@sema-agent/server 7.115.0 → 7.116.0

package/dist/plugins/session-policy-store-sql.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import { loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
-import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
+import { assertSessionRuleNamesCurrent, loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
+import { assertSessionRuleNamesReachable, readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
 import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText } from "./sql-json-column.js";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
@@ -104,6 +104,8 @@ export class SqlSessionPolicyStore {
                 throw new SessionPolicyError("corrupt", `the session rules rev mark for session ${JSON.stringify(sessionId)} is unreadable (rev ${String(markRows[0].rev)}, gen ${String(markRows[0].gen)}) — refusing rather than stamp a rev/lineage nothing proves`);
             }
             const clean = normalizeRules(stripRev(rules));
+            assertSessionRuleNamesCurrent(clean);
+            assertSessionRuleNamesReachable(clean);
             if (prior && opts?.operator !== true) {
                 const loosens = loosenReasons(prior, clean);
                 if (loosens.length > 0) {

package/dist/plugins/store-backend.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore, SessionCaptureRecordStore } from "@sema-agent/core";
+import type { SessionStore, SessionPolicyStore, FileHistoryStore, WorkflowJournalStore, ToolResultStore, SessionCaptureRecordStore, UsageWindowStore } from "@sema-agent/core";
 import { type OutcomeSink } from "./file-outcome-sink.js";
 import { type InboxWarn } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
@@ -355,6 +355,11 @@ export interface StoreBackend {
      *  clock to expose replica clock skew (the write-behind counters bucket on LOCAL floor(now/windowMs); skew
      *  splits a fleet window into disjoint buckets = soft-limit leak). OPTIONAL: local backend omits (no fleet). */
     dbNowMs?(): Promise<number>;
+    /** S-1014(core 7.41.0 #1308):**local 后端专有**的 usage-window 账本店 = core `FileStorageBackend` 自己那一只(`usageWindowStore`)——
+     *  它的坏读披露座是 backend 构造时那**一只** `onCorruptRead`(core:「`FileStorageBackend` forwards its one sink」),所以坏账本拒(`usage_window.store_corrupt`,
+     *  拒绝句不带盘上位置)的同时,路径进本 backend 的 `file_store_corrupt_read` 披露座(逐命中 warn)。修前 `boot/stores.ts` 在同一数据根上自己
+     *  `new FileUsageWindowStore(root)` 第二只实例、不接座 ⇒ 坏值只拒不披露,运维找不到是哪只文件。SQL 后端省略(它们有自己的 usage-window 双方言店)。 */
+    fileUsageWindowStore?(): UsageWindowStore;
 }
 /** (c)(clay 拍 a+c,2026-07-27;[ref] 换店后域=file_history_blob,门与旋钮名不变)云形 blob 姿势门——
  *  boot 时调用(boot/stores.ts),纯函数可单测。SQL 后端(mysql|pg)把 blob 字节落单行的形已被两役

package/dist/plugins/store-backend.js

@@ -265,7 +265,7 @@ class LocalBackend {
     }
     async ensureSchema() { }
     async runOneTimeMigrations() {
-        return { ...NO_SQL_MIGRATIONS, askOriginRowsMigrated: await this.runStore.migrateRetiredAskOriginRows() };
+        return { ...NO_SQL_MIGRATIONS, askOriginRowsMigrated: await this.runStore.migrateRetiredAskOriginRows(), holderDeathCodeRowsBackfilled: this.runStore.migrateLegacyHolderDeathCodes() };
     }
     async close() {
         await this.sessionStore.dispose();
@@ -315,6 +315,7 @@ class LocalBackend {
     }
     checkpointStoreInst;
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
+    fileUsageWindowStore() { return this.fileBackend.usageWindowStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
     sessionCaptureRecords() { return this.captureRecordsSource; }

package/dist/plugins/store-contracts.d.ts

@@ -140,7 +140,7 @@ export type PersistedTaskResult = TaskResult & PersistedResultSideKeys;
 /**
  * 🔴 run 店「持有它的实例丢了」那一判的**行上落款**(S-928 codex r1-F1 提为常量):三只 run 店的 `reapStale` 把心跳过期的 running 行翻成
  * `failed` 并写下这一句。它是 run 店死亡判决留在行上的证据之一(另一只 = {@link RUN_ORPHANED_ERROR})—— 用户输入受理账本的收敛判词
- * (S-969 L8 起两车道同一只)据 {@link isHolderDeathVerdict} 在 reap **之后**仍能判出「写者死了」。改这一句 = 改那条判据;所以三个写者与那一个读者都只引用本常量。读时折叠成同一句话的 wire 展示站点
+ * (S-969 L8 起两车道同一只)据 {@link isHolderDeathVerdict} 在 reap **之后**仍能判出「写者死了」—— 7.116.0 起判据是同行的机读码 `run.stalled`({@link RUN_HOLDER_DEATH_CODES}),本句只给人读;三个写者同写句子与码。读时折叠成同一句话的 wire 展示站点
  * (`routes/runs.ts` 的 stale 折叠、`routes/trace-usage.ts` 的 WORKER_DOWN 帧)刻意留字面量:它们由文案冻结门逐字钉着,且不参与任何判据。
  */
 export declare const RUN_STALLED_ERROR = "run stalled (instance lost?)";
@@ -148,19 +148,38 @@ export declare const RUN_STALLED_ERROR = "run stalled (instance lost?)";
  * 🔴 File 车道「持有它的进程随重启没了」那一判的行上落款(S-969 L8 提为常量):boot 孤儿回收(`FileRunStore.reclaimOrphanedAtBoot`,
  * 数据根 LOCK 作证前世进程已死 ⇒ 仍 running 的行无条件判孤儿)与运行期 claim 接管的 running 臂(`judgeClaim`,外来 + owner 已死 + 无可续)
  * 都写这一句;接管臂在括号里附上前任持有者的进程指纹(取证用,形 = {@link buildRunOrphanedError})。与 {@link RUN_STALLED_ERROR} 同一种身份:
- * run 店写在行上的**死亡判决**,读者 = {@link isHolderDeathVerdict}。
+ * run 店写在行上的**死亡判决**,读者 = {@link isHolderDeathVerdict}(按同行的机读码 `run.orphaned` 判,本句只给人读)。
  */
 export declare const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
 /** File 车道两个孤儿落款写口共用的那一句(`heldBy` = 接管臂的前任持有者描述;boot 回收臂不带)。 */
 export declare function buildRunOrphanedError(heldBy?: string): string;
 /**
- * run 行上是不是一份**持有者死亡判决**:`failed`,且 `error` 是 run 店的两只死亡落款之一 —— {@link RUN_STALLED_ERROR}(三只 run 店的
- * `reapStale`:心跳过期 ⇒ 实例丢了)或 {@link RUN_ORPHANED_ERROR}(File 车道:前世进程随重启没了;接管臂带括注)。判决只说「持有它的那个进程
- * 死在这条腿收场之前」,不说是谁 —— 持有者是谁读行上的 `instanceId`(两只落款都不改它)。唯一读者 = 用户输入受理账本的收敛判词
- * (`src/user-input-ledger.ts` `judgeOpen`);改任一句落款 = 改那条判据,所以写者与读者都只引用本模块的常量。
- * 正常失败(别的 error)/ park 过期收割(`approval expired before decision`:腿 park 过)都**不是**死亡判决。
+ * run 店的两只**死亡判决机读码**(行上 `errorCode` 列;`GET /v1/runs/:id` 的 `errorCode` 读它)—— 与两句死亡落款一一对应:
+ * {@link RUN_STALLED_ERROR} ⇔ `run.stalled`(三只 run 店的 `reapStale`:心跳过期 ⇒ 实例丢了)、{@link RUN_ORPHANED_ERROR}(含接管臂的括注形)⇔
+ * `run.orphaned`(File 车道:前世进程随重启没了)。码是判据,句子只给人读。族 `run.` = run 店自己写在行上的生命周期判决(core 不铸这一族)。
  */
-export declare function isHolderDeathVerdict(run: Pick<RunRecord, "status" | "error">): boolean;
+export declare const RUN_HOLDER_DEATH_CODES: {
+    readonly stalled: "run.stalled";
+    readonly orphaned: "run.orphaned";
+};
+export type RunHolderDeathCode = (typeof RUN_HOLDER_DEATH_CODES)[keyof typeof RUN_HOLDER_DEATH_CODES];
+/**
+ * 一次性迁移 **M6** 的判据(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):7.116.0 之前写下的死亡判决行只有句子、码列为空 ——
+ * 该行应有的码。两处用:local 腿的起服写回(`FileRunStore.migrateLegacyHolderDeathCodes`)与 SQL 两孪生行映射里的**读侧半场**(滚动升级窗里旧副本
+ * 还会写这种行,起服写回覆盖不到;本函数随 M6 一起删)。只认两句落款的原字节(接管臂括注形按前缀认);码列已有值 / 非 `failed` / 别的句子 ⇒ 原样。
+ */
+export declare function readLegacyHolderDeathCode(row: {
+    readonly status: string;
+    readonly error: string | null;
+    readonly errorCode: string | null;
+}): string | null;
+/**
+ * run 行上是不是一份**持有者死亡判决**:`failed`,且行上的码是 {@link RUN_HOLDER_DEATH_CODES} 之一。判决只说「持有它的那个进程死在这条腿收场之前」,
+ * 不说是谁 —— 持有者是谁读行上的 `instanceId`(判决不改它)。读者 = 用户输入受理账本的收敛判词(`src/user-input-ledger.ts` `judgeOpen`)。
+ * 旧行(只有句子)由一次性迁移 M6 补上码(起服写回 + SQL 滚动窗的读侧半场,{@link readLegacyHolderDeathCode}),所以这里不再按句子判。
+ * 正常失败(别的码 / 无码)/ park 过期收割(`approval.expired`:腿 park 过)都**不是**死亡判决。
+ */
+export declare function isHolderDeathVerdict(run: Pick<RunRecord, "status" | "errorCode">): boolean;
 export interface RunRecord {
     taskId: string;
     sessionId: string;

package/dist/plugins/store-contracts.js

@@ -6,10 +6,19 @@ export const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
 export function buildRunOrphanedError(heldBy) {
     return heldBy === undefined ? RUN_ORPHANED_ERROR : `${RUN_ORPHANED_ERROR} (claim held by ${heldBy}, which is gone)`;
 }
+export const RUN_HOLDER_DEATH_CODES = { stalled: "run.stalled", orphaned: "run.orphaned" };
+const RUN_HOLDER_DEATH_CODE_WORDS = new Set(Object.values(RUN_HOLDER_DEATH_CODES));
+export function readLegacyHolderDeathCode(row) {
+    if (row.errorCode !== null || row.status !== "failed" || row.error === null)
+        return row.errorCode;
+    if (row.error === RUN_STALLED_ERROR)
+        return RUN_HOLDER_DEATH_CODES.stalled;
+    if (row.error === RUN_ORPHANED_ERROR || row.error.startsWith(`${RUN_ORPHANED_ERROR} (`))
+        return RUN_HOLDER_DEATH_CODES.orphaned;
+    return null;
+}
 export function isHolderDeathVerdict(run) {
-    if (run.status !== "failed" || run.error === null)
-        return false;
-    return run.error === RUN_STALLED_ERROR || run.error === RUN_ORPHANED_ERROR || run.error.startsWith(`${RUN_ORPHANED_ERROR} (`);
+    return run.status === "failed" && run.errorCode !== null && RUN_HOLDER_DEATH_CODE_WORDS.has(run.errorCode);
 }
 export const RUN_STATUS_CLASS = {
     running: "live",

package/dist/plugins/tidb-session-store.js

@@ -141,7 +141,7 @@ export class TiDBSessionStore {
     async listSessions(opts) {
         const params = [];
         const where = ["sm.placement_kind IS NULL"];
-        if (opts.owner) {
+        if (opts.owner !== undefined) {
             where.push(opts.includeUnowned ? "(sm.owner = ? OR sm.owner IS NULL)" : "sm.owner = ?");
             params.push(opts.owner);
         }

package/dist/request-key-closure.js

@@ -28,7 +28,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
-    "verify", "verifyRounds",
+    "userInvokedSkills", "verify", "verifyRounds",
 ];
 const TASK_BODY_SCENARIO_KEYS = ["businessContext", "lenses", "repo", "rounds", "team"];
 const ACCEPTED_BODY = new Set([...TASK_BODY_DECLARED_KEYS, ...TASK_BODY_SCENARIO_KEYS]);

package/dist/run-local.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { type AskRequest, type Brain, type TaskSpec } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type Brain, type TaskSpec } from "@sema-agent/core";
 import { type UnattendedPolicyRefusal } from "./tool-approval.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView } from "./deployment-governance.js";
 import { type ServiceConfig } from "./config.js";
@@ -131,8 +131,10 @@ export interface LocalApproverIo {
  *
  * 🔴 S-694 起本席也服**三张审批名单**产的 ask(审批基线取 live 席,见 {@link RUN_LOCAL_APPROVAL_SEAT}):
  * `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ 策略 `ask` ⇒ 落到这里。`AskRequest` 不带是哪条声明产的
- * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),所以无 TTY 拒句**列出**可能产门的全部旋钮,
- * `APPROVAL_DENY` 也点名(它当场拒、不经本席 —— 运维排查「为什么这只工具不跑」时要在同一句里看到它)。
+ * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),但带这一问的**类**(`classes`,core 7.37.0 起)。
+ * 🔴 无 TTY 拒句的出路**按这一问的类说话**({@link NO_TTY_ASK_CLASS_ROW} 一张闭集表:每类 ⇒ 一种出路):没人表态的服务器工具调用指 `APPROVAL_GRANT`,
+ * 写下的 ask 名单指名单旋钮(`APPROVAL_DENY` 也点名 —— 它当场拒、不经本席),部署强制要人答的问(`operator_forced`)列「one of」能铸它的来源、shell 地板(`shell_floor`)另一句只列铸它的旋钮,其余各类**不点任何旋钮**、只说去终端答;
+ * 类缺席 ⇒ 说实话(「引擎没有说明这一问的类」),不回落成全量旋钮清单(那句对多数类是错的出路)。
  *
  * 🔴 非 TTY 臂答**拒**(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
  * `suspendAsk`**(dist `core/hooks.js` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
@@ -149,6 +151,37 @@ export interface LocalApproverIo {
 /** 本席的形:core `OnAsk` 的函数臂(`"allow"` / `"deny"` 两个字面臂本席从不用)—— 人的答是布尔,没有人被问的拒是部署政策拒对象;
  *  结构上可赋给 `OnAsk`。 */
 export type LocalApprover = (req: AskRequest, signal?: AbortSignal) => Promise<boolean | UnattendedPolicyRefusal>;
+/**
+ * 无 TTY 拒句里**出路**的种类(闭集)。每一类问对应一种({@link NO_TTY_ASK_CLASS_ROW});`terminal_only` = 没有本部署的旋钮能放行这一问,只剩去终端答。
+ * 说出口的三种按 {@link NO_TTY_SPOKEN_REMEDIES} 的顺序各说一次(一问可以折叠多类 ⇒ 多种出路,顺序恒定)。
+ */
+declare const NO_TTY_SPOKEN_REMEDIES: readonly ["grant", "approval_lists", "deployment_mandate", "shell_gate"];
+type NoTtySpokenRemedy = (typeof NO_TTY_SPOKEN_REMEDIES)[number];
+type NoTtyRemedy = NoTtySpokenRemedy | "terminal_only";
+/**
+ * 一类问 ⇒ 这条腿上它的出路。**穷尽表**:core 的 `ASK_CLASSES` 加一类 ⇒ 这里 tsc 红(`Record<AskClass, …>` 少一键),新类必须在这里表态,
+ * 不会悄悄落成「没有出路」。本仓知道而 core 不知道的只有一件:**哪只部署旋钮会产哪一类问**(逐类的产地见各行):
+ *  · `unstated`:没有任何层表态的服务器工具调用(core 7.40.0)—— 运维为自己接的服务器表态的地方是 `APPROVAL_GRANT`(`run-local` 没有请求体,写不了 `settings.permissions.allow`);
+ *  · `ask_rule`:写下的 ask 规则 —— `APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO`(`operatorAsk`)与治理层的 commandPolicy ask 名单(同一只铸点);请求体的
+ *    `settings.permissions.ask` 到不了这条腿(本文件不 import 任何请求受理 / `task-settings`,`run-local` 的 spec 自铸);
+ *  · `operator_forced`:部署**强制**要人答的问 —— 能铸它的来源(真 Runner × `applyLocalGovernance` 亲读类集,读数在 `test/run-local.test.ts` S-1100 ⑨ 各格):`APPROVAL_NEVER_AUTO`
+ *    (`operatorAlwaysHumanAsk` 盖部署出身;类集 `[ask_rule, operator_forced]`)与 `runtime.commandPolicy`(ask 条目 ⇒ `[ask_rule, operator_forced]`,同一只铸点;allowlist 形里没列的命令 ⇒ `[operator_forced]`)。
+ *    读码补全(未亲跑):耐久资源耗尽的「恒问人」同走 `operatorAlwaysHumanAsk`、SUP 路由的 capability-danger 门同走它 —— 两者都要 checkpoint 店 / 路由器,run-local 没有;本仓没有给 `spec.tools` 盖部署工具标记的旋钮
+ *    (grep `egress: true` / `irreversibility` 字面量零命中),core 的 A2A 隔离对端形本仓也不设。所以「one of」两项就是这条腿上能铸它的全部来源;
+ *  · `shell_floor`:shell 地板被抬到 always —— `AUTONOMY=ask`(`autonomyOverrides`)与 `MANUAL_MODE_SHELL_GATE=always`,真 Runner 读数两者的类集都是 `[shell_floor]`(**不是** `operator_forced`):
+ *    单独一句,不与 `operator_forced` 的来源混在一起 —— 混说会把 `APPROVAL_NEVER_AUTO` 的问指到一定没设的 `AUTONOMY`;
+ *  · 其余:引擎自己的问(写门 / 形状层 / 写保护 / 探针 / 钩子 / 组织规则 / 引擎的守卫 / 工具标记 …)没有一只本部署旋钮能放行 —— 只说去终端答。
+ *    不借 core 的 `headlessApprovalRemedy`:那一句是给**库的调用方**的出路(「wire an approver (`onAsk`)」「run with `permissionMode: "bypassPermissions"`」),
+ *    而本腿的席**已经接好**(缺的是终端),也没有任何命令行旗给 `permissionMode` —— 照搬会把运维指向一个不存在的旋钮。
+ *
+ * `autoBudgetReleases`:`APPROVAL_AUTO_BUDGET` 能放行这类问吗(读 `createDurableAskPolicy` 的预算臂:只放行**没进 `APPROVAL_NEVER_AUTO`、耐久资源没耗尽**的
+ * `APPROVAL_REQUIRE` 命中,换成一句带理由的 allow)。按 `classes` **整体**读:集里每一类都放得行才建议预算 —— 折叠了别的类(`operator_forced` 等)说明另一层的问仍在,
+ * 预算放不掉它(与 {@link unattendedAnswers} 读整体同一律)。
+ */
+export declare const NO_TTY_ASK_CLASS_ROW: Readonly<Record<AskClass, {
+    readonly remedy: NoTtyRemedy;
+    readonly autoBudgetReleases: boolean;
+}>>;
 export declare function createLocalApprover(io: LocalApproverIo): LocalApprover;
 export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, streams?: {
     input: NodeJS.ReadableStream;
@@ -176,4 +209,5 @@ export declare function installRunLocalExitBoundary(deps: {
     logger: Logger;
     exit?: (code: number) => void;
 }): RunLocalExitBoundary;
+export {};
 //# sourceMappingURL=run-local.d.ts.map

package/dist/run-local.js

@@ -8,6 +8,7 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { readAskClassPair } from "./approval-card.js";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
 import { withUnattendedLeg } from "./unattended-permission-mode.js";
 import { buildUnattendedPolicyRefusal } from "./tool-approval.js";
@@ -133,6 +134,52 @@ export function applyLocalGovernance(base, config, workspaceDir, engineDataRoot)
 }
 const NO_TTY_REFUSAL_REASON = "this run-local invocation has no TTY, so there is no one to put this approval to; it is refused fail-closed instead of being asked.";
 const UNDISPLAYABLE_ARGS_REFUSAL_REASON = "the call's arguments cannot be displayed, so there is nothing a person could review; it is refused fail-closed instead of being asked.";
+const NO_TTY_SPOKEN_REMEDIES = ["grant", "approval_lists", "deployment_mandate", "shell_gate"];
+export const NO_TTY_ASK_CLASS_ROW = {
+    content_question: { remedy: "terminal_only", autoBudgetReleases: false },
+    hook: { remedy: "terminal_only", autoBudgetReleases: false },
+    ancestor: { remedy: "terminal_only", autoBudgetReleases: false },
+    unverifiable_delete: { remedy: "terminal_only", autoBudgetReleases: false },
+    transcript_write: { remedy: "terminal_only", autoBudgetReleases: false },
+    org_rule: { remedy: "terminal_only", autoBudgetReleases: false },
+    governance_unavailable: { remedy: "terminal_only", autoBudgetReleases: false },
+    rule_unreadable: { remedy: "terminal_only", autoBudgetReleases: false },
+    ask_rule: { remedy: "approval_lists", autoBudgetReleases: true },
+    denial_limit_fallback: { remedy: "terminal_only", autoBudgetReleases: false },
+    operator_forced: { remedy: "deployment_mandate", autoBudgetReleases: false },
+    shell_floor: { remedy: "shell_gate", autoBudgetReleases: false },
+    write_protection_unresolved: { remedy: "terminal_only", autoBudgetReleases: false },
+    probe: { remedy: "terminal_only", autoBudgetReleases: false },
+    write_protection: { remedy: "terminal_only", autoBudgetReleases: false },
+    tool_marks_mcp: { remedy: "terminal_only", autoBudgetReleases: false },
+    tool_marks_a2a: { remedy: "terminal_only", autoBudgetReleases: false },
+    policy_rra: { remedy: "terminal_only", autoBudgetReleases: false },
+    artifact_shared_read: { remedy: "terminal_only", autoBudgetReleases: false },
+    mode: { remedy: "terminal_only", autoBudgetReleases: false },
+    unstated: { remedy: "grant", autoBudgetReleases: false },
+    ordinary: { remedy: "terminal_only", autoBudgetReleases: false },
+    requires_user_interaction: { remedy: "terminal_only", autoBudgetReleases: false },
+};
+const NO_TTY_REMEDY_SENTENCE = {
+    grant: () => `No rule, policy or hook granted this server tool and it states no permission of its own: the operator states one with APPROVAL_GRANT ` +
+        `(an allow rule for server tools — an exact tool name, mcp__<server>__* or a2a__<peer>__*).`,
+    approval_lists: (budget) => `The gate comes from the approval lists: APPROVAL_REQUIRE / APPROVAL_NEVER_AUTO (APPROVAL_DENY refuses outright without asking); ` +
+        `a separate .env for this CLI keeps a server's lists off it.` +
+        (budget ? ` APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls.` : ""),
+    deployment_mandate: () => `This deployment mandates a person for it — one of: APPROVAL_NEVER_AUTO (always a human), or a runtime.commandPolicy entry in config.d/governance.json ` +
+        `(an \`ask\` entry, or — when that policy has any \`allow\` entry — a command it does not list).`,
+    shell_gate: () => `This deployment raises the shell gate to always-ask — one of: AUTONOMY=ask, MANUAL_MODE_SHELL_GATE=always.`,
+};
+function buildNoTtyRemedySentence(req) {
+    const terminal = "Run it in a terminal to answer interactively.";
+    const pair = readAskClassPair(req);
+    if (pair === undefined)
+        return `The engine did not say what kind of question this is, so no setting can be named here. ${terminal}`;
+    const rows = pair.classes.map((c) => NO_TTY_ASK_CLASS_ROW[c]);
+    const budget = rows.every((r) => r.autoBudgetReleases);
+    const spoken = NO_TTY_SPOKEN_REMEDIES.filter((k) => rows.some((r) => r.remedy === k)).map((k) => NO_TTY_REMEDY_SENTENCE[k](budget));
+    return [...spoken, terminal].join(" ");
+}
 export function createLocalApprover(io) {
     let tail = Promise.resolve();
     const refuseWithoutPerson = (reason) => {
@@ -141,11 +188,7 @@ export function createLocalApprover(io) {
     };
     return async (req, signal) => {
         if (!io.isTty) {
-            io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — this run-local invocation has no TTY, so there is nobody to ask. ` +
-                `The gate comes from this deployment's governance knobs: APPROVAL_REQUIRE / APPROVAL_NEVER_AUTO (the approval lists; ` +
-                `APPROVAL_DENY refuses outright without asking), AUTONOMY, MANUAL_MODE_SHELL_GATE, runtime.commandPolicy (config.d/governance.json). ` +
-                `Run it in a terminal to answer interactively, or relax the knob (APPROVAL_AUTO_BUDGET auto-approves that many APPROVAL_REQUIRE calls; ` +
-                `a separate .env for this CLI keeps a server's lists off it).`);
+            io.printErr(`denied "${terminalSafeText(req.toolName)}" (${terminalSafeText(req.message)}) — this run-local invocation has no TTY, so there is nobody to ask. ${buildNoTtyRemedySentence(req)}`);
             return refuseWithoutPerson(NO_TTY_REFUSAL_REASON);
         }
         const argsShown = argsDisplayOf(req.args);

package/dist/runs.d.ts

@@ -99,64 +99,6 @@ export declare function markChildrenStoppedByUserOnAbort(signal: AbortSignal, ta
 export declare function isSessionConflictResult(result: {
     terminal: TerminalCause;
 }): boolean;
-/**
- * E18 resume-at CALLER error → an HTTP 4xx. A bad/stale resume-at target (the resolved entryId is gone or is not a
- * settled message boundary) surfaces as a FAILED TaskResult carrying a `resume_at.*` errorCode (core swallows the
- * prepare-throw into the result, exactly like a session conflict — runtask catch → status:"failed"+errorCode). The
- * sync path otherwise 200s a failed result; map these to 4xx so a caller mistake reads as one. `not_found` (the
- * entry is genuinely absent) → 404; everything else (not_a_message / conflicts_resume / no_session) → 422.
- *
- * [ref] Phase3: `requireExistingSession` on a genuinely-missing/purged session ALSO surfaces as a failed result
- * (core prepare-task maps the store's `not_found` → `resume.session_not_found`); map it to 404 (the session is gone),
- * the same "caller mistake reads as a 4xx, not a silent 200 fresh run" discipline.
- *
- * [ref] rewind exclusive mode (core 1.292 resumeAtMode:"before"): its two edge rejections ride the same `resume_at.*`
- * prefix (before_target_not_user / before_root_unsupported → 422 via the existing branch, errorCode passed through
- * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
- * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
- * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
- *
- * [ref] 件A([ref] 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
- * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
- * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
- * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
- * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
- * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
- *
- * [ref] (core 7.0.0 片2/3, [ref] S-3): the session capture opt-out's four prepare-throw refusals ride the
- * same pipe. `memory.capture_optout_denied` is TERMINAL (the principal's `allowMemoryOptOut` verdict is an
- * explicit `false`, or the posture is `capture-required` / `governed`-with-absent-verdict — a retry cannot
- * change it) → 403, the `memory.admission_denied` twin. `memory.capture_optout_unpersisted` is the
- * declaration arm's "control-plane record could not be written" refusal — a store outage, retry may succeed
- * → 503 (transient fail-closed, the `memory.admission_required` twin; no retryAfterMs on this one — core
- * mints none, so the sync leg forwards no hint rather than inventing one). `config.memory_capture_spelling`
- * is a TaskSpec authoring mistake (the only legal spelling is the string "off") → 400, the
- * `config.memory_erasure_request` family shape. `config.memory_capture_unsupported` is the DEPLOYMENT SHAPE
- * refusing the declaration (remote/per-run execution with no durable capture-record carrier: the record
- * would not survive to a resume replica) → 409 — the request is well-formed, the deployment's state
- * conflicts with it, the `config.refresh_unavailable` family shape ("change the deployment, not the request").
- * Status choices are pinned by the `config.`/`memory.` family status sets in error-code-catalog-live.test.ts.
- *
- * S-125 件⑥(core 7.4.0 [ref]):`rewind.child_scope_unsupported` —— 这条腿是一个**委派子代**,它的文件编辑
- * 记在**根 session** 的文件历史里,所以「把文件还原到某个 entry」是根 session 的动作、不是子代的;core 在
- * prepare 期响亮拒(零计费,文件一个字节没动)。映射 **422**:请求形式合法、语义上找错了执行者 —— 与
- * `resume_at.*` 的「调用方指错了锚」同一族同一档,而不是 404(目标在,只是不归你)也不是 409(部署状态没冲突)。
- * ⚠️ **前缀不吞**:本码前缀是 `rewind.`,与下面那条 `resume_at.` **开集前缀臂**不同族 —— 它不会被那一臂顺手
- * 兜走(兜走会把一条「找错执行者」的拒答成「锚解析不了」),也不是 `rewind_snapshot.`(那是「快照找不到」)。
- * 三个前缀各自成族,逐码对表见 `test/resume-anchor.test.ts` 的 S-125 `rewind.` 族格。
- * 🔴 **可达性如实**:本仓的 HTTP 面**今天铸不出**这条腿 —— 子代由 core 内部的 Agent 工具派生,
- * `fileHistoryLineage` 是 core prepare 的 internals(不在 `TaskSpec` 上),server 从不直接 prepare 一条带
- * lineage 的子代腿。本臂是**分诊面的完备性**(core 说 X ⇒ wire 形是 Y),不是一条今天在跑的路;将来的
- * 委派入口接线那天零改动即生效。同族其余码(`rewind_files_retired` / `invalid_spec` / `conflicting_targets` /
- * `restore_failed`)今天**仍落 200-with-failed-body**,那是各自提货批**之前**就存在的缺口(不是回归),已在上述对表格里
- * 逐码显式登记为债务,并由那道门看住不许陈腐。
- *
- * S-724(core 7.31.0 #1048 / #1050):`rewind.capture_disabled` → **422**(关断词与还原同体 = 自相矛盾;本服务的请求面上
- * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(立门理由:core 这一拒落在会话分叉之后、不回滚;S-865 / core 7.35.0
- * #1195 起 core 在分叉之前拒);映射是分诊面完备性)、`rewind.store_unconfigured`
- * → **409**(部署没有历史店;`FILE_HISTORY_CAPTURE=false` 自本版不再摘店 ⇒ 可达面只剩没有后端的部署形,那里
- * `capabilities.rewindFiles` 恒报 false —— 三问在 CHANGELOG 7.104.0)。
- */
 export declare function resumeAtHttpStatus(result: {
     terminal: TerminalCause;
 }): number | undefined;

package/dist/runs.js

@@ -71,6 +71,19 @@ export function isSessionConflictResult(result) {
         return result.terminal.code === "conflict";
     return /stale write|concurrent write|conflict/i.test(result.terminal.message ?? "");
 }
+const PREPARE_REFUSAL_HTTP_STATUS = {
+    "resume.session_not_found": 404,
+    "rewind_snapshot.unresolvable": 422,
+    "rewind.child_scope_unsupported": 422,
+    "rewind.capture_disabled": 422,
+    "rewind.store_unconfigured": 409,
+    "memory.capture_optout_unpersisted": 503,
+    "config.memory_capture_spelling": 400,
+    "config.invalid_checkpoint_store": 400,
+    "config.skill_listing_budget_invalid": 400,
+    "config.user_invoked_skill_unknown": 400,
+    "config.memory_capture_unsupported": 409,
+};
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);
     if (code === undefined)
@@ -86,26 +99,8 @@ export function resumeAtHttpStatus(result) {
         if (wire !== undefined)
             return wire.status;
     }
-    if (code === "resume.session_not_found")
-        return 404;
-    if (code === "rewind_snapshot.unresolvable")
-        return 422;
-    if (code === "rewind.child_scope_unsupported")
-        return 422;
-    if (code === "rewind.capture_disabled")
-        return 422;
-    if (code === "rewind.store_unconfigured")
-        return 409;
-    if (code === "memory.capture_optout_unpersisted")
-        return 503;
-    if (code === "config.memory_capture_spelling")
-        return 400;
-    if (code === "config.invalid_checkpoint_store")
-        return 400;
-    if (code === "config.skill_listing_budget_invalid")
-        return 400;
-    if (code === "config.memory_capture_unsupported")
-        return 409;
+    if (Object.hasOwn(PREPARE_REFUSAL_HTTP_STATUS, code))
+        return PREPARE_REFUSAL_HTTP_STATUS[code];
     if (!code.startsWith("resume_at."))
         return undefined;
     return code === "resume_at.not_found" ? 404 : 422;

package/dist/session-policy-wire.d.ts

@@ -16,15 +16,25 @@
  *        自陈「Malformed shape → 400(never a downstream TypeError)」,这一半没守);
  *      · `loosenReasons` 的每一臂都从 `prior` 出发,**prior 为空时恒回空集** ⇒ tighten-only 门对一条
  *        全新的会话放行任何内容,坏形因此连「收紧门」这一层都碰不到。
- * ⇒ 类修:一只读者,键集由 `keyof SessionPermissionRules` **派生**(下方 `RULE_FIELD_ROLE` 的
- * `satisfies Record<keyof SessionPermissionRules, RuleFieldRole>`:core 加桶 ⇒ 缺键**编译红**;core 删桶 ⇒
+ * ⇒ 类修:一只读者,键集由 `keyof SessionPermissionRules` **派生**(下方 `RULE_FIELDS` 的
+ * `satisfies Record<keyof SessionPermissionRules, true>`:core 加桶 ⇒ 缺键**编译红**;core 删桶 ⇒
  * 多键**编译红**),两条腿同调。
  *
  * ── S-800(7.105.0):同一只读者多判一问 —— 写得进却跑不了的工具名 ─────────────────────────────────
  * 两条写入腿是 server 往会话规则店写的**全部**写口,所以「写口 fail-closed」收成一只**写口读者**
- * ({@link readWritableSessionPermissionRules} = 形读者 + {@link legacyToolNameOf}),两腿同调,将来第三条写入腿
+ * ({@link readWritableSessionPermissionRules} = 形读者 + 名字判官),两腿同调,将来第三条写入腿
  * 调同一只也同得。判词多一种(`legacy-tool-name`),两腿各把它映射成 `400 rules.legacy_tool_name`(映射点仍在各自
  * 站点:码位只放字面量)。形读者本身不变 —— SQL 店的读回也用它,读回不许判名字(理由见写口读者头注)。
+ * S-1047(7.116.0 / core 7.41.0 #1156):名字判官 = core 导出的 `assertSessionRuleNamesCurrent`(两只 bundled 店与本仓 SQL 双生在 `putRules`
+ * 里同点同调它;准备阶段的名审计与本仓配置表读的是同一只 `judgeRuleToolName`)—— 本仓手写的那一只(`legacyToolNameOf`)删除,零双读;
+ * 「哪几桶装工具名」归 core(它的 `HOLDS_TOOL_NAMES`)。
+ *
+ * ── 7.116.0:写口读者再多判一问 —— 够不着挂载工具的协议名 ─────────────────────────────────────
+ * 缺段(`mcp__srv__` / `mcp__`)与对端段铸不出(`mcp__github.com__*`)的协议名 core 的判官判 `current`(它只看退役名与无前缀 `__` 名),
+ * 而配置表一直拒缺段名 —— 一个名字两张表两种答案,对端段那一半则两张表都照收、永不命中。判官与句子是 `namespaced-rule-name.ts` 的那一只
+ * (配置表同调),码 `400 request.field_invalid`(会话规则写口既有的字段值码;不另铸新码,也不往 core 的判词闭集里塞本仓的词)。
+ * 这一问要逐桶判,而 core 不导出 `HOLDS_TOOL_NAMES` 的运行期值 ⇒ 桶表 {@link TOOL_NAME_FIELDS} 的键集从 core 判官交回的 `field` 型派生(两向 tsc 配对),
+ * 随这一问在 core 自己给出判词那天整只退役。SQL 店写口经 {@link assertSessionRuleNamesReachable} 同判。
  *
  * ── 文案也在这里(codex 一轮追加:两条腿各铸一份句子 = 第二份手抄)───────────────────────────────
  * 初版把 wire 文案留在两个路由各自铸,理由是错误文案冻结门(`test/api-error-text-freeze.test.ts`)锚的是
@@ -33,54 +43,25 @@
  * 「常量锚」):句子收进本文件**单一属主**,冻结职责搬到冻结门的**常量锚格** —— 那一格直接断言这两只
  * 渲染器对每一种判词的输出字节,且对判词闭集穷尽(加一种判词 ⇒ 那一格编译红)。文案一个字节未改。
  */
-import type { SessionPermissionRules, SessionPolicyError, SessionRulesRecord } from "@sema-agent/core";
-declare const RULE_FIELD_ROLE: {
-    readonly toolAllow: "tool-name";
-    readonly toolDeny: "tool-name";
-    readonly allowDirs: "path";
-    readonly commandAllow: "command";
-    readonly commandDeny: "command";
-};
+import { SessionPolicyError } from "@sema-agent/core";
+import type { SessionPermissionRules, SessionRuleNameRefusal, SessionRulesRecord } from "@sema-agent/core";
+import { type UnreachableNamespacedRuleName } from "./namespaced-rule-name.js";
 /** core `SessionPermissionRules` 的桶名全集(派生,不是手抄)。 */
 export declare const SESSION_PERMISSION_RULE_FIELDS: readonly (keyof SessionPermissionRules)[];
-/** 装工具名的那几桶(由 {@link RULE_FIELD_ROLE} 派生的型)。 */
-export type ToolNameRuleField = {
-    [K in keyof typeof RULE_FIELD_ROLE]: (typeof RULE_FIELD_ROLE)[K] extends "tool-name" ? K : never;
-}[keyof typeof RULE_FIELD_ROLE];
+/** 工具名桶里一条够不着任何挂载工具的协议名(缺段 / 对端段铸不出);`verdict` = 判官的判词。 */
+export interface SessionRuleUnreachableName {
+    readonly field: SessionRuleNameRefusal["field"];
+    readonly name: string;
+    readonly verdict: UnreachableNamespacedRuleName;
+}
+/** 逐桶逐条过协议规则名判官;第一条够不着的交回,全部够得着 ⇒ `undefined`。 */
+export declare function unreachableSessionRuleNameOf(rules: SessionPermissionRules): SessionRuleUnreachableName | undefined;
 /**
- * S-800(client-core [ref] CC-226;server [ref];core [ref])—— 「写得进、跑不了、撤不掉」的工具名。
- *
- * 两臂,逐字对应 core 7.33.8 准备阶段名审计抛 `config.legacy_tool_name` 的那两臂(判据只用 core **导出**的
- * 两件,零镜像表 —— 表随 core 钉版走):
- *  · `"retired"`:名字在 core 的 `RETIRED_TOOL_NAMES` 里;`guidance` = 那张表给它的一句现役指引(原样);
- *  · `"unprefixed-namespace"`:名字里有 `"__"` 分隔符,而 `protocolOf(name)` 认不出它属于哪个协议。
- *
- * 为什么在**写口**判:会话规则店只准非 operator 收紧,删掉一条 deny 算放宽 ⇒ 写进去的这种名字属主自己删不掉,
- * 而准备阶段见它就整只拒启 ⇒ 这个会话之后的每一跑都起不来。写口是唯一还来得及说「不」的地方。
- *
- * ⚠️ **比准备阶段严一格**(方向安全,与 client-core 0.83.6 的 KL-157 同向):准备阶段对**本 run 名册里挂着**的
- * 同名工具放行(部署自己挂了一只叫 `Task` 的工具就不审计它),写口看不到将来哪一跑的名册 ⇒ 一律拒。
- * 受伤的是「部署自带与退役名同名的工具、又要在会话规则里点它」的形;出路 = 部署级工具策略(不经会话规则店)。
- * ⚠️ **过渡形**:core 已表态(#1156)把这两臂抽成一只导出纯函数并在会话规则店写口即拒 —— 到货后本函数
- * 换成调 core 那只(拒因原样透传),三份判定收成一份。**S-877 提货复核(core 7.35.0)**:#1156 **未随版**(发车帖 [ref] 逐字
- * 「照 #1156 未随本版」);同版新导出的 `rosterToolName` / `ruleNamesOf`(#1194)是**别名归一**(一个名字在名册上落到哪只行的线名 /
- * 一次调用可被规则拼成的名字集),不回答「这个名字会不会让准备阶段拒启」,不能替本函数 ⇒ 本函数照留,等 #1156。
- *
- * 🔴 **为什么不复用 `config.ts` 的 `unmatchableToolNamesRefusal`**(本仓另一只按名字判的单点;读过实现后裁):两只回答的
- * 不是同一个问题。那一只问「这张表里这条条目会不会**永远不生效**」(匹配不上活工具,或编不成一条规则)—— 7.115.0 起它对 `allow` 也照判
- * (修前豁免 `allow`:那时 allow 是白名单,匹配不上 = fail-closed 且当场可见;allow 改成 allow 规则后豁免臂已删),并且拒两段 MCP 名
- * `mcp__srv`(一名两义)与 core 文法编不出的串。本函数问的是「引擎见到这条会话规则会不会**拒启**」:引擎准备阶段的名审计对会话规则的
- * `allow` 桶照样抛,对 `mcp__srv` 却
- * **不**抛(会话层自 core 5.55 / 5.56 起把它当整对端覆盖形真命中)。判据只能逐字跟 core 那两臂走,不能借另一只的口径。
- * 两只在「退役名」「无前缀 `__` 名」两臂上同源(都读 core 导出的同两件),#1156 到货的那一批一并换调 core 的导出函数。
+ * SQL 会话规则店写口的同一问(core 判官之后、收紧门之前,与 `assertSessionRuleNamesCurrent` 同点):够不着 ⇒ 抛,一条写语句都不发。
+ * 抛的是普通 `Error`(不是 `SessionPolicyError`:core 那张闭集里没有这个词,也不往里塞)—— 本服务的两条 HTTP 写口在读者那一层先拒,
+ * 走到这里 = 有一个绕过写口读者的写者,HTTP 上落 500(服务端自身的失误,响亮)。
  */
-export type LegacyToolName = {
-    why: "retired";
-    guidance: string;
-} | {
-    why: "unprefixed-namespace";
-};
-export declare function legacyToolNameOf(name: string): LegacyToolName | undefined;
+export declare function assertSessionRuleNamesReachable(rules: SessionPermissionRules): void;
 /** 一条规则体的**形**问题。判词而非文案(见文件头注的「文案属主」一段)。 */
 export type SessionPermissionRulesShapeProblem = 
 /** 整体不是一只普通对象(`null` / 数组 / 标量 / 缺席)。 */
@@ -92,14 +73,17 @@ export type SessionPermissionRulesShapeProblem =
     kind: "field-not-string-array";
     field: keyof SessionPermissionRules;
 };
-/** 一条**要写进店**的规则体的问题 = 形问题 ∪ S-800 的名字问题(判据 {@link legacyToolNameOf})。 */
+/** 一条**要写进店**的规则体的问题 = 形问题 ∪ S-800 的名字问题(判官 = core 的 `assertSessionRuleNamesCurrent`)。 */
 export type SessionPermissionRulesProblem = SessionPermissionRulesShapeProblem
-/** S-800:形对,但工具名桶里有一条写进去就跑不了的名字。 */
+/** S-800 / S-1047:形对,但工具名桶里有一条写进去就跑不了的名字;`refusal` = core 判官交回的 detail(原样上 wire)。 */
  | {
     kind: "legacy-tool-name";
-    field: ToolNameRuleField;
-    name: string;
-    legacy: LegacyToolName;
+    refusal: SessionRuleNameRefusal;
+}
+/** 形对、core 判官也放行,但工具名桶里有一条够不着任何挂载工具的协议名(缺段 / 对端段铸不出)。 */
+ | {
+    kind: "unreachable-tool-name";
+    unreachable: SessionRuleUnreachableName;
 };
 /** 两只读者的读数:有问题给判词,没问题给**已收窄**的规则体(调用方零 cast)。`P` = 这只读者会给的判词集。 */
 export type SessionPermissionRulesRead<P extends SessionPermissionRulesProblem = SessionPermissionRulesProblem> = {
@@ -124,9 +108,9 @@ export declare function readSessionPermissionRules(raw: unknown): SessionPermiss
  * **写口读者**(S-800)= 形读者 + 名字判官:两条写入腿(`PUT /v1/sessions/:id/policy`、sync/import 的 `policy`
  * 面经 {@link readSessionRulesRecords})往会话规则店写之前的**唯一**判据。两问,按序:
  *  ① 形(同 {@link readSessionPermissionRules};一份坏形的体答形的 400);
- *  ② 工具名桶里的每一条过 {@link legacyToolNameOf} —— 写进去之后属主撤不掉、会话之后每一跑都起不来的名字,
- *     写口是唯一来得及拒的地方。
- * 🔴 **只在写口,不在读回**:SQL 店读回同一行时只判形(形读者)。一条早先写进去的退役名行必须**读得出来** ——
+ *  ② 工具名桶里的每一条过 core 的判官({@link legacyToolNameRefusalOf})—— 写进去就让会话之后每一跑都起不来的名字,在写口拒;
+ *  ③ 工具名桶里的每一条过协议规则名判官({@link unreachableSessionRuleNameOf})—— 写进去永远匹配不到任何挂载工具的协议名,在写口拒。
+ * 🔴 **只在写口,不在读回**:SQL 店读回同一行时只判形(形读者)。一条早先写进去的退役名行(或够不着的协议名行)必须**读得出来** ——
  * 那是运营方清掉它的唯一路径(operator 的 PUT 先读写前快照),也是 core 准备阶段报 `config.legacy_tool_name`
  * 而不是一只 500 `corrupt` 的前提。把判官放进形读者会让读回把它判坏(7.105.0 车QQ 双库套件实抓,修在同批)。
  */
@@ -179,10 +163,7 @@ export declare function describeSessionPermissionRulesProblem(p: SessionPermissi
  * 调用点据此发 `rules.legacy_tool_name`,否则发形的码。闭集穷尽两层:记录级判词或桶级判词加一种 ⇒ 编译红,
  * 新判词不会静默落进某一个码。
  */
-export declare function legacyToolNameProblemOf(p: SessionRulesRecordProblem): {
-    field: ToolNameRuleField;
-    name: string;
-} | undefined;
+export declare function legacyToolNameProblemOf(p: SessionRulesRecordProblem): SessionRuleNameRefusal | undefined;
 /** `policy[]` 判词 → 人话(sync/import 腿在它前面拼 `policy: `)。闭集穷尽同上。 */
 export declare function describeSessionRulesRecordProblem(p: SessionRulesRecordProblem): string;
 /**
@@ -212,5 +193,4 @@ export declare function sessionPolicyErrorHttp(code: SessionPolicyError["code"])
     status: number;
     errorCode: string;
 };
-export {};
 //# sourceMappingURL=session-policy-wire.d.ts.map