@sema-agent/server 7.121.0 → 7.123.0

package/dist/fleet/engine-signal.js

@@ -23,15 +23,24 @@ export function mintEngineSignal(deps) {
     const ds = deps.drainState;
     const draining = ds === undefined ? undefined : drainingFactOf(ds);
     const restart = deps.restartState?.();
-    const gen = deps.configApplyState?.();
+    const configApply = deps.configApplyState?.();
     return {
         verdict,
         ...(draining !== undefined ? { draining } : {}),
         ...(restart !== undefined ? { restart } : {}),
         ...(deps.config?.fleetGeneration !== undefined ? { generation: deps.config.fleetGeneration } : {}),
-        ...(deps.instanceId !== undefined ? { instanceId: deps.instanceId } : {}),
         lease: deps.servingLease?.() ?? LEASE_NONE,
-        ...(gen !== undefined ? { configTargetVersion: gen.configTargetVersion, configAppliedVersion: gen.configAppliedVersion } : {}),
+        ...(configApply !== undefined ? { configApply } : {}),
+    };
+}
+export const ENGINE_SIGNAL_KEY = "engineSignal";
+export function buildEngineSignal(s) {
+    return {
+        ready: s.verdict.ready,
+        ...(s.draining !== undefined ? { draining: s.draining } : {}),
+        ...(s.restart !== undefined ? { restart: s.restart } : {}),
+        ...fleetMembershipKeys(s),
+        ...(s.configApply !== undefined ? { configTargetVersion: s.configApply.configTargetVersion, configAppliedVersion: s.configApply.configAppliedVersion } : {}),
     };
 }
 export function fleetMembershipKeys(s) {
@@ -51,8 +60,23 @@ export function fleetMembershipKeys(s) {
         }
     }
 }
-export function drainingFlag(s) {
-    return !s.verdict.ready && s.verdict.reasons.includes("draining");
+export function heartbeatReadinessKeys(s) {
+    return { ready: s.verdict.ready, draining: s.draining !== undefined };
+}
+export function healthDrainingKeys(s) {
+    return s.draining === undefined ? {} : { draining: true, drainingSince: s.draining.since };
+}
+export function healthConfigLedgerKeys(s) {
+    const g = s.configApply;
+    if (g === undefined)
+        return {};
+    return {
+        configTargetVersion: g.configTargetVersion,
+        configAppliedVersion: g.configAppliedVersion,
+        configTargetOrdinal: g.configTargetOrdinal,
+        configAppliedOrdinal: g.configAppliedOrdinal,
+        ...(g.configApplyStaleMs !== undefined ? { configApplyStaleMs: g.configApplyStaleMs } : {}),
+    };
 }
 export function restartActionable(s) {
     return s.restart !== undefined && s.restart.withheld !== true;

package/dist/fleet/serving-lease.js

@@ -39,8 +39,8 @@ export function createServingLeaseClient(o) {
     const epoch = o.clock?.epoch ?? Date.now;
     const f = o.fetchImpl ?? fetch;
     const stickyPath = o.dataRoot === undefined ? undefined : join(o.dataRoot, SERVING_LEASE_DENIED_FILE);
-    let enabled = false;
-    let enabledAtMono = 0;
+    let capability;
+    const enabled = () => capability?.announced === true;
     let denied = false;
     let stopped = false;
     let lease;
@@ -55,7 +55,7 @@ export function createServingLeaseClient(o) {
     };
     const schedule = (ms) => {
         clear();
-        if (stopped || denied || !enabled)
+        if (stopped || denied || !enabled())
             return;
         timer = setTimeout(() => void renewNow(), Math.max(RENEW_MIN_INTERVAL_MS, ms));
         timer.unref?.();
@@ -97,7 +97,7 @@ export function createServingLeaseClient(o) {
         o.drain({ actionId: leaseDrainActionId(o.generation), deadlineAt: epoch() + o.drainWindowMs() });
     };
     const renewOnce = async () => {
-        if (stopped || denied || !enabled)
+        if (stopped || denied || !enabled())
             return;
         const sendMono = mono();
         const sendEpoch = epoch();
@@ -132,7 +132,7 @@ export function createServingLeaseClient(o) {
         failStreak = 0;
         switch (reading.verdict) {
             case "granted":
-                if (denied || !enabled)
+                if (denied)
                     return;
                 lease = { expiresAtMono: sendMono + reading.ttlMs, leaseUntil: sendEpoch + reading.ttlMs };
                 nextInMs = reading.ttlMs / 3;
@@ -161,29 +161,27 @@ export function createServingLeaseClient(o) {
                 return;
             const on = caps?.servingLease === true;
             if (!on)
-                recordFailOpen("server.fleet.serving-lease-capability-absent", `worker=${o.center.worker} generation=${o.generation} was=${enabled ? "enabled" : "none"}`);
-            if (on && !enabled) {
-                enabled = true;
-                enabledAtMono = mono();
+                recordFailOpen("server.fleet.serving-lease-capability-absent", `worker=${o.center.worker} generation=${o.generation} was=${enabled() ? "enabled" : "none"}`);
+            if (on && !enabled()) {
+                capability = { announced: true, firstSeenAtMono: capability?.firstSeenAtMono ?? mono() };
                 o.logger?.info("fleet_serving_lease_enabled", { generation: o.generation, worker: o.center.worker });
                 void renewNow();
             }
-            else if (!on && enabled) {
-                enabled = false;
-                lease = undefined;
+            else if (!on && capability?.announced === true) {
+                capability = { announced: false, firstSeenAtMono: capability.firstSeenAtMono };
                 clear();
-                o.logger?.warn("fleet_serving_lease_disabled", { note: "the fleet center no longer announces the servingLease capability — the lease is out of effect (leaseState none) until it does again" });
+                o.logger?.warn("fleet_serving_lease_disabled", { note: "the fleet center no longer announces the servingLease capability — the lease is out of effect (leaseState none) until it does again; its outage clock is not reset (when the capability returns, the last grant and this process's first sighting of the capability still count)" });
             }
         },
         view() {
             if (denied)
                 return { state: "denied" };
-            if (!enabled)
+            if (capability === undefined || !capability.announced)
                 return { state: "none" };
             const now = mono();
             if (lease !== undefined && now < lease.expiresAtMono)
                 return { state: "granted", leaseUntil: lease.leaseUntil };
-            const expiredAt = lease?.expiresAtMono ?? enabledAtMono;
+            const expiredAt = lease?.expiresAtMono ?? capability.firstSeenAtMono;
             return { state: "expired", pastOutageMax: now - expiredAt >= o.outageMaxMs };
         },
         resumeStickyDenial() {

package/dist/fleet-client.d.ts

@@ -6,10 +6,12 @@
  *    配置席 `fleetAdvertiseAddress`(env `FLEET_ADVERTISE_ADDRESS`,`loadConfig` 解析一次;可达性是运维的话,不自猜:k8s pod IP /
  *    docker alias / 127.0.0.1:port 只有部署环境自己知道)。不配中心的部署零行为变化;配了中心而不公告的引擎只报用量、不注册(7.105.0 及以前它连用量都不报)。
  *  - **announce=注册=心跳同形状幂等 upsert**:boot 后(listen 之后)POST 一次 + 每 heartbeatMs 续。
- *    `ready` / `draining` 两字段由**同一只**就绪谓词的同一次读铸(S-740:`http/readiness.ts` 的 `readinessOf`,
- *    与 `/health.ready`、`GET /readyz`、计费提交门同源):`ready = verdict.ready`(= roster 已落 ∧ ¬draining),
- *    `draining = reasons ∋ "draining"`。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时心跳说「就绪」
- *    而计费提交在 503。
+ *    `ready` / `draining` 两字段由引擎信号铸点的同一次读铸(S-740:`ready` = `http/readiness.ts` `readinessOf` 的判,
+ *    与 `/health.ready`、`GET /readyz`、计费提交门同源;= roster 已落 ∧ ¬draining),`draining` = 排空事实在场(与嵌套
+ *    `engineSignal.draining` 同一个字段,`fleet/engine-signal.ts` 规则 5)。修前 `ready = !isDraining()`,不含 roster ⇒ roster 未落时
+ *    心跳说「就绪」而计费提交在 503。
+ *  - **`engineSignal`(7.123.0)**:引擎态整只(契约 `EngineSignal`),与扁平键同一次读数;契约包 10.x 的心跳形没有它的座位(10.x 中心
+ *    默认 strip 解析丢掉它、照收心跳);扁平布尔 `draining` settings-schema 12.0.0 删、本引擎 7.124.0+ 删发。
  *  - **`restart?`(S-741)**:在场 ⇔ 本副本必须重启才能应用配置 —— 取自 `/health.restart` **同一只**取值口(装配层接
  *    `deployment.restartState`,config-center 的 `restartState()`),同一个对象,形 = settings-schema `RestartSignal`;
  *    缺席即键缺席(中心按行整体替换,不合并 —— 一条不带它的心跳就是「不再需要」)。
@@ -80,8 +82,8 @@ export interface FleetClientOpts {
     advertiseAddress?: string | undefined;
     version: string;
     /** 编排器片 2 件 1:引擎信号的**一只铸点**(装配层接 `mintEngineSignal(deployment)` —— `/health` 与 `/readyz` 读的同一只、同一个 deps 组)。
-     *  每条公告现铸**一次**,`ready` / `draining` / `restart` / 代际与租约三键 / 世代账都取自这一次(不会撕裂成 `ready:true` + `draining:true`,
-     *  也不会出现心跳与 `/health` 各算一份重启或租约)。修前是 `readiness` + `restart` 两只取值口(S-740 / S-741),合进这一只。 */
+     *  每条公告现铸**一次**,嵌套 `engineSignal` 与扁平 `ready` / `draining` / `restart` / 代际与租约三键都取自这一次(不会撕裂成 `ready:true` +
+     *  `draining:true`,也不会出现心跳与 `/health` 各算一份重启或租约)。修前是 `readiness` + `restart` 两只取值口(S-740 / S-741),合进这一只。 */
     signal: () => EngineSignalFacts;
     /** S-768:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
      *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */

package/dist/fleet-client.js

@@ -1,5 +1,5 @@
 import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
-import { drainingFlag, fleetMembershipKeys } from "./fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./config-center/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 export const FLEET_USAGE_KEY_CAP = 1024;
@@ -99,18 +99,19 @@ export function startFleetClient(opts) {
             return;
         try {
             const signal = opts.signal();
+            const engineSignal = buildEngineSignal(signal);
             const modelRefusals = opts.modelRefusals();
             const body = {
                 instanceId: opts.instanceId,
                 worker: opts.center.worker,
                 address,
                 version: opts.version,
-                ready: signal.verdict.ready,
-                draining: drainingFlag(signal),
+                ...heartbeatReadinessKeys(signal),
                 heartbeatMs,
                 ...(signal.restart !== undefined ? { restart: signal.restart } : {}),
                 ...(modelRefusals !== undefined ? { modelRefusals } : {}),
                 ...fleetMembershipKeys(signal),
+                [ENGINE_SIGNAL_KEY]: engineSignal,
             };
             const { res } = await send("fleet-instances", "POST", body);
             if (!res.ok)

package/dist/governance-overrides.d.ts

@@ -7,13 +7,18 @@
  * 塞 `allowedTools` 的调用点会静默改写请求的表。型上禁掉它(`allowedTools?: never`),写出来就是编译红 —— 比文本扫描的静态门(方括号写法、
  * 展开形会漏)更硬。
  *
+ * 🔴 入参型上同样**没有** `permissionMode`:一条 run 的模式词只有存储的提交体一个源(写者 = 每一个 spec 出生点的盖章 —— 新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx` —— 与 `plan_review` 写回),
+ * 按段的收紧折叠写它就是第二个源 —— 一个被批准的计划会在下一次挂起→续跑被折回 plan。core 对模式词是钳(不会放宽),所以这里不另设运行期守卫:
+ * 型禁就是这条规则的全部(`permissionMode?: never`,写出来就是编译红)。
+ *
  * 🔴 型禁有一个洞([ref] 合并复审 opus 腿):本仓没开 `exactOptionalPropertyTypes`,`{ allowedTools: undefined }` 过型检,而 core 的替换会把 base 上的表
  * 抹成 `undefined`。所以折叠口再加一道**运行期**守卫:入参对象自带 `allowedTools` 键(任何值,含 `undefined`)⇒ 抛(fail-closed:宁多问一次)。
  */
 import { type TaskSpec } from "@sema-agent/core";
-/** 收紧折叠的入参:`TaskSpec` 的字段,`allowedTools` 除外(型上禁)。 */
-export type GovernanceOverrides = Partial<Omit<TaskSpec, "allowedTools">> & {
+/** 收紧折叠的入参:`TaskSpec` 的字段,`allowedTools` 与 `permissionMode` 除外(型上禁)。 */
+export type GovernanceOverrides = Partial<Omit<TaskSpec, "allowedTools" | "permissionMode">> & {
     readonly allowedTools?: never;
+    readonly permissionMode?: never;
 };
 /** 本仓唯一的收紧折叠口(deny-wins 合并;core 在放宽时抛)。 */
 export declare function tightenGoverned(base: TaskSpec, overrides: GovernanceOverrides): TaskSpec;

package/dist/http/admission.js

@@ -2,7 +2,8 @@ import { APPROVAL_REACH, MCP_IMAGE_MAX_BASE64, isApprovalReach, isPermissionMode
 import { isModelAllowlisted, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, stampEntryPermissionMode, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { autonomyModeFloor } from "../runtime-governance.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
@@ -623,19 +624,20 @@ export function createAdmission(ctx) {
             sendError(res, 400, "request.precondition_unmet", "cascade requested but no ladder configured — set MODEL_CASCADE_LADDER (catalog model names, cheapest→strongest)");
             return null;
         }
+        const admitted = stampEntryPermissionMode(body, autonomyModeFloor(deps.config.autonomy));
         try {
-            const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
+            const auth = deps.authorize ? await deps.authorize({ req, body: admitted }) : undefined;
             const engineNotices = [];
-            const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
+            const spec = await deps.resolveSpec(admitted, req, auth, { leg: "fresh", ...(legFacts?.liveStream === true ? { liveStream: true } : {}), onNotice: (n) => engineNotices.push(n) });
             const bindingIntent = await resolveDevicePlacementIntent({
                 config: deps.config,
                 req,
                 rootSessionId: spec.sessionId,
-                deviceId: body.deviceId,
+                deviceId: admitted.deviceId,
                 store: deps.deviceStore,
                 enrollment: deps.deviceEnrollment,
             });
-            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
+            return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: admitted.jobId, body: admitted, ...(bindingIntent === undefined ? {} : { bindingIntent }), ...(engineNotices.length > 0 ? { engineNotices } : {}) };
         }
         catch (err) {
             if (err instanceof HttpError) {

package/dist/http/approval-sweeps.js

@@ -8,7 +8,7 @@ import { hasServiceAuth } from "./dispatch.js";
 import { gatedPrincipal } from "./principal-gate.js";
 import { admissionRefusalOf, readinessOf } from "./readiness.js";
 import { readResumeCtx } from "./resume-ctx-read.js";
-import { storedBodyReplayRefusal } from "./checkpoint-ctx.js";
+import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -72,7 +72,7 @@ export function createApprovalSweeps(ctx) {
                 return undefined;
             if (read.kind === "absent")
                 return undefined;
-            return storedBodyReplayRefusal(read.ctx);
+            return storedBodyReplayRefusal(read.ctx, deps.config.autonomy);
         };
         let parkedSkipped = 0;
         const replaySkipped = [];

package/dist/http/checkpoint-ctx.d.ts

@@ -20,8 +20,19 @@
  * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里技能(顶层 / 子代)的 `disallowedTools` 有引擎读成空的条目(`"Bash "` 这类 7.41 去白后有效、
  * 7.42 什么也不拒的条目)⇒ 提交 400(`resolveSpec`,拒点);存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`。判据函数 = `rule-entry-list.ts` `skillDenyInertEntryOf`。
  *
- * ## 一只判据、五个问点({@link storedBodyReplayRefusal} / {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面两问合在 {@link storedBodyReplayRefusal} 一处,答复合在 {@link storedBodyReplayAnswer} 一处。
+ * ## 第三问(7.122.0):体里模式词的读法记号
+ * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
+ * 治理层不再在每一次续跑重钳。更早版本写下的行体里是**请求的原词**,运维的 plan 由治理层每段重新折上(7.121.x 及以前:只读手 + 写面 roots)。
+ * 那种行在本版上按体里的原词重放 = 静默放宽(`acceptEdits` / `bypassPermissions` 原词直接生效;无词 ⇒ 引擎读 checkpoint 记下的词)。
+ * ⇒ 同一条规则:**写模式词的人盖读法记号** —— 模式词的写者:每一个出生点(新的持久化写都经 {@link buildCheckpointCtx})与 `plan_review` 写回(经 {@link withPermissionModeRewritten}),各自写词的同一拍在 ctx 上写记号
+`permissionModeReading`(闭集只有当前一词 {@link PERMISSION_MODE_READINGS});续跑重放之前,**本部署此刻有入口地板**
+ * (`runtime-governance.ts` `autonomyModeFloor`)而行上没有当前记号、且体的生效词被地板钳会变 ⇒ 拒(行字节不动)。没有地板的部署、体的词本就在地板之下(`plan`)的行
+ * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
+ * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
+ *
+ * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
+ * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
@@ -32,13 +43,19 @@
  * 一次性迁移登记表(本条那一行):所有旧读法下停驻的行都已结束或被收割(停驻行的终局 = 落盘起 `TERMINAL_BACKSTOP_MS`,见
  * `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删。
  */
+import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
-import { type SkillDenyInertEntry } from "../rule-entry-list.js";
+import type { SkillDenyInertEntry } from "../rule-entry-list.js";
 /** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
  *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
 export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
 export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
+/** 体里模式词的读法记号闭集(一词 = 当前读法):这一行体的顶层 `permissionMode` 是这条 run 模式词**唯一的源**(提交入口盖过运维地板、`plan_review` 写回改它),
+ *  续跑照它读、不再由治理层按段重钳。写点两个 = {@link buildCheckpointCtx}(每一次新的持久化写都写)与 {@link withPermissionModeRewritten}(`plan_review` 写回改词的那一拍写);
+ *  **不改词**的续跑腿写回传原 ctx ⇒ 记号随行。 */
+export declare const PERMISSION_MODE_READINGS: readonly ["entry_word"];
+export type PermissionModeReading = (typeof PERMISSION_MODE_READINGS)[number];
 /** 被拒的行是在哪种读法下写的(闭集;拒句按它穷举):`list` = 无记号或记号认不得(≤7.114.0 的名单读法;认不得的记号不是任何一代的证据,
  *  按最早那一代说话);`statement` = 7.115.0–7.116.x 写下的表态读法。 */
 export declare const ALLOW_LIST_READING_ERAS: readonly ["list", "statement"];
@@ -53,13 +70,44 @@ export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
  *
  * 调用方是「本进程刚按当前读法读过这份体」的写点:fresh 提交(受理门按当前读法读过 `allow`),或已经过了续跑拒臂的重放腿
  * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
- * 续跑腿的**写回**不经本函数:它传读进来的 ctx(或其展开),记号随行;在写回口重新判会把一条没记号的旧行「洗」成新行。
+ * 续跑腿的**写回**不经本函数:**不改词**的写回传读进来的 ctx(记号随行,不重新判 —— 在写回口重新判会把一条没记号的旧行「洗」成新行);
+ * **改词**的写回(只有 `plan_review` 的批准 / 编辑)经 {@link withPermissionModeRewritten}。
  */
 export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
 }): CheckpointCtx;
+/**
+ * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
+ * `test/allow-list-reading-park-refusal.test.ts` 枚举调用点,多一处即红)。与 {@link buildCheckpointCtx} **同一条规则**:按当前读法写下的词,盖当前读法记号。
+ *
+ * 为什么记号必须随词一起写,而不是留给读的一侧去豁免:第三问问的是「体的词是不是按当前读法写下的」,记号就是这句话的证据。改写之后体里的词是本版的 `plan_review`
+ * 刚写下的(一个人刚批准的档),它确实是 `entry_word` 读法的词;若只改体、记号缺席,重建段的同一问把它读成「7.121.x 的请求原词」,被地板钳回 `plan` ≠ 所写词 ⇒ 误拒
+ * 一条刚被批准的 run。判据侧(`stored-body-replay.ts`)**不为「plan_review 之后」另开特判臂** —— 读的一侧只有一个读法,写的一侧各自负责盖章。
+ *
+ * 为什么这不是在「洗」旧行:走到写回口的行,其**原体**已过 prepare 段的同一问(词被地板钳不变:词已是 `plan`,或本部署没有地板);原体的词会被地板钳的旧行
+ * (`acceptEdits` / `bypassPermissions` / 无词)在 prepare 段就被拒,到不了这里。入参 `ctx` 的其余位(memoryScope / 无人值守标 / allow 记号)原样随行,只换体与模式词记号。
+ *
+ * 本模块零值依赖的闭包纪律不变(随包排空脚本经编译产物 import;`test/drain-check-local.test.ts`):本函数只用本模块内的东西。
+ */
+export declare function withPermissionModeRewritten(ctx: CheckpointCtx, body: TaskRequestBody): CheckpointCtx;
+/** 行上带的是不是当前的模式词读法记号(第三问的记号那一半;另一半 —— 体的生效词被地板钳会不会变 —— 读请求设置的解析层,住在 `http/stored-body-replay.ts`)。
+ *  记号缺席或认不得 ⇒ 不是「按当前读法写下」的证据,与 allow 记号同一条纪律。 */
+export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean;
+/**
+ * 第三问的拒答复 —— 码与落点同 allow 记号那一问(`checkpoint.unsupported_version`,409,`retriable:true` = 那张卡仍 pending,**不是**「原样重试会成功」)。
+ * 句子说原因(更早的版本在每次续跑重钳运维的 AUTONOMY、没把它记进任务;本版只在提交时记一次 ⇒ 续跑会按任务提交时的原词跑)与两条出路。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: { error: "<整句双引号字面>", errorCode: "<码>"`,中间只许有空白。
+ */
+export declare function permissionModeReadingRefusal(): {
+    status: number;
+    body: {
+        error: string;
+        errorCode: string;
+        retriable: true;
+    };
+};
 /**
  * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
  * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
@@ -89,12 +137,11 @@ export type StoredBodyReplayRefusal = {
 } | {
     readonly kind: "skill_deny_inert";
     readonly entry: SkillDenyInertEntry;
+} | {
+    readonly kind: "permission_mode_reading";
+    readonly stored: PermissionMode | undefined;
+    readonly floor: PermissionMode;
 };
-/**
- * 「存量体能否重放」的**唯一**判据(文件头「一只判据、五个问点」):不能 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。
- * 顺序:先 allow 读法记号,再技能拒侧读成空(两问都中时答第一问 —— 任一问中都不重放,句子只需一句)。
- */
-export declare function storedBodyReplayRefusal(ctx: CheckpointCtx): StoredBodyReplayRefusal | undefined;
 /** 续跑家族交回的拒答复形(`{ status, body }`,由 `sendResumeOutcome` / 各路由发送;`body` 至少 `error` + `errorCode`)。 */
 export interface ResumeRefusalAnswer {
     readonly status: number;
@@ -110,17 +157,19 @@ export interface ResumeRefusalAnswer {
  */
 export declare function resumeBlockedByPolicyAnswer(message: string, blockedBy: string, extra?: Record<string, unknown> | undefined): ResumeRefusalAnswer;
 /**
- * {@link storedBodyReplayRefusal} 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
  * 事件名三个(问点各一:`resume_refused_stored_body` / `steer_wake_park_refused_stored_body` / `deny_sweep_stored_body_skipped`),字段形只有这一只。
  */
 export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
     kind: StoredBodyReplayRefusal["kind"];
     era?: AllowListReadingEra;
     layer?: SkillDenyInertEntry["layer"];
+    storedMode?: PermissionMode | null;
+    floor?: PermissionMode;
     note: string;
 };
 /**
- * {@link storedBodyReplayRefusal} 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};技能拒侧 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * `request.field_invalid` 同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  */
 export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal): ResumeRefusalAnswer;

package/dist/http/checkpoint-ctx.js

@@ -1,5 +1,5 @@
-import { skillDenyInertEntryOf } from "../rule-entry-list.js";
 export const PERMISSIONS_ALLOW_READINGS = ["allow_layer"];
+export const PERMISSION_MODE_READINGS = ["entry_word"];
 export const ALLOW_LIST_READING_ERAS = ["list", "statement"];
 export function bodyCarriesAllowList(body) {
     const settings = body?.settings;
@@ -17,6 +17,24 @@ export function buildCheckpointCtx(fields) {
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
+        permissionModeReading: "entry_word",
+    };
+}
+export function withPermissionModeRewritten(ctx, body) {
+    return { ...ctx, body, permissionModeReading: "entry_word" };
+}
+export function permissionModeReadingStated(ctx) {
+    const reading = ctx.permissionModeReading;
+    return typeof reading === "string" && PERMISSION_MODE_READINGS.includes(reading);
+}
+export function permissionModeReadingRefusal() {
+    return {
+        status: 409,
+        body: {
+            error: "this task was suspended by an earlier server version that re-applied this deployment's AUTONOMY on every resume instead of recording it in the task; this version records the operator's plan floor once, when a task is submitted, so continuing would run this task under the permission mode it was submitted with rather than the one it ran under. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel); to let it finish with read-only hands instead, set AUTONOMY=read-only until it does.",
+            errorCode: "checkpoint.unsupported_version",
+            retriable: true,
+        },
     };
 }
 export function allowListReadingUnstated(ctx) {
@@ -55,14 +73,6 @@ export function allowListReadingRefusal(era) {
         }
     }
 }
-export function storedBodyReplayRefusal(ctx) {
-    if (allowListReadingUnstated(ctx))
-        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx) };
-    const entry = skillDenyInertEntryOf(ctx.body);
-    if (entry !== undefined)
-        return { kind: "skill_deny_inert", entry };
-    return undefined;
-}
 export function resumeBlockedByPolicyAnswer(message, blockedBy, extra) {
     return {
         status: 409,
@@ -75,6 +85,8 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
         case "skill_deny_inert":
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a skill disallowedTools entry the engine now reads as empty (an earlier engine trimmed it into a working deny); it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        case "permission_mode_reading":
+            return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no log fields`);
@@ -87,6 +99,8 @@ export function storedBodyReplayAnswer(refusal) {
             return allowListReadingRefusal(refusal.era);
         case "skill_deny_inert":
             return resumeBlockedByPolicyAnswer(refusal.entry.message, "request.field_invalid");
+        case "permission_mode_reading":
+            return permissionModeReadingRefusal();
         default: {
             const unhandled = refusal;
             throw new Error(`stored-body replay refusal ${JSON.stringify(unhandled)} has no answer`);

package/dist/http/dispatch.js

@@ -3,10 +3,10 @@ import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessio
 import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath } from "./route-table.js";
-import { sendJson, sendError, isSseResponse } from "./send.js";
-import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal } from "./readiness.js";
-import { fleetMembershipKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
+import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
+import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf } from "./readiness.js";
+import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, verifiedIdentitySource } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
@@ -43,6 +43,7 @@ export function createDispatch(ctx) {
     const { deps, noteActivity, routeCtxBase, counters } = ctx;
     const openResponses = new Set();
     let lastAttachEndedAt = 0;
+    const openSubscriptions = new Set();
     if (deps.drainState) {
         deps.drainState.attachedStreams = () => {
             let n = 0;
@@ -52,6 +53,12 @@ export function createDispatch(ctx) {
             return n;
         };
         deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
+        deps.drainState.endSubscriptions = () => {
+            const { errorCode, message } = billableRefusalOf("draining").body;
+            for (const r of [...openSubscriptions])
+                if (isSseResponse(r))
+                    endSseWithError(r, { errorCode, message });
+        };
     }
     async function dispatchSegment(rows, req, res, url, search, method, allow, ctx, admit) {
         for (const row of rows) {
@@ -82,10 +89,14 @@ export function createDispatch(ctx) {
         const allow = { pre: [], post: [] };
         noteActivity(url);
         const admitted = method !== "OPTIONS" && !isProbePath(url);
-        if (admitted)
+        const subscription = admitted && isSubscriptionRequest(method, url);
+        const countedInflight = admitted && !subscription;
+        if (countedInflight)
             counters.admittedInflight++;
         if (admitted)
             openResponses.add(res);
+        if (subscription)
+            openSubscriptions.add(res);
         let logged = false;
         const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
         const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
@@ -93,8 +104,9 @@ export function createDispatch(ctx) {
             if (logged)
                 return;
             logged = true;
-            if (admitted)
+            if (countedInflight)
                 counters.admittedInflight--;
+            openSubscriptions.delete(res);
             if (openResponses.delete(res) && isSseResponse(res))
                 lastAttachEndedAt = performance.now();
             const route = routeLabel(method, url);
@@ -116,6 +128,7 @@ export function createDispatch(ctx) {
         }
         if (req.method === "GET" && url === "/health") {
             const signal = mintEngineSignal(deps);
+            const engineSignal = buildEngineSignal(signal);
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
@@ -123,7 +136,7 @@ export function createDispatch(ctx) {
             sendJson(res, 200, {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}) } : {}),
+                ...healthDrainingKeys(signal),
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(signal.verdict),
@@ -144,18 +157,7 @@ export function createDispatch(ctx) {
                     const configHandoff = deps.configHandoffState?.();
                     return configHandoff ? { configHandoff } : {};
                 })(),
-                ...(() => {
-                    const gen = deps.configApplyState?.();
-                    if (!gen)
-                        return {};
-                    return {
-                        configTargetVersion: gen.configTargetVersion,
-                        configAppliedVersion: gen.configAppliedVersion,
-                        configTargetOrdinal: gen.configTargetOrdinal,
-                        configAppliedOrdinal: gen.configAppliedOrdinal,
-                        ...(gen.configApplyStaleMs !== undefined ? { configApplyStaleMs: gen.configApplyStaleMs } : {}),
-                    };
-                })(),
+                ...healthConfigLedgerKeys(signal),
                 ...(() => {
                     const credential = deps.centerCredentialState?.();
                     return credential ? { centerCredential: credential } : {};
@@ -173,6 +175,7 @@ export function createDispatch(ctx) {
                         storeProbe: { live: probe.live, ageMs: probe.ageMs, ...(probe.error !== undefined ? { error: publicStoreProbeError(probe.error) } : {}) },
                     };
                 })(),
+                [ENGINE_SIGNAL_KEY]: engineSignal,
             });
             return;
         }

package/dist/http/health-self-report.d.ts

@@ -23,6 +23,9 @@
  * `/health` 排在凭据门之前、缺省全网卡监听:本模块只出闭集词、布尔与运维要发布的 URL。两只 URL 值都过 display-safe 律
  * (`buildDisplaySafeUrl`,所有展示面 URL 的同一个铸点):userinfo 落地、query 值成记号、尾斜杠折掉 —— issuer 的来源
  * (`AUTH_BRIDGE_ISSUER` / `SEMA_REGISTRY_URL`)起服时不判凭据形,这一道是它上无鉴权面的唯一闸。令牌、名单、worker 名、凭证一概不上。
+ * 同一张面上本模块之外还有一个**调用方自取**的串(如实,7.123.0 起;`model` / `dataRoot` / `version` 等其余非闭集的名是部署自己的事实,不是调用方放进来的):排空中的动作号 `engineSignal.draining.actionId`(`fleet/engine-signal.ts` 铸,契约 §0.4)——
+ * 引擎自起的排空是引擎的闭集词,经排空口(operator-only)进的排空是调用方自取的幂等键**原样**(契约包今天只要求非空串,推荐 `manual:<uuid>`),
+ * 所以那一键不是闭集词:调用方不要往里放秘密或人名。
  *
  * ## 在场律
  * 三键**恒在场**;缺席 = 老 worker(≤7.120.x)。`center.issuer` / `center.webBaseUrl` 缺席即缺席(没有鉴权桥 / 没配旋钮),不拼不猜。