@sema-agent/server 7.145.0 → 7.147.0

package/dist/hooks/hook-source.d.ts

@@ -1,6 +1,6 @@
 /**
  * 请求面**来源**闭集 —— 一个 hook 组(`settings.hooks[event][i].source`)是谁写的。词表与「托管与否」的映射**只在这里**;
- * hooks 执行器按它分车道(`hook-runner.ts` 的三相),将来请求面别处的来源键(MCP 服务器条目)读同一张词表,不另立第二份。
+ * hooks 执行器按它分相、分车道(`hook-runner.ts` 的三相 / 两张注册),将来请求面别处的来源键(MCP 服务器条目)读同一张词表,不另立第二份。
  *
  * 词表(闭集;集外词 = 形错,受理面整份拒,fail-closed;缺席 = 非托管):
  *  · `managedPolicy`          —— 组织策略(托管设置)。**托管**,且是终判相。
@@ -28,7 +28,7 @@ type HookSourcePrefix = keyof typeof HOOK_SOURCE_PREFIX_PHASE;
 export type HookGroupSource = HookSourceWord | `${HookSourcePrefix}:${string}`;
 /**
  * 执行相 —— **固定次序**就是这张数组的次序:非托管 → 托管插件 → 托管策略(终判)。后一相在前一相的最终输入上跑;结果按信任序(倒序)读。
- * 托管 = 后两相;非托管与托管各一只事件墙钟(见 `hook-runner.ts`)。
+ * 托管 = 后两相;相按 {@link hookLaneOf} 归两条车道(每道一张引擎注册,见 `hook-runner.ts`)。
  */
 export declare const HOOK_PHASES: readonly ["unmanaged", "managedPlugin", "managedPolicy"];
 export type HookPhase = (typeof HOOK_PHASES)[number];
@@ -36,6 +36,18 @@ export type HookPhase = (typeof HOOK_PHASES)[number];
 export declare const MAX_HOOK_SOURCE_NAME_CHARS = 128;
 /** 受理面的读法:合形 ⇒ 来源;否则 `undefined`(调用方铸拒)。只认 own 词(`Object.hasOwn`:原型上的名字不是词表成员)。 */
 export declare function readHookGroupSource(raw: unknown): HookGroupSource | undefined;
+/**
+ * 车道 —— **一条车道 = 一张引擎注册**(`hook-runner.ts` 的 `SETTINGS_HOOKS_REGISTRATIONS`):非托管相一道;托管两相(插件相 + 策略相)同一道。
+ * 每条车道自带引擎的 handler 预算与本服务的事件墙钟 / LLM 条数 / 账本,两道之间不共用任何一只钟。相 → 道只在这张表(`satisfies`:加一个相不写道 = 编译红)。
+ */
+declare const HOOK_PHASE_LANE: {
+    readonly unmanaged: "unmanaged";
+    readonly managedPlugin: "managed";
+    readonly managedPolicy: "managed";
+};
+export type HookLane = (typeof HOOK_PHASE_LANE)[HookPhase];
+/** 来源 → 车道(经相;缺席 ⇒ 非托管)。帧上的 `lane` 位、车道注册的分组都读这一只。 */
+export declare function hookLaneOf(source: HookGroupSource | undefined): HookLane;
 /** 来源 → 相。缺席 ⇒ 非托管(老包不带 `source`:行为与此前逐字同)。 */
 export declare function hookPhaseOf(source: HookGroupSource | undefined): HookPhase;
 /** 拒句里的词表(由两张表派生,不另写一份)。 */

package/dist/hooks/hook-source.js

@@ -27,6 +27,14 @@ export function readHookGroupSource(raw) {
         return undefined;
     return raw;
 }
+const HOOK_PHASE_LANE = {
+    unmanaged: "unmanaged",
+    managedPlugin: "managed",
+    managedPolicy: "managed",
+};
+export function hookLaneOf(source) {
+    return HOOK_PHASE_LANE[hookPhaseOf(source)];
+}
 export function hookPhaseOf(source) {
     if (source === undefined)
         return "unmanaged";

package/dist/http/active-run-conflict.d.ts

@@ -16,7 +16,7 @@
 import { type GovernancePosture } from "../runtime-governance.js";
 import type { ShellGateDoctrine } from "@sema-agent/core";
 import { type RunRecord } from "../plugins/store-contracts.js";
-import { type PendingRowBinding } from "../plugins/checkpoint-store-sql.js";
+import { type PendingRowBinding } from "../plugins/checkpoint-store-face.js";
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run \u2014 POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
 /**

package/dist/http/active-run-conflict.js

@@ -1,6 +1,6 @@
 import { governanceOriginOf } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
-import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
+import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-face.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { refusalBody } from "./refusal-body.js";
 import { trustedCheckpointId } from "../checkpoint-identity.js";

package/dist/http/admission.js

@@ -2,7 +2,8 @@ import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isT
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, parseTaskSettings, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { serverCredentialValueSources } from "../server-secret-env.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
@@ -284,6 +285,11 @@ export function createAdmission(ctx) {
                         return null;
                     }
                 }
+                const credentialIssue = settingsEnvCredentialIssue(readSettingsEnv(st).reaching, serverCredentialValueSources(deps.config.modelApiKeyEnv));
+                if (credentialIssue !== null) {
+                    sendError(res, 400, "request.env_credential_refused", credentialIssue.message, { ...credentialIssue.fields });
+                    return null;
+                }
             }
             if (st.ultracode !== undefined && typeof st.ultracode !== "boolean") {
                 sendError(res, 400, "request.field_invalid", "settings.ultracode must be a boolean");
@@ -297,6 +303,10 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", "settings.skillListingMaxDescChars must be a positive integer");
                 return null;
             }
+            if (st.autoCompactEnabled !== undefined && !autoCompactEnabledOk(st.autoCompactEnabled)) {
+                sendError(res, 400, "request.field_invalid", "settings.autoCompactEnabled must be a boolean");
+                return null;
+            }
             if (st.hooks !== undefined && st.hooks !== null) {
                 const hooksParsed = parseHooksConfig(st.hooks);
                 if (!hooksParsed.config) {

package/dist/http/approval-sweeps.d.ts

@@ -6,16 +6,13 @@
  * 不是请求流水线。`createWallClockJumpGuard` 建的 `denySweepClockGuard` 是 ① 的私有件,随它同居。
  * ctx 字段 3 只(`deps` / `resumeCheckpoint` / `mayDiscloseRowError`),机器算(closure-free-vars)与手抄一致。
  */
-import { type ParkedAskRedeemRequest } from "../tool-approval.js";
+import { type ParkedAskRedeemRequest, type ParkedAskRedeemResult } from "../tool-approval.js";
 import type { createResumeLegs } from "./resume-legs.js";
 import type { FlatServiceDeps } from "./server.js";
 export declare function createApprovalSweeps(ctx: {
     deps: FlatServiceDeps;
 } & Pick<ReturnType<typeof createResumeLegs>, "resumeCheckpoint" | "mayDiscloseRowError">): {
     denyExpiredApprovals: (now: number) => Promise<void>;
-    redeemParkedAsk: (req: ParkedAskRedeemRequest) => Promise<{
-        status: number;
-        body: Record<string, unknown>;
-    }>;
+    redeemParkedAsk: (req: ParkedAskRedeemRequest) => Promise<ParkedAskRedeemResult>;
 };
 //# sourceMappingURL=approval-sweeps.d.ts.map

package/dist/http/approval-sweeps.js

@@ -231,8 +231,9 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
-        return { status: out.status, body: out.body };
+        const remember = req.remember === "session" ? { grantedBy: req.principal ?? null, laneCannotRecord: "decide_once" } : undefined;
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, remember, true, { principal: req.principal, explicitOperator: false });
+        return { status: out.status, body: out.body, ...(remember !== undefined ? { rememberApplied: out.rememberApplied === true } : {}) };
     }
     return { denyExpiredApprovals, redeemParkedAsk };
 }

package/dist/http/checkpoint-ctx.d.ts

@@ -1,27 +1,23 @@
 /**
- * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及持久化体里 `settings.permissions.allow` 的**读法记号**。
+ * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及「这条停驻行的持久化体在本版上能否重放」的四问与它们的答复。
  *
- * ## 病(两代,同一形)
- * `settings.permissions.allow` 的读法换过两次:≤7.114.0 是「名单」(名单外的工具一律拒);7.115.0–7.116.x 是「表态」(只回答没人表态的那一问,
- * 写 / shell 这类普通问照问);7.117.0 起整份交给引擎的 allow 层(`TaskSpec.allowedTools`:表里的调用免问 —— 普通问与没人表态两类都清,内容形也收)。
- * 续跑家族重建 spec 时把**持久化的提交体**原样重放进 `resolveSpec`(`resume-legs.ts` 的 `resolveResumeSpec`)—— 一条在旧读法下停驻、体里带非空 `allow`
- * 的行,升级后续跑就被按新读法读,每一次换代都是放宽方向(名单 → 表态:名单外的工具放开;表态 → allow 层:普通问不再问)。持久面上的静默语义翻转。
+ * ## allow 读法问(常设规则,按行的写者版本;不是迁移、不读记号)
+ * `settings.permissions.allow` 的读法换过两次:≤7.114.x 是「名单」(名单外的工具一律拒);7.115.0–7.116.x 是「表态」(只回答没人表态的那一问);
+ * 7.117.0 起整份交给引擎的 allow 层(表里的调用免问)。续跑家族把**持久化的提交体**原样重放进 `resolveSpec` —— 7.117.0 之前写下、体里带非空 `allow` 的行
+ * 按今天的读法重放 = 静默放宽(名单外的工具放开 / 普通问不再问)。⇒ 规则一句:**体里 `allow` 在生效(非空数组,{@link bodyCarriesAllowList})而行的写者版本
+ * 证不出 ≥ {@link ALLOW_LAYER_READING_SINCE}(`CheckpointCtx.writerVersion` 缺席、读不出,或早于它)⇒ 拒**({@link allowListReadingRefusal},409 `checkpoint.unsupported_version`,行字节不动)。
+ *  · 证据只有一个源:行上的写者版本(`route-ctx.ts` `CheckpointCtx.writerVersion`;7.124.0 起每一次写都带)。7.117.0–7.145.x 写过的 allow 读法记号
+ *    不是本问的读者 —— 记号写点已删(一次性迁移 M7 退役)、键在存量行上无人读;7.117.0–7.123.x 写下、带非空 `allow` 的行没有写者版本,同样拒(证不出;fail-closed)。
+ *  · 写者版本因此是本问的拒因,而它的写点必须守住同一条律:**盖写者版本的写只发生在本进程按当前读法读过这份体之后** —— 新提交(受理门按当前读法读)、
+ *    或已经过了本判据的续跑腿写回(`resume-legs.ts` `commitResumeCtx`、在飞 run 的切档写回)。在判据之前盖版本 = 把一条旧行洗成新行。
+ *  · 没有期限:日历窗关不证明旧行不在(留存拉长、备份恢复、`APPROVAL_TERMINAL_BACKSTOP_MS` 调长),所以这一问常设,不进一次性迁移登记表。
  *
- * ## 规则(一条;持久数据的「响亮拒 + 一次性迁移」,零双读)
- * 续跑重放持久化体之前问一句:**体里的 `allow` 在生效(非空数组)而本行的读法记号不是当前这一个词 ⇒ 拒**。
- * 行留停驻、字节不动(拒发生在认领之前,run 行、卡、ctx 一个字节都不写);出路 = 作为新任务重提,这条任务若还停驻着先取消(`task_done` 唤醒停驻与 workflow 宿主那条腿没有可取消的 run)。
- * **没有**「按旧读法继续读」的臂(那是第二种读法),也**没有**「按新读法静默续跑」的臂(那是对一条已提交任务的静默放宽)。
- *  · 记号 = 当前写点在体里带非空 `allow` 时写在 ctx 上的 `permissionsAllowReading`,闭集只有当前读法一个词({@link PERMISSIONS_ALLOW_READINGS})。
- *    写点 = 每一次**新的**持久化写({@link buildCheckpointCtx} 是它们的唯一构造口);续跑腿的写回传的是读进来的那只 ctx(或其展开),记号随行,不重新判。
- *  · 拒句按「这行是在哪种读法下写的」分两句({@link ALLOW_LIST_READING_ERAS} 穷举):无记号(或记号认不得)= 名单时代;`"statement"` = 表态时代。
- *  · 体里没有 `allow`(或空数组 —— 三代都把空数组读成「没有」)的行不写记号、不受本规则影响。
- *
- * ## 第二问(7.117.0 起,引擎 7.42 逐字读规则条目;7.131.0 起覆盖全部工具名清单):工具名清单读成空的存量体
- * 同一面上的第二个「新提交会被拒、存量体重放不能放过」:提交体里工具名清单 —— 技能(顶层 / 子代)的 `disallowedTools`(7.117.0:`"Bash "` 这类 7.41 去白后有效、
+ * ## 工具名清单问(7.117.0 起,引擎 7.42 逐字读规则条目;7.131.0 起覆盖全部工具名清单):工具名清单读成空的存量体
+ * 「新提交会被拒、存量体重放不能放过」:提交体里工具名清单 —— 技能(顶层 / 子代)的 `disallowedTools`(7.117.0:`"Bash "` 这类 7.41 去白后有效、
  * 7.42 什么也不拒的条目)、子代定义的 `denyTools` / `allowTools`、顶层 `excludeTools` / `allowTools`(7.131.0:限制侧近似名 / 大小写孪生、退役名、文法读不出,放行侧只近似名)—— 有引擎读成空的条目 ⇒ 提交 400(`resolveSpec`,拒点);
  * 存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`(`blockedBy` = 该层的拒码)。判据函数 = `rule-entry-list.ts` `inertToolListEntryOf`。
  *
- * ## 第三问(7.122.0):体里模式词的读法记号
+ * ## 模式词问(7.122.0):体里模式词的读法记号
  * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
  * 治理层不再在每一次续跑重钳。更早版本写下的行体里是**请求的原词**,运维的 plan 由治理层每段重新折上(7.121.x 及以前:只读手 + 写面 roots)。
  * 那种行在本版上按体里的原词重放 = 静默放宽(`acceptEdits` / `bypassPermissions` 原词直接生效;无词 ⇒ 引擎读 checkpoint 记下的词)。
@@ -31,62 +27,63 @@
  * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
  * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
  *
- * ## 第四问(7.137.0):体里的退役请求键
+ * ## 退役请求键问(7.137.0):体里的退役请求键
  * 请求键退役之后({@link RETIRED_REQUEST_KEYS}:今天两只 —— `promptProfile` 换成布尔 `promptLean`,`rewindFiles` 是退役的旧文件还原拼法),新提交带它在键闭集门 400。存体里的旧键怎么办,闭集里每个键有
  * **一个处置格**,住在哪张表就是哪个处置:**拒**表({@link REPLAY_REFUSED_RETIRED_KEYS},今天 `promptProfile`)是塑形过任务本身的键,**惰性**表({@link INERT_RETIRED_KEYS},今天 `rewindFiles`)是一次性键。
  *  · 拒表的键:存体里的旧键由一次性迁移在起服时原地改写
  *    (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
- *    旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同前两只读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
+ *    旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同模式词读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
  *    也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
  *  · 惰性表的键:一次性键 —— 只在提交的那一拍起作用(文件还原的一次性动作),续跑重建里没有任何一条腿读它,存体里留着它不要求任何事、不改变重放要做的事 ⇒ 不拒、不改写、续跑照常。
  *    这不是上面那条「旧键无人读、静默续跑」的臂:那一臂的前提是读不出旧键会让续跑做一件提交时没要的事,惰性格的判据恰是「没有这个键,重放做的事一字不差」。
  * 加一个退役键必须选格 —— 进拒表 ⇒ {@link retiredRequestKeyRefusal} 的 switch 与 `stored-body-replay.ts` 的迁移 id 表编译红,直到给它一句拒句和改写它的迁移;进惰性表 ⇒ 改动里要写明它为什么是一次性的。
  *
  * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(前两问的判据在本模块、第三问读请求设置
- * 与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问(加 `settings.env` 凭据那一臂,规则在 `stored-request-env-credentials-m38.ts`)合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(allow 读法问的谓词在本模块;工具名清单问另读请求设置的解析层与
+ * 执行车道 / 配置根两个属主、模式词问读请求设置与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
- * allow 记号,工具名清单那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
+ * 一问,工具名清单那一问漏在外面,卡铸出来了、`/wake` 恒 409([ref] 合并复审两腿同报)。
  *
  * ## 凭据位密封(7.134.0;常设规则,不是迁移)
  * 体里请求面凭据位上的值在 ctx 里只以封签存在 —— 写:{@link buildCheckpointCtx} / {@link sealCheckpointCtx} 一只封口;读:续跑上下文读口里一只开口
  * {@link openCheckpointCtx};开不开 ⇒ `409 conflict.checkpoint_ctx_unsealable`。规则全文在本文件末段「凭据位密封」的头注。
- *
- * ## 何时删(一次性迁移,不是长期双读)
- * 本判据、拒臂、记号写点与 `CheckpointCtx.permissionsAllowReading` 一起删,删除条件与窗登记在 `plugins/one-time-migrations.ts` 的
- * 一次性迁移登记表(本条那一行):所有旧读法下停驻的行都已结束或被收割(停驻行的终局 = 落盘起 `TERMINAL_BACKSTOP_MS`,见
- * `plugins/checkpoint-store-sql.ts`)之后的那个版本。删的时候记号的读者一起删。
  */
 import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { InertToolListEntry } from "../rule-entry-list.js";
 import { type Refusal } from "./refusal-body.js";
-/** 读法记号的闭集(一词 = 当前读法):这一行体里的 `settings.permissions.allow` 是按「交给引擎的 allow 层」写下、也该按它读的
- *  (与能力位 `settings.permissions.allowLayer` 同一个说法)。 */
-export declare const PERMISSIONS_ALLOW_READINGS: readonly ["allow_layer"];
-export type PermissionsAllowReading = (typeof PERMISSIONS_ALLOW_READINGS)[number];
-/** 体里模式词的读法记号闭集(一词 = 当前读法):这一行体的顶层 `permissionMode` 是这条 run 模式词**唯一的源**(提交入口盖过运维地板、`plan_review` 写回改它),
- *  续跑照它读、不再由治理层按段重钳。写点两个 = {@link buildCheckpointCtx}(每一次新的持久化写都写)与 {@link withPermissionModeRewritten}(`plan_review` 写回改词的那一拍写);
- *  **不改词**的续跑腿写回传原 ctx ⇒ 记号随行。 */
-export declare const PERMISSION_MODE_READINGS: readonly ["entry_word"];
-export type PermissionModeReading = (typeof PERMISSION_MODE_READINGS)[number];
-/** 被拒的行是在哪种读法下写的(闭集;拒句按它穷举):`list` = 无记号或记号认不得(≤7.114.0 的名单读法;认不得的记号不是任何一代的证据,
- *  按最早那一代说话);`statement` = 7.115.0–7.116.x 写下的表态读法。 */
-export declare const ALLOW_LIST_READING_ERAS: readonly ["list", "statement"];
-export type AllowListReadingEra = (typeof ALLOW_LIST_READING_ERAS)[number];
+/** allow 层读法从这一版起(7.117.0):此前的写者对 `settings.permissions.allow` 是另一种读法(≤7.114.x 名单 / 7.115.0–7.116.x 表态)。规则见顶注「allow 读法问」。 */
+export declare const ALLOW_LAYER_READING_SINCE = "7.117.0";
 /**
  * 体里的 `settings.permissions.allow` 是否**在生效**:非空数组(三代同一个「在」—— 空数组 = 没有)。
  * 入参是持久化的 JSON(可能来自任何旧版本),逐层判形,不信型面。
  */
 export declare function bodyCarriesAllowList(body: TaskRequestBody): boolean;
+/**
+ * 行的写者版本**证得出** ≥ {@link ALLOW_LAYER_READING_SINCE}:在场、读得出、三段数不小于它(三段相等时预发布算在它之前 —— semver 序,失效关闭方向)。
+ * 缺席 / 读不出(`"unknown"`、前导零、空标识段这类不合 SemVer 文法的串)/ 更早 ⇒ `false`。入参是持久化的 JSON,不信型面。
+ */
+export declare function writerReadsAllowLayer(writerVersion: unknown): boolean;
+/** allow 读法问(顶注):体里 `allow` 在生效而写者版本证不出 ≥ {@link ALLOW_LAYER_READING_SINCE} ⇒ `true`(拒)。 */
+export declare function allowListWriterUnproven(ctx: CheckpointCtx): boolean;
+/**
+ * allow 读法问的拒答复 —— 码 `checkpoint.unsupported_version`,409(卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带;
+ * 两版本键由 {@link storedBodyReplayAnswer} 按那一码的键律补)。拒在认领之前,没有 `taskId`。句子一句:写者证不出是哪种读法(早于 7.117.0,或没记下版本 —— 7.124.0 之前的写者都不记),
+ * 两种旧读法各是什么、照今天的读法续跑会放宽什么,出路(作为新任务重提,仍停驻的先取消)。
+ * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
+ */
+export declare function allowListReadingRefusal(): ResumeRefusalAnswer;
+/** 体里模式词的读法记号闭集(一词 = 当前读法):这一行体的顶层 `permissionMode` 是这条 run 模式词**唯一的源**(提交入口盖过运维地板、`plan_review` 写回改它),
+ *  续跑照它读、不再由治理层按段重钳。写点两个 = {@link buildCheckpointCtx}(每一次新的持久化写都写)与 {@link withPermissionModeRewritten}(`plan_review` 写回改词的那一拍写);
+ *  **不改词**的续跑腿写回传原 ctx ⇒ 记号随行。 */
+export declare const PERMISSION_MODE_READINGS: readonly ["entry_word"];
+export type PermissionModeReading = (typeof PERMISSION_MODE_READINGS)[number];
 /**
  * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 写记号的唯一口。
  *
- * 调用方是「本进程刚按当前读法读过这份体」的写点:fresh 提交(受理门按当前读法读过 `allow`),或已经过了续跑拒臂的重放腿
- * (`startFreshHostTurn` 把宿主的存量体交给 `POST /v1/runs` 同一条链 —— 它在那之前调过 `resolveResumeSpecOrBlocked`,没记号却带 `allow` 的体到不了这里)。
  * 续跑腿的**写回**不经本函数:**不改词**的写回传读进来的 ctx(记号随行,不重新判 —— 在写回口重新判会把一条没记号的旧行「洗」成新行);
  * **改词**的写回(只有 `plan_review` 的批准 / 编辑)经 {@link withPermissionModeRewritten}。两种写回落盘之前都过同一只封口 {@link sealCheckpointCtx}。
  *
@@ -103,27 +100,27 @@ export declare function buildCheckpointCtx(fields: {
  * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
  * `test/allow-list-reading-park-refusal.test.ts` 枚举调用点,多一处即红)。与 {@link buildCheckpointCtx} **同一条规则**:按当前读法写下的词,盖当前读法记号。
  *
- * 为什么记号必须随词一起写,而不是留给读的一侧去豁免:第三问问的是「体的词是不是按当前读法写下的」,记号就是这句话的证据。改写之后体里的词是本版的 `plan_review`
+ * 为什么记号必须随词一起写,而不是留给读的一侧去豁免:模式词问问的是「体的词是不是按当前读法写下的」,记号就是这句话的证据。改写之后体里的词是本版的 `plan_review`
  * 刚写下的(一个人刚批准的档),它确实是 `entry_word` 读法的词;若只改体、记号缺席,重建段的同一问把它读成「7.121.x 的请求原词」,被地板钳回 `plan` ≠ 所写词 ⇒ 误拒
  * 一条刚被批准的 run。判据侧(`stored-body-replay.ts`)**不为「plan_review 之后」另开特判臂** —— 读的一侧只有一个读法,写的一侧各自负责盖章。
  *
  * 为什么这不是在「洗」旧行:走到写回口的行,其**原体**已过 prepare 段的同一问(词被地板钳不变:词已是 `plan`,或本部署没有地板);原体的词会被地板钳的旧行
- * (`acceptEdits` / `bypassPermissions` / 无词)在 prepare 段就被拒,到不了这里。入参 `ctx` 的其余位(memoryScope / 无人值守标 / allow 记号)原样随行,只换体与模式词记号。
+ * (`acceptEdits` / `bypassPermissions` / 无词)在 prepare 段就被拒,到不了这里。入参 `ctx` 的其余位(memoryScope / 无人值守标)原样随行,只换体与模式词记号。
  *
  * 本模块零值依赖的闭包纪律不变(随包排空脚本经编译产物 import;`test/drain-check-local.test.ts`):本函数只用本模块内的东西。
  */
 export declare function withPermissionModeRewritten(ctx: CheckpointCtx, body: TaskRequestBody): CheckpointCtx;
-/** 行上带的是不是当前的模式词读法记号(第三问的记号那一半;另一半 —— 体的生效词被地板钳会不会变 —— 读请求设置的解析层,住在 `http/stored-body-replay.ts`)。
- *  记号缺席或认不得 ⇒ 不是「按当前读法写下」的证据,与 allow 记号同一条纪律。 */
+/** 行上带的是不是当前的模式词读法记号(模式词问的记号那一半;另一半 —— 体的生效词被地板钳会不会变 —— 读请求设置的解析层,住在 `http/stored-body-replay.ts`)。
+ *  记号缺席或认不得 ⇒ 不是「按当前读法写下」的证据。 */
 export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean;
 /**
- * 第三问的拒答复 —— 码与落点同 allow 记号那一问(`checkpoint.unsupported_version`,409;卡仍 pending 时体上的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
+ * 模式词问的拒答复 —— 码 `checkpoint.unsupported_version`,409(卡仍 pending 时体上的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
  * 句子说原因(更早的版本在每次续跑重钳运维的 AUTONOMY、没把它记进任务;本版只在提交时记一次 ⇒ 续跑会按任务提交时的原词跑)与两条出路。
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
  */
 export declare function permissionModeReadingRefusal(): ResumeRefusalAnswer;
 /**
- * 第四问:**退役的请求键**闭集 = 两张处置表之并(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下的)。键住在哪张表就是它的处置格,规则全文见头注第四问。
+ * 退役请求键问:**退役的请求键**闭集 = 两张处置表之并(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下的)。键住在哪张表就是它的处置格,规则全文见头注「退役请求键问」。
  * 拒表:存体仍带它 ⇒ 续跑重放拒({@link retiredRequestKeyRefusal});加一个 ⇒ 加一行,那只函数的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
  */
 export declare const REPLAY_REFUSED_RETIRED_KEYS: readonly ["promptProfile"];
@@ -135,7 +132,7 @@ export type RetiredRequestKey = (typeof RETIRED_REQUEST_KEYS)[number];
 /** 存体顶层带的第一只**需要拒**的退役请求键(拒表序);惰性键不算,没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
 export declare function retiredRequestKeyOf(body: unknown): ReplayRefusedRetiredKey | undefined;
 /**
- * 第四问的拒答复 —— 码与落点同另两只读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
+ * 退役请求键问的拒答复 —— 码与落点同模式词读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
  * 句子说键、它换成了什么、为什么不续跑,与两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)。不回显值。
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: <整句双引号字面 或 一只模板串>`,中间只许有空白(模板串形冻结的是骨架,`${…}` 折成一个洞)。
  * **窗的日期不手写**:`rewriteWindowEnd` 由调用方交 —— 判据(`stored-body-replay.ts`)按「退役键 → 改写它的迁移」那张表读登记表该行的 `removableAfter`,窗只写在登记表一处;
@@ -143,32 +140,31 @@ export declare function retiredRequestKeyOf(body: unknown): ReplayRefusedRetired
  * 删法见登记表 M30 的 `removal`(唯一来源)。
  */
 export declare function retiredRequestKeyRefusal(key: ReplayRefusedRetiredKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
-/**
- * 本行能否被按当前读法重放:体里 `allow` 在生效而行上的记号不是当前这一个词 ⇒ **不能**(`true` = 拒)。
- * 记号缺席、是旧词(`"statement"`)或认不得(手改 / 将来的写者)⇒ 同样拒:只有当前这个词是「按当前读法写下」的证据。
- */
-export declare function allowListReadingUnstated(ctx: CheckpointCtx): boolean;
-/** 被拒的行是哪一代写的(只在 {@link allowListReadingUnstated} 为真时有意义):记号是 `"statement"` ⇒ 表态时代;其余(缺席 / 认不得)⇒ 名单时代。 */
-export declare function allowListReadingEraOf(ctx: CheckpointCtx): AllowListReadingEra;
-/**
- * 拒的答复 —— 码与落点照「退役 mode-seed 行」的先例(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
- * 拒在认领之前,所以没有 `taskId`(行没抢到就不造键)。句子按这一行是哪一代写的分两句(闭集穷举,加一代 ⇒ 编译红):说原因(这条任务停在哪种读法上、
- * 照当前读法续跑会放宽什么)与出路(作为新任务重提,仍停驻的先取消)。
- *
- * 🔴 形是给冻结门看的(`api-error-text-freeze` 的 resume 家族收集器):`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
- */
-export declare function allowListReadingRefusal(era: AllowListReadingEra): ResumeRefusalAnswer;
 /**
  * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
  * 答 `checkpoint.unsupported_version` 的三臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
  */
-export type StoredBodyReplayRefusal = {
+export type StoredBodyReplayRefusal = 
+/** 体里带非空 `settings.permissions.allow`、写者版本证不出 ≥ {@link ALLOW_LAYER_READING_SINCE}(顶注「allow 读法问」)。 */
+{
     readonly kind: "allow_list_reading";
-    readonly era: AllowListReadingEra;
     readonly writerVersion?: string;
 } | {
     readonly kind: "inert_tool_list";
     readonly entry: InertToolListEntry;
+}
+/** 存体 `settings.env` 带凭据条目、一次性迁移 M38 的剥键窗已关:`refusal` = 提交腿那只 400(`request.env_credential_refused`)的码、句子与机读位(由预判用同一只判据铸),答复折成 409 `resume_blocked_by_policy`。 */
+ | {
+    readonly kind: "settings_env_credential";
+    readonly refusal: Refusal;
+}
+/** 存体里有本版读者读不出、而本部署会采纳的成员(hooks / settings.env / permissions / MCP transport / A2A headers …;判据 `unread-request-members.ts`):`refusal` = 拒点 `resolveSpec` 抛的那只 400
+ *  (`request.field_invalid`,`field` = 第一个坐标,句子点名全部坐标)的码、句子与机读位,答复折成 409 `resume_blocked_by_policy`;`members` = 判据交回的坐标(键路径与下标,不带值;与拒句同一个上限,截断由问点做),`memberCount` = 总数 —— 运维行读这两格。 */
+ | {
+    readonly kind: "unread_members";
+    readonly refusal: Refusal;
+    readonly members: readonly string[];
+    readonly memberCount: number;
 } | {
     readonly kind: "permission_mode_reading";
     readonly stored: PermissionMode | undefined;
@@ -214,6 +210,13 @@ export interface ResumeRefusalAnswer {
  * · (`retriable`,卡在才在)。
  */
 export declare function resumeBlockedByPolicyAnswer(inner: Refusal): ResumeRefusalAnswer;
+/**
+ * 续跑腿上认领之前一只 typed 拒的**唯一折法**(`resume-legs.ts` 的两处折叠口同调:装配 `resolveResumeSpec` 与停驻赎回的执行上下文)。一条律:
+ * 拒体自报这一拍答不出(`permanence: "transient"` —— 依赖此刻不可用,不是政策:今天 = 中心答不出场景裁定)⇒ 原码原状态原体(同一张卡在依赖恢复后可再决;
+ * SLA 拒扫腿按「其余 ≥400」逐拍重试,不把它当确定性拒过期掉);其余 ⇒ {@link resumeBlockedByPolicyAnswer}(准入策略挡住,`blockedBy` = 原码)。
+ * 两形之后都由调用方经 {@link resumeRefusalWithCard} 追加 `retriable`(卡仍 pending)。
+ */
+export declare function resumeAssemblyRefusalAnswer(status: number, inner: Refusal): ResumeRefusalAnswer;
 /**
  * 一次续跑的答复是不是 {@link resumeBlockedByPolicyAnswer} 铸的那一只(409 `resume_blocked_by_policy`)—— SLA 拒扫腿据此区分「同一份字节在本版永远被拒」与别的 ≥400
  * (后者可能是瞬时的,照旧逐拍重试)。码的写端与读端住在同一个模块,读端不在别处第二次手拼这个字面。
@@ -231,26 +234,28 @@ export declare function isResumeBlockedByPolicy(answer: {
  */
 export declare function resumeRefusalWithCard(answer: ResumeRefusalAnswer, cardPending: boolean): ResumeRefusalAnswer;
 /**
- * `stored-body-replay.ts` `storedBodyReplayRefusal` 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,allow 臂带 `era`、技能臂带 `layer`,`note` 一句出路。
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的**日志字段**(三处问点同一形,各自只再加坐标键 `sessionId` / `taskId`):`kind` 判别,技能臂带 `layer`、退役键臂带 `key`、allow 读法臂带 `writerVersion`(有才在),`note` 一句出路。
  * 事件名三个(问点各一:`resume_refused_stored_body` / `steer_wake_park_refused_stored_body` / `deny_sweep_stored_body_skipped`),字段形只有这一只。
  */
 export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefusal): {
     kind: StoredBodyReplayRefusal["kind"];
-    era?: AllowListReadingEra;
+    writerVersion?: string;
     layer?: InertToolListEntry["layer"];
     storedMode?: PermissionMode | null;
     floor?: PermissionMode;
     key?: ReplayRefusedRetiredKey;
+    members?: readonly string[];
+    memberCount?: number;
     note: string;
 };
 /**
- * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 记号 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 读法 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
  * 退役请求键 ⇒ {@link retiredRequestKeyRefusal};这三只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  *
  * 🔴 `cardPending` —— **调用方交出的事实**:这一次拒的时候,有没有一张待批卡仍在等。`retriable:true` 说的恰是「卡仍 pending」,所以它只在卡在时在场(经
  * {@link resumeRefusalWithCard} 一处写):续跑入口(`/decide` · `/resume` · `/wake` · plan_review · workflow 决定的新一跑,五个问点里除下面这一个之外全部)传 `true`;
- * 终态 run 的 `POST /v1/runs/:id/steer` 在**铸唤醒卡之前**就拒,没有卡也没铸卡 ⇒ 传 `false`,体上不带 `retriable`(三条臂同一条律;其余键两种处境逐字相同 —— 同判同答)。
+ * 终态 run 的 `POST /v1/runs/:id/steer` 在**铸唤醒卡之前**就拒,没有卡也没铸卡 ⇒ 传 `false`,体上不带 `retriable`(每条臂同一条律;其余键两种处境逐字相同 —— 同判同答)。
  * 没有默认值:每个调用点必须说出这件事实。
  */
 export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal, readerVersion: string, cardPending: boolean): ResumeRefusalAnswer;

package/dist/http/checkpoint-ctx.js

@@ -1,7 +1,5 @@
 import { refusalBody } from "./refusal-body.js";
-export const PERMISSIONS_ALLOW_READINGS = ["allow_layer"];
-export const PERMISSION_MODE_READINGS = ["entry_word"];
-export const ALLOW_LIST_READING_ERAS = ["list", "statement"];
+export const ALLOW_LAYER_READING_SINCE = "7.117.0";
 export function bodyCarriesAllowList(body) {
     const settings = body?.settings;
     if (settings === null || typeof settings !== "object" || Array.isArray(settings))
@@ -12,6 +10,33 @@ export function bodyCarriesAllowList(body) {
     const allow = permissions["allow"];
     return Array.isArray(allow) && allow.length > 0;
 }
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function readVersion(v) {
+    const m = SEMVER.exec(v);
+    return m === null ? undefined : { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] !== undefined };
+}
+export function writerReadsAllowLayer(writerVersion) {
+    if (typeof writerVersion !== "string")
+        return false;
+    const writer = readVersion(writerVersion);
+    const since = readVersion(ALLOW_LAYER_READING_SINCE);
+    if (writer === undefined)
+        return false;
+    for (let i = 0; i < 3; i++)
+        if (writer.core[i] !== since.core[i])
+            return writer.core[i] > since.core[i];
+    return !writer.pre;
+}
+export function allowListWriterUnproven(ctx) {
+    return bodyCarriesAllowList(ctx.body) && !writerReadsAllowLayer(ctx.writerVersion);
+}
+export function allowListReadingRefusal() {
+    return {
+        status: 409,
+        body: refusalBody({ errorCode: "checkpoint.unsupported_version", message: "this task's stored request carries settings.permissions.allow and was written by a server version that is earlier than 7.117.0 or that did not record its version (versions before 7.124.0 did not), so this server cannot tell how that list was meant to be read: 7.114.0 and earlier read it as a whitelist (every tool not on it was refused) and 7.115.0 to 7.116.x as a statement that answered only the question nobody else had answered, while this version hands it to the engine's allow layer, where each entry is a standing yes for the calls it covers, so continuing could give the task more tools or fewer questions than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel)." }),
+    };
+}
+export const PERMISSION_MODE_READINGS = ["entry_word"];
 export function buildCheckpointCtx(fields, sealer, sessionId) {
     const ctx = {
         body: fields.body,
@@ -19,7 +44,6 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(fields.promptScreened === true ? { promptScreened: true } : {}),
-        ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
         permissionModeReading: "entry_word",
     };
     return sealCheckpointCtx(ctx, sealer, sessionId);
@@ -64,40 +88,6 @@ export function retiredRequestKeyRefusal(key, rewriteWindowEnd) {
         }
     }
 }
-export function allowListReadingUnstated(ctx) {
-    if (!bodyCarriesAllowList(ctx.body))
-        return false;
-    const reading = ctx.permissionsAllowReading;
-    return !(typeof reading === "string" && PERMISSIONS_ALLOW_READINGS.includes(reading));
-}
-export function allowListReadingEraOf(ctx) {
-    const reading = ctx.permissionsAllowReading;
-    return reading === "statement" ? "statement" : "list";
-}
-export function allowListReadingRefusal(era) {
-    switch (era) {
-        case "list":
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "checkpoint.unsupported_version",
-                    message: "this task was suspended by an earlier server version that did not record how it read settings.permissions.allow (7.114.0 and earlier read it as a whitelist: every tool not on the list was refused); this version hands that list to the engine's allow layer, where each entry is a standing yes for the calls it covers, so continuing would give the task more tools than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel). To allow only certain tools, use the session rules' toolAllow (PUT /v1/sessions/:id/policy) or the request's excludeTools.",
-                }),
-            };
-        case "statement":
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "checkpoint.unsupported_version",
-                    message: "this task was suspended by an earlier server version (7.115.0 to 7.116.x) that read settings.permissions.allow as a statement that the named tools are allowed, which answered only the question nobody else had answered and never cleared an ordinary question such as a file write or a shell command; this version hands that list to the engine's allow layer, where an entry also clears those ordinary questions, so continuing would run calls without asking that the task was submitted to ask about. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel).",
-                }),
-            };
-        default: {
-            const unhandled = era;
-            throw new Error(`allow-list reading era ${String(unhandled)} has no refusal sentence`);
-        }
-    }
-}
 export function buildCheckpointVersionKeys(writerVersion, readerVersion) {
     return writerVersion !== undefined ? { writerVersion, readerVersion } : {};
 }
@@ -107,6 +97,9 @@ export function resumeBlockedByPolicyAnswer(inner) {
         body: refusalBody({ errorCode: "resume_blocked_by_policy", message: `resume blocked by an admission policy change: ${inner.message} — nothing was resumed; if the task is still suspended on its approval, cancel it (POST /v1/runs/:id/cancel) to end it without another model turn`, facts: { blockedBy: inner.errorCode, ...inner.facts } }),
     };
 }
+export function resumeAssemblyRefusalAnswer(status, inner) {
+    return inner.facts?.permanence === "transient" ? { status, body: refusalBody(inner) } : resumeBlockedByPolicyAnswer(inner);
+}
 export function isResumeBlockedByPolicy(answer) {
     return answer.status === 409 && typeof answer.body === "object" && answer.body !== null && answer.body.errorCode === "resume_blocked_by_policy";
 }
@@ -116,9 +109,13 @@ export function resumeRefusalWithCard(answer, cardPending) {
 export function storedBodyReplayLogFields(refusal) {
     switch (refusal.kind) {
         case "allow_list_reading":
-            return { kind: refusal.kind, era: refusal.era, note: "this session's stored request carries settings.permissions.allow written under an earlier reading (list era: a whitelist; statement era: a statement that cleared only the unstated question); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
+            return { kind: refusal.kind, ...(refusal.writerVersion !== undefined ? { writerVersion: refusal.writerVersion } : {}), note: "this session's stored request carries settings.permissions.allow and its writer version does not show it was written under the allow-layer reading (7.117.0 and later; versions before 7.124.0 recorded no writer version); it is not replayed under the current reading — the task stays suspended until someone cancels it" };
         case "inert_tool_list":
             return { kind: refusal.kind, layer: refusal.entry.layer, note: "this session's stored request carries a tool-list entry the engine reads as empty (a skill disallowedTools, an agent definition's denyTools / allowTools, the request's excludeTools / allowTools, or the rules in settings.permissions.deny / ask: a retired name, a case twin, a spelling no tool name can have, a rule core's grammar cannot compile, or a ~/ path rule on a lane with no home), or a permission list that is malformed or over the entry cap in either direction; it is not replayed — the task stays suspended until someone cancels it and resubmits with the entry fixed" };
+        case "settings_env_credential":
+            return { kind: refusal.kind, note: "this session's stored request carries credentials in settings.env (a credential variable name of this engine, or a value shaped like a secret) and the one-time window that dropped them on resume has closed; it is not replayed — the task stays suspended until someone cancels it and resubmits with the credentials moved into the engine's environment" };
+        case "unread_members":
+            return { kind: refusal.kind, members: refusal.members, memberCount: refusal.memberCount, note: "this session's stored request carries members this version's readers cannot take as written (named in the refusal: settings.hooks / settings.env / an MCP server's transport / an A2A peer's headers …) and this deployment would apply them; replaying it would run without them, so it is not replayed — the task stays suspended until someone cancels it and resubmits with those members in the current form" };
         case "permission_mode_reading":
             return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         case "retired_request_key":
@@ -135,11 +132,14 @@ export function storedBodyReplayAnswer(refusal, readerVersion, cardPending) {
 function storedBodyReplayArmAnswer(refusal, readerVersion) {
     switch (refusal.kind) {
         case "allow_list_reading": {
-            const answer = allowListReadingRefusal(refusal.era);
+            const answer = allowListReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
         }
         case "inert_tool_list":
             return resumeBlockedByPolicyAnswer(refusal.entry.extra === undefined ? { errorCode: refusal.entry.code, message: refusal.entry.message } : { errorCode: refusal.entry.code, message: refusal.entry.message, facts: refusal.entry.extra });
+        case "settings_env_credential":
+        case "unread_members":
+            return resumeBlockedByPolicyAnswer(refusal.refusal);
         case "permission_mode_reading": {
             const answer = permissionModeReadingRefusal();
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };

package/dist/http/claim-latency.d.ts

@@ -0,0 +1,10 @@
+/** `step` 标签的闭集:一个往返一个词。 */
+export declare const EXECUTION_CLAIM_STEPS: readonly ["run_claim", "placement_commit"];
+export type ExecutionClaimStep = (typeof EXECUTION_CLAIM_STEPS)[number];
+/** 计时落点:`Metrics` 的 `observe` 子集(deps 上没有指标注册表、或只带计数的桩 ⇒ 不计,行为逐字不变)。 */
+export interface ClaimLatencySink {
+    observe?(name: string, value: number, labels?: Record<string, string>): void;
+}
+/** 量一次认领往返(秒)。`claim` 是刚发出的往返(调用点在实参位置发起它,时钟随即起);抛也计、上抛原错。 */
+export declare function timeClaim<T>(sink: ClaimLatencySink | undefined, step: ExecutionClaimStep, claim: Promise<T>): Promise<T>;
+//# sourceMappingURL=claim-latency.d.ts.map

package/dist/http/claim-latency.js

@@ -0,0 +1,12 @@
+import { EXECUTION_CLAIM_METRIC } from "../observability/metrics.js";
+export const EXECUTION_CLAIM_STEPS = ["run_claim", "placement_commit"];
+export async function timeClaim(sink, step, claim) {
+    const started = performance.now();
+    try {
+        return await claim;
+    }
+    finally {
+        sink?.observe?.(EXECUTION_CLAIM_METRIC, (performance.now() - started) / 1000, { step });
+    }
+}
+//# sourceMappingURL=claim-latency.js.map