@sema-agent/server 7.120.0 → 7.122.0

package/dist/approval-reconciler.js

@@ -6,6 +6,7 @@ import { buildRevokeFrame } from "./approval-card.js";
 import { encodeCheckpointScope } from "./security.js";
 const RECONCILE_STORE_TIMEOUT_MS = 10_000;
 const RECONCILE_SEGMENT_BUDGET_MS = 30_000;
+const PARK_COMMIT_BIND_BUDGET_MS = 2_000;
 function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
     let timer;
     return Promise.race([
@@ -80,6 +81,13 @@ export function decideReconcileAction(input) {
 }
 export function createApprovalReconciler(deps) {
     const { askStore, checkpoints, runs, logger, metrics, batchLimit, pendingGraceMs, adhocGraceMs, orphanTtlMs, unattendedPolicy, emitRevoke } = deps;
+    const warn = (event, fields) => {
+        try {
+            logger.warn(event, fields);
+        }
+        catch {
+        }
+    };
     const revoke = (row, askIds, reason, nowMs) => {
         if (askIds.length === 0 || !emitRevoke)
             return;
@@ -87,39 +95,32 @@ export function createApprovalReconciler(deps) {
             emitRevoke(buildRevokeFrame(row.batchId, askIds, reason, nowMs, row.taskId), { owner: row.owner, sessionId: row.sessionId, taskId: row.taskId });
         }
         catch (err) {
-            try {
-                logger.warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
-            }
-            catch {
-            }
+            warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
         }
     };
-    const reconcileOne = async (ask, nowMs) => {
+    const bindAtGate = async (ask, nowMs, deadlineMs) => {
+        const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
         const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
         let batchState = batchRow?.state ?? "MISSING";
         let batchBoundAskId = batchRow?.boundAskId ?? null;
         const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
         let gateMatch;
-        if (checkpoints && !irreversibleBatch) {
+        if (checkpoints && !irreversibleBatch && !expired()) {
             const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
             gateMatch = classifyGateMatch(ask, candidates);
             if (gateMatch.kind === "hash_mismatch") {
-                try {
-                    logger.warn("approval_reconcile_hash_mismatch", {
-                        askId: ask.askId,
-                        taskId: ask.taskId,
-                        toolCallId: ask.toolCallId,
-                        candidates: gateMatch.candidates,
-                        reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
-                            "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
-                            "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
-                    });
-                }
-                catch {
-                }
+                warn("approval_reconcile_hash_mismatch", {
+                    askId: ask.askId,
+                    taskId: ask.taskId,
+                    toolCallId: ask.toolCallId,
+                    candidates: gateMatch.candidates,
+                    reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
+                        "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
+                        "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
+                });
             }
             const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
-            if (match) {
+            if (match && !expired()) {
                 const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
                     gateToken: match.token,
                     gateBoundCallId: match.boundCallId,
@@ -127,12 +128,20 @@ export function createApprovalReconciler(deps) {
                 }), "bindBatch");
                 if (res.ok) {
                     revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
-                    return { outcome: "parked", match: gateMatch };
+                    return { bound: true, match: gateMatch };
                 }
                 batchState = res.batchState;
                 batchBoundAskId = res.boundAskId ?? null;
             }
         }
+        return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
+    };
+    const reconcileOne = async (ask, nowMs) => {
+        const attempt = await bindAtGate(ask, nowMs);
+        if (attempt.bound)
+            return { outcome: "parked", match: attempt.match };
+        const { batchState, batchBoundAskId, irreversibleBatch } = attempt;
+        const gateMatch = attempt.match;
         const run = runs && !irreversibleBatch ? ((await withDeadline(runs.getRun(ask.taskId), "getRun")) ?? null) : null;
         const action = decideReconcileAction({ ask, candidates: [], run, batchState, batchBoundAskId, nowMs, adhocGraceMs, orphanTtlMs, allowBind: false });
         switch (action.kind) {
@@ -149,7 +158,7 @@ export function createApprovalReconciler(deps) {
                 if (!won)
                     return { outcome: "held", match: gateMatch };
                 if (action.reason === VOID_REASONS.ORPHAN_TTL_EXCEEDED) {
-                    logger.warn("approval_ask_orphan_voided", { askId: ask.askId, taskId: ask.taskId, ageMs: nowMs - ask.createdAtMs, ttlMs: orphanTtlMs });
+                    warn("approval_ask_orphan_voided", { askId: ask.askId, taskId: ask.taskId, ageMs: nowMs - ask.createdAtMs, ttlMs: orphanTtlMs });
                 }
                 revoke(ask, [ask.askId], action.reason === VOID_REASONS.BATCH_BOUND_ELSEWHERE ? "superseded_by_park" : "aborted", nowMs);
                 return { outcome: "voided", match: gateMatch };
@@ -160,6 +169,37 @@ export function createApprovalReconciler(deps) {
             }
         }
     };
+    const parkCommits = deps.parkCommits;
+    const budgetMs = deps.parkCommitBindBudgetMs ?? PARK_COMMIT_BIND_BUDGET_MS;
+    const bindCommittedPark = async (calls) => {
+        const deadlineMs = Date.now() + budgetMs;
+        const work = (async () => {
+            const rows = await askStore.listParkingBySession(calls.sessionId);
+            for (const ask of rows) {
+                if (!calls.toolCallIds.includes(ask.toolCallId))
+                    continue;
+                if (Date.now() >= deadlineMs) {
+                    warn("approval_park_commit_bind_failed", { askId: ask.askId, taskId: ask.taskId, err: `park-commit bind budget (${budgetMs}ms) spent before this row`, fallback: "periodic_sweep" });
+                    return;
+                }
+                try {
+                    if ((await bindAtGate(ask, Date.now(), deadlineMs)).bound)
+                        metrics?.inc("approval_reconciled_total", { outcome: "parked" }, 1);
+                }
+                catch (err) {
+                    warn("approval_park_commit_bind_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err), fallback: "periodic_sweep" });
+                }
+            }
+        })();
+        parkCommits?.track(work);
+        try {
+            await withDeadline(work, "bindCommittedPark", budgetMs);
+        }
+        catch (err) {
+            warn("approval_park_commit_bind_failed", { sessionId: calls.sessionId, err: err instanceof Error ? err.message : String(err), fallback: "periodic_sweep" });
+        }
+    };
+    parkCommits?.onParkCommitted(bindCommittedPark);
     return {
         async runOnce(nowMs) {
             const stats = {
@@ -184,11 +224,7 @@ export function createApprovalReconciler(deps) {
             for (const ask of parking) {
                 if (Date.now() >= parkingDeadline) {
                     stats.budgetExhausted += 1;
-                    try {
-                        logger.warn("approval_reconcile_budget_exhausted", { segment: "PARKING", processed: stats.parked + stats.denied + stats.voided + stats.held + stats.failed, scanned: stats.scanned, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
-                    }
-                    catch {
-                    }
+                    warn("approval_reconcile_budget_exhausted", { segment: "PARKING", processed: stats.parked + stats.denied + stats.voided + stats.held + stats.failed, scanned: stats.scanned, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
                     break;
                 }
                 if (ask.boundInputHash === null)
@@ -224,11 +260,7 @@ export function createApprovalReconciler(deps) {
                 }
                 catch (err) {
                     stats.failed += 1;
-                    try {
-                        logger.warn("approval_reconcile_row_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err) });
-                    }
-                    catch {
-                    }
+                    warn("approval_reconcile_row_failed", { askId: ask.askId, taskId: ask.taskId, err: err instanceof Error ? err.message : String(err) });
                 }
             }
             const pending = await withDeadline(askStore.listByState("STREAM_PENDING", batchLimit), "listByState(STREAM_PENDING)");
@@ -236,11 +268,7 @@ export function createApprovalReconciler(deps) {
             for (const row of pending) {
                 if (Date.now() >= orphanDeadline) {
                     stats.budgetExhausted += 1;
-                    try {
-                        logger.warn("approval_reconcile_budget_exhausted", { segment: "STREAM_PENDING", expired: stats.orphansExpired, scanned: pending.length, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
-                    }
-                    catch {
-                    }
+                    warn("approval_reconcile_budget_exhausted", { segment: "STREAM_PENDING", expired: stats.orphansExpired, scanned: pending.length, budgetMs: RECONCILE_SEGMENT_BUDGET_MS });
                     break;
                 }
                 if (row.expiresAtMs + pendingGraceMs >= nowMs)
@@ -254,23 +282,15 @@ export function createApprovalReconciler(deps) {
                 }
                 catch (err) {
                     stats.failed += 1;
-                    try {
-                        logger.warn("approval_orphan_expire_failed", { askId: row.askId, taskId: row.taskId, policy: unattendedPolicy, err: err instanceof Error ? err.message : String(err) });
-                    }
-                    catch {
-                    }
+                    warn("approval_orphan_expire_failed", { askId: row.askId, taskId: row.taskId, policy: unattendedPolicy, err: err instanceof Error ? err.message : String(err) });
                 }
             }
             if (stats.unmatchableNoHash > 0) {
-                try {
-                    logger.warn("approval_reconcile_rows_unmatchable", {
-                        rows: stats.unmatchableNoHash,
-                        scanned: stats.scanned,
-                        reason: "bound_input_hash is NULL — criterion 1 (identity ∧ hash) cannot match; rows fall through to the run-terminal / adhoc / orphan arms",
-                    });
-                }
-                catch {
-                }
+                warn("approval_reconcile_rows_unmatchable", {
+                    rows: stats.unmatchableNoHash,
+                    scanned: stats.scanned,
+                    reason: "bound_input_hash is NULL — criterion 1 (identity ∧ hash) cannot match; rows fall through to the run-terminal / adhoc / orphan arms",
+                });
             }
             if (stats.parked + stats.denied + stats.voided + stats.orphansExpired > 0) {
                 metrics?.inc("approval_reconciled_total", { outcome: "parked" }, stats.parked);

package/dist/auto-mode-face.d.ts

@@ -15,7 +15,8 @@
  *
  * 本模块按**server 侧可知的同三项**算一份「若此刻提交会不会武装」的裁决,供壳(cli `sema doctor permissions`)
  * 与人自查。三项分别对应三个未武装原因(判序 = 谓词的合取序,先判到的先报):
- *  · `mode_not_auto`        —— 本次意图不是 auto(`?permissionMode=` 查询串给的;缺席 = 按 auto 意图答);
+ *  · `mode_not_auto`        —— 本次意图不是 auto(`?permissionMode=` 查询串给的;缺席 = 按 auto 意图答),或意图经本部署的运维入口地板
+ *                              (`AUTONOMY=plan`)钳过之后不是 auto —— 与受理门同一只钳,提交时那个词到不了引擎;
  *  · `deployment_incapable` —— 装配面没挂 `RunnerDeps.autoMode` 分类器席位(生产装配恒挂;桩/一次性 CLI 不挂);
  *  · `org_denied`           —— per-principal caps 的 `autoMode === false` 且本地 deny 未设(center 显式 deny、center
  *                              硬失败的 fail-closed 拒项);
@@ -80,7 +81,7 @@ export declare const AUTO_MODE_UNARMED_REASONS: readonly ["mode_not_auto", "depl
 export type AutoModeUnarmedReason = (typeof AUTO_MODE_UNARMED_REASONS)[number];
 /** 锁步表:词表与语义一一对应(加员/删员任一侧不同步 = tsc 红)。语义只供文档/测试,不上 wire。 */
 export declare const AUTO_MODE_UNARMED_REASON_SEMANTICS: {
-    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\")";
+    readonly mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\"),或意图经本部署的运维入口地板(AUTONOMY=plan)钳过之后不是 auto —— 与受理门同一只钳,提交时那个词到不了引擎";
     readonly deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器)";
     readonly org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项";
     readonly local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false";
@@ -118,11 +119,17 @@ export type AutoModeVerdict = {
  * 三项合取的 server 侧裁决。`requestedMode` 缺席 = 按 auto 意图答(「若请求会不会武装」);`principal` =
  * 调用方经门验证的身份(匿名 ⇒ undefined ⇒ center 客户端答 undefined,本地 deny 层照样罩)。
  *
+ * 意图那一项判的是**提交之后到得了引擎的那个词**:本次意图先过本部署的运维入口地板(`floor`,调用方传 `runtime-governance.ts`
+ * `autonomyModeFloor(<活 config 的 AUTONOMY>)` —— 与受理门盖章读同一只属主),钳法 = core `clampPermissionMode`(受理门 `stampEntryPermissionMode`
+ * 用的同一只钳;地板缺席 ⇒ 原样)。`AUTONOMY=plan` 部署上任何意图都被钳成 `plan` ⇒ `mode_not_auto`(闭集词复用,不另铸)。
+ *
  * 🔴 resolver 抛错**不吞**:合成腿的每一层都自带 fail-closed/缺席臂(center 客户端 catch-all、grant 腿 onFault),
  * 走到这里还在抛 = 装配缺陷,读面 500 比一句编出来的 reason 诚实。
  */
 export declare function judgeAutoModeArming(face: AutoModeFaceDeps | undefined, input: {
     readonly requestedMode: PermissionMode | undefined;
+    /** 本部署此刻的运维入口地板(`autonomyModeFloor(config.autonomy)`;`undefined` = 没有地板)。必填:不传地板不是「没有地板」的合法拼法。 */
+    readonly floor: PermissionMode | undefined;
     readonly principal: string | undefined;
     /** 本地 `PERMISSIONS_DISABLE_AUTO_MODE`(= catalog/settings 键 `permissions.disableAutoMode`)是否置 true —— caps false 时分词
      *  `local_denied` / `org_denied`(seam ⑤;两者对壳的指路不同:改本机 env vs 找组织)。 */

package/dist/auto-mode-face.js

@@ -1,4 +1,4 @@
-import { classifierSeatModel } from "@sema-agent/core";
+import { clampPermissionMode, classifierSeatModel } from "@sema-agent/core";
 import { resolveMainModel } from "./model-select.js";
 export function classifierRouteFor(deps) {
     try {
@@ -11,7 +11,7 @@ export function classifierRouteFor(deps) {
 }
 export const AUTO_MODE_UNARMED_REASONS = ["mode_not_auto", "deployment_incapable", "org_denied", "local_denied", "settings_denied", "resolver_fault"];
 export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
-    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\")",
+    mode_not_auto: "本次意图不是 auto(壳发的 permissionMode 不是 \"auto\"),或意图经本部署的运维入口地板(AUTONOMY=plan)钳过之后不是 auto —— 与受理门同一只钳,提交时那个词到不了引擎",
     deployment_incapable: "装配面没挂 RunnerDeps.autoMode 分类器席位(本部署/本进程形不具备分类器)",
     org_denied: "per-principal caps.autoMode === false 且本地 deny 未设:center 显式 deny / center 硬失败 fail-closed 拒项",
     local_denied: "本地 catalog 键 PERMISSIONS_DISABLE_AUTO_MODE=true(center/settings 键名 permissions.disableAutoMode)把 caps.autoMode 折成 false",
@@ -21,7 +21,9 @@ export const AUTO_MODE_UNARMED_REASON_SEMANTICS = {
 export async function judgeAutoModeArming(face, input) {
     const route = face?.seatMounted ? face.classifierModel?.() : undefined;
     const model = route !== undefined ? { model: route } : {};
-    if (input.requestedMode !== undefined && input.requestedMode !== "auto")
+    const intent = input.requestedMode ?? "auto";
+    const entry = input.floor === undefined ? intent : clampPermissionMode(intent, input.floor).effective;
+    if (entry !== "auto")
         return { armed: false, reason: "mode_not_auto", ...model };
     if (face === undefined || !face.seatMounted)
         return { armed: false, reason: "deployment_incapable" };

package/dist/bench/s1/live-deps.js

@@ -370,6 +370,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     process.env.LEADER_WORKER_BUDGET_USD = String((rt.maxCostUsd ?? 1.0) / 2);
     const run = createLeaderRunner({
         brain, models, roles, pricing, e2bApiKey: rt.e2bApiKey, workspace: W,
+        autonomy: () => undefined,
         ...(s1DebugGit() ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
     });
     const teamSeedWrite = (trap.seedFiles ?? [])

package/dist/boot/config-center.d.ts

@@ -14,6 +14,7 @@ import type { UnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import type { ConsolidationSeatWatch } from "./memory-consolidation.js";
 import type { DegradeRouteWatch } from "../brain.js";
 import { type EngineRestartSignal } from "../config-center/facade.js";
+import { type ConfigHandoff } from "../fleet/engine-signal.js";
 import { type ConfigApplyLedgerView } from "../config-center/apply-ledger.js";
 import type { CenterPullView } from "../config-center/pull-state.js";
 import type { LimitSync } from "./limit-sync.js";
@@ -108,17 +109,14 @@ export interface ConfigCenterRuntime {
     onSelfReportChange(listener: (changed: SelfReportChange) => void): void;
     /** /health.restart 与 fleet 心跳 `restart` 的**同一只**取值口(orchestrator 自动重启信号;settings-schema `RestartSignal` 形)。 */
     restartState(): EngineRestartSignal | undefined;
+    /** `/health.configHandoff` 的取值口(只上 `/health`):在场 ⇔ 部署声明了耐久接力(`CONFIG_LKG_DURABLE` ∧ LKG 启用 —— 判「handoff confirmed」的
+     *  同一只谓词)∧ 应用着的那一代 ≠ 最后确认耐久接力的那一代(接力账;合成律 `buildConfigHandoff`)。非耐久部署 / 本地腿 / 没有配置管道 ⇒ 缺席。
+     *  两个事实两张脸:「要重启但扣着」归 `restart.withheld`,「声明了耐久接力而这一代没确认」归本键。 */
+    configHandoffState(): ConfigHandoff | undefined;
     /** S-768:`/health.modelRefusals` 与 fleet 心跳 `modelRefusals` 的**同一只**取值口(settings-schema 6.2.0 `ModelRefusalsSignal` 形:
      *  名 → 码 + 组拒码)。描述**最近一次被判的那份中心候选目录**(每次候选 apply 的报告 `ApplyReport.modelRefusals` 投影;组拒时就是被拒
      *  的那份 —— 引擎自己的拒因表不换代)。没有可报的拒 / 没有配置管道 / 还没判过候选 ⇒ `undefined`(键缺席)。值变了 ⇒ 通知自报订阅者。 */
     modelRefusalsState(): ModelRefusalsSignal | undefined;
-    /** /health.modelPlaneDeferred:被扣着、还没有 next-boot handoff 的候选(codex R18 起的状态机)。S-668 波 0 起
-     *  模型面不再 defer,键名保留,今天承载的是 durable LKG 发布债与 skills 债(见 `planeDeferredNoHandoff`)。 */
-    planeDeferredState(): {
-        version: number;
-        since: number;
-        blocked?: string[];
-    } | undefined;
     /** [ref] 世代账:/health 的 target/applied/失败持续时长三键 + 诊断端点的 configApply 段(同一份读数)。
      *  `undefined` = 本部署没有配置管道(纯 env worker)⇒ 两个读面的形状**逐字不变**(additive 纪律)。 */
     configApplyState(): ConfigApplyLedgerView | undefined;

package/dist/boot/config-center.js

@@ -11,7 +11,7 @@ import { applyCenterPlugins } from "../capabilities/center-plugins.js";
 import { applyCatalogToSource, withPromptArtifactBackfill } from "../capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
-import { configLkgEnabled, isRosterGateArmed } from "../config.js";
+import { isRosterGateArmed } from "../config.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
@@ -20,6 +20,7 @@ import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETC
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
 import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, applyCenterSkills, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, fetchPromptArtifact } from "../config-center/facade.js";
+import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../config-center/mcp-revocation.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../config-center/apply-ledger.js";
@@ -315,9 +316,27 @@ export async function createConfigCenterRuntime(ctx) {
         }
     };
     let bootConfigPending;
-    const lkgEnabled = configProvider?.kind === "remote" && configLkgEnabled();
+    const lkgEnabled = configProvider?.kind === "remote" && config.configLkgEnabled;
     const lkgPathFor = (identity) => config.configLkgPath ?? defaultLkgPath(config, cc?.worker, identity);
     const lkgSurvivesRestart = lkgEnabled && process.env.CONFIG_LKG_DURABLE === "true";
+    let handoff = {};
+    let handoffMissingSince;
+    const latchHandoff = () => {
+        const bootIdentity = currentIdentity();
+        const ledger = { ...handoff, ...(bootIdentity !== undefined ? { bootIdentity } : {}) };
+        handoffMissingSince = configHandoffMissing(ledger) ? (handoffMissingSince ?? Date.now()) : undefined;
+        return ledger;
+    };
+    const noteHandoff = (next) => {
+        const applied = next.applied ?? handoff.applied;
+        const durable = next.durable ?? handoff.durable;
+        handoff = { ...(applied !== undefined ? { applied } : {}), ...(durable !== undefined ? { durable } : {}) };
+        latchHandoff();
+    };
+    const markApplied = (gen, version) => {
+        applyLedger.applied(gen, version);
+        noteHandoff({ applied: version });
+    };
     let lkgBooted = false;
     let bootLkgCandidate;
     let lastPrewarmBodiesVerified = false;
@@ -357,6 +376,8 @@ export async function createConfigCenterRuntime(ctx) {
             }
             lastPrewarmBodiesVerified = true;
             await saveLkg(lkgPath, cc?.worker, identity, effectiveObj, etag);
+            if (lkgSurvivesRestart)
+                noteHandoff({ durable: { version: effectiveObj.version, identity } });
             return lkgSurvivesRestart;
         }
         catch (err) {
@@ -417,7 +438,10 @@ export async function createConfigCenterRuntime(ctx) {
                     recordApply(rep);
                 },
             });
-            applyLedger.applied(lkgGen, lkgR.effective.version);
+            const lkgIdentity = candidateIdentityOf(lkgR.effective);
+            if (lkgSurvivesRestart && lkgIdentity !== undefined)
+                noteHandoff({ durable: { version: lkgR.effective.version, identity: lkgIdentity } });
+            markApplied(lkgGen, lkgR.effective.version);
             await adoptCenterPrompts(lkgR.effective, "boot-lkg");
             const lkgPlane = modelPlaneCommitted(lkgReport);
             if (lkgPlane)
@@ -485,7 +509,7 @@ export async function createConfigCenterRuntime(ctx) {
                             recordApply(rep);
                         },
                     });
-                    applyLedger.applied(bootGen, r.effective.version);
+                    markApplied(bootGen, r.effective.version);
                     const bootClean = fullyLandedForLkg(r, bootReport);
                     if (bootClean)
                         ccEtag = r.etag;
@@ -604,9 +628,9 @@ export async function createConfigCenterRuntime(ctx) {
         onSelfReportChange: (listener) => {
             selfReportListeners.push(listener);
         },
-        restartState: () => pendingRestart,
+        restartState: () => buildRestartSignal(pendingRestart, planeDeferredNoHandoff),
+        configHandoffState: () => (configProvider === undefined || configProvider.kind === "local" || !lkgSurvivesRestart ? undefined : buildConfigHandoff(latchHandoff(), handoffMissingSince)),
         modelRefusalsState: () => modelRefusals,
-        planeDeferredState: () => planeDeferredNoHandoff,
         configApplyState: () => (configProvider ? applyLedger.view() : undefined),
         centerPullState: () => {
             const view = applyLedger.view();
@@ -622,7 +646,7 @@ export async function createConfigCenterRuntime(ctx) {
         },
         async applyCenterCapabilities(skills) {
             if (effective?.skills && config.configCenter) {
-                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, configLkgEnabled() ? defaultSkillCacheDir(config) : undefined);
+                skills = await applyCenterSkills(skills, effective.skills, config.configCenter, logger, undefined, config.configLkgEnabled ? defaultSkillCacheDir(config) : undefined);
             }
             if (effective?.plugins !== undefined) {
                 const pluginOut = await applyCenterPlugins(skills, effective, {
@@ -850,7 +874,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 ceilingVerdict?.judge();
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
-                                applyLedger.applied(tickGen, r.effective.version);
+                                markApplied(tickGen, r.effective.version);
                                 const tickPlane = modelPlaneCommitted(applyReport);
                                 if (tickPlane)
                                     appliedPlaneEff = r.effective;
@@ -963,7 +987,7 @@ export async function createConfigCenterRuntime(ctx) {
                     limitSync?.sync();
                     ceilingVerdict?.judge();
                     applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
-                    applyLedger.applied(lateGen, r.effective.version);
+                    markApplied(lateGen, r.effective.version);
                     const latePlane = modelPlaneCommitted(applyReportLate);
                     if (latePlane)
                         appliedPlaneEff = r.effective;

package/dist/boot/engine-lease.d.ts

@@ -36,7 +36,7 @@
  *     的请求是毫秒级的,而本腿 15s 采样一拍 —— 采样点几乎必然落在两次轮询之间,`attached` 与
  *     `inflight` **同时读到 0**。只看那两条的实现会在一只**正被使用**的引擎底下把它关掉。租约的
  *     建立面按设计就是「首个 HTTP/SSE 接触」,不只是 SSE。
- *  4. **退出 = 走 `drain`**,即 `boot/shutdown.ts` 里 SIGTERM 用的那一条 `drainThenShutdown`:拒新提交
+ *  4. **退出 = 走 `drain`**,即 `boot/shutdown.ts` 里 SIGTERM 用的那一只唯一排空入口 `enterDrain`(编排器片 2 前名 `drainThenShutdown`):拒新提交
  *     (503+Retry-After)→ 候在途腿跑完 → `hardShutdown`。in-flight run 的结算 / park 语义与人工停机
  *     **逐字一致**。本模块自己**从不** `process.exit`。
  *  5. **crash-last 判别位**([ref] ④「flush 判别位标 auto-exit 非崩溃」):走上面那条受控退,

package/dist/boot/leader.js

@@ -51,6 +51,7 @@ export function createLeaderFace(ctx) {
                 retentionPolicy: governanceSeams.retentionPolicy,
             },
             deploymentPosture: () => buildDeploymentPostureSeats(config),
+            autonomy: () => config.autonomy,
             ...(ctx.tracer ? { tracer: ctx.tracer } : {}),
             ...(config.usageWindows && ctx.usageWindowStore
                 ? { usageWindows: config.usageWindows, usageWindowStore: ctx.usageWindowStore }

package/dist/boot/reapers.d.ts

@@ -24,6 +24,7 @@ import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { ApprovalNonceStore, CheckpointStoreFull, CostQuotaStore, ImageBake, RateLimiterStore, ServiceWorkflowJournalStore, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
+import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -68,6 +69,8 @@ export interface ReapersCtx {
     subRunner: Runner;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
+    /** S-1280:checkpoint 店的 park 提交观察层(stage-06 与店同一处铸;在场 ⇔ 有 checkpoint 店)。对账收敛器订阅它,在停车行提交那一拍收口 PARKING。 */
+    parkCommits: ParkCommitWatch | undefined;
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     costQuota: CostQuota | CostQuotaStore | undefined;
     toolResultStore: ToolResultStoreFull | undefined;

package/dist/boot/reapers.js

@@ -56,7 +56,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -122,6 +122,7 @@ export function startReapers(ctx) {
             orphanTtlMs: config.streamApproval.orphanTtlMs,
             unattendedPolicy: config.unattendedApprovalPolicy,
             ...(toolApproval ? { emitRevoke: (frame, target) => void toolApproval.emitRevoke(frame, target) } : {}),
+            parkCommits,
         });
     })();
     const reapSessions = createPlacementAwareReapSessions({ host: backend?.session(), routed: subRunner.sessions });

package/dist/boot/resolve-spec.js

@@ -26,7 +26,7 @@ import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { isIsolatedExecEnv, routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
-import { applyRuntimeGovernance, stripDelegationTools } from "../runtime-governance.js";
+import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { memoryProjectKeyFor, memorySpecForRequest } from "../memory-scope.js";
 import { inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -331,6 +331,7 @@ export function createResolveSpec(ctx) {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
             systemPrompt: typeof body.systemPrompt === "string" ? body.systemPrompt : undefined,
             appendSystemPrompt: acceptedAppend,
+            ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             sessionId: auth?.sessionId,
             principal: auth?.principal,
             images: body.images,
@@ -598,9 +599,6 @@ export function createResolveSpec(ctx) {
                 throw new HttpError(422, `request settings cannot be applied as written: ${e.message}`);
             }
         }
-        if (governed.handsReadOnly === true && Array.isArray(governed.tools)) {
-            governed = { ...governed, tools: stripDelegationTools(governed.tools) };
-        }
         if (shouldDiscloseNoPersistentMemory({
             memoryFaceMounted: memoryFaceMounted(governed.memory),
             declaredCapable: effectiveMemoryPersistenceCapable(config),

package/dist/boot/shutdown.d.ts

@@ -26,11 +26,12 @@ import type { Logger } from "../observability/logger.js";
 import type { startOtlpExporter } from "../observability/otel-exporter.js";
 import type { CostQuota } from "../observability/cost-quota.js";
 import type { RateLimiter } from "../observability/rate-limit.js";
-import type { startFleetClientFromEnv } from "../fleet-client.js";
+import type { startFleetClientFromConfig } from "../fleet-client.js";
 import type { BreakerStateStore, CostQuotaStore, RateLimiterStore, StoreBackend } from "../plugins/store-backend.js";
 import type { WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import { type DrainState } from "../fleet/drain-entry.js";
 export interface ShutdownCtx {
     config: ServiceConfig;
     /** [ref]①:崩溃遗言的 version 键(与 /v1/capabilities.version 同源=main 的 serviceVersion())。 */
@@ -61,16 +62,10 @@ export interface ShutdownCtx {
     subRunner: Runner;
     lspManager: RunnerDeps["lspManager"];
     workflowNotifyJournal: WorkflowNotifyJournalStore | undefined;
-    fleetClient: ReturnType<typeof startFleetClientFromEnv>;
+    fleetClient: ReturnType<typeof startFleetClientFromConfig>;
     backend: StoreBackend | undefined;
-    drainState: {
-        draining: boolean;
-        since?: number;
-        inflight?: () => number;
-        lastActivityAt?: () => number;
-        attachedStreams?: () => number;
-        lastAttachEndedAt?: () => number;
-    };
+    /** 编排器片 2 件 2:共享排空盒子(`fleet/drain-entry.ts`)—— 本函数往上装**唯一**入口 `enter`。 */
+    drainState: DrainState;
     /** [ref]-2:store 活体探针(main 建)——不停的话 hardShutdown 后仍对正在关闭的池发探针,刷假
      *  store_probe_dead 告警(文件头契约 3 的同族漏网)。缺席 = 该部署形没建探针。 */
     storeLiveProbe: {
@@ -95,6 +90,10 @@ export interface ShutdownCtx {
     /** S-929 F1:checkpoint 店的 park 提交观察层(`plugins/park-commit-watch.ts`;在场 ⇔ 本部署有 checkpoint 店)。hardShutdown 在
      *  `backend.close()` 之前等它 quiesce —— 在飞的 `put`(审批 park / 资源挂起…,与审批协调器在不在场无关)不许被抽掉连接池。 */
     parkCommits: ParkCommitWatch | undefined;
+    /** 编排器片 2 件 3:服务租约客户端(在场 ⇔ fleet 成员 ∧ 中心车道配齐)。hardShutdown 起点停它的续租定时器(文件头契约 3 同族)。 */
+    servingLease?: {
+        stop(): void;
+    } | undefined;
 }
 /**
  * 受控退的**后台宽限**还要等多久(ms)—— hardShutdown 软停后台 shell 之后、`process.exit` 之前,给软停过的行**一次**