@sema-agent/server 7.138.0 → 7.140.0

package/dist/trace/self-minted-wire.d.ts

@@ -129,6 +129,10 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 409;
                 readonly since: "7.108.0";
             };
+            readonly "memory.erasure_store_unjudged": {
+                readonly attr: 409;
+                readonly since: "7.140.0";
+            };
             readonly "internal.memory_control_plane_corrupt": {
                 readonly attr: 500;
                 readonly since: "7.108.0";
@@ -649,6 +653,26 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /** `GET /v1/sessions/:id/background` 的 `rows[]` 上本版新出现的键:`sessionId` —— 后台 agent 行的子会话 id(引擎绑定之后才在,别的行型恒缺席;只是 id,不授读权)。 */
+    readonly sessionBackgroundRowKey: {
+        readonly at: "GET /v1/sessions/:id/background rows[] 行键(<键> → 在场律)";
+        readonly members: {
+            sessionId: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
+    /** 会话列表行(`GET /v1/sessions` 的 `sessions[]`;同一只投影 = `PATCH /v1/sessions/:id` 的 200 体与 409 `conflict.session_row_changed` 的 `currentRow`)上本版新出现的键:`rowTag` —— 行标签(条件写的前置条件值;读时派生、零存储)。 */
+    readonly sessionsListRowKey: {
+        readonly at: "GET /v1/sessions sessions[] 行键 = PATCH /v1/sessions/:id 200 体 = 409 conflict.session_row_changed currentRow(<键> → 在场律)";
+        readonly members: {
+            rowTag: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /** `tool_end` 帧 `gate.disposition`(denied 臂)上的键(<臂>#<键> → 在场律;回放面 `GET /v1/runs/:id/events` 同读):`extension` —— hook 层拒且拒者的扩展注册名已知时 = 那张注册的名字(过出口座)。 */
     readonly toolEndGateDispositionKey: {
         readonly at: "tool_end gate.disposition 键(<臂>#<键> → 在场律)";
@@ -765,6 +789,10 @@ export declare const SELF_MINTED_WIRE: {
                 attr: string;
                 since: string;
             };
+            fork_target: {
+                attr: string;
+                since: string;
+            };
             scratchpad_root: {
                 attr: string;
                 since: string;
@@ -1242,6 +1270,75 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 200;
                 readonly since: "7.137.0";
             };
+            readonly "POST /v1/tasks|/v1/tasks/stream|/v1/runs#rewindFiles(\u65B0\u63D0\u4EA4;\u4F53 request.body_shape + unknownKeys [rewindFiles])": {
+                readonly attr: 400;
+                readonly since: "7.139.0";
+            };
+            readonly "POST /v1/side-query#uncoded_error_with_preflight_prefix(\u6CA1\u6709\u5F15\u64CE\u7801\u3001\u82F1\u6587\u5F00\u5934\u4E0E\u524D\u7F00\u8868\u540C\u5F62\u7684\u9519\u8BEF;\u4F53 internal.error)": {
+                readonly attr: 500;
+                readonly since: "7.139.0";
+            };
+            readonly "PATCH /v1/sessions/:id#mirror_row(\u53EA\u8BFB\u955C\u50CF\u884C\u4E0A\u7684\u5199,\u5E26\u4E0D\u5E26 expectedRowTag;\u4F53 conflict.session_mirror + forkPath)": {
+                readonly attr: 409;
+                readonly since: "7.139.0";
+            };
+            readonly "PATCH /v1/sessions/:id#owner_changed_after_gate(\u95E8\u90A3\u4E00\u8BFB\u4E4B\u540E\u540C\u4E00\u4F1A\u8BDD\u7684\u5C5E\u4E3B\u88AB\u6539;\u4F53 not_found.session)": {
+                readonly attr: 404;
+                readonly since: "7.139.0";
+            };
+            readonly "PATCH /v1/sessions/:id#expectedRowTag_stale(\u884C\u5DF2\u4E0D\u5728\u90A3\u53EA\u6807\u7B7E\u4E0A;\u4F53 conflict.session_row_changed + currentRow)": {
+                readonly attr: 409;
+                readonly since: "7.139.0";
+            };
+            readonly "PATCH /v1/sessions/:id#expectedRowTag_current(\u884C\u4ECD\u5728\u90A3\u53EA\u6807\u7B7E\u4E0A;\u4F53 = \u5217\u8868\u884C)": {
+                readonly attr: 200;
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/memory/entries/:entryId/provenance|POST /v1/memory/erase|GET /v1/memory/origin/clearances|POST /v1/memory/origin/entries/:entryId/clear#layer_unaddressed_two_stores(\u4E0D\u70B9\u540D\u5C42\u7684\u6761\u76EE id / \u5E97\u7EA7\u8D26\u672C\u8BF7\u6C42,\u672C\u90E8\u7F72\u70B9\u540D\u7684\u5C42\u5206\u4F4F\u4E24\u53EA\u5E97;\u4F53 request.memory_layer)": {
+                readonly attr: 400;
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/memory/erase|POST /v1/sessions/:id/memory/erase#erasure_store_unjudged(\u62B9\u9664\u843D\u5230\u90E8\u7F72\u7684\u5E97\u4E4B\u5916\u7684\u90A3\u53EA\u5E97:\u70B9\u540D\u7684\u5C42\u4F4F\u5728\u4E2A\u4EBA\u6302\u8F7D\u4E0A,\u6216\u6309\u4F1A\u8BDD\u62B9\u9664\u800C\u8FD9\u53EA\u4F1A\u8BDD\u5728\u53E6\u4E00\u53EA\u5E97\u6709\u8D21\u732E / \u90A3\u53EA\u5E97\u7684\u8D26\u8BFB\u4E0D\u51FA;\u4F53 memory.erasure_store_unjudged,\u4EC0\u4E48\u90FD\u6CA1\u5220)": {
+                readonly attr: 409;
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/memory/export|POST /v1/memory/import|GET /v1/memory/origin/external|POST /v1/memory/erase#layers_span_two_stores(\u8BF7\u6C42\u70B9\u540D\u7684\u5C42\u5206\u4F4F\u4E24\u53EA\u5E97;\u4F53 request.memory_layer)": {
+                readonly attr: 400;
+                readonly since: "7.140.0";
+            };
+            readonly "\u8BB0\u5FC6\u8BF8\u53E3 + POST /v1/admin/memory/consolidation/run|GET /v1/admin/memory/consolidation|GET /v1/memory/export|POST /v1/memory/sync/:scope#layer_unreadable(\u8BF7\u6C42\u70B9\u540D\u7684\u5C42\u5F15\u64CE\u8BFB\u4E0D\u51FA;\u4F53 request.memory_layer)": {
+                readonly attr: 400;
+                readonly since: "7.140.0";
+            };
+        };
+    };
+    /**
+     * 记忆动词的**层座**(`<端点>#<查询串 | 体>.scope` → 读法):不点名层的动词(条目 id / 会话 id / 店级账本)多一个可选的 `scope`,只用来定店;唯一读法 =
+     * `http/memory-layer-reply.ts` 的 `readLayerSeat`(在场而不是非空串 ⇒ 400、面不调)。只登本版新增的座。
+     */
+    readonly memoryLayerSeatKey: {
+        readonly at: "记忆动词的层座(<端点>#<query | body>.scope → 读法;只登本版新增的)";
+        readonly members: {
+            readonly "GET /v1/memory/entries/:entryId/provenance#query.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers";
+                readonly since: "7.140.0";
+            };
+            readonly "GET /v1/memory/origin/clearances#query.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers";
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/memory/origin/entries/:entryId/clear#body.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;not passed to the engine";
+                readonly since: "7.140.0";
+            };
+            readonly "GET /v1/sessions/:id/memory-status#query.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ every store of this deployment, folded;cache keyed by (session, store control plane)";
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/sessions/:id/memory/erase#body.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ the deployment's store;selector still minted from the path";
+                readonly since: "7.140.0";
+            };
         };
     };
     /**
@@ -1351,6 +1448,22 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: "unsupported (a body field of POST /v1/assistant/tasks/:id/plan_review — send it there, this door never reads it): checkpointId";
                 readonly since: "7.137.0";
             };
+            readonly "400 request.body_shape#PATCH /v1/sessions/:id": {
+                readonly attr: "the body must be a JSON object carrying at least one of `title` and `pinned` (and, optionally, `expectedRowTag`), and nothing else";
+                readonly since: "7.139.0";
+            };
+            readonly "400 request.field_invalid#PATCH /v1/sessions/:id.expectedRowTag": {
+                readonly attr: "expectedRowTag must be the `rowTag` string a session list row carries (43 characters: letters, digits, `-` and `_`)";
+                readonly since: "7.139.0";
+            };
+            readonly "409 conflict.session_mirror#PATCH /v1/sessions/:id": {
+                readonly attr: "this session is a read-only mirror of a session whose writer is elsewhere — it cannot be renamed or pinned here; fork it (forkPath) to continue here; nothing was written";
+                readonly since: "7.139.0";
+            };
+            readonly "409 conflict.session_row_changed#PATCH /v1/sessions/:id": {
+                readonly attr: "the session row changed since the rowTag you sent was read — nothing was written; currentRow is the row as it stands now: decide again, then send its rowTag";
+                readonly since: "7.139.0";
+            };
         };
     };
     /**
@@ -1366,6 +1479,27 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /**
+     * 会话行写口 `PATCH /v1/sessions/:id`:体受理键里本版新增的一键与它两只 409 拒体上的键(`<面>#<键>` → 读法 / 在场律)。受理闭集属主 = `session-row.ts` 的体读者 `readSessionRowPatch`;
+     * `conflict.session_mirror#forkPath` 是执行面同码同键,本版新出现的面是 PATCH。
+     */
+    readonly sessionRowWriteKey: {
+        readonly at: "PATCH /v1/sessions/:id 体受理键与 409 拒体键(<面>#<键> → 读法 / 在场律;只登本版新增的)";
+        readonly members: {
+            readonly "body#expectedRowTag": {
+                readonly attr: "optional;43×[A-Za-z0-9_-] else 400 request.field_invalid;alone 400 request.body_shape;stale⇒409 conflict.session_row_changed";
+                readonly since: "7.139.0";
+            };
+            readonly "409 conflict.session_row_changed#currentRow": {
+                readonly attr: "always";
+                readonly since: "7.139.0";
+            };
+            readonly "409 conflict.session_mirror#forkPath": {
+                readonly attr: "always";
+                readonly since: "7.139.0";
+            };
+        };
+    };
     /**
      * `409 approval_stale` 拒体上的键,按出现面登记(`<端点>#<键>` → 在场律)。`currentPending` 的值形是每道门一形(`wire-types.ts` 的 `ApprovalStaleCurrentPending`:
      * 这道门的决断体回显的那几位);本表只登本版新出现的面(`/decide` 那一形早于本表,不在这里)。
@@ -1625,8 +1759,32 @@ export declare const SELF_MINTED_WIRE: {
                 readonly since: "7.136.0";
             };
             readonly "GET /v1/config/catalog#rows[K8S_SANDBOX_ENV].semantics": {
-                readonly attr: "values-only-in-the-pod-own-secret;role-needs-secrets-create;denied-refuses-boot";
-                readonly since: "7.137.0";
+                readonly attr: "values-only-in-the-pod-own-secret;role-needs-secrets-create;denied-refuses-boot;own-credential-name-refuses-boot";
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/config/catalog#rows[K8S_NAMESPACE].semantics": {
+                readonly attr: "required-no-default;absent-or-blank-refuses-boot";
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/config/catalog#rows[E2B_SANDBOX_ENV].semantics": {
+                readonly attr: "own-credential-name-refuses-boot";
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/config/catalog#rows[DOCKER_SANDBOX_ENV].semantics": {
+                readonly attr: "own-credential-name-refuses-boot";
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/config/catalog#rows[CONFIG_PROVIDER].semantics": {
+                readonly attr: "remote-without-center-url-refuses-boot";
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/config/catalog#rows[RETENTION_MODE].semantics": {
+                readonly attr: "enforce-without-horizon-or-cadence-refuses-boot";
+                readonly since: "7.139.0";
+            };
+            readonly "GET /v1/config/catalog#rows[RETENTION_SWEEP_INTERVAL_SEC].semantics": {
+                readonly attr: "cadence-without-horizon-refuses-boot";
+                readonly since: "7.139.0";
             };
             /**
              * MCP 远端失败句在面板与重拨回执上的出口读法:出口座的 `mcp-remote-text` 行(`trace/exit-seat.ts`)—— 与 trace / 通告同一个脱敏器(引擎记号 `[redacted]` = 已抹的值,原样;
@@ -1657,6 +1815,15 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: "names-engine-notice:model.capability_downgraded";
                 readonly since: "7.137.0";
             };
+            /**
+             * 7.140.0:会话记忆状态不带层座 ⇒ 本部署每一只店的引擎答案按一条折叠律合成一份(`memory-operator-faces.ts` `foldPlaneStatuses`;契约 §9 开头):
+             * 计数相加 / 最近一次取大 / 任一店有采集记录即 true / 任一店读不出 ⇒ 那一键缺席。一只店 ⇒ 恒等(单店部署字节同上一版)。
+             * 钉 test/memory-operator-faces.test.ts「逐店折叠律」、test/memory-layer-seat-http.test.ts「会话记忆状态不带层座」。
+             */
+            readonly "GET /v1/sessions/:id/memory-status#committedCount|foldedCount|lastCaptureAt|captureOptedOut|optOutSource(\u4E0D\u5E26\u5C42\u5EA7)": {
+                readonly attr: "fold-across-deployment-stores(sum|max|any-record|absent-if-any-unreadable);one-store⇒identity";
+                readonly since: "7.140.0";
+            };
         };
     };
 };

package/dist/trace/self-minted-wire.js

@@ -45,6 +45,7 @@ export const SELF_MINTED_WIRE = {
             "memory.erasure_evidence_unavailable": { attr: 409, since: "7.108.0" },
             "memory.erasure_selector_mismatch": { attr: 409, since: "7.108.0" },
             "memory.erasure_census_incomplete": { attr: 409, since: "7.108.0" },
+            "memory.erasure_store_unjudged": { attr: 409, since: "7.140.0" },
             "internal.memory_control_plane_corrupt": { attr: 500, since: "7.108.0" },
         },
     },
@@ -233,6 +234,18 @@ export const SELF_MINTED_WIRE = {
             supportsThinkingOff: { attr: "always", since: "7.138.0" },
         },
     },
+    sessionBackgroundRowKey: {
+        at: "GET /v1/sessions/:id/background rows[] 行键(<键> → 在场律)",
+        members: {
+            sessionId: { attr: "present-iff background agent row bound to a child session", since: "7.139.0" },
+        },
+    },
+    sessionsListRowKey: {
+        at: "GET /v1/sessions sessions[] 行键 = PATCH /v1/sessions/:id 200 体 = 409 conflict.session_row_changed currentRow(<键> → 在场律)",
+        members: {
+            rowTag: { attr: "present-iff the row can be written conditionally (the store has the row write primitive and the row carries an incarnation)", since: "7.139.0" },
+        },
+    },
     toolEndGateDispositionKey: {
         at: "tool_end gate.disposition 键(<臂>#<键> → 在场律)",
         members: {
@@ -283,6 +296,7 @@ export const SELF_MINTED_WIRE = {
             file_history_restore: { attr: "-", since: "7.133.0" },
             skills_disabled: { attr: "-", since: "7.133.0" },
             existing_session: { attr: "-", since: "7.133.0" },
+            fork_target: { attr: "-", since: "7.139.0" },
             scratchpad_root: { attr: "-", since: "7.133.0" },
             ask_answer: { attr: "-", since: "7.133.0" },
             policy_person_ask: { attr: "-", since: "7.133.0" },
@@ -441,6 +455,26 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/tasks|/v1/tasks/stream|/v1/runs#限制侧名内带 *(agents[i].denyTools)": { attr: 200, since: "7.137.0" },
             "POST /v1/assistant/tasks/:id/plan_review#checkpointId_not_current(体带的门身份不是该会话此刻待决的 plan 门;体 approval_stale + currentPending { checkpointId }?;不落决断、零状态改动)": { attr: 409, since: "7.137.0" },
             "POST /v1/assistant/tasks/:id/plan_review#checkpointId_current(体带当前门的身份;受理形与不带键同)": { attr: 200, since: "7.137.0" },
+            "POST /v1/tasks|/v1/tasks/stream|/v1/runs#rewindFiles(新提交;体 request.body_shape + unknownKeys [rewindFiles])": { attr: 400, since: "7.139.0" },
+            "POST /v1/side-query#uncoded_error_with_preflight_prefix(没有引擎码、英文开头与前缀表同形的错误;体 internal.error)": { attr: 500, since: "7.139.0" },
+            "PATCH /v1/sessions/:id#mirror_row(只读镜像行上的写,带不带 expectedRowTag;体 conflict.session_mirror + forkPath)": { attr: 409, since: "7.139.0" },
+            "PATCH /v1/sessions/:id#owner_changed_after_gate(门那一读之后同一会话的属主被改;体 not_found.session)": { attr: 404, since: "7.139.0" },
+            "PATCH /v1/sessions/:id#expectedRowTag_stale(行已不在那只标签上;体 conflict.session_row_changed + currentRow)": { attr: 409, since: "7.139.0" },
+            "PATCH /v1/sessions/:id#expectedRowTag_current(行仍在那只标签上;体 = 列表行)": { attr: 200, since: "7.139.0" },
+            "GET /v1/memory/entries/:entryId/provenance|POST /v1/memory/erase|GET /v1/memory/origin/clearances|POST /v1/memory/origin/entries/:entryId/clear#layer_unaddressed_two_stores(不点名层的条目 id / 店级账本请求,本部署点名的层分住两只店;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+            "POST /v1/memory/erase|POST /v1/sessions/:id/memory/erase#erasure_store_unjudged(抹除落到部署的店之外的那只店:点名的层住在个人挂载上,或按会话抹除而这只会话在另一只店有贡献 / 那只店的账读不出;体 memory.erasure_store_unjudged,什么都没删)": { attr: 409, since: "7.140.0" },
+            "POST /v1/memory/export|POST /v1/memory/import|GET /v1/memory/origin/external|POST /v1/memory/erase#layers_span_two_stores(请求点名的层分住两只店;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+            "记忆诸口 + POST /v1/admin/memory/consolidation/run|GET /v1/admin/memory/consolidation|GET /v1/memory/export|POST /v1/memory/sync/:scope#layer_unreadable(请求点名的层引擎读不出;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+        },
+    },
+    memoryLayerSeatKey: {
+        at: "记忆动词的层座(<端点>#<query | body>.scope → 读法;只登本版新增的)",
+        members: {
+            "GET /v1/memory/entries/:entryId/provenance#query.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers", since: "7.140.0" },
+            "GET /v1/memory/origin/clearances#query.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers", since: "7.140.0" },
+            "POST /v1/memory/origin/entries/:entryId/clear#body.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;not passed to the engine", since: "7.140.0" },
+            "GET /v1/sessions/:id/memory-status#query.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ every store of this deployment, folded;cache keyed by (session, store control plane)", since: "7.140.0" },
+            "POST /v1/sessions/:id/memory/erase#body.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ the deployment's store;selector still minted from the path", since: "7.140.0" },
         },
     },
     refusalSentenceForm: {
@@ -471,6 +505,10 @@ export const SELF_MINTED_WIRE = {
             "400 request.field_invalid#plan_review.checkpointId.not_non_empty_string": { attr: "checkpointId must be a non-empty string (the identity of the plan gate you decided on: …)", since: "7.137.0" },
             "400 request.field_invalid#plan_review.checkpointId.too_large": { attr: "checkpointId too large (max <n> chars)", since: "7.137.0" },
             "400 request.body_shape#/decide.checkpointId(落 unsupportedKeys)": { attr: "unsupported (a body field of POST /v1/assistant/tasks/:id/plan_review — send it there, this door never reads it): checkpointId", since: "7.137.0" },
+            "400 request.body_shape#PATCH /v1/sessions/:id": { attr: "the body must be a JSON object carrying at least one of `title` and `pinned` (and, optionally, `expectedRowTag`), and nothing else", since: "7.139.0" },
+            "400 request.field_invalid#PATCH /v1/sessions/:id.expectedRowTag": { attr: "expectedRowTag must be the `rowTag` string a session list row carries (43 characters: letters, digits, `-` and `_`)", since: "7.139.0" },
+            "409 conflict.session_mirror#PATCH /v1/sessions/:id": { attr: "this session is a read-only mirror of a session whose writer is elsewhere — it cannot be renamed or pinned here; fork it (forkPath) to continue here; nothing was written", since: "7.139.0" },
+            "409 conflict.session_row_changed#PATCH /v1/sessions/:id": { attr: "the session row changed since the rowTag you sent was read — nothing was written; currentRow is the row as it stands now: decide again, then send its rowTag", since: "7.139.0" },
         },
     },
     decisionBodyKey: {
@@ -479,6 +517,14 @@ export const SELF_MINTED_WIRE = {
             "POST /v1/assistant/tasks/:id/plan_review#checkpointId": { attr: "optional;non-empty-string≤128;not-current⇒409 approval_stale;direct-door:signed-envelope-ext", since: "7.137.0" },
         },
     },
+    sessionRowWriteKey: {
+        at: "PATCH /v1/sessions/:id 体受理键与 409 拒体键(<面>#<键> → 读法 / 在场律;只登本版新增的)",
+        members: {
+            "body#expectedRowTag": { attr: "optional;43×[A-Za-z0-9_-] else 400 request.field_invalid;alone 400 request.body_shape;stale⇒409 conflict.session_row_changed", since: "7.139.0" },
+            "409 conflict.session_row_changed#currentRow": { attr: "always", since: "7.139.0" },
+            "409 conflict.session_mirror#forkPath": { attr: "always", since: "7.139.0" },
+        },
+    },
     approvalStaleBodyKey: {
         at: "409 approval_stale 拒体(<端点>#<键> → 在场律)",
         members: {
@@ -552,12 +598,19 @@ export const SELF_MINTED_WIRE = {
             "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_BUCKET].semantics": { attr: "boot-checks-bucket;runtime-latest-no-such-bucket-fails-run", since: "7.136.0" },
             "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_PREFIX].semantics": { attr: "multi-segment-prefix;bad-segment-refuses-boot", since: "7.136.0" },
             "GET /v1/config/catalog#rows[WORKSPACE_SNAPSHOT_PREFIX].derivedDefaultNote": { attr: "absent=>kata", since: "7.136.0" },
-            "GET /v1/config/catalog#rows[K8S_SANDBOX_ENV].semantics": { attr: "values-only-in-the-pod-own-secret;role-needs-secrets-create;denied-refuses-boot", since: "7.137.0" },
+            "GET /v1/config/catalog#rows[K8S_SANDBOX_ENV].semantics": { attr: "values-only-in-the-pod-own-secret;role-needs-secrets-create;denied-refuses-boot;own-credential-name-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[K8S_NAMESPACE].semantics": { attr: "required-no-default;absent-or-blank-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[E2B_SANDBOX_ENV].semantics": { attr: "own-credential-name-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[DOCKER_SANDBOX_ENV].semantics": { attr: "own-credential-name-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[CONFIG_PROVIDER].semantics": { attr: "remote-without-center-url-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[RETENTION_MODE].semantics": { attr: "enforce-without-horizon-or-cadence-refuses-boot", since: "7.139.0" },
+            "GET /v1/config/catalog#rows[RETENTION_SWEEP_INTERVAL_SEC].semantics": { attr: "cadence-without-horizon-refuses-boot", since: "7.139.0" },
             "GET /v1/sessions/:id/mcp#servers[].error": { attr: "exit-seat:mcp-remote-text(engine-mark=masked-value)+truncate:200", since: "7.138.0" },
             "POST /v1/sessions/:id/mcp/reconnect#reason|status.error|listingIncomplete.error": { attr: "exit-seat:mcp-remote-text(engine-mark=masked-value)+truncate:200", since: "7.138.0" },
             "GET /v1/config/catalog#rows[MODEL_VISION].semantics": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },
             "GET /v1/config/catalog#rows[MODEL_VISION].derivedDefaultNote": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },
             "GET /v1/config/catalog#rows[MODEL_CHEAP_VISION].semantics": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },
+            "GET /v1/sessions/:id/memory-status#committedCount|foldedCount|lastCaptureAt|captureOptedOut|optOutSource(不带层座)": { attr: "fold-across-deployment-stores(sum|max|any-record|absent-if-any-unreadable);one-store⇒identity", since: "7.140.0" },
         },
     },
 };

package/dist/url-refusal.d.ts

@@ -12,7 +12,7 @@
  * 拒句从源头不含解析记号 —— 判官只给规则词,值只经本模块的展示律出现。
  *
  * ## 读者
- * 中心基址三席 + 公告地址 + 请求期 `centerFetch`(`web-admin-client/center-request.ts` `pathBaseUrlRefusal`:禁 userinfo / query / fragment)·
+ * 中心基址三席 + 公告地址 + 记忆同步中心基址 `MEMORY_SYNC_URL` + 请求期 `centerFetch`(`web-admin-client/center-request.ts` `pathBaseUrlRefusal`:禁 userinfo / query / fragment)·
  * 续签 issuer(只问形)· 模型路由三键(`model-route-url.ts`:禁 userinfo / fragment,query 照收)· `MEMORY_EMBEDDER_ENDPOINT` 与
  * `A2A_SERVE_URL`(禁 userinfo)· `SANDBOX_PKG_SOURCE=custom` 六只地址(形 + 带凭据,后者的判官是契约包根的 `findUrlCredential`,拒句经 {@link buildUrlCredentialRefusal})。
  * 「scheme 只有判官与展示铸点读」由 `test/config-url-display-safe.test.ts` 的读者普查门钉住。

package/dist/web-admin-client/apply-effective.d.ts

@@ -94,9 +94,11 @@ export declare function withModelPlaneOf<E extends EffectiveConfig>(target: E, s
  */
 export declare function fullyLandedForLkg(read: ConfigCandidateRead, report: ApplyReport | undefined): boolean;
 /**
- * [ref]:组拒码 → 铸它的那条模型面不变量 —— **以码为键**(组拒码闭集的属主是 settings-schema `MODEL_PLANE_REFUSAL_CODES`;那边加一个码
- * ⇒ 本表缺键 ⇒ 本仓 tsc 红)。模型面 stage 的组拒按**码**铸(码是判决那刻的数据),不变量 id 由本表派生 —— 一个 id 两个码
- * (`model-route-endpoint`)时码不可能从 id 反推,反过来查才是全函数。
+ * [ref]:组拒码 → 铸它的那条模型面不变量 —— **以码为键**。组拒码闭集的属主是 settings-schema `MODEL_PLANE_REFUSAL_CODES`,每个码恰有**一个铸码方**,
+ * 分两本账(下面两个表 + 三道编译门;那边加一个码而这两本都没收 ⇒ 本仓 tsc 红):
+ *  · 本表 = **本仓模型面 stage 自己铸**的码 → 铸它的不变量。模型面 stage 的组拒按**码**铸(码是判决那刻的数据),不变量 id 由本表派生 —— 一个 id 两个码
+ *    (`model-route-endpoint`)时码不可能从 id 反推,反过来查才是全函数;
+ *  · {@link ENGINE_MINTED_PLANE_REFUSAL_CODES} = 契约包出码、执法者是本仓但**今天未执法**的码(名字里的 ENGINE 沿契约包的词义 = worker,即本仓),本仓 stage 现在不铸。
  */
 export declare const PLANE_REFUSAL_INVARIANT_OF: {
     readonly "config.default_model_missing": "default-model-resolvable";
@@ -104,6 +106,18 @@ export declare const PLANE_REFUSAL_INVARIANT_OF: {
     readonly "config.model_route_endpoint_missing": "model-route-endpoint";
     readonly "config.gateway_fallback_without_primary": "model-route-endpoint";
 };
+/**
+ * 契约包出码、执法者是本仓但今天**未执法**的两只组拒码:本地配置腿上「管模型面的目录会顶替已声明的 env 表、决定不是 `replaced`」那道闸,与「每个任务都要解的 summarize 落不到可服务条目」的不变量。
+ *
+ * 词义:settings-schema 发布说明里的「engine / 引擎一侧」指**本仓(worker)**,不是 `@sema-agent/core` —— 这两码要的全部输入(本地配置腿、env 表、模型面 stage 与组拒口)只在本仓,core 里没有读
+ * `MODEL_ID` / `config.d` 的地方、也没有组拒码。(契约包自己有几处把同一个词写成 core 7.58.0,那是它的叫法错。)所以本仓 stage 现在没有对应的不变量、不铸这两个码,不是因为「归引擎」,而是**还没做**,两码各自候什么:
+ *  · `CATALOG_REPLACES_ENV_MODELS_CODE`:执法是一整组跨仓件 —— 开机迁移 SS-M11(铸决定文档)· 本地腿每拍读决定(读数身份进候选的 etag)· 目录信任判官走根级文档 · 命令行 / 桌面 / 客户端核心三个写者先接契约包的计划助手;
+ *    候设计票。在那之前,候选目录管着模型面而 env 表也声明了时,仍照旧由目录服务(与升级前逐位同)。
+ *  · `SUMMARIZE_MODEL_MISSING_CODE`:码的前提是「summarize 落不到可服务条目 ⇒ 采纳后每个任务都被拒」,而本仓所钉 core 7.59.0 起非严格座位(summarize 在内)点名目录里没有的词时读作未设、沿自己的回落链走
+ *    (summarize 的链是 → default,即回落缺省模型)并通告 `model.role_defaulted`;链上没有可解的模型才拒 —— 前提与所钉 core 相抵,候上游(settings-schema / core)重定义或退役这个码;在那之前 summarize 角色绑到不可用条目时仍是角色绑定那一行 warn(`ROLE_BINDING_UNAVAILABLE_HINT`),不是组拒。
+ * 两码开始被铸之后,它们进 `/health.modelRefusals.plane` 的座位是**另案设计**(现在没有座:见 `model-plane-face.ts` 对「装配期被引擎整份拒收」的披露),不在这张表里偷铸一个不变量替它占位。
+ */
+export declare const ENGINE_MINTED_PLANE_REFUSAL_CODES: readonly ["config.catalog_replaces_env_models", "config.summarize_model_missing"];
 /**
  * [ref] —— **「无中心配置」档的候选**:中心凭证换人时,server 把在用的中心配置降到这一档({@link applyEffective} 吃它,和吃任何候选走同一条 stage → swap → commit)。
  * 它的意思是「**撤回**中心配置」—— 中心下发的每个热面回 env 底:

package/dist/web-admin-client/apply-effective.js

@@ -1,8 +1,8 @@
-import { expandTiers, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
-import { WEB_ADMIN_ENV, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
+import { expandTiers, modelOriginOf, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
+import { CATALOG_REPLACES_ENV_MODELS_CODE, SUMMARIZE_MODEL_MISSING_CODE, WEB_ADMIN_ENV, narrowAtMention, resolveActiveTiers, resolveCatalogDefaultModel } from "@sema-agent/settings-schema";
 import { modelKeyPoison } from "../key-resolver.js";
 import { buildEnvModelIdNotServedNotice, mintCapabilityKeys, readAtMention, servedModelTableLeg } from "../model-select.js";
-import { applyAutoCompactWindow, buildModelCostKey, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
+import { applyAutoCompactWindow, buildModelCostKey, ownCredentialHitsInForce, parseAutonomy, unmatchableToolNamesRefusal } from "../config.js";
 import { NAME_TABLE_BEHAVIOR } from "../namespaced-rule-name.js";
 import { buildModelCompat, readModelCompat } from "../model-compat.js";
 import { buildModelHeadersKey } from "../model-entry-headers.js";
@@ -118,7 +118,7 @@ export function applyEffective(config, eff, logger, opts) {
     }
     const mp = staged.modelPlaneGroup.stages.models;
     if (mp !== undefined) {
-        declareCandidateWithheldEnv(mp.modelApiKeyEnv, staged.version);
+        declareCandidateWithheldEnv(config, mp.modelApiKeyEnv, staged.version);
         if (opts.swapPlane !== undefined) {
             try {
                 opts.swapPlane({ models: mp.models, tiers: mp.activeTiers });
@@ -171,17 +171,25 @@ export function applyEffective(config, eff, logger, opts) {
         logger?.info("web_admin_projects", { projects: Object.keys(staged.projects) });
     return true;
 }
-function declareCandidateWithheldEnv(modelApiKeyEnv, version) {
+function declareCandidateWithheldEnv(seats, modelApiKeyEnv, version) {
+    const entries = Object.entries(modelApiKeyEnv)
+        .map(([model, envName]) => `${model}→${envName}`)
+        .join(", ");
     try {
         declareServerWithheldEnv(modelApiKeyEnv);
     }
     catch (err) {
-        const entries = Object.entries(modelApiKeyEnv)
-            .map(([model, envName]) => `${model}→${envName}`)
-            .join(", ");
         throw new Error(`model catalog (effective v${version}): a model entry's apiKeyEnv names a variable the engine cannot withhold from model-driven shells — ` +
             `the candidate is refused whole and the current generation keeps serving; fix that entry's apiKeyEnv (entries: ${entries}). Engine: ${err instanceof Error ? err.message : String(err)}`);
     }
+    const handedOn = ownCredentialHitsInForce(seats);
+    if (handedOn.length === 0)
+        return;
+    withdrawServerWithheldEnv();
+    throw new Error(`model catalog (effective v${version}): a model entry's apiKeyEnv names a variable a name-list env knob hands on — ` +
+        handedOn.map((h) => `env ${h.knob} hands on ${h.name}, which this candidate makes ${h.problem}`).join("; ") +
+        `; or point that entry's apiKeyEnv at a variable no name list hands on. The name lists are read at boot (changing one takes a restart); ` +
+        `the candidate is refused whole and the current generation keeps serving (entries: ${entries}).`);
 }
 function commitStaged(config, staged) {
     const mp = staged.modelPlaneGroup.stages.models;
@@ -240,13 +248,14 @@ export const PLANE_REFUSAL_INVARIANT_OF = {
     "config.model_route_endpoint_missing": "model-route-endpoint",
     "config.gateway_fallback_without_primary": "model-route-endpoint",
 };
+export const ENGINE_MINTED_PLANE_REFUSAL_CODES = [CATALOG_REPLACES_ENV_MODELS_CODE, SUMMARIZE_MODEL_MISSING_CODE];
 function modelPlaneGroupReport(group) {
     return {
         applied: MODEL_PLANE_DOMAINS.flatMap((d) => (group.stages[d] !== undefined ? MODEL_PLANE_SURFACES[d] : [])),
         ...(group.rejected !== undefined ? { rejected: { keys: group.rejected.keys, reason: group.rejected.reason } } : {}),
     };
 }
-const ROLE_BINDING_UNAVAILABLE_HINT = "tasks resolving this role fail: alias/tier expansion cannot mint this name; the engine refuses it loud — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
+const ROLE_BINDING_UNAVAILABLE_HINT = "alias/tier expansion cannot mint this name, so the engine does not hold it: a strict seat (default, classifier) refuses the task loud; any other role reads as unset and falls back along its own chain with a model.role_defaulted notice (refused only when nothing on that chain resolves) — bind the role to a usable model, or make the entry usable (see the entry's own warn)";
 export const NO_CENTER_EFFECTIVE = deepFreeze({ version: 0, updatedAt: "", models: { models: [], roles: {} }, mcp: { servers: [] } });
 export const isNoCenterEffective = (eff) => eff === NO_CENTER_EFFECTIVE;
 function deepFreeze(v) {
@@ -636,7 +645,8 @@ function engineDefaultOfSelect(select, models, activeTiers) {
     catch (err) {
         return { unresolved: err instanceof Error ? err.message : String(err) };
     }
-    const name = Object.keys(models).find((n) => models[n] === picked);
+    const origin = modelOriginOf(picked);
+    const name = Object.keys(models).find((n) => models[n] === origin);
     return name !== undefined ? { name } : { unresolved: "the engine picked a model object that is not an entry of the usable catalog" };
 }
 export function logEffectiveDiff(config, eff, logger) {

package/dist/web-admin-client/candidate-gate.d.ts

@@ -1,10 +1,12 @@
 /**
  * 配置候选的**唯一判官**:一份候选(中心有效视图,或本地 `config.d` 读出的那份)能不能收 —— 只有这一种判法。
  *
- * 判据(三件,任一即拒;每条拒因带成因词,闭集 {@link CandidateRejectReason}):读腿交出的 `domainErrors`(某个域读不懂 / 拼错键 / 坏文件:那个域已落
+ * 判据(三件,任一即拒;每条拒因带成因词,闭集 {@link CandidateRejectReason}):读腿交出的 `domainErrors`(某个域判形失败 / 拼错键 / 悬空引用:那个域已落
  * schema 缺省)与 prompts 面的判官(`judgePromptsWire`:契约包的 wire 形再交引擎 verify —— 中心层只有一种形)—— 成因 `domain_invalid`;读腿交出的
- * `retiredDomains`(带事实的退役域文档,契约包的墓碑;拒句点名退役版本与一次性迁移)—— 成因 `retired_domain`。任一 ⇒ `rejected`:
- * **整份候选不收**,一个域都不应用。退役域此前在读腿整包抛、走「源不可达」那条臂(版本读不到、没有拒判行、刷新拍算失败);现在读腿只交数据,
+ * `refusedDocuments`(读它的域之前契约就拒了的那份文档 —— 契约的类型 `ConfigDocumentRefusal`:带事实的退役域 = 墓碑,或 `config.d` 里契约的文件层拒的一份 ——
+ * 空 / 坏 JSON / 不是对象 / 读失败)—— 成因就是那份发现自带的词(契约闭集 `CONFIG_DOCUMENT_REFUSAL_REASONS`),拒行的 `domain` 是它的 `document`。
+ * 任一 ⇒ `rejected`:**整份候选不收**,一个域都不应用。
+ * 被拒文档此前要么在读腿整包抛、走「源不可达」那条臂(墓碑;门控域的坏文件),要么被读成「域按缺省落 + 域诊断」(目录域的坏文件);现在读腿只交数据,
  * 坏候选只有本判官一种判法。
  * 读腿的逐条丢弃(`droppedEntries`)不在这里 —— 颗粒是条目的失效留在条目上,候选照收(调用方响亮点名)。
  *
@@ -27,23 +29,25 @@
  * (盘上 LKG 的读回复判也经本判官,`config-lkg.ts`)。
  */
 import type { PublishedPromptArtifact } from "@sema-agent/core";
+import type { ConfigDocumentRefusal, ConfigDocumentRefusalReason } from "@sema-agent/settings-schema";
 import type { EffectiveConfig } from "./types.js";
 /** 读腿交出的一条域级诊断(与 `FetchEffectiveResult.domainErrors` 同形;error 文案已在产出边界脱敏)。 */
 export interface CandidateDomainError {
     readonly domain: string;
     readonly error: string;
 }
-/** 判官拒一份候选的成因(闭集):某个域判形失败(含 prompts 面)/ 带事实的退役域文档(墓碑)。 */
-export type CandidateRejectReason = "domain_invalid" | "retired_domain";
+/** 判官拒一份候选的成因(闭集):某个域判形失败(含 prompts 面)`domain_invalid` ∪ 被拒文档自带的词(契约闭集 `CONFIG_DOCUMENT_REFUSAL_REASONS`:
+ *  `empty` / `invalid_json` / `not_object` / `io` 文件层,`retired_domain` 墓碑)—— 被拒文档的词表只在契约一处定义,这里派生(契约加词 ⇒ 按词穷举的读者编译红)。 */
+export type CandidateRejectReason = "domain_invalid" | ConfigDocumentRefusalReason;
 /** 拒判里的一条:哪一域、为什么(读腿 / 契约包的原句)、成因词。`config_candidate_rejected` 行的 `errors` 就是这一列。 */
 export interface CandidateDomainRejection extends CandidateDomainError {
     readonly reason: CandidateRejectReason;
 }
-/** 判官的输入:一份读出来的候选。`retiredDomains` = 读腿交出的退役域发现(两条读腿同形,见 `read-warnings.ts` 的 `RetiredDomainFinding`)。 */
+/** 判官的输入:一份读出来的候选。`refusedDocuments` = 读腿交出的被拒文档(两条读腿同形,契约的类型 `ConfigDocumentRefusal`;判官只读文档名、拒句与成因词)。 */
 export interface ConfigCandidateRead {
     readonly effective: EffectiveConfig;
     readonly domainErrors?: readonly CandidateDomainError[];
-    readonly retiredDomains?: readonly CandidateDomainError[];
+    readonly refusedDocuments?: readonly Pick<ConfigDocumentRefusal, "document" | "error" | "reason">[];
 }
 export type ConfigCandidateVerdict = 
 /** `prompts` = 候选的中心层(引擎 verify 过的发布形 artifact;候选不带 prompts 键 ⇒ `undefined` = 撤下中心层、内置提示词服务)。 */

package/dist/web-admin-client/candidate-gate.js

@@ -5,7 +5,7 @@ export function judgeConfigCandidate(r) {
     const errors = [
         ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error, reason: "domain_invalid" })),
         ...(promptsGate !== undefined && !promptsGate.ok ? [{ domain: "prompts", error: promptsGate.error, reason: "domain_invalid" }] : []),
-        ...(r.retiredDomains ?? []).map((rd) => ({ domain: rd.domain, error: rd.error, reason: "retired_domain" })),
+        ...(r.refusedDocuments ?? []).map((d) => ({ domain: d.document, error: d.error, reason: d.reason })),
     ];
     if (errors.length === 0)
         return { verdict: "clean", prompts: promptsGate?.ok ? promptsGate.artifact : undefined };

package/dist/web-admin-client/http-client.d.ts

@@ -1,11 +1,12 @@
-import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
+import { type ConfigDocumentRefusal, type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
-import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile } from "./read-warnings.js";
+import { type DroppedConfigEntry, type UnreadConfigFile } from "./read-warnings.js";
 import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
- *  `retiredDomains`([ref]):wire 上带事实的退役域(墓碑)不抛 —— 交成发现、那一键不进 effective,候选判官整拒这份候选(与本地腿同键同义)。
+ *  `refusedDocuments`:被拒文档(契约类型 `ConfigDocumentRefusal`,与本地腿同键同义;wire 上只有一种 —— 带事实的退役域,墓碑,成因词 `retired_domain`)不抛 —— 交成发现、那一键不进 effective,
+ *  候选判官整拒这份候选。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
  *  boot/refresh 的候选门直接消费。`droppedEntries`([ref] ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
  *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
@@ -25,7 +26,7 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
     }>;
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
-    retiredDomains?: RetiredDomainFinding[];
+    refusedDocuments?: ConfigDocumentRefusal[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity: string;
 } | null>;

package/dist/web-admin-client/http-client.js

@@ -10,7 +10,7 @@ export async function fetchEffective(center, etag, fetchImpl, worker) {
     if (!res.ok)
         throw new Error(`web-admin HTTP ${res.status}`);
     const warnings = [];
-    const { body, retiredDomains } = separateRetiredDomains(await res.json());
+    const { body, refusedDocuments } = separateRetiredDomains(await res.json());
     const wire = readEffectiveWire(body, (w) => warnings.push(w));
     const { domainErrors, droppedEntries, droppedCatalogEntries, unreadFiles } = splitFoldedReadWarnings(warnings, "center");
     const effective = withDroppedCatalogEntries(wire, droppedCatalogEntries);
@@ -22,7 +22,7 @@ export async function fetchEffective(center, etag, fetchImpl, worker) {
         ...(domainErrors.length > 0 ? { domainErrors } : {}),
         ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
         ...(unreadFiles.length > 0 ? { unreadFiles } : {}),
-        ...(retiredDomains.length > 0 ? { retiredDomains: [...retiredDomains] } : {}),
+        ...(refusedDocuments.length > 0 ? { refusedDocuments: [...refusedDocuments] } : {}),
     };
 }
 export async function fetchPrincipalCaps(center, principal, etag, fetchImpl, worker) {

package/dist/web-admin-client/read-warnings.d.ts

@@ -25,29 +25,19 @@
  * 留在条目上,只有颗粒更粗的失效才动候选。
  */
 import { z } from "zod";
-import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning, type RetiredDomainName } from "@sema-agent/settings-schema";
-/**
- * 退役域的一条**发现**(两条读腿同形)。读腿只把契约包的墓碑(`RetiredDomainError`)换成数据交出去 —— 判决只在候选判官
- * (`candidate-gate.ts` 的 `judgeConfigCandidate`,成因 `retired_domain`):与域判形失败同一条回落链(候选 → 盘上 LKG → env)、同一行
- * `config_candidate_rejected`、刷新拍同形(拍跑完,候选被判拒是结论)。拉取层的抛只剩 I/O 与载荷形(不是一份 effective)两种。
- * `error` = 契约包铸的整句(墓碑表那一行:退役版本、事实今天住哪、一次性迁移 id)—— 模板句,不含任何配置值,所以不过 `redactConfigError`
- * (那道脱敏把引号段换成指纹,会把句中点名的域名换掉)。
- */
-export type RetiredDomainFinding = {
-    readonly domain: RetiredDomainName;
-    readonly error: string;
-    readonly migration: string;
-};
-/** 墓碑 → 发现;不是墓碑 ⇒ `undefined`(调用方照原样抛)。两条读腿的唯一换装点。 */
-export declare function retiredDomainFindingOf(e: unknown): RetiredDomainFinding | undefined;
+import { type ConfigDocumentRefusal, type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 /**
  * 远端读腿在过契约读腿(`readEffectiveWire`)**之前**把退役域键分出去:wire 体上每个退役域键过契约的同一只墓碑(`refuseRetiredDomain`)——
- * 带事实 ⇒ 一条发现、这一键从体上拿掉(其余域照读、版本照读,判官整拒这份候选);缺席 / `{}` ⇒ 不理会(契约读腿自己丢 `{}`)。
+ * 带事实 ⇒ 一份被拒文档(契约的类型 `ConfigDocumentRefusal` 的墓碑臂:`document` = 退役域名,`reason: "retired_domain"`,`error` / `migration` 取
+ * `RetiredDomainError` 的同名字段)、这一键从体上拿掉(其余域照读、版本照读,判官整拒这份候选);缺席 / `{}` ⇒ 不理会(契约读腿自己丢 `{}`)。
  * 体不是对象 ⇒ 原样交回、不判(载荷形错,契约读腿抛)。墓碑判据只在契约包,这里只分键。
+ * 被拒文档是两条读腿同形的发现(判决只在候选判官 `candidate-gate.ts` 的 `judgeConfigCandidate`,成因词 = 发现自带的 `reason`):本地腿的被拒文档是契约整目录拒单
+ * `inspectBundle` 的原样(`config-provider.ts`),wire 上没有文件层,只有这一种墓碑。`error` 本模块不脱敏(与折叠产物同律):各腿在自己的产出边界上过
+ * `redactSecrets` 兜底、不过 `redactConfigError`(句子不含配置值;引号段读法会把句中点名的域名换成指纹)。
  */
 export declare function separateRetiredDomains(body: unknown): {
     readonly body: unknown;
-    readonly retiredDomains: readonly RetiredDomainFinding[];
+    readonly refusedDocuments: readonly ConfigDocumentRefusal[];
 };
 /** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`),
  *  `"unread"` 进读腿不读的文件面(`unreadFiles`;点名不判拒)。 */