@sema-agent/server 7.133.0 → 7.135.0

package/dist/plugins/workflow-journal-payload.js

@@ -0,0 +1,32 @@
+import { WorkflowJournalIncompatibleError, callKeyOrdinal, readWorkflowJournalEntry } from "@sema-agent/core";
+import { SqlJsonColumnError, decodeJsonColumn } from "./sql-json-column.js";
+export function journalEntryPayload(entry) {
+    return entry.parked !== undefined ? { payload: entry.parked, parked: true } : { payload: entry.result, parked: false };
+}
+export function journalRowPayloadOf(entry) {
+    const { payload, parked } = journalEntryPayload(entry);
+    return JSON.stringify(parked ? { parked: payload } : payload);
+}
+const ANY_JSON = (body) => ({ value: body });
+export function journalLogicalRow(callKey, payload) {
+    return payload !== null && typeof payload === "object" && !Array.isArray(payload) && Object.hasOwn(payload, "parked")
+        ? { callKey, parked: payload.parked }
+        : { callKey, result: payload };
+}
+export function journalEntryOfCell(runId, callKey, cell, where) {
+    let payload;
+    try {
+        payload = decodeJsonColumn(cell, ANY_JSON, where);
+    }
+    catch (e) {
+        if (!(e instanceof SqlJsonColumnError) || e.problem !== "not-json")
+            throw e;
+        payload = cell;
+    }
+    const row = journalLogicalRow(callKey, payload);
+    const reading = readWorkflowJournalEntry(row);
+    if ("corrupt" in reading)
+        throw new WorkflowJournalIncompatibleError(runId, callKeyOrdinal(callKey), row);
+    return reading.entry;
+}
+//# sourceMappingURL=workflow-journal-payload.js.map

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -15,7 +15,7 @@
  * record (InMemory `{ scope, byOrdinal }` / File "first line names the scope, one line per ordinal"):
  *   - `workflow_journal_owner (run_id) PK` — the run's ONE owning scope, the `incarnation` token minted by the claim
  *     that wrote the record, and `appended_at_ms` (the owner's last append; the GC clock of this row). Written by the
- *     run's first append; never a second scope (S-197, below).
+ *     run's first append; never a second scope ([ref], below).
  *   - `workflow_journal (run_id, incarnation, ordinal) PK` — one row per recorded call, keyed by the owner record that
  *     wrote it. NO scope column: a run's scope lives in exactly one place, so "one run, two scopes" is not a state this
  *     schema can hold.
@@ -26,7 +26,7 @@
  * OVERWRITES (last-write-wins) — a resumed run re-appends its replayed prefix verbatim, so this is the exact InMemory
  * `byOrdinal.set(ordinal, …)` semantics, not a duplicate row.
  *
- * 🔴 **The scope wall — ONE predicate, both faces** (S-197; core `workflowJournalStoreContract` "scope wall" case;
+ * 🔴 **The scope wall — ONE predicate, both faces** ([ref]; core `workflowJournalStoreContract` "scope wall" case;
  * core's InMemory / File stores refuse the same way): a run's journal belongs to the scope of its first append. Every
  * face answers through the owner row and the same pair `workflow_journal_owner.run_id = ? AND scope = ?`:
  *   - `append` writes its row through `INSERT … SELECT … FROM workflow_journal_owner WHERE run_id = ? AND scope = ?` —
@@ -43,7 +43,7 @@
  * owner's row at the same ordinal. With the incarnation in the key, the stale write lands on a key of the dead record —
  * a row readable by no one, removed by the sweep — and the new record's rows are untouchable by it, on every engine,
  * without a locking clause.
- * Before S-197 the scope sat on every row: the read faces filtered it, the write face never judged it (a cross-scope
+ * Before [ref] the scope sat on every row: the read faces filtered it, the write face never judged it (a cross-scope
  * append on a NEW ordinal inserted a second scope's row into the run; on an EXISTING ordinal it overwrote the owner's
  * result under the owner's scope), held up by "runId is unique per scope and the owner is the sole writer".
  *
@@ -59,9 +59,10 @@
  *     a multi-byte UTF-8 payload would silently slip past the byte-budget cap on PG with plain `LENGTH`, so
  *     the twin uses the byte-counting function instead — codex R3, real dual-DB-suite-confirmed) in `loadPage`'s
  *     size-gate CASE.
- *   - `loadPage`'s bind-param ORDER: TiDB's `?`s appear in query-text order (maxResultBytes first, inside the
- *     CASE, ahead of runId/scope), so its params array is `[maxResultBytes, runId, scope, limit, offset]`; PG's
- *     `$n` are POSITIONAL (not text-order), so its array is `[runId, scope, maxResultBytes, limit, offset]`
+ *   - `loadPage`'s bind-param ORDER (both the chunk read and the single oversize-row read go through `readRows`): TiDB's `?`s
+ *     appear in query-text order (the byte gate first, inside the CASE, ahead of runId/scope), so its params array is
+ *     `[inlineBytes, runId, scope, from, limit]`; PG's `$n` are POSITIONAL (not text-order), so its array is
+ *     `[runId, scope, inlineBytes, from, limit]`
  *     (`$3` inside the CASE refers to the third element regardless of where `$3` sits in the text). Same
  *     placeholder-arity-fallout class the sql-driver.ts header calls out for null-safe compares.
  *   - affectedRows vs rowCount (via SqlDriver's normalized `affected`). The guarded write reads it as the wall's
@@ -96,12 +97,12 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     /** Record one agent's result. Idempotent per (run_id, ordinal) under the run's owner record: the PK upsert OVERWRITES (last-write-wins), so a
      *  resumed run re-appending its replayed prefix verbatim leaves no duplicate. callKeyOrdinal is the SOLE ordinal
      *  source (core's parser — a malformed key collapses to 0, matching InMemory). Throws on a REAL failure
-     *  (LOAD-BEARING) — an oversize entry included, on BOTH arms (S-194 / core 7.12.0 [ref]; see below) — and REFUSES an
-     *  append under a scope other than the run's owner, on any ordinal and both arms, writing nothing (S-197; the scope
+     *  (LOAD-BEARING) — an oversize entry included, on BOTH arms ([ref] / core 7.12.0 [ref]; see below) — and REFUSES an
+     *  append under a scope other than the run's owner, on any ordinal and both arms, writing nothing ([ref]; the scope
      *  wall in the file header). */
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
     /** Entries for `runId` IF its owner scope === `scope`, ASCENDING by ordinal; otherwise EMPTY. CORE-9 audit
-     *  BLOCKER: the scope wall (S-197: the owner row, the same predicate append writes through) — the LLM controls
+     *  BLOCKER: the scope wall ([ref]: the owner row, the same predicate append writes through) — the LLM controls
      *  `resumeFromRunId`, so a cross-scope runId resolves to an empty journal (resume safely diverges to live, never
      *  discloses another tenant's results). Each row's `result` is the persisted JSON.stringify(TaskResult) → JSON.parse
      *  back. Throws on failure (LOAD-BEARING). */
@@ -109,8 +110,16 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     /** [ref] locator 云形(core 1.353 WorkflowJournalStore.locator additive):SQL 店的 journal 坐标=
      *  [ref] HTTP 读面路由(file 店返 jsonl 路径=CC 本地形;此处返云形,core 铸 diagnostics 教句时单源引用)。 */
     locator(runId: string, _scope: string): string;
-    /** codex R1-H2:分页投影读——LIMIT/OFFSET 界行数,字节门界单行字节(超限行不取 result 全文,只回字节数;
-     *  读面标 truncated)。ORDER BY ordinal 与 load 同轴;scope 墙与 load 同一只 JOIN(S-197)。
+    /** 分页投影读 —— **判整份 journal,取一页**。
+     *
+     *  🔴 判的范围 = `load` 的范围:这条 journal 里只要有一行(任意一页、任意大小)被 core 的判官判坏,本读就抛 `WorkflowJournalIncompatibleError`(点名按序数升序的第一条坏行 ——
+     *  与内存 / 文件店 `load` 逐行判的次序同),页只是投影。修前只判本页取到、且不超 `maxResultBytes` 的行:同一条坏 journal 在内存 / 文件上整次拒、在这里答 200
+     *  (坏行在别的页、或是超单行门的坏行 —— 后者只出尺寸存根,永不解码)。判官只有一只、判的范围只有一个,页不是判的单位。
+     *
+     *  读法:按序数的键集游标分块(每块 {@link JOURNAL_SCAN_CHUNK_ROWS} 行,`ORDER BY ordinal` 的主键序;不用 OFFSET —— 活 run 在读的同时还在 append,位置偏移会在块界上漏行或重行),
+     *  每行经 {@link journalEntryOfCell}(`load` 的同一只回装点)判一遍;位置落在 `[offset, offset + limit)` 里的行进页。内存峰值 ≤ 正在读的一块 + 已收下的页(各 ≤ 50 行 × `maxResultBytes`,读面传 64 KiB)+ 一条超门的行(驱动 / 解码的开销另计):
+     *  行字节超 `maxResultBytes` 的行在块里只回字节数(库端 CASE 门,全文不过线),判它时单条取回全文、判完即弃 —— 页里它仍只是 `resultJson: null` 的尺寸存根。
+     *  ORDER BY ordinal 与 `load` 同轴;scope 墙与 `load` 同一只 JOIN([ref])。读放大:每次读 = 整份 journal 的一遍主键范围扫描(≤ 一次续跑 `load` 的量),这是「判整份」的代价。
      *  🔴 param ORDER differs by dialect (see file header): TiDB's `?`s bind in text order (maxResultBytes first,
      *  inside the CASE); PG's `$n` are positional, so its array keeps runId/scope first. Never unify — a swap
      *  silently mis-binds the OTHER dialect's placeholders. */
@@ -123,7 +132,12 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
         resultJson: string | null;
         resultBytes: number;
     }>>;
-    /** GC — purge ALL journal entries for a run (every incarnation), then its owner row (S-197). Scoped by run_id alone;
+    /** 超 `maxResultBytes` 的那一行的全文:单条读(序数 ≥ 它的第一行)—— 返回的行**必须就是它**(序数相等);它在块读与这次读之间被清扫了,读到的是「序数更大的下一行」,
+     *  那是别人的字节,不能挂在它的键下判 ⇒ 无可判(`undefined`),下一块读自然读到那一行、用它自己的键判。 */
+    private oversizeCellOf;
+    /** 读面的**唯一**行读法(`loadPage` 的块读与超门行的单条读共用):序数 ≥ `from` 的至多 `limit` 行,字节超 `inlineBytes` 的行 `resultJson` 为 null(只回 `resultBytes`)。 */
+    private readRows;
+    /** GC — purge ALL journal entries for a run (every incarnation), then its owner row ([ref]). Scoped by run_id alone;
      *  idempotent (returns the journal rows removed). Mirrors the resume-anchor store's deleteBySession. An append racing the
      *  two DELETEs can leave a row behind without its owner record; it is keyed by the dead incarnation — readable and
      *  overwritable by no one (file header) — and the GC sweep removes it by age. */
@@ -157,9 +171,9 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
      *  bound. A resume of a journal older than the retention window simply re-runs live (resume is an optimization).
      *  Idempotent; returns the journal rows purged.
      *
-     *  S-197: the same cutoff then purges owner rows whose OWN clock (`appended_at_ms`, pushed by every append of the
+     *  [ref]: the same cutoff then purges owner rows whose OWN clock (`appended_at_ms`, pushed by every append of the
      *  owner) is older. Each DELETE's predicate reads only the row it deletes — a cross-table "owner with no rows left"
-     *  test inside the DELETE would be a non-current read on every engine here (the B-022 lesson: TiDB pins start_ts, PG
+     *  test inside the DELETE would be a non-current read on every engine here (the [ref] lesson: TiDB pins start_ts, PG
      *  READ COMMITTED re-checks only the target row), so a concurrent append could have its owner deleted from under it.
      *  Every row of a run was written by an append that first pushed the owner's clock (monotonically — GREATEST) to at least
      *  that row's `created_at_ms`, so an owner past the cutoff normally has no row left after the first DELETE. The one

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,18 +1,13 @@
 import { callKeyOrdinal } from "@sema-agent/core";
 import { assertJournalEntryFits } from "@sema-agent/core";
-import { journalEntryOfBody, journalRowPayloadOf, readJournalRowBody } from "../orchestration/workflow-journal-entry.js";
+import { journalEntryOfCell, journalRowPayloadOf } from "./workflow-journal-payload.js";
 import { randomUUID } from "node:crypto";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { decodeJsonColumn, foldJsonColumn, jsonColumnText, jsonColumnTextExpr } from "./sql-json-column.js";
+import { jsonColumnText, jsonColumnTextExpr } from "./sql-json-column.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
-function decodeJournalResult(cell, where) {
-    try {
-        return decodeJsonColumn(cell, readJournalRowBody, where);
-    }
-    catch (e) {
-        throw foldJsonColumn(e, (m) => `workflow journal: ${m} — refusing rather than replay a journal entry nobody can read`);
-    }
-}
+const INT_MIN = -2147483648;
+const INT_MAX = 2147483647;
+const JOURNAL_SCAN_CHUNK_ROWS = 50;
 export class SqlWorkflowJournalStore {
     db;
     resumeClaimTtlMs;
@@ -43,18 +38,42 @@ export class SqlWorkflowJournalStore {
         const { rows } = await this.db.query(this.q(`SELECT call_key, ${jsonColumnText("tidb", "result")} FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC`, `SELECT call_key, ${jsonColumnText("pg", "result")} FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC`), [runId, scope]);
         return rows.map((r) => {
             const callKey = String(r.call_key);
-            return journalEntryOfBody(callKey, decodeJournalResult(r.result, `workflow_journal.result for run ${runId} entry ${callKey}`));
+            return journalEntryOfCell(runId, callKey, r.result, `workflow_journal.result for run ${runId} entry ${callKey}`);
         });
     }
     locator(runId, _scope) {
         return `/v1/workflows/${runId}/journal`;
     }
     async loadPage(runId, scope, opts) {
+        const page = [];
+        let position = 0;
+        let from = INT_MIN;
+        for (;;) {
+            const chunk = await this.readRows(runId, scope, from, JOURNAL_SCAN_CHUNK_ROWS, opts.maxResultBytes);
+            for (const row of chunk) {
+                const cell = row.resultJson ?? (await this.oversizeCellOf(runId, scope, row.ordinal));
+                if (typeof cell === "string")
+                    journalEntryOfCell(runId, row.callKey, cell, `workflow_journal.result for run ${runId} entry ${row.callKey}`);
+                if (position >= opts.offset && position < opts.offset + opts.limit)
+                    page.push({ callKey: row.callKey, resultJson: row.resultJson, resultBytes: row.resultBytes });
+                position += 1;
+            }
+            const last = chunk.at(-1);
+            if (last === undefined || chunk.length < JOURNAL_SCAN_CHUNK_ROWS || last.ordinal >= INT_MAX)
+                return page;
+            from = last.ordinal + 1;
+        }
+    }
+    async oversizeCellOf(runId, scope, ordinal) {
+        const row = (await this.readRows(runId, scope, ordinal, 1, INT_MAX))[0];
+        return row !== undefined && row.ordinal === ordinal && row.resultJson !== null ? row.resultJson : undefined;
+    }
+    async readRows(runId, scope, from, limit, inlineBytes) {
         const params = this.db.dialect === "tidb"
-            ? [opts.maxResultBytes, runId, scope, opts.limit, opts.offset]
-            : [runId, scope, opts.maxResultBytes, opts.limit, opts.offset];
-        const { rows } = await this.db.query(this.q(`SELECT call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE ${jsonColumnTextExpr("tidb", "result")} END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC LIMIT ? OFFSET ?`, `SELECT call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE ${jsonColumnTextExpr("pg", "result")} END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC LIMIT $4 OFFSET $5`), params);
-        return rows.map((r) => ({ callKey: String(r.call_key), resultJson: r.result_json === null ? null : String(r.result_json), resultBytes: Number(r.result_bytes) }));
+            ? [inlineBytes, runId, scope, from, limit]
+            : [runId, scope, inlineBytes, from, limit];
+        const { rows } = await this.db.query(this.q(`SELECT ordinal, call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE ${jsonColumnTextExpr("tidb", "result")} END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? AND ordinal >= ? ORDER BY ordinal ASC LIMIT ?`, `SELECT ordinal, call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE ${jsonColumnTextExpr("pg", "result")} END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 AND ordinal >= $4 ORDER BY ordinal ASC LIMIT $5`), params);
+        return rows.map((r) => ({ ordinal: Number(r.ordinal), callKey: String(r.call_key), resultJson: r.result_json === null ? null : String(r.result_json), resultBytes: Number(r.result_bytes) }));
     }
     async deleteByRun(runId) {
         const res = await this.db.query(this.q("DELETE FROM workflow_journal WHERE run_id = ?", "DELETE FROM workflow_journal WHERE run_id = $1"), [runId]);

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -70,7 +70,7 @@ type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 export declare const MAX_RUN_BLOB_BYTES: number;
 declare const onWarnType: (msg: string, meta: Record<string, unknown>) => void;
 export type InboxWarn = typeof onWarnType;
-/** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`)在**两条写腿**(put / update 常态 + oversize 降级)
+/** [ref]:workflow_run 行的 `error`(脚本抛出的 `err.message`)在**两条写腿**(put / update 常态 + oversize 降级)
  *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。
  *  core 7.48.0 起 `error` 在铸点也过 core 的 `redactSecrets`,但两张脱敏表互不为超集(本仓的表多认几种记号,core 的表多认另几种)⇒ 这一口暂留;
  *  退役条件 = core 的脱敏表成为两表的并集(本仓的每一种记号它都认)—— 到那时这一口与它的两条调用一起删。 */
@@ -90,12 +90,12 @@ export declare function withRedactedError<T extends {
  *  第一臂,「那张表独自作数」—— 剥成缺席就把一条走第一臂的记录推去走派生臂,而派生的两个缓存只装这条 run
  *  **自己做出**的 park,继承来、从未跑到的那一条**只存在于被剥掉的那张表里**,于是它要么被漏掉、要么被
  *  当成不存在而在 resume 时活着重跑([ref] 正要消灭的形)。它同时也是本仓 `/decide` 的 workflow 车道复核
- *  「这条 park 属于这条 run」的**单一真源**(S-252)。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
+ *  「这条 park 属于这条 run」的**单一真源**([ref])。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
  *  `test/slim-oversize-run.test.ts` 里那两格(最狠的一级上 `parks` 仍逐字完整 + 负控:记录本来没有
  *  这一位时不许凭空补 `[]`)。缺席 ⇒ 不补:补 `[]` 会把「这版引擎没写这个位」伪造成「这条 run 没有 park」,
  *  而 core 对两者的处置相反。
  *
- *  🔴 **S-252(7.75.0):阶梯不再为 park 另存第二份恢复身份。** 7.71.0 的 S-192 曾在 `agents[]` 里逐行保住
+ *  🔴 **[ref](7.75.0):阶梯不再为 park 另存第二份恢复身份。** 7.71.0 的 [ref] 曾在 `agents[]` 里逐行保住
  *  `callKey`/`sessionId`/`parkedCheckpointToken`(外加两级 `label` 预算与一枚不可恢复标记),因为当时
  *  `/decide` 的复核只认那一行。core 7.17.0 之后同一条记录上有了 `parks[]`,那份保留就成了**第二个会漂的
  *  定义**(真案:最后一级清空 `agents` 之后 token 仍躺在同一个 blob 的 `parks` 里,而 `/decide` 照拒)。
@@ -185,7 +185,7 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
 /**
- * S-185 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
+ * [ref] 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
  * {@link import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex} 的文件头,
  * 这里只记方言差)。行是 `WorkflowRun` 的派生投影(一行一枚指针),写者只有一个(Journaling 装饰器的写观察点);
  * 收割在删 run 行的同一个方法里按同一张待删 id 表删它们的指针({@link SqlWorkflowRunStore.reap})。

package/dist/posture-source.d.ts

@@ -1,17 +1,17 @@
 /**
- * S-167 → S-178 → S-1492 —— **一个部署级旋钮的值是谁定的**,五词闭集 + 一句运维指路。
+ * [ref] → [ref] → [ref] —— **一个部署级旋钮的值是谁定的**,五词闭集 + 一句运维指路。
  *
  * ## 为什么是一个共享件而不是每键一份
  *
- * S-167 给 `READ_FACE` 造了这套东西(值 + 来源 + 指路句),理由写在 `read-face-posture.ts` 的顶注里:
+ * [ref] 给 `READ_FACE` 造了这套东西(值 + 来源 + 指路句),理由写在 `read-face-posture.ts` 的顶注里:
  * 「缺席」这一态里塞着两件不同的事(单机 turnkey 没表态 vs 多租户就是要引擎默认),而把它们分开之后,
- * **env 恒赢的判据**与**运维面「为什么这台机器是这个值」**才有真答案。S-178 把同一条律推到另外三个键
+ * **env 恒赢的判据**与**运维面「为什么这台机器是这个值」**才有真答案。[ref] 把同一条律推到另外三个键
  * (`STREAM_ASK_WINDOW_MS` / `DURABLE_APPROVAL` / `SESSION_AUTO_TITLE`)时,唯一诚实的做法是**抽这一份**
  * ——四词表抄第二遍的那天,两份表会在加词时分家,而「这个值是谁定的」在运维面上是个是非题,不能有两个答案。
  *
  * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
  * `env 显式` > `center 发布` > `车道声明` > `posture 派生` > `引擎/服务端默认`。
- * `lane`(S-1492,[ref])= **执行车道的契约行替运维声明了这个旋钮的缺省**(目前只有 `READ_FACE`:隔离型车道的读面缺省 `open`,声明在 `execution-lane-caps.ts`)。
+ * `lane`([ref],[ref])= **执行车道的契约行替运维声明了这个旋钮的缺省**(目前只有 `READ_FACE`:隔离型车道的读面缺省 `open`,声明在 `execution-lane-caps.ts`)。
  * 它是出处,不是表态:运维从没写过这个键,所以与 `posture` 一样不算「有人要求过」({@link isExplicitPosture});比 `posture` 优先,因为车道声明比整机 posture 更具体
  * (同一台单机上 `e2b` 沙箱里的读面缺省 `open`,理由是沙箱边界而不是「一个可信主人」)。
  *
@@ -22,12 +22,12 @@
  * 得到一句谁都不认的空话,或者更坏:一句**对某些键是假的**话。
  *
  * 🔴 `centerMeaning` 是 G-7(test [ref])的修复面,成因是一次真的过期断言:这一臂原本硬编码
- * 「applied from the web-admin (**restart-to-apply**)」,而 S-174(core 7.10.0 [ref])之后
+ * 「applied from the web-admin (**restart-to-apply**)」,而 [ref](core 7.10.0 [ref])之后
  * `readFace.face` 是**热换席**(`Runner.swapDeps({readFace})`,下一拍 refresh 当场换进全部 Runner,
  * `read-face` 重启片也不再为它签理由)——运维照那句话去滚动重启一片 fleet,重启的是一个已经生效的变更。
  * 生效时机是**键**的事实,不是四词表的属性,所以它跟 `postureMeaning` 一样归键。
  */
-/** 旋钮取值来源的闭集词表(顺序 = 优先序;五词,S-1492 起多 `lane`)。 */
+/** 旋钮取值来源的闭集词表(顺序 = 优先序;五词,[ref] 起多 `lane`)。 */
 export declare const POSTURE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
 /** 一个旋钮的取值来源(闭集五词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
 export type PostureSource = (typeof POSTURE_SOURCE_WORDS)[number];
@@ -41,13 +41,13 @@ export interface PostureKnobFacts {
      * 还是这个键根本没有 center 腿?),以及怎么把这个键取回来。只在 `source === "center"` 时被读到。
      *
      * 🔴 为什么归键而不是共享(G-7 的成因):生效时机是键的事实。同一句「restart-to-apply」对
-     * `readFace.face` 是假的(S-174 热换席),对三个 S-178 旋钮则连触发条件都没有(`config.ts` 的
+     * `readFace.face` 是假的([ref] 热换席),对三个 [ref] 旋钮则连触发条件都没有(`config.ts` 的
      * `postureSourceOfKnob` / `postureSourceOfNumEnv` 只产 env/posture/engine-default,center 写不到
      * 它们)—— 一句共享的硬编码必然对其中一类说谎。
      */
     readonly centerMeaning: string;
     /**
-     * `lane` 那一臂**专属**的一句话(S-1492):执行车道的契约行为什么替这个旋钮声明了缺省、这一声明的风险是什么、怎么钉回。只在 `source === "lane"` 时被读到。
+     * `lane` 那一臂**专属**的一句话([ref]):执行车道的契约行为什么替这个旋钮声明了缺省、这一声明的风险是什么、怎么钉回。只在 `source === "lane"` 时被读到。
      * 与 `centerMeaning` 同理由归键:没有 lane 腿的旋钮(今天除 `READ_FACE` 外都是)写一句「本键没有 lane 腿」,比一句会骗人的通用话诚实。
      */
     readonly laneMeaning: string;
@@ -64,17 +64,17 @@ export declare function postureSourceNote(facts: PostureKnobFacts): string;
 /**
  * 这个值是**运维显式表态**的吗?
  *
- * 🔴 S-178 施工时真踩(本批全量抓出):`hasOperatorGateIntent`(`src/approval.ts`)判「运维表达过门意图
+ * 🔴 [ref] 施工时真踩(本批全量抓出):`hasOperatorGateIntent`(`src/approval.ts`)判「运维表达过门意图
  * 没有」时读的是 `durableApproval` 这个**值** —— 那在本键进 posture 家族之前是对的(它只有显式设过才为
  * 真),之后当场失真:单机 turnkey 上 posture 派生的 `true` 会被读成「运维要门」,于是 run-local 那条
  * **结构上没有 durable 门**的腿在每次 boot 打一条补偿 warn,而它其实正处在「零门意图的既定姿势」里。
- * 这与 S-167 头注①记的是**同一形**病(用一个会被 posture 铸出来的量当「有人表态过」的代理)。
+ * 这与 [ref] 头注①记的是**同一形**病(用一个会被 posture 铸出来的量当「有人表态过」的代理)。
  *
  * ⇒ 判据落到**来源**上,穷举 switch(五词闭集加员即编译红):`env`(这台机器的运维写下的)与 `center`
  * (组织发布的)是表态;`lane`(车道契约行声明的缺省)、`posture`(姿态派生)与 `engine-default`(内建缺省)都**不是**「有人要求过」。
  */
 export declare function isExplicitPosture(source: PostureSource): boolean;
-/** operator 诊断面的一行读数:值 + 来源 + 指路句。三个 S-178 旋钮与 S-167 的 readFace 同形。 */
+/** operator 诊断面的一行读数:值 + 来源 + 指路句。三个 [ref] 旋钮与 [ref] 的 readFace 同形。 */
 export interface PostureKnobReading<V> {
     value: V;
     source: PostureSource;

package/dist/principal-jwt.d.ts

@@ -5,7 +5,7 @@ import { type ApprovalEnvelope } from "./approval-hmac.js";
  *
  * 它回答的是**一跳**:签发方(issuer)与判定这份 token 的那口钟可以差多少(exp/nbf 门的宽限)。
  *
- * 🔴 它**不**回答「两台副本之间差多少」:S-280 的消费记录不再靠任何钟差上界活着 —— 受理窗的判定、
+ * 🔴 它**不**回答「两台副本之间差多少」:[ref] 的消费记录不再靠任何钟差上界活着 —— 受理窗的判定、
  * 落地后的复核、到期清扫三处读的是**同一口钟**(消费记录店自己的钟,见
  * `plugins/approval-nonce-store.ts` 的 `nowMs()`)。曾经由本常量推导出的那个「副本间钟差」常量已
  * 整条删除:它是一条**猜出来的**上界,没有任何一条腿强制它,而正确的修法是根本不需要这个数。
@@ -36,7 +36,7 @@ export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[
  *
  * 第三槽在两种门上是**同一条规则**「这份决定作用在哪份内容上」:动作门填被批工具调用的 `boundInputHash`
  * (core 铸);非动作门 `plan_review` 的 `edit` 填**修订后的计划**的哈希(计划随本次请求一起提交,签名器手上
- * 就有原文),`approve` / `reject` 不作用于任何新内容 ⇒ null。B-121(test 黑盒发现,验真后修):此前 edit 也填
+ * 就有原文),`approve` / `reject` 不作用于任何新内容 ⇒ null。[ref](test 黑盒发现,验真后修):此前 edit 也填
  * null,于是为「只改 README」签出的证明可以拿去提交任意 `editedPlan`——签名只护住了 decision/reason,没护住
  * 决定真正落地的那份内容。`cnf.bnd` 与 HMAC 都吃第三槽,所以 JWT 与信封同时绑住它;不匹配 ⇒
  * `401 principal_unbound`(既有码,cnf.bnd 不符)。旧注记「计划哈希被拒」说的是 approve(worker 没有可哈希的
@@ -51,7 +51,7 @@ export declare function editedPlanBinding(editedPlan: string): string;
 /**
  * JWT `cnf.bnd` = **「这份身份凭据被签发去决哪一张卡」**(动作身份),故只哈希前三位。
  *
- * 🔴 **与 HMAC 信封的分工**(S-433 F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
+ * 🔴 **与 HMAC 信封的分工**([ref] F1 立此,属主注在 `approval-hmac.ts` 顶):HMAC 绑的是**「决了什么」**
  * —— `decision` / `reason` / `permissionModeAfter` 这些**会改变后果**的字段全在那一把里。所以「同一张卡上
  * 把 approve 的档偷偷调宽」只由 HMAC 拦;本函数**刻意不跟着加位**:决定内容改了 `cnf.bnd` 不该变(否则
  * 一份合法 JWT 会被绑死在一个它签发时还不知道的值上,而 `permissionModeAfter` 恰恰是决裁那一刻才定的)。
@@ -97,7 +97,7 @@ export type DirectDoorProofResult = {
  * verify principal → bind → mac-present → mac-valid (so a non-operator never gets a MAC oracle, an unverified
  * caller never reaches the operator list).
  *
- * 🔴 `opts.nowSec`(S-280 / 合并复审 R2):受理窗要按**哪口钟**判。非动作门(plan_review)的反重放是
+ * 🔴 `opts.nowSec`([ref] / 合并复审 R2):受理窗要按**哪口钟**判。非动作门(plan_review)的反重放是
  * 一条**消费记录**,而那条记录的生死由**消费记录店的钟**决定 —— 所以那条腿必须把店钟喂进来
  * (`floor(店钟/1000)`),否则「还受理 ⇒ 记录还在」就退化成「两台副本的钟差不多」这条没人声明过的假设。
  * 缺席 = 本机墙钟,这对动作门(`/decide`)是对的:它的反重放是 checkpointToken 的一次性,不牵扯第二台
@@ -110,7 +110,7 @@ export type DirectDoorProofResult = {
  * {sessionId, nonce, <content hash>, decision, reason}. Pass `actionBinding:false` for a non-action gate; the default
  * (true) keeps the /decide tool-approval contract byte-identical. The THIRD slot carries one rule on both gates —
  * "the content this decision acts on": the bound tool input for /decide, `editedPlanBinding(editedPlan)` for a
- * plan_review `edit` (B-121), null for approve/reject. Binding approve/reject to a hash of the EXISTING plan was
+ * plan_review `edit` ([ref]), null for approve/reject. Binding approve/reject to a hash of the EXISTING plan was
  * rejected (the plan artifact lives in a profile ref store; the worker has no TOCTOU original) — that ruling never
  * covered `edit`, whose content arrives with the request.
  */
@@ -119,7 +119,7 @@ export declare function verifyDirectDoorProof(proof: {
     mac?: string;
     kid?: string;
 }, 
-/** 🔴 **命名类型,不是结构等价的内联字面**(S-433 F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
+/** 🔴 **命名类型,不是结构等价的内联字面**([ref] F1 [high] 的**根因**,验真后修):本位此前是一份手抄的
  *  五字段内联形 —— 结构类型让**多带一个字段的调用方**照样编译通过,而下面那次手抄再把它**丢掉**,于是
  *  `approval-hmac.ts` 上新增的签名位在这条唯一的真实验签链上**静默失效**,tsc 一个字都不响。
  *  用 {@link ApprovalEnvelope} 之后,信封的形只有**一个**声明点,新增一位自动到达验签器。 */

package/dist/project-identity.d.ts

@@ -19,7 +19,7 @@ export type ProjectIdentity = {
 export declare function resolveProjectIdentity(taskRoot: string): ProjectIdentity;
 /**
  * 退役 `repo:` 键的**唯一**铸点([ref] ①:`repo:` + sha256 hex 前 24;`root` 为 realpath 字符串,不加尾斜杠、不折大小写)。
- * S-640 起它只是一次性迁移的来源(`memory-project-layer.ts` 把这一层的条目折进新键;窗见 `plugins/one-time-migrations.ts` 登记表)。
+ * [ref] 起它只是一次性迁移的来源(`memory-project-layer.ts` 把这一层的条目折进新键;窗见 `plugins/one-time-migrations.ts` 登记表)。
  */
 export declare function mintRepoScopeKey(projectRoot: string): string;
 /** 这把键是不是本仓铸的项目键族(现行 `userrepo:` 或退役的 `repo:`)—— 运维不许把它们点名成全局层 / 同步层。 */
@@ -38,7 +38,7 @@ export declare function assertProjectLayerOwnable(scope: string, envName: string
  */
 export declare function normalizeGitRemoteUrl(url: string): string | undefined;
 /**
- * 任务根 → 项目层身份(S-640):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
+ * 任务根 → 项目层身份([ref]):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
  * 缺席形与 {@link resolveProjectIdentity} 同;git 配置在而读不了 ⇒ `unreadable`。
  */
 export declare function projectLayerIdentityOf(taskRoot: string): {
@@ -54,7 +54,7 @@ export interface ProjectLayerOfTask {
     readonly foldFrom: readonly string[];
 }
 /**
- * 任务根 → 项目层(S-640:`userrepo:<属主段>/<档>.<摘要>`,属主 = `owner`,调用方由 `projectLayerOwnerOf(全局层)` 求得)。
+ * 任务根 → 项目层([ref]:`userrepo:<属主段>/<档>.<摘要>`,属主 = `owner`,调用方由 `projectLayerOwnerOf(全局层)` 求得)。
  * `foldFrom` = 同一 checkout 能推出的旧层:退役 `repo:<同一路径哈希>`(一次性迁移,窗见 `plugins/one-time-migrations.ts` 登记表 M25)
  * + 当前档是 `r` 时它的 `p` 档(常设律)。
  * `taskRoot === undefined` = 调用方**此刻不知道**任务根在本机哪里(根在沙箱/设备盘上;或 host 车道会话没登记 cwd、手落在 factory 现铸的

package/dist/project-memory.d.ts

@@ -25,7 +25,7 @@ interface ProjectMemoryCtx {
  *  every CLAUDE file it finds, per directory level up the ancestor chain, whereas this loader reads one root and
  *  takes the single first hit. */
 declare const INSTRUCTION_FILE_CHAIN: readonly ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
-/** 一个链成员(相对项目根的拼写)。导出给 S-961 的 wire 段与它的值闭集登记(`trace/self-minted-wire.ts`)—— 链长一员,两处 tsc 跟着红。 */
+/** 一个链成员(相对项目根的拼写)。导出给 [ref] 的 wire 段与它的值闭集登记(`trace/self-minted-wire.ts`)—— 链长一员,两处 tsc 跟着红。 */
 export type InstructionChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
 /** Recover (root, rel) for a path the LOADER declared — every declared path is `root + one chain member`.
  *  The probe needs this to re-run the loader's parent-directory symlink gate each round (self-review: the probe
@@ -49,14 +49,14 @@ export declare function instructionChainCoordinates(absPath: string, p?: Platfor
  * `phase: "post-compact"` forces a re-read (core re-renders the prefix there anyway). No entry for
  * sessionless one-shot runs. (post-clear never arrives from core — [ref] — so it is not a cache key here.)
  *
- * S-690 — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
+ * [ref] — source-change notice: with `instructionSource` wired, every prepare of a non-subagent session that WALKED the
  * instruction chain hands the chain member it selected (`null` = none) to {@link announceInstructionSource}, which
  * compares it with the session's persisted baseline. A prepare stopped by a pre-walk gate (hands-less, a cwd that is not
  * an absolute local directory) is "not applicable", not "none" — it never reaches the mint (O6, see `LoadOutcome`). The member is the one the snapshot carries — a cache hit answers the cached pick, so
  * the notice follows what the model actually reads, not the disk (a same-process edit changes nothing until the
  * snapshot is re-read: restart, post-compact, or a new session).
  *
- * S-961 — the same statement (same predicate, same member) also settles the calling LEG's `wiring_manifest.instructions`
+ * [ref] — the same statement (same predicate, same member) also settles the calling LEG's `wiring_manifest.instructions`
  * segment through {@link settleLegInstructionStatement} (`instruction-selection.ts`): the leg scope is the run identity
  * the ctx does not carry, and the first call inside a leg's scope whose `ctx.sessionId` equals the leg's session is that
  * leg's own prepare (a session-less adhoc leg falls back to plain first-call; [ref] X1). The segment projects
@@ -70,7 +70,7 @@ export declare function makeLoadProjectMemory(opts: {
     maxBytes?: number;
     /** TEST-ONLY: shrink the snapshot-cache bound so the settle-time trim is observable without 256 sessions. */
     cacheMax?: number;
-    /** S-690: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
+    /** [ref]: the baseline store + notice exit. Absent ⇒ no source-change notice (the session store has no baseline face). */
     instructionSource?: InstructionSourceSeat;
 }): (ctx: ProjectMemoryCtx) => Promise<string | null | ProjectMemoryLoad>;
 /**

package/dist/read-face-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-167(clay 裁定 2,[ref] 转达 / [ref] ②)—— **READ 容纳面档位的来源**(单一属主)。
+ * [ref](clay 裁定 2,[ref] 转达 / [ref] ②)—— **READ 容纳面档位的来源**(单一属主)。
  *
  * ## 它解决的问题
  *
@@ -20,7 +20,7 @@
  * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
  * `env 显式` > `center 发布` > `lane 声明` > `posture 派生` > `引擎默认`。env 恒赢的论证逐字见 `web-admin-client/read-face.ts`
  * 头注①(READ 容纳面描述的是**这台机器的磁盘上有什么**,组织的下发面不知道)。
- * 🔴 **`lane` 一臂(S-1492,clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
+ * 🔴 **`lane` 一臂([ref],clay 裁 [ref])**:隔离型执行车道(`e2b` / `k8s` / `local-docker`)的契约行**显式声明**读面缺省 `open`
  * (`execution-lane-caps.ts` 的 `laneReadFaceDefault`;沙箱内部就是模型的整个世界)。运维没写 `READ_FACE` 时,车道声明比整机 posture 更具体 ⇒ 排在它前面;
  * 声明 `roots` 的车道(`host` / `ssh` / `adb` / `device` / 未设车道)不替运维声明缺省,回到既有的 posture 派生,**一个字节不变**。
  * 缺席这一态的派生**只有一只函数**({@link readFaceDefaultFor}),且读的是**最终生效的车道**(`loadConfig` 装配完 `remoteExec` 之后一次;
@@ -39,7 +39,7 @@
 import { type LaneReadFaceDefault, type RemoteExecProvider } from "./execution-lane-caps.js";
 import { type PostureSource } from "./posture-source.js";
 /**
- * 档位来源的闭集词表 —— **S-178 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
+ * 档位来源的闭集词表 —— **[ref] 起转 `posture-source.ts` 的共享件**(本模块只是给这一档取个本地名字,
  * 不再持第二份词表:同一张四词表抄两遍的那天,两份会在加词时分家)。
  */
 export declare const READ_FACE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
@@ -77,7 +77,7 @@ export declare function settleDerivedReadFace(seat: ReadFaceDeploymentSeat, sing
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
  *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
  *
- *  🔴 `center` 那句话的事实来源是 S-174(core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
+ *  🔴 `center` 那句话的事实来源是 [ref](core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
  *  闭集 `SWAPPABLE_DEP_SEATS` ⇒ 组织发布/撤回一个档位,**下一拍 refresh 当场换进全部 Runner**,
  *  `web-admin-client/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
  *  `CENTER_READ_FACE_LIVE_KEYS`,由 core 的 `isSwappableDepSeat` 派生)。本句此前逐字写着
@@ -92,10 +92,10 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     note: string;
 };
 /**
- * S-176 —— 派生的档位(`posture` 单机 ⇒ open,或 S-1492 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ * [ref] —— 派生的档位(`posture` 单机 ⇒ open,或 [ref] 的 `lane` 隔离车道 ⇒ open)在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
  *
- * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
- * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。S-1492 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
+ * 为什么要有:[ref] 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。[ref] 的 `lane` 臂同一个补偿:多租户沙箱部署升级后读面从 `roots` 变 `open`,
  * 指路句带挂载告诫与钉回出路。
  * 为什么只在 `posture` / `lane` 两词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
  * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。

package/dist/request-key-closure.d.ts

@@ -32,7 +32,7 @@ declare const TASK_BODY_SCENARIO_KEYS: readonly ["repo"];
 export type ScenarioBodyKey = (typeof TASK_BODY_SCENARIO_KEYS)[number];
 /** 剥掉索引签名,只留**具名**键 —— `TaskRequestBody` 上那条 `[k: string]: unknown` 会让
  *  `keyof` 退化成 `string`,双向门就永远恒真(零判别力)。
- *  🔴 **导出**(S-405):姊妹门 `request-value-closure.ts` 的双向钉要同一个剥法 —— 抄第二份 = 两处哪天
+ *  🔴 **导出**([ref]):姊妹门 `request-value-closure.ts` 的双向钉要同一个剥法 —— 抄第二份 = 两处哪天
  *  分岔(一边看得见索引签名、一边看不见)谁都发现不了,而两边的判别力都建立在「剥干净了」这句话上。 */
 export type NamedKeysOf<T> = {
     [K in keyof T as string extends K ? never : number extends K ? never : K]: T[K];

package/dist/request-key-closure.js

@@ -23,7 +23,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "excludeAllTools", "excludeTools", "fileHistory",
     "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries", "outputStyle",
-    "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
+    "outputSchema", "permissionMode", "projectId", "projectMemory", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFiles", "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
     "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",

package/dist/request-tool-axes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * 请求侧 `toolAxes` 声明的读法 —— `mcpServers[].toolAxes`(`task-mcp.ts`)与 `a2aPeers[].toolAxes`(`task-a2a.ts`)同一只。
+ *
+ * 律(一句):判官是引擎包根的 `readToolAxes(declared, at)`;请求侧再多一条 —— **不许写 `boundaryFlow`**。
+ * `boundaryFlow: "engine"`(须同条 `egress: false`)声明一只引擎专用工具:名册行读成零条腿,设备车道的发射闸对它的调用不欠任何东西。
+ * 引擎分不出一条声明来自请求还是部署,所以这个位只许部署声明(`config.d` / 配置中心)写 —— 那两条腿原样交引擎(由引擎判 `egress: false`)。
+ * 读数形与引擎判官同一只(`ToolAxesRead`):请求侧写了这个位 ⇒ `ok: false`,原因句点名工具(或 skill)与出路;各腿按自己既有的「判不过」处置读它
+ * (MCP 新提交 400 点名 / 续跑重放整条 server 不进;A2A 整条对端不挂、warn 点名)。
+ */
+import { type ToolAxesRead, type ToolAxesSurface } from "@sema-agent/core";
+export declare function readRequestToolAxes(declared: unknown, at: ToolAxesSurface): ToolAxesRead;
+//# sourceMappingURL=request-tool-axes.d.ts.map

package/dist/request-tool-axes.js

@@ -0,0 +1,20 @@
+import { readToolAxes } from "@sema-agent/core";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
+import { MAX_KEY_ECHO } from "./request-key-closure.js";
+const KEY_NOUN = { mcp: "tool", a2a: "skill" };
+export function readRequestToolAxes(declared, at) {
+    const read = readToolAxes(declared, at);
+    if (!read.ok || read.toolAxes === undefined)
+        return read;
+    for (const [name, axes] of Object.entries(read.toolAxes)) {
+        if (axes !== undefined && Object.hasOwn(axes, "boundaryFlow")) {
+            return {
+                ok: false,
+                problem: `the axes declared for ${KEY_NOUN[at]} ${JSON.stringify(stripControlAndBidi(name).slice(0, MAX_KEY_ECHO))} carry "boundaryFlow", which only a deployment's declaration may state ` +
+                    `(it declares an engine-only ${KEY_NOUN[at]}, so the device lane's launch gate would owe its calls nothing; the engine cannot tell a request's entry from a deployment's) — drop "boundaryFlow"`,
+            };
+        }
+    }
+    return read;
+}
+//# sourceMappingURL=request-tool-axes.js.map