@sema-agent/server 7.105.0 → 7.107.0

package/dist/operator-ask.js

@@ -1,4 +1,10 @@
 export function operatorAsk(rule, message) {
     return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
 }
+export function operatorAlwaysHumanAsk(rule, message) {
+    return withDeploymentAuthorship(operatorAsk(rule, message));
+}
+export function withDeploymentAuthorship(ask) {
+    return { ...ask, authoredBy: "deployment" };
+}
 //# sourceMappingURL=operator-ask.js.map

package/dist/parked-decide.d.ts

@@ -9,7 +9,7 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
@@ -142,6 +142,19 @@ export interface ParkedDecideDeps {
     rebuildInheritedGate?: (row: BackgroundAgentRecord, identity: {
         principal: string | undefined;
     }) => Promise<RebuiltInheritedGate | undefined>;
+    /**
+     * 🔴 S-877 四续 ⑪ —— 复活子代**自己的**审批席(`ToolExecuteContext.onAsk`:core 的委派工具把它转给子代,子代自己的引擎问 —— 模式写门 /
+     * 形状层 —— 在这里答)。本腿直接调 `execute`,不经 Runner,ctx 由本腿铸;不给 ⇒ 子代自己的问落 subRunner 的 `deps.onAsk`(协调器
+     * `ask()` 的无 ALS 上下文臂,没有会话身份 ⇒ 读不了会话授权 ⇒ 每条非只读命令 / 每次写都再 park,`remember:"session"` 对复活子代无效;
+     * 子代活着时同一问落父的席、带身份、读得到授权 —— 同一个子代两种答案)。生产 = 协调器的窗 0 席 `boundUnattendedAsk`(与 bg run 腿给父任务
+     * 装的同一只):身份 = 行的根会话(与 remember 的授权锚同键 {@link grantRootOf})+ 权威 principal;授权读不中 ⇒ 无人值守政策口(park),
+     * 不放宽。缺席(协调器未装的部署)⇒ ctx 不带座,逐字今天。
+     */
+    approverSeatFor?: (identity: {
+        owner: string | null;
+        taskId: string;
+        sessionId: string;
+    }) => NonNullable<ToolExecuteContext["onAsk"]>;
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
 export interface ParkedDecideRequest {

package/dist/parked-decide.js

@@ -62,6 +62,9 @@ export async function findParkedAgentForCheckpoint(agentStore, cp) {
     }
     return undefined;
 }
+function grantRootOf(row) {
+    return row.rootSessionId ?? row.parentSessionId;
+}
 function mintReviveArgs(row, knownAgentTypes) {
     return {
         prompt: row.description ?? "resume parked agent",
@@ -148,7 +151,7 @@ function sessionGone(taskId) {
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
-    const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
+    const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
         return { status: 400, body: { error: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", errorCode: "decide.parked_remember_unsupported", taskId: match.handle } };
     }
@@ -234,9 +237,13 @@ export async function decideParkedAgent(deps, req, match) {
         }
     }
     const outcome = buildParkedResumeOutcome(req);
+    const seatRoot = grantRootOf(row);
     const ctx = {
         toolCallId: `drv-${ticket.claimId}`,
         ...(surface.mountsCallerTool !== undefined ? { mountsCallerTool: surface.mountsCallerTool } : {}),
+        ...(deps.approverSeatFor !== undefined && seatRoot !== undefined
+            ? { onAsk: deps.approverSeatFor({ owner: decodeCheckpointScope(req.scope) ?? null, taskId: match.handle, sessionId: seatRoot }) }
+            : {}),
         reviveClaim: {
             row: { ...ticket.row, parkClaimId: ticket.claimId },
             rev: ticket.reservedRev,

package/dist/plugins/session-policy-store-sql.d.ts

@@ -3,6 +3,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type JsonColumnShape } from "./sql-json-column.js";
 import { type SqlDriver } from "./sql-driver.js";
+import type { Logger } from "../observability/logger.js";
 /** `session_policy.policy_key` 的**唯一铸造点**(core 复合键的 sha256)。
  *
  *  🔴 导出而不是让收编腿再抄一份(clay 宪法「schema 单一属主禁复制」):[ref] form b 的身份重绑要
@@ -32,20 +33,26 @@ export declare const policyKeyFor: (sessionId: string, principal: string | undef
  * + 恰好解一次 `decodeJsonColumn` + 折码 `foldJsonColumn`);本店只留「形判据是哪一只」与「坏体折成哪个码」。
  */
 export declare function readSessionRulesBody(body: unknown): JsonColumnShape<SessionPermissionRules>;
+/** 本店唯一的日志口:抹除封键那一臂(S-891)的点名。缺席 ⇒ 退回 `console.warn`(不静默)。 */
+export type SessionPolicyStoreLogger = Pick<Logger, "warn">;
 /** Dual-dialect durable SessionPolicyStore. See the file header for the dialect-delta ledger. */
 export declare class SqlSessionPolicyStore implements SessionPolicyStore {
     private readonly db;
-    constructor(db: SqlDriver);
+    private readonly logger?;
+    constructor(db: SqlDriver, logger?: SessionPolicyStoreLogger | undefined);
     /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
     private q;
     /** 判据属主 = `sql-errors.ts`([ref] P1-①;本站点旧形已是并集形,收编后语义不变)。 */
     private isDupKey;
-    /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory). */
+    /** Read the stored rules for (session, principal-owner); null when none (parity with InMemory).
+     *  🔴 S-891(codex r1 [high] ①):同一条语句带上这把键的**封键记号** —— 封着 ⇒ `corrupt`,不答「没有规则」(见 {@link sealedKeyError})。 */
     getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
     /** 2c session-sync: every (principal, rules) record for a session across ALL principals — getRules is
      *  per-(session,principal), but a cross-backend session EXPORT must bundle the WHOLE session's policy (the importer
      *  replays each via putRules). principal is read from the DENORMALIZED column (the sha256 policy_key is one-way);
-     *  NULL → undefined = the session-wide row (parity with core's InMemory `principal ?? undefined`). Rules carry rev. */
+     *  NULL → undefined = the session-wide row (parity with core's InMemory `principal ?? undefined`). Rules carry rev.
+     *  🔴 S-891:会话里有**封着的键** ⇒ 整只枚举 `corrupt`(与一行读不出形时整只枚举拒同一口径 —— 导出一份缺了那把键的规则,
+     *  导入方就会把「状态未知」当成「这个 principal 没有规则」)。 */
     listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
     /** Operator/owner write: CAS + tighten-only (unless operator) + rev bump, atomic in one txn; first-write race retried. */
     putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
@@ -91,7 +98,8 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
      *      against a CURRENT read (PG is pinned to READ COMMITTED, TiDB's DML is a current read), so a row for a
      *      DIFFERENT principal that a concurrent putRules commits BETWEEN ① and ③ would be deleted by a session-wide
      *      DELETE while ② never marked it — a silently reset rev line, exactly the defect this batch exists to close.
-     *      Scoped to the key set, the invariant is exact and checkable: **every row this seam deletes leaves a mark**.
+     *      Scoped to the key set, the invariant is exact and checkable: **every row this seam deletes leaves a mark** —
+     *      a readable row's mark continues its rev line and ends its lineage; an unreadable row's mark SEALS its key (S-891, below).
      *      A row born after ① is simply not part of this erase (same as one born a microsecond after ③ — the caller
      *      that needs "and nothing came back" re-issues; the seam is idempotent).
      *  No rows ⇒ return early: an erase of a session that never had rules writes NO mark (no line, nothing to keep),
@@ -99,8 +107,31 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
      *  Why the mark is a separate table and not a tombstone row: see the DDL comment in tidb-pool.ts — a tombstone
      *  would keep `session_id` + the DENORMALIZED plaintext `principal` in the table after an E21 purge, i.e. the
      *  right-to-delete would degrade to buy rev ordering. The mark keeps only the one-way hash, the session id and
-     *  an integer. */
+     *  an integer.
+     *
+     *  🔴 **S-891(7.106.0)—— 抹除恒删行;计数读不出的行留「封键记号」**。一行的计数读不出(三个读点的同一只判词
+     *  {@link readRowCounters} 判坏:`rev` 不是 ≥ 1 的安全整数 / `gen` 不是 ≥ 0 的安全整数;或下一代的号 `gen + 1` 已出安全整数)
+     *  ⇒ 这一行**照删**,它的记号元组写 `(键, 会话, {@link SEALED_MARK_REV}, 0, 时刻)`、走**同一句** `GREATEST` 合并:rev 落上界,
+     *  世代 = `GREATEST(旧记号.gen + 1, 0)`(有旧记号照抬,没有就是 0)。于是这把键的下一次 `putRules` 算出 `上界 + 1`,被写前那道
+     *  **同一只** {@link isStoredCounter} 拒(`corrupt`,零写);读面同答 `corrupt`({@link sealedKeyError})—— **封键**,直到运营方
+     *  显式解封(USAGE §9.11:原地把记号的 `rev` 归 0、`gen` + 1;不删记号,删了会交回世代)。
+     *  两条都不许丢,所以是这个形:
+     *   · **删得掉** —— 抹除是运营方清坏行的出路(E21 `DELETE /v1/sessions/:id`、2c overwrite-dst 都经这里)。7.105.0 的「拒,一条写
+     *     都不发」让一行坏计数把整个会话的删除半程停住、重试恒败;
+     *   · **不许同世代** —— 修复车 QS 的「照删、不写记号」被 codex 真复现:这把键的血统没在本次抹除上结束,重建行从旧记号起号、
+     *     与持有**旧快照**的活读者同世代 ⇒ 读者把重建的宽松行读成延续(deny → allow)。读不出的号不能拿来结束血统,
+     *     那就不让这把键再有下一行,直到有人看过。
+     *  响亮面:提交**之后**一条 warn(`session_policy_erase_sealed_keys`,点名会话与被封的键 + 两个计数的原文;回滚了就什么都没封,
+     *  死锁重试也不重复报)。这**不是** fail-open(没有放行任何东西,方向是 fail-closed),所以不走 `recordFailOpen`;普查登记 P 类终态。
+     *  残余(如实):记号里**已有**的世代若被列外改到 BIGINT 上界,冲突臂的 `记号.gen + 1` 在库里溢出 ⇒ 这次抹除响亮失败
+     *  (驱动错误;那只记号本来就读不回,`putRules` 同样拒)—— 抹除不读记号,这一形不在本判词射程内。 */
     deleteBySession(sessionId: string): Promise<void>;
+    /**
+     * S-891 封键的响亮面:一次抹除至多一条 warn。日志座**抛** ⇒ 退回 `console.warn` 带原句 —— 走到这里删除已经提交,
+     * 一次日志故障不许把它报成失败(E21 会因此 500、overwrite-dst 会因此中止;codex 7.105.0 修复验证轮 [medium] 同形)。
+     * 缺日志座(直接 `new` 本店的工具 / 测试)⇒ `console.warn`,不静默。
+     */
+    private discloseSealed;
     /**
      * The store's one read-check-write transaction. Its load-bearing read is line ~106's
      * `SELECT rules, rev … FOR UPDATE` — a LOCKING read, therefore a CURRENT read on both engines, which is
@@ -114,10 +145,10 @@ export declare class SqlSessionPolicyStore implements SessionPolicyStore {
 }
 /** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
 export declare class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool: MySqlPool);
+    constructor(pool: MySqlPool, logger?: SessionPolicyStoreLogger);
 }
 /** PostgreSQL binding — historical class name + ctor shape preserved. */
 export declare class PgSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, logger?: SessionPolicyStoreLogger);
 }
 //# sourceMappingURL=session-policy-store-sql.d.ts.map

package/dist/plugins/session-policy-store-sql.js

@@ -26,9 +26,15 @@ function isStoredCounter(n, floor) {
     return Number.isSafeInteger(n) && n >= floor;
 }
 function rowToStored(r, where) {
+    const counters = readRowCounters(r, where);
+    if ("problem" in counters)
+        throw new SessionPolicyError("corrupt", counters.problem);
+    return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev: counters.rev, gen: counters.gen };
+}
+function readRowCounters(r, where) {
     const rev = Number(r.rev);
     if (!isStoredCounter(rev, 1)) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always a whole number ≥ 1 within the safe-integer range (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules`);
+        return { problem: `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always a whole number ≥ 1 within the safe-integer range (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules` };
     }
     if (r.gen === undefined || r.gen === null) {
         throw new Error(`session_policy row ${where} came back without a \`gen\` column — a read leg did not project it (the column is BIGINT NOT NULL on both dialects). ` +
@@ -36,14 +42,22 @@ function rowToStored(r, where) {
     }
     const gen = Number(r.gen);
     if (!isStoredCounter(gen, 0)) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0 within the safe-integer range; refusing rather than let a reader judge lineage by a value nothing minted`);
+        return { problem: `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0 within the safe-integer range; refusing rather than let a reader judge lineage by a value nothing minted` };
     }
-    return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev, gen };
+    return { rev, gen };
+}
+const SEALED_MARK_REV = Number.MAX_SAFE_INTEGER;
+const SEALED_EVENT = "session_policy_erase_sealed_keys";
+const NO_SEALED_KEYS = [];
+function sealedKeyError(sessionId, what) {
+    return new SessionPolicyError("corrupt", `session rules for session ${JSON.stringify(sessionId)}: ${what} is sealed — an erase removed a row whose counters were unreadable (session_policy_rev_mark.rev = ${SEALED_MARK_REV}), so its rule state is unknown; refusing rather than serve it as "no rules" until an operator unseals it (USAGE §9.11)`);
 }
 export class SqlSessionPolicyStore {
     db;
-    constructor(db) {
+    logger;
+    constructor(db, logger) {
         this.db = db;
+        this.logger = logger;
     }
     q(tidb, pg) {
         return this.db.dialect === "tidb" ? tidb : pg;
@@ -52,13 +66,23 @@ export class SqlSessionPolicyStore {
         return isDupKeyError(this.db.dialect, e);
     }
     async getRules(sessionId, principal) {
-        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE policy_key = ?`, `SELECT ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE policy_key = $1`), [policyKey(sessionId, principal)]);
-        if (!rows[0])
+        const key = policyKey(sessionId, principal);
+        const { rows } = await this.db.query(this.q(`SELECT 'row' AS src, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE policy_key = ?` +
+            " UNION ALL SELECT 'seal', NULL, rev, gen FROM session_policy_rev_mark WHERE policy_key = ? AND rev = ?", `SELECT 'row' AS src, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE policy_key = $1` +
+            " UNION ALL SELECT 'seal', NULL, rev, gen FROM session_policy_rev_mark WHERE policy_key = $2 AND rev = $3"), [key, key, SEALED_MARK_REV]);
+        if (rows.some((r) => r.src === "seal"))
+            throw sealedKeyError(sessionId, `key ${key}`);
+        const row = rows.find((r) => r.src === "row");
+        if (row === undefined)
             return null;
-        return rowToStored(rows[0], `for session ${JSON.stringify(sessionId)}`);
+        return rowToStored(row, `for session ${JSON.stringify(sessionId)}`);
     }
     async listBySession(sessionId) {
-        const { rows } = await this.db.query(this.q(`SELECT principal, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE session_id = ?`, `SELECT principal, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE session_id = $1`), [sessionId]);
+        const { rows } = await this.db.query(this.q(`SELECT 'row' AS src, principal, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE session_id = ?` +
+            " UNION ALL SELECT 'seal', NULL, NULL, rev, gen FROM session_policy_rev_mark WHERE session_id = ? AND rev = ?", `SELECT 'row' AS src, principal, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE session_id = $1` +
+            " UNION ALL SELECT 'seal', NULL, NULL, rev, gen FROM session_policy_rev_mark WHERE session_id = $2 AND rev = $3"), [sessionId, sessionId, SEALED_MARK_REV]);
+        if (rows.some((r) => r.src === "seal"))
+            throw sealedKeyError(sessionId, "one of its keys");
         return rows.map((r) => ({
             principal: r.principal == null ? undefined : String(r.principal),
             rules: rowToStored(r, `for session ${JSON.stringify(sessionId)} (enumeration)`),
@@ -120,22 +144,20 @@ export class SqlSessionPolicyStore {
         }
     }
     async deleteBySession(sessionId) {
-        await this.retrying(() => this.tx(async (conn) => {
+        const sealed = await this.retrying(() => this.tx(async (conn) => {
             const { rows } = await conn.query(this.q("SELECT policy_key, rev, gen FROM session_policy WHERE session_id = ? ORDER BY policy_key FOR UPDATE", "SELECT policy_key, rev, gen FROM session_policy WHERE session_id = $1 ORDER BY policy_key FOR UPDATE"), [sessionId]);
             if (rows.length === 0)
-                return;
+                return NO_SEALED_KEYS;
             const now = new Date();
             const keys = rows.map((r) => String(r.policy_key));
             const params = [];
-            for (const r of rows) {
-                const rev = Number(r.rev);
-                const nextGen = Number(r.gen ?? 0) + 1;
-                if (!isStoredCounter(rev, 1) || !isStoredCounter(nextGen, 0)) {
-                    throw new SessionPolicyError("corrupt", `session rules row for session ${JSON.stringify(sessionId)} carries rev ${String(r.rev)} / gen ${String(r.gen)} — the erase would leave a mark outside the safe-integer range; refusing before writing it`);
-                }
-            }
+            const sealedKeys = [];
             const tuples = rows.map((r) => {
-                params.push(String(r.policy_key), sessionId, Number(r.rev), Number(r.gen ?? 0) + 1, now);
+                const counters = readRowCounters(r, `for session ${JSON.stringify(sessionId)} (erase)`);
+                const readable = !("problem" in counters) && isStoredCounter(counters.gen + 1, 0);
+                if (!readable)
+                    sealedKeys.push({ policyKey: String(r.policy_key), rev: String(r.rev), gen: String(r.gen) });
+                params.push(String(r.policy_key), sessionId, readable ? counters.rev : SEALED_MARK_REV, readable ? counters.gen + 1 : 0, now);
                 const base = params.length - 5;
                 return this.db.dialect === "tidb" ? "(?,?,?,?,?)" : `($${base + 1},$${base + 2},$${base + 3},$${base + 4},$${base + 5})`;
             });
@@ -144,7 +166,27 @@ export class SqlSessionPolicyStore {
                 " ON CONFLICT (policy_key) DO UPDATE SET rev = GREATEST(session_policy_rev_mark.rev, EXCLUDED.rev), gen = GREATEST(session_policy_rev_mark.gen + 1, EXCLUDED.gen), erased_at = EXCLUDED.erased_at"), params);
             const holes = keys.map((_, i) => (this.db.dialect === "tidb" ? "?" : `$${i + 1}`)).join(",");
             await conn.query(`DELETE FROM session_policy WHERE policy_key IN (${holes})`, keys);
+            return sealedKeys;
         }));
+        if (sealed.length > 0)
+            this.discloseSealed(sessionId, sealed);
+    }
+    discloseSealed(sessionId, keys) {
+        const fields = {
+            sessionId,
+            keys,
+            note: "these rows' counters were unreadable, so the erase could not end their lineage: each key now carries a sealed rev mark and answers every read and write with SessionPolicyError corrupt until an operator unseals its session_policy_rev_mark row in place (USAGE §9.11)",
+        };
+        if (this.logger === undefined) {
+            console.warn(`[session-policy] ${SEALED_EVENT}`, fields);
+            return;
+        }
+        try {
+            this.logger.warn(SEALED_EVENT, fields);
+        }
+        catch (err) {
+            console.warn(`[session-policy] ${SEALED_EVENT} — the injected logger threw (${err instanceof Error ? err.message : String(err)})`, fields);
+        }
     }
     async tx(fn) {
         const conn = await this.db.connect();
@@ -168,13 +210,13 @@ export class SqlSessionPolicyStore {
     }
 }
 export class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, logger) {
+        super(mysqlDriver(pool), logger);
     }
 }
 export class PgSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, logger) {
+        super(pgDriver(pool), logger);
     }
 }
 //# sourceMappingURL=session-policy-store-sql.js.map

package/dist/plugins/sql-driver.d.ts

@@ -59,7 +59,7 @@
  *    `INTRA_TXN_PLAIN_READS` 每条带理由);真值神谕:`test/sql-txn-semantics-integration.test.ts`(三引擎)。
  *
  * **④ 引擎事实不进店** —— `SqlDriver.facts` 是**运维读面**(`GET /v1/diagnostics/wiring` 的 `sqlEngine`
- *    段与 `GET /v1/capabilities` 的 `sql` 位)的料。店里不许出现 `if (engine === …)`:引擎判别在全仓
+ *    段与 `GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,S-866 ①))的料。店里不许出现 `if (engine === …)`:引擎判别在全仓
  *    只有连接初始化这一处,机器门 G-A 守着。`SqlDialect`(SQL **文本**方言,两值)与 `engine`(运行期
  *    引擎事实,三值)是两条轴,刻意不合成一个三值。
  *

package/dist/plugins/store-backend.d.ts

@@ -13,6 +13,7 @@ import { type ApprovalAskStore as ApprovalAskStoreType } from "./approval-ask-st
 import { type MemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
+import { type SessionPolicyStoreLogger } from "./session-policy-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
 import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
@@ -31,6 +32,7 @@ import { type AdoptionLogStore } from "./adoption-log-sql.js";
 import { type SqlRetentionStore, type SqlRetentionStoreOptions } from "./retention-store-sql.js";
 import { type RetentionLaneStore } from "./retention-lane-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
+import { type StoreDegradedReason } from "../store-posture.js";
 /** boot 期的一条日志座(级别由**座位**决定,不由参数携带):`createStoreBackend` 的 `onWarn` / `onError`
  *  两参与 `LocalBackend` 的同名字段共用此形。装配层把它们分别接到 `logger.warn` / `logger.error` 上。 */
 export type BootLogSink = (msg: string, meta?: Record<string, unknown>) => void;
@@ -194,8 +196,9 @@ export interface StoreBackend {
      *  mapping from URLs). REQUIRED on all backends (works local — one JSONL, like approvalExemption). */
     sendFileLedger(): SendFileLedger;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
-     *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
-    sessionPolicy(): ServiceSessionPolicyStore;
+     *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore.
+     *  `logger`:SQL 孪生抹除封键那一臂(S-891)的点名口(缺席 ⇒ 店退回 `console.warn`);local(core 的 File 店)不收。 */
+    sessionPolicy(logger?: SessionPolicyStoreLogger): ServiceSessionPolicyStore;
     /** [ref] per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
      *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed
      *  `FileFileHistoryStore` under the data root). Backs core's RunnerDeps.fileHistoryStore. */
@@ -394,6 +397,12 @@ export declare function openStoreBackendWithFallback(config: ServiceConfig, logg
     error?: (msg: string, meta?: Record<string, unknown>) => void;
 }): Promise<{
     backend: StoreBackend | undefined;
-    degraded: boolean;
+    degradedReason: StoreDegradedReason | undefined;
 }>;
+/**
+ * S-866 ⑤c / G4 —— SQL 族「显式要了持久而店打不开」的拒启句(唯一铸点)。点名 `DB_BACKEND=<引擎>`,给三条出路:修坐标 / 连通性;
+ * `SESSION_BACKEND=auto`(尽力而为:店不可达时以内存起服,什么都不持久);`DB_BACKEND=memory`(显式内存部署)。驱动原文只取 message
+ * (与修前 `fatalExit` 打出的同一句),凭据不在其中(驱动不回显口令)。
+ */
+export declare function buildSqlStoreOpenRefusal(engine: "mysql" | "pg", err: unknown): string;
 //# sourceMappingURL=store-backend.d.ts.map

package/dist/plugins/store-backend.js

@@ -52,6 +52,7 @@ import { TiDBRetentionLaneStore, PgRetentionLaneStore } from "./retention-lane-s
 import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { createFilePermissionRuleStores } from "./permission-rule-store-file.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { storeDegradedReasonFor } from "../store-posture.js";
 function historyBlobBackend(config, dialect, pool) {
     const s = config.snapshotBlobStore;
     if (!s)
@@ -122,7 +123,7 @@ class TiDBBackend {
     approvalAsk() { return new TiDBApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
-    sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
+    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
@@ -170,7 +171,7 @@ class PgBackend {
     approvalAsk() { return new PgApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
-    sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
+    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
@@ -346,15 +347,25 @@ export async function openStoreBackendWithFallback(config, logger) {
             throw err;
         if (err instanceof StoreBootRefusalError)
             throw err;
-        if (!mayFallback)
+        if (!mayFallback) {
+            if (config.dbBackend === "mysql" || config.dbBackend === "pg")
+                throw new Error(buildSqlStoreOpenRefusal(config.dbBackend, err), { cause: err });
             throw err;
+        }
         logger.warn("store_db_unreachable_fallback_memory", {
             backend: backend?.kind ?? config.dbBackend,
             error: err instanceof Error ? err.message : String(err),
         });
         await backend?.close().catch(() => undefined);
-        return { backend: undefined, degraded: true };
+        return { backend: undefined, degradedReason: storeDegradedReasonFor(config.dbBackend) };
     }
-    return { backend, degraded: false };
+    return { backend, degradedReason: undefined };
+}
+export function buildSqlStoreOpenRefusal(engine, err) {
+    const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
+    const detail = err instanceof Error ? err.message : String(err);
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store (${detail}) — refusing to boot, because DB_BACKEND asks for a durable store and SESSION_BACKEND does not allow running without it. ` +
+        `Next: fix the ${coords} coordinates or the store's reachability; or set SESSION_BACKEND=auto to boot in memory while the store is unreachable (best effort — nothing persists, and /health reports storeDegraded); ` +
+        `or set DB_BACKEND=memory for an explicitly in-memory deployment.`);
 }
 //# sourceMappingURL=store-backend.js.map

package/dist/plugins/tidb-pool.js

@@ -390,7 +390,7 @@ export const SCHEMA_STATEMENTS = [
      -- 被删会话(**明文**会话 id —— 所以它必须随会话一起走,见上)。记号的读写按 policy_key 单键;托管留存的整树
      -- 清扫按本列删(S-546 A9,索引 idx_session_policy_rev_mark_session)。
      session_id VARCHAR(64)  NOT NULL,
-     -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。
+     -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。= 安全整数上界 ⇒ 封键(S-891:被抹行的计数读不出;运营方原地解封,见 USAGE §9.11)。
      rev        BIGINT       NOT NULL,
      -- 这把键的**下一行从第几代开始**(每次抹除 +1;与 core File 侧车 <stem>.hwm.json 的 __gen 同义)。
      -- 血统必须比它终结的那一行活得久,理由与 rev 完全一样:留在行里就等于跟着行一起消失。

package/dist/read-face-posture.d.ts

@@ -25,10 +25,10 @@
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
  * `readDenyBuiltinExclude`)一个字节不动 —— 放开容纳面不等于放开那几档 deny,两者在 core 里是**并列
  * 机制**(有活行的 deny 表在 open 面上照样拦)。
- * ⚠️ **但别把这句话读成「凭证/shell 历史/钱包那几档一直在岗」**:core 7.22.0([ref])起内建表的**缺省
- * 选择是空** —— 一台没写 `READ_DENY_BUILTIN_TIERS` 的部署上,那张表**一行都不生效**(要老姿态就显式写
- * `credentials,browser,wallet,agent-config`;运维面全文见 `docs/DEPLOY-PREREQS.md` 的 core 7.22.0 段)。
- * 本模块的定界不变,变的是「并列的那一侧默认开着」这个**前提**。core 的 `config.read_face_deployment_clamped`
+ * ⚠️ **但别把这句话读成「每一档都一直在岗」**:内建表的缺省选择是 core 的 `READ_DENY_DEFAULT_TIERS` —— core 7.34.0 R-2 起
+ * = `credentials` + 家目录锚定的 `agent-config` 两档(7.22.0–7.33.x 是空选择 OFF;7.106.0 合并复审 X10-L2 改真)。一台没写
+ * `READ_DENY_BUILTIN_TIERS` 的部署上只有这两档生效(shell 历史 / 浏览器 / 钱包要显式写,`none` = 一行都不生效)。
+ * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
 import { type PostureSource } from "./posture-source.js";

package/dist/request-key-closure.js

@@ -19,10 +19,10 @@ export function keyClosureClause(names, label) {
 }
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
-    "appendSystemPrompt", "approverPosture", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
     "excludeAllTools", "excludeTools", "fileHistory",
-    "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
+    "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",

package/dist/request-value-closure.d.ts

@@ -10,8 +10,8 @@
  * 一个敲错的隐私/收紧请求被静默丢掉(用户以为关了,其实没关),或者一个敲错的键把功能静默关掉。
  *
  * 🔴 **判别是「值域恰好是一个关断词」,不是「值域恰好是一个字面量」**(S-724 加 `fileHistory` 时定形):
- * `approverPosture` 的值域也只有一个词(`"bypass"`),但它是一句**姿态声明**、闭集属主在 core、本仓刻意**零判据**
- * (`http/wire-types.ts` 那一段逐字成文);把判别放宽成「单字面量」会把它也拖进本表 = 同一语义面第二个判官。
+ * 当年的反例是 `approverPosture`(值域也只有一个词 `"bypass"`,但它是一句**姿态声明**、闭集属主在 core,本仓刻意零判据);
+ * 那个请求键已随 core 7.34.0 退役(S-877,[ref] 裁 ③),判别式的理由不变 —— 一个非关断的单字面量键不属于本表。
  * 关断词全集 {@link OffSwitchWord} 是 core 的两种关断拼法,新增第三种拼法 = 加一个词(并逐键重判)。
  *
  * ## 为什么是一只判据函数,不是每处一抄
@@ -53,10 +53,14 @@ export declare const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be th
 /**
  * S-724 b′(主会话裁,车PW codex r1 [high] 复现后)—— `fileHistory: "disabled"` 与还原**同体**的拒句(`request.field_conflict`)。
  * 与 `tool-approval.ts` 的 `SETTLED_BY_DENY_ONLY` / `READ_ROOT_GRANT_ALLOW_ONLY` **同一族**:「只看体就能判的矛盾,在裁决之前响亮说」。
- * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`),但它的拒
- * 落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
- * 且拒后不回滚 —— 拒传不回来。所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
+ * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`)。立门时(7.104.0)
+ * core 的拒落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
+ * 且拒后不回滚 —— 所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
  * 能不能共存,不看部署、不看店。
+ * ⚠️ S-865 / S-877(core 7.35.0 #1195):core 起把只看请求体就判得出的拒因(本码在内)挪到**会话 acquire 之前**的请求门
+ * (`runner/file-history-request.js`),被拒的请求会话日志逐字节不动 —— 本门当年防的那个副作用在引擎侧已不存在。本门的 400
+ * 照旧有效(core wire 单:「the at-accept 400 stays valid」),退不退(退则 fresh 腿改落 core 的 422 `rewind.capture_disabled`)
+ * 列 7.106.0 收车档候裁。
  * 判据:{@link fileHistoryRestoreConflict}。**只在 fresh 受理门**(`http/admission.ts`);续跑腿不过这道门(RESUME 重放不过受理门,
  * 同律 —— 且续跑腿重建时整族剥掉一次性历史动作,矛盾在盘上的体里本就留不下来)。wire 可见、字节冻结。
  */
@@ -96,5 +100,13 @@ export interface SingleMemberOffFieldIssue {
  * 全部合法或全部缺席 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。
  */
 export declare function singleMemberOffFieldIssue(raw: unknown): SingleMemberOffFieldIssue | null;
+/** `inheritEnv` 的受理词表(闭集;**顺序 = 拒句里的列举顺序**)。 */
+export declare const INHERIT_ENV_WORDS: readonly ["all", "scrub"];
+/** 一条请求能声明的继承策略(wire 形,见 `TaskRequestBody.inheritEnv`)。 */
+export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
+/** 词表外的拒句(wire 可见;点名两词与各自的意思 —— 拿错的人要在同一条回执里读到该发什么)。 */
+export declare const INHERIT_ENV_VALUE_MESSAGE: string;
+/** `inheritEnv` 在场且不在词表里 ⇒ 拒句;缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。 */
+export declare function inheritEnvFieldIssue(raw: unknown): string | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -23,4 +23,16 @@ export function singleMemberOffFieldIssue(raw) {
     }
     return null;
 }
+export const INHERIT_ENV_WORDS = ["all", "scrub"];
+export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
+    `("all" = the model-driven host shell inherits this machine's whole environment, honored only on a single-user host-lane deployment; ` +
+    `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
+export function inheritEnvFieldIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const value = raw.inheritEnv;
+    if (value === undefined)
+        return null;
+    return INHERIT_ENV_WORDS.includes(value) ? null : INHERIT_ENV_VALUE_MESSAGE;
+}
 //# sourceMappingURL=request-value-closure.js.map

package/dist/router/route-orchestration.d.ts

@@ -104,6 +104,17 @@ export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: stri
  *  - `toolPolicy` — ALSO ask on the direct write hand tools `Edit`/`Write` (review HIGH: shellGate alone
  *    leaves a non-isolated SUP task able to mutate the real fs via write tools ungated). The worker's existing
  *    approval machinery (durable suspend / poll) enforces the `ask` — same precondition as `shellGate:"always"`.
+ *
+ * 🔴 S-897(7.106.0,[ref]):这些 ask 是**部署**(运维开的 `ROUTER_ENABLED` 路由)写下的门 ⇒ 盖 core 的部署出身位
+ * `authoredBy:"deployment"`,经**唯一**盖位函数(`operator-ask.ts` 的 `withDeploymentAuthorship`,经 `operatorAlwaysHumanAsk`
+ * 取用 —— 治理层 ask、`APPROVAL_NEVER_AUTO` / 预算耗尽 ask 同一只)。修前:写工具的 ask 只自报 `matchedAskRule`(非强制卡),
+ * shellGate always 的 shell ask 是 core 自铸的、没有出身位 ⇒ 卡上只剩单个强制词(`operator_always`;读边界探针命中时是
+ * `probe_mandate`,它把 always 藏在后面)⇒ bypass 下壳按那一个词放行(cli L-758 的规则面)。盖了之后 core 判 `mandated`、
+ * 不铸 `mandate` 词(表外的门)⇒ 活卡与 park 行两腿都读成「另有门在」,壳出卡。
+ * shell 那一问的出身只能由**策略的** ask 带进去(core 的 shell 座铸的 ask 没有出身位的写口)⇒ 策略对 shell 工具也问一次,
+ * core 把它与 shellGate always 折成同一只 ask(不是两问)。
+ * ⚠️ 连带(产品面,如实):写工具的 ask 从此也是强制卡 ⇒ 用户的「本会话放行」不再退役 SUP 路由的写门(shell 那一问修前就退不掉)。
+ * 不改路由判据本身(`routeServiceTask` 一字不动)。
  */
 export declare function supPostureOverrides(): Partial<TaskSpec>;
 //# sourceMappingURL=route-orchestration.d.ts.map

package/dist/router/route-orchestration.js

@@ -1,5 +1,5 @@
-import {} from "@sema-agent/core";
-import { operatorAsk } from "../operator-ask.js";
+import { COARSE_SHELL_TOOLS } from "@sema-agent/core";
+import { operatorAlwaysHumanAsk } from "../operator-ask.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -40,11 +40,12 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
     return false;
 }
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
+const SHELL_TOOLS = new Set(COARSE_SHELL_TOOLS);
 export function supPostureOverrides() {
-    const ask = (toolName) => operatorAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
-    const writeGate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
+    const ask = (toolName) => operatorAlwaysHumanAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
+    const gate = {
+        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) || SHELL_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };
-    return { shellGate: "always", toolPolicy: writeGate };
+    return { shellGate: "always", toolPolicy: gate };
 }
 //# sourceMappingURL=route-orchestration.js.map

package/dist/run-local.js

@@ -9,6 +9,7 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
+import { createUnattendedLeg, unattendedPermissionMode, withUnattendedLeg } from "./unattended-permission-mode.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -567,7 +568,8 @@ export async function runLocal(argv, deps = {}) {
         ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
-    const spec = applyLocalGovernance({
+    const unattendedLeg = createUnattendedLeg(unattendedPermissionMode(config), runnerDeps);
+    const spec = withUnattendedLeg(applyLocalGovernance({
         objective: mention.cleanedObjective,
         sessionId,
         backgroundScope: "session",
@@ -583,7 +585,7 @@ export async function runLocal(argv, deps = {}) {
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),
         ...(Object.keys(limits).length > 0 ? { limits } : {}),
-    }, config, workspaceDir, memoryEngine?.root);
+    }, config, workspaceDir, memoryEngine?.root), unattendedLeg);
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: executionLaneOf(config.remoteExec?.provider) });
     const settleSessionBackground = async () => {
         const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);

package/dist/runs.d.ts

@@ -150,7 +150,8 @@ export declare function isSessionConflictResult(result: {
  * 逐码显式登记为债务,并由那道门看住不许陈腐。
  *
  * S-724(core 7.31.0 #1048 / #1050):`rewind.capture_disabled` → **422**(关断词与还原同体 = 自相矛盾;本服务的请求面上
- * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(core 这一拒落在会话分叉之后、不回滚);映射是分诊面完备性)、`rewind.store_unconfigured`
+ * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(立门理由:core 这一拒落在会话分叉之后、不回滚;S-865 / core 7.35.0
+ * #1195 起 core 在分叉之前拒);映射是分诊面完备性)、`rewind.store_unconfigured`
  * → **409**(部署没有历史店;`FILE_HISTORY_CAPTURE=false` 自本版不再摘店 ⇒ 可达面只剩没有后端的部署形,那里
  * `capabilities.rewindFiles` 恒报 false —— 三问在 CHANGELOG 7.104.0)。
  */