@sema-agent/server 7.123.0 → 7.124.0

package/dist/read-face-posture.d.ts

@@ -11,14 +11,14 @@
  *
  * 于是本模块把「档位」与「档位是谁定的」拆成两个字段:值仍是 `open | roots | 缺席`,来源是本文件的
  * **四词闭集**。来源不是装饰:
- *  ① `config-center/read-face.ts` 的 **env 恒赢**判据此前用的是「`config.readFace` 键在不在场」这个
+ *  ① `web-admin-client/read-face.ts` 的 **env 恒赢**判据此前用的是「`config.readFace` 键在不在场」这个
  *     **代理**;posture 会铸键,代理当场失真(center 的 face 会被一台从没设过 env 的机器挡掉)。
  *     换成读来源之后判据说的就是它真正想说的那件事:**这台机器的 env 显式占住了这个键吗**。
  *  ② 运维面:`GET /v1/diagnostics/wiring` 报 `{face, source, note}`,「为什么这台机器是 open」有答案
  *     (裁定的补偿项:升级即放开,得让运维看得见并知道怎么钉回)。
  *
  * ## 优先序(三态,与 `config.ts` 的 `postureOn` 同形)
- * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `config-center/read-face.ts`
+ * `env 显式` > `center 发布` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
  *
  * ## 定界
@@ -54,7 +54,7 @@ export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFace
  *
  *  🔴 `center` 那句话的事实来源是 S-174(core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
  *  闭集 `SWAPPABLE_DEP_SEATS` ⇒ 组织发布/撤回一个档位,**下一拍 refresh 当场换进全部 Runner**,
- *  `config-center/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
+ *  `web-admin-client/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
  *  `CENTER_READ_FACE_LIVE_KEYS`,由 core 的 `isSwappableDepSeat` 派生)。本句此前逐字写着
  *  「(restart-to-apply)」—— G-7 抓获的那条过期断言,方向恰好是「让运维为一个已生效的变更重启 fleet」。
  *  ⚠️ 只说 `face` 这一席:三个 deny 键仍是 boot-baked,那半场的话不在这条读面上(它们没有来源位)。 */

package/dist/read-face-posture.js

@@ -7,7 +7,7 @@ export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
-        centerMeaning: "published by the config-center and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
+        centerMeaning: "published by the web-admin and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }

package/dist/run-local.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
+import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
 import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
 import { createDurableAbsenceSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
@@ -25,7 +25,8 @@ import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, configProviderKind, createConfigProvider } from "./config-provider.js";
 import { composeExecutionLane } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
-import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
+import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
+import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
 import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
@@ -337,6 +338,8 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const configProvider = createConfigProvider(providerInput);
+    if (configProvider.kind === "local")
+        logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     let effective;
     try {
         const r = await configProvider.fetchEffective(undefined);
@@ -613,7 +616,7 @@ export async function runLocal(argv, deps = {}) {
         }
         throw err;
     }
-    const mention = resolveTaskModel(undefined, args.objective, config.models, undefined, config.modelRefusals);
+    const mention = resolveTaskModel(undefined, args.objective, config.models, DEFAULT_AT_MENTION, config.modelRefusals);
     if (mention.unavailable !== undefined) {
         const { requested, name, refusal } = mention.unavailable;
         printErr(`cannot run: ${modelUnavailableMessage("@-mention", requested, name, refusal)}`);

package/dist/runtime-caps-resolver.d.ts

@@ -65,8 +65,8 @@
  */
 import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
-import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
-import type { CenterEndpoint } from "./config-center/center-request.js";
+import { fetchPrincipalCaps, type ExecutionRuling } from "./web-admin-client/facade.js";
+import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 import type { ServiceConfig } from "./config-types.js";
 import { type Logger } from "./observability/logger.js";
@@ -75,7 +75,7 @@ export declare function resetExecutionLaneDefaultTraceForTest(): void;
 export interface EntitlementsResolverOpts {
     /** S-651:中心端点(基址 + 凭证**来源**;每次抓取取一次值,不持有启动快照)。 */
     center: CenterEndpoint;
-    /** This worker's name (`SEMA_REGISTRY_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
+    /** This worker's name (`SEMA_WEB_ADMIN_WORKER`), passed as `?worker=` so a worker-scoped `wpt_<self>` token can
      *  resolve its OWN worker's principal caps (caps-only); harmless on a full token (the caps value
      *  is worker-independent). Omitted ⇒ no `?worker=` (a full-token, non-fleet deployment). */
     worker?: string;
@@ -135,7 +135,7 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * (`RuntimeCaps.autoMode` 三态逐 principal 解,[ref] 起「缺席=不阻」),任何部署级布尔都对它说不了话——
  * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
-export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
+export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "webAdmin">): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
     /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;

package/dist/runtime-caps-resolver.js

@@ -1,4 +1,4 @@
-import { fetchPrincipalCaps } from "./config-center/facade.js";
+import { fetchPrincipalCaps } from "./web-admin-client/facade.js";
 import { createIdentityBins } from "./center-credential.js";
 import { HttpError } from "./security.js";
 import { createLogger } from "./observability/logger.js";
@@ -53,7 +53,7 @@ export function toCoreRuntimeCaps(ent) {
     return Object.keys(caps).length ? caps : undefined;
 }
 export function centerEntitlementSourceWired(config) {
-    return config.configCenter !== undefined && !config.configCenter.dryRun;
+    return config.webAdmin !== undefined && !config.webAdmin.dryRun;
 }
 export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
     if (!ruling) {

package/dist/runtime-governance.d.ts

@@ -1,7 +1,7 @@
 /**
  * Runtime governance compiler — the "second baton" (center §10, core 1.114.0): turn the
- * operator's declarative `runtime.autonomy` + `runtime.commandPolicy` (`@sema-agent/settings-schema`,
- * carried to the service via sema-registry `EffectiveConfig.runtime`) into TIGHTEN-ONLY overrides on the
+ * operator's declarative `governance.autonomy` + `governance.commandPolicy` (`@sema-agent/settings-schema`,
+ * carried to the service in the effective config's `governance` domain) into TIGHTEN-ONLY overrides on the
  * per-task `TaskSpec`. Pure so it is unit-testable in isolation (the spec is otherwise assembled inside
  * main.ts's `resolveSpec`).
  *
@@ -28,7 +28,7 @@ import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernanceOverrides } from "./governance-overrides.js";
 /** 运维 autonomy 四档的**闭集**(同上)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
-export declare const AUTONOMY_MODES: ["read-only", "ask", "plan", "auto"];
+export declare const AUTONOMY_MODES: ("plan" | "auto" | "ask" | "read-only")[];
 /** A per-command governance rule (registry `runtime.commandPolicy[]`) —— **型也从契约派生**:
  *  契约给 `command` 加一条 refine / 给 `decision` 加一个判词,本仓的型当场跟上(或在下面的
  *  `RANK` / 穷尽 switch 上编译红),而不是靠人记得把手写联合改一遍。 */
@@ -39,7 +39,7 @@ export type Autonomy = NonNullable<GovernanceConfig["autonomy"]>;
 export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
  *  see {@link VALID_COMMAND_NAME}), AND the `decision` enum. Returns the list of human-readable errors (empty =
- *  OK). Called at config-apply (config-center/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
+ *  OK). Called at config-apply (web-admin-client/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through
  *  {@link compileCommandPolicyLayers}'s `decision==="deny"?…:"ask"` to ASK, silently WEAKENING an intended deny. */
@@ -176,7 +176,7 @@ export declare function autonomyKeepsOpenWriteFace(autonomy: Autonomy | undefine
  * 是 always」。`commandPolicy` 不入判据:它产的是 `toolPolicy` 的 ask,不抬 shellGate 档,与本格无关。
  *
  * ⚠️ **已知残留(codex 交叉复审 2026-08-11 逮到,如实登记而不是掩盖)**:本判据读的是**当下**的
- * config,而 `config.autonomy` 是**热改**的(`config-center/apply-effective.ts` 就地写 `config.autonomy`)。
+ * config,而 `config.autonomy` 是**热改**的(`web-admin-client/apply-effective.ts` 就地写 `config.autonomy`)。
  * 于是失真是**双向**的,不是我原先写的「只往缺席方向」:
  *  · 缺席向(常见):mint 之后运维把 `AUTONOMY=ask` 撤了 ⇒ 老 park 行归不出治理出身,少标一个;
  *  · **在场向**(窄):一条**纯 SUP 路由**产的门(`ROUTER_ENABLED` 开 ∧ 路由判 supervisor ∧ 当时治理层

package/dist/sealed-key.d.ts

@@ -2,7 +2,7 @@ import type { Logger } from "./observability/logger.js";
 /** Algorithm tag — MUST equal registry-core's `SEALED_BOX_ALG` (v1 sole value; a different alg on
  *  the wire is a loud per-model rejection in applyEffective, never a guess). */
 export declare const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
-/** The subset applyEffective needs (keeps sema-registry decoupled from fs/boot concerns). */
+/** The subset applyEffective needs (keeps web-admin decoupled from fs/boot concerns). */
 export interface SealedKeyOpener {
     has(publicKeyId: string): boolean;
     /** All private-key ids this host holds (surfaces in the no-private-key warn for operator triage). */
@@ -62,17 +62,17 @@ export declare function deriveKeyId(publicKeyRaw: Uint8Array): string;
  */
 export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Promise<SealedKeyStore>;
 /**
- * Best-effort public-key registration with the sema-registry (`POST /api/config/execution-keys`).
+ * Best-effort public-key registration with the web-admin (`POST /api/config/execution-keys`).
  *
  * HONESTY over fake automation: that endpoint is ADMIN-gated, and a fleet worker only holds
  * SERVICE_PULL_TOKEN — so automatic registration works ONLY when the operator deliberately provides
- * an admin token (SEMA_REGISTRY_ADMIN_TOKEN in this service's env; the REGISTRY_ADMIN_TOKEN alias was tombstoned in 5.0.0). Without
+ * an admin token (SEMA_WEB_ADMIN_ADMIN_TOKEN in this service's env; its older names are settings-schema tombstones). Without
  * one we do the next-best REAL thing: print the FULL public key + id at boot (a public key is not a
  * secret) with the exact registration instructions, and warn that the web "paste key" face stays
  * dark for this host until an admin registers it. Never throws (fire-and-forget from boot).
  */
 export declare function reportExecutionPublicKey(opts: {
-    /** sema-registry base URL (config.configCenter.baseUrl). Absent = no center → manual print only. */
+    /** web-admin base URL (config.webAdmin.baseUrl). Absent = no center → manual print only. */
     baseUrl?: string;
     /** Admin bearer for the center's config write face. Absent = manual print (see above). */
     adminToken?: string;

package/dist/sealed-key.js

@@ -4,7 +4,8 @@ import { join } from "node:path";
 import _sodium from "libsodium-wrappers";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { createCenterCredentialSource } from "./center-credential.js";
-import { centerFetch } from "./config-center/center-request.js";
+import { centerFetch } from "./web-admin-client/center-request.js";
+import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
 const SEAL_OVERHEAD_BYTES = 48;
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
@@ -101,7 +102,7 @@ export async function reportExecutionPublicKey(opts) {
         });
     };
     if (!baseUrl || !adminToken) {
-        manual(!baseUrl ? "no registry configured (SEMA_REGISTRY_URL unset)" : "no admin token (SEMA_REGISTRY_ADMIN_TOKEN unset; the worker's pull token cannot write execution keys)");
+        manual(!baseUrl ? `no web-admin configured (${WEB_ADMIN_ENV.url} unset)` : `no admin token (${WEB_ADMIN_ENV.adminToken} unset; the worker's pull token cannot write execution keys)`);
         return;
     }
     try {

package/dist/security.d.ts

@@ -17,9 +17,9 @@ export interface SessionListItem {
     /** K-5c (shell §K): the latest run's task_id — the shell's one-hop live-tail re-attach anchor on resume. */
     lastRunId: string | null;
     /** [ref]([ref]/[ref]):the LATEST run's **engine run id**(`TaskResult.runId`)when known —— OMIT-when-absent,
-     *  恒不铸 null。runs-ledger listers 从 latest run 的 `result` JSON 提取(终局与 park 时写、认领续跑即清空 —— S-173 ⇒ 在跑 latest 键诚实缺席);
-     *  local lister 走 `noteTaskRun` 席实时记录(⇒ 在跑也在场)——两面缺席集合不完全相等,读法一致:
-     *  缺席 = 「此行无已知 engine runId」,禁读成其它含义。⚠️ 与 `lastRunId`(= latest run 的 **task_id**)
+     *  恒不铸 null。所有 lister(SQL 双生、local 会话店 —— 它的 run 店是必填位)从 latest run 的 `result` JSON 提取(终局与 park 时写、认领续跑即清空 —— S-173
+     *  ⇒ 在跑 latest 键诚实缺席)。
+     *  读法一致:缺席 = 「此行无已知 engine runId」,禁读成其它含义。⚠️ 与 `lastRunId`(= latest run 的 **task_id**)
      *  是两条身份轴,命名对齐 core `SessionStoreSummary.lastTaskRunId`。wire:additive 键零投影透传
      *  (sessions-list.ts);sema-sdk spec `SessionSummary` 闭集候 SDK 半场开键([ref]/.82 班车)。 */
     lastTaskRunId?: string;

package/dist/service-version.d.ts

@@ -1,5 +1,5 @@
 /** Service version for GET /v1/capabilities — read from the package.json shipped next to src/ in the
- *  image (Dockerfile COPYs it). Best-effort: an unreadable file reports "unknown", never crashes boot. */
+ *  image (Dockerfile COPYs it), once per process. Best-effort: an unreadable file reports "unknown", never crashes boot. */
 declare function serviceVersion(): string;
 export { serviceVersion };
 //# sourceMappingURL=service-version.d.ts.map

package/dist/service-version.js

@@ -1,5 +1,10 @@
 import { readFileSync } from "node:fs";
+let cachedServiceVersion;
 function serviceVersion() {
+    cachedServiceVersion ??= readServiceVersion();
+    return cachedServiceVersion;
+}
+function readServiceVersion() {
     try {
         const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
         return pkg.version ?? "unknown";

package/dist/session-titler.d.ts

@@ -54,17 +54,6 @@ export interface SessionTitler {
 export declare const TITLE_MAX_CHARS = 80;
 /** Single line, control chars stripped, hard cap; surrounding quotes (a common LLM tic) trimmed. */
 export declare function sanitizeTitle(raw: string): string;
-/**
- * S-236 ②(7.106.0,cli L-687)—— objective 里**用户自己写的**那部分:剥掉全部 `<system-reminder>…</system-reminder>` 块(跨行、
- * 多块、夹在正文中间都剥;**未闭合**的块剥到末尾 —— 被截断的附件同样不是用户写的)后 trim。
- *
- * 为什么:壳把附件(技能清单一类的 `<system-reminder>` 块)拼在正文**之前**提交,标题器取前 {@link OBJECTIVE_SNIPPET_CHARS} 字
- * 去起名 ⇒ 标题成了技能清单。判据只认这一个**字面标签**(CC 的附件信封),不按内容猜「像不像用户写的」——
- * 正文里提到这个词的普通文字不是块,原样保留。剥完是空串 ⇒ 调用方走「空 objective 不起名」的既有臂。
- * ⚠️ 只治这一类:S-236 原件(fresh `/decide` 腿把指路文本当 objective 提交)是另一类非用户文本,没有信封可剥,本函数刻意不加
- * 按内容猜的第二臂(要么 fresh 腿传席,要么另立一臂 —— 候裁,见车RA 收车档)。
- */
-export declare function userAuthoredObjectiveText(objective: string): string;
 export declare function buildTitlePrompt(objective: string): string;
 export declare function createSessionTitler(deps: SessionTitlerDeps): SessionTitler;
 //# sourceMappingURL=session-titler.d.ts.map

package/dist/session-titler.js

@@ -1,6 +1,7 @@
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
+import { userAuthoredText } from "./user-authored-text.js";
 export const TITLE_MAX_CHARS = 80;
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
@@ -12,11 +13,8 @@ export function sanitizeTitle(raw) {
     const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
     return unquoted.length > TITLE_MAX_CHARS ? `${unquoted.slice(0, TITLE_MAX_CHARS - 1)}…` : unquoted;
 }
-export function userAuthoredObjectiveText(objective) {
-    return objective.replace(/<system-reminder>[\s\S]*?(?:<\/system-reminder>|$)/g, "").trim();
-}
 export function buildTitlePrompt(objective) {
-    const text = userAuthoredObjectiveText(objective);
+    const text = userAuthoredText(objective);
     const snippet = text.length > OBJECTIVE_SNIPPET_CHARS ? `${text.slice(0, OBJECTIVE_SNIPPET_CHARS)}…` : text;
     const fenced = snippet.replace(/<(\/?)request>/gi, "<\u200b$1request>");
     return ("Write a short title (at most 8 words) summarizing the user request below. " +
@@ -38,7 +36,7 @@ export function createSessionTitler(deps) {
         .catch(() => ({ state: continueWord, unreadable: true }));
     return {
         maybeTitle(sessionId, objective, model) {
-            if (!sessionId || !userAuthoredObjectiveText(objective))
+            if (!sessionId || !userAuthoredText(objective))
                 return;
             if (seen.has(sessionId))
                 return;

package/dist/shared-memory-scope-authorizer.d.ts

@@ -25,7 +25,7 @@ export interface SharedMemoryScopeAuthorizerOptions {
      * 部署自证的 org scope —— **取值口而非值**([ref])。
      *
      * 🔴 类型上是函数是刻意的,不是风格:这组 scope 的真源是 `config.projects` 的 `defaultScopes`,
-     * 而 `config.projects` 被 config-center **就地热应用**(`mutateInPlace`,整表替换),env 腿恒空
+     * 而 `config.projects` 被 web-admin **就地热应用**(`mutateInPlace`,整表替换),env 腿恒空
      * ⇒ 这一域的**常态**就是运行期变更。此前这里收的是一个数组(装配点在 boot 期算一次),而且本模块
      * 还 `[...new Set(...)]` 又复制一层,连「换引用」这条后路都封死 ⇒ 两个方向都错到进程重启为止:
      *  · **新登记**一个带 `org:` 的项目 ⇒ 该 org 的共享库在快照里没有 ⇒ 折成 `{state:"connected",
@@ -33,7 +33,7 @@ export interface SharedMemoryScopeAuthorizerOptions {
      *    unavailable),运维以为配好了;
      *  · **撤销**方向更糟:项目/scope 下架后,principal-less 的单用户请求仍按旧快照继续被放行 ——
      *    一次运维撤销动作**静默不生效**([ref] 点名的静默类型),方向是 fail-OPEN。
-     * 而且它没被登进 `config-center/restart-signal.ts` 的 `RESTART_SLICES` ⇒ `/health` 连一句
+     * 而且它没被登进 `web-admin-client/restart-signal.ts` 的 `RESTART_SLICES` ⇒ `/health` 连一句
      * 「该重启了」都不会说。⇒ 收口是把读取时机对齐消费时机:每次 `resolve` 现取。
      * (缺席 = 部署没有任何自证 scope,与传 `() => []` 等价。)
      *
@@ -51,8 +51,8 @@ export interface SharedMemoryScopeAuthorizerOptions {
  *    Set 建、交回来已去重,这里再包一层是纯浪费。**去重责任因此上移到取值口**(契约见下面那个字段的注),
  *    principal 在场那支的合并 Set 保留(它要与目录 scope 求并,那一次是真需要的)。
  *  · **具名保留**(不做 generation 缓存):`config.projects` 由 `mutateInPlace` **就地**改,对象身份恒定,
- *    没有可用的失效信号;而 config-center 的 `appliedGeneration` 是那个模块的私有 WeakMap,不在公面上。
- *    要缓存就得先给 config-center 开一只「已提交世代」读口 —— 那是别人模块的接缝件,且**缓存失效写错
+ *    没有可用的失效信号;而 web-admin 的 `appliedGeneration` 是那个模块的私有 WeakMap,不在公面上。
+ *    要缓存就得先给 web-admin 开一只「已提交世代」读口 —— 那是别人模块的接缝件,且**缓存失效写错
  *    一次,就恰好把本条 finding 刚关掉的那个陈旧窗原样放回来**(还多一层代码)。规模面亦不支持先做:
  *    projects 是运维手写的登记簿(量级十几~百),而这条腿的**同一次**调用里,principal 在场那支还要
  *    `await directory.lookup()`(网络/缓存),扫表在它旁边不构成瓶颈。⇒ 若哪天登记簿真长到会阻塞事件循环,

package/dist/task-a2a.d.ts

@@ -1,7 +1,7 @@
 /**
  * [DESIGN-269 车1 §2.2/§2.3 — A2A client seam] — project a caller's per-request A2A peers
  * (`TaskRequest.a2aPeers`) into the engine, so a `sema` run can talk to the agents the USER declares,
- * not only the ones the deployment's config center declares. Point-for-point mirror of `task-mcp.ts`
+ * not only the ones the deployment's web-admin declares. Point-for-point mirror of `task-mcp.ts`
  * (the MCP seam), because the trust question is the same question — and deliberately NOT a copy where
  * the two protocols differ (see 「A2A 比 MCP 窄」 below).
  *

package/dist/tool-approval.d.ts

@@ -5,6 +5,7 @@ import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js
 import { type AllowRuleShadowProjection, type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
+import { type AskRowEndingCause, type SettleCause, type SettleOutcome } from "./approval-deny-reasons.js";
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
@@ -25,6 +26,38 @@ export declare const APPROVAL_GATE_KINDS_SQL_IN: string;
  * (`test/parked-late-decision.test.ts` G3-c:本函数的输出经 `lookupRoute` 落 `approval-decide`)。会话段按路由的 `safeDecode` 对称编码。
  */
 export declare function approvalDecidePath(sessionId: string): string;
+/**
+ * [ref] 随批小件:`tool_approval.not_pending` 404 的**判别位**([ref] 排障代价实证 —— 三因合并成一句人话,现场分不出「答案没地方兑」与「打错副本了」)。
+ * DECIDED/PARKED 已从 404 分流(DECIDED ⇒ 200 回放首决,回执带 `decidedBy`,**不是**成因;PARKED ⇒ 赎回席),残余两类:
+ *  · 行 `VOID` / `DENIED`(没有人决过它)—— `cause` = **行上记的那个成因词**(问账 `denied_reason` 列;与决断口 410 `gone.ask` 体的 `cause`、审计 settle 行
+ *    的 `cause` 同一个词,闭集 {@link SettleCause});行上没写归因(存量行)⇒ 缺席,不替没写的行编一个词;
+ *  · {@link NOT_PENDING_UNKNOWN_CAUSE} —— 无墓碑 / 无行 / 行仍在别处活着:换副本或换端点重试才有意义(这个词只属于 404 面,不是结局成因)。
+ * 对齐 [ref] 反枚举语义:cause 只在**已过属主门**的面上出,不扩枚举面(属主门不过 = 与未知 id 同形)。
+ * **无持久店的部署上恒不带**:那台机器压根没有行可判,编一个 cause 是撒谎(D1 体逐字不变)。
+ */
+export declare const NOT_PENDING_UNKNOWN_CAUSE: "unknown_or_other_replica";
+export type NotPendingCause = AskRowEndingCause | typeof NOT_PENDING_UNKNOWN_CAUSE;
+/**
+ * 结算一张卡的**判决** —— 判别联合,逼每个调用点说清「这次等待是怎么结束的」:
+ *  · `by:"human"` —— 一次**决议**到了(人答,或从问账行读回来的决议,含部署政策拒落成的 `DECIDED` 行,`hostSettledBy` 记它的来源词):`allowed` 说方向;审计 settle 行
+ *    `outcome` = `allowed` / `denied`,**没有 `cause`**;
+ *  · `by:"system"` —— 这次等待**没有等到决议就结束了**(非人结局):必须点名一个 {@link SettleCause};审计 settle 行 `outcome:"expired"` + 该 `cause`。
+ * 成因**只从事实读**(窗钟到 / 中止信号 / emit 零接收 / 腿作用域退出 / 兄弟被原子撤卡 / 有序关停锁存位 / 问账行的列),不从拒句散文判;
+ * 没有「裸 `settle(false, "expired")`」这一形。
+ */
+export type SettleVerdict = {
+    readonly by: "human";
+    readonly allowed: boolean;
+    readonly updatedInput?: unknown;
+    /** 宿主自报来源(见 {@link HostSettledBy};缺席 = 人)。 */
+    readonly hostSettledBy?: HostSettledBy;
+    readonly denyReason?: string;
+    readonly readRootGrant?: string;
+} | {
+    readonly by: "system";
+    readonly cause: SettleCause;
+    readonly hostSettledBy?: HostSettledBy;
+};
 /**
  * 🔴 [ref](案A)追记 F6 —— durable 回决口(`POST /v1/tasks/:taskId/asks/:askId/decision`)的 **200 体
  * additive 判别位**:这次决议在**本副本**上有没有被一条活着的腿消费掉。
@@ -597,7 +630,13 @@ export interface ToolApprovalFrame {
      * 成因表也补了第四支:`settleVoidedSiblings` 的撤卡兄弟走的同样是这个词,那既不是 TTL 也不是断连。
      * Cosmetic dialog-dismiss(这句仍成立——它讲的是**帧的角色**,不是终局)。
      */
-    outcome?: "allowed" | "denied" | "expired";
+    outcome?: SettleOutcome;
+    /**
+     * "tool_approval_complete" only(**ADDITIVE**):`outcome:"expired"` 的**成因** —— 与审计 settle 行 `cause` 是同一个词(闭集 {@link SettleCause}:窗到期 / 广播全灭 /
+     * 断连 / 呈不出去 / run 取消 / run 退出 / 批撤 / 兄弟被撤 / 崩溃 / 关停 ……)。**在场 ⇔ 非人结局**;人答(`allowed` / `denied`)不带。壳据它把「卡消失了」渲成具体的话
+     * (「已取消」「已到期」「断连」各自一句),而不再只有 `expired` 一个词。⚠️ 缺席不是证据:旧 server 从不发这个键,人答也不发。
+     */
+    cause?: SettleCause;
 }
 /** The per-run context `ask` recovers via ALS (mirrors QuestionRunContext + sessionId, which keys the allow-all). */
 /** [ref]:`GET /v1/approvals` 第二顶层键 `livePending` 的行形(与 durable `pending` 行**分数组不混编**
@@ -1363,7 +1402,7 @@ export declare class ToolApprovalCoordinator {
      * 三步:
      *  ① 本进程握着的**每一张**未决卡(可达 / 悬挂 / 委派子代,不挑)按**断连同路**收场 —— {@link PendingApproval.forceParkNow}(park 路由;
      *     `deny` 政策下是部署政策拒;有持久 ask 店时走同一把终局 claim)。有序关停与断连是同一件事:投递面要没了,**不是**有人拒了
-     *     (不交裸 `false`,S-689 同律)。审计 settle 行携 `cause:"shutdown_before_park"`(成因在 `settle` 咽喉读锁存位,F10);
+     *     (不交裸 `false`,S-689 同律)。审计 settle 行携 `cause:"shutdown_before_park"`(`forceParkNow` 的调用点点名它);
      *  ② 在 `deadlineMs` 之前等:未决卡结清、在飞腿闭合(闭了的腿照常落 `leg_closed`)、**本次路由到 park 的卡全部结清**
      *     (F1:观察到 core 已处置这次调用 —— 停车行提交或承载它的腿退场 ⇒ 那张卡的审计 settle 行此刻才写,见 {@link settleParksAwaitingCommit})、
      *     店里在飞的 `put` 静默;
@@ -1427,7 +1466,7 @@ export declare class ToolApprovalCoordinator {
      *
      *  🔴 **本口只收「行真的没了」那一类**([ref] codex R3-F2,验真后拆分;红先钉在
      *  `test/unattended-approval-policy.test.ts`):`expireAsk` 返回的 `voidedSiblings` 的行是 **VOID**,
-     *  裸 `(false,"expired")` 正是它们的真终局。而**调用方自己那个 askId** 的行是 **PARKING**(已转投递
+     *  非人结局的判决(`{by:"system", cause}`)正是它们的真终局。而**调用方自己那个 askId** 的行是 **PARKING**(已转投递
      *  面)—— 把它混进本名单会让「同 askId 的重复本地注册」拿到裸 deny,而赢家拿的是 park 路由:同一条
      *  持久行、两种 live 终局。那一支改走 {@link settleSameAskIdParkRoute}。 */
     private settleVoidedSiblings;
@@ -1592,7 +1631,7 @@ export declare class ToolApprovalCoordinator {
      * 条目(跨副本/无流内窗)= 正常,返回 `{ settled: 0 }`,调用方据此诚实回显 `updatedInputForwarded`。
      *
      * 🔴 与 {@link settleVoidedSiblings} 是**两个语义,禁合并**(F29):那边是撤卡收尾,结算值恒
-     * `(false, "expired")`——批内兄弟被原子撤卡,它们的终局就是「没了」;这边是「同一只 askId 已经有了
+     * `{by:"system", cause}`(`batch_sibling_withdrawn` 等)——批内兄弟被原子撤卡,它们的终局就是「没了」;这边是「同一只 askId 已经有了
      * 真决议」,重复注册必须拿到**同一个**决议(approve 就是 approve)——合并会把外部批准的重复条目错
      * 结算成拒绝。已被结算过的条目再调 settle 天然无操作(幂等),所以本口对「赢家自己已 settle」安全。
      */