@sema-agent/server 7.105.0 → 7.106.0

package/dist/plugins/session-policy-store-sql.d.ts

@@ -3,6 +3,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type JsonColumnShape } from "./sql-json-column.js";
 import { type SqlDriver } from "./sql-driver.js";
+import type { Logger } from "../observability/logger.js";
 /** `session_policy.policy_key` 的**唯一铸造点**(core 复合键的 sha256)。
  *
  *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):[ref] form b 的身份重绑要
@@ -32,20 +33,26 @@ export declare const policyKeyFor: (sessionId: string, principal: string | undef
  * + 恰好解一次 `decodeJsonColumn` + 折码 `foldJsonColumn`);本店只留「形判据是哪一只」与「坏体折成哪个码」。
  */
 export declare function readSessionRulesBody(body: unknown): JsonColumnShape<SessionPermissionRules>;
+/** 本店唯一的日志口:抹除封键那一臂(S-891)的点名。缺席 ⇒ 退回 `console.warn`(不静默)。 */
+export type SessionPolicyStoreLogger = Pick<Logger, "warn">;
 /** Dual-dialect durable SessionPolicyStore. See the file header for the dialect-delta ledger. */
 export declare class SqlSessionPolicyStore implements SessionPolicyStore {
     private readonly db;
-    constructor(db: SqlDriver);
+    private readonly logger?;
+    constructor(db: SqlDriver, logger?: SessionPolicyStoreLogger | undefined);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     /** 判据属主 = `sql-errors.ts`([ref] P1-①;本站点旧形已是并集形,收编后语义不变)。 */
     private isDupKey;
-    /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory). */
+    /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory).
+     *  🔴 S-891(codex r1 [high] ①):同一条语句带上这把键的**封键记号** —— 封着 ⇒ `corrupt`,不答「没有规则」(见 {@link sealedKeyError})。 */
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     /** 2c session-sync: every (principal, rules) record for a session across ALL principals — getRules is
      *  per-(session,principal), but a cross-backend session EXPORT must bundle the WHOLE session's policy (the importer
      *  replays each via putRules). principal is read from the DENORMALIZED column (the sha256 policy_key is one-way);
-     *  NULL → undefined = the session-wide row (parity with core's InMemory `principal ?? undefined`). Rules carry rev. */
+     *  NULL → undefined = the session-wide row (parity with core's InMemory `principal ?? undefined`). Rules carry rev.
+     *  🔴 S-891:会话里有**封着的键** ⇒ 整只枚举 `corrupt`(与一行读不出形时整只枚举拒同一口径 —— 导出一份缺了那把键的规则,
+     *  导入方就会把「状态未知」当成「这个 principal 没有规则」)。 */
     listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
     /** Operator/owner write: CAS + tighten-only (unless operator) + rev bump, atomic in one txn; first-write race retried. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
@@ -91,7 +98,8 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
      *      against a CURRENT read (PG is pinned to READ COMMITTED, TiDB's DML is a current read), so a row for a
      *      DIFFERENT principal that a concurrent putRules commits BETWEEN ① and ③ would be deleted by a session-wide
      *      DELETE while ② never marked it — a silently reset rev line, exactly the defect this batch exists to close.
-     *      Scoped to the key set, the invariant is exact and checkable: **every row this seam deletes leaves a mark**.
+     *      Scoped to the key set, the invariant is exact and checkable: **every row this seam deletes leaves a mark** —
+     *      a readable row's mark continues its rev line and ends its lineage; an unreadable row's mark SEALS its key (S-891, below).
      *      A row born after ① is simply not part of this erase (same as one born a microsecond after ③ — the caller
      *      that needs "and nothing came back" re-issues; the seam is idempotent).
      *  No rows ⇒ return early: an erase of a session that never had rules writes NO mark (no line, nothing to keep),
@@ -99,8 +107,31 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
      *  Why the mark is a separate table and not a tombstone row: see the DDL comment in tidb-pool.ts — a tombstone
      *  would keep `session_id` + the DENORMALIZED plaintext `principal` in the table after an E21 purge, i.e. the
      *  right-to-delete would degrade to buy rev ordering. The mark keeps only the one-way hash, the session id and
-     *  an integer. */
+     *  an integer.
+     *
+     *  🔴 **S-891(7.106.0)—— 抹除恒删行;计数读不出的行留「封键记号」**。一行的计数读不出(三个读点的同一只判词
+     *  {@link readRowCounters} 判坏:`rev` 不是 ≥ 1 的安全整数 / `gen` 不是 ≥ 0 的安全整数;或下一代的号 `gen + 1` 已出安全整数)
+     *  ⇒ 这一行**照删**,它的记号元组写 `(键, 会话, {@link SEALED_MARK_REV}, 0, 时刻)`、走**同一句** `GREATEST` 合并:rev 落上界,
+     *  世代 = `GREATEST(旧记号.gen + 1, 0)`(有旧记号照抬,没有就是 0)。于是这把键的下一次 `putRules` 算出 `上界 + 1`,被写前那道
+     *  **同一只** {@link isStoredCounter} 拒(`corrupt`,零写);读面同答 `corrupt`({@link sealedKeyError})—— **封键**,直到运营方
+     *  显式解封(USAGE §9.11:原地把记号的 `rev` 归 0、`gen` + 1;不删记号,删了会交回世代)。
+     *  两条都不许丢,所以是这个形:
+     *   · **删得掉** —— 抹除是运营方清坏行的出路(E21 `DELETE /v1/sessions/:id`、2c overwrite-dst 都经这里)。7.105.0 的「拒,一条写
+     *     都不发」让一行坏计数把整个会话的删除半程停住、重试恒败;
+     *   · **不许同世代** —— 修复车 QS 的「照删、不写记号」被 codex 真复现:这把键的血统没在本次抹除上结束,重建行从旧记号起号、
+     *     与持有**旧快照**的活读者同世代 ⇒ 读者把重建的宽松行读成延续(deny → allow)。读不出的号不能拿来结束血统,
+     *     那就不让这把键再有下一行,直到有人看过。
+     *  响亮面:提交**之后**一条 warn(`session_policy_erase_sealed_keys`,点名会话与被封的键 + 两个计数的原文;回滚了就什么都没封,
+     *  死锁重试也不重复报)。这**不是** fail-open(没有放行任何东西,方向是 fail-closed),所以不走 `recordFailOpen`;普查登记 P 类终态。
+     *  残余(如实):记号里**已有**的世代若被列外改到 BIGINT 上界,冲突臂的 `记号.gen + 1` 在库里溢出 ⇒ 这次抹除响亮失败
+     *  (驱动错误;那只记号本来就读不回,`putRules` 同样拒)—— 抹除不读记号,这一形不在本判词射程内。 */
     deleteBySession(sessionId: string): Promise<void>;
+    /**
+     * S-891 封键的响亮面:一次抹除至多一条 warn。日志座**抛** ⇒ 退回 `console.warn` 带原句 —— 走到这里删除已经提交,
+     * 一次日志故障不许把它报成失败(E21 会因此 500、overwrite-dst 会因此中止;codex 7.105.0 修复验证轮 [medium] 同形)。
+     * 缺日志座(直接 `new` 本店的工具 / 测试)⇒ `console.warn`,不静默。
+     */
+    private discloseSealed;
     /**
      * The store's one read-check-write transaction. Its load-bearing read is line ~106's
      * `SELECT rules, rev … FOR UPDATE` — a LOCKING read, therefore a CURRENT read on both engines, which is
@@ -114,10 +145,10 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
 }
 /** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
 export declare class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, logger?: SessionPolicyStoreLogger);
 }
 /** PostgreSQL binding — historical class name + ctor shape preserved. */
 export declare class PgSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, logger?: SessionPolicyStoreLogger);
 }
 //# sourceMappingURL=session-policy-store-sql.d.ts.map

package/dist/plugins/session-policy-store-sql.js

@@ -26,9 +26,15 @@ function isStoredCounter(n, floor) {
     return Number.isSafeInteger(n) && n >= floor;
 }
 function rowToStored(r, where) {
+    const counters = readRowCounters(r, where);
+    if ("problem" in counters)
+        throw new SessionPolicyError("corrupt", counters.problem);
+    return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev: counters.rev, gen: counters.gen };
+}
+function readRowCounters(r, where) {
     const rev = Number(r.rev);
     if (!isStoredCounter(rev, 1)) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always a whole number ≥ 1 within the safe-integer range (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules`);
+        return { problem: `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always a whole number ≥ 1 within the safe-integer range (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules` };
     }
     if (r.gen === undefined || r.gen === null) {
         throw new Error(`session_policy row ${where} came back without a \`gen\` column — a read leg did not project it (the column is BIGINT NOT NULL on both dialects). ` +
@@ -36,14 +42,22 @@ function rowToStored(r, where) {
     }
     const gen = Number(r.gen);
     if (!isStoredCounter(gen, 0)) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0 within the safe-integer range; refusing rather than let a reader judge lineage by a value nothing minted`);
+        return { problem: `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0 within the safe-integer range; refusing rather than let a reader judge lineage by a value nothing minted` };
     }
-    return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev, gen };
+    return { rev, gen };
+}
+const SEALED_MARK_REV = Number.MAX_SAFE_INTEGER;
+const SEALED_EVENT = "session_policy_erase_sealed_keys";
+const NO_SEALED_KEYS = [];
+function sealedKeyError(sessionId, what) {
+    return new SessionPolicyError("corrupt", `session rules for session ${JSON.stringify(sessionId)}: ${what} is sealed — an erase removed a row whose counters were unreadable (session_policy_rev_mark.rev = ${SEALED_MARK_REV}), so its rule state is unknown; refusing rather than serve it as "no rules" until an operator unseals it (USAGE §9.11)`);
 }
 export class SqlSessionPolicyStore {
     db;
-    constructor(db) {
+    logger;
+    constructor(db, logger) {
         this.db = db;
+        this.logger = logger;
     }
     q(tidb, pg) {
         return this.db.dialect === "tidb" ? tidb : pg;
@@ -52,13 +66,23 @@ export class SqlSessionPolicyStore {
         return isDupKeyError(this.db.dialect, e);
     }
     async getRules(sessionId, principal) {
-        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE policy_key = ?`, `SELECT ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE policy_key = $1`), [policyKey(sessionId, principal)]);
-        if (!rows[0])
+        const key = policyKey(sessionId, principal);
+        const { rows } = await this.db.query(this.q(`SELECT 'row' AS src, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE policy_key = ?` +
+            " UNION ALL SELECT 'seal', NULL, rev, gen FROM session_policy_rev_mark WHERE policy_key = ? AND rev = ?", `SELECT 'row' AS src, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE policy_key = $1` +
+            " UNION ALL SELECT 'seal', NULL, rev, gen FROM session_policy_rev_mark WHERE policy_key = $2 AND rev = $3"), [key, key, SEALED_MARK_REV]);
+        if (rows.some((r) => r.src === "seal"))
+            throw sealedKeyError(sessionId, `key ${key}`);
+        const row = rows.find((r) => r.src === "row");
+        if (row === undefined)
             return null;
-        return rowToStored(rows[0], `for session ${JSON.stringify(sessionId)}`);
+        return rowToStored(row, `for session ${JSON.stringify(sessionId)}`);
     }
     async listBySession(sessionId) {
-        const { rows } = await this.db.query(this.q(`SELECT principal, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE session_id = ?`, `SELECT principal, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE session_id = $1`), [sessionId]);
+        const { rows } = await this.db.query(this.q(`SELECT 'row' AS src, principal, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE session_id = ?` +
+            " UNION ALL SELECT 'seal', NULL, NULL, rev, gen FROM session_policy_rev_mark WHERE session_id = ? AND rev = ?", `SELECT 'row' AS src, principal, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE session_id = $1` +
+            " UNION ALL SELECT 'seal', NULL, NULL, rev, gen FROM session_policy_rev_mark WHERE session_id = $2 AND rev = $3"), [sessionId, sessionId, SEALED_MARK_REV]);
+        if (rows.some((r) => r.src === "seal"))
+            throw sealedKeyError(sessionId, "one of its keys");
         return rows.map((r) => ({
             principal: r.principal == null ? undefined : String(r.principal),
             rules: rowToStored(r, `for session ${JSON.stringify(sessionId)} (enumeration)`),
@@ -120,22 +144,20 @@ export class SqlSessionPolicyStore {
         }
     }
     async deleteBySession(sessionId) {
-        await this.retrying(() => this.tx(async (conn) => {
+        const sealed = await this.retrying(() => this.tx(async (conn) => {
             const { rows } = await conn.query(this.q("SELECT policy_key, rev, gen FROM session_policy WHERE session_id = ? ORDER BY policy_key FOR UPDATE", "SELECT policy_key, rev, gen FROM session_policy WHERE session_id = $1 ORDER BY policy_key FOR UPDATE"), [sessionId]);
             if (rows.length === 0)
-                return;
+                return NO_SEALED_KEYS;
             const now = new Date();
             const keys = rows.map((r) => String(r.policy_key));
             const params = [];
-            for (const r of rows) {
-                const rev = Number(r.rev);
-                const nextGen = Number(r.gen ?? 0) + 1;
-                if (!isStoredCounter(rev, 1) || !isStoredCounter(nextGen, 0)) {
-                    throw new SessionPolicyError("corrupt", `session rules row for session ${JSON.stringify(sessionId)} carries rev ${String(r.rev)} / gen ${String(r.gen)} — the erase would leave a mark outside the safe-integer range; refusing before writing it`);
-                }
-            }
+            const sealedKeys = [];
             const tuples = rows.map((r) => {
-                params.push(String(r.policy_key), sessionId, Number(r.rev), Number(r.gen ?? 0) + 1, now);
+                const counters = readRowCounters(r, `for session ${JSON.stringify(sessionId)} (erase)`);
+                const readable = !("problem" in counters) && isStoredCounter(counters.gen + 1, 0);
+                if (!readable)
+                    sealedKeys.push({ policyKey: String(r.policy_key), rev: String(r.rev), gen: String(r.gen) });
+                params.push(String(r.policy_key), sessionId, readable ? counters.rev : SEALED_MARK_REV, readable ? counters.gen + 1 : 0, now);
                 const base = params.length - 5;
                 return this.db.dialect === "tidb" ? "(?,?,?,?,?)" : `($${base + 1},$${base + 2},$${base + 3},$${base + 4},$${base + 5})`;
             });
@@ -144,7 +166,27 @@ export class SqlSessionPolicyStore {
                 " ON CONFLICT (policy_key) DO UPDATE SET rev = GREATEST(session_policy_rev_mark.rev, EXCLUDED.rev), gen = GREATEST(session_policy_rev_mark.gen + 1, EXCLUDED.gen), erased_at = EXCLUDED.erased_at"), params);
             const holes = keys.map((_, i) => (this.db.dialect === "tidb" ? "?" : `$${i + 1}`)).join(",");
             await conn.query(`DELETE FROM session_policy WHERE policy_key IN (${holes})`, keys);
+            return sealedKeys;
         }));
+        if (sealed.length > 0)
+            this.discloseSealed(sessionId, sealed);
+    }
+    discloseSealed(sessionId, keys) {
+        const fields = {
+            sessionId,
+            keys,
+            note: "these rows' counters were unreadable, so the erase could not end their lineage: each key now carries a sealed rev mark and answers every read and write with SessionPolicyError corrupt until an operator unseals its session_policy_rev_mark row in place (USAGE §9.11)",
+        };
+        if (this.logger === undefined) {
+            console.warn(`[session-policy] ${SEALED_EVENT}`, fields);
+            return;
+        }
+        try {
+            this.logger.warn(SEALED_EVENT, fields);
+        }
+        catch (err) {
+            console.warn(`[session-policy] ${SEALED_EVENT} — the injected logger threw (${err instanceof Error ? err.message : String(err)})`, fields);
+        }
     }
     async tx(fn) {
         const conn = await this.db.connect();
@@ -168,13 +210,13 @@ export class SqlSessionPolicyStore {
     }
 }
 export class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, logger) {
+        super(mysqlDriver(pool), logger);
     }
 }
 export class PgSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, logger) {
+        super(pgDriver(pool), logger);
     }
 }
 //# sourceMappingURL=session-policy-store-sql.js.map

package/dist/plugins/sql-driver.d.ts

@@ -59,7 +59,7 @@
  *    `INTRA_TXN_PLAIN_READS` 每条带理由);真值神谕:`test/sql-txn-semantics-integration.test.ts`(三引擎)。
  *
  * **④ 引擎事实不进店** —— `SqlDriver.facts` 是**运维读面**(`GET /v1/diagnostics/wiring` 的 `sqlEngine`
- *    段与 `GET /v1/capabilities` 的 `sql` 位)的料。店里不许出现 `if (engine === …)`:引擎判别在全仓
+ *    段与 `GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,S-866 ①))的料。店里不许出现 `if (engine === …)`:引擎判别在全仓
  *    只有连接初始化这一处,机器门 G-A 守着。`SqlDialect`(SQL **文本**方言,两值)与 `engine`(运行期
  *    引擎事实,三值)是两条轴,刻意不合成一个三值。
  *

package/dist/plugins/store-backend.d.ts

@@ -13,6 +13,7 @@ import { type ApprovalAskStore as ApprovalAskStoreType } from "./approval-ask-st
 import { type MemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
+import { type SessionPolicyStoreLogger } from "./session-policy-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
 import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
@@ -31,6 +32,7 @@ import { type AdoptionLogStore } from "./adoption-log-sql.js";
 import { type SqlRetentionStore, type SqlRetentionStoreOptions } from "./retention-store-sql.js";
 import { type RetentionLaneStore } from "./retention-lane-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
+import { type StoreDegradedReason } from "../store-posture.js";
 /** boot 期的一条日志座(级别由**座位**决定,不由参数携带):`createStoreBackend` 的 `onWarn` / `onError`
  *  两参与 `LocalBackend` 的同名字段共用此形。装配层把它们分别接到 `logger.warn` / `logger.error` 上。 */
 export type BootLogSink = (msg: string, meta?: Record<string, unknown>) => void;
@@ -194,8 +196,9 @@ export interface StoreBackend {
      *  mapping from URLs). REQUIRED on all backends (works local — one JSONL, like approvalExemption). */
     sendFileLedger(): SendFileLedger;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
-     *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
-    sessionPolicy(): ServiceSessionPolicyStore;
+     *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore.
+     *  `logger`:SQL 孪生抹除封键那一臂(S-891)的点名口(缺席 ⇒ 店退回 `console.warn`);local(core 的 File 店)不收。 */
+    sessionPolicy(logger?: SessionPolicyStoreLogger): ServiceSessionPolicyStore;
     /** [ref] per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
      *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed
      *  `FileFileHistoryStore` under the data root). Backs core's RunnerDeps.fileHistoryStore. */
@@ -394,6 +397,12 @@ export declare function openStoreBackendWithFallback(config: ServiceConfig, logg
     error?: (msg: string, meta?: Record<string, unknown>) => void;
 }): Promise<{
     backend: StoreBackend | undefined;
-    degraded: boolean;
+    degradedReason: StoreDegradedReason | undefined;
 }>;
+/**
+ * S-866 ⑤c / G4 —— SQL 族「显式要了持久而店打不开」的拒启句(唯一铸点)。点名 `DB_BACKEND=<引擎>`,给三条出路:修坐标 / 连通性;
+ * `SESSION_BACKEND=auto`(尽力而为:店不可达时以内存起服,什么都不持久);`DB_BACKEND=memory`(显式内存部署)。驱动原文只取 message
+ * (与修前 `fatalExit` 打出的同一句),凭据不在其中(驱动不回显口令)。
+ */
+export declare function buildSqlStoreOpenRefusal(engine: "mysql" | "pg", err: unknown): string;
 //# sourceMappingURL=store-backend.d.ts.map

package/dist/plugins/store-backend.js

@@ -52,6 +52,7 @@ import { TiDBRetentionLaneStore, PgRetentionLaneStore } from "./retention-lane-s
 import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { createFilePermissionRuleStores } from "./permission-rule-store-file.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { storeDegradedReasonFor } from "../store-posture.js";
 function historyBlobBackend(config, dialect, pool) {
     const s = config.snapshotBlobStore;
     if (!s)
@@ -122,7 +123,7 @@ class TiDBBackend {
     approvalAsk() { return new TiDBApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
-    sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
+    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
@@ -170,7 +171,7 @@ class PgBackend {
     approvalAsk() { return new PgApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
-    sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
+    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
@@ -346,15 +347,25 @@ export async function openStoreBackendWithFallback(config, logger) {
             throw err;
         if (err instanceof StoreBootRefusalError)
             throw err;
-        if (!mayFallback)
+        if (!mayFallback) {
+            if (config.dbBackend === "mysql" || config.dbBackend === "pg")
+                throw new Error(buildSqlStoreOpenRefusal(config.dbBackend, err), { cause: err });
             throw err;
+        }
         logger.warn("store_db_unreachable_fallback_memory", {
             backend: backend?.kind ?? config.dbBackend,
             error: err instanceof Error ? err.message : String(err),
         });
         await backend?.close().catch(() => undefined);
-        return { backend: undefined, degraded: true };
+        return { backend: undefined, degradedReason: storeDegradedReasonFor(config.dbBackend) };
     }
-    return { backend, degraded: false };
+    return { backend, degradedReason: undefined };
+}
+export function buildSqlStoreOpenRefusal(engine, err) {
+    const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
+    const detail = err instanceof Error ? err.message : String(err);
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store (${detail}) — refusing to boot, because DB_BACKEND asks for a durable store and SESSION_BACKEND does not allow running without it. ` +
+        `Next: fix the ${coords} coordinates or the store's reachability; or set SESSION_BACKEND=auto to boot in memory while the store is unreachable (best effort — nothing persists, and /health reports storeDegraded); ` +
+        `or set DB_BACKEND=memory for an explicitly in-memory deployment.`);
 }
 //# sourceMappingURL=store-backend.js.map

package/dist/plugins/tidb-pool.js

@@ -390,7 +390,7 @@ export const SCHEMA_STATEMENTS = [
      -- 被删会话(**明文**会话 id —— 所以它必须随会话一起走,见上)。记号的读写按 policy_key 单键;托管留存的整树
      -- 清扫按本列删(S-546 A9,索引 idx_session_policy_rev_mark_session)。
      session_id VARCHAR(64)  NOT NULL,
-     -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。
+     -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。= 安全整数上界 ⇒ 封键(S-891:被抹行的计数读不出;运营方原地解封,见 USAGE §9.11)。
      rev        BIGINT       NOT NULL,
      -- 这把键的**下一行从第几代开始**(每次抹除 +1;与 core File 侧车 <stem>.hwm.json 的 __gen 同义)。
      -- 血统必须比它终结的那一行活得久,理由与 rev 完全一样:留在行里就等于跟着行一起消失。

package/dist/read-face-posture.d.ts

@@ -25,10 +25,10 @@
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
  * `readDenyBuiltinExclude`)一个字节不动 —— 放开容纳面不等于放开那几档 deny,两者在 core 里是**并列
  * 机制**(有活行的 deny 表在 open 面上照样拦)。
- * ⚠️ **但别把这句话读成「凭证/shell 历史/钱包那几档一直在岗」**:core 7.22.0([ref])起内建表的**缺省
- * 选择是空** —— 一台没写 `READ_DENY_BUILTIN_TIERS` 的部署上,那张表**一行都不生效**(要老姿态就显式写
- * `credentials,browser,wallet,agent-config`;运维面全文见 `docs/DEPLOY-PREREQS.md` 的 core 7.22.0 段)。
- * 本模块的定界不变,变的是「并列的那一侧默认开着」这个**前提**。core 的 `config.read_face_deployment_clamped`
+ * ⚠️ **但别把这句话读成「每一档都一直在岗」**:内建表的缺省选择是 core 的 `READ_DENY_DEFAULT_TIERS` —— core 7.34.0 R-2 起
+ * = `credentials` + 家目录锚定的 `agent-config` 两档(7.22.0–7.33.x 是空选择 OFF;7.106.0 合并复审 X10-L2 改真)。一台没写
+ * `READ_DENY_BUILTIN_TIERS` 的部署上只有这两档生效(shell 历史 / 浏览器 / 钱包要显式写,`none` = 一行都不生效)。
+ * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
 import { type PostureSource } from "./posture-source.js";

package/dist/request-key-closure.js

@@ -19,10 +19,10 @@ export function keyClosureClause(names, label) {
 }
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
-    "appendSystemPrompt", "approverPosture", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
     "excludeAllTools", "excludeTools", "fileHistory",
-    "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
+    "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",

package/dist/request-value-closure.d.ts

@@ -10,8 +10,8 @@
  * 一个敲错的隐私/收紧请求被静默丢掉(用户以为关了,其实没关),或者一个敲错的键把功能静默关掉。
  *
  * 🔴 **判别是「值域恰好是一个关断词」,不是「值域恰好是一个字面量」**(S-724 加 `fileHistory` 时定形):
- * `approverPosture` 的值域也只有一个词(`"bypass"`),但它是一句**姿态声明**、闭集属主在 core、本仓刻意**零判据**
- * (`http/wire-types.ts` 那一段逐字成文);把判别放宽成「单字面量」会把它也拖进本表 = 同一语义面第二个判官。
+ * 当年的反例是 `approverPosture`(值域也只有一个词 `"bypass"`,但它是一句**姿态声明**、闭集属主在 core,本仓刻意零判据);
+ * 那个请求键已随 core 7.34.0 退役(S-877,[ref] 裁 ③),判别式的理由不变 —— 一个非关断的单字面量键不属于本表。
  * 关断词全集 {@link OffSwitchWord} 是 core 的两种关断拼法,新增第三种拼法 = 加一个词(并逐键重判)。
  *
  * ## 为什么是一只判据函数,不是每处一抄
@@ -53,10 +53,14 @@ export declare const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be th
 /**
  * S-724 b′(主会话裁,车PW codex r1 [high] 复现后)—— `fileHistory: "disabled"` 与还原**同体**的拒句(`request.field_conflict`)。
  * 与 `tool-approval.ts` 的 `SETTLED_BY_DENY_ONLY` / `READ_ROOT_GRANT_ALLOW_ONLY` **同一族**:「只看体就能判的矛盾,在裁决之前响亮说」。
- * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`),但它的拒
- * 落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
- * 且拒后不回滚 —— 拒传不回来。所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
+ * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`)。立门时(7.104.0)
+ * core 的拒落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
+ * 且拒后不回滚 —— 所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
  * 能不能共存,不看部署、不看店。
+ * ⚠️ S-865 / S-877(core 7.35.0 #1195):core 起把只看请求体就判得出的拒因(本码在内)挪到**会话 acquire 之前**的请求门
+ * (`runner/file-history-request.js`),被拒的请求会话日志逐字节不动 —— 本门当年防的那个副作用在引擎侧已不存在。本门的 400
+ * 照旧有效(core wire 单:「the at-accept 400 stays valid」),退不退(退则 fresh 腿改落 core 的 422 `rewind.capture_disabled`)
+ * 列 7.106.0 收车档候裁。
  * 判据:{@link fileHistoryRestoreConflict}。**只在 fresh 受理门**(`http/admission.ts`);续跑腿不过这道门(RESUME 重放不过受理门,
  * 同律 —— 且续跑腿重建时整族剥掉一次性历史动作,矛盾在盘上的体里本就留不下来)。wire 可见、字节冻结。
  */
@@ -96,5 +100,13 @@ export interface SingleMemberOffFieldIssue {
  * 全部合法或全部缺席 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。
  */
 export declare function singleMemberOffFieldIssue(raw: unknown): SingleMemberOffFieldIssue | null;
+/** `inheritEnv` 的受理词表(闭集;**顺序 = 拒句里的列举顺序**)。 */
+export declare const INHERIT_ENV_WORDS: readonly ["all", "scrub"];
+/** 一条请求能声明的继承策略(wire 形,见 `TaskRequestBody.inheritEnv`)。 */
+export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
+/** 词表外的拒句(wire 可见;点名两词与各自的意思 —— 拿错的人要在同一条回执里读到该发什么)。 */
+export declare const INHERIT_ENV_VALUE_MESSAGE: string;
+/** `inheritEnv` 在场且不在词表里 ⇒ 拒句;缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。 */
+export declare function inheritEnvFieldIssue(raw: unknown): string | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -23,4 +23,16 @@ export function singleMemberOffFieldIssue(raw) {
     }
     return null;
 }
+export const INHERIT_ENV_WORDS = ["all", "scrub"];
+export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
+    `("all" = the model-driven host shell inherits this machine's whole environment, honored only on a single-user host-lane deployment; ` +
+    `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
+export function inheritEnvFieldIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const value = raw.inheritEnv;
+    if (value === undefined)
+        return null;
+    return INHERIT_ENV_WORDS.includes(value) ? null : INHERIT_ENV_VALUE_MESSAGE;
+}
 //# sourceMappingURL=request-value-closure.js.map

package/dist/router/route-orchestration.d.ts

@@ -104,6 +104,17 @@ export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: stri
  *  - `toolPolicy` — ALSO ask on the direct write hand tools `Edit`/`Write` (review HIGH: shellGate alone
  *    leaves a non-isolated SUP task able to mutate the real fs via write tools ungated). The worker's existing
  *    approval machinery (durable suspend / poll) enforces the `ask` — same precondition as `shellGate:"always"`.
+ *
+ * 🔴 S-897(7.106.0,[ref]):这些 ask 是**部署**(运维开的 `ROUTER_ENABLED` 路由)写下的门 ⇒ 盖 core 的部署出身位
+ * `authoredBy:"deployment"`,经**唯一**盖位函数(`operator-ask.ts` 的 `withDeploymentAuthorship`,经 `operatorAlwaysHumanAsk`
+ * 取用 —— 治理层 ask、`APPROVAL_NEVER_AUTO` / 预算耗尽 ask 同一只)。修前:写工具的 ask 只自报 `matchedAskRule`(非强制卡),
+ * shellGate always 的 shell ask 是 core 自铸的、没有出身位 ⇒ 卡上只剩单个强制词(`operator_always`;读边界探针命中时是
+ * `probe_mandate`,它把 always 藏在后面)⇒ bypass 下壳按那一个词放行(cli L-758 的规则面)。盖了之后 core 判 `mandated`、
+ * 不铸 `mandate` 词(表外的门)⇒ 活卡与 park 行两腿都读成「另有门在」,壳出卡。
+ * shell 那一问的出身只能由**策略的** ask 带进去(core 的 shell 座铸的 ask 没有出身位的写口)⇒ 策略对 shell 工具也问一次,
+ * core 把它与 shellGate always 折成同一只 ask(不是两问)。
+ * ⚠️ 连带(产品面,如实):写工具的 ask 从此也是强制卡 ⇒ 用户的「本会话放行」不再退役 SUP 路由的写门(shell 那一问修前就退不掉)。
+ * 不改路由判据本身(`routeServiceTask` 一字不动)。
  */
 export declare function supPostureOverrides(): Partial<TaskSpec>;
 //# sourceMappingURL=route-orchestration.d.ts.map

package/dist/router/route-orchestration.js

@@ -1,5 +1,5 @@
-import {} from "@sema-agent/core";
-import { operatorAsk } from "../operator-ask.js";
+import { COARSE_SHELL_TOOLS } from "@sema-agent/core";
+import { operatorAlwaysHumanAsk } from "../operator-ask.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -40,11 +40,12 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
     return false;
 }
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
+const SHELL_TOOLS = new Set(COARSE_SHELL_TOOLS);
 export function supPostureOverrides() {
-    const ask = (toolName) => operatorAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
-    const writeGate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
+    const ask = (toolName) => operatorAlwaysHumanAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
+    const gate = {
+        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) || SHELL_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };
-    return { shellGate: "always", toolPolicy: writeGate };
+    return { shellGate: "always", toolPolicy: gate };
 }
 //# sourceMappingURL=route-orchestration.js.map

package/dist/run-local.js

@@ -9,6 +9,7 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
+import { createUnattendedLeg, unattendedPermissionMode, withUnattendedLeg } from "./unattended-permission-mode.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -567,7 +568,8 @@ export async function runLocal(argv, deps = {}) {
         ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
-    const spec = applyLocalGovernance({
+    const unattendedLeg = createUnattendedLeg(unattendedPermissionMode(config), runnerDeps);
+    const spec = withUnattendedLeg(applyLocalGovernance({
         objective: mention.cleanedObjective,
         sessionId,
         backgroundScope: "session",
@@ -583,7 +585,7 @@ export async function runLocal(argv, deps = {}) {
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),
         ...(Object.keys(limits).length > 0 ? { limits } : {}),
-    }, config, workspaceDir, memoryEngine?.root);
+    }, config, workspaceDir, memoryEngine?.root), unattendedLeg);
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: executionLaneOf(config.remoteExec?.provider) });
     const settleSessionBackground = async () => {
         const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);

package/dist/runs.d.ts

@@ -150,7 +150,8 @@ export declare function isSessionConflictResult(result: {
  * 逐码显式登记为债务,并由那道门看住不许陈腐。
  *
  * S-724(core 7.31.0 #1048 / #1050):`rewind.capture_disabled` → **422**(关断词与还原同体 = 自相矛盾;本服务的请求面上
- * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(core 这一拒落在会话分叉之后、不回滚);映射是分诊面完备性)、`rewind.store_unconfigured`
+ * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(立门理由:core 这一拒落在会话分叉之后、不回滚;S-865 / core 7.35.0
+ * #1195 起 core 在分叉之前拒);映射是分诊面完备性)、`rewind.store_unconfigured`
  * → **409**(部署没有历史店;`FILE_HISTORY_CAPTURE=false` 自本版不再摘店 ⇒ 可达面只剩没有后端的部署形,那里
  * `capabilities.rewindFiles` 恒报 false —— 三问在 CHANGELOG 7.104.0)。
  */

package/dist/runs.js

@@ -1,7 +1,7 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
-import { ROSTER_BOUND_HTTP_STATUS } from "./roster-bound-http-status.js";
+import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js";
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
@@ -76,8 +76,8 @@ export function resumeAtHttpStatus(result) {
     if (Object.hasOwn(GOVERNANCE_HTTP_STATUS, code)) {
         return GOVERNANCE_HTTP_STATUS[code] ?? undefined;
     }
-    if (Object.hasOwn(ROSTER_BOUND_HTTP_STATUS, code)) {
-        return ROSTER_BOUND_HTTP_STATUS[code];
+    if (Object.hasOwn(TOOL_DECLARATION_HTTP_STATUS, code)) {
+        return TOOL_DECLARATION_HTTP_STATUS[code] ?? undefined;
     }
     if (isSessionErrorCode(code)) {
         const wire = sessionErrorHttp(code, "open");
@@ -208,7 +208,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     if (approval) {
         const coordinator = approval.coordinator;
         spec.onAsk = approvalLeg.windowZero
-            ? (askReq) => Promise.resolve(coordinator.unattendedAskOutcome({ taskId, owner: elicitOwner ?? owner, toolName: askReq.toolName }))
+            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}) })
             : coordinator.boundAsk({
                 owner: elicitOwner ?? owner,
                 taskId,

package/dist/runtime-caps-resolver.d.ts

@@ -113,18 +113,12 @@ export interface EntitlementsResolverOpts {
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`;**[ref] / core [ref] 起三态**,黑板 [ref]/[ref]):
  *  `undefined`(center 缺席/未答)= 不阻;`true` = 不阻;`false` = **org deny**(CC `permissions.disableAutoMode`
- *  镜像)。core 武装式 = `spec.autoModeRequested === true ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`
+ *  镜像)。core 武装式 = `spec.permissionMode === "auto" ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`(core 7.34.0 起;此前意图座是退役的 `autoModeRequested`)
  *  ——「用户开 + org 拒」极性(此前是 `=== true` 的「org 授予」极性,无 center 的本地部署零授予路径 ⇒ auto 永不
  *  武装,真实用户诊断的病根)。
- *  🔴 **上面那条武装式是 [ref] 的目标形,不是「本仓现在装的那版 core 的形」——引用它之前先看装的是哪版**
- *  ([ref]① 随 codex r2-[high] 补:我方在 WIRE 附录 F 照抄这一句,写成了「7.2.0 的行为」,而 npm **7.2.0
- *  不含 [ref]** —— 它的 `dist/core/runner/prepare-task.js` 逐字仍是 `runtimeCaps?.autoMode === true &&
- *  deps.autoMode !== undefined`,即旧「org 授予」极性、**缺键 ⇒ 不武装**)。判「现在是哪套极性」的唯一判据 =
- *  安装包探针 `CORE_ARMS_AUTO_ON_INTENT`(`src/auto-mode-face.ts`;实测本树 7.2.0 ⇒ **false** = 旧式臂),
- *  代码侧已按它分臂,失实的只是散落各处的散文。⚠️ 同形措辞在本文件 :209 / :362-364 / :548 与
- *  `src/boot/runtime-caps.ts:182` 还各有一处(均 [ref] 既有文字,本批未逐条改 —— 登记在 handoff 未闭环项)。
- *  所以**缺键=不写键**在这条轴上是行为承重的(在新式 core 上):补一个 false 就是替 org 说了一句
- *  它没说的 deny;在旧式 core 上两者同为「不武装」,差别不显形。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
+ *  ([ref]① 的历史:npm 7.2.0 不含 [ref]、是旧「org 授予」极性,本仓曾用安装包探针分臂;S-877 / core 7.34.0 起引擎只剩
+ *  上面这一种极性,探针随 7.106.0 退役 —— 本仓精确钉的 core 恒是它。)
+ *  所以**缺键=不写键**在这条轴上是行为承重的:补一个 false 就是替 org 说了一句它没说的 deny。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /**
  * #A5([ref] 件2)—— 「这台 worker 上**存在** per-principal entitlement 源吗」的**单一谓词**。