@sema-agent/server 7.146.0 → 7.148.0

package/dist/http/routes/config-catalog.js

@@ -1,6 +1,6 @@
 import { DOMAINS } from "@sema-agent/settings-schema";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { configKnobTable } from "../../config.js";
@@ -11,7 +11,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "config-catalog": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;

package/dist/http/routes/devices.d.ts

@@ -11,12 +11,12 @@
  *   · 绑定读面在会话族:`GET /v1/sessions/:id/execution-placement`(`routes/sessions.ts`;体 = 执行放置格的 wire 投影,
  *     device 车道上是 `{ role: "writer", lane: "device", device: { deviceId, rev } }`)。绑定是根会话行上的执行格,读只有会话店的执行席一只。
  *   · `POST /v1/devices/sessions/:rootSessionId/rebind` —— 显式换绑动词(v2 稿 §2 门序五步):
- *     ① gatedPrincipal + owner 门 —— 一次行读(会话店执行席:住客 + 格),属主门判**格上**两属主列(非属主 404 反枚举同串,[ref] 纪律)
+ *     ① gatedPerson + owner 门 —— 一次行读(会话店执行席:住客 + 格),属主门判**格上**两属主列(非属主 404 反枚举同串,[ref] 纪律)
  *     ② 目标设备在场门(不存在 / 不是该域的 / 已吊销 ⇒ 404 **同串** —— 设备 id 也是不可枚举面)
  *     ③ 无活跃 run 门:池级 `getActiveTaskId` 读一次作**早拒**(零审计行);**保证**在设备店的换绑事务里 —— 同一连接先锁根会话行、
  *        再锁定读 `task_active`,有认领 ⇒ 不写(读写序律;hub 内存在途计数不作门 —— 内存态跨副本不可见);两处同拒 409
  *        `device.rebind_active_run` 体带 `activeTaskId`
- *     ③′ 子代半(写前一次观察):以根为根的活后台子代(running / parked;`probeSessionChildren` 那一次枚举,scope = 会话属主 `sessionChildrenScope`,
+ *     ③′ 子代半(写前一次观察):以根为根的活后台子代(running / parked;`probeSessionChildren` 那一次枚举,scope = 会话属主 `sessionTenantScope`,
  *        与删除门同读)⇒ 同码 409,体 `children`(名册 id)+ `retirePath`(显式结清口 —— 先结清、再换绑)
  *     ④ 前态 CAS(店内单事务:按门那一读的住客 ∧ 格上两属主列 ∧ rev 定址,`execution_rev` 恒变列 + `session_rebound` 审计行;输 = 409
  *        `device.rebind_rev_conflict` 体带 `currentRev` —— [ref] currentPending 哲学,壳一跳重定位;门后会话被删并同 id 重登记 ⇒ 住客不符 ⇒ 设备 404,
@@ -29,7 +29,7 @@
  * ── 调用方域(owner domain)的唯一铸造点 ─────────────────────────────────────────────────────────
  * device lane 的三表自持 O11 复合身份 `{owner_tenant, owner_subject}`(device-store.ts 头注;全局
  * principal 一个字节不动)。基线稿 §11-O11 的落法:「认证需在 SSO 校验点把 tenant+subject 传到 device
- * placement 校验腿」——对位到本仓的真源即:subject = `gatedPrincipal`(verified 链),tenant =
+ * placement 校验腿」——对位到本仓的真源即:subject = `gatedPerson`(verified 链),tenant =
  * `ssoVerifiedScope`(registry-JWT 的 `scope` claim,security.ts:同为签名真源、非自报头)。两者齐备
  * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
  * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的

package/dist/http/routes/devices.js

@@ -1,11 +1,11 @@
 import { sendError, sendJson } from "../send.js";
-import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { explicitOperatorOk, gatedPerson, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, isDeviceAbsolutePath, sameDeviceOwner, } from "../../device-store.js";
 import { boundDeviceOf } from "../../execution-placement.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
-import { probeSessionChildren, sessionChildrenScope } from "../../session-children-retire.js";
+import { probeSessionChildren, sessionTenantScope } from "../../session-children-retire.js";
 import { liveChildrenRefusal } from "./background.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../execution-context.js";
@@ -123,7 +123,7 @@ export async function handleDevices(req, res, match, ctx) {
     }
     const { deps } = ctx;
     const { readJson, safeDecode } = ctx.helpers;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && principal === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
@@ -163,7 +163,7 @@ export async function handleDevices(req, res, match, ctx) {
         }
         if ((await readClosedBody(req, res, readJson, [])) === null)
             return;
-        const ttlSeconds = (deps.config.remoteExec?.provider === "device" ? deps.config.remoteExec.enrollTokenTtlSec : undefined) ?? DEFAULT_ENROLL_TOKEN_TTL_SEC;
+        const ttlSeconds = (deps.config.remoteExec.provider === "device" ? deps.config.remoteExec.enrollTokenTtlSec : undefined) ?? DEFAULT_ENROLL_TOKEN_TTL_SEC;
         const issued = await enrollment.issueEnrollToken({ target: domain, createdBy: domain.subject, ttlSeconds });
         if (!issued.ok) {
             sendDeviceRejection(res, issued.reject);
@@ -283,7 +283,7 @@ export async function handleDevices(req, res, match, ctx) {
         sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId });
         return;
     }
-    const tree = await probeSessionChildren({ agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry }, rootSessionId, sessionChildrenScope(placement.occupant.owner));
+    const tree = await probeSessionChildren({ agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry }, rootSessionId, sessionTenantScope(placement.occupant.owner));
     if (tree.liveChildren.length > 0) {
         sendError(res, 409, "device.rebind_active_run", "this session still has background agents running or waiting on an approval under it — rebinding now would leave them addressed at the old device; retire them (POST retirePath) or let them finish, then retry", liveChildrenRefusal(rootSessionId, tree.liveChildren));
         return;

package/dist/http/routes/diagnostics.d.ts

@@ -15,6 +15,7 @@ import type { WiringManifest } from "@sema-agent/core";
 import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../tool-approval.js";
 import { verifiedIdentitySource } from "../principal-gate.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+import { STORE_NOT_DURABLE_CODE, type StorePosture } from "../../store-posture.js";
 /** 流内审批门的读数形:上场即 `"active"`,否则是那**四**个合取项里**第一个**不满足的原因词
  *  (与 `resolveStreamApprovalGate` 同一闭集,词表**取型**自它 ⇒ 增删 reason 在此处自动跟随/编译红;
  *  [ref] 删掉第 5 项「账必须持久」时本行数字漏改过一次,**数字是手抄的那一半**)。 */
@@ -60,10 +61,11 @@ export interface ServerWiringGateInput {
  *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个
  *  符号,所以诊断页读到的与消费端撞到的行为不可能不同。 */
 export declare function buildServerWiringGates(input: ServerWiringGateInput): ServerWiringGates;
-/** 启动自检的判决:`refusals` 非空 ⇒ 拒启(装配谎言);`warnings` ⇒ 留痕但放行。 */
+/** 启动自检的判决:`refusals` 非空 ⇒ 拒启(装配谎言 / 声明兑现不了);`warnings` ⇒ 留痕但放行。`refusalCode` present-iff 店持久性那一条拒了(抛出物带它,起服 fatal 标题带它)。 */
 export interface StaticWiringAudit {
     refusals: readonly string[];
     warnings: readonly string[];
+    refusalCode?: typeof STORE_NOT_DURABLE_CODE;
 }
 /** 自检输入 = core 的静态半场 + 我方装配现场的两件事实。 */
 export interface StaticWiringFacts {
@@ -71,9 +73,31 @@ export interface StaticWiringFacts {
     manifest: WiringManifest;
     /** 我方喂给 `resolveStreamApprovalGate` 的 `checkpointStore` 实参的在场性(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
     parkFacility: boolean;
-    /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
-    backendKind: "mysql" | "pg" | "local" | undefined;
+    /** 店的持久性装配值(`store-posture.ts`,`boot/stores.ts` 铸;caps / `/health` / 诊断同一只)。 */
+    store: StorePosture;
 }
+/**
+ * 三项对表(设计稿件二)。判据全是**两个独立谓词对同一件事的答案**,矛盾即装配谎言 —— 装配谎言不是
+ * 「配置不理想」,是「服务端对自己接了什么线的两套说法互斥」,继续启动只会把矛盾带进运行期的每一条腿。
+ *
+ *  ① park 设施:core 从 `spec.checkpointStore ?? deps.checkpointStore` 判 `parkLane.capable`,我方从
+ *     `backend.checkpoint ∧ DURABLE_APPROVAL` 判 `parkFacility` 并据此决定流内审批协议上不上场。两者
+ *     不等 ⇒ 协议按「窗到期能 park」上场而引擎侧根本不 park(结局是 core fail-closed deny),或反之
+ *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
+ *     park,窗到期依旧无降级目的地。
+ *  ② 会话店持久性:manifest 声明 `declared_durable`,而会话店的介质(店持久性判定里的**数据根**那一行:SQL 两方言 = 委托给库、local = 数据根所在挂载、
+ *     没有后端 = 内存)判为 `ephemeral` ⇒ 「替换后还在」的声明没有介质兑现 ⇒ 拒启 `config.store_not_durable`(拒句逐根列三根判定 + 两条出路)。
+ *     介质判不出(`unknown`:非 Linux / 挂载表读不到 / 介质形不在规则表里)⇒ 只 warn —— 判不了的部署不能因自报位停机;
+ *     数据根持久而另两根(封签钥匙目录 / file 记忆根)易失或判不出 ⇒ 也只 warn:会话店的声明兑现了,掉的是停驻行的封签钥匙 / 记忆,不是会话(能力位如实报最弱)。
+ *     声明不是 `declared_durable` ⇒ 恒过。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。
+ *  ③ interaction posture 声明 `interactive` 却没有任何 question 投递面 ⇒ 只 **warn**:core 在 prepare 时
+ *     会按腿拒,boot 先一步把话说成人话。不拒启,因为部署形本身可能只是暂时没接活体面,而 core 侧已有
+ *     兜底门 —— 拒启会把一个可运行的部署挡在门外。
+ *  ④ park 车道的持久性读数不可信时 ⇒ **warn**(理由与这条判据为什么不是拒启,见其行内注)。
+ *
+ * 判决分两级是有判据的:**拒启**留给「两个谓词对同一件事互斥」(其中一个必错,继续跑就是带着谎言服务);
+ * **警告**留给「读数不可信/声明不完整」(信号本身还不足以断定谁错,据此拒启会挡住正常部署)。
+ */
 export declare function buildStaticWiringAudit(facts: StaticWiringFacts): StaticWiringAudit;
 /**
  * boot 消费口:`refusals` 非空即抛(拒启,与 memory+durable 两条既有拒启同族的 fail-loud 形),

package/dist/http/routes/diagnostics.js

@@ -4,9 +4,10 @@ import { projectExecutionLaneCapability } from "../../capabilities/execution-lan
 import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
+import { STORE_NOT_DURABLE_CODE, StoreNotDurableError, describeStoreRoot, projectStoreDurabilityWiring, unwiredStorePosture } from "../../store-posture.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
@@ -43,20 +44,6 @@ export function buildServerWiringGates(input) {
         approvalGrant: [...input.approvalGrant],
     };
 }
-function durableSessionMedium(kind) {
-    switch (kind) {
-        case "mysql":
-        case "pg":
-        case "local":
-            return true;
-        case undefined:
-            return false;
-        default: {
-            const unknownKind = kind;
-            throw new Error(`durableSessionMedium: no ruling for store backend kind ${JSON.stringify(unknownKind)}`);
-        }
-    }
-}
 export function buildStaticWiringAudit(facts) {
     const refusals = [];
     const warnings = [];
@@ -70,9 +57,26 @@ export function buildStaticWiringAudit(facts) {
         refusals.push(`park facility contradiction: this server assembled its approval gates with parkFacility=true, but the engine's static wiring resolves parkLane.effective=${JSON.stringify(park.effective)} (reasons: ${park.reasons.join(", ") || "none"}). ` +
             `A window expiry would then have no degradation target and adjudicate as a fail-closed deny — refusing to start.`);
     }
-    if (facts.manifest.session.store === "declared_durable" && !durableSessionMedium(facts.backendKind)) {
-        refusals.push(`session store durability contradiction: the engine's static wiring reports session.store="declared_durable" while the store backend is ${facts.backendKind === undefined ? "absent (env-only worker)" : `"${facts.backendKind}"`}. ` +
-            `A durable declaration with no durable medium is a claim nothing can honor — refusing to start. Wire DB_BACKEND=mysql|pg|local, or fix the store's durability declaration.`);
+    let refusalCode;
+    if (facts.manifest.session.store === "declared_durable") {
+        const roots = facts.store.roots;
+        const session = roots.find((r) => r.root === "data");
+        const listed = roots.map((r) => `${describeStoreRoot(r)}`).join("; ");
+        if (session === undefined || session.verdict === "ephemeral") {
+            refusalCode = STORE_NOT_DURABLE_CODE;
+            const wayOut = session?.rule === "backend_memory" || session === undefined
+                ? `No store backend was assembled (env-only worker or a degraded boot) — wire DB_BACKEND=mysql|pg|local, or fix the session store's durability declaration.`
+                : `Two ways out: mount a persistent volume at ${session.path ?? "the data root"} (or point LOCAL_DATA_ROOT at one), or declare this deployment non-durable (DB_BACKEND=memory).`;
+            refusals.push(`${STORE_NOT_DURABLE_CODE}: the engine's static wiring reports session.store="declared_durable" while the session store's medium does not survive a container / Pod replacement (store durability by root: ${listed}). ` +
+                `A durable declaration on an ephemeral medium is a claim nothing can honor — sessions, parked approvals and memory would vanish with the next replacement while every read face said "durable". Refusing to start. ${wayOut}`);
+        }
+        else if (facts.store.durability !== "durable") {
+            warnings.push(`store durability is "${facts.store.durability}" (by root: ${listed}). ` +
+                (facts.store.durability === "unknown"
+                    ? `This server could not prove that every root survives a container / Pod replacement (no mount evidence for it — not Linux, an unreadable mount table, or a mount shape outside the rule table); GET /v1/capabilities store.durability and /health.store.durability say "unknown". `
+                    : `The session store's medium holds, but a root marked ephemeral does not survive a container / Pod replacement — mount a persistent volume there (SEALED_KEY_DIR / MEMORY_ENGINE_DIR name those directories). `) +
+                `Per-root detail: GET /v1/diagnostics/wiring storeDurability.roots.`);
+        }
     }
     if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
         warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +
@@ -84,14 +88,15 @@ export function buildStaticWiringAudit(facts) {
         warnings.push(`interactionPosture declares "interactive" but no question delivery face is wired (question.wired=${JSON.stringify(facts.manifest.question.wired)}) — ` +
             `every leg that asks a question will be refused by the engine at prepare time. Wire the live question seam (ASK_QUESTION_ENABLED), or declare the headless posture.`);
     }
-    return { refusals, warnings };
+    return { refusals, warnings, ...(refusalCode !== undefined ? { refusalCode } : {}) };
 }
 export function assertStaticWiringConsistent(facts, logger) {
     const audit = buildStaticWiringAudit(facts);
     for (const w of audit.warnings)
         logger?.warn("wiring_static_warning", { detail: w });
     if (audit.refusals.length > 0) {
-        throw new Error(`static wiring self-check failed — refusing to start:\n${audit.refusals.map((r) => `  · ${r}`).join("\n")}`);
+        const text = `static wiring self-check failed — refusing to start:\n${audit.refusals.map((r) => `  · ${r}`).join("\n")}`;
+        throw audit.refusalCode !== undefined ? new StoreNotDurableError(text) : new Error(text);
     }
     return audit;
 }
@@ -106,7 +111,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config)) {
+            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config)) {
                 sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only");
                 return;
             }
@@ -117,6 +122,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
             sendJson(res, 200, {
                 static: deps.staticWiring,
                 memoryPosture: deps.memoryPosture ?? null,
+                storeDurability: projectStoreDurabilityWiring(deps.storePosture ?? unwiredStorePosture(deps.config.dbBackend)),
                 sqlEngine: deps.sqlEngine?.facts ?? null,
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),

package/dist/http/routes/engine.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError, sendHttpError, invalidJsonError } from "../send.js";
-import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { HANDOVER_REASONS } from "../../boot/engine-lease.js";
 import { assertNever } from "../route-ctx.js";
@@ -31,7 +31,7 @@ function sendHandoverUnavailable(res, why) {
 }
 export async function handleEngine(req, res, match, ctx) {
     const { deps } = ctx;
-    if (deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+    if (deps.config.requirePrincipal && gatedSubject(req, deps.config) === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }

package/dist/http/routes/fleet.js

@@ -2,7 +2,8 @@ import { hookNoticeWire } from "../../fleet/fleet-bus.js";
 import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTerminalWorkflowRows } from "../../fleet/fleet-terminal-window.js";
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { fleetViewOf, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
+import { routeListFilter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
@@ -14,8 +15,8 @@ export async function handleFleet(req, res, match, ctx) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
-            const { fleetWide } = fleetViewOf(req, deps, "read");
-            const principal = gatedPrincipal(req, deps.config);
+            const { fleetWide } = routeListFilter(req, deps, match.decl.id);
+            const principal = gatedSubject(req, deps.config);
             if (deps.config.requirePrincipal && !principal && !fleetWide) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
@@ -48,6 +49,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             name: "rewrite", scope: "strip", sessionId: "strip",
             description: "scrub", agentType: "scrub", agentName: "scrub", currentAction: "scrub",
             currentTool: "scrub", transcriptId: "scrub", stoppedBy: "scrub", editedFiles: "scrub",
+            model: "scrub",
         };
         void SCOPED_TASK_KEY_DISPOSITION;
         const stripT = (r) => {

package/dist/http/routes/images.js

@@ -5,7 +5,7 @@ import { manifestToIndexEntry } from "../../images/manifest.js";
 import { validateBake, buildBakeArgv } from "../../images/bake-validate.js";
 import { streamSseLog } from "../sse-log.js";
 import { sendJson, sendError } from "../send.js";
-import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired } from "../principal-gate.js";
+import { headerStr, safeEqual, gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { idemCallerOf, idemKeyOf } from "../idempotency.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -48,7 +48,7 @@ export async function handleImages(req, res, match, ctx) {
     if (deps.imageBakes && isBakeRouteId(match.decl.id)) {
         const bakes = deps.imageBakes;
         const idx = deps.imageIndex;
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedPerson(req, deps.config);
         const isExplicitOperator = explicitOperatorOk(principal, deps.config);
         const operatorLane = facts.operatorLane(deps);
         const cfg = deps.config.imageBakes;
@@ -289,7 +289,7 @@ export async function handleImages(req, res, match, ctx) {
     const pool = facts.imagePool(deps);
     if (pool.available && isIndexRouteId(match.decl.id)) {
         const idx = pool.imageIndex;
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedPerson(req, deps.config);
         const operator = explicitOperatorOk(principal, deps.config);
         const viewer = { operator, tenantId: principal ?? null };
         const q = new URLSearchParams(match.search);
@@ -440,10 +440,13 @@ const BAKE_ROUTE_ID_SET = new Set(BAKE_ROUTE_IDS);
 const isBakeRouteId = (id) => BAKE_ROUTE_ID_SET.has(id);
 const isIndexRouteId = (id) => !BAKE_ROUTE_ID_SET.has(id);
 async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
+    const LOST = "lost";
     await streamSseLog(req, res, {
         statusOf: async (id) => {
             const bake = await bakes.getBake(id);
-            return bake ? { status: bake.status, updatedAt: bake.updatedAt } : undefined;
+            if (!bake)
+                return undefined;
+            return { status: bake.status === "running" && Date.now() - new Date(bake.updatedAt).getTime() > staleMs ? LOST : bake.status };
         },
         getEvents: (id, after) => bakes.getEvents(id, after),
         formatEvent: (ev) => ({
@@ -451,8 +454,9 @@ async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
             event: ev.kind,
             data: { kind: ev.kind, seq: ev.seq, ts: ev.ts, ...(ev.level ? { level: ev.level } : {}), ...(ev.data ?? {}) },
         }),
-        staleFrame: () => ({ event: "done", data: { kind: "done", status: "FAILED", error: "bake-runner lost (no heartbeat)", digest: null, indexId: null, repo: null, ref: null } }),
-    }, bakeId, staleMs);
+        isTerminalEvent: (ev) => ev.kind === "done",
+        closingFrameOf: (row, deliveredTerminal) => row.status === LOST && !deliveredTerminal ? { event: "done", data: { kind: "done", status: "FAILED", error: "bake-runner lost (no heartbeat)", digest: null, indexId: null, repo: null, ref: null } } : undefined,
+    }, bakeId);
 }
 function bakeView(b) {
     return {

package/dist/http/routes/leader.d.ts

@@ -1,9 +1,9 @@
 /**
  * [ref] A9 域模块 —— v2 leader 端点([ref])。
  *
- * 路由:`POST /v1/leader`(异步,形同 `/v1/runs`)· `GET /v1/leader/:id`。整域由 `deps.leaderEndpoint`
+ * 路由:`POST /v1/leader`(异步,形同 `/v1/runs`)· `GET /v1/leader/:id` · `POST /v1/leader/:id/cancel`(停止律与 run / bake 同一条,见 `leader/endpoint.ts` 头注)。整域由 `deps.leaderEndpoint`
  * 的存在与否开关;身份层与 `/v1/runs` 同款(BL-4:此前整条路跳过 authorize/requirePrincipal 且不记 owner,
- * 任何持服务令牌者能提交/读任意租户的 leader run),owner 用 crypto 验证过的 `gatedPrincipal`。本域零可变状态。
+ * 任何持服务令牌者能提交/读任意租户的 leader run),owner 用 crypto 验证过的 `gatedSubject`。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
@@ -27,6 +27,11 @@ export declare const LEADER_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/leader/:id";
     readonly methods: readonly ["GET"];
+}, {
+    readonly id: "leader-cancel";
+    readonly pattern: RegExp;
+    readonly label: "/v1/leader/:id/cancel";
+    readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
 export type LeaderRouteId = RouteIdsOf<typeof LEADER_ROUTES>;

package/dist/http/routes/leader.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, headerStr, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedSubject, headerStr, runIdentityOf, sendPrincipalRefusal } from "../principal-gate.js";
 import { idemCallerOf } from "../idempotency.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -10,6 +10,7 @@ export async function handleLeader(req, res, match, ctx) {
         case "leader-submit":
         case "leader-detail":
         case "leader-by-idem":
+        case "leader-cancel":
             break;
         default:
             return assertNever(match.decl.id);
@@ -22,7 +23,7 @@ export async function handleLeader(req, res, match, ctx) {
         return;
     }
     const endpoint = lane.endpoint;
-    if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
+    if (deps.config.requirePrincipal && !gatedSubject(req, deps.config)) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
@@ -36,7 +37,7 @@ export async function handleLeader(req, res, match, ctx) {
             sendError(res, 422, "request.autonomy_lane_refused", laneRefusal);
             return;
         }
-        const r = await endpoint.handle("POST", LEADER_SUBMIT_PATH, body, caller, headerStr(req.headers["idempotency-key"]) ?? null);
+        const r = await endpoint.handle("POST", LEADER_SUBMIT_PATH, body, caller, headerStr(req.headers["idempotency-key"]) ?? null, runIdentityOf(req, deps.config, caller.subject ?? null));
         if (r) {
             sendJson(res, r.status, r.body);
             return;
@@ -49,6 +50,13 @@ export async function handleLeader(req, res, match, ctx) {
             return;
         }
     }
+    else if (match.decl.id === "leader-cancel") {
+        const r = await endpoint.handle("POST", `${LEADER_SUBMIT_PATH}/${match.params.id}/cancel`, undefined, caller);
+        if (r) {
+            sendJson(res, r.status, r.body);
+            return;
+        }
+    }
     else {
         const r = await endpoint.handle("GET", `${LEADER_SUBMIT_PATH}/${match.params.id}`, undefined, caller);
         if (r) {
@@ -62,5 +70,6 @@ export const LEADER_ROUTES = [
     { id: "leader-submit", path: LEADER_SUBMIT_PATH, billable: "submit", methods: ["POST"] },
     { id: "leader-by-idem", path: LEADER_SUBMIT_PATH, methods: ["GET"] },
     { id: "leader-detail", pattern: /^\/v1\/leader\/(?<id>[^/]+)$/, label: "/v1/leader/:id", methods: ["GET"] },
+    { id: "leader-cancel", pattern: /^\/v1\/leader\/(?<id>[^/]+)\/cancel$/, label: "/v1/leader/:id/cancel", methods: ["POST"] },
 ];
 //# sourceMappingURL=leader.js.map

package/dist/http/routes/mcp-reconnect.d.ts

@@ -59,7 +59,7 @@
  * = 持久 run 账面 ∧ 会话属主面(两道 501 的同一批 deps 推导出来,「说 yes 但 501」结构上不可能)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 本面的三词闭集 —— **`unsupported` 是本仓的词**(core 的三词是 `reconnected`/`refused`/`not_declared`)。 */
 export type McpReconnectOutcome = "accepted" | "refused" | "unsupported";
 export declare function handleMcpReconnect(req: IncomingMessage, res: ServerResponse, match: RouteMatch<McpReconnectRouteId>, ctx: RouteCtx): Promise<void>;

package/dist/http/routes/mcp-reconnect.js

@@ -2,11 +2,9 @@ import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
-import {} from "../route-ctx.js";
-import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import { admitSessionById, enter } from "../owner-access.js";
+import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { sessionOwnerCellOf } from "../../security.js";
 import { seatText } from "../../trace/exit-seat.js";
 import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
@@ -73,11 +71,9 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 }
             }
             const { runStore, sessionStorage } = fact;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendPrincipalRefusal(res, req, deps.config);
+            const entry = enter(req, res, deps, match.decl.id);
+            if (entry === undefined)
                 return;
-            }
             const parsed = BodySchema.safeParse((await ctx.helpers.readJson(req)) ?? {});
             if (!parsed.success) {
                 sendError(res, 400, "request.body_shape", "body must be { server: string (non-empty, at most 190 characters) } — one NAMED MCP server, required; there is no all-servers form (re-dialing every server would CLOSE the healthy ones, and a stdio server that owns a device cannot be re-dialed while the old connection still holds it)");
@@ -89,14 +85,10 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const owner = (await sessionStorage.headOf(sessionId))?.owner;
-            if (owner === undefined) {
-                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                return;
-            }
-            const operator = explicitOperatorOk(principal, deps.config);
-            if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(sessionStorage, sessionId, owner)))
+            const admitted = await admitSessionById(entry, res, sessionStorage, sessionId);
+            if (admitted === undefined)
                 return;
+            const owner = admitted.row.owner;
             const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {

package/dist/http/routes/memory-bundle.js

@@ -1,11 +1,10 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
-import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { sentMemoryFaceFault } from "../memory-face-fault-reply.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_BUNDLE_EXPORT_PATH = "/v1/memory/export";
 export const MEMORY_BUNDLE_IMPORT_PATH = "/v1/memory/import";
@@ -36,15 +35,13 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+    if (sentMemoryFaceFault(res, err, { kind: "operator" }))
         return true;
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
     if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
-    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
-        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }
@@ -69,7 +66,7 @@ export function buildImportReportWire(r) {
 }
 export async function handleMemoryBundle(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;

package/dist/http/routes/memory-compliance.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
-import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { readLayerSeat, sentMemoryFaceFault } from "../memory-face-fault-reply.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_ERASE_PATH = "/v1/memory/erase";
@@ -13,7 +13,7 @@ const EraseRequestSchema = z.object({
     allowUnevidenced: z.boolean().optional(),
 });
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+    if (sentMemoryFaceFault(res, err, { kind: "operator" }))
         return true;
     if (sentMemoryComplianceFailure(res, err, { kind: "operator" }, ctx.deps.logger))
         return true;
@@ -22,7 +22,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
 }
 export async function handleMemoryCompliance(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;

package/dist/http/routes/memory-consolidation.js

@@ -1,8 +1,7 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
-import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
-import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
+import { sentMemoryFaceFault } from "../memory-face-fault-reply.js";
+import { gatedPerson, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_CONSOLIDATION_STATUS_PATH = "/v1/admin/memory/consolidation";
@@ -74,7 +73,7 @@ function codeOf(err) {
 }
 export async function handleMemoryConsolidation(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
@@ -107,7 +106,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                 row = scope !== undefined ? await faces.lastRun(scope) : undefined;
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+                if (sentMemoryFaceFault(res, err, { kind: "operator" }))
                     return;
                 throw err;
             }
@@ -149,19 +148,17 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                 }
             }
             try {
-                const r = await faces.run(decided.scope);
+                const r = await faces.run(decided.scope, principal);
                 sendJson(res, 200, buildRunSummary(r));
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+                if (sentMemoryFaceFault(res, err, { kind: "operator" }))
                     return;
                 const coreCode = codeOf(err);
                 if (coreCode !== undefined) {
                     sendError(res, 409, "memory.consolidation_refused", `memory consolidation refused (${coreCode}): ${err instanceof Error ? err.message : String(err)}`);
                     return;
                 }
-                if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
-                    return;
                 ctx.deps.logger?.warn?.("memory_consolidation_run_failed", { scope: decided.scope, err: String(err) });
                 sendError(res, 500, "internal.error", "memory consolidation run failed");
             }

package/dist/http/routes/memory-origin.d.ts

@@ -87,12 +87,14 @@ export declare const MEMORY_ORIGIN_CLEARANCES_PATH = "/v1/memory/origin/clearanc
  *
  * 被剥的 core 键**只有一个**:`entryText`(完整正文托管字节),而且**剥了要说** —— `custodyBytes` 是它
  * 留在审计面上的那句披露(0 = 这行没揣着字节;>0 = 崩溃恢复席里还有一条记忆的正文,pending 行要人处置)。
+ * `custodyErased: true`(core 7.66.0 [ref])= 这行的托管被一次擦除取走了(此时 `custodyBytes` 恒 0,该清标不再能续)。
  * 嵌套的 `origin` 不是「被剥」而是**被深投影**(三键之外的成员剥值留名,见 {@link buildOriginWire})。
  * 🔴 **不要**给这个函数标 `: Record<string, unknown>` 返回型:那会让 `keyof ReturnType<…>` 塌成 `string`,
  * 编译期差集门当场变成恒真(vacuous)—— `buildImportReportWire` 的头注里踩过这个坑,而本车在 `origin`
  * 那只投影上**又踩了一次**(标了具体返回型,门读标注不读字面量),所以这条钉现在有两处案底。
  */
 export declare function buildClearanceRowWire(r: OriginClearanceRow): {
+    custodyErased?: true | undefined;
     events: {
         detail?: string | undefined;
         eventId: string;
@@ -105,7 +107,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "done" | "failed" | "pending";
+    status: "done" | "pending" | "failed";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;