@sema-agent/server 7.137.0 → 7.139.0

package/dist/boot/execution-env.js

@@ -4,6 +4,7 @@ import { createHostLspManager } from "../host-lsp-manager.js";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
+import { sandboxEnvNamesInForce } from "../config.js";
 import { createE2bLspManager } from "../lsp/e2b-manager.js";
 import { evictLspOnDestroy } from "../lsp-evict.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
@@ -11,7 +12,7 @@ import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
-import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, K8S_SANDBOX_NAMESPACE_DEFAULT, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
+import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
 import { judgeSandboxGitPlane, runIdentitySourceOf, sandboxBrokerSeatOf, sandboxGitPlaneAsksSecretSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
@@ -43,24 +44,6 @@ function boundedSessionSetter(map, maxEntries) {
             map.delete(map.keys().next().value);
     };
 }
-function forwardedSandboxEnvKeys(remoteExec) {
-    switch (remoteExec.provider) {
-        case "e2b":
-        case "k8s":
-            return Object.keys(remoteExec.sandboxEnv ?? {}).sort();
-        case "local-docker":
-            return Object.keys(remoteExec.env ?? {}).sort();
-        case "ssh":
-        case "adb":
-        case "host":
-        case "device":
-            return [];
-        default: {
-            const unreachable = remoteExec;
-            throw new Error(`unhandled remote-exec provider: ${String(unreachable.provider)}`);
-        }
-    }
-}
 function buildSandboxLaneEnv(config, explicit) {
     const secretEnv = { ...(explicit ?? {}) };
     const env = Object.fromEntries(Object.entries(derivePkgSourceEnv(config.sandboxPkgSource, config.sandboxPkgSourceCustom)).filter(([name]) => !Object.hasOwn(secretEnv, name)));
@@ -173,7 +156,7 @@ export async function ensureSandboxSecretSeat(k8sCfg, logger, deps, read = () =>
     const names = Object.keys(k8sCfg.podSecretEnv ?? {});
     if (names.length === 0)
         return;
-    const namespace = k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT;
+    const namespace = k8sCfg.namespace;
     const seat = await read();
     switch (seat.state) {
         case "granted":
@@ -235,6 +218,12 @@ function buildRealSystemNote(remoteExec) {
         "and the Bash read boundary is a text-level friction floor, not a safety boundary; the safety boundary is a sandbox lane: " +
         `set REMOTE_EXEC=${sandboxLanes} (see docs/DEPLOY-PREREQS.md, section "S-281")`);
 }
+function hostWorktreeUnwrappedRefusal() {
+    return Object.assign(new Error('isolation "worktree" was requested but cannot be honored: this host lane has no worktree wrapper active ' +
+        "(WORKTREE_ISOLATION_ENABLED=true together with WORKTREE_REPO_ROOT=<a git repository> turns it on; a repo root that does not exist or has no `.git` leaves it off — see the boot log), " +
+        "and the base host environment would place the sub-agent in an empty temporary directory instead of an isolated checkout. " +
+        "The sub-agent was not started (fail-closed — no silent fallback to the shared working tree)."), { code: "isolation.unavailable" });
+}
 export function createExecutionEnv(ctx) {
     const { config, logger, metrics, taskAttachmentStore } = ctx;
     const laneHomeDir = executionLaneHomeDir(config);
@@ -275,7 +264,7 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.token ? { token: config.remoteExec.token } : {}),
             ...(config.remoteExec.caCert ? { caCert: config.remoteExec.caCert } : {}),
             ...(config.remoteExec.insecureTls ? { insecureTls: true } : {}),
-            ...(config.remoteExec.namespace ? { namespace: config.remoteExec.namespace } : {}),
+            namespace: config.remoteExec.namespace,
             ...(config.remoteExec.runtimeClass != null ? { runtimeClass: config.remoteExec.runtimeClass } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...(config.remoteExec.timeoutMs != null ? { timeoutMs: config.remoteExec.timeoutMs } : {}),
@@ -312,7 +301,7 @@ export function createExecutionEnv(ctx) {
         };
         sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
-            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT))
+            .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
             .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
     else if (config.remoteExec?.provider === "ssh") {
@@ -332,6 +321,7 @@ export function createExecutionEnv(ctx) {
                 hub: ctx.deviceLane.hub,
                 store: ctx.deviceLane.store,
                 enrollment: ctx.deviceLane.enrollment,
+                seat: ctx.deviceLane.seat,
                 ...homeDirSeat,
                 ...(config.remoteExec.execTimeoutMs != null ? { execTimeoutMs: config.remoteExec.execTimeoutMs } : {}),
                 perSessionCwd,
@@ -375,6 +365,8 @@ export function createExecutionEnv(ctx) {
                 backgroundShell: config.requirePrincipal !== true,
             };
             executionEnvFactory = (ctx) => {
+                if (ctx.isolation === "worktree")
+                    throw hostWorktreeUnwrappedRefusal();
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
                 const inheritEnv = perSessionInheritEnv.get(ctx.sessionId);
@@ -414,7 +406,7 @@ export function createExecutionEnv(ctx) {
             logger.error("worktree_isolation_disabled_bad_repo_root", {
                 repoRoot: wtRoot,
                 reason: existsSync(wtRoot) ? "not a git repository (no .git)" : "path does not exist",
-                note: "WORKTREE_ISOLATION_ENABLED is set but WORKTREE_REPO_ROOT is not a usable git repo — isolation left OFF; isolation:'worktree' agents run on the shared base env. Fix the path or unset the flag.",
+                note: "WORKTREE_ISOLATION_ENABLED is set but WORKTREE_REPO_ROOT is not a usable git repo — isolation left OFF; isolation:'worktree' workflow agents are refused (isolation.unavailable) until it is fixed. Fix the path or unset the flag.",
             });
         }
         else if (config.remoteExec?.provider === "host") {
@@ -473,7 +465,7 @@ export function createExecutionEnv(ctx) {
     if (executionEnvFactory) {
         const isolated = laneIsolated(executionLaneOf(config.remoteExec.provider));
         const suspendable = DEPLOYMENT_SHAPE_PREDICATES.suspendableHands.holds(config);
-        const sandboxEnvKeys = forwardedSandboxEnvKeys(config.remoteExec);
+        const sandboxEnvKeys = [...sandboxEnvNamesInForce(config)].sort();
         logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });

package/dist/boot/execution-lane.d.ts

@@ -5,7 +5,7 @@ import type { Logger } from "../observability/logger.js";
 export declare const FILE_SOURCED_LANES: readonly ["host", "local-docker"];
 export type FileSourcedLane = (typeof FILE_SOURCED_LANES)[number];
 export interface ExecutionLaneComposeCtx {
-    /** 本入口的配置源形态(`configProviderKind` / `serviceConfigSourceKind` 的答案 —— 与它真建的 provider 同一只判据)。
+    /** 本入口的配置源形态(`configSourceKind` 的答案 —— 与它真建的 provider 同一只判据)。
      *  只有 `local` 才读文件;`undefined` = 纯 env 部署。 */
     readonly configSource: "local" | "remote" | undefined;
     /** 配置根(与配置源同一个根,不分裂)。 */

package/dist/boot/governance-seams.d.ts

@@ -41,13 +41,14 @@
  *
  * ## 件D 的边界(成文,别读成「数据会被删」)
  *
- * 本仓**没有任何** store 声明 `retention:"managed"`(亲验:session/checkpoint/tool-result 三族 SQL 双生
- * 与 local 形都没有这一位),托管留存的执行面(调度/重试/副本协调/逐行审计)按 §5.2 是「server 半场四件
- * 皆新建」,不在本批。所以本装配点对件D 只做两件事:①把策略递给 core 的启动期校验
- * (`assertRetentionCapability` —— 锁着 + 店不能删 ⇒ 拒启,「策略锁着、数据永存」不许发生);②策略在场
- * 而没有任何 managed 店时打一条响亮 warn。**不**假装有执行面。
+ * 三只被托管的 SQL 店(session / checkpoint / tool-result)的 `retention` 声明读一个事实 —— 留存扫车道开不开(`plugins/retention-store-sql.ts` 的
+ * `retentionSweepRuns`):开 ⇒ `managed`,关(缺省)⇒ `none`;local 形的店恒声明 `none`。删除的执行面是扫车道(`boot/retention-lane.ts`)与 SQL 店上的
+ * 执行器,不在本装配点。所以本装配点对件D 只做两件事:①把策略与执行器递给 core 的启动期校验
+ * (`assertRetentionCapability` —— 配对由引擎一个判官判:店声明 `managed` 而部署不跑执行器、执行器不是执行器,锁不锁都拒;锁着 + 店不能删 ⇒ 拒启,
+ * 「策略锁着、数据永存」不许发生);②策略在场而扫车道关着(节律缺或为 0)时打一条响亮 warn,句说这个真因。**不**假装有执行面。
+ * 车道关着而策略在场只可能在 `audit-only` 档:`enforce` 而车道不齐在 `loadConfig` 就拒了(配置不变量 `retention-lane-complete`)。
  */
-import { type LockedKey, type RunnerDeps } from "@sema-agent/core";
+import { type LockedKey, type ManagedRetentionCapability, type RunnerDeps } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
 /** 装配产物:三个 core 座席 + 已校验的锁集(同步拒面 `assertRequestMcpUnlocked` 读它)。 */
@@ -61,7 +62,7 @@ export interface GovernanceSeams {
 }
 /** 依赖收窄到真实消费面(接口隔离 —— 测试用真形字面量,零铸形)。 */
 export interface GovernanceSeamsCtx {
-    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "mcpServers" | "requirePrincipal">;
+    config: Pick<ServiceConfig, "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep" | "mcpServers" | "requirePrincipal">;
     logger: Pick<Logger, "info" | "warn">;
     /**
      * core 留存能力校验的对象集(名字进拒启文案)。喂的是**装配现场的真店**,不是「我以为装了什么」——
@@ -72,18 +73,11 @@ export interface GovernanceSeamsCtx {
         store: object | undefined;
     }>;
     /**
-     * [ref] 车1 —— **本 build 是否真的接了留存执行器**(sweep lane;车2 的 `startRetentionLane()`)。
-     * 缺席 = `false`。
-     *
-     * 🔴 为什么这一位必须存在(codex 交叉复审 R2-[critical],验真后修):core 的
-     * `assertRetentionCapability` 只读**店的声明位**。[ref] 车1 让三只 SQL 店如实声明了 `"managed"`
-     * (它们的行确实由托管留存删),于是那道门从此**放行** locked policy —— 可执行器还在车2 手里。
-     * 两者之间的窗口如果什么都不做,后果正是本仓最忌的那种:部署自述「策略已受管」、审计与能力面
-     * 也这么说,而**没有任何东西在删数据**;车1 之前那条 `retention_policy_not_executed` 的响亮 warn
-     * 还会因为"有 managed 店在场"而**静音**。
-     * ⇒ 判据改成问「有没有东西真会删」,而不是「有没有店说自己被管」。车2 接上 lane 时把这一位传 true。
+     * 交给引擎启动检查的留存执行器 —— 本部署跑扫车道 ⇒ 那只执行器(`backend.retention`),不跑 ⇒ `null`(必填:漏递即编译红,
+     * 引擎对 `undefined` 也拒启)。「店说 managed」与「有执行器」的配对由引擎一个判官判(引擎 7.58.0:锁不锁都判);
+     * 店的词与这一格读同一个事实(`retention-store-sql.ts` 的 `retentionSweepRuns`),本仓不再另判一遍。
      */
-    retentionExecutorWired?: boolean;
+    retentionExecutor: ManagedRetentionCapability | null;
 }
 /**
  * 件C 的装配相容性判据(纯,可单测)——见文件头「两条判据」。

package/dist/boot/governance-seams.js

@@ -49,30 +49,16 @@ export function createGovernanceSeams(ctx) {
     }
     const retentionPolicy = config.retentionPolicy;
     const locked = lockedKeys.has("retentionPolicy");
-    assertRetentionCapability({ policy: retentionPolicy, locked, stores: retentionStores });
-    if (retentionPolicy !== undefined) {
-        const managed = retentionStores.filter((s) => s.store?.retention === "managed");
-        const executorWired = ctx.retentionExecutorWired === true;
-        if (managed.length === 0) {
-            logger.warn("retention_policy_not_executed", {
-                maxAgeDays: retentionPolicy.maxAgeDays,
-                note: "RETENTION_MAX_AGE_DAYS is configured but NO wired store declares retention:\"managed\", and this build ships no " +
-                    "retention scheduler — the policy is a DECLARATION only; nothing deletes data on its account. It is relayed to the " +
-                    "engine for the startup capability check and will become effective when a managed-retention store + scheduler land.",
-            });
-        }
-        else if (!executorWired) {
-            const detail = `retention policy is configured (maxAgeDays=${retentionPolicy.maxAgeDays}) and ${managed.length} wired store(s) declare ` +
-                `retention:"managed", but THIS BUILD WIRES NO RETENTION EXECUTOR (the sweep lane) — nothing enumerates domains or calls ` +
-                `the destructive store methods, so no data is deleted on the policy's account. A "managed" declaration is a statement ` +
-                `about who OWNS deleting those rows, not proof that a scheduler is running.`;
-            if (locked) {
-                throw new Error(`${detail} Refusing to start with the retentionPolicy key LOCKED: a locked policy over a deployment that does not ` +
-                    `actually delete is exactly the "policy locked, data immortal" posture the engine's capability check exists to ` +
-                    `prevent. Unlock the key, remove the policy, or run a build whose retention sweep lane is wired.`);
-            }
-            logger.warn("retention_policy_not_executed", { maxAgeDays: retentionPolicy.maxAgeDays, note: detail });
-        }
+    assertRetentionCapability({ policy: retentionPolicy, locked, stores: retentionStores, executor: ctx.retentionExecutor });
+    if (retentionPolicy !== undefined && config.retentionSweep.intervalSec === 0) {
+        logger.warn("retention_policy_not_executed", {
+            maxAgeDays: retentionPolicy.maxAgeDays,
+            mode: config.retentionSweep.mode,
+            retentionSweepIntervalSec: config.retentionSweep.intervalSec,
+            note: "RETENTION_MAX_AGE_DAYS is set but RETENTION_SWEEP_INTERVAL_SEC is unset or 0, so the retention sweep lane is off: nothing deletes data — " +
+                "or records what it would delete — on this policy's account; the policy is a declaration relayed to the engine's startup capability check. " +
+                "To run the lane set RETENTION_SWEEP_INTERVAL_SEC above 0 on a SQL backend (RETENTION_MODE=audit-only records what would be deleted; enforce deletes it).",
+        });
     }
     return { compliancePostureResolver, lockedConfig, retentionPolicy, lockedKeys };
 }

package/dist/boot/leader.d.ts

@@ -49,6 +49,9 @@ export interface LeaderCtx {
      *  唯一出口就是它(`runtask.js` 的 `catch (flushErr) => deps.onError`),所以它与 `usageWindowStore`
      *  席同生共死:挂窗不挂汇 = 治理轴上的静默失败面([ref])。必填键,理由同 `tracer`。 */
     onError: RunnerDeps["onError"];
+    /** 部署座 —— 起服第 5 段装配口 `assembleDeploymentMods` 交回的**同一份**(主车道各 Runner 经共享基座吃的就是它)。leader 车道的每一只 Runner 都要带:
+     *  缺席 = 运维声明的 mod 包管不到 leader 派出的腿。必填键,理由同 `tracer`。 */
+    deploymentMods: NonNullable<RunnerDeps["mods"]>;
     /** [ref] 车4 件1:durable store 后端(leader-run 登记表从这里取)。缺席 = 无 DB 的 env-only worker。 */
     backend?: StoreBackend | undefined;
 }

package/dist/boot/leader.js

@@ -59,6 +59,7 @@ export function createLeaderFace(ctx) {
                 : {}),
             ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
             ...(ctx.onError ? { onError: ctx.onError } : {}),
+            mods: ctx.deploymentMods,
             fanoutEnabled: config.leaderFanoutEnabled,
             ...((process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID)
                 ? { routerModel: (process.env.MODEL_ROUTER_ID || process.env.MODEL_CHEAP_ID) }

package/dist/boot/memory-consolidation.js

@@ -5,7 +5,7 @@ import { memoryMountRootOf } from "../memory-scope.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
 import { backendOwnsControlPlane } from "../memory-operator-faces.js";
-import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, modelOriginOf, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -151,7 +151,7 @@ export function consolidationSeatBillingOf(plane) {
     catch (err) {
         return { kind: "unresolvable", fault: `the main model (${DEFAULT_MODEL_REF}) does not resolve: ${err instanceof Error ? err.message : String(err)}` };
     }
-    return seat.entry === main ? { kind: "main-model", mainModel: main.id } : { kind: "own-model", seatModel: seat.entry.id, mainModel: main.id };
+    return modelOriginOf(seat.entry) === modelOriginOf(main) ? { kind: "main-model", mainModel: main.id } : { kind: "own-model", seatModel: seat.entry.id, mainModel: main.id };
 }
 export function resolveConsolidationValve(input) {
     const decided = decideConsolidationValve(input);

package/dist/boot/org-delivery.js

@@ -1,5 +1,17 @@
 import { principalInboxConsumerOf } from "@sema-agent/core";
 import { createOrgDeliveryGate } from "../org-delivery-gate.js";
+function declarationOf(consumer) {
+    switch (consumer.kind) {
+        case "assistant":
+            return { declared: "PRINCIPAL_INBOX_ASSISTANT declares a principal-inbox consumer", undeclare: "unset PRINCIPAL_INBOX_ASSISTANT" };
+        case "terminals":
+            return { declared: 'RunnerDeps.principalInboxConsumer declares "terminals" (the scope\'s terminal sessions drain the principal inbox)', undeclare: "drop the RunnerDeps.principalInboxConsumer declaration" };
+        default: {
+            const unknown = consumer;
+            throw new Error(`unknown principal-inbox consumer kind: ${JSON.stringify(unknown)}`);
+        }
+    }
+}
 export function mountOrgDeliveryGate(input) {
     const consumer = principalInboxConsumerOf(input.runnerDeps);
     if (consumer.kind === "none")
@@ -11,8 +23,9 @@ export function mountOrgDeliveryGate(input) {
             ...(directory === undefined ? ["an organization membership directory (a web-admin center, or MEMORY_ORG_DIRECTORY_JSON)"] : []),
             ...(backend === undefined ? ["a store backend for the delivery quota (DB_BACKEND=mysql|pg|local)"] : []),
         ];
-        throw new Error(`PRINCIPAL_INBOX_ASSISTANT declares a principal-inbox consumer, so this deployment must mount the organization delivery gate — but it lacks ${missing.join("; ")}. ` +
-            `Refusing to boot rather than run with a declared inbox that nothing may legitimately write to; provide the missing pieces or unset PRINCIPAL_INBOX_ASSISTANT.`);
+        const { declared, undeclare } = declarationOf(consumer);
+        throw new Error(`${declared}, so this deployment must mount the organization delivery gate — but it lacks ${missing.join("; ")}. ` +
+            `Refusing to boot rather than run with a declared inbox that nothing may legitimately write to; provide the missing pieces or ${undeclare}.`);
     }
     input.logger.info("org_delivery_gate_mounted", { consumer: consumer.kind });
     return createOrgDeliveryGate({ directory, mailbox: mailboxStore, quota: backend.orgDeliveryQuota(), consumer });

package/dist/boot/resolve-spec.d.ts

@@ -15,9 +15,10 @@ import type { Metrics } from "../observability/metrics.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
-import { type createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
+import type { createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
 import { type OwnerAwareSessionStore } from "../security.js";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
+import type { PeerDesk } from "../peer-seat.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
 type PrincipalCaps = ReturnType<typeof createPrincipalEntitlementsClient>;
 /** `resolveSpec` 原先从 `main()` 闭包里拿到的全部 boot 局部量。 */
@@ -84,6 +85,8 @@ export interface ResolveSpecCtx {
     /** [ref] 件C:本部署已校验的锁集(boot/governance-seams.ts 的产物,与 `RunnerDeps.lockedConfig`
      *  同源一次解析)。空集 = 无锁 = 现行为。本域只用它做**同步拒面**(§4.3),不做第二次裁决。 */
     lockedKeys: ReadonlySet<import("@sema-agent/core").LockedKey>;
+    /** 本进程的对端座 desk(stage-05 建、HTTP 服务的 `peerDesk` 同一只):请求面 MCP / A2A 的胜出草稿在 `opts.lease` 下经它登记,换回声明带的引用 —— 两只漏斗开的租约属于它。 */
+    peerDesk: PeerDesk;
     /** 本部署**装载簿**(stage-07 的出厂技能 + 配置源覆盖之后的终表,场景工厂读的同一份)。本装配器只拿它答「场景交来的这只技能来自哪里」
      *  (run 名册 `wiring_manifest.skills[].source`,`buildRunSkills`);名字在装载簿里唯一(装载器同名即抛、配置源按名覆盖)。 */
     loadedSkills: readonly LoadedSkill[];

package/dist/boot/resolve-spec.js

@@ -25,10 +25,10 @@ import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
 import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
-import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { applyRuntimeGovernance } from "../runtime-governance.js";
 import { HttpError, createCodedHttpError, encodeCheckpointScope } from "../security.js";
 import { headReadOf, sessionFaceOfHead } from "../session-incarnation.js";
+import { legProjectIdOf, sessionWorkspaceStoreOf, stampLegSessionWitness } from "../session-workspace.js";
 import { memorySpecForRequest } from "../memory-scope.js";
 import { createMemoryProjectLayers } from "../memory-project-layer.js";
 import { inheritEnvFacts, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
@@ -40,6 +40,7 @@ import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { assertRequestA2aEntries, resolveRequestA2a, snapshotRequestA2a } from "../task-a2a.js";
 import { assertRequestImageUrls } from "../request-image-urls.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
+import { GOVERNANCE_HTTP_STATUS } from "../governance-http-status.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_RULE_REFUSAL_CODE, SettingsRuleRefusalError, acceptAppendSystemPrompt, applyTaskSettings, createWorkflowAskPolicy, effectivePermissionMode, effectiveThinking, parseTaskSettings, taskHooksHonored, settingsPermissionBucketIssue } from "../task-settings.js";
@@ -53,11 +54,16 @@ import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "..
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { fieldConflictFacts } from "../field-conflict.js";
+function unrooted(spec) {
+    const { sessionId: _neverWritten, ...resolved } = spec;
+    return resolved;
+}
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore, checkpointStore, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, loadedSkills, peerDesk, } = ctx;
     const deploymentSkillSources = new Map(loadedSkills.map((k) => [k.spec.name, k.source]));
     const scenarioGate = createScenarioGate({ config, scenarios, principalCaps, logger }, "enforce");
     const sessionHeadOf = headReadOf(ownerAware);
+    const sessionWorkspace = sessionWorkspaceStoreOf(ownerAware);
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
         approvalSeat: durableEnabled ? "durable" : "absent",
@@ -80,6 +86,13 @@ export function createResolveSpec(ctx) {
         if (seatRefusal !== undefined)
             throw createCodedHttpError(501, "capability.checkpoint_store_required", seatRefusal);
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
+        const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
+        const a2aPeers = snapshotRequestA2a(body.a2aPeers, { reread: storedToolAxes !== undefined });
+        if (lockedKeys.has("a2a") && a2aPeers !== undefined && a2aPeers !== null) {
+            throw new HttpError(GOVERNANCE_HTTP_STATUS["config.locked_key"], "`a2aPeers` is administratively locked by this deployment (locked key \"a2a\") — task-supplied A2A peers are refused; locks are config-time and there is no request-time unlock", {
+                code: "config.locked_key",
+            });
+        }
         if (opts?.leg === "fresh")
             assertRequestMcpEntries(body.mcpServers);
         if (opts?.leg === "fresh") {
@@ -142,8 +155,6 @@ export function createResolveSpec(ctx) {
                 }
             }
         }
-        const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
-        const a2aPeers = snapshotRequestA2a(body.a2aPeers, { reread: storedToolAxes !== undefined });
         if (opts?.leg === "fresh")
             assertRequestA2aEntries(a2aPeers);
         if (opts?.leg === "fresh")
@@ -167,12 +178,13 @@ export function createResolveSpec(ctx) {
             hostSemanticsLane: folded.hostSemanticsLane,
         });
         const stamped = stampHandsLane(final, gated.hands);
-        return stampRunSkills(stamped, runSkills.roster);
+        return stampLegSessionWitness(stampRunSkills(stamped, runSkills.roster), gated.sessionWitness);
     };
     const gateScenarioAndAppend = async (body, auth, opts) => {
         const scenarioName = await scenarioGate(auth?.principal, body.scenario);
-        gateExecutionLane(await principalCaps?.executionRuling(auth?.principal), executionLaneOf(config.remoteExec?.provider), logger);
-        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, auth?.sessionId !== undefined ? { sessionId: auth.sessionId, delegationRoot: { sessionId: auth.sessionId, incarnation: (sessionHeadOf === undefined ? undefined : sessionFaceOfHead(auth.sessionId, await sessionHeadOf(auth.sessionId)))?.incarnation ?? null } } : {});
+        const root = opts.execution.root;
+        const sessionWitness = { sessionId: root, incarnation: (sessionHeadOf === undefined ? undefined : sessionFaceOfHead(root, await sessionHeadOf(root)))?.incarnation ?? null };
+        const cap = selectScenario(scenarios, scenarioName)(body, auth?.principal, { sessionId: sessionWitness.sessionId, delegationRoot: sessionWitness });
         const acceptedAppend = acceptAppendSystemPrompt(body.appendSystemPrompt, (detail) => logger.warn("append_system_prompt_dropped", { detail, sessionId: auth?.sessionId ?? null }));
         const objective = typeof body.objective === "string" ? body.objective : "";
         const parsedSettings = parseTaskSettings(body.settings, opts?.leg === "fresh" || !taskHooksHonored(config) ? {} : { storedHooksReread: storedHooksRereadM20(new Date().toISOString().slice(0, 10)) });
@@ -222,7 +234,7 @@ export function createResolveSpec(ctx) {
                 }
             }
         }
-        return { scenarioName, cap, hands: cap.hands, acceptedAppend, objective, parsedSettings, attachmentNotice };
+        return { scenarioName, cap, hands: cap.hands, acceptedAppend, objective, parsedSettings, attachmentNotice, sessionWitness };
     };
     const bindSettingsCwdEnvAndModel = (body, auth, gated, opts) => {
         const { objective, parsedSettings } = gated;
@@ -339,9 +351,10 @@ export function createResolveSpec(ctx) {
             if (rewindFilesToEntryId === undefined)
                 throw new HttpError(404, `rewindFilesTo: no such message in this session (rewind_files_to.unknown_event) — ${NO_ANCHOR_HINT}; name another prompt`, { code: "rewind_files_to.unknown_event" });
         }
-        const s4ProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
-        const s4DefaultScopes = s4ProjectId ? config.projects[s4ProjectId]?.defaultScopes : undefined;
-        return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes };
+        const submittedProjectId = auth?.resolvedProjectId ?? (typeof body.projectId === "string" && body.projectId ? body.projectId.toLowerCase() : undefined);
+        const s4DefaultScopes = submittedProjectId ? config.projects[submittedProjectId]?.defaultScopes : undefined;
+        const legProjectId = await legProjectIdOf(submittedProjectId, sessionWorkspace, auth?.sessionId);
+        return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId };
     };
     const declaresInteractivePosture = (body, req, opts) => {
         if (opts?.liveStream !== true)
@@ -358,14 +371,14 @@ export function createResolveSpec(ctx) {
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
-        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, projectKey, a2aPeers, storedToolAxes, runSkills, } = parts;
+        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, legProjectId, projectKey, a2aPeers, storedToolAxes, runSkills, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
             ...buildPromptSeats(scenarioName, cap.prompt, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined),
             appendSystemPrompt: acceptedAppend,
             ...(body.outputStyle !== undefined ? { outputStyle: body.outputStyle } : {}),
             ...(body.projectMemory !== undefined ? { projectMemory: body.projectMemory } : {}),
-            sessionId: auth?.sessionId,
+            ...(legProjectId !== undefined ? { projectId: legProjectId } : {}),
             principal: auth?.principal,
             images: body.images,
             ...(body.userAttachments !== undefined ? { userAttachments: body.userAttachments } : {}),
@@ -385,7 +398,6 @@ export function createResolveSpec(ctx) {
             suggestNextPrompts: normalizeSuggestNextPrompts(body.suggestNextPrompts),
             restoreFiles: body.restoreFiles === true ? true : undefined,
             acceptPartialRestore: body.acceptPartialRestore === true ? true : undefined,
-            ...(body.rewindFiles === true ? { rewindFiles: true } : {}),
             rewindFilesTo: rewindFilesToEntryId,
             ...(body.fileHistory === "disabled" ? { fileHistory: "disabled" } : {}),
             additionalDirectories,
@@ -491,8 +503,8 @@ export function createResolveSpec(ctx) {
             ...(() => { const v = toolNameListFromBody(body.userInvokedSkills); return v ? { userInvokedSkills: v } : {}; })(),
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
-            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined, storedToolAxes),
-            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
+            mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, peerDesk, opts.lease, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined, storedToolAxes),
+            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, peerDesk, opts.lease, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",
@@ -659,9 +671,7 @@ export function createResolveSpec(ctx) {
     };
     const resolveSpecForLeg = async (body, req, auth, opts) => {
         const spec = await resolveSpec(body, req, auth, opts);
-        if (opts?.unattendedLeg !== true)
-            return spec;
-        return withUnattendedLeg(spec);
+        return unrooted(opts.unattendedLeg !== true ? spec : withUnattendedLeg(spec));
     };
     return resolveSpecForLeg;
 }

package/dist/boot/retention-lane.d.ts

@@ -155,22 +155,28 @@ export interface RetentionSweepOutcome {
 /**
  * lane **自持的** boot 不变式(设计稿 §7,codex F3)—— 与 core 的 `assertRetentionCapability` 是两道门,
  * 各答各的问题:
- *  · core 那道问的是「**锁着**的策略会不会盖在一只删不了的店上」——只在 locked 时说话;
- *  · **本道**问的是「lane 开着的时候,它真的能删吗」——**不看 locked 状态**。
+ *  · core 那道判**配对**,锁不锁都判(`executor` 必给):声明 `managed` 的店 × 没有执行器(`null`)⇒ 拒;执行器四个契约方法
+ *    (`listRetentionDomains` / `expireCheckpoints` / `deleteExpiredSessions` / `deleteOrphanToolResults`)缺一 ⇒ 拒;
+ *    **锁着**的策略盖在声明 `none` 的店上 ⇒ 拒。它不问 lane 开没开、策略在不在,也不拦没锁时「执行器在场 × 店声明 `none`」(部署可以持有执行器而不在某只店上跑);
+ *  · **本道**问的是「lane 开着的时候,它接得上能删的东西吗」——**不看 locked 状态**:执行器在场、lane 调的**五**个方法都在
+ *    (多出的 `previewRetention` 是 audit-only 档的读数口,不在 core 的四方法契约里,引擎的检查覆盖不到它)、每只被 lane 消费的店都声明 `managed`。
+ *    「执行器在场」与「契约方法齐」两格和引擎的判官说的是同一件事(各自一句拒句),其余几格是引擎不问的。
  *
- * 为什么后者必须存在:core 的门在 `locked=false` 时整条放行,于是
- *  ① `RETENTION_SWEEP_INTERVAL_SEC>0` 而 policy 缺席 = 没有有效 cutoff 的 sweep(每 tick 什么都算不出来,
- *     读数一路 0,看起来像"没有候选");
- *  ② unlocked policy × 一只 `"none"` 的店照样过检 —— 部署于是**广告了一个不执行的留存面**:能力位说
+ * 「lane 开着而没有视界(天数)」与「`RETENTION_MODE=enforce` 而车道不齐」不在本道:那是配置事实,判在 `loadConfig` 的配置不变量段
+ * (`config-invariants.ts` 的 `retentionLaneRefusal`,一条规则)—— 到得了本道的部署,lane 开着就一定有视界。本道只判**接线**(配置看不见的那几格)。
+ *
+ * 为什么本道必须存在:引擎的门不拦
+ *  · 没锁时,执行器在场 × 一只 `"none"` 的店 —— 部署于是**广告了一个不执行的留存面**:能力位说
  *     `{mode,maxAgeDays}`、审计表也在长,而那只店的行谁都没在删。
- * 两者都在**启动期**拒(安全控件不得半开),不是让运维从一台"启动成功、什么也没删"的机器上猜。
+ *     本仓的 SQL 后端按同一个事实(扫车道开不开,`plugins/retention-store-sql.ts` 的 `retentionSweepRuns`)给它铸的三只店声明词,所以 lane 开着时
+ *     这三只店在这一格上恒是 `managed`;这一格防的是声明与 lane 脱钩的店(别的后端、替身)。
+ * 这些都在**启动期**拒(安全控件不得半开),不是让运维从一台"启动成功、什么也没删"的机器上猜。
  *
  * @param locked 只进文案(让拒启信息能说清"你锁没锁都一样拒");**判据本身不读它** —— 这一格的存在
  *               就是为了让"不看 locked"这句话在签名上可见,而不是靠注释声明。
  */
 export declare function assertRetentionLaneWirable(input: {
     intervalSec: number;
-    policy: RetentionPolicy | undefined;
     executor: RetentionExecutor | undefined;
     stores: ReadonlyArray<{
         name: string;

package/dist/boot/retention-lane.js

@@ -2,24 +2,18 @@ import { recordFailOpen } from "../observability/fail-open.js";
 export const RETENTION_SWEEP_STUCK_THRESHOLD = 5;
 export const RETENTION_LEASE_TTL_FACTOR = 2;
 const DAY_MS = 86_400_000;
+const LANE_EXECUTOR_METHODS = ["listRetentionDomains", "previewRetention", "expireCheckpoints", "deleteExpiredSessions", "deleteOrphanToolResults"];
 export function assertRetentionLaneWirable(input) {
     if (input.intervalSec <= 0)
         return;
     const lockNote = input.locked === true ? " (the retentionPolicy key is LOCKED, but this gate refuses either way)" : "";
-    if (input.policy === undefined) {
-        throw new Error(`RETENTION_SWEEP_INTERVAL_SEC=${input.intervalSec} arms the managed-retention sweep lane, but RETENTION_MAX_AGE_DAYS is not ` +
-            `configured — the lane would run with NO horizon to compute a cutoff from, enumerate domains every tick and delete nothing, ` +
-            `while the capability surface advertises a retention face that does not exist${lockNote}. Set RETENTION_MAX_AGE_DAYS, or set ` +
-            `RETENTION_SWEEP_INTERVAL_SEC=0 to leave the lane off.`);
-    }
     if (input.executor === undefined) {
         throw new Error(`RETENTION_SWEEP_INTERVAL_SEC=${input.intervalSec} arms the managed-retention sweep lane, but this deployment wires NO retention ` +
             `executor — the destructive store methods live on the SQL backends only (DB_BACKEND=mysql|pg); the local/file backend honestly ` +
             `declares retention:"none" and nothing would delete a row${lockNote}. Run a SQL backend, or set RETENTION_SWEEP_INTERVAL_SEC=0.`);
     }
     const executor = input.executor;
-    const CONTRACT_METHODS = ["listRetentionDomains", "previewRetention", "expireCheckpoints", "deleteExpiredSessions", "deleteOrphanToolResults"];
-    for (const m of CONTRACT_METHODS) {
+    for (const m of LANE_EXECUTOR_METHODS) {
         if (typeof executor[m] !== "function") {
             throw new Error(`the wired retention executor is missing \`${m}\` — a store that declares retention:"managed" PROMISES the whole ` +
                 `ManagedRetentionCapability contract, and the sweep lane calls every method of it${lockNote}. Refusing to start with a ` +

package/dist/boot/runner-deps.d.ts

@@ -29,6 +29,7 @@ import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { MemoryBackend } from "@sema-agent/core";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
 import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
+import type { PeerDesk } from "../peer-seat.js";
 /**
  * `RunnerDeps.onAsk` 的装配([ref] 件4:从内联闭包提为具名导出,**纯 testability 重构、零行为变化**)。
  *
@@ -65,7 +66,9 @@ export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordina
  *  [ref]:第五词 `shell-gate-off` 随 core 7.34.0 的 off 车道一起退役(引擎侧零发射点),同批删 —— 它唯一的本仓消费者
  *  (「本 session 显式 bypass ⇒ 降级 info」那条回查腿与 `boot/session-shell-gate-registry.ts` 登记簿)一并删干净。所以这是「按实现亲读」的开集快照,不是 core 类型闭集——词表外的值原样进日志并标
  *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
- *  的 dist 扫描格钉住(两种发射写法都读;读不出词的经变量发射点本身红;core 加词/收进 d.ts 那天先红)。 */
+ *  的 dist 扫描格钉住(两种发射写法都读;读不出词的经变量发射点本身红;core 加词/收进 d.ts 那天先红)。
+ *  第七词 `peer-seat-hold`(runtask 的 `holdDeclarations`,字面量):对端座的三员对象里 `hold` / `release` 抛了 ⇒ 引擎报一次、该引用
+ *  不被持有;座是本仓的 desk,所以这是部署自己的故障,与其余六词同走 warn + 计数。 */
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 /** [ref]:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
  *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
@@ -163,6 +166,8 @@ export interface RunnerDepsCtx {
     /** core 7.49.0 [ref]:引擎数据根(boot 事实,`boot/stores.ts` 恒铸 —— 记忆引擎开不开都在)。共享基座把它交成每只 Runner 的
      *  `memoryEngineDir`:引擎从它解出每条腿的唯一豁免根(守卫集不再收 `dataRoot`)。开引擎时与 `memoryEngine.root` 同一只。 */
     engineDataRoot: string;
+    /** 对端座的 desk(进程一只,`peer-seat.ts`):共享基座把它的座交成每只 Runner 的 `peerSeat` —— MCP / A2A 声明里的引用只经它在发送时作答。 */
+    peerDesk: PeerDesk;
     /**
      * [ref](core 7.21.1)—— 记忆整理的**已解析座**(`boot/memory-consolidation.ts` 的
      * `resolveConsolidationDriverSeat` 产物),在场 **iff** 整理阀门开着(`resolveConsolidationValve` 的判决:
@@ -228,7 +233,8 @@ export interface RunnerDepsCtx {
     executionEnvFactory: RunnerDeps["executionEnvFactory"];
     lspManager: RunnerDeps["lspManager"];
     fleetBus: FleetEventBus;
-    /** 部署座的 mods 注册(stage-05 `createDeploymentMods` 铸、起服自证过)—— 共享基座 ⇒ 主 / handless / hookAgent / sub 每一只 Runner 同一份。 */
+    /** 部署座的 mods 注册(起服第 5 段装配口 `assembleDeploymentMods` 铸:自铸 + 运维声明的包,起服自证过)—— 主 / handless / hookAgent / sub 经本共享基座、
+     *  leader 车道的路由 / worker / 修复腿经 `LeaderWireConfig.mods`(`boot/leader.ts` 递同一份),每一只 Runner 同一份。 */
     deploymentMods: NonNullable<RunnerDeps["mods"]>;
     workflowRunStore: WorkflowRunStore | undefined;
     workflowJournalStore: ServiceWorkflowJournalStore | undefined;
@@ -241,7 +247,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "crossBoundaryPosture" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "mods" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations" | "peerSeat">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -268,7 +274,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentMods" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot" | "peerDesk">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;