
                     storeLabel: "claimTerminal(window)",
-                    claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, claimIntent), "claimTerminal(window)", timeoutMs, (late) => {
+                    claim: (timeoutMs) => boundedClaim(() => settleByPolicy(store, { askId: pinnedAskId, batchId: pinnedBatchId }, this.unattendedPolicy), "claimTerminal(window)", timeoutMs, (late) => {
                         if (!late.claimed) {
                             lateClaimLossSettle(late.current, "expire");
                             return;
@@ -1498,7 +1545,6 @@ export class ToolApprovalCoordinator {
                     const store = this.askStore;
                     const pinnedAskId = askId;
                     const pinnedBatchId = batchId;
-                    const claimIntent = this.unattendedClaimIntent;
                     const settleUnreachable = () => {
                         if (done)
                             return;
@@ -1508,7 +1554,7 @@ export class ToolApprovalCoordinator {
                     await resolveLocalOutcome({
                         intent: "unreachable",
                         storeLabel: "claimTerminal(emit-failed)",
-                        claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, claimIntent), "claimTerminal(emit-failed)", timeoutMs, (late) => {
+                        claim: (timeoutMs) => boundedClaim(() => settleByPolicy(store, { askId: pinnedAskId, batchId: pinnedBatchId }, this.unattendedPolicy), "claimTerminal(emit-failed)", timeoutMs, (late) => {
                             if (!late.claimed) {
                                 lateClaimLossSettle(late.current, "unreachable");
                                 return;
@@ -2060,6 +2106,7 @@ export class ToolApprovalCoordinator {
                 ...(e.sessionId !== undefined ? { sessionId: e.sessionId } : {}),
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
+                ...(e.mandated ? { mandated: true } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
                 ...(contentKind !== undefined ? { contentKind } : {}),
                 frame: e.frame.approvalId === id ? e.frame : { ...e.frame, approvalId: id },
@@ -2067,6 +2114,12 @@ export class ToolApprovalCoordinator {
         }
         return rows;
     }
+    hasLivePendingFrom(originTaskId) {
+        for (const e of this.pending.values())
+            if (e.originTaskId === originTaskId)
+                return true;
+        return false;
+    }
     async pollSuspendedDecisions() {
         const store = this.askStore;
         if (!store)

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, GateDisposition, Settlement, PausedCause, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
  *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
@@ -60,7 +60,7 @@ type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peer
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
 type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection" | "teamRole";
-type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence";
+type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence" | "fileHistory";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
@@ -130,12 +130,20 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable" | "mandated";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
+type ParkArmKeys = keyof Extract<PendingAction, {
+    kind: "tool_approval";
+}>;
+type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "origin" | "ruleStoreUnreadable";
+type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
+type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
+type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "fileHistory";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -197,6 +205,13 @@ type McpListingIncompleteKeys = keyof NonNullable<McpReconnectResult["listingInc
 type McpListingIncompleteProjected = "reason" | "pages" | "budgetMs" | "error";
 type _GuardMcpListingIncomplete = AssertAllKeysHandled<Exclude<McpListingIncompleteKeys, McpListingIncompleteProjected>>;
 type _GuardMcpListingIncompleteReverse = AssertAllKeysHandled<Exclude<McpListingIncompleteProjected, McpListingIncompleteKeys>>;
+type LspOptionsWired = "env" | "log";
+type LspOptionsUnwired = "onNotice" | "servers" | "spawn" | "readText" | "resolveRoot" | "warmup" | "maxSessions" | "idleTtlMs" | "diagnostics";
+type _GuardLspOptions = AssertAllKeysHandled<Exclude<keyof NodeLspManagerOptions, LspOptionsWired | LspOptionsUnwired>>;
+type _GuardLspOptionsReverse = AssertAllKeysHandled<Exclude<LspOptionsWired | LspOptionsUnwired, keyof NodeLspManagerOptions>>;
+type _NoDoubleBookLspOptions = AssertAllKeysHandled<Extract<LspOptionsWired, LspOptionsUnwired>>;
+type RunnerDepsDroppedPendingS724 = "fileHistoryCapture";
+type _GuardFacelessRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsDroppedPendingS724, keyof RunnerDeps>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
     _GuardNotificationReverse,
@@ -259,6 +274,9 @@ export type CoreKeysetGuards = [
     _GuardPermissionTraceNonEmpty,
     _GuardInboxSummary,
     _GuardInboxSummaryReverse,
+    _GuardParkArmQueue,
+    _NoDoubleBookParkArmQueue,
+    _GuardParkArmQueueReverse,
     _GuardTaskSpec,
     _GuardTaskSpecReverse,
     _GuardTaskResult,
@@ -294,7 +312,11 @@ export type CoreKeysetGuards = [
     _GuardMcpListingIncomplete,
     _GuardMcpListingIncompleteReverse,
     _GuardWiringMcpLiveness,
-    _GuardWiringMcpLivenessReverse
+    _GuardWiringMcpLivenessReverse,
+    _GuardLspOptions,
+    _NoDoubleBookLspOptions,
+    _GuardLspOptionsReverse,
+    _GuardFacelessRunnerDepsReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,8 +16,34 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "instructions.source_changed"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
+/**
+ * S-690 —— **本仓自铸**的通告码与它们的受众(码 / 铸点 / 受众三者的属主都是本仓)。
+ *
+ * 为什么可以有这一族:core 的 `EngineNotice.code` 刻意是开放 `string`,顶注逐字「a host forwarding its own notices
+ * through the same sink is a supported shape」—— 部署经同一只 `onNotice` 转发体投自己的通告,白名单 / 归属 / 消毒 /
+ * 隔离四件判据一个不绕。为什么受众写在这里:core 的 `NOTICE_AUDIENCE` 只收录 core 自己铸的码,对本仓的码
+ * `noticeAudienceOf` 只会读保守默认 `"operator"` —— 那是「不认识」,不是判决。顶注的「本仓不许自造第二份受众语义」
+ * 说的是 **core 的码**;本表只收 core 码册里**没有**的码,这里是它们唯一的一份受众语义。
+ *
+ * 🔴 机器门(`test/engine-notice-wire.test.ts` 的 server 自铸码属主门):① 本表的码与 core 运行期码册 `ENGINE_NOTICE_CODES`
+ * **零交集**(core 哪天铸了同名码 ⇒ 属主变成两个,当场红:销本表的行、改走 core 的受众与工厂);② 判 `"user"` 的码必须
+ * 入白名单;③ 白名单里的码,受众一律由「本表 ∪ core 注册表」给,判出来必须是 `"user"`。
+ */
+export declare const SERVER_NOTICE_AUDIENCE: {
+    readonly "instructions.source_changed": "user";
+    /**
+     * O2(7.101.0 合并复审)—— boot 期探测到 ≤7.30.x 引擎留下的锁住的记忆层(唯一铸点 `src/memory-layer-legacy-lock.ts`,
+     * 调用点 = `boot/stores.ts` 的 file 记忆引擎装配段)。受众 **operator**:恢复动词是运维在数据根上执行一次 `chmod -R u+w`,
+     * 而且铸在 boot 期、没有任何会话 ⇒ 不上 wire、不进白名单,只走转发体的日志终点(`engine_notice` warn)。
+     * `detail: { layers, remedy }` —— 层名(挂载面的直接子目录名)与那一句补救;条目名 / 内容不进。
+     */
+    readonly "memory.layer_locked_legacy": "operator";
+};
+export type ServerNoticeCode = keyof typeof SERVER_NOTICE_AUDIENCE;
+/** 该码是否本仓自铸(属主判据单点:门与投递面都读这一个)。 */
+export declare function isServerNoticeCode(code: string): code is ServerNoticeCode;
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
 /**

package/dist/trace/engine-notice-wire.js

@@ -23,7 +23,15 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "mcp.injection_dropped",
     "delegation.ask_unresolvable",
     "task.interrupt_unconsumed",
+    "instructions.source_changed",
 ];
+export const SERVER_NOTICE_AUDIENCE = {
+    "instructions.source_changed": "user",
+    "memory.layer_locked_legacy": "operator",
+};
+export function isServerNoticeCode(code) {
+    return Object.hasOwn(SERVER_NOTICE_AUDIENCE, code);
+}
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
     return WIRE_CODES.has(code);