@sema-agent/server 7.121.0 → 7.122.0

package/dist/http/admission.js

@@ -2,7 +2,8 @@ import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -623,19 +624,20 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
+        const admitted = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
         try {
-            const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
+            const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
             const bindingIntent = await resolveDevicePlacementIntent({
                 config: deps.config,
                 req,
                 rootSessionId: spec.sessionId,
-                deviceId: body.deviceId,
+                deviceId: admitted.deviceId,
                 store: deps.deviceStore,
                 enrollment: deps.deviceEnrollment,
             });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/approval-sweeps.js

@@ -8,7 +8,7 @@ import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { admissionRefusalOf, readinessOf } from "./readiness.js";
 import { readResumeCtx } from "./resume-ctx-read.js";
-import { storedBodyReplayRefusal } from "./checkpoint-ctx.js";
+import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -72,7 +72,7 @@ export function createApprovalSweeps(ctx) {
                 return undefined;
             if (read.kind === "absent")
                 return undefined;
-            return storedBodyReplayRefusal(read.ctx);
+            return storedBodyReplayRefusal(read.ctx, deps.config.autonomy);
         };
         let parkedSkipped = 0;
         const replaySkipped = [];

package/dist/http/checkpoint-ctx.d.ts

@@ -20,8 +20,19 @@
  * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里技能(顶层 / 子代)的 `disallowedTools` 有引擎读成空的条目(`"Bash "` 这类 7.41 去白后有效、
  * 7.42 什么也不拒的条目)⇒ 提交 400(`resolveSpec`,拒点);存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`。判据函数 = `rule-entry-list.ts` `skillDenyInertEntryOf`。
  *
- * ## 一只判据、五个问点({@link storedBodyReplayRefusal} / {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面两问合在 {@link storedBodyReplayRefusal} 一处,答复合在 {@link storedBodyReplayAnswer} 一处。
+ * ## 第三问(7.122.0):体里模式词的读法记号
+ * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
+ * 治理层不再在每一次续跑重钳。更早版本写下的行体里是**请求的原词**,运维的 plan 由治理层每段重新折上(7.121.x 及以前:只读手 + 写面 roots)。
+ * 那种行在本版上按体里的原词重放 = 静默放宽(`acceptEdits` / `bypassPermissions` 原词直接生效;无词 ⇒ 引擎读 checkpoint 记下的词)。
+ * ⇒ 同一条规则:**写模式词的人盖读法记号** —— 模式词的写者:每一个出生点(新的持久化写都经 {@link buildCheckpointCtx})与 `plan_review` 写回(经 {@link withPermissionModeRewritten}),各自写词的同一拍在 ctx 上写记号
+`permissionModeReading`(闭集只有当前一词 {@link PERMISSION_MODE_READINGS});续跑重放之前,**本部署此刻有入口地板**
+ * (`runtime-governance.ts` `autonomyModeFloor`)而行上没有当前记号、且体的生效词被地板钳会变 ⇒ 拒(行字节不动)。没有地板的部署、体的词本就在地板之下(`plan`)的行
+ * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
+ * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
+ *
+ * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
+ * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
@@ -32,13 +43,19 @@
  * 一次性迁移登记表(本条那一行):所有旧读法下停驻的行都已结束或被收割(停驻行的终局 = 落盘起 `TERMINAL_BACKSTOP_MS`,见
  * `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删。
  */
+import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
-import { type SkillDenyInertEntry } from "../rule-entry-list.js";
+import type { SkillDenyInertEntry } from "../rule-entry-list.js";
 /** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
  *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
 export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
 export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/** 体里模式词的读法记号闭集(一词 = 当前读法):这一行体的顶层 `permissionMode` 是这条 run 模式词**唯一的源**(提交入口盖过运维地板、`plan_review` 写回改它),
+ *  续跑照它读、不再由治理层按段重钳。写点两个 = {@link buildCheckpointCtx}(每一次新的持久化写都写)与 {@link withPermissionModeRewritten}(`plan_review` 写回改词的那一拍写);
+ *  **不改词**的续跑腿写回传原 ctx ⇒ 记号随行。 */
+export declare const PERMISSION_MODE_READINGS: readonly ["entry_word"];
+export type PermissionModeReading = (typeof PERMISSION_MODE_READINGS)[number];
 /** 被拒的行是在哪种读法下写的(闭集;拒句按它穷举):`list` = 无记号或记号认不得(≤7.114.0 的名单读法;认不得的记号不是任何一代的证据,
  *  按最早那一代说话);`statement` = 7.115.0–7.116.x 写下的表态读法。 */
 export declare const ALLOW_LIST_READING_ERAS: readonly ["list", "statement"];
@@ -53,13 +70,44 @@ export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
  *
  * 调用方是「本进程刚按当前读法读过这份体」的写点:fresh 提交(受理门按当前读法读过 `allow`),或已经过了续跑拒臂的重放腿
  * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
- * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
+ * 续跑腿的**写回**不经本函数:**不改词**的写回传读进来的 ctx(记号随行,不重新判 —— 在写回口重新判会把一条没记号的旧行「洗」成新行);
+ * **改词**的写回(只有 `plan_review` 的批准 / 编辑)经 {@link withPermissionModeRewritten}。
  */
 export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
 }): CheckpointCtx;
+/**
+ * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
+ * `test/allow-list-reading-park-refusal.test.ts` 枚举调用点,多一处即红)。与 {@link buildCheckpointCtx} **同一条规则**:按当前读法写下的词,盖当前读法记号。
+ *
+ * 为什么记号必须随词一起写,而不是留给读的一侧去豁免:第三问问的是「体的词是不是按当前读法写下的」,记号就是这句话的证据。改写之后体里的词是本版的 `plan_review`
+ * 刚写下的(一个人刚批准的档),它确实是 `entry_word` 读法的词;若只改体、记号缺席,重建段的同一问把它读成「7.121.x 的请求原词」,被地板钳回 `plan` ≠ 所写词 ⇒ 误拒
+ * 一条刚被批准的 run。判据侧(`stored-body-replay.ts`)**不为「plan_review 之后」另开特判臂** —— 读的一侧只有一个读法,写的一侧各自负责盖章。
+ *
+ * 为什么这不是在「洗」旧行:走到写回口的行,其**原体**已过 prepare 段的同一问(词被地板钳不变:词已是 `plan`,或本部署没有地板);原体的词会被地板钳的旧行
+ * (`acceptEdits` / `bypassPermissions` / 无词)在 prepare 段就被拒,到不了这里。入参 `ctx` 的其余位(memoryScope / 无人值守标 / allow 记号)原样随行,只换体与模式词记号。
+ *
+ * 本模块零值依赖的闭包纪律不变(随包排空脚本经编译产物 import;`test/drain-check-local.test.ts`):本函数只用本模块内的东西。
+ */
+export declare function withPermissionModeRewritten(ctx: CheckpointCtx, body: TaskRequestBody): CheckpointCtx;
+/** 行上带的是不是当前的模式词读法记号(第三问的记号那一半;另一半 —— 体的生效词被地板钳会不会变 —— 读请求设置的解析层,住在 `http/stored-body-replay.ts`)。
+ *  记号缺席或认不得 ⇒ 不是「按当前读法写下」的证据,与 allow 记号同一条纪律。 */
+export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean;
+/**
+ * 第三问的拒答复 —— 码与落点同 allow 记号那一问(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending,**不是**「原样重试会成功」)。
+ * 句子说原因(更早的版本在每次续跑重钳运维的 AUTONOMY、没把它记进任务;本版只在提交时记一次 ⇒ 续跑会按任务提交时的原词跑)与两条出路。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
+ */
+export declare function permissionModeReadingRefusal(): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        retriable: true;
+    };
+};
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -89,12 +137,11 @@ export type StoredBodyReplayRefusal = {
 } | {
     readonly kind: "skill_deny_inert";
     readonly entry: SkillDenyInertEntry;
+} | {
+    readonly kind: "permission_mode_reading";
+    readonly stored: PermissionMode | undefined;
+    readonly floor: PermissionMode;
 };
-/**
- * 「存量体能否重放」的**唯一**判据(文件头「一只判据、五个问点」):不能 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。
- * 顺序:先 allow 读法记号,再技能拒侧读成空(两问都中时答第一问 —— 任一问中都不重放,句子只需一句)。
- */
-export declare function storedBodyReplayRefusal(ctx: CheckpointCtx): StoredBodyReplayRefusal | undefined;
 /** 续跑家族交回的拒答复形(`{ status, body }`,由 `sendResumeOutcome` / 各路由发送;`body` 至少 `error` + `errorCode`)。 */
 export interface ResumeRefusalAnswer {
     readonly status: number;
@@ -110,17 +157,19 @@ export interface ResumeRefusalAnswer {
  */
 export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy: string, extra?: Record<string, unknown> | undefined): ResumeRefusalAnswer;
 /**
- * {@link storedBodyReplayRefusal} 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
  * 事件名三个(问点各一:`resume_refused_stored_body` / `steer_wake_park_refused_stored_body` / `deny_sweep_stored_body_skipped`),字段形只有这一只。
  */
 export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
     kind: StoredBodyReplayRefusal["kind"];
     era?: AllowListReadingEra;
     layer?: SkillDenyInertEntry["layer"];
+    storedMode?: PermissionMode | null;
+    floor?: PermissionMode;
     note: string;
 };
 /**
- * {@link storedBodyReplayRefusal} 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
 export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal): ResumeRefusalAnswer;

package/dist/http/checkpoint-ctx.js

@@ -1,5 +1,5 @@
-import { skillDenyInertEntryOf } from "../rule-entry-list.js";
 export const PERMISSIONS_ALLOW_READINGS = ["allow_layer"];
+export const PERMISSION_MODE_READINGS = ["entry_word"];
 export const ALLOW_LIST_READING_ERAS = ["list", "statement"];
 export function bodyCarriesAllowList(body) {
     const settings = body?.settings;
@@ -17,6 +17,24 @@ export function buildCheckpointCtx(fields) {
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
+        permissionModeReading: "entry_word",
+    };
+}
+export function withPermissionModeRewritten(ctx, body) {
+    return { ...ctx, body, permissionModeReading: "entry_word" };
+}
+export function permissionModeReadingStated(ctx) {
+    const reading = ctx.permissionModeReading;
+    return typeof reading === "string" && PERMISSION_MODE_READINGS.includes(reading);
+}
+export function permissionModeReadingRefusal() {
+    return {
+        status: 409,
+        body: {
+            error: "this task was suspended by an earlier server version that re-applied this deployment's AUTONOMY on every resume instead of recording it in the task; this version records the operator's plan floor once, when a task is submitted, so continuing would run this task under the permission mode it was submitted with rather than the one it ran under. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel); to let it finish with read-only hands instead, set AUTONOMY=read-only until it does.",
+            errorCode: "checkpoint.unsupported_version",
+            retriable: true,
+        },
     };
 }
 export function allowListReadingUnstated(ctx) {
@@ -55,14 +73,6 @@ export function allowListReadingRefusal(era) {
         }
     }
 }
-export function storedBodyReplayRefusal(ctx) {
-    if (allowListReadingUnstated(ctx))
-        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
-    const entry = skillDenyInertEntryOf(ctx.body);
-    if (entry !== undefined)
-        return { kind: "skill_deny_inert", entry };
-    return undefined;
-}
 export function resumeBlockedByPolicyAnswer(message, blockedBy, extra) {
     return {
         status: 409,
@@ -75,6 +85,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
         case "skill_deny_inert":
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a skill disallowedTools entry the engine now reads as empty (an earlier engine trimmed it into a working deny); it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        case "permission_mode_reading":
+            return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
@@ -87,6 +99,8 @@ export function storedBodyReplayAnswer(refusal) {
             return allowListReadingRefusal(refusal.era);
         case "skill_deny_inert":
             return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
+        case "permission_mode_reading":
+            return permissionModeReadingRefusal();
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);

package/dist/http/dispatch.js

@@ -3,9 +3,9 @@ import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessio
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
-import { sendJson, sendError, isSseResponse } from "./send.js";
-import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal } from "./readiness.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
+import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
+import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf } from "./readiness.js";
 import { fleetMembershipKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
@@ -43,6 +43,7 @@ export function createDispatch(ctx) {
     const { deps, noteActivity, routeCtxBase, counters } = ctx;
     const openResponses = new Set();
     let lastAttachEndedAt = 0;
+    const openSubscriptions = new Set();
     if (deps.drainState) {
         deps.drainState.attachedStreams = () => {
             let n = 0;
@@ -52,6 +53,12 @@ export function createDispatch(ctx) {
             return n;
         };
         deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
+        deps.drainState.endSubscriptions = () => {
+            const { errorCode, message } = billableRefusalOf("draining").body;
+            for (const r of [...openSubscriptions])
+                if (isSseResponse(r))
+                    endSseWithError(r, { errorCode, message });
+        };
     }
     async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit) {
         for (const row of rows) {
@@ -82,10 +89,14 @@ export function createDispatch(ctx) {
         const allow = { pre: [], post: [] };
         noteActivity(url);
         const admitted = method !== "OPTIONS" && !isProbePath(url);
-        if (admitted)
+        const subscription = admitted && isSubscriptionRequest(method, url);
+        const countedInflight = admitted && !subscription;
+        if (countedInflight)
             counters.admittedInflight++;
         if (admitted)
             openResponses.add(res);
+        if (subscription)
+            openSubscriptions.add(res);
         let logged = false;
         const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
         const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
@@ -93,8 +104,9 @@ export function createDispatch(ctx) {
             if (logged)
                 return;
             logged = true;
-            if (admitted)
+            if (countedInflight)
                 counters.admittedInflight--;
+            openSubscriptions.delete(res);
             if (openResponses.delete(res) && isSseResponse(res))
                 lastAttachEndedAt = performance.now();
             const route = routeLabel(method, url);

package/dist/http/resume-legs.js

@@ -29,7 +29,7 @@ import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-seg
 import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
-import { storedBodyPermissionMode } from "../task-settings.js";
+import { planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../task-settings.js";
 import { acceptedResumingReceipt, buildHostLegOutcome } from "./route-ctx.js";
 import { mintAndDriveDurableRun } from "./durable-run-leg.js";
 import { createSessionsLocal } from "./routes/sessions.js";
@@ -43,7 +43,8 @@ import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "./resume-ctx-read.js";
-import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, storedBodyReplayRefusal } from "./checkpoint-ctx.js";
+import { resumeBlockedByPolicyAnswer, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { httpErrorCode } from "./send.js";
 function isCheckpointReopenedFailure(r) {
     const code = failureCodeOf(r.terminal);
@@ -422,7 +423,7 @@ export function createResumeLegs(ctx) {
         return storedBodyReplayAnswer(refusal);
     };
     const resolveResumeSpecOrBlocked = async (ctx, req, auth) => {
-        const replay = storedBodyReplayRefusal(ctx);
+        const replay = storedBodyReplayRefusal(ctx, deps.config.autonomy);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
         try {
@@ -1352,7 +1353,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } });
-        const replay = storedBodyReplayRefusal(ctxRead.ctx);
+        const replay = storedBodyReplayRefusal(ctxRead.ctx, deps.config.autonomy);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
         return { ok: true, prepared: { sessionId, token, cp, ctx: ctxRead.ctx } };
@@ -1364,11 +1365,10 @@ export function createResumeLegs(ctx) {
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
         const effMode = storedBodyPermissionMode(ctx.body);
         if (permissionModeAfter !== undefined && effMode !== "plan") {
-            throw new Error("drivePlanReview: permissionModeAfter was passed for a task that was not submitted with permissionMode \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
+            throw new Error("drivePlanReview: permissionModeAfter was passed for a task whose stored permission mode is not \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
         }
-        const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
-        const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
-        const rebuildCtx = { ...ctx, body: resumeBody };
+        const approvedMode = planReviewDecisionExitsPlan(decision) && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
+        const rebuildCtx = approvedMode === undefined ? ctx : withPermissionModeRewritten(ctx, { ...ctx.body, permissionMode: approvedMode });
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;

package/dist/http/route-ctx.d.ts

@@ -168,6 +168,14 @@ export interface CheckpointCtx {
      * 写点只有 `buildCheckpointCtx`(同模块;新的持久化写);续跑腿的写回传原 ctx / 其展开 ⇒ 记号随行。体里没有 `allow` 的行不写它。
      */
     permissionsAllowReading?: import("./checkpoint-ctx.js").PermissionsAllowReading;
+    /**
+     * 体里**模式词的读法记号**(闭集只有当前一词 `"entry_word"`):在场 = 这一行体的顶层 `permissionMode` 是这条 run 模式词唯一的源(提交入口盖过运维
+     * `AUTONOMY=plan` 的地板;`plan_review` 写回改它),续跑照它读。**服务端写、不来自请求体**。缺席(7.121.x 及以前写下的行 —— 那时运维的 plan 由治理层每段重钳)
+     * 而本部署此刻有入口地板、体的词被地板钳会变 ⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注第三问)。
+     * 写点两个(写模式词的人盖记号,同模块):`buildCheckpointCtx`(每一次新的持久化写都写)与 `withPermissionModeRewritten`(`plan_review` 改词的写回);
+     * 不改词的续跑腿写回传原 ctx ⇒ 记号随行。
+     */
+    permissionModeReading?: import("./checkpoint-ctx.js").PermissionModeReading;
 }
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {
@@ -448,8 +456,8 @@ export interface RouteLegs {
     drivePlanReview(prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/plan_review` 腿传 `true`。 */
     acceptEarly?: boolean, 
-    /** S-433:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在 `approve`
-     *  上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
+    /** S-433:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定
+     *  —— `approve` / `edit` —— 上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
     permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<{
         status: number;
         body: object;
@@ -586,7 +594,7 @@ export interface RouteDeclFacts {
      *  503 照旧罩着(它判的是「这台机能不能收写」,与方法无关,且必须在解析请求体之前)。 */
     readonly methodDispatched?: true;
 }
-/** **可分派行**多出来的两列(S-146 第三刀):身份 + 它真认的方法。纯门行两列都没有(见下)。 */
+/** **可分派行**多出来的列(S-146 第三刀):身份 + 它真认的方法(+ S-1281 的订阅类)。纯门行一列都没有(见下)。 */
 interface RouteDeclIdentity {
     /** **全表唯一**的行名(kebab 闭集词)。这是声明行的身份:域 handler 用
      *  `switch (match.decl.id)` 闭集分派(漏一口 = 编译红),所以它必须稳定、唯一、且与路径解耦
@@ -601,6 +609,14 @@ interface RouteDeclIdentity {
      *     ② 2 条「一条路径住着两只域」的跨域行按方法拆成两行各归各域(`/v1/tasks` = trace-usage 的 GET +
      *     tasks 的 POST;`/v1/memory/export` = memory-policy 的 GET + memory-bundle 的 POST)。 */
     readonly methods: readonly RouteMethod[];
+    /**
+     * 「这条 GET 开的是一条**只读订阅**」—— 一条 SSE 读面(推送队列 / 账本 tail),它看着别人干活,自己不是活(S-1281)。
+     * 在场 ⇒ 分派器不把它记进在飞(`drainState.inflight()`:排空等的、`/health` 报的、SIGHUP 空闲窗与附着租约读的那一只),只记进附着
+     * (`attachedStreams()`:壳还挂在这只引擎上);排空进入那一拍(以及硬停起点)由分派器发一帧 `draining` 终帧后关掉它
+     * (`drainState.endSubscriptions`)。闭集 = 八条 GET SSE 读面,逐行理由见各行注;**唯一**一条「在飞腿的流」`POST /v1/tasks/stream`
+     * 不带它 —— 那条流就是 sync 腿本身(关流 = 断连语义),照旧算在飞。漏标一条订阅的方向是**多算在飞**(排空多等),不是少等。
+     */
+    readonly subscription?: true;
 }
 /**
  * **可分派行**:一条真路由。匹配式二选一 —— `path`(精确;标签**就是** path 自身,所以没有 label 列,

package/dist/http/route-table.d.ts

@@ -141,6 +141,9 @@ export declare function billableKindOf(url: string): BillableKind | undefined;
  *  `billable=false`(零模型工作),塞进那张名单会让它们连带吃 drain 与 roster-pending 两道 503 ——
  *  而收编与规则读写在排空期/roster 未落时做完全无害。 */
 export declare function isCredentialGatedRewrite(method: string, url: string): boolean;
+/** S-1281:这次请求是不是一条**只读订阅**(`RouteDeclFacts.subscription` 那一列;方法也要对上 —— 订阅行恒只认 GET)。
+ *  分派器在 admission 那一拍(第一个 await 之前)同步判它:订阅不进在飞计数,只进附着集与订阅集。 */
+export declare function isSubscriptionRequest(method: string, url: string): boolean;
 /** 见 `RouteDeclFacts.methodDispatched` 的头注(单 URL 多方法端点)。 */
 export declare function isMethodDispatchedSubmitPath(url: string): boolean;
 /** 一次分派查找的结果:命中的行与它的参数,外加**这条路径上所有行**的方法并集(405 的 `Allow`)。 */

package/dist/http/route-table.js

@@ -111,6 +111,7 @@ const LABEL_BY_PATH = new Map(ROUTE_DECLARATIONS.flatMap((d) => ("path" in d ? [
 const SHAPED_LABEL_DECLS = ROUTE_DECLARATIONS.filter((d) => !("path" in d) && typeof d.label === "string");
 const BILLABLE_DECLS = ROUTE_DECLARATIONS.filter((d) => d.billable !== undefined);
 const METHOD_DISPATCHED_DECLS = ROUTE_DECLARATIONS.filter((d) => d.methodDispatched === true);
+const SUBSCRIPTION_DECLS = ROUTE_DECLARATIONS.filter(isDispatchDecl).filter((d) => d.subscription === true);
 const CREDENTIAL_GATED_BY_METHOD = (() => {
     const m = new Map();
     for (const d of ROUTE_DECLARATIONS)
@@ -142,6 +143,9 @@ export function isCredentialGatedRewrite(method, url) {
     const rows = CREDENTIAL_GATED_BY_METHOD.get(method.toUpperCase());
     return rows !== undefined && rows.some((d) => declMatches(d, url));
 }
+export function isSubscriptionRequest(method, url) {
+    return SUBSCRIPTION_DECLS.some((d) => d.methods.includes(method) && matchDecl(d, url) !== null);
+}
 export function isMethodDispatchedSubmitPath(url) {
     return METHOD_DISPATCHED_DECLS.some((d) => declMatches(d, url));
 }

package/dist/http/routes/admin-drain.d.ts

@@ -6,8 +6,11 @@
  * 进入排空经 `drainState.enter`(收尾链装的唯一入口)。
  *  · 门序 = operator 面的既有口径(`routes/retention-ops.ts` 逐字):身份 → 授权 → 验型;billable=false,**刻意不吃排空 503**
  *    (排空中的重放必须能拿到 `already_draining` 回执,吃了就自锁)。
- *  · 体坏 ⇒ 400 `request.field_invalid`(零状态变化);身份不符 ⇒ 409 `conflict.fleet_identity`(零状态变化;拒句点名不符的字段,不回显值);
- *    没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`。
+ *  · 判序:体坏 ⇒ 400 `request.field_invalid`(零状态变化)→ 没有收尾链(嵌入宿主 / 测试夹具)⇒ 501 `capability.drain_state_required`
+ *    → 身份不符 ⇒ 409 `conflict.fleet_identity`(零状态变化;拒句点名不符的字段,不回显值)→ 入口:已在排空 / 硬停已在进行 ⇒ 200 回执
+ *    (这一发的期限不会被采用);这一发会进入排空而 `deadlineAt` 离进入那一拍超过 `FLEET_LEASE_OUTAGE_MAX_MS`(`config.fleetLeaseOutageMaxMs`,
+ *    本口随入参声明的准入上界,`fleet/drain-entry.ts` 规则 2)⇒ 入口答拒、本口 400 `request.field_invalid`(零状态变化;拒句点名字段、上界的
+ *    席名与值,不回显请求带的期限)。
  *  · 首次 ⇒ 200 回执 `state:"draining"`;同一 `actionId`(或别的动作)再来 ⇒ 200 `already_draining`,回显第一次的 `since` / `deadlineAt`,不重置。
  *  · 人手形:`actionId` 自取(推荐 `manual:<uuid>`),身份照样四元比对 —— 非 fleet 成员不带 `expectedGeneration`(缺席对缺席);
  *    `instanceId` 在场才比(从本机 `/health` 读);不带 `scope` = 点名缺省 scope(多租引擎要带它自己的 `FLEET_SCOPE`)。

package/dist/http/routes/admin-drain.js

@@ -39,8 +39,20 @@ export async function handleAdminDrain(req, res, match, ctx) {
                 sendError(res, 409, "conflict.fleet_identity", `the drain request names a different instance than this engine (mismatched: ${mismatched.join(", ")}) — nothing was changed; compare with this engine's GET /health (worker comes from SEMA_REGISTRY_WORKER, generation from FLEET_GENERATION, scope from FLEET_SCOPE — unset, and a request without scope, mean "${fleetScopeOf(undefined)}")`);
                 return;
             }
-            sendJson(res, 200, enter({ actionId: request.actionId, deadlineAt: request.deadlineAt }));
-            return;
+            const answer = enter({ actionId: request.actionId, deadlineAt: request.deadlineAt, deadlineBoundMs: deps.config.fleetLeaseOutageMaxMs });
+            switch (answer.state) {
+                case "deadline_beyond_bound":
+                    sendError(res, 400, "request.field_invalid", `the drain request's deadlineAt is further from now than FLEET_LEASE_OUTAGE_MAX_MS (${answer.boundMs} ms) on this engine's clock — the longest this engine stays up without serving; send a nearer deadline — nothing was changed`);
+                    return;
+                case "draining":
+                case "already_draining":
+                    sendJson(res, 200, answer);
+                    return;
+                default: {
+                    const unhandled = answer;
+                    throw new Error(`drain entry: unknown answer ${JSON.stringify(unhandled)}`);
+                }
+            }
         }
         default:
             return assertNever(match.decl.id);

package/dist/http/routes/approvals-assistant.d.ts

@@ -151,6 +151,7 @@ export declare const APPROVALS_ASSISTANT_ROUTES: readonly [{
     readonly id: "approvals-stream";
     readonly path: "/v1/approvals/stream";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "assistant-inbox";
     readonly path: "/v1/assistant/inbox";

package/dist/http/routes/approvals-assistant.js

@@ -7,7 +7,7 @@ import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
-import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, storedBodyPermissionMode } from "../../task-settings.js";
+import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { redactRiskDescriptor } from "../../observability/run-terminal.js";
@@ -59,7 +59,7 @@ const DECISION_DOOR_FAMILY = {
     "assistant-task-plan-review": {
         accepted: PLAN_REVIEW_BODY_DECLARED_KEYS,
         requestNoun: "plan-review-request",
-        costliestTypo: "a misspelled `permissionModeAfter` silently leaves this task read-only after you approved its plan",
+        costliestTypo: "a misspelled `permissionModeAfter` silently leaves this task asking before every write after you approved its plan",
     },
 };
 const SUBMIT_BODY_NEAR_MISS_KEYS = ["permissionMode"];
@@ -534,8 +534,8 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", `permissionModeAfter must be one of ${PLAN_APPROVE_PERMISSION_MODES_AFTER.map((m) => JSON.stringify(m)).join(" | ")} when present (the permission mode this task continues in once the plan is approved; absent = "default", which keeps asking before each write)`);
                 return;
             }
-            if (decision !== "approve" && body.permissionModeAfter !== undefined) {
-                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with decision 'approve' (got '${decision}')`);
+            if (!planReviewDecisionExitsPlan(decision) && body.permissionModeAfter !== undefined) {
+                sendError(res, 400, "request.field_conflict", `permissionModeAfter is only valid with a decision that carries the plan out ('approve' or 'edit'; got '${decision}')`);
                 return;
             }
             if (body.reason !== undefined && typeof body.reason !== "string") {
@@ -610,7 +610,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             if (body.permissionModeAfter !== undefined) {
                 const storedCtx = plan.prepared.ctx;
                 if (storedCtx.body !== undefined && storedBodyPermissionMode(storedCtx.body) !== "plan") {
-                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not submitted with permissionMode \"plan\", so approving the plan lifts no read-only restriction");
+                    sendError(res, 400, "request.field_conflict", "permissionModeAfter does not apply to this task: it was not started in plan mode (its stored permission mode is not \"plan\"), so approving the plan returns it to the mode it was in before planning");
                     return;
                 }
             }
@@ -910,7 +910,7 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
 }
 export const APPROVALS_ASSISTANT_ROUTES = [
     { id: "approvals-list", path: "/v1/approvals", methods: ["GET"] },
-    { id: "approvals-stream", path: "/v1/approvals/stream", methods: ["GET"] },
+    { id: "approvals-stream", path: "/v1/approvals/stream", methods: ["GET"], subscription: true },
     { id: "assistant-inbox", path: "/v1/assistant/inbox", methods: ["GET"] },
     { id: "assistant-tasks", path: "/v1/assistant/tasks", methods: ["GET"] },
     { id: "approval-decide", pattern: /^\/v1\/approvals\/(?<sessionId>[^/]+)\/decide$/, label: "/v1/approvals/:id/decide", methods: ["POST"] },

package/dist/http/routes/capabilities.js

@@ -4,7 +4,8 @@ import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
 import { taskWriteFaceRefusal } from "../../hosted-posture.js";
-import { autonomyOverrides } from "../../runtime-governance.js";
+import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
+import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
@@ -64,7 +65,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
-            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, principal: gatedPrincipal(req, deps.config), localDeny: deps.config.permissionsDisableAutoMode });
+            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, floor: autonomyModeFloor(deps.config.autonomy), principal: gatedPrincipal(req, deps.config), localDeny: deps.config.permissionsDisableAutoMode });
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
             const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPrincipal(req, deps.config)).available;
@@ -82,7 +83,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                     ? { stream: true, sessionScope: true, observe: true, resume: "snapshot", bgNotifyFailClosed: true, steerPriority: "engine", hookFailureNotice: true, leaseClient: true, generationEcho: true }
                     : false,
                 workspace: facts.workspaceBrowse().available,
-                leader: facts.leaderLane(deps).available,
+                leader: facts.leaderLane(deps).available && leaderEntryRefusal(leaderRunEntry(deps.config.autonomy)) === undefined,
                 images: facts.imagePool(deps).available,
                 memory: false,
                 memoryWrite: false,
@@ -144,7 +145,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 skillToolLists: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
-                taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyOverrides(deps.config.autonomy).writeFace !== "roots",
+                taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyKeepsOpenWriteFace(deps.config.autonomy),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: facts.mcpInjection(deps).available,
                 a2a: true,

package/dist/http/routes/fleet.d.ts

@@ -14,6 +14,7 @@ export declare const FLEET_ROUTES: readonly [{
     readonly id: "fleet-stream";
     readonly path: "/v1/fleet/stream";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
 export type FleetRouteId = RouteIdsOf<typeof FLEET_ROUTES>;

package/dist/http/routes/fleet.js

@@ -239,6 +239,6 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
     });
 }
 export const FLEET_ROUTES = [
-    { id: "fleet-stream", path: "/v1/fleet/stream", methods: ["GET"] },
+    { id: "fleet-stream", path: "/v1/fleet/stream", methods: ["GET"], subscription: true },
 ];
 //# sourceMappingURL=fleet.js.map

package/dist/http/routes/images.d.ts

@@ -55,6 +55,7 @@ export declare const IMAGES_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/images/bakes/:id/events";
     readonly methods: readonly ["GET"];
+    readonly subscription: true;
 }, {
     readonly id: "image-bake-cancel";
     readonly pattern: RegExp;