@sema-agent/server 7.118.0 → 7.120.0

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { hostDecisionFacts, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
+import { hostDecisionFacts, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS, standingAnswerDurablyRecordable } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -17,6 +17,7 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
+import { deploymentListAsks } from "../../approval.js";
 import { answerGrantsBeyondCall, grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
@@ -640,13 +641,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }", retiredDecisionKeyFacts(body)?.extra);
                 return;
             }
             {
                 const keyIssue = decisionBodyKeyIssue("approval-decide", body);
                 if (keyIssue) {
-                    sendError(res, 400, "request.body_shape", keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys });
+                    const retired = retiredDecisionKeyFacts(body);
+                    sendError(res, 400, "request.body_shape", retired?.error ?? keyIssue.message, { unknownKeys: keyIssue.unknownKeys, unsupportedKeys: keyIssue.unsupportedKeys, ...retired?.extra });
                     return;
                 }
             }
@@ -819,7 +821,8 @@ function redactPendingDisclosures(row) {
     const next = redactRiskDescriptor(rd);
     return next === rd ? row : { ...row, riskDescriptor: next };
 }
-function projectPendingForWire(row, governance) {
+function projectPendingForWire(row, deployment) {
+    const governance = deployment;
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
     const rememberRefused = !standingAnswerDurablyRecordable({
@@ -828,6 +831,7 @@ function projectPendingForWire(row, governance) {
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
         grantBinding: grantBindingOf(row),
         classes: row.classes,
+        deploymentListQuestion: carriesDeploymentListQuestion(row.toolName !== null && deployment !== undefined && deploymentListAsks(deployment, { toolName: row.toolName }), row.classes),
     });
     return { ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
 }

package/dist/http/routes/capabilities.js

@@ -1,4 +1,4 @@
-import { expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { PERMISSION_MODES, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
 import { modelImageInput, isModelAllowlisted, selectableCatalog } from "../../model-select.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
@@ -23,7 +23,7 @@ import { workflowModelAllowlistFor } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
-import { coercePermissionModeStrict, SETTINGS_PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
+import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
     if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
@@ -60,7 +60,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             const requestedModeRaw = new URLSearchParams(match.search).get("permissionMode");
             const requestedMode = requestedModeRaw === null ? undefined : coercePermissionModeStrict(requestedModeRaw);
             if (requestedModeRaw !== null && requestedMode === undefined) {
-                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${SETTINGS_PERMISSION_MODE_WORDS}`);
+                sendError(res, 400, "request.field_invalid", `permissionMode must be one of ${PERMISSION_MODE_WORDS}`);
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
@@ -160,6 +160,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 streamApproval: facts.streamApproval(deps).available,
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
+                permissionModes: [...PERMISSION_MODES],
+                sessionReadRedaction: true,
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 retention: retentionAdvertisement(deps.config),

package/dist/http/routes/devices.js

@@ -2,7 +2,7 @@ import { sendError, sendJson } from "../send.js";
 import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, sameDeviceOwner, } from "../../device-store.js";
+import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, isDeviceAbsolutePath, sameDeviceOwner, } from "../../device-store.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../device-placement.js";
 import { echoKeyName } from "../../request-key-closure.js";
@@ -109,8 +109,8 @@ function parseEnrollBody(res, body) {
             return null;
         }
     }
-    if (workspaceRoot.length === 0) {
-        sendError(res, 400, "request.field_invalid", "workspaceRoot is required and must be non-empty (it is the device-side root every instruction resolves against)");
+    if (!isDeviceAbsolutePath(workspaceRoot)) {
+        sendError(res, 400, "request.field_invalid", "workspaceRoot must be an absolute POSIX path (it is the device-side root every instruction resolves against)");
         return null;
     }
     return { token: token, pubkey: pubkey, platformOs: os, platformArch: platformArch, displayName: displayName, workspaceRoot: workspaceRoot };

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
+        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/rules.js

@@ -4,10 +4,10 @@ import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sen
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createLogger } from "../../observability/logger.js";
-import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
+import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
+import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
 import { PERSISTED_RULE_MATCHES, isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
@@ -26,7 +26,7 @@ const CcImportPrepareBodySchema = z
         .object({
         layer: z.enum(["userSettings", "projectSettings", "localSettings"]),
         path: z.string().min(1).max(1024),
-        root: z.string().min(1).max(1024),
+        root: z.string().max(1024),
         content: z.string().max(MAX_LAYER_CONTENT_CHARS),
     })
         .strict())
@@ -34,6 +34,9 @@ const CcImportPrepareBodySchema = z
         .max(MAX_LAYERS),
 })
     .strict();
+function ccImportRootRefused(layer) {
+    return !isValidDurableScope({ kind: "project", root: layer.root });
+}
 const TICKET_CONTROL_CHARS_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
 const TicketStringSchema = z.string().min(1).max(190).refine((t) => !TICKET_CONTROL_CHARS_RE.test(t));
 const CcImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
@@ -170,6 +173,10 @@ export async function handleRules(req, res, match, ctx) {
             sendError(res, 400, "request.body_shape", "body must be {layers:[{layer,path,root,content}]}");
             return;
         }
+        if (parsed.data.layers.some(ccImportRootRefused)) {
+            sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
+            return;
+        }
         const prepared = await lane.prepareImport(principal, parsed.data.layers);
         if (!prepared.ok) {
             sendError(res, 413, "request.payload_too_large", "too many allow entries across the submitted settings layers");
@@ -231,7 +238,7 @@ async function handleRuleList(res, search, caller, lane, config) {
     const scopeRaw = q.get("scope");
     const scopeFilter = scopeRaw === null ? undefined : parseRuleScope(scopeRaw);
     if (scopeRaw !== null && scopeFilter === undefined) {
-        sendError(res, 400, "request.query_invalid", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.query_invalid", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const cursorRaw = q.get("cursor");
@@ -305,7 +312,7 @@ async function handleRuleWrite(res, rawBody, caller, lane, config) {
     }
     const scope = parseRuleScope(parsed.data.scope);
     if (scope === undefined) {
-        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const target = resolveTargetPrincipal(parsed.data.principal, caller, config);
@@ -354,7 +361,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, config) {
     }
     const scope = parseRuleScope(parsed.data.scope);
     if (scope === undefined) {
-        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const target = resolveTargetPrincipal(parsed.data.principal, caller, config);

package/dist/http/routes/runs.js

@@ -1,7 +1,7 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventForRead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { z } from "zod";
-import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
+import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { RUN_HOLDER_DEATH_CODES, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
@@ -15,14 +15,14 @@ import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
-import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
+import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
 import { ASK_DECISION_CONSUMER_ABSENT, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { readTurnActivityMs } from "../../turn-activity.js";
 import { mintCancelledResult } from "../../run-cancel-context.js";
-import { userInputLaneOf } from "../../user-input-ledger.js";
+import { acceptedInputKindOf } from "../../user-input-ledger.js";
 import { INJECTION_TIERS } from "../../trace/injection-tier.js";
 import { buildCrossSliceUsage, readResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
@@ -150,8 +150,9 @@ function sendSteerReplayRefusal(res, refusal) {
 async function acceptLiveUserInput(deps, res, at) {
     if (!deps.userInputLedger)
         return undefined;
+    const input = acceptedInputKindOf(at.tier);
     try {
-        return await deps.userInputLedger.accept({ input: userInputLaneOf(at.tier), messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+        return await deps.userInputLedger.accept({ input, messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
     }
     catch (e) {
         deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
@@ -1372,6 +1373,11 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const parsedBody = AskDecisionBodySchema.safeParse(rawBody);
         if (!parsedBody.success) {
+            const retired = retiredDecisionKeyFacts(rawBody);
+            if (retired !== undefined) {
+                sendError(res, 400, "request.body_shape", retired.error, retired.extra);
+                return;
+            }
             sendError(res, 400, "request.body_shape", "invalid ask decision body — expected decision=approve|deny plus optional updatedInput / note / idempotencyKey / actor.label / decidedBy");
             return;
         }
@@ -1517,7 +1523,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendTerminal(row0);
             return;
         }
-        if (policyCannotAllow(decidedBy, body.decision === "approve", storedCardDemandsAPerson(row0.cardJson))) {
+        if (body.decision === "approve" && policyCannotAnswer(heldAskOf(storedCardDemandsAPerson(row0.cardJson)), decidedBy)) {
             sendError(res, 400, "request.field_conflict", POLICY_CANNOT_ALLOW_PERSON_ASK);
             return;
         }

package/dist/http/routes/sessions.js

@@ -1,7 +1,7 @@
-import { materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
+import { SessionError, materializeA2aTools, materializeMcpTools, sanitizePathComponent } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
 import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
-import { windowMessages, truncateMessageBlobs } from "../../audit.js";
+import { windowMessages, truncateMessageBlobs, redactSessionViewForRead } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
@@ -596,9 +596,13 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "the session audit view requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const audit = await readOwnedSessionView(auditFact.sessionAudit, match.params.sessionId);
-            if (audit === undefined)
+            const owned = await readOwnedSessionView(auditFact.sessionAudit, match.params.sessionId);
+            if (owned === undefined)
                 return;
+            if (!Array.isArray(owned.messages)) {
+                throw new SessionError("corrupt_session", `session ${match.params.sessionId} is unreadable: its archive projection carries "messages" as ${owned.messages === null ? "null" : typeof owned.messages}, not an array`);
+            }
+            const ownedMessages = owned.messages;
             const q = new URLSearchParams(match.search);
             const qi = (k) => {
                 const v = q.get(k);
@@ -609,12 +613,12 @@ export async function handleSessions(req, res, match, ctx) {
             };
             const msgIndex = qi("message");
             if (msgIndex !== undefined) {
-                const messages = audit.messages;
-                if (msgIndex >= messages.length) {
-                    sendError(res, 404, "not_found.message_index", "message index out of range", { total: messages.length });
+                if (msgIndex >= ownedMessages.length) {
+                    sendError(res, 404, "not_found.message_index", "message index out of range", { total: ownedMessages.length });
                     return;
                 }
-                sendJson(res, 200, { sessionId: audit.sessionId, floorEntryId: audit.floorEntryId, index: msgIndex, message: messages[msgIndex] });
+                const one = redactSessionViewForRead({ ...owned, messages: [ownedMessages[msgIndex]] });
+                sendJson(res, 200, { sessionId: owned.sessionId, floorEntryId: owned.floorEntryId, index: msgIndex, message: one.messages[0] });
                 return;
             }
             const tail = qi("tail");
@@ -631,19 +635,19 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const undrainedKey = undrained !== undefined ? { userInputUndrained: undrained } : {};
             if (tail === undefined && before === undefined && blobCap === undefined) {
-                sendJson(res, 200, { ...audit, ...undrainedKey });
+                sendJson(res, 200, { ...redactSessionViewForRead(owned), ...undrainedKey });
                 return;
             }
-            let messages = audit.messages;
+            let selected = ownedMessages;
             let window;
             if (tail !== undefined || before !== undefined) {
-                const w = windowMessages(messages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
-                messages = w.messages;
+                const w = windowMessages(ownedMessages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
+                selected = w.messages;
                 window = w.window;
             }
-            if (blobCap !== undefined && blobCap > 0)
-                messages = truncateMessageBlobs(messages, blobCap);
-            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}), ...undrainedKey });
+            const view = redactSessionViewForRead({ ...owned, messages: selected });
+            const messages = blobCap !== undefined && blobCap > 0 ? truncateMessageBlobs(view.messages, blobCap) : view.messages;
+            sendJson(res, 200, { ...view, messages, ...(window ? { window } : {}), ...undrainedKey });
             return;
         }
     }
@@ -756,7 +760,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             if (owner === null) {
-                sendError(res, 409, "conflict.session_ownerless", "session policy requires an owned session (set REQUIRE_PRINCIPAL / attach a principal); this session is ownerless");
+                sendError(res, 409, "conflict.session_ownerless", "this session has no recorded owner, so its rules can be neither read nor changed through this route; rules already stored for it keep applying to the runs of the principal they were stored under. Ways out: on the local backend, during the upgrade window, the first task submitted with a principal on a session written by an earlier version claims it for that principal (this route then serves its owner); or delete the session (DELETE /v1/sessions/:id), which removes its rules with it");
                 return;
             }
             const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);

package/dist/http/wire-types.d.ts

@@ -6,8 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, SkillSpec } from "@sema-agent/core";
-import type { SettingsPermissionMode } from "../task-settings.js";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec } from "@sema-agent/core";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -17,7 +16,9 @@ export interface TaskRequestBody {
      *  table — e.g. "default"/"code-review"/"scan"/"discuss"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
      *  `scenario_unknown`, a known-but-not-allowed one a typed 400 `scenario_not_allowed`; absent ⇒ the ruling's
-     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`).
+     *  assigned scenario, else `DEFAULT_SCENARIO` (consumed at `boot/resolve-spec.ts` via `gateScenarioRequest`). A name
+     *  on that default chain this deployment does not have is NEVER folded to `default`: an assigned one is a typed 503
+     *  `state.scenario_assignment_unknown`, a dangling `DEFAULT_SCENARIO` refuses to boot.
      *  ⚠️ scenario-SPECIFIC keys (`repo`/`lenses`/`rounds`, read through `ScenarioRequest`'s index signature) are
      *  deliberately NOT declared here — they belong to one scenario each, not to the shared submit surface. */
     scenario?: string;
@@ -333,18 +334,16 @@ export interface TaskRequestBody {
     toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
      *  the RAW mode (axis-agnostic, no client-side interpretation); the SERVICE interprets it tighten-only vs the
-     *  deployment baseline. Post-[ref] all FIVE modes are honored as gate-SHAPE choices (`plan` ⇒ read-only hands +
-     *  `present_plan`; `acceptEdits`/`bypassPermissions`/`auto` select how much the mode-derived fs-write ask gate
-     *  asks — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins; the old "LOOSEN →
-     *  coerced to default" note was pre-[ref] doc-rot). Folds onto the SAME tighten-only governance as
-     *  `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
+     *  deployment baseline. All SIX core modes are honored (`plan` ⇒ read-only hands + `present_plan`;
+     *  `acceptEdits` selects how much the mode-derived fs-write ask gate asks; `bypassPermissions`/`auto`/`dontAsk` ride the
+     *  engine's own mode table verbatim — `dontAsk` refuses every ask by the mode, zero cards, the gate records
+     *  `deniedBy:"mode"`) — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins). Folds onto the SAME
+     *  tighten-only governance as `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
      *  [ref]-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
      *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
-     *  (coercePermissionMode). */
-    /**  🔴 型**从值表派生**(S-496 U1 / [ref]):闭集的属主是 `task-settings.ts` 的
-     *  `SETTINGS_PERMISSION_MODES`(受理腿 `isSettingsPermissionMode` 与两句 400 文案同读那一份)。
-     *  改前这里是第 6 份手抄的五词联合 —— 加/退一个模式时 wire 型面与受理腿会各走各的。 */
-    permissionMode?: SettingsPermissionMode;
+     *  (coercePermissionMode).
+     *  🔴 型与闭集的属主是 core 的 `PermissionMode` / `PERMISSION_MODES`(受理腿 `isPermissionMode` 与三句 400 文案同读那一份)—— 本仓不持词表。 */
+    permissionMode?: PermissionMode;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the [ref] memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries

package/dist/images/manifest.d.ts

@@ -6,7 +6,13 @@
  * one-time seed and the P3 atomic-publish pipeline — kept side-effect-free so it is unit-tested without a DB.
  */
 import type { ImageIndexUpsert, ImageNestedBuildMode, ImageStatus } from "../plugins/store-contracts.js";
-/** Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract). */
+/**
+ * Project the manifest's `nestedBuild` (string posture OR bool) → the enum (center contract).
+ *
+ * 声明型 = 闭集词 | `true`(老写法的裸布尔,含义 = `rootless-buildkit`)| `false` / 缺席(= `none`)。**其余一律抛** —— 修前「未知的非空词」
+ * 被上调成 `rootless-buildkit`(一条没人声明过的 nested-build 能力写进 index),运行期的非声明型真值(数字 / 对象 …)走 `v ? … : …` 同样被上调。
+ * 抛出的句子沿用该面既有的拒法:`done` 帧的 auto-register 把它收成「built-but-unregistered」终局 FAILED,错误句带这一句(见 `http/routes/images.ts`)。
+ */
 export declare function nestedBuildModeOf(v: string | boolean | undefined): ImageNestedBuildMode;
 /** The fields of build.sh's `sandbox-manifest.json` this projection reads (a superset is fine; extras ignored). */
 export interface BuildManifest {

package/dist/images/manifest.js

@@ -1,18 +1,19 @@
-const NESTED_BUILD_MODES = [
-    "none",
-    "docker-cli-only",
-    "rootless-buildkit",
-    "privileged-dind",
-];
+const NESTED_BUILD_MODE_WORDS = {
+    none: true,
+    "docker-cli-only": true,
+    "rootless-buildkit": true,
+    "privileged-dind": true,
+};
+const isNestedBuildMode = (v) => Object.prototype.hasOwnProperty.call(NESTED_BUILD_MODE_WORDS, v);
 export function nestedBuildModeOf(v) {
-    if (typeof v === "string") {
-        return NESTED_BUILD_MODES.includes(v)
-            ? v
-            : v
-                ? "rootless-buildkit"
-                : "none";
-    }
-    return v ? "rootless-buildkit" : "none";
+    if (v === undefined || v === false)
+        return "none";
+    if (v === true)
+        return "rootless-buildkit";
+    if (typeof v === "string" && isNestedBuildMode(v))
+        return v;
+    const got = typeof v === "string" ? `the string ${JSON.stringify(v.slice(0, 64))}` : v === null ? "null" : Array.isArray(v) ? "an array" : `type ${typeof v}`;
+    throw new Error(`manifest capabilities.nestedBuild must be one of ${Object.keys(NESTED_BUILD_MODE_WORDS).join(" | ")} (or a bare boolean); got ${got}`);
 }
 export function shmToMB(v) {
     if (!v)
@@ -32,11 +33,12 @@ export function profileFromManifest(m) {
 export function manifestToIndexEntry(m, opts) {
     const profile = profileFromManifest(m);
     const tag = (m.tag ?? "").includes(":") ? (m.tag ?? "").split(":")[1] : (m.tag ?? "");
+    const nestedBuildMode = nestedBuildModeOf(m.capabilities?.nestedBuild);
     const capabilities = {
         browser: !!m.capabilities?.browser,
         db: !!m.capabilities?.db,
-        nestedBuild: !!m.capabilities?.nestedBuild,
-        nestedBuildMode: nestedBuildModeOf(m.capabilities?.nestedBuild),
+        nestedBuild: nestedBuildMode !== "none",
+        nestedBuildMode,
     };
     const pc = m.capabilities?.podContract;
     const devShmMB = shmToMB(pc?.devShm);

package/dist/list-entry-display.d.ts

@@ -0,0 +1,14 @@
+/**
+ * **机读位的值** —— 通告 `detail` 里的规则文本(`permission.allowed_tool_not_granted` 的 `detail.entries[].entry`、`permission.rule_row_dropped` 的
+ * `detail.rows[].rule`)在会话流行与运维日志行上一律是这一只:条目的脱敏原值。显示形不进机读位(壳若再加引号就是两层)。
+ */
+export declare function redactListEntry(entry: string): string;
+/**
+ * **人读句里条目的唯一写法** —— 本仓把规则条目 / 工具名原串写进任何一句给人读的话(拒句、起服拒启行)一律调这一只:引擎的条目写者
+ * `renderListEntry`(core 7.46.0 #1428 包根导出:JSON 串形带引号,看不见 / 印成空白的字符写成 `\uXXXX`,超长截断)—— 与引擎自己的通告句同一个渲染;
+ * 判定拿原串。
+ * 🔴 凭据先认、再渲染:渲染把看不见的字符写成 ASCII 转义,之后的脱敏器就认不出夹着零宽字符的凭据 ⇒ 原串上认出凭据时渲染它的脱敏值;
+ * 没有凭据的条目渲染**原串**(格式字符留给渲染器写成 `\uXXXX` —— 人要看得见它,不能先被脱敏器剥掉)。
+ */
+export declare function displayListEntry(entry: string): string;
+//# sourceMappingURL=list-entry-display.d.ts.map

package/dist/list-entry-display.js

@@ -0,0 +1,14 @@
+import { renderListEntry } from "@sema-agent/core";
+import { redactSecretsWithArms } from "./trace/redact.js";
+function scanListEntry(entry) {
+    const scan = redactSecretsWithArms(entry);
+    return { redacted: scan.text, credential: scan.arms.size > 0 };
+}
+export function redactListEntry(entry) {
+    return scanListEntry(entry).redacted;
+}
+export function displayListEntry(entry) {
+    const scan = scanListEntry(entry);
+    return renderListEntry(scan.credential ? scan.redacted : entry);
+}
+//# sourceMappingURL=list-entry-display.js.map

package/dist/memory-store-refusal.d.ts

@@ -34,27 +34,22 @@
  * 路径不上 wire,只进这一条运维 warn —— 它是**日志行**不是 wire 错误体,所以铸点跟读法属主住在一起(不住 `http/`:`http/` 全树门
  * `test/error-code-key-gate.test.ts` 咬的是错误体里的 `code:` 键位,日志字段名不该借 wire 层的目录去过它)。
  */
+import { type ScopeHomeForm, type StoreFormRefusalCode } from "@sema-agent/core";
 import type { Logger } from "./observability/logger.js";
-/** core 的两码(`dist/core/memory-engine/layout.js` `TARGET_OUTSIDE_STORE` / `SCOPE_HOME_NOT_DIRECTORY`;core 不在包根导出它们,这两个常量是它们在本仓的唯一写点)。 */
-export declare const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-export declare const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
-/** 店形拒族(闭集;core 加第三码 ⇒ 它落未分类 500 + 运维 warn,由人裁归不归这一族)。 */
-export declare const STORE_FORM_REFUSAL_CODES: readonly ["memory.target_outside_store", "memory.scope_home_not_directory"];
-export type StoreFormRefusalCode = (typeof STORE_FORM_REFUSAL_CODES)[number];
 /** 一次店形拒的读数(纯数据)。`path` / `form` 取自 core 的 `detail`(读不出 ⇒ `undefined`,不猜、不从句子里抠)。 */
-export interface StoreFormRefusal {
+export interface StoreFormRefusalReading {
     readonly code: StoreFormRefusalCode;
     /** core 原句(以码领头;7.44.0 起不含宿主路径)。 */
     readonly message: string;
     /** `detail.path`:落点 / 被改指的根 / 不是目录的 scope home —— **只给运维行**。 */
     readonly path: string | undefined;
-    /** `detail.form`(只在 home 那一码上):原样字符串,不镜像 core 的闭集(本仓只把它写进运维行,不按它分支)。 */
-    readonly form: string | undefined;
+    /** `detail.form`(只在 home 那一码上),经 core 闭集读;本仓只把它写进运维行,不按它分支。 */
+    readonly form: ScopeHomeForm | undefined;
 }
-/** 抛出面:`err` 是店形拒 ⇒ 读数;否则 `undefined`。形 = core 的 `Error` + `.code` + `.detail`。 */
-export declare function storeFormRefusalOf(err: unknown): StoreFormRefusal | undefined;
+/** 抛出面:`err` 是店形拒(core `StoreFormRefusal` 的形:码在族里)⇒ 读数;否则 `undefined`。`detail` 读不全不改判(码定族,`detail` 只供运维行)。 */
+export declare function storeFormRefusalOf(err: unknown): StoreFormRefusalReading | undefined;
 /** 两受众共用的运维行(一处铸点):码 + core `detail` 里的宿主路径与 home 形。`logger` 缺席(只有不接 logger 的测试装配)⇒ 不落。 */
-export declare function logStoreFormRefusal(logger: Pick<Logger, "warn"> | undefined, refusal: StoreFormRefusal): void;
+export declare function logStoreFormRefusal(logger: Pick<Logger, "warn"> | undefined, refusal: StoreFormRefusalReading): void;
 /** 报告面:harvest `incident` 是这一族拒 ⇒ 码;否则 `undefined`(真控制面损坏的 `sidecar_corrupt` 走这一臂 —— 不被说成店形拒)。 */
 export declare function storeFormRefusalInIncident(incident: {
     readonly kind: string;

package/dist/memory-store-refusal.js

@@ -1,7 +1,6 @@
-export const TARGET_OUTSIDE_STORE = "memory.target_outside_store";
-export const SCOPE_HOME_NOT_DIRECTORY = "memory.scope_home_not_directory";
-export const STORE_FORM_REFUSAL_CODES = [TARGET_OUTSIDE_STORE, SCOPE_HOME_NOT_DIRECTORY];
-const isStoreFormRefusalCode = (code) => typeof code === "string" && STORE_FORM_REFUSAL_CODES.includes(code);
+import { SCOPE_HOME_FORMS, STORE_FORM_REFUSAL_CODES } from "@sema-agent/core";
+const isStoreFormRefusalCode = (code) => STORE_FORM_REFUSAL_CODES.includes(code);
+const isScopeHomeForm = (form) => SCOPE_HOME_FORMS.includes(form);
 export function storeFormRefusalOf(err) {
     if (!(err instanceof Error))
         return undefined;
@@ -9,7 +8,7 @@ export function storeFormRefusalOf(err) {
     if (!isStoreFormRefusalCode(code))
         return undefined;
     const d = typeof detail === "object" && detail !== null ? detail : {};
-    return { code, message: err.message, path: typeof d.path === "string" ? d.path : undefined, form: typeof d.form === "string" ? d.form : undefined };
+    return { code, message: err.message, path: typeof d.path === "string" ? d.path : undefined, form: isScopeHomeForm(d.form) ? d.form : undefined };
 }
 export function logStoreFormRefusal(logger, refusal) {
     logger?.warn("memory_store_form_refused", {

package/dist/namespaced-rule-name.d.ts

@@ -14,9 +14,10 @@
  *  · 会话规则写口(`session-policy-wire.ts`)与 SQL 会话规则店的写口(`assertSessionRuleNamesReachable`);
  *  · 引擎 allow 层的条目表:请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT`、技能的两只清单 `allowedTools` / `disallowedTools`(顶层 `skills[]` 与子代
  *    `agents[].skills[]` 两处受理口)—— 经 `rule-entry-list.ts` 的 `emptyToolSegmentEntryOf`(本仓这一问;退役名 / 铸不出的判词那一半由引擎 `compileAllowList` 给)。
- * **不调它的面**(如实,未接):`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`、`rules-consent.ts` 与两只持久规则店零判官调用)、子代的工具名表
- * `agents[].allowTools` / `denyTools`(`spec-fields.ts` 只判形与条数)。在这两处写铸不出的服务器段、工具段为空的协议名仍被收下、永不命中。把这些面接上判官 = 另一件事
- * (本版不做,也不在本文件里加特例;`unmatchableRuleNameOf` 就是现成的那一只)。
+ * **不调它的面**:`/v1/rules` 的持久规则写口与 `cc-import` 导入口(`http/routes/rules.ts`、`rules-consent.ts` 与两只持久规则店零判官调用)—— 如实未接,
+ * 在那里写铸不出的服务器段、工具段为空的协议名仍被收下、永不命中;把它接上判官 = 另一件事(不在本文件里加特例;`unmatchableRuleNameOf` 就是现成的那一只)。
+ * 子代的工具名表 `agents[].allowTools` / `denyTools` 不是本文件的面:core 7.45.0 #1377 / #1385 起名字归引擎在开跑前一只判(三来源同判,`spec-fields.ts`
+ * 受理口只判形与条数),本仓不对它另做对照。
  * **精确名的工具段归一不在这里判**:包根没有导出工具段的铸法,不手抄 —— 精确名的工具段按字面收,本仓每张表上都不判它。
  *
  * 规则文本里「工具名那一段」怎么取也只有一种读法:{@link ruleEntryToolName}(配置表与技能清单同读)。

package/dist/namespaced-rule-name.js

@@ -1,5 +1,5 @@
 import { PROTOCOL_TABLE, isNamespacedCoveringRuleName, judgeRuleToolName, parsePermissionRule, protocolOf } from "@sema-agent/core";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { displayListEntry } from "./list-entry-display.js";
 export function ruleEntryToolName(entry) {
     return parsePermissionRule(entry).toolName;
 }
@@ -11,10 +11,6 @@ export function unmatchableRuleNameOf(name) {
     const ns = emptyToolSegmentOf(name);
     return ns === undefined ? undefined : { kind: "empty_tool_segment", ns };
 }
-function presentName(name) {
-    const clean = name.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return clean.length <= 160 ? clean : `${clean.slice(0, 160)}…(${name.length} chars)`;
-}
 export function describeUnmatchableRuleName(v, name) {
     switch (v.kind) {
         case "retired":
@@ -22,7 +18,7 @@ export function describeUnmatchableRuleName(v, name) {
         case "unmintable_segment":
             return v.guidance;
         case "unprefixed_namespace":
-            return `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentName(name)}`).join(" or ")}`;
+            return `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => displayListEntry(`${e.prefix}${name}`)).join(" or ")}`;
         case "empty_tool_segment":
             return describeEmptyToolSegment(v.ns);
         default: {

package/dist/observability/fail-open.d.ts

@@ -356,7 +356,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.session-repo.corrupt-record-skipped": {
         readonly cls: "F";
-        readonly note: "S-990(`plugins/store-backend.ts` 的 `FileSessionRepo` 座,local 车道的会话存档):一份会话存档里有记录读不出(整行毁 / 半截 JSON / 形不对,core 记成 `kind:\"record\"` 逐条披露)或存档文件 / 目录整体读不出(`kind:\"file\"`)⇒ core 的成文处置是跳过 + 披露,会话照常打开、列表少一行。最坏后果 = 模型读到的历史少了一截 / 列表静默少一份会话 —— 都是**可用性**损失,不开任何门;发起这一轮的人另有 wire 面披露(打开自己存档时的 `engine_notice` 码 `session.records_skipped`,与本 tag 无关、不动)⇒ F。**计数单位 = 一条被跳过的记录 = 一次命中**(`replay` 级是同一批记录的汇总,不计,S-616 同教训);**每命中一行探针**(`SEMA_FAILOPEN_PROBE`)带 `path` / `sessionId` / `line` / `form` / `reason` 逐条明细 —— 运维要看「哪份存档的哪一行坏了」读探针,不读本条 warn:本条是每进程每 tag 一次的告警(`detail` 是首条明细,不是全部)。修前:每命中一行 warn,一份 113 行坏记录的存档做一次列表 + 一次查看打出 342 行,存档没修好每读再发。";
+        readonly note: "S-990(`plugins/local-session-store.ts` `createLocalSessionRepo` 的 `FileSessionRepo` 座,local 车道的会话存档;`LocalSessionStore` 与会话视图口 `audit.ts` 共用,S-879):一份会话存档里有记录读不出(整行毁 / 半截 JSON / 形不对,core 记成 `kind:\"record\"` 逐条披露)或存档文件 / 目录整体读不出(`kind:\"file\"`)⇒ core 的成文处置是跳过 + 披露,会话照常打开、列表少一行。最坏后果 = 模型读到的历史少了一截 / 列表静默少一份会话 —— 都是**可用性**损失,不开任何门;发起这一轮的人另有 wire 面披露(打开自己存档时的 `engine_notice` 码 `session.records_skipped`,与本 tag 无关、不动)⇒ F。**计数单位 = 一条被跳过的记录 = 一次命中**(`replay` 级是同一批记录的汇总,不计,S-616 同教训);**每命中一行探针**(`SEMA_FAILOPEN_PROBE`)带 `path` / `sessionId` / `line` / `form` / `reason` 逐条明细 —— 运维要看「哪份存档的哪一行坏了」读探针,不读本条 warn:本条是每进程每 tag 一次的告警(`detail` 是首条明细,不是全部)。修前:每命中一行 warn,一份 113 行坏记录的存档做一次列表 + 一次查看打出 342 行,存档没修好每读再发。";
     };
     readonly "server.workflow-journal.corrupt-record-skipped": {
         readonly cls: "F";
@@ -390,6 +390,14 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。";
     };
+    readonly "server.snapshot-bucket.presence-unproven": {
+        readonly cls: "F";
+        readonly note: "S-1195(7.119.0;`plugins/snapshot-bucket-presence.ts` 的 `ensureSnapshotBucket`,boot 期核一次快照桶 `SESSION_SNAPSHOT_BUCKET`;detail = `bucket=… endpoint=<buildDisplaySafeUrl 的显示形> <HTTP 状态 | request failed: 错类>`):presigned 列举对 `MINIO_ENDPOINT` **连不上 / 403 / 5xx / 没有 NoSuchBucket 的 404**,或探针到窗尾一次都没答过(detail 写 `probe still pending when the window ended`)⇒ **证明不了桶缺**,不拒启、照常起服(只有 404 + `NoSuchBucket` 才是「缺」,那一形窗内重试、到窗拒启,不走本 tag)。三问:①错误落到哪 —— 本 tag 的计数 / 探针行 / 记录器的一次性 warn,detail 带端点显示形与状态或错类;②谁受害 —— 桶其实不存在、或凭据不能列举的部署:之后每一次快照 offload 写与 SendUserFile 私有 presigned 请求会答 404 / 403,孤儿 sweep 每分钟一条失败,运维读到的是一串失败请求而不是「桶没建」(与 7.118.x 的既有形状同形,不是新损失);③缺席倒向哪边 —— 倒向**放行起服**:没有证据既不拒启、也不伪造「桶在场」或「桶缺」,不是门 / 权限 / 凭证。最坏后果 = 缺桶的部署晚一步才暴露;不放行的代价是对象存储一次抖动 / 一次 403 就让整只服务起不来。计数非零 = 这台部署启动时没能确认快照桶,按 detail 的端点与状态去核对网络 / 凭据 / 桶。";
+    };
+    readonly "server.config-lkg.landed-path-unresolved": {
+        readonly cls: "P-DEBT";
+        readonly note: "7.120.0(`config-lkg.ts` 的 `landedPathOf`,`lkgReadDenyRows` 每次铸部署姿态座席时调;detail = `segment=<那一段的路径>`):`CONFIG_LKG_PATH` 覆写路径上有一段**目录在、却解不开**(悬空符号链接 / 链接环 / 读不了的目录:`realpath` 失败而 `lstat` 不说「不存在」)⇒ 这一段之下 LKG 真正会落在哪说不出来,读拒行只剩声明的拼写那一行(照旧在),真实落点那一行缺席。段**不存在**(`ENOENT` / `ENOTDIR`:还没建出来)是常态,不进这一臂;末段(文件本身)是悬空链接也不进(落盘的 rename 换掉的是那条目录项,文件就落在声明的拼写上)。归 P 的理由:这一行守的是 LKG 文件(含凭据),链接之后通了、LKG 写到链接目标下,模型按目标路径读得到它,直到重启重铸座席。归 DEBT 的理由:引擎没有「锚定单文件」的读拒行、座席只在 Runner 构造时铸一次,本服务说不出将来的落点;拿文件名在任意深度拒会把用户仓里同名文件一并挡掉。计数非零 = 去看 detail 点名的那一段(链接指向哪、卷挂了没有),修好后重启。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;