@sema-agent/server 7.120.0 → 7.121.0

package/dist/http/routes/runs.js

@@ -1656,7 +1656,7 @@ export async function createDurableRun(req, res, ctx, prepared, idemKey) {
     return resp;
 }
 export const RUNS_ROUTES = [
-    { id: "runs-submit", path: "/v1/runs", billable: true, methods: ["POST"] },
+    { id: "runs-submit", path: "/v1/runs", billable: "submit", methods: ["POST"] },
     { id: "run-steer", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/steer$/, label: "/v1/runs/:id/steer", methods: ["POST"] },
     { id: "run-interrupt", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/interrupt$/, label: "/v1/runs/:id/interrupt", methods: ["POST"] },
     { id: "run-detach", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/detach$/, label: "/v1/runs/:id/detach", methods: ["POST"] },
@@ -1669,7 +1669,7 @@ export const RUN_VERBS_ROUTES = [
     { id: "run-subagent-output", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/output$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"] },
     { id: "run-subagent-stream", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/stream$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["GET"] },
     { id: "run-subagent-steer", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/steer$/, label: "/v1/runs/:id/subagents/:sub/*", methods: ["POST"] },
-    { id: "run-subagent-resume", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/resume$/, label: "/v1/runs/:id/subagents/:sub/*", billable: true, methods: ["POST"] },
+    { id: "run-subagent-resume", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/subagents\/(?<sub>[^/]+)\/resume$/, label: "/v1/runs/:id/subagents/:sub/*", billable: "resume", methods: ["POST"] },
     { id: "run-task-output", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/tasks\/(?<tid>[^/]+)\/output$/, label: "/v1/runs/:id/tasks/:tid/*", methods: ["GET"] },
     { id: "run-task-stop", pattern: /^\/v1\/runs\/(?<runId>[^/]+)\/tasks\/(?<tid>[^/]+)\/stop$/, label: "/v1/runs/:id/tasks/:tid/*", methods: ["POST"] },
     { id: "elicitation-respond", pattern: /^\/v1\/elicitations\/(?<id>[^/]+)\/respond$/, label: "/v1/elicitations/:id/respond", methods: ["POST"] },

package/dist/http/routes/side-query.d.ts

@@ -17,7 +17,7 @@ export declare function handleSideQuery(req: IncomingMessage, res: ServerRespons
 export declare const SIDE_QUERY_ROUTES: readonly [{
     readonly id: "side-query";
     readonly path: "/v1/side-query";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */

package/dist/http/routes/side-query.js

@@ -133,6 +133,6 @@ export async function handleSideQuery(req, res, match, ctx) {
     }
 }
 export const SIDE_QUERY_ROUTES = [
-    { id: "side-query", path: "/v1/side-query", billable: true, methods: ["POST"] },
+    { id: "side-query", path: "/v1/side-query", billable: "submit", methods: ["POST"] },
 ];
 //# sourceMappingURL=side-query.js.map

package/dist/http/routes/tasks.d.ts

@@ -25,12 +25,12 @@ export declare function handleTasks(req: IncomingMessage, res: ServerResponse, m
 export declare const TASKS_ROUTES: readonly [{
     readonly id: "tasks-submit";
     readonly path: "/v1/tasks";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }, {
     readonly id: "tasks-submit-stream";
     readonly path: "/v1/tasks/stream";
-    readonly billable: true;
+    readonly billable: "submit";
     readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */

package/dist/http/routes/tasks.js

@@ -639,7 +639,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
+                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope({ sessionId: prepared.spec.sessionId, taskId: durableTaskId }, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {
@@ -901,7 +901,7 @@ export async function handleTasks(req, res, match, ctx) {
     }
 }
 export const TASKS_ROUTES = [
-    { id: "tasks-submit", path: "/v1/tasks", billable: true, methods: ["POST"] },
-    { id: "tasks-submit-stream", path: "/v1/tasks/stream", billable: true, methods: ["POST"] },
+    { id: "tasks-submit", path: "/v1/tasks", billable: "submit", methods: ["POST"] },
+    { id: "tasks-submit-stream", path: "/v1/tasks/stream", billable: "submit", methods: ["POST"] },
 ];
 //# sourceMappingURL=tasks.js.map

package/dist/http/server.d.ts

@@ -649,8 +649,6 @@ export interface ServiceGovernanceDeps {
      *  「诊断说亮、位说暗」。缺席(桩/一次性 CLI)⇒ 读面如实答 `deployment_incapable`。 */
     autoModeFace?: import("../auto-mode-face.js").AutoModeFaceDeps;
 }
-/** **部署自述面**:只被 /health、/v1/capabilities 与提交前置门读的部署事实(多为 live getter,
- *  不是快照——/health 必须回答「此刻」)。 */
 export interface ServiceDeploymentDeps {
     /** Stable per-process id recorded on runs (audit / stale recovery). */
     instanceId?: string;
@@ -687,15 +685,10 @@ export interface ServiceDeploymentDeps {
      *    (= 引擎附着租约集的大小)。消费方是 `boot/engine-lease.ts` 的自退判据;与 `inflight` 同族,
      *    同一个共享盒子,不另开第二条 main↔server 的通道。
      */
-    drainState?: {
-        draining: boolean;
-        since?: number;
-        reason?: string;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    drainState?: import("../fleet/drain-entry.js").DrainState;
+    /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端
+     *  (非 fleet 成员 / 没接中心 / 测试夹具)⇒ `none`(与没有租约的引擎逐字同)。 */
+    servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;
     /** boot ready 门(b):false = 布防(`CONFIG_REQUIRE_ROSTER=true`)且首次 effective pull 尚未落 roster
      *  (worker 只有占位模型)。就绪原因 `model_roster_pending`(`http/readiness.ts`):计费提交 503 + `/readyz` 503 +
      *  /health 加性 `ready:false`。absent = 恒 ready(未布防 / 非 registry 部署),现有部署零影响。config-center 的
@@ -722,6 +715,9 @@ export interface ServiceDeploymentDeps {
      *  (`boot/stage-10-http-server.ts` → `modelRefusals: () => deployment.modelRefusalsState?.()`)—— 一处铸、两出口。缺席 / 返回 undefined =
      *  没有可报的拒或没有配置管道 ⇒ `/health` 形状逐字不变(additive)。 */
     modelRefusalsState?: () => import("@sema-agent/settings-schema").ModelRefusalsSignal | undefined;
+    /** `/health.configHandoff`(只上 `/health`):在场 ⇔ 部署声明了耐久接力 ∧ 应用着的那一代没被确认(config-center 接力账的 `configHandoffState()`;合成律
+     *  `fleet/engine-signal.ts` 的 `buildConfigHandoff`)。缺席 / 返回 undefined = 有接力、没有中心或本地腿 ⇒ 键缺席。 */
+    configHandoffState?: () => import("../fleet/engine-signal.js").ConfigHandoff | undefined;
     /** [ref] 追加件:`POST /v1/admin/config/refresh` 的实现面 —— 触发**一次既有**的 refresh 拍(在飞则 join)。
      *  缺席 / 回 `"not-wired"` = 本部署没有配置管道 ⇒ 该口诚实 4xx(绝不吞成 200)。 */
     configRefreshNow?: () => Promise<"triggered" | "not-wired" | "failed">;
@@ -739,16 +735,6 @@ export interface ServiceDeploymentDeps {
     mcpRevocationState?: () => {
         revoked: string[];
     } | undefined;
-    /** codex R18: the persistent "retained WITHOUT a next-boot handoff" state — a candidate whose restart signal is
-     *  withheld because no restart-surviving handoff exists yet (durable-declared LKG publication incomplete, or a
-     *  boot skills debt not yet proven repairable). Surfaced on /health (`modelPlaneDeferred` — the key keeps its birth
-     *  name: it was born for the model-plane deferral, which retired with the `models-tiers` slice in S-668 波 0) so
-     *  the stuck state outlives the one-shot warn (the etag advances → later ticks 304). */
-    planeDeferredState?: () => {
-        version: number;
-        since: number;
-        blocked?: string[];
-    } | undefined;
     /** B1(鲁棒性批3 设计件):后台**缓存**探针的读座——/health 绝不逐请求打 DB(center/k8s 高频面),
      *  main.ts 只在 SQL 后端(backend.kind !== "local")挂环(createStoreLiveProbe,STORE_PROBE_INTERVAL_MS)。
      *  缺席(local/memory/探针关)= /health 形状不变;接线 = `storeProbe{live,ageMs,error?}` 恒在

package/dist/http/server.js

@@ -31,6 +31,23 @@ export { routeLabel, isBillableSubmitPath, isCredentialGatedRewrite, isMethodDis
 export { MAX_SKILL_CONTENT_CHARS, MAX_SYSTEM_PROMPT_CHARS, MAX_OUTPUT_SCHEMA_CHARS, validateUserSkills };
 import { explicitOperatorOk, isOperator } from "./principal-gate.js";
 export { explicitOperatorOk, isOperator };
+class DrainYieldingPreemptBook extends Map {
+    drainingNow;
+    constructor(drainingNow) {
+        super();
+        this.drainingNow = drainingNow;
+    }
+    set(taskId, ctrl) {
+        super.set(taskId, ctrl);
+        if (this.drainingNow())
+            ctrl.abort();
+        return this;
+    }
+    yieldAll() {
+        for (const ctrl of this.values())
+            ctrl.abort();
+    }
+}
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
     if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
@@ -44,7 +61,7 @@ export function createHttpServer(rawDeps) {
     }
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
-    const preemptableRuns = new Map();
+    const preemptableRuns = new DrainYieldingPreemptBook(() => deps.drainState?.draining === true);
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
     const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
@@ -58,6 +75,8 @@ export function createHttpServer(rawDeps) {
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
+    if (deps.drainState)
+        deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
         deps.hookWakeBus.deliver = async (sessionId, text) => {
             try {

package/dist/http/wire-types.d.ts

@@ -6,7 +6,7 @@
  * cut: ONLY TaskRequestBody (its field types are inline or core imports — no other server.ts-local satellites);
  * sibling request/response shapes can migrate here later on the same pattern.
  */
-import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec } from "@sema-agent/core";
+import type { A2aServerSpec, AgentDefinition, ApprovalReach, McpServerSpec, PermissionMode, SkillSpec, TaskSpec } from "@sema-agent/core";
 import type { wiringManifestFaceEventData } from "../trace/project.js";
 import type { buildSyncSubmitBody } from "./sync-submit-body.js";
 export interface TaskRequestBody {
@@ -63,6 +63,12 @@ export interface TaskRequestBody {
      *  question (raised on the board). Rejected fail-loud when `systemPrompt` is an already-assembled prompt
      *  (anchors detected) — that assembler arm cannot mount the rider (silent drop would belie the capability bit). */
     appendSystemPrompt?: string;
+    /** 7.121.0:输出风格的**每轮一句**(引擎 `TaskSpec.outputStyle`,core 7.39.0 起):原样投给引擎,引擎在每个附件周期用自己的标记帧陈述
+     *  `"<name> output style is active. <turnReminder>"`(`turnReminder` 缺席 ⇒ 引擎的缺省句),回声为 `steering_injected` `source:"output_style"`。
+     *  **一个事实一个座位**:风格的**正文**(指南全文)走 `settings.outputStyle`(折进 `appendSystemPrompt` 那一块),这里只放名字与每轮那一句;
+     *  只在非缺省风格时声明。值形的属主是引擎(`{ name, turnReminder? }` 恰两键、`name` 非空且 ≤ `OUTPUT_STYLE_NAME_MAX`、`turnReminder` 在场即非空串):
+     *  本服务**不另判**,坏值在 prepare 被引擎拒 `config.output_style_invalid`(不会被静默忽略)。能力位 `outputStyle`。 */
+    outputStyle?: TaskSpec["outputStyle"];
     /** Explicit model selection (CLI `/model` picker + `run --model <ref>`). An INTENT by catalog
      *  name (e.g. "deepseek-pro") — resolveSpec gates it against the SAME allow-list as an inline `@name` mention
      *  (config.models keys), so it picks WHICH configured model but can never inject one. Wins over an inline

package/dist/model-reach-scope.d.ts

@@ -3,7 +3,8 @@
  *
  * 两层,一只 `AsyncLocalStorage`:
  *  · **腿层**(`withModelReachScope`,三条带用户面投递口的 run 腿各包一次:流式 `POST /v1/tasks/stream`、后台 `POST /v1/runs`、续跑):
- *    带着这条腿的 `sessionId`(通告归属键)与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);
+ *    带着这条腿的两枚身份 —— `sessionId`(通告归属键)与 `taskId`(这条腿的 run 资源 id,= 本腿交给引擎的 `spec.taskId`;7.121.0)——
+ *    与本腿已经说过的目标集合(去重单位 = 每腿每目标一次);
  *  · **调用层**(`createModelReachBrain` 每次模型调用包一次):一只可变的 {@link ModelCallReach},出网观察者
  *    (`outbound-dispatcher.ts` 的 undici 诊断通道订阅)把这次调用发出的每一条请求的**结局**记在上面 —— 最后一条是
  *    「连上了、有了回答」还是「建连就失败了」。
@@ -33,6 +34,12 @@ export interface ModelCallReach {
 /** 一条 run 腿的作用域。 */
 export interface ModelReachLegScope {
     readonly sessionId: string;
+    /**
+     * 7.121.0:这条腿的 **run 资源 id** —— 与本腿交给引擎的 `spec.taskId` 同值(流式腿 = `X-Task-Id` / `meta.taskId`,后台腿 = 提交回执的
+     * `taskId`,续跑腿 = 被续的那条 run 行 id)。缺席 = 这条腿没有 run 资源(没有 run 店的部署上的流式腿)。不是引擎的 run 身份
+     * (`TaskResult.runId`,每次 prepare 一铸)—— 那一枚在模型调用这一层读不到。
+     */
+    readonly taskId?: string;
     /** 本腿已经通告过的目标(`targetHost`)—— 去重单位 = 每腿每目标一次。 */
     readonly announced: Set<string>;
 }
@@ -43,9 +50,14 @@ export interface ModelReachStore {
 export declare const modelReachContext: AsyncLocalStorage<ModelReachStore>;
 /**
  * 腿层入口:每条腿都开**自己的**作用域 —— `sessionId` 缺席(无会话腿)⇒ 空作用域(没有归属键就没有用户面可投;也不继承外层腿的
- * 归属键 —— codex r1 旁注:修前缺席即原样执行、会沿用外层腿)。嵌套时内层覆盖外层 —— 归属跟着「这一轮是谁的腿」走。
+ * 归属键 —— codex r1 旁注:修前缺席即原样执行、会沿用外层腿)。嵌套时内层覆盖外层 —— 归属跟着「这一轮是谁的腿」走,两枚身份一起走
+ * (内层没有 run 资源就是没有,不借外层的)。两键都是**必填形参**(值可 `undefined`):三个调用点各自说清这条腿有没有 run 资源,
+ * 漏传一枚 = 编译红,不会静默变成「没有」。
  */
-export declare function withModelReachScope<T>(sessionId: string | undefined, fn: () => T): T;
+export declare function withModelReachScope<T>(leg: {
+    readonly sessionId: string | undefined;
+    readonly taskId: string | undefined;
+}, fn: () => T): T;
 /** 调用层入口(`createModelReachBrain` 用):在当前腿作用域(可能缺席)之上开一只新的调用观察。 */
 export declare function withModelCallReach<T>(call: ModelCallReach, fn: () => T): T;
 /** 观察者读口:当前异步上下文里的模型调用观察(作用域外 ⇒ `undefined`)。 */

package/dist/model-reach-scope.js

@@ -1,7 +1,8 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 export const modelReachContext = new AsyncLocalStorage();
-export function withModelReachScope(sessionId, fn) {
-    return modelReachContext.run(sessionId === undefined || sessionId.length === 0 ? {} : { leg: { sessionId, announced: new Set() } }, fn);
+export function withModelReachScope(leg, fn) {
+    const { sessionId, taskId } = leg;
+    return modelReachContext.run(sessionId === undefined || sessionId.length === 0 ? {} : { leg: { sessionId, ...(taskId !== undefined && taskId.length > 0 ? { taskId } : {}), announced: new Set() } }, fn);
 }
 export function withModelCallReach(call, fn) {
     const outer = modelReachContext.getStore();

package/dist/model-unreachable-notice.d.ts

@@ -20,7 +20,8 @@
  * 没有归属键 ⇒ 不铸(运维日志 `outbound_connect_failed` 照有)。腿里的**辅助**调用(WebFetch 摘要器、压实、提示建议、分类器 …)与
  * 主循环**同一条规则**:本帧说的是「这个模型端点够不着」,不是「这条 run 失败了」(措辞如此,不暗示终态);不设豁免名单 —— codex r1 / r2
  * 两轮证明豁免名单结构上开放(core 自己发起的辅助调用本仓包不到)。按 **run 终态**归属是另一种设计,候裁(收车档 ⑤)。去重单位 = **每腿每目标一次**(同一条腿里
- * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId }` ——
+ * 重试 / 子代对同一个网关再失败,不再说一遍)。受众 user;detail = `{ code, targetHost, proxyInUse?, remedy, sessionId, taskId? }` ——
+ * `taskId`(7.121.0)= 这条腿的 run 资源 id,腿没有 run 资源时缺席;引擎的 run 身份 `runId` 在这一层读不到,本码不带 ——
  * `proxyInUse` 只在这一跳走了代理时在场,且只是**变量名**(代理地址是基础设施细节,不上租户 wire,与 `OutboundProxyError` 的
  * F3 裁定同一条)。`targetHost`(模型端点的 `host:port`)对 user 受众是**新披露的部署事实**(F7 裁定:它是部署自己声明的模型端点,
  * 不是基础设施秘密,可以上;代理地址仍不上)—— 不要读成「终局句里本就有」:代理形下终局句只带码与 `via outbound proxy (from <变量>)`、不含任何主机地址,

package/dist/model-unreachable-notice.js

@@ -17,6 +17,7 @@ function announceModelUnreachable(leg, failure, router = defaultEngineNoticeRout
             ...(failure.proxyInUse !== null ? { proxyInUse: failure.proxyInUse } : {}),
             remedy: MODEL_UNREACHABLE_REMEDY,
             sessionId: leg.sessionId,
+            ...(leg.taskId !== undefined ? { taskId: leg.taskId } : {}),
         },
         sessionId: leg.sessionId,
     });

package/dist/observability/fail-open.d.ts

@@ -398,6 +398,22 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "P-DEBT";
         readonly note: "7.120.0(`config-lkg.ts` 的 `landedPathOf`,`lkgReadDenyRows` 每次铸部署姿态座席时调;detail = `segment=<那一段的路径>`):`CONFIG_LKG_PATH` 覆写路径上有一段**目录在、却解不开**(悬空符号链接 / 链接环 / 读不了的目录:`realpath` 失败而 `lstat` 不说「不存在」)⇒ 这一段之下 LKG 真正会落在哪说不出来,读拒行只剩声明的拼写那一行(照旧在),真实落点那一行缺席。段**不存在**(`ENOENT` / `ENOTDIR`:还没建出来)是常态,不进这一臂;末段(文件本身)是悬空链接也不进(落盘的 rename 换掉的是那条目录项,文件就落在声明的拼写上)。归 P 的理由:这一行守的是 LKG 文件(含凭据),链接之后通了、LKG 写到链接目标下,模型按目标路径读得到它,直到重启重铸座席。归 DEBT 的理由:引擎没有「锚定单文件」的读拒行、座席只在 Runner 构造时铸一次,本服务说不出将来的落点;拿文件名在任意深度拒会把用户仓里同名文件一并挡掉。计数非零 = 去看 detail 点名的那一段(链接指向哪、卷挂了没有),修好后重启。";
     };
+    readonly "server.fleet.serving-lease-unconfirmed": {
+        readonly cls: "P-DEBT";
+        readonly note: "7.121.0 修复轮(`fleet/serving-lease.ts` 的 `renewOnce`,租约生效时每一次续租;detail = `worker=<w> generation=<g> why=<不可达句 | verdict=unknown>`):中心这一次**没有确认**本实例该不该服务 —— 不可达 / 超时 / 非 2xx / 答复读不成判决,或答 `unknown`(此刻没有本实例的生命周期对象)。按设计**什么都不改**(规则 2 第三臂):到期之前照常 `granted`,过期后 `expired` 照常接单,直到过期满 `FLEET_LEASE_OUTAGE_MAX_MS` 才拒新工作。放行的最坏后果 = 一只其实已被取代的实例在中心失联期间多服务至多「租约剩余 + `T_max`」(中心的代际下限持久,恢复后第一次续租即拒);不放行的代价是中心抖一下整队停服。归 P 类:围栏轴,最坏后果是作业完整性(被取代的实例多服务),不是难看;归 DEBT:容忍规则本身(`T_max` 的取值与去抖)待裁定,收口条件 = 那次裁定落地。计数持续非零 = 中心长时间没确认本实例,去看 detail 的 why(连不上 / 中心不认识这只实例)。";
+    };
+    readonly "server.fleet.serving-lease-capability-absent": {
+        readonly cls: "P-DEBT";
+        readonly note: "7.121.0 修复轮(`fleet/serving-lease.ts` 的 `noteCenterCapabilities`;fleet 成员每一次中心能力读数;detail = `worker=<w> generation=<g> was=<enabled|none>`):中心答复体读得出、却**没有宣告** `servingLease`(老中心 `{ ok: true }` / 降级中心 / 位撤掉)⇒ 规则 1:租约不生效,`leaseState: none`,零续租、零 503 —— 这只 fleet 成员此刻**不受围栏**。答复体读不出不进这一臂(那是「没有读数」,上一次的位与钟原样,`fleet-client.ts` `capabilityReadingOf`);已被拒的实例不进(拒是黏的,位消失不复活)。放行的最坏后果 = 中心不执行围栏期间,一只被取代的实例照常服务;不放行的代价是老中心 / 降级中心下所有成员在第一次续租就失败。归 P 类:围栏轴,成员此刻不受围栏;归 DEBT:能力门控是契约规则(中心不宣告 = 不执行),收口条件 = 租约容忍规则的那次裁定(含「位从有到无再到有」的去抖)落地。计数非零 = 这台中心没宣告租约能力。";
+    };
+    readonly "server.fleet.announce-reply-unreadable": {
+        readonly cls: "P-DEBT";
+        readonly note: "7.121.0 修复验证轮(`fleet-client.ts` 的公告环,fleet 成员每一拍心跳 2xx 答复;detail = `why=<body|not-an-object|invalid-capabilities> leaseState=<此刻的租约态>`):答复不是能力读数(体读不出 / 不是对象 / `capabilities` 键在场而形坏 —— settings-schema 9.0.0 `readCapabilityReading` 的 `unreadable`,外加本仓的 `body`)⇒ 当作没有这一拍答复,租约的状态与钟原样。**一律**计数(不论租约生效与否):租约还没生效(`leaseState=none`)时这只成员**一直不受围栏**,而修前这一形零计数(中心每拍答 `<html>` ⇒ 成员恒 none、零痕迹);租约已生效时计数说明中心的答复在坏、围栏靠的是上一次读数。归 P 类:围栏轴;归 DEBT:本进程判不出中心为什么答坏体,收口条件 = 中心契约 / 监控(中心侧对心跳答复形的执法)落地。每段连拍另有一行 warn `fleet_announce_reply_unreadable`(带 `why`)。";
+    };
+    readonly "server.fleet.denied-marker-unpersisted": {
+        readonly cls: "P-DEBT";
+        readonly note: "7.121.0(`fleet/serving-lease.ts` 的 `enterDenied`,中心以正面证据拒了本实例的服务租约那一拍;detail = `worker=<w> generation=<g>`):拒要落成数据根下一只文件(重启后起步即排空),而这一次**没落下** —— 没有数据根,或写失败(盘满 / 只读挂载 / 目录不在)。本进程照样被拒、照样当拍排空、到期自停;放行的是**重启之后**:同代际重启的实例不记得被拒,在第一次续租得到答复之前会接新工作(中心宣告了能力位时,第一次续租就再被拒一次 —— 中心的代际下限是持久的;中心那时不可达则一直接单到过期满 `FLEET_LEASE_OUTAGE_MAX_MS`)。归 P 类:这是围栏的记忆;归 DEBT:进程内无法把「记不住」变成 fail-closed(起步不接单直到第一次答复,是对租约不可达容忍规则的改动,另案)。denied 行的 `sticky` 同拍说 `process-only`,不声称跨重启记得。计数非零 = 这台机器的数据根写不进,或部署没有数据根。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -371,6 +371,22 @@ export const FAIL_OPEN_TAGS = {
         cls: "P-DEBT",
         note: "7.120.0(`config-lkg.ts` 的 `landedPathOf`,`lkgReadDenyRows` 每次铸部署姿态座席时调;detail = `segment=<那一段的路径>`):`CONFIG_LKG_PATH` 覆写路径上有一段**目录在、却解不开**(悬空符号链接 / 链接环 / 读不了的目录:`realpath` 失败而 `lstat` 不说「不存在」)⇒ 这一段之下 LKG 真正会落在哪说不出来,读拒行只剩声明的拼写那一行(照旧在),真实落点那一行缺席。段**不存在**(`ENOENT` / `ENOTDIR`:还没建出来)是常态,不进这一臂;末段(文件本身)是悬空链接也不进(落盘的 rename 换掉的是那条目录项,文件就落在声明的拼写上)。归 P 的理由:这一行守的是 LKG 文件(含凭据),链接之后通了、LKG 写到链接目标下,模型按目标路径读得到它,直到重启重铸座席。归 DEBT 的理由:引擎没有「锚定单文件」的读拒行、座席只在 Runner 构造时铸一次,本服务说不出将来的落点;拿文件名在任意深度拒会把用户仓里同名文件一并挡掉。计数非零 = 去看 detail 点名的那一段(链接指向哪、卷挂了没有),修好后重启。",
     },
+    "server.fleet.serving-lease-unconfirmed": {
+        cls: "P-DEBT",
+        note: "7.121.0 修复轮(`fleet/serving-lease.ts` 的 `renewOnce`,租约生效时每一次续租;detail = `worker=<w> generation=<g> why=<不可达句 | verdict=unknown>`):中心这一次**没有确认**本实例该不该服务 —— 不可达 / 超时 / 非 2xx / 答复读不成判决,或答 `unknown`(此刻没有本实例的生命周期对象)。按设计**什么都不改**(规则 2 第三臂):到期之前照常 `granted`,过期后 `expired` 照常接单,直到过期满 `FLEET_LEASE_OUTAGE_MAX_MS` 才拒新工作。放行的最坏后果 = 一只其实已被取代的实例在中心失联期间多服务至多「租约剩余 + `T_max`」(中心的代际下限持久,恢复后第一次续租即拒);不放行的代价是中心抖一下整队停服。归 P 类:围栏轴,最坏后果是作业完整性(被取代的实例多服务),不是难看;归 DEBT:容忍规则本身(`T_max` 的取值与去抖)待裁定,收口条件 = 那次裁定落地。计数持续非零 = 中心长时间没确认本实例,去看 detail 的 why(连不上 / 中心不认识这只实例)。",
+    },
+    "server.fleet.serving-lease-capability-absent": {
+        cls: "P-DEBT",
+        note: "7.121.0 修复轮(`fleet/serving-lease.ts` 的 `noteCenterCapabilities`;fleet 成员每一次中心能力读数;detail = `worker=<w> generation=<g> was=<enabled|none>`):中心答复体读得出、却**没有宣告** `servingLease`(老中心 `{ ok: true }` / 降级中心 / 位撤掉)⇒ 规则 1:租约不生效,`leaseState: none`,零续租、零 503 —— 这只 fleet 成员此刻**不受围栏**。答复体读不出不进这一臂(那是「没有读数」,上一次的位与钟原样,`fleet-client.ts` `capabilityReadingOf`);已被拒的实例不进(拒是黏的,位消失不复活)。放行的最坏后果 = 中心不执行围栏期间,一只被取代的实例照常服务;不放行的代价是老中心 / 降级中心下所有成员在第一次续租就失败。归 P 类:围栏轴,成员此刻不受围栏;归 DEBT:能力门控是契约规则(中心不宣告 = 不执行),收口条件 = 租约容忍规则的那次裁定(含「位从有到无再到有」的去抖)落地。计数非零 = 这台中心没宣告租约能力。",
+    },
+    "server.fleet.announce-reply-unreadable": {
+        cls: "P-DEBT",
+        note: "7.121.0 修复验证轮(`fleet-client.ts` 的公告环,fleet 成员每一拍心跳 2xx 答复;detail = `why=<body|not-an-object|invalid-capabilities> leaseState=<此刻的租约态>`):答复不是能力读数(体读不出 / 不是对象 / `capabilities` 键在场而形坏 —— settings-schema 9.0.0 `readCapabilityReading` 的 `unreadable`,外加本仓的 `body`)⇒ 当作没有这一拍答复,租约的状态与钟原样。**一律**计数(不论租约生效与否):租约还没生效(`leaseState=none`)时这只成员**一直不受围栏**,而修前这一形零计数(中心每拍答 `<html>` ⇒ 成员恒 none、零痕迹);租约已生效时计数说明中心的答复在坏、围栏靠的是上一次读数。归 P 类:围栏轴;归 DEBT:本进程判不出中心为什么答坏体,收口条件 = 中心契约 / 监控(中心侧对心跳答复形的执法)落地。每段连拍另有一行 warn `fleet_announce_reply_unreadable`(带 `why`)。",
+    },
+    "server.fleet.denied-marker-unpersisted": {
+        cls: "P-DEBT",
+        note: "7.121.0(`fleet/serving-lease.ts` 的 `enterDenied`,中心以正面证据拒了本实例的服务租约那一拍;detail = `worker=<w> generation=<g>`):拒要落成数据根下一只文件(重启后起步即排空),而这一次**没落下** —— 没有数据根,或写失败(盘满 / 只读挂载 / 目录不在)。本进程照样被拒、照样当拍排空、到期自停;放行的是**重启之后**:同代际重启的实例不记得被拒,在第一次续租得到答复之前会接新工作(中心宣告了能力位时,第一次续租就再被拒一次 —— 中心的代际下限是持久的;中心那时不可达则一直接单到过期满 `FLEET_LEASE_OUTAGE_MAX_MS`)。归 P 类:这是围栏的记忆;归 DEBT:进程内无法把「记不住」变成 fail-closed(起步不接单直到第一次答复,是对租约不可达容忍规则的改动,另案)。denied 行的 `sticky` 同拍说 `process-only`,不声称跨重启记得。计数非零 = 这台机器的数据根写不进,或部署没有数据根。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/plugins/one-time-migrations.js

@@ -617,7 +617,7 @@ function removedRuleRowNote(kind) {
         case "rule":
             return "a persisted permission rule whose project scope root is not a complete absolute path was removed by a one-time migration: the current engine drops such a row on every read (it protected nothing) and refuses any write naming that scope, so it could not be revoked through DELETE /v1/rules; re-add it with the project's full path if it is still wanted";
         case "revoked-rule":
-            return "a persisted permission rule whose project scope root is not a complete absolute path, and which had already been revoked (every approval behind it is removed by a tombstone in the same bucket), was removed by a one-time migration: it granted nothing before and grants nothing now — the revocation stands, no action needed";
+            return "a persisted permission rule row whose project scope root is not a complete absolute path, and which had no live approval left (every approval behind it was already removed, or it never had one), was removed by a one-time migration: the row took effect nowhere before and takes effect nowhere now — no action needed";
         case "tombstone":
             return "a revocation record (tombstone) whose project scope root is not a complete absolute path was removed by a one-time migration: it can only cover rules with that same scope, which were removed with it or were never there, so nothing it revoked comes back — no action needed";
         default: {

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -417,7 +417,8 @@ export declare const RULE_REAP_BATCH = 500;
  *
  * `kind` 是闭集(启动日志按它穷尽分句,`one-time-migrations.ts` `logOneTimeMigrations`):
  *  · `rule` —— 仍有活 add 的规则行(引擎读侧每跑一次丢它并告知;它从未生效,要的话按项目的完整路径重写);
- *  · `revoked-rule` —— 每个 add 都已被同桶墓碑撤掉的规则行(判活用 core 的 `applyTombstones`):它什么都不授予,人的撤销照旧成立,无需处置;
+ *  · `revoked-rule` —— 没有活 add 的规则行(判活用 core 的 `applyTombstones`:每个 add 都已被同桶墓碑撤掉,或这一行本来就没有 add):它在任何一侧都已不生效
+ *    (allow / deny / ask 同判),无需处置;逐行 warn 的句子只说这个事实,不依赖桶里有没有墓碑、也不依赖态;
  *  · `tombstone` —— 一条撤销记录。它只盖得住同 (behavior, 文本, scope) 的规则 ⇒ 那些规则的 scope 与它同样不被收,随它一起删了或本来就不在,
  *    删它不会让任何被撤销的东西回来。
  */

package/dist/plugins/remote-env-device.js

@@ -5,7 +5,6 @@ export const DEVICE_PROVIDER = "device";
 const ok = (value) => ({ ok: true, value });
 const STREAM_PENDING_MAX_BYTES = 2 * 1024 * 1024;
 const STREAM_PENDING_MAX_ENTRIES = 8192;
-const VERIFY_FIRST = "may have already executed on the target; verify its effect before re-running";
 export const DEVICE_OUTCOME_TO_FILE_ERROR = {
     aborted: "aborted",
     already_exists: "already_exists",

package/dist/request-key-closure.js

@@ -23,7 +23,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "disableSkills", "enableFork",
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
-    "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
+    "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",

package/dist/rules-consent.d.ts

@@ -510,9 +510,13 @@ export type DurableRuleScope = Exclude<RuleScope, {
  *  客户端会无限重试)、引擎读侧丢(撤销口删不动),一条规则在两侧是两种命运。存量的那种行由一次性迁移 M11 删
  *  (`plugins/one-time-migrations.ts` 登记表)。 */
 export declare function parseRuleScope(text: string): DurableRuleScope | undefined;
-/** 引擎不收的 scope(或 cc-import 层 root)的**唯一一句**拒句:写 / 撤 / 列举过滤三个路由口、cc-import 预览的层 root、local-import 的成员拒因
- *  `scope_unreadable` 都出站这一只(各口的码照旧各自的),不在读点各抄一份。 */
+/** 引擎不收的 scope 的**唯一一句**拒句:写 / 撤 / 列举过滤三个路由口、local-import 的成员拒因 `scope_unreadable` 都出站这一只
+ *  (各口的码照旧各自的),不在读点各抄一份。cc-import 预览的层 root 判据是同一只(`isValidDurableScope`),但那份体里没有 scope 字段,
+ *  拒句另由 {@link buildCcImportLayerRootRefusal} 铸。 */
 export declare const RULE_SCOPE_REFUSAL_SENTENCE = "scope must be 'global' or 'project:<root>' with an absolute root";
+/** cc-import 预览里第 `layerIndex` 层的 root 不是引擎收的绝对路径时的拒句 —— 点名这份体里真有的字段与层号(体里没有 scope 字段,
+ *  不回 {@link RULE_SCOPE_REFUSAL_SENTENCE})。判据与上面三个入口是同一只谓词,所以「absolute」是同一个词;句子只此一处铸,路由不手拼。 */
+export declare function buildCcImportLayerRootRefusal(layerIndex: number): string;
 /** 一条规则在 wire 上的行 = 一个逻辑 (rule, scope) 对([ref] v2 §6 F5)。
  *  `adds` **如实上 wire**、不折叠成单值:同一条规则可以被批准过多次(不同 dot、不同来源、不同时刻),
  *  折成「一个 addedAt」会让「这条规则是我导入的还是我点过卡的」在治理面上不可分。 */

package/dist/rules-consent.js

@@ -61,6 +61,9 @@ export function parseRuleScope(text) {
     return isValidDurableScope(scope) ? scope : undefined;
 }
 export const RULE_SCOPE_REFUSAL_SENTENCE = "scope must be 'global' or 'project:<root>' with an absolute root";
+export function buildCcImportLayerRootRefusal(layerIndex) {
+    return `layers[${layerIndex}].root must be an absolute path`;
+}
 export function sameWireRuleIdentity(row, identity) {
     return row.behavior === identity.behavior && row.rule === identity.rule && row.scope === identity.scope;
 }

package/dist/runs.js

@@ -423,7 +423,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 await append("suggestions", { suggestions: suggestions.map((s) => redactSecrets(s)) });
             }
         };
-        await instructionLeg.run(spec.sessionId, () => withModelReachScope(spec.sessionId, () => withPrincipal(principal, () => {
+        await instructionLeg.run(spec.sessionId, () => withModelReachScope({ sessionId: spec.sessionId, taskId }, () => withPrincipal(principal, () => {
             const withElicit = elicitation
                 ? () => elicitation.runWithContext({ taskId, owner: elicitOwner ?? owner, emit: elicitEmit, abortSignal: cancelCtrl.signal }, runBody)
                 : runBody;

package/dist/tool-approval.d.ts

@@ -1341,6 +1341,13 @@ export declare class ToolApprovalCoordinator {
      *  流没了,值相等即目标集;极端复用形下多转的那条也只是从流内卡变 durable 卡,方向保守。
      *  返回触发条数(0 = 无流内未决 ask,调用方照旧 abort)。幂等:已结算条目跳过,重复调用无害。 */
     parkOpenAsksForTask(wireTaskId: string): number;
+    /**
+     * 编排器片 2 件 2 —— 下面 `drainForShutdown` 的第 ① 步,提前到**排空进入**那一拍(`boot/shutdown.ts` 的唯一排空入口调):锁存
+     * {@link shutdownDraining},本进程握着的每一张未决卡按断连同路改路耐久停驻(core `onAsk` 答 "unavailable" 的合同 —— 有 park 设施则停驻、
+     * 没有则无头自动拒,fail-closed);之后**登记**的卡在登记那一拍同路(`askBroadcast` 读同一位)。幂等(再调只是再扫一遍未决表)。
+     * 让出放在进入那一拍而不是硬停那一拍:活卡在排空窗里没有人能答到一只正在下线的副本上,早一拍停驻 = 早一拍能在替补上赎回。
+     */
+    beginDrain(): void;
     /**
      * 🔴 **S-929 —— 有序关停的审批面收尾(一只;`boot/shutdown.ts` 的 `hardShutdown` 起点调,SIGTERM / SIGINT / SIGHUP 三条停止路同一处)。**
      *

package/dist/tool-approval.js

@@ -707,11 +707,14 @@ export class ToolApprovalCoordinator {
         }
         return n;
     }
-    async drainForShutdown(deadlineMs) {
+    beginDrain() {
         this.shutdownDraining = true;
         for (const e of [...this.pending.values()])
             if (e.settledOutcome === undefined)
                 e.forceParkNow();
+    }
+    async drainForShutdown(deadlineMs) {
+        this.beginDrain();
         while ((this.asksInFlight > 0 || this.pending.size > 0 || this.streams.size > 0 || this.parksAwaitingCommit.size > 0) && Date.now() < deadlineMs) {
             await new Promise((r) => setTimeout(r, SHUTDOWN_DRAIN_POLL_MS));
         }

package/dist/trace/core-keyset-guard.d.ts

@@ -148,8 +148,8 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";

package/dist/trace/self-minted-wire.d.ts

@@ -169,6 +169,70 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /** 7.121.0:`GET /health` 自报位 `auth.kinds[]` 的成员(验过的身份来源闭集;这台部署的装配能回的那几个)。 */
+    readonly healthAuthKind: {
+        readonly at: "GET /health auth.kinds[]";
+        readonly members: {
+            service_token: {
+                attr: string;
+                since: string;
+            };
+            sso: {
+                attr: string;
+                since: string;
+            };
+            direct_door_jwt: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 7.121.0:`GET /health` 自报位 `auth.identityAttach`。 */
+    readonly healthIdentityAttach: {
+        readonly at: "GET /health auth.identityAttach";
+        readonly members: {
+            available: {
+                attr: string;
+                since: string;
+            };
+            unavailable: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 7.121.0:`GET /health` 自报位 `operator`。 */
+    readonly healthOperator: {
+        readonly at: "GET /health operator";
+        readonly members: {
+            present: {
+                attr: string;
+                since: string;
+            };
+            absent: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 7.121.0:`GET /health` 自报位 `center.sessionsVisible`(两个布尔 + 一个词;成员按 JSON 字面登记)。 */
+    readonly healthSessionsVisible: {
+        readonly at: "GET /health center.sessionsVisible";
+        readonly members: {
+            true: {
+                attr: string;
+                since: string;
+            };
+            false: {
+                attr: string;
+                since: string;
+            };
+            unknown: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /** 本仓在出口对 core 值做的变换(值变、键不变)。 */
     readonly wireValueRule: {
         readonly at: "出口值变换(<端点>#<键> → 变换)";

package/dist/trace/self-minted-wire.js

@@ -60,6 +60,36 @@ export const SELF_MINTED_WIRE = {
             shutdown_before_park: { attr: "-", since: "7.116.0" },
         },
     },
+    healthAuthKind: {
+        at: "GET /health auth.kinds[]",
+        members: {
+            service_token: { attr: "-", since: "7.121.0" },
+            sso: { attr: "-", since: "7.121.0" },
+            direct_door_jwt: { attr: "-", since: "7.121.0" },
+        },
+    },
+    healthIdentityAttach: {
+        at: "GET /health auth.identityAttach",
+        members: {
+            available: { attr: "-", since: "7.121.0" },
+            unavailable: { attr: "-", since: "7.121.0" },
+        },
+    },
+    healthOperator: {
+        at: "GET /health operator",
+        members: {
+            present: { attr: "-", since: "7.121.0" },
+            absent: { attr: "-", since: "7.121.0" },
+        },
+    },
+    healthSessionsVisible: {
+        at: "GET /health center.sessionsVisible",
+        members: {
+            true: { attr: "-", since: "7.121.0" },
+            false: { attr: "-", since: "7.121.0" },
+            unknown: { attr: "-", since: "7.121.0" },
+        },
+    },
     wireValueRule: {
         at: "出口值变换(<端点>#<键> → 变换)",
         members: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.120.0",
+  "version": "7.121.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.46.0",
-    "@sema-agent/settings-schema": "8.0.0",
+    "@sema-agent/settings-schema": "9.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",