@sema-agent/server 7.133.0 → 7.135.0

package/dist/http/routes/approvals-assistant.d.ts

@@ -52,13 +52,13 @@ export declare function deriveDecisionDoorKeyTable(family: DecisionDoorFamily, r
  * 被两句话抢答)。
  *
  * 🔴 **重放不额外过门**,也不需要:`/decide` 的幂等回放(`decideIdempotentReplay`)重放的是**同一次请求的同一份
- * 体**、走同一条路由同一道门;plan_review 的反重放是一次性 nonce(S-280),守的也是同一份现写的字节;而续跑重建
+ * 体**、走同一条路由同一道门;plan_review 的反重放是一次性 nonce([ref]),守的也是同一份现写的字节;而续跑重建
  * 读的是盘上的体、走 `resolveSpec` 的宽容层 ⇒ 4xx 砖不到任何存量挂起的任务。**门只站在人(或客户端)现写的
  * 那份字节上**(与 tasks 面「RESUME 重放不过门」同一条律)。
  */
 export declare function decisionBodyKeyIssue(door: DecisionDoorId, raw: unknown, table?: DecisionDoorKeyTable): KeyClosureIssue | null;
 /**
- * S-342 —— 「空串的理由 = 没有理由 = 这是一次**裸拒**」。这条语义只适用于**本仓自铸**的那一个域。
+ * [ref] —— 「空串的理由 = 没有理由 = 这是一次**裸拒**」。这条语义只适用于**本仓自铸**的那一个域。
  *
  * ## 三个域,三个属主(这才是归一:每个域的读法只写一次,而不是三处各挑一种写法)
  * `body.reason` 在这条路由上会被读三次,而它们的属主**不是同一个**:
@@ -99,7 +99,7 @@ export type QuestionAnswerCheck = {
  * Structural check for an operator-supplied QuestionAnswer (durable ask resume, TC-5.4). Strict on the
  * load-bearing shape — `answers[]` non-empty, each `{header: string, selected: string[], note?: string}` —
  * so a typo'd payload fails the request instead of resuming the task with an answer the tool can't use.
- * S-452 起**同时闭键**:词表外的键(拼错 / 未来键 / `__proto__`)拒不丢。
+ * [ref] 起**同时闭键**:词表外的键(拼错 / 未来键 / `__proto__`)拒不丢。
  */
 export declare function checkQuestionAnswer(v: unknown): QuestionAnswerCheck;
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
@@ -128,7 +128,7 @@ export declare function handleApprovalsAssistant(req: IncomingMessage, res: Serv
 export type PendingProjectionDeployment = GovernancePosture & Pick<GateIntentView, "approvalRequire" | "approvalDeny" | "approvalNeverAuto">;
 export declare function streamApprovals(req: IncomingMessage, res: ServerResponse, cs: Pick<CheckpointStoreFull, "listPending">, 
 /**
- * 🔴 S-454:**第二条 diff 源** —— `GET /v1/approvals` 的 `livePending` 那**同一只**读函数
+ * 🔴 [ref]:**第二条 diff 源** —— `GET /v1/approvals` 的 `livePending` 那**同一只**读函数
  * (`Pick` 而不是另立接口:同源是结构事实,不是两处各写一份的约定)。
  *
  * 为什么必须同源:消费方(client-core `hitl/approvalsFeed`)对 stream 上任一非 heartbeat 事件的
@@ -136,7 +136,7 @@ export declare function streamApprovals(req: IncomingMessage, res: ServerRespons
  * 一条只在拉面存在的行则永远等不到催人事件。
  *
  * `undefined` = 本部署无 live 审批面(`TOOL_APPROVAL_ENABLED=false` ⇒ 协调器未装配)⇒ 本源整个
- * 缺席,流的字节与 S-454 之前逐字相同(能力缺席 = 零变化,不是空数组)。**位置在 `pollMs` 之前**
+ * 缺席,流的字节与 [ref] 之前逐字相同(能力缺席 = 零变化,不是空数组)。**位置在 `pollMs` 之前**
  * 与 `governance` 同一条理由:`pollMs` 只有测试传,而本参数是每个生产调用点都必须表态的那一个。
  */
 live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined, scope: string | undefined, 

package/dist/http/routes/approvals-assistant.js

@@ -2,7 +2,8 @@ import { screenedGate } from "../../trace/project.js";
 import { hostDecisionFacts, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS, carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
+import { carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS } from "../../approval-content-kind.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, ownerOfCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -14,7 +15,7 @@ import { redactRiskDescriptor } from "../../observability/run-terminal.js";
 import { buildRunName } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
-import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
+import { sendJson, sendError, sseHeaders, logRequestError, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
 import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
@@ -23,17 +24,17 @@ import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answe
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { readResumeCtx } from "../resume-ctx-read.js";
+import { KEEP_SEALED, readResumeCtx } from "../resume-ctx-read.js";
 import { StoreCorruptError } from "../../plugins/sql-json-column.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "decidedBy", "feedback", "remember", "updatedInput"];
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decidedBy", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
@@ -285,8 +286,16 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
                 : ownScope;
+            let durableRows;
+            try {
+                durableRows = await cs.listPending(scope);
+            }
+            catch (err) {
+                sendApprovalsReadFailure(req, res, deps.logger, err);
+                return;
+            }
             sendJson(res, 200, {
-                pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
+                pending: durableRows.map((r) => projectPendingForWire(r, deps.config)),
                 serverNowMs: Date.now(),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
@@ -340,12 +349,21 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         if (match.decl.id === "assistant-inbox") {
             const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
             const scope = operator && ownerParam ? ownerParam : ownScope;
-            const summaries = await cs.listByScope(scope);
+            let summaries;
+            try {
+                summaries = await cs.listByScope(scope);
+            }
+            catch (err) {
+                sendApprovalsReadFailure(req, res, deps.logger, err);
+                return;
+            }
             const inbox = (await Promise.all(summaries.map(async (s) => {
-                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId));
+                const ctxRead = await readResumeCtx(cs.getCtx(s.sessionId), KEEP_SEALED);
                 if (ctxRead.kind === "corrupt")
                     recordFailOpen("server.assistant-inbox.objective-ctx-corrupt", ctxRead.where);
-                const objective = ctxRead.kind === "ok" ? (ctxRead.ctx.body?.objective ?? null) : null;
+                const storedBody = ctxRead.kind === "ok" ? ctxRead.ctx.body : undefined;
+                const storedObjective = typeof storedBody === "object" && storedBody !== null ? storedBody.objective : undefined;
+                const objective = typeof storedObjective === "string" ? storedObjective : null;
                 const input = s.toolInput != null ? redactedPreview(s.toolInput) : null;
                 return {
                     sessionId: s.sessionId,
@@ -383,7 +401,14 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             const runStore = ledger.runStore;
-            const summaries = await cs.listByScope(scope);
+            let summaries;
+            try {
+                summaries = await cs.listByScope(scope);
+            }
+            catch (err) {
+                sendApprovalsReadFailure(req, res, deps.logger, err);
+                return;
+            }
             const byGate = new Map(summaries.map((s) => [s.sessionId, s]));
             const runs = await runStore.listRuns({ owner: ownerOfCheckpointScope(scope), limit: 100 });
             const tasks = runs
@@ -655,7 +680,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy? }", retiredDecisionKeyFacts(body)?.extra);
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, decidedBy?, feedback? }", retiredDecisionKeyFacts(body)?.extra);
                 return;
             }
             {
@@ -719,6 +744,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     return;
                 }
             }
+            if (body.feedback !== undefined && typeof body.feedback !== "string") {
+                sendError(res, 400, "request.field_invalid", "feedback must be a string (the words the approving person wrote on the card; omit the key when there are none)");
+                return;
+            }
             if (deps.config.directDoorActive && body.updatedInput !== undefined) {
                 sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
@@ -727,6 +756,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
+            if (deps.config.directDoorActive && body.feedback !== undefined) {
+                sendError(res, 400, "feedback_not_in_proof", "feedback is not supported on a direct-door worker (not covered by the decision proof)");
+                return;
+            }
             const decidedByReading = readDecidedBy(body.decidedBy, deps.config.directDoorActive);
             switch (decidedByReading.kind) {
                 case "not_in_proof":
@@ -743,11 +776,20 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
             }
             const decidedBy = decidedByReading.decidedBy;
+            if (body.feedback !== undefined && decision !== "approve") {
+                sendError(res, 400, "request.field_conflict", "feedback is only valid with decision 'approve' — the words of a denial are its reason", fieldConflictFacts("approval_feedback", ["feedback", "decision"]));
+                return;
+            }
+            if (body.feedback !== undefined && decidedBy !== "person") {
+                sendError(res, 400, "request.field_conflict", "feedback is only valid on a person's decision — the agent reads it as the user's own words, which a policy decision cannot carry", fieldConflictFacts("approval_feedback", ["feedback", "decidedBy"]));
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
                 boundInputHash: body.boundInputHash,
                 updatedInput: body.updatedInput,
+                ...(typeof body.feedback === "string" ? { feedback: body.feedback } : {}),
             };
             let deciderPrincipal = principal;
             if (deps.config.directDoorActive) {
@@ -811,6 +853,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...(decision === "approve" && binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
                     ...(answer !== undefined ? { answer } : {}),
                     ...((r) => (r !== undefined ? { reason: r } : {}))(decisionReasonOf(body)),
+                    ...(binding.feedback !== undefined ? { feedback: binding.feedback } : {}),
                 },
                 deciderPrincipal,
                 explicitOperator,
@@ -827,6 +870,25 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
     return assertNever(match.decl.id);
 }
 const APPROVALS_STREAM_POLL_MS = 3000;
+function approvalsReadFailureOf(err) {
+    return err instanceof StoreCorruptError ? "approvals.read_corrupt" : "approvals.read_unavailable";
+}
+function sendApprovalsReadFailure(req, res, logger, err) {
+    logRequestError(logger, req, err);
+    const failure = approvalsReadFailureOf(err);
+    switch (failure) {
+        case "approvals.read_corrupt":
+            sendError(res, 500, "approvals.read_corrupt", "a stored approval row cannot be read - retrying this request will fail the same way until an operator repairs or removes the row");
+            return;
+        case "approvals.read_unavailable":
+            sendError(res, 503, "approvals.read_unavailable", "the approvals queue could not be read right now - retry this request; until a read succeeds, this answer does not mean nothing is pending");
+            return;
+        default: {
+            const unhandled = failure;
+            throw new Error(`approvals read failure word without an answer: ${String(unhandled)}`);
+        }
+    }
+}
 function redactPendingDisclosures(row) {
     const rd = row.riskDescriptor;
     if (rd === null || rd === undefined)
@@ -898,13 +960,25 @@ export async function streamApprovals(req, res, cs, live, scope, governance, pol
             snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
         catch (err) {
-            if (err instanceof StoreCorruptError) {
-                if (!res.writableEnded)
-                    res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_corrupt", message: "a stored approval row cannot be read - this stream is closing, and reconnecting will fail the same way until an operator repairs or removes the row" })}\n\n`);
-                break;
+            const failure = approvalsReadFailureOf(err);
+            let endStream = false;
+            switch (failure) {
+                case "approvals.read_corrupt":
+                    if (!res.writableEnded)
+                        res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_corrupt", message: "a stored approval row cannot be read - this stream is closing, and reconnecting will fail the same way until an operator repairs or removes the row" })}\n\n`);
+                    endStream = true;
+                    break;
+                case "approvals.read_unavailable":
+                    if (!res.writableEnded)
+                        res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_unavailable", message: "the approvals queue could not be read - this stream stays open and retries on its next poll; until a read succeeds, silence here does not mean nothing is pending" })}\n\n`);
+                    break;
+                default: {
+                    const unhandled = failure;
+                    throw new Error(`approvals read failure word without a stream answer: ${String(unhandled)}`);
+                }
             }
-            if (!res.writableEnded)
-                res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "approvals.read_unavailable", message: "the approvals queue could not be read - this stream stays open and retries on its next poll; until a read succeeds, silence here does not mean nothing is pending" })}\n\n`);
+            if (endStream)
+                break;
         }
         if (snapshot !== undefined) {
             durableLane.tick(snapshot.pending);

package/dist/http/routes/background.d.ts

@@ -1,11 +1,11 @@
 /**
- * S-745(core 7.32.0 #1107 的 server 半场;wire 形 [ref] / [ref] / [ref] 定)—— **会话后台任务的两只读口**:
+ * [ref](core 7.32.0 [ref] 的 server 半场;wire 形 [ref] / [ref] / [ref] 定)—— **会话后台任务的两只读口**:
  *
  *   `GET  /v1/sessions/:id/background`        → 200 `{ rows: [{ id, description?, type, status, createdAt, sessionScoped, retained? }] }`
  *   `POST /v1/sessions/:id/background/stop`   body `{ includeRetained: boolean }` → 200 `{ receipts: [{ id, outcome }] }`
  *
- * 消费方:cli L-694 ①(删前核登记)/ L-686(退出三选一:「Exit and stop tasks」= `includeRetained:true`,`sema kill` =
- * `includeRetained:false`,两臂都等受据再退)/ client-core CC-194 B 半(对账谓词)。老 server 404 ⇒ 壳只出 Stay / 退出两臂。
+ * 消费方:cli [ref] ①(删前核登记)/ [ref](退出三选一:「Exit and stop tasks」= `includeRetained:true`,`sema kill` =
+ * `includeRetained:false`,两臂都等受据再退)/ client-core [ref] B 半(对账谓词)。老 server 404 ⇒ 壳只出 Stay / 退出两臂。
  *
  * ── 读口:逐字投 core `list()` 行 ─────────────────────────────────────────────────────────────────
  * 读的是**进程内**注册表(`defaultTaskRegistry.list`),访问元组 = 会话自己的 `{ owner: sid, sessionId: sid, scope }`

package/dist/http/routes/background.js

@@ -60,10 +60,10 @@ export async function handleBackground(req, res, match, ctx) {
     }
     const owned = facts.sessionOwnership(deps);
     if (!owned.available) {
-        sendError(res, 501, "capability.session_ownership_required", "the session background faces require the session-ownership face (sessionStorage.ownerOf)");
+        sendError(res, 501, "capability.session_ownership_required", "the session background faces require the session-ownership face (sessionStorage.headOf)");
         return;
     }
-    const owner = await owned.sessionStorage.ownerOf(sessionId);
+    const owner = (await owned.sessionStorage.headOf(sessionId))?.owner;
     if (owner === undefined) {
         sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
         return;

package/dist/http/routes/capabilities.d.ts

@@ -13,7 +13,7 @@ import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
  *  的语义原样 =「本域已应答」;走到函数尾才是「没匹配上」,置 `miss.fell` 交回装配器继续下一个域。
  *  跨域的东西(deps / 助手 / 单域状态 / 每请求量)一律在首行解构出来,于是下面每一行都逐字不变。 */
 /**
- * S-481 —— 本域独占的运行期状态(每 `createHttpServer` 实例一份)。**模块级不行**:测试里一个进程建几十台
+ * [ref] —— 本域独占的运行期状态(每 `createHttpServer` 实例一份)。**模块级不行**:测试里一个进程建几十台
  * server,一张模块级缓存会把 A 台的探测读数发给 B 台,一只模块级限速窗会让第二台起来就被第一台的计数挡住。
  */
 export interface CapabilitiesLocal {

package/dist/http/routes/capabilities.js

@@ -1,12 +1,12 @@
 import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableCatalog } from "../../model-select.js";
+import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableAliasNames, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
 import { buildModelPlaneFace } from "../../model-plane-face.js";
 import { isRosterGateArmed } from "../../config.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
-import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../../deployment-shape.js";
 import { taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
@@ -32,7 +32,9 @@ import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { headReadOf } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
+import { sessionRulesNamespaceFormsHonored } from "../../session-policy-wire.js";
 function routePairingOf(deps, name, m) {
     if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
         return "unknown";
@@ -131,7 +133,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
                 settings: { permissions: { allowGrant: true, allowLayer: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
@@ -143,6 +145,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 writeProtection: projectWriteProtectionCapability(deps.writeProtection),
                 appendSystemPrompt: true,
                 outputStyle: true,
+                projectMemory: true,
                 compactionModel: true,
                 subagentOutput: facts.subagentOutput(deps).available,
                 subagentStream: facts.subagentOutput(deps).available,
@@ -154,9 +157,10 @@ export async function handleCapabilities(req, res, match, ctx) {
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
+                scenarioSkills: true,
                 userAttachments: USER_ATTACHMENT_SEAT,
-                projectContext: cwdHonored(deps.config),
-                callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                projectContext: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(deps.config),
+                callerCwd: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyKeepsOpenWriteFace(deps.config.autonomy),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: facts.mcpInjection(deps).available,
@@ -186,12 +190,13 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sessionSearch: facts.sessionList(deps).available,
                 sessionFork: facts.sessionFork(deps).available,
                 sessionDelete: facts.sessionDelete(deps).available,
-                resumeAt: Boolean(deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+                resumeAt: Boolean(deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
                 promptSuggestions: true,
                 sessionPolicy: facts.sessionPolicy(deps).available,
+                sessionRulesNamespaceForms: sessionRulesNamespaceFormsHonored(),
                 rewindFiles: Boolean(deps.fileHistoryStore),
                 restoreFiles: Boolean(deps.fileHistoryStore),
-                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
                 fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore, deps.config.fileHistoryCapture),
                 scheduler: facts.hostScheduler(deps.config).available,
                 sessionSync: facts.sessionSync(deps).available,
@@ -258,6 +263,7 @@ export async function handleCapabilities(req, res, match, ctx) {
         case "models": {
             const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
             const atMention = deps.config.atMention;
+            const mentionBit = (name) => (atMention.mode !== "all" ? { atMentionable: isAtMentionable(name, atCatalog, atMention, deps.config.modelRefusals) } : {});
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
                 .map(([name, m]) => ({
@@ -270,7 +276,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atMention.mode !== "all" ? { atMentionable: isAtMentionable(name, atCatalog, atMention, deps.config.modelRefusals) } : {}),
+                ...mentionBit(name),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
@@ -287,6 +293,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                     candidateRejection,
                     modelRefusals: deps.modelRefusalsState?.(),
                 }),
+                aliases: selectableAliasNames(deps.config.models, atCatalog, deps.config.modelRefusals).map((name) => ({ name, ...mentionBit(name) })),
             });
             return;
         }
@@ -301,6 +308,7 @@ function sendMcpProbeRefusal(res, ctx, refusal, outcome, retryAfterSec) {
         res.setHeader("retry-after", String(retryAfterSec));
     sendError(res, status, refusal.errorCode, refusal.message, {
         ...(refusal.unknownKeys !== undefined ? { unknownKeys: refusal.unknownKeys } : {}),
+        ...(refusal.facts ?? {}),
         ...(retryAfterSec !== undefined ? { retryAfterSec } : {}),
     });
 }

package/dist/http/routes/config-catalog.d.ts

@@ -10,7 +10,7 @@
  * 刻意不吃 drain / roster-pending 两道 503(排障读面在停机窗里恰恰要打得通)。
  *
  * 🔴 鉴权 = `explicitOperatorOk`(「谁是 operator」的唯一读法:空名单 = 谁都不是)—— 设计稿 §0.5 点名禁「空名单 = 人人都是」的 fail-open 读法
- * (S-1050 起整只删):本面是部署事实外泄口(env 在场性 / 后端形态 / 限额值)。单用户形只在部署方显式声明 `OPERATOR_SINGLE_USER=true`
+ * ([ref] 起整只删):本面是部署事实外泄口(env 在场性 / 后端形态 / 限额值)。单用户形只在部署方显式声明 `OPERATOR_SINGLE_USER=true`
  * (每个调用方都是运维)时对调用方开。
  *
  * 🔴 旋钮 `CONFIG_CATALOG_ENABLED=false` / operator 名单空 ⇒ 501(事实 `configCatalog`,与能力位同一只函数):

package/dist/http/routes/devices.d.ts

@@ -34,7 +34,7 @@
  * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
  * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的
  * 同向裁定是「缺 tenant/global scope 明确拒注册」。enrollment/管理端点与**首绑写协议**都从
- * 这同一个函数取域(S-470 起它住在 `http/device-placement.ts` —— 提交腿也要用,放在路由域里是层序倒挂),
+ * 这同一个函数取域([ref] 起它住在 `http/device-placement.ts` —— 提交腿也要用,放在路由域里是层序倒挂),
  * 不得手抄第二份派生。
  *
  * ── 反枚举 404 的单一铸造点 ──────────────────────────────────────────────────────────────────────

package/dist/http/routes/diagnostics.d.ts

@@ -16,13 +16,13 @@ import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../too
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 流内审批门的读数形:上场即 `"active"`,否则是那**四**个合取项里**第一个**不满足的原因词
  *  (与 `resolveStreamApprovalGate` 同一闭集,词表**取型**自它 ⇒ 增删 reason 在此处自动跟随/编译红;
- *  S-384 删掉第 5 项「账必须持久」时本行数字漏改过一次,**数字是手抄的那一半**)。 */
+ *  [ref] 删掉第 5 项「账必须持久」时本行数字漏改过一次,**数字是手抄的那一半**)。 */
 export type StreamApprovalGateReading = "active" | Extract<StreamApprovalGate, {
     active: false;
 }>["reason"];
 /** server 自己的装配谓词读数(core 的静态半场之外的那一半:本仓在这台 worker 上做出的判断)。
  *
- *  🔴 S-178:三个 **posture 家族**旋钮改报 `{value, source, note}`(与 S-167 的 `readFace` 同一张四词表、
+ *  🔴 [ref]:三个 **posture 家族**旋钮改报 `{value, source, note}`(与 [ref] 的 `readFace` 同一张四词表、
  *  同一只 note 函数)。裸布尔答不出裁定的补偿项要求的那句话 —— 单机形升级后 `durableApproval` 缺席即
  *  ON、审批窗缺席即 24h,运维必须在一个读面上看得见「这是 posture 派生的」以及「怎么钉回」。
  *  `streamApproval` 那一格是**门读数**(另一根轴:这条腿现在通不通),不是旋钮,故形不变。 */
@@ -43,10 +43,10 @@ export interface ServerWiringGateInput {
     streamApprovalEnabled: boolean;
     /** 谓词自己的入参类型(结构形,不 import store 依赖树)—— 取型而非重述,两处不可能漂。 */
     backend: StreamApprovalGateInput["backend"];
-    /** 在场性即事实;本面不取实例,故 `unknown` 足够(取窄型会把整棵 store 类型树拖进诊断域)。 */
-    checkpointStore: unknown;
+    /** 谓词自己的入参类型(只收店的形,工厂方法过不了 tsc)—— 取型而非重述,与 `backend` 同理;在场性即事实,本面不读实例的内容。 */
+    checkpointStore: StreamApprovalGateInput["checkpointStore"];
     durableApproval: boolean;
-    /** S-178:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
+    /** [ref]:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
     durableApprovalSource: PostureSource;
     streamAskWindowMs: number;
     streamAskWindowMsSource: PostureSource;
@@ -68,7 +68,7 @@ export interface StaticWiringAudit {
 export interface StaticWiringFacts {
     /** core `describeStaticWiring(deps, specTemplate)` 的产物。 */
     manifest: WiringManifest;
-    /** 我方喂给 `resolveStreamApprovalGate` 的 `parkFacility` 实参(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
+    /** 我方喂给 `resolveStreamApprovalGate` 的 `checkpointStore` 实参的在场性(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
     parkFacility: boolean;
     /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
     backendKind: "mysql" | "pg" | "local" | undefined;

package/dist/http/routes/diagnostics.js

@@ -12,7 +12,7 @@ export function buildServerWiringGates(input) {
         toolApprovalEnabled: input.toolApprovalEnabled,
         streamApprovalEnabled: input.streamApprovalEnabled,
         backend: input.backend,
-        parkFacility: input.checkpointStore !== undefined,
+        checkpointStore: input.checkpointStore,
     });
     const noCenterArm = (knob) => `this knob has no web-admin arm on this deployment — it is set by ${knob} on this machine, or derived from the deployment posture`;
     const noLaneArm = (knob) => `this knob has no execution-lane default — ${knob} does not depend on which execution lane this deployment runs`;

package/dist/http/routes/fleet.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— MF-Fleet 实时舰队流。
  *
  * 路由:`GET /v1/fleet/stream`(SSE PUSH:连上先快照,之后每条 per-row delta)。跑在服务凭据门**之前**的
- * 读路谓词段(S-672:先过 `dispatch.ts` 的 `readCredentialOk`「服务凭据 ∨ 已验 principal」,再按 principal 自门,
+ * 读路谓词段([ref]:先过 `dispatch.ts` 的 `readCredentialOk`「服务凭据 ∨ 已验 principal」,再按 principal 自门,
  * 与 workflow 只读路由同段)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";

package/dist/http/routes/fleet.js

@@ -2,12 +2,11 @@ import { hookNoticeWire } from "../../fleet/fleet-bus.js";
 import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTerminalWorkflowRows } from "../../fleet/fleet-terminal-window.js";
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { fleetViewOf, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
     const { deps } = ctx;
-    const { sessionOwnerScope } = ctx.helpers;
     switch (match.decl.id) {
         case "fleet-stream": {
             const fleet = facts.fleetStream(deps);
@@ -15,7 +14,7 @@ export async function handleFleet(req, res, match, ctx) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
-            const { fleetWide } = sessionOwnerScope(req);
+            const { fleetWide } = fleetViewOf(req, deps, "read");
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && !principal && !fleetWide) {
                 sendPrincipalRefusal(res, req, deps.config);
@@ -77,7 +76,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             return rest;
         };
         const SCOPED_WORKFLOW_KEY_DISPOSITION = {
-            id: "keep", status: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
+            id: "keep", status: "keep", errorCode: "keep", parked: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
             startedCount: "keep", elapsedMs: "keep", tokens: "keep",
             name: "rewrite", scope: "strip", sessionId: "strip",
             description: "scrub",
@@ -90,6 +89,8 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                     id: rest.id,
                     status: rest.status,
                     name: "(unattributed)",
+                    ...(rest.errorCode !== undefined ? { errorCode: rest.errorCode } : {}),
+                    ...(rest.parked !== undefined ? { parked: rest.parked } : {}),
                     ...(rest.doneCount !== undefined ? { doneCount: rest.doneCount } : {}),
                     ...(rest.totalCount !== undefined ? { totalCount: rest.totalCount } : {}),
                     ...(rest.failedCount !== undefined ? { failedCount: rest.failedCount } : {}),

package/dist/http/routes/mcp-reconnect.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-381(core 7.22.0 [ref] 的 server 半场;提货单 [ref] ⓪ @server 第 3 条 / 判据帖 [ref] G1)——
+ * [ref](core 7.22.0 [ref] 的 server 半场;提货单 [ref] ⓪ @server 第 3 条 / 判据帖 [ref] G1)——
  * **会话内 MCP re-dial** 的 wire 面:
  *
  *   `POST /v1/sessions/:id/mcp/reconnect`  body `{ server: string }`
@@ -30,13 +30,13 @@
  * 消费端**不许**解析它。名册**按 `tools` 的在场性**投成 `toolNames`(present-iff),**不按 `outcome`**。
  *
  * ── 查找与拒绝形(与 steer / capture-optout **同一只**,不新造)───────────────────────────────────
- * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.ownerOf`,未知与他人**同码同串**
+ * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.headOf(id)?.owner`,未知与他人**同码同串**
  * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
  * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
- * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
+ * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,[ref] 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;「谁是 operator」的唯一读法 `explicitOperatorOk`)。
  *
- * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
+ * ── 应答期限([ref])────────────────────────────────────────────────────────────────────────────
  * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟
  * (env `MCP_TIMEOUT`,未设落 SDK 缺省 60s;拨号之前还有一次不在那条钟里的旧连接 `close()`),一台拨不通 / 半开的远端能把这一口
  * HTTP 请求挂很久。现在与 `GET /v1/sessions/:id/mcp` 面板读**同一只**数 `MCP_DIAL_DEADLINE_MS`(`../mcp-dial-deadline.ts`),

package/dist/http/routes/mcp-reconnect.js

@@ -65,8 +65,8 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     case "run_store_absent":
                         sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
                         return;
-                    case "session_owner_face_absent":
-                        sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
+                    case "session_head_face_absent":
+                        sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.headOf)");
                         return;
                     default:
                         return assertNever(fact.why);
@@ -89,7 +89,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const owner = await sessionStorage.ownerOf(sessionId);
+            const owner = (await sessionStorage.headOf(sessionId))?.owner;
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;

package/dist/http/routes/memory-consolidation.d.ts

@@ -11,7 +11,7 @@
  *
  * ── 缺席形(D4):**501**,与能力位同一只事实 ─────────────────────────────────────────────────────
  * 两口恒挂载;域头调事实 `memoryConsolidation`(`src/capability-facts.ts`,`capabilities.memoryConsolidationDriver` 读的是同一只):
- *  · 阀门关(`MEMORY_CONSOLIDATION_DRIVER=off`,或 S-824 出厂缺省派生成关 —— 未设而整理座落主模型)⇒ 501
+ *  · 阀门关(`MEMORY_CONSOLIDATION_DRIVER=off`,或 [ref] 出厂缺省派生成关 —— 未设而整理座落主模型)⇒ 501
  *    `feature.memory_consolidation_disabled`。旋钮关是一句运维表态,不是部署能力缺失 —— 「去开旋钮」由 `feature.*` 这一族码
  *    与拒句承担(同仓旋钮关的既有答法),不靠状态码:HTTP 上「这台部署上不可用」只有 501 一种答。
  *  · operator 名单空 ⇒ 501 `capability.operator_principals_required`(对谁都打不通 = 部署不可用,先于授权答)。

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/notify-wake.d.ts

@@ -15,7 +15,7 @@ import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js
  * `NOTIFY_WAKE_ROUTES`)。历史:2026-07-31 的缝合审查出这两件事**曾经不同步** —— 匹配形写死在本文件的
  * 判路代码里、`isBillableSubmitPath` 的名单写在 `server.ts` 里,wake 从来没进过名单,于是同一条
  * `driveResumeIntoRunLog` 模型腿从 `/v1/assistant/tasks/:id/resume` 进来受三道提交门管、从 wake 进来
- * 一道都不受。S-146 让两件事变成同一行的两列,再想漏就得把一行拆成两处才做得到。
+ * 一道都不受。[ref] 让两件事变成同一行的两列,再想漏就得把一行拆成两处才做得到。
  */
 export declare function handleNotifyWake(req: IncomingMessage, res: ServerResponse, match: RouteMatch<NotifyWakeRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const NOTIFY_WAKE_ROUTES: readonly [{

package/dist/http/routes/notify-wake.js

@@ -54,10 +54,10 @@ export async function handleNotifyWake(req, res, match, ctx) {
             }
             const owned = facts.sessionOwnership(deps);
             if (!owned.available) {
-                sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.ownerOf)");
+                sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.headOf)");
                 return;
             }
-            const notifyOwner = await owned.sessionStorage.ownerOf(notifySession);
+            const notifyOwner = (await owned.sessionStorage.headOf(notifySession))?.owner;
             if (notifyOwner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;