@sema-agent/server 7.142.0 → 7.143.0

package/dist/boot/web-admin.js

@@ -18,6 +18,7 @@ import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
 import { configSourceKind, createConfigProvider, raceBootFetch, BOOT_FETCH_DEFERRED } from "../config-provider.js";
+import { REMOTE_CATALOG_SOURCE } from "../env-model-table-gate.js";
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
@@ -55,11 +56,14 @@ export async function createWebAdminRuntime(ctx) {
     let latestEffective;
     let candidateRejection;
     let judgedOrdinal = 0;
-    const noteCandidateVerdict = (ordinal, rejection) => {
+    let arrivalSeq = 0;
+    const admitArrival = (ordinal, rejection) => {
         if (ordinal < judgedOrdinal)
-            return;
+            return { seq: undefined };
         judgedOrdinal = ordinal;
         candidateRejection = rejection;
+        arrivalSeq += 1;
+        return { seq: arrivalSeq };
     };
     const applyLedger = createConfigApplyLedger();
     let lastPull = "none";
@@ -88,6 +92,7 @@ export async function createWebAdminRuntime(ctx) {
     let bootSkillStale = false;
     let pendingRestart;
     let modelRefusals;
+    let modelRefusalsArrival;
     const cc = config.webAdmin;
     const bootCredential = cc?.credential.read();
     const bootVerdict = bootCredential === undefined ? undefined : judgeCenterCredentialAtBoot(bootCredential);
@@ -208,7 +213,7 @@ export async function createWebAdminRuntime(ctx) {
         const domains = verdict.domains.join(",");
         if (candidateRejection?.version === r.effective.version && candidateRejection.domains.join(",") === domains)
             return;
-        noteCandidateVerdict(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
+        admitArrival(ordinal, candidateRejectionOf(r, verdict, candidateSource().kind, Date.now()));
         logger.warn("config_candidate_rejected", buildCandidateRejectedFields(r, verdict, leg, { lkgVersion: latestEffective?.version ?? "(env)", ...localDirField }));
     };
     const noteSourceAtApplied = () => {
@@ -217,7 +222,7 @@ export async function createWebAdminRuntime(ctx) {
         if (rejected === undefined || rejected.version === appliedVersion)
             return;
         const gen = generationOf(appliedVersion);
-        noteCandidateVerdict(gen, undefined);
+        admitArrival(gen, undefined);
         if (!cc?.dryRun)
             applyLedger.applied(gen, appliedVersion);
         logger.info("config_source_back_to_applied", {
@@ -258,8 +263,9 @@ export async function createWebAdminRuntime(ctx) {
         if (!same)
             notifySelfReport("model_refusals");
     };
-    const recordApply = (rep) => {
+    const recordApply = (rep, ticket) => {
         applyLedger.recordApply(rep);
+        modelRefusalsArrival = ticket.seq;
         publishModelRefusals(buildModelRefusalsSignal(rep.modelRefusals));
     };
     let adoptedArtifact;
@@ -518,19 +524,21 @@ export async function createWebAdminRuntime(ctx) {
             const lkgEffective = read.lkg.effective;
             candidateIdentity.set(lkgEffective, identity);
             bindValidator(read.lkg.etag, identity);
-            return { effective: lkgEffective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}), prompts: read.prompts };
+            return { effective: lkgEffective, ...(read.lkg.etag !== undefined ? { etag: read.lkg.etag } : {}), prompts: read.prompts, catalogSource: REMOTE_CATALOG_SOURCE };
         };
         const bootApplyLkgInline = async (lkgR) => {
             const lkgGen = generationOf(lkgR.effective.version);
             applyLedger.seenTarget(lkgGen, lkgR.effective.version);
+            const lkgArrival = admitArrival(lkgGen, undefined);
             let lkgReport;
             applyEffective(config, lkgR.effective, logger, {
                 leg: "boot",
+                catalogSource: lkgR.catalogSource,
                 sealedKeys,
                 generation: lkgGen,
                 report: (rep) => {
                     lkgReport = rep;
-                    recordApply(rep);
+                    recordApply(rep, lkgArrival);
                 },
             });
             const lkgIdentity = candidateIdentityOf(lkgR.effective);
@@ -613,7 +621,7 @@ export async function createWebAdminRuntime(ctx) {
                     }
                     else {
                         warnReadNotices(r, "boot");
-                        logEffectiveDiff(config, r.effective, logger);
+                        logEffectiveDiff(config, r.effective, r.catalogSource, logger);
                         ccEtag = r.etag;
                     }
                 }
@@ -631,14 +639,16 @@ export async function createWebAdminRuntime(ctx) {
                         warnReadNotices(r, "boot");
                         const bootGen = generationOf(r.effective.version);
                         applyLedger.seenTarget(bootGen, r.effective.version);
+                        const bootArrival = admitArrival(bootGen, undefined);
                         let bootReport;
                         applyEffective(config, r.effective, logger, {
                             leg: "boot",
+                            catalogSource: r.catalogSource,
                             sealedKeys,
                             generation: bootGen,
                             report: (rep) => {
                                 bootReport = rep;
-                                recordApply(rep);
+                                recordApply(rep, bootArrival);
                             },
                         });
                         markApplied(bootGen, r.effective);
@@ -651,7 +661,7 @@ export async function createWebAdminRuntime(ctx) {
                             const lkgPlane = await bootFromLkg("boot candidate's model plane was refused", "model-plane");
                             if (lkgPlane) {
                                 let planeReport;
-                                applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
+                                applyEffective(config, withModelPlaneOf(r.effective, lkgPlane.effective), logger, { leg: "boot", catalogSource: lkgPlane.catalogSource, sealedKeys, generation: bootGen, report: (rep) => (planeReport = rep) });
                                 if (modelPlaneCommitted(planeReport)) {
                                     bootPlaneEff = lkgPlane.effective;
                                     logger.warn("config_model_plane_from_lkg", { version: r.effective.version, lkgVersion: lkgPlane.effective.version, note: "the live candidate's model plane was refused at boot — serving the LKG's model plane (the catalog and what rides with it) with the live candidate's other groups; the refresh cadence re-judges the candidate" });
@@ -746,6 +756,7 @@ export async function createWebAdminRuntime(ctx) {
         restartState: () => buildRestartSignal(pendingRestart, planeDeferredNoHandoff),
         configHandoffState: () => (configProvider === undefined || configProvider.kind === "local" || !lkgSurvivesRestart ? undefined : buildConfigHandoff(latchHandoff(), handoffMissingSince)),
         modelRefusalsState: () => modelRefusals,
+        latestPlaneRefusalState: () => (modelRefusals?.plane !== undefined && modelRefusalsArrival !== undefined && modelRefusalsArrival === arrivalSeq ? modelRefusals.plane : undefined),
         candidateRejectionState: () => (cc?.dryRun ? undefined : candidateRejection),
         configApplyState: () => (configProvider ? applyLedger.view() : undefined),
         centerPullState: () => {
@@ -905,11 +916,12 @@ export async function createWebAdminRuntime(ctx) {
                     const committed = applyEffective(config, eff, logger, {
                         leg: "hot",
                         checkpointStorePresent,
+                        catalogSource: c.catalogSource,
                         sealedKeys,
                         generation: gen,
                         report: (rep) => {
                             report = rep;
-                            recordApply(rep);
+                            recordApply(rep, c.arrival);
                         },
                         ...(planeChanged ? { swapPlane: swapRunnerDeps } : {}),
                     });
@@ -937,14 +949,14 @@ export async function createWebAdminRuntime(ctx) {
                 const demoteToNoCenter = async (awaiting) => {
                     const gen = reserveArrivalGeneration();
                     applyLedger.seenTarget(gen, NO_CENTER_EFFECTIVE.version);
-                    const hot = await commitHot({ eff: NO_CENTER_EFFECTIVE, prompts: undefined, gen, phase: "no-center" });
+                    const arrival = admitArrival(gen, undefined);
+                    const hot = await commitHot({ eff: NO_CENTER_EFFECTIVE, catalogSource: REMOTE_CATALOG_SOURCE, prompts: undefined, gen, arrival, phase: "no-center" });
                     if (!hot.committed) {
                         throw new Error("the no-center tier was refused (the Runners did not accept the env model table) — the previous account's center configuration is still in force; retried next tick");
                     }
                     if (hot.report !== undefined && !hot.report.fullyApplied) {
                         logger.warn("center_identity_demotion_partial", { groups: refusedGroups(hot.report).map((g) => g.group), note: "a group of the no-center tier was refused — that group keeps its previous values (loud; the env base for that group could not be applied)" });
                     }
-                    noteCandidateVerdict(gen, undefined);
                     latestEffective = undefined;
                     ccEtag = undefined;
                     announceTier(tier.demote(awaiting, hot.report !== undefined ? refusedGroups(hot.report).map((g) => g.group) : []));
@@ -1013,14 +1025,14 @@ export async function createWebAdminRuntime(ctx) {
                                 announceCandidateRejected(r, verdict, arrival !== undefined ? "late-boot" : "refresh", tickGen);
                                 return "ok";
                             }
-                            noteCandidateVerdict(tickGen, undefined);
+                            const tickArrival = admitArrival(tickGen, undefined);
                             warnReadNotices(r, "refresh");
                             if (ccRef?.dryRun) {
-                                logEffectiveDiff(config, r.effective, logger);
+                                logEffectiveDiff(config, r.effective, r.catalogSource, logger);
                                 ccEtag = r.etag;
                             }
                             else {
-                                const hot = await commitHot({ eff: r.effective, prompts: verdict.prompts, gen: tickGen, phase: "refresh" });
+                                const hot = await commitHot({ eff: r.effective, catalogSource: r.catalogSource, prompts: verdict.prompts, gen: tickGen, arrival: tickArrival, phase: "refresh" });
                                 if (!hot.committed)
                                     return "ok";
                                 const applyReport = hot.report;
@@ -1127,14 +1139,14 @@ export async function createWebAdminRuntime(ctx) {
                         announceCandidateRejected(r, lateVerdict, "late-boot", lateGen);
                         return;
                     }
-                    noteCandidateVerdict(lateGen, undefined);
+                    const lateArrival = admitArrival(lateGen, undefined);
                     warnReadNotices(r, "boot-deferred");
                     if (ccRef?.dryRun) {
-                        logEffectiveDiff(config, r.effective, logger);
+                        logEffectiveDiff(config, r.effective, r.catalogSource, logger);
                         ccEtag = r.etag;
                         return;
                     }
-                    const hotLate = await commitHot({ eff: r.effective, prompts: lateVerdict.prompts, gen: lateGen, phase: "boot-deferred" });
+                    const hotLate = await commitHot({ eff: r.effective, catalogSource: r.catalogSource, prompts: lateVerdict.prompts, gen: lateGen, arrival: lateArrival, phase: "boot-deferred" });
                     if (!hotLate.committed)
                         return;
                     const applyReportLate = hotLate.report;

package/dist/capabilities/hands-lane.d.ts

@@ -12,8 +12,8 @@
  *     不是静默继承 full(词表闭集纪律)。
  *  ② {@link HANDS_EXCLUSIVE_TOOL_NAMES} + {@link handsDenyPolicy} —— 纵深:hands=none 的任务即便被误接到
  *     有手 Runner 上,手独占名单逐一 deny。**不是**主保证(主保证是根本不挂 factory ⇒ 工具面不可见)。
- *  ③ {@link stampHandsLane} / {@link handsLaneOf} —— 车道作为 TaskSpec 上的**显式字段**([ref]):
- *     resolveSpec 出口铸一次,执行点读一次,**缺席即拒**(不是回落最宽车道)。
+ *  ③ {@link createHandsRunnerSelector} —— 车道是这条腿的部署事实(`leg-facts.ts`:装配器出口铸一次,两只漏斗以装配输出调选路器时读一次),
+ *     **缺席即拒**(不是回落最宽车道)。
  */
 import { type Runner, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
 /** 场景对手带工具面的表态(闭集)。`full` = core 手带 band 照常 mount;`none` = 不挂 executionEnvFactory 的 Runner。 */
@@ -114,32 +114,7 @@ export declare function tightenWithHandsDeny(base: ToolPolicy | undefined): Tool
 /** 装配点的取用形:`full` 原样放行基线,`none` 叠 deny。**穷举 switch**,无缺省臂。 */
 export declare function toolPolicyForHands(hands: ScenarioHands, base: ToolPolicy | undefined): ToolPolicy | undefined;
 /**
- * 执行车道在 TaskSpec 上的**显式字段键**([ref];修前是一张以 spec **对象身份**为键的 WeakMap 旁表)。
- *
- * 为什么是 symbol 而不是字符串键:`TaskSpec` 是**上游 core 的类型面**,一个字符串键会进
- * `Object.keys` / `JSON.stringify` / core 自己的键审计,等于 server 在别人的契约上私自加一个键;
- * symbol 键随 spread(`{...spec}`)与 rest 解构(`const {objective, ...taskConfig} = spec`)结构性
- * 地跟着走,却对上游的键面**不可见**(结构化克隆与 JSON 同样跳过 symbol 键)。于是「车道是 spec 上
- * 的一个字段、复制 spec 不丢车道」与「不污染上游契约」两件事同时成立。
- *
- * 修前的旁表要求「从 resolveSpec 出来的那一只对象必须一路原样活到执行点」——一条**隐形**的对象身份
- * 契约:任何一次 `{...spec}` 都会静默把车道降级成最宽的 `full`(实测:登记 `none` 的 spec 复制后
- * `laneOf` 答 `full`)。字段化把那条隐形要求整条删掉。
- */
-export declare const HANDS_LANE_FIELD: unique symbol;
-/** 已铸车道的 TaskSpec。铸点唯一(`boot/resolve-spec.ts` 的 resolveSpec 出口),读点唯一({@link handsLaneOf})。 */
-export type LanedTaskSpec = TaskSpec & {
-    readonly [HANDS_LANE_FIELD]: ScenarioHands;
-};
-/**
- * 铸车道(**单一属主**:只允许 resolveSpec 的出口调用)。
- *
- * 字段是 `enumerable`(所以复制得走)、`writable:false` + `configurable:false`(所以同一只 spec 被
- * 第二次铸车道会当场 TypeError —— 两个写者是漂移的成因,响亮好过后到者悄悄赢)。
- */
-export declare function stampHandsLane<T extends TaskSpec>(spec: T, hands: ScenarioHands): T & LanedTaskSpec;
-/**
- * 车道字段缺席的拒因 —— 具名类,便于调用点/测试按类型判,而不是嗅文案。
+ * 车道读不到的拒因 —— 具名类,便于调用点/测试按类型判,而不是嗅文案。
  *
  * 🔴 **刻意不是 `HttpError`、刻意不铸新的 wire 错误码**:它落到 `http/server.ts` 的兜底 catch,
  * wire 上是 500 `internal.error`(内部文本不回显,只进 `request_error` 日志行)。理由两条:
@@ -153,19 +128,14 @@ export declare class HandsLaneUnstampedError extends Error {
     constructor();
 }
 /**
- * 读车道 —— **缺席即拒**([ref] P 类:车道选择是保护型量,fail-closed;`observability/fail-open.ts`
- * 头注把「车道选择」逐字列在「正解是 fail-closed,不是留痕后继续放行」那一族里)。
+ * 装配点的选路席:`{full, handsless}` 两只 Runner + 这条腿的车道 ⇒ 本任务跑哪一只。公共缝 `runnerFor(spec)` 的生产实现;
+ * 两只漏斗(受理 / 续跑)以**装配器输出的那一只对象**调它(`leg-facts.ts`:读在 `stampSpecRoot` 复制之前)。
  *
- * 修前此处是 `?? "full"`:一只没经过本仓 resolver 的 spec 会**静默拿到最宽的车道**(全量可写手带)。
- * 「唯一可达形是测试桩」这个论证不是防线 —— 它是一句关于今天调用图的断言,而防线要防的正是明天多出
- * 来的第二个执行点。缺席现在整只拒(500 + 日志留原句),而不是把一个未经裁定的任务放进有手车道。
- */
-export declare function handsLaneOf(spec: TaskSpec): ScenarioHands;
-/**
- * 装配点的选路席:`{full, handsless}` 两只 Runner + 车道字段 ⇒ 本任务跑哪一只。
+ * 车道读不到 ⇒ **缺席即拒**([ref] P 类:车道选择是保护型量,fail-closed;`observability/fail-open.ts` 头注把「车道选择」逐字列在
+ * 「正解是 fail-closed,不是留痕后继续放行」那一族里)。读不到的两种来路:嵌入方自带的 `resolveSpec`(不铸本仓的腿事实),
+ * 或有人把复制品交了进来(读晚了)—— 都整只拒(500 + 日志留原句),绝不把一个未经裁定的任务放进最宽的有手车道。
  *
- * 具名工厂而不是在 main.ts 手搓闭包:选路规则(读字段 → 穷举 switch)于是只有**一份实现**,
- * 测试与生产装配拿的是同一只(手搓等价闭包 = 第二真源,正是本件要删的那一类)。
+ * 具名工厂而不是在 main.ts 手搓闭包:选路规则(读车道 → 穷举 switch)于是只有**一份实现**,测试与生产装配拿的是同一只。
  */
 export declare function createHandsRunnerSelector(pair: HandsRunnerPair): (spec: TaskSpec) => Runner;
 //# sourceMappingURL=hands-lane.d.ts.map

package/dist/capabilities/hands-lane.js

@@ -1,4 +1,5 @@
 import { handBandEffects, judgeRuleToolName, combinePolicies, createAllowDenyPolicy } from "@sema-agent/core";
+import { legFactsOf } from "../leg-facts.js";
 import { TOOL_NAME_ROSTER } from "../namespaced-rule-name.js";
 export function withoutHands(deps) {
     const { executionEnvFactory: _handsDropped, ...rest } = deps;
@@ -29,7 +30,7 @@ export const HANDS_BAND_TOOL_NAMES = Object.freeze([
     "ExitWorktree",
     "ListAgents",
 ].filter((n, i, all) => judgeRuleToolName(n, TOOL_NAME_ROSTER).kind === "current" && all.indexOf(n) === i));
-export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskOutput", "TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
+export const HANDS_DUAL_USE_TOOL_NAMES = Object.freeze(["TaskStop", "SendMessage", "AgentTranscript", "ListAgents"]);
 export const HANDS_EXCLUSIVE_TOOL_NAMES = Object.freeze(HANDS_BAND_TOOL_NAMES.filter((n) => !HANDS_DUAL_USE_TOOL_NAMES.includes(n)));
 export const OFFICE_KEPT_HAND_TOOL_NAMES = Object.freeze(["Read", "Glob", "Grep"]);
 export const OFFICE_EXCLUDED_TOOL_NAMES = Object.freeze(HANDS_EXCLUSIVE_TOOL_NAMES.filter((n) => !OFFICE_KEPT_HAND_TOOL_NAMES.includes(n)));
@@ -48,24 +49,18 @@ export function toolPolicyForHands(hands, base) {
             return tightenWithHandsDeny(base);
     }
 }
-export const HANDS_LANE_FIELD = Symbol("sema-server.handsLane");
-export function stampHandsLane(spec, hands) {
-    Object.defineProperty(spec, HANDS_LANE_FIELD, { value: hands, enumerable: true, writable: false, configurable: false });
-    return spec;
-}
 export class HandsLaneUnstampedError extends Error {
     constructor() {
         super("execution lane is not stamped on this task spec — refusing to run it rather than falling back to the widest (full-hands) lane");
         this.name = "HandsLaneUnstampedError";
     }
 }
-export function handsLaneOf(spec) {
-    const lane = spec[HANDS_LANE_FIELD];
-    if (lane === undefined)
-        throw new HandsLaneUnstampedError();
-    return lane;
-}
 export function createHandsRunnerSelector(pair) {
-    return (spec) => pickHandsRunner(handsLaneOf(spec), pair);
+    return (spec) => {
+        const hands = legFactsOf(spec)?.hands;
+        if (hands === undefined)
+            throw new HandsLaneUnstampedError();
+        return pickHandsRunner(hands, pair);
+    };
 }
 //# sourceMappingURL=hands-lane.js.map

package/dist/capabilities/mcp-probe.d.ts

@@ -354,8 +354,9 @@ export declare function buildMcpProbeInflightRefusal(): McpProbeRefusal;
  * 在任何传输被触碰**之前**就被拒)。
  *
  * 异源复核 [medium]:修前这一形在两条口上都被抛给分派器尾 ⇒ `500 internal.error`。可自带申报那一口的申报
- * 是**调用方**写的,把它答成 500 是把调用方的错说成这台机器故障;中心申报那一口反过来 —— 那是部署方写的,
- * 5xx 才是对的方向。⇒ 一条规则:**谁写的申报,谁的错**。
+ * 是**调用方**写的,把它答成 500 是把调用方的错说成这台机器故障 ⇒ 自带申报那一口答 400 `request.field_invalid`(本句)。
+ * 中心申报那一口**不走本句**:那是部署方写的、部署上挂不起来,引擎的拒按同步提交腿读的同一张「码 → 状态」表读成应答
+ * (409 `config.mcp_server_name_collision` + 引擎原句,`http/engine-refusal.ts`),与同一份声明集在提交腿上的答复同码同状态同句。
  *
  * 🔴 **不回显因由**:那句话来自申报集本身,可能带调用方的内情(名字、地址形)。调用方手里有自己的体,
  * 点名「两台撞了命名空间」就够他自己找;原文留在那一层的日志里。

package/dist/capabilities/scenarios.d.ts

@@ -5,6 +5,7 @@ import { type RepoReadClient } from "./repo-tools.js";
 import { type LoadedSkill, type RunSkillEntry, type ScenarioSkillEntry, type SkillSource } from "./skills.js";
 import { type ScenarioHands } from "./hands-lane.js";
 import type { DelegationRootWitness } from "../delegated-session-owner.js";
+import type { BackgroundCompletionSinkFor } from "../session-notify-door.js";
 /**
  * Scenario routing — a deployment serves many scenarios from one image. Each request's `scenario`
  * selects a pre-wired capability bundle: tools (incl. subagent roster) + its prompt seats + skills.
@@ -85,7 +86,8 @@ export interface ScenarioContext {
     /**
      * [ref] / [ref]:**委派树根的见证**(停驻挂点的属主来源)—— 根会话 id + 调用方判断那一刻读到的根行住客(`delegated-session-owner.ts` 的 `DelegationRootWitness`)。
      * 由**每一个**接了停驻挂点的取用方显式交出(一条读法,没有回落):请求腿 = 本请求经鉴权解析的会话与受理时那一读(`boot/resolve-spec.ts`);`/decide` 赎回面 = 行上的
-     * `rootSessionId` 与赎回腿写口放行的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它**只**喂停驻挂点,不挂任何会话级设施(那是 {@link sessionId} 的事,
+     * `rootSessionId` 与赎回腿写口放行的那一位住客(`parked-revive-surface.ts`,交不交座都交)。它喂停驻挂点与 Runner 之外的后台子代完成 relay(会话通知门的目标住客:属主与化身),
+     * 不挂任何会话级设施(那是 {@link sessionId} 的事,
      * 判据是「这只 bundle 是不是在那只会话上取用的」,与属主来源是两个独立判据)。缺席 = 没有根可交(boot 期探针、run-local、行上没有根)⇒ 律给哨兵。
      * 挂点在停驻那一刻再读一次根行:住客不是见证的那一位(删了、同 id 被重新登记)⇒ 停驻否决 —— 不按新住客认领。
      */
@@ -157,6 +159,14 @@ export interface ScenarioDeps {
      * 停驻都经它(子代沿用父的委派工具实例)。
      */
     ensureChildSessionDurable?: (sessionId: string, root: DelegationRootWitness | undefined) => Promise<void>;
+    /**
+     * **Runner 之外的后台子代完成**交给哪里 —— 按委派树根见证({@link ScenarioContext.delegationRoot})造委派工具挂载期的 `background.notify`。
+     * 停驻赎回腿的复活、操作员 `handle.resume` 都不是哪一次 run 内的调用,没有调用车道;引擎只在能解出一只完成 sink(调用 ?? 挂载)时才起后台续跑,
+     * 解不出 ⇒ 拒(`revive.no_background`)。sink = 委派树根会话的会话通知门(`session-notify-door.ts` 的 `createBackgroundCompletionRelay`;律与地址、
+     * 竞态、条目形都写在那里)。Runner 之内的调用照旧走调用车道,这只 sink 不被调。缺席(没有门的装配:run-local)⇒ 不接 ——
+     * 不接一只空 sink(接了 = 引擎起续跑、完成没人收)。
+     */
+    backgroundCompletionSinkFor?: BackgroundCompletionSinkFor;
     /**
      * [ref]([ref] F2 症状 → [ref] 定谳):**会话级**任务清单店解析器,属主 =
      * `boot/task-list-lane.ts` 的 {@link import("../boot/task-list-lane.js").createTaskListLane}

package/dist/capabilities/scenarios.js

@@ -59,6 +59,7 @@ export function buildScenarios(deps) {
                             ...(deps.backgroundAgentStore ? { agentStore: deps.backgroundAgentStore } : {}),
                             ...(deps.checkpointStore ? { checkpointStore: deps.checkpointStore } : {}),
                             ...(ensureChildSessionDurable !== undefined ? { ensureChildSessionDurable: (childSessionId) => ensureChildSessionDurable(childSessionId, delegationRoot) } : {}),
+                            ...(deps.backgroundCompletionSinkFor !== undefined && delegationRoot !== undefined ? { notify: deps.backgroundCompletionSinkFor(delegationRoot) } : {}),
                         },
                         ...createSubagentExtraTools(deps.subagentExtraTools),
                         ...(deps.logger

package/dist/capabilities/skills.d.ts

@@ -1,4 +1,4 @@
-import type { SkillSpec, TaskSpec } from "@sema-agent/core";
+import type { SkillSpec } from "@sema-agent/core";
 import type { RemoteExecProvider } from "../execution-lane-caps.js";
 import { type Logger } from "../observability/logger.js";
 /**
@@ -105,22 +105,6 @@ export type ScenarioSkillEntry = SkillListEntry<SkillSource>;
 export type RunSkillSource = SkillSource | "request";
 /** run 级名册的一条(`wiring_manifest.skills[]`)。铸点唯一:`capabilities/scenarios.ts` 的 `buildRunSkills`。 */
 export type RunSkillEntry = SkillListEntry<RunSkillSource>;
-/**
- * run 级技能名册在 TaskSpec 上的**显式字段键** —— 与执行车道字段(`hands-lane.ts` 的 `HANDS_LANE_FIELD`,[ref])同一形:symbol 键随
- * spread / rest 解构走(续跑腿的 `taskConfig` 就是 rest 解构出来的),对上游 core 的键面不可见(JSON / 结构化克隆跳过 symbol 键)。
- * 铸点唯一 = `boot/resolve-spec.ts` 的 resolveSpec 出口({@link stampRunSkills});读点唯一 = {@link runSkillsOf}(每条投 `wiring_manifest` 的腿)。
- */
-export declare const RUN_SKILLS_FIELD: unique symbol;
-/**
- * 铸名册(**单一属主**:只许 resolveSpec 的出口调用)。字段 `enumerable`(复制得走)、`writable:false` + `configurable:false`(同一只 spec 被第二次铸 ⇒
- * 当场 TypeError,两个写者是漂移的成因)。名册冻结一份拷贝(spec 与腿不共享可变引用)。
- */
-export declare function stampRunSkills<T extends TaskSpec>(spec: T, roster: readonly RunSkillEntry[]): T;
-/**
- * 读名册。`undefined` = 这只 spec 不是本仓装配出口产的(嵌入方自写 `resolveSpec` / 测试桩)⇒ 腿上没有关于技能的陈述(段缺席)。
- * 不是保护型量(缺席只少一段披露,不放宽任何东西)⇒ 缺席照常跑,与车道字段的「缺席即拒」不同。入参收 `object`:续跑腿手里是 rest 解构出来的 taskConfig。
- */
-export declare function runSkillsOf(spec: object): readonly RunSkillEntry[] | undefined;
 /** 一个技能范围的卡上清单 —— 与 {@link skillsForScenario} 同一只过滤、同一个序,只是投影不同。 */
 export declare function scenarioSkillEntries(loaded: readonly LoadedSkill[], scope: string): ScenarioSkillEntry[];
 /** {@link parseFrontmatter} 的三种读数(闭集):`absent` = 第一行不是围栏,没有 frontmatter(正当的全局技能)· `block` = 围栏收好了的块 · `unclosed` = 第一行是围栏而块没收好(读不了 —— 调用方拒载)。 */

package/dist/capabilities/skills.js

@@ -127,14 +127,6 @@ function skillsInScope(loaded, scope) {
 export function skillsForScenario(loaded, scope) {
     return skillsInScope(loaded, scope).map((k) => k.spec);
 }
-export const RUN_SKILLS_FIELD = Symbol("sema-server.runSkills");
-export function stampRunSkills(spec, roster) {
-    Object.defineProperty(spec, RUN_SKILLS_FIELD, { value: Object.freeze(roster.map((e) => Object.freeze({ ...e }))), enumerable: true, writable: false, configurable: false });
-    return spec;
-}
-export function runSkillsOf(spec) {
-    return spec[RUN_SKILLS_FIELD];
-}
 export function scenarioSkillEntries(loaded, scope) {
     return skillsInScope(loaded, scope).map((k) => ({ name: k.spec.name, description: k.spec.description, source: k.source }));
 }

package/dist/capability-facts.d.ts

@@ -21,9 +21,8 @@
 import type { FlatServiceDeps } from "./http/server.js";
 import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
-import type { ServiceFileHistoryStore } from "./plugins/store-backend.js";
+import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/store-backend.js";
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
-import { type SyncBlobHistoryStore } from "./session-sync.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
@@ -47,7 +46,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)";
     readonly session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)";
     readonly policy_purge_absent: "the session policy store has no deleteBySession purge verb";
-    readonly sync_blob_faces_absent: "the file-history store has no blob transfer faces (SQL backends only)";
+    readonly blob_exchange_absent: "the file-history store carries no blob exchange (FileHistoryStore.blobExchange — SQL backends only)";
     readonly device_hub_absent: "the device lane hub is not wired";
     readonly device_store_absent: "the device store is not wired";
     readonly device_enrollment_absent: "device enrollment is not wired";
@@ -193,10 +192,11 @@ export declare function sessionSync(d: Pick<Deps, "backend" | "sessionStorage" |
     sessionStorage: SyncSessionStore;
     historyStore: ServiceFileHistoryStore;
 }>;
-/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店有 blob 搬运面(只有 SQL 两只店有)。「店有没有 blob 两面」只在 `syncBlobFacesOf` 判一次(marker 门,不做名字探测),
- *  blob 取值口 `blobGetterOf` 读的是同一只 —— 本事实为真 ⟺ 取值口通到 `historyStore.getBlob`。 */
-export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy | "sync_blob_faces_absent", {
-    historyStore: SyncBlobHistoryStore;
+/** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带 blob 交换组(只有 SQL 两只店有)。「店能不能交换 blob」只在 `blobExchangeOf` 判一次(core 判官),
+ *  blob 取值口 `blobGetterOf` 读的是同一只 —— 本事实为真 ⟺ 取值口通到 `blobExchange.get`;判过的组随事实交出,路由的 GET / PUT / 在场预检只读它。 */
+export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy | "blob_exchange_absent", {
+    historyStore: ServiceFileHistoryStore;
+    blobExchange: ServiceBlobExchange;
 }>;
 /** 持久审批底座(checkpoint 店)在场 —— `/v1/approvals/*` 与 `/v1/assistant/*` 整条车道、会话 wake 都站在它上面。 */
 export declare function checkpointPark(d: Pick<Deps, "checkpointStore">): Fact<"checkpoint_store_absent", {
@@ -280,7 +280,7 @@ export declare function memoryExport(d: Pick<Deps, "memoryExport">): Fact<"memor
     read: Store<"memoryExport">;
 }>;
 /**
- * 中心侧同步口(`POST /v1/memory/sync/:scope`):DB 记忆平面的同步执行位在场 ∧ 本中心声明了同步身份(`MEMORY_SYNC_SERVE_IDENTITY`)。
+ * 中心侧同步口(`POST /v2/memory/sync/:scope`):DB 记忆平面的同步执行位在场 ∧ 本中心声明了同步身份(`MEMORY_SYNC_SERVE_IDENTITY`)。
  * 见证 = 执行位 + 那份声明 —— 能力位 `memorySyncServe` 的 `{ identity }` 逐字投影它,入站 `peer` 与它按串比:一处声明,两个读者读同一个值。
  */
 export declare function memorySyncServe(d: Pick<Deps, "memorySync" | "config">): Fact<"memory_db_plane_absent" | "memory_sync_identity_undeclared", {

package/dist/capability-facts.js

@@ -4,7 +4,7 @@ import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-approval.js";
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
-import { overwriteWipeIncapable, syncBlobFacesOf } from "./session-sync.js";
+import { blobExchangeOf, overwriteWipeIncapable } from "./session-sync.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
 import { headReadOf } from "./session-incarnation.js";
 export const CAPABILITY_FACT_WHY = {
@@ -27,7 +27,7 @@ export const CAPABILITY_FACT_WHY = {
     session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)",
     session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)",
     policy_purge_absent: "the session policy store has no deleteBySession purge verb",
-    sync_blob_faces_absent: "the file-history store has no blob transfer faces (SQL backends only)",
+    blob_exchange_absent: "the file-history store carries no blob exchange (FileHistoryStore.blobExchange — SQL backends only)",
     device_hub_absent: "the device lane hub is not wired",
     device_store_absent: "the device store is not wired",
     device_enrollment_absent: "device enrollment is not wired",
@@ -190,8 +190,8 @@ export function sessionSyncFileHistory(d) {
     const sync = sessionSync(d);
     if (!sync.available)
         return sync;
-    const faces = syncBlobFacesOf(sync.historyStore);
-    return faces !== undefined ? yes({ historyStore: faces }) : no("sync_blob_faces_absent");
+    const blobExchange = blobExchangeOf(sync.historyStore);
+    return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
 }
 export function checkpointPark(d) {
     return d.checkpointStore !== undefined ? yes({ checkpointStore: d.checkpointStore }) : no("checkpoint_store_absent");

package/dist/card-void.d.ts

@@ -1,18 +1,15 @@
 /**
- * **结算时作废一张本服务兑现不了的卡** —— 全仓「结算作废」的唯一动词:读卡 → 卡仍 pending ∧ 卡在调用方说的那只会话上 ⇒
+ * **结算时作废一张本 run 自己会话上的、本服务兑现不了的卡** —— 读卡 → 卡仍 pending ∧ 卡在调用方说的那只会话上 ⇒
  * 按卡**自己的** scope 走 checkpoint 店的 `expire`(与引擎的本进程仲裁器、续跑的 resolve 同一只 CAS,恰一个赢家)。不新增任何持久态。
  *
- * 规则只有一条:**本服务兑现不了的卡不留在待决面上**。两个产地读这一只动词,各自只答「手里是哪一张卡、它该在哪只会话上」:
- *  · 验证器自己的停驻(`verifier-pause-card.ts`):卡在验证器现铸的会话上,本服务的续跑链连不回它;
- *  · 停驻没落定就以失败收场的腿(`runs.ts` 的 `voidHeldParkCard`:后台腿与续跑腿):卡在本 run 的会话上,但兑现它的那条 run 已经
- *    `failed`、认领已放 —— 卡的命运先于认领释放(调用方先调本动词、再放认领)。
+ * 规则只有一条:**本服务兑现不了的卡不留在待决面上**。产地 = 停驻没落定就以失败收场的腿(`runs.ts` 的 `voidHeldParkCard`:后台腿与
+ * 续跑腿):卡在本 run 的会话上,但兑现它的那条 run 已经 `failed`、认领已放 —— 卡的命运先于认领释放(调用方先调本动词、再放认领)。
+ * 验证器自己的停驻卡不走这里:它由引擎的 `Runner.voidVerifierPause` 作废(引擎读卡上的组合腿判它是不是验证器的卡,
+ * `verifier-pause-card.ts`);那只动词只收验证器的卡,本 run 自己会话上的卡按引擎的读法仍走店级 `expire`。
  *
  * 不抛:作废没做成(店读 / 作废抛错、卡的会话对不上、没接店)⇒ 卡回到「留在待决面上、由审批兜底收割收走」的形,按产地登记的 tag
  * 响亮留痕(计数 + 探针行 + 一次 warn),结算照常往下走。卡已不 pending / 已不在 ⇒ 什么都不做(CAS 输给了别的结算者,结局相同)。
- *
- * ## 🚧 过渡(引擎动词到货即改调)
- * 店级 `expire` 只作废卡,**不释放**引擎为这张卡钉住的会话(引擎在停驻时 pin 会话,只在续跑终局 / 续跑失败臂 unpin):
- * 被作废的卡的会话在本副本内存里一直常驻到进程重启。引擎给出「作废停驻卡并释放其会话」的动词之后,本动词改调它(两个产地一字不改)。
+ * 店级 `expire` 只作废卡,不动引擎在停驻时给这只会话打的钉(钉在续跑终局 / 续跑失败臂放)。
  */
 import type { CheckpointToken } from "@sema-agent/core";
 import { type FailOpenTag } from "./observability/fail-open.js";

package/dist/config-catalog.js

@@ -337,7 +337,7 @@ export const CONFIG_CATALOG = [
             return compat.reasoningEffortLevels ?? null;
         },
     }),
-    r("MODEL_ROUTER_ID", "modelPlane", "string", "leader 路由分类模型覆写", { derivedDefaultNote: "缺席 ⇒ MODEL_CHEAP_ID,再退 default", danger: BILL }),
+    r("MODEL_ROUTER_ID", "modelPlane", "string", "leader 路由分类模型覆写", { derivedDefaultNote: "缺席 ⇒ 在服务表里解 classifier 角色(classifier → summarize → default;env cheap 槽绑 summarize,采纳的目录绑它自己的)", danger: BILL }),
     r("MODEL_THINKING_FORMAT", "modelPlane", "enum", "本网关收「开/关思考」的拼法(上 core OpenAICompletionsCompat.thinkingFormat;缺省开思考的 vLLM/Qwen 网关只有 qwen-chat-template 关得掉;anthropic 腿不铸此键;未知词拒启)", {
         enumValues: [...THINKING_FORMATS],
         derivedDefaultNote: "缺席 ⇒ 不铸此键,core 按 baseUrl/模型 id 自行推断(默认 openai 的 reasoning_effort)",