@sema-agent/server 7.144.0 → 7.146.0

package/dist/http/run-meta.d.ts

@@ -1,21 +1,28 @@
 /**
- * [ref] A9 装配缝的一片小叶子 —— 提交路径共用的两个纯函数(run 行元数据 + cascade 配置)。
+ * [ref] A9 装配缝的一片小叶子 —— 提交路径共用的三只小件(run 行元数据 + run 行预览的补写口 + cascade 配置)。
  *
- * 为什么单独成文件:`runMeta` 被 tasks 与 runs **两个**域模块调用,`cascadeConfig` 同理(还被测试直接引)。
- * 挂在任一域模块上都会造出 routes/* 互相值 import 的第二条边;它们又是纯函数(只依赖入参 + redact 叶子),
+ * 为什么单独成文件:`runMeta` 与预览补写口被 tasks 与 runs **两个**域模块调用,`cascadeConfig` 同理(还被测试直接引)。
+ * 挂在任一域模块上都会造出 routes/* 互相值 import 的第二条边;它们只依赖入参(受理座 / run 店两只口)+ 预览读法叶子,
  * 所以正确归处是叶子。server.ts 转出口 `cascadeConfig` 以保住既有 import 点。
  */
-import type { TaskSpec, CascadeConfig } from "@sema-agent/core";
+import type { CascadeConfig } from "@sema-agent/core";
+import type { RunAcceptance } from "../run-acceptance.js";
+import type { RunStore } from "../plugins/store-backend.js";
 /** The denormalized run-row metadata captured at submit: correlation (jobId), credential-derived source,
- *  and a redacted objective glance for lists. One place so the three submit paths can't drift. */
+ *  and a redacted objective glance for lists. One place so the three submit paths can't drift.
+ *
+ *  预览只取受理座交出的、提交那一刻就知道的交付文本(律的属主 = `run-acceptance.ts`「交付的是哪一份」):腿上没有 prompt 屏 ⇒ 交付的就是请求原文,
+ *  建行即写;腿上有屏 ⇒ 建行**不写**(列 NULL = 没建过预览),引擎交付可写的那一份时经 {@link fillRunPreviewOnDelivery} 补写一次。本函数不读请求体。 */
 export declare function runMeta(prepared: {
     jobId?: string;
-    spec: TaskSpec;
+    acceptance: Pick<RunAcceptance, "objectiveAtSubmit">;
 }, source: string | null): {
     jobId: string | null;
     source: string | null;
-    objectivePreview: string;
+    objectivePreview: string | null;
 };
+/** 腿上有屏时 run 行预览的补写口(建行之后、起跑之前登记):交付的那一份 → 同一只读法 → 店的写一次口(列已有值则不动)。腿上没有屏 ⇒ 受理座永不调它。 */
+export declare function fillRunPreviewOnDelivery(acceptance: Pick<RunAcceptance, "onDelivered">, runStore: Pick<RunStore, "fillObjectivePreview">, taskId: string): void;
 /** Build the cascade config from the operator ladder. Default gate = `status==="completed"` (escalate
  *  on a cheap-rung failure); cost-ceiling from the task's budget bounds the cold-rerun tax. */
 export declare function cascadeConfig(ladder: readonly string[], maxCostUsd?: number): CascadeConfig;

package/dist/http/run-meta.js

@@ -1,12 +1,15 @@
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function runMeta(prepared, source) {
-    const obj = prepared.spec.objective ?? "";
+    const delivered = prepared.acceptance.objectiveAtSubmit;
     return {
         jobId: prepared.jobId ?? null,
         source,
-        objectivePreview: buildRunObjectivePreview(obj),
+        objectivePreview: delivered === undefined ? null : buildRunObjectivePreview(delivered),
     };
 }
+export function fillRunPreviewOnDelivery(acceptance, runStore, taskId) {
+    acceptance.onDelivered("run-preview", (objective) => runStore.fillObjectivePreview(taskId, buildRunObjectivePreview(objective)));
+}
 export function cascadeConfig(ladder, maxCostUsd) {
     return {
         ladder: ladder.map((model) => ({ model })),

package/dist/http/server.d.ts

@@ -2,7 +2,7 @@ import http from "node:http";
 import type { MemoryComplianceFaces, MemoryOriginFaces, SessionMemoryStatusFace } from "../memory-operator-faces.js";
 import type { SideQueryAccounting } from "../budget.js";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
@@ -31,7 +31,7 @@ import type { Metrics } from "../observability/metrics.js";
 import { type RateGate } from "../observability/rate-limit.js";
 import type { QuotaTracker } from "../observability/cost-quota.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
-import type { ConsolidationSeatLabel, ConsolidationValve } from "../boot/memory-consolidation.js";
+import type { ConsolidationValve, MemoryConsolidationFaces } from "../boot/memory-consolidation.js";
 import { streamApprovals, checkQuestionAnswer } from "./routes/approvals-assistant.js";
 export { streamApprovals, checkQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
@@ -65,7 +65,7 @@ export interface RequestAuth {
  * 平铺形的直接后果 = main.ts 一个上千行的装配字面量,键与键之间没有任何「属于同一件事」的编译期表达,
  * 键落错家/从未接线只能靠源码钉逐个盯(1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族)。
  *
- * 药:七个**窄**接口 + 顶层必填八件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
+ * 药:七个**窄**接口 + 顶层必填件(今天九件)。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
  * 属性检查保护),键放错组当场编译红。
  *
  * 兼容形(本批**不动消费点**):`ServiceDeps` = 平铺视图 ∩ 组槽。旧的平铺构造(96 个测试文件 +
@@ -73,8 +73,8 @@ export interface RequestAuth {
  * 入口摊平回平铺视图,server.ts 内的 ~700 处 `deps.x` 消费点原样保留。消费点迁移是后批的事——
  * 一步到位需要同批改 ~700 处 src + ~800 处 test 键位,与「先立形、后搬家」相比没有额外收益。
  */
-/** createHttpServer 的**必填八件**——引擎、部署配置、提交的身份与根会话(authorizer)、请求→TaskSpec 的映射、选路席、side-query 执行席、读口场景门、对端座的 desk。
- *  八者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
+/** createHttpServer 的**必填九件**——引擎、部署配置、提交的身份与根会话(authorizer)、请求→TaskSpec 的映射、选路席、side-query 执行席、读口场景门、对端座的 desk、部署座的 mod 注册。
+ *  九者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
  *  错误推迟到运行期(本仓 E-HIGH-1 病族的成因就是「可选键从未接线、编译期无声」)。 */
 export interface ServiceCoreDeps {
     runner: Runner;
@@ -172,6 +172,14 @@ export interface ServiceCoreDeps {
      * 🔴 **必填**:没有 MCP / A2A 凭据的嵌入也给一只 `createPeerDesk()`(零 IO)—— 一个部署只有一张登记表,缺席不是「没有座」的另一种读法。
      */
     peerDesk: PeerDesk;
+    /**
+     * 部署座的 mod 注册(`RunnerDeps.mods`:这个部署每只 Runner 都带的同一份;起服第五段装配口 `assembleDeploymentMods` 交回,装配点把同一个值交给 Runner 与这里)。
+     * 本层只问它一件事:这条腿上有没有 prompt 屏(`prompt-screen.ts` 的 `promptScreenDeclared`,读注册**声明**的事件,连同任务座 `TaskSpec.mods`)——
+     * 有屏 ⇒ 受理座把目标落盘(run 行预览 · 续跑体 · 会话标题 · fleet 行名)推迟到引擎原样交付之后(读法全文 `run-acceptance.ts`「交付的是哪一份」)。
+     * 🔴 **必填**:缺席若读成「没有屏」,装了屏的部署会把屏前文本落进上面四处,而且谁也看不见 —— 机密轴上没有静默的那一侧。没有 mod 的嵌入显式传 `[]`;
+     * 与交给 Runner 的必须是同一个值(两处不同 = 嵌入方的装配错,本层读不出来)。
+     */
+    deploymentMods: NonNullable<RunnerDeps["mods"]>;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -573,15 +581,9 @@ export interface ServiceSeamDeps {
      *  **启动期**就被拒了(`boot/memory-consolidation.ts`),那些机器根本起不来。⇒ 缺席形是 **404 族**
      *  (整域不挂),刻意**不是** 501:501 说「换部署形态」,这里的动作是「把旋钮打开」。全文见
      *  `routes/memory-consolidation.ts` 头注。
-     *  🔴 `seat` 的词表单一真源 = `boot/memory-consolidation.ts` 的 {@link ConsolidationSeatLabel}
-     *  (type-only import,tsc 擦除、非装载边)——在这里再写一遍字面量联合就是第二份会漂的词表。 */
-    memoryConsolidation?: {
-        readonly seat: ConsolidationSeatLabel;
-        readonly model: string;
-        readonly scopes: readonly string[];
-        run(scope: string): Promise<ConsolidationRunReceipt>;
-        lastRun(scope: string): ConsolidationDriverRunRow | undefined;
-    };
+     *  🔴 形的单一真源 = `boot/memory-consolidation.ts` 的 {@link MemoryConsolidationFaces}(type-only import,tsc 擦除、非装载边)——
+     *  在这里再写一遍成员表就是第二份会漂的形(core 7.63.0 把 `lastRun` 改成异步时这里的手抄形正好漂了一次)。 */
+    memoryConsolidation?: MemoryConsolidationFaces;
     /** [ref] §3.1 / [ref] §1.3([ref] S-2):per-principal memory-capture opt-out 授权表的管理面
      *  (`/v1/admin/memory-optout` 四口,operator-only)—— `backend.memoryOptOutGrant()` 的同一只(与
      *  `RuntimeCaps.allowMemoryOptOut` 的 resolver 腿读同一张表,零缓存直读 ⇒ 写后下一次 prepare 即生效)。
@@ -721,7 +723,10 @@ export interface ServiceDeploymentDeps {
      *    orchestrator/shell retries against the replacement instance; read paths + in-flight verbs (steer/cancel/
      *    respond/subagent) stay open so the runs we are waiting on can still finish/interact.
      *  • `inflight` is ASSIGNED BY createServer (a live union of this replica's in-flight legs: durable bg/resume
-     *    `inflightRuns` + live sync/resume streams `steerableRuns`) — main.ts polls it to know when drain is done.
+     *    `inflightRuns` + live sync/resume streams `steerableRuns`, the leader leg, and the session-resident background
+     *    shells/monitors — `inflightBreakdown` is the same read split into its three terms) — an observable fact (`/health.inflight`).
+     *    `blockingInflight` (also ASSIGNED BY createServer) is the same breakdown minus the session-resident term: "is there still work that
+     *    must be waited out" — the drain wait main.ts polls after SIGTERM, the orphan/lease windows and the SIGHUP idle window read THAT.
      *  • /health carries `draining:true` + `version` (build self-description); draining is a readiness reason
      *    (`http/readiness.ts`) ⇒ `/readyz` 503 + `/health` `ready:false` (the k8s readiness 摘流信号).
      *  • [ref]:`attachedStreams` 同样 ASSIGNED BY createServer —— 本副本当前打开着的 SSE 流条数
@@ -732,6 +737,12 @@ export interface ServiceDeploymentDeps {
      *    硬停起点各调一次。
      */
     drainState?: import("../fleet/drain-entry.js").DrainState;
+    /**
+     * 在飞数第四类的读口:本进程**会话驻留的后台 shell / monitor** 行数(`session-resident-background.ts` 的 `countSessionResidentBackground` 在 composition root 绑上围栏表;
+     * 法与边界见该文件头)。`createHttpServer` 把它作为 `inflightBreakdown.sessionResident` 并进总数 `drainState.inflight` 的**同一次读**;它**不**进阻断集
+     * `drainState.blockingInflight`(排空 / 孤儿窗与附着租约自退 / SIGHUP 空闲窗判停读阻断集)。缺席(嵌入方 / 夹具)= 这一项恒 0,`inflight` 逐字同改前。
+     */
+    sessionResidentBackground?: () => number;
     /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端
      *  (非 fleet 成员 / 没接中心 / 测试夹具)⇒ `none`(与没有租约的引擎逐字同)。 */
     servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;
@@ -880,7 +891,7 @@ export interface ServiceDepGroups {
     deployment?: ServiceDeploymentDeps;
     knobs?: ServiceKnobDeps;
 }
-/** 平铺视图 = 必填八件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
+/** 平铺视图 = 必填九件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
 export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & ServiceCoordinatorDeps & ServiceSeamDeps & ServiceObservabilityDeps & ServiceGovernanceDeps & ServiceDeploymentDeps & ServiceKnobDeps>;
 /** createHttpServer 的入参:两形皆可(平铺=存量,分组=推荐)。同名键两形都给时,**顶层显式键赢**
  *  (含显式 `undefined`)——一处装配点只该用一形,混用时以肉眼最近的那个为准。 */

package/dist/http/server.js

@@ -9,6 +9,7 @@ import {} from "../memory-sync.js";
 import {} from "../orchestration/workflow-agent-steer.js";
 import {} from "../orchestration/workflow-completion-inbox.js";
 import {} from "../fleet/fleet-bus.js";
+import { blockingInflightOf, inflightTotal } from "../fleet/drain-entry.js";
 import {} from "../tool-approval.js";
 import {} from "../observability/rate-limit.js";
 import { IdempotencyCache } from "./idempotency.js";
@@ -20,6 +21,7 @@ import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 import { sendError, sendHttpError, sendOpenFaceFault, logRequestError } from "./send.js";
 import { createRequestGuards } from "./request-guards.js";
+import { createRunConcurrencyGate, liveRunIdsOf } from "./run-concurrency-cap.js";
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
 import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
@@ -66,6 +68,9 @@ export function createHttpServer(rawDeps) {
     if (typeof deps.authorize !== "function") {
         throw new Error("createHttpServer: the authorize seat is required — it is the only resolver of a submission's root session; pass `createAuthorizer(config, runner.sessions)` for a single-user embedding; refusing to start rather than run submissions on a root nobody attested");
     }
+    if (!Array.isArray(deps.deploymentMods)) {
+        throw new Error("createHttpServer: the deploymentMods seat is required — it is how the server learns whether a prompt screen runs on its legs (the same registrations the Runners carry as `mods`); pass `[]` for an embedding without mods; refusing to start rather than store objective text before the screen decides");
+    }
     {
         const retired = retiredServiceDepsRefusal(deps);
         if (retired !== undefined)
@@ -101,16 +106,28 @@ export function createHttpServer(rawDeps) {
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
     const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
-    if (deps.drainState)
-        deps.drainState.inflight = () => new Set([...inflightRuns.keys(), ...steerableRuns.keys()]).size + counters.uncountedBillableInflight + counters.admittedInflight + (deps.leaderEndpoint?.inflight?.() ?? 0);
+    const blockingParts = () => ({
+        http: liveRunIdsOf(inflightRuns, steerableRuns).size + counters.uncountedBillableInflight + counters.admittedInflight,
+        leader: deps.leaderEndpoint?.inflight?.() ?? 0,
+    });
+    const inflightBreakdown = () => ({ ...blockingParts(), sessionResident: deps.sessionResidentBackground?.() ?? 0 });
+    if (deps.drainState) {
+        deps.drainState.inflightBreakdown = inflightBreakdown;
+        deps.drainState.inflight = () => inflightTotal(inflightBreakdown());
+        deps.drainState.blockingInflight = () => blockingInflightOf(blockingParts());
+    }
     let lastBillableActivityAt = performance.now();
+    let firstBillableActivityAt = null;
     const noteActivity = (url) => {
         if (isProbePath(url))
             return;
         lastBillableActivityAt = performance.now();
+        firstBillableActivityAt ??= lastBillableActivityAt;
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
+    if (deps.drainState)
+        deps.drainState.firstActivityAt = () => firstBillableActivityAt;
     if (deps.drainState)
         deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
@@ -152,7 +169,8 @@ export function createHttpServer(rawDeps) {
     }
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { admitRun } = createRunConcurrencyGate({ deps, inflightRuns, steerableRuns });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {

package/dist/http/stored-body-replay.d.ts

@@ -1,19 +1,20 @@
 /**
- * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
+ * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只,外加 `settings.env` 凭据一臂;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
  * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
  * 四问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
  *
- * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:第三问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
+ * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:模式词问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
  * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
- * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,前两问的谓词照旧住在各自属主里。
+ * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,allow 读法问、工具名清单问与退役请求键问的谓词照旧住在各自属主里。
  */
 import type { PermissionMode } from "@sema-agent/core";
 import { type Autonomy } from "../runtime-governance.js";
 import { type ExecutionConfigRootDeployment } from "../execution-config-root.js";
+import { type ModelApiKeyEnvTable } from "../server-secret-env.js";
 import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
 import type { CheckpointCtx } from "./route-ctx.js";
 /**
- * 第三问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词进这块地板会变
+ * 模式词问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词进这块地板会变
  * (`runtime-governance.ts` `entryPermissionMode`,与提交入口的盖章同一只函数;判的是「词变不变」而不是 `clamped` —— 体无词的旧行进地板取地板本身,
  * 那也是变)⇒ 返回拒因的两个事实(体的词、地板);能 ⇒ `undefined`。
  */
@@ -22,13 +23,15 @@ export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor:
     floor: PermissionMode;
 } | undefined;
 /**
- * 预判读的部署配置:`autonomy`(第三问的模式词地板)、执行车道的 home 两位(`~/` 形规则那一问)与配置根的几位(user 设置层 `/` 规则那一问)。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
+ * 预判读的部署配置:`autonomy`(模式词问的模式词地板)、执行车道的 home 两位(`~/` 形规则那一问)与配置根的几位(user 设置层 `/` 规则那一问)。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
  */
 export type StoredReplayDeployment = ExecutionConfigRootDeployment & {
     readonly autonomy?: Autonomy | undefined;
+    /** 生效配置模型条目 name → `apiKeyEnv`(`settings.env` 凭据判据的名单一臂;缺席 = 没有模型条目,与 `serverCredentialValueSources` 的缺省同读)。 */
+    readonly modelApiKeyEnv?: ModelApiKeyEnvTable | undefined;
 };
 /**
- * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
+ * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法(体里带非空 `allow` 而写者版本证不出 ≥ 7.117.0;常设,按写者版本)→ 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
  * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
  */
 export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;

package/dist/http/stored-body-replay.js

@@ -1,4 +1,4 @@
-import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, rulePolicyBucketsRefusal, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, readSettingsEnv, rulePolicyBucketsRefusal, settingsEnvCredentialIssue, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
 import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { entryProblemsFacts } from "../entry-problems.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
@@ -6,7 +6,9 @@ import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { migrationWindowEnd } from "../plugins/one-time-migrations.js";
-import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
+import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m38.js";
+import { serverCredentialValueSources } from "../server-secret-env.js";
+import { allowListWriterUnproven, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
         return undefined;
@@ -57,11 +59,23 @@ function storedRulePolicyRefusal(body, deployment) {
     const neverAutoRefused = neverAutoNamesRefusal(neverAuto);
     return neverAutoRefused === undefined ? undefined : replayInertEntry(tightenOnlySeatField("neverAuto"), "deny", SETTINGS_RULE_REFUSAL_CODE, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${neverAutoRefused.message}`, { ...entryProblemsFacts(neverAutoRefused.problems) });
 }
+function storedEnvCredentialRefusal(body, deployment) {
+    const issue = settingsEnvCredentialIssue(readSettingsEnv(body?.settings).reaching, serverCredentialValueSources(deployment.modelApiKeyEnv));
+    if (issue === null || storedEnvCredentialsDropM38(new Date().toISOString().slice(0, 10)))
+        return undefined;
+    return { errorCode: "request.env_credential_refused", message: issue.message, facts: { ...issue.fields } };
+}
 export function storedBodyReplayRefusal(ctx, deployment) {
     const writer = ctx.writerVersion !== undefined ? { writerVersion: ctx.writerVersion } : {};
-    if (allowListReadingUnstated(ctx))
-        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx), ...writer };
-    const entry = storedPermissionBucketRefusal(ctx.body) ?? storedTightenOnlySeatRefusal(ctx.body) ?? inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
+    if (allowListWriterUnproven(ctx))
+        return { kind: "allow_list_reading", ...writer };
+    const early = storedPermissionBucketRefusal(ctx.body) ?? storedTightenOnlySeatRefusal(ctx.body);
+    if (early !== undefined)
+        return { kind: "inert_tool_list", entry: early };
+    const envCredential = storedEnvCredentialRefusal(ctx.body, deployment);
+    if (envCredential !== undefined)
+        return { kind: "settings_env_credential", refusal: envCredential };
+    const entry = inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
     if (entry !== undefined)
         return { kind: "inert_tool_list", entry };
     const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));

package/dist/http/submit-ctx.d.ts

@@ -3,6 +3,9 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { buildCheckpointCtx, type CheckpointCtxSealer, type SealedCheckpointCtx } from "./checkpoint-ctx.js";
 import { type RefusalBody } from "./refusal-body.js";
+import type { CheckpointCtx, PreparedTaskSubmission } from "./route-ctx.js";
+/** 这份续跑输入里体的目标是不是**不可展示**的那一份(`CheckpointCtx.promptScreened` 在场)。读续跑体目标的展示面只经这一只问;落盘的 JSON 逐位判形,不信型面。 */
+export declare function objectiveWithheldIn(ctx: Pick<CheckpointCtx, "promptScreened">): boolean;
 /** 写不进的那一种可答复的结局(各腿把它交回自己的出口:同步 / durable 腿直接回,活流腿编码成终帧)。 */
 export interface SubmitCtxRefusal {
     readonly status: 413 | 409;
@@ -23,4 +26,13 @@ export declare function persistSubmitCtx(store: {
     readonly runStore: RunStore;
     readonly taskId: string;
 } | undefined, sessionId: string, fields: Parameters<typeof buildCheckpointCtx>[0]): Promise<SubmitCtxRefusal | undefined>;
+/**
+ * 提交腿写续跑输入的入口(三个调用点同调这一只):体与标记按受理座提交时交出的那一份定(见文件头「体里的目标按哪一份写」),只写这一笔。
+ * 写不进的处置与答复 = {@link persistSubmitCtx}(本函数只定体、不另判)。
+ */
+export declare function persistSubmissionCtx(store: {
+    putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
+}, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & {
+    readonly spec: Pick<PreparedTaskSubmission["spec"], "sessionId" | "model">;
+}): Promise<SubmitCtxRefusal | undefined>;
 //# sourceMappingURL=submit-ctx.d.ts.map

package/dist/http/submit-ctx.js

@@ -3,6 +3,17 @@ import { releaseClaimedRun } from "./claimed-run.js";
 import { buildCheckpointCtx, CheckpointCtxUnsealableError } from "./checkpoint-ctx.js";
 import { refusalBody } from "./refusal-body.js";
 import { limitFactsUnmeasured } from "../limit-refusal.js";
+import { serviceVersion } from "../service-version.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { DEFAULT_MODEL_REF } from "../model-select.js";
+const WITHHELD_OBJECTIVE = "";
+export function objectiveWithheldIn(ctx) {
+    return ctx.promptScreened === true;
+}
+function withheldBody(body, picked) {
+    const pin = typeof body.model !== "string" && typeof picked === "string" && picked !== DEFAULT_MODEL_REF ? { model: picked } : {};
+    return { ...body, objective: WITHHELD_OBJECTIVE, ...pin };
+}
 function unsealableRefusal(e) {
     return {
         status: 409,
@@ -53,4 +64,16 @@ export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
         return rowTooLargeRefusal(tooLarge);
     }
 }
+export async function persistSubmissionCtx(store, deps, claim, prepared) {
+    const sessionId = prepared.spec.sessionId;
+    const screened = prepared.acceptance.objectiveAtSubmit === undefined;
+    if (screened && prepared.verify !== undefined)
+        recordFailOpen("server.objective-delivery.verify-replay-copy", `session=${sessionId}`);
+    return persistSubmitCtx(store, deps, claim, sessionId, {
+        body: screened && prepared.verify === undefined ? withheldBody(prepared.body, prepared.spec.model) : prepared.body,
+        memoryScope: prepared.auth?.memoryScope,
+        ...(screened || prepared.bodyFromScreenedCtx === true ? { promptScreened: true } : {}),
+        writerVersion: serviceVersion(),
+    });
+}
 //# sourceMappingURL=submit-ctx.js.map

package/dist/http/wire-types.d.ts

@@ -172,9 +172,14 @@ export interface TaskRequestBody {
      *  `outputSchema` (core ignores it there). */
     outputRetries?: number;
     /** Within-task compaction tuning (core [ref] `TaskSpec.compaction`). ⚠️ ONLY `clampTolerance` is a caller
-     *  knob — the rest of core's compaction object is an OPERATOR axis and is deliberately not on the wire, so this
-     *  type is narrower than core's field on purpose. `boot/resolve-spec.ts` accepts a finite number in [0,1] and
-     *  omits the whole `compaction` key otherwise. Pairs with `compactionModel` (which gear compacts). */
+     *  knob HERE — the rest of core's compaction object is an OPERATOR axis and is deliberately not on the wire, so this
+     *  type is narrower than core's field on purpose. `spec-fields.ts` `compactionSpecFragment` accepts a finite number
+     *  in [0,1] and omits the whole `compaction` key otherwise. Pairs with `compactionModel` (which gear compacts).
+     *  The other caller-owned member of core's `compaction`, the automatic-compaction seat `autoCompact`, rides the CC
+     *  settings key `settings.autoCompactEnabled` (boolean; 7.146.0, capability bit `taskSettings.autoCompactEnabled`) —
+     *  ONE seat per fact: it is deliberately NOT repeated here (`compaction.autoCompact` in the body is not read). Both
+     *  members are minted into the one `TaskSpec.compaction` object by the same mapper. The manual seat `manualCompact`
+     *  (the pass `POST /v1/runs/:id/compact` asks for) is not caller-writable: it takes the deployment's / engine's default. */
     compaction?: {
         clampTolerance?: number;
     };

package/dist/json-body-limit.d.ts

@@ -0,0 +1,8 @@
+/**
+ * 一切 JSON 请求体的字节上限 —— `readJson` 边读边计,越过即 413 `request.payload_too_large`(一条一直都在的门,`http/request-guards.ts`)。
+ *
+ * 住叶子(零依赖)而不是守门族里:依它定帽的面要读同一个数 —— 收编批量导入的「每个会话信封最多多少字节」只有落在它之下才可达
+ * (一个越过它的信封根本进不了门,把旋钮设到那里就是一只永远够不着的帽),配置的上帽从这里算(`adoption/import-limits.ts`)。
+ */
+export declare const MAX_JSON_BODY_BYTES: number;
+//# sourceMappingURL=json-body-limit.d.ts.map

package/dist/json-body-limit.js

@@ -0,0 +1,2 @@
+export const MAX_JSON_BODY_BYTES = 8 * 1024 * 1024;
+//# sourceMappingURL=json-body-limit.js.map

package/dist/leader/diffout.d.ts

@@ -45,7 +45,7 @@ export type PullDiffResult = {
  * 而它**本就已经** `import { safeRev } from "./diffout.js"` —— 依赖边在,共享零成本。两份手抄的后果不是
  * 「多写一行」,是**单边改值后上行/pull 两腿对同一个 diff 的过/拒判定分家**:同一份补丁在一条腿上过、
  * 另一条腿上被截断,而两处都「按自己的常量」正确工作,没有任何一处会报错。
- * (同族先例:`checkpoint-store-sql.ts` 的 `export const TERMINAL_GRACE_MS`。)
+ * (同族先例:`checkpoint-store-face.ts` 的 `export const TERMINAL_GRACE_MS`。)
  */
 export declare const DEFAULT_MAX_DIFF_BYTES: number;
 export declare function safeRev(rev: string): boolean;

package/dist/local-data-root.d.ts

@@ -7,8 +7,8 @@
  * `scripts/drain-check-local.mjs`(经 `dist/local-data-root.js` 取同一只函数,缺省数据根不再自抄一份链:抄本只对了一半,
  * 设了 `AGENT_DATA_DIR` 的部署不带参数跑脚本会读到另一个目录并报「干净」)。纯叶、零反向依赖 ⇒ 脚本引它不会把整个服务装载起来。
  *
- * ⚠️ 与**配置根**(`configLocalRoot`:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`,不吃 `LOCAL_DATA_ROOT`)不是同一条链 —— 两根分家的那一形由
- * boot 期的 `local_roots_split` 告警说出来,本函数不改那条解析。
+ * ⚠️ 与**配置根**(`configLocalRoot`:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`,不吃 `LOCAL_DATA_ROOT`)不是同一条链 —— 两根一声不响分家的那一形
+ * (没给 `CONFIG_LOCAL_DIR`)由 boot 期的 `local_roots_split` 告警说出来,本函数不改那条解析。
  */
 export declare function resolveLocalDataRoot(env: Readonly<Record<string, string | undefined>>, home: string): string;
 //# sourceMappingURL=local-data-root.d.ts.map

package/dist/memory-operator-faces.d.ts

@@ -58,7 +58,7 @@
  * core 自己响亮拒(`memory.erasure_evidence_unavailable`),那是**运行期**的诚实拒,与「换部署形态才行」
  * 不是一回事(附录 A 两条分列)。
  */
-import { type EntryProvenanceAccount, type MemoryBackend, type MemoryEntryOrigin, type MemoryErasureAttestation, type OriginClearanceRow, type DeploymentSessionMemoryStatus, type SessionCaptureRecordStore } from "@sema-agent/core";
+import { type EntryProvenanceAccount, type MemoryBackend, type MemoryEntryOrigin, type MemoryErasureAttestation, type OriginClearanceRow, type DeploymentSessionMemoryStatus, type SessionCaptureRecordStore, type SessionMemoryStatus } from "@sema-agent/core";
 import { type MemoryScopeStores } from "./memory-scope-stores.js";
 import type { SessionCaptureRecordSource } from "./plugins/store-backend.js";
 /**
@@ -249,11 +249,16 @@ export interface SessionMemoryStatusFace {
 /** 一份会话记忆状态的读法(见 {@link SessionMemoryStatusFace.readingAt})。 */
 export interface SessionMemoryStatusReading {
     readonly key: string;
-    /** 引擎的答案,原样(引擎不抛:读不出的源 = 缺席的键)。路由只投 wire 的五键。 */
+    /** 引擎的答案,原样(引擎不抛:读不出的源 = 缺席的键)。路由只投 wire 的键。 */
     status: (sessionId: string) => Promise<SessionMemoryView>;
 }
-/** 状态面上 wire 的五键所在的那一份:部署对象答案去掉逐店明细 `planes`(逐店明细不上 wire,见 `core-keyset-guard.ts`)。 */
-export type SessionMemoryView = Omit<DeploymentSessionMemoryStatus, "planes">;
+/**
+ * 状态面上 wire 的键所在的那一份,**引擎的答案原样**:带层座 ⇒ 那只店的引擎答案(`SessionMemoryStatus`:五键 + `writeHome`,`writeHome` 是店绑定的键);
+ * 不带层座 ⇒ 部署对象的答案(`DeploymentSessionMemoryStatus`:引擎折好的五键 + 引擎择好的会话级 `writeHome` + 逐店明细 `planes`,每行是一只店原样的 `SessionMemoryStatus`)。
+ * 会话级 `writeHome` 由引擎在店之间择一(点名家的店里较新的那只的家,原样;任一店读不出 / 同刻 / 无店点名 ⇒ 缺席);本服务不折、不择一、不去重,
+ * 路由把顶层 `writeHome` 与每行的 `plane` / `writeHome` 原样投出(见 `core-keyset-guard.ts` ⑩e)。
+ */
+export type SessionMemoryView = SessionMemoryStatus & Partial<Pick<DeploymentSessionMemoryStatus, "planes">>;
 /**
  * [ref] seam①([ref] §S-7,core 7.0.2 [ref] 件1)—— `GET /v1/sessions/:id/memory-status` 的引擎面。
  * 命名照 CLAUDE.md 工厂律:返回带行为的活对象 ⇒ `create*`。

package/dist/memory-scope-stores.d.ts

@@ -2,10 +2,11 @@
  * 记忆作用域店 —— 本部署的记忆在本宿主的**唯一持有者**:「一层住在哪只店」与「本部署有哪些店」都只在这里答。
  *
  * ## 规则(一条)
- * 一层(scope)的平面只有引擎的纯分类函数答(`scopePlanesOf`,契约 = 本服务铸 spec 时盖在会话上的同一只判据 {@link memoryScopeContractOf});
+ * 一层(scope)的平面只有引擎答(`memoryScopePlaneOf`,契约 = 本服务铸 spec 时盖在会话上的同一只判据 {@link memoryScopeContractOf});
  * 一层的店 = 它那只平面的店(项目平面 = 部署的店;目录钉住的部署上个人平面是个人挂载上的另一只店,引擎的 `resolveMemoryScopeStore` 开它)。
- * **本部署有哪些店**只有引擎的部署对象答(`createMemoryDeployment(…).stores()`):项目店,再加上个人挂载**在盘上**的那只个人店 ——
- * 盘的集合,不是配置点名的层推出来的集合(配置只决定会话往哪写;换了 `MEMORY_SCOPE` 之后个人挂载上留下的那只店照样在集合里)。
+ * **本部署有哪些店**只有引擎的部署对象答(`createMemoryDeployment(…).stores()`,契约 `memory.deployment.store_set`):项目店,再加上个人挂载上
+ * **存有记录**的那只个人店 —— 盘的集合,不是配置点名的层推出来的集合(配置只决定会话往哪写;换了 `MEMORY_SCOPE` 之后个人挂载上写过的那只店照样在集合里),
+ * 也不是「开过」的集合(打开 / 读 / 被拒的请求只留下引擎具名的工件,不让店进集;每次从盘上读,每只部署对象答同一个集合)。
  * 本服务在会话之外读写某一层的每一条腿(同步执行器、项目层折叠、中心侧导出 / 同步、bundle 导出导入、合规抹除 / 出处、外源标记、会话记忆状态、整理)
  * 一律问**本对象**。本对象就是起服装配出来的那只记忆引擎对象(`boot/stores.ts` 的 `memoryEngine`、`run-local.ts` 的同名量):它的 `backend` / `root`
  * 正是交给 Runner 的两件事实(`RunnerDeps.memoryBackend` / `RunnerDeps.memoryEngineDir`)—— 宿主腿与会话对同一层答同一只店。每进程一只,所有腿共用。
@@ -18,7 +19,7 @@
  *
  * ## 请求的店({@link memoryStoreForRequest})
  * 点名层的动词按点名的层取店;点名的几层不在同一只店 ⇒ 响亮拒(一次请求只落一只店)。不点名层的条目 id / 店级账本动词答在**本部署唯一的那只店**上;
- * 部署有两只店(盘上有个人店)⇒ 不猜,响亮拒并指路「在请求里点名层」。没有部署对象的部署(SQL 记忆孪生,不钉目录 ⇒ 两个平面同一只店)恒是一只店。
+ * 部署有两只店(个人挂载上的店存有记录)⇒ 不猜,响亮拒并指路「在请求里点名层」。没有部署对象的部署(SQL 记忆孪生,不钉目录 ⇒ 两个平面同一只店)恒是一只店。
  */
 import { type MemoryBackend, type MemoryDeployment } from "@sema-agent/core";
 import type { SessionCaptureRecordSource } from "./plugins/store-backend.js";
@@ -29,7 +30,7 @@ export interface MemoryScopeStores {
     readonly root: string;
     /** capture opt-out 记录源(起服取一次的那一只;缺席 ⇒ 引擎各自的文件缺省)。本部署每一只记忆引擎 —— 部署对象、各操作面按店构造的引擎 —— 都只读这一格。 */
     readonly captureRecords: SessionCaptureRecordSource | undefined;
-    /** 层 `layer` 的平面(引擎的规范化 + 纯分类函数,与引擎的店解析同一读法;零建店、零读盘)。引擎读不出的层键 ⇒ 抛引擎的 `config.memory_scope_key`,原样。 */
+    /** 层 `layer` 的平面(引擎的 `memoryScopePlaneOf`,与引擎的店解析同一只;零建店、零读盘)。引擎读不出的层键 ⇒ 抛引擎的 `config.memory_scope_key`,原样。 */
     planeOf(layer: string): "project" | "personal";
     /** 层 `layer` 住的那只店(先判平面、每个平面一只实例)。读不出的层键 ⇒ 同 {@link MemoryScopeStores.planeOf}。 */
     storeOf(layer: string): MemoryBackend;
@@ -37,7 +38,8 @@ export interface MemoryScopeStores {
     deployment(): MemoryDeployment | undefined;
 }
 /**
- * 控制面归属判据 —— 记忆操作面(合规 / 外源标记 / 会话记忆状态 / consolidation 阀门的 D1 拒启门)与部署对象共用的**同一只**谓词:
+ * 控制面归属判据 —— 记忆操作面(合规 / 外源标记 / 会话记忆状态)与部署对象共用的**同一只**谓词(这些部署面问「后端发不发布控制面」;
+ * 整理阀门问的是另一件事 —— 整理状态随不随后端走 —— 只问引擎的 `memoryGovernanceDurability`,见 `boot/memory-consolidation.ts`):
  * backend 的面上带**非空** `controlPlaneRoot` 才算归属在案。空串与缺席同判「不归属」:core 对空串会 truthy-回退到本副本盘上派生控制面
  * (engine 构造里的 `backendControl ? … : derive(…)`),对无状态多副本部署这正是 D1 要拒的那台机器(折叠账随 pod 一起死)。
  */
@@ -63,7 +65,7 @@ export declare class MemoryLayerRefusal extends Error {
 /**
  * 一次请求的记忆店。`layers` = 请求点名的层(空 = 没点名):
  *  · 点名 ⇒ 它们共住的那一只店;分住两只 ⇒ 拒(一次请求只落一只店,按店拆成几次请求)。
- *  · 没点名 ⇒ 本部署唯一的那只店(= 部署的店);部署有两只店(盘上有个人店,{@link MemoryScopeStores.deployment})⇒ 拒,指路在请求里点名层。
+ *  · 没点名 ⇒ 本部署唯一的那只店(= 部署的店);部署有两只店(个人挂载上的店存有记录,{@link MemoryScopeStores.deployment})⇒ 拒,指路在请求里点名层。
  * `seat` = 这个动词点名层的那一处(拒句里指路用,如 `` `scope` ``;缺省 = 层座 `scope`)。
  * 拒一律 {@link MemoryLayerRefusal}(读不出的层键同码,引擎原句随句)。
  */

package/dist/memory-scope-stores.js

@@ -1,4 +1,4 @@
-import { createMemoryDeployment, normalizeMemorySpec, resolveMemoryScopeStore, scopePlanesOf } from "@sema-agent/core";
+import { createMemoryDeployment, memoryScopePlaneOf, resolveMemoryScopeStore } from "@sema-agent/core";
 import { memoryScopeContractOf } from "./memory-scope.js";
 export function backendOwnsControlPlane(backend) {
     return controlPlaneRootOf(backend) !== undefined;
@@ -7,6 +7,7 @@ export function controlPlaneRootOf(backend) {
     const root = backend?.controlPlaneRoot;
     return typeof root === "string" && root !== "" ? root : undefined;
 }
+const PLANE_FACE = "memoryScopeStores.planeOf";
 export function createMemoryScopeStores(input) {
     let personal;
     const resolve = (layer) => resolveMemoryScopeStore({
@@ -16,19 +17,7 @@ export function createMemoryScopeStores(input) {
         memoryEngineDir: input.root,
         ...(input.onIncident !== undefined ? { onIncident: input.onIncident } : {}),
     });
-    const planeOf = (layer) => {
-        const contract = memoryScopeContractOf([layer]);
-        let spec;
-        try {
-            spec = normalizeMemorySpec({ scopes: [layer], writeScope: layer, ...(contract !== undefined ? { scopeContract: contract } : {}) });
-        }
-        catch {
-            spec = undefined;
-        }
-        if (spec === undefined || spec.writeScope === null)
-            return resolve(layer).plane;
-        return scopePlanesOf(spec.scopes, spec.writeScope, spec.scopeContract)?.writePlane ?? "project";
-    };
+    const planeOf = (layer) => memoryScopePlaneOf(PLANE_FACE, layer, memoryScopeContractOf([layer]));
     let deployment;
     return {
         backend: input.backend,

package/dist/memory-scope.d.ts

@@ -173,6 +173,42 @@ export declare function memoryEngineRootFor(config: Pick<ServiceConfig, "memoryE
  *  所以它的根必须走这条链而不是 `memoryEngineRootFor` 的分派(codex 修复验证轮 [medium]:分派会把 run-local 的
  *  记忆搬到 `<localDataRoot>/memory-work`,存量记忆与控制面升级后隐形)。 */
 export declare function fileMemoryEngineRoot(config: Pick<ServiceConfig, "memoryEngineDir">, fallbackRoot?: string): string;
+/**
+ * 一条路径的**规范形**(给 {@link judgeMemoryRootOutsideDataRoot} 的 `canonical` 座用的生产实现):
+ *  · 既存的绝对路径 ⇒ **原样**交给 `realpath`(`.native`:大小写不敏感的文件系统上返回盘上的拼写;符号链接、macOS 的 `/var` → `/private/var` 在这一步展平)。
+ *    不先在字串上折 `..`:操作系统在展开符号链接**之后**才折 `..`,`/link/..` 的真身是链接目标的父目录,字串折叠会把它读成 `/`;
+ *  · 其余(尚不存在 / 相对)⇒ 绝对化并折叠 → 取**最深既存祖先**的 `realpath` → 接回尚不存在的尾巴(尾巴只做字串规范化)。
+ *
+ * 为什么按「最深既存祖先」而不是直接 `realpath(p)`:boot 期记忆根常常还没建出来(新数据根),`realpath` 对不存在的路径抛 ENOENT,
+ * 而数据根那一侧已经存在、会被展平 —— 两侧拼写空间不一样,同一个目录会被读成「不在其下」。祖先用 `existsSync` 找(它对 ENOENT / ENOTDIR / EACCES / ELOOP
+ * 一律答 `false`,不抛),所以走到的那一级一定 stat 得动;`realpath` 仍可能在「探完到取值之间目录被挪走 / 搜索权限被收」的竞态里抛 ——
+ * 不在本函数里吞(吞了就是一条无声的降级臂),由 boot 调用点接住并响亮报一行(`memory_engine_dir_check_unavailable`),起服照常。
+ *
+ * 取舍:尾巴(不存在的那几段)只比规范化字串,**不折大小写**,`..` 也按字串折:两个只差大小写、且都还不存在的拼写在大小写不敏感的盘上会被读成两处 ——
+ * 方向是多报一条 warn(这条判据的失败方向),不会漏报。
+ */
+export declare function canonicalPathOf(p: string): string;
+/** {@link judgeMemoryRootOutsideDataRoot} 的读数:记忆引擎的根落在本机数据根**之外**。三键即 boot 日志行的字段(`hint` 是一句带两条真路径的人话)。 */
+export type MemoryRootOutsideDataRoot = {
+    readonly root: string;
+    readonly dataRoot: string;
+    readonly hint: string;
+};
+/**
+ * 【判官】file 形记忆引擎的**已解析根**是不是落在本机数据根(`config.localDataRoot`)**之外** —— 是 ⇒ 回两条真路径(boot 打一条 warn),不是 ⇒ `undefined`。
+ *
+ * 判据只有这一条**路径包含**:`path.relative(数据根, 记忆根)` 不以 `..` 段开头、也不是绝对路径(跨盘符)⇒ 在其下(相等也算在其下)。**与 env 是否显式无关**:
+ * `MEMORY_ENGINE_DIR` 缺席不是判据(此前判据是「`LOCAL_DATA_ROOT` 在 ∧ `MEMORY_ENGINE_DIR` 缺席」,于是 `AGENT_DATA_DIR` 已把两者放在同一处时,
+ * 「正在共享全机默认库」一句不真,而显式 `MEMORY_ENGINE_DIR` 指到数据根之外的真分家反而不报)。数据根缺席 ⇒ 无从比较,不报。
+ *
+ * 纯函数:不读 env、不读盘 —— 规范化走 `canonical` 座(缺省 `path.resolve`,字串规范形;boot 递 {@link canonicalPathOf} 取符号链接 / 大小写展平后的形)。
+ * 读数里的两条路径是**调用方给的原样拼写**(运维认得出来的那两条),不是规范形。
+ */
+export declare function judgeMemoryRootOutsideDataRoot(a: {
+    readonly memoryRoot: string;
+    readonly dataRoot: string | undefined;
+    readonly canonical?: (p: string) => string;
+}): MemoryRootOutsideDataRoot | undefined;
 /** 本部署 file 记忆引擎的**平面三坐标**(根 / 记忆目录 / 控制面目录)—— {@link fileMemoryPlaneFor} 一次算齐。 */
 export interface FileMemoryPlane {
     readonly root: string;