@sema-agent/server 7.147.0 → 7.149.0

package/dist/http/routes/capabilities.js

@@ -2,10 +2,10 @@ import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLev
 import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableAliasNames, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
-import { buildModelPlaneFace } from "../../model-plane-face.js";
-import { isRosterGateArmed } from "../../config.js";
+import { readModelPlaneFace } from "../../model-plane-face.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
+import { SESSION_READ_REDACTED_LEAVES } from "../../audit.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../../deployment-shape.js";
 import { taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
@@ -22,7 +22,7 @@ import { assertNever } from "../route-ctx.js";
 import { fileHistoryCaptureOf } from "../../file-history-capture.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { projectWriteProtectionCapability } from "../../write-protection.js";
-import { projectStoreCapability } from "../../store-posture.js";
+import { projectStoreCapability, unwiredStorePosture } from "../../store-posture.js";
 import { projectWebSearchCapability } from "../../plugins/web-search.js";
 import { projectExecutionLaneCapability } from "../../capabilities/execution-lane.js";
 import { SETTINGS_CONTRACT_CAPABILITY } from "../../capabilities/settings-contract.js";
@@ -35,7 +35,7 @@ import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
-import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, sendPrincipalRefusal } from "../principal-gate.js";
 import { readAdoptionImportCapability } from "../../adoption/import.js";
 import { headReadOf } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
@@ -79,10 +79,10 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const entitlementSource = centerEntitlementSourceWired(deps.config);
-            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, floor: autonomyModeFloor(deps.config.autonomy), principal: gatedPrincipal(req, deps.config), localDeny: deps.config.permissionsDisableAutoMode });
+            const { fault: autoModeFault, ...autoMode } = await judgeAutoModeArming(deps.autoModeFace, { requestedMode, floor: autonomyModeFloor(deps.config.autonomy), principal: gatedPerson(req, deps.config), localDeny: deps.config.permissionsDisableAutoMode });
             if (autoModeFault !== undefined)
                 deps.logger?.warn("auto_mode_face_resolver_fault", { fault: autoModeFault });
-            const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPrincipal(req, deps.config)).available;
+            const rulesLaneForCaller = facts.ruleLaneForCaller(deps, gatedPerson(req, deps.config)).available;
             const streamApprovalFact = facts.streamApproval(deps);
             sendJson(res, 200, gateCompositeMembers({
                 ...deps.capabilities,
@@ -113,8 +113,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 memory: false,
                 memoryWrite: false,
                 memoryEngine: projectMemoryEngineCapability(deps.memoryPosture),
-                store: projectStoreCapability(deps.storePosture ?? { declared: deps.config.dbBackend, backend: "memory" }, deps.sqlEngine?.facts),
-                centerWiring: deps.centerWiring?.(gatedPrincipal(req, deps.config)),
+                store: projectStoreCapability(deps.storePosture ?? unwiredStorePosture(deps.config.dbBackend), deps.sqlEngine?.facts),
+                centerWiring: deps.centerWiring?.(gatedPerson(req, deps.config)),
                 webSearch: projectWebSearchCapability(deps.webSearchProvider),
                 sessionBackgroundable: facts.durableRuns(deps).available,
                 runMemoryCaptureOptOut: facts.durableRuns(deps).available,
@@ -123,7 +123,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sharedMemory: facts.sharedMemoryRead(deps).available,
                 principalInboxDelivery: facts.principalInboxDelivery(deps).available,
                 adoption: facts.adoption(deps).available,
-                adoptionImport: await readAdoptionImportCapability(facts.adoptionSessionImport(deps), gatedPrincipal(req, deps.config), deps.config),
+                adoptionImport: await readAdoptionImportCapability(facts.adoptionSessionImport(deps), gatedPerson(req, deps.config), deps.config),
                 memoryBundle: facts.memoryBundle(deps).available,
                 memoryCompliance: facts.memoryCompliance(deps).available,
                 memoryOrigin: facts.memoryOrigin(deps).available,
@@ -203,12 +203,13 @@ export async function handleCapabilities(req, res, match, ctx) {
                 approvalDecidedVia: true,
                 planReviewCheckpointId: true,
                 permissionModes: [...PERMISSION_MODES],
-                sessionReadRedaction: true,
+                sessionReadRedaction: [...SESSION_READ_REDACTED_LEAVES],
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 projects: facts.projectRegistry(deps).available,
                 retention: retentionAdvertisement(deps.config),
                 peerLane: Boolean(deps.peerDirectory),
+                scenarioSubject: true,
                 sessionList: facts.sessionList(deps).available,
                 sessionSearch: facts.sessionList(deps).available,
                 sessionFork: facts.sessionFork(deps).available,
@@ -217,7 +218,6 @@ export async function handleCapabilities(req, res, match, ctx) {
                 promptSuggestions: true,
                 sessionPolicy: facts.sessionPolicy(deps).available,
                 sessionRulesNamespaceForms: sessionRulesNamespaceFormsHonored(),
-                rewindFiles: Boolean(deps.fileHistoryStore),
                 restoreFiles: Boolean(deps.fileHistoryStore),
                 rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
                 sessionRewindFiles: facts.sessionRewindFiles(deps).available,
@@ -254,7 +254,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             return;
         }
         case "capability-mcp": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
@@ -269,7 +269,7 @@ export async function handleCapabilities(req, res, match, ctx) {
             return;
         }
         case "capability-mcp-probe": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
@@ -299,11 +299,12 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 supportsThinkingOff: thinkingOffSpelled(m),
-                ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
+                ...(m.contextWindow ? { contextWindow: m.contextWindow, ...(Object.hasOwn(deps.config.contextWindowSources, name) ? { contextWindowSource: deps.config.contextWindowSources[name] } : {}) } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
                 ...(m.thinkingLevelMap !== undefined ? { thinkingLevelMap: m.thinkingLevelMap } : {}),
+                ...(m.defaultThinking !== undefined ? { defaultThinking: m.defaultThinking } : {}),
                 ...mentionBit(name),
                 routePairing: routePairingOf(deps, name, m),
             }));
@@ -316,11 +317,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) },
                 droppedEntries: buildDroppedEntriesWire(deps.config.droppedCatalogEntries),
                 ...(candidateRejection !== undefined ? { candidateRejected: buildCandidateRejectedWire(candidateRejection) } : {}),
-                modelPlane: buildModelPlaneFace(deps.config, {
-                    envTableIsPlaceholder: isRosterGateArmed(deps.config.webAdmin),
-                    candidateRejection,
-                    latestPlaneRefusal: deps.latestPlaneRefusalState?.(),
-                }),
+                modelPlane: readModelPlaneFace(deps.config, deps),
                 aliases: selectableAliasNames(deps.config.models, atCatalog, deps.config.modelRefusals).map((name) => ({ name, ...mentionBit(name) })),
             });
             return;

package/dist/http/routes/config-catalog.js

@@ -1,6 +1,6 @@
 import { DOMAINS } from "@sema-agent/settings-schema";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { configKnobTable } from "../../config.js";
@@ -11,7 +11,7 @@ export async function handleConfigCatalog(req, res, match, ctx) {
     const { deps } = ctx;
     switch (match.decl.id) {
         case "config-catalog": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;

package/dist/http/routes/devices.d.ts

@@ -11,12 +11,12 @@
  *   · 绑定读面在会话族:`GET /v1/sessions/:id/execution-placement`(`routes/sessions.ts`;体 = 执行放置格的 wire 投影,
  *     device 车道上是 `{ role: "writer", lane: "device", device: { deviceId, rev } }`)。绑定是根会话行上的执行格,读只有会话店的执行席一只。
  *   · `POST /v1/devices/sessions/:rootSessionId/rebind` —— 显式换绑动词(v2 稿 §2 门序五步):
- *     ① gatedPrincipal + owner 门 —— 一次行读(会话店执行席:住客 + 格),属主门判**格上**两属主列(非属主 404 反枚举同串,[ref] 纪律)
+ *     ① gatedPerson + owner 门 —— 一次行读(会话店执行席:住客 + 格),属主门判**格上**两属主列(非属主 404 反枚举同串,[ref] 纪律)
  *     ② 目标设备在场门(不存在 / 不是该域的 / 已吊销 ⇒ 404 **同串** —— 设备 id 也是不可枚举面)
  *     ③ 无活跃 run 门:池级 `getActiveTaskId` 读一次作**早拒**(零审计行);**保证**在设备店的换绑事务里 —— 同一连接先锁根会话行、
  *        再锁定读 `task_active`,有认领 ⇒ 不写(读写序律;hub 内存在途计数不作门 —— 内存态跨副本不可见);两处同拒 409
  *        `device.rebind_active_run` 体带 `activeTaskId`
- *     ③′ 子代半(写前一次观察):以根为根的活后台子代(running / parked;`probeSessionChildren` 那一次枚举,scope = 会话属主 `sessionChildrenScope`,
+ *     ③′ 子代半(写前一次观察):以根为根的活后台子代(running / parked;`probeSessionChildren` 那一次枚举,scope = 会话属主 `sessionTenantScope`,
  *        与删除门同读)⇒ 同码 409,体 `children`(名册 id)+ `retirePath`(显式结清口 —— 先结清、再换绑)
  *     ④ 前态 CAS(店内单事务:按门那一读的住客 ∧ 格上两属主列 ∧ rev 定址,`execution_rev` 恒变列 + `session_rebound` 审计行;输 = 409
  *        `device.rebind_rev_conflict` 体带 `currentRev` —— [ref] currentPending 哲学,壳一跳重定位;门后会话被删并同 id 重登记 ⇒ 住客不符 ⇒ 设备 404,
@@ -29,7 +29,7 @@
  * ── 调用方域(owner domain)的唯一铸造点 ─────────────────────────────────────────────────────────
  * device lane 的三表自持 O11 复合身份 `{owner_tenant, owner_subject}`(device-store.ts 头注;全局
  * principal 一个字节不动)。基线稿 §11-O11 的落法:「认证需在 SSO 校验点把 tenant+subject 传到 device
- * placement 校验腿」——对位到本仓的真源即:subject = `gatedPrincipal`(verified 链),tenant =
+ * placement 校验腿」——对位到本仓的真源即:subject = `gatedPerson`(verified 链),tenant =
  * `ssoVerifiedScope`(registry-JWT 的 `scope` claim,security.ts:同为签名真源、非自报头)。两者齐备
  * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
  * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的

package/dist/http/routes/devices.js

@@ -1,11 +1,11 @@
 import { sendError, sendJson } from "../send.js";
-import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { explicitOperatorOk, gatedPerson, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, isDeviceAbsolutePath, sameDeviceOwner, } from "../../device-store.js";
 import { boundDeviceOf } from "../../execution-placement.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
-import { probeSessionChildren, sessionChildrenScope } from "../../session-children-retire.js";
+import { probeSessionChildren, sessionTenantScope } from "../../session-children-retire.js";
 import { liveChildrenRefusal } from "./background.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
 import { deviceOwnerDomainOf } from "../execution-context.js";
@@ -123,7 +123,7 @@ export async function handleDevices(req, res, match, ctx) {
     }
     const { deps } = ctx;
     const { readJson, safeDecode } = ctx.helpers;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && principal === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
@@ -283,7 +283,7 @@ export async function handleDevices(req, res, match, ctx) {
         sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId });
         return;
     }
-    const tree = await probeSessionChildren({ agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry }, rootSessionId, sessionChildrenScope(placement.occupant.owner));
+    const tree = await probeSessionChildren({ agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry }, rootSessionId, sessionTenantScope(placement.occupant.owner));
     if (tree.liveChildren.length > 0) {
         sendError(res, 409, "device.rebind_active_run", "this session still has background agents running or waiting on an approval under it — rebinding now would leave them addressed at the old device; retire them (POST retirePath) or let them finish, then retry", liveChildrenRefusal(rootSessionId, tree.liveChildren));
         return;

package/dist/http/routes/diagnostics.d.ts

@@ -15,6 +15,7 @@ import type { WiringManifest } from "@sema-agent/core";
 import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../tool-approval.js";
 import { verifiedIdentitySource } from "../principal-gate.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+import { STORE_NOT_DURABLE_CODE, type StorePosture } from "../../store-posture.js";
 /** 流内审批门的读数形:上场即 `"active"`,否则是那**四**个合取项里**第一个**不满足的原因词
  *  (与 `resolveStreamApprovalGate` 同一闭集,词表**取型**自它 ⇒ 增删 reason 在此处自动跟随/编译红;
  *  [ref] 删掉第 5 项「账必须持久」时本行数字漏改过一次,**数字是手抄的那一半**)。 */
@@ -60,10 +61,11 @@ export interface ServerWiringGateInput {
  *  `resolveStreamApprovalGate` —— 与 `/v1/capabilities` 的 `streamApproval` 位、与回决口的 501 门同一个
  *  符号,所以诊断页读到的与消费端撞到的行为不可能不同。 */
 export declare function buildServerWiringGates(input: ServerWiringGateInput): ServerWiringGates;
-/** 启动自检的判决:`refusals` 非空 ⇒ 拒启(装配谎言);`warnings` ⇒ 留痕但放行。 */
+/** 启动自检的判决:`refusals` 非空 ⇒ 拒启(装配谎言 / 声明兑现不了);`warnings` ⇒ 留痕但放行。`refusalCode` present-iff 店持久性那一条拒了(抛出物带它,起服 fatal 标题带它)。 */
 export interface StaticWiringAudit {
     refusals: readonly string[];
     warnings: readonly string[];
+    refusalCode?: typeof STORE_NOT_DURABLE_CODE;
 }
 /** 自检输入 = core 的静态半场 + 我方装配现场的两件事实。 */
 export interface StaticWiringFacts {
@@ -71,9 +73,33 @@ export interface StaticWiringFacts {
     manifest: WiringManifest;
     /** 我方喂给 `resolveStreamApprovalGate` 的 `checkpointStore` 实参的在场性(= checkpoint 店在场 ∧ DURABLE_APPROVAL)。 */
     parkFacility: boolean;
-    /** store backend 的种类;`undefined` = env-only worker(无 backend)。 */
-    backendKind: "mysql" | "pg" | "local" | undefined;
+    /** 店的持久性装配值(`store-posture.ts`,`boot/stores.ts` 铸;caps / `/health` / 诊断同一只)。 */
+    store: StorePosture;
 }
+/**
+ * 三项对表(设计稿件二)。判据全是**两个独立谓词对同一件事的答案**,矛盾即装配谎言 —— 装配谎言不是
+ * 「配置不理想」,是「服务端对自己接了什么线的两套说法互斥」,继续启动只会把矛盾带进运行期的每一条腿。
+ *
+ *  ① park 设施:core 从 `spec.checkpointStore ?? deps.checkpointStore` 判 `parkLane.capable`,我方从
+ *     `backend.checkpoint ∧ DURABLE_APPROVAL` 判 `parkFacility` 并据此决定流内审批协议上不上场。两者
+ *     不等 ⇒ 协议按「窗到期能 park」上场而引擎侧根本不 park(结局是 core fail-closed deny),或反之
+ *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
+ *     park,窗到期依旧无降级目的地。
+ *  ② 会话店持久性:manifest 声明 `declared_durable`,而会话店的介质(店持久性判定里的**数据根**那一行:SQL 两方言 = 委托给库、local = 数据根所在挂载、
+ *     没有后端 = 内存)判为 `ephemeral` ⇒ 「替换后还在」的声明没有介质兑现 ⇒ 拒启 `config.store_not_durable`(拒句逐根列三根判定 + 三条出路)。
+ *     local 店的声明不是常量:它由 `local-store-declaration.ts` 的唯一读者定(运维声明 `LOCAL_STORE_DURABILITY=ephemeral`,或店落在调用方自己那块易失盘上 ⇒
+ *     会话店与检查点店两半一起声明 `process-local`)—— 那时清单读 `process_local`,本条恒过,改出 warn 一行(带依据与挂卷出路;同一件事 park 那条不再另说)。
+ *     介质判不出(`unknown`:非 Linux / 挂载表读不到 / 介质形不在规则表里)⇒ 只 warn —— 判不了的部署不能因自报位停机;
+ *     数据根持久而另两根(封签钥匙目录 / file 记忆根)易失或判不出 ⇒ 也只 warn:会话店的声明兑现了,掉的是停驻行的封签钥匙 / 记忆,不是会话(能力位如实报最弱)。
+ *     声明不是 `declared_durable` ⇒ 恒过。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。
+ *  ③ interaction posture 声明 `interactive` 却没有任何 question 投递面 ⇒ 只 **warn**:core 在 prepare 时
+ *     会按腿拒,boot 先一步把话说成人话。不拒启,因为部署形本身可能只是暂时没接活体面,而 core 侧已有
+ *     兜底门 —— 拒启会把一个可运行的部署挡在门外。
+ *  ④ park 车道的持久性读数不可信时 ⇒ **warn**(理由与这条判据为什么不是拒启,见其行内注)。
+ *
+ * 判决分两级是有判据的:**拒启**留给「两个谓词对同一件事互斥」(其中一个必错,继续跑就是带着谎言服务);
+ * **警告**留给「读数不可信/声明不完整」(信号本身还不足以断定谁错,据此拒启会挡住正常部署)。
+ */
 export declare function buildStaticWiringAudit(facts: StaticWiringFacts): StaticWiringAudit;
 /**
  * boot 消费口:`refusals` 非空即抛(拒启,与 memory+durable 两条既有拒启同族的 fail-loud 形),

package/dist/http/routes/diagnostics.js

@@ -4,9 +4,11 @@ import { projectExecutionLaneCapability } from "../../capabilities/execution-lan
 import { readOutboundWiring } from "../../outbound-dispatcher.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincipalsRequired, verifiedIdentitySource } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
+import { STORE_NOT_DURABLE_CODE, StoreNotDurableError, describeStoreRoot, projectStoreDurabilityWiring, unwiredStorePosture } from "../../store-posture.js";
+import { describeLocalStoreDeclaration } from "../../local-store-declaration.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
@@ -43,17 +45,18 @@ export function buildServerWiringGates(input) {
         approvalGrant: [...input.approvalGrant],
     };
 }
-function durableSessionMedium(kind) {
-    switch (kind) {
-        case "mysql":
-        case "pg":
-        case "local":
-            return true;
-        case undefined:
-            return false;
+function processLocalMediumSentence(dataRoot, aggregate, listed) {
+    const readFaces = `Store durability by root: ${listed}; GET /v1/capabilities store.durability and /health.store.durability say "${aggregate}" (the weakest root).`;
+    switch (dataRoot) {
+        case "ephemeral":
+            return `The data root's medium does not survive a replacement either — sessions and parked approvals on it go with the next replacement. ${readFaces}`;
+        case "durable":
+            return `The data root's medium measures durable today — the declaration is what this deployment promises, not what the disk does today. ${readFaces}`;
+        case "unknown":
+            return `This server could not prove whether the data root survives a replacement. ${readFaces}`;
         default: {
-            const unknownKind = kind;
-            throw new Error(`durableSessionMedium: no ruling for store backend kind ${JSON.stringify(unknownKind)}`);
+            const unhandled = dataRoot;
+            throw new Error(`unhandled store durability ${JSON.stringify(unhandled)}`);
         }
     }
 }
@@ -70,11 +73,37 @@ export function buildStaticWiringAudit(facts) {
         refusals.push(`park facility contradiction: this server assembled its approval gates with parkFacility=true, but the engine's static wiring resolves parkLane.effective=${JSON.stringify(park.effective)} (reasons: ${park.reasons.join(", ") || "none"}). ` +
             `A window expiry would then have no degradation target and adjudicate as a fail-closed deny — refusing to start.`);
     }
-    if (facts.manifest.session.store === "declared_durable" && !durableSessionMedium(facts.backendKind)) {
-        refusals.push(`session store durability contradiction: the engine's static wiring reports session.store="declared_durable" while the store backend is ${facts.backendKind === undefined ? "absent (env-only worker)" : `"${facts.backendKind}"`}. ` +
-            `A durable declaration with no durable medium is a claim nothing can honor — refusing to start. Wire DB_BACKEND=mysql|pg|local, or fix the store's durability declaration.`);
+    let refusalCode;
+    const roots = facts.store.roots;
+    const listed = roots.map((r) => `${describeStoreRoot(r)}`).join("; ");
+    const processLocalDeclaration = facts.store.localDeclaration?.durability === "process-local" ? facts.store.localDeclaration : undefined;
+    if (facts.manifest.session.store === "declared_durable") {
+        const session = roots.find((r) => r.root === "data");
+        if (session === undefined || session.verdict === "ephemeral") {
+            refusalCode = STORE_NOT_DURABLE_CODE;
+            const wayOut = session?.rule === "backend_memory" || session === undefined
+                ? `No store backend was assembled (env-only worker or a degraded boot) — wire DB_BACKEND=mysql|pg|local, or fix the session store's durability declaration.`
+                : `Three ways out: mount a persistent volume at ${session.path ?? "the data root"} (or point LOCAL_DATA_ROOT at one); or declare the local store ephemeral (LOCAL_STORE_DURABILITY=ephemeral — sessions, parked approvals and memory then do not survive a container / Pod replacement); or keep nothing on disk (DB_BACKEND=memory).`;
+            refusals.push(`${STORE_NOT_DURABLE_CODE}: the engine's static wiring reports session.store="declared_durable" while the session store's medium does not survive a container / Pod replacement (store durability by root: ${listed}). ` +
+                `A durable declaration on an ephemeral medium is a claim nothing can honor — sessions, parked approvals and memory would vanish with the next replacement while every read face said "durable". Refusing to start. ${wayOut}`);
+        }
+        else if (facts.store.durability !== "durable") {
+            warnings.push(`store durability is "${facts.store.durability}" (by root: ${listed}). ` +
+                (facts.store.durability === "unknown"
+                    ? `This server could not prove that every root survives a container / Pod replacement (no mount evidence for it — not Linux, an unreadable mount table, or a mount shape outside the rule table); GET /v1/capabilities store.durability and /health.store.durability say "unknown". `
+                    : `The session store's medium holds, but a root marked ephemeral does not survive a container / Pod replacement — mount a persistent volume there (SEALED_KEY_DIR / MEMORY_ENGINE_DIR name those directories). ` +
+                        `A sealing-key directory declared with SEALED_KEY_DIR on such a medium is refused at boot while parked approvals are durable (the parked rows would outlive the key their credentials are sealed to); ` +
+                        `the default <data root>/sealed-key and the file memory root are reported here, not refused. `) +
+                `Per-root detail: GET /v1/diagnostics/wiring storeDurability.roots.`);
+        }
+    }
+    else if (processLocalDeclaration !== undefined) {
+        const declaration = processLocalDeclaration;
+        warnings.push(`the local store declares itself process-local (${describeLocalStoreDeclaration(declaration)}): its session store and checkpoint store promise their rows survive a process restart, not a container / Pod replacement. ` +
+            `${processLocalMediumSentence(roots.find((r) => r.root === "data")?.verdict ?? "unknown", facts.store.durability, listed)} ` +
+            `To keep them across replacements, mount a persistent volume at each root above that does not read durable (LOCAL_DATA_ROOT / SEALED_KEY_DIR / MEMORY_ENGINE_DIR point the three roots at one)${declaration.rule === "declared_ephemeral" ? " and unset LOCAL_STORE_DURABILITY" : ""}.`);
     }
-    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
+    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable" && processLocalDeclaration === undefined) {
         warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +
             `(parkLane.checkpointDurability=${JSON.stringify(facts.manifest.parkLane.checkpointDurability ?? null)}). ` +
             `A parked approval survives a restart only on a durable store, and this reading folds "declared process-local" together with "declared nothing" — every in-tree adapter declares "durable", so a non-durable reading here means a store this build does not own. ` +
@@ -84,14 +113,15 @@ export function buildStaticWiringAudit(facts) {
         warnings.push(`interactionPosture declares "interactive" but no question delivery face is wired (question.wired=${JSON.stringify(facts.manifest.question.wired)}) — ` +
             `every leg that asks a question will be refused by the engine at prepare time. Wire the live question seam (ASK_QUESTION_ENABLED), or declare the headless posture.`);
     }
-    return { refusals, warnings };
+    return { refusals, warnings, ...(refusalCode !== undefined ? { refusalCode } : {}) };
 }
 export function assertStaticWiringConsistent(facts, logger) {
     const audit = buildStaticWiringAudit(facts);
     for (const w of audit.warnings)
         logger?.warn("wiring_static_warning", { detail: w });
     if (audit.refusals.length > 0) {
-        throw new Error(`static wiring self-check failed — refusing to start:\n${audit.refusals.map((r) => `  · ${r}`).join("\n")}`);
+        const text = `static wiring self-check failed — refusing to start:\n${audit.refusals.map((r) => `  · ${r}`).join("\n")}`;
+        throw audit.refusalCode !== undefined ? new StoreNotDurableError(text) : new Error(text);
     }
     return audit;
 }
@@ -106,7 +136,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config)) {
+            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config)) {
                 sendError(res, 403, "auth.operator_only", "wiring diagnostics are operator-only");
                 return;
             }
@@ -117,6 +147,7 @@ export async function handleDiagnostics(req, res, match, ctx) {
             sendJson(res, 200, {
                 static: deps.staticWiring,
                 memoryPosture: deps.memoryPosture ?? null,
+                storeDurability: projectStoreDurabilityWiring(deps.storePosture ?? unwiredStorePosture(deps.config.dbBackend)),
                 sqlEngine: deps.sqlEngine?.facts ?? null,
                 writeProtection: deps.writeProtection ?? null,
                 readFace: buildReadFaceWiring(deps.config),

package/dist/http/routes/engine.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError, sendHttpError, invalidJsonError } from "../send.js";
-import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { HANDOVER_REASONS } from "../../boot/engine-lease.js";
 import { assertNever } from "../route-ctx.js";
@@ -31,7 +31,7 @@ function sendHandoverUnavailable(res, why) {
 }
 export async function handleEngine(req, res, match, ctx) {
     const { deps } = ctx;
-    if (deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+    if (deps.config.requirePrincipal && gatedSubject(req, deps.config) === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }

package/dist/http/routes/fleet.js

@@ -2,7 +2,8 @@ import { hookNoticeWire } from "../../fleet/fleet-bus.js";
 import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTerminalWorkflowRows } from "../../fleet/fleet-terminal-window.js";
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
-import { fleetViewOf, gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
+import { routeListFilter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
@@ -14,8 +15,8 @@ export async function handleFleet(req, res, match, ctx) {
                 sendError(res, 501, "capability.self_orchestration_required", "fleet stream requires self-orchestration / fleet wiring");
                 return;
             }
-            const { fleetWide } = fleetViewOf(req, deps, "read");
-            const principal = gatedPrincipal(req, deps.config);
+            const { fleetWide } = routeListFilter(req, deps, match.decl.id);
+            const principal = gatedSubject(req, deps.config);
             if (deps.config.requirePrincipal && !principal && !fleetWide) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
@@ -48,6 +49,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             name: "rewrite", scope: "strip", sessionId: "strip",
             description: "scrub", agentType: "scrub", agentName: "scrub", currentAction: "scrub",
             currentTool: "scrub", transcriptId: "scrub", stoppedBy: "scrub", editedFiles: "scrub",
+            model: "scrub",
         };
         void SCOPED_TASK_KEY_DISPOSITION;
         const stripT = (r) => {

package/dist/http/routes/images.js

@@ -5,7 +5,7 @@ import { manifestToIndexEntry } from "../../images/manifest.js";
 import { validateBake, buildBakeArgv } from "../../images/bake-validate.js";
 import { streamSseLog } from "../sse-log.js";
 import { sendJson, sendError } from "../send.js";
-import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired } from "../principal-gate.js";
+import { headerStr, safeEqual, gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { idemCallerOf, idemKeyOf } from "../idempotency.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -48,7 +48,7 @@ export async function handleImages(req, res, match, ctx) {
     if (deps.imageBakes && isBakeRouteId(match.decl.id)) {
         const bakes = deps.imageBakes;
         const idx = deps.imageIndex;
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedPerson(req, deps.config);
         const isExplicitOperator = explicitOperatorOk(principal, deps.config);
         const operatorLane = facts.operatorLane(deps);
         const cfg = deps.config.imageBakes;
@@ -289,7 +289,7 @@ export async function handleImages(req, res, match, ctx) {
     const pool = facts.imagePool(deps);
     if (pool.available && isIndexRouteId(match.decl.id)) {
         const idx = pool.imageIndex;
-        const principal = gatedPrincipal(req, deps.config);
+        const principal = gatedPerson(req, deps.config);
         const operator = explicitOperatorOk(principal, deps.config);
         const viewer = { operator, tenantId: principal ?? null };
         const q = new URLSearchParams(match.search);
@@ -440,10 +440,13 @@ const BAKE_ROUTE_ID_SET = new Set(BAKE_ROUTE_IDS);
 const isBakeRouteId = (id) => BAKE_ROUTE_ID_SET.has(id);
 const isIndexRouteId = (id) => !BAKE_ROUTE_ID_SET.has(id);
 async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
+    const LOST = "lost";
     await streamSseLog(req, res, {
         statusOf: async (id) => {
             const bake = await bakes.getBake(id);
-            return bake ? { status: bake.status, updatedAt: bake.updatedAt } : undefined;
+            if (!bake)
+                return undefined;
+            return { status: bake.status === "running" && Date.now() - new Date(bake.updatedAt).getTime() > staleMs ? LOST : bake.status };
         },
         getEvents: (id, after) => bakes.getEvents(id, after),
         formatEvent: (ev) => ({
@@ -451,8 +454,9 @@ async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
             event: ev.kind,
             data: { kind: ev.kind, seq: ev.seq, ts: ev.ts, ...(ev.level ? { level: ev.level } : {}), ...(ev.data ?? {}) },
         }),
-        staleFrame: () => ({ event: "done", data: { kind: "done", status: "FAILED", error: "bake-runner lost (no heartbeat)", digest: null, indexId: null, repo: null, ref: null } }),
-    }, bakeId, staleMs);
+        isTerminalEvent: (ev) => ev.kind === "done",
+        closingFrameOf: (row, deliveredTerminal) => row.status === LOST && !deliveredTerminal ? { event: "done", data: { kind: "done", status: "FAILED", error: "bake-runner lost (no heartbeat)", digest: null, indexId: null, repo: null, ref: null } } : undefined,
+    }, bakeId);
 }
 function bakeView(b) {
     return {

package/dist/http/routes/leader.d.ts

@@ -1,9 +1,9 @@
 /**
  * [ref] A9 域模块 —— v2 leader 端点([ref])。
  *
- * 路由:`POST /v1/leader`(异步,形同 `/v1/runs`)· `GET /v1/leader/:id`。整域由 `deps.leaderEndpoint`
+ * 路由:`POST /v1/leader`(异步,形同 `/v1/runs`)· `GET /v1/leader/:id` · `POST /v1/leader/:id/cancel`(停止律与 run / bake 同一条,见 `leader/endpoint.ts` 头注)。整域由 `deps.leaderEndpoint`
  * 的存在与否开关;身份层与 `/v1/runs` 同款(BL-4:此前整条路跳过 authorize/requirePrincipal 且不记 owner,
- * 任何持服务令牌者能提交/读任意租户的 leader run),owner 用 crypto 验证过的 `gatedPrincipal`。本域零可变状态。
+ * 任何持服务令牌者能提交/读任意租户的 leader run),owner 用 crypto 验证过的 `gatedSubject`。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
@@ -27,6 +27,11 @@ export declare const LEADER_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/leader/:id";
     readonly methods: readonly ["GET"];
+}, {
+    readonly id: "leader-cancel";
+    readonly pattern: RegExp;
+    readonly label: "/v1/leader/:id/cancel";
+    readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
 export type LeaderRouteId = RouteIdsOf<typeof LEADER_ROUTES>;

package/dist/http/routes/leader.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, headerStr, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedSubject, headerStr, runIdentityOf, sendPrincipalRefusal } from "../principal-gate.js";
 import { idemCallerOf } from "../idempotency.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -10,6 +10,7 @@ export async function handleLeader(req, res, match, ctx) {
         case "leader-submit":
         case "leader-detail":
         case "leader-by-idem":
+        case "leader-cancel":
             break;
         default:
             return assertNever(match.decl.id);
@@ -22,7 +23,7 @@ export async function handleLeader(req, res, match, ctx) {
         return;
     }
     const endpoint = lane.endpoint;
-    if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
+    if (deps.config.requirePrincipal && !gatedSubject(req, deps.config)) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
@@ -36,7 +37,7 @@ export async function handleLeader(req, res, match, ctx) {
             sendError(res, 422, "request.autonomy_lane_refused", laneRefusal);
             return;
         }
-        const r = await endpoint.handle("POST", LEADER_SUBMIT_PATH, body, caller, headerStr(req.headers["idempotency-key"]) ?? null);
+        const r = await endpoint.handle("POST", LEADER_SUBMIT_PATH, body, caller, headerStr(req.headers["idempotency-key"]) ?? null, runIdentityOf(req, deps.config, caller.subject ?? null));
         if (r) {
             sendJson(res, r.status, r.body);
             return;
@@ -49,6 +50,13 @@ export async function handleLeader(req, res, match, ctx) {
             return;
         }
     }
+    else if (match.decl.id === "leader-cancel") {
+        const r = await endpoint.handle("POST", `${LEADER_SUBMIT_PATH}/${match.params.id}/cancel`, undefined, caller);
+        if (r) {
+            sendJson(res, r.status, r.body);
+            return;
+        }
+    }
     else {
         const r = await endpoint.handle("GET", `${LEADER_SUBMIT_PATH}/${match.params.id}`, undefined, caller);
         if (r) {
@@ -62,5 +70,6 @@ export const LEADER_ROUTES = [
     { id: "leader-submit", path: LEADER_SUBMIT_PATH, billable: "submit", methods: ["POST"] },
     { id: "leader-by-idem", path: LEADER_SUBMIT_PATH, methods: ["GET"] },
     { id: "leader-detail", pattern: /^\/v1\/leader\/(?<id>[^/]+)$/, label: "/v1/leader/:id", methods: ["GET"] },
+    { id: "leader-cancel", pattern: /^\/v1\/leader\/(?<id>[^/]+)\/cancel$/, label: "/v1/leader/:id/cancel", methods: ["POST"] },
 ];
 //# sourceMappingURL=leader.js.map

package/dist/http/routes/mcp-reconnect.d.ts

@@ -59,7 +59,7 @@
  * = 持久 run 账面 ∧ 会话属主面(两道 501 的同一批 deps 推导出来,「说 yes 但 501」结构上不可能)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 本面的三词闭集 —— **`unsupported` 是本仓的词**(core 的三词是 `reconnected`/`refused`/`not_declared`)。 */
 export type McpReconnectOutcome = "accepted" | "refused" | "unsupported";
 export declare function handleMcpReconnect(req: IncomingMessage, res: ServerResponse, match: RouteMatch<McpReconnectRouteId>, ctx: RouteCtx): Promise<void>;