@sema-agent/server 7.134.0 → 7.135.0

package/dist/http/checkpoint-ctx.js

@@ -125,13 +125,15 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
 }
 export const CHECKPOINT_CTX_SEAL_ALG = "checkpoint-ctx-sealedbox-v1";
 export const CHECKPOINT_CTX_CREDENTIAL_SLOTS = [
-    { path: ["mcpServers", "*", "transport", "headers"], holds: "map" },
-    { path: ["mcpServers", "*", "transport", "env"], holds: "map" },
-    { path: ["a2aPeers", "*", "headers"], holds: "map" },
-    { path: ["settings", "env"], holds: "map" },
-    { path: ["settings", "webSearch", "apiKey"], holds: "value" },
-    { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map" },
+    { path: ["mcpServers", "*", "transport", "headers"], holds: "map", since: 1 },
+    { path: ["mcpServers", "*", "transport", "env"], holds: "map", since: 1 },
+    { path: ["a2aPeers", "*", "headers"], holds: "map", since: 1 },
+    { path: ["settings", "env"], holds: "map", since: 1 },
+    { path: ["settings", "webSearch", "apiKey"], holds: "value", since: 1 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "headers"], holds: "map", since: 1 },
+    { path: ["settings", "hooks", "*", "*", "hooks", "*", "plugin", "options"], holds: "map", since: 2 },
 ];
+export const CHECKPOINT_CTX_CREDENTIAL_GENERATION = Math.max(...CHECKPOINT_CTX_CREDENTIAL_SLOTS.map((slot) => slot.since));
 export const CHECKPOINT_CTX_UNSEALABLE_REASONS = ["no_key_store", "key_not_held", "unopenable", "plaintext", "unrecognized_seal"];
 export class CheckpointCtxUnsealableError extends Error {
     field;
@@ -146,7 +148,7 @@ export class CheckpointCtxUnsealableError extends Error {
 function mintSealedCheckpointCtx(sealed) {
     return sealed;
 }
-export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
+export const CHECKPOINT_CTX_SEALING_REQUIRED = "a durable checkpoint store is wired but checkpointCtxSealing is not: suspended tasks keep the request's credentials (MCP / A2A headers and env values, settings.env, settings.webSearch.apiKey, http hook headers, command hook plugin options) in their resume context, and they are stored sealed or not at all — give the service a sealed-key store for them (this service builds it under <data root>/sealed-key/checkpoint-ctx-keys/ at boot; a failure there is the earlier checkpoint_ctx_sealing_unavailable warning — make that directory creatable and chmod-able by the service, or repair or remove a key file there whose public and private halves do not belong together), or, when embedding, pass checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir); refusing to start rather than write credentials in plaintext";
 const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 export function isSealedCheckpointValue(v) {
     if (!isRecord(v))
@@ -160,7 +162,7 @@ function defineOwn(target, key, value) {
 function mapCredentialSlots(body, visit) {
     let out = body;
     for (const slot of CHECKPOINT_CTX_CREDENTIAL_SLOTS)
-        out = mapAt(out, slot.path, 0, slot.holds, "", visit);
+        out = mapAt(out, slot.path, 0, slot.holds, "", (value, field) => visit(value, field, slot));
     return out;
 }
 function mapAt(node, path, i, holds, field, visit) {
@@ -213,42 +215,70 @@ function memberField(field, key) {
 }
 function sealBody(body, sealer, sessionId) {
     let valuesSealed = 0;
-    const sealed = mapCredentialSlots(body, (value, field) => {
+    let generation = 1;
+    const sealed = mapCredentialSlots(body, (value, field, slot) => {
         if (sealer === undefined)
             throw new CheckpointCtxUnsealableError(field, "no_key_store");
         valuesSealed += 1;
+        generation = Math.max(generation, slot.since);
         return sealer.seal(value, sessionId);
     });
-    return { body: sealed, valuesSealed };
+    return { body: sealed, valuesSealed, generation };
 }
 export function sealCheckpointCtx(ctx, sealer, sessionId) {
-    const { body } = sealBody(ctx.body, sealer, sessionId);
-    return mintSealedCheckpointCtx({ ...ctx, body: body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG });
+    const { body, generation } = sealBody(ctx.body, sealer, sessionId);
+    return mintSealedCheckpointCtx({ ...ctx, body: body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation });
+}
+const CREDENTIAL_GENERATION_FIELD = "credentialSlotGeneration";
+function credentialStampOf(stored) {
+    const stamp = stored.credentialSeal;
+    const raw = stored.credentialSlotGeneration;
+    const generation = raw === undefined ? 1 : Number.isInteger(raw) && raw >= 1 && raw <= CHECKPOINT_CTX_CREDENTIAL_GENERATION ? raw : undefined;
+    return { stamp, generation };
+}
+function credentialValueReading(row, slot, value) {
+    if (row.stamp === undefined)
+        return "plaintext";
+    if (row.stamp !== CHECKPOINT_CTX_SEAL_ALG || row.generation === undefined)
+        return "unrecognized_seal";
+    if (slot.since > row.generation)
+        return "plaintext";
+    if (isSealedCheckpointValue(value))
+        return "seal";
+    if (isRecord(value) && Object.hasOwn(value, "sealed"))
+        return "unrecognized_seal";
+    return "plaintext";
 }
 export function openCheckpointCtx(stored, opener, sessionId) {
-    const { credentialSeal, ...rest } = stored;
-    const stamp = credentialSeal;
+    const { credentialSeal: _stamp, credentialSlotGeneration: _generation, ...rest } = stored;
+    const row = credentialStampOf(stored);
+    if (row.stamp === CHECKPOINT_CTX_SEAL_ALG && row.generation === undefined)
+        return { kind: "unsealable", field: CREDENTIAL_GENERATION_FIELD, reason: "unrecognized_seal" };
     try {
-        const body = mapCredentialSlots(stored.body, (value, field) => {
-            if (stamp === undefined)
-                throw new CheckpointCtxUnsealableError(field, "plaintext");
-            if (stamp !== CHECKPOINT_CTX_SEAL_ALG)
-                throw new CheckpointCtxUnsealableError(field, "unrecognized_seal");
-            if (isSealedCheckpointValue(value)) {
-                if (opener === undefined)
-                    throw new CheckpointCtxUnsealableError(field, "no_key_store");
-                if (!opener.holds(value.publicKeyId))
-                    throw new CheckpointCtxUnsealableError(field, "key_not_held");
-                try {
-                    return opener.open(value, sessionId);
+        const body = mapCredentialSlots(stored.body, (value, field, slot) => {
+            const reading = credentialValueReading(row, slot, value);
+            switch (reading) {
+                case "plaintext":
+                case "unrecognized_seal":
+                    throw new CheckpointCtxUnsealableError(field, reading);
+                case "seal": {
+                    const sealed = value;
+                    if (opener === undefined)
+                        throw new CheckpointCtxUnsealableError(field, "no_key_store");
+                    if (!opener.holds(sealed.publicKeyId))
+                        throw new CheckpointCtxUnsealableError(field, "key_not_held");
+                    try {
+                        return opener.open(sealed, sessionId);
+                    }
+                    catch {
+                        throw new CheckpointCtxUnsealableError(field, "unopenable");
+                    }
                 }
-                catch {
-                    throw new CheckpointCtxUnsealableError(field, "unopenable");
+                default: {
+                    const unreachable = reading;
+                    return unreachable;
                 }
             }
-            if (isRecord(value) && Object.hasOwn(value, "sealed"))
-                throw new CheckpointCtxUnsealableError(field, "unrecognized_seal");
-            throw new CheckpointCtxUnsealableError(field, "plaintext");
         });
         return { kind: "ok", ctx: { ...rest, body: body } };
     }
@@ -270,12 +300,21 @@ export function sealedCredentialFieldOf(stored) {
     return first;
 }
 export function sealStoredCheckpointCtxM28(stored, sealer, sessionId) {
-    if (stored.credentialSeal !== undefined)
-        return undefined;
+    const row = credentialStampOf(stored);
     const body = stored.body;
     if (!isRecord(body))
         return undefined;
-    const out = sealBody(body, sealer, sessionId);
-    return out.valuesSealed === 0 ? undefined : { ctx: mintSealedCheckpointCtx({ ...stored, body: out.body, credentialSeal: CHECKPOINT_CTX_SEAL_ALG }), valuesSealed: out.valuesSealed };
+    let valuesSealed = 0;
+    let generation = 1;
+    const sealed = mapCredentialSlots(body, (value, _field, slot) => {
+        generation = Math.max(generation, slot.since);
+        if (credentialValueReading(row, slot, value) !== "plaintext")
+            return value;
+        valuesSealed += 1;
+        return sealer.seal(value, sessionId);
+    });
+    return valuesSealed === 0
+        ? undefined
+        : { ctx: mintSealedCheckpointCtx({ ...stored, body: sealed, credentialSeal: CHECKPOINT_CTX_SEAL_ALG, credentialSlotGeneration: generation }), valuesSealed };
 }
 //# sourceMappingURL=checkpoint-ctx.js.map

package/dist/http/dispatch.d.ts

@@ -1,12 +1,12 @@
 /**
- * 请求流水线(S-147 切片:`http/server.ts` 的 `handle()` 与它的模块级词表搬家;S-146 再把「这是什么路由」
+ * 请求流水线([ref] 切片:`http/server.ts` 的 `handle()` 与它的模块级词表搬家;[ref] 再把「这是什么路由」
  * 整件事交给 `./route-table.ts`)。
  *
  * 住在这里的是**一条请求从进门到落地**的全过程,一件事一遍:admission 计数 / 附着登记 / CORS / /health /
  * /metrics / 鉴权桥 / 全局服务凭据门 / 无凭据写门 / drain 与 roster-pending 两道 503 / 破坏性会话写门 /
  * 两段分派 / 全局 404。
  *
- * 🔴 S-146 之后本文件**不再持有任何一份路由名单**:分派序、门侧、标签、三只门的判据全部读
+ * 🔴 [ref] 之后本文件**不再持有任何一份路由名单**:分派序、门侧、标签、三只门的判据全部读
  * `ROUTES` / `ROUTE_DECLARATIONS`(见 route-table.ts 头注)。三道门也不再「按行号插在 37 只 if 中间」——
  * 它们在门前段与门后段之间**恒定一处**执行,三段代码逐字未动,只是不再被域调用夹着。
  *
@@ -19,7 +19,7 @@ import type { ServiceConfig } from "../config-types.js";
 import type { RouteCtxBase, RunRegistry } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
 /**
- * 🔴 S-672(test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
+ * 🔴 [ref](test T-72 [ref];主会话裁 ①,分诊 [ref])—— 全局服务凭据门**之前**那几族只读路
  * (`route-table.ts` 里 `position: "read-credential"` 的行)的**唯一**鉴权谓词:「服务凭据 ∨ 已验 principal」。
  *
  * 病:这几族(trace-usage / workflows / fleet)排在全局门之前,理由只有一条 —— 只读 `TRACE_TOKEN` 单凭据的调用方

package/dist/http/durable-run-leg.js

@@ -12,6 +12,7 @@ import { recordResourceWindow } from "../resource-window.js";
 import { persistSubmitCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { serviceVersion } from "../service-version.js";
+import { headReadOf } from "../session-incarnation.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -59,10 +60,10 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     }
     commitSessionInheritEnv(deps, args.prepared.spec.sessionId, args.prepared.body);
     const anchorOwner = args.prepared.auth?.principal ?? null;
-    const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-    const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
+    const headOf = headReadOf(deps.sessionStorage);
+    const captureTurnAnchor = deps.resumeAnchorStore && headOf
         ? async (eventId) => {
-            const leaf = await getLeafId(sessionId);
+            const leaf = (await headOf(sessionId))?.leafId;
             if (leaf)
                 await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner);
         }

package/dist/http/idempotency.d.ts

@@ -109,7 +109,7 @@ export declare function submissionIdemOf(raw: string, caller: IdemCaller, body:
  */
 export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFace, clientTaskId?: string): string;
 /**
- * 提交腿的**运行结局**(在飞合流共享的那一只)—— `status` + `body` 是它一直以来的两位;S-528 起多一位
+ * 提交腿的**运行结局**(在飞合流共享的那一只)—— `status` + `body` 是它一直以来的两位;[ref] 起多一位
  * `wiringManifest`。
  *
  * 🔴 **为什么回执挂在 outcome 上、不铸进 `body`**(codex 对抗复审 [medium],红先复现后修):在飞合流按资源族
@@ -132,7 +132,7 @@ export declare function inflightKeyOf(idem: RunIdemBinding, face: SubmitReplayFa
 export interface SubmitOutcome {
     status: number;
     body: unknown;
-    /** S-528:本条 run 的起手接线回执(present-iff 引擎真产了 `wiring_manifest` 帧)。 */
+    /** [ref]:本条 run 的起手接线回执(present-iff 引擎真产了 `wiring_manifest` 帧)。 */
     wiringManifest?: WiringManifestReceipt;
 }
 //# sourceMappingURL=idempotency.d.ts.map

package/dist/http/mcp-dial-deadline.d.ts

@@ -1,10 +1,10 @@
 /**
- * S-431 —— 一条 HTTP 请求愿意等**一次远端 MCP 拨号**多久:**一只数、一只 helper**,两口共读。
+ * [ref] —— 一条 HTTP 请求愿意等**一次远端 MCP 拨号**多久:**一只数、一只 helper**,两口共读。
  *
  * 同一类动作(连一台远端 MCP 服务器 + 列它的工具)在本仓有两张 HTTP 面:
  *  · `GET /v1/sessions/:id/mcp` 面板(`routes/sessions.ts`)—— 物化部署缺省场景的申报,到点答 200 `degraded:true`;
  *  · `POST /v1/sessions/:id/mcp/reconnect`(`routes/mcp-reconnect.ts`)—— 在飞 run 上重拨一台,到点答 503。
- * 修前面板有期限、reconnect 是裸 `await`(S-431):同一件事两个读法,一台拨不通 / 半开的远端能把后者挂很久。
+ * 修前面板有期限、reconnect 是裸 `await`([ref]):同一件事两个读法,一台拨不通 / 半开的远端能把后者挂很久。
  * 两口各自**到点答什么**不同(面板是只读的部署面,有一个诚实的空形;reconnect 是一次交易,没有结果就没有
  * 一个能当 `outcome` 的词)—— 但**等多久**是一个事实,所以只有一个数。
  *
@@ -26,9 +26,11 @@ export declare class DeadlineExceeded extends Error {
  * 让**应答**不再等 `work`:`work` 先落定就原样交出(resolve / reject 都不变形),期限先到就 reject
  * {@link DeadlineExceeded}。
  *
- * 🔴 **只界应答,不取消 `work`**:本函数不持有任何取消把手 —— core 的 `TaskStream.reconnectMcpServer` 与
- * `materializeMcpTools` 都不收 `AbortSignal`(d.ts 逐字),所以期限到点后底层拨号**继续跑**,落定时
- * 才释放它占的连接 / 子进程。调用点必须把这句话交代给调用方(reconnect 的 503 文案、契约 §G.7c)。
+ * 🔴 **只界应答,本身不取消 `work`**:本函数不持有任何取消把手 —— 取消是调用点的事,两口各自读 core 动词的形:
+ *  · 面板的 `materializeMcpTools` 自 core 7.55.0([ref])起收末位 `signal`:面板在期限到点时触发它,在飞的拨号就停、半开连接被关
+ *    (`routes/sessions.ts`);
+ *  · reconnect 的 `TaskStream.reconnectMcpServer(server)` 仍不收 `AbortSignal`(d.ts 逐字)⇒ 期限到点后底层重拨**继续跑**,落定时
+ *    才释放它占的连接 / 子进程。这一口必须把这句话交代给调用方(reconnect 的 503 文案、契约 §G.7c)。
  * 迟到的落定(尤其迟到的 reject)挂一条吞掉,免得没人 await 它时变成未处理拒绝。
  */
 export declare function raceDeadline<T>(work: Promise<T>, deadlineMs: number): Promise<T>;

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -1,16 +1,16 @@
 /**
- * S-930 —— 记忆合规面(抹除 / 出处)上 core **已分类拒**的**唯一** HTTP 映射。两面同调:
+ * [ref] —— 记忆合规面(抹除 / 出处)上 core **已分类拒**的**唯一** HTTP 映射。两面同调:
  *  · operator 面 `routes/memory-compliance.ts`(`POST /v1/memory/erase` · `GET /v1/memory/entries/:entryId/provenance`);
  *  · 会话所有者自助抹除面 `routes/sessions.ts`(`POST /v1/sessions/:id/memory/erase`)。
  *
- * ## 病(sdk 车 SH 黑盒实证,S-930)
+ * ## 病(sdk 车 SH 黑盒实证,[ref])
  * 修前自助面在路由里自写了一份更窄的分类:只认 `config.memory_erasure_request`(400)与 `memory.target_outside_store`(409),
  * core 的另外三只 409 与 `ControlPlaneCorruptError` 全落 500 `internal.error` —— 「同一个 requestId 拿去抹另一个会话」这种**调用方自己
  * 能改**的错被说成服务器坏了。两份分类 = 两个判官,少的那份恒是静默的一份。现在**码与状态**只在这里判一次,两面同读。
  *
  * ## 规则(三层,与 operator 面既有层序逐字同序)
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
- *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 #1094)/ `memory.scope_home_not_directory`(core 7.44.0 #1368)—— 跨面 store 状态码,409、码原样
+ *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 [ref])/ `memory.scope_home_not_directory`(core 7.44.0 [ref])—— 跨面 store 状态码,409、码原样
  *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);
  *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
  *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
@@ -30,7 +30,7 @@ import type { ServerResponse } from "node:http";
 import type { Logger } from "../observability/logger.js";
 /**
  * 已分类拒 → HTTP 状态的**唯一**码表 = 自铸 wire 值登记处的 `sessionMemoryEraseStatus` 集(F3:wire 变更清单从同一张表 diff,状态改一处、
- * 清单跟着列)。两面同读(S-930:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
+ * 清单跟着列)。两面同读([ref]:码与状态只判一次)。键写错 ⇒ tsc 红(索引的是 `as const` 表的键)。
  */
 /** 读这张映射的受众(闭集)。会话所有者受众必须交一只 `withheld` —— 被换成固定句的 core 原句落到那里(运维材料不许丢)。 */
 export type MemoryComplianceAudience = {

package/dist/http/owner-access.d.ts

@@ -1,5 +1,5 @@
 /**
- * 🔴 **属主存取器**(S-487 RH-3 第一期)——「这个调用方读得到这一行 run / 会话吗」的行只经这里取得。
+ * 🔴 **属主存取器**([ref] RH-3 第一期)——「这个调用方读得到这一行 run / 会话吗」的行只经这里取得。
  *
  * ## 律(一条)
  * 判官只有一只:run 行 = `principal-gate.ts` 的 `runOwnerReadable`(三条放行臂,含 [ref] C8 窄互认),会话行 = `sessionOwnerReadable`
@@ -39,14 +39,12 @@ export declare function readOwnedRun(config: OwnerAccessConfig, runStore: {
     getRun(taskId: string): Promise<RunRecord | undefined>;
 }, principal: Principal | undefined, taskId: string, arm: OwnerArm): Promise<RunRecord | undefined>;
 /**
- * 会话行读口:属主一读 + 无主时 placement 一格(`sessionOwnerCellOf`,S-1770)+ 会话面判官。`undefined` = 没有这只会话(`ownerOf` 答 `undefined`)≡ 读不到。
- * 读回的那一格交给调用点(要按属主作答的口用它)。店的读失败照常抛(500,绝不当成「读不到」或「读得到」)。
+ * 会话行读口:属主一读(会话店唯一的按 id 读 `headOf(id)?.owner`)+ 无主时 placement 一格(`sessionOwnerCellOf`,[ref])+ 会话面判官。
+ * `undefined` = 没有这只会话(头读答 `undefined`)≡ 读不到。读回的那一格交给调用点(要按属主作答的口用它)。店的读失败照常抛(500,绝不当成「读不到」或「读得到」)。
  */
 export declare function readOwnedSession(w: IdentityWiring & {
     readonly config: OwnerAccessConfig;
-}, store: Pick<OwnerAwareSessionStore, "placementOf"> & {
-    ownerOf(sessionId: string): Promise<string | null | undefined>;
-}, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<SessionOwnerCell | undefined>;
+}, store: Pick<OwnerAwareSessionStore, "placementOf"> & Required<Pick<OwnerAwareSessionStore, "headOf">>, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<SessionOwnerCell | undefined>;
 /**
  * leader 登记表的判官形(boot 装配一次,`createLeaderEndpoint` 的必填席)—— leader 模块不再自判属主(修前它手抄 `owner == null || owner === requester`,
  * 缺 C8 窄互认臂而注称 mirrors runOwnerOk)。leader 腿的调用方身份经幂等身份结构(`IdemCaller.principal`,即 `gatedPrincipal` 的回值)转手而来,

package/dist/http/owner-access.js

@@ -30,7 +30,7 @@ export async function readOwnedRun(config, runStore, principal, taskId, arm) {
     return row !== undefined && runRowReadable(config, principal, row.owner, arm) ? row : undefined;
 }
 export async function readOwnedSession(w, store, caller, sessionId, arm) {
-    const owner = await store.ownerOf(sessionId);
+    const owner = (await store.headOf(sessionId))?.owner;
     if (owner === undefined)
         return undefined;
     const cell = await sessionOwnerCellOf(store, sessionId, owner);

package/dist/http/principal-gate.d.ts

@@ -42,7 +42,7 @@ export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConf
  */
 export declare function principalTokenPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
 /**
- * 🔴 **`requirePrincipal` 部署上「这次请求没有可用身份」的唯一 401 铸点**(S-305,7.76.2)。
+ * 🔴 **`requirePrincipal` 部署上「这次请求没有可用身份」的唯一 401 铸点**([ref],7.76.2)。
  *
  * 此前 45 个路由各自手抄同一行 `sendError(res, 401, "auth.principal_required", …)`,于是直连门上
  * 「JWT 出示了但过期/签不上」与「什么头都没带」在 wire 上**同形**(黑盒实测:plan_review 带过期 JWT
@@ -56,7 +56,7 @@ export declare function principalTokenPresentedButUnverified(req: IncomingMessag
  */
 export declare function sendPrincipalRefusal(res: ServerResponse, req: IncomingMessage, config: ServiceConfig): void;
 /**
- * 🔴 **`401 auth.unauthorized` 的唯一铸点**(S-850,7.104.0;test [ref] QA 7a C15)。
+ * 🔴 **`401 auth.unauthorized` 的唯一铸点**([ref],7.104.0;test [ref] QA 7a C15)。
  *
  * 病:十六处路由(9 个文件)各自手抄同一个 401 —— 码 `auth.unauthorized`、message 就一个词 `unauthorized`。照 sema-up 部署、壳接上
  * 引擎后,第一句就撞上它,不说要哪份凭据、放哪、去哪拿。
@@ -78,7 +78,7 @@ export declare const UNAUTHORIZED_OPERATOR = "unauthorized \u2014 this endpoint
 export declare const UNAUTHORIZED_IDENTITY = "unauthorized \u2014 this endpoint acts for a named caller and the request carries no caller identity this deployment verifies: identify the caller the way this deployment does (a registry sign-in token as the Bearer token, a signed principal token on a direct-door deployment, or the principal header set by a trusted front end)";
 export declare function sendUnauthorized(res: ServerResponse, face: UnauthorizedFace): void;
 /**
- * 🔴 **「这个调用方读得到这一行 run 吗」的唯一谓词**(S-297 抽取;此前只活在 `server.ts runOwnerOk` 的
+ * 🔴 **「这个调用方读得到这一行 run 吗」的唯一谓词**([ref] 抽取;此前只活在 `server.ts runOwnerOk` 的
  * 函数体里,而 `runOwnerOk` 把**判断**与**404 怎么发**焊在一起 —— 于是任何需要同一条判断但不想 404 的
  * 读面(如 `/mcp` 面板的 `lastLegMcp`:非属主就不投这个键、面板照常 200)只能手抄一份,而手抄那份必然
  * 漏掉下面这条窄互认臂:`explicitOperatorOk` 顶注已经为同族的病写过「SINGLE mint point,不要再造兄弟」)。
@@ -112,7 +112,7 @@ export interface IdentityWiring {
  */
 export declare function wiredIdentitySources(w: IdentityWiring): readonly IdentitySource[];
 /**
- * 🔴 **「这台部署有没有身份边界」的唯一判据**(S-1452;S-1509 改读身份来源)。dev-open = 装配**没接任何身份来源**({@link wiredIdentitySources} 为空:
+ * 🔴 **「这台部署有没有身份边界」的唯一判据**([ref];[ref] 改读身份来源)。dev-open = 装配**没接任何身份来源**({@link wiredIdentitySources} 为空:
  * 没配 service token、没装鉴权桥、没开直连门)、**也没声明**只读 trace token 或 `REQUIRE_PRINCIPAL`:请求里没有任何东西替主体头作保,头是谁都能自报的
  * **标签**(过滤 / 展示用),不是身份。装了鉴权桥的部署(SSO 单开)带登录令牌的调用方是验过的身份 ⇒ 不是 dev-open(修前只看 token / `REQUIRE_PRINCIPAL`,
  * 这一形被读成 dev-open,任何人 fleet-wide 读全部会话)。
@@ -151,7 +151,7 @@ export declare function fleetViewOf(req: IncomingMessage, w: IdentityWiring, fac
  * 面板的上一腿 MCP 投影)。没有身份边界的部署({@link devOpenDeployment})上不钉任何人(与会话列表同读,列表把这只会话列给谁,谁就读得到它);
  * 有身份边界的部署上:
  *  · **无主的行**经无主臂的唯一判据 `ownerlessRowOpen`(`security.ts`):普通会话照旧对任何调用方开放;委派子代的 placed 行只对 fleet 调用方
- *    ({@link sessionCallerOf})开放 —— 任何具名主体、没有 service 凭据的无身份调用方都与别人的行同体(调用点答 404)(S-1770)。
+ *    ({@link sessionCallerOf})开放 —— 任何具名主体、没有 service 凭据的无身份调用方都与别人的行同体(调用点答 404)([ref])。
  *    代价如实:属主还没定下的子代行连它将来的属主也暂时读不到(由一次性迁移 M23 / 那一行的下一次停驻定下);
  *  · 有主的行就是 run 面那一条谓词({@link runOwnerReadable}),一字不变。
  * run 面(poll / events / cancel …)不读本谓词 —— 那是 run 资源的门,另一只。
@@ -163,7 +163,7 @@ export declare function sessionOwnerReadable(caller: SessionCaller, cell: Sessio
  */
 export type OperatorRoster = Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
 /**
- * 🔴 **「谁是 operator」的唯一读法**(S-1050,[ref] ① 裁 A;IMAGE-API-DESIGN.md §P2.4a MUST-FIX 的那一只门)。
+ * 🔴 **「谁是 operator」的唯一读法**([ref],[ref] ① 裁 A;IMAGE-API-DESIGN.md §P2.4a MUST-FIX 的那一只门)。
  *  · 名单为空 ⇒ **没人是**(没有任何形把「空名单」读成「人人是」—— 那条读法 `isOperator` 已删);
  *  · 名单非空 ⇒ 验过的主体在名单里才是;
  *  · 单用户形显式声明 `OPERATOR_SINGLE_USER=true` ⇒ 这台部署的**每个调用方**都是(单用户形只有一位用户,能到这台部署的就是他;边界是部署自己的
@@ -175,7 +175,7 @@ export declare function explicitOperatorOk(principal: string | undefined, roster
 /** 「这台部署**有没有**运维」的唯一读法(名单非空 ∨ 单用户声明在场)—— 能力事实 `operatorLane`、整理阀门的可达性告警、起服提示同读这一只。 */
 export declare function operatorRosterPresent(roster: OperatorRoster): boolean;
 /**
- * 起服提示(S-1050):单用户形(`REQUIRE_PRINCIPAL` 未开)+ 没有运维名册 + 这台部署有审批底座 ⇒ 一行 warn。这一形在「空名单 = 人人是」那条读法退役之后
+ * 起服提示([ref]):单用户形(`REQUIRE_PRINCIPAL` 未开)+ 没有运维名册 + 这台部署有审批底座 ⇒ 一行 warn。这一形在「空名单 = 人人是」那条读法退役之后
  * 丢的东西就是审批队列的运维视图(跨 scope 列表 / `?owner=` / 无主体调用方的整个队列),补回它只要一行配置 —— 不拒启:升级那一拍打掉一台今天跑得好好的
  * 单用户机器比一条提示重。多租形不提示(它另有拒启不变量);没有审批底座的形什么都没少。
  */

package/dist/http/principal-gate.js

@@ -1,4 +1,5 @@
 import { timingSafeEqual } from "node:crypto";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ownerlessRowOpen, mintPrincipal } from "../security.js";
 import { sendError } from "./send.js";
 export function headerStr(v) {
@@ -98,7 +99,7 @@ export function runOwnerReadable(principal, owner, config) {
         return true;
     if (principal !== undefined && sameIdentity(principal, owner))
         return true;
-    return !config.requirePrincipal && owner === "anon:shell-live" && principal === undefined;
+    return !DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(config) && owner === "anon:shell-live" && principal === undefined;
 }
 export function hasServiceAuth(config) {
     return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
@@ -121,7 +122,7 @@ export function wiredIdentitySources(w) {
     return IDENTITY_SOURCES.filter((k) => identitySourceWired(k, w));
 }
 export function devOpenDeployment(w) {
-    return wiredIdentitySources(w).length === 0 && !w.config.traceToken && !w.config.requirePrincipal;
+    return wiredIdentitySources(w).length === 0 && !w.config.traceToken && !DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(w.config);
 }
 export function actsForDeployment(req, config, principal) {
     return systemFor(req, config) !== undefined && principal() === undefined;

package/dist/http/readiness.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-739 / S-740(车OE,7.102.0):**就绪判的唯一属主** —— 一只谓词 {@link readinessOf},全部读点经它:
+ * [ref] / [ref](车OE,7.102.0):**就绪判的唯一属主** —— 一只谓词 {@link readinessOf},全部读点经它:
  *
  *  ① `GET /readyz`(`dispatch.ts`,凭据门之前,与 `/health` 同位):200 `{ready:true}` / 503 `{ready:false, reasons}` ——
  *     给**摘流**语义的探针(k8s readinessProbe / LB 健康检查);**重启**语义的探针(Docker HEALTHCHECK、k8s livenessProbe)

package/dist/http/request-guards.d.ts

@@ -1,5 +1,5 @@
 /**
- * 请求守门族(S-147 切片:`http/server.ts` 4837–5195 + `MAX_BODY` 逐字搬家,正文一字未改)。
+ * 请求守门族([ref] 切片:`http/server.ts` 4837–5195 + `MAX_BODY` 逐字搬家,正文一字未改)。
  * 配额 / 租约 / 用量窗 / 限流 / owner-scope / 体读取 —— 每只守门的判据与它自己的头注原位随行。
  * ctx 字段 1 只(`deps`):本族对外围的耦合就这一格,它也是这一族的可测性读数。
  */
@@ -21,7 +21,7 @@ import { type SqlWallSource, type SqlWallsReading } from "../plugins/sql-driver.
  * 入参是**已判好的墙**(`sql-driver.ts` `sqlWallsOf` —— 事实缺席时的落点只在那里定义,与 blob 帽同一只判官、同一个方向);本函数不读事实、不判缺席,
  * 墙从哪来(`sources` 里**被拒的那一堵**的出处)原样带进判决(`wallSource`),拒句按它分两形:库报的墙点名库的上限与旋钮,假定的墙(事实还没建立,或事实在场但这一堵读失败、退了文档缺省)只说「库的这个上限没读到、按最保守的墙拒」。
  *
- * 🔴 **包墙腿是同一只规则的提前一跑,不是第二套规则**(S-1746 主会话裁定):包墙是物理连接的事实(会话值,连接建立时从全局拷一份、此后不变),
+ * 🔴 **包墙腿是同一只规则的提前一跑,不是第二套规则**([ref] 主会话裁定):包墙是物理连接的事实(会话值,连接建立时从全局拷一份、此后不变),
  * 终判在将要执行写入的那条连接上 —— 那是库自己(续跑输入那一笔被拒 ⇒ 店的带码拒 ⇒ 同一个 413;会话日志那一笔走它既有的失败面);SQL 快照 blob 则由
  * `blob-backend.ts` 经 `connectJudged` 在写入连接上判。受理时手里没有那条连接,判官 `sqlWallsOf` 读的 `facts` 是池里**最近一次初始化**的那条连接的读数
  * (`SqlDriver.facts`:池见过的最新读数,只在有连接初始化时才更新),同一个折算 `packetWallStatementBytes`:拒 ⇒ 413 在任何副作用之前;收 ⇒ 写入那条连接上的判决仍是终判。
@@ -44,7 +44,7 @@ export interface SubmitBodyRefusal {
 }
 export declare function refuseSubmitBody(walls: SqlWallsReading, body: unknown): SubmitBodyRefusal | null;
 /**
- * S-866 ③ —— 租约拒绝的应答形({@link leaseRefusalOf} 的产物;`{status, body}` 交回形 + 镜像头用的 `retryAfterSec`)。
+ * [ref] ③ —— 租约拒绝的应答形({@link leaseRefusalOf} 的产物;`{status, body}` 交回形 + 镜像头用的 `retryAfterSec`)。
  * 体经唯一组句器铸(键序 `error, errorCode, …机读位`;冻结门 `FROZEN_RESULT_BODY` 读 `refusalBody({ errorCode, message, … })` 这一形)。
  */
 export interface LeaseRefusal {
@@ -53,7 +53,7 @@ export interface LeaseRefusal {
     readonly retryAfterSec: number;
 }
 /**
- * S-866 ③ —— 一次被拒的租约准入 → HTTP 应答的**唯一**映射(三只门 {@link createRequestGuards} 里的 `leaseDenied` /
+ * [ref] ③ —— 一次被拒的租约准入 → HTTP 应答的**唯一**映射(三只门 {@link createRequestGuards} 里的 `leaseDenied` /
  * `ownerLeaseDenied` / `ownerFleetLeaseDenied` 同调它;12 个调用点零改)。按拒因穷举(加一臂 = 编译红):
  *  · `budget_exhausted` ⇒ **429 `quota_exhausted`**(字节同 7.105.0 的路由发送形:`retryAfterSec` + 中心 E4 结构化字段逐字透传);
  *  · `lease_unavailable` ⇒ **503 `fleet.lease_unavailable`**(只在 `FLEET_LEASE_FAIL_CLOSED` 生效时出现):体 `{reason, retryAfterSec}`,

package/dist/http/request-guards.js

@@ -6,6 +6,7 @@ import { refusalBody } from "./refusal-body.js";
 import { limitFactsUnmeasured } from "../limit-refusal.js";
 import { gatedPrincipal, explicitOperatorOk, sessionOwnerReadable, sessionCallerOf, sendPrincipalRefusal } from "./principal-gate.js";
 import { runRowReadable } from "./owner-access.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { quotaWindowResetsAt } from "../observability/cost-quota.js";
 import { escapedStatementBytes, packetWallStatementBytes, rowWallPayloadBytes } from "../plugins/sql-driver.js";
 const MAX_BODY = 8 * 1024 * 1024;
@@ -186,7 +187,7 @@ export function createRequestGuards(ctx) {
     }
     function ownerGate(req, res, readable, notFound) {
         const principal = gatedPrincipal(req, deps.config);
-        if (deps.config.requirePrincipal && !principal) {
+        if (DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(deps.config) && !principal) {
             sendPrincipalRefusal(res, req, deps.config);
             return false;
         }

package/dist/http/resume-ctx-read.d.ts

@@ -1,8 +1,8 @@
 /**
- * **续跑上下文这一次读的结局**(S-577 第二半,7.94.0)—— 属主模块,所有消费腿共用这一只读口。
+ * **续跑上下文这一次读的结局**([ref] 第二半,7.94.0)—— 属主模块,所有消费腿共用这一只读口。
  *
  * 🔴 **为什么必须有这只铸点**:此前各消费腿各写一句 `.catch(() => null)`(还有一处把异常文案拼上 wire),
- * 于是店层在 S-577 里把坏体从「答缺席」改成「响亮拒」之后,那些 `catch` 会把那次拒**原样吞回缺席** ——
+ * 于是店层在 [ref] 里把坏体从「答缺席」改成「响亮拒」之后,那些 `catch` 会把那次拒**原样吞回缺席** ——
  * 机制上「坏体不再与缺席同答」成立,**用户面上不成立**(用户拿到的还是同一个 409)。判据要钉用户实际
  * 拿到的码,这只铸点就是让那句判据有地方落(test [ref] 的判据订正,当拍采纳)。
  *
@@ -16,13 +16,13 @@
  *    ⚠️ `not-text`(投影漂 = 我方的码病)**刻意不进这一态**,原样上抛、响亮成 500 —— 不许伪装成
  *    「数据坏了」,更不许折成缺席(那会让一次代码漂看起来像「这条会话没有上下文」)。
  *
- * 🔴 **按「店的拒绝形」分类,不按「列错误类」**(S-608,7.95.1:这一句此前反了,整整一版)。修前本口
+ * 🔴 **按「店的拒绝形」分类,不按「列错误类」**([ref],7.95.1:这一句此前反了,整整一版)。修前本口
  * 认的是属主谓词 `isJsonColumnBodyProblem`(= 一只 `SqlJsonColumnError`),而 SQL 两孪生的 `refusing()`
  * 早把列错误**折**成了一只普通 `Error` ⇒ 折后的错落进下面那条「店抖动 ⇒ 当缺席」臂,坏体与缺席在
- * 用户面上仍然同答 409 —— 正是 S-577 第二半要修的那个病,只是它当时只在 local 车道上修成了(那一侧
+ * 用户面上仍然同答 409 —— 正是 [ref] 第二半要修的那个病,只是它当时只在 local 车道上修成了(那一侧
  * 恰好没折码,把列错误漏了出来 = 巧合式正确)。两条车道现在同一份拒绝契约,本口只认它。
  *
- * 🔴 **第四态 `unsealable`(S-1907,7.134.0):读出来了,但凭据位上的封签开不开**。店交出的是**落盘形**(凭据位上是封签,`StoredCheckpointCtx`);
+ * 🔴 **第四态 `unsealable`([ref],7.134.0):读出来了,但凭据位上的封签开不开**。店交出的是**落盘形**(凭据位上是封签,`StoredCheckpointCtx`);
  * 本口在任何消费者看到之前经**唯一**开口 `openCheckpointCtx` 开封(规则属主 = `checkpoint-ctx.ts` 末段「凭据位密封」)—— 所以 `ok` 交出的恒是开封形,
  * 没有哪条腿拿着封签去重建 spec。开不开(没有保管店 / 钥匙不在本副本 / 密文坏或不是本行封的 / 明文 / 认不出的封签)⇒ `unsealable`(`field` + `reason`),
  * 各续跑入口答 {@link resumeCtxUnsealableAnswer}(409 `conflict.checkpoint_ctx_unsealable`)。**不折成缺席**(出路不同:缺席 = 重提;开不开 = 看 `reason`
@@ -69,7 +69,7 @@ export declare const KEEP_SEALED = "keep_sealed";
 export declare function readResumeCtx(load: Promise<StoredCheckpointCtx | null>, opening: CheckpointCtxOpening): Promise<ResumeCtxRead>;
 export declare function readResumeCtx(load: Promise<StoredCheckpointCtx | null>, opening: typeof KEEP_SEALED): Promise<SealedResumeCtxRead>;
 /**
- * 开不开的对外答复(S-1907)—— 409 `conflict.checkpoint_ctx_unsealable`,机读 `field`(哪一个凭据位,提交体路径;键名不是秘密,值从不进来)+ `reason`
+ * 开不开的对外答复([ref])—— 409 `conflict.checkpoint_ctx_unsealable`,机读 `field`(哪一个凭据位,提交体路径;键名不是秘密,值从不进来)+ `reason`
  * (闭集 `CHECKPOINT_CTX_UNSEALABLE_REASONS`)。句子说「这条任务的续跑上下文里带的凭据本服务开不开」、五种成因与出路(按 `reason` 修好保管目录后原样重发,
  * 或作为新任务重提、仍停驻的先取消)。拒在任何状态改动之前:卡仍待决、行字节不动、`plan_review` 的一次性 nonce 未烧。
  * 🔴 形是给冻结门看的(与 {@link resumeCtxCorruptAnswer} 同一条):`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
@@ -82,7 +82,7 @@ export declare function resumeCtxUnsealableAnswer(read: {
     body: RefusalBody;
 };
 /** 坏体的对外答复 —— 与会话策略面**同码**(`session-policy-wire.ts` 的 `corrupt` ⇒ 500),不铸新词。
- *  文案只说「哪一行读不出来 + 该找谁」,不把店层 detail 拼上 wire(内部机件不上 wire,S-376 同律)。 */
+ *  文案只说「哪一行读不出来 + 该找谁」,不把店层 detail 拼上 wire(内部机件不上 wire,[ref] 同律)。 */
 export declare function resumeCtxCorruptAnswer(where: string): {
     status: number;
     body: RefusalBody;

package/dist/http/resume-ctx-read.js

@@ -28,7 +28,7 @@ export function resumeCtxUnsealableAnswer(read) {
         status: 409,
         body: refusalBody({
             errorCode: "conflict.checkpoint_ctx_unsealable",
-            message: "this task's stored resume context holds credentials from its request (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, or http hook headers) that this server cannot unseal — reason says why: no_key_store (this server has no sealed-key store), key_not_held (they were sealed with a key this server does not hold: another replica's, or a replaced sealed-key directory), unopenable (the sealed value is damaged or belongs to another session), plaintext (an older server version stored them unsealed), unrecognized_seal (a seal format this version does not know). Nothing was decided and nothing was resumed. If whoever operates this deployment restores the sealed-key directory that sealed them and restarts this server (it reads its keys only at startup), the same request can be sent again; otherwise submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
+            message: "this task's stored resume context holds credentials from its request (MCP / A2A headers or env values, settings.env, settings.webSearch.apiKey, http hook headers, or command hook plugin options) that this server cannot unseal — reason says why: no_key_store (this server has no sealed-key store), key_not_held (they were sealed with a key this server does not hold: another replica's, or a replaced sealed-key directory), unopenable (the sealed value is damaged or belongs to another session), plaintext (an older server version stored them unsealed), unrecognized_seal (a seal format this version does not know). Nothing was decided and nothing was resumed. If whoever operates this deployment restores the sealed-key directory that sealed them and restarts this server (it reads its keys only at startup), the same request can be sent again; otherwise submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
             facts: {
                 field: read.field,
                 reason: read.reason,

package/dist/http/resume-legs.d.ts

@@ -1,5 +1,5 @@
 /**
- * 续跑腿家族 + 路由 ctx 的装配(S-147 切片:`http/server.ts` 2378–4804 与 1119–1128 逐字搬家,正文一字未改)。
+ * 续跑腿家族 + 路由 ctx 的装配([ref] 切片:`http/server.ts` 2378–4804 与 1119–1128 逐字搬家,正文一字未改)。
  *
  * 🔴 为什么 `routeCtxBase` 住在这个文件里而不是组合根:`startFreshHostTurn` 把**整只** ctx 交给
  * `mintAndDriveDurableRun`,而 `ctx.legs` 装的正是本文件这几条腿 —— 两者是一个结。拆开只有两条路:
@@ -8,7 +8,7 @@
  * 腿是提升的函数声明、ctx 是文件尾的 `const`,谁也不会在工厂执行期读到对方。
  *
  * ctx 字段 27 只(registry 6 + helpers 14 + deps/runnerFor/prepareSpec/finalizeTaskResult + 三只配额/租约/用量窗
- * 判据;S-947 删 `cancelledViaVerb` 旁表后 28 → 27,与 `test/split-ctx-parity.test.ts` 的读数同)—— 这是**如实披露**的耦合读数(设计稿 §9:把它变小是波 3 的事,本刀不承诺)。型一律从既有型派生
+ * 判据;[ref] 删 `cancelledViaVerb` 旁表后 28 → 27,与 `test/split-ctx-parity.test.ts` 的读数同)—— 这是**如实披露**的耦合读数(设计稿 §9:把它变小是波 3 的事,本刀不承诺)。型一律从既有型派生
  * (`RunRegistry` / `RouteHelpers` / `RouteLegs` / `ReturnType<typeof createRequestGuards>`),不手抄签名 ⇒ 不会漂。
  */
 import type { IncomingMessage } from "node:http";
@@ -29,7 +29,7 @@ import { type ResumeRefusalAnswer } from "./checkpoint-ctx.js";
  */
 export declare function resumeRefusalDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
 /**
- * 🔴 **引擎拒一次续跑(`CheckpointError`)的 HTTP 答复 —— 唯一组句器**(S-1690 / S-1692,core 7.52.0;五条续跑腿〔`/decide` · `/resume` · `/wake` · `plan_review` ·
+ * 🔴 **引擎拒一次续跑(`CheckpointError`)的 HTTP 答复 —— 唯一组句器**([ref] / [ref],core 7.52.0;五条续跑腿〔`/decide` · `/resume` · `/wake` · `plan_review` ·
  * workflow 决定在宿主会话上起的新一跑〕同经 `driveResumeLeg` 的 catch 臂到这里,SLA 拒扫腿与 PARKED 赎回席经 `resumeCheckpoint` 同得)。
  *
  * 规则(一条):**一次拒 = 一个答复形,与「谁发现的」无关**。引擎在认领前 / CAS 前拒的,与本服务在重放存量体之前自己拒的(`resume_blocked_by_policy`,