@sema-agent/server 7.116.0 → 7.117.0

package/dist/http/admission.js

@@ -1,4 +1,4 @@
-import { isThinkingLevel, expandTiers } from "@sema-agent/core";
+import { MCP_IMAGE_MAX_BASE64, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
@@ -8,7 +8,7 @@ import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEn
 import * as facts from "../capability-facts.js";
 import { buildDeadToolMatcherRefusal, deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
-import { describeUnreachableSkillToolListEntry, normalizeApproachNotice, skillToolListOk, unknownTaskAgentModelRef, unreachableSkillToolListEntryOf, validateTaskAgents } from "../spec-fields.js";
+import { normalizeApproachNotice, skillToolListOk, skillToolListRefusal, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { skillCarriesRetiredManifest } from "./retired-skill-manifest.js";
@@ -39,15 +39,15 @@ export function validateUserSkills(skills) {
             if (s[key] !== undefined && !skillToolListOk(s[key]))
                 return `skill.${key} must be an array of strings (permission-rule spellings: a tool name, mcp__<server> / mcp__<server>__*, Bash(<prefix>:*), Read(//<dir>/**))`;
         }
-        const unreachable = unreachableSkillToolListEntryOf(s);
-        if (unreachable !== undefined)
-            return describeUnreachableSkillToolListEntry(unreachable);
+        const listRefusal = skillToolListRefusal(s);
+        if (listRefusal !== undefined)
+            return listRefusal;
     }
     return null;
 }
 export const SKILL_MANIFEST_RETIRED = "skill.manifest was retired in core 7.41.0 — a skill's tools are its allowedTools / disallowedTools now (an allow-rule and a deny-rule source for the run the skill is activated in, never a fence); move manifest.allowTools to allowedTools. To fence tools use deny rules (settings.permissions.deny) or a delegated agent's allowTools; to fence write paths use the session rules' allowDirs";
 const MAX_IMAGES_PER_REQUEST = 20;
-const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
+const MAX_IMAGE_BASE64_BYTES = MCP_IMAGE_MAX_BASE64;
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
     return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist, config.modelRefusals));
@@ -238,7 +238,7 @@ export function createAdmission(ctx) {
             for (const img of body.images) {
                 const data = img.data;
                 if (typeof data === "string" && Buffer.byteLength(data, "utf8") > MAX_IMAGE_BASE64_BYTES) {
-                    sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes`);
+                    sendError(res, 413, "request.payload_too_large", `each inline image must be at most ${MAX_IMAGE_BASE64_BYTES} base64 bytes (the engine's inline-image limit — the model API's 5 MB image cap)`);
                     return null;
                 }
             }

package/dist/http/approval-sweeps.js

@@ -8,7 +8,7 @@ import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { readinessOf, billableRefusalOf } from "./readiness.js";
 import { readResumeCtx } from "./resume-ctx-read.js";
-import { allowListReadingUnstated } from "./checkpoint-ctx.js";
+import { storedBodyReplayRefusal } from "./checkpoint-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -66,21 +66,24 @@ export function createApprovalSweeps(ctx) {
                 return false;
             }
         };
-        const allowListUnservable = async (sessionId) => {
+        const storedBodyUnservable = async (sessionId) => {
             const read = await readResumeCtx(cs.getCtx(sessionId));
             if (read.kind === "corrupt")
-                return false;
-            return read.kind === "ok" && allowListReadingUnstated(read.ctx);
+                return undefined;
+            if (read.kind === "absent")
+                return undefined;
+            return storedBodyReplayRefusal(read.ctx);
         };
         let parkedSkipped = 0;
-        const allowListSkipped = [];
+        const replaySkipped = [];
         for (const { sessionId } of expired) {
             if (await isParkedOwned(sessionId)) {
                 parkedSkipped += 1;
                 continue;
             }
-            if (await allowListUnservable(sessionId)) {
-                allowListSkipped.push(sessionId);
+            const unservable = await storedBodyUnservable(sessionId);
+            if (unservable !== undefined) {
+                replaySkipped.push({ sessionId, kind: unservable.kind });
                 continue;
             }
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
@@ -88,11 +91,11 @@ export function createApprovalSweeps(ctx) {
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
-        if (allowListSkipped.length > 0) {
-            deps.logger?.warn?.("deny_sweep_allow_list_reading_skipped", {
-                count: allowListSkipped.length,
-                sessionIds: allowListSkipped,
-                note: "these expired approvals belong to tasks suspended by a server version that read settings.permissions.allow as a whitelist; this version does not replay them, so the SLA deny cannot be delivered. They stay suspended (session lock held) until the reaper collects them at their terminal time — cancel them (POST /v1/runs/:id/cancel) to release the sessions now",
+        if (replaySkipped.length > 0) {
+            deps.logger?.warn?.("deny_sweep_stored_body_skipped", {
+                count: replaySkipped.length,
+                skipped: replaySkipped,
+                note: "these expired approvals belong to tasks whose stored request this version does not replay (kind allow_list_reading: settings.permissions.allow written under an earlier reading; kind skill_deny_inert: a skill disallowedTools entry the engine now reads as empty), so the SLA deny cannot be delivered. They stay suspended until the terminal backstop reaps them or someone cancels them; nothing was retried",
             });
         }
     }

package/dist/http/checkpoint-ctx.d.ts

@@ -1,43 +1,57 @@
 /**
- * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及持久化体里 `settings.permissions.allow` 的**读法记号** —— S-1034(7.115.0)。
+ * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及持久化体里 `settings.permissions.allow` 的**读法记号**。
  *
- * ## 病
- * 7.115.0 把 `settings.permissions.allow` 从「名单」(名单外的工具一律拒)改成「allow 规则」(命中 = 带理由的放行,未命中 = 不表态、照常判)。
- * 续跑家族重建 spec 时把**持久化的提交体**原样重放进 `resolveSpec`(`resume-legs.ts` 的 `resolveResumeSpec`)——
- * 一条在 ≤7.114.0 上停驻、体里带非空 `allow` 的行,升级后续跑就被按新读法读:名单外的工具不再被拒。持久面上的静默语义翻转(放宽方向)。
- * 坏形 `allow`(`Task` / `mcp__figma` / `Bash(npm:*)` …)的旧行则每次续跑都 409、SLA 拒扫腿逐拍重试直到收割 —— 一张本来放不开任何门的停驻被砖化。
+ * ## 病(两代,同一形)
+ * `settings.permissions.allow` 的读法换过两次:≤7.114.0 是「名单」(名单外的工具一律拒);7.115.0–7.116.x 是「表态」(只回答没人表态的那一问,
+ * 写 / shell 这类普通问照问);7.117.0 起整份交给引擎的 allow 层(`TaskSpec.allowedTools`:表里的调用免问 —— 普通问与没人表态两类都清,内容形也收)。
+ * 续跑家族重建 spec 时把**持久化的提交体**原样重放进 `resolveSpec`(`resume-legs.ts` 的 `resolveResumeSpec`)—— 一条在旧读法下停驻、体里带非空 `allow`
+ * 的行,升级后续跑就被按新读法读,每一次换代都是放宽方向(名单 → 表态:名单外的工具放开;表态 → allow 层:普通问不再问)。持久面上的静默语义翻转。
  *
  * ## 规则(一条;持久数据的「响亮拒 + 一次性迁移」,零双读)
- * 续跑重放持久化体之前问一句:**体里的 `allow` 在生效(非空数组)而本行没有「按表态读」的记号 ⇒ 拒**。
+ * 续跑重放持久化体之前问一句:**体里的 `allow` 在生效(非空数组)而本行的读法记号不是当前这一个词 ⇒ 拒**。
  * 行留停驻、字节不动(拒发生在认领之前,run 行、卡、ctx 一个字节都不写);出路 = 作为新任务重提,这条任务若还停驻着先取消(`task_done` 唤醒停驻与 workflow 宿主那条腿没有可取消的 run)。
- * **没有**「按旧名单语义继续读」的臂:那是第二种读法,正是本规则要消灭的东西。
- *  · 记号 = ≥7.115.0 写下的行在体里带非空 `allow` 时,ctx 上的 `permissionsAllowReading: "statement"`(闭集一词)。
+ * **没有**「按旧读法继续读」的臂(那是第二种读法),也**没有**「按新读法静默续跑」的臂(那是对一条已提交任务的静默放宽)。
+ *  · 记号 = 当前写点在体里带非空 `allow` 时写在 ctx 上的 `permissionsAllowReading`,闭集只有当前读法一个词({@link PERMISSIONS_ALLOW_READINGS})。
  *    写点 = 每一次**新的**持久化写({@link buildCheckpointCtx} 是它们的唯一构造口);续跑腿的写回传的是读进来的那只 ctx(或其展开),记号随行,不重新判。
- *  · 体里没有 `allow`(或空数组 —— 7.114.0 的名单判据 `acceptedRuleList` 对空数组同样读成「没有名单」)的行不写记号、不受本规则影响。
+ *  · 拒句按「这行是在哪种读法下写的」分两句({@link ALLOW_LIST_READING_ERAS} 穷举):无记号(或记号认不得)= 名单时代;`"statement"` = 表态时代。
+ *  · 体里没有 `allow`(或空数组 —— 三代都把空数组读成「没有」)的行不写记号、不受本规则影响。
  *
- * ## 判据与 7.114.0 的关系(如实)
- * 7.114.0 只在三桶整体合法时才读名单;判据这里只看「`allow` 是非空数组」,比 7.114.0 的「名单生效」宽一格(坏桶的行 7.114.0 也不读名单)——
- * 方向 = 多拒,不会漏拒;而坏桶的体当年就被 fresh 受理门拒在门外,盘上本不该有。
+ * ## 第二问(7.117.0,引擎 7.42 逐字读规则条目):技能拒侧读成空的存量体
+ * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里技能(顶层 / 子代)的 `disallowedTools` 有引擎读成空的条目(`"Bash "` 这类 7.41 去白后有效、
+ * 7.42 什么也不拒的条目)⇒ 提交 400(`resolveSpec`,拒点);存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`。判据函数 = `rule-entry-list.ts` `skillDenyInertEntryOf`。
+ *
+ * ## 一只判据、五个问点({@link storedBodyReplayRefusal} / {@link storedBodyReplayAnswer})
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面两问合在 {@link storedBodyReplayRefusal} 一处,答复合在 {@link storedBodyReplayAnswer} 一处。
+ * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
+ * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
+ * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
+ * allow 记号,技能拒侧那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
  *
  * ## 何时删(一次性迁移,不是长期双读)
- * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件 = 所有 ≤7.114.0 停驻的行都已结束或被收割
- * (停驻行的终局时刻 = 落盘起 `TERMINAL_BACKSTOP_MS`,见 `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删:
- * 届时盘上不会再有没记号却带 `allow` 的行,而有记号的行读不读它都一样。
+ * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件与窗登记在 `plugins/one-time-migrations.ts` 的
+ * 一次性迁移登记表(本条那一行):所有旧读法下停驻的行都已结束或被收割(停驻行的终局 = 落盘起 `TERMINAL_BACKSTOP_MS`,见
+ * `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删。
  */
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
-/** 读法记号的闭集(一词):这一行体里的 `settings.permissions.allow` 是按「allow 规则(表态)」写下、也该按它读的。 */
-export declare const PERMISSIONS_ALLOW_READINGS: readonly ["statement"];
+import { type SkillDenyInertEntry } from "../rule-entry-list.js";
+/** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
+ *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
+export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
 export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/** 被拒的行是在哪种读法下写的(闭集;拒句按它穷举):`list` = 无记号或记号认不得(≤7.114.0 的名单读法;认不得的记号不是任何一代的证据,
+ *  按最早那一代说话);`statement` = 7.115.0–7.116.x 写下的表态读法。 */
+export declare const ALLOW_LIST_READING_ERAS: readonly ["list", "statement"];
+export type AllowListReadingEra = (typeof ALLOW_LIST_READING_ERAS)[number];
 /**
- * 体里的 `settings.permissions.allow` 是否**在生效**:非空数组(与 7.114.0 名单判据 `acceptedRuleList` 同一个「在」——空数组 = 没有)。
+ * 体里的 `settings.permissions.allow` 是否**在生效**:非空数组(三代同一个「在」—— 空数组 = 没有)。
  * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
  */
 export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
 /**
  * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 写记号的唯一口。
  *
- * 调用方是「本进程刚按表态读过这份体」的写点:fresh 提交(受理门按 7.115.0 读过 `allow`),或已经过了续跑拒臂的重放腿
+ * 调用方是「本进程刚按当前读法读过这份体」的写点:fresh 提交(受理门按当前读法读过 `allow`),或已经过了续跑拒臂的重放腿
  * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
  * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
  */
@@ -47,17 +61,20 @@ export declare function buildCheckpointCtx(fields: {
     unattendedLeg?: true;
 }): CheckpointCtx;
 /**
- * 本行能否被按 7.115.0 的读法重放:体里 `allow` 在生效而行上没有记号 ⇒ **不能**(`true` = 拒)。
- * 记号的值不在闭集里(手改 / 将来的写者)⇒ 同样拒:认不得的记号不是证据。
+ * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
+ * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
  */
 export declare function allowListReadingUnstated(ctx: CheckpointCtx): boolean;
+/** 被拒的行是哪一代写的(只在 {@link allowListReadingUnstated} 为真时有意义):记号是 `"statement"` ⇒ 表态时代;其余(缺席 / 认不得)⇒ 名单时代。 */
+export declare function allowListReadingEraOf(ctx: CheckpointCtx): AllowListReadingEra;
 /**
  * 拒的答复 —— 码与落点照「退役 mode-seed 行」的先例(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending;**不是**「原样重试会成功」)。
- * 拒在认领之前,所以没有 `taskId`(行没抢到就不造键)。句子说原因(这条任务停在 `allow` 还是名单的版本上)与出路(作为新任务重提,仍停驻的先取消;要「只许这些工具」用会话规则 `toolAllow` / 每请求 `excludeTools`)。
+ * 拒在认领之前,所以没有 `taskId`(行没抢到就不造键)。句子按这一行是哪一代写的分两句(闭集穷举,加一代 ⇒ 编译红):说原因(这条任务停在哪种读法上、
+ * 照当前读法续跑会放宽什么)与出路(作为新任务重提,仍停驻的先取消)。
  *
  * 🔴 形是给冻结门看的(`api-error-text-freeze` 的 resume 家族收集器):`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
  */
-export declare function allowListReadingRefusal(): {
+export declare function allowListReadingRefusal(era: AllowListReadingEra): {
     status: number;
     body: {
         error: string;
@@ -65,4 +82,46 @@ export declare function allowListReadingRefusal(): {
         retriable: true;
     };
 };
+/** 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。 */
+export type StoredBodyReplayRefusal = {
+    readonly kind: "allow_list_reading";
+    readonly era: AllowListReadingEra;
+} | {
+    readonly kind: "skill_deny_inert";
+    readonly entry: SkillDenyInertEntry;
+};
+/**
+ * 「存量体能否重放」的**唯一**判据(文件头「一只判据、五个问点」):不能 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。
+ * 顺序:先 allow 读法记号,再技能拒侧读成空(两问都中时答第一问 —— 任一问中都不重放,句子只需一句)。
+ */
+export declare function storedBodyReplayRefusal(ctx: CheckpointCtx): StoredBodyReplayRefusal | undefined;
+/** 续跑家族交回的拒答复形(`{ status, body }`,由 `sendResumeOutcome` / 各路由发送;`body` 至少 `error` + `errorCode`)。 */
+export interface ResumeRefusalAnswer {
+    readonly status: number;
+    readonly body: {
+        readonly error: string;
+        readonly errorCode: string;
+    } & Record<string, unknown>;
+}
+/**
+ * 「续跑被一条准入策略挡住」的**唯一**铸点:`resolveSpec` 在重放存量体时抛出的 `HttpError`(400 族)折成 409 `resume_blocked_by_policy`,
+ * `blockedBy` = 那条 400 的码(属主 `http/send.ts` `httpErrorCode`),`extra` 原样随体。{@link storedBodyReplayAnswer} 的技能拒侧那一臂与
+ * `resume-legs.ts` 的折叠口都调它 —— 句子与码只在这里写一次(冻结门 `api-error-text-freeze` 的模板骨架表锚这一处)。
+ */
+export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy: string, extra?: Record<string, unknown> | undefined): ResumeRefusalAnswer;
+/**
+ * {@link storedBodyReplayRefusal} 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
+ * 事件名三个(问点各一:`resume_refused_stored_body` / `steer_wake_park_refused_stored_body` / `deny_sweep_stored_body_skipped`),字段形只有这一只。
+ */
+export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
+    kind: StoredBodyReplayRefusal["kind"];
+    era?: AllowListReadingEra;
+    layer?: SkillDenyInertEntry["layer"];
+    note: string;
+};
+/**
+ * {@link storedBodyReplayRefusal} 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
+ */
+export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal): ResumeRefusalAnswer;
 //# sourceMappingURL=checkpoint-ctx.d.ts.map

package/dist/http/checkpoint-ctx.js

@@ -1,4 +1,6 @@
-export const PERMISSIONS_ALLOW_READINGS = ["statement"];
+import { skillDenyInertEntryOf } from "../rule-entry-list.js";
+export const PERMISSIONS_ALLOW_READINGS = ["allow_layer"];
+export const ALLOW_LIST_READING_ERAS = ["list", "statement"];
 export function bodyCarriesAllowList(body) {
     const settings = body?.settings;
     if (settings === null || typeof settings !== "object" || Array.isArray(settings))
@@ -14,7 +16,7 @@ export function buildCheckpointCtx(fields) {
         body: fields.body,
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
-        ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "statement" } : {}),
+        ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
     };
 }
 export function allowListReadingUnstated(ctx) {
@@ -23,14 +25,72 @@ export function allowListReadingUnstated(ctx) {
     const reading = ctx.permissionsAllowReading;
     return !(typeof reading === "string" && PERMISSIONS_ALLOW_READINGS.includes(reading));
 }
-export function allowListReadingRefusal() {
+export function allowListReadingEraOf(ctx) {
+    const reading = ctx.permissionsAllowReading;
+    return reading === "statement" ? "statement" : "list";
+}
+export function allowListReadingRefusal(era) {
+    switch (era) {
+        case "list":
+            return {
+                status: 409,
+                body: {
+                    error: "this task was suspended by an earlier server version that did not record how it read settings.permissions.allow (7.114.0 and earlier read it as a whitelist: every tool not on the list was refused); this version hands that list to the engine's allow layer, where each entry is a standing yes for the calls it covers, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
+                    errorCode: "checkpoint.unsupported_version",
+                    retriable: true,
+                },
+            };
+        case "statement":
+            return {
+                status: 409,
+                body: {
+                    error: "this task was suspended by an earlier server version (7.115.0 to 7.116.x) that read settings.permissions.allow as a statement that the named tools are allowed, which answered only the question nobody else had answered and never cleared an ordinary question such as a file write or a shell command; this version hands that list to the engine's allow layer, where an entry also clears those ordinary questions, so continuing would run calls without asking that the task was submitted to ask about. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
+                    errorCode: "checkpoint.unsupported_version",
+                    retriable: true,
+                },
+            };
+        default: {
+            const unhandled = era;
+            throw new Error(`allow-list reading era ${String(unhandled)} has no refusal sentence`);
+        }
+    }
+}
+export function storedBodyReplayRefusal(ctx) {
+    if (allowListReadingUnstated(ctx))
+        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
+    const entry = skillDenyInertEntryOf(ctx.body);
+    if (entry !== undefined)
+        return { kind: "skill_deny_inert", entry };
+    return undefined;
+}
+export function resumeBlockedByPolicyAnswer(message, blockedBy, extra) {
     return {
         status: 409,
-        body: {
-            error: "this task was suspended by an earlier server version, which read settings.permissions.allow as a whitelist (every tool not on the list was refused); this version reads that list as a statement that the named tools are allowed, not as a whitelist, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
-            errorCode: "checkpoint.unsupported_version",
-            retriable: true,
-        },
+        body: { error: `resume blocked by an admission policy change: ${message}`, errorCode: "resume_blocked_by_policy", blockedBy, ...(extra ?? {}) },
     };
 }
+export function storedBodyReplayLogFields(refusal) {
+    switch (refusal.kind) {
+        case "allow_list_reading":
+            return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
+        case "skill_deny_inert":
+            return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a skill disallowedTools entry the engine now reads as empty (an earlier engine trimmed it into a working deny); it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        default: {
+            const unhandled = refusal;
+            throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
+        }
+    }
+}
+export function storedBodyReplayAnswer(refusal) {
+    switch (refusal.kind) {
+        case "allow_list_reading":
+            return allowListReadingRefusal(refusal.era);
+        case "skill_deny_inert":
+            return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
+        default: {
+            const unhandled = refusal;
+            throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);
+        }
+    }
+}
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/resume-legs.js

@@ -42,7 +42,7 @@ import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { allowListReadingRefusal, allowListReadingUnstated } from "./checkpoint-ctx.js";
+import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "./checkpoint-ctx.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
@@ -408,26 +408,21 @@ export function createResumeLegs(ctx) {
         });
         return { spec, engineNotices };
     };
-    const refuseAllowListReading = (sessionId) => {
-        deps.logger?.warn?.("resume_refused_allow_list_reading", { sessionId, note: "this session's stored request carries settings.permissions.allow written by a server that read it as a whitelist; it is not replayed under the current reading — the task stays suspended until someone cancels it" });
-        return allowListReadingRefusal();
+    const refuseStoredBodyReplay = (sessionId, refusal) => {
+        deps.logger?.warn?.("resume_refused_stored_body", { sessionId, ...storedBodyReplayLogFields(refusal) });
+        return storedBodyReplayAnswer(refusal);
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
-        if (allowListReadingUnstated(ctx))
-            return { ok: false, answer: refuseAllowListReading(auth.sessionId) };
+        const replay = storedBodyReplayRefusal(ctx);
+        if (replay !== undefined)
+            return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
         try {
             const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
             return { ok: true, spec, engineNotices };
         }
         catch (e) {
             if (e instanceof HttpError) {
-                return {
-                    ok: false,
-                    answer: {
-                        status: 409,
-                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", blockedBy: httpErrorCode(e.status, e.code), ...(e.extra ?? {}) },
-                    },
-                };
+                return { ok: false, answer: resumeBlockedByPolicyAnswer(e.message, httpErrorCode(e.status, e.code), e.extra) };
             }
             throw e;
         }
@@ -1348,8 +1343,9 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
-        if (allowListReadingUnstated(ctxRead.ctx))
-            return refuse(refuseAllowListReading(sessionId));
+        const replay = storedBodyReplayRefusal(ctxRead.ctx);
+        if (replay !== undefined)
+            return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
     }
     async function drivePlanReview(prepared, decision, editedPlan, reason, req, acceptEarly, permissionModeAfter) {

package/dist/http/retired-skill-manifest.d.ts

@@ -9,7 +9,7 @@
  * 「带」= 键在场、值是什么都算(`null` / 空对象同样是「我带了 manifest」)—— 与引擎的退役键表读法同形(`RETIRED_TASK_SPEC_KEYS["skills[].manifest"]`:`at !== undefined`)。
  * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
  *
- * 🔴 本模块**零运行期 import**(随包脚本要在没有服务其余部分的位置加载它,与 `checkpoint-ctx.js` 同一姿势)—— 往里加 import 要先想想脚本那一头。
+ * 🔴 本模块**零运行期 import**(随包脚本要在没有服务其余部分的位置加载它;`checkpoint-ctx.js` 7.117.0 起经 `rule-entry-list.js` 依赖引擎包根 —— 包形里有它)—— 往里加 import 要先想想脚本那一头。
  */
 /** 一条技能(提交体 `skills[]` / `agents[].skills[]` 的元素)是否还带退役的 `manifest` 键。 */
 export declare function skillCarriesRetiredManifest(skill: unknown): boolean;

package/dist/http/route-ctx.d.ts

@@ -162,9 +162,9 @@ export interface CheckpointCtx {
      */
     unattendedLeg?: true;
     /**
-     * 🔴 S-1034(7.115.0)—— 体里 `settings.permissions.allow` 的**读法记号**:在场 = 这一行是 ≥7.115.0 写下的、体里带非空 `allow`,
-     * 它按「allow 规则(表态)」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
-     * 缺席而体里带非空 `allow` = ≤7.114.0 停驻的行(那时 `allow` 是名单)⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
+     * 体里 `settings.permissions.allow` 的**读法记号**(闭集只有当前读法一词 `"allow_layer"`):在场 = 这一行是当前读法下写下的、体里带非空 `allow`,
+     * 它按「交给引擎的 allow 层」写、也按它读。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 缺席(≤7.114.0,名单时代)或旧词 `"statement"`(7.115.0–7.116.x,表态时代)而体里带非空 `allow` ⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注)。
      * 写点只有 `buildCheckpointCtx`(同模块;新的持久化写);续跑腿的写回传原 ctx / 其展开 ⇒ 记号随行。体里没有 `allow` 的行不写它。
      */
     permissionsAllowReading?: import("./checkpoint-ctx.js").PermissionsAllowReading;

package/dist/http/routes/capabilities.js

@@ -1,5 +1,5 @@
 import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { isModelAllowlisted, selectableCatalog } from "../../model-select.js";
+import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
@@ -120,7 +120,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
                 taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config) },
-                settings: { permissions: { allowGrant: true } },
+                settings: { permissions: { allowGrant: true, allowLayer: true } },
                 permissionModeAuto: {
                     accepted: true,
                     classifierSeat: deps.autoModeFace?.seatMounted === true,
@@ -238,7 +238,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 id: m.id,
                 provider: m.provider,
                 reasoning: m.reasoning,
-                vision: Array.isArray(m.input) ? m.input.includes("image") : false,
+                ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),

package/dist/http/routes/runs.js

@@ -30,6 +30,7 @@ import { mintAndDriveDurableRun } from "../durable-run-leg.js";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
+import { storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "../checkpoint-ctx.js";
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
 const AskDecisionActorSchema = ActorAssertionWire.strip();
@@ -634,6 +635,11 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.noResumeCtx = true;
                     return;
                 }
+                const unservable = storedBodyReplayRefusal(resumeRead.ctx);
+                if (unservable !== undefined) {
+                    mintResult.unservable = unservable;
+                    return;
+                }
                 const cpScope = encodeCheckpointScope(run.owner);
                 const wakeToken = mintCheckpointToken();
                 await cs.put(wakeToken, {
@@ -688,6 +694,12 @@ export async function handleRuns(req, res, match, ctx) {
                 sendError(res, 500, "corrupt", "run already ended and this session's stored resume context cannot be read — no wake card was minted and nothing was queued. Ask whoever operates this deployment to repair or remove the row named in `where` before steering this session again.", { where: mintResult.corruptCtxWhere });
                 return;
             }
+            if (mintResult.unservable !== undefined) {
+                deps.logger?.warn?.("steer_wake_park_refused_stored_body", { taskId, sessionId: run.sessionId, ...storedBodyReplayLogFields(mintResult.unservable) });
+                const { status, body: { error, errorCode, ...rest } } = storedBodyReplayAnswer(mintResult.unservable);
+                sendError(res, status, errorCode, error, rest);
+                return;
+            }
             if (mintResult.noResumeCtx) {
                 sendError(res, 409, "conflict.resume_context_unavailable", "run already ended and this session's resume context is gone — a steer queued now could never be delivered by POST /v1/sessions/:id/wake; submit a new task instead");
                 return;

package/dist/model-select.d.ts

@@ -136,12 +136,23 @@ export declare function terminalCatalogName(ref: string, catalog: Record<string,
  *    它自己)。命中保留名 ⇒ undefined,调用方接着问 {@link refusedCatalogEntry} 拿拒因码。
  */
 export declare function matchCatalogModel(ref: string, catalog: Record<string, unknown>, refusals?: Readonly<Record<string, ModelEntryRefusal>>): string | undefined;
+/** 「这个目录条目收不收图」的三态(闭集):声明了 `input` 且含 `"image"` / 声明了且不含 / 没声明。 */
+export declare const MODEL_IMAGE_INPUTS: readonly ["yes", "no", "undeclared"];
+export type ModelImageInput = (typeof MODEL_IMAGE_INPUTS)[number];
 /**
- * vision precheck: a catalog model can read images iff its `input` modality list
- * includes `"image"` (the SAME test as the vision capability on GET /v1/models — `server.ts`). FALSE-SAFE on
- * missing/unknown modality info: returns `true` (do NOT block) — only an EXPLICIT text-only `input` triggers the
- * precheck, so a model that never declared its modalities is never wrongly 422'd. Lets a request with images 422
- * up-front instead of hitting the downstream gateway as an opaque deserialize 400 on a text-only model.
+ * 「这个目录条目收不收图」的**唯一读法**。两个读者都投影它,不各写各的:
+ *  · 目录行 `GET /v1/models` 的 `vision`:`yes` ⇒ `true`,`no` ⇒ `false`,`undeclared` ⇒ **键缺席**(不替没声明的模型答「收」也不答「不收」);
+ *  · 运行期的带图预检 {@link modelSupportsImages}:只有明说 `no` 才出信号。
+ * 此前两处各判各的,且对「没声明」答法相反(目录行报 false、预检放行)——客户端只读得到目录那一位,于是在手写、没声明 `input` 的
+ * 条目上把用户的图拦在了本地,而引擎其实会把图交给模型。env 车道与配置中心车道恒写 `input`,分叉只落在手写目录条目上。
+ * `input` 不是数组(手写错形)与条目不在,同归 `undeclared`:没有可信的声明。
+ */
+export declare function modelImageInput(model: {
+    input?: unknown;
+} | undefined): ModelImageInput;
+/**
+ * 带图预检:只有目录条目**明说**不收图({@link modelImageInput} 为 `"no"`)才为假 —— 提交时据此计数并告警(引擎会把这些图换成给模型的
+ * 占位句);没声明的条目为真(不出信号,图原样交给模型)。
  */
 export declare function modelSupportsImages(model: {
     input?: unknown;

package/dist/model-select.js

@@ -90,9 +90,13 @@ export function matchCatalogModel(ref, catalog, refusals) {
     }
     return undefined;
 }
-export function modelSupportsImages(model) {
+export const MODEL_IMAGE_INPUTS = ["yes", "no", "undeclared"];
+export function modelImageInput(model) {
     if (!model || !Array.isArray(model.input))
-        return true;
-    return model.input.includes("image");
+        return "undeclared";
+    return model.input.includes("image") ? "yes" : "no";
+}
+export function modelSupportsImages(model) {
+    return modelImageInput(model) !== "no";
 }
 //# sourceMappingURL=model-select.js.map

package/dist/namespaced-rule-name.d.ts

@@ -1,9 +1,10 @@
 /**
  * 协议规则名(`mcp__…` / `a2a__…`)够不够得着一只挂载工具 —— **一只**判官 + **一只**句子。调它的面(点名,不是「每个面」):
- *  · 运维四表与中心下发的同名表、请求 `settings.permissions.{allow,ask,deny}`(经 `config.ts` 的 `unmatchableToolNamesRefusal`);
+ *  · 运维三张名表(`APPROVAL_REQUIRE` / `DENY` / `NEVER_AUTO`)与中心下发的同名表、请求 `settings.permissions.{ask,deny}`(经 `config.ts` 的
+ *    `unmatchableToolNamesRefusal`);
  *  · 会话规则写口两腿与 SQL 会话规则店的写口(经 `session-policy-wire.ts`);
- *  · 技能的两只清单 `allowedTools` / `disallowedTools`,两处受理口:顶层 `skills[]`(`http/admission.ts` 的 `validateUserSkills`)与子代
- *    `agents[].skills[]`(`spec-fields.ts` 的 `validateTaskAgents`),经 `spec-fields.ts` 的 `unreachableSkillToolListEntryOf`。
+ *  · 引擎 allow 层的三张条目表(core 7.42.0 起):请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT`、技能的两只清单 `allowedTools` /
+ *    `disallowedTools`(顶层 `skills[]` 与子代 `agents[].skills[]` 两处受理口)—— 经 `rule-entry-list.ts` 的 `unreachableRuleEntryOf`(同一只函数)。
  * **不调它的面**(如实,未接):`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`)、子代的工具名表 `agents[].allowTools` /
  * `denyTools`(`spec-fields.ts` 只判形与条数)。在这两处写铸不出的服务器段仍被收下、永不命中。
  * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表与技能清单同读)。
@@ -17,8 +18,9 @@
  *     (`mcp__<摘要>__*`)没人照做得了 ⇒ 判词单列 `wildcard_peer`,句子说实话(写具体的服务器名)。
  * 判据不看规则是覆盖形还是精确名:两种形的对端段命运相同。精确名的**工具段**归一不在这里判(包根没有导出工具段的铸法,不手抄)。
  *
- * core 下一版(7.42.0)的规则名判官会自己给这个判词;到货那天本仓这只对照整只退役(连同会话规则写口这一问的码由 `request.field_invalid` 归回
- * `rules.legacy_tool_name`)。
+ * 翻转条件:core 的规则名判官(`judgeRuleToolName`)自己给出「对端段铸不出」这一判词 —— core 7.42.x 还没有(包根 `RULE_TOOL_NAME_VERDICTS`
+ * 只有 current / retired / unprefixed_namespace,亲核),等上游;到货那天本仓这只对照整只退役(连同会话规则写口这一问的码由 `request.field_invalid`
+ * 归回 `rules.legacy_tool_name`)。
  */
 import { type ProtocolNamespace } from "@sema-agent/core";
 /**

package/dist/observability/fail-open.d.ts

@@ -116,7 +116,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approvals.risk-descriptor-cell-unreadable": {
         readonly cls: "F";
-        readonly note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.risk_descriptor` 这一格**不是合法 JSON 文本**(手改过的行 / 回滚残留 / 列语义漂;与同一 `rows.map` 里的 `rule_suggestions` 是同族坏法,两方言都是 TEXT 列)。放行的最坏后果 = **这一行**的分诊 descriptor 落 null:severity 折 0 排到有 descriptor 的行之后、`shadowedRule` 无可脱敏、读面派生的 `governanceForced` 徽章不亮 —— 三者都是**展示/分诊**,不是执法判据(门早已 park,真按 `shellGateDoctrine` 判的 `active-run-conflict.ts` 读的是 checkpoint blob 的 `get()`,不经本读面),且 `governanceForced` 的成文语义本就是「缺席 = 没有治理来源的**证据**」。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),连同其余所有行一起消失。故 F 类;tag 与候选那格**分开计**,并计会让「哪一格在坏」在遥测里读不出来。";
+        readonly note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.risk_descriptor` 这一格**不是合法 JSON 文本**(手改过的行 / 回滚残留 / 列语义漂;与同一 `rows.map` 里的 `rule_suggestions` 是同族坏法,两方言都是 TEXT 列)。放行的最坏后果 = **这一行**的分诊 descriptor 落 null:severity 折 0 排到有 descriptor 的行之后、披露位(`allowRuleShadowed`;7.117.0 前叫 `shadowedRule`)无可脱敏、读面派生的 `governanceForced` 徽章不亮 —— 三者都是**展示/分诊**,不是执法判据(门早已 park,真按 `shellGateDoctrine` 判的 `active-run-conflict.ts` 读的是 checkpoint blob 的 `get()`,不经本读面),且 `governanceForced` 的成文语义本就是「缺席 = 没有治理来源的**证据**」。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),连同其余所有行一起消失。故 F 类;tag 与候选那格**分开计**,并计会让「哪一格在坏」在遥测里读不出来。";
     };
     readonly "server.approvals.park-row-blob-unreadable": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -110,7 +110,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.approvals.risk-descriptor-cell-unreadable": {
         cls: "F",
-        note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.risk_descriptor` 这一格**不是合法 JSON 文本**(手改过的行 / 回滚残留 / 列语义漂;与同一 `rows.map` 里的 `rule_suggestions` 是同族坏法,两方言都是 TEXT 列)。放行的最坏后果 = **这一行**的分诊 descriptor 落 null:severity 折 0 排到有 descriptor 的行之后、`shadowedRule` 无可脱敏、读面派生的 `governanceForced` 徽章不亮 —— 三者都是**展示/分诊**,不是执法判据(门早已 park,真按 `shellGateDoctrine` 判的 `active-run-conflict.ts` 读的是 checkpoint blob 的 `get()`,不经本读面),且 `governanceForced` 的成文语义本就是「缺席 = 没有治理来源的**证据**」。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),连同其余所有行一起消失。故 F 类;tag 与候选那格**分开计**,并计会让「哪一格在坏」在遥测里读不出来。",
+        note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.risk_descriptor` 这一格**不是合法 JSON 文本**(手改过的行 / 回滚残留 / 列语义漂;与同一 `rows.map` 里的 `rule_suggestions` 是同族坏法,两方言都是 TEXT 列)。放行的最坏后果 = **这一行**的分诊 descriptor 落 null:severity 折 0 排到有 descriptor 的行之后、披露位(`allowRuleShadowed`;7.117.0 前叫 `shadowedRule`)无可脱敏、读面派生的 `governanceForced` 徽章不亮 —— 三者都是**展示/分诊**,不是执法判据(门早已 park,真按 `shellGateDoctrine` 判的 `active-run-conflict.ts` 读的是 checkpoint blob 的 `get()`,不经本读面),且 `governanceForced` 的成文语义本就是「缺席 = 没有治理来源的**证据**」。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),连同其余所有行一起消失。故 F 类;tag 与候选那格**分开计**,并计会让「哪一格在坏」在遥测里读不出来。",
     },
     "server.approvals.park-row-blob-unreadable": {
         cls: "F",