@sema-agent/server 7.128.0 → 7.129.1

package/dist/approval-card.d.ts

@@ -21,7 +21,7 @@
  * 没有方法、没有捕获的行为。
  */
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type AskRequest as CoreAskRequest, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type RuleOffer, type SteerReplayFacet } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type ResumeStartupCause, type RuleOffer, type RuleOffersAbsence as CoreRuleOffersAbsence, type SteerReplayFacet } from "@sema-agent/core";
 import type { AskRow } from "./plugins/approval-ask-store-sql.js";
 /** 模型自由文本(`sourceAgentName` / `delegation.agentName`)的限长(设计稿 §6.2)。设计 §3.1 把
  *  「限长 + 脱敏」写成 **server 新增责任**(引擎无此层):spawning model 挑的名字是自由文本,
@@ -384,22 +384,19 @@ export declare function readAllowRuleShadowed(req: unknown): AllowRuleShadowProj
  */
 export declare function readRuleEvidence(req: unknown): RuleEvidenceProjection | undefined;
 /**
- * [ref] 第五单(core [ref] 修②)—— `ruleOffers` 缺席因由的**闭三词集**。
+ * [ref] 第五单(core [ref] 修②)—— `ruleOffers` 缺席因由的**闭集**。
  *
- * 🔴 **型从 core 派生,不手抄**(S-249):core 刻意**不导出**这个名字,也不导出运行期常量
- * (`permission-rule-lanes.d.ts` 顶注逐字:「Deliberately not exported: this is a wire vocabulary, and its
- * two faces declare it literally … so a consumer reads the closed set on the type it is holding」)——
- * 于是本仓**必须**自持一份运行期词表(zod 要字面元组),但**不必**自持一份型。做法:型 =
- * `AskRequest["ruleOffersAbsence"]` 的联合(那正是 core 要我们读的那张脸),运行期词表另立一行,
- * 两者之间架**两向编译围栏** ⇒ core 加词 / 改词 / 退役任一,本文件当场 tsc 红。
- * (对照 {@link AskEvidenceAbsenceSchema}:那一族 core **给了**运行期常量,所以那边零词表、用 `z.custom`。
- * 两族的姿势不同不是分歧,是「上游给什么就用什么」的同一条纪律的两种兑现。)
+ * 🔴 **型与运行期词表都读 core 的导出**(core 7.51.0 #1515 起 core 导出 `RULE_OFFERS_ABSENCES` 与 `RuleOffersAbsence`):
+ * 此前 core 刻意不导出这张词表,本仓只能自持一份手抄运行期表(zod 要字面元组)+ 两向编译围栏;core 给了常量之后
+ * 那份手抄表与围栏退役(一个事实一个来源)—— 与 {@link AskEvidenceAbsenceSchema}「上游给了运行期常量就零词表」同一条纪律。
+ * 7.51.0 的词:`mandated` / `allow_outranked` / `ask_rule_matched` / `lane_cannot_speak`(`shadowed` 退役、拆成中间两词)。
  */
-export type RuleOffersAbsence = NonNullable<CoreAskRequest["ruleOffersAbsence"]>;
+export type RuleOffersAbsence = CoreRuleOffersAbsence;
 export declare const RuleOffersAbsenceSchema: z.ZodEnum<{
     mandated: "mandated";
+    allow_outranked: "allow_outranked";
+    ask_rule_matched: "ask_rule_matched";
     lane_cannot_speak: "lane_cannot_speak";
-    shadowed: "shadowed";
 }>;
 /**
  * `ruleOffersAbsence` 座的**三态读数**(S-663 codex r1 起;此前是 {@link readRuleOffersAbsence} 函数体内的两步)。
@@ -464,6 +461,9 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  *    `AskRequest.origin`(盖章点即 core 的筛点),照旧只过「非空串」形门(`tool-approval.ts` 帧键 `origin` 顶注)。
  *  · `classifierNoRuling`(core 7.43.0 #1353)—— 分类器没给判词的成因词,core `AUTO_MODE_FALLBACK_CAUSES` 闭集一词(筛 = `isAutoModeFallbackCause`)。
  *    读者:活卡帧读 `AskRequest.classifierNoRuling`(`tool-approval.ts`);inbox 行读 core `CheckpointSummary` 已筛过的同名位、直投不经本函数。
+ *  · `cause`(core 7.51.0 #1448)—— **载体是引擎续跑回执的 `details`**(不是 ask 的三个载体之一),值是起跑失败的成因词,core `RESUME_STARTUP_CAUSES` 闭集一词
+ *    (成员表取 core 常量;core 的 `resumeStartupCauseOf` 从失败的**码**读出)。读者:`parked-decide.ts` 的 422 `parked_resume.startup_failed` 体(`cause`)。
+ *    回执没说 ⇒ 缺席(不计数,「分不出」是一等状态);集外词 / 非串 ⇒ 按缺席(键不上 wire)+ 计一次,与卡上的闭集词同一只计数。
  *  · `differs`(core 7.44.0 #1374)—— **载体是引擎拒 steer 重放那只错的 `detail`**(不是 ask 的三个载体之一),值是 core `STEER_REPLAY_FACETS` 的**非空子集**
  *    (core:「恒非空」;筛 = 本文件 {@link isSteerReplayDiffers},成员表取 core 常量)。读者:`runs.ts` 的 409 `steering.duplicate_input_id` 体(`detail.differs`)。
  *    集外成员 / 空数组 / 非数组 ⇒ 按缺席(不铸 `detail`,码仍是契约)+ 计一次;detail 只报形名(`differs=<array>` —— 数组从不展开成员,见 {@link outOfSetDetail})。
@@ -480,12 +480,14 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  * 只读值不调用值)。
  */
 export declare function readClosedWordSeat<S extends ClosedWordSeat>(carrier: object, seat: S): ClosedWordOf<S> | undefined;
-/** ask 载体上的闭集词座名:三个 core 载体上**同名**(`AskRequest` / 寄存行 `tool_approval` 臂 / `CheckpointSummary`)—— 任一处改名 / 退役 ⇒ 下面的围栏编译红。 */
-type AskClosedWordSeat = "mandate" | "origin" | "classifierNoRuling";
+/** ask 载体上的闭集词座名:三个 core 载体上**同名**(`AskRequest` / 寄存行 `tool_approval` 臂 / `CheckpointSummary`)—— 任一处改名 / 退役 ⇒ 下面的围栏编译红。
+ *  S-1493(core 7.51.0 #1688)起第四座 `boundGrantAbsence`:卡为什么没有授予绑定摘要(`not_bindable` / `unreadable`)。 */
+type AskClosedWordSeat = "mandate" | "origin" | "classifierNoRuling" | "boundGrantAbsence";
 /** 闭集词座的名 = ask 载体上的三座 + 引擎拒 steer 重放那只错的 `detail.differs`(载体不同、读法同一只)。 */
-type ClosedWordSeat = AskClosedWordSeat | "differs";
-/** 一座的值型:ask 三座 = core 寄存行上那一座的型(去掉可选位的 `undefined`);`differs` = core 闭集 `SteerReplayFacet` 的数组(core `detail.differs` 的型)。 */
-type ClosedWordOf<S extends ClosedWordSeat> = S extends AskClosedWordSeat ? NonNullable<ToolApprovalPark[S]> : readonly SteerReplayFacet[];
+type ClosedWordSeat = AskClosedWordSeat | "differs" | "cause";
+/** 一座的值型:ask 座 = core 寄存行上那一座的型(去掉可选位的 `undefined`);`differs` = core 闭集 `SteerReplayFacet` 的数组(core `detail.differs` 的型);
+ *  `cause` = core 的 `ResumeStartupCause`(续跑回执 `details.cause` 的型)。 */
+type ClosedWordOf<S extends ClosedWordSeat> = S extends AskClosedWordSeat ? NonNullable<ToolApprovalPark[S]> : S extends "differs" ? readonly SteerReplayFacet[] : ResumeStartupCause;
 /**
  * 🔴 **S-934 ②(core 7.37.0 #1214)—— ask 类对的唯一窄读**:`askClass`(一问的类 = `classes` 的首员)与 `classes`(这一问属于的全部类,core
  * `ASK_CLASSES` 序)。三个载体上同名:`AskRequest`(活卡帧 / 呈卡帧的卡读它)、寄存行 `PendingAction.tool_approval`(运维队列行经
@@ -525,8 +527,11 @@ export interface AskClassPair {
  * bypass 姿态下按 `ask_rule` / `hook` 照问的那条壳规则无从落地。缺席 = 老行(core 7.5.0 之前 park 的)/ 集外词(计 S-249 tag)。
  * S-934 ②(core 7.37.0 #1214)第六 / 七位 `askClass` / `classes`:这一问的类对(经 {@link readAskClassPair};两位同在同缺,与活卡帧 / 呈卡帧的卡
  * 同名同义同值)—— durable 审批席按类答的依据。缺席 = 老行(core 7.37.0 之前 park 的,续跑不补)/ 读不出(计 S-249 tag)。
+ * S-1493(core 7.51.0 #1688)第八位 `boundGrantAbsence`:这张卡为什么没有授予绑定摘要(经 {@link readClosedWordSeat};与活卡帧 / inbox 行同名同义同值)——
+ * `not_bindable` = 这一问不绑任何授予(「本会话放行」可按工具记)。缺席 = 技能卡(带摘要;摘要不上队列行,见 ⑧b)/ 7.51.0 之前停驻的行(core inbox 投
+ * `unreadable`,队列行如实缺席)/ 集外词(计 S-249 tag)。
  */
-export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "ruleOffersAbsence" | "mandated" | "mandate" | "origin" | "askClass" | "classes">;
+export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "ruleOffersAbsence" | "mandated" | "mandate" | "origin" | "askClass" | "classes" | "boundGrantAbsence">;
 /**
  * S-700 —— park 行事实的**唯一投影**(`pendingAction` 是寄存行上 core 铸的那一只,读自持久层 ⇒ `unknown`)。
  *
@@ -553,7 +558,7 @@ export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "rule
  * `ruleOffersAbsence` 推「强制」的**权限**判据需要的是三态(读不出 ⇒ 按强制,fail-closed),方向相反,所以权限面
  * 不许拿本函数的产物去推强制 —— 两者共用的是 schema,不是折叠。
  */
-export declare function parkRowFacts(pendingAction: unknown): ParkRowFacts;
+export declare function parkRowFacts(stored: unknown): ParkRowFacts;
 /** S-114(core 7.4.0 [ref])—— 回落卡的计数与窗。`limit` 是**闭二词**(core d.ts 逐字),两个计数是
  *  非负整数,`autoDenyAfterMs` 是 core 契约里的 `0..2147483647` 非负整数(`0` = 本卡不武装窗:部署把
  *  旋钮关了,或 TOTAL 档的卡按 [ref]① 恒 0 等人)。四成员**全必填**——core 的 `DenialLimitFallback` 上
@@ -670,8 +675,9 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     }, z.core.$strict>]>>>;
     ruleOffersAbsence: z.ZodOptional<z.ZodEnum<{
         mandated: "mandated";
+        allow_outranked: "allow_outranked";
+        ask_rule_matched: "ask_rule_matched";
         lane_cannot_speak: "lane_cannot_speak";
-        shadowed: "shadowed";
     }>>;
     denialLimitFallback: z.ZodOptional<z.ZodObject<{
         consecutive: z.ZodNumber;
@@ -707,8 +713,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -804,8 +810,9 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         }, z.core.$strict>]>>>;
         ruleOffersAbsence: z.ZodOptional<z.ZodEnum<{
             mandated: "mandated";
+            allow_outranked: "allow_outranked";
+            ask_rule_matched: "ask_rule_matched";
             lane_cannot_speak: "lane_cannot_speak";
-            shadowed: "shadowed";
         }>>;
         denialLimitFallback: z.ZodOptional<z.ZodObject<{
             consecutive: z.ZodNumber;
@@ -841,8 +848,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -912,8 +919,28 @@ export interface ApprovalCardSource {
  * 头注。)
  */
 export declare function buildApprovalCard(source: ApprovalCardSource, req: unknown, requiresRealApproval: boolean): ApprovalCard;
-/** 落库信封的纯构造(写侧;读侧 = `ApprovalCardEnvelopeSchema.safeParse`,**同一个 schema**)。 */
+/** 落库信封的纯构造(写侧;读侧 = {@link readStoredCardEnvelope},**同一个 schema**)。 */
 export declare function buildApprovalCardEnvelope(approvalId: string, card: ApprovalCard): ApprovalCardEnvelope;
+/**
+ * 🔴 **存下的卡的唯一读者入口**(S-1562)—— `approval_ask.card_json` 的每一个读点(断连重放 {@link buildReplayFrame}、回决口的「要不要人」
+ * {@link storedCardDemandsAPerson}、幂等重入与规则兑付两处(`tool-approval.ts`)、local 车道的启动收敛(`approval-crash-convergence.ts`))都经这一只,
+ * 不各自 `safeParse`(修前五处各写一遍 —— 读法的任何一次改动都要改五处,漏一处就是两种读法)。
+ *
+ * 读法 = **一次性迁移 M18 的读侧半场 + 同一只 schema**:7.128.x 写下的卡上两座可能带引擎 7.51.0 退役的词(`ruleOffersAbsence: "shadowed"` /
+ * 类对里的 `governance_unavailable`),起服改写够不着的行(滚动升级窗里旧副本新写的、local 车道的文件 ask 账)读时过同一只改写
+ * (`retired-card-words.ts`),**响亮**:每改写一次计一次 `server.approval-card.retired-card-word-read`(计数 + probe + 一次 warn,detail 只报座名)。
+ * 窗关(登记表 M18)后读侧半场随起服改写一起删,本函数回到「只 `safeParse`」。读不出(真坏形)⇒ `undefined`,各读点的处置不变(跳过 + warn / park /
+ * 按要人 / 素材缺席 / 收敛成因按缺省)。
+ */
+export declare function readStoredCardEnvelope(cardJson: unknown): ApprovalCardEnvelope | undefined;
+/**
+ * 🔴 **停驻行 `tool_approval` 臂的读侧入口**(S-1562;一次性迁移 M18 的读侧半场)—— 读它两座的两个读者(运维队列行 {@link parkRowFacts}、
+ * 耐久 `/decide` 的 remember 判据 `tool-approval.ts` `parkRowStandingAnswerFacts`)先经这一只:7.50.x 停驻的行上两座的退役词按 M18 那一只改写读,
+ * 响亮(同一个 tag)。停驻行是**引擎写的文档**,没有起服改写这一半:引擎的行摘要覆盖类对 `askClass` / `classes`,本服务改写 = 续跑判官判 `damaged`、拒续跑 ⇒ **所有**停驻行
+ * (SQL 店的、local 车道引擎 File 店的)都只在这里读时改写,交的是浅拷贝,被读的行一个字节不动。
+ * 改写之后读者只读 core 的一张闭集,「读不出 ⇒ 按强制」只会遇到真坏形。别的臂 / 非对象 ⇒ 原样。窗关随 M18 一起删。
+ */
+export declare function currentParkArm<T>(pendingAction: T): T;
 /**
  * [ref] §3.1 的呈卡帧(设计稿 §4.1)—— **live 铸造**形(重放形见 {@link buildReplayFrame},
  * 两者投的是同一种帧,区别只在 `card` 的来源:这里是刚投影出来的,那里是从行上回读的)。

package/dist/approval-card.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
 import { PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS } from "./permission-rule-vocab.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
@@ -267,8 +268,7 @@ export function readRuleEvidence(req) {
         ...(raw.personalRuleDotsAbsent !== undefined ? { personalRuleDotsAbsent: raw.personalRuleDotsAbsent } : {}),
     };
 }
-const RULE_OFFERS_ABSENCE_VALUES = ["mandated", "lane_cannot_speak", "shadowed"];
-export const RuleOffersAbsenceSchema = z.enum(RULE_OFFERS_ABSENCE_VALUES);
+export const RuleOffersAbsenceSchema = z.enum(RULE_OFFERS_ABSENCES);
 const RuleOffersAbsenceEnvelopeSchema = z.object({ ruleOffersAbsence: RuleOffersAbsenceSchema.optional() });
 export function readRuleOffersAbsenceSeat(x) {
     const parsed = RuleOffersAbsenceEnvelopeSchema.safeParse(x);
@@ -318,11 +318,21 @@ function isSteerReplayDiffers(v) {
     const facets = STEER_REPLAY_FACETS;
     return Array.isArray(v) && v.length > 0 && v.every((f) => facets.includes(f));
 }
+function isResumeStartupCause(v) {
+    const words = RESUME_STARTUP_CAUSES;
+    return words.includes(v);
+}
+function isBoundGrantAbsence(v) {
+    const words = BOUND_GRANT_ABSENCES;
+    return words.includes(v);
+}
 const CLOSED_WORD_SEAT_GUARDS = {
     mandate: isPersistedRuleMandate,
     origin: isAskOrigin,
     classifierNoRuling: isAutoModeFallbackCause,
+    boundGrantAbsence: isBoundGrantAbsence,
     differs: isSteerReplayDiffers,
+    cause: isResumeStartupCause,
 };
 export function readAskClassPair(carrier) {
     const askClass = "askClass" in carrier ? carrier.askClass : undefined;
@@ -335,13 +345,15 @@ export function readAskClassPair(carrier) {
     recordFailOpen("server.approval-card.closed-word-out-of-set", isAskClass(askClass) ? `classes=${outOfSetDetail(classes)}` : `askClass=${outOfSetDetail(askClass)}`);
     return undefined;
 }
-export function parkRowFacts(pendingAction) {
-    if (typeof pendingAction !== "object" || pendingAction === null || !("kind" in pendingAction) || pendingAction.kind !== "tool_approval")
+export function parkRowFacts(stored) {
+    if (typeof stored !== "object" || stored === null || !("kind" in stored) || stored.kind !== "tool_approval")
         return {};
+    const pendingAction = currentParkArm(stored);
     const ruleOffersAbsence = readRuleOffersAbsence(pendingAction);
     const mandate = readClosedWordSeat(pendingAction, "mandate");
     const origin = readClosedWordSeat(pendingAction, "origin");
     const askClassPair = readAskClassPair(pendingAction);
+    const boundGrantAbsence = readClosedWordSeat(pendingAction, "boundGrantAbsence");
     return {
         ...(readParkRowTrueSeat(pendingAction, "requiresRealApproval") ? { requiresRealApproval: true } : {}),
         ...(readParkRowTrueSeat(pendingAction, "mandated") ? { mandated: true } : {}),
@@ -349,6 +361,7 @@ export function parkRowFacts(pendingAction) {
         ...(origin !== undefined ? { origin } : {}),
         ...(ruleOffersAbsence !== undefined ? { ruleOffersAbsence } : {}),
         ...(askClassPair ?? {}),
+        ...(boundGrantAbsence !== undefined ? { boundGrantAbsence } : {}),
     };
 }
 const DenialLimitFallbackSchema = z
@@ -492,6 +505,22 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
 export function buildApprovalCardEnvelope(approvalId, card) {
     return { schemaVersion: APPROVAL_CARD_SCHEMA_VERSION, approvalId, card };
 }
+export function readStoredCardEnvelope(cardJson) {
+    const stored = retireStoredCardWords(cardJson);
+    if (stored.seats.length > 0)
+        noteRetiredCardWordRead("card_json", stored.seats);
+    const parsed = ApprovalCardEnvelopeSchema.safeParse(stored.value);
+    return parsed.success ? parsed.data : undefined;
+}
+export function currentParkArm(pendingAction) {
+    const arm = retireParkArmWords(pendingAction);
+    if (arm.seats.length > 0)
+        noteRetiredCardWordRead("parked row", arm.seats);
+    return arm.value;
+}
+function noteRetiredCardWordRead(carrier, seats) {
+    recordFailOpen("server.approval-card.retired-card-word-read", `${carrier}: ${seats.join(" / ")}`);
+}
 export function buildApprovalRequestFrame(input) {
     return {
         type: "approval_request",
@@ -510,8 +539,8 @@ export function buildRevokeFrame(batchId, askIds, reason, serverNowMs, originTas
     return { type: "approval_revoke", schemaVersion: 1, batchId, askIds: [...askIds], reason, serverNowMs, taskId: originTaskId };
 }
 export function buildReplayFrame(row, nowMs) {
-    const parsed = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
-    if (!parsed.success)
+    const parsed = readStoredCardEnvelope(row.cardJson);
+    if (parsed === undefined)
         return undefined;
     return {
         type: "approval_request",
@@ -519,16 +548,16 @@ export function buildReplayFrame(row, nowMs) {
         askId: row.askId,
         taskId: row.taskId,
         kind: "permission",
-        card: parsed.data.card,
+        card: parsed.card,
         expiresAtMs: row.expiresAtMs,
         expiresInMs: Math.max(0, row.expiresAtMs - nowMs),
         serverNowMs: nowMs,
-        approvalId: parsed.data.approvalId,
+        approvalId: parsed.approvalId,
     };
 }
 export function storedCardDemandsAPerson(cardJson) {
-    const parsed = ApprovalCardEnvelopeSchema.safeParse(cardJson);
-    return !parsed.success || parsed.data.card.risk.requiresRealApproval;
+    const parsed = readStoredCardEnvelope(cardJson);
+    return parsed === undefined || parsed.card.risk.requiresRealApproval;
 }
 export function buildApprovalPreamble(rows, nowMs, replayMax) {
     const frames = [];

package/dist/approval-crash-convergence.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER, FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
-import { ApprovalCardEnvelopeSchema } from "./approval-card.js";
+import { readStoredCardEnvelope } from "./approval-card.js";
 import { APPROVAL_ENDING_CAUSES } from "./approval-deny-reasons.js";
 import { writerGoneEvidenceFor } from "./user-input-ledger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
@@ -31,12 +31,12 @@ export async function convergeCrashedAsksAtBoot(input) {
                 break;
             for (const row of page) {
                 seen.add(row.askId);
-                const envelope = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
-                if (!envelope.success) {
+                const envelope = readStoredCardEnvelope(row.cardJson);
+                if (envelope === undefined) {
                     causeUnreadable += 1;
                     recordFailOpen("server.approval-crash-convergence.cause-unreadable", `ask ${row.askId} (task ${row.taskId}): card envelope unreadable — cause defaulted to ${APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK}`);
                 }
-                const reason = envelope.success && input.audit !== undefined ? input.audit.causeFor(envelope.data.approvalId) : APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK;
+                const reason = envelope !== undefined && input.audit !== undefined ? input.audit.causeFor(envelope.approvalId) : APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK;
                 let won;
                 try {
                     won = await store.transitionAsk(row.askId, "STREAM_PENDING", "VOID", { deniedReason: reason, updatedAtMs: now() });

package/dist/bake-runner/main.js

@@ -3,7 +3,7 @@ import { readFile } from "node:fs/promises";
 import { createLogger } from "../observability/logger.js";
 import { logConfigDiagnostics, parseEnvNameAllowlist, parseNumOrFailNonNegative } from "../config.js";
 import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
-import { hostSubprocessEnv } from "../server-secret-env.js";
+import { declareServerWithheldEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { BakeRunner, } from "./runner.js";
 const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
@@ -256,6 +256,7 @@ function makeClock() {
     };
 }
 async function main() {
+    declareServerWithheldEnv();
     const env = loadEnv();
     const log = createLogger(process.env.LOG_LEVEL || "info");
     logConfigDiagnostics(log);

package/dist/boot/execution-env.js

@@ -222,6 +222,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.runtimeClass != null ? { runtimeClass: config.remoteExec.runtimeClass } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
+            ...(config.remoteExec.livenessMs != null ? { livenessMs: config.remoteExec.livenessMs } : {}),
             dataTimeoutMs: workspaceSnapshotTimeoutOf(config.remoteExec),
             ...(config.remoteExec.memory ? { memory: config.remoteExec.memory } : {}),
             ...(config.remoteExec.cpu ? { cpu: config.remoteExec.cpu } : {}),

package/dist/boot/memory-consolidation.d.ts

@@ -1,6 +1,7 @@
+import { type LaneHomeDeployment } from "../execution-lane-caps.js";
 import type { RestartSliceCtx } from "../web-admin-client/restart-signal.js";
 import type { MemoryConsolidationDriverConfig, ServiceConfig } from "../config-types.js";
-import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type SessionCaptureRecordStore } from "@sema-agent/core";
+import { resolveMemoryConsolidationDriver, type ConsolidationWriteJudge, type ConsolidationWriteJudgeInput, type EngineNotice, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type MemoryBackend, type MemoryConsolidationDriverDeps, type PermissionRuleStoreProvider, type SessionCaptureRecordStore } from "@sema-agent/core";
 /**
  * 座解析的 options 形 = core 解析器交回的那只(core 7.50.0 起它**不含** `writeJudge`:判官不是模型席的一部分,由调用方在动词上带)。
  * 取解析器的返回型而不是自己写 `Omit<…>`:形的属主是 core 的解析器,本仓不持第二份。
@@ -396,26 +397,55 @@ export declare function assertAutoConsolidationWirable(input: {
     memoryConsolidationWired: boolean;
 }): void;
 /**
- * 运维阀门腿的写判官座(core 7.50.0 起驱动动词必带)。
+ * 运维阀门腿的写判官座的**输入**(core 的判官构造器 `createConsolidationWriteJudge` 的 `input`)。返回值带一只**活的**规则店 provider(有行为,不是纯数据)⇒ `create*`(工厂命名律:`build*` 只产纯数据;不拆店出返回值,因为输入就是引擎构造器要的那一只形,多拆一个函数只会多一个规则)。
  *
- * ## 判官只有一只,这条腿拿不到它
+ * ## 构造器只有引擎那一只,本仓只供部署事实
  *
- * 「这条路径能不能写」在引擎里只有**一只**判官(合成写判官:技能拒行 / 收窄折叠 / 调用方与继承策略 / 人的持久规则车道 /
- * 组织车道,一条走法一个优先序);引擎的自动整理腿把**腿自己的**那只交给驱动。本腿(运维手动阀门)没有腿:没有名册上的
- * `Write` 脸、没有引擎盖的豁免根与工作目录、没有持久规则车道 —— 而引擎包今天不导出那只判官的构造器。在本仓手搭一只
- * 「对部署策略问一次合成 `Write`」的判官 = 把引擎判官的层走法、脸、豁免根、已中止信号的约定与判词读法**再写一份**
- * (第二个读者,与引擎那只迟早分歧,而且分歧是静默的)。所以本腿不造第二只。
+ * 「这条路径能不能写」在引擎里只有**一只**判官(合成写判官:技能拒行 / 收窄折叠 / 调用方与继承策略 / 人的持久规则车道 / 组织车道,一条走法一个优先序)。
+ * 引擎的自动整理腿(有腿:名册上的 `Write` 脸、引擎盖的豁免根、人的持久规则读者)与本腿(运维手动阀门:没有腿)用的是**同一个构造器** ——
+ * 同样的行给同样的答案,本仓不手搭第二只({@link createOperatorValveWriteJudge} 恰一处调用它,见 `test/memory-consolidation-write-judge.test.ts` ⑥)。
  *
- * ## 于是它是一只**响亮的放行座**,登记为保护型欠账
+ * ## 本仓供的两个部署事实(其余键一律缺席,缺席的语义见引擎:那一层不存在)
+ *
+ *  · `ruleStoreProvider` = 部署唯一的那只合成规则店(`RunnerDeps.permissionRuleStore` 的同一个变量,装配第 4 段铸一次)。规则店没装配 ⇒ 缺席 ⇒ 没有规则层。
+ *  · `anchors.home` = `executionLaneHomeDir(config)` —— `~/` 行的基,与引擎执行环境的 `homeDir` 座、下单 422 门、规则基 `taskHome` 是**同一只函数**
+ *    (车道没有自己的 home 时诚实缺席;缺席 ⇒ 引擎读到人持有的 `~/` 收紧行时无处锚定 = 按异议处置,拒闭)。**刻意不另调 `os.homedir()`**:
+ *    那会在非 host 车道上造出第二个读法 —— 阀门答「可解析」而腿内答「读不出」。⚠️ 今天这一键在生产座上**空转**:阀门不带主体(下面的 `principal`),
+ *    引擎读匿名地板、不读任何人的持久行,「`~/` 行无锚 ⇒ 拒闭」走不到;留着它是为了主体有了来源之后不必再回来改这里。
+ *
+ * ## 刻意缺席的键(披露,不是遗漏)—— 三层没喂,所以这条腿仍是**响亮的放行座**(P-DEBT,见 {@link createOperatorValveWriteJudge})
+ *
+ *  · `principal` / `localOwnerDeclared`(人的持久规则层):阀门是 operator 面的一次调用,本仓没有一个能回答「这个库属于谁」的来源 ——
+ *    单用户 + file 后端(阀门结构上能起的唯一形,见 {@link assertConsolidationDriverWirable})里记忆是部署级全局层 / 任务根散列的项目层,principal 标签从不分盘,
+ *    本仓也从不声明 `localOwnerRules`;整理 run 又是按 scope 单飞、可续跑的持久作业,「谁的规则」对并入 / 续跑的调用方没有定义。
+ *  · `callerPolicy`(部署的调用方策略层):`APPROVAL_REQUIRE` / `APPROVAL_DENY` / `AUTONOMY` / 敏感路径守卫集是**每任务现合成**的(`deployment-governance.ts`,
+ *    读热可改的活配置,「禁 memoize」),没有部署级单例;boot 期铸一份喂进来就是冻结一份会过期的策略(收紧不生效 = 静默放行)。喂它需要一份设计:取哪几层、
+ *    活配置怎么读、审批席取什么形;其中敏感路径层还要引擎的豁免根(`RunnerDeps.memoryEngineDir` 盖在每个请求上),而宿主构造器的输入没有这一位 —— 要向 core 请托,
+ *    不在本层造第二条豁免根的读法。
+ *  · `anchors.root`:阀门按 scope 跑,手里没有项目根 —— 项目层 scope 键是任务根的单向散列(`project-identity.ts` 的 `repo:<sha256[:24]>`),反推不出根;
+ *    全局层根本没有根。⇒ 人持有的相对 deny / ask 行无处锚定 = 异议,拒闭(引擎契约:判官不猜一行原本指向哪里)。
+ *
+ *  所以今天这条腿的放行范围与 7.128.x 相同(人的规则、部署的审批名单 / 敏感路径守卫都拦不住手动阀门这一轮折叠);变的只是「判官不再是代答」—— 往后每喂一层,
+ *  只在本函数加键,钉 = `test/memory-consolidation-write-judge.test.ts` ⑦。
  *
- * 答 `no_objection` —— 与 v7.49.x 本腿的行为逐字同(那时驱动根本不问),不回退任何现网能力;每被问一次记一次
- * `server.memory-consolidation.operator-valve-unjudged`(P-DEBT:计数 + 探针行 + 一次性告警),债在遥测里显形。
  * 自动整理腿不受影响:它走引擎腿自己的判官,人的持久规则与部署策略照判。
- * 退役条件:引擎导出宿主可用的写判官构造器(收部署策略 + 一只规则店主体)那一版,本函数换成它、本 tag 删。
- * scope 与人:本仓的文件后端不按请求主体铸 scope(单用户形是部署声明的全局层 `MEMORY_SCOPE` 与按任务根派生的项目层),
- * 所以从 scope 读不出「这是谁的库」;匿名 run 读不读本地属主那只规则桶另候裁定 —— 两件都不在本座里猜。
  */
-export declare function createOperatorValveWriteJudge(): ConsolidationWriteJudge;
+export declare function createOperatorValveJudgeInput(facts: {
+    /** 部署唯一的合成规则店(装配第 4 段铸一次,`RunnerDeps.permissionRuleStore` 与本座读同一只)。缺席 = 规则店没装配。 */
+    readonly ruleStoreProvider: PermissionRuleStoreProvider | undefined;
+    /** 只读 `executionLaneHomeDir` 读的两位(`ServiceConfig` 结构满足)。 */
+    readonly config: LaneHomeDeployment;
+}): ConsolidationWriteJudgeInput;
+/**
+ * 运维阀门腿的写判官座:引擎的判官构造器喂 {@link createOperatorValveJudgeInput},**外加一个响亮的债计数**(P-DEBT)。
+ *
+ * 构造器只有引擎那一只,本函数不判任何东西:`judge(target)` 的答案原样返回。它只在每次被问时记一次
+ * `server.memory-consolidation.operator-valve-layers-unfed`(计数 + 探针行 + 一次性告警)—— 因为人的规则层、部署策略层、项目根三样都没喂
+ * ({@link createOperatorValveJudgeInput} 头注),放行的最坏后果没变:运维手动整理时,一条点名记忆库路径的人的持久规则或部署写策略拦不住这一轮折叠
+ * (与 7.128.x 逐字同)。债在遥测里显形,而不是随着「判官已换成引擎的」这句话消失。自动整理腿不受影响,走引擎腿自己的判官。
+ * 收口 = 三层各自有了来源(人:「读谁的桶」裁定;策略:设计 + 引擎的豁免根入参;根:无来源则永久缺席并改写本债)那一版,本 tag 删。
+ */
+export declare function createOperatorValveWriteJudge(facts: Parameters<typeof createOperatorValveJudgeInput>[0]): ConsolidationWriteJudge;
 /** 两个 admin 口消费的窄能力面(`ServiceDeps.memoryConsolidation` 的实参来源)。 */
 export interface MemoryConsolidationFaces {
     /** D3 的座位自证(投影用;boot 期解析一次,restart-to-apply)。 */
@@ -476,7 +506,7 @@ export declare function createMemoryConsolidationFaces(store: {
      *  早问库目录一次、应用时问每个产物文件,答 `no_objection` 以外一律拒写。装配层给哪一只见 {@link createOperatorValveWriteJudge}。 */
     writeJudge: ConsolidationWriteJudge;
     /** 引擎通告的**运维行**座(与 Runner 的 `onNotice` 同一只转发器)。缺席 ⇒ 通告只在回执上。判官拒的两种时机都经它走一次:
-     *  应用时拒 = 引擎在驱动里铸的 `memory.consolidation_incomplete`;早问拒 = 驱动抛出的拒绝经引擎导出的构造器转成的
+     *  应用时拒 = 引擎在驱动里铸的 `memory.consolidation_incomplete`;早问拒 = 驱动抛出的拒绝经引擎导出的投递口(`deliverWriteRefusal`)转成的
      *  `memory.consolidation_refused`(本仓不读通告名、不自铸通告形)。 */
     onNotice?: (notice: EngineNotice) => void;
 }): MemoryConsolidationFaces;

package/dist/boot/memory-consolidation.js

@@ -1,9 +1,10 @@
 import { redactSecrets } from "../trace/redact.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { memoryMountRootOf } from "../memory-scope.js";
+import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
 import { backendOwnsControlPlane } from "../memory-operator-faces.js";
-import { CONSOLIDATION_WRITE_REFUSED_CODE, ConsolidationRefusedError, expandTiers, MemoryEngine, memoryConsolidationRefusedNotice, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -317,10 +318,18 @@ export function assertAutoConsolidationWirable(input) {
         `unset, or set MEMORY_AUTO_CONSOLIDATION=off (unsetting it is NOT the same: the engine's named default is ON as of ` +
         `core 7.21.1).`);
 }
-export function createOperatorValveWriteJudge() {
-    return () => {
-        recordFailOpen("server.memory-consolidation.operator-valve-unjudged");
-        return { verdict: "no_objection" };
+export function createOperatorValveJudgeInput(facts) {
+    const home = executionLaneHomeDir(facts.config);
+    return {
+        ...(facts.ruleStoreProvider !== undefined ? { ruleStoreProvider: facts.ruleStoreProvider } : {}),
+        anchors: home !== undefined ? { home } : {},
+    };
+}
+export function createOperatorValveWriteJudge(facts) {
+    const judge = createConsolidationWriteJudge(createOperatorValveJudgeInput(facts));
+    return (target) => {
+        recordFailOpen("server.memory-consolidation.operator-valve-layers-unfed");
+        return judge(target);
     };
 }
 export function createMemoryConsolidationFaces(store, input) {
@@ -343,9 +352,7 @@ export function createMemoryConsolidationFaces(store, input) {
                 writeJudge: input.writeJudge,
                 ...(input.onNotice !== undefined ? { onNotice: input.onNotice } : {}),
             }).catch((err) => {
-                if (input.onNotice !== undefined && err instanceof ConsolidationRefusedError && err.code === CONSOLIDATION_WRITE_REFUSED_CODE) {
-                    input.onNotice(memoryConsolidationRefusedNotice({ code: err.code, scope, reason: err.message, ...(err.occurrenceId !== undefined ? { occurrenceId: err.occurrenceId } : {}) }));
-                }
+                deliverWriteRefusal(err, scope, input.onNotice);
                 throw err;
             });
             if (receipt.stopDetail !== undefined) {

package/dist/boot/side-query-lane.d.ts

@@ -26,9 +26,10 @@
  *    降级成**结构性事实**(这条路上根本没有 wrapper);
  *  · `headers` 半边从此有出路(wrapper 形只注得进 `apiKey`,core 的座位 `{apiKey, headers?}` 两半都收);
  *  · 判据(`gatewayBaseUrl`)与 resolver 一样**按调用现取** —— 见下面 `createSideQueryLane` 的注。
- * `createPerModelKeyBrain` **不删**:它仍是 WebFetch 摘要面(`boot/webfetch-summarize-lane.ts`)的
- * key plane —— core 的 `WebFetchSummarizerOptions` 至今只有 `maxContentChars`,那一面没有座位可换
- * (亲验 core 5.46.0 `dist/tools/web.d.ts`)。
+ * `createPerModelKeyBrain` 当时**没删**:它还是 WebFetch 摘要面(`boot/webfetch-summarize-lane.ts`)的 key plane ——
+ * core 的 `WebFetchSummarizerOptions` 那时只有 `maxContentChars`。core 7.51.0 给摘要器补上了同一签名的座
+ * (`WebFetchSummarizerOptions.getApiKeyAndHeaders`)⇒ 包装退役,四面(任务 / side-query / 记忆整理 / WebFetch 摘要)
+ * 都经 core 的座位供给 per-model 凭据,本仓不再在任何一面包 brain。
  *
  * 🔴 **poison(声明的钥匙拿不到)上抛,绝不静默回落网关 key** —— `resolveModelApiKey` 抛
  * `ModelKeyPoisonedError` 是「这个模型配了自己的钥匙(托管密钥解不开 / S-896 起 `apiKeyEnv` 变量缺席)却拿不到」的响亮态;吞成 undefined 等于用共享
@@ -46,8 +47,9 @@
  * 是配对法的单一实现,三只一方 brain(openai / anthropic / open-responses)在 `buildRequest` 里逐次
  * 复判 —— 部署声明了 `config.baseUrl` 而 entry URL 不在那个根上、凭据又只有部署级那一份 ⇒
  * `route.credential_mismatch` 响亮拒;连部署级凭据都没有 ⇒ `route.credential_missing`。**三面同批**
- * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据、或不声明
- * `config.baseUrl`(core 的 `"unpinned"` 快速起步姿态)。⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
+ * (主推理链 / side-query / WebFetch 摘要走的是同一只 brain 栈),旋钮 = 给模型自己的凭据(当年还有第二条:不声明
+ * `config.baseUrl`,走 core 的 `"unpinned"` 快速起步姿态 —— core 7.51.0 #1531 起该姿态退役,一份部署凭据只配一个根)。
+ * ⇒ [ref] 要的「三面同批 + 旋钮」由上游一次交齐。
  *
  * 于是本席的 `isOffRouteBaseUrl` + `recordFailOpen("server.model-key.off-route-model-uses-gateway-key")`
  * 两件**一并撤线**:那条计数的语义是「这一次调用真把网关凭据发给了别家」,而在 5.57 上那次调用根本
@@ -97,21 +99,6 @@ export interface SideQueryLaneCtx {
 export declare function createPerModelAuthSeat(getKeyResolver: () => KeyResolver, opts?: {
     readonly upstream?: SideQuerySpec["getApiKeyAndHeaders"];
 }): PerModelAuthSeat;
-/**
- * per-model key 注入 brain wrapper —— **[ref] 后只服务 WebFetch 摘要面**
- * (`boot/webfetch-summarize-lane.ts`)。side-query 面已换到 core 的 spec 座位(见顶注「[ref] 换装」);
- * core 的 `WebFetchSummarizerOptions` 至今只有 `maxContentChars`(亲验 5.46.0 `dist/tools/web.d.ts`),
- * 那一面**没有座位可换**,只能继续在 brain 层补凭据。
- *
- * 语义(与 `createPerModelAuthSeat` 同一张表,只是注入位在 `options.apiKey`):
- *  · `options.apiKey` **已在场** ⇒ 原样透传(上游/装饰器已经定了凭据,本层不抢);
- *  · resolver 缺席 / 返回 undefined ⇒ 不注入 ⇒ 网关 key(additive 契约);
- *  · resolver 抛(sealed key 中毒)⇒ **上抛**,本次调用整体失败,一个字节都不发。
- *
- * `complete` 在场时同样包一层:core 的 `Brain.complete` 是 compaction/摘要腿的直调口(WebFetch 摘要器
- * 正是**优先**走它),漏包等于给同一个病留第二条路。
- */
-export declare function createPerModelKeyBrain(brain: Brain, getKeyResolver: () => KeyResolver): Brain;
 /**
  * 装配 side-query 执行席 = 真 `runSideQuery` + core 的 per-model auth 座,models/roles 与 Runner 同源。
  *

package/dist/boot/side-query-lane.js

@@ -8,30 +8,6 @@ export function createPerModelAuthSeat(getKeyResolver, opts = {}) {
         return resolve ? await resolve({ name: model.name }) : undefined;
     };
 }
-export function createPerModelKeyBrain(brain, getKeyResolver) {
-    const seat = createPerModelAuthSeat(getKeyResolver);
-    const keyFor = async (model, given) => {
-        if (given !== undefined)
-            return given;
-        return (await seat(model))?.apiKey;
-    };
-    const stream = async (model, context, options) => {
-        const apiKey = await keyFor(model, options?.apiKey);
-        return brain.stream(model, context, apiKey === undefined ? options : { ...options, apiKey });
-    };
-    const complete = brain.complete?.bind(brain);
-    return {
-        stream,
-        ...(complete
-            ? {
-                complete: async (model, context, options) => {
-                    const apiKey = await keyFor(model, options?.apiKey);
-                    return complete(model, context, apiKey === undefined ? options : { ...options, apiKey });
-                },
-            }
-            : {}),
-    };
-}
 export function createSideQueryLane(ctx) {
     return (spec) => runSideQuery({
         ...spec,

package/dist/boot/stage-01-config.js

@@ -14,8 +14,11 @@ import { setRunTerminalLogObserver } from "../observability/run-terminal.js";
 import { setRedactionObserver } from "../trace/redact.js";
 import { installOutboundDispatcher } from "../outbound-dispatcher.js";
 import { provisionSemaConfigDir } from "../sema-config-dir.js";
+import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "../server-secret-env.js";
 export function runStage01() {
+    declareServerWithheldEnv();
     const config = loadConfig();
+    bindOwnCredentialsConfig(config);
     const runStaleFailure = crossInvariant("run-stale-heartbeat").check({ live: config, next: config });
     if (runStaleFailure !== undefined) {
         throw new Error(runStaleFailure);

package/dist/boot/stage-06-runners.js

@@ -76,7 +76,7 @@ export function runStage06(ctx) {
             onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
             ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
-            writeJudge: createOperatorValveWriteJudge(),
+            writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),
             onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
         })
         : undefined;