@sema-agent/server 7.119.0 → 7.121.0

package/dist/http/routes/admin-drain.d.ts

@@ -1,40 +1,21 @@
 /**
- * [ref](C17,[ref]/[ref] 认领,黑板 [ref] 原文即本口的契约):`POST /v1/admin/drain {reason}` ——
- * 编排壳在发停机信号(SIGTERM)**之前**先调本口显式声明停机因由;server 记入 `drainState.reason`,
- * draining 期间由 `/health`(`drainReason`)与 503 draining 体(`reason`)透出。未声明 = 两面键缺席
- * (additive,不编数)——升级/缩容/驱逐在消费端因此可判别,而不是一律读成「实例没了」。
+ * `POST /v1/admin/drain` —— 排空口(编排器长远稿片 2 件 2;契约体 = settings-schema 8.1.0 `DrainRequest`,回执 = `DrainReceipt`)。
  *
- * 族属 = adoption / retention-ops 的 operator lane(同一条 `explicitOperatorOk` 门、billable=false、
- * **刻意不吃 drain 503**——它正是 drain 开始前要调的口,吃了就自锁)。门序照 retention-ops 逐字:
- * 身份 → 授权 → 验型。刻意**不进** `isCredentialGatedRewrite` 名单:那族的判据是「授权唯一输入是
- * service token ∧ 爆炸半径跨租户持久改写」,本口只写一个进程内观测字段(重启即逝、零持久面),
- * operator 门(空表恒拒,fail-closed)已是正确强度。
- *
- * reason 校验:非空 trim 后 string ≤ {@link MAX_DRAIN_REASON_CHARS} —— 它会进 /health 与 503 体
- * (消费面是监控/壳),超长或怪型响亮拒([ref] 坏值立律),拒绝不留痕(不写半个值)。
- *
- * 🔴 **写侧特权、读侧公开 —— 这条不对称是刻意的,但必须被写的人知道**([ref],2026-08-19 合并重扫
- * partial,存活断言):本口是 operator-only + fail-closed(空 `OPERATOR_PRINCIPALS` 恒拒),而透出面里
- * `/health` 在 `server.ts` 的鉴权门**之前**、无鉴权、缺省全网卡监听,USAGE 三处白纸黑字把它定为「无需
- * 鉴权」—— 任何能连到这个端口的人都读得到这段**运维手打的自由文本**。
- * **裁定:行为不改。** 判据三条:① `/health` 免鉴权是既成契约,而它正是这条信息的设计消费者(k8s
- * probe / LB / 编排器带不了 token,`drainReason` 放这儿的全部理由就是给它们看);② 值的内容完全由
- * operator 自选,且窗口只在 draining 期;③ 同一免鉴权体上早已有 `dataRoot` 绝对路径 / `pid` / `port` /
- * `instanceId` / `configHash` / `storeProbe`,单独收紧本键不改变那面的暴露量级。
- * (那条另立的兄弟件 —— `storeProbe.error` 把**原始异常 message 未截断**塞出去、DSN 片段可随之外泄 ——
- * 已在 [ref] 修掉:免鉴权面上它改成闭集词,原文只走日志轴。两件的判据不同故不合并:本键的值由 operator
- * 自选且窗口只在 draining 期,`storeProbe.error` 的值则来自不受控的驱动异常。)
- * ⇒ 真正的缺口是**告诫缺席**:此前路由头注、400 文案、CHANGELOG、wire 契约四处都只说「透出」,没有一处
- * 说「其中一面免鉴权」,操作员要拼出「我写的字是公开的」得自己合并两处文档去推理。本批把它写进**写口
- * 现场**(400 文案 + 本注 + USAGE 端点条目),因为那是操作员唯一会读到的地方。
- * 词表化(把自由文本换成受限枚举)= 行为变更,**不在本批**:它会让「rolling upgrade to 7.36.0」这类真正
- * 有用的因由说不出来,取舍要属主拍。
+ * 一只入口的 HTTP 车道(Docker 车道 / 中心直调 / 人手形):体经契约读器 `readDrainRequest`(一处判形),身份四元经
+ * `fleet/drain-entry.ts` 的 `drainIdentityMismatches`(一处判身份;本引擎的 scope = `config.fleetScope`,env `FLEET_SCOPE` 的唯一读数),
+ * 进入排空经 `drainState.enter`(收尾链装的唯一入口)。
+ *  · 门序 = operator 面的既有口径(`routes/retention-ops.ts` 逐字):身份 → 授权 → 验型;billable=false,**刻意不吃排空 503**
+ *    (排空中的重放必须能拿到 `already_draining` 回执,吃了就自锁)。
+ *  · 体坏 ⇒ 400 `request.field_invalid`(零状态变化);身份不符 ⇒ 409 `conflict.fleet_identity`(零状态变化;拒句点名不符的字段,不回显值);
+ *    没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`。
+ *  · 首次 ⇒ 200 回执 `state:"draining"`;同一 `actionId`(或别的动作)再来 ⇒ 200 `already_draining`,回显第一次的 `since` / `deadlineAt`,不重置。
+ *  · 人手形:`actionId` 自取(推荐 `manual:<uuid>`),身份照样四元比对 —— 非 fleet 成员不带 `expectedGeneration`(缺席对缺席);
+ *    `instanceId` 在场才比(从本机 `/health` 读);不带 `scope` = 点名缺省 scope(多租引擎要带它自己的 `FLEET_SCOPE`)。
+ * 修前形(7.35.0 起的 `{reason}` 停机因由声明:只记一句话、不进排空)随契约体退役 —— 零别名;那一形的请求体读不成 `DrainRequest` ⇒ 400。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 export declare const ADMIN_DRAIN_PATH = "/v1/admin/drain";
-/** 上限与 approvals 的 reason 族同量级(消费面同为人读短句;非同一常量——两面语义无关,独立演化)。 */
-export declare const MAX_DRAIN_REASON_CHARS = 256;
 export declare function handleAdminDrain(req: IncomingMessage, res: ServerResponse, match: RouteMatch<AdminDrainRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const ADMIN_DRAIN_ROUTES: readonly [{
     readonly id: "admin-drain";

package/dist/http/routes/admin-drain.js

@@ -1,9 +1,11 @@
+import { readDrainRequest } from "@sema-agent/settings-schema/fleet";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
+import { fleetScopeOf } from "../../config-types.js";
+import { drainIdentityMismatches } from "../../fleet/drain-entry.js";
 import { assertNever } from "../route-ctx.js";
 export const ADMIN_DRAIN_PATH = "/v1/admin/drain";
-export const MAX_DRAIN_REASON_CHARS = 256;
 const OPERATOR_ONLY_MESSAGE = "drain declaration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS";
 export async function handleAdminDrain(req, res, match, ctx) {
     const { deps } = ctx;
@@ -22,18 +24,22 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
                 return;
             }
-            const body = (await ctx.helpers.readJson(req));
-            const reason = body?.reason;
-            if (typeof reason !== "string" || reason.trim().length === 0 || reason.length > MAX_DRAIN_REASON_CHARS) {
-                sendError(res, 400, "request.field_invalid", `the drain reason is surfaced verbatim on the UNAUTHENTICATED /health endpoint (and in 503 draining bodies), so anyone who can reach this port can read it — do not put ticket ids, hostnames, or internal identifiers in it. body must be { reason: string }: a non-empty string of at most ${MAX_DRAIN_REASON_CHARS} characters`);
+            const request = readDrainRequest(await ctx.helpers.readJson(req));
+            if (request === undefined) {
+                sendError(res, 400, "request.field_invalid", "the drain request must be { actionId, worker, deadlineAt, scope?, expectedGeneration?, instanceId?, term? }: actionId a non-empty idempotency key, worker this engine's worker name, deadlineAt epoch milliseconds, expectedGeneration a canonical decimal string (\"7\") — nothing was changed");
                 return;
             }
-            if (!deps.drainState) {
-                sendError(res, 501, "capability.drain_state_required", "this deployment has no drain state wired (embedded in another process?) — the declared reason would have nowhere to surface");
+            const enter = deps.drainState?.enter;
+            if (enter === undefined) {
+                sendError(res, 501, "capability.drain_state_required", "this deployment has no drain entry wired (embedded in another process?) — there is no drain for this request to enter");
                 return;
             }
-            deps.drainState.reason = reason.trim();
-            sendJson(res, 200, { ok: true });
+            const mismatched = drainIdentityMismatches(request, { scope: deps.config.fleetScope, worker: deps.config.configCenter?.worker, generation: deps.config.fleetGeneration, instanceId: deps.instanceId });
+            if (mismatched.length > 0) {
+                sendError(res, 409, "conflict.fleet_identity", `the drain request names a different instance than this engine (mismatched: ${mismatched.join(", ")}) — nothing was changed; compare with this engine's GET /health (worker comes from SEMA_REGISTRY_WORKER, generation from FLEET_GENERATION, scope from FLEET_SCOPE — unset, and a request without scope, mean "${fleetScopeOf(undefined)}")`);
+                return;
+            }
+            sendJson(res, 200, enter({ actionId: request.actionId, deadlineAt: request.deadlineAt }));
             return;
         }
         default:

package/dist/http/routes/approvals-assistant.d.ts

@@ -183,17 +183,17 @@ export declare const APPROVALS_ASSISTANT_ROUTES: readonly [{
     readonly id: "assistant-task-resume";
     readonly pattern: RegExp;
     readonly label: "/v1/assistant/tasks/:id/resume";
-    readonly billable: true;
+    readonly billable: "resume";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "assistant-task-plan-review";
     readonly pattern: RegExp;
     readonly label: "/v1/assistant/tasks/:id/plan_review";
-    readonly billable: true;
+    readonly billable: "hitl-answer";
     readonly methods: readonly ["POST"];
 }, {
     readonly prefix: "/v1/approvals";
-    readonly billable: true;
+    readonly billable: "hitl-answer";
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
 export type ApprovalsAssistantRouteId = RouteIdsOf<typeof APPROVALS_ASSISTANT_ROUTES>;

package/dist/http/routes/approvals-assistant.js

@@ -917,9 +917,9 @@ export const APPROVALS_ASSISTANT_ROUTES = [
     { id: "approval-exemptions-list", pattern: /^\/v1\/approvals\/(?<sessionId>[^/]+)\/exemptions(?:\/(?<tool>[^/]+))?$/, label: "/v1/approvals/:id/exemptions", methods: ["GET"] },
     { id: "approval-exemption-delete", pattern: /^\/v1\/approvals\/(?<sessionId>[^/]+)\/exemptions(?:\/(?<tool>[^/]+))?$/, label: "/v1/approvals/:id/exemptions", methods: ["DELETE"] },
     { id: "assistant-task-preempt", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/preempt$/, label: "/v1/assistant/tasks/:id/preempt", methods: ["POST"] },
-    { id: "assistant-task-resume", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/resume$/, label: "/v1/assistant/tasks/:id/resume", billable: true, methods: ["POST"] },
-    { id: "assistant-task-plan-review", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/plan_review$/, label: "/v1/assistant/tasks/:id/plan_review", billable: true, methods: ["POST"] },
-    { prefix: "/v1/approvals", billable: true },
+    { id: "assistant-task-resume", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/resume$/, label: "/v1/assistant/tasks/:id/resume", billable: "resume", methods: ["POST"] },
+    { id: "assistant-task-plan-review", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/plan_review$/, label: "/v1/assistant/tasks/:id/plan_review", billable: "hitl-answer", methods: ["POST"] },
+    { prefix: "/v1/approvals", billable: "hitl-answer" },
 ];
 const DECISION_DOOR_KEY_TABLE = deriveDecisionDoorKeyTable(DECISION_DOOR_FAMILY, APPROVALS_ASSISTANT_ROUTES);
 //# sourceMappingURL=approvals-assistant.js.map

package/dist/http/routes/capabilities.js

@@ -79,7 +79,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                     : false,
                 sessionEvents: facts.sessionEventStream(deps).available,
                 fleet: facts.fleetStream(deps).available
-                    ? { stream: true, sessionScope: true, observe: true, resume: "snapshot", bgNotifyFailClosed: true, steerPriority: "engine", hookFailureNotice: true }
+                    ? { stream: true, sessionScope: true, observe: true, resume: "snapshot", bgNotifyFailClosed: true, steerPriority: "engine", hookFailureNotice: true, leaseClient: true, generationEcho: true }
                     : false,
                 workspace: facts.workspaceBrowse().available,
                 leader: facts.leaderLane(deps).available,
@@ -130,6 +130,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 readFace: deps.config.readFace ?? null,
                 writeProtection: projectWriteProtectionCapability(deps.writeProtection),
                 appendSystemPrompt: true,
+                outputStyle: true,
                 compactionModel: true,
                 subagentOutput: facts.subagentOutput(deps).available,
                 subagentStream: facts.subagentOutput(deps).available,
@@ -161,6 +162,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalDecisionNote: true,
                 approvalDecidedBy: true,
                 permissionModes: [...PERMISSION_MODES],
+                sessionReadRedaction: true,
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 retention: retentionAdvertisement(deps.config),

package/dist/http/routes/devices.js

@@ -2,12 +2,13 @@ import { sendError, sendJson } from "../send.js";
 import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, sameDeviceOwner, } from "../../device-store.js";
+import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, isDeviceAbsolutePath, sameDeviceOwner, } from "../../device-store.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../device-placement.js";
 import { echoKeyName } from "../../request-key-closure.js";
 const DEVICE_NOT_FOUND_MESSAGE = "device not found";
 const NO_DEVICE_DOMAIN_MESSAGE = "device management needs a caller domain: this credential carries no verified tenant scope claim (registry auth-bridge JWT `scope`) and is not an explicit operator — connect through the registry auth bridge, or configure OPERATOR_PRINCIPALS";
+const NO_ENROLL_DOMAIN_MESSAGE = "device enrollment needs a registry login that carries a tenant scope: this credential carries no verified tenant scope claim (registry auth-bridge JWT `scope`), and an operator principal carries no scope, so it cannot enroll a device or issue an enroll token — connect through the registry auth bridge with a tenant-scoped login";
 const DEVICE_LANE_REQUIRED_MESSAGE = "device management requires the device execution lane (REMOTE_EXEC=device with a SQL store backend) — this deployment has no device lane wired";
 const _deviceRouteCodesPinned = ["not_found.device", "device.rebind_rev_conflict", "device.rebind_active_run"];
 void _deviceRouteCodesPinned;
@@ -109,8 +110,8 @@ function parseEnrollBody(res, body) {
             return null;
         }
     }
-    if (workspaceRoot.length === 0) {
-        sendError(res, 400, "request.field_invalid", "workspaceRoot is required and must be non-empty (it is the device-side root every instruction resolves against)");
+    if (!isDeviceAbsolutePath(workspaceRoot)) {
+        sendError(res, 400, "request.field_invalid", "workspaceRoot must be an absolute POSIX path (it is the device-side root every instruction resolves against)");
         return null;
     }
     return { token: token, pubkey: pubkey, platformOs: os, platformArch: platformArch, displayName: displayName, workspaceRoot: workspaceRoot };
@@ -164,7 +165,7 @@ export async function handleDevices(req, res, match, ctx) {
     }
     if (match.decl.id === "device-enroll-tokens") {
         if (domain === undefined) {
-            sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
+            sendError(res, 403, "auth.forbidden", NO_ENROLL_DOMAIN_MESSAGE);
             return;
         }
         if ((await readClosedBody(req, res, readJson, [])) === null)
@@ -180,7 +181,7 @@ export async function handleDevices(req, res, match, ctx) {
     }
     if (match.decl.id === "device-enroll") {
         if (domain === undefined) {
-            sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
+            sendError(res, 403, "auth.forbidden", NO_ENROLL_DOMAIN_MESSAGE);
             return;
         }
         const raw = await readClosedBody(req, res, readJson, ENROLL_BODY_KEYS);

package/dist/http/routes/leader.d.ts

@@ -16,7 +16,7 @@ export declare function handleLeader(req: IncomingMessage, res: ServerResponse,
 export declare const LEADER_ROUTES: readonly [{
     readonly id: "leader-submit";
     readonly path: "/v1/leader";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "leader-detail";

package/dist/http/routes/leader.js

@@ -51,7 +51,7 @@ export async function handleLeader(req, res, match, ctx) {
     throw new Error(`leader endpoint did not claim its own declared route: ${match.decl.id}`);
 }
 export const LEADER_ROUTES = [
-    { id: "leader-submit", path: LEADER_SUBMIT_PATH, billable: true, methods: ["POST"] },
+    { id: "leader-submit", path: LEADER_SUBMIT_PATH, billable: "submit", methods: ["POST"] },
     { id: "leader-detail", pattern: /^\/v1\/leader\/(?<id>[^/]+)$/, label: "/v1/leader/:id", methods: ["GET"] },
 ];
 //# sourceMappingURL=leader.js.map

package/dist/http/routes/memory-consolidation.d.ts

@@ -58,7 +58,7 @@ export declare function handleMemoryConsolidation(req: IncomingMessage, res: Ser
 export declare const MEMORY_CONSOLIDATION_ROUTES: readonly [{
     readonly id: "memory-consolidation-run";
     readonly path: "/v1/admin/memory/consolidation/run";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "memory-consolidation-status";

package/dist/http/routes/memory-consolidation.js

@@ -163,7 +163,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
     }
 }
 export const MEMORY_CONSOLIDATION_ROUTES = [
-    { id: "memory-consolidation-run", path: MEMORY_CONSOLIDATION_RUN_PATH, billable: true, methods: ["POST"] },
+    { id: "memory-consolidation-run", path: MEMORY_CONSOLIDATION_RUN_PATH, billable: "submit", methods: ["POST"] },
     { id: "memory-consolidation-status", path: MEMORY_CONSOLIDATION_STATUS_PATH, methods: ["GET"] },
 ];
 //# sourceMappingURL=memory-consolidation.js.map

package/dist/http/routes/notify-wake.d.ts

@@ -22,7 +22,7 @@ export declare const NOTIFY_WAKE_ROUTES: readonly [{
     readonly id: "session-wake";
     readonly pattern: RegExp;
     readonly label: "/v1/sessions/:id/$verb";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "session-notify";

package/dist/http/routes/notify-wake.js

@@ -143,7 +143,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
     }
 }
 export const NOTIFY_WAKE_ROUTES = [
-    { id: "session-wake", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/wake$/, label: "/v1/sessions/:id/$verb", billable: true, methods: ["POST"] },
+    { id: "session-wake", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/wake$/, label: "/v1/sessions/:id/$verb", billable: "submit", methods: ["POST"] },
     { id: "session-notify", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/notify$/, label: "/v1/sessions/:id/$verb", methods: ["POST"] },
 ];
 //# sourceMappingURL=notify-wake.js.map

package/dist/http/routes/rules.js

@@ -4,10 +4,10 @@ import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sen
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createLogger } from "../../observability/logger.js";
-import { RULE_IMPORT_RETRY_AFTER_SEC, MAX_RULE_SCOPE_CHARS, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
+import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, buildCcImportLayerRootRefusal, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { CONTROL_AND_BIDI_CHARS } from "../../text-bidi.js";
 import { HttpError } from "../../security.js";
-import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS } from "@sema-agent/core";
+import { MAX_RULE_TEXT_CHARS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
 import { PERSISTED_RULE_MATCHES, isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
@@ -26,7 +26,7 @@ const CcImportPrepareBodySchema = z
         .object({
         layer: z.enum(["userSettings", "projectSettings", "localSettings"]),
         path: z.string().min(1).max(1024),
-        root: z.string().min(1).max(1024),
+        root: z.string().max(1024),
         content: z.string().max(MAX_LAYER_CONTENT_CHARS),
     })
         .strict())
@@ -34,6 +34,9 @@ const CcImportPrepareBodySchema = z
         .max(MAX_LAYERS),
 })
     .strict();
+function ccImportRootRefused(layer) {
+    return !isValidDurableScope({ kind: "project", root: layer.root });
+}
 const TICKET_CONTROL_CHARS_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`);
 const TicketStringSchema = z.string().min(1).max(190).refine((t) => !TICKET_CONTROL_CHARS_RE.test(t));
 const CcImportRedeemBodySchema = z.object({ ticket: TicketStringSchema }).strict();
@@ -170,6 +173,11 @@ export async function handleRules(req, res, match, ctx) {
             sendError(res, 400, "request.body_shape", "body must be {layers:[{layer,path,root,content}]}");
             return;
         }
+        const refusedLayer = parsed.data.layers.findIndex(ccImportRootRefused);
+        if (refusedLayer >= 0) {
+            sendError(res, 400, "request.body_shape", buildCcImportLayerRootRefusal(refusedLayer));
+            return;
+        }
         const prepared = await lane.prepareImport(principal, parsed.data.layers);
         if (!prepared.ok) {
             sendError(res, 413, "request.payload_too_large", "too many allow entries across the submitted settings layers");
@@ -231,7 +239,7 @@ async function handleRuleList(res, search, caller, lane, config) {
     const scopeRaw = q.get("scope");
     const scopeFilter = scopeRaw === null ? undefined : parseRuleScope(scopeRaw);
     if (scopeRaw !== null && scopeFilter === undefined) {
-        sendError(res, 400, "request.query_invalid", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.query_invalid", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const cursorRaw = q.get("cursor");
@@ -305,7 +313,7 @@ async function handleRuleWrite(res, rawBody, caller, lane, config) {
     }
     const scope = parseRuleScope(parsed.data.scope);
     if (scope === undefined) {
-        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const target = resolveTargetPrincipal(parsed.data.principal, caller, config);
@@ -354,7 +362,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, config) {
     }
     const scope = parseRuleScope(parsed.data.scope);
     if (scope === undefined) {
-        sendError(res, 400, "request.body_shape", "scope must be 'global' or 'project:<root>' with a non-empty root");
+        sendError(res, 400, "request.body_shape", RULE_SCOPE_REFUSAL_SENTENCE);
         return;
     }
     const target = resolveTargetPrincipal(parsed.data.principal, caller, config);

package/dist/http/routes/runs.d.ts

@@ -40,7 +40,7 @@ idemKey: string | undefined): Promise<{
 export declare const RUNS_ROUTES: readonly [{
     readonly id: "runs-submit";
     readonly path: "/v1/runs";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "run-steer";
@@ -99,7 +99,7 @@ export declare const RUN_VERBS_ROUTES: readonly [{
     readonly id: "run-subagent-resume";
     readonly pattern: RegExp;
     readonly label: "/v1/runs/:id/subagents/:sub/*";
-    readonly billable: true;
+    readonly billable: "resume";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "run-task-output";

package/dist/http/routes/runs.js

@@ -1656,7 +1656,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
     return resp;
 }
 export const RUNS_ROUTES = [
-    { id: "runs-submit", path: "/v1/runs", billable: true, methods: ["POST"] },
+    { id: "runs-submit", path: "/v1/runs", billable: "submit", methods: ["POST"] },
     { id: "run-steer", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/steer$/, label: "/v1/runs/:id/steer", methods: ["POST"] },
     { id: "run-interrupt", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/interrupt$/, label: "/v1/runs/:id/interrupt", methods: ["POST"] },
     { id: "run-detach", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/detach$/, label: "/v1/runs/:id/detach", methods: ["POST"] },
@@ -1669,7 +1669,7 @@ export const RUN_VERBS_ROUTES = [
     { id: "run-subagent-output", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/output$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"] },
     { id: "run-subagent-stream", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/stream$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"] },
     { id: "run-subagent-steer", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/steer$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["POST"] },
-    { id: "run-subagent-resume", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/resume$/, label: "/v1/runs/:id/subagents/:sub/*", billable: true, methods: ["POST"] },
+    { id: "run-subagent-resume", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/resume$/, label: "/v1/runs/:id/subagents/:sub/*", billable: "resume", methods: ["POST"] },
     { id: "run-task-output", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/tasks\/(?<tid>[^/]+)\/output$/, label: "/v1/runs/:id/tasks/:tid/*", methods: ["GET"] },
     { id: "run-task-stop", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/tasks\/(?<tid>[^/]+)\/stop$/, label: "/v1/runs/:id/tasks/:tid/*", methods: ["POST"] },
     { id: "elicitation-respond", pattern: /^\/v1\/elicitations\/(?<id>[^/]+)\/respond$/, label: "/v1/elicitations/:id/respond", methods: ["POST"] },

package/dist/http/routes/side-query.d.ts

@@ -17,7 +17,7 @@ export declare function handleSideQuery(req: IncomingMessage, res: ServerRespons
 export declare const SIDE_QUERY_ROUTES: readonly [{
     readonly id: "side-query";
     readonly path: "/v1/side-query";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */

package/dist/http/routes/side-query.js

@@ -133,6 +133,6 @@ export async function handleSideQuery(req, res, match, ctx) {
     }
 }
 export const SIDE_QUERY_ROUTES = [
-    { id: "side-query", path: "/v1/side-query", billable: true, methods: ["POST"] },
+    { id: "side-query", path: "/v1/side-query", billable: "submit", methods: ["POST"] },
 ];
 //# sourceMappingURL=side-query.js.map

package/dist/http/routes/tasks.d.ts

@@ -25,12 +25,12 @@ export declare function handleTasks(req: IncomingMessage, res: ServerResponse, m
 export declare const TASKS_ROUTES: readonly [{
     readonly id: "tasks-submit";
     readonly path: "/v1/tasks";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "tasks-submit-stream";
     readonly path: "/v1/tasks/stream";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */

package/dist/http/routes/tasks.js

@@ -639,7 +639,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
+                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope({ sessionId: prepared.spec.sessionId, taskId: durableTaskId }, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {
@@ -901,7 +901,7 @@ export async function handleTasks(req, res, match, ctx) {
     }
 }
 export const TASKS_ROUTES = [
-    { id: "tasks-submit", path: "/v1/tasks", billable: true, methods: ["POST"] },
-    { id: "tasks-submit-stream", path: "/v1/tasks/stream", billable: true, methods: ["POST"] },
+    { id: "tasks-submit", path: "/v1/tasks", billable: "submit", methods: ["POST"] },
+    { id: "tasks-submit-stream", path: "/v1/tasks/stream", billable: "submit", methods: ["POST"] },
 ];
 //# sourceMappingURL=tasks.js.map

package/dist/http/server.d.ts

@@ -649,8 +649,6 @@ export interface ServiceGovernanceDeps {
      *  「诊断说亮、位说暗」。缺席(桩/一次性 CLI)⇒ 读面如实答 `deployment_incapable`。 */
     autoModeFace?: import("../auto-mode-face.js").AutoModeFaceDeps;
 }
-/** **部署自述面**:只被 /health、/v1/capabilities 与提交前置门读的部署事实(多为 live getter,
- *  不是快照——/health 必须回答「此刻」)。 */
 export interface ServiceDeploymentDeps {
     /** Stable per-process id recorded on runs (audit / stale recovery). */
     instanceId?: string;
@@ -687,15 +685,10 @@ export interface ServiceDeploymentDeps {
      *    (= 引擎附着租约集的大小)。消费方是 `boot/engine-lease.ts` 的自退判据;与 `inflight` 同族,
      *    同一个共享盒子,不另开第二条 main↔server 的通道。
      */
-    drainState?: {
-        draining: boolean;
-        since?: number;
-        reason?: string;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    drainState?: import("../fleet/drain-entry.js").DrainState;
+    /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端
+     *  (非 fleet 成员 / 没接中心 / 测试夹具)⇒ `none`(与没有租约的引擎逐字同)。 */
+    servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;
     /** boot ready 门(b):false = 布防(`CONFIG_REQUIRE_ROSTER=true`)且首次 effective pull 尚未落 roster
      *  (worker 只有占位模型)。就绪原因 `model_roster_pending`(`http/readiness.ts`):计费提交 503 + `/readyz` 503 +
      *  /health 加性 `ready:false`。absent = 恒 ready(未布防 / 非 registry 部署),现有部署零影响。config-center 的
@@ -722,6 +715,9 @@ export interface ServiceDeploymentDeps {
      *  (`boot/stage-10-http-server.ts` → `modelRefusals: () => deployment.modelRefusalsState?.()`)—— 一处铸、两出口。缺席 / 返回 undefined =
      *  没有可报的拒或没有配置管道 ⇒ `/health` 形状逐字不变(additive)。 */
     modelRefusalsState?: () => import("@sema-agent/settings-schema").ModelRefusalsSignal | undefined;
+    /** `/health.configHandoff`(只上 `/health`):在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没被确认(config-center 接力账的 `configHandoffState()`;合成律
+     *  `fleet/engine-signal.ts` 的 `buildConfigHandoff`)。缺席 / 返回 undefined = 有接力、没有中心或本地腿 ⇒ 键缺席。 */
+    configHandoffState?: () => import("../fleet/engine-signal.js").ConfigHandoff | undefined;
     /** [ref] 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
      *  缺席 / 回 `"not-wired"` = 本部署没有配置管道 ⇒ 该口诚实 4xx(绝不吞成 200)。 */
     configRefreshNow?: () => Promise<"triggered" | "not-wired" | "failed">;
@@ -739,16 +735,6 @@ export interface ServiceDeploymentDeps {
     mcpRevocationState?: () => {
         revoked: string[];
     } | undefined;
-    /** codex R18: the persistent "retained WITHOUT a next-boot handoff" state — a candidate whose restart signal is
-     *  withheld because no restart-surviving handoff exists yet (durable-declared LKG publication incomplete, or a
-     *  boot skills debt not yet proven repairable). Surfaced on /health (`modelPlaneDeferred` — the key keeps its birth
-     *  name: it was born for the model-plane deferral, which retired with the `models-tiers` slice in S-668 波 0) so
-     *  the stuck state outlives the one-shot warn (the etag advances → later ticks 304). */
-    planeDeferredState?: () => {
-        version: number;
-        since: number;
-        blocked?: string[];
-    } | undefined;
     /** B1(鲁棒性批3 设计件):后台**缓存**探针的读座——/health 绝不逐请求打 DB(center/k8s 高频面),
      *  main.ts 只在 SQL 后端(backend.kind !== "local")挂环(createStoreLiveProbe,STORE_PROBE_INTERVAL_MS)。
      *  缺席(local/memory/探针关)= /health 形状不变;接线 = `storeProbe{live,ageMs,error?}` 恒在

package/dist/http/server.js

@@ -31,6 +31,23 @@ export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDis
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
 import { explicitOperatorOk, isOperator } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator };
+class DrainYieldingPreemptBook extends Map {
+    drainingNow;
+    constructor(drainingNow) {
+        super();
+        this.drainingNow = drainingNow;
+    }
+    set(taskId, ctrl) {
+        super.set(taskId, ctrl);
+        if (this.drainingNow())
+            ctrl.abort();
+        return this;
+    }
+    yieldAll() {
+        for (const ctrl of this.values())
+            ctrl.abort();
+    }
+}
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
     if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
@@ -44,7 +61,7 @@ export function createHttpServer(rawDeps) {
     }
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
-    const preemptableRuns = new Map();
+    const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
     const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
@@ -58,6 +75,8 @@ export function createHttpServer(rawDeps) {
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
+    if (deps.drainState)
+        deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
         deps.hookWakeBus.deliver = async (sessionId, text) => {
             try {

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -63,6 +63,12 @@ export interface TaskRequestBody {
      *  question (raised on the board). Rejected fail-loud when `systemPrompt` is an already-assembled prompt
      *  (anchors detected) — that assembler arm cannot mount the rider (silent drop would belie the capability bit). */
     appendSystemPrompt?: string;
+    /** 7.121.0:输出风格的**每轮一句**(引擎 `TaskSpec.outputStyle`,core 7.39.0 起):原样投给引擎,引擎在每个附件周期用自己的标记帧陈述
+     *  `"<name> output style is active. <turnReminder>"`(`turnReminder` 缺席 ⇒ 引擎的缺省句),回声为 `steering_injected` `source:"output_style"`。
+     *  **一个事实一个座位**:风格的**正文**(指南全文)走 `settings.outputStyle`(折进 `appendSystemPrompt` 那一块),这里只放名字与每轮那一句;
+     *  只在非缺省风格时声明。值形的属主是引擎(`{ name, turnReminder? }` 恰两键、`name` 非空且 ≤ `OUTPUT_STYLE_NAME_MAX`、`turnReminder` 在场即非空串):
+     *  本服务**不另判**,坏值在 prepare 被引擎拒 `config.output_style_invalid`(不会被静默忽略)。能力位 `outputStyle`。 */
+    outputStyle?: TaskSpec["outputStyle"];
     /** Explicit model selection (CLI `/model` picker + `run --model <ref>`). An INTENT by catalog
      *  name (e.g. "deepseek-pro") — resolveSpec gates it against the SAME allow-list as an inline `@name` mention
      *  (config.models keys), so it picks WHICH configured model but can never inject one. Wins over an inline

package/dist/list-entry-display.d.ts

@@ -0,0 +1,14 @@
+/**
+ * **机读位的值** —— 通告 `detail` 里的规则文本(`permission.allowed_tool_not_granted` 的 `detail.entries[].entry`、`permission.rule_row_dropped` 的
+ * `detail.rows[].rule`)在会话流行与运维日志行上一律是这一只:条目的脱敏原值。显示形不进机读位(壳若再加引号就是两层)。
+ */
+export declare function redactListEntry(entry: string): string;
+/**
+ * **人读句里条目的唯一写法** —— 本仓把规则条目 / 工具名原串写进任何一句给人读的话(拒句、起服拒启行)一律调这一只:引擎的条目写者
+ * `renderListEntry`(core 7.46.0 #1428 包根导出:JSON 串形带引号,看不见 / 印成空白的字符写成 `\uXXXX`,超长截断)—— 与引擎自己的通告句同一个渲染;
+ * 判定拿原串。
+ * 🔴 凭据先认、再渲染:渲染把看不见的字符写成 ASCII 转义,之后的脱敏器就认不出夹着零宽字符的凭据 ⇒ 原串上认出凭据时渲染它的脱敏值;
+ * 没有凭据的条目渲染**原串**(格式字符留给渲染器写成 `\uXXXX` —— 人要看得见它,不能先被脱敏器剥掉)。
+ */
+export declare function displayListEntry(entry: string): string;
+//# sourceMappingURL=list-entry-display.d.ts.map

package/dist/list-entry-display.js

@@ -0,0 +1,14 @@
+import { renderListEntry } from "@sema-agent/core";
+import { redactSecretsWithArms } from "./trace/redact.js";
+function scanListEntry(entry) {
+    const scan = redactSecretsWithArms(entry);
+    return { redacted: scan.text, credential: scan.arms.size > 0 };
+}
+export function redactListEntry(entry) {
+    return scanListEntry(entry).redacted;
+}
+export function displayListEntry(entry) {
+    const scan = scanListEntry(entry);
+    return renderListEntry(scan.credential ? scan.redacted : entry);
+}
+//# sourceMappingURL=list-entry-display.js.map