@sema-agent/server 7.130.0 → 7.132.0

package/dist/task-settings.d.ts

@@ -47,9 +47,10 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider, type PermissionMode } from "@sema-agent/core";
-import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
+import { type PathRuleBases, type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PermissionMode } from "@sema-agent/core";
 import { type KeyClosureIssue } from "./request-key-closure.js";
+import { type RunnableHooksConfig } from "./hooks/hook-runner.js";
+import type { StoredHooksRereadM20 } from "./stored-request-hooks-m20.js";
 import { type EntryPermissionMode } from "./runtime-governance.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
@@ -213,10 +214,10 @@ export interface ParsedTaskSettings {
      *  orthogonal axes — `thinking:"max"` (the reasoning axis) + `selfOrchestration:true` (the orchestration axis,
      *  through its existing fail-closed gate). NOT a new mechanism; just a preset that fans out to existing spec fields. */
     ultracode?: boolean;
-    /** hooks hook-runner(阶段一):registry-core 0.1.51 契约校验过的 hooks 配置。像 shellEnv 一样
+    /** hooks hook-runner(阶段一):经 `parseHooksConfig`(契约包分类器 + 服务侧上限 + 本仓会跑的条目类型)判过的 hooks 配置。像 shellEnv 一样
      *  这里只 PARSE;应用点(main.ts resolveSpec)按单用户闸(`requirePrincipal !== true`)决定翻不翻成
-     *  core `TaskSpec.hooks` 回调——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
-    hooks?: HooksConfig;
+     *  任务座 `TaskSpec.mods` 上的一张注册 `settings.hooks`——多租户 lane 收到只警告忽略(hook 命令跑在 worker host = class ② 能力授予)。 */
+    hooks?: RunnableHooksConfig;
     /** [ref](7.77.0)—— CC settings 同名键:上下文窗口里**留给技能清单**的比例((0,1];CC 默认 0.01 = 1%)。
      *  超预算时引擎把描述裁短、再不够退成 name-only(`cli259.js` 的清单渲染算法),**从不**拒掉一条技能 ——
      *  这正是本版把技能条数/描述两条帽整条退役后的补偿面:per-turn 成本的旋钮在**渲染侧**,不在受理侧。
@@ -232,6 +233,15 @@ export interface ParseTaskSettingsResult {
     /** Sub-fields the caller SENT but this version does not wire(`env`;`hooks` 仅在 MALFORMED 时入列——valid hooks
      *  已是 applied 字段)。Empty when none. */
     deferred: string[];
+    /** 一次性迁移 M20(窗口见 `plugins/one-time-migrations.ts` 登记表):存下的 hooks 被唯一读者拒掉、经重读座剥掉点名的键后过了读者 ⇒ 本次读数里 `settings.hooks` 是重读的产物,
+     *  并带被剥的坐标(出门形)。缺席 = 没有发生重读。 */
+    hooksReread?: {
+        readonly stripped: readonly string[];
+    };
+}
+/** `parseTaskSettings` 的可选座:续跑重放腿才有的重读座(一次性迁移 M20;新提交腿与不问 hooks 的读者不递)。 */
+export interface ParseTaskSettingsSeats {
+    readonly storedHooksReread?: StoredHooksRereadM20;
 }
 /** Cap on `outputStyle` length — it lands in the system prompt, so it shares the `MAX_SYSTEM_PROMPT_CHARS` (16384)
  *  posture (an uncapped prompt body is a per-turn token-cost hole; cross review). Exported so the HTTP layer
@@ -314,7 +324,7 @@ export declare function taskSettingsKeyIssue(raw: unknown): KeyClosureIssue | nu
  * 🔒 **`settings.hooks` 会不会被采纳** —— 全仓**唯一**的车道谓词(S-995,主会话裁):hook 命令跑在 WORKER HOST([ref] class ② 能力授予),所以只有单用户车道
  * (`requirePrincipal !== true`,与 scheduler / backgroundShell / lspHost / MCP 注入同一姿势)采纳;多租户车道收到 hooks **整只忽略**(`task_hooks_ignored`),绝不执行。
  * 三处读它,谁也不许内联 `requirePrincipal`(各写各的 = 迟早漂):
- *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不装 `TaskSpec.hooks` + 一条 `task_hooks_ignored`;
+ *  · `boot/resolve-spec.ts` —— 装配:不采纳 ⇒ 不铸 `TaskSpec.mods` 的 `settings.hooks` 注册 + 一条 `task_hooks_ignored`;
  *  · `http/routes/capabilities.ts` —— 能力位 `taskSettings.hooks`(「says yes ⟺ route works」);
  *  · `http/admission.ts` —— fresh 受理面的「别名 matcher 永不命中」判据的**求值深度**:采纳 ⇒ `"regex"`(运行期同一只匹配函数,带资源闸);不采纳 ⇒ `"literal"`
  *    (7.112.0 的字面判:零调用方正则执行 —— 受理面是所有车道,租户不能借一只灾难回溯的 matcher 占满事件循环)。
@@ -333,31 +343,17 @@ export declare function taskHooksHonored(config: {
  * 重放也走的宽容层,一个 4xx 在这里会把存量 parked 任务永久砖死;FRESH 提交面由 {@link taskSettingsKeyIssue}
  * 在 `server.ts` prepareSpec 里 400 响亮拒 + 逐字列名。双层姿势与 outputStyle / permissionMode 两处逐字相同。
  */
-export declare function parseTaskSettings(raw: unknown): ParseTaskSettingsResult;
+export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSettingsSeats): ParseTaskSettingsResult;
 /** Defensive acceptance of the `appendSystemPrompt` rider ([ref] R2 + codex F2): the HTTP 400 gate (prepareSpec,
  *  MAX_SYSTEM_PROMPT_CHARS) only covers FRESH submits — every resume family re-enters resolveSpec on a STORED body,
  *  and a pre-1.243 store preserved unknown request keys verbatim (the field was INERT then), so an over-cap legacy
  *  value must not become active prompt content after rollout (context exhaustion / spend hole). Over-cap ⇒ dropped +
  *  warned — the rider was inert pre-upgrade, so dropping preserves the stored task's prior behavior; a 4xx here would
  *  permanently brick that task's resume instead (same defensive posture as parseTaskSettings' outputStyle drop).
- *  Cap value = the submit gate's (16384; MAX_SETTINGS_OUTPUT_STYLE_CHARS — both land in the same spec field). */
-/** TRUE when `text` is an ALREADY-ASSEMBLED system prompt — core's migration guard detects the same three
- *  constitution anchors and takes the pass-through assembler arm, whose section subset (OPAQUE_KEPT, dist-read)
- *  has NO `core/role.append`: any append rider (top-level or settings.outputStyle) would be SILENTLY discarded
- *  there. Shared predicate for the submit 400 gate, the resolveSpec resume mirror, and the center-declaration
- *  probe — one definition so the three gates can't drift. */
-export declare function hasConstitutionAnchors(text: unknown): boolean;
-/** codex R9 (provider-aware append-less detection): mirrors core's ACTUAL pass-through triggers instead of a raw
- *  body-text heuristic — the assembler's migration guard probes (a) `stableBlocks` identity declarations and
- *  (b) `stableSystem` OUTPUT for the three anchors; a plain `userSystemPrompt` under the DEFAULT provider (no
- *  scenario provider) never triggers it and `core/role.append` is retained, so an anchored systemPrompt there
- *  must NOT block/strip a rider (R9 false-positive: unbranded default / scan rejected valid combos). Probing
- *  calls the provider hooks with a minimal ctx — server providers (and centerPromptProvider) are pure functions
- *  of ctx, and the same hooks run again inside core's assembly; a hook throw = conservative false (core will
- *  fail the task loudly on its own). `replaceAll` owns the whole prompt(legacy free-form `system()` 腿已随 core 2.0.0 删除)
- *  (REPLACE_ALL_EXCLUDED strips role.append) → append-less true. */
-export declare function providerDropsAppend(provider: PromptProvider | undefined, userSystemPrompt: string | undefined): boolean;
-export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void, packDropsAppend?: boolean): string | undefined;
+ *  Cap value = the submit gate's (16384; MAX_SETTINGS_OUTPUT_STYLE_CHARS — both land in the same spec field).
+ *  A well-formed rider always mounts: the engine (core 7.52.0) lands it in its own task-append band whatever the role
+ *  text is — there is no "already-assembled" pass-through arm left that could drop it. */
+export declare function acceptAppendSystemPrompt(v: unknown, warn?: (detail: string) => void): string | undefined;
 /** [ref]②/codex F2 — what the workflow ask leg needs from the deployment, on EVERY lane. It is name-keyed and
  *  fs-independent, so it never had the lane split {@link FsWriteGateWiring} carried (that split is itself gone
  *  since [ref] — the sandbox lanes wire a gate of their own shape instead of no gate). */
@@ -457,6 +453,32 @@ export interface FsWriteGateWiring {
      *  本 wiring 的组合点。) */
     isExempt?: (toolName: string, canonicalPath: string) => boolean | Promise<boolean>;
 }
+/**
+ * deny / ask 两桶(core 规则编译器读的收紧表)的**问序,单表**:{@link rulePolicyBucketsRefusal} 的两段循环(名字层 + 文法 · `~/` 要 home)都迭代它 ——
+ * 两桶都有坏条目时,拒点与存体预判点名同一个桶、说同一句。表里每个词同时是 core 规则的 `behavior`。
+ */
+export declare const RULE_POLICY_BUCKETS: readonly ["ask", "deny"];
+export type RulePolicyBucket = (typeof RULE_POLICY_BUCKETS)[number];
+/**
+ * deny / ask 两桶的**完整规则判**,唯一一只(拒点 {@link rejectUnmatchableSettingsNames} 与存体预判 `http/stored-body-replay.ts` 同调):
+ *  ② 按 {@link RULE_POLICY_BUCKETS} 的序逐桶问 `unmatchableToolNamesRefusal`(名字层 + core 规则文法);③ 都过了,再逐桶判 `~/` 形要 home 的那一拒。第一个坏处答 `{ bucket, message }`。
+ * 入参:桶、{@link RulePolicyBases}。**home 同源**:拒点的 home 是 `resolve-spec.ts` 的 `laneHomeBase()` 经 `executionLaneHomeDir(config)` 算出的,预判传同一个函数对同一份部署配置算出的。
+ * **声明给文法的基**只有拒点有(根 + home 的并集,执行车道才知道根):core 的规则文法对**没声明**的基不下判词(见 `config.ts` `uncompilableRuleGuidance`),所以预判什么也不声明、两腿逐字同句;
+ * 预判不能把 home 当「半个基」声明给文法 —— core 的路径族只从根推,缺根时一个合法的 Windows 形 home 会按默认族被判 `unsupported.path_base`(V6-k)。
+ * ③ 排在最后:一条同时文法不成立又带 `~/` 的规则,先说文法(补上 home 它仍被文法拒,先说 home 是误导)。
+ */
+export interface RulePolicyBases {
+    /** 声明给 core 规则文法的路径基(这条 task 的根 + home):拒点才有;存体预判不声明。 */
+    readonly declared?: PathRuleBases;
+    /** 执行环境的 home(`~/` 形规则的前提);这个部署解不出 ⇒ 缺席。 */
+    readonly home?: string;
+}
+export declare function rulePolicyBucketsRefusal(permissions: Readonly<Partial<Record<RulePolicyBucket, readonly string[]>>>, bases: RulePolicyBases): {
+    readonly bucket: RulePolicyBucket;
+    readonly message: string;
+} | undefined;
+/** 请求的 settings 编不成生效的规则 / 有永远不生效的条目 ⇒ 422 的句首(三只桶同一个出口;`resolveSpec` 的拒点与存体重放预判的 409 句子同用这一个,不各写一份)。 */
+export declare const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
 export declare function deriveSettingsPolicy(settings: ParsedTaskSettings, gate?: FsWriteGateWiring, workflowGate?: WorkflowGateWiring): {
     toolPolicy?: ToolPolicy;
 };

package/dist/task-settings.js

@@ -1,7 +1,8 @@
-import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createFsWriteGatePolicy, parseRuleText, resolveReasoningProfile, rankOf, isThinkingLevel, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, isPermissionMode, ruleToolGrammarOf, } from "@sema-agent/core";
 import { unmatchableToolNamesRefusal } from "./config.js";
 import { MAX_PERMISSION_RULES_PER_LIST, createRuleListPolicy } from "./permission-rule-list.js";
 import { allowLayerEntryCountIssue, describeAllowLayerOverCap, ruleEntryListShapeOk } from "./rule-entry-list.js";
+import { limitRefusal } from "./limit-refusal.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
@@ -93,8 +94,9 @@ function bucketIssueMessage(f, rule) {
         case "over_cap":
             switch (rule) {
                 case "rule_policy":
-                    return (`${f.field} has ${f.count} entries — at most ${f.cap} are accepted. Refused rather than truncated: a truncated list silently drops the rules past the cap, ` +
-                        `and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list`);
+                    return limitRefusal(f.field, "entries", f.count, f.cap, {
+                        tail: "Refused rather than truncated: a truncated list silently drops the rules past the cap, and a dropped deny / ask rule is a tightening that never happened. Merge rules into broader patterns or trim the list",
+                    }).message;
                 case "allow_layer":
                     return describeAllowLayerOverCap(f.field, f.count);
             }
@@ -138,7 +140,7 @@ export function settingsPermissionBucketIssue(perms) {
                 case "allow_layer": {
                     const over = allowLayerEntryCountIssue(field, v);
                     if (over !== undefined)
-                        fields = { field, reason: "over_cap", count: over.count, cap: over.cap };
+                        fields = { field, reason: "over_cap", count: over.facts.count, cap: over.facts.cap };
                     else if (!ruleEntryListShapeOk(v))
                         fields = { field, reason: "bad_entry", index: v.findIndex((x) => typeof x !== "string") };
                     break;
@@ -193,18 +195,26 @@ export function taskSettingsKeyIssue(raw) {
 export function taskHooksHonored(config) {
     return config.requirePrincipal !== true;
 }
-export function parseTaskSettings(raw) {
+export function parseTaskSettings(raw, seats = {}) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
     const s = raw;
     const deferred = [];
     let hooksConfig;
+    let hooksReread;
     if (s.hooks !== undefined && s.hooks !== null) {
         const parsedHooks = parseHooksConfig(s.hooks);
         if (parsedHooks.config)
             hooksConfig = parsedHooks.config;
-        else
-            deferred.push("hooks");
+        else {
+            const reread = seats.storedHooksReread?.(s.hooks);
+            if (reread !== undefined) {
+                hooksConfig = reread.config;
+                hooksReread = { stripped: reread.stripped };
+            }
+            else
+                deferred.push("hooks");
+        }
     }
     const shellEnv = cleanEnvMap(s.env);
     if (s.env !== undefined && s.env !== null && shellEnv === undefined)
@@ -252,36 +262,9 @@ export function parseTaskSettings(raw) {
     const maxDesc = s.skillListingMaxDescChars;
     if (skillListingMaxDescOk(maxDesc))
         out.skillListingMaxDescChars = maxDesc;
-    return { settings: Object.keys(out).length > 0 ? out : undefined, deferred };
-}
-export function hasConstitutionAnchors(text) {
-    return typeof text === "string" && text.includes(CYBER_RISK) && text.includes(URL_SAFETY) && text.includes(HARNESS_SECTION_ANCHOR);
-}
-export function providerDropsAppend(provider, userSystemPrompt) {
-    if (!provider)
-        return false;
-    if (provider.replaceAll === true)
-        return true;
-    const ctx = { userSystemPrompt, tools: [], memoryEnabled: false, consolidationEnabled: false };
-    if (provider.stableBlocks) {
-        try {
-            return provider.stableBlocks(ctx).some((d) => d.slot === "identity" && hasConstitutionAnchors(d.text));
-        }
-        catch {
-            return false;
-        }
-    }
-    if (provider.stableSystem) {
-        try {
-            return hasConstitutionAnchors(provider.stableSystem(ctx));
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
+    return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
-export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
+export function acceptAppendSystemPrompt(v, warn) {
     if (v === undefined)
         return undefined;
     if (typeof v !== "string" || v.length === 0) {
@@ -292,10 +275,6 @@ export function acceptAppendSystemPrompt(v, warn, packDropsAppend) {
         warn?.(`appendSystemPrompt dropped: ${v.length} chars exceeds the ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} cap (pre-cap stored body on a resume leg?)`);
         return undefined;
     }
-    if (packDropsAppend === true) {
-        warn?.("appendSystemPrompt dropped: the effective prompt pack cannot mount the append rider (assembled-identity/stableSystem pass-through, replaceAll, or legacy provider — no core/role.append section)");
-        return undefined;
-    }
     return v;
 }
 const RULE_SOURCE_BY_BEHAVIOR = { ask: "settings.permissions.ask", deny: "settings.permissions.deny" };
@@ -321,33 +300,39 @@ function createWorkflowAskPolicy(isExempt) {
     };
 }
 function rejectUnmatchableSettingsNames(perms, pathBases) {
-    if (pathBases?.home === undefined) {
-        for (const [field, names, behavior] of [
-            ["permissions.ask", perms.ask, "ask"],
-            ["permissions.deny", perms.deny, "deny"],
-        ]) {
-            for (const name of names ?? []) {
-                const parsed = parseRuleText(name, behavior);
+    const refused = rulePolicyBucketsRefusal(perms, { ...(pathBases !== undefined ? { declared: pathBases } : {}), ...(pathBases?.home !== undefined ? { home: pathBases.home } : {}) });
+    if (refused !== undefined)
+        throw new Error(refused.message);
+}
+export const RULE_POLICY_BUCKETS = ["ask", "deny"];
+export function rulePolicyBucketsRefusal(permissions, bases) {
+    for (const bucket of RULE_POLICY_BUCKETS) {
+        const names = permissions[bucket];
+        if (!names)
+            continue;
+        const unmatchable = unmatchableToolNamesRefusal(`permissions.${bucket}`, names, { consumer: "rule-policy", behavior: bucket, ...(bases.declared !== undefined ? { pathBases: bases.declared } : {}) });
+        if (unmatchable !== undefined)
+            return { bucket, message: unmatchable.message };
+    }
+    if (bases.home === undefined) {
+        for (const bucket of RULE_POLICY_BUCKETS) {
+            const field = `permissions.${bucket}`;
+            for (const name of permissions[bucket] ?? []) {
+                const parsed = parseRuleText(name, bucket);
                 if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
-                    throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
-                        `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
-                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`);
+                    return {
+                        bucket,
+                        message: `${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
+                            `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
+                            `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`,
+                    };
                 }
             }
         }
     }
-    const judgments = [
-        ["permissions.ask", perms.ask, { consumer: "rule-policy", behavior: "ask", ...(pathBases !== undefined ? { pathBases } : {}) }],
-        ["permissions.deny", perms.deny, { consumer: "rule-policy", behavior: "deny", ...(pathBases !== undefined ? { pathBases } : {}) }],
-    ];
-    for (const [field, names, judgment] of judgments) {
-        if (!names)
-            continue;
-        const unmatchable = unmatchableToolNamesRefusal(field, names, judgment);
-        if (unmatchable !== undefined)
-            throw new Error(unmatchable.message);
-    }
+    return undefined;
 }
+export const REQUEST_SETTINGS_REFUSAL_PREFIX = "request settings cannot be applied as written: ";
 export function deriveSettingsPolicy(settings, gate, workflowGate) {
     const perms = settings.permissions;
     if (!perms)

package/dist/text-bidi.d.ts

@@ -1,50 +1,7 @@
-/**
- * `text-bidi.ts` —— 双向控制符(bidi)与 C0 控制符字符类的**单一属主**。
- *
- * ## 为什么有这个文件
- * 同一条字符类此前在本仓有两份逐字手抄(`session-titler.ts` 的 `sanitizeTitle`、
- * `plugins/send-user-file.ts` 的 `sanitizeSendFileName`),第三份还要给审批卡的 bidi **在场检测**用。
- * 这是一条安全语义上的词表(它划定「人眼看到的顺序可能不是字节顺序」那一族码点),三份手抄必然漂移 ——
- * 单一属主的纪律与 `APPROVAL_GATE_KINDS` 同源(CLAUDE.md 硬条款:词表是闭集,不许散落副本)。
- *
- * ## 两条类刻意分开(**别合并**)
- *  · {@link BIDI_CONTROL_CHARS} —— **只有** bidi 一族(LRM/RLM、嵌入与覆写、隔离符)。它是**检测**用的:
- *    问的是「这串文本里有没有能让人眼读到与执行顺序不同的东西」。C0 控制符不属于这一问 —— 一条 Bash
- *    命令里出现换行、一段 diff 里出现制表符都是**正常**的,把它们算进来会让检测位恒为真、从而毫无判别力。
- *  · {@link CONTROL_AND_BIDI_CHARS} —— bidi ∪ C0/DEL,**清洗**用的(标题、文件名这类要落一行的短串)。
- *    清洗面比检测面宽是对的:那两处要的是「只留可打印的一行」。
- *
- * ## 案锚
- * Trojan Source([ref]②;`docs/DISEASE-SHAPES.md` 的不可见字符条):字面控制符让**人审与机器门看到
- * 两份不同的文本**。审批卡是本仓唯一一处「把模型写的命令交给人眼判断」的面,所以它需要的是**披露**
- * (告诉壳「这串里有 bidi」),不是清洗 —— 清洗会改掉即将被执行的那串字节,让卡上显示的与真正跑的不是
- * 同一个东西,那比不披露更坏。
- */
-/**
- * bidi 一族的字符类**内容**(不含方括号,便于拼进更大的类)。
- *
- * 逐字 = Unicode 的 `Bidi_Control=Yes` **全集**(12 个码点),不是「常见的那几个」:
- *  · U+061C = ALM(Arabic Letter Mark);U+200E/200F = LRM/RLM;
- *  · U+202A-202E = 嵌入/覆写族(含 RLO);U+2066-2069 = 隔离符族。
- *
- * 🔴 **U+061C 是 codex 交叉复审 [medium] 验真后补的**:首版漏了它 —— 而漏一个码点在**检测**面上不是
- * 「覆盖率差一点」,是一条完整的跳过路(只用 ALM 构造的输入让在场位缺席,壳于是照常按干净渲染)。
- * 交叉锚:core 自己的 `APPROVER_REFUSED_CHARS_RE`(`dist/core/tool-policy.js`)同样含 `\\u061c`。
- *
- * ⚠️ 与 core 那只**更宽**的集合的差额如实登记(刻意,不是漏):core 还含 C1(`\\u0080-\\u009f`)与
- * U+2028/U+2029(行/段分隔符)。那两族**不是 bidi**(不影响阅读方向),属于「不可打印 / 换行伪装」的
- * 另一问;本类是 bidi 专用,混进来会让 {@link hasBidiControls} 的语义从「方向可能骗你」滑成「有奇怪
- * 字符」。清洗面要不要跟着加宽是另一件(见 {@link CONTROL_AND_BIDI_CHARS} 的注)。
- */
-export declare const BIDI_CONTROL_CHARS = "\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
-/** bidi ∪ C0/DEL —— **清洗**面用(见文件头注:清洗面比检测面宽是刻意的)。
- *  ⚠️ 仍**不含** C1(`€-Ÿ`)与 U+2028/U+2029:加宽是行为变更、要各自的判据支撑,不搭本批的车
- *  (登记在此,别当成漏)。两处存量消费方(标题、文件名)较其手抄前身**多剥一枚 U+061C**
- *  (经 {@link BIDI_CONTROL_CHARS} 内插带入)—— 对本清洗类是有意收紧,merge-rescan 745 验真后
- *  钉在两消费方各自的测试里;除此之外与手抄前身逐字同集。 */
-export declare const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
+/** bidi ∪ C0/DEL —— **清洗**面用(见文件头注:清洗面比检测面宽是刻意的)。bidi 半场内插 core 的类,C0/DEL 半场是本仓清洗面自己的。 */
+export declare const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061C\\u200E\\u200F\\u202A-\\u202E\\u2066-\\u2069";
 /** 清洗用的全局正则(`String.replace` 会在返回前把 `lastIndex` 归零,故模块级常量可安全复用)。 */
 export declare const CONTROL_AND_BIDI_STRIP_RE: RegExp;
-/** 这串文本里**有没有** bidi 控制符。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
+/** 这串文本里**有没有** bidi 控制符(判官 = core 的 {@link carriesBidiControls})。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
 export declare function hasBidiControls(text: string): boolean;
 //# sourceMappingURL=text-bidi.d.ts.map

package/dist/text-bidi.js

@@ -1,8 +1,8 @@
-export const BIDI_CONTROL_CHARS = "\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
+import { BIDI_CONTROL_CHARS, carriesBidiControls } from "@sema-agent/core";
 export const CONTROL_AND_BIDI_CHARS = `\\u0000-\\u001f\\u007f${BIDI_CONTROL_CHARS}`;
 export const CONTROL_AND_BIDI_STRIP_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`, "g");
-const BIDI_DETECT_RE = new RegExp(`[${BIDI_CONTROL_CHARS}]`);
+const WHOLE_TEXT_SCAN = { maxNodes: 1, maxChars: Number.MAX_SAFE_INTEGER };
 export function hasBidiControls(text) {
-    return BIDI_DETECT_RE.test(text);
+    return carriesBidiControls(text, WHOLE_TEXT_SCAN);
 }
 //# sourceMappingURL=text-bidi.js.map

package/dist/tool-approval.d.ts

@@ -509,7 +509,7 @@ export interface ToolApprovalFrame {
     readRootCandidate?: ReadRootGrantCandidate;
     /**
      * **E-14**([ref]② Trojan Source 族;**ADDITIVE**,`"tool_approval"` only)—— 这只 ask 的**工具输入**
-     * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类属主 `text-bidi.ts`)。
+     * (`AskRequest.args`)里含 bidi 控制符(LRM/RLM、嵌入/覆写、隔离符;字符类与在场谓词的属主是 core 的 `BIDI_CONTROL_CHARS` / `carriesBidiControls`,经 `text-bidi.ts` 的 `hasBidiControls` 取)。
      *
      * 🔴 **真才带,缺席绝不编 `false`**(与 `governanceForced`/`requiresRealApproval` 同形)。缺席的含义是
      * 「没扫到」——它同时覆盖「真的没有」与「args 序列化不了(循环引用)所以扫不了」两形,消费端**禁**把

package/dist/trace/core-keyset-guard.d.ts

@@ -50,7 +50,7 @@ type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded,
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "cause" | "inputHasBidi" | "rememberRefused";
 type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
 type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure" | "task_started" | "compaction_started";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory";
 type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -67,6 +67,16 @@ type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[
 type WiringLegHandled = "kind";
 type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
 type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
+type WiringModRowKeys = WiringSection<"mods">[number] extends infer R ? (R extends unknown ? keyof R : never) : never;
+type WiringModRowHandled = "name" | "seat" | "tier" | "events" | "observe" | "skipped" | "refusedBy" | "reason";
+type _GuardWiringModRow = AssertAllKeysHandled<Exclude<WiringModRowKeys, WiringModRowHandled>>;
+type _GuardWiringModRowReverse = AssertAllKeysHandled<Exclude<WiringModRowHandled, WiringModRowKeys>>;
+type WiringModSkipKeys = keyof NonNullable<Extract<WiringSection<"mods">[number], {
+    events: unknown;
+}>["skipped"]>[number];
+type WiringModSkipHandled = "registration" | "cause" | "reason";
+type _GuardWiringModSkip = AssertAllKeysHandled<Exclude<WiringModSkipKeys, WiringModSkipHandled>>;
+type _GuardWiringModSkipReverse = AssertAllKeysHandled<Exclude<WiringModSkipHandled, WiringModSkipKeys>>;
 type WiringAskHandled = "form" | "provenance" | "effective";
 type _GuardWiringAsk = AssertAllKeysHandled<Exclude<keyof WiringSection<"ask">, WiringAskHandled>>;
 type _GuardWiringAskReverse = AssertAllKeysHandled<Exclude<WiringAskHandled, keyof WiringSection<"ask">>>;
@@ -136,6 +146,11 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
+type PromptAssembledFrame = Extract<TraceEvent, {
+    kind: "prompt.assembled";
+}>;
+type PromptManifestNotOnRow = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["prompt_manifest"]["excluded"][number];
+type _GuardPromptManifestNotOnRowReverse = AssertAllKeysHandled<Exclude<PromptManifestNotOnRow, keyof PromptAssembledFrame>>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
@@ -148,9 +163,9 @@ type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCal
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "userAttachments";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "writeProtectedAdditions" | "complianceAdditionalDenies" | "modelRole" | "enableBlockedReport" | "promptForm";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -294,6 +309,10 @@ export type CoreKeysetGuards = [
     _GuardWiringFleetReverse,
     _GuardSubagentTranscriptTierWords,
     _GuardSubagentTranscriptTierWordsReverse,
+    _GuardWiringModRow,
+    _GuardWiringModRowReverse,
+    _GuardWiringModSkip,
+    _GuardWiringModSkipReverse,
     _GuardWiringMcp,
     _GuardWiringMcpReverse,
     _GuardWiringRules,
@@ -306,6 +325,7 @@ export type CoreKeysetGuards = [
     _GuardWiringGovernanceReverse,
     _GuardPermissionTrace,
     _GuardPermissionTraceReverse,
+    _GuardPromptManifestNotOnRowReverse,
     _GuardPermissionTraceNonEmpty,
     _GuardInboxSummary,
     _GuardInboxSummaryReverse,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -47,6 +47,13 @@ export interface EngineNoticeWireRow {
     /** **服务端观察时刻**(ms epoch)——`EngineNotice` 自身不带时间戳,这是本仓收到它的那一拍,不是 core 铸它的那一拍。 */
     ts: number;
 }
+/**
+ * 上 wire 的**注册方写的自由文本**的唯一出口纪律:`redactSecrets` + 截到 {@link NOTICE_TEXT_MAX}。
+ * 同一个事实(一张扩展注册被判拒、一个判官被跳过)有两个出口 —— 通告 `mods.registration_refused` 的 `detail`(经 {@link sanitizeNoticeDetail})与
+ * `wiring_manifest.mods[]` 的行(`trace/project.ts`)—— 两个出口的每一个串都过这一只,所以同一个串在两边逐字节相等;
+ * 规则只在这里写一次,`mods[]` 行不另造第二份脱敏 / 截长。
+ */
+export declare function sanitizeWireText(text: string): string;
 /**
  * `detail` 消毒(设计稿 ②:`redactSecrets` + 尺寸 bound;`workspaceChangedEventData` 先例)。
  *
@@ -54,7 +61,7 @@ export interface EngineNoticeWireRow {
  * ——§E1 的既有姿态:上 wire 的自由文本一律经本仓的脱敏器,不因为上游说过一次就免检。
  *
  * 契约(逐条,门在 `test/engine-notice-wire.test.ts`):
- *  · 串 ⇒ `redactSecrets` + 截到 {@link NOTICE_TEXT_MAX};
+ *  · 串 ⇒ {@link sanitizeWireText}(`redactSecrets` + 截到 {@link NOTICE_TEXT_MAX});
  *  · 有限 number / boolean / null ⇒ 逐字(harvest 的 count/moved/escalated 是判据数字,不许变形);
  *  · 非有限 number(NaN/Infinity)⇒ **丢键**(JSON 里它们会变成 `null`,一个看起来合法的假读数);
  *  · 数组 ⇒ 逐项消毒,超 {@link DETAIL_MAX_ITEMS} 截断;对象 ⇒ 逐键消毒,超 {@link DETAIL_MAX_KEYS} 丢尾键;
@@ -91,7 +98,8 @@ export declare function redactNoticeMessage(message: unknown): string;
  * 通告 `detail` 里的**规则文本**换成条目的脱敏原值({@link redactListEntry}:凭据换记号,不加引号、不转义 —— 机读位不是显示面,显示形只属于人读句)。
  * 会话流行(经 {@link engineNoticeEventData},之后照常过 {@link sanitizeNoticeDetail})与运维日志行(`boot/runner-deps.ts` 的转发席,其余字段逐字)
  * 同调这一只 ⇒ 两条出路上同一条规则文本逐字节同(会话流行另有 detail 串的 {@link NOTICE_TEXT_MAX} 字上限,超长的那一截只在日志行上),两只码里同一条
- * 规则文本也同(引擎交来的两形本身一致时 —— `rule_row_dropped` 交的是引擎中和过的形,空白 / 超长的条目两只码今天不同,上游缝)。其余字段、其余码原样。
+ * 规则文本也同 —— core 7.53.0(#1884)起引擎交来的两形就是同一只读法的产物(原串,长于 1 024 码点的截到 1 024 + 一枚截断记号;修前 `rule_row_dropped`
+ * 交中和形,空白 / 超长的条目两只码不同)。其余字段、其余码原样。
  */
 export declare function redactNoticeRuleText(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
 export declare function engineNoticeEventData(notice: {

package/dist/trace/engine-notice-wire.js

@@ -40,6 +40,9 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "task.tool_turn_incomplete",
     "route.finish_reason_unknown",
     "route.stream_end_ignored",
+    "route.credential_origin_mismatch",
+    "mods.registration_refused",
+    "config.session_rules_earlier_grammar",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -53,6 +56,9 @@ export function engineNoticeSessionId(notice) {
     return typeof fromDetail === "string" && fromDetail.length > 0 ? fromDetail : undefined;
 }
 const NOTICE_TEXT_MAX = 1000;
+export function sanitizeWireText(text) {
+    return redactSecrets(text).slice(0, NOTICE_TEXT_MAX);
+}
 const DETAIL_MAX_DEPTH = 4;
 const DETAIL_MAX_KEYS = 32;
 const DETAIL_MAX_ITEMS = 32;
@@ -64,7 +70,7 @@ function sanitizeValue(v, depth) {
     if (v === null)
         return null;
     if (typeof v === "string")
-        return redactSecrets(v).slice(0, NOTICE_TEXT_MAX);
+        return sanitizeWireText(v);
     if (typeof v === "number")
         return Number.isFinite(v) ? v : undefined;
     if (typeof v === "boolean")
@@ -99,6 +105,7 @@ function sanitizeValue(v, depth) {
 export const RULE_TEXT_DETAIL_FIELDS = {
     "permission.allowed_tool_not_granted": { array: "entries", field: "entry" },
     "permission.rule_row_dropped": { array: "rows", field: "rule" },
+    "config.session_rules_earlier_grammar": { array: "entries", field: "entry" },
 };
 export function redactNoticeMessage(message) {
     return redactSecrets(String(message));

package/dist/trace/ledger-events.d.ts

@@ -31,7 +31,9 @@
  *    的 `switch (ev.type)` 白名单臂(差集门 `test/durable-append-arm-parity.test.ts` 看守两腿一致);
  *  · **腿自己的带外行**:park/终局/失败/建议/用量/装配自证(不来自流事件)。
  */
-export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" | "status" | "context_usage" | "compacted" | "diagnostics" | "steering_injected" | "compaction_outcome" | "workspace_changed" | "wiring_manifest"
+export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" | "status" | "context_usage" | "compacted" | "diagnostics" | "steering_injected" | "compaction_outcome"
+/** S-1732(core 7.53.0 #2008):压缩 pass 的开始帧(`{ trigger, pass, startedAt }`;结束帧带同一个 `pass`)。原样落账,两条 durable 腿同源。 */
+ | "compaction_started" | "workspace_changed" | "wiring_manifest"
 /** S-212(7.71.0):运行期名册变更(core 7.8.0 [ref] ⑪)。**快照语义**——`delta.roster` 是整只
  *  变更后名册,消费端收到即整只替换,所以回放不需要任何合并;它的耐久面因此不是 `wiring_manifest.tools`
  *  的重复,而是那份开腿快照**之后**的每一次改动(修前两条 durable 腿零 case ⇒ 回放只见开头一版)。 */

package/dist/trace/ledger-sink.d.ts

@@ -104,6 +104,35 @@ export declare function createSerialLedgerAppend(appendEvent: (seq: number, type
  * 返回 `.catch` 用的处理器(产物是函数 ⇒ `create*`)。
  */
 export declare function createForwardAppendFailedNote(type: string): (err: unknown) => void;
+/**
+ * 人在环帧(`question` / `question_complete`、`elicitation` / `elicitation_complete`)的**账本孪生投递口**。
+ *
+ * 一条律:**凡进 run 流的 HITL 帧都有账本孪生;腿只决定「还要不要同时直写 socket」**。后台腿没有 live 面,
+ * 它的投递口就是账本追加本身(`runs.ts`);同步流腿有 live SSE,走本函数 —— 同一只帧对象先落账、再按需直写,
+ * 于是两条腿对同一只帧的落法只差「直写要不要」,不差「账本有没有」。
+ *
+ * 顺序与失败语义(与后台腿同一条):
+ *  · **先账本后直写**。账本落不下 ⇒ 本次投递**失败**(抛),帧不上 socket —— 一只没有孪生的帧不许单独露面
+ *    (否则壳看见一张重载就丢的卡)。调用方(协调器)按「开帧投递失败」处理:这一问结算 `unavailable`、记一次既有的
+ *    P-DEBT 留痕;消卡帧则落「面包屑丢失」的 F 类留痕。
+ *  · **seq 不自造**:孪生走 `sink.append` —— 本腿账本唯一的那条串行链(与 text / tool / done 行同一个计数器)。
+ *  · **直写口已不可达**(客户端离开,而 run 因 detach 继续)⇒ 账本孪生即送达,不再触碰那条已死的连接
+ *    (不抛、也不记「丢帧」—— 帧没丢,在账本里)。
+ *  · **本腿没有账本**(无 durable run 行的部署:`sink` 缺席)⇒ 直写就是全部投递,死流姿态由 `writeLive` 自己带
+ *    (question 抛、elicitation 静默记账),字节逐字同孪生落地之前。
+ *
+ * 命名(CLAUDE.md 工厂命名律):`create*` —— 返回的是捕获了两个口的闭包,不是纯数据。
+ */
+export declare function createLedgerTwinEmit<F extends {
+    type: LedgerEventType;
+}>(opts: {
+    /** 本腿的账本(sync 腿 = 有 durable run 行才有;缺席 ⇒ 无孪生可落)。只用 `append`:seq 由它那条链铸。 */
+    sink: Pick<LedgerSink, "append"> | undefined;
+    /** 本腿的直写口(sync 腿 = 一个具名 SSE 事件)。 */
+    writeLive: (frame: F) => void;
+    /** 直写面此刻可达吗 —— 与协调器问「这条腿还够得着人吗」的是**同一只**谓词(`QuestionRunContext.deliverable`)。 */
+    liveReachable: () => boolean;
+}): (frame: F) => Promise<void>;
 export declare function createLedgerSink(opts: {
     /** The seq-stamped durable append — typically `(seq, type, data) => runStore.appendEvent(taskId, seq, type, data)`. */
     appendEvent: (seq: number, type: LedgerEventType, data: unknown) => Promise<void>;