@sema-agent/server 7.147.0 → 7.149.0

package/dist/http/routes/mcp-reconnect.js

@@ -2,11 +2,9 @@ import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
-import {} from "../route-ctx.js";
-import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import { admitSessionById, enter } from "../owner-access.js";
+import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { sessionOwnerCellOf } from "../../security.js";
 import { seatText } from "../../trace/exit-seat.js";
 import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
@@ -73,11 +71,9 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 }
             }
             const { runStore, sessionStorage } = fact;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendPrincipalRefusal(res, req, deps.config);
+            const entry = enter(req, res, deps, match.decl.id);
+            if (entry === undefined)
                 return;
-            }
             const parsed = BodySchema.safeParse((await ctx.helpers.readJson(req)) ?? {});
             if (!parsed.success) {
                 sendError(res, 400, "request.body_shape", "body must be { server: string (non-empty, at most 190 characters) } — one NAMED MCP server, required; there is no all-servers form (re-dialing every server would CLOSE the healthy ones, and a stdio server that owns a device cannot be re-dialed while the old connection still holds it)");
@@ -89,14 +85,10 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const owner = (await sessionStorage.headOf(sessionId))?.owner;
-            if (owner === undefined) {
-                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                return;
-            }
-            const operator = explicitOperatorOk(principal, deps.config);
-            if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(sessionStorage, sessionId, owner)))
+            const admitted = await admitSessionById(entry, res, sessionStorage, sessionId);
+            if (admitted === undefined)
                 return;
+            const owner = admitted.row.owner;
             const activeTaskId = await runStore.getActiveTaskId(sessionId);
             const live = activeTaskId === undefined ? undefined : ctx.registry.steerableRuns.get(activeTaskId);
             if (live) {

package/dist/http/routes/memory-bundle.js

@@ -1,11 +1,10 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
-import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFencedBundle, readOriginAware } from "../../memory-origin-fence.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { sentMemoryFaceFault } from "../memory-face-fault-reply.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_BUNDLE_EXPORT_PATH = "/v1/memory/export";
 export const MEMORY_BUNDLE_IMPORT_PATH = "/v1/memory/import";
@@ -36,15 +35,13 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+    if (sentMemoryFaceFault(res, err, { kind: "operator" }))
         return true;
     const code = codeOf(err);
     if (code !== undefined && sentCoreCode(res, code, err instanceof Error ? err.message : String(err)))
         return true;
     if (sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
-    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
-        return true;
     ctx.deps.logger?.warn?.(`memory_bundle_${face}_failed`, { err: String(err) });
     return false;
 }
@@ -69,7 +66,7 @@ export function buildImportReportWire(r) {
 }
 export async function handleMemoryBundle(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;

package/dist/http/routes/memory-compliance.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
-import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { readLayerSeat, sentMemoryFaceFault } from "../memory-face-fault-reply.js";
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_ERASE_PATH = "/v1/memory/erase";
@@ -13,7 +13,7 @@ const EraseRequestSchema = z.object({
     allowUnevidenced: z.boolean().optional(),
 });
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+    if (sentMemoryFaceFault(res, err, { kind: "operator" }))
         return true;
     if (sentMemoryComplianceFailure(res, err, { kind: "operator" }, ctx.deps.logger))
         return true;
@@ -22,7 +22,7 @@ function sentClassifiedFailure(res, ctx, face, err) {
 }
 export async function handleMemoryCompliance(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;

package/dist/http/routes/memory-consolidation.js

@@ -1,8 +1,7 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
-import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
-import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
+import { sentMemoryFaceFault } from "../memory-face-fault-reply.js";
+import { gatedPerson, explicitOperatorOk, sendPrincipalRefusal, sendOperatorPrincipalsRequired } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_CONSOLIDATION_STATUS_PATH = "/v1/admin/memory/consolidation";
@@ -74,7 +73,7 @@ function codeOf(err) {
 }
 export async function handleMemoryConsolidation(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
@@ -107,7 +106,7 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                 row = scope !== undefined ? await faces.lastRun(scope) : undefined;
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+                if (sentMemoryFaceFault(res, err, { kind: "operator" }))
                     return;
                 throw err;
             }
@@ -149,19 +148,17 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                 }
             }
             try {
-                const r = await faces.run(decided.scope);
+                const r = await faces.run(decided.scope, principal);
                 sendJson(res, 200, buildRunSummary(r));
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+                if (sentMemoryFaceFault(res, err, { kind: "operator" }))
                     return;
                 const coreCode = codeOf(err);
                 if (coreCode !== undefined) {
                     sendError(res, 409, "memory.consolidation_refused", `memory consolidation refused (${coreCode}): ${err instanceof Error ? err.message : String(err)}`);
                     return;
                 }
-                if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
-                    return;
                 ctx.deps.logger?.warn?.("memory_consolidation_run_failed", { scope: decided.scope, err: String(err) });
                 sendError(res, 500, "internal.error", "memory consolidation run failed");
             }

package/dist/http/routes/memory-origin.d.ts

@@ -87,12 +87,14 @@ export declare const MEMORY_ORIGIN_CLEARANCES_PATH = "/v1/memory/origin/clearanc
  *
  * 被剥的 core 键**只有一个**:`entryText`(完整正文托管字节),而且**剥了要说** —— `custodyBytes` 是它
  * 留在审计面上的那句披露(0 = 这行没揣着字节;>0 = 崩溃恢复席里还有一条记忆的正文,pending 行要人处置)。
+ * `custodyErased: true`(core 7.66.0 [ref])= 这行的托管被一次擦除取走了(此时 `custodyBytes` 恒 0,该清标不再能续)。
  * 嵌套的 `origin` 不是「被剥」而是**被深投影**(三键之外的成员剥值留名,见 {@link buildOriginWire})。
  * 🔴 **不要**给这个函数标 `: Record<string, unknown>` 返回型:那会让 `keyof ReturnType<…>` 塌成 `string`,
  * 编译期差集门当场变成恒真(vacuous)—— `buildImportReportWire` 的头注里踩过这个坑,而本车在 `origin`
  * 那只投影上**又踩了一次**(标了具体返回型,门读标注不读字面量),所以这条钉现在有两处案底。
  */
 export declare function buildClearanceRowWire(r: OriginClearanceRow): {
+    custodyErased?: true | undefined;
     events: {
         detail?: string | undefined;
         eventId: string;

package/dist/http/routes/memory-origin.js

@@ -1,10 +1,9 @@
 import { z } from "zod";
 import { sendJson, sendError } from "../send.js";
 import { sentMemoryStoreRefusal } from "../memory-store-refusal-reply.js";
-import { sentControlPlaneCorrupt } from "../memory-control-plane-corrupt-reply.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
-import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { readLayerSeat, sentMemoryFaceFault } from "../memory-face-fault-reply.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
@@ -50,7 +49,7 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
-    if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+    if (sentMemoryFaceFault(res, err, { kind: "operator" }))
         return true;
     if (face === "clear") {
         const coreCode = codeOf(err);
@@ -59,8 +58,6 @@ function sentClassifiedFailure(res, ctx, face, err) {
     }
     if (face !== "clearances" && sentMemoryStoreRefusal(res, err, ctx.deps.logger))
         return true;
-    if (sentControlPlaneCorrupt(res, err, { kind: "operator" }))
-        return true;
     ctx.deps.logger?.warn?.(`memory_origin_${face}_failed`, { err: String(err) });
     return false;
 }
@@ -98,6 +95,7 @@ export function buildClearanceRowWire(r) {
         ...(r.tombstonedAt !== undefined ? { tombstonedAt: r.tombstonedAt } : {}),
         events: r.events.map(buildClearanceEventWire),
         custodyBytes: Buffer.byteLength(r.entryText, "utf8"),
+        ...(r.custodyErased === true ? { custodyErased: true } : {}),
     };
 }
 function parseScopes(raw) {
@@ -113,7 +111,7 @@ function parseScopes(raw) {
 }
 export async function handleMemoryOrigin(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
@@ -163,7 +161,8 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
             if (at === null)
                 return;
             try {
-                sendJson(res, 200, { clearances: (at !== undefined ? faces.listClearances(at) : faces.listClearances()).map(buildClearanceRowWire) });
+                const rows = await (at !== undefined ? faces.listClearances(at) : faces.listClearances());
+                sendJson(res, 200, { clearances: rows.map(buildClearanceRowWire) });
             }
             catch (err) {
                 if (!sentClassifiedFailure(res, ctx, "clearances", err))

package/dist/http/routes/memory-policy.js

@@ -5,9 +5,14 @@ import * as facts from "../../capability-facts.js";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
 import { parseProjectLayerKey } from "../../project-layer-key.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-import { sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { sentMemoryFaceFault } from "../memory-face-fault-reply.js";
+function layerFaceAudience(deps, principal, face, scope) {
+    if (explicitOperatorOk(principal, deps.config))
+        return { kind: "operator" };
+    return { kind: "layer_owner", face, withheld: (coreMessage) => deps.logger?.warn?.(face === "export" ? "memory_export_refused" : "memory_sync_refused", { scope, err: coreMessage }) };
+}
 const ORG_PREFIX = "org:";
 export const MEMORY_EXPORT_MAX_LIMIT = 500;
 function encodeExportCursor(c) {
@@ -36,16 +41,16 @@ function directoryDecidesThisFace(mode) {
             return false;
     }
 }
-async function gateMemoryScope(deps, principal, scope, need) {
-    if (scope === formatUserScope(principal) || parseProjectLayerKey(scope)?.owner === principal)
+async function gateMemoryScope(deps, person, scope, need) {
+    if (scope === formatUserScope(person) || parseProjectLayerKey(scope)?.owner === person)
         return { kind: "allow" };
-    if (explicitOperatorOk(principal, deps.config))
+    if (explicitOperatorOk(person, deps.config))
         return { kind: "allow" };
     const directory = deps.orgMemoryDirectory;
     if (!scope.startsWith(ORG_PREFIX) || directory === undefined || !directoryDecidesThisFace(deps.config.memoryOrgAdmissionMode)) {
         return { kind: "not_found" };
     }
-    const lookup = await directory.lookup(principal);
+    const lookup = await directory.lookup(person);
     if (lookup.kind === "unavailable")
         return { kind: "unavailable", retryAfterMs: lookup.retryAfterMs };
     const grant = lookup.scopes[scope];
@@ -70,7 +75,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
     const { readJson, safeDecode } = ctx.helpers;
     switch (match.decl.id) {
         case "memory-export": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (!principal) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -100,7 +105,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
             }
             const decoded = beforeRaw === null ? undefined : decodeExportCursor(beforeRaw);
             if (decoded !== undefined && !decoded.ok) {
-                sendError(res, 400, "request.query_invalid", "before must be the opaque `nextBefore` cursor from a previous page of this endpoint", { detail: decoded.why });
+                sendError(res, 400, "request.query_invalid", `before must be the opaque \`nextBefore\` cursor from a previous page of this endpoint: ${decoded.why}`);
                 return;
             }
             try {
@@ -125,7 +130,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 });
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+                if (sentMemoryFaceFault(res, err, layerFaceAudience(deps, principal, "export", scope)))
                     return;
                 deps.logger?.warn?.("memory_export_failed", { scope, err: String(err) });
                 sendError(res, 500, "internal.error", "memory export failed");
@@ -133,7 +138,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
             return;
         }
         case "memory-sync-scope": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (!principal) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -185,7 +190,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
                 sendJson(res, 200, out);
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "operator" }))
+                if (sentMemoryFaceFault(res, err, layerFaceAudience(deps, principal, "sync", scope)))
                     return;
                 deps.logger?.warn?.("memory_sync_failed", { scope, peer: parsed.value.peer, err: String(err) });
                 sendError(res, 500, "internal.error", "memory sync failed");
@@ -193,7 +198,7 @@ export async function handleMemoryPolicy(req, res, match, ctx) {
             return;
         }
         case "policy": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (deps.config.requirePrincipal && !principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;

package/dist/http/routes/notify-wake.js

@@ -1,8 +1,8 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCallerOf } from "../principal-gate.js";
-import { ownerlessRowOpen, sessionOwnerCellOf } from "../../security.js";
+import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
+import { admitSessionRow, enter, refuse } from "../owner-access.js";
 import { sendResumeOutcome } from "../route-ctx.js";
-import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { readResumeRestatement } from "../resume-restatement.js";
 export async function handleNotifyWake(req, res, match, ctx) {
@@ -13,11 +13,9 @@ export async function handleNotifyWake(req, res, match, ctx) {
         case "session-notify": {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendPrincipalRefusal(res, req, deps.config);
+            const notifyEntry = enter(req, res, deps, "session-notify");
+            if (notifyEntry === undefined)
                 return;
-            }
             const notifySession = safeDecode(match.params.sessionId);
             if (notifySession === null) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
@@ -57,16 +55,9 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 return;
             }
             const notifyHead = await owned.sessionStorage.headOf(notifySession);
-            if (notifyHead === undefined) {
-                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+            const notifyAdmitted = await admitSessionRow(notifyEntry, res, owned.sessionStorage, notifySession, notifyHead);
+            if (notifyAdmitted === undefined)
                 return;
-            }
-            const notifyOwner = notifyHead.owner;
-            const notifyOperator = explicitOperatorOk(principal, deps.config);
-            if (!notifyOperator && notifyOwner !== principal && !ownerlessRowOpen(await sessionOwnerCellOf(owned.sessionStorage, notifySession, notifyOwner), sessionCallerOf(req, deps))) {
-                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                return;
-            }
             const payload = {
                 task_id: nb.task_id,
                 status: nb.status,
@@ -75,7 +66,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 ...(nb.seq !== undefined ? { seq: nb.seq } : {}),
                 ...(nb.source !== undefined ? { source: nb.source } : {}),
             };
-            const out = await ctx.legs.sessionNotify.deliver({ sessionId: notifySession, occupant: notifyHead, ownerlessEntryOwner: principal ?? null }, payload);
+            const out = await ctx.legs.sessionNotify.deliver({ sessionId: notifySession, occupant: notifyAdmitted.row, ownerlessEntryOwner: notifyEntry.caller.subject ?? null }, payload);
             switch (out.delivery) {
                 case "live":
                     sendJson(res, 200, { sessionId: notifySession, delivery: "live" });
@@ -90,7 +81,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                     sendJson(res, 202, { sessionId: notifySession, delivery: "parked", note: "no live stream — parked in the session inbox; drained as a task_notification on the next stream open" });
                     return;
                 case "withdrawn":
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                    refuse(notifyEntry, res, "missing");
                     return;
                 default:
                     return assertNever(out);
@@ -103,7 +94,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
             }
             if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
                 return;
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedSubject(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;

package/dist/http/routes/observability.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { quotaWindowResetsAt } from "../../observability/cost-quota.js";
@@ -12,7 +12,7 @@ export async function handleObservability(req, res, match, ctx) {
                 sendOperatorPrincipalsRequired(res);
                 return;
             }
-            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config)) {
+            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config)) {
                 sendError(res, 403, "auth.operator_only", "the outcomes view is operator-only");
                 return;
             }
@@ -41,7 +41,7 @@ export async function handleObservability(req, res, match, ctx) {
             return;
         }
         case "usage": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedPerson(req, deps.config);
             if (!principal) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;

package/dist/http/routes/principal-inbox.d.ts

@@ -2,7 +2,7 @@
  * 跨主体投递门的**受理口**:`POST /v1/principal-inbox/messages`。
  *
  * 本口只做三件事,其余全归门(`src/org-delivery-gate.ts`,规则全文在它的头注):
- *  ① 取发件人 —— **只**取自验过的身份面(`gatedPrincipal`),交给门的 `authedFrom` 就是 `{ scope: <那位主体> }`;
+ *  ① 取发件人 —— **只**取自验过的身份面(`gatedSubject`),交给门的 `authedFrom` 就是 `{ scope: <那位主体> }`;
  *     体里没有发件人这个键(写了 = 词表外键,400)。没有验过的身份 ⇒ 401(身份面那一句),不论部署是否要求 principal ——
  *     门要一个发件人 scope,匿名者没有。无凭证部署上 principal 头只是调用方自报 ⇒ 本口在分派器的无凭证写门内
  *     (声明行 `credentialGated`,503 `auth.service_token_required`;本地开发显式 `ALLOW_UNAUTHED_WRITES=true` 才放行);
@@ -15,10 +15,12 @@
  *
  * 拒绝词 → HTTP 状态(穷举 `switch`,core 加词 ⇒ 编译红):
  *  · `not_member` → 404:「不同 org」「查无此人」「目录答不上来」同一份字节(门保证),404 与本仓反枚举的既有形一致;
- *  · `rate_limited` → 429;
+ *  · `rate_limited` → 429,体带 `retryAfterSec`、头带同值 `Retry-After`(门答案里的那一个数 —— 配额店按店钟算的到当前窗结束的整秒数;本口不再算一遍,
+ *    一个数两个投影,先例 `run-concurrency-cap.ts`);三界(尝试 / 对偶 / 聚合)同一句同一个数,另三只词没有这两样;
  *  · `inbox_full` → 409(收件人那一侧的状态,不是发件人的速率;与 `steering.queue_full` 同档);
  *  · `recipient_tombstoned` → 410(收件人正在被删除,这条路关了)。
  * 门缺席(本部署没声明收件箱消费方)⇒ 501 `capability.unavailable`,能力位 `principalInboxDelivery` 读同一只事实。
+ * 配额店读不出自己的状态 ⇒ 门抛 `OrgDeliveryQuotaUnreadableError`,由 HTTP 兜底(`http/server.ts`)答带因的 500(fail-closed,一封都没投)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";

package/dist/http/routes/principal-inbox.js

@@ -1,5 +1,5 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
+import { gatedSubject, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { principalInboxBodyKeyIssue } from "../../request-key-closure.js";
@@ -10,7 +10,8 @@ function sendRefusal(res, outcome) {
             sendError(res, 404, "org_delivery.not_member", outcome.message);
             return;
         case "org_delivery.rate_limited":
-            sendError(res, 429, "org_delivery.rate_limited", outcome.message);
+            res.setHeader("retry-after", String(outcome.retryAfterSec));
+            sendError(res, 429, "org_delivery.rate_limited", outcome.message, { retryAfterSec: outcome.retryAfterSec });
             return;
         case "org_delivery.inbox_full":
             sendError(res, 409, "org_delivery.inbox_full", outcome.message);
@@ -19,7 +20,7 @@ function sendRefusal(res, outcome) {
             sendError(res, 410, "org_delivery.recipient_tombstoned", outcome.message);
             return;
         default:
-            return assertNever(outcome.code);
+            return assertNever(outcome);
     }
 }
 export async function handlePrincipalInbox(req, res, match, ctx) {
@@ -27,7 +28,7 @@ export async function handlePrincipalInbox(req, res, match, ctx) {
     const { readJson } = ctx.helpers;
     switch (match.decl.id) {
         case "principal-inbox-messages": {
-            const principal = gatedPrincipal(req, deps.config);
+            const principal = gatedSubject(req, deps.config);
             if (principal === undefined) {
                 sendUnauthorized(res, "identity");
                 return;

package/dist/http/routes/projects.d.ts

@@ -9,7 +9,7 @@
  *  · **登记簿只由配置中心下发**:settings-schema 的本地读取集不收 `projects` 域 ⇒ 没有中心腿在应用配置的部署上没有登记簿 —— 两口 501
  *    `capability.unavailable`,能力位 `capabilities.projects`(布尔)读同一只事实(`capability-facts.ts` 的 `projectRegistry`)答 `false`;
  *    有登记簿时答 `true`。本面不开写动词(写到哪里由另一张设计定;写面到货时另立一位,本位不改义)。
- *  · **可见性 fail-closed**:身份判在登记簿在场判**之前**(否则「这台有没有登记簿」先于 401 泄出去);fleet 调用方(`fleetViewOf` 读档)看全部;
+ *  · **可见性 fail-closed**:身份判在登记簿在场判**之前**(否则「这台有没有登记簿」先于 401 泄出去);fleet 调用方(列表面 `list.read` 读档(`listFilterOf`))看全部;
  *    带验过主体的调用方只看 `registeredBy` 恰是自己的登记;看不见的与不存在的同码同句(404 `not_found.project`,不给存在性预言机)。
  *
  * 归档:`archivedAt` 在场 = 已归档。列表缺省不列,`?archived=true` 只列已归档的,`?archived=false` 与缺省同;单项读不论归档与否都答(会话行引用它)。

package/dist/http/routes/projects.js

@@ -1,6 +1,7 @@
 import { PROJECT_ID_REGEX } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
-import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
+import { sendUnauthorized } from "../principal-gate.js";
+import { routeListFilter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { projectByTable } from "../../trace/projection-table.js";
@@ -36,7 +37,7 @@ function readArchivedQuery(raw) {
 export async function handleProjects(req, res, match, ctx) {
     const { deps } = ctx;
     const { safeDecode } = ctx.helpers;
-    const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
+    const { fleetWide, gateOwner } = routeListFilter(req, deps, match.decl.id);
     if (!fleetWide && gateOwner === null) {
         sendUnauthorized(res, "identity");
         return;

package/dist/http/routes/retention-ops.js

@@ -1,5 +1,6 @@
 import { sendJson, sendError } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
+import { limitFacts } from "../../limit-refusal.js";
+import { gatedPerson, explicitOperatorOk, sendOperatorPrincipalsRequired, sendPrincipalRefusal } from "../principal-gate.js";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { RETENTION_AUDIT_DEFAULT_LIMIT, RETENTION_AUDIT_MAX_LIMIT } from "../../plugins/retention-lane-store-sql.js";
@@ -27,7 +28,7 @@ function decodeCursor(raw) {
 }
 export async function handleRetention(req, res, match, ctx) {
     const { deps } = ctx;
-    const principal = gatedPrincipal(req, deps.config);
+    const principal = gatedPerson(req, deps.config);
     if (deps.config.requirePrincipal && !principal) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
@@ -64,9 +65,7 @@ async function handleHold(req, res, ctx, store, rawDomain, principal, held) {
         return;
     }
     if (domain.length > DOMAIN_MAX_CHARS) {
-        sendError(res, 400, "request.field_invalid", "the retention domain does not fit the hold table's identity column", {
-            detail: `domain is ${domain.length} characters; retention_hold.domain holds at most ${DOMAIN_MAX_CHARS}`,
-        });
+        sendError(res, 400, "request.field_invalid", `the retention domain does not fit the hold table's identity column: domain is ${domain.length} characters; retention_hold.domain holds at most ${DOMAIN_MAX_CHARS}`, limitFacts("domain", "characters", domain.length, DOMAIN_MAX_CHARS));
         return;
     }
     let note;
@@ -84,9 +83,7 @@ async function handleHold(req, res, ctx, store, rawDomain, principal, held) {
                     return;
                 }
                 if (n.length > NOTE_MAX_CHARS) {
-                    sendError(res, 400, "request.field_invalid", "the retention hold note is longer than this face accepts", {
-                        detail: `note is ${n.length} characters; the limit is ${NOTE_MAX_CHARS}`,
-                    });
+                    sendError(res, 400, "request.field_invalid", `the retention hold note is longer than this face accepts: note is ${n.length} characters; the limit is ${NOTE_MAX_CHARS}`, limitFacts("note", "characters", n.length, NOTE_MAX_CHARS));
                     return;
                 }
                 note = n;
@@ -125,7 +122,7 @@ async function handleAuditRead(res, store, search) {
     const beforeRaw = q.get("before");
     const decoded = beforeRaw === null ? undefined : decodeCursor(beforeRaw);
     if (decoded !== undefined && !decoded.ok) {
-        sendError(res, 400, "request.query_invalid", "before must be the opaque `nextBefore` cursor from a previous page of this endpoint", { detail: decoded.why });
+        sendError(res, 400, "request.query_invalid", `before must be the opaque \`nextBefore\` cursor from a previous page of this endpoint: ${decoded.why}`);
         return;
     }
     const domainRaw = q.get("domain");