@sema-agent/server 7.125.1 → 7.126.0

package/dist/boot/stage-03-store-backend.js

@@ -2,10 +2,10 @@ import { uuidv7 } from "@sema-agent/core";
 import { openStores } from "./stores.js";
 export async function runStage03(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
-    const { backend, storePosture, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
+    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
     const instanceId = uuidv7();
     const sessionCaptureRecords = backend?.sessionCaptureRecords();
     const sessionCaptureRecordStore = sessionCaptureRecords?.();
-    return { ...ctx, backend, backgroundAgentStore, breakerState, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngineFacts, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
+    return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngineFacts, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
 }
 //# sourceMappingURL=stage-03-store-backend.js.map

package/dist/boot/stage-04-stores.d.ts

@@ -44,6 +44,7 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-05-execution-env.d.ts

@@ -6,12 +6,11 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -60,6 +59,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-05-execution-env.js

@@ -2,15 +2,18 @@ import { createToolTracer, createPermissionDeniedMeter } from "../observability/
 import { composeHooks } from "../hooks/hook-runner.js";
 import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
 import { assertWorkspaceSpaceReadable, createExecutionEnv } from "./execution-env.js";
-import { sessionFaceReaderOf } from "./session-incarnation-seat.js";
+import { incarnationReadOf } from "../session-incarnation.js";
 import * as facts from "../capability-facts.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
+import { runStore } from "./late-binds.js";
 export function runStage05(ctx) {
     const { backend, config, instanceId, logger, metrics, sessionStore, taskAttachmentStore } = ctx;
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId }) : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, noteSessionIncarnation, sessionIncarnationOf, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}) });
+    const incarnationOf = incarnationReadOf(sessionStore);
+    const spaceCommits = backend !== undefined ? () => runStore : undefined;
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(incarnationOf !== undefined ? { incarnationOf } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
-    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), sessionFaceReaderOf(sessionStore), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
+    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { incarnationOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
     if (toolTracer)
         logger.info("tool_trace_enabled", {});
@@ -18,6 +21,6 @@ export function runStage05(ctx) {
         ...(toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics)),
         ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
     };
-    return { ...ctx, deploymentHooks, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, noteSessionIncarnation, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, sessionIncarnationOf, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
+    return { ...ctx, deploymentHooks, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, spaceReclaimer, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
 }
 //# sourceMappingURL=stage-05-execution-env.js.map

package/dist/boot/stage-06-runners.d.ts

@@ -20,7 +20,6 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: Runner;
-    handslessSubRunner: Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -67,12 +66,11 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -121,6 +119,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-06-runners.js

@@ -3,7 +3,7 @@ import { outwardPlane } from "../terminal.js";
 import { createSessionTitler } from "../session-titler.js";
 import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
-import { withoutExecutionEnv } from "../capabilities/hands-lane.js";
+import { withoutHands } from "../capabilities/hands-lane.js";
 import { redactSecrets } from "../trace/redact.js";
 import { hasServiceAuth } from "../http/server.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
@@ -20,8 +20,9 @@ import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
 import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-authorizer.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
+import { withInternalRunEnvs } from "../internal-run-env.js";
 export function runStage06(ctx) {
-    const { backend, backgroundAgentStore, brain, sessionIncarnationOf, config, webAdmin, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
+    const { backend, backgroundAgentStore, brain, engineDataRoot, config, webAdmin, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
@@ -110,9 +111,9 @@ export function runStage06(ctx) {
         consolidationSeat,
         hands: commitHands,
         mcpRevocations,
-        sessionIncarnationOf,
         config, logger, metrics, localRoot, promptSource: webAdmin.promptSource, rosterStore, backgroundAgentStore, mailboxStore, mailboxRecipientLifecycle, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
+        engineDataRoot,
         sessionCaptureRecords,
         memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
         permissionRuleStore: permissionRuleProvider,
@@ -123,9 +124,9 @@ export function runStage06(ctx) {
         getRunStore: () => runStore,
     });
     const runner = new Runner(runnerDeps);
-    const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
+    const handslessRunner = new Runner(withoutHands(runnerDeps));
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => webAdmin.getKeyResolver(), metrics });
-    const hookAgentRunner = new Runner({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) });
+    const hookAgentRunner = new Runner(withInternalRunEnvs({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) }));
     const agentHookCall = async ({ prompt, model, timeoutMs, system }) => {
         const pick = hookModelFor(model);
         if (!pick.ok)
@@ -196,6 +197,7 @@ export function runStage06(ctx) {
             orgMemoryAdmission,
             governanceSeams,
             sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
+            engineDataRoot,
         }),
         sessionStore: subRunnerSessions,
         onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent ? runnerDeps.onBackgroundChildEvent : undefined,
@@ -204,7 +206,6 @@ export function runStage06(ctx) {
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -35,7 +35,6 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: import("@sema-agent/core").Runner;
-    handslessSubRunner: import("@sema-agent/core").Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: import("@sema-agent/core").Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -82,12 +81,11 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -136,6 +134,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -27,7 +27,7 @@ import { buildDisplaySafeUrl } from "../trace/redact.js";
 import * as facts from "../capability-facts.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export async function runStage07(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, durableEnabled, handslessSubRunner, instanceId, localRoot, logger, memoryEngine, metrics, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, durableEnabled, instanceId, localRoot, logger, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
     const authorize = createAuthorizer(config, sessionStore);
     const runStore = backend ? backend.run() : undefined;
     bindRunStore(runStore);
@@ -153,8 +153,8 @@ export async function runStage07(ctx) {
     const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver(), logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
-        webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
+        runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
+        webSearch: webSearch ? webSearch : undefined, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,
         ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
@@ -168,7 +168,6 @@ export async function runStage07(ctx) {
     const parkedReviveInheritedGate = parkedReviveSurface && config.durableApproval
         ? createParkedReviveInheritedGate({
             config, question, logger, localRoot,
-            memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
             approvalExemptionStore,
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),

package/dist/boot/stage-08-reapers.d.ts

@@ -48,7 +48,6 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: Runner;
-    handslessSubRunner: Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -95,12 +94,11 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -149,6 +147,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-08-reapers.js

@@ -5,7 +5,7 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
@@ -30,6 +30,7 @@ export function runStage08(ctx) {
             },
             audit: { append: (row) => retentionLaneStore.appendAudit(row, Date.now()) },
             holdInForce: (domain) => retentionLaneStore.holdInForce(domain),
+            ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
             logger,
             metrics,
             now: () => Date.now(),
@@ -56,7 +57,6 @@ export function runStage08(ctx) {
         ["handsless", handslessRunner],
         ["hookAgent", hookAgentRunner],
         ["sub", subRunner],
-        ["handslessSub", handslessSubRunner],
     ];
     const swapRunnerDeps = (next) => {
         for (let i = 0; i < bootRunners.length; i++) {

package/dist/boot/stage-09-leader.d.ts

@@ -77,7 +77,6 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: import("@sema-agent/core").Runner;
-    handslessSubRunner: import("@sema-agent/core").Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: import("@sema-agent/core").Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -124,12 +123,11 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -178,6 +176,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-09-leader.js

@@ -6,7 +6,7 @@ import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         deviceStore: deviceLane?.store,
         dropSessionScoped,
@@ -15,6 +15,7 @@ export function runStage09(ctx) {
         workflowCompletionInbox, taskListLane, mailboxStore, mailboxRecipientLifecycle,
         backgroundAgentStore,
         userInputLedgerStore,
+        ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
     });
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError });
     const drainState = { draining: false };

package/dist/boot/stage-10-http-server.d.ts

@@ -76,7 +76,6 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: import("@sema-agent/core").Runner;
-    handslessSubRunner: import("@sema-agent/core").Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: import("@sema-agent/core").Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -123,12 +122,11 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -177,6 +175,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     backend: import("../plugins/store-backend.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-10-http-server.js

@@ -29,7 +29,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, noteSessionIncarnation, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -177,6 +177,7 @@ export async function runStage10(ctx) {
         configApplyState: () => webAdmin.configApplyState(),
         centerCredentialState: () => webAdmin.centerCredentialState(),
         modelRefusalsState: () => webAdmin.modelRefusalsState(),
+        candidateRejectionState: () => webAdmin.candidateRejectionState(),
         configHandoffState: () => webAdmin.configHandoffState(),
         mcpRevocations,
         mcpRevocationState: () => webAdmin.mcpRevocationState(),
@@ -199,7 +200,6 @@ export async function runStage10(ctx) {
         getCenterPrompts: () => webAdmin.getCenterPrompts(),
         getKeyResolver: () => webAdmin.getKeyResolver(),
         taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
-        noteSessionIncarnation,
         hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
         checkpointStore, deploymentHooks, imageIndex, perTaskImage,

package/dist/boot/stores.d.ts

@@ -20,6 +20,7 @@ export declare function openStores(ctx: OpenStoresCtx): Promise<{
         backend: MemoryBackend;
         root: string;
     } | undefined;
+    engineDataRoot: string;
     memorySyncCursors: MemorySyncStore | undefined;
     rosterStore: import("@sema-agent/core").RosterStore | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;

package/dist/boot/stores.js

@@ -119,6 +119,7 @@ export async function openStores(ctx) {
     if (config.dbBackend === "local" && backend)
         config.sessionBackend = "tidb";
     let memoryEngine;
+    const engineDataRoot = memoryEngineRootFor(config, localRoot);
     let memorySyncCursors;
     let vectorMode;
     if (config.memoryEngineBackend !== "file" && config.memoryEngineEnabled) {
@@ -169,7 +170,7 @@ export async function openStores(ctx) {
                 ...(embedder !== undefined ? { embedder } : {}),
             });
             vectorMode = pgMem.vectorMode;
-            memoryEngine = { backend: pgMem, root: memoryEngineRootFor(config, localRoot) };
+            memoryEngine = { backend: pgMem, root: engineDataRoot };
         }
         else {
             const pool = backend?.mysqlPool();
@@ -181,7 +182,7 @@ export async function openStores(ctx) {
             memorySyncCursors = new TiDBMemorySyncStore(pool);
             const tidbMem = new TiDBMemoryEngineBackend(pool, { history: countedHistorySink(new TiDBMemoryHistoryStore(pool)) });
             vectorMode = tidbMem.vectorMode;
-            memoryEngine = { backend: tidbMem, root: memoryEngineRootFor(config, localRoot) };
+            memoryEngine = { backend: tidbMem, root: engineDataRoot };
         }
         logger.info("memory_engine_enabled", {
             enabled: true,
@@ -447,7 +448,7 @@ export async function openStores(ctx) {
             .startRefresh()
         : undefined;
     return {
-        backend, storePosture, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
+        backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, mailboxRecipientLifecycle,
         taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
         usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts,
     };

package/dist/boot/web-admin.d.ts

@@ -15,6 +15,7 @@ import type { ConsolidationSeatWatch } from "./memory-consolidation.js";
 import type { DegradeRouteWatch } from "../brain.js";
 import { type EngineRestartSignal } from "../web-admin-client/facade.js";
 import { type ConfigHandoff } from "../fleet/engine-signal.js";
+import { type CandidateRejection } from "../web-admin-client/candidate-gate.js";
 import { type ConfigApplyLedgerView } from "../web-admin-client/apply-ledger.js";
 import type { CenterPullView } from "../web-admin-client/pull-state.js";
 import type { LimitSync } from "./limit-sync.js";
@@ -117,6 +118,10 @@ export interface WebAdminRuntime {
      *  名 → 码 + 组拒码)。描述**最近一次被判的那份中心候选目录**(每次候选 apply 的报告 `ApplyReport.modelRefusals` 投影;组拒时就是被拒
      *  的那份 —— 引擎自己的拒因表不换代)。没有可报的拒 / 没有配置管道 / 还没判过候选 ⇒ `undefined`(键缺席)。值变了 ⇒ 通知自报订阅者。 */
     modelRefusalsState(): ModelRefusalsSignal | undefined;
+    /** S-1457:`GET /v1/models.candidateRejected` 的取值口 —— 最近一次候选被判官整拒的结论(`candidateRejection` 座;域集就是判官交出的 `rejected.domains`)。
+     *  present-iff 当前生效的配置是因判官整拒了最近一份候选而回落的那一份:后来的候选被判 clean 即撤下;还没判过候选 / 没有配置管道 ⇒ `undefined`(键缺席)。
+     *  dry-run 姿势(`webAdmin.dryRun`,compare-only)恒 `undefined`:候选从不被应用,生效配置恒是 env,拒判是预演读数(日志行照响),不是配置没换的原因。 */
+    candidateRejectionState(): CandidateRejection | undefined;
     /** [ref] 世代账:/health 的 target/applied/失败持续时长三键 + 诊断端点的 configApply 段(同一份读数)。
      *  `undefined` = 本部署没有配置管道(纯 env worker)⇒ 两个读面的形状**逐字不变**(additive 纪律)。 */
     configApplyState(): ConfigApplyLedgerView | undefined;

package/dist/boot/web-admin.js

@@ -23,7 +23,7 @@ import { applyEffective, applyCenterReadFace, mutateInPlace, logEffectiveDiff, a
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
 import { buildUnreadConfigFileFields } from "../web-admin-client/read-warnings.js";
-import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
+import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateRejectionOf, judgeConfigCandidate } from "../web-admin-client/candidate-gate.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 function lkgReadNote(scope) {
@@ -31,7 +31,7 @@ function lkgReadNote(scope) {
         case "whole":
             return "booting from the persisted last-known-good (all restart-to-apply faces included) — the live pull continues in the background and reconciles on arrival";
         case "model-plane":
-            return "the live candidate's model plane was refused at boot — the persisted last-known-good supplies the model plane only (catalog and the collab templates that reference it); every other group and every restart-to-apply face stays the live candidate's";
+            return "the live candidate's model plane was refused at boot — the persisted last-known-good supplies the model plane only (the catalog and what rides with it); every other group and every restart-to-apply face stays the live candidate's";
     }
 }
 export async function createWebAdminRuntime(ctx) {
@@ -39,7 +39,14 @@ export async function createWebAdminRuntime(ctx) {
     let ccEtag;
     let effective;
     let latestEffective;
-    let lastRejectedCandidate;
+    let candidateRejection;
+    let judgedOrdinal = 0;
+    const noteCandidateVerdict = (ordinal, rejection) => {
+        if (ordinal < judgedOrdinal)
+            return;
+        judgedOrdinal = ordinal;
+        candidateRejection = rejection;
+    };
     const applyLedger = createConfigApplyLedger();
     let lastPull = "none";
     let generationOrdinal = 0;
@@ -146,11 +153,16 @@ export async function createWebAdminRuntime(ctx) {
             });
         }
     };
-    const announceCandidateRejected = (r, verdict, leg) => {
+    const rejectionSource = () => {
+        if (configProvider === undefined)
+            throw new Error("config candidate judged without a config provider (no pipeline ⇒ nothing was pulled)");
+        return configProvider.kind;
+    };
+    const announceCandidateRejected = (r, verdict, leg, ordinal) => {
         const domains = verdict.domains.join(",");
-        if (lastRejectedCandidate?.version === r.effective.version && lastRejectedCandidate.domains === domains)
+        if (candidateRejection?.version === r.effective.version && candidateRejection.domains.join(",") === domains)
             return;
-        lastRejectedCandidate = { version: r.effective.version, domains, at: Date.now() };
+        noteCandidateVerdict(ordinal, candidateRejectionOf(r, verdict, rejectionSource(), Date.now()));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
     const selfReportListeners = [];
@@ -503,7 +515,7 @@ export async function createWebAdminRuntime(ctx) {
                 hint: rejected && modelsDomainErr
                     ? "config.d/models.json 在场但 models 域判形失败,整份本地候选被拒(真因见本行 domainError)— 模型继续走 env 兜底"
                     : rejected
-                        ? "config.d 里别的域判形失败,整份本地候选被拒(坏域与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
+                        ? "config.d 里别的域让整份本地候选被拒(判形失败,或带事实的退役域文档;坏域与真因见 config_candidate_rejected)— config.d/models.json 的模型不用,继续走 env 兜底"
                         : modelsDropped.length > 0 && totalModels === 0
                             ? "config.d/models.json 的条目全部被逐条丢弃(逐条真因见 config_entry_dropped)— 模型继续走 env 兜底"
                             : totalModels > 0
@@ -536,7 +548,7 @@ export async function createWebAdminRuntime(ctx) {
                 if (dryRun) {
                     const dryVerdict = judgeConfigCandidate(r);
                     if (dryVerdict.verdict === "rejected") {
-                        announceCandidateRejected(r, dryVerdict, "boot");
+                        announceCandidateRejected(r, dryVerdict, "boot", generationOrdinal);
                     }
                     else {
                         warnReadNotices(r, "boot");
@@ -550,7 +562,7 @@ export async function createWebAdminRuntime(ctx) {
                         await bootFallBackWhole(`boot candidate rejected: ${bootVerdict.domains.join(",")}`);
                         const rejectedGen = generationOf(r.effective.version);
                         applyLedger.seenTarget(rejectedGen, r.effective.version);
-                        announceCandidateRejected(r, bootVerdict, "boot");
+                        announceCandidateRejected(r, bootVerdict, "boot", rejectedGen);
                         if (configProvider.kind === "local")
                             warnLocalNoModels(r, true);
                     }
@@ -581,7 +593,7 @@ export async function createWebAdminRuntime(ctx) {
                                 applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
                                 if (modelPlaneCommitted(planeReport)) {
                                     bootPlaneEff = lkgPlane.effective;
-                                    logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (catalog and the collab templates that reference it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
+                                    logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (the catalog and what rides with it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
                                 }
                             }
                         }
@@ -665,6 +677,7 @@ export async function createWebAdminRuntime(ctx) {
         restartState: () => buildRestartSignal(pendingRestart, planeDeferredNoHandoff),
         configHandoffState: () => (configProvider === undefined || configProvider.kind === "local" || !lkgSurvivesRestart ? undefined : buildConfigHandoff(latchHandoff(), handoffMissingSince)),
         modelRefusalsState: () => modelRefusals,
+        candidateRejectionState: () => (cc?.dryRun ? undefined : candidateRejection),
         configApplyState: () => (configProvider ? applyLedger.view() : undefined),
         centerPullState: () => {
             const view = applyLedger.view();
@@ -858,10 +871,10 @@ export async function createWebAdminRuntime(ctx) {
                             applyLedger.seenTarget(tickGen, r.effective.version);
                             const verdict = judgeConfigCandidate(r);
                             if (verdict.verdict === "rejected") {
-                                announceCandidateRejected(r, verdict, arrival !== undefined ? "late-boot" : "refresh");
+                                announceCandidateRejected(r, verdict, arrival !== undefined ? "late-boot" : "refresh", tickGen);
                                 return "ok";
                             }
-                            lastRejectedCandidate = undefined;
+                            noteCandidateVerdict(tickGen, undefined);
                             warnReadNotices(r, "refresh");
                             if (ccRef?.dryRun) {
                                 logEffectiveDiff(config, r.effective, logger);
@@ -918,7 +931,7 @@ export async function createWebAdminRuntime(ctx) {
                                 const signal = signalRestart({ applied: "complete", effective: r.effective, ...(r.etag !== undefined ? { etag: r.etag } : {}), baseline: effective, lkgPersisted });
                                 logger.info("web_admin_refreshed", {
                                     version: r.effective.version,
-                                    note: "collab + runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
+                                    note: "runtime governance (incl. approvalRequire) + limits + models/roles/roster hot-applied; skills/mcp/a2a/scenarios are restart-to-apply",
                                     ...restartLogFields(signal),
                                 });
                                 latestEffective = r.effective;
@@ -967,9 +980,10 @@ export async function createWebAdminRuntime(ctx) {
                     applyLedger.seenTarget(lateGen, r.effective.version);
                     const lateVerdict = judgeConfigCandidate(r);
                     if (lateVerdict.verdict === "rejected") {
-                        announceCandidateRejected(r, lateVerdict, "late-boot");
+                        announceCandidateRejected(r, lateVerdict, "late-boot", lateGen);
                         return;
                     }
+                    noteCandidateVerdict(lateGen, undefined);
                     warnReadNotices(r, "boot-deferred");
                     if (ccRef?.dryRun) {
                         logEffectiveDiff(config, r.effective, logger);