@sema-agent/server 7.140.0 → 7.142.0

package/dist/approval-policy-settlement.d.ts

@@ -29,6 +29,6 @@ import type { ParkTriggerCause } from "./approval-deny-reasons.js";
  * `batchId` 必须是**行上**的批(幂等命中的存量行可能是别的政策 / 旧版本铸的整腿批,错 scope 的 claim 如实 `absent`)。
  */
 export declare function settleByPolicy(store: Pick<ApprovalAskStore, "claimTerminal">, row: Pick<AskRow, "askId" | "batchId">, policy: UnattendedApprovalPolicy, 
-/** 转 park 的触发成因(窗到期 / 广播全灭 / 有序关停):`park` 政策的 `expire` 赢下 PARKING 时随同一步写进行(`denied_reason`),跨副本的读者据它归因;`deny` 政策落的是一条决议,不带。 */
+/** 转 park 的触发成因(窗到期 / 广播全灭 / 有序关停):`park` 政策的 `expire` 赢下 PARKING 时随同一步写进行(`park_trigger`),跨副本的读者据它归因;`deny` 政策落的是一条决议,不带。 */
 cause: ParkTriggerCause): Promise<AskTerminalClaimOutcome>;
 //# sourceMappingURL=approval-policy-settlement.d.ts.map

package/dist/approval-reconciler.d.ts

@@ -123,6 +123,17 @@ export declare function classifyGateMatch(ask: AskRow, candidates: readonly Chec
 export declare function selectGateCandidate(ask: AskRow, candidates: readonly CheckpointAskCandidate[]): CheckpointAskCandidate | undefined;
 /** 判据表 v2 的判定(纯函数;顺序 = 设计稿 §9 尾的五臂汇总,注见文件头)。 */
 export declare function decideReconcileAction(input: ReconcileInput): ReconcileAction;
+/** 判据 1 执行体({@link bindParkingAskAtGate})一次尝试的结果。没绑上 ⇒ 交回批的真实态,周期扫据它续判 ②③④⑤。 */
+export type GateBindAttempt = {
+    bound: true;
+    match: GateMatchOutcome;
+} | {
+    bound: false;
+    match?: GateMatchOutcome;
+    batchState: BatchState | "MISSING" | null;
+    batchBoundAskId: string | null;
+    irreversibleBatch: boolean;
+};
 /** 收敛器一次 tick 的产出(可观测 + 测试断言面)。 */
 export interface ReconcileStats {
     /** 段一扫到的 `PARKING` 行数。 */
@@ -202,7 +213,7 @@ export type ApprovalRevokeEmitter = (frame: ApprovalRevokeFrame, target: {
     sessionId: string;
     taskId: string;
 }) => void;
-/** 判据 1 的读口(窄接口,不绑具体 checkpoint 店实现——local 车道的店没有这个面,装配点传 undefined)。 */
+/** 判据 1 的读口(窄接口,不绑具体 checkpoint 店实现;三个后端的 checkpoint 店都有这一面,后端的只读口 `checkpointReadView()` 也交它 —— 起服收敛读那一口)。 */
 export interface ReconcileCheckpointPort {
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;
 }
@@ -245,5 +256,26 @@ export interface ApprovalReconciler {
      *  段级错误由调用方(reaper 腿的 throttled catch)兜。 */
     runOnce(nowMs: number): Promise<ReconcileStats>;
 }
+/**
+ * {@link bindParkingAskAtGate} 的依赖(三个调用方交同一形):批 / 绑两口、判据 1 的候选读口、warn 与撤卡两个出口。
+ */
+export interface GateBindDeps {
+    readonly askStore: Pick<ApprovalAskStore, "getBatch" | "bindBatch">;
+    /** 缺席 ⇒ 候选集恒空 ⇒ 判据 1 恒不命中(诚实降级,与 {@link ApprovalReconcilerDeps.checkpoints} 同一句)。 */
+    readonly checkpoints: ReconcileCheckpointPort | undefined;
+    /** warn 的出口(调用方保证它不抛 —— 可观测面绝不成为故障源)。 */
+    readonly warn: (event: string, fields: Record<string, unknown>) => void;
+    /** 被 `bindBatch` 连坐的兄弟的撤卡帧(帧是通知,真源是行;失败不回滚 CAS)。 */
+    readonly revoke: (row: AskRow, askIds: readonly string[], reason: ApprovalRevokeFrame["reason"], nowMs: number) => void;
+}
+/**
+ * 🔴 **判据 1 的唯一执行体**([ref] 起一只判官;[ref] 起三个调用方):⓪ 批态先读 → 候选读口 → {@link classifyGateMatch} → 命中即 `bindBatch`
+ * (+ 被连坐兄弟的撤卡帧)。调用方:
+ *  · 周期扫(`createApprovalReconciler` 的 `reconcileOne`)—— 不命中 / 绑失败时拿回批的真实态,续判 ②③④⑤;
+ *  · park 提交那一拍(`bindCommittedPark`)—— 只问「这一行此刻能不能收口」,不命中即止(其余臂是周期扫的事);
+ *  · local 车道起服收敛(`approval-crash-convergence.ts`)—— 审计判为孤儿的前世 `PARKING` 行:命中 ⇒ `PARKED`;不命中 ⇒ 调用方收 `VOID`。
+ * 判据、读口、写口一个字都不分叉:事件路径与起服都是本函数的即时调用,不是第二份判据。
+ */
+export declare function bindParkingAskAtGate(deps: GateBindDeps, ask: AskRow, nowMs: number, deadlineMs?: number): Promise<GateBindAttempt>;
 export declare function createApprovalReconciler(deps: ApprovalReconcilerDeps): ApprovalReconciler;
 //# sourceMappingURL=approval-reconciler.d.ts.map

package/dist/approval-reconciler.js

@@ -79,6 +79,45 @@ export function decideReconcileAction(input) {
     void candidates;
     return { kind: "hold" };
 }
+export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
+    const { askStore, checkpoints, warn, revoke } = deps;
+    const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
+    const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
+    let batchState = batchRow?.state ?? "MISSING";
+    let batchBoundAskId = batchRow?.boundAskId ?? null;
+    const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
+    let gateMatch;
+    if (checkpoints && !irreversibleBatch && !expired()) {
+        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
+        gateMatch = classifyGateMatch(ask, candidates);
+        if (gateMatch.kind === "hash_mismatch") {
+            warn("approval_reconcile_hash_mismatch", {
+                askId: ask.askId,
+                taskId: ask.taskId,
+                toolCallId: ask.toolCallId,
+                candidates: gateMatch.candidates,
+                reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
+                    "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
+                    "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
+            });
+        }
+        const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
+        if (match && !expired()) {
+            const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
+                gateToken: match.token,
+                gateBoundCallId: match.boundCallId,
+                gateBoundInputHash: match.boundInputHash,
+            }), "bindBatch");
+            if (res.ok) {
+                revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
+                return { bound: true, match: gateMatch };
+            }
+            batchState = res.batchState;
+            batchBoundAskId = res.boundAskId ?? null;
+        }
+    }
+    return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
+}
 export function createApprovalReconciler(deps) {
     const { askStore, checkpoints, runs, logger, metrics, batchLimit, pendingGraceMs, adhocGraceMs, orphanTtlMs, unattendedPolicy, emitRevoke } = deps;
     const warn = (event, fields) => {
@@ -98,44 +137,8 @@ export function createApprovalReconciler(deps) {
             warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
         }
     };
-    const bindAtGate = async (ask, nowMs, deadlineMs) => {
-        const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
-        const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
-        let batchState = batchRow?.state ?? "MISSING";
-        let batchBoundAskId = batchRow?.boundAskId ?? null;
-        const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
-        let gateMatch;
-        if (checkpoints && !irreversibleBatch && !expired()) {
-            const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
-            gateMatch = classifyGateMatch(ask, candidates);
-            if (gateMatch.kind === "hash_mismatch") {
-                warn("approval_reconcile_hash_mismatch", {
-                    askId: ask.askId,
-                    taskId: ask.taskId,
-                    toolCallId: ask.toolCallId,
-                    candidates: gateMatch.candidates,
-                    reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
-                        "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
-                        "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
-                });
-            }
-            const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
-            if (match && !expired()) {
-                const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
-                    gateToken: match.token,
-                    gateBoundCallId: match.boundCallId,
-                    gateBoundInputHash: match.boundInputHash,
-                }), "bindBatch");
-                if (res.ok) {
-                    revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
-                    return { bound: true, match: gateMatch };
-                }
-                batchState = res.batchState;
-                batchBoundAskId = res.boundAskId ?? null;
-            }
-        }
-        return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
-    };
+    const gate = { askStore, checkpoints, warn, revoke };
+    const bindAtGate = (ask, nowMs, deadlineMs) => bindParkingAskAtGate(gate, ask, nowMs, deadlineMs);
     const reconcileOne = async (ask, nowMs) => {
         const attempt = await bindAtGate(ask, nowMs);
         if (attempt.bound)
@@ -150,11 +153,11 @@ export function createApprovalReconciler(deps) {
                 return { outcome: "held", match: gateMatch };
             }
             case "deny": {
-                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
+                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { endingCause: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
                 return { outcome: won ? "denied" : "held", match: gateMatch };
             }
             case "void": {
-                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
+                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { endingCause: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
                 if (!won)
                     return { outcome: "held", match: gateMatch };
                 if (action.reason === APPROVAL_ENDING_CAUSES.ORPHAN_TTL_EXCEEDED) {

package/dist/approval.d.ts

@@ -95,6 +95,21 @@ export declare function buildNoResponderBootWarns(input: {
         hint: string;
     };
 }>;
+/**
+ * 单用户 turnkey 起服行 `tool_policy_single_user_default` 的**载荷**(纯数据 ⇒ `build*`;打不打、用哪只 logger 归 stage-07 的调用点,
+ * 打的判据是 {@link singleUserAutoAcceptBaselineApplies})。文案只此一处。
+ *
+ * 它说的是**部署工具策略层**的姿势:这一层铺的是一条在场的、看效果的 allow-all 基线(`createApprovalBaselinePolicy(config, { kind: "absent" })`),
+ * 好让引擎的「写手无裁决」告警不再响 —— 这一层自己不问也不拒。它**不是逐调用的放行**:每次调用仍由本次运行的权限模式与引擎写门裁(`auto` 下 shell 的写 / 删
+ * 照样出问并交分类器)。修前这一句写成「ALL write/hand/MCP tool surfaces auto-allowed」,读者(含取证)把它读成逐调用放行,与运行期读数相反。
+ */
+export declare function buildSingleUserDefaultPostureNotice(): {
+    event: "tool_policy_single_user_default";
+    fields: {
+        posture: string;
+        tighten: string;
+    };
+};
 /**
  * [ref] 件⑩ —— **center 的 `forceDurableGate` 在无 checkpoint 店的部署上会静默 inert**,补一条 boot 披露。
  *

package/dist/approval.js

@@ -53,6 +53,16 @@ export function buildNoResponderBootWarns(input) {
     }
     return out;
 }
+export function buildSingleUserDefaultPostureNotice() {
+    return {
+        event: "tool_policy_single_user_default",
+        fields: {
+            posture: "deployment tool-policy baseline is allow-all — this layer asks no question and refuses nothing of its own (core's per-surface UNGATED enumeration is suppressed for single-user turnkey). " +
+                "It is not a per-call verdict: each call is still judged by the run's permission mode and the engine's write gate — a shell write or delete can still be asked, or handed to the classifier under auto",
+            tighten: "APPROVAL_REQUIRE / AUTONOMY / commandPolicy (re-surfaces + gates specific surfaces)",
+        },
+    };
+}
 export function buildForceDurableGateInertNotice(input) {
     if (!input.entitlementSourceWired || input.checkpointStorePresent)
         return undefined;

package/dist/audit.d.ts

@@ -1,6 +1,7 @@
 import { type SessionPlacementRecord, type StoredPromptEpoch } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
+import { type LocalSessionRows } from "./plugins/local-session-window.js";
 /**
  * Audit view of a session = its **current context** (the live messages + the last compaction's
  * summary), i.e. the floor-bounded window — never the full raw transcript. This matches the
@@ -76,10 +77,11 @@ export declare function buildSessionAudit(pool: Pool, sessionId: string, handles
  *  audit face was TiDB-only and a PG/local deployment 404'd the whole web session area. */
 export declare function buildSessionAuditPg(pool: PgPool, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
 /** The LOCAL (File) leg — web session area on DB_BACKEND=local: the same view over `LocalSessionWindow.wake`
- *  (`plugins/local-session-window.ts`). All three legs read one way — a bounded window that carries the epoch anchor below its
+ *  (`plugins/local-session-window.ts`), read from the local session store's rows (its row projection and its log export — the view's
+ *  `createdAt` is the row's, as on the SQL twins). All three legs read one way — a bounded window that carries the epoch anchor below its
  *  floor — and on every backend that is what the run reads: the SQL twins' run wakes the same window; the local run wakes the whole
  *  tree, and the local window is cut from that tree's branch, with the anchor walking the branch below the floor. */
-export declare function buildSessionAuditLocal(root: string, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
+export declare function buildSessionAuditLocal(rows: LocalSessionRows, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
 /**
  * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
  * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;

package/dist/audit.js

@@ -34,8 +34,8 @@ export async function buildSessionAudit(pool, sessionId, handles) {
 export async function buildSessionAuditPg(pool, sessionId, handles) {
     return auditFromStorage(await PgSessionStorage.wake(pool, sessionId), sessionId, handles);
 }
-export async function buildSessionAuditLocal(root, sessionId, handles) {
-    return auditFromStorage(await LocalSessionWindow.wake(root, sessionId), sessionId, handles);
+export async function buildSessionAuditLocal(rows, sessionId, handles) {
+    return auditFromStorage(await LocalSessionWindow.wake(rows, sessionId), sessionId, handles);
 }
 async function auditFromStorage(storage, sessionId, handles) {
     if (!storage)

package/dist/auth-bridge.d.ts

@@ -1,4 +1,4 @@
-import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
+import { VerifiedIdentity, type AuthBridgeErrorCode } from "@sema-agent/settings-schema/api/auth-bridge";
 import { type TokenScopeRefusal } from "@sema-agent/settings-schema/api/scopes";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -52,12 +52,13 @@ type BridgeSinks = {
     readonly logger?: Logger | undefined;
     readonly metrics?: Pick<Metrics, "inc"> | undefined;
 };
-/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 是 `unknown` —— 这一位正是边界要判的形,它不信型面
- *  (席是嵌入方可换的:`""` 过得了 `scope: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
+/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 与 `principalInc` 是 `unknown` —— 这两位正是边界要判的形,它不信型面
+ *  (席是嵌入方可换的:`""` 过得了 `scope: string` / `principalInc?: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
 type ReportedOutcome = {
     ok: true;
-    identity: Omit<BridgeIdentity, "scope"> & {
+    identity: Omit<BridgeIdentity, "scope" | "principalInc"> & {
         scope?: unknown;
+        principalInc?: unknown;
     };
 } | {
     ok: false;
@@ -65,8 +66,10 @@ type ReportedOutcome = {
 };
 /**
  * 注入边界:任何验证器(内建 {@link createWebAdminJwtVerifier},或嵌入方注入的 `ServiceDeps.webAdminJwtVerifier`)交来的结局,在这里定「装不装身份」。
- * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次(入参型见 {@link ReportedOutcome})。
- * 读不出 ⇒ 同一只记账口、不交身份(调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
+ * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次;化身号经契约的**同一只**判官 `VerifiedIdentity.shape.principalInc`(= `PrincipalIncarnation.optional()`,
+ * 契约验证器读 `sub_inc` 用的就是它)再判一次(入参型见 {@link ReportedOutcome})。
+ * 读不出 scope ⇒ 记 `readTokenScope` 的拒词;化身号在场而不合形 ⇒ 记 `malformed`(与契约验证器同一条律:声明在场坏形 ⇒ 令牌 malformed)。两种都经同一只记账口、不交身份
+ * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
 /** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */

package/dist/auth-bridge.js

@@ -1,5 +1,5 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
-import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
+import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, VerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { centerJwksFetch } from "./web-admin-client/center-request.js";
@@ -17,12 +17,18 @@ function recordBridgeRefusal(sinks, error, at = {}) {
 export function admitBridgeIdentity(outcome, sinks) {
     if (!outcome.ok)
         return undefined;
-    const scoped = readTokenScope({ scope: outcome.identity.scope });
+    const { scope, principalInc, ...rest } = outcome.identity;
+    const scoped = readTokenScope({ scope });
     if ("refused" in scoped) {
         recordBridgeRefusal(sinks, scoped.refused);
         return undefined;
     }
-    return { ...outcome.identity, scope: scoped.scope };
+    const inc = VerifiedIdentity.shape.principalInc.safeParse(principalInc);
+    if (!inc.success) {
+        recordBridgeRefusal(sinks, "malformed");
+        return undefined;
+    }
+    return { ...rest, scope: scoped.scope, ...(inc.data !== undefined ? { principalInc: inc.data } : {}) };
 }
 export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 export const JWKS_FETCH_TIMEOUT_MS = 10_000;

package/dist/boot/adoption.js

@@ -1,4 +1,5 @@
 import { createAdoptionRunner } from "../adoption/runner.js";
+import { seatText } from "../trace/exit-seat.js";
 export async function runAdoptionBootScan(ctx) {
     const store = ctx.backend?.adoptionLog?.();
     if (!store)
@@ -29,7 +30,7 @@ export async function runAdoptionBootScan(ctx) {
         return reading;
     }
     catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
+        const error = seatText("operator-log-text", err instanceof Error ? err.message : String(err));
         ctx.logger.error?.("adoption_boot_scan_failed", { error });
         return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [], error };
     }

package/dist/boot/budget-tracing.d.ts

@@ -11,6 +11,22 @@ export interface BudgetTracingCtx {
     backend: StoreBackend | undefined;
     breakerState: ReturnType<BreakerStateStore["startRefresh"]> | undefined;
 }
+/**
+ * S9 (SILENT-FALLBACK P0-e): write-behind flush/refresh failures previously vanished in a bare catch —
+ * the fleet silently degrades to per-replica counting (soft limits stop being fleet-wide). Every failure
+ * ticks the counter + streak gauge; warn once per episode (streak hits 3), info on the recovery edge.
+ * `info.error` is the client exception's text (the counter turns the rejection into it) ⇒ the warn's field passes the exit seat.
+ */
+export declare function createCounterDegradeHook({ logger, metrics }: {
+    logger: Pick<Logger, "warn" | "info">;
+    metrics: Pick<Metrics, "setGauge" | "inc">;
+}): (info: {
+    table: string;
+    kind: string;
+    streak: number;
+    prevStreak: number;
+    error?: string;
+}) => void;
 export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     brain: import("@sema-agent/core").Brain;
     degradeRouteWatch: import("../brain.js").DegradeRouteWatch;

package/dist/boot/budget-tracing.js

@@ -6,19 +6,23 @@ import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import { buildQuotaBounds } from "./limit-sync.js";
 import { assembleFileHistory } from "../file-history-capture.js";
-export function createBudgetAndTracing(ctx) {
-    const { config, logger, metrics, backend, breakerState } = ctx;
-    const { brain, degradeRoute: degradeRouteWatch } = createBrainAssembly(config, { breakerState });
-    const pricing = buildPricing(config.models);
-    const counterDegradeHook = (info) => {
+import { seatText } from "../trace/exit-seat.js";
+export function createCounterDegradeHook({ logger, metrics }) {
+    return (info) => {
         metrics.setGauge("counter_flush_fail_streak", info.streak, { table: info.table, kind: info.kind });
         if (info.streak > 0)
             metrics.inc("counter_flush_failed_total", { table: info.table, kind: info.kind });
         if (info.streak === 3)
-            logger.warn("counter_flush_degraded", { table: info.table, kind: info.kind, streak: info.streak, ...(info.error ? { error: info.error } : {}) });
+            logger.warn("counter_flush_degraded", { table: info.table, kind: info.kind, streak: info.streak, ...(info.error ? { error: seatText("operator-log-text", info.error) } : {}) });
         else if (info.streak === 0 && info.prevStreak >= 3)
             logger.info("counter_flush_recovered", { table: info.table, kind: info.kind, prevStreak: info.prevStreak });
     };
+}
+export function createBudgetAndTracing(ctx) {
+    const { config, logger, metrics, backend, breakerState } = ctx;
+    const { brain, degradeRoute: degradeRouteWatch } = createBrainAssembly(config, { breakerState });
+    const pricing = buildPricing(config.models);
+    const counterDegradeHook = createCounterDegradeHook({ logger, metrics });
     const bounds = buildQuotaBounds(config);
     const costQuota = backend?.costQuota
         ? backend.costQuota(bounds.limitMicroUsd, bounds.windowMs, counterDegradeHook).startRefresh()

package/dist/boot/device-lane.d.ts

@@ -18,6 +18,7 @@ import type { DeviceStore } from "../device-store.js";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import { type DeviceWsHub } from "../device-ws-hub.js";
 import type { ServiceConfig } from "../config.js";
+import type { DeviceRelayDeclaration } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
@@ -75,4 +76,14 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  * 抛而不是 warn:降级的代价由用户承担(他以为命令跑在自己机器上、看到的却是云上一个空目录的结果)。
  */
 export declare function assertDeviceLaneWired(isDeviceLane: boolean, lane: DeviceLane | undefined, hasFactory: boolean): void;
+/**
+ * 设备入口 × 已绑设备的起服一行(拒的那一半在配置期:device 车道上 `DEVICE_RELAY_URL` 必填 —— 缺席拒起是车道必需 env 门(`config.ts` `declaredExecutionLane` → `laneMissingEnv`),坏形 / 带凭据形拒启是 `parseDeviceRelayUrlEnv`;
+ * 起不起服不随表里有几条绑定变)。
+ *
+ * 字面 `none` = 运维声明「设备拨本引擎自己的地址 + `wsPath`」。此刻根会话行上若有设备绑定(writer(device, D) 的格),这些会话的设备从此只能拨那个入口 ——
+ * 撤中继声明的回滚序是先恢复引擎自己的入口、再写 `none`,本行让运维看见押在那个入口上的绑定有几条:`device_relay_withdrawn_with_bindings { bindings }`
+ * (只交数,不交会话 id)。绑定 0 ⇒ 不响。URL ⇒ 不读表(设备读能力面拨它,与绑定数无关)。
+ * 读数 = 设备店的绑定数(唯一读法 `boundDeviceOf` 的聚合);读故障原样抛 ⇒ 起服失败(不折成 0 —— 折 0 就是在有绑定时不响)。
+ */
+export declare function noteDeviceRelayBindings(relay: DeviceRelayDeclaration, store: Pick<DeviceStore, "countDeviceBindings">, logger: Pick<Logger, "warn">): Promise<void>;
 //# sourceMappingURL=device-lane.d.ts.map

package/dist/boot/device-lane.js

@@ -56,4 +56,20 @@ export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
             "an assembly bug, not a configuration one — refusing to start rather than silently execute in-process (#157)");
     }
 }
+export async function noteDeviceRelayBindings(relay, store, logger) {
+    switch (relay.kind) {
+        case "url":
+            return;
+        case "none": {
+            const bindings = await store.countDeviceBindings();
+            if (bindings > 0)
+                logger.warn("device_relay_withdrawn_with_bindings", { bindings });
+            return;
+        }
+        default: {
+            const unknownKind = relay;
+            throw new Error(`noteDeviceRelayBindings: no arm for ${JSON.stringify(unknownKind)}`);
+        }
+    }
+}
 //# sourceMappingURL=device-lane.js.map

package/dist/boot/engine-lease.d.ts

@@ -130,6 +130,29 @@ export interface EngineLeaseExitReport {
     /** 成孤儿到自退之间隔了多久;非孤儿退出时键缺席(不编 0)。 */
     orphanedForMs?: number;
 }
+/**
+ * [ref] —— 租约窗的 wire 读数(`GET /health` 的 `engineLease`;壳持租约的触点节拍据此定,别处起的短窗引擎不再让第二句失败)。
+ *
+ * ## 报的是什么
+ *  · `lingerMs` = 本腿**会执行的最短静默窗**:父还活着的窗({@link EngineLeaseDeps.lingerMs})与孤儿窗({@link EngineLeaseOrphanLane.lingerMs},只在看门狗装了时存在)取小。
+ *    取**最短**而不是「此刻生效」:此刻生效的窗在父死那一拍从 owned 窗掉到孤儿窗,按旧读数定节拍的壳会在下一次读 `/health` 之前被拆台;
+ *    最短窗是配置的性质、不随状态变,壳的触点只要比它密,在任何状态下都留得住引擎。
+ *  · `tickMs` = 自退检查的采样拍。自退发生在**生效窗**满之后、至多再晚一拍(顶注 8);生效窗恒 ≥ `lingerMs`(`lingerMs` 是各窗里最短的一个),所以触点比 `lingerMs` 密 ⇒ 在任何状态下都先于自退。
+ *    读数**不预言**自退时刻:父还活着时生效的是 owned 窗,自退只会更晚。
+ *
+ * ## 一源
+ * 与租约腿自己的行为同一处铸出:`engine_lease_armed` 日志、自退判据用的窗、拍频推导(`tickMs = min(15s, 最短窗)`)和本读数读的是同一组数 ——
+ * 不存在第二处去「算一遍租约窗」。一个永远不到期的窗(owned 窗 = `Infinity` 且没有孤儿车道)不是租约:读数整个缺席,不补 0、不把 `Infinity` 送进 JSON。
+ */
+export interface EngineLeaseFacts {
+    readonly lingerMs: number;
+    readonly tickMs: number;
+}
+/** {@link createEngineLeaseTracker} 的把手:`stop()` 收摊;`facts` 现读 —— **腿还在观察**时才有(收摊 / 自退触发之后缺席,says-yes ⟺ 腿在转)。 */
+export interface EngineLeaseHandle {
+    stop(): void;
+    readonly facts: EngineLeaseFacts | undefined;
+}
 export interface EngineLeaseDeps {
     /** 活附着数 = 本副本当前**打开着的 SSE 流**条数(`drainState.attachedStreams`,由 `createHttpServer` 自赋)。 */
     attachedStreams: () => number;
@@ -167,7 +190,5 @@ export interface EngineLeaseDeps {
     now?: () => number;
 }
 /** 装配并**立刻**起自退检查(装配即 `engine_lease_armed`)。返回停机链用的 `stop()`。 */
-export declare function createEngineLeaseTracker(deps: EngineLeaseDeps): {
-    stop(): void;
-};
+export declare function createEngineLeaseTracker(deps: EngineLeaseDeps): EngineLeaseHandle;
 //# sourceMappingURL=engine-lease.d.ts.map

package/dist/boot/engine-lease.js

@@ -1,7 +1,9 @@
 export const ENGINE_LEASE_TICK_MS = 15_000;
 export function createEngineLeaseTracker(deps) {
     const orphanLane = deps.orphan;
-    const tickMs = deps.tickMs ?? Math.min(ENGINE_LEASE_TICK_MS, deps.lingerMs, orphanLane?.lingerMs ?? Number.POSITIVE_INFINITY);
+    const shortestLingerMs = Math.min(deps.lingerMs, orphanLane?.lingerMs ?? Number.POSITIVE_INFINITY);
+    const tickMs = deps.tickMs ?? Math.min(ENGINE_LEASE_TICK_MS, shortestLingerMs);
+    const leaseFacts = Number.isFinite(shortestLingerMs) ? Object.freeze({ lingerMs: shortestLingerMs, tickMs }) : undefined;
     const now = deps.now ?? (() => performance.now());
     let stopped = false;
     let idleSince = now();
@@ -66,6 +68,11 @@ export function createEngineLeaseTracker(deps) {
         stopped = true;
         clearInterval(timer);
     }
-    return { stop };
+    return {
+        stop,
+        get facts() {
+            return stopped ? undefined : leaseFacts;
+        },
+    };
 }
 //# sourceMappingURL=engine-lease.js.map

package/dist/boot/execution-env.d.ts

@@ -8,10 +8,13 @@ import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
+import { type RemoteContainerEnvDeps } from "../plugins/remote-env-e2b.js";
+import { type WorkspaceFillOf } from "../plugins/workspace-fill.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
-import { type SandboxGitPlane, type SandboxGitRunRows } from "../sandbox-git-plane.js";
+import { type SandboxGitPlaneSeat, type SandboxGitRunRows } from "../sandbox-git-plane.js";
 import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { type SpaceCommitRows } from "../workspace-space-commit.js";
+import { type LocalDockerEnvDeps } from "../plugins/remote-env-local-docker.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { TaskInheritEnv } from "../request-value-closure.js";
@@ -77,10 +80,19 @@ export declare function createSessionScopedRegistries(maxEntries?: number): Sess
  *  · 运维行座(`logger`)随部署级配置走。
  * `deps` = 适配器自己的测试缝(假集群 / 假对象存储),生产装配不传。返回的是工厂闭包 ⇒ `create*`。
  */
+/**
+ * 一条 run 是不是它工作区的属主:它的放置根就是它自己的会话(core `ExecutionEnvFactoryContext.placementRootSessionId`)。委派子代 / 后台代理与父 run 并发
+ * (一只工作区两个写者)、本服务为自己起的 run(放置根 = `INTERNAL_RUN_PLACEMENT_ROOT`)都不是。两个读者同一判:k8s 工作区空间(子代依律关)与
+ * 恢复点的播种(只有属主播种)。
+ */
+export declare function ownsItsWorkspace(ctx: {
+    readonly sessionId: string;
+    readonly placementRootSessionId: string;
+}): boolean;
 export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     imageOf(sessionId: string): string | undefined;
     /** The member git-credential broker seat for the pod's run (`runId` = the one reading of the run that owns the pod, the same value its
-     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `sandboxBrokerSeatOf` over the boot's plane reading and the run row's identity);
+     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `createSandboxBrokerSeatOf` over the plane seat's reading at that pod and the run row's identity);
      *  absent seat / `undefined` answer ⇒ the pod carries no broker. */
     brokerSeatOf?(runId: string | undefined): Promise<K8sEnvConfig["sandboxBroker"]>;
     /** The session store's by-id head read (`SessionStore.headOf`, picked once by `headReadOf`); the occupant is its live-occupant projection
@@ -90,11 +102,13 @@ export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     /** The run store's commit-fence rows (`workspace_space_commit`); answers `undefined` only before stage 7 binds the run store
      *  or without a store backend — the latter `assertWorkspaceSpaceReadable` refuses together with `space`. */
     spaceCommits(): SpaceCommitRows | undefined;
+    /** The restore point's fill seat of the run (`workspace-fill.ts`; `createExecutionEnv` mints the one reading). Absent / `undefined` ⇒ the pod as it comes. */
+    workspaceFillOf?: WorkspaceFillOf;
 }, deps?: K8sEnvDeps): ReturnType<typeof k8sExecutionEnvFactory>;
 /**
  * k8s 车道沙箱秘密座的**起服前提**(装配后的真门,第 5 段 await)。法只有一条:**秘密座非空(`K8S_SANDBOX_ENV` 点到了本进程环境里有的键)⇒
  * 问一次 SelfSubjectAccessReview(env 座那一行动词 {@link SANDBOX_SECRET_SEAT_VERBS}`.env`,沙箱命名空间)** —— 只问这一座自己发的调用,
- * 不问租约座的 `patch`(那一座由凭据平面的判官在它的前提都成立时另问,见 `readSandboxGitPlane`):
+ * 不问租约座的 `patch`(那一座由凭据平面座在它的前提都成立时另问一次,见 `sandbox-git-plane.ts` 的 `createSandboxGitPlaneSeat` 的 `settle`):
  *  · 答了「不许」(任一动词)⇒ 拒启,一行拒句点名缺的动词、命名空间、Role 规则原文与出路(`[sandbox-secret-rbac]`)—— 不等第一个 run 才失败;
  *  · 问不到(请求失败 / 审查本身被拒 / 答复没有 `status.allowed`)⇒ 照常起服:F 类兜底口 `server.sandbox-secret.seat-unverified` 计数 + 一行
  *    `sandbox_secret_seat_unverified`。放行的最坏后果:RBAC 真缺时第一个要建 Secret 的 run 连接即拒(`auth_failed`,pod 被删)—— 秘密值仍然
@@ -141,6 +155,12 @@ export interface ExecutionEnvCtx {
     /** run 店的按 id 读(成员凭据代理座读 run 行上受理时记下的身份元组 `RunRecord.identity`)。取值闭包:run 店第 7 段才绑(`late-binds.ts`),
      *  平面开着时每个 run 的 pod 建起前求值一次。不传 / 答 `undefined`(没有存储后端)⇒ 读不到身份 ⇒ 不挂代理。 */
     runRows?: () => SandboxGitRunRows | undefined;
+    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。 */
+    laneDeps?: {
+        readonly e2b?: RemoteContainerEnvDeps;
+        readonly k8s?: K8sEnvDeps;
+        readonly localDocker?: LocalDockerEnvDeps;
+    };
 }
 export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perTaskImage: PerTaskImageRegistry;
@@ -158,6 +178,6 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     spaceReclaimer: SpaceReclaimer | undefined;
     sandboxSecretSeatGate: (() => Promise<void>) | undefined;
     sandboxPodReaper: SandboxPodReaper | undefined;
-    readSandboxGitPlane: () => Promise<SandboxGitPlane>;
+    sandboxGitPlane: SandboxGitPlaneSeat;
 };
 //# sourceMappingURL=execution-env.d.ts.map