@sema-agent/server 7.145.0 → 7.147.0

package/dist/http/dispatch.js

@@ -11,6 +11,7 @@ import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfig
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { actsForDeployment, admitRunIdentity, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
+import { inflightTotal } from "../fleet/drain-entry.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
     if (!hasServiceAuth(config))
@@ -130,17 +131,32 @@ export function createDispatch(ctx) {
             const engineSignal = buildEngineSignal(signal);
             const declaredMods = deploymentModPackagesFact(deps);
             const configHash = createHash("sha256")
-                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
+                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec.provider, port: deps.config.port }))
                 .digest("hex")
                 .slice(0, 16);
             sendJson(res, 200, {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
                 ...healthDrainingKeys(signal),
-                ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
+                ...(() => {
+                    const breakdown = deps.drainState?.inflightBreakdown?.();
+                    return breakdown ? { inflight: inflightTotal(breakdown), inflightBreakdown: breakdown } : {};
+                })(),
                 ...(() => {
                     const lease = deps.drainState?.engineLease?.();
-                    return lease ? { engineLease: { lingerMs: lease.lingerMs, tickMs: lease.tickMs } } : {};
+                    if (!lease)
+                        return {};
+                    const fa = lease.firstAttach;
+                    const ho = lease.handover;
+                    return {
+                        engineLease: {
+                            lingerMs: lease.lingerMs,
+                            tickMs: lease.tickMs,
+                            lane: lease.lane,
+                            ...(fa ? { firstAttach: { windowMs: fa.windowMs, since: fa.since, attachedAt: fa.attachedAt } } : {}),
+                            ...(ho ? { handover: { since: ho.since, reason: ho.reason, lingerMs: ho.lingerMs, backgroundShells: ho.backgroundShells } } : {}),
+                        },
+                    };
                 })(),
                 ...(deps.storePosture?.degradedReason !== undefined ? { durable: false, storeDegraded: true } : {}),
                 ...healthReadinessKeys(signal.verdict),

package/dist/http/durable-run-leg.d.ts

@@ -2,6 +2,7 @@ import type { RunStore } from "../plugins/store-backend.js";
 import type { RunIdemBinding, RunRecord } from "../plugins/store-contracts.js";
 import type { PreparedTaskSubmission, RouteCtxBase, WorkflowDecisionDelivery } from "./route-ctx.js";
 import type { RunIdentity } from "../identity-source.js";
+import type { RunSlot } from "./run-concurrency-cap.js";
 export interface DurableRunLegArgs {
     /** `prepareSpec` 的产物,或内部车道按同一条 `resolveSpec` 装配出来的等价形。 */
     prepared: PreparedTaskSubmission;
@@ -27,6 +28,10 @@ export interface DurableRunLegArgs {
     /** `/decide` 第三条车道的 fresh 投递腿交来的那一件决定投递(带着的决定 + 起跑之前落行的那一笔;语义与 TRUSTED 纪律的属主 =
      *  `route-ctx.ts` 的 {@link WorkflowDecisionDelivery} 顶注)。缺席 ⇒ 只摊本会话已受理的决定行。 */
     workflowDecision?: WorkflowDecisionDelivery;
+    /** 提交门占着的**并发帽席位**(`http/run-concurrency-cap.ts`):本腿在 `runInBackground` 把这条 run 登记进 `inflightRuns` 的那一拍(它在返回前同步登记)就地放掉 ——
+     *  与 `POST /v1/tasks` 两口同形,在飞集里的这一条不再叠一枚席位。落点拒 / 续跑输入拒 / 409 / 抛 等没走到登记的出口不放,由提交门的 `finally` 兜底(`release` 幂等)。
+     *  缺席 = 没有帽可放(`/decide` 第三条车道〔延续,不判帽〕、帽关着的部署)。 */
+    runSlot?: RunSlot;
 }
 /**
  * 本腿的结局:一份收据,或「这次提交的一把幂等钥匙已经指向一条行」(店的原子赢或观察的**观察**臂 —— 本腿不碰

package/dist/http/durable-run-leg.js

@@ -8,6 +8,7 @@ import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../too
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext } from "./execution-context.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
+import { timeClaim } from "./claim-latency.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
@@ -21,7 +22,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const sessionId = args.prepared.spec.sessionId;
     const taskId = args.clientTaskId ?? uuidv7();
     const trustedInternals = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
-    const created = await runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null });
+    const created = await timeClaim(deps.metrics, "run_claim", runStore.createRun(taskId, sessionId, args.prepared.auth?.principal ?? null, deps.instanceId ?? "default", { ...runMeta(args.prepared, args.source), identity: args.identity, idem: args.idem ?? null }));
     if (created.ok)
         clearTurnActivity(taskId);
     if (created.ok)
@@ -99,6 +100,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             executionLane: args.prepared.execution.lane,
         }
         : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.prepared.legFacts?.sessionWitness), args.prepared.legFacts?.skills));
+    args.runSlot?.release();
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/execution-context.d.ts

@@ -12,12 +12,15 @@
  *     在场而与行头不是同一位住客(化身 ∧ 属主,写口同一只判官 `sameOccupant`)⇒ 同 404(他人在门与解析之间删掉并同 id 重登记,或同一化身的属主变了 ——
  *     local M10 认领 / identical 重戳 / SQL 导入提交点改属主 —— 判到新住客的车道就是错的);local 格是 `forking`
  *     ⇒ 409 `conflict.fork_in_progress`;读故障抛(不吞成 absent)。解析器不建行、不铸根。
+ *     随后(同一步,就在那一读之后):这只根会话 id 在本进程被删过、而那一读的住客不是删前的属主 ⇒ 409 `conflict.session_id_retired`
+ *     (表与规则 `deleted-session-ids.ts`,这里是它唯一的读点;店不带执行席 ⇒ fresh 判门判过的那一读,continuation 判不出 ⇒ 表里有就拒)。
  *  ② 定车道:`mirror` ⇒ 409 `conflict.session_mirror`(体带 `forkPath`);`writer(L)` 而 L 不在本部署的车道表 ⇒ 409 `execution_lane.not_served{boundLane}`;absent ⇒ 表首。
  *  ③ 授权:主体的执行车道裁定(`gateExecutionLane`,判据与码同 `runtime-caps-resolver.ts`);服务形不判。
  *  ④ 只 fresh:设备准入链(体 `deviceId` 只在 device 车道收;准入链三步 + 首绑目标三读,全读;判的是步 ① 那一读)。
  *
  * 入口三形(判别联合,{@link ExecutionEntry}):`fresh`(提交腿:根 = authorizer 交出的 `auth.sessionId`,`judged` = authorizer 判过的头)·
- * `continuation`(续跑家族与停驻赎回:根 = checkpoint / 停驻行的根;不带 `judged` —— 步 ① 那一读就是这条执行对根的唯一一读,认领之后由写口按它判)·
+ * `continuation`(续跑家族与停驻赎回:根 = checkpoint / 停驻行的根;不带 `judged` —— 步 ① 那一读就是这条执行对根的唯一一读,认领之后由写口按它判;
+ * run 外回退口 `POST /v1/sessions/:id/rewind-files` 同形:根 = 路径上的会话,它不认领、不提交放置,只取步 ①–③ 的拒)·
  * `service`(服务 run:没有会话根)。
  * `fresh` / `continuation` 两形型上恒带 `root: string`,`service` 形没有 `root` 键 —— 「按一只缺席的根去读行」在型上不可表达。
  *
@@ -108,6 +111,8 @@ export declare function resolveExecutionContext(deps: ExecutionContextDeps, entr
     readonly root: string;
 }>): Promise<RootedExecutionContext>;
 export declare function resolveExecutionContext(deps: ExecutionContextDeps, entry: ExecutionEntry): Promise<ExecutionContext>;
+/** 步 ① 之后那一判的拒句(409 `conflict.session_id_retired`;不回显 id / 属主)。续跑家族把它包进 `resume_blocked_by_policy` 的句子里答。 */
+export declare const SESSION_ID_RETIRED_MESSAGE = "this session id was deleted on this server while a different owner held it, so this server will not run it for you \u2014 start the session under a new id";
 /** 拒体里「继续在本处执行」的下一步路径(fork 口)—— 镜像拒体的 `forkPath` 唯一铸法(执行面与会话行写口 `PATCH /v1/sessions/:id` 同读)。 */
 export declare function forkPathOf(root: string): string;
 /** 解析器的拒是不是「会话不在」(停驻赎回腿把它答成自己既有的 `decide.not_parked`;判据只在这里认那只答复的码)。 */
@@ -198,6 +203,7 @@ export interface ExecutionCommitDeps {
     } | undefined;
     readonly metrics?: {
         inc(name: string, labels?: Record<string, string>): void;
+        observe?(name: string, value: number, labels?: Record<string, string>): void;
     } | undefined;
 }
 /**

package/dist/http/execution-context.js

@@ -6,7 +6,9 @@ import { sameOccupant } from "../execution-placement.js";
 import { deployedExecutionLanes } from "../execution-lane-caps.js";
 import { gateExecutionLane } from "../runtime-caps-resolver.js";
 import { releaseClaimedRun } from "./claimed-run.js";
+import { sessionIdRetiredFor } from "../deleted-session-ids.js";
 import { refusalBody } from "./refusal-body.js";
+import { timeClaim } from "./claim-latency.js";
 export async function resolveExecutionContext(deps, entry) {
     const lanes = deployedExecutionLanes(deps.config);
     switch (entry.kind) {
@@ -16,6 +18,8 @@ export async function resolveExecutionContext(deps, entry) {
         case "continuation": {
             const seat = deps.sessionStorage?.executionPlacement;
             const reading = seat === undefined ? undefined : await readRow(seat, entry.root, entry.kind === "fresh" ? entry.judged : undefined);
+            if (sessionIdRetiredFor(entry.root, servedOwnerOf(entry, reading), deps.config))
+                throw createCodedHttpError(409, "conflict.session_id_retired", SESSION_ID_RETIRED_MESSAGE);
             const { lane, placement } = laneOf(entry.root, reading?.cell ?? { role: "absent" }, lanes);
             gateExecutionLane(await deps.executionRuling?.(entry.principal), lane, deps.logger);
             const ctx = { kind: entry.kind, root: entry.root, occupant: reading?.occupant, placement, lane };
@@ -30,6 +34,12 @@ export async function resolveExecutionContext(deps, entry) {
         }
     }
 }
+export const SESSION_ID_RETIRED_MESSAGE = "this session id was deleted on this server while a different owner held it, so this server will not run it for you — start the session under a new id";
+function servedOwnerOf(entry, reading) {
+    if (reading !== undefined)
+        return reading.occupant.owner;
+    return entry.kind === "fresh" ? entry.judged?.owner : undefined;
+}
 async function readRow(seat, root, judged) {
     const reading = await seat.read(root);
     if (reading === undefined || (judged !== undefined && !sameOccupant(judged, reading.occupant)))
@@ -194,6 +204,9 @@ export async function commitExecutionContext(deps, claim, ctx) {
     if (ctx.occupant === undefined || seat === undefined)
         return null;
     const occupant = ctx.occupant;
+    return timeClaim(deps.metrics, "placement_commit", commitPlacement(deps, claim, ctx, seat, occupant));
+}
+async function commitPlacement(deps, claim, ctx, seat, occupant) {
     const release = (why) => releaseClaim(deps, claim, why);
     const deadlineMs = placementWriteDeadlineMs(deps.config?.runStaleSec);
     const withDeadline = async (work) => {

package/dist/http/health-self-report.d.ts

@@ -12,6 +12,9 @@
  *    `service_token` 臂读的正是它),所以 `required` 与 `kinds` 是同一次求值的两个投影,不是两个来源;
  *  · `auth.identityAttach` = kinds 里有没有**带调用方身份**的一类({@link carriesCallerIdentity},穷举):`service_token` 认的是系统
  *    (`systemFor` 回系统名或 null),不是人;
+ *  · `auth.serviceTokenActsForDeployment` = 出示 service 凭据、不报主体的调用方在这台部署上代不代部署本人 —— `required`(同一次 kinds 求值的 `service_token` 词)
+ *    ∧ 门读那一格声明的同一只读法 `serviceTokenDeclaredActsForDeployment`(`actsForDeployment` 的合取项,`principal-gate.ts`)。没配 service 凭据 ⇒ `false`(那一臂够不着);
+ *    缺省部署 ⇒ 与 `required` 同值。运维聚合口的 401 operator 句指的就是这一位;
  *  · `operator` = 能力事实 `operatorLane`(operator 面族的 501 门读的同一只;名单本身不上 wire);
  *  · `center.issuer` = 鉴权桥 issuer 的唯一取值 `authBridgeIssuerOf`(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读);
  *  · `center.webBaseUrl` = 运维旋钮 `SEMA_WEB_ADMIN_WEB_URL`(`config.webAdmin.webBaseUrl`,接了中心才挂;起服时已判成固定基址);
@@ -49,6 +52,7 @@ export interface HealthSelfReport {
         readonly required: boolean;
         readonly kinds: readonly IdentitySource[];
         readonly identityAttach: IdentityAttach;
+        readonly serviceTokenActsForDeployment: boolean;
     };
     readonly operator: OperatorPresence;
     readonly center: {
@@ -58,8 +62,8 @@ export interface HealthSelfReport {
     };
 }
 /**
- * 三键的**唯一铸点**(`build*`:纯数据)。只读装配本身:`auth` 三位都从一次 `wiredIdentitySources` 求值投出(`required` = 其中有 `service_token`),
- * 不收调用方递进来的第二份布尔 —— 一个事实一次求值。
+ * 三键的**唯一铸点**(`build*`:纯数据)。只读装配本身:`auth` 四位都从一次 `wiredIdentitySources` 求值投出(`required` = 其中有 `service_token`;
+ * `serviceTokenActsForDeployment` = `required` ∧ 门读的那一格声明),不收调用方递进来的第二份布尔 —— 一个事实一次求值。
  */
 export declare function buildHealthSelfReport(deps: Pick<FlatServiceDeps, "config" | "webAdminJwtVerifier" | "sessionStorage" | "runStore">): HealthSelfReport;
 //# sourceMappingURL=health-self-report.d.ts.map

package/dist/http/health-self-report.js

@@ -1,4 +1,4 @@
-import { wiredIdentitySources } from "./principal-gate.js";
+import { serviceTokenDeclaredActsForDeployment, wiredIdentitySources } from "./principal-gate.js";
 import { operatorLane, sessionList } from "../capability-facts.js";
 import { authBridgeIssuerOf } from "../auth-bridge.js";
 import { centerLaneConfigured } from "../web-admin-client/center-request.js";
@@ -26,8 +26,9 @@ export function buildHealthSelfReport(deps) {
     const issuer = authBridgeIssuerOf(config)?.issuer;
     const webBaseUrl = config.webAdmin?.webBaseUrl;
     const sessionsVisible = centerLaneConfigured(config) && config.fleetAdvertiseAddress !== undefined && bridgeWired && sessionList(deps).available ? (config.requirePrincipal ? true : "unknown") : false;
+    const required = kinds.includes("service_token");
     return {
-        auth: { required: kinds.includes("service_token"), kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable" },
+        auth: { required, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable", serviceTokenActsForDeployment: required && serviceTokenDeclaredActsForDeployment(config) },
         operator: operatorLane(deps).available ? "present" : "absent",
         center: {
             ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),

package/dist/http/memory-compliance-failure-reply.d.ts

@@ -10,9 +10,9 @@
  *
  * ## 规则(三层,与 operator 面既有层序逐字同序)
  *  ① core 的**本口专属**码(闭集穷举 `switch`,见 {@link sentCoreCode})—— 码与状态两面同;文案按受众(下一节,一条规则);
- *  ② **店形拒**两码 `memory.target_outside_store`(core 7.31.1 [ref])/ `memory.scope_home_not_directory`(core 7.44.0 [ref])—— 跨面 store 状态码,409、码原样
+ *  ② **店形拒**一族(按族表读;成员举例 `memory.target_outside_store` / `memory.scope_home_not_directory` / 引擎 7.65.0 起 `memory.control_plane_links_unsupported`)—— 跨面 store 状态码,409、码原样
  *     (判据 `memory-store-refusal.ts` 一只;运维行 `memory_store_form_refused { code, path?, form? }` 两受众同一只铸点,路径只在那里);
- *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义见下);
+ *  ③ `ControlPlaneCorruptError` —— typed 500 `internal.memory_control_plane_corrupt`(fail-closed 信号,一码两义;映射本体在 `memory-control-plane-corrupt-reply.ts` 那一只,导出导入 / 外源 / 整理 / 合规各口同调);
  *  其余 ⇒ `false`(未分类,调用方发它自己那句 500 且**不回显**内部文本)。
  *
  * ## 文案按受众分(码与状态不分)—— **一条规则,三层同施,不按码挑**(F9,7.108.0 合并复审 opus 腿 O-9)

package/dist/http/memory-compliance-failure-reply.js

@@ -1,5 +1,5 @@
-import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { logStoreFormRefusal, storeFormRefusalOf } from "../memory-store-refusal.js";
+import { sentControlPlaneCorrupt } from "./memory-control-plane-corrupt-reply.js";
 import { sentMemoryStoreRefusal } from "./memory-store-refusal-reply.js";
 import { sendError } from "./send.js";
 import { assertNever } from "./route-ctx.js";
@@ -63,6 +63,9 @@ export function sentMemoryComplianceFailure(res, err, audience, logger) {
                     case "memory.scope_home_not_directory":
                         sendError(res, 409, "memory.scope_home_not_directory", "session memory erasure refused — a scope directory in this deployment's memory store is not a real directory (it was replaced by a link or a file), so this erasure did not complete; ask the operator to put the real directory back, then resend with the same requestId");
                         return true;
+                    case "memory.control_plane_links_unsupported":
+                        sendError(res, 409, "memory.control_plane_links_unsupported", "session memory erasure refused — this deployment's memory control plane is on a file system that cannot make hard links, so its memory store does not open and this erasure changed nothing; ask the operator to move the control plane to a volume that supports hard links, then resend with the same requestId");
+                        return true;
                     default:
                         return assertNever(storeForm.code);
                 }
@@ -70,19 +73,6 @@ export function sentMemoryComplianceFailure(res, err, audience, logger) {
                 return assertNever(audience);
         }
     }
-    if (err instanceof ControlPlaneCorruptError) {
-        switch (audience.kind) {
-            case "operator":
-                sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
-                return true;
-            case "session_owner":
-                audience.withheld(err.message);
-                sendError(res, 500, "internal.memory_control_plane_corrupt", "session memory erasure could not be completed — this deployment's memory control plane could not be read cleanly (depending on where it stopped, either nothing was changed or the deletions were already committed and a replay finishes them); ask the operator to repair it, then resend with the same requestId");
-                return true;
-            default:
-                return assertNever(audience);
-        }
-    }
-    return false;
+    return sentControlPlaneCorrupt(res, err, audience);
 }
 //# sourceMappingURL=memory-compliance-failure-reply.js.map

package/dist/http/memory-control-plane-corrupt-reply.d.ts

@@ -0,0 +1,25 @@
+/**
+ * core 的 `ControlPlaneCorruptError` ⇒ typed 500 `internal.memory_control_plane_corrupt` 的 **HTTP 映射** —— 唯一一处码字面量、唯一一处 `instanceof` 判别。
+ *
+ * ## 为什么是一只
+ * 这是 core 的 fail-closed 信号:记忆引擎的控制面(账本 / 事务日志 / 清标账 / 治理账)说不清,它宁可不答,也不在一个说不清的账上拼一个答案。
+ * 凡是会碰控制面的 operator 记忆口,对它的答法必须是同一句话:消费端按 `errorCode` 分支,运维有具体动作(修 / 重建账本后重试)。
+ * 此前这条映射写在四个地方(导出 / 导入口、外源标记口、整理口、合规口),码字面量与判别各一份 = 第五个口加错码或漏一支的口子。
+ * 同族的店形拒早已是一只(`sentMemoryStoreRefusal`,在 `memory-store-refusal-reply.ts`);本文件是第二只。挂在每一个**已分类收尾**上:
+ * `routes/memory-bundle.ts`(导出 / 导入)· `routes/memory-origin.ts`(外源列表 / 清标 / 清标账列表 —— 清标账列表是纯控制面读,店形拒不挂在它上面,它的损坏信号走这一只)·
+ * `routes/memory-consolidation.ts`(整理)· `memory-compliance-failure-reply.ts`(出处 / 抹除,两受众)。
+ *
+ * ## 文案按受众分(码与状态不分;与 `memory-compliance-failure-reply.ts` 同一条规则)
+ *  · operator ⇒ 引擎原句上 wire(点名**哪一张**控制面账本坏了,运维下一步动作取决于它;原句带宿主路径,过了 operator 门的受众拿它不是泄露);
+ *  · 会话所有者(自助抹除口,只有这一个口有这个受众)⇒ 一句固定指路,引擎原句整句交 `withheld` 落运维行 —— 不逐句判断哪句安全。
+ *    固定句**一码两义都真**:操作前账本读不出 ⇒ 什么都没发生;落定后残留枚举失败 ⇒ 抹除已提交、重放收敛(core 原话)。两句都不许诺零删除,
+ *    都指路「运维修好后用同一个 requestId 重发」。本层**不**嗅 core 文案去分辨哪一义(拿上游自由文本当判别式是第二真源)。
+ *
+ * 两处 `sendError` 的码都写**字面量**:错误码目录门(`test/error-code-catalog-live.test.ts`)与文案冻结门(`test/api-error-text-freeze.test.ts`,
+ * 固定句是它冻的那一句)扫的是源码字面量,变量态的码 / 句对它们隐形。
+ */
+import type { ServerResponse } from "node:http";
+import type { MemoryComplianceAudience } from "./memory-compliance-failure-reply.js";
+/** `err` 是 core 的控制面损坏 ⇒ 500 `internal.memory_control_plane_corrupt`(文案按受众),返回 true(已应答);否则 false,一个字节都不写。 */
+export declare function sentControlPlaneCorrupt(res: ServerResponse, err: unknown, audience: MemoryComplianceAudience): boolean;
+//# sourceMappingURL=memory-control-plane-corrupt-reply.d.ts.map

package/dist/http/memory-control-plane-corrupt-reply.js

@@ -0,0 +1,19 @@
+import { ControlPlaneCorruptError } from "@sema-agent/core";
+import { assertNever } from "./route-ctx.js";
+import { sendError } from "./send.js";
+export function sentControlPlaneCorrupt(res, err, audience) {
+    if (!(err instanceof ControlPlaneCorruptError))
+        return false;
+    switch (audience.kind) {
+        case "operator":
+            sendError(res, 500, "internal.memory_control_plane_corrupt", err.message);
+            return true;
+        case "session_owner":
+            audience.withheld(err.message);
+            sendError(res, 500, "internal.memory_control_plane_corrupt", "session memory erasure could not be completed — this deployment's memory control plane could not be read cleanly (depending on where it stopped, either nothing was changed or the deletions were already committed and a replay finishes them); ask the operator to repair it, then resend with the same requestId");
+            return true;
+        default:
+            return assertNever(audience);
+    }
+}
+//# sourceMappingURL=memory-control-plane-corrupt-reply.js.map

package/dist/http/memory-store-refusal-reply.d.ts

@@ -1,6 +1,6 @@
 /**
- * **店形拒**两码(`memory.target_outside_store` / `memory.scope_home_not_directory`,判据在 `src/memory-store-refusal.ts`)的
- * **operator 面 HTTP 映射** + 两受众共用的**运维行** —— 唯一一处码字面量。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
+ * **店形拒**一族(`memory.target_outside_store` / `memory.scope_home_not_directory` / `memory.control_plane_links_unsupported`,族表与判据在 `src/memory-store-refusal.ts`)的
+ * **operator 面 HTTP 映射** + 两受众共用的**运维行** —— operator 面唯一一处码字面量(会话所有者面的逐码臂在 `http/memory-compliance-failure-reply.ts`;引擎加码 ⇒ 两处各补一臂)。挂在每一个触 store 树的 operator 记忆口的已分类收尾上:
  * `routes/memory-compliance.ts`(出处 / 抹除;经 `http/memory-compliance-failure-reply.ts` 的 operator 受众臂)· `routes/memory-origin.ts`(外源列表 / 清标;**不含**只读控制面的清标账列表 ——
  * core 的 wire 表逐字:只碰控制面的面不判,给它挂一条永远收不到的码路径正是附录 A 活触发门要防的形)·
  * `routes/memory-bundle.ts`(导出 / 导入)。会话所有者的自助抹除口**不走这里的 wire 句**(经 `http/memory-compliance-failure-reply.ts` 的会话所有者受众臂:同码、固定文案),
@@ -8,7 +8,7 @@
  * `POST /v1/admin/memory/consolidation/run` 也不走这里:那口把 core 的**任何**有码拒一律收成 409 `memory.consolidation_refused`
  * (码进文案,附录 A 该行),这一族已在那条臂上,不再给它第二个码。
  *
- * ## 为什么 409(两码同一条)
+ * ## 为什么 409(一族同一条)
  * core 的读法:operator 要处置的盘形(去掉 store 里那只通到外面的目录链 / 把 scope home 放回真目录),不是可重试的 IO 故障,也不是对调用方的裁决。与
  * `memory.erasure_census_incomplete` 同一类(**当前 store 状态**下这次做不了;状态修好后重发即改判)⇒ 409,不 500(服务器没坏)、
  * 不 4xx 请求族(请求没写错)。抹除面:链先于请求在场 ⇒ core 在提交点之前拒,零删除、零 journal(真 core 格钉在

package/dist/http/memory-store-refusal-reply.js

@@ -12,6 +12,9 @@ export function sentMemoryStoreRefusal(res, err, logger) {
         case "memory.scope_home_not_directory":
             sendError(res, 409, "memory.scope_home_not_directory", refusal.message);
             return true;
+        case "memory.control_plane_links_unsupported":
+            sendError(res, 409, "memory.control_plane_links_unsupported", refusal.message);
+            return true;
         default: {
             const unhandled = refusal.code;
             throw new Error(`unhandled store-form refusal word: ${String(unhandled)}`);

package/dist/http/owner-access.d.ts

@@ -16,6 +16,7 @@
 import type { ServiceConfig } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { RunRecord } from "../plugins/store-contracts.js";
+import type { SessionHead } from "@sema-agent/core";
 import { type OwnerAwareSessionStore, type Principal, type SessionCaller, type SessionOwnerCell } from "../security.js";
 import { type IdentityWiring, type OperatorRoster } from "./principal-gate.js";
 /** 调用点挂哪条臂(闭集):`owner` = 只有属主判官;`owner_or_operator` = 属主判官 ∨ 显式运维(`explicitOperatorOk`,唯一读法)。 */
@@ -46,6 +47,16 @@ export declare function readOwnedRun(config: OwnerAccessConfig, runStore: {
 export declare function readOwnedSession(w: IdentityWiring & {
     readonly config: OwnerAccessConfig;
 }, store: Pick<OwnerAwareSessionStore, "placementOf"> & Required<Pick<OwnerAwareSessionStore, "headOf">>, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<SessionOwnerCell | undefined>;
+/**
+ * 同一只读口,连头一起交回:门过了的调用点还要读这只会话的**内容**(坏档判据 `leafOfAdmittedHead` 读头的叶子;门之前不许读)或头上的属主原值时用它 ——
+ * 一次头读、一只判官,与 {@link readOwnedSession} 是同一读(那一只就是本函数取 `cell`)。`undefined` 的读法同上。
+ */
+export declare function readOwnedSessionHead(w: IdentityWiring & {
+    readonly config: OwnerAccessConfig;
+}, store: Pick<OwnerAwareSessionStore, "placementOf"> & Required<Pick<OwnerAwareSessionStore, "headOf">>, caller: SessionCaller, sessionId: string, arm: OwnerArm): Promise<{
+    readonly cell: SessionOwnerCell;
+    readonly head: SessionHead;
+} | undefined>;
 /**
  * 🔴 **会话读面的属主读的第三个结局**:有主 / 无此行 / **属主读不出**(店交出具名拒 {@link SessionOwnerUnreadableError} —— 会话的行事实没有落下,补铸它要读的存档又用不了;
  * 谁也判不了「这是不是你的会话」)。第三个读作第二个:**与「没有这一行」同一个值**(`undefined`),调用点落的就是它们对「不存在 / 非属主」的那一臂 ——

package/dist/http/owner-access.js

@@ -32,11 +32,14 @@ export async function readOwnedRun(config, runStore, principal, taskId, arm) {
     return row !== undefined && runRowReadable(config, principal, row.owner, arm) ? row : undefined;
 }
 export async function readOwnedSession(w, store, caller, sessionId, arm) {
-    const owner = (await store.headOf(sessionId))?.owner;
-    if (owner === undefined)
+    return (await readOwnedSessionHead(w, store, caller, sessionId, arm))?.cell;
+}
+export async function readOwnedSessionHead(w, store, caller, sessionId, arm) {
+    const head = await store.headOf(sessionId);
+    if (head === undefined || head.owner === undefined)
         return undefined;
-    const cell = await sessionOwnerCellOf(store, sessionId, owner);
-    return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? cell : undefined;
+    const cell = await sessionOwnerCellOf(store, sessionId, head.owner);
+    return operatorArmHolds(w.config, caller.principal, arm) || sessionOwnerReadable(caller, cell, w) ? { cell, head } : undefined;
 }
 export async function foldOwnerUnreadable(logger, face, sessionId, read) {
     try {

package/dist/http/principal-gate.d.ts

@@ -72,8 +72,10 @@ export declare function sendPrincipalRefusal(res: ServerResponse, req: IncomingM
  * 每面一句模块级常量(冻结门按常量解引用逐字钉)。三句都**不含任何值**(令牌 / 头名 / 路径实参一概不回显),且**不区分**
  * 「没带」与「带错」—— 同一道门上两者逐字同体,区分就是探测面。
  *  · `credential` —— 全局凭据门(`dispatch.ts`):部署配了 service token,请求没带或带的不认(registry 登录令牌验不过同属此面);
- *  · `operator` —— 只给运维凭据开的口(`/metrics*` 与 `GET /v1/tasks/source-summary`):不带主体头的 service token 开得了(带主体头的是那位主体,
- *    {@link actsForDeployment}),指标口另认只读的 `METRICS_TOKEN`、`source-summary` 另认只读的 `TRACE_TOKEN`(都在全局门之前判);
+ *  · `operator` —— 只给运维凭据开的口(`/metrics*` 与 `GET /v1/tasks/source-summary`):不带主体头的 service token 开得了 —— 在部署让它代自己说话时
+ *    ({@link actsForDeployment};带主体头的是那位主体;声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` 的部署上它不代任何人),指标口另认只读的 `METRICS_TOKEN`、
+ *    `source-summary` 另认只读的 `TRACE_TOKEN`(都在全局门之前判)。句子只有一句、两形都真:service token 那条出路带条件「在这台部署让它代自己说话时」,
+ *    并指 `/health` 的自报位 `auth.serviceTokenActsForDeployment` 去读这台部署的答案 —— 铸点不读配置、签名不变(一面一只常量);
  *  · `identity` —— 过了凭据门(或这台部署没配 service token)、但这一口要一个**验过的调用方身份**:属主寻址的读 / 写面、规则面、
  *    记忆面。在配了 service token 的部署上,「带 service token 却没身份」只会落在只认身份的口(规则 / 记忆 / 会话策略)上 ——
  *    这时再叫调用方「去带 service token」是假出路,所以这一面的句子只讲身份。
@@ -81,7 +83,7 @@ export declare function sendPrincipalRefusal(res: ServerResponse, req: IncomingM
  */
 export type UnauthorizedFace = "credential" | "operator" | "identity";
 export declare const UNAUTHORIZED_CREDENTIAL = "unauthorized \u2014 the request carries no credential this deployment accepts: send the deployment's service token as a Bearer token in the Authorization header (its operator set it as SERVICE_AUTH_TOKEN or SERVICE_AUTH_TOKENS; a sema-up deployment keeps SERVICE_AUTH_TOKEN in ~/.sema-up/<project>/.env on the machine that ran sema-up)";
-export declare const UNAUTHORIZED_OPERATOR = "unauthorized \u2014 this endpoint is for the deployment's operators and the request carries no operator credential: send the deployment's service token as a Bearer token in the Authorization header without a principal header (a service-token request that names a principal acts for that principal, not for the deployment), or a read-only token this endpoint accepts (METRICS_TOKEN for the metrics endpoints, TRACE_TOKEN for the task source summary)";
+export declare const UNAUTHORIZED_OPERATOR = "unauthorized \u2014 this endpoint is for the deployment's operators and the request carries no operator credential: send the deployment's service token as a Bearer token in the Authorization header without a principal header where this deployment lets its service token act for the deployment itself (GET /health reports it as auth.serviceTokenActsForDeployment; a service-token request that names a principal acts for that principal, not for the deployment), or a read-only token this endpoint accepts (METRICS_TOKEN for the metrics endpoints, TRACE_TOKEN for the task source summary)";
 export declare const UNAUTHORIZED_IDENTITY = "unauthorized \u2014 this endpoint acts for a named caller and the request carries no caller identity this deployment verifies: identify the caller the way this deployment does (a registry sign-in token as the Bearer token, a signed principal token on a direct-door deployment, or the principal header set by a trusted front end)";
 export declare function sendUnauthorized(res: ServerResponse, face: UnauthorizedFace): void;
 /**
@@ -128,15 +130,24 @@ export declare function wiredIdentitySources(w: IdentityWiring): readonly Identi
  */
 export declare function devOpenDeployment(w: IdentityWiring): boolean;
 /**
- * service 凭据**代部署本身**说话:出示了这台部署的 service 凭据({@link systemFor}),且不代任何验过的主体。带主体头的 service 凭据请求是前端(BFF)
- * 代那位主体发的 —— 它读那位主体,不读全舰队;部署姿态(单用户 / 多租)不改这一句(单用户形上的主体头同样是「这次请求为谁」)。
- * 两处读它:fleet 调用方的凭据臂({@link sessionCallerOf})与 `/metrics` 族的 service 臂(`dispatch.ts`)。先判凭据、后取主体:`principal` 只在出示了
- * service 凭据时才求值(调用点那一次 {@link gatedPrincipal}),没带凭据的请求不因主体头的形而改答。
+ * 🔴 **律(一句,一个参数)**:出示这台部署的 service 凭据且不报主体的调用方代部署本人说话(fleet),**除非部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false`**
+ * —— 此时它是无身份调用方,按各面既有的「过了凭据门、没有主体」那一臂答。带主体头的 service 凭据请求是前端(BFF)代那位主体发的 —— 它读那位主体,
+ * 不读全舰队(两形同读);部署姿态(单用户 / 多租)不改这一句(单用户形上的主体头同样是「这次请求为谁」)。
+ * 本函数是这条律的**唯一实施点**:声明位({@link ServiceConfig.serviceTokenActsForDeployment},env 一处)是这里的一个合取项,两个读者一次继承 ——
+ * fleet 调用方的凭据臂({@link sessionCallerOf})与 `/metrics` 族的 service 臂(`dispatch.ts`);不加拒码、不加闸点。自报位 `/health.auth.serviceTokenActsForDeployment`
+ * 投的是同一只读法({@link serviceTokenDeclaredActsForDeployment})与同一只武装谓词(`http/health-self-report.ts`)。先判声明与凭据、后取主体:`principal` 只在两者都成立时才求值(调用点那一次 {@link gatedPrincipal}),
+ * 没带凭据的请求不因主体头的形而改答。
  */
 export declare function actsForDeployment(req: IncomingMessage, config: ServiceConfig, principal: () => Principal | undefined): boolean;
+/**
+ * 声明位 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT` 的**唯一读法**:门({@link actsForDeployment})、自报位(`http/health-self-report.ts`)、起服行
+ * ({@link buildServiceTokenPostureNotice})三处都经它,不各写一份真值判断。只有字面 `true` 是「代部署本人」:`loadConfig` 恒写这一格(缺省 `true`),
+ * 绕过类型手搓的配置缺这一格 ⇒ 读作不代(fail-closed:安全轴上的缺席不静默放宽),三处同读 —— 不会出现「门收窄、自报位说缺席、起服行沉默」。
+ */
+export declare function serviceTokenDeclaredActsForDeployment(config: Pick<ServiceConfig, "serviceTokenActsForDeployment">): boolean;
 /**
  * 🔴 **「这个调用方是不是 fleet 调用方(看得到所有租户)」的唯一铸点**({@link SessionCaller}):验过的主体 + 是不是 fleet —— {@link devOpenDeployment} 上的任何
- * 调用方,或 {@link actsForDeployment}(出示 service 凭据、不报主体)。带主体头的是那位主体,不是 fleet;只读 trace token 不是 service 凭据;operator 不在这里
+ * 调用方,或 {@link actsForDeployment}(出示 service 凭据、不报主体,除非部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false`)。带主体头的是那位主体,不是 fleet;只读 trace token 不是 service 凭据;operator 不在这里
  * (运维口各自读 {@link explicitOperatorOk})。读者:会话行属主门(无主 placed 行的放行臂)与 fleet 面的 {@link fleetViewOf} —— 同一问一只读法。
  */
 export declare function sessionCallerOf(req: IncomingMessage, w: IdentityWiring): SessionCaller;
@@ -175,21 +186,22 @@ export type OperatorRoster = Pick<ServiceConfig, "operatorPrincipals" | "operato
  *  · 名单非空 ⇒ 验过的主体在名单里才是;
  *  · 单用户形显式声明 `OPERATOR_SINGLE_USER=true` ⇒ 这台部署的**每个调用方**都是(单用户形只有一位用户,能到这台部署的就是他;边界是部署自己的
  *    凭据门 —— 没配凭据的部署上,能连上端口的都是)。声明只在单用户形成立(起服不变量)。
- * `principal` 必须是验过的身份(`gatedPrincipal`),绝不是自述头。全部运维面(审批队列、steer.trusted、记忆运维口、bake 门……)读这一只;
+ * `principal` 必须是验过的身份(`gatedPrincipal`),绝不是自述头。全部运维面(审批队列、steer / interrupt / wake 的属主门旁路、记忆运维口、bake 门……)读这一只 —— 只答授权;
+ * 送话口的文本框架(`trusted`)从不读它(调用方的话恒 `trusted: false`,见 `routes/runs.ts` steer 口的注);
  * 🔴 SINGLE mint point (E1):不要再造兄弟。
  */
 export declare function explicitOperatorOk(principal: string | undefined, roster: OperatorRoster): boolean;
-/** 「这台部署**有没有**运维」的唯一读法(名单非空 ∨ 单用户声明在场)—— 能力事实 `operatorLane`、整理阀门的可达性告警、起服提示同读这一只。 */
+/** 「这台部署**有没有**运维」的唯一读法(名单非空 ∨ 单用户声明在场)—— 能力事实 `operatorLane` 读这一只(整理阀门的可达性告警随本条退役)。单用户形上,装了运维面的进程里它恒真(`operator-declaration-required`:服务进程起服第 1 段、`createHttpServer` 对不声明的单用户形拒),多租形上空名单 ⇒ 假。 */
 export declare function operatorRosterPresent(roster: OperatorRoster): boolean;
 /**
- * 起服提示([ref]):单用户形(`REQUIRE_PRINCIPAL` 未开)+ 没有运维名册 + 这台部署有审批底座 ⇒ 一行 warn。这一形在「空名单 = 人人是」那条读法退役之后
- * 丢的东西就是审批队列的运维视图(跨 scope 列表 / `?owner=` / 无主体调用方的整个队列),补回它只要一行配置 —— 不拒启:升级那一拍打掉一台今天跑得好好的
- * 单用户机器比一条提示重。多租形不提示(它另有拒启不变量);没有审批底座的形什么都没少。
+ * 起服一行:部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` ⇒ `service_token_posture { actsForDeployment: false }`(info);缺省不打。
+ * 声明形让运维面板开位当天成片 401,而「位关了」与「token 错了」在 wire 上同体(反探测律),这一行是起服时唯一一处说清这台部署选了哪一读法的地方。
+ * 不加逐请求事件(请求日志有 route / status,无凭据来源)。判据与字段单源在这里,装配处(`boot/stage-07-capability-layer.ts`)只调一次、原样打。
  */
-export declare function buildOperatorUndeclaredNotice(config: OperatorRoster & Pick<ServiceConfig, "requirePrincipal">, approvalFaceWired: boolean): {
-    event: "operator_undeclared_single_user";
+export declare function buildServiceTokenPostureNotice(config: Pick<ServiceConfig, "serviceTokenActsForDeployment">): {
+    event: "service_token_posture";
     fields: {
-        detail: string;
+        actsForDeployment: false;
     };
 } | undefined;
 /** operator 面族在「名单为空」这一形上的**唯一**拒发口:事实 `operatorLane`(`capability-facts.ts`)为假 ⇒ 这一面对任何

package/dist/http/principal-gate.js

@@ -1,6 +1,6 @@
 import { timingSafeEqual } from "node:crypto";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { PRINCIPAL_TOKEN_HEADER, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedPrincipalInc, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
+import { PRINCIPAL_TOKEN_HEADER, sameSessionOwner, verifiedPrincipal, ssoVerifiedPrincipal, ssoVerifiedPrincipalInc, ssoVerifiedScope, ownerlessRowOpen, mintPrincipal } from "../security.js";
 import { IDENTITY_SOURCES, runIdentityClaimOverflow } from "../identity-source.js";
 import { sendError } from "./send.js";
 export function headerStr(v) {
@@ -120,7 +120,7 @@ export function sendPrincipalRefusal(res, req, config) {
     sendError(res, 401, "auth.principal_required", `missing principal header '${config.principalHeader}'`);
 }
 export const UNAUTHORIZED_CREDENTIAL = "unauthorized — the request carries no credential this deployment accepts: send the deployment's service token as a Bearer token in the Authorization header (its operator set it as SERVICE_AUTH_TOKEN or SERVICE_AUTH_TOKENS; a sema-up deployment keeps SERVICE_AUTH_TOKEN in ~/.sema-up/<project>/.env on the machine that ran sema-up)";
-export const UNAUTHORIZED_OPERATOR = "unauthorized — this endpoint is for the deployment's operators and the request carries no operator credential: send the deployment's service token as a Bearer token in the Authorization header without a principal header (a service-token request that names a principal acts for that principal, not for the deployment), or a read-only token this endpoint accepts (METRICS_TOKEN for the metrics endpoints, TRACE_TOKEN for the task source summary)";
+export const UNAUTHORIZED_OPERATOR = "unauthorized — this endpoint is for the deployment's operators and the request carries no operator credential: send the deployment's service token as a Bearer token in the Authorization header without a principal header where this deployment lets its service token act for the deployment itself (GET /health reports it as auth.serviceTokenActsForDeployment; a service-token request that names a principal acts for that principal, not for the deployment), or a read-only token this endpoint accepts (METRICS_TOKEN for the metrics endpoints, TRACE_TOKEN for the task source summary)";
 export const UNAUTHORIZED_IDENTITY = "unauthorized — this endpoint acts for a named caller and the request carries no caller identity this deployment verifies: identify the caller the way this deployment does (a registry sign-in token as the Bearer token, a signed principal token on a direct-door deployment, or the principal header set by a trusted front end)";
 export function sendUnauthorized(res, face) {
     switch (face) {
@@ -139,15 +139,10 @@ export function sendUnauthorized(res, face) {
         }
     }
 }
-function sameIdentity(principal, owner) {
-    return principal === owner;
-}
 export function runOwnerReadable(principal, owner, config) {
     if (owner === null)
         return true;
-    if (principal !== undefined && sameIdentity(principal, owner))
-        return true;
-    return !DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(config) && owner === "anon:shell-live" && principal === undefined;
+    return sameSessionOwner(config, owner, principal ?? null);
 }
 export function hasServiceAuth(config) {
     return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
@@ -173,7 +168,10 @@ export function devOpenDeployment(w) {
     return wiredIdentitySources(w).length === 0 && !w.config.traceToken && !DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(w.config);
 }
 export function actsForDeployment(req, config, principal) {
-    return systemFor(req, config) !== undefined && principal() === undefined;
+    return serviceTokenDeclaredActsForDeployment(config) && systemFor(req, config) !== undefined && principal() === undefined;
+}
+export function serviceTokenDeclaredActsForDeployment(config) {
+    return config.serviceTokenActsForDeployment === true;
 }
 export function sessionCallerOf(req, w) {
     const principal = gatedPrincipal(req, w.config);
@@ -211,17 +209,10 @@ export function explicitOperatorOk(principal, roster) {
 export function operatorRosterPresent(roster) {
     return roster.operatorSingleUser === true || roster.operatorPrincipals.length > 0;
 }
-export function buildOperatorUndeclaredNotice(config, approvalFaceWired) {
-    if (config.requirePrincipal === true || operatorRosterPresent(config) || !approvalFaceWired)
+export function buildServiceTokenPostureNotice(config) {
+    if (serviceTokenDeclaredActsForDeployment(config))
         return undefined;
-    return {
-        event: "operator_undeclared_single_user",
-        fields: {
-            detail: "this single-user deployment declares no operator: OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not set, so no caller is an operator — " +
-                "GET /v1/approvals, its stream, /v1/assistant/inbox and /v1/assistant/tasks show each caller only its own pending approvals (a caller that sends no principal sees only the anonymous ones - the cards and tasks that were submitted without a principal - never a named principal's) and ignore ?owner=. " +
-                "To act as this deployment's operator, add one line: OPERATOR_SINGLE_USER=true",
-        },
-    };
+    return { event: "service_token_posture", fields: { actsForDeployment: false } };
 }
 export function sendOperatorPrincipalsRequired(res) {
     sendError(res, 501, "capability.operator_principals_required", `this endpoint is operator-only and this deployment has no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can be an operator; ${buildOperatorRosterWayOut()}`);

package/dist/http/request-guards.d.ts

@@ -1,5 +1,5 @@
 /**
- * 请求守门族([ref] 切片:`http/server.ts` 4837–5195 + `MAX_BODY` 逐字搬家,正文一字未改)。
+ * 请求守门族([ref] 切片:`http/server.ts` 4837–5195 逐字搬家,正文一字未改;JSON 体上限的数住叶子 `json-body-limit.ts`)。
  * 配额 / 租约 / 用量窗 / 限流 / owner-scope / 体读取 —— 每只守门的判据与它自己的头注原位随行。
  * ctx 字段 1 只(`deps`):本族对外围的耦合就这一格,它也是这一族的可测性读数。
  */
@@ -23,7 +23,7 @@ import { type SqlWallSource, type SqlWallsReading } from "../plugins/sql-driver.
  *
  * 🔴 **包墙腿是同一只规则的提前一跑,不是第二套规则**([ref] 主会话裁定):包墙是物理连接的事实(会话值,连接建立时从全局拷一份、此后不变),
  * 终判在将要执行写入的那条连接上 —— 那是库自己(续跑输入那一笔被拒 ⇒ 店的带码拒 ⇒ 同一个 413;会话日志那一笔走它既有的失败面);SQL 快照 blob 则由
- * `blob-backend.ts` 经 `connectJudged` 在写入连接上判。受理时手里没有那条连接,判官 `sqlWallsOf` 读的 `facts` 是池里**最近一次初始化**的那条连接的读数
+ * 店的 blob 索引(`stores-sql/blob-index-sql.ts`)经 `connectJudged` 在写入连接上判。受理时手里没有那条连接,判官 `sqlWallsOf` 读的 `facts` 是池里**最近一次初始化**的那条连接的读数
  * (`SqlDriver.facts`:池见过的最新读数,只在有连接初始化时才更新),同一个折算 `packetWallStatementBytes`:拒 ⇒ 413 在任何副作用之前;收 ⇒ 写入那条连接上的判决仍是终判。
  * 这个读数是**缓存**,DBA 调了全局值之后、下一条连接初始化之前,它与库此刻的值两个方向都可能不一致:调大 ⇒ 受理口仍按旧的小值拒(新墙本装得下的体也 413,
  * 直到有连接按新值初始化 —— 快照 blob 的旧连接自换就会带来一条);调小 ⇒ 受理口按旧的大值放行,写入那条连接上的库再拒(续跑输入那一笔 = 同一个 413)。

package/dist/http/request-guards.js

@@ -9,14 +9,14 @@ import { runRowReadable } from "./owner-access.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { quotaWindowResetsAt } from "../observability/cost-quota.js";
 import { escapedStatementBytes, packetWallStatementBytes, rowWallPayloadBytes } from "../plugins/sql-driver.js";
-const MAX_BODY = 8 * 1024 * 1024;
+import { MAX_JSON_BODY_BYTES } from "../json-body-limit.js";
 export function refuseSubmitBody(walls, body) {
     const rowWall = walls.maxRowBytes;
     const packetWall = walls.maxPacketBytes;
     const row = rowWall === null ? null : { wallBytes: rowWall, limitBytes: rowWallPayloadBytes(rowWall, "json") };
     const packet = packetWall === null ? null : { wallBytes: packetWall, limitBytes: packetWallStatementBytes(packetWall) };
-    const liveRow = row !== null && row.limitBytes < MAX_BODY ? row : null;
-    const livePacket = packet !== null && packet.limitBytes < 2 * MAX_BODY ? packet : null;
+    const liveRow = row !== null && row.limitBytes < MAX_JSON_BODY_BYTES ? row : null;
+    const livePacket = packet !== null && packet.limitBytes < 2 * MAX_JSON_BODY_BYTES ? packet : null;
     if (liveRow === null && livePacket === null)
         return null;
     const json = JSON.stringify(body);
@@ -228,8 +228,8 @@ export function createRequestGuards(ctx) {
         let size = 0;
         for await (const c of req) {
             size += c.length;
-            if (size > MAX_BODY)
-                throw bodyTooLargeError("request body too large", MAX_BODY);
+            if (size > MAX_JSON_BODY_BYTES)
+                throw bodyTooLargeError("request body too large", MAX_JSON_BODY_BYTES);
             chunks.push(c);
         }
         if (chunks.length === 0)