@sema-agent/server 7.119.0 → 7.120.0

package/dist/config-types.d.ts

@@ -1994,6 +1994,13 @@ export interface ServiceConfigFlat {
      *  `READ_DENY_BUILTIN_EXCLUDE`=逗号分隔;不在表里的行名 / 空串**启动期响亮拒**。
      *  🔴 不变量(判据帖 G5b):删内建**绝不**削弱任务自己显式声明的 deny —— 那是另一层(additions)。 */
     readDenyBuiltinExclude?: readonly string[];
+    /** core 7.46.0 #1419:部署**声明**的配置根(`SEMA_CONFIG_DIR`,绝对路径;起服的供给动作建出目录,能不能用由引擎判)—— 交引擎 `RunnerDeps.agentConfigDir`
+     *  与守卫集 `createSensitivePathPolicy` 的同名入参:内建读拒表里以 `.sema` 开头的行在这个根下同样拒,写进根下要问一次。缺席 = 没声明
+     *  ⇒ 引擎读字面 `~/.sema`(与 LKG / skill 缓存 / scheduler 店的缺省落点同一处)。读法单一属主 `sema-config-dir.ts`。 */
+    agentConfigDir?: string;
+    /** LKG 落盘路径的覆写(`CONFIG_LKG_PATH`,绝对路径;单一读法 `config-lkg.ts` `lkgPathOverrideOf`)。缺席 = LKG 落在配置根下按箱派生。
+     *  读者:LKG 的落盘 / 读回(`boot/config-center.ts`)与读拒行(部署姿态座席族 —— LKG 在哪,读拒就守哪,`lkgReadDenyRows`)。 */
+    configLkgPath?: string;
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
     /** Per-principal request cap per minute on task/run endpoints. 0 disables. */
@@ -2127,7 +2134,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "configLkgPath">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -20,6 +20,8 @@ import {} from "./posture-source.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { describeUnmatchableRuleName, ruleEntryToolName, unmatchableRuleNameOf } from "./namespaced-rule-name.js";
 import { bakeOperatorPrincipalsRefusal, bakeRunnerCredentialRefusal, halfOpenDirectDoorRefusal, leaderDurableStoreRefusal, operatorPrincipalsRequiredRefusal } from "./config-invariants.js";
+import { declaredSemaConfigDir } from "./sema-config-dir.js";
+import { lkgPathOverrideOf } from "./config-lkg.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, executionLaneOf, executionLaneRequiredRefusal, isSingleMachineDefaultLane, laneRequiredEnv } from "./execution-lane-caps.js";
 import { MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "@sema-agent/settings-schema/execution-lanes";
 import { AUTONOMY_MODES } from "./runtime-governance.js";
@@ -29,6 +31,7 @@ import { parseCenterCredentialRenewLeadMs } from "./center-credential-renewer.js
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
+import { displayListEntry } from "./list-entry-display.js";
 import { buildDisplaySafeUrl, redactSecrets } from "./trace/redact.js";
 import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
@@ -1209,17 +1212,11 @@ function parseDegradeOn(words) {
     }
     return words;
 }
-const PRESENTED_NAME_MAX = 160;
-function presentToolName(name) {
-    const clean = name.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return clean.length <= PRESENTED_NAME_MAX ? clean : `${clean.slice(0, PRESENTED_NAME_MAX)}…(${name.length} chars)`;
-}
 function ccRuleFormGuidance(name) {
     if (!name.includes("(") && !name.includes(")"))
         return undefined;
-    const shown = presentToolName(name);
-    return (`CC-form rule specifier — this list matches the WHOLE tool name verbatim, so it can only ever match a tool literally named "${shown}". ` +
-        `Drop the parentheses to gate the tool itself ("${presentToolName(name.split("(")[0] ?? name)}"); ` +
+    return (`CC-form rule specifier — this list matches the WHOLE tool name verbatim, so it can only ever match a tool literally named ${displayListEntry(name)}. ` +
+        `Drop the parentheses to gate the tool itself (${displayListEntry(name.split("(")[0] ?? name)}); ` +
         `to decide per COMMAND use \`runtime.commandPolicy\` ({command, decision} — bare argv[0] names); ` +
         `to put every shell call behind an approval use MANUAL_MODE_SHELL_GATE=always`);
 }
@@ -1264,7 +1261,7 @@ export function unmatchableToolNamesRefusal(source, names, judgment) {
         return undefined;
     const message = (`${source} has ${bad.length === 1 ? "an entry" : "entries"} that can never take effect — ${bad.length === 1 ? "it" : "each"} would never match a live tool or cannot be compiled into a rule ` +
         `(names are read exactly as written: no alias folding, no protocol prefix added): ` +
-        bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        bad.map((b) => `${displayListEntry(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
     return { message, names: bad.map((b) => b.name) };
 }
 const APPROVAL_GRANT_ENV = "APPROVAL_GRANT";
@@ -1899,6 +1896,8 @@ function parseOrchestrationDomain(ctx) {
             assertReadDenyBuiltinsResolvable(tiers, exclude);
             return { ...(tiers !== undefined ? { readDenyBuiltinTiers: tiers } : {}), ...(exclude !== undefined ? { readDenyBuiltinExclude: exclude } : {}) };
         })(),
+        ...((dir) => (dir !== undefined ? { agentConfigDir: dir } : {}))(declaredSemaConfigDir()),
+        ...((p) => (p !== undefined ? { configLkgPath: p } : {}))(lkgPathOverrideOf(process.env.CONFIG_LKG_PATH)),
         ...((h) => (h !== undefined ? { remoteExecHomeDir: h } : {}))((() => {
             const raw = process.env.REMOTE_EXEC_HOME_DIR;
             if (raw === undefined || raw === "")
@@ -2337,6 +2336,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "sessionAutoTitleSource", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled", "lspEnvAllow",
     "imageBakes", "readFace", "readFaceSource", "taskWriteFaceEscalation", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
+    "agentConfigDir", "configLkgPath",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",

package/dist/deployment-governance.d.ts

@@ -11,6 +11,8 @@ export interface DeploymentGovernanceConfigView {
     readonly commandPolicy?: ServiceConfig["commandPolicy"];
     readonly manualModeShellGate?: ServiceConfig["manualModeShellGate"];
     readonly sensitiveWritePatterns: ServiceConfig["sensitiveWritePatterns"];
+    /** core 7.46.0 #1419:部署声明的配置根 —— 守卫集的 `.sema/…` 模式在根下同样守(与 Runner 的同名座同一个值,`loadConfig` 铸)。 */
+    readonly agentConfigDir?: ServiceConfig["agentConfigDir"];
     /**
      * 本部署的**本地店根**(`LOCAL_DATA_ROOT → CONFIG_LOCAL_DIR → AGENT_DATA_DIR → ~/.ai-agent`)—— 在本口只喂
      * **誊本门**(`<localDataRoot>/sessions`)。S-133 起它**不再**当守卫集的 `dataRoot`(那是引擎记忆根,见
@@ -185,7 +187,7 @@ type WriteTargetForm = "unstamped-relative" | "absolute-or-stamped";
  *  · `writeTargetGuard`(守卫集策略自带,shell 写站问「这个绝对目标守不守」)—— 只在本层的形**覆盖守卫的入参形**时带上
  *    ({@link WRITE_TARGET_GUARD_DOMAIN}):真身层带;词法层不带(它的 env 对绝对形报错 ⇒ core 的「判不了就守」会把每一次
  *    shell 写都判成受守,正与两层射程互补的原设计相反)。这不是给某一形开的特例,是同一条「成员描述它守得住的那部分」的读法;
- *  · `projection` / `pathDenyRules` / `nameSets` —— 守卫集策略不带,本包装也不报(报了就是替它声称一张它没有的拒表)。
+ *  · `projection` / `pathRules` / `nameSets` —— 守卫集策略不带,本包装也不报(报了就是替它声称一张它没有的拒表)。
  * 修前(core 7.33.x)这里是一只 `{ check }` 字面量,7.34.0 起那只字面量把真身层的守卫剥掉了 —— 沙箱 lane 的 shell 写站
  * 因此看不见部署守卫集(`cp x .env` 在 acceptEdits 下被引擎 place 并答掉)。
  */

package/dist/deployment-governance.js

@@ -87,18 +87,20 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
     const sensitivePathLayers = config.sensitiveWritePatterns.length > 0
         ? (() => {
             const dataRootOpt = roots.engineDataRoot !== undefined ? { dataRoot: roots.engineDataRoot } : {};
+            const configRootOpt = config.agentConfigDir !== undefined ? { agentConfigDir: config.agentConfigDir } : {};
             const realTarget = createSensitivePathPolicy({
                 env: pathAdjudication.env,
                 patterns: config.sensitiveWritePatterns,
                 ...(pathAdjudication.cwd !== undefined ? { rootPath: pathAdjudication.cwd } : {}),
                 ...dataRootOpt,
+                ...configRootOpt,
             });
             const transcriptGuard = config.localDataRoot !== undefined ? [createTranscriptIntegrityPolicy({ sessionsDirs: [join(config.localDataRoot, "sessions")] })] : [];
             if (pathAdjudication.cwd !== undefined)
                 return [realTarget, ...transcriptGuard];
             return [
                 scopedToWriteTargetForm(realTarget, "absolute-or-stamped"),
-                scopedToWriteTargetForm(createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...dataRootOpt }), "unstamped-relative"),
+                scopedToWriteTargetForm(createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...dataRootOpt, ...configRootOpt }), "unstamped-relative"),
                 ...transcriptGuard,
             ];
         })()

package/dist/device-store.d.ts

@@ -161,6 +161,13 @@ export declare const DEVICE_TEXT_LIMITS: {
     readonly connEpoch: 64;
     readonly replicaId: 128;
 };
+/**
+ * 设备侧路径「是不是绝对路径」的**唯一判据**(v1 设备都是 POSIX:`platformOs` 闭集 `darwin` | `linux`;用 `posix` 而不是 `node:path`,
+ * server 跑在什么平台上与设备路径语义无关)。两处读它、不写第二份:入籍口(`http/routes/devices.ts`,`workspaceRoot` 不过 ⇒ 400)与
+ * 铸 env(`plugins/remote-env-device.ts` `effectiveDeviceCwd`,有效工作目录不过 ⇒ 响亮拒;那一道守的是入籍口收紧之前落库的存量行与
+ * 会话 / 委派链来的 cwd)。
+ */
+export declare function isDeviceAbsolutePath(p: string): boolean;
 export declare function assertDeviceOwnerShape(owner: DeviceOwner): void;
 export declare function assertDeviceIdShape(deviceId: string): void;
 export declare function assertRootSessionIdShape(rootSessionId: string): void;

package/dist/device-store.js

@@ -1,4 +1,5 @@
 import { createHash, randomBytes, randomInt } from "node:crypto";
+import { posix } from "node:path";
 export const DEVICE_ERROR_CODES = {
     NOT_BOUND: "device.not_bound",
     OFFLINE: "device.offline",
@@ -86,6 +87,9 @@ export const DEVICE_TEXT_LIMITS = {
     connEpoch: 64,
     replicaId: 128,
 };
+export function isDeviceAbsolutePath(p) {
+    return posix.isAbsolute(p);
+}
 export function assertDeviceOwnerShape(owner) {
     assertIdentityKey("owner.tenant", owner.tenant, DEVICE_KEY_MAX_BYTES);
     assertIdentityKey("owner.subject", owner.subject, DEVICE_KEY_MAX_BYTES);

package/dist/device-ws-hub.js

@@ -425,7 +425,20 @@ export function createDeviceWsHub(options) {
             clearTimeout(conn.handshakeTimer);
         conn.handshakeTimer = null;
         releasePreAuthSlot(conn);
-        sendServerFrame(conn, { t: "helloAck", ok: true, heartbeatIntervalMs, maxInflight: maxInflightPerDevice, gen: conn.genStr, pendingInstructions: pendingIds, chunkWatermarks });
+        const helloAck = {
+            t: "helloAck",
+            ok: true,
+            heartbeatIntervalMs,
+            maxInflight: maxInflightPerDevice,
+            gen: conn.genStr,
+            pendingInstructions: pendingIds,
+            chunkWatermarks,
+            reconnectGraceMs,
+            cancelGraceMs,
+            chunkGapTimeoutMs,
+            executionCeilingGraceMs: execGraceMs,
+        };
+        sendServerFrame(conn, helloAck);
         logger?.info?.("device_connected", { deviceId: row.deviceId, generation: acquired.generation, epoch: frame.epoch, replicaId });
         metrics?.inc("device_connected_total");
     }
@@ -469,12 +482,7 @@ export function createDeviceWsHub(options) {
         }
     }
     function failOnChunkGap(p) {
-        const missing = p.nextStreamSeq;
-        settle(p, {
-            ok: false,
-            errorCode: "outcome_unknown",
-            message: `the output stream had a gap (missing chunk streamSeq ${missing}) so the result cannot be reported faithfully — ${OUTCOME_UNKNOWN_SENTENCE}`,
-        });
+        settle(p, outcomeUnknown(`the output stream had a gap (missing chunk streamSeq ${p.nextStreamSeq}) so the result cannot be reported faithfully`));
     }
     function chunkPayloadBytes(frame) {
         return frame.dataB64 === undefined ? 0 : Math.floor((frame.dataB64.length * 3) / 4);
@@ -549,11 +557,11 @@ export function createDeviceWsHub(options) {
         if (complaint !== null) {
             metrics?.inc("device_stream_terminator_missing_total");
             sendServerFrame(conn, { t: "resultAck", gen: conn.genStr, instructionId: p.instructionId });
-            settle(p, { ok: false, errorCode: "outcome_unknown", message: `${complaint} — ${OUTCOME_UNKNOWN_SENTENCE}` });
+            settle(p, outcomeUnknown(complaint));
             return;
         }
         sendServerFrame(conn, { t: "resultAck", gen: conn.genStr, instructionId: p.instructionId });
-        settle(p, outcome);
+        settle(p, !outcome.ok && outcome.errorCode === "outcome_unknown" ? outcomeUnknown(outcome.message) : outcome);
     }
     function onDeviceText(conn, text) {
         conn.lastFrameAt = Date.now();

package/dist/device-ws-protocol.d.ts

@@ -235,6 +235,21 @@ export type DeviceHelloAckFrame = {
     gen: string;
     pendingInstructions: string[];
     chunkWatermarks: Record<string, number>;
+    /**
+     * 四个**宽限位**(additive,协议 §5.6 不升版):本连接所在 server 副本**此刻生效**的四只预算,值与汇聚端
+     * 计时器读的是同一只常量 —— 不是文档里的「默认值」,是这台部署的实际值。executor 据此定自己的重连
+     * 退避上界 / 取消应答时限 / 补片节奏 / 执行兜底预算,不必抄文档里的数。
+     *  · `reconnectGraceMs`:断连后在途不判丢的窗(R4;运维旋钮 `DEVICE_RECONNECT_GRACE_MS`);
+     *  · `cancelGraceMs`:`cancel` 送达后等终局回执的窗(R11);
+     *  · `chunkGapTimeoutMs`:等缺失 `streamSeq` 的上限(R8);
+     *  · `executionCeilingGraceMs`:`timeoutMs` 之后云侧兜底再等的宽限(R12:`timeoutMs` + 本值)。
+     * **可选位**:7.120+ 服务端恒发;缺席 = 老服务端,按协议 §1.5 回落文档缺省(不得当 0)。型上标可选,是为了让拿这只型读老服务端帧的
+     * 消费方被编译器逼着处理缺席;本服务自己的铸点按 `Required<DeviceHelloAckFrame>` 构造(`device-ws-hub.ts`),漏一位编译红。
+     */
+    reconnectGraceMs?: number;
+    cancelGraceMs?: number;
+    chunkGapTimeoutMs?: number;
+    executionCeilingGraceMs?: number;
 };
 export type DeviceHelloRejectFrame = {
     t: "helloReject";

package/dist/http/resume-legs.js

@@ -69,6 +69,10 @@ const WORKER_SWAP_REDEEMABLE = {
     write_face_damaged: false,
     skill_grants_damaged: false,
     constraint_chain_missing: false,
+    hands_coordinates_damaged: false,
+    installation_record_absent: true,
+    installation_record_misaligned: false,
+    installation_record_invalid: false,
 };
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;

package/dist/http/routes/capabilities.js

@@ -161,6 +161,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
                 permissionModes: [...PERMISSION_MODES],
+                sessionReadRedaction: true,
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 retention: retentionAdvertisement(deps.config),

package/dist/http/routes/devices.js

@@ -2,7 +2,7 @@ import { sendError, sendJson } from "../send.js";
 import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, sameDeviceOwner, } from "../../device-store.js";
+import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, isDeviceAbsolutePath, sameDeviceOwner, } from "../../device-store.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../device-placement.js";
 import { echoKeyName } from "../../request-key-closure.js";
@@ -109,8 +109,8 @@ function parseEnrollBody(res, body) {
             return null;
         }
     }
-    if (workspaceRoot.length === 0) {
-        sendError(res, 400, "request.field_invalid", "workspaceRoot is required and must be non-empty (it is the device-side root every instruction resolves against)");
+    if (!isDeviceAbsolutePath(workspaceRoot)) {
+        sendError(res, 400, "request.field_invalid", "workspaceRoot must be an absolute POSIX path (it is the device-side root every instruction resolves against)");
         return null;
     }
     return { token: token, pubkey: pubkey, platformOs: os, platformArch: platformArch, displayName: displayName, workspaceRoot: workspaceRoot };

package/dist/http/routes/rules.js

@@ -4,10 +4,10 @@ import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sen
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createLogger } from "../../observability/logger.js";
-import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
+import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
+import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
 import { PERSISTED_RULE_MATCHES, isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
@@ -26,7 +26,7 @@ const CcImportPrepareBodySchema = z
         .object({
         layer: z.enum(["userSettings", "projectSettings", "localSettings"]),
         path: z.string().min(1).max(1024),
-        root: z.string().min(1).max(1024),
+        root: z.string().max(1024),
         content: z.string().max(MAX_LAYER_CONTENT_CHARS),
     })
         .strict())
@@ -34,6 +34,9 @@ const CcImportPrepareBodySchema = z
         .max(MAX_LAYERS),
 })
     .strict();
+function ccImportRootRefused(layer) {
+    return !isValidDurableScope({ kind: "project", root: layer.root });
+}
 const TICKET_CONTROL_CHARS_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
 const TicketStringSchema = z.string().min(1).max(190).refine((t) => !TICKET_CONTROL_CHARS_RE.test(t));
 const CcImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
@@ -170,6 +173,10 @@ export async function handleRules(req, res, match, ctx) {
             sendError(res, 400, "request.body_shape", "body must be {layers:[{layer,path,root,content}]}");
             return;
         }
+        if (parsed.data.layers.some(ccImportRootRefused)) {
+            sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
+            return;
+        }
         const prepared = await lane.prepareImport(principal, parsed.data.layers);
         if (!prepared.ok) {
             sendError(res, 413, "request.payload_too_large", "too many allow entries across the submitted settings layers");
@@ -231,7 +238,7 @@ async function handleRuleList(res, search, caller, lane, config) {
     const scopeRaw = q.get("scope");
     const scopeFilter = scopeRaw === null ? undefined : parseRuleScope(scopeRaw);
     if (scopeRaw !== null && scopeFilter === undefined) {
-        sendError(res, 400, "request.query_invalid", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.query_invalid", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const cursorRaw = q.get("cursor");
@@ -305,7 +312,7 @@ async function handleRuleWrite(res, rawBody, caller, lane, config) {
     }
     const scope = parseRuleScope(parsed.data.scope);
     if (scope === undefined) {
-        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const target = resolveTargetPrincipal(parsed.data.principal, caller, config);
@@ -354,7 +361,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, config) {
     }
     const scope = parseRuleScope(parsed.data.scope);
     if (scope === undefined) {
-        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const target = resolveTargetPrincipal(parsed.data.principal, caller, config);

package/dist/list-entry-display.d.ts

@@ -0,0 +1,14 @@
+/**
+ * **机读位的值** —— 通告 `detail` 里的规则文本(`permission.allowed_tool_not_granted` 的 `detail.entries[].entry`、`permission.rule_row_dropped` 的
+ * `detail.rows[].rule`)在会话流行与运维日志行上一律是这一只:条目的脱敏原值。显示形不进机读位(壳若再加引号就是两层)。
+ */
+export declare function redactListEntry(entry: string): string;
+/**
+ * **人读句里条目的唯一写法** —— 本仓把规则条目 / 工具名原串写进任何一句给人读的话(拒句、起服拒启行)一律调这一只:引擎的条目写者
+ * `renderListEntry`(core 7.46.0 #1428 包根导出:JSON 串形带引号,看不见 / 印成空白的字符写成 `\uXXXX`,超长截断)—— 与引擎自己的通告句同一个渲染;
+ * 判定拿原串。
+ * 🔴 凭据先认、再渲染:渲染把看不见的字符写成 ASCII 转义,之后的脱敏器就认不出夹着零宽字符的凭据 ⇒ 原串上认出凭据时渲染它的脱敏值;
+ * 没有凭据的条目渲染**原串**(格式字符留给渲染器写成 `\uXXXX` —— 人要看得见它,不能先被脱敏器剥掉)。
+ */
+export declare function displayListEntry(entry: string): string;
+//# sourceMappingURL=list-entry-display.d.ts.map

package/dist/list-entry-display.js

@@ -0,0 +1,14 @@
+import { renderListEntry } from "@sema-agent/core";
+import { redactSecretsWithArms } from "./trace/redact.js";
+function scanListEntry(entry) {
+    const scan = redactSecretsWithArms(entry);
+    return { redacted: scan.text, credential: scan.arms.size > 0 };
+}
+export function redactListEntry(entry) {
+    return scanListEntry(entry).redacted;
+}
+export function displayListEntry(entry) {
+    const scan = scanListEntry(entry);
+    return renderListEntry(scan.credential ? scan.redacted : entry);
+}
+//# sourceMappingURL=list-entry-display.js.map

package/dist/namespaced-rule-name.js

@@ -1,5 +1,5 @@
 import { PROTOCOL_TABLE, isNamespacedCoveringRuleName, judgeRuleToolName, parsePermissionRule, protocolOf } from "@sema-agent/core";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { displayListEntry } from "./list-entry-display.js";
 export function ruleEntryToolName(entry) {
     return parsePermissionRule(entry).toolName;
 }
@@ -11,10 +11,6 @@ export function unmatchableRuleNameOf(name) {
     const ns = emptyToolSegmentOf(name);
     return ns === undefined ? undefined : { kind: "empty_tool_segment", ns };
 }
-function presentName(name) {
-    const clean = name.replace(CONTROL_AND_BIDI_STRIP_RE, "");
-    return clean.length <= 160 ? clean : `${clean.slice(0, 160)}…(${name.length} chars)`;
-}
 export function describeUnmatchableRuleName(v, name) {
     switch (v.kind) {
         case "retired":
@@ -22,7 +18,7 @@ export function describeUnmatchableRuleName(v, name) {
         case "unmintable_segment":
             return v.guidance;
         case "unprefixed_namespace":
-            return `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => `${e.prefix}${presentName(name)}`).join(" or ")}`;
+            return `pre-prefix short form — the live name carries a protocol prefix: ${PROTOCOL_TABLE.map((e) => displayListEntry(`${e.prefix}${name}`)).join(" or ")}`;
         case "empty_tool_segment":
             return describeEmptyToolSegment(v.ns);
         default: {

package/dist/observability/fail-open.d.ts

@@ -394,6 +394,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-1195(7.119.0;`plugins/snapshot-bucket-presence.ts` 的 `ensureSnapshotBucket`,boot 期核一次快照桶 `SESSION_SNAPSHOT_BUCKET`;detail = `bucket=… endpoint=<buildDisplaySafeUrl 的显示形> <HTTP 状态 | request failed: 错类>`):presigned 列举对 `MINIO_ENDPOINT` **连不上 / 403 / 5xx / 没有 NoSuchBucket 的 404**,或探针到窗尾一次都没答过(detail 写 `probe still pending when the window ended`)⇒ **证明不了桶缺**,不拒启、照常起服(只有 404 + `NoSuchBucket` 才是「缺」,那一形窗内重试、到窗拒启,不走本 tag)。三问:①错误落到哪 —— 本 tag 的计数 / 探针行 / 记录器的一次性 warn,detail 带端点显示形与状态或错类;②谁受害 —— 桶其实不存在、或凭据不能列举的部署:之后每一次快照 offload 写与 SendUserFile 私有 presigned 请求会答 404 / 403,孤儿 sweep 每分钟一条失败,运维读到的是一串失败请求而不是「桶没建」(与 7.118.x 的既有形状同形,不是新损失);③缺席倒向哪边 —— 倒向**放行起服**:没有证据既不拒启、也不伪造「桶在场」或「桶缺」,不是门 / 权限 / 凭证。最坏后果 = 缺桶的部署晚一步才暴露;不放行的代价是对象存储一次抖动 / 一次 403 就让整只服务起不来。计数非零 = 这台部署启动时没能确认快照桶,按 detail 的端点与状态去核对网络 / 凭据 / 桶。";
     };
+    readonly "server.config-lkg.landed-path-unresolved": {
+        readonly cls: "P-DEBT";
+        readonly note: "7.120.0(`config-lkg.ts` 的 `landedPathOf`,`lkgReadDenyRows` 每次铸部署姿态座席时调;detail = `segment=<那一段的路径>`):`CONFIG_LKG_PATH` 覆写路径上有一段**目录在、却解不开**(悬空符号链接 / 链接环 / 读不了的目录:`realpath` 失败而 `lstat` 不说「不存在」)⇒ 这一段之下 LKG 真正会落在哪说不出来,读拒行只剩声明的拼写那一行(照旧在),真实落点那一行缺席。段**不存在**(`ENOENT` / `ENOTDIR`:还没建出来)是常态,不进这一臂;末段(文件本身)是悬空链接也不进(落盘的 rename 换掉的是那条目录项,文件就落在声明的拼写上)。归 P 的理由:这一行守的是 LKG 文件(含凭据),链接之后通了、LKG 写到链接目标下,模型按目标路径读得到它,直到重启重铸座席。归 DEBT 的理由:引擎没有「锚定单文件」的读拒行、座席只在 Runner 构造时铸一次,本服务说不出将来的落点;拿文件名在任意深度拒会把用户仓里同名文件一并挡掉。计数非零 = 去看 detail 点名的那一段(链接指向哪、卷挂了没有),修好后重启。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -367,6 +367,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-1195(7.119.0;`plugins/snapshot-bucket-presence.ts` 的 `ensureSnapshotBucket`,boot 期核一次快照桶 `SESSION_SNAPSHOT_BUCKET`;detail = `bucket=… endpoint=<buildDisplaySafeUrl 的显示形> <HTTP 状态 | request failed: 错类>`):presigned 列举对 `MINIO_ENDPOINT` **连不上 / 403 / 5xx / 没有 NoSuchBucket 的 404**,或探针到窗尾一次都没答过(detail 写 `probe still pending when the window ended`)⇒ **证明不了桶缺**,不拒启、照常起服(只有 404 + `NoSuchBucket` 才是「缺」,那一形窗内重试、到窗拒启,不走本 tag)。三问:①错误落到哪 —— 本 tag 的计数 / 探针行 / 记录器的一次性 warn,detail 带端点显示形与状态或错类;②谁受害 —— 桶其实不存在、或凭据不能列举的部署:之后每一次快照 offload 写与 SendUserFile 私有 presigned 请求会答 404 / 403,孤儿 sweep 每分钟一条失败,运维读到的是一串失败请求而不是「桶没建」(与 7.118.x 的既有形状同形,不是新损失);③缺席倒向哪边 —— 倒向**放行起服**:没有证据既不拒启、也不伪造「桶在场」或「桶缺」,不是门 / 权限 / 凭证。最坏后果 = 缺桶的部署晚一步才暴露;不放行的代价是对象存储一次抖动 / 一次 403 就让整只服务起不来。计数非零 = 这台部署启动时没能确认快照桶,按 detail 的端点与状态去核对网络 / 凭据 / 桶。",
     },
+    "server.config-lkg.landed-path-unresolved": {
+        cls: "P-DEBT",
+        note: "7.120.0(`config-lkg.ts` 的 `landedPathOf`,`lkgReadDenyRows` 每次铸部署姿态座席时调;detail = `segment=<那一段的路径>`):`CONFIG_LKG_PATH` 覆写路径上有一段**目录在、却解不开**(悬空符号链接 / 链接环 / 读不了的目录:`realpath` 失败而 `lstat` 不说「不存在」)⇒ 这一段之下 LKG 真正会落在哪说不出来,读拒行只剩声明的拼写那一行(照旧在),真实落点那一行缺席。段**不存在**(`ENOENT` / `ENOTDIR`:还没建出来)是常态,不进这一臂;末段(文件本身)是悬空链接也不进(落盘的 rename 换掉的是那条目录项,文件就落在声明的拼写上)。归 P 的理由:这一行守的是 LKG 文件(含凭据),链接之后通了、LKG 写到链接目标下,模型按目标路径读得到它,直到重启重铸座席。归 DEBT 的理由:引擎没有「锚定单文件」的读拒行、座席只在 Runner 构造时铸一次,本服务说不出将来的落点;拿文件名在任意深度拒会把用户仓里同名文件一并挡掉。计数非零 = 去看 detail 点名的那一段(链接指向哪、卷挂了没有),修好后重启。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/operator-ask.d.ts

@@ -68,7 +68,7 @@ export declare function operatorAsk(rule: string, message: string): OperatorAskR
 export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
 /**
  * 🔴 **S-958 —— 治理层的叶策略包装**:`leaf` 产的每一只 ask 盖部署出身(经 {@link withDeploymentAuthorship}),allow / deny 原物交回;
- * 成员(`projection` / `pathDenyRules` / `writeTargetGuard` / `nameSets`)经 core `wrapToolPolicy` 随行(契约「包装至少拒内层所拒」:
+ * 成员(`projection` / `pathRules` / `writeTargetGuard` / `nameSets`)经 core `wrapToolPolicy` 随行(契约「包装至少拒内层所拒」:
  * 只加一位、从不放宽)。同步叶保持同步返回;叶抛照抛(fail-closed 的属主仍是叶)。
  *
  * **只收叶**:治理层(`runtime-governance.ts` `applyRuntimeGovernance`)对每一片叶各盖一次,再交 core `combinePolicies` 折**一次**

package/dist/plugins/one-time-migrations.d.ts

@@ -1,5 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
+import { type UndurableScopeRuleRow, type UnreadableRuleBucket } from "./permission-rule-store-sql.js";
 /** 迁移读数(启动日志一行写全;测试按它断言,不靠日志文本)。 */
 export interface OneTimeMigrationReport {
     /** M1:退役快照索引表 —— `dropped` = 本次真 drop 了,`absent` = 早已不在(第二跑/全新库)。 */
@@ -33,6 +34,13 @@ export interface OneTimeMigrationReport {
     readonly workflowParkIndexKey: "reshaped" | "current" | "file-ledger";
     /** M9:改形时原样搬进新表的指针行数(`current` / `file-ledger` 时恒 0)。非零 = 这次迁移真重建了一张表,运维该看见一次。 */
     readonly workflowParkIndexRowsCarried: number;
+    /** M11:本次从持久规则桶里删掉的、scope 不被引擎 durable 谓词收的行(一行一条,启动日志逐行 warn;local 车道恒空,见头注 M11 段)。 */
+    readonly undurableScopeRuleRows: readonly UndurableScopeRuleRow[];
+    /** M11:连续争不过在线写者、留到下一次起服的桶数(那期间坏行照旧由引擎读侧丢并告知;非零 ⇒ warn)。 */
+    readonly undurableScopeRuleBucketsDeferred: number;
+    /** M11:读腿整桶拒的桶(唯一判官判不过:形 / 指纹 / behavior 闭集 / 墓碑规范文本 / 单一验证器)—— 一个字节没动,一桶一条拒因
+     *  (不带行内容),启动日志逐桶 warn;local 车道恒空(见头注 M11 段)。 */
+    readonly undurableScopeRuleBucketsUnreadable: readonly UnreadableRuleBucket[];
 }
 /**
  * S-590 —— 一条一次性迁移的窗(登记表的一行;纯数据)。字段注写着每个值的取证方式,改一行之前照着重核。

package/dist/plugins/one-time-migrations.js

@@ -5,6 +5,7 @@ import { ensureIndexes } from "./ensure-index.js";
 import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextExpr, readNonNullJsonValueColumn } from "./sql-json-column.js";
 import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR } from "./store-contracts.js";
+import { PERMISSION_RULE_TABLE, purgeUndurableScopeRows } from "./permission-rule-store-sql.js";
 export const ONE_TIME_MIGRATIONS = [
     {
         id: "M1",
@@ -133,6 +134,21 @@ export const ONE_TIME_MIGRATIONS = [
             "已存的规则对写下它们的 principal 的 run 照旧生效;出路 = 删会话(`DELETE /v1/sessions/:id`,规则随之删)",
         reportKeys: [],
     },
+    {
+        id: "M11",
+        introducedIn: "7.120.0",
+        releasedOn: "2026-10-08",
+        removableAfter: "2026-11-07",
+        removal: "删 migrateOn 的 M11 步(`permission_rule` 在场探针 + `purgeUndurableScopeRows` 调用)与 `permission-rule-store-sql.ts` 的 `purgeUndurableScopeRows` / " +
+            "`purgeAllBuckets` / `purgeOneBucket` / `contentFreeRefusal` / `PurgeAccumulator` / `UndurableScopeRuleRow` / `UnreadableRuleBucket` / `UndurableScopePurge` / " +
+            "`UndurableScopePurgeDb` / `UNDURABLE_PURGE_PAGE` / `UNDURABLE_PURGE_OCC_ATTEMPTS`、本文件的 `removedRuleRowNote`,以及 `BucketRefusedError` 的 `verdict` 位(若届时再无别的读者;" +
+            "判官 `decodeBucketRow` 与写法 `writeBucket` 是读腿 / 写臂本身,留);报告、日志行(含逐行的 `permission_rule_row_removed` 与逐桶的 " +
+            "`permission_rule_bucket_unreadable`)与 `NO_SQL_MIGRATIONS` 的 `undurableScopeRuleRows` / `undurableScopeRuleBucketsDeferred` / `undurableScopeRuleBucketsUnreadable`",
+        afterRemoval: "引擎读侧的既有响亮臂:scope root 不是完整绝对路径的存量行(跳过了带本条的版本直接升的库,或窗关之后别的写者写进来的)在有效视图里被丢、" +
+            "每次 run 一条 `permission.rule_row_dropped`(点名规则与 root)—— 那一行不参与任何检查,但撤销口删不动它(引擎的写臂对这种 scope 同样拒);" +
+            "出路 = 运维在库里把那只桶的那一行删掉(整桶 OCC 回写,指纹按 `buildRuleBucketChecksum` 重算)",
+        reportKeys: ["undurableScopeRuleRows", "undurableScopeRuleBucketsDeferred", "undurableScopeRuleBucketsUnreadable"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -149,6 +165,9 @@ export const NO_SQL_MIGRATIONS = {
     allowRuleShadowRowsUnreadable: 0,
     workflowParkIndexKey: "file-ledger",
     workflowParkIndexRowsCarried: 0,
+    undurableScopeRuleRows: [],
+    undurableScopeRuleBucketsDeferred: 0,
+    undurableScopeRuleBucketsUnreadable: [],
 };
 const RETIRED_SNAPSHOT_TABLE = "snapshot_manifest";
 const RETIRED_STEER_SEAT_COLUMN = "pending_steer";
@@ -293,8 +312,16 @@ async function migrateOn(db, dialect) {
     let retiredSnapshotTable = "absent";
     let retiredSnapshotRows = 0;
     let retiredSteerSeatColumn = "absent";
+    let undurableScopeRuleRows = [];
+    let undurableScopeRuleBucketsDeferred = 0;
+    let undurableScopeRuleBucketsUnreadable = [];
     const destroyed = [];
     try {
+        if (await tableExists(db, dialect, PERMISSION_RULE_TABLE)) {
+            ({ removed: undurableScopeRuleRows, bucketsDeferred: undurableScopeRuleBucketsDeferred, bucketsUnreadable: undurableScopeRuleBucketsUnreadable } = await purgeUndurableScopeRows(db, dialect));
+            for (const r of undurableScopeRuleRows)
+                destroyed.push(`removed permission_rule ${r.kind} (bucket ${r.ownerKey}, ${r.behavior} ${r.tool}, scope root ${JSON.stringify(r.scopeRoot)})`);
+        }
         const counted = !snapshotTablePresent
             ? undefined
             : await db.rows(`SELECT COUNT(*) AS n FROM ${RETIRED_SNAPSHOT_TABLE}`).then((rows) => Number(rows[0]?.n ?? 0), async (e) => {
@@ -323,7 +350,7 @@ async function migrateOn(db, dialect) {
     return {
         retiredSnapshotTable, retiredSnapshotRows, retiredSteerSeatColumn, retiredSteerSeatStaleRows, askOriginRowsMigrated, auditDetailJsonNullRows,
         sessionIncarnationColumn, sessionIncarnationsBackfilled, holderDeathCodeRowsBackfilled, allowRuleShadowRowsMigrated, allowRuleShadowRowsUnreadable,
-        workflowParkIndexKey, workflowParkIndexRowsCarried,
+        workflowParkIndexKey, workflowParkIndexRowsCarried, undurableScopeRuleRows, undurableScopeRuleBucketsDeferred, undurableScopeRuleBucketsUnreadable,
     };
 }
 const WORKFLOW_PARK_INDEX_TABLE = "workflow_agent_session";
@@ -525,7 +552,8 @@ export function migrateRetiredAskOrigin(type, data) {
 export function logOneTimeMigrations(log, backend, report) {
     const changed = report.retiredSnapshotTable === "dropped" || report.retiredSteerSeatColumn === "dropped" || report.askOriginRowsMigrated > 0 || report.auditDetailJsonNullRows > 0 ||
         report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0 || report.holderDeathCodeRowsBackfilled > 0 || report.allowRuleShadowRowsMigrated > 0 || report.allowRuleShadowRowsUnreadable > 0 ||
-        report.workflowParkIndexKey === "reshaped";
+        report.workflowParkIndexKey === "reshaped" || report.undurableScopeRuleRows.length > 0 || report.undurableScopeRuleBucketsDeferred > 0 ||
+        report.undurableScopeRuleBucketsUnreadable.length > 0;
     (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
         retiredSnapshotTable: report.retiredSnapshotTable,
@@ -541,6 +569,9 @@ export function logOneTimeMigrations(log, backend, report) {
         allowRuleShadowRowsUnreadable: report.allowRuleShadowRowsUnreadable,
         workflowParkIndexKey: report.workflowParkIndexKey,
         workflowParkIndexRowsCarried: report.workflowParkIndexRowsCarried,
+        undurableScopeRuleRowsRemoved: report.undurableScopeRuleRows.length,
+        undurableScopeRuleBucketsDeferred: report.undurableScopeRuleBucketsDeferred,
+        undurableScopeRuleBucketsUnreadable: report.undurableScopeRuleBucketsUnreadable.length,
         removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
         note: "one-time persisted-data migrations (M1: retired whole-tree snapshot index table dropped; M2: retired single-seat " +
             "steering column dropped; M3: retired ask-origin spelling rewritten in place; M4: audit details written as the JSON " +
@@ -551,10 +582,48 @@ export function logOneTimeMigrations(log, backend, report) {
             "under an earlier reading from resuming under the current one; M8: parked rows' allow-layer disclosure written by an earlier engine " +
             "under its old key shadowedRule rewritten to allowRuleShadowed; M9: the workflow park pointer index rebuilt with the key (session, run), " +
             "its rows carried over; M10 writes nothing at boot — on the local backend, while its window is open, the first task submitted with a principal " +
-            "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim). Each step " +
+            "on a session written by an earlier version (which recorded no owner) claims that session for the principal, one session_owner_claimed line per claim; " +
+            "M11: persisted permission rules whose project scope root is not a complete absolute path — accepted by earlier versions, dropped on every read " +
+            "by the current engine and not removable through DELETE /v1/rules — removed, one permission_rule_row_removed line per row; a bucket the read path " +
+            "refuses in whole is left untouched, one permission_rule_bucket_unreadable line per bucket). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
     });
+    for (const row of report.undurableScopeRuleRows) {
+        log.warn("permission_rule_row_removed", {
+            backend,
+            ownerKey: row.ownerKey,
+            kind: row.kind,
+            behavior: row.behavior,
+            tool: row.tool,
+            scopeRoot: row.scopeRoot,
+            note: removedRuleRowNote(row.kind),
+        });
+    }
+    for (const bucket of report.undurableScopeRuleBucketsUnreadable) {
+        log.warn("permission_rule_bucket_unreadable", {
+            backend,
+            ownerKey: bucket.ownerKey,
+            why: bucket.why,
+            note: "a persisted permission-rule bucket that the read path refuses in whole was left untouched by the one-time removal of rows whose project scope root " +
+                "is not a complete absolute path (removing rows from a bucket the read path refuses would turn that refusal into a readable bucket): every read of it " +
+                "keeps being refused, as before this release, until someone repairs or deletes that row by hand",
+        });
+    }
+}
+function removedRuleRowNote(kind) {
+    switch (kind) {
+        case "rule":
+            return "a persisted permission rule whose project scope root is not a complete absolute path was removed by a one-time migration: the current engine drops such a row on every read (it protected nothing) and refuses any write naming that scope, so it could not be revoked through DELETE /v1/rules; re-add it with the project's full path if it is still wanted";
+        case "revoked-rule":
+            return "a persisted permission rule whose project scope root is not a complete absolute path, and which had already been revoked (every approval behind it is removed by a tombstone in the same bucket), was removed by a one-time migration: it granted nothing before and grants nothing now — the revocation stands, no action needed";
+        case "tombstone":
+            return "a revocation record (tombstone) whose project scope root is not a complete absolute path was removed by a one-time migration: it can only cover rules with that same scope, which were removed with it or were never there, so nothing it revoked comes back — no action needed";
+        default: {
+            const unknown = kind;
+            throw new Error(`M11: no log sentence for removed-row kind ${JSON.stringify(unknown)}`);
+        }
+    }
 }
 //# sourceMappingURL=one-time-migrations.js.map