@sema-agent/server 7.12.0 → 7.14.0

package/dist/boot/reapers.js

@@ -15,6 +15,7 @@
 import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
+import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
 /** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
@@ -74,10 +75,22 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
 }
 /** 起后台维护 tick,返回定时器 handle(收尾段 clearInterval 用)。 */
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, getRunDenySweep, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, getRunDenySweep, } = ctx;
     // S7 (SILENT-FALLBACK P0-d): the sweeps' return counts were discarded — an instance death that batch-fails
     // N orphans was indistinguishable from organic failures. Count + log ONLY when a sweep flipped rows (>0),
     // so healthy ticks stay silent. Tolerant of void-returning stores (typeof guard).
+    /**
+     * 一条维护腿的**起飞登记**(codex 对抗复审 R1 [high] 的修复面)。
+     *
+     * 代替裸 `void <promise>`:语义与 `void` 完全一样(不 await、错误由各腿自己的 guard 接住),
+     * 只多一件事 —— 把这一份 promise 登记进收编闸的在飞集,好让一条正要动数据的收编弧**等它落地**。
+     * 少一处没换,那条腿就是闸的漏网者(而漏网是静默的),所以本文件里 tick 内**不该再出现裸 `void`**。
+     * 入参允许 `undefined`(可选链的腿:`void store?.reap()` 在店缺席时求值成 undefined)。
+     */
+    const leg = (p) => {
+        if (p !== undefined)
+            trackMaintenanceLeg(p);
+    };
     const reapCount = (metric, labels) => (n) => {
         if (typeof n === "number" && n > 0) {
             metrics.inc(metric, labels, n);
@@ -111,6 +124,8 @@ export function startReapers(ctx) {
     const rosterReapOlderThanGuard = createThrottledReaperCatch("roster_reap_older_than", logger);
     const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
+    const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
+    let permissionRuleReapInFlight = false; // A-010.17 / codex R2:重入守卫(邻居四腿同形,理由见调用点)
     let approvalReconcileInFlight = false; // 车5 §8 C-8:重入守卫(邻居四先例同形——本腿时长随 PARKING 行数增长)
     // #151 车5(design/172 §3.0 对账收敛器 + 崩溃恢复扫描):建腿条件 = 开关开 ∧ **有 `StoreBackend`**
     // (见下方判据行 —— 是**任意** backend,不限 SQL twins:`local` 车道也算,它的 `approvalAsk()` 是进程内
@@ -237,12 +252,32 @@ export function startReapers(ctx) {
             metrics.setGauge("fleet_clock_probe_ok", 0);
         }
     };
+    let quiesceLogged = false;
     const reaper = setInterval(() => {
-        void probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError); // S10
-        void runStore
+        // 🔴 A-010.18(验真后修):**收编弧跑动期间整轮让路**。design/183 I1「引擎先停」此前在进程内
+        // 零执法 —— 弧在逐表 UPDATE 的同时,本 tick 的好几条腿写的正是被迁的那些表。最锋利的是审批收敛器:
+        // 它按 `owner` 读出一批行再 CAS 结算,而收编正在把 `approval_ask.owner` 从 A 改成 B ⇒ 一只本该
+        // PARKED 的 ask 可能被写成 **DENIED**,而 DENIED 是终局(收编回滚不了它,重跑也追认不回来)。
+        // 为什么让开**整轮**而不是挑腿避让、以及「只挡本副本」这条射程边界,逐字见 `adoption/quiesce.ts`。
+        // 让路是零代价的:每条腿都幂等、都能等下一轮,而弧是毫秒级的几条 UPDATE。
+        if (isAdoptionQuiescing()) {
+            if (!quiesceLogged) {
+                quiesceLogged = true; // 一次性 —— 弧毫秒级,逐 tick 刷屏没有信息量
+                logger.info("reaper_tick_yielded_to_adoption", {
+                    // 文案只说**兑得出来**的话(codex R1 [high] 的教训):本行保证的是「不再**起飞**新腿」。
+                    // 已经在飞的那些由弧侧的有界排空负责等,等不到会另打一条 `adoption_maintenance_drain_timeout`
+                    // —— 两条读数合起来才是全貌,所以这一行不许自称「没有任何腿在写被迁的表」。
+                    note: "an adoption arc is running in this process; the maintenance tick launches NO new legs for its duration. Legs already airborne when the arc began are waited on separately (bounded) — see adoption_maintenance_drain_timeout if that wait ran out (design/183 I1, in-process half)",
+                });
+            }
+            return;
+        }
+        quiesceLogged = false;
+        leg(probeClockSkew().then(() => probeClockSkewGuard.onSuccess(), probeClockSkewGuard.onError)); // S10
+        leg(runStore
             ?.reapStale(config.runStaleSec * 1000)
             .then(reapCount("runs_reaped_total", { kind: "stale" }))
-            .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError);
+            .then(() => runsReapStaleGuard.onSuccess(), runsReapStaleGuard.onError));
         // Durable F4 (design/45) + design/80 §3 inv#3 crash-safe backstop: CAS-expire checkpoints past their
         // deadline OR their absolute terminal_at_ms backstop (≈ deny), then fail the suspended run rows whose
         // checkpoint was thereby expired (release task_active = unlock the session). These run EVERY tick,
@@ -256,51 +291,51 @@ export function startReapers(ctx) {
             // 真 pin 只存在于 in-memory TtlSessionStore;本部署 durable checkpoint 恒配 durable session 后端
             // (pin=no-op),deny-sweep 走 resumeCheckpoint=core 内部 unpin ✓。SESSION_BACKEND=memory+durable
             // checkpoint 的 niche dev 组合下 abort-expire 臂会把被钉会话泄到进程终——显式接受,不为 dev 形加腿。
-            void checkpointStore
+            leg(checkpointStore
                 .reapExpired(Date.now())
                 .then(reapCount("checkpoints_reaped_total", {}))
-                .then(() => checkpointsReapExpiredGuard.onSuccess(), checkpointsReapExpiredGuard.onError);
-            void runStore
+                .then(() => checkpointsReapExpiredGuard.onSuccess(), checkpointsReapExpiredGuard.onError));
+            leg(runStore
                 ?.failSuspendedWithExpiredCheckpoint()
                 .then(reapCount("runs_reaped_total", { kind: "expired_checkpoint" }))
-                .then(() => runsFailSuspendedExpiredCheckpointGuard.onSuccess(), runsFailSuspendedExpiredCheckpointGuard.onError);
+                .then(() => runsFailSuspendedExpiredCheckpointGuard.onSuccess(), runsFailSuspendedExpiredCheckpointGuard.onError));
             // D-D SLA-timer: resolve-DENY human/irreversible_ask gates past their deadline (graceful — the model
             // continues with the denial), vs the abort reapExpired gives the other kinds. Bounded per tick.
-            void getRunDenySweep()?.(Date.now())
-                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
+            leg(getRunDenySweep()?.(Date.now())
+                .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError)); // A10 搬运改写:晚绑取值(原 `runDenySweep?.`)
         }
         // The finer, OPT-IN time-based suspended-run reaper (APPROVAL_TIMEOUT_SEC). Stays gated — reapSuspended
         // with a 0 TTL would nuke ALL suspended rows (cutoff = now). The absolute backstop above is the safety
         // floor; this is the operator-chosen deadline. ([2354] A-5:F4 轮询店的 expireStale 腿随车道退役。)
         if (config.approvalTimeoutSec > 0) {
-            void runStore
+            leg(runStore
                 ?.reapSuspended(config.approvalTimeoutSec * 1000)
                 .then(reapCount("runs_reaped_total", { kind: "suspended" }))
-                .then(() => runsReapSuspendedGuard.onSuccess(), runsReapSuspendedGuard.onError);
+                .then(() => runsReapSuspendedGuard.onSuccess(), runsReapSuspendedGuard.onError));
         }
         // GC checkpoint_ctx rows whose checkpoint is gone (bound to the checkpoint lifecycle).
-        void checkpointStore
+        leg(checkpointStore
             ?.reapCtx(Date.now() - config.runStaleSec * 1000)
-            .then(() => checkpointReapCtxGuard.onSuccess(), checkpointReapCtxGuard.onError);
+            .then(() => checkpointReapCtxGuard.onSuccess(), checkpointReapCtxGuard.onError));
         rateLimiter?.sweep();
         if (costQuota instanceof CostQuota)
             costQuota.reap(); // TiDB variant self-reaps in its flush loop
-        void toolResultStore
+        leg(toolResultStore
             ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
-            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
+            ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError)); // optional extra: SQL twins only (the local FileToolResultStore persists like transcripts)
         // 2c session-sync: GLOBALLY GC grace-window orphan blobs (standalone /sync/blobs PUTs that were never
         // imported are otherwise collected only on reap()/deleteBySession(), which never fire for a never-imported scope).
         // Bounds the standalone-PUT orphan-blob exhaustion (review finding) to the grace window. Durable twins only (local
         // omits the seam → optional-chained no-op).
-        void fileSnapshotStore
+        leg(fileSnapshotStore
             ?.sweepOrphanBlobs?.()
-            .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError);
+            .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError));
         // D-1 附件 TTL:上传后从未被任何 task 引用(session_id NULL)且超过 attachmentUnboundTtlMs 的行收割
         // (绑定行不在此收——随会话 E21 级联删)。best-effort,与其余 reaper 腿同姿。
-        void taskAttachmentStore
+        leg(taskAttachmentStore
             ?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs)
             .then(reapCount("attachments_reaped_total", {}))
-            .then(() => attachmentReapUnboundGuard.onSuccess(), attachmentReapUnboundGuard.onError);
+            .then(() => attachmentReapUnboundGuard.onSuccess(), attachmentReapUnboundGuard.onError));
         // D-1 孤儿**对象**彻底 GC(clay 拍 2026-07-28):对象存储 × meta 行对账,grace 默认 1h(上传先行窗
         // 保护;`ATTACHMENT_ORPHAN_GRACE_MS=0` 关掉本腿——同 tick 邻居都有旋钮,复审 F10)。
         // 列举失败=本轮 warn 跳过(「列不出来」绝不当「没有孤儿」),下轮再试。
@@ -309,7 +344,7 @@ export function startReapers(ctx) {
         // wfRunReap/bgAgentReap 都有同款守卫。
         if (config.attachmentOrphanGraceMs > 0 && !attachmentSweepInFlight && taskAttachmentStore?.sweepOrphanObjects) {
             attachmentSweepInFlight = true;
-            void taskAttachmentStore
+            leg(taskAttachmentStore
                 .sweepOrphanObjects(config.attachmentOrphanGraceMs)
                 .then((n) => { if (n > 0) {
                 metrics.inc("attachment_orphan_objects_swept_total", {}, n);
@@ -329,21 +364,21 @@ export function startReapers(ctx) {
                     // observability must never crash the tick — see comment above.
                 }
             })
-                .finally(() => { attachmentSweepInFlight = false; });
+                .finally(() => { attachmentSweepInFlight = false; }));
         }
         // P1d-β 2c session-sync: GC ABANDONED staged imports — staging-id session_event rows (`%#stg-%`) with NO
         // session_meta whose oldest row is older than the grace window (an in-flight stream stays fresh → never reaped).
         // Bounds the orphan-staging-row growth (a Phase B that opened a staging then never committed). Durable session
         // stores only (the local backend stages in memory → no durable rows; the seam is absent → optional-chained no-op).
-        void backend?.session()?.sweepStagingSessions?.()
-            .then(() => sessionSweepStagingGuard.onSuccess(), sessionSweepStagingGuard.onError);
+        leg(backend?.session()?.sweepStagingSessions?.()
+            .then(() => sessionSweepStagingGuard.onSuccess(), sessionSweepStagingGuard.onError));
         // Bake-runner backstop (§P2.7): fail any `running` bake whose lease went stale (the runner crashed mid-build),
         // append a synthetic terminal `done{failed}` so SSE readers settle, and force-release the single-flight lease.
         // staleMs (≈3× the 30s heartbeat) bounds a healthy slow build so it is never wrongly reaped.
-        void imageBakes
+        leg(imageBakes
             ?.reapStaleBakes(config.imageBakes.staleMs)
             .then(reapCount("bakes_reaped_total", {}))
-            .then(() => imageBakesReapStaleGuard.onSuccess(), imageBakesReapStaleGuard.onError);
+            .then(() => imageBakesReapStaleGuard.onSuccess(), imageBakesReapStaleGuard.onError));
         // SVC-3 worktree isolation: deregister worktrees orphaned by a process crash (the Runner never reached
         // destroy → `git worktree remove` never ran). `git worktree prune` cleans registrations whose dirs are
         // already gone. Best-effort, userland (core ships no post-kill Runner hook); never throws. Unset = no-op.
@@ -353,22 +388,22 @@ export function startReapers(ctx) {
         // 照抄 bgAgentReap 的 in-flight + finally 释放形。
         if (worktreeReap && !worktreeReapInFlight) {
             worktreeReapInFlight = true;
-            void worktreeReap()
+            leg(worktreeReap()
                 .then(() => worktreeReapGuard.onSuccess(), worktreeReapGuard.onError)
-                .finally(() => (worktreeReapInFlight = false));
+                .finally(() => (worktreeReapInFlight = false)));
         }
         // SVC-1 (adversarial-review HIGH): PERIODIC notify-recovery sweep (not just at boot) — re-delivers a terminal
         // run whose in-process notify was lost, AND finalizes-as-abandoned a `running` run orphaned past the grace
         // window (core never resumes/reaps a prior `running` row, so nothing else would). Idempotent; best-effort.
-        void workflowNotifyGate
+        leg(workflowNotifyGate
             ?.recover(workflowRecoverOpts)
-            .then(() => workflowNotifyRecoverGuard.onSuccess(), workflowNotifyRecoverGuard.onError);
+            .then(() => workflowNotifyRecoverGuard.onSuccess(), workflowNotifyRecoverGuard.onError));
         // SVC-2 (adversarial-review HIGH): time-based GC of the workflow_journal table (the heaviest, TaskResult-bearing
         // one) — the per-run deleteByRun has no run-store reap hook, so this bounded sweep is what stops unbounded
         // growth. A resume of a journal older than the retention window re-runs live (resume is an optimization).
-        void workflowJournalStore
+        leg(workflowJournalStore
             ?.reapExpired?.(Date.now(), config.workflowJournalRetentionMs)
-            .then(() => workflowJournalReapExpiredGuard.onSuccess(), workflowJournalReapExpiredGuard.onError);
+            .then(() => workflowJournalReapExpiredGuard.onSuccess(), workflowJournalReapExpiredGuard.onError));
         // Retention (WorkflowRunStore never auto-purges, reap is explicit):
         // age out TERMINAL workflow_run rows across ALL scopes. SQL twins only (reapAllScopes is their DISTINCT-scope
         // extension; the contract itself has no cross-scope enumeration, and the File store keeps the transcripts-like
@@ -379,30 +414,30 @@ export function startReapers(ctx) {
             const sweep = sqlWorkflowRunStore?.reapAllScopes?.(Date.now(), { maxAgeMs: config.workflowRunRetentionMs });
             if (sweep) {
                 wfRunReapInFlight = true;
-                void sweep
+                leg(sweep
                     .then(() => workflowRunReapAllScopesGuard.onSuccess(), workflowRunReapAllScopesGuard.onError)
-                    .finally(() => (wfRunReapInFlight = false));
+                    .finally(() => (wfRunReapInFlight = false)));
             }
             // 1.108: SQL notify-journal retention rides the same knob — ACKED rows are pure history (pending rows are
             // the recovery backlog and are NEVER reaped; the orphan-grace sweep retires a stuck pending run).
-            void workflowNotifyJournal
+            leg(workflowNotifyJournal
                 ?.reapAcked?.(Date.now() - config.workflowRunRetentionMs)
-                .then(() => workflowNotifyJournalReapAckedGuard.onSuccess(), workflowNotifyJournalReapAckedGuard.onError);
+                .then(() => workflowNotifyJournalReapAckedGuard.onSuccess(), workflowNotifyJournalReapAckedGuard.onError));
         }
         // core 1.364 durable bg-agent joint reap(定义在 interval 上方,契约注释在彼)。in-flight 守卫同
         // wfRun sweep(per-scope 串行循环,短 tick + 多 scope 下不叠罗汉)。
         if (reapBgAgents && !bgAgentReapInFlight) {
             bgAgentReapInFlight = true;
-            void reapBgAgents()
+            leg(reapBgAgents()
                 .then(() => bgAgentsReapGuard.onSuccess(), bgAgentsReapGuard.onError)
-                .finally(() => (bgAgentReapInFlight = false));
+                .finally(() => (bgAgentReapInFlight = false)));
         }
         // [1522] MED2:agent_roster TTL 清理(core RB-23②③ 派给部署的半场)——SQL twins 扩展面
         // (reapOlderThan,duck probe;File/Memory 店 core 自带 maxAgeMs,无此面=no-op)。
-        void rosterStore
+        leg(rosterStore
             ?.reapOlderThan?.(Date.now() - config.rosterRetentionMs)
             .then(reapCount("roster_rows_reaped_total", {}))
-            .then(() => rosterReapOlderThanGuard.onSuccess(), rosterReapOlderThanGuard.onError);
+            .then(() => rosterReapOlderThanGuard.onSuccess(), rosterReapOlderThanGuard.onError));
         // 修8(三路复审 absorb-2,接线 (b)):periodic scratchpad sweep — 无 E21 purge 兜到的孤儿目录(session 从未
         // DELETE、purge 当次失败、local 后端无 purge coordinator)按 mtime 过期回收。SCRATCHPAD_SWEEP_TTL_MS
         // (default 7d,0=禁用)。activeSessionIds 不传:活跃判据的诚实边界在 env-facts.ts 的 sweep 文档——TTL 7d
@@ -413,18 +448,40 @@ export function startReapers(ctx) {
         // 库延迟增长,短 REAP_INTERVAL_SEC 下无守卫会逐 tick 叠罗汉压同一批行。
         if (approvalReconciler && !approvalReconcileInFlight) {
             approvalReconcileInFlight = true;
-            void approvalReconciler
+            leg(approvalReconciler
                 .runOnce(Date.now())
                 .then(() => approvalReconcileGuard.onSuccess(), approvalReconcileGuard.onError)
-                .finally(() => (approvalReconcileInFlight = false));
+                .finally(() => (approvalReconcileInFlight = false)));
+        }
+        // A-010.17:规则店的保留期腿。**只删可证已死的行**(过期导入票 + 超期孤儿 pending 记录)——
+        // 谓词、每轮上界、以及「为什么这条腿不需要旋钮」逐字见 `plugins/permission-rule-store-sql.ts`
+        // 的 `reapExpired` / `RULE_REAP_BATCH`。
+        // `?.` 的缺席臂 = File 车道没有这一面(如实登记在 `rules-consent.ts` 的接口注里,不是漏接)。
+        //
+        // 🔴 重入守卫(codex 对抗复审 R2 [high],验真后修):第一版按「两条等值 DELETE,时长不随在飞量增长」
+        // 判定无需守卫 —— 那句话**不成立**。`permission_rule_approval` 按设计永久留审计事实(只增不减),
+        // 而 MySQL 存量库在删库重建之前拿不到新加的清扫索引 ⇒ 这条腿的时长会随**审计史**增长。一旦越过
+        // tick 间隔,下一轮就叠在同一批行上。判据与邻居四腿(attachmentSweep / wfRunReap / bgAgentReap /
+        // worktreeReap)同形。
+        if (!permissionRuleReapInFlight) {
+            permissionRuleReapInFlight = true;
+            leg(permissionRuleStores
+                ?.reapExpired?.(Date.now())
+                .then(reapCount("permission_rules_reaped_total", {}))
+                .then(() => permissionRuleReapGuard.onSuccess(), permissionRuleReapGuard.onError)
+                .finally(() => (permissionRuleReapInFlight = false)));
+            // 店缺席(File 车道 / 关旋钮)⇒ 上面整条求值成 undefined、`finally` 永不跑 ⇒ 守卫要当场归位,
+            // 否则第一轮之后这条腿就被自己的守卫永久锁死(而它本来就该零调用,锁死是静默的)。
+            if (permissionRuleStores?.reapExpired === undefined)
+                permissionRuleReapInFlight = false;
         }
         if (config.scratchpadSweepTtlMs > 0) {
-            void sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
+            leg(sweepStaleScratchpads(config.localDataRoot ?? localRoot, { olderThanMs: config.scratchpadSweepTtlMs })
                 .then((removed) => {
                 if (removed > 0)
                     logger.info("scratchpads_swept", { removed });
             })
-                .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError);
+                .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError));
         }
     }, config.reapIntervalSec * 1000);
     reaper.unref?.();

package/dist/boot/resolve-spec.js

@@ -26,6 +26,7 @@ import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilit
 import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { gateScenarioRequest, mergeUserSkills, selectScenario } from "../capabilities/scenarios.js";
 import { toolPolicyForHands } from "../capabilities/hands-lane.js";
+import { shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane } from "../env-facts.js";
@@ -741,6 +742,18 @@ export function createResolveSpec(ctx) {
             // 件A origin 盖章(#148 件3④):部署形态维随 requirePrincipal——多租户下登记簿种子(projectId
             // 选定)按 request 盖章走 core 准入门,单用户一律 deployment(v4 §1 N2;零 org 键=整键缺席零迁移)。
             memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }) : undefined,
+            // #217(core 5.26.0 提货):部署对「本机能不能把用户的『记住 X』落到持久处」的自我声明,env
+            // `MEMORY_PERSISTENCE_CAPABLE` 三态直通。**部署面旋钮,不开请求键**——恢复 remote lane 的
+            // `# Memory` 写指令是「这条执行车道与记忆根共享挂载」这个部署事实,归 operator 不归调用方表态
+            // (operator-knob 律:部署级旋钮禁挂客户端表态派生腿)。与请求键 `memoryWrite` 两轴正交:后者是
+            // per-run 收紧(writeScope:null),前者是部署声明;任一取否方向即只读方向,客户端永远撑不开
+            // 部署声明的 `false`(core 自己也把 declared false 当 FLOOR:委派转发 tighten-only)。
+            // 三态的 absent 腿 = **整键缺席**(core:「absent = 各自推断」),所以走条件展开而不是赋 undefined。
+            // 🔴 core 5.27.0([3612] F2)起,`false` 还让这次会话成为**受限会话**:按已提交账供给,磁盘上
+            // 无事务背书的分歧不收编不供给(留盘 + `restricted_divergence` 点名)。**受限是会话级的这一个键**,
+            // 与上面 `memoryWrite:false` 铸出的 `writeScope:null` **只读平面**不是一回事 —— 那条平面照旧
+            // adopt-on-read(暂停的只是 harvest)。两轴各自的完整口径见 `config-types.ts` 的字段注。
+            ...(config.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: config.memoryPersistenceCapable } : {}),
             // Scenario-provided capabilities (e.g. code-review = repo tools + reviewer subagents + prompt).
             // RFC A2: the SelectEnvironment tool rides after the scenario's tools (spec.tools is ADDITIVE to core's
             // built-in roster — prepare-task mounts first-party tools separately). Only when the image chain is live.
@@ -1066,6 +1079,24 @@ export function createResolveSpec(ctx) {
         if (governed.handsReadOnly === true && Array.isArray(governed.tools)) {
             governed = { ...governed, tools: stripDelegationTools(governed.tools) };
         }
+        // #217(core 5.26.0 提货,板 [3499]②/[3521]④ 两次点名的 server 接线半场):零记忆面部署形把 core 的
+        // `NO_PERSISTENT_MEMORY_NOTICE` 组进 system prompt(core 导出但**不注入** —— 「组装归宿主」,同
+        // MEMORY_SAFETY 姿势)。判别式与 provider 分腿装配的全部理由在 capabilities/memory-notice.ts。
+        // 🔴 位置即契约:必须在 governance+settings 折完之后 —— `handsReadOnly` 是判别式的一位输入,而它可能
+        // 由 autonomy(governance 拍)或 permissionMode:plan(settings 拍)才被点亮;在阶段④判会漏掉这两条腿。
+        if (shouldDiscloseNoPersistentMemory({
+            memory: governed.memory,
+            declaredCapable: config.memoryPersistenceCapable,
+            hands: gated.hands,
+            handsReadOnly: governed.handsReadOnly === true,
+            excludeTools: governed.excludeTools,
+            // core 的 `isRemoteExecutionEnv` 是鸭子类型判别,我方**所有** `REMOTE_EXEC` 车道(含 `host` ——
+            // remote-env-host.ts 实现了 suspendVM/workspaceHandle/execStream,亲验)都满足它。判别位因此是
+            // 「provider 有没有设」;未设 = in-process(core 拿 StubExecutionEnv,非 remote)。
+            remoteExecutionEnv: config.remoteExec !== undefined,
+        })) {
+            governed = { ...governed, promptProvider: withNoPersistentMemoryNotice(governed.promptProvider) };
+        }
         return { governed, scratchpadDir, hostSemanticsLane };
     };
     /** 阶段⑥(image·envFacts·router):吃 阶段⑤的 governed + scratchpadDir/hostSemanticsLane + 场景名,吐**最终**

package/dist/boot/runner-deps.d.ts

@@ -87,6 +87,20 @@ export interface RunnerDepsCtx {
     /** #154 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleSuggestions` 不铸(诚实缺席)。 */
     permissionRuleStore: RunnerDeps["permissionRuleStore"];
+    /**
+     * 交接件⑤ —— commit 尾注的署名座(`RunnerDeps.hands.commitCoAuthor`)。
+     *
+     * 🔴 为什么它属于**共享基座**而不是主 runner 的差异键:署名是**部署身份**([931]① clay 拍:
+     * 「署名 = 产品身份资产,归部署」),不是「哪一只 Runner 在跑」的属性。一个被委派出去的子代
+     * 提交进的是**同一个仓**、代表的是**同一个部署** —— 它的 commit 少一行 trailer 没有任何理由。
+     * 修前两条腿都漏:`main.ts` 与 `run-local.ts` 的 subRunner 都只在主 runner 上写了这一键,而两处
+     * 的「差异键」注释块逐条列了 sessionStore / checkpointStore / 四个座位,**都没提 hands**
+     * —— 也就是说它不是一次有理由的分歧,是漏配(与本函数头注记的 [1543]§三族A 同一个病族)。
+     * 由**调用方**给值(而不是在基座里按 `config` 现算):两条腿的判据本就不同(HTTP 腿按
+     * `configProvider === "local"` 分 branded/非 branded,run-local 恒是 Sema 本地形),
+     * 各自算一次、传进来一次,两只 Runner 自动同源。
+     */
+    hands: RunnerDeps["hands"];
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
@@ -102,7 +116,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -131,7 +145,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores">;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -50,6 +50,8 @@ export function createSharedRunnerDeps(ctx) {
         // [1070]① agent-team S1:持久名册 seam(具名 spawn advisory 写入;SendMessage 活注册表 miss 后咨询)。
         rosterStore: ctx.rosterStore ? ctx.rosterStore : undefined,
         hooks: ctx.deploymentHooks,
+        // 交接件⑤:署名座进基座 ⇒ 主/sub 两只 Runner 自动同源(理由见 RunnerDepsCtx.hands 的注)。
+        hands: ctx.hands,
         toolResultStore: ctx.toolResultStore,
         // E6: operator-tightened session tool rules — core folds them into the ToolPolicy FIRST (subtract-only) for tasks
         // carrying a sessionId (a delegated subagent has none → inherits no rules). Opt-in: undefined ⇒ no rules read.
@@ -200,10 +202,9 @@ export function createRunnerDeps(ctx) {
         // toolResultStore/sessionPolicyStore —— 共享基座展开,见 createSharedRunnerDeps 头注
         // (含每键各自的历史 rationale 注释,搬到了那个函数里,不在此重复)。
         ...sharedRunnerDeps,
-        // [931]① clay 拍(core 1.300 BREAKING:缺省不署 Co-Authored-By,署名=产品身份资产归部署):
-        // branded 形态(local provider = Sema 产品线,scenarios brandIdentity 同判据)commit 尾注接 Sema 署名;
-        // 非 brand 部署维持 core 新缺省(不署)。seam=RunnerDeps.hands.commitCoAuthor。
-        hands: config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined,
+        // 交接件⑤:`hands` 已随共享基座展开(`...sharedRunnerDeps`)—— 这里**不再**手写同名键,
+        // 否则它会 override 展开、把 subRunner 重新甩开(本文件头注写死的那条:「不要再在任一调用点
+        // 手写同名键」)。判据([931]① branded 才署名)搬到了唯一的取值点 main.ts 的 `commitHands`。
         // design/73 §1 (core 1.226 seam, clay 拍 2026-07-04 接): consume mechanical TaskOutcome facts into the
         // outcome ledger — tidb/pg = SQL rows (coreOutcomeToLedgerRow mapping + verbatim `core_outcome` JSON so
         // red-line ② oracleHadRedRun survives lossless), local = owner-only JSONL. Read-only v1: records facts,
@@ -252,6 +253,13 @@ export function createRunnerDeps(ctx) {
         //  有写路径),这条是纯文档只读面,共享内容永不进注入块/索引、永不落模型可写盘、永不被 harvest。)
         // S3-TOB 复审 F-9(operator 可观测底座):harvest 报告 → metrics(拒收/incident/patch 计数从此可见;
         // core swallow-guard 保证 throwing consumer 不伤边界)。
+        // #231(core 5.27.0 提货,codex 复审 [medium] 验真后修):**拒收码进遥测**。此前本站点只读
+        // `ok`/`incident`/`patches` 三件,而受限会话(`memoryPersistenceCapable:false`)对磁盘分歧的处置
+        // 走的是 `report.inboundFindings`(`ok` 仍是 true、`incident` 缺席)⇒ core 承诺的「响亮点名」在
+        // 我方这一侧**一条日志一个计数都没有**:运维看不到本机上有多少字节因为受限而没被收编。逐 code
+        // 计数(词表是 core 的 `HarvestRejectionCode` 闭集,基数天然有界)+ 一条 warn。
+        // ⚠️ **不打路径**:记忆根下的文件名是用户内容(core 已把逐条 reason 通告给模型那一侧),运维面
+        // 只需要「哪一类、多少条」。计数用 `??` 兜住旧引擎缺席的两个数组(additive 字段,不是 fail-open 分支)。
         onMemoryHarvestReport: memoryEngine
             ? (report, info) => {
                 metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
@@ -259,6 +267,18 @@ export function createRunnerDeps(ctx) {
                     metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
                 if (report.incident)
                     logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
+                const byCode = new Map();
+                for (const r of [...(report.rejections ?? []), ...(report.inboundFindings ?? [])])
+                    byCode.set(r.code, (byCode.get(r.code) ?? 0) + 1);
+                for (const [code, count] of byCode)
+                    metrics.inc("memory_harvest_rejections_total", { phase: info.phase, code }, count);
+                if (byCode.size > 0) {
+                    logger.warn("memory_harvest_rejections", {
+                        phase: info.phase,
+                        // 逐 code 计数(排序固定,便于日志 diff);内容/路径一律不进这条线。
+                        codes: [...byCode].sort(([a], [b]) => (a < b ? -1 : 1)).map(([code, count]) => `${code}=${count}`).join(","),
+                    });
+                }
                 // 142-S2.5-W1: 成功 harvest 真有 patch 落地 = 本地记忆变了 ⇒ fire-and-forget 一轮同步
                 // (trigger 自带 inflight 节流:上一轮在飞则跳过,漏掉的变更下一轮全量补上)。
                 if (memorySyncRunner && report.ok && (report.patches?.add ?? 0) + (report.patches?.update ?? 0) > 0)

package/dist/boot/stores.js

@@ -15,6 +15,7 @@
 import { join } from "node:path";
 import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore } from "@sema-agent/core";
 import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
+import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/memory-engine-pg.js";
 import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugins/memory-engine-tidb.js";
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
@@ -29,6 +30,8 @@ import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentS
 import { createSessionStore } from "../plugins/session-store.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
+import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
+import { buildMemoryWriteBoundaryAudit } from "./memory-boundary.js";
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     // One shared SQL store backend for L1 + L2 (TiDB/MySQL or PostgreSQL per DB_BACKEND). Owned here.
@@ -51,6 +54,20 @@ export async function openStores(ctx) {
     // S5 review LOW-1: always render the series (0 = healthy) — gauge absence is indistinguishable from
     // "old build without this metric", which breaks `== 0`-style alert rules.
     metrics.setGauge("store_backend_degraded", storeBackendDegraded ? 1 : 0);
+    // #119 升级前置断言(core 5.26.0 提货):`CREATE TABLE IF NOT EXISTS` 对**存量** tool_result 是空操作 ⇒
+    // 没删表就升上来的部署,出处两列与加宽的 ref 列都不在,而每一次 offload 写都会撞 unknown column、被
+    // core 的失败臂吞成一条内联占位(服务照跑、工具产物全丢)。判据与恢复动作见
+    // assertToolResultProvenanceSchema 的头注。
+    // 🔴 位置:**不在** `ensureSchema` 里 —— 那条通道的契约是「只发 CREATE」(test/ensure-schema.test.ts 的
+    // 运行时门),一条只读探针进去也算破例。放在 DDL 之后、任何路由装配之前,拒启的意义仍在(还没开始服务)。
+    {
+        const mysqlPool = backend?.mysqlPool?.();
+        const pgPool = backend?.pgPool?.();
+        if (pgPool)
+            await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
+        else if (mysqlPool)
+            await assertToolResultProvenanceSchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
+    }
     // S21 (SILENT-FALLBACK P1): MINIO_* partially set silently falls back to SQL-blob snapshots. Warn on the
     // partial config and always render which backend blobs actually use.
     {
@@ -100,16 +117,44 @@ export async function openStores(ctx) {
                 }
             },
         });
+        // #228:检索档位(lexical|portable|native)是「后端上限 × embedder 在场」的**推断结果**,不是旋钮
+        // ([3590] 裁①)。下面两支各自从**实例的 getter** 读真值——不在这里自己推断,推断出的档与实际跑的档
+        // 一旦分家,启动日志就成了另一句谎([3606]①:lexical 在跑必须运维可见)。
+        let vectorMode;
         if (dialect === "pg") {
             const pool = backend?.pgPool();
             if (!pool)
                 throw new Error("MEMORY_ENGINE_BACKEND=pg requires DB_BACKEND=pg (the memory engine binds the same PG pool) — refusing to start half-configured");
             const q = async (text, params) => { const r = await pool.query(text, params); return { rows: r.rows }; };
+            // ⚠️ 维度守卫的**位置**(诚实记档,不编造对表):这里 ensure schema 不传 `memoryVector`,即 embedding
+            // 列是 `jsonb`(portable 档),schema 侧**没有维度**可与 MEMORY_EMBEDDER_DIM 对表。boot 期能做的
+            // 只有「DIM 是正整数」(config.ts parseMemoryEmbedder);真正的维度守卫在写入路径两处:
+            // ① 本仓 embedder 拿到长度不符的响应直接抛(绝不截断/补零);
+            // ② `PgMemoryEngineBackend.embeddingParam` 对长度不符的向量返回 null,该行退回词面档、不写坏向量。
             await ensurePgMemoryEngineSchema(q);
             await ensurePgMemoryHistorySchema(q);
             await ensurePgMemorySyncSchema(q); // 142-S2.5: sync_cursors(+push_queue)同池 ensure,幂等
             memorySyncCursors = new PgMemorySyncStore(q);
-            const pgMem = new PgMemoryEngineBackend(q, { history: countedHistorySink(new PgMemoryHistoryStore(q)) });
+            // #228:配了 MEMORY_EMBEDDER_*(config 层已把半配/坏值/错后端全拒掉)⇒ 注入,vectorMode 由 lexical
+            // 升到 portable;没配 ⇒ undefined,逐字保持改前行为。
+            // onFailure(codex 复审 F2):embed 抛出去之后,applyPatches 的外层 catch 会把它折成一条
+            // `io error: …` **冲突**(core 的冲突词表把它讲成「并发改动」),search 那腿则直接退回词面档 ——
+            // 两条路都不会在部署面留下「向量供应商挂了」的信号。这条腿就是那个信号(抛照抛,只是被看见)。
+            const embedder = memoryEmbedderFor(config, {
+                onFailure: (err) => {
+                    metrics.inc("memory_embed_failed_total", { backend: dialect });
+                    logger.warn("memory_embedder_failed", {
+                        model: config.memoryEmbedder?.model,
+                        err: String(err).slice(0, 300),
+                        note: "memory writes for this batch report an io-error conflict and retrieval falls back to the lexical floor until the embedder recovers",
+                    });
+                },
+            });
+            const pgMem = new PgMemoryEngineBackend(q, {
+                history: countedHistorySink(new PgMemoryHistoryStore(q)),
+                ...(embedder !== undefined ? { embedder } : {}),
+            });
+            vectorMode = pgMem.vectorMode;
             // 工作面根:DB 形态下 memory/ 目录=per-worker ephemeral 物化区(丢了重建,控制面同);
             // 复用 localDataRoot 下独立子树,绝不与 File backend 的持久 memory/ 混写。
             memoryEngine = { backend: pgMem, root: join(config.localDataRoot ?? localRoot, "memory-work") };
@@ -122,9 +167,24 @@ export async function openStores(ctx) {
             await ensureTiDBMemoryHistorySchema(pool);
             await ensureTiDBMemorySyncSchema(pool); // 142-S2.5: sync_cursors(+push_queue)同池 ensure,幂等
             memorySyncCursors = new TiDBMemorySyncStore(pool);
-            memoryEngine = { backend: new TiDBMemoryEngineBackend(pool, { history: countedHistorySink(new TiDBMemoryHistoryStore(pool)) }), root: join(config.localDataRoot ?? localRoot, "memory-work") };
+            // tidb 记忆后端 v1 无向量档(传 embedder 它自己 fail-loud 拒);config 层已保证 MEMORY_EMBEDDER_*
+            // 只可能与 pg 后端同时在场,所以这一支不注入,恒 lexical。
+            const tidbMem = new TiDBMemoryEngineBackend(pool, { history: countedHistorySink(new TiDBMemoryHistoryStore(pool)) });
+            vectorMode = tidbMem.vectorMode;
+            memoryEngine = { backend: tidbMem, root: join(config.localDataRoot ?? localRoot, "memory-work") };
         }
-        logger.info("memory_engine_enabled", { enabled: true, backend: dialect, multiTenant: config.requirePrincipal === true, workRoot: memoryEngine.root });
+        // embedder 身份(model + dim)一并自报(codex 复审 F1 的**部分**缓解,记档):本仓没有向量指纹列
+        // (要加列 = 动 SQL,超出 #228 单),所以「同维度换模型 ⇒ 旧向量与新查询向量不同空间、排序变噪音」
+        // 这件事在库里查不出来;能做的是把当前跑的模型写进启动日志,让换模型这件事在运维面留痕(USAGE 里
+        // 的对应纪律:换模型/换维度前先清 `agent_memory_engine_entry.embedding`)。
+        logger.info("memory_engine_enabled", {
+            enabled: true,
+            backend: dialect,
+            vectorMode,
+            ...(config.memoryEmbedder !== undefined ? { embedderModel: config.memoryEmbedder.model, embedderDim: config.memoryEmbedder.dimensions } : {}),
+            multiTenant: config.requirePrincipal === true,
+            workRoot: memoryEngine.root,
+        });
     }
     else {
         memoryEngine = memoryEngineBackendFor(config);
@@ -139,6 +199,36 @@ export async function openStores(ctx) {
             });
         }
     }
+    // #214 记忆边界不变式([3492]② 立案):记忆没有写工具 —— 模型是用 fs 工具往记忆根写文件的,所以整条
+    // 「记住 X」链的成立条件是**记忆根落在该次任务的 fs 授权边界内**。判据本体(含为什么是 warn 不是拒启、
+    // 为什么围栏根未知时闭嘴)在 boot/memory-boundary.ts;这里只负责把 boot 期的真事实喂进去。
+    // 围栏根的口径与 resolve-spec 的 fs 写门同源:host 语义车道才有本机围栏可谈 —— `REMOTE_EXEC` 未设的
+    // in-process 形,手就在本进程 cwd 跑;显式 `host` 形取 operator 配的 workspaceBase(没配 = 每任务临时
+    // 目录,boot 期不可知 ⇒ 空数组 ⇒ 不判)。其它车道一律非 host 语义,走 remote 那一臂。
+    {
+        const lane = config.remoteExec?.provider;
+        const hostSemanticsLane = lane === undefined || lane === "host";
+        // core 的 remote 判决(与文件平面是两根轴):`isRemoteExecutionEnv` 是鸭子类型,我方**所有**
+        // REMOTE_EXEC 车道(含 `host` —— remote-env-host.ts 实现了 suspendVM/workspaceHandle/execStream,
+        // 亲验)都满足;未设 provider = in-process(core 拿 StubExecutionEnv)。
+        const coreRemoteExecutionEnv = config.remoteExec !== undefined;
+        // 🔴 codex 复审(medium,已核真):`REMOTE_EXEC=host` 的 `workspaceBase` **不是**任务围栏 —— host
+        // factory 每任务在它下面另铸一个 `sema-host-*` 子目录,而且调用方的 per-session cwd 还能整个换掉它。
+        // 拿 workspaceBase 当围栏,会把「记忆根是真任务目录的**兄弟**」这一形误判成「在围栏内」而闭嘴 ——
+        // 恰恰是本判据要抓的那种坏部署。所以 host 腿一律报**未知**(空数组 ⇒ 不判),只有 in-process 腿
+        // (手就在本进程 cwd 上跑,boot 期这一位是真的)才给围栏根。宁可少说,不可说错。
+        const containmentRoots = lane === undefined ? [process.cwd()] : [];
+        const audit = buildMemoryWriteBoundaryAudit({
+            memoryRoot: memoryEngine?.root,
+            lane: lane ?? "in-process",
+            hostSemanticsLane,
+            coreRemoteExecutionEnv,
+            declaredCapable: config.memoryPersistenceCapable,
+            containmentRoots,
+        });
+        for (const w of audit.warnings)
+            logger.warn(w.tag, { detail: w.detail, lane: lane ?? "in-process", root: memoryEngine?.root ?? null });
+    }
     // RosterStore(agent-team S1 server 半场,[1070]① 提货单;core 1.316 `RunnerDeps.rosterStore`):
     // 具名子 agent 持久名册。形态跟 StoreBackend:tidb/pg=SQL twins(语义三条+真双库验证,
     // roster-store-sql.ts 顶注);local=core FileRosterStore(dataRoot 下 roster.json,core 自带原子写/