@sema-agent/server 7.139.0 → 7.140.0

package/dist/trace/redact.js

@@ -1168,21 +1168,37 @@ function unitCountWithin(scan, from, to, max) {
         return true;
     noteEvidenceRead(scan, from);
     noteEvidenceRead(scan, to);
-    const st = scan.table.starts;
-    if (st.length === 0)
-        return false;
-    const k = firstCredentialSpanFrom(scan.table, from);
-    if (k >= st.length || st[k] >= to)
+    const t = scan.table;
+    const lo = firstCredentialSpanFrom(t, from);
+    let a = lo;
+    let b = t.ends.length;
+    while (a < b) {
+        const mid = (a + b) >>> 1;
+        if (t.ends[mid] <= to)
+            a = mid + 1;
+        else
+            b = mid;
+    }
+    if (a === lo)
         return false;
-    let n = 0;
-    for (let p = from; p < to;) {
-        if (n > max)
-            return false;
-        const unit = opaqueUnitEnd(scan, p);
-        p = unit > 0 && unit <= to ? unit : p + 1;
-        n += 1;
+    const saved = unitSavings(t);
+    return to - from - (saved[a] - saved[lo]) <= max;
+}
+const UNIT_SAVINGS = new WeakMap();
+function unitSavings(t) {
+    let saved = UNIT_SAVINGS.get(t);
+    if (saved === undefined) {
+        const n = t.starts.length;
+        saved = new Float64Array(n + 1);
+        for (let k = 0; k < n; k++)
+            saved[k + 1] = saved[k] + (t.ends[k] - t.starts[k] - 1);
+        UNIT_SAVINGS.set(t, saved);
     }
-    return n <= max;
+    return saved;
+}
+export function unitCountWithinForTest(table, from, to, max) {
+    const t = { starts: Int32Array.from(table, (x) => x[0]), ends: Int32Array.from(table, (x) => x[1]) };
+    return unitCountWithin(buildForensicScan(t, 1), from, to, max);
 }
 function collectSsh2FenceSpans(scan, text, span, isHead) {
     let cachedFrom = 0;
@@ -1241,16 +1257,20 @@ function pemFenceLineEnd(text, labelFrom) {
     }
     return isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : PEM_LINE_INVALID;
 }
-function collectPemFenceSpans(text, span, isHead) {
+function collectPemFenceSpans(scan, text, span, isHead) {
     let endFrom = -1;
     let endAt = -1;
     let endAfter = -1;
+    const visibleEndLine = (b) => {
+        const after = pemFenceLineEnd(text, b + PEM_END_OPEN.length);
+        return after >= 0 && !inOpaqueUnit(scan, b) ? after : -1;
+    };
     const earliestEndFence = (from) => {
         if (endFrom >= 0 && from >= endFrom && (endAt < 0 || endAt >= from))
             return;
         let b = text.indexOf(PEM_END_OPEN, from);
         let after = -1;
-        while (b >= 0 && (after = pemFenceLineEnd(text, b + PEM_END_OPEN.length)) < 0)
+        while (b >= 0 && (after = visibleEndLine(b)) < 0)
             b = text.indexOf(PEM_END_OPEN, b + 1);
         endFrom = from;
         endAt = b;
@@ -1260,6 +1280,10 @@ function collectPemFenceSpans(text, span, isHead) {
         const fence = text.indexOf(PEM_FENCE_OPEN, from);
         if (fence < 0)
             return;
+        if (inOpaqueUnit(scan, fence)) {
+            from = fence + 1;
+            continue;
+        }
         const bodyFrom = pemFenceLineEnd(text, fence + PEM_FENCE_OPEN.length);
         if (bodyFrom === PEM_LINE_INVALID) {
             from = fence + 1;
@@ -1272,7 +1296,7 @@ function collectPemFenceSpans(text, span, isHead) {
                 span(fence, text.length, true);
             return;
         }
-        if (endAt - bodyFrom > PEM_FENCE_BODY_MAX) {
+        if (!unitCountWithin(scan, bodyFrom, endAt, PEM_FENCE_BODY_MAX)) {
             from = fence + 1;
             continue;
         }
@@ -1610,7 +1634,7 @@ let forensicRescanMode = "incremental";
 export function setForensicRescanModeForTest(mode) {
     forensicRescanMode = mode;
 }
-function foldCredentialSpans(prev, spans, from) {
+function foldCredentialSpans(prev, spans, from, admit) {
     const cap = spans.length - from;
     if (cap === 0)
         return { next: prev, dirty: NO_CREDENTIAL_SPANS };
@@ -1619,6 +1643,8 @@ function foldCredentialSpans(prev, spans, from) {
     let m = 0;
     for (let i = from; i < spans.length; i++) {
         const sp = spans[i];
+        if (admit !== undefined && !admit(sp))
+            continue;
         const k = firstCredentialSpanFrom(prev, sp.start + 1) - 1;
         if (k >= 0 && prev.ends[k] >= sp.end)
             continue;
@@ -1742,7 +1768,7 @@ function buildForensicScan(table, armCount) {
         hdr: { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false },
     };
 }
-function advanceEvidence(scan, table, dirty) {
+function useEvidenceView(scan, table, dirty) {
     scan.table = table;
     scan.cursor = 0;
     scan.dirty = dirty;
@@ -2417,7 +2443,7 @@ export function structuralScannerForTest(arm) {
         case "json-secret-field":
             return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect(collectJsonSecretFieldSpans) };
         case "pem-fence":
-            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect(collectPemFenceSpans) };
+            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect((text, span, isHead) => collectPemFenceSpans(buildForensicScan(NO_CREDENTIAL_SPANS, 1), text, span, isHead)) };
     }
 }
 let ppkScanBytes = 0;
@@ -2574,6 +2600,7 @@ const armPool = (() => {
             retry: boundary === undefined ? undefined : (text, at, out) => collectStickySpans(boundary, text, at, out),
             headSrc: boundary === undefined ? undefined : headSrc,
             headFirst: boundary === undefined ? undefined : headFirst,
+            family: undefined,
         };
     };
     const scannerMember = (token, order, arm, rank = ARM_RANK.structural, lexical = false) => {
@@ -2588,9 +2615,12 @@ const armPool = (() => {
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
+            family: undefined,
         };
     };
-    const forensicMember = (token, order, arm) => {
+    const forensicMember = (token, order, arm, family = undefined, view = "all") => {
+        if (view === "other-families" && family === undefined)
+            throw new Error(`redact: forensic arm ${token} reads the other-families evidence view but declares no credential family`);
         const repl = spanRepl(token);
         const rank = ARM_RANK.structural;
         return {
@@ -2603,11 +2633,13 @@ const armPool = (() => {
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
+            family,
+            view,
         };
     };
     const structuralScannerMember = (row, order) => {
         if (row === PEM_FENCE_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectPemFenceSpans(text, span, isHead));
+            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectPemFenceSpans(scan, text, span, isHead), "pem-armor", "other-families");
         if (row === SSH2_FENCE_PATTERN)
             return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, span, isHead));
         if (row === URL_CREDENTIAL_PATTERN)
@@ -2620,7 +2652,7 @@ const armPool = (() => {
     for (const row of STRUCTURAL_SECRET_PATTERNS)
         members.push(structuralScannerMember(row, members.length));
     members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead)));
-    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span) => collectPemFragmentSpans(scan, text, json, span)));
+    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span) => collectPemFragmentSpans(scan, text, json, span), "pem-armor"));
     members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead)));
     members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead) => collectAnchoredValueSpans(text, json, span, isHead), ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
@@ -2636,6 +2668,13 @@ const armPool = (() => {
     const retryMembers = members.filter((m) => m.retry !== undefined);
     const phase1 = members.filter((m) => m.phase === 1);
     const phase2 = members.filter((m) => m.phase === 2);
+    const familyOfOrder = members.map((m) => m.family);
+    const viewKeyOf = (m) => {
+        switch (m.view) {
+            case "all": return undefined;
+            case "other-families": return m.family;
+        }
+    };
     const laneOf = (scope) => {
         const inScope = (m) => {
             switch (scope) {
@@ -2643,7 +2682,9 @@ const armPool = (() => {
                 case "bounded-unit": return !m.lexical;
             }
         };
-        return { phase1: phase1.filter(inScope), phase2: phase2.filter(inScope), retry: retryMembers.filter(inScope) };
+        const lanePhase2 = phase2.filter(inScope);
+        const viewKeys = [...new Set(lanePhase2.map(viewKeyOf))];
+        return { phase1: phase1.filter(inScope), phase2: lanePhase2, retry: retryMembers.filter(inScope), viewKeys, viewOf: lanePhase2.map((m) => viewKeys.indexOf(viewKeyOf(m))) };
     };
     const LANES = {
         "free-text": laneOf("free-text"),
@@ -2694,18 +2735,22 @@ const armPool = (() => {
             m.collect(text, json, eat, spans, isHead);
         closeCoveragePositions(0);
         if (lane.phase2.length > 0) {
-            const scan = buildForensicScan(credentialSpans(text), lane.phase2.length);
+            const tokens = credentialSpans(text);
+            const scan = buildForensicScan(tokens, lane.phase2.length);
             const reuse = forensicRescanMode === "incremental";
             const foot = scan.armFoot;
+            const views = lane.viewKeys.map((key) => ({ key, table: tokens, dirty: undefined }));
             let folded = 0;
             for (let level = 0;; level += 1) {
                 const before = spans.length;
                 for (let j = 0; j < lane.phase2.length; j++) {
-                    const dirty = scan.dirty;
+                    const view = views[lane.viewOf[j]];
+                    const dirty = view.dirty;
                     if (dirty !== undefined && footprintClean(dirty, foot[2 * j], foot[2 * j + 1])) {
                         forensicSkips += 1;
                         continue;
                     }
+                    useEvidenceView(scan, view.table, dirty);
                     scan.footLo = FOOT_NONE;
                     scan.footHi = -1;
                     lane.phase2[j].collect(scan, text, json, level === 0 ? eat : undefined, spans, isHead);
@@ -2715,11 +2760,18 @@ const armPool = (() => {
                 }
                 closeCoveragePositions(before);
                 forensicLevels += 1;
-                const grown = foldCredentialSpans(scan.table, spans, folded);
+                let grew = false;
+                for (const view of views) {
+                    const key = view.key;
+                    const grown = foldCredentialSpans(view.table, spans, folded, key === undefined ? undefined : (sp) => familyOfOrder[sp.order] !== key);
+                    if (grown.dirty.starts.length > 0)
+                        grew = true;
+                    view.table = grown.next;
+                    view.dirty = reuse ? grown.dirty : undefined;
+                }
                 folded = spans.length;
-                if (grown.dirty.starts.length === 0)
+                if (!grew)
                     break;
-                advanceEvidence(scan, grown.next, reuse ? grown.dirty : undefined);
             }
         }
         poolSpanCount += spans.length;

package/dist/trace/self-minted-wire.d.ts

@@ -129,6 +129,10 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 409;
                 readonly since: "7.108.0";
             };
+            readonly "memory.erasure_store_unjudged": {
+                readonly attr: 409;
+                readonly since: "7.140.0";
+            };
             readonly "internal.memory_control_plane_corrupt": {
                 readonly attr: 500;
                 readonly since: "7.108.0";
@@ -1290,6 +1294,51 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 200;
                 readonly since: "7.139.0";
             };
+            readonly "GET /v1/memory/entries/:entryId/provenance|POST /v1/memory/erase|GET /v1/memory/origin/clearances|POST /v1/memory/origin/entries/:entryId/clear#layer_unaddressed_two_stores(\u4E0D\u70B9\u540D\u5C42\u7684\u6761\u76EE id / \u5E97\u7EA7\u8D26\u672C\u8BF7\u6C42,\u672C\u90E8\u7F72\u70B9\u540D\u7684\u5C42\u5206\u4F4F\u4E24\u53EA\u5E97;\u4F53 request.memory_layer)": {
+                readonly attr: 400;
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/memory/erase|POST /v1/sessions/:id/memory/erase#erasure_store_unjudged(\u62B9\u9664\u843D\u5230\u90E8\u7F72\u7684\u5E97\u4E4B\u5916\u7684\u90A3\u53EA\u5E97:\u70B9\u540D\u7684\u5C42\u4F4F\u5728\u4E2A\u4EBA\u6302\u8F7D\u4E0A,\u6216\u6309\u4F1A\u8BDD\u62B9\u9664\u800C\u8FD9\u53EA\u4F1A\u8BDD\u5728\u53E6\u4E00\u53EA\u5E97\u6709\u8D21\u732E / \u90A3\u53EA\u5E97\u7684\u8D26\u8BFB\u4E0D\u51FA;\u4F53 memory.erasure_store_unjudged,\u4EC0\u4E48\u90FD\u6CA1\u5220)": {
+                readonly attr: 409;
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/memory/export|POST /v1/memory/import|GET /v1/memory/origin/external|POST /v1/memory/erase#layers_span_two_stores(\u8BF7\u6C42\u70B9\u540D\u7684\u5C42\u5206\u4F4F\u4E24\u53EA\u5E97;\u4F53 request.memory_layer)": {
+                readonly attr: 400;
+                readonly since: "7.140.0";
+            };
+            readonly "\u8BB0\u5FC6\u8BF8\u53E3 + POST /v1/admin/memory/consolidation/run|GET /v1/admin/memory/consolidation|GET /v1/memory/export|POST /v1/memory/sync/:scope#layer_unreadable(\u8BF7\u6C42\u70B9\u540D\u7684\u5C42\u5F15\u64CE\u8BFB\u4E0D\u51FA;\u4F53 request.memory_layer)": {
+                readonly attr: 400;
+                readonly since: "7.140.0";
+            };
+        };
+    };
+    /**
+     * 记忆动词的**层座**(`<端点>#<查询串 | 体>.scope` → 读法):不点名层的动词(条目 id / 会话 id / 店级账本)多一个可选的 `scope`,只用来定店;唯一读法 =
+     * `http/memory-layer-reply.ts` 的 `readLayerSeat`(在场而不是非空串 ⇒ 400、面不调)。只登本版新增的座。
+     */
+    readonly memoryLayerSeatKey: {
+        readonly at: "记忆动词的层座(<端点>#<query | body>.scope → 读法;只登本版新增的)";
+        readonly members: {
+            readonly "GET /v1/memory/entries/:entryId/provenance#query.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers";
+                readonly since: "7.140.0";
+            };
+            readonly "GET /v1/memory/origin/clearances#query.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers";
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/memory/origin/entries/:entryId/clear#body.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;not passed to the engine";
+                readonly since: "7.140.0";
+            };
+            readonly "GET /v1/sessions/:id/memory-status#query.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ every store of this deployment, folded;cache keyed by (session, store control plane)";
+                readonly since: "7.140.0";
+            };
+            readonly "POST /v1/sessions/:id/memory/erase#body.scope": {
+                readonly attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ the deployment's store;selector still minted from the path";
+                readonly since: "7.140.0";
+            };
         };
     };
     /**
@@ -1766,6 +1815,15 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: "names-engine-notice:model.capability_downgraded";
                 readonly since: "7.137.0";
             };
+            /**
+             * 7.140.0:会话记忆状态不带层座 ⇒ 本部署每一只店的引擎答案按一条折叠律合成一份(`memory-operator-faces.ts` `foldPlaneStatuses`;契约 §9 开头):
+             * 计数相加 / 最近一次取大 / 任一店有采集记录即 true / 任一店读不出 ⇒ 那一键缺席。一只店 ⇒ 恒等(单店部署字节同上一版)。
+             * 钉 test/memory-operator-faces.test.ts「逐店折叠律」、test/memory-layer-seat-http.test.ts「会话记忆状态不带层座」。
+             */
+            readonly "GET /v1/sessions/:id/memory-status#committedCount|foldedCount|lastCaptureAt|captureOptedOut|optOutSource(\u4E0D\u5E26\u5C42\u5EA7)": {
+                readonly attr: "fold-across-deployment-stores(sum|max|any-record|absent-if-any-unreadable);one-store⇒identity";
+                readonly since: "7.140.0";
+            };
         };
     };
 };

package/dist/trace/self-minted-wire.js

@@ -45,6 +45,7 @@ export const SELF_MINTED_WIRE = {
             "memory.erasure_evidence_unavailable": { attr: 409, since: "7.108.0" },
             "memory.erasure_selector_mismatch": { attr: 409, since: "7.108.0" },
             "memory.erasure_census_incomplete": { attr: 409, since: "7.108.0" },
+            "memory.erasure_store_unjudged": { attr: 409, since: "7.140.0" },
             "internal.memory_control_plane_corrupt": { attr: 500, since: "7.108.0" },
         },
     },
@@ -460,6 +461,20 @@ export const SELF_MINTED_WIRE = {
             "PATCH /v1/sessions/:id#owner_changed_after_gate(门那一读之后同一会话的属主被改;体 not_found.session)": { attr: 404, since: "7.139.0" },
             "PATCH /v1/sessions/:id#expectedRowTag_stale(行已不在那只标签上;体 conflict.session_row_changed + currentRow)": { attr: 409, since: "7.139.0" },
             "PATCH /v1/sessions/:id#expectedRowTag_current(行仍在那只标签上;体 = 列表行)": { attr: 200, since: "7.139.0" },
+            "GET /v1/memory/entries/:entryId/provenance|POST /v1/memory/erase|GET /v1/memory/origin/clearances|POST /v1/memory/origin/entries/:entryId/clear#layer_unaddressed_two_stores(不点名层的条目 id / 店级账本请求,本部署点名的层分住两只店;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+            "POST /v1/memory/erase|POST /v1/sessions/:id/memory/erase#erasure_store_unjudged(抹除落到部署的店之外的那只店:点名的层住在个人挂载上,或按会话抹除而这只会话在另一只店有贡献 / 那只店的账读不出;体 memory.erasure_store_unjudged,什么都没删)": { attr: 409, since: "7.140.0" },
+            "POST /v1/memory/export|POST /v1/memory/import|GET /v1/memory/origin/external|POST /v1/memory/erase#layers_span_two_stores(请求点名的层分住两只店;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+            "记忆诸口 + POST /v1/admin/memory/consolidation/run|GET /v1/admin/memory/consolidation|GET /v1/memory/export|POST /v1/memory/sync/:scope#layer_unreadable(请求点名的层引擎读不出;体 request.memory_layer)": { attr: 400, since: "7.140.0" },
+        },
+    },
+    memoryLayerSeatKey: {
+        at: "记忆动词的层座(<端点>#<query | body>.scope → 读法;只登本版新增的)",
+        members: {
+            "GET /v1/memory/entries/:entryId/provenance#query.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers", since: "7.140.0" },
+            "GET /v1/memory/origin/clearances#query.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers", since: "7.140.0" },
+            "POST /v1/memory/origin/entries/:entryId/clear#body.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;not passed to the engine", since: "7.140.0" },
+            "GET /v1/sessions/:id/memory-status#query.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ every store of this deployment, folded;cache keyed by (session, store control plane)", since: "7.140.0" },
+            "POST /v1/sessions/:id/memory/erase#body.scope": { attr: "optional;non-empty-string else 400 request.field_invalid;names the layer whose store answers;absent ⇒ the deployment's store;selector still minted from the path", since: "7.140.0" },
         },
     },
     refusalSentenceForm: {
@@ -595,6 +610,7 @@ export const SELF_MINTED_WIRE = {
             "GET /v1/config/catalog#rows[MODEL_VISION].semantics": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },
             "GET /v1/config/catalog#rows[MODEL_VISION].derivedDefaultNote": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },
             "GET /v1/config/catalog#rows[MODEL_CHEAP_VISION].semantics": { attr: "names-engine-notice:model.capability_downgraded", since: "7.137.0" },
+            "GET /v1/sessions/:id/memory-status#committedCount|foldedCount|lastCaptureAt|captureOptedOut|optOutSource(不带层座)": { attr: "fold-across-deployment-stores(sum|max|any-record|absent-if-any-unreadable);one-store⇒identity", since: "7.140.0" },
         },
     },
 };

package/dist/web-admin-client/candidate-gate.d.ts

@@ -1,10 +1,12 @@
 /**
  * 配置候选的**唯一判官**:一份候选(中心有效视图,或本地 `config.d` 读出的那份)能不能收 —— 只有这一种判法。
  *
- * 判据(三件,任一即拒;每条拒因带成因词,闭集 {@link CandidateRejectReason}):读腿交出的 `domainErrors`(某个域读不懂 / 拼错键 / 坏文件:那个域已落
+ * 判据(三件,任一即拒;每条拒因带成因词,闭集 {@link CandidateRejectReason}):读腿交出的 `domainErrors`(某个域判形失败 / 拼错键 / 悬空引用:那个域已落
  * schema 缺省)与 prompts 面的判官(`judgePromptsWire`:契约包的 wire 形再交引擎 verify —— 中心层只有一种形)—— 成因 `domain_invalid`;读腿交出的
- * `retiredDomains`(带事实的退役域文档,契约包的墓碑;拒句点名退役版本与一次性迁移)—— 成因 `retired_domain`。任一 ⇒ `rejected`:
- * **整份候选不收**,一个域都不应用。退役域此前在读腿整包抛、走「源不可达」那条臂(版本读不到、没有拒判行、刷新拍算失败);现在读腿只交数据,
+ * `refusedDocuments`(读它的域之前契约就拒了的那份文档 —— 契约的类型 `ConfigDocumentRefusal`:带事实的退役域 = 墓碑,或 `config.d` 里契约的文件层拒的一份 ——
+ * 空 / 坏 JSON / 不是对象 / 读失败)—— 成因就是那份发现自带的词(契约闭集 `CONFIG_DOCUMENT_REFUSAL_REASONS`),拒行的 `domain` 是它的 `document`。
+ * 任一 ⇒ `rejected`:**整份候选不收**,一个域都不应用。
+ * 被拒文档此前要么在读腿整包抛、走「源不可达」那条臂(墓碑;门控域的坏文件),要么被读成「域按缺省落 + 域诊断」(目录域的坏文件);现在读腿只交数据,
  * 坏候选只有本判官一种判法。
  * 读腿的逐条丢弃(`droppedEntries`)不在这里 —— 颗粒是条目的失效留在条目上,候选照收(调用方响亮点名)。
  *
@@ -27,23 +29,25 @@
  * (盘上 LKG 的读回复判也经本判官,`config-lkg.ts`)。
  */
 import type { PublishedPromptArtifact } from "@sema-agent/core";
+import type { ConfigDocumentRefusal, ConfigDocumentRefusalReason } from "@sema-agent/settings-schema";
 import type { EffectiveConfig } from "./types.js";
 /** 读腿交出的一条域级诊断(与 `FetchEffectiveResult.domainErrors` 同形;error 文案已在产出边界脱敏)。 */
 export interface CandidateDomainError {
     readonly domain: string;
     readonly error: string;
 }
-/** 判官拒一份候选的成因(闭集):某个域判形失败(含 prompts 面)/ 带事实的退役域文档(墓碑)。 */
-export type CandidateRejectReason = "domain_invalid" | "retired_domain";
+/** 判官拒一份候选的成因(闭集):某个域判形失败(含 prompts 面)`domain_invalid` ∪ 被拒文档自带的词(契约闭集 `CONFIG_DOCUMENT_REFUSAL_REASONS`:
+ *  `empty` / `invalid_json` / `not_object` / `io` 文件层,`retired_domain` 墓碑)—— 被拒文档的词表只在契约一处定义,这里派生(契约加词 ⇒ 按词穷举的读者编译红)。 */
+export type CandidateRejectReason = "domain_invalid" | ConfigDocumentRefusalReason;
 /** 拒判里的一条:哪一域、为什么(读腿 / 契约包的原句)、成因词。`config_candidate_rejected` 行的 `errors` 就是这一列。 */
 export interface CandidateDomainRejection extends CandidateDomainError {
     readonly reason: CandidateRejectReason;
 }
-/** 判官的输入:一份读出来的候选。`retiredDomains` = 读腿交出的退役域发现(两条读腿同形,见 `read-warnings.ts` 的 `RetiredDomainFinding`)。 */
+/** 判官的输入:一份读出来的候选。`refusedDocuments` = 读腿交出的被拒文档(两条读腿同形,契约的类型 `ConfigDocumentRefusal`;判官只读文档名、拒句与成因词)。 */
 export interface ConfigCandidateRead {
     readonly effective: EffectiveConfig;
     readonly domainErrors?: readonly CandidateDomainError[];
-    readonly retiredDomains?: readonly CandidateDomainError[];
+    readonly refusedDocuments?: readonly Pick<ConfigDocumentRefusal, "document" | "error" | "reason">[];
 }
 export type ConfigCandidateVerdict = 
 /** `prompts` = 候选的中心层(引擎 verify 过的发布形 artifact;候选不带 prompts 键 ⇒ `undefined` = 撤下中心层、内置提示词服务)。 */

package/dist/web-admin-client/candidate-gate.js

@@ -5,7 +5,7 @@ export function judgeConfigCandidate(r) {
     const errors = [
         ...(r.domainErrors ?? []).map((de) => ({ domain: de.domain, error: de.error, reason: "domain_invalid" })),
         ...(promptsGate !== undefined && !promptsGate.ok ? [{ domain: "prompts", error: promptsGate.error, reason: "domain_invalid" }] : []),
-        ...(r.retiredDomains ?? []).map((rd) => ({ domain: rd.domain, error: rd.error, reason: "retired_domain" })),
+        ...(r.refusedDocuments ?? []).map((d) => ({ domain: d.document, error: d.error, reason: d.reason })),
     ];
     if (errors.length === 0)
         return { verdict: "clean", prompts: promptsGate?.ok ? promptsGate.artifact : undefined };

package/dist/web-admin-client/http-client.d.ts

@@ -1,11 +1,12 @@
-import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
+import { type ConfigDocumentRefusal, type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
-import { type DroppedConfigEntry, type RetiredDomainFinding, type UnreadConfigFile } from "./read-warnings.js";
+import { type DroppedConfigEntry, type UnreadConfigFile } from "./read-warnings.js";
 import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
- *  `retiredDomains`([ref]):wire 上带事实的退役域(墓碑)不抛 —— 交成发现、那一键不进 effective,候选判官整拒这份候选(与本地腿同键同义)。
+ *  `refusedDocuments`:被拒文档(契约类型 `ConfigDocumentRefusal`,与本地腿同键同义;wire 上只有一种 —— 带事实的退役域,墓碑,成因词 `retired_domain`)不抛 —— 交成发现、那一键不进 effective,
+ *  候选判官整拒这份候选。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
  *  boot/refresh 的候选门直接消费。`droppedEntries`([ref] ②):schema 逐条丢掉的条目(坐标 + 字段诊断)——
  *  **不**进候选门,调用方响亮点名、其余照用(分面单点 `splitFoldedReadWarnings`,与本地腿同一只)。
@@ -25,7 +26,7 @@ export declare function fetchEffective(center: CenterEndpoint, etag: string | un
     }>;
     droppedEntries?: DroppedConfigEntry[];
     unreadFiles?: UnreadConfigFile[];
-    retiredDomains?: RetiredDomainFinding[];
+    refusedDocuments?: ConfigDocumentRefusal[];
     readWarnings: readonly EffectiveReadWarning[];
     credentialIdentity: string;
 } | null>;

package/dist/web-admin-client/http-client.js

@@ -10,7 +10,7 @@ export async function fetchEffective(center, etag, fetchImpl, worker) {
     if (!res.ok)
         throw new Error(`web-admin HTTP ${res.status}`);
     const warnings = [];
-    const { body, retiredDomains } = separateRetiredDomains(await res.json());
+    const { body, refusedDocuments } = separateRetiredDomains(await res.json());
     const wire = readEffectiveWire(body, (w) => warnings.push(w));
     const { domainErrors, droppedEntries, droppedCatalogEntries, unreadFiles } = splitFoldedReadWarnings(warnings, "center");
     const effective = withDroppedCatalogEntries(wire, droppedCatalogEntries);
@@ -22,7 +22,7 @@ export async function fetchEffective(center, etag, fetchImpl, worker) {
         ...(domainErrors.length > 0 ? { domainErrors } : {}),
         ...(droppedEntries.length > 0 ? { droppedEntries } : {}),
         ...(unreadFiles.length > 0 ? { unreadFiles } : {}),
-        ...(retiredDomains.length > 0 ? { retiredDomains: [...retiredDomains] } : {}),
+        ...(refusedDocuments.length > 0 ? { refusedDocuments: [...refusedDocuments] } : {}),
     };
 }
 export async function fetchPrincipalCaps(center, principal, etag, fetchImpl, worker) {

package/dist/web-admin-client/read-warnings.d.ts

@@ -25,29 +25,19 @@
  * 留在条目上,只有颗粒更粗的失效才动候选。
  */
 import { z } from "zod";
-import { type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning, type RetiredDomainName } from "@sema-agent/settings-schema";
-/**
- * 退役域的一条**发现**(两条读腿同形)。读腿只把契约包的墓碑(`RetiredDomainError`)换成数据交出去 —— 判决只在候选判官
- * (`candidate-gate.ts` 的 `judgeConfigCandidate`,成因 `retired_domain`):与域判形失败同一条回落链(候选 → 盘上 LKG → env)、同一行
- * `config_candidate_rejected`、刷新拍同形(拍跑完,候选被判拒是结论)。拉取层的抛只剩 I/O 与载荷形(不是一份 effective)两种。
- * `error` = 契约包铸的整句(墓碑表那一行:退役版本、事实今天住哪、一次性迁移 id)—— 模板句,不含任何配置值,所以不过 `redactConfigError`
- * (那道脱敏把引号段换成指纹,会把句中点名的域名换掉)。
- */
-export type RetiredDomainFinding = {
-    readonly domain: RetiredDomainName;
-    readonly error: string;
-    readonly migration: string;
-};
-/** 墓碑 → 发现;不是墓碑 ⇒ `undefined`(调用方照原样抛)。两条读腿的唯一换装点。 */
-export declare function retiredDomainFindingOf(e: unknown): RetiredDomainFinding | undefined;
+import { type ConfigDocumentRefusal, type DroppedEntryIdentity, type DroppedEntryReasonCode, type EffectiveReadWarning } from "@sema-agent/settings-schema";
 /**
  * 远端读腿在过契约读腿(`readEffectiveWire`)**之前**把退役域键分出去:wire 体上每个退役域键过契约的同一只墓碑(`refuseRetiredDomain`)——
- * 带事实 ⇒ 一条发现、这一键从体上拿掉(其余域照读、版本照读,判官整拒这份候选);缺席 / `{}` ⇒ 不理会(契约读腿自己丢 `{}`)。
+ * 带事实 ⇒ 一份被拒文档(契约的类型 `ConfigDocumentRefusal` 的墓碑臂:`document` = 退役域名,`reason: "retired_domain"`,`error` / `migration` 取
+ * `RetiredDomainError` 的同名字段)、这一键从体上拿掉(其余域照读、版本照读,判官整拒这份候选);缺席 / `{}` ⇒ 不理会(契约读腿自己丢 `{}`)。
  * 体不是对象 ⇒ 原样交回、不判(载荷形错,契约读腿抛)。墓碑判据只在契约包,这里只分键。
+ * 被拒文档是两条读腿同形的发现(判决只在候选判官 `candidate-gate.ts` 的 `judgeConfigCandidate`,成因词 = 发现自带的 `reason`):本地腿的被拒文档是契约整目录拒单
+ * `inspectBundle` 的原样(`config-provider.ts`),wire 上没有文件层,只有这一种墓碑。`error` 本模块不脱敏(与折叠产物同律):各腿在自己的产出边界上过
+ * `redactSecrets` 兜底、不过 `redactConfigError`(句子不含配置值;引号段读法会把句中点名的域名换成指纹)。
  */
 export declare function separateRetiredDomains(body: unknown): {
     readonly body: unknown;
-    readonly retiredDomains: readonly RetiredDomainFinding[];
+    readonly refusedDocuments: readonly ConfigDocumentRefusal[];
 };
 /** 折叠产物:`scope` 决定消费方做什么 —— `"domain"` 进候选门(`domainErrors`),`"entry"` 进逐条丢弃面(`droppedEntries`),
  *  `"unread"` 进读腿不读的文件面(`unreadFiles`;点名不判拒)。 */

package/dist/web-admin-client/read-warnings.js

@@ -1,26 +1,22 @@
 import { z } from "zod";
 import { DROPPED_ENTRY_REASON_CODES, ModelRole, RETIRED_DOMAINS, RetiredDomainError, formatConfigPath, isDisclosableIdentity, isRetiredDomainName, refuseRetiredDomain, renderQuotedSentence, } from "@sema-agent/settings-schema";
-export function retiredDomainFindingOf(e) {
-    return e instanceof RetiredDomainError ? { domain: e.domain, error: e.message, migration: e.migration } : undefined;
-}
 export function separateRetiredDomains(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
-        return { body, retiredDomains: [] };
-    const findings = [];
+        return { body, refusedDocuments: [] };
+    const refused = [];
     const rest = { ...body };
     for (const domain of Object.keys(RETIRED_DOMAINS).filter(isRetiredDomainName)) {
         try {
             refuseRetiredDomain(domain, rest[domain]);
         }
         catch (e) {
-            const finding = retiredDomainFindingOf(e);
-            if (finding === undefined)
+            if (!(e instanceof RetiredDomainError))
                 throw e;
-            findings.push(finding);
+            refused.push({ document: e.domain, reason: "retired_domain", error: e.message, migration: e.migration });
             delete rest[domain];
         }
     }
-    return findings.length === 0 ? { body, retiredDomains: [] } : { body: rest, retiredDomains: findings };
+    return refused.length === 0 ? { body, refusedDocuments: [] } : { body: rest, refusedDocuments: refused };
 }
 export function buildUnreadConfigKeyFields(k, dir) {
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.139.0",
+  "version": "7.140.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -70,7 +70,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.60.0",
-    "@sema-agent/settings-schema": "15.1.0",
+    "@sema-agent/settings-schema": "15.2.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",