@sema-agent/server 7.148.0 → 7.149.0

package/dist/tool-approval.d.ts

@@ -1,4 +1,4 @@
-import type { ExecutionLane } from "./execution-lane-caps.js";
+import type { ApprovalLegOrigin } from "./approval-leg-origin.js";
 import { type ApprovalDecider, type HostSettledBy, type HostSource, type RetiredDecisionKeyFacts } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
 import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundGrantAbsence, type BoundSkillGrants, type ToolApprovalCard, type ReopenReason } from "@sema-agent/core";
@@ -26,6 +26,8 @@ interface OpenAskAdoption {
     /** 待决行多于 {@link ADOPT_OPEN_ASKS_MAX}:只接管了最先的那么多只。 */
     readonly capped: boolean;
 }
+/** Bound on the remembered allow-all grants (insertion-order evict — a long-lived worker must not grow unbounded). */
+export declare const MAX_ALLOW_SESSIONS = 4096;
 /**
  * 耐久回决口 `POST /v1/approvals/:sessionId/decide` 的路径串 —— [ref]:迟到回决口 PARKING 臂 202 体的机读指路 `decidePath`。
  * 路由表那一行(`http/routes/approvals-assistant.ts` 的 `approval-decide`)按 pattern 匹配它;两者同形由往返钉守
@@ -471,7 +473,7 @@ export interface ToolApprovalFrame {
      * (`finishRespond`)读的是同一份事实 ⇒ 帧说不可记 ⇔ 点了 `allow_session` 回执 `rememberApplied:false`。壳读这一位决定渲不渲
      * 「本会话放行」,不再从 `requiresRealApproval` / `mandated` / `governanceForced` 三位自己推断(那一推断漏掉第四个理由:core 7.41.0
      * 的 `Skill` 卡批准即授予清单,三位全无)。`card_json` 卡面、`livePending` 行、运维队列行同名同义。
-     * 🔴 **真才带,缺席绝不编 `false`**:缺席 = 可记(有会话时)或老服务端。没有会话的腿上点了照样只放行一次(回执说明),本位不管那一形。
+     * 🔴 **真才带,缺席绝不编 `false`**:缺席 = 可记(有会话时)或老服务端。没有会话的腿上、或读不出会话住客的腿上点了照样只放行一次(回执说明),本位不管那两形。
      */
     rememberRefused?: true;
     /**
@@ -890,12 +892,10 @@ export type ApprovalLegFamily = {
     readonly transport: HitlTransport<ToolApprovalFrame>;
 };
 /** 两族共有的腿身份与腿轴。 */
-interface ToolApprovalRunContextBase {
+interface ToolApprovalRunContextBase extends ApprovalLegOrigin {
     taskId: string;
     sessionId?: string;
     owner: string | null;
-    /** 这条腿的执行车道 —— 装配点写所在边界执行上下文的 `ctx.lane`(`http/execution-context.ts`)。出处带车道:这只席造的问在铸行时记下它。 */
-    executionLane: ExecutionLane;
     abortSignal?: AbortSignal;
     /** [ref]([ref] §3.1 askId 派生的腿轴;车3 刀 3a 换轴:原 `leg?: number` → `legKey?: string`)。
      *  = `sha256(resume checkpoint token)` 的 hex,**首腿缺席折空串**(空串是首腿的真值,不是「未知」)。
@@ -1342,7 +1342,7 @@ export declare class ToolApprovalCoordinator {
     private readonly pendingByAskId;
     /** preamble 呈出的卡的消卡订阅(键 = askId;见 {@link watchPresentedCards})。只订本副本上此刻在等的 ask,落定即清 ⇒ 有界于活登记数。 */
     private readonly presentedCardWatchers;
-    /** Per-capability session grants — keys = sessionAllowKey(owner, sessionId, category, grant binding) (修2; bounded). */
+    /** Per-capability session grants — keys = sessionAllowKey(owner, sessionId, session incarnation, category, grant binding) (修2; bounded). */
     private readonly allowAllSessions;
     /** [ref] HIGH-1(broker)→[ref]四 core 产品裁定「多活集合+广播+首决胜出」:per-(owner, host-session)
      *  的**当前活跃连接集合**——boundAsk 闭包只携身份,emit 时广播给该 key 下**全部**活连接(宿主重连/
@@ -1777,8 +1777,7 @@ export declare class ToolApprovalCoordinator {
         owner: string | null;
         taskId: string;
         sessionId?: string;
-        executionLane: ExecutionLane;
-    }, why: LegUnattended) => ((req: AskRequest) => Promise<AskOutcome>);
+    } & ApprovalLegOrigin, why: LegUnattended) => ((req: AskRequest) => Promise<AskOutcome>);
     /**
      * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据;[ref] / SN-C1 换读口)。
      *
@@ -1966,7 +1965,7 @@ export declare class ToolApprovalCoordinator {
      *  emit 时经 broker 取该 (owner, session) 的「当前」活跃流(宿主重连/续聊的新 SSE 自动接卡;
      *  internalsSnapshot 冻结的闭包因此永不携死流)。查无活流 = "unavailable"(G1 回路:durable 部署
      *  park;inherited plain-ask 的 park 回路 = core [ref]①,落地前该臂 = deny,与 1.257 前行为一致)。 */
-    boundAsk: (identity: {
+    boundAsk: (identity: ApprovalLegOrigin & {
         owner: string | null;
         taskId: string;
         sessionId?: string;
@@ -1974,8 +1973,6 @@ export declare class ToolApprovalCoordinator {
         /** [ref] 车3 刀 3b(§7.3):本腿的 walltime deadline —— 与 `legKey` 同源同理由,随**出处**走
          *  (子代经继承链拿到的是宿主腿的闭包,窗必须按宿主腿的剩余 walltime 算)。 */
         legDeadlineMonotonic?: number;
-        /** 宿主腿的执行车道(装配点写执行上下文的 `ctx.lane`);子代经继承链冻同一闭包 ⇒ 子代的问记宿主腿的车道。 */
-        executionLane: ExecutionLane;
     }) => ((req: AskRequest, signal?: AbortSignal) => Promise<AskOutcome>);
     /** 广播版裁决路径——`ask()`(ALS,恒单元素数组)与 `boundAsk`([ref]四多活集合,可能多元素)共用。
      *  全体 `ctxs` 保证同一 (owner, sessionId)(streamKey 分组不变式;单元素数组平凡成立)。
@@ -2068,10 +2065,10 @@ export declare class ToolApprovalCoordinator {
     /**
      * `GET /v1/tool-approvals/:approvalId` —— **按问读口**:一只 ask 此刻在哪一态({@link TOOL_APPROVAL_READ_STATES})。与 {@link respond} 同根同门
      * (HTTP 层的鉴权 / 属主身份同一只 `gatedSubject`;看不见这只问 —— 属主不过 / 查无 / 行读不出 / 没有问账 —— 与应答口同答 404 `not_found.ask`({@link askNotVisible}),
-     * 无存在性 / 状态谕示),读法与应答口逐条同源:
-     * 本副本上在等它的活登记({@link liveEntryFor})⇒ `pending`(行投影 = 列表面 `livePending[]` 的同一只投影);否则按 id 读行
-     * ({@link askRowFor} + {@link askRowVisibleTo}),行态 → 读态与晚答口的分派同一张表;行仍 `STREAM_PENDING` 而本副本没有在等它的登记 ⇒ 它活在别的副本上,
-     * 与晚答口同答 404 `tool_approval.not_pending` + `unknown_or_other_replica`(那里才有兑现它的闭包;属主看得见的态)。
+     * 无存在性 / 状态谕示)。看不看得见只有一个来源:有行的问 = 店答出的行上当下的属主(按 id 读行,{@link askRowFor} + {@link askRowVisibleTo});
+     * 店答不出 ⇒ 看不见,本副本登记上记下的那一位(行上属主的读缓存)不替店作答。没有行的问(问账没上场 / 旧族腿)= 登记记下的那一位(唯一可读的属主事实)。
+     * 读到的行仍 `STREAM_PENDING`:本副本有在等它的登记 ⇒ `pending`(行投影 = 列表面 `livePending[]` 的同一只投影);没有 ⇒ 它活在别的副本上,
+     * 与晚答口同答 404 `tool_approval.not_pending` + `unknown_or_other_replica`(那里才有兑现它的闭包;属主看得见的态);其余行态 → 读态与晚答口的分派同一张表。
      * 纯读:零写、零结算、不碰本地登记(晚答口的 DECIDED 臂会顺手同步本副本的活登记,读口不做)。
      */
     readApproval(id: string, principal: string | undefined): {
@@ -2082,10 +2079,9 @@ export declare class ToolApprovalCoordinator {
         body: unknown;
     }>;
     /**
-     * [ref]:有行的登记的按问读口 —— 行可见且仍 `STREAM_PENDING` ⇒ `pending`(列表面同一只行投影);否则按行的态答(与读行半场同一张表)。
-     * 🔴 行**读不出**(店抛 / 超时)⇒ 只有**本协调器自己铸的活登记**回落:登记记下的属主认调用方 ⇒ `pending`,否则与未知 id 同答 —— 与同一刻的应答口同答
-     * (活登记的应答拿登记属主当候选、不多读一次店,店抖动不挡真实回决,D5),也与 7.135.x 的读口同答。**接管登记**([ref],起服从问账接管、没有引擎腿在等)的
-     * 属主跟着行走,登记上那一格不是权威 —— 应答口对它恒读行判、读不出 ⇒ 404,读口同样 404(两口同答;7.135.x 两口都 404)。读得出的「没有这一行」不回落(那是行的真相)。
+     * 有行的登记的按问读口 —— 行可见且仍 `STREAM_PENDING` ⇒ `pending`(列表面同一只行投影);否则按行的态答(与读行半场同一张表)。
+     * 行读不出(店抛 / 超时)与查无同答 404 —— 活登记与接管登记一样:登记上那一格只是行上属主的读缓存,店答不出时它不替店说「你看得见」
+     * (应答口同律:属主门那一读读不出 ⇒ 同一句 404;决议写失败之后读不回行 ⇒ 500,那是「不知道落没落」,不是看得见)。
      */
     private readByRow;
     /** {@link readApproval} 的读行半场。 */
@@ -2136,12 +2132,15 @@ export declare class ToolApprovalCoordinator {
     /** {@link respondLate} 的读行:按 id 读出行,交 {@link dispatchRowTruth}。 */
     private dispatchLateByRow;
     /**
-     * 按 wire 身份(= 行的键)读行 —— 三态分开交回({@link AskRowRead}):读到了 / 读得出的「没有这一行」/ 读不出(店抛或超时,记账)。
-     * 「读不出」与「不在」不折成一个值:调用点各自表态 —— 应答口与晚答口按「查无」答(读不出 = **不知道**这只 ask 落在哪一态,而受理臂都在对客户端做承诺,
-     * 不知道 ⇒ 回那句 404,绝不把未知说成受理;D5 的 fail-open 只覆盖「不挡人的真实回决」那一面,这条腿方向相反),按问读口对本协调器自己铸的活登记回落那一份登记
-     * (接管登记不回落,{@link readByRow})。
+     * 按 wire 身份(= 行的键)读行,给属主门用(应答口 / 晚答口 / 按问读口):读到了 ⇒ 那一行;读得出的「没有这一行」与读不出(店抛或超时,记账)同答 `null`。
+     * 读不出 = **不知道**属主是谁、这只 ask 落在哪一态 ⇒ 调用方看不见它(与查无同答 404):属主门 fail-closed,受理臂不把未知说成受理,读口不把未知说成待决。
      */
     private askRowFor;
+    /**
+     * 一只有行的问**此刻的行** —— 应答口 / 按问读口 / 列表面读行的**唯一**入口:{@link askRowFor} 点读(读不出 ⇒ `null` ⇒ 看不见),读到仍待决的行就把这只问在本副本上的登记
+     * 对齐到行上当下的属主([ref];先于各口的门判:门判的是调用方,不是这次对齐)。读序号在**发起读之前**取({@link nextRowReadSeq}):晚回来的旧读盖不掉之后发起的读。
+     */
+    private askRowFollowingOwner;
     /**
      * 一条行(的此刻真相)→ 应答口的答案:属主门 + 受理回执 + 六态穷举分派(闭集:新增 `AskState` 而不在此表态 = **编译错**)。两个入口:本副本没有在等
      * 这只 ask 的登记({@link dispatchLateByRow} 读出行),以及有登记但回决的 CAS 干净地输(行已有终局,`decideAsk` 带回的那条行)—— 一只 ask 的
@@ -2229,20 +2228,10 @@ export declare class ToolApprovalCoordinator {
     /** 回决收尾(D1 现行为逐字不变的那一半)——session allow-all 记账 + settle + 200 响应体。原 `respond()`
      *  方法体的逐字搬运([ref] 车2 拆分,行为零改动)。 */
     private finishRespond;
-    /** [ref]([ref] 案):live pending 的**列表读面**——`GET /v1/approvals` 响应第二顶层键 `livePending`
-     *  的唯一数据源,**同时**是 `/v1/approvals/stream` 的 live 半场 diff 源(推与拉必须同源:feed 收到
-     *  `live_pending` 事件就会去 `list()`,两处各读各的会给出一条列不出来的事件)。纯读投影,零锁/零结算
-     *  语义。
-     *  🔴 **[ref] 起行上带整只活卡帧**(`frame`,见 {@link LivePendingRow.frame}):旧文那句「input/args
-     *  不上列表,详情走流帧」对**悬挂 ask 结构上不成立**(它永远没有流帧),而 `frame` 是 `askBroadcast`
-     *  那一处构造的同一个对象 ⇒ 仍然只有**一个**脱敏属主、零第二投影。`scope` 与 durable 面同一个值(checkpoint scope):`undefined` = operator 全量(含 owner null 的
-     *  条目),`_`(`CHECKPOINT_PUBLIC_SCOPE`)= 匿名那一组 = owner null 的条目(R7:不带主体的调用方列得出它答得了的那几张),
-     *  其余串 = 只见 `owner === scope` 的条目(null-owner 行对具名主体不列,宁少列不超范围)。行的 `approvalId` 就是 `respond()` 收的 id
-     *  (同源可达,[ref] 判据);`expiresAtMs` 照抄登记时单点铸定的窗死线([ref] 三键同一个数)。 */
     /**
      * 🔴 [ref] —— **起服接管**:把问账里仍 `STREAM_PENDING` 的问接进本审批机的活集合,让 `livePending[]`(及 `/v1/approvals/stream` 的 live 半场、
-     * 按问读口、应答口)在重启之后不重开流也看得见、答得了它们。审批机仍是这些读面**唯一**的读源:读问账的只有这里(起服一次),之后列表行由
-     * 同一只 {@link livePendingRowOf} 投影,卡帧 = `buildReplayFrame`(开流 preamble 同一只构造)—— 不是 GET 上加一只读表的第二 reader。
+     * 按问读口、应答口)在重启之后不重开流也看得见、答得了它们。审批机仍是这些读面**唯一**的候选源(哪些问在本副本上有登记):扫问账找待决行的只有这里(起服一次),之后列表行由
+     * 同一只 {@link livePendingRowOf} 投影,卡帧 = `buildReplayFrame`(开流 preamble 同一只构造)—— 不是 GET 上按属主扫表的第二 reader;列表面对候选逐只点读行(见 {@link listLivePending}),候选集之外的问它不认识。
      *
      * 律(设计稿 `design-[ref].md` §2):接管登记**没有引擎腿在等它**(铸它的进程没了,或它活在别的副本上),与活登记同一只状态机 ——
      * 应答 = 同一把 `decideAsk` CAS({@link answerRegistration}),收敛 = 同一条悬挂轮询腿读行({@link pollSuspendedDecisions});它活多久只由行说了算,
@@ -2290,7 +2279,26 @@ export declare class ToolApprovalCoordinator {
     }>;
     /** 这只 askId 在本副本上有几条**有引擎腿在等**的登记(接管登记不算)—— 轮询腿的「被唤醒数」读它。 */
     private waitingRegistrationCount;
-    listLivePending(scope: string | undefined): LivePendingRow[];
+    /**
+     * [ref]([ref] 案):live pending 的**列表读面** —— `GET /v1/approvals` 响应第二顶层键 `livePending` 的唯一数据源,**同时**是 `/v1/approvals/stream` 的 live 半场 diff 源
+     * (推与拉必须同源:feed 收到 `live_pending` 事件就会去 `list()`,两处各读各的会给出一条列不出来的事件)。纯读投影,零锁 / 零结算语义。
+     * 🔴 **[ref] 起行上带整只活卡帧**(`frame`,见 {@link LivePendingRow.frame}):旧文那句「input/args 不上列表,详情走流帧」对**悬挂 ask 结构上不成立**(它永远没有流帧),
+     * 而 `frame` 是 `askBroadcast` 那一处构造的同一个对象 ⇒ 仍然只有**一个**脱敏属主、零第二投影。
+     * `scope` 与 durable 面同一个值(checkpoint scope):`undefined` = operator 全量(含 owner null 的条目),`_`(`CHECKPOINT_PUBLIC_SCOPE`)= 匿名那一组 = owner null 的条目
+     * (R7:不带主体的调用方列得出它答得了的那几张),其余串 = 只见 `owner === scope` 的条目(null-owner 行对具名主体不列,宁少列不超范围)。
+     * 行的 `approvalId` 就是 `respond()` 收的 id(同源可达,[ref] 判据);`expiresAtMs` 照抄登记时单点铸定的窗死线([ref] 三键同一个数)。
+     *
+     * 🔴 **有行的问,列表只列按问读口会答 `pending` 的**(看不看得见只有一个来源,{@link readApproval} 同一条律):本副本此刻的登记只是**候选**(哪些问在本副本上有登记);
+     * 有行的问,列不列它、列给谁只由店答出的行说了算 —— 对每只候选点读行({@link askRowFollowingOwner},与读口 / 应答口同一只 {@link askRowFor}):行读不出(店抛 / 超时)⇒ 看不见 ⇒ 不列
+     * (与读口的 `404 not_found.ask` 同隐;店恢复后下一次列表即回),行已离开 `STREAM_PENDING`(别处答了 / 收走了,本副本的登记还没闻讯)⇒ 不列(读口答的是它此刻的态),
+     * 行上当下的属主不在 `scope` 内 ⇒ 不列(登记上记下的那一位只是行上属主的读缓存,不替店作答)。没有行的问(问账没上场 / 旧族腿)登记记下的属主是唯一可读的属主事实 ⇒ 照登记列。
+     * 读行并发发起、各自带 {@link DURABLE_CONVERGE_READ_TIMEOUT_MS} 的墙钟 ⇒ 一次列表至多等一个期限;行体的投影取在读完之后、对每个列出的 wire 身份重取此刻代表它的那条登记
+     * ({@link liveEntryFor}):读行期间已结算的不列,读行期间被活登记接替的接管登记按活登记的样子列。
+     * 读行的次数 = 本副本此刻**有行的不同 ask 数**(重复登记共用一次读,没有行的问不读),**不按 `scope` 先筛**(登记上的属主只是读缓存,不替店判谁看得见 —— scope 之外的卡也要读一次行才判得出);
+     * 登记数的上界是每个任务 / 每个属主各一个未决帽(`STREAM_APPROVAL_ADMIT_MAX_PER_TASK` / `_PER_OWNER`)加起服接管上限 {@link ADOPT_OPEN_ASKS_MAX},本副本的总数没有全局帽。
+     * 列表行 ⊆ 按问读口对同一调用方答 `pending` 的那些;反过来不然 —— `scope` 比读口窄:具名主体的列表不含无主的卡(宁少列),运维列表按 `?owner=` / 全量列、含读口对运维不放行的卡。
+     */
+    listLivePending(scope: string | undefined): Promise<LivePendingRow[]>;
     /**
      * [ref]:某只委派子代此刻有没有**待决**的活卡 —— fleet 对账腿「子代活性由属主说了算」的属主②读口(另一只是
      * bg registry 账)。子代卡在一张没人答的卡上时当然不出帧,只看「静默」就会把它当孤儿扫下面板(报案的真形)。

package/dist/tool-approval.js

@@ -37,7 +37,7 @@ const ADOPT_OPEN_ASKS_MAX = 1_000;
 const EDITED_DECISION_MARK_CAP_MS = 10_000;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
 const SHUTDOWN_DRAIN_POLL_MS = 50;
-const MAX_ALLOW_SESSIONS = 4096;
+export const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
 const DEFAULT_ADMIT_MAX_PER_OWNER = 256;
 const DEFAULT_PARK_REDEMPTION_MAX = 2000;
@@ -115,8 +115,10 @@ const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
-function sessionAllowKey(owner, sessionId, category, binding) {
-    return JSON.stringify([owner, sessionId, category, binding.kind === "bound" ? binding.digest : null]);
+function sessionAllowKey(owner, sessionId, incarnation, category, binding) {
+    if (!sessionId || !incarnation)
+        return undefined;
+    return JSON.stringify([owner, sessionId, incarnation, category, binding.kind === "bound" ? binding.digest : null]);
 }
 function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
     const classes = screenAskClassMembers(req.askClass, req.classes)?.classes;
@@ -227,9 +229,6 @@ function mandatedFromSeat(seat) {
             return false;
     }
 }
-function rowOrUnknown(read) {
-    return read.kind === "row" ? read.row : null;
-}
 function askRowVisibleTo(row, principal) {
     return row !== null && askOwnerAdmitsAnswer(row.owner, principal);
 }
@@ -960,7 +959,8 @@ export class ToolApprovalCoordinator {
         const sessionId = origin.sessionId;
         if (!sessionId)
             return false;
-        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName), facts.grantBinding));
+        const liveKey = sessionAllowKey(origin.owner, sessionId, origin.incarnation, sessionAllowCategory(req.toolName), facts.grantBinding);
+        const live = liveKey !== undefined && this.allowAllSessions.has(liveKey);
         const durable = !live && facts.grantBinding.kind === "none" && (await this.durableGrantHas(sessionId, req.toolName));
         if (!live && !durable)
             return false;
@@ -984,7 +984,14 @@ export class ToolApprovalCoordinator {
     }
     boundUnattendedAsk = (identity, why) => {
         return async (req) => {
-            const origin = { owner: identity.owner, taskId: identity.taskId, ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}), legKey: "", executionLane: identity.executionLane };
+            const origin = {
+                owner: identity.owner,
+                taskId: identity.taskId,
+                ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}),
+                legKey: "",
+                executionLane: identity.executionLane,
+                ...(identity.incarnation !== undefined ? { incarnation: identity.incarnation } : {}),
+            };
             if (await this.standingGrantSettles(origin, req, this.governanceForcedOf(origin, req)))
                 return true;
             return this.unattendedAskOutcome({ ...why, taskId: identity.taskId, owner: identity.owner, toolName: req.toolName });
@@ -1230,6 +1237,7 @@ export class ToolApprovalCoordinator {
             ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}),
             legKey: ctx.legKey ?? "",
             executionLane: ctx.executionLane,
+            ...(ctx.incarnation !== undefined ? { incarnation: ctx.incarnation } : {}),
             ...(ctx.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: ctx.legDeadlineMonotonic } : {}),
         }, [ctx], req, signal);
     };
@@ -1243,6 +1251,7 @@ export class ToolApprovalCoordinator {
                 ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}),
                 legKey: identity.legKey ?? "",
                 executionLane: identity.executionLane,
+                ...(identity.incarnation !== undefined ? { incarnation: identity.incarnation } : {}),
                 ...(identity.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: identity.legDeadlineMonotonic } : {}),
             }, live, req, signal);
         };
@@ -1902,6 +1911,7 @@ export class ToolApprovalCoordinator {
             ...(reachability === "unreached" ? { suspended: true } : {}),
             ...(child ? { originTaskId: req.sourceSessionId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
+            ...(origin.incarnation !== undefined ? { incarnation: origin.incarnation } : {}),
             frame,
             ...(cardFrame !== undefined ? { cardFrame } : {}),
             approvalId: wireApprovalId,
@@ -2058,10 +2068,7 @@ export class ToolApprovalCoordinator {
         const store = this.askStore;
         if (!store)
             return this.askNotVisible();
-        const readSeq = this.nextRowReadSeq();
-        const row = rowOrUnknown(await this.askRowFor(store, id, "getAsk(respond-by-row)"));
-        if (row?.state === "STREAM_PENDING")
-            this.followRowOwner(row.askId, row.owner, readSeq);
+        const row = await this.askRowFollowingOwner(store, id, "getAsk(respond-by-row)");
         if (!askRowVisibleTo(row, principal))
             return this.askNotVisible();
         if (row.state !== "STREAM_PENDING")
@@ -2175,17 +2182,7 @@ export class ToolApprovalCoordinator {
         const store = this.askStore;
         if (!store)
             return this.askNotVisible();
-        const readSeq = this.nextRowReadSeq();
-        const read = await this.askRowFor(store, id, "getAsk(read-by-row)");
-        if (read.kind === "unreadable") {
-            if (entry.adopted === true || !askOwnerAdmitsAnswer(entry.owner, principal))
-                return this.askNotVisible();
-            const body = { state: "pending", ...livePendingRowOf(entry) };
-            return { status: 200, body };
-        }
-        const row = rowOrUnknown(read);
-        if (row?.state === "STREAM_PENDING")
-            this.followRowOwner(row.askId, row.owner, readSeq);
+        const row = await this.askRowFollowingOwner(store, id, "getAsk(read-by-row)");
         if (askRowVisibleTo(row, principal) && row.state === "STREAM_PENDING") {
             const body = { state: "pending", ...livePendingRowOf(entry) };
             return { status: 200, body };
@@ -2193,7 +2190,7 @@ export class ToolApprovalCoordinator {
         return this.readStateOfRow(row, principal);
     }
     async readAskRowState(store, id, principal) {
-        return this.readStateOfRow(rowOrUnknown(await this.askRowFor(store, id, "getAsk(read)")), principal);
+        return this.readStateOfRow(await this.askRowFor(store, id, "getAsk(read)"), principal);
     }
     async readParkedGate(row) {
         const gate = this.parkedGate;
@@ -2350,18 +2347,24 @@ export class ToolApprovalCoordinator {
         return undefined;
     }
     async dispatchLateByRow(store, id, parsed, httpReq, principal) {
-        return this.dispatchRowTruth(rowOrUnknown(await this.askRowFor(store, id, "getAsk(respond-late)")), id, parsed, httpReq, principal);
+        return this.dispatchRowTruth(await this.askRowFor(store, id, "getAsk(respond-late)"), id, parsed, httpReq, principal);
     }
     async askRowFor(store, id, label) {
         try {
-            const row = await this.withStoreDeadline(store.getAsk(id), label, DURABLE_CONVERGE_READ_TIMEOUT_MS);
-            return row === null ? { kind: "absent" } : { kind: "row", row };
+            return await this.withStoreDeadline(store.getAsk(id), label, DURABLE_CONVERGE_READ_TIMEOUT_MS);
         }
         catch (err) {
             this.noteStoreError(err, label);
-            return { kind: "unreadable" };
+            return null;
         }
     }
+    async askRowFollowingOwner(store, id, label) {
+        const readSeq = this.nextRowReadSeq();
+        const row = await this.askRowFor(store, id, label);
+        if (row?.state === "STREAM_PENDING")
+            this.followRowOwner(row.askId, row.owner, readSeq);
+        return row;
+    }
     async dispatchRowTruth(row, id, parsed, httpReq, principal) {
         if (!askRowVisibleTo(row, principal))
             return this.askNotVisible();
@@ -2793,15 +2796,20 @@ export class ToolApprovalCoordinator {
                 throw new Error(`unhandled standing-answer home: ${String(unhandled)}`);
             }
         }
-        if (parsed.value === "allow_session")
-            rememberApplied = Boolean(entry.sessionId) && grantable;
-        if (parsed.value === "allow_session" && entry.sessionId && grantable) {
-            if (this.allowAllSessions.size >= MAX_ALLOW_SESSIONS) {
-                const oldest = this.allowAllSessions.values().next().value;
-                if (oldest !== undefined)
-                    this.allowAllSessions.delete(oldest);
+        if (parsed.value === "allow_session") {
+            const grantKey = grantable ? sessionAllowKey(judgedOwner, entry.sessionId, entry.incarnation, sessionAllowCategory(entry.toolName), entry.grantBinding) : undefined;
+            rememberApplied = grantKey !== undefined;
+            if (grantKey !== undefined) {
+                if (this.allowAllSessions.size >= MAX_ALLOW_SESSIONS) {
+                    const oldest = this.allowAllSessions.values().next().value;
+                    if (oldest !== undefined)
+                        this.allowAllSessions.delete(oldest);
+                }
+                this.allowAllSessions.add(grantKey);
+            }
+            else if (grantable && entry.sessionId) {
+                defaultLogger.warn("session_grant_refused_occupant_unreadable", { sessionId: entry.sessionId, toolName: entry.toolName });
             }
-            this.allowAllSessions.add(sessionAllowKey(judgedOwner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
         const settleArgs = opts?.settleOutcome !== undefined
@@ -2979,18 +2987,29 @@ export class ToolApprovalCoordinator {
                 n += 1;
         return n;
     }
-    listLivePending(scope) {
-        const rows = [];
+    async listLivePending(scope) {
         const owner = scope === undefined ? undefined : ownerOfCheckpointScope(scope);
-        const seen = new Set();
-        for (const e of this.pending.values()) {
-            if (owner !== undefined && e.owner !== owner)
-                continue;
-            if (seen.has(e.approvalId))
-                continue;
-            seen.add(e.approvalId);
-            rows.push(livePendingRowOf(e));
-        }
+        const inScope = (rowOwner) => owner === undefined || rowOwner === owner;
+        const candidates = new Map();
+        for (const e of this.pending.values())
+            if (!candidates.has(e.approvalId))
+                candidates.set(e.approvalId, e);
+        const store = this.askStore;
+        const ids = [...candidates.keys()];
+        const listed = await Promise.all([...candidates.values()].map(async (entry) => {
+            if (store === undefined || !this.registrationHasRow(entry))
+                return inScope(entry.owner);
+            const ask = await this.askRowFollowingOwner(store, entry.askId, "getAsk(list-live)");
+            return ask?.state === "STREAM_PENDING" && inScope(ask.owner);
+        }));
+        const rows = [];
+        ids.forEach((id, i) => {
+            if (!listed[i])
+                return;
+            const current = this.liveEntryFor(id);
+            if (current !== undefined)
+                rows.push(livePendingRowOf(current));
+        });
         return rows;
     }
     hasLivePendingFromLeg(names) {

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.lineage_rerooted", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed", "memory.harvest_refused", "memory.harvest_conflict", "config.legacy_tool_name", "config.read_deny_floor_unkept"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -121,6 +121,17 @@ export declare function engineNoticeEventData(notice: {
 export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => unknown;
 /** 口的槽位(闭集):`live` = 流上的人(SSE),`durable` = 这条 run 的事件账。{@link EngineNoticeRouter.routeConfirmed} 只数 `durable` 槽的落账确认。 */
 export type EngineNoticeSlot = "live" | "durable";
+/**
+ * 分流器收的通告形:引擎的四键(`code` / `message` / `detail` / 顶层 `sessionId`)加本服务的一只**投递键** `taskId` ——
+ * 在场 = 这条通告说的是哪一条 run(run 资源 id),只投给登记了同一条 run 的腿;缺席 = 按会话投(引擎的通告都不带它)。投递键不上 wire(行里没有它)。
+ */
+export interface RoutedNotice {
+    readonly code: string;
+    readonly message: string;
+    readonly detail?: Record<string, unknown>;
+    readonly sessionId?: unknown;
+    readonly taskId?: unknown;
+}
 /** 一条腿的两只具名口(各自可缺席:bg 腿没有 live SSE,ephemeral sync 腿没有账本)。 */
 export interface EngineNoticeLegSlots {
     readonly live?: EngineNoticeWireSink;
@@ -142,6 +153,11 @@ export interface EngineNoticeLegSlots {
  * 药:每次 `registerLeg` 铸一个单调 legId,`route` **只投最新代**;旧代的口留在表里(它自己的注销仍
  * 按身份精确删,不会误删新代),但一帧都收不到。方向 = fail-closed(宁可旧腿少一帧,不可新腿的事实
  * 写进旧腿的账)。
+ *
+ * 🔴 **反方向同一条:点名了 run 的通告不进别的 run 的账**(投递键 `taskId`,{@link RoutedNotice})。本服务按腿作用域定归属的通告
+ * (`read-deny-floor-notice.ts`:腿派出去的 run 的那一帧)带上这条腿的 run;腿的作用域可以被续延留住(后台子代在腿收场之后才准备),
+ * 那一刻同会话的最新一代可能已是下一条 run ⇒ 最新一代登记的 run 不是点名的那一条 ⇒ 不投。腿登记时带它写的那条 run(`registerEngineNoticeLeg` 的 `taskId`);
+ * 引擎的通告不带投递键,照旧按会话投。
  */
 export declare class EngineNoticeRouter {
     private readonly legs;
@@ -150,7 +166,7 @@ export declare class EngineNoticeRouter {
      *
      * 每只口各自 try 隔离在 {@link route} 里,单口抛不牵连同腿另一口。
      */
-    registerLeg(sessionId: string, slots: EngineNoticeLegSlots): () => void;
+    registerLeg(sessionId: string, slots: EngineNoticeLegSlots, taskId?: string): () => void;
     /** 单口腿的便捷形(测试用):登记为 **durable** 槽 —— 这样 `route()` 与 `routeConfirmed()` 两条路都能用一只口测到(live 槽对后者结构上恒不计)。 */
     register(sessionId: string, sink: EngineNoticeWireSink): () => void;
     /** 诊断/门用:某会话此刻**最新代**有几只口在听(旧代不计——它们收不到帧)。 */
@@ -158,28 +174,18 @@ export declare class EngineNoticeRouter {
     /** 诊断/门用:某会话此刻有几代腿在表里(>1 = 正处在换代窗内)。 */
     legCount(sessionId: string): number;
     /**
-     * 分流器的 wire 半场。返回**真投出去的口数**(0 = 没投:非白名单码 / 缺 sessionId / 该会话无活跃腿)。
+     * 分流器的 wire 半场。返回**真投出去的口数**(0 = 没投:非白名单码 / 缺 sessionId / 该会话无活跃腿 / 点名的 run 不是最新一代登记的那一条)。
      *
      * 单只口抛错**不吃掉同腿的其它口**(fleet bus 订阅者隔离同理由),并按 F 类登记留痕。
      */
-    route(notice: {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }, nowMs?: number): number;
+    route(notice: RoutedNotice, nowMs?: number): number;
     /**
      * [ref](codex r1-F2 / r2-F1;[ref] opus 腿 L2 改按槽判):同一只扇出,但**等**每只口交回的持久化结果 —— 返回**确认落账**的口数:
      * 只数 **`durable` 槽**里交回 thenable 且兑现 `true` 的口;兑现 `false` / 拒绝不算;`live` 槽**结构上不计**(不管它返回什么 —— 流上的人收没收到说明不了落账;
      * 修前按「交回 thenable」反推是不是 durable 口,哪天 live 口改成 async 返回 `true` 就会被计成落账)。给「投出之后要记一笔『告知过』」的铸点用:
      * 记账必须跟在**落账**之后,不能跟在「调用了口」之后(后台腿唯一的口是事件账 append,写失败时 `route()` 的计数照样是 1)。判据(白名单 / 归属 / 最新代 / 隔离)与 `route()` 逐字同一条。
      */
-    routeConfirmed(notice: {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }, nowMs?: number): Promise<number>;
+    routeConfirmed(notice: RoutedNotice, nowMs?: number): Promise<number>;
     /** 两只入口共用的扇出:返回每只**没抛**的口的持久化结果(promise 形一律先接住拒绝 ⇒ 绝不留未处理拒绝)。 */
     private fanOut;
 }
@@ -197,6 +203,8 @@ export declare const defaultEngineNoticeRouter: EngineNoticeRouter;
  */
 export declare function registerEngineNoticeLeg(opts: {
     sessionId: string | undefined;
+    /** 这条腿写的那条 run(run 资源 id = 本腿 `spec.taskId`;没有 run 资源 ⇒ 缺席)—— 点名了 run 的通告只投给登记了同一条 run 的腿。 */
+    taskId?: string;
     live?: EngineNoticeWireSink;
     durable?: EngineNoticeWireSink;
     router?: EngineNoticeRouter;
@@ -210,11 +218,6 @@ export declare function registerEngineNoticeLeg(opts: {
      * `route()` 恒返 0 —— 一条结构上永远投不出去的用户面披露,就是本仓 `task.user_steer_undrained` 陈腐明拒
      * 那一族的病。缺席/空数组 ⇒ 一个字节不投(既有腿逐字不变)。
      */
-    pending?: readonly {
-        code: string;
-        message: string;
-        detail?: Record<string, unknown>;
-        sessionId?: unknown;
-    }[];
+    pending?: readonly RoutedNotice[];
 }): () => void;
 //# sourceMappingURL=engine-notice-wire.d.ts.map

package/dist/trace/engine-notice-wire.js

@@ -54,6 +54,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.harvest_refused",
     "memory.harvest_conflict",
     "config.legacy_tool_name",
+    "config.read_deny_floor_unkept",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {
@@ -149,9 +150,9 @@ const isThenableResult = (v) => typeof v === "object" && v !== null && typeof v.
 let nextLegId = 1;
 export class EngineNoticeRouter {
     legs = new Map();
-    registerLeg(sessionId, slots) {
+    registerLeg(sessionId, slots, taskId) {
         const sinks = [...(slots.live ? [{ slot: "live", sink: slots.live }] : []), ...(slots.durable ? [{ slot: "durable", sink: slots.durable }] : [])];
-        const leg = { legId: nextLegId++, sinks };
+        const leg = { legId: nextLegId++, sinks, ...(taskId !== undefined && taskId.length > 0 ? { taskId } : {}) };
         const list = this.legs.get(sessionId) ?? [];
         list.push(leg);
         this.legs.set(sessionId, list);
@@ -197,6 +198,9 @@ export class EngineNoticeRouter {
         const leg = list && list.length > 0 ? list[list.length - 1] : undefined;
         if (!leg || leg.sinks.length === 0)
             return [];
+        const named = notice.taskId;
+        if (typeof named === "string" && named.length > 0 && leg.taskId !== named)
+            return [];
         const row = engineNoticeEventData(notice, sessionId, nowMs, uuidv7());
         const outcomes = [];
         for (const { slot, sink } of leg.sinks) {
@@ -219,7 +223,7 @@ export function registerEngineNoticeLeg(opts) {
     if (live === undefined && durable === undefined)
         return () => undefined;
     const router = opts.router ?? defaultEngineNoticeRouter;
-    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) });
+    const unregister = router.registerLeg(sessionId, { ...(live ? { live } : {}), ...(durable ? { durable } : {}) }, opts.taskId);
     for (const notice of opts.pending ?? [])
         router.route(notice);
     return unregister;

package/dist/trace/ledger-sink.d.ts

@@ -69,7 +69,9 @@ export interface LedgerSink {
      *  The redaction owner is NOT this writer: it is `redactLedgerEventData` — the one confluence every ledger row
      *  crosses at the three store twins' `appendEvent` AND again on the read face (idempotent). Redacting here too
      *  would put two writers on one semantic surface; the other park writers (`http/server.ts`'s two resume legs)
-     *  would still need it, and a per-writer arm is exactly the shape that drifts. */
+     *  would still need it, and a per-writer arm is exactly the shape that drifts.
+     *  Never rejects: the park is already committed by the engine (its card is in the checkpoint store) and only the run row's park write
+     *  decides the run (`park-row-commit.ts`); an unwritable park / usage row is a loud log gap (`appendParkRow`), not a verdict. */
     appendParked(kind: ParkLedgerEventType, result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */

package/dist/trace/project.d.ts

@@ -440,8 +440,10 @@ export interface ModelUsageSeat {
  * 终局由 {@link attachModelUsage} 先结清最后一拍再落 `done`,停驻由本函数先 drain 再落停驻行。顺序属于写口、不属于调用点:
  * 只回结果的 verify 腿没有逐 turn 落账的流(无 `turn_end` 帧),挂起前的用量只有停驻这一拍才落账;若各调用点各自记得「先结清」,
  * 这条腿的账本尾帧就会是 `model_usage`,与不带 `verify` 的停驻(用量在 `turn_end` 就结清了)两形不同序(`GET /v1/runs/:id/events` 的尾帧)。
- * 用量行落不下 ⇒ 停驻行**照落**,然后把用量行的失败抛给调用方(失败语义与此前逐字同:账本里有停驻帧、调用方按「停驻没落定」收场 —— bg 腿以 `failed` 收、手里的卡作废;
- * 尽力而为的调用点(detach 腿的兜底停驻、续跑腿的重开臂)照旧吞掉它,停驻帧不因为一笔用量行的失败而缺席)。顺序变了,谁来写、写不下谁抛没有变。
+ *
+ * **不抛**:这两行是一次**已提交**停驻的投影(卡在引擎交回之前已落 checkpoint 店;停驻成立与否只由 run 行的停驻写回答,`park-row-commit.ts`)。
+ * 写不下 ⇒ 响亮留痕(`server.runs.terminal-ledger-write-failed`,`arm=park-usage` / `arm=park-row`,与终局帧写不下同一只 tag:run 行是 durable truth,
+ * 读面与收割器容忍账本尾巴缺席),调用方照常往下提交行 —— 账本写不下从不改这条 run 的判词。用量行落不下 ⇒ 停驻行照落(两笔各自留痕)。
  */
 export declare function appendParkRow(append: AppendFn, usage: ModelUsageSeat | undefined, word: ParkLedgerEventType, result: unknown, reopened?: string | null): Promise<void>;
 /**

package/dist/trace/project.js

@@ -2,6 +2,7 @@ import { admitProviderEcho, redactErrorMessage, redactModelText } from "../obser
 import { isInputAuthor, isRunOrigin, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { errorText } from "../observability/err-text.js";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { seatText } from "./exit-seat.js";
 import { sanitizeWireText } from "./engine-notice-wire.js";
@@ -328,20 +329,20 @@ export function parkEventData(result, reopened) {
     };
 }
 export async function appendParkRow(append, usage, word, result, reopened) {
-    let drainFailed = false;
-    let drainFailure;
     if (usage !== undefined) {
         try {
             await appendModelUsageDelta(append, usage.modelUsage, usage.taskId);
         }
         catch (e) {
-            drainFailed = true;
-            drainFailure = e;
+            recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=park-usage ${errorText(e)}`);
         }
     }
-    await append(word, parkEventData(result, reopened));
-    if (drainFailed)
-        throw drainFailure;
+    try {
+        await append(word, parkEventData(result, reopened));
+    }
+    catch (e) {
+        recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=park-row ${errorText(e)}`);
+    }
 }
 export function taskStartedEventData(ev) {
     return {

package/dist/trace/redact.d.ts

@@ -266,6 +266,18 @@ export declare function redactSecrets(text: string, opts?: {
     json?: boolean;
     before?: string;
 }): string;
+/**
+ * **一个孤立的标识符(目录条目名)本身是不是一枚凭据形** —— 与 {@link redactSecretsWithArms} 的强臂读法是**两个问题**:那一个问「这段自由文本里有没有一枚凭据」
+ * (规则素材闸:整条命令),这一个问「这个孤立的值**本身**是不是一枚凭据」。三条律,都不带一条自己的正则,读的是同一个候选池、同一张臂表:
+ *  ① **档 `"bounded-unit"`**([ref],{@link RedactionScope}):标识符不是自由文本,词法关键字臂出局 —— `tokenizer-model-2026-11-08` 里的 `token` 不是「令牌关键字 + 值」
+ *     (自由文本档对它的读数是 `token «redacted»`);值形臂〔前缀 + 值形 + 长度下限〕与结构锚臂留在档里;
+ *  ② **只认强证据臂**(`full` 档;弱证据残片臂是为兜上游截断过的残片而宁多脱的短前缀启发式,被判的是运维写的完整串,它们的前提不成立);
+ *  ③ **凭据形在串首**(**同一条**强认领起点 = 0 —— 串首是弱认领、强认领嵌在后面的不算,如 `ASIAPACIFIC1.mask-rcnn-…`):「名字**就是**一枚凭据」是把密钥误贴进名字位的形;名字里嵌着的 `sk-` + 长体(`mask-rcnn-resnet50-fpn-1x-coco` 里的 `sk-rcnn-…`,
+ *     脱敏器在自由文本里为真钥紧贴普通词字符也遮,宁多脱)不是 —— 拒收一个现实名字的代价(模型不可用)与多遮一截日志的代价不是一个量级。
+ * 只问不出门(`observe: false`,不计「已脱」读数)。实际判别力 = 「值段带已知凭据前缀」({@link unitCarriesCredential} 顶注的 🚧):没有前缀的高熵串不认 ——
+ * 是「认得出的凭据形不收」,不是「名字里不会有秘密」。读者:目录条目名的入口判据(`model-entry-refusal.ts`)。
+ */
+export declare function isCredentialShapedUnit(unit: string): boolean;
 /**
  * 脱敏 + **这一遍命中了哪些档位的臂**({@link RedactionArm} 闭集两词)—— 与 {@link redactSecrets} 同一只
  * 脱敏器、同一张表、同一遍扫描的另一个出口。