@sema-agent/server 7.133.0 → 7.135.0

package/dist/tool-approval.js

@@ -1,9 +1,10 @@
-import { parkedFacetOf, readApprovalCard } from "./approval-content-kind.js";
+import { readApprovalCard } from "./approval-content-kind.js";
 import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, classifyAsk, foldArbitrationRow, policyCannotAnswer, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
+import { seatText } from "./trace/exit-seat.js";
 import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
@@ -11,8 +12,8 @@ import { errorKindOf } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { ownerOfCheckpointScope } from "./security.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "./approval-ask-machine.js";
-import { currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, buildApprovalCompleteFrame, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
+import { currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildReplayFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, buildApprovalCompleteFrame, readRuleOfferList, } from "./approval-card.js";
+import { askRowCarriesOwner, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, causeOfAskRow } from "./approval-deny-reasons.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
@@ -22,14 +23,6 @@ import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 import { refusalBody } from "./http/refusal-body.js";
 const defaultLogger = createLogger();
-export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
-export function isApprovalGateKind(k) {
-    return k !== undefined && APPROVAL_GATE_KINDS.includes(k);
-}
-export function denySweepOwns(gate) {
-    return isApprovalGateKind(typeof gate?.kind === "string" ? gate.kind : undefined) && parkedFacetOf(gate) === "A";
-}
-export const APPROVAL_GATE_KINDS_SQL_IN = `(${APPROVAL_GATE_KINDS.map((k) => `'${k}'`).join(",")})`;
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
 const DEFAULT_UNREACHED_ASK_TTL_MS = 60 * 60_000;
@@ -327,9 +320,14 @@ function parseToolApprovalFields(body, retired) {
 export function buildUnattendedPolicyRefusal(reason) {
     return { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason };
 }
-function unattendedRefusalReason(arm) {
+function unattendedRefusalReason(site) {
+    if (site.arm === "frame_family_undeclared") {
+        return (`UNATTENDED_APPROVAL_POLICY=deny: this run has no live approval channel — the client that started it did not declare the "${site.family}" ` +
+            "approval frame family (settings.approvalFrameFamilies), so no approval card is shown to it, and an approval request no one can answer " +
+            `is refused here instead of being parked for a person. Upgrade the client, or declare the family it renders (arm: ${site.arm}).`);
+    }
     return ("UNATTENDED_APPROVAL_POLICY=deny: this deployment declares that no one attends its approvals, so an approval " +
-        `request no one can answer is refused here instead of being parked for a person (arm: ${arm}).`);
+        `request no one can answer is refused here instead of being parked for a person (arm: ${site.arm}).`);
 }
 function isChildAsk(req) {
     return req.fromSubagent === true;
@@ -361,11 +359,53 @@ export function resolveStreamApprovalGate(input) {
         return { active: false, reason: "protocol_disabled" };
     if (!input.backend)
         return { active: false, reason: "no_backend" };
-    if (!input.parkFacility)
+    if (input.checkpointStore === undefined)
         return { active: false, reason: "no_park_facility" };
-    return { active: true, askStore: input.backend.approvalAsk() };
+    return { active: true, askStore: input.backend.approvalAsk(), checkpointStore: input.checkpointStore };
 }
 export const APPROVAL_FRAME_FAMILIES = ["tool_approval", "approval_request"];
+export function presentedApprovalFrameFamily(streamApprovalOn) {
+    return streamApprovalOn ? "approval_request" : "tool_approval";
+}
+const APPROVAL_FRAME_FAMILIES_FIELD = "settings.approvalFrameFamilies";
+const APPROVAL_FRAME_FAMILY_WORDS = APPROVAL_FRAME_FAMILIES.map((w) => `"${w}"`).join(" | ");
+export function approvalFrameFamiliesIssue(settings) {
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return null;
+    const raw = Reflect.get(settings, "approvalFrameFamilies");
+    if (raw === undefined)
+        return null;
+    if (!Array.isArray(raw)) {
+        return {
+            message: `${APPROVAL_FRAME_FAMILIES_FIELD} must be an array of approval frame family words (${APPROVAL_FRAME_FAMILY_WORDS}) — the families of approval cards this client renders. ` +
+                'Refused rather than ignored, because an ignored declaration reads as "in effect" to the caller',
+            fields: { field: APPROVAL_FRAME_FAMILIES_FIELD, reason: "bad_entry" },
+        };
+    }
+    const seen = new Set();
+    for (const [index, entry] of raw.entries()) {
+        if (!APPROVAL_FRAME_FAMILIES.includes(entry)) {
+            return {
+                message: `${APPROVAL_FRAME_FAMILIES_FIELD}[${index}] is not one of ${APPROVAL_FRAME_FAMILY_WORDS} — every entry must be an approval frame family word. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`,
+                fields: { field: APPROVAL_FRAME_FAMILIES_FIELD, reason: "bad_entry", index },
+            };
+        }
+        if (seen.has(entry)) {
+            return {
+                message: `${APPROVAL_FRAME_FAMILIES_FIELD}[${index}] repeats a family declared earlier in the list — declare each family once`,
+                fields: { field: APPROVAL_FRAME_FAMILIES_FIELD, reason: "bad_entry", index },
+            };
+        }
+        seen.add(entry);
+    }
+    return null;
+}
+export function declaredApprovalFrameFamilies(settings) {
+    if (approvalFrameFamiliesIssue(settings) !== null || settings === null || typeof settings !== "object")
+        return new Set();
+    const raw = Reflect.get(settings, "approvalFrameFamilies");
+    return new Set(Array.isArray(raw) ? raw.filter((w) => APPROVAL_FRAME_FAMILIES.includes(w)) : []);
+}
 export function createApprovalCardEmitter(sinks) {
     const present = [sinks.appendDurable, sinks.writeLive].filter((w) => w !== undefined);
     const attempt = (write, frame) => (async () => {
@@ -410,17 +450,22 @@ export function createApprovalCardEmitter(sinks) {
     };
 }
 export function resolveApprovalLeg(input) {
-    if (!input.streamApprovalOn)
-        return { active: false, windowZero: input.windowMs === 0 };
-    const tightDeadline = input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
+    const active = input.streamApprovalOn;
+    const tightDeadline = active && input.legWalltimeMs !== undefined && input.legWalltimeMs - input.windowMarginMs <= 0;
     if (input.windowMs === 0 || tightDeadline)
-        return { active: true, windowZero: true };
+        return { active, unattended: { arm: "window_zero" } };
+    const family = presentedApprovalFrameFamily(active);
+    if (!input.declaredFamilies.has(family))
+        return { active, unattended: { arm: "frame_family_undeclared", family } };
     return {
-        active: true,
-        windowZero: false,
-        ...(input.legWalltimeMs !== undefined ? { legDeadlineMonotonic: input.nowMonotonicMs + input.legWalltimeMs } : {}),
+        active,
+        ...(active && input.legWalltimeMs !== undefined ? { legDeadlineMonotonic: input.nowMonotonicMs + input.legWalltimeMs } : {}),
     };
 }
+export function approvalPreambleReplays(input) {
+    const leg = resolveApprovalLeg({ ...input, nowMonotonicMs: performance.now() });
+    return leg.active && leg.unattended === undefined;
+}
 function effectiveAskWindowMs(ttlMs, windowMarginMs, legDeadlineMonotonic, nowMonotonicMs) {
     if (legDeadlineMonotonic === undefined)
         return ttlMs;
@@ -513,6 +558,7 @@ export class ToolApprovalCoordinator {
     parkRedemptionTtlMs;
     parkRedemptionPerPrincipalMax;
     parkedRedeem;
+    parkedGate;
     askAudit;
     sessionGrants;
     deploymentListAsks;
@@ -532,6 +578,7 @@ export class ToolApprovalCoordinator {
         this.admitMaxPerOwner = opts?.admitMaxPerOwner ?? DEFAULT_ADMIT_MAX_PER_OWNER;
         this.unattendedPolicy = opts?.unattendedPolicy ?? "park";
         this.parkedRedeem = opts?.parkedRedeem;
+        this.parkedGate = opts?.parkedGate;
         this.parkRedemptionMax = opts?.parkRedemptionMax ?? DEFAULT_PARK_REDEMPTION_MAX;
         this.parkRedemptionTtlMs = opts?.parkRedemptionTtlMs ?? DEFAULT_PARK_REDEMPTION_TTL_MS;
         this.parkRedemptionPerPrincipalMax = opts?.parkRedemptionPerPrincipalMax ?? DEFAULT_PARK_REDEMPTION_PER_PRINCIPAL_MAX;
@@ -553,7 +600,7 @@ export class ToolApprovalCoordinator {
                 outcomeWord = "unavailable";
                 break;
             case "deny":
-                outcome = buildUnattendedPolicyRefusal(unattendedRefusalReason(site.arm));
+                outcome = buildUnattendedPolicyRefusal(unattendedRefusalReason(site));
                 outcomeWord = "deny";
                 break;
             default: {
@@ -579,12 +626,12 @@ export class ToolApprovalCoordinator {
         return this.unattendedRoutesToPark ? deriveBatchId(sourceTaskId, runId, legKey) : deriveAskScopedBatchId(askId);
     }
     unattendedAskOutcome(site) {
-        return this.unattendedOutcome({
-            arm: "window_zero",
+        const facts = {
             ...(site.taskId !== undefined ? { taskId: site.taskId } : {}),
             ...(site.owner !== undefined && site.owner !== null ? { owner: site.owner } : {}),
             ...(site.toolName !== undefined ? { toolName: site.toolName } : {}),
-        });
+        };
+        return this.unattendedOutcome(site.arm === "frame_family_undeclared" ? { arm: site.arm, family: site.family, ...facts } : { arm: site.arm, ...facts });
     }
     async landUnattendedOutcome(outcome, row) {
         const store = this.askStore;
@@ -715,16 +762,7 @@ export class ToolApprovalCoordinator {
         const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
         const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
         const out = [];
-        for (const raw of offers) {
-            const parsed = RuleOfferRawSchema.safeParse(screenUncoveredDetailSeat(backfillLegacyBatchMemberKind(raw)));
-            if (!parsed.success) {
-                defaultLogger.warn("rule_offer_dropped_unreadable_shape", {
-                    kind: typeof raw === "object" && raw !== null ? String(raw.kind) : typeof raw,
-                    note: "this offer's shape is outside the closed vocabulary this build reads (member kind / match / reason) — dropped whole; sibling offers still render (core/dist skew?)",
-                });
-                continue;
-            }
-            const offer = parsed.data;
+        for (const { offer } of readRuleOfferList(offers)) {
             if (ToolApprovalCoordinator.ruleOfferTextsOverSize(offer))
                 return undefined;
             if (!ToolApprovalCoordinator.ruleOfferDerivedFactsAgree(offer)) {
@@ -933,12 +971,12 @@ export class ToolApprovalCoordinator {
             return false;
         }
     }
-    boundUnattendedAsk = (identity) => {
+    boundUnattendedAsk = (identity, why) => {
         return async (req) => {
             const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "" };
             if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
                 return true;
-            return this.unattendedAskOutcome({ taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
+            return this.unattendedAskOutcome({ ...why, taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
         };
     };
     async sessionGrantUncontestedByRow(origin, req) {
@@ -2015,7 +2053,7 @@ export class ToolApprovalCoordinator {
         if (!entry || (entry.owner !== null && entry.owner !== principal)) {
             return this.respondLate(id, principal, parsed, httpReq);
         }
-        return this.answerRegistration(entry, id, principal, parsed, httpReq);
+        return this.answerRegistration(entry, entry.owner, id, principal, parsed, httpReq);
     }
     async respondAdopted(entry, id, principal, parsed, httpReq) {
         const store = this.askStore;
@@ -2026,9 +2064,9 @@ export class ToolApprovalCoordinator {
             return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
         if (row.state !== "STREAM_PENDING")
             return this.dispatchRowTruth(row, id, parsed, httpReq, principal);
-        return this.answerRegistration(entry, id, principal, parsed, httpReq);
+        return this.answerRegistration(entry, row.owner, id, principal, parsed, httpReq);
     }
-    answerRegistration(entry, id, principal, parsed, httpReq) {
+    answerRegistration(entry, judgedOwner, id, principal, parsed, httpReq) {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, parsed);
         if (preRule !== undefined)
             return preRule;
@@ -2038,7 +2076,7 @@ export class ToolApprovalCoordinator {
         const ruleEligibility = { eligible: true };
         const store = this.askStore;
         if (store && entry.askId !== undefined && entry.batchId !== undefined) {
-            return this.respondWithCas(store, entry.askId, entry.batchId, entry, parsed, ruleEligibility).then((cas) => cas.lost ? this.dispatchRowTruth(cas.row, id, parsed, httpReq, principal) : this.afterLiveDecision(cas.result, entry, parsed, principal, ruleEligibility));
+            return this.respondWithCas(store, entry.askId, entry.batchId, judgedOwner, entry, parsed, ruleEligibility).then((cas) => cas.lost ? this.dispatchRowTruth(cas.row, id, parsed, httpReq, principal) : this.afterLiveDecision(cas.result, entry, parsed, principal, ruleEligibility));
         }
         return this.afterLiveDecision(this.finishRespond(entry, parsed), entry, parsed, principal, ruleEligibility);
     }
@@ -2142,7 +2180,19 @@ export class ToolApprovalCoordinator {
     async readAskRowState(store, id, principal) {
         return this.readStateOfRow(await this.askRowFor(store, id, "getAsk(read)"), principal);
     }
-    readStateOfRow(row, principal) {
+    async readParkedGate(row) {
+        const gate = this.parkedGate;
+        if (gate === undefined || row.gateToken === null)
+            return { kind: "open" };
+        try {
+            return await this.withStoreDeadline(gate({ gateToken: row.gateToken, gateBoundCallId: row.gateBoundCallId }), "readParkedGate", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+        }
+        catch (err) {
+            this.noteStoreError(err, "readParkedGate");
+            return { kind: "open" };
+        }
+    }
+    async readStateOfRow(row, principal) {
         if (!askRowVisibleTo(row, principal))
             return this.notPending(NOT_PENDING_UNKNOWN_CAUSE);
         const projection = buildAskRowReadProjection(row, Date.now());
@@ -2157,8 +2207,34 @@ export class ToolApprovalCoordinator {
             }
             case "PARKING":
             case "PARKED": {
-                const parkSession = parkSessionOf(row);
-                body = { state: "parked", ...projection, ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}) };
+                const gate = row.state === "PARKED" ? await this.readParkedGate(row) : { kind: "open" };
+                switch (gate.kind) {
+                    case "open": {
+                        const parkSession = parkSessionOf(row);
+                        body = { state: "parked", ...projection, ...(parkSession !== undefined ? { decidePath: approvalDecidePath(parkSession) } : {}), ...(gate.reopened !== undefined ? { reopened: gate.reopened } : {}) };
+                        break;
+                    }
+                    case "decided":
+                        body = { state: "decided", ...projection, decision: gate.decision, decidedAtMs: gate.decidedAtMs, ...(gate.decisionNote !== undefined ? { decisionNote: gate.decisionNote } : {}) };
+                        break;
+                    case "void":
+                        body = { state: "void", ...projection };
+                        break;
+                    case "unknown":
+                        if (gate.why === "decision_unreadable") {
+                            defaultLogger.error("tool approval read saw a PARKED row whose gate is settled but carries no usable decision", {
+                                askId: row.askId,
+                                defect: seatText("operator-log-text", gate.defects[0]),
+                                defectCount: gate.defects.length,
+                            });
+                        }
+                        return this.notPending();
+                    default: {
+                        const unhandled = gate;
+                        defaultLogger.error("tool approval read hit an unknown gate reading", { askId: row.askId, gate: unhandled });
+                        return this.notPending();
+                    }
+                }
                 break;
             }
             case "DENIED":
@@ -2583,12 +2659,12 @@ export class ToolApprovalCoordinator {
             return withFlag(false, "rule_store_error");
         }
     }
-    async respondWithCas(askStore, askId, batchId, entry, parsed, ruleEligibility) {
+    async respondWithCas(askStore, askId, batchId, owner, entry, parsed, ruleEligibility) {
         let winnerRow;
         let ambiguousConfirmedRow;
         let noteLanded = false;
         try {
-            const decided = await this.withStoreDeadline(askStore.decideAsk(askId, batchId, {
+            const decided = await this.withStoreDeadline(askStore.decideAsk(askId, batchId, owner, {
                 decision: parsed.value === "deny" ? "deny" : "approve",
                 ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
                 ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
@@ -2610,6 +2686,8 @@ export class ToolApprovalCoordinator {
             ruleEligibility.eligible = false;
             try {
                 const row = await this.withStoreDeadline(askStore.getAsk(askId), "getAsk(decideAsk-confirm)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+                if (row !== null && !askRowCarriesOwner(row, owner))
+                    return { lost: true, row: null };
                 if (row?.state === "DECIDED" && row.decision === (parsed.value === "deny" ? "deny" : "approve")) {
                     winnerRow = row;
                     ambiguousConfirmedRow = row;

package/dist/tool-rule-names.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-919(安全轴,八病审计 SG H2-a)—— 本仓**收紧方向**按引擎工具名匹配的策略臂的**唯一**名字读法。
+ * [ref](安全轴,八病审计 SG H2-a)—— 本仓**收紧方向**按引擎工具名匹配的策略臂的**唯一**名字读法。
  *
  * ## 规则(一条,与 core 7.36.0 [ref] `NAME_READINGS` 同判)
  * 一个调用可以答好几个名字:嵌入方工具声明别名(`MyShell{aliases:["Bash"]}`)后,模型按哪个名调它、它的 wire 名、
@@ -17,6 +17,12 @@
  * 修前(≤7.107.0)本仓自写的这些臂只比 `req.toolName`:模型按别名调嵌入方工具时,运维名单一个都不拦(core 同族策略判 deny、
  * 本仓判 allow)。本仓自身不声明带别名的工具,所以只有经 `resolveSpec` 席挂别名工具的嵌入方走得到。
  *
+ * ⚠️ **别名只是名字,不是标记的载体**(core 7.54.0 [ref],[ref] 已定案):上面这条读法只回答「这次调用答得上哪些名字」;嵌入方工具自己的
+ * 安全标记(`egress`、不可逆层级 `irreversibility`、可逆探针)**不再**因别名恰是引擎工具名(`MyShell{aliases:["Bash"]}`)而镜像到引擎 shell 上 ——
+ * 7.53.x 及以前,`MyShell` 的 `egress: true` / `irreversibility: "always"` 会让引擎 `Bash` 的调用多问一次(收紧),它的恒可逆探针会让引擎 `Bash` 的
+ * `touch` 不问就跑(放宽);7.54.0 起两者都不再作用于引擎 shell。要收紧引擎 shell:给**正名**叫 `Bash` 的工具声明标记(同名标记仍作用),或请求
+ * `TaskSpec.shellGate: "always"`(本仓的入口 `MANUAL_MODE_SHELL_GATE` / 请求 `shellGate`)。
+ *
  * 返回**命中的那个名字**(调用答得上的名字里第一个被规则够到的,拼写在先)—— 规则归因(`matchedAskRule`)写运维名单里的那个名,
  * 不写一个名单里查不到的 wire 名;够不到 ⇒ `undefined`。判定式(精确集 / covering 规则)由调用方给,本函数只管「读哪些名字」。
  */

package/dist/trace/core-keyset-guard.d.ts

@@ -60,7 +60,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory" | "permissionMode";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "mods" | "lsp" | "hands" | "writeProtection" | "teamRole" | "fileHistory" | "permissionMode" | "sessionRules" | "projectMemory";
 type WiringSectionExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["wiring_manifest_tenant"]["excluded"][number];
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -133,6 +133,9 @@ type _GuardWiringAutoConsolidationReverse = AssertAllKeysHandled<Exclude<WiringA
 type WiringModelGateHandled = "class" | "removed" | "restore";
 type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
 type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
+type ProjectTables = typeof import("./project.js");
+type _GuardWiringSessionRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"sessionRules">, TableCoreKeys<ProjectTables["WIRING_SESSION_RULES_DISPOSITIONS"]>>>;
+type _GuardWiringSessionRulesReverse = AssertAllKeysHandled<Exclude<TableCoreKeys<ProjectTables["WIRING_SESSION_RULES_DISPOSITIONS"]>, keyof WiringSection<"sessionRules">>>;
 type WiringPermissionModeHandled = "requested" | "effective" | "foldedBy";
 type _GuardWiringPermissionMode = AssertAllKeysHandled<Exclude<keyof PermissionModeReceipt, WiringPermissionModeHandled>>;
 type _GuardWiringPermissionModeReverse = AssertAllKeysHandled<Exclude<WiringPermissionModeHandled, keyof PermissionModeReceipt>>;
@@ -145,8 +148,9 @@ type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernan
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
 export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed" | "permission.allowed_tools_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
-type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
-type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
+type PermissionTraceRunEvent = "permission.cross_boundary_taint";
+type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped | PermissionTraceRunEvent>>;
+type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped | PermissionTraceRunEvent, PermissionTraceKind>>;
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
@@ -215,13 +219,13 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "family" | "pathTarget" | "hostTarget" | "targets" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptRole" | "promptBinding" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "mods" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "outputStyle" | "projectMemory" | "allowedTools" | "allowTools" | "userAttachments" | "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies";
 /** 导出:请求体键闭集门(`request-key-closure.ts`)据它锁「本仓记为未接线的引擎座,提交口不许受理」—— 两处分类只能同向。 */
-export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm";
+export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
@@ -243,7 +247,7 @@ type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "fold
 type SessionMemoryStatusExcluded = "writeHome";
 type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
 type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
-type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage";
+type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
 type _GuardSideQueryResultReverse = AssertAllKeysHandled<Exclude<SideQueryResultForwarded | SideQueryResultStripped, keyof SideQueryResult>>;
@@ -257,7 +261,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "mode" | "askClass" | "classes";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier" | "released" | "clearedBy" | "mode" | "askClass" | "classes";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
@@ -316,7 +320,7 @@ type LspOptionsUnwired = "onNotice" | "servers" | "spawn" | "readText" | "resolv
 type _GuardLspOptions = AssertAllKeysHandled<Exclude<keyof NodeLspManagerOptions, LspOptionsWired | LspOptionsUnwired>>;
 type _GuardLspOptionsReverse = AssertAllKeysHandled<Exclude<LspOptionsWired | LspOptionsUnwired, keyof NodeLspManagerOptions>>;
 type _NoDoubleBookLspOptions = AssertAllKeysHandled<Extract<LspOptionsWired, LspOptionsUnwired>>;
-/** ⑯ 账上记过、已接线的 `RunnerDeps` 席(S-724 起 `fileHistoryCapture`)。反向钉:core 改名 / 退役 ⇒ 红。 */
+/** ⑯ 账上记过、已接线的 `RunnerDeps` 席([ref] 起 `fileHistoryCapture`)。反向钉:core 改名 / 退役 ⇒ 红。 */
 type RunnerDepsLedgerWired = "fileHistoryCapture";
 type _GuardLedgerRunnerDepsReverse = AssertAllKeysHandled<Exclude<RunnerDepsLedgerWired, keyof RunnerDeps>>;
 export type CoreKeysetGuards = [
@@ -388,6 +392,8 @@ export type CoreKeysetGuards = [
     _GuardWiringAutoModeReverse,
     _GuardWiringPermissionMode,
     _GuardWiringPermissionModeReverse,
+    _GuardWiringSessionRules,
+    _GuardWiringSessionRulesReverse,
     _GuardWiringGovernance,
     _GuardWiringGovernanceReverse,
     _GuardPermissionTrace,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -98,7 +98,7 @@ export declare function redactNoticeMessage(message: unknown): string;
  * 通告 `detail` 里的**规则文本**换成条目的脱敏原值({@link redactListEntry}:凭据换记号,不加引号、不转义 —— 机读位不是显示面,显示形只属于人读句)。
  * 会话流行(经 {@link engineNoticeEventData},之后照常过 {@link sanitizeNoticeDetail})与运维日志行(`boot/runner-deps.ts` 的转发席,其余字段逐字)
  * 同调这一只 ⇒ 两条出路上同一条规则文本逐字节同(会话流行另有 detail 串的 {@link NOTICE_TEXT_MAX} 字上限,超长的那一截只在日志行上),两只码里同一条
- * 规则文本也同 —— core 7.53.0(#1884)起引擎交来的两形就是同一只读法的产物(原串,长于 1 024 码点的截到 1 024 + 一枚截断记号;修前 `rule_row_dropped`
+ * 规则文本也同 —— core 7.53.0([ref])起引擎交来的两形就是同一只读法的产物(原串,长于 1 024 码点的截到 1 024 + 一枚截断记号;修前 `rule_row_dropped`
  * 交中和形,空白 / 超长的条目两只码不同)。其余字段、其余码原样。
  */
 export declare function redactNoticeRuleText(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
@@ -109,7 +109,7 @@ export declare function engineNoticeEventData(notice: {
 }, sessionId: string, nowMs: number): EngineNoticeWireRow;
 /**
  * 一条 run 腿注册进来的投递口。抛错由 {@link EngineNoticeRouter.route} 隔离(见那里的 fail-open 登记)。
- * 返回值只对 {@link EngineNoticeRouter.routeConfirmed} 有意义(S-928 codex r1-F2 / r2-F1):durable 口交回它那一次账本写的 thenable,
+ * 返回值只对 {@link EngineNoticeRouter.routeConfirmed} 有意义([ref] codex r1-F2 / r2-F1):durable 口交回它那一次账本写的 thenable,
  * 兑现 `true` = 这一帧落进了账本;`false` / 拒绝 = 没落(写失败已由口自己留痕);同步口(live SSE)不交 thenable,**不是**落账确认。`route()` 不读返回值。
  */
 export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => unknown;
@@ -163,7 +163,7 @@ export declare class EngineNoticeRouter {
         sessionId?: unknown;
     }, nowMs?: number): number;
     /**
-     * S-928(codex r1-F2 / r2-F1;[ref] opus 腿 L2 改按槽判):同一只扇出,但**等**每只口交回的持久化结果 —— 返回**确认落账**的口数:
+     * [ref](codex r1-F2 / r2-F1;[ref] opus 腿 L2 改按槽判):同一只扇出,但**等**每只口交回的持久化结果 —— 返回**确认落账**的口数:
      * 只数 **`durable` 槽**里交回 thenable 且兑现 `true` 的口;兑现 `false` / 拒绝不算;`live` 槽**结构上不计**(不管它返回什么 —— 流上的人收没收到说明不了落账;
      * 修前按「交回 thenable」反推是不是 durable 口,哪天 live 口改成 async 返回 `true` 就会被计成落账)。给「投出之后要记一笔『告知过』」的铸点用:
      * 记账必须跟在**落账**之后,不能跟在「调用了口」之后(后台腿唯一的口是事件账 append,写失败时 `route()` 的计数照样是 1)。判据(白名单 / 归属 / 最新代 / 隔离)与 `route()` 逐字同一条。
@@ -195,7 +195,7 @@ export declare function registerEngineNoticeLeg(opts: {
     durable?: EngineNoticeWireSink;
     router?: EngineNoticeRouter;
     /**
-     * L-167 —— **腿开张之前**就已经铸好的通告(装配期 `resolveSpec` 的产物,经
+     * [ref] —— **腿开张之前**就已经铸好的通告(装配期 `resolveSpec` 的产物,经
      * `PreparedTaskSubmission.engineNotices` 递过来)。注册完口**立刻**经同一只 {@link EngineNoticeRouter.route}
      * 投出:白名单、归属键、消毒、隔离四件判据一个都不绕,**不是**第二条投递机制 —— 只是把 `route()` 挪到
      * 「这条会话已经有口在听」的那一拍。

package/dist/trace/engine-notice-wire.js

@@ -43,6 +43,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "route.credential_origin_mismatch",
     "mods.registration_refused",
     "config.session_rules_earlier_grammar",
+    "advisor.not_attached",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/exit-seat.d.ts

@@ -7,7 +7,13 @@ export type SafeText = string & {
 /**
  * **座表(闭集;一行 = 一类出口)**。加一类出口 = 加一行;表外的座名是编译错误。
  *  · `trace-frame-text`:trace 帧的自由文本位(子代名 / 动作行 / 通告正文与结果 / 诊断 / 注入摘录 / 压缩说明 / 人类输入的署名与附件标签 …),不设界;
- *  · `trace-frame-line`:trace 帧里一行宽的展示位(`workspace_changed.cwd` / `brain_status.detail`),界 300 码元。
+ *  · `trace-frame-line`:trace 帧里一行宽的展示位(`workspace_changed.cwd` / `brain_status.detail`),界 300 码元;
+ *  · `operator-log-text`:运维日志字段里的一句话 —— 读口坏行的缺陷句(core 的筛按位置点名并回显落盘标量)、`tool_trace` 行里工具的输出 / 失败句 / 拒因、
+ *    hook 吐出的预览(非 JSON 的输出 / 应答体)与判词、Stop 评估者回话的头、观察面回调与唤醒投递抛出的句子、matcher 超预算的那两串、标题器的两只失败句;界 200 码元(含截断记号);
+ *  · `operator-log-arg`:运维日志字段里模型写的工具入参(`tool_trace` 的 `arg.*`:路径 / 命令 / 模式 / 非对象入参的串形);界 120 码元(含截断记号);
+ *  · `operator-log-error`:运维日志字段里 hook 一侧的报错 —— hook 命令的 stderr、prompt 条目的载体失败句、起子进程 / 读会话分支抛出的句子;界 300 码元(含截断记号);
+ *  · `operator-log-message`:运维日志字段里写给人看的一段话 —— hook 输出的 `systemMessage`、Stop 评估者判「做不到」的理由;界 500 码元(含截断记号);
+ *  · `session-title`:自动标题器落行的会话标题(落库 / 列表面 / `session_titled` 帧同一份);界 80 码元(含截断记号),在 `title` 列宽之内。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -17,8 +23,41 @@ declare const EXIT_SEATS: {
         readonly scope: "free-text";
         readonly maxChars: 300;
     };
+    readonly "operator-log-text": {
+        readonly scope: "free-text";
+        readonly maxChars: 200;
+        readonly emit: "log-line";
+    };
+    readonly "operator-log-arg": {
+        readonly scope: "free-text";
+        readonly maxChars: 120;
+        readonly emit: "log-line";
+    };
+    readonly "operator-log-error": {
+        readonly scope: "free-text";
+        readonly maxChars: 300;
+        readonly emit: "log-line";
+    };
+    readonly "operator-log-message": {
+        readonly scope: "free-text";
+        readonly maxChars: 500;
+        readonly emit: "log-line";
+    };
+    readonly "session-title": {
+        readonly scope: "free-text";
+        readonly maxChars: 80;
+        readonly emit: "title-line";
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
+/** 设了界的座名。 */
+export type BoundedExitSeat = {
+    [K in ExitSeat]: (typeof EXIT_SEATS)[K] extends {
+        readonly maxChars: number;
+    } ? K : never;
+}[ExitSeat];
+/** 一行的界(码元;含截断记号)—— 界的唯一属主是座表,站点要用这个数(显示预算、文档钉)就读它,不另抄一份。 */
+export declare function seatMaxChars(seat: BoundedExitSeat): number;
 /**
  * 出口座:`seat` 是座表的一行,`text` 是要出门的自由文本。返回的 {@link SafeText} 就是这个出口该写出去的字节。
  * 表外的座名(只有绕过类型才到得了)⇒ 抛 —— 那是调用方的编程错,不是脱敏失败,不吞成占位。