@sema-agent/server 7.134.0 → 7.135.0

package/dist/plugins/usage-window-store-sql.d.ts

@@ -8,10 +8,10 @@
  *
  * 并发正确性(本 store 的靶心;两副本同 key 并发 charge 绝不能丢账——丢账方向=治理窗漏放):
  *  - **ensure-first + 行锁**(mailbox twin 正字先例,[ref] 复审靶1):事务内先幂等建空行
- *    (形 A,S-127:MySQL `ON DUPLICATE KEY UPDATE <pk> = <pk>` / PG `ON CONFLICT DO NOTHING`)⇒
+ *    (形 A,[ref]:MySQL `ON DUPLICATE KEY UPDATE <pk> = <pk>` / PG `ON CONFLICT DO NOTHING`)⇒
  *    `SELECT … FOR UPDATE` 时行恒在,「无行 FOR UPDATE + INSERT」的并发死锁/dup 撞车形整个消掉。
  *    MySQL 侧动词**不能**是 `INSERT IGNORE`:InnoDB 对重复键的 IGNORE 取 S 锁,随后的 FOR UPDATE 要升 X,
- *    两个并发 charge 各持一把 S 互等 ⇒ ER_LOCK_DEADLOCK(B-013);ON DUPLICATE 的重复键取的就是 X。
+ *    两个并发 charge 各持一把 S 互等 ⇒ ER_LOCK_DEADLOCK([ref]);ON DUPLICATE 的重复键取的就是 X。
  *  - charge 频率低(core 只在任务进场/turn 边界/收尾 delta 提交),悲观锁简单正确,不用乐观 CAS。
  *  - `read` 无锁单 SELECT(readUsageRecord 纯函数);行缺席 = EMPTY_USAGE_WINDOW_RECORD。
  *  - record JSON 坏形(手工污染)= **fail-loud throw**:治理窗算错=计费面撒谎,不 fail-open。
@@ -29,7 +29,7 @@ import type { UsageWindow, UsageWindowReading, UsageWindowRecord, UsageWindowSto
 import { type JsonColumnShape } from "./sql-json-column.js";
 export declare const USAGE_WINDOW_TABLE = "usage_window";
 /**
- * `usage_window.record` 的**形读者**(S-550 车③a:本店既有的那一份深度判据逐字搬进来,一个字没改判)。
+ * `usage_window.record` 的**形读者**([ref] 车③a:本店既有的那一份深度判据逐字搬进来,一个字没改判)。
  *
  * 判据深到内层元素:非数值 tokens 参与累加会得到 `"0oops"` ⇒ `exhausted:false` ⇒ **超额账户被判未耗尽**
  * (与 core `FileUsageWindowStore` 的 validateSlots/validateBuckets 同轴)。

package/dist/plugins/user-input-ledger-file.d.ts

@@ -15,7 +15,7 @@ export declare class MemoryUserInputLedgerStore implements UserInputLedgerStore
     listOpen(after?: OpenScanCursor, limit?: number): Promise<OpenScanPage>;
     listCrashed(sessionId: string): Promise<UserInputAcceptance[]>;
     listUnannounced(sessionId: string, limit: number): Promise<UserInputAcceptance[]>;
-    /** S-965:会话树删除 = 一行会话级墓碑(守卫:该会话此刻有行 ⇒ 落;否则零写、回 0)。写抛 ⇒ 原样抛(协调器据此不删会话本体)。 */
+    /** [ref]:会话树删除 = 一行会话级墓碑(守卫:该会话此刻有行 ⇒ 落;否则零写、回 0)。写抛 ⇒ 原样抛(协调器据此不删会话本体)。 */
     deleteBySession(sessionId: string): Promise<number>;
 }
 /** local 车道(File)孪生。 */

package/dist/plugins/user-input-ledger-sql.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-928 用户输入受理账本的 **SQL** 孪生(单文件双方言,[ref] A12 收拢形;两条语句并排写死,方言差异显式)。
+ * [ref] 用户输入受理账本的 **SQL** 孪生(单文件双方言,[ref] A12 收拢形;两条语句并排写死,方言差异显式)。
  * 语义属主 = `src/user-input-ledger.ts`;File / Memory 两只在 `user-input-ledger-file.ts`。四只孪生吃同一组试剂盒断言
  * (`test/helpers/user-input-ledger-kit.ts`;本孪生的真双库腿在 `test/store-contract-kit-db-integration.test.ts`)。
  *
@@ -13,12 +13,12 @@
  * 无 owner / principal / scope 列(行随它挂靠的会话走 —— 收编形Ⅲ);`writer` 是受理进程的 `instanceId`(随进程消亡,不是租户轴)。
  * 行里不存输入正文(只有身份与时刻)。
  *
- * ## 会话树删除(S-965)
+ * ## 会话树删除([ref])
  * `deleteBySession` = `DELETE … WHERE session_id = ?`(真删行;File 孪生是一行会话级墓碑,同义)。两条删会话树的级联各有一臂:在线删除协调器
  * 经本动词;托管留存的事务化孪生(`retention-store-sql.ts` `purgeSessionTrees` ④)在**自己的事务**里对本表发同一只谓词(`session_id` 单键,
  * 多值集合按方言)—— 它不调店,理由见该文件顶注的布局裁定(一个事务 ⇒ 一条连接 ⇒ 一个属主)。谓词走 `(session_id, state, accepted_at_ms)` 索引的前缀。
  *
- * ## 读不出的行(S-969 L6):逐行跳过,游标按原始行推进
+ * ## 读不出的行([ref] L6):逐行跳过,游标按原始行推进
  * 三只读口都按 `state` 列取行(`= 'open'` / `= 'converged'`),所以 `state` 词表外的行任何读口都取不到;被取到的行上读不出的列 —— `input_kind`
  * 词表外(新版本写的输入族:滚动发布 / 回滚的混版窗)、收敛行缺 `state_at_ms` —— 由 {@link readRows} 逐行跳过 + 计 F 类 tag
  * `server.user-input-ledger.corrupt-record-skipped`(File 孪生重放坏行的同一只登记座),其余行照交。修前一行读不出 ⇒ 整页抛:收敛断点不前进

package/dist/plugins/web-search.d.ts

@@ -5,7 +5,7 @@
  *
  * Multi-provider, picked by `WEB_SEARCH_PROVIDER`:
  *   - `brave`   — Brave Web Search API (GET, `X-Subscription-Token` header); with `WEB_SEARCH_ENDPOINT` set to a
- *                 Brave-compatible gateway's full search URL (e.g. a self-hosted Nólë gateway, S-669) the same leg
+ *                 Brave-compatible gateway's full search URL (e.g. a self-hosted Nólë gateway, [ref]) the same leg
  *                 serves that backend — no new provider word, `capabilities.webSearch.backend` still reads `brave`
  *   - `tavily`  — Tavily Search API (POST, `Authorization: Bearer`, native include/exclude_domains)
  *   - `searxng` — a self-hosted SearXNG instance (GET `?format=json`, no auth)
@@ -54,6 +54,7 @@
  *    验证搜索配对不对。挂哪儿(boot 期一次性 warn / `/health` 子字段 / 显式端点)未定 ——
  *    注意 boot 期探活会给每次启动加一次出网,多租/离线部署要能关。
  */
+import { type UrlCredentialFacts } from "../url-credential.js";
 /**
  * Search providers this backend speaks —— **词表的唯一属主**(运行期与类型同一份)。
  * Absent `WEB_SEARCH_PROVIDER` ⇒ no backend ⇒ WebSearch is not assembled.
@@ -69,7 +70,7 @@
 export declare const WEB_SEARCH_PROVIDERS: readonly ["brave", "tavily", "searxng"];
 export type WebSearchProvider = (typeof WEB_SEARCH_PROVIDERS)[number];
 /**
- * S-382:`GET /v1/capabilities` 的 `webSearch` 位 —— **部署默认后端**的闭集自述。
+ * [ref]:`GET /v1/capabilities` 的 `webSearch` 位 —— **部署默认后端**的闭集自述。
  *
  * ## 病
  * 「这台 worker 的搜索走哪只后端」此前只在 operator 面可知(`GET /v1/config/catalog` 的
@@ -159,7 +160,7 @@ export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) =
 /**
  * Build the `WebSearchConfig` (a `search` fn + `maxResults`) for `assembleFullBodyTools({ webSearch })`. The API key
  * stays captured in this closure — it is never surfaced to the model or the tool args. Every error a leg throws leaves
- * through {@link redactedBackendFailure} (S-716 ③).
+ * through {@link redactedBackendFailure} ([ref] ③).
  */
 export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
 /**
@@ -195,7 +196,7 @@ export declare function webSearchConfigFromEnv(env?: NodeJS.ProcessEnv): WebSear
  *  · `absent`    —— 没带(或 `null`)⇒ 用部署后端;
  *  · `honored`   —— 每个字段形对,且 `provider` 点名了一只本部署会说的后端 ⇒ 这次调用用它;
  *  · `malformed` —— 任一字段形错 ⇒ 受理面 400 `request.field_invalid`(`issue` 逐字点名字段)。
- * **`provider` 缺席或不在词表里也是形错**(S-199 主会话改判,codex 验修 V1 [high]):一段 `settings.webSearch` 就是
+ * **`provider` 缺席或不在词表里也是形错**([ref] 主会话改判,codex 验修 V1 [high]):一段 `settings.webSearch` 就是
  * 调用方在点名目的地(`endpoint` / `apiKey` 都挂在它点名的那只后端上),认不出就拒,不静默换成部署后端 —— 改判前
  * 这一形回落部署后端,`{provider:"searx", endpoint:<私有地址>}` 的查询于是发到了部署配的后端。env 腿的同一只
  * {@link isWebSearchProvider} 守卫对**部署**的词表外答「不装配」,那是部署自己的缺席,不是换别人的目的地。
@@ -210,9 +211,22 @@ export type RequestWebSearchVerdict = {
 } | {
     readonly kind: "honored";
     readonly config: WebSearchBackendConfig;
-} | {
+}
+/** `facts` = 拒体的机读位(`field` + `reason`;只有「endpoint 带凭据」这一族在场,与 MCP / A2A / http 钩子三座同一只铸点)。 */
+ | {
     readonly kind: "malformed";
     readonly issue: string;
+    readonly facts?: UrlCredentialFacts;
 };
 export declare function judgeRequestWebSearch(raw: unknown): RequestWebSearchVerdict;
+/**
+ * **fresh 提交门**读的判决([ref],受理面 `admission.ts` 独有):{@link judgeRequestWebSearch}(装配点读的那一只,续跑重放也走)+ 一条只属于新提交的 ——
+ * 采纳下来的 `endpoint` 带凭据(userinfo 一形已在上面的判官里拒,句子不变;这里补凭据名参数:名字在日志脱敏器凭据名表里的 query / fragment 参数)⇒ `malformed`,
+ * 拒句说出路,机读位 `field` + `reason` 与 MCP / A2A / http 钩子三座同一只铸点。
+ *
+ * 为什么不并进 {@link judgeRequestWebSearch}:那一只被装配点读(续跑重放存量 body),在那里答 `malformed` 的后果是「这次调用不装配 WebSearch」(见 `capabilities/scenarios.ts`)——
+ * 升级前停驻的任务会悄悄卸载这个工具,比不拒更糟;已落盘的字节也不因拒而消失。与 MCP 条目门 / A2A 对端门 / hooks matcher 判据同一条 `fresh` 限定律。
+ * 部署 env 的 `WEB_SEARCH_ENDPOINT` 同理不判:那是运维的配置,不进任何请求的停驻 ctx。
+ */
+export declare function judgeFreshRequestWebSearch(raw: unknown): RequestWebSearchVerdict;
 //# sourceMappingURL=web-search.d.ts.map

package/dist/plugins/web-search.js

@@ -2,6 +2,7 @@ import { validateHeaderValue } from "node:http";
 import { createSearxngSearchBackend } from "@sema-agent/core";
 import { isHierarchicalUrl } from "@sema-agent/settings-schema";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRequestUrlCredentialRefusal, findUrlCredential, findUrlUserinfo, urlCredentialFacts } from "../url-credential.js";
 export const WEB_SEARCH_PROVIDERS = ["brave", "tavily", "searxng"];
 function isWebSearchProvider(word) {
     return WEB_SEARCH_PROVIDERS.includes(word);
@@ -201,8 +202,8 @@ function judgeEndpoint(raw) {
         return ABSENT;
     if (!isHierarchicalUrl(raw))
         return { ok: false, issue: ENDPOINT_FORM };
-    const url = new URL(raw);
-    return url.username !== "" || url.password !== "" ? { ok: false, issue: ENDPOINT_USERINFO } : { ok: true, value: raw };
+    const credential = findUrlUserinfo(raw);
+    return credential !== undefined ? { ok: false, issue: ENDPOINT_USERINFO, credential } : { ok: true, value: raw };
 }
 const COUNT_FORM = "must be a number ≥ 1";
 function judgeCount(raw) {
@@ -320,8 +321,10 @@ export function judgeRequestWebSearch(raw) {
         maxResults: judgeCount(s.maxResults),
     };
     for (const [field, j] of Object.entries(fields)) {
-        if (!j.ok)
-            return { kind: "malformed", issue: `settings.webSearch.${field} ${j.issue}` };
+        if (!j.ok) {
+            const at = `settings.webSearch.${field}`;
+            return { kind: "malformed", issue: `${at} ${j.issue}`, ...(j.credential === undefined ? {} : { facts: urlCredentialFacts(at, j.credential) }) };
+        }
     }
     return {
         kind: "honored",
@@ -333,4 +336,16 @@ export function judgeRequestWebSearch(raw) {
         }),
     };
 }
+const ENDPOINT_CREDENTIAL_EXIT = "settings.webSearch.apiKey is stored sealed: send the credential as settings.webSearch.apiKey (brave and tavily send it as a request header; " +
+    "the searxng backend sends no credential from a request, so a searxng instance that needs one is declared in the deployment's WEB_SEARCH_ENDPOINT instead)";
+export function judgeFreshRequestWebSearch(raw) {
+    const verdict = judgeRequestWebSearch(raw);
+    if (verdict.kind !== "honored" || verdict.config.endpoint === undefined)
+        return verdict;
+    const credential = findUrlCredential(verdict.config.endpoint);
+    if (credential === undefined)
+        return verdict;
+    const refusal = buildRequestUrlCredentialRefusal("settings.webSearch.endpoint", credential, ENDPOINT_CREDENTIAL_EXIT);
+    return { kind: "malformed", issue: refusal.message, facts: refusal.facts };
+}
 //# sourceMappingURL=web-search.js.map

package/dist/{orchestration/workflow-journal-entry.d.ts → plugins/workflow-journal-payload.d.ts}

@@ -1,5 +1,6 @@
 /**
- * S-185(core 7.10.0 [ref] / B-049)—— `WorkflowJournalEntry` **两臂**的单点读写。
+ * [ref](core 7.10.0 [ref] / [ref])—— `WorkflowJournalEntry` **两臂**的单点读写;`workflow_journal.result` 这一列的**单一属主叶**(写腿编码、读腿解码与判官
+ * 都在这里 —— SQL 店与 journal HTTP 读面的 SQL 分页腿共读,core 7.55.0 T3 起从 `orchestration/workflow-journal-entry.ts` 搬到列属主的家)。
  *
  * core 7.10.0 把 journal 记录从一个 interface 换成了判别联合:
  *   `{ callKey, result }`  —— 这一序数的子代跑完了,`result` 是它的 `TaskResult`;
@@ -15,17 +16,17 @@
  * 承重记录**——而 journal 是 LOAD-BEARING(丢一条 = 一次已完成的子代被当成没跑过而重跑,外部副作用重复)。
  * 收敛到这里之后,第三臂到货 ⇒ 本文件**一处**编译红。
  *
- * 🔴 **park 臂的形是 fail-closed 的**:core 的类型要求 `parked.terminal.kind === "paused"`。从盘上读回来的
- * 字节没有类型,所以 {@link readJournalRowBody} 在铸 park 臂时**亲验**这一位,不合就判坏——它是 LOAD-BEARING
- * 面上的坏行(一条说自己 park 了却拿不出暂停终局的记录,既不能驱动、也不能当成跑完),吞掉它会让 resume
- * 在一个被钉住的子代 session 旁边重新起一只活跑,正是 core 那条「一次性、响亮」的 schema 台阶要防的形。
+ * 🔴 **读回一行的判官是 core 的那一只**(core 7.55.0 [ref] T3 `readWorkflowJournalEntry`):从盘上读回来的字节没有类型,一条
+ * 「说自己 park 了却拿不出带令牌的暂停终局」的记录、一条完成臂不是对象的记录,既不能驱动、也不能当成跑完 —— 吞掉它会让 resume 在一个被
+ * 钉住的子代 session 旁边重新起一只活跑。本仓此前自判 park 臂的 `terminal.kind`(漏了 checkpoint 令牌那一条);现在本仓只做**信封解码**
+ * ({@link journalLogicalRow}:`{"parked": …}` 判别位活在载荷里),臂的判定全交 core,坏行 ⇒ `WorkflowJournalIncompatibleError`
+ * (码 `workflow.journal_incompatible`,点名序数)—— core 的两只内置 journal 与它的店契约盒对坏行要的就是这一只拒绝。
  *
  * 🔴 **盘上的编码是那道台阶的一部分**,不是实现细节:见 {@link journalRowPayloadOf} 的顶注(park 载荷走
  * `{"parked": …}` 信封,好让**回滚/混版**的老读者拿到一个没有 `terminal` 的对象、落进 core 的响亮拒绝臂,
  * 而不是把一个暂停终局当成可重放结果)。
  */
-import type { TaskResult, WorkflowJournalEntry } from "@sema-agent/core";
-import type { JsonColumnReader } from "../plugins/sql-json-column.js";
+import { type TaskResult, type WorkflowJournalEntry } from "@sema-agent/core";
 /** park 臂的载荷型(core 的 `WorkflowJournalEntry` park 成员逐字):一只 `terminal` 收敛到 `paused` 的 `TaskResult`。 */
 export type ParkedTaskResult = TaskResult & {
     terminal: Extract<TaskResult["terminal"], {
@@ -64,33 +65,23 @@ export declare function journalEntryPayload(entry: WorkflowJournalEntry): {
  */
 export declare function journalRowPayloadOf(entry: WorkflowJournalEntry): string;
 /**
- * 盘上一行 payload 的**形读者**(S-550 车③a:`workflow_journal.result` 这一列的唯一判据)。
- *
- * 判别式 = 解出来的对象上有没有**自有** `parked` 键。它与 `TaskResult` 结构上不相交(core 的 `TaskResult`
- * 没有这个成员),所以历史字节(裸 TaskResult)恒判 result 臂 —— 不需要任何「老字节 = result」的兼容规则,
- * 判别式自己就说清了。
- *
- * park 臂验 `terminal.kind === "paused"`;不合 ⇒ 判坏,由 LOAD-BEARING 的读腿把它当店故障传上去。
- * 一条「说自己 park 了却拿不出暂停终局」的行既驱动不了、也不能当跑完,吞掉它会让 resume 在被钉住的子代
- * session 旁边重新起一只活跑 —— 与 {@link journalRowPayloadOf} 那道信封屏障要防的是同一件事。
- *
- * 🔴 **「一只 JSON 对象」这一条也必须判**(S-550):此前回装点是裸 `JSON.parse` + `as TaskResult`,于是
- * 一行 `null` 字面 / JSON 字符串标量 / 双重编码的 `result` 会被当成一条**合法的已完成记录**端给 resume
- * (`{callKey, result: null}`)—— 那正是「一次已完成的子代被当成跑过而不再跑」与「一条坏行冒充跑完」
- * 两种最坏形的同一个入口。
+ * 盘上一行 payload 的**信封解码**(本仓唯一自判的部分;{@link journalRowPayloadOf} 的逆):载荷是一只对象且带**自有** `parked` 键 ⇒ 停驻臂(值 = 信封里那一份),
+ * 否则整份载荷是完成臂 —— `parked` 与 core 的 `TaskResult` 结构上不相交,所以历史字节(裸 TaskResult)恒判完成臂,不需要任何「老字节 = result」的兼容规则。
+ * 交出的是 core `readWorkflowJournalEntry` 要的**逻辑行**(`callKey` + 两臂之一);两臂里装的东西拿不拿得出续跑要读的(完成臂是对象 / 停驻臂是带令牌的
+ * paused 终局)归 core 判。
  */
-export declare const readJournalRowBody: JsonColumnReader<JournalRowBody>;
-/** {@link readJournalRowBody} 收窄出来的两臂(判别位已定,载荷已验形)。 */
-export type JournalRowBody = {
-    parked: true;
-    payload: ParkedTaskResult;
+export declare function journalLogicalRow(callKey: string, payload: unknown): {
+    readonly callKey: string;
+    readonly parked: unknown;
 } | {
-    parked: false;
-    payload: TaskResult;
+    readonly callKey: string;
+    readonly result: unknown;
 };
 /**
- * {@link journalRowPayloadOf} 的逆的**后半**:已解码、已验形的载荷 → 记录。**唯一**的铸点(SQL 店的 `load`
- * 与 HTTP journal 读面共读它;两处各自经 `decodeJsonColumn(text, readJournalRowBody, …)` 把文本收成这只体)。
+ * 一格 `workflow_journal.result` 读回一条记录的**唯一读法**(SQL 店的 `load` 与 HTTP journal 读面的 SQL 分页腿共读它):JSON 解码 → 信封解码
+ * ({@link journalLogicalRow})→ core `readWorkflowJournalEntry`。判官说坏 ⇒ 抛 `WorkflowJournalIncompatibleError`(码 `workflow.journal_incompatible`,
+ * 序数 = core 对 `callKey` 的解析;拒句是 core 判官的定句,不引存下的值)。读不成 JSON 的格是一条读不成对象的行(同判坏,同一只拒绝);
+ * 投影漏了的格(`not-text`,读腿写错)原样抛 —— 那是程序错,不是坏数据。
  */
-export declare function journalEntryOfBody(callKey: string, body: JournalRowBody): WorkflowJournalEntry;
-//# sourceMappingURL=workflow-journal-entry.d.ts.map
+export declare function journalEntryOfCell(runId: string, callKey: string, cell: unknown, where: string): WorkflowJournalEntry;
+//# sourceMappingURL=workflow-journal-payload.d.ts.map

package/dist/plugins/workflow-journal-payload.js

@@ -0,0 +1,32 @@
+import { WorkflowJournalIncompatibleError, callKeyOrdinal, readWorkflowJournalEntry } from "@sema-agent/core";
+import { SqlJsonColumnError, decodeJsonColumn } from "./sql-json-column.js";
+export function journalEntryPayload(entry) {
+    return entry.parked !== undefined ? { payload: entry.parked, parked: true } : { payload: entry.result, parked: false };
+}
+export function journalRowPayloadOf(entry) {
+    const { payload, parked } = journalEntryPayload(entry);
+    return JSON.stringify(parked ? { parked: payload } : payload);
+}
+const ANY_JSON = (body) => ({ value: body });
+export function journalLogicalRow(callKey, payload) {
+    return payload !== null && typeof payload === "object" && !Array.isArray(payload) && Object.hasOwn(payload, "parked")
+        ? { callKey, parked: payload.parked }
+        : { callKey, result: payload };
+}
+export function journalEntryOfCell(runId, callKey, cell, where) {
+    let payload;
+    try {
+        payload = decodeJsonColumn(cell, ANY_JSON, where);
+    }
+    catch (e) {
+        if (!(e instanceof SqlJsonColumnError) || e.problem !== "not-json")
+            throw e;
+        payload = cell;
+    }
+    const row = journalLogicalRow(callKey, payload);
+    const reading = readWorkflowJournalEntry(row);
+    if ("corrupt" in reading)
+        throw new WorkflowJournalIncompatibleError(runId, callKeyOrdinal(callKey), row);
+    return reading.entry;
+}
+//# sourceMappingURL=workflow-journal-payload.js.map

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -15,7 +15,7 @@
  * record (InMemory `{ scope, byOrdinal }` / File "first line names the scope, one line per ordinal"):
  *   - `workflow_journal_owner (run_id) PK` — the run's ONE owning scope, the `incarnation` token minted by the claim
  *     that wrote the record, and `appended_at_ms` (the owner's last append; the GC clock of this row). Written by the
- *     run's first append; never a second scope (S-197, below).
+ *     run's first append; never a second scope ([ref], below).
  *   - `workflow_journal (run_id, incarnation, ordinal) PK` — one row per recorded call, keyed by the owner record that
  *     wrote it. NO scope column: a run's scope lives in exactly one place, so "one run, two scopes" is not a state this
  *     schema can hold.
@@ -26,7 +26,7 @@
  * OVERWRITES (last-write-wins) — a resumed run re-appends its replayed prefix verbatim, so this is the exact InMemory
  * `byOrdinal.set(ordinal, …)` semantics, not a duplicate row.
  *
- * 🔴 **The scope wall — ONE predicate, both faces** (S-197; core `workflowJournalStoreContract` "scope wall" case;
+ * 🔴 **The scope wall — ONE predicate, both faces** ([ref]; core `workflowJournalStoreContract` "scope wall" case;
  * core's InMemory / File stores refuse the same way): a run's journal belongs to the scope of its first append. Every
  * face answers through the owner row and the same pair `workflow_journal_owner.run_id = ? AND scope = ?`:
  *   - `append` writes its row through `INSERT … SELECT … FROM workflow_journal_owner WHERE run_id = ? AND scope = ?` —
@@ -43,7 +43,7 @@
  * owner's row at the same ordinal. With the incarnation in the key, the stale write lands on a key of the dead record —
  * a row readable by no one, removed by the sweep — and the new record's rows are untouchable by it, on every engine,
  * without a locking clause.
- * Before S-197 the scope sat on every row: the read faces filtered it, the write face never judged it (a cross-scope
+ * Before [ref] the scope sat on every row: the read faces filtered it, the write face never judged it (a cross-scope
  * append on a NEW ordinal inserted a second scope's row into the run; on an EXISTING ordinal it overwrote the owner's
  * result under the owner's scope), held up by "runId is unique per scope and the owner is the sole writer".
  *
@@ -59,9 +59,10 @@
  *     a multi-byte UTF-8 payload would silently slip past the byte-budget cap on PG with plain `LENGTH`, so
  *     the twin uses the byte-counting function instead — codex R3, real dual-DB-suite-confirmed) in `loadPage`'s
  *     size-gate CASE.
- *   - `loadPage`'s bind-param ORDER: TiDB's `?`s appear in query-text order (maxResultBytes first, inside the
- *     CASE, ahead of runId/scope), so its params array is `[maxResultBytes, runId, scope, limit, offset]`; PG's
- *     `$n` are POSITIONAL (not text-order), so its array is `[runId, scope, maxResultBytes, limit, offset]`
+ *   - `loadPage`'s bind-param ORDER (both the chunk read and the single oversize-row read go through `readRows`): TiDB's `?`s
+ *     appear in query-text order (the byte gate first, inside the CASE, ahead of runId/scope), so its params array is
+ *     `[inlineBytes, runId, scope, from, limit]`; PG's `$n` are POSITIONAL (not text-order), so its array is
+ *     `[runId, scope, inlineBytes, from, limit]`
  *     (`$3` inside the CASE refers to the third element regardless of where `$3` sits in the text). Same
  *     placeholder-arity-fallout class the sql-driver.ts header calls out for null-safe compares.
  *   - affectedRows vs rowCount (via SqlDriver's normalized `affected`). The guarded write reads it as the wall's
@@ -96,12 +97,12 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     /** Record one agent's result. Idempotent per (run_id, ordinal) under the run's owner record: the PK upsert OVERWRITES (last-write-wins), so a
      *  resumed run re-appending its replayed prefix verbatim leaves no duplicate. callKeyOrdinal is the SOLE ordinal
      *  source (core's parser — a malformed key collapses to 0, matching InMemory). Throws on a REAL failure
-     *  (LOAD-BEARING) — an oversize entry included, on BOTH arms (S-194 / core 7.12.0 [ref]; see below) — and REFUSES an
-     *  append under a scope other than the run's owner, on any ordinal and both arms, writing nothing (S-197; the scope
+     *  (LOAD-BEARING) — an oversize entry included, on BOTH arms ([ref] / core 7.12.0 [ref]; see below) — and REFUSES an
+     *  append under a scope other than the run's owner, on any ordinal and both arms, writing nothing ([ref]; the scope
      *  wall in the file header). */
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
     /** Entries for `runId` IF its owner scope === `scope`, ASCENDING by ordinal; otherwise EMPTY. CORE-9 audit
-     *  BLOCKER: the scope wall (S-197: the owner row, the same predicate append writes through) — the LLM controls
+     *  BLOCKER: the scope wall ([ref]: the owner row, the same predicate append writes through) — the LLM controls
      *  `resumeFromRunId`, so a cross-scope runId resolves to an empty journal (resume safely diverges to live, never
      *  discloses another tenant's results). Each row's `result` is the persisted JSON.stringify(TaskResult) → JSON.parse
      *  back. Throws on failure (LOAD-BEARING). */
@@ -109,8 +110,16 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     /** [ref] locator 云形(core 1.353 WorkflowJournalStore.locator additive):SQL 店的 journal 坐标=
      *  [ref] HTTP 读面路由(file 店返 jsonl 路径=CC 本地形;此处返云形,core 铸 diagnostics 教句时单源引用)。 */
     locator(runId: string, _scope: string): string;
-    /** codex R1-H2:分页投影读——LIMIT/OFFSET 界行数,字节门界单行字节(超限行不取 result 全文,只回字节数;
-     *  读面标 truncated)。ORDER BY ordinal 与 load 同轴;scope 墙与 load 同一只 JOIN(S-197)。
+    /** 分页投影读 —— **判整份 journal,取一页**。
+     *
+     *  🔴 判的范围 = `load` 的范围:这条 journal 里只要有一行(任意一页、任意大小)被 core 的判官判坏,本读就抛 `WorkflowJournalIncompatibleError`(点名按序数升序的第一条坏行 ——
+     *  与内存 / 文件店 `load` 逐行判的次序同),页只是投影。修前只判本页取到、且不超 `maxResultBytes` 的行:同一条坏 journal 在内存 / 文件上整次拒、在这里答 200
+     *  (坏行在别的页、或是超单行门的坏行 —— 后者只出尺寸存根,永不解码)。判官只有一只、判的范围只有一个,页不是判的单位。
+     *
+     *  读法:按序数的键集游标分块(每块 {@link JOURNAL_SCAN_CHUNK_ROWS} 行,`ORDER BY ordinal` 的主键序;不用 OFFSET —— 活 run 在读的同时还在 append,位置偏移会在块界上漏行或重行),
+     *  每行经 {@link journalEntryOfCell}(`load` 的同一只回装点)判一遍;位置落在 `[offset, offset + limit)` 里的行进页。内存峰值 ≤ 正在读的一块 + 已收下的页(各 ≤ 50 行 × `maxResultBytes`,读面传 64 KiB)+ 一条超门的行(驱动 / 解码的开销另计):
+     *  行字节超 `maxResultBytes` 的行在块里只回字节数(库端 CASE 门,全文不过线),判它时单条取回全文、判完即弃 —— 页里它仍只是 `resultJson: null` 的尺寸存根。
+     *  ORDER BY ordinal 与 `load` 同轴;scope 墙与 `load` 同一只 JOIN([ref])。读放大:每次读 = 整份 journal 的一遍主键范围扫描(≤ 一次续跑 `load` 的量),这是「判整份」的代价。
      *  🔴 param ORDER differs by dialect (see file header): TiDB's `?`s bind in text order (maxResultBytes first,
      *  inside the CASE); PG's `$n` are positional, so its array keeps runId/scope first. Never unify — a swap
      *  silently mis-binds the OTHER dialect's placeholders. */
@@ -123,7 +132,12 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
         resultJson: string | null;
         resultBytes: number;
     }>>;
-    /** GC — purge ALL journal entries for a run (every incarnation), then its owner row (S-197). Scoped by run_id alone;
+    /** 超 `maxResultBytes` 的那一行的全文:单条读(序数 ≥ 它的第一行)—— 返回的行**必须就是它**(序数相等);它在块读与这次读之间被清扫了,读到的是「序数更大的下一行」,
+     *  那是别人的字节,不能挂在它的键下判 ⇒ 无可判(`undefined`),下一块读自然读到那一行、用它自己的键判。 */
+    private oversizeCellOf;
+    /** 读面的**唯一**行读法(`loadPage` 的块读与超门行的单条读共用):序数 ≥ `from` 的至多 `limit` 行,字节超 `inlineBytes` 的行 `resultJson` 为 null(只回 `resultBytes`)。 */
+    private readRows;
+    /** GC — purge ALL journal entries for a run (every incarnation), then its owner row ([ref]). Scoped by run_id alone;
      *  idempotent (returns the journal rows removed). Mirrors the resume-anchor store's deleteBySession. An append racing the
      *  two DELETEs can leave a row behind without its owner record; it is keyed by the dead incarnation — readable and
      *  overwritable by no one (file header) — and the GC sweep removes it by age. */
@@ -157,9 +171,9 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
      *  bound. A resume of a journal older than the retention window simply re-runs live (resume is an optimization).
      *  Idempotent; returns the journal rows purged.
      *
-     *  S-197: the same cutoff then purges owner rows whose OWN clock (`appended_at_ms`, pushed by every append of the
+     *  [ref]: the same cutoff then purges owner rows whose OWN clock (`appended_at_ms`, pushed by every append of the
      *  owner) is older. Each DELETE's predicate reads only the row it deletes — a cross-table "owner with no rows left"
-     *  test inside the DELETE would be a non-current read on every engine here (the B-022 lesson: TiDB pins start_ts, PG
+     *  test inside the DELETE would be a non-current read on every engine here (the [ref] lesson: TiDB pins start_ts, PG
      *  READ COMMITTED re-checks only the target row), so a concurrent append could have its owner deleted from under it.
      *  Every row of a run was written by an append that first pushed the owner's clock (monotonically — GREATEST) to at least
      *  that row's `created_at_ms`, so an owner past the cutoff normally has no row left after the first DELETE. The one

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,18 +1,13 @@
 import { callKeyOrdinal } from "@sema-agent/core";
 import { assertJournalEntryFits } from "@sema-agent/core";
-import { journalEntryOfBody, journalRowPayloadOf, readJournalRowBody } from "../orchestration/workflow-journal-entry.js";
+import { journalEntryOfCell, journalRowPayloadOf } from "./workflow-journal-payload.js";
 import { randomUUID } from "node:crypto";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-import { decodeJsonColumn, foldJsonColumn, jsonColumnText, jsonColumnTextExpr } from "./sql-json-column.js";
+import { jsonColumnText, jsonColumnTextExpr } from "./sql-json-column.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
-function decodeJournalResult(cell, where) {
-    try {
-        return decodeJsonColumn(cell, readJournalRowBody, where);
-    }
-    catch (e) {
-        throw foldJsonColumn(e, (m) => `workflow journal: ${m} — refusing rather than replay a journal entry nobody can read`);
-    }
-}
+const INT_MIN = -2147483648;
+const INT_MAX = 2147483647;
+const JOURNAL_SCAN_CHUNK_ROWS = 50;
 export class SqlWorkflowJournalStore {
     db;
     resumeClaimTtlMs;
@@ -43,18 +38,42 @@ export class SqlWorkflowJournalStore {
         const { rows } = await this.db.query(this.q(`SELECT call_key, ${jsonColumnText("tidb", "result")} FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC`, `SELECT call_key, ${jsonColumnText("pg", "result")} FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC`), [runId, scope]);
         return rows.map((r) => {
             const callKey = String(r.call_key);
-            return journalEntryOfBody(callKey, decodeJournalResult(r.result, `workflow_journal.result for run ${runId} entry ${callKey}`));
+            return journalEntryOfCell(runId, callKey, r.result, `workflow_journal.result for run ${runId} entry ${callKey}`);
         });
     }
     locator(runId, _scope) {
         return `/v1/workflows/${runId}/journal`;
     }
     async loadPage(runId, scope, opts) {
+        const page = [];
+        let position = 0;
+        let from = INT_MIN;
+        for (;;) {
+            const chunk = await this.readRows(runId, scope, from, JOURNAL_SCAN_CHUNK_ROWS, opts.maxResultBytes);
+            for (const row of chunk) {
+                const cell = row.resultJson ?? (await this.oversizeCellOf(runId, scope, row.ordinal));
+                if (typeof cell === "string")
+                    journalEntryOfCell(runId, row.callKey, cell, `workflow_journal.result for run ${runId} entry ${row.callKey}`);
+                if (position >= opts.offset && position < opts.offset + opts.limit)
+                    page.push({ callKey: row.callKey, resultJson: row.resultJson, resultBytes: row.resultBytes });
+                position += 1;
+            }
+            const last = chunk.at(-1);
+            if (last === undefined || chunk.length < JOURNAL_SCAN_CHUNK_ROWS || last.ordinal >= INT_MAX)
+                return page;
+            from = last.ordinal + 1;
+        }
+    }
+    async oversizeCellOf(runId, scope, ordinal) {
+        const row = (await this.readRows(runId, scope, ordinal, 1, INT_MAX))[0];
+        return row !== undefined && row.ordinal === ordinal && row.resultJson !== null ? row.resultJson : undefined;
+    }
+    async readRows(runId, scope, from, limit, inlineBytes) {
         const params = this.db.dialect === "tidb"
-            ? [opts.maxResultBytes, runId, scope, opts.limit, opts.offset]
-            : [runId, scope, opts.maxResultBytes, opts.limit, opts.offset];
-        const { rows } = await this.db.query(this.q(`SELECT call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE ${jsonColumnTextExpr("tidb", "result")} END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? ORDER BY ordinal ASC LIMIT ? OFFSET ?`, `SELECT call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE ${jsonColumnTextExpr("pg", "result")} END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 ORDER BY ordinal ASC LIMIT $4 OFFSET $5`), params);
-        return rows.map((r) => ({ callKey: String(r.call_key), resultJson: r.result_json === null ? null : String(r.result_json), resultBytes: Number(r.result_bytes) }));
+            ? [inlineBytes, runId, scope, from, limit]
+            : [runId, scope, inlineBytes, from, limit];
+        const { rows } = await this.db.query(this.q(`SELECT ordinal, call_key, CASE WHEN LENGTH(result) > ? THEN NULL ELSE ${jsonColumnTextExpr("tidb", "result")} END AS result_json, LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = ? AND scope = ? AND ordinal >= ? ORDER BY ordinal ASC LIMIT ?`, `SELECT ordinal, call_key, CASE WHEN OCTET_LENGTH(result) > $3 THEN NULL ELSE ${jsonColumnTextExpr("pg", "result")} END AS result_json, OCTET_LENGTH(result) AS result_bytes FROM workflow_journal JOIN workflow_journal_owner USING (run_id, incarnation) WHERE run_id = $1 AND scope = $2 AND ordinal >= $4 ORDER BY ordinal ASC LIMIT $5`), params);
+        return rows.map((r) => ({ ordinal: Number(r.ordinal), callKey: String(r.call_key), resultJson: r.result_json === null ? null : String(r.result_json), resultBytes: Number(r.result_bytes) }));
     }
     async deleteByRun(runId) {
         const res = await this.db.query(this.q("DELETE FROM workflow_journal WHERE run_id = ?", "DELETE FROM workflow_journal WHERE run_id = $1"), [runId]);

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -70,7 +70,7 @@ type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 export declare const MAX_RUN_BLOB_BYTES: number;
 declare const onWarnType: (msg: string, meta: Record<string, unknown>) => void;
 export type InboxWarn = typeof onWarnType;
-/** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`)在**两条写腿**(put / update 常态 + oversize 降级)
+/** [ref]:workflow_run 行的 `error`(脚本抛出的 `err.message`)在**两条写腿**(put / update 常态 + oversize 降级)
  *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。
  *  core 7.48.0 起 `error` 在铸点也过 core 的 `redactSecrets`,但两张脱敏表互不为超集(本仓的表多认几种记号,core 的表多认另几种)⇒ 这一口暂留;
  *  退役条件 = core 的脱敏表成为两表的并集(本仓的每一种记号它都认)—— 到那时这一口与它的两条调用一起删。 */
@@ -90,12 +90,12 @@ export declare function withRedactedError<T extends {
  *  第一臂,「那张表独自作数」—— 剥成缺席就把一条走第一臂的记录推去走派生臂,而派生的两个缓存只装这条 run
  *  **自己做出**的 park,继承来、从未跑到的那一条**只存在于被剥掉的那张表里**,于是它要么被漏掉、要么被
  *  当成不存在而在 resume 时活着重跑([ref] 正要消灭的形)。它同时也是本仓 `/decide` 的 workflow 车道复核
- *  「这条 park 属于这条 run」的**单一真源**(S-252)。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
+ *  「这条 park 属于这条 run」的**单一真源**([ref])。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
  *  `test/slim-oversize-run.test.ts` 里那两格(最狠的一级上 `parks` 仍逐字完整 + 负控:记录本来没有
  *  这一位时不许凭空补 `[]`)。缺席 ⇒ 不补:补 `[]` 会把「这版引擎没写这个位」伪造成「这条 run 没有 park」,
  *  而 core 对两者的处置相反。
  *
- *  🔴 **S-252(7.75.0):阶梯不再为 park 另存第二份恢复身份。** 7.71.0 的 S-192 曾在 `agents[]` 里逐行保住
+ *  🔴 **[ref](7.75.0):阶梯不再为 park 另存第二份恢复身份。** 7.71.0 的 [ref] 曾在 `agents[]` 里逐行保住
  *  `callKey`/`sessionId`/`parkedCheckpointToken`(外加两级 `label` 预算与一枚不可恢复标记),因为当时
  *  `/decide` 的复核只认那一行。core 7.17.0 之后同一条记录上有了 `parks[]`,那份保留就成了**第二个会漂的
  *  定义**(真案:最后一级清空 `agents` 之后 token 仍躺在同一个 blob 的 `parks` 里,而 `/decide` 照拒)。
@@ -185,7 +185,7 @@ export declare class SqlWorkflowNotifyJournalStore implements WorkflowNotifyJour
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
 }
 /**
- * S-185 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
+ * [ref] 车CM —— **workflow 出身 park 的有界 join 索引** SQL 双生(契约与纪律的唯一属主 =
  * {@link import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex} 的文件头,
  * 这里只记方言差)。行是 `WorkflowRun` 的派生投影(一行一枚指针),写者只有一个(Journaling 装饰器的写观察点);
  * 收割在删 run 行的同一个方法里按同一张待删 id 表删它们的指针({@link SqlWorkflowRunStore.reap})。

package/dist/posture-source.d.ts

@@ -1,17 +1,17 @@
 /**
- * S-167 → S-178 → S-1492 —— **一个部署级旋钮的值是谁定的**,五词闭集 + 一句运维指路。
+ * [ref] → [ref] → [ref] —— **一个部署级旋钮的值是谁定的**,五词闭集 + 一句运维指路。
  *
  * ## 为什么是一个共享件而不是每键一份
  *
- * S-167 给 `READ_FACE` 造了这套东西(值 + 来源 + 指路句),理由写在 `read-face-posture.ts` 的顶注里:
+ * [ref] 给 `READ_FACE` 造了这套东西(值 + 来源 + 指路句),理由写在 `read-face-posture.ts` 的顶注里:
  * 「缺席」这一态里塞着两件不同的事(单机 turnkey 没表态 vs 多租户就是要引擎默认),而把它们分开之后,
- * **env 恒赢的判据**与**运维面「为什么这台机器是这个值」**才有真答案。S-178 把同一条律推到另外三个键
+ * **env 恒赢的判据**与**运维面「为什么这台机器是这个值」**才有真答案。[ref] 把同一条律推到另外三个键
  * (`STREAM_ASK_WINDOW_MS` / `DURABLE_APPROVAL` / `SESSION_AUTO_TITLE`)时,唯一诚实的做法是**抽这一份**
  * ——四词表抄第二遍的那天,两份表会在加词时分家,而「这个值是谁定的」在运维面上是个是非题,不能有两个答案。
  *
  * ## 优先序(与 `config.ts` 的 `postureOn` 同形)
  * `env 显式` > `center 发布` > `车道声明` > `posture 派生` > `引擎/服务端默认`。
- * `lane`(S-1492,[ref])= **执行车道的契约行替运维声明了这个旋钮的缺省**(目前只有 `READ_FACE`:隔离型车道的读面缺省 `open`,声明在 `execution-lane-caps.ts`)。
+ * `lane`([ref],[ref])= **执行车道的契约行替运维声明了这个旋钮的缺省**(目前只有 `READ_FACE`:隔离型车道的读面缺省 `open`,声明在 `execution-lane-caps.ts`)。
  * 它是出处,不是表态:运维从没写过这个键,所以与 `posture` 一样不算「有人要求过」({@link isExplicitPosture});比 `posture` 优先,因为车道声明比整机 posture 更具体
  * (同一台单机上 `e2b` 沙箱里的读面缺省 `open`,理由是沙箱边界而不是「一个可信主人」)。
  *
@@ -22,12 +22,12 @@
  * 得到一句谁都不认的空话,或者更坏:一句**对某些键是假的**话。
  *
  * 🔴 `centerMeaning` 是 G-7(test [ref])的修复面,成因是一次真的过期断言:这一臂原本硬编码
- * 「applied from the web-admin (**restart-to-apply**)」,而 S-174(core 7.10.0 [ref])之后
+ * 「applied from the web-admin (**restart-to-apply**)」,而 [ref](core 7.10.0 [ref])之后
  * `readFace.face` 是**热换席**(`Runner.swapDeps({readFace})`,下一拍 refresh 当场换进全部 Runner,
  * `read-face` 重启片也不再为它签理由)——运维照那句话去滚动重启一片 fleet,重启的是一个已经生效的变更。
  * 生效时机是**键**的事实,不是四词表的属性,所以它跟 `postureMeaning` 一样归键。
  */
-/** 旋钮取值来源的闭集词表(顺序 = 优先序;五词,S-1492 起多 `lane`)。 */
+/** 旋钮取值来源的闭集词表(顺序 = 优先序;五词,[ref] 起多 `lane`)。 */
 export declare const POSTURE_SOURCE_WORDS: readonly ["env", "center", "lane", "posture", "engine-default"];
 /** 一个旋钮的取值来源(闭集五词)。加词 ⇒ {@link postureSourceNote} 的穷举 switch 编译红。 */
 export type PostureSource = (typeof POSTURE_SOURCE_WORDS)[number];
@@ -41,13 +41,13 @@ export interface PostureKnobFacts {
      * 还是这个键根本没有 center 腿?),以及怎么把这个键取回来。只在 `source === "center"` 时被读到。
      *
      * 🔴 为什么归键而不是共享(G-7 的成因):生效时机是键的事实。同一句「restart-to-apply」对
-     * `readFace.face` 是假的(S-174 热换席),对三个 S-178 旋钮则连触发条件都没有(`config.ts` 的
+     * `readFace.face` 是假的([ref] 热换席),对三个 [ref] 旋钮则连触发条件都没有(`config.ts` 的
      * `postureSourceOfKnob` / `postureSourceOfNumEnv` 只产 env/posture/engine-default,center 写不到
      * 它们)—— 一句共享的硬编码必然对其中一类说谎。
      */
     readonly centerMeaning: string;
     /**
-     * `lane` 那一臂**专属**的一句话(S-1492):执行车道的契约行为什么替这个旋钮声明了缺省、这一声明的风险是什么、怎么钉回。只在 `source === "lane"` 时被读到。
+     * `lane` 那一臂**专属**的一句话([ref]):执行车道的契约行为什么替这个旋钮声明了缺省、这一声明的风险是什么、怎么钉回。只在 `source === "lane"` 时被读到。
      * 与 `centerMeaning` 同理由归键:没有 lane 腿的旋钮(今天除 `READ_FACE` 外都是)写一句「本键没有 lane 腿」,比一句会骗人的通用话诚实。
      */
     readonly laneMeaning: string;
@@ -64,17 +64,17 @@ export declare function postureSourceNote(facts: PostureKnobFacts): string;
 /**
  * 这个值是**运维显式表态**的吗?
  *
- * 🔴 S-178 施工时真踩(本批全量抓出):`hasOperatorGateIntent`(`src/approval.ts`)判「运维表达过门意图
+ * 🔴 [ref] 施工时真踩(本批全量抓出):`hasOperatorGateIntent`(`src/approval.ts`)判「运维表达过门意图
  * 没有」时读的是 `durableApproval` 这个**值** —— 那在本键进 posture 家族之前是对的(它只有显式设过才为
  * 真),之后当场失真:单机 turnkey 上 posture 派生的 `true` 会被读成「运维要门」,于是 run-local 那条
  * **结构上没有 durable 门**的腿在每次 boot 打一条补偿 warn,而它其实正处在「零门意图的既定姿势」里。
- * 这与 S-167 头注①记的是**同一形**病(用一个会被 posture 铸出来的量当「有人表态过」的代理)。
+ * 这与 [ref] 头注①记的是**同一形**病(用一个会被 posture 铸出来的量当「有人表态过」的代理)。
  *
  * ⇒ 判据落到**来源**上,穷举 switch(五词闭集加员即编译红):`env`(这台机器的运维写下的)与 `center`
  * (组织发布的)是表态;`lane`(车道契约行声明的缺省)、`posture`(姿态派生)与 `engine-default`(内建缺省)都**不是**「有人要求过」。
  */
 export declare function isExplicitPosture(source: PostureSource): boolean;
-/** operator 诊断面的一行读数:值 + 来源 + 指路句。三个 S-178 旋钮与 S-167 的 readFace 同形。 */
+/** operator 诊断面的一行读数:值 + 来源 + 指路句。三个 [ref] 旋钮与 [ref] 的 readFace 同形。 */
 export interface PostureKnobReading<V> {
     value: V;
     source: PostureSource;