@sema-agent/server 7.148.0 → 7.150.0

package/dist/adoption/wire.d.ts

@@ -71,10 +71,10 @@ export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota",
 export type NotMigratedFace = (typeof NOT_MIGRATED_FACES)[number];
 export declare const AdoptionNotMigratedSchema: z.ZodObject<{
     face: z.ZodEnum<{
+        "org-delivery-quota": "org-delivery-quota";
         "usage-window": "usage-window";
         "cost-quota": "cost-quota";
         "rate-limit": "rate-limit";
-        "org-delivery-quota": "org-delivery-quota";
         "approval-exemption-grantor": "approval-exemption-grantor";
         "approval-ask-decision-actor": "approval-ask-decision-actor";
         "image-bake-requested-by": "image-bake-requested-by";
@@ -120,10 +120,10 @@ export declare const AdoptionReportSchema: z.ZodObject<{
     }, z.core.$strict>>;
     notMigratedByDesign: z.ZodArray<z.ZodObject<{
         face: z.ZodEnum<{
+            "org-delivery-quota": "org-delivery-quota";
             "usage-window": "usage-window";
             "cost-quota": "cost-quota";
             "rate-limit": "rate-limit";
-            "org-delivery-quota": "org-delivery-quota";
             "approval-exemption-grantor": "approval-exemption-grantor";
             "approval-ask-decision-actor": "approval-ask-decision-actor";
             "image-bake-requested-by": "image-bake-requested-by";
@@ -182,10 +182,10 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
         }, z.core.$strict>>;
         notMigratedByDesign: z.ZodArray<z.ZodObject<{
             face: z.ZodEnum<{
+                "org-delivery-quota": "org-delivery-quota";
                 "usage-window": "usage-window";
                 "cost-quota": "cost-quota";
                 "rate-limit": "rate-limit";
-                "org-delivery-quota": "org-delivery-quota";
                 "approval-exemption-grantor": "approval-exemption-grantor";
                 "approval-ask-decision-actor": "approval-ask-decision-actor";
                 "image-bake-requested-by": "image-bake-requested-by";

package/dist/approval-card.d.ts

@@ -86,14 +86,14 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         name: "name";
         path: "path";
         host: "host";
+        tool: "tool";
+        pattern: "pattern";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
-        pattern: "pattern";
         subpath: "subpath";
         name_prefix: "name_prefix";
         subdomain: "subdomain";
-        tool: "tool";
     }>;
     command: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
@@ -105,14 +105,14 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
             name: "name";
             path: "path";
             host: "host";
+            tool: "tool";
+            pattern: "pattern";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
-            pattern: "pattern";
             subpath: "subpath";
             name_prefix: "name_prefix";
             subdomain: "subdomain";
-            tool: "tool";
         }>;
         command: z.ZodString;
         segment: z.ZodString;
@@ -408,7 +408,7 @@ type ClosedWordOf<S extends ClosedWordSeat> = S extends AskClosedWordSeat ? NonN
  * {@link parkRowFacts} 读它);`CheckpointSummary` 不回显(core 原句「read the row」)⇒ inbox 行不带。
  *
  * 判据(display,不是裁决输入 —— 裁决在 core 的仲裁点,本仓无人值守腿的按类作答读的是 core 交来的 `AskRequest.classes` 本身,不经本函数):
- *  · **两键都缺席 ⇒ 缺席**(不计数):老引擎(core 7.37.0 之前)、老行(续跑不补,KL-1214-b)、不盖 `origin` 的站(KL-1214-a)。缺席从不编默认类;
+ *  · **两键都缺席 ⇒ 缺席**(不计数):老引擎(core 7.37.0 之前)、老行(续跑不补,[ref])、不盖 `origin` 的站([ref])。缺席从不编默认类;
  *  · **在场 ⇒ 读法就是 core 的屏** `screenAskClassMembers`([ref] ⑥,core 7.38.0 [ref] 导出;引擎在写停车行前用的同一只):`askClass` 在集、`classes`
  *    非空数组且每员在集、无重复、按 `ASK_CLASSES` 规范序取首员 === `askClass`;屏收 ⇒ 投屏给的规范序副本。屏拒(半对 / 集外词 / 首员不符 /
  *    重复员)⇒ **两键都不投**(卡上少一行类 ≪ 卡上出现生词或半只对)+ 计一次 `server.approval-card.closed-word-out-of-set`([ref] 族,detail 前缀
@@ -574,15 +574,15 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
     rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
     approvalCard: z.ZodOptional<z.ZodEnum<{
-        shell: "shell";
-        plan: "plan";
-        skill: "skill";
         question: "question";
+        fetch: "fetch";
         "file-edit": "file-edit";
         "file-write": "file-write";
         "notebook-edit": "notebook-edit";
-        fetch: "fetch";
+        shell: "shell";
+        skill: "skill";
         workflow: "workflow";
+        plan: "plan";
         generic: "generic";
         "computer-access": "computer-access";
         "computer-control": "computer-control";
@@ -590,10 +590,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
         member: z.ZodEnum<{
-            hook: "hook";
-            skill: "skill";
-            deployment: "deployment";
             request: "request";
+            deployment: "deployment";
+            skill: "skill";
+            hook: "hook";
             persisted: "persisted";
         }>;
         entries: z.ZodArray<z.ZodString>;
@@ -606,14 +606,14 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             name: "name";
             path: "path";
             host: "host";
+            tool: "tool";
+            pattern: "pattern";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
-            pattern: "pattern";
             subpath: "subpath";
             name_prefix: "name_prefix";
             subdomain: "subdomain";
-            tool: "tool";
         }>;
         command: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
@@ -625,14 +625,14 @@ export declare const ApprovalCardSchema: z.ZodObject<{
                 name: "name";
                 path: "path";
                 host: "host";
+                tool: "tool";
+                pattern: "pattern";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
-                pattern: "pattern";
                 subpath: "subpath";
                 name_prefix: "name_prefix";
                 subdomain: "subdomain";
-                tool: "tool";
             }>;
             command: z.ZodString;
             segment: z.ZodString;
@@ -692,8 +692,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceSessionId: z.ZodOptional<z.ZodString>;
     agentId: z.ZodOptional<z.ZodString>;
@@ -708,7 +708,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }>;
         words: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
-        by: z.ZodCustom<"org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
+        by: z.ZodCustom<"content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
         words: z.ZodString;
     }, z.core.$strict>]>>>;
     delegation: z.ZodOptional<z.ZodObject<{
@@ -752,15 +752,15 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
         rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
         approvalCard: z.ZodOptional<z.ZodEnum<{
-            shell: "shell";
-            plan: "plan";
-            skill: "skill";
             question: "question";
+            fetch: "fetch";
             "file-edit": "file-edit";
             "file-write": "file-write";
             "notebook-edit": "notebook-edit";
-            fetch: "fetch";
+            shell: "shell";
+            skill: "skill";
             workflow: "workflow";
+            plan: "plan";
             generic: "generic";
             "computer-access": "computer-access";
             "computer-control": "computer-control";
@@ -768,10 +768,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
             member: z.ZodEnum<{
-                hook: "hook";
-                skill: "skill";
-                deployment: "deployment";
                 request: "request";
+                deployment: "deployment";
+                skill: "skill";
+                hook: "hook";
                 persisted: "persisted";
             }>;
             entries: z.ZodArray<z.ZodString>;
@@ -784,14 +784,14 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 name: "name";
                 path: "path";
                 host: "host";
+                tool: "tool";
+                pattern: "pattern";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
-                pattern: "pattern";
                 subpath: "subpath";
                 name_prefix: "name_prefix";
                 subdomain: "subdomain";
-                tool: "tool";
             }>;
             command: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
@@ -803,14 +803,14 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                     name: "name";
                     path: "path";
                     host: "host";
+                    tool: "tool";
+                    pattern: "pattern";
                     exact: "exact";
                     prefix: "prefix";
                     wildcard: "wildcard";
-                    pattern: "pattern";
                     subpath: "subpath";
                     name_prefix: "name_prefix";
                     subdomain: "subdomain";
-                    tool: "tool";
                 }>;
                 command: z.ZodString;
                 segment: z.ZodString;
@@ -870,8 +870,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceSessionId: z.ZodOptional<z.ZodString>;
         agentId: z.ZodOptional<z.ZodString>;
@@ -886,7 +886,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }>;
             words: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
-            by: z.ZodCustom<"org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
+            by: z.ZodCustom<"content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
             words: z.ZodString;
         }, z.core.$strict>]>>>;
         delegation: z.ZodOptional<z.ZodObject<{

package/dist/approval-gate-currency.d.ts

@@ -61,7 +61,7 @@
  * 行没了 ⇒ `unknown`(`row_absent`;应答口 PARKED 臂的 404 `not_found.approval` 同判)。
  *
  * ## 盲区(core 的筛仍不判的一处,如实写下)
- *  · 种类 × 当事方的配对(结算种类与 `settlement.who` 的当事方是否相配)—— 筛不判(core KL-1265-b),本判官也不核:读的是种类。只有坏行 / 手改行才走得到。
+ *  · 种类 × 当事方的配对(结算种类与 `settlement.who` 的当事方是否相配)—— 筛不判(core [ref]),本判官也不核:读的是种类。只有坏行 / 手改行才走得到。
  *  (时刻与方向两处自 core 7.56.0 [ref] 起由筛判:I10 / I11。trace 投影读同一种记录、经同一只筛,零改即得 I10 —— 坏时刻在两个读者那里是同一个答法。)
  */
 import { type Checkpoint, type CheckpointToken, type SettlementKind } from "@sema-agent/core";

package/dist/approval-leg-origin.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 一条腿的**审批出处两格**:执行车道 + 这条腿的会话此刻的住客令牌(化身,`session-incarnation.ts`)。
+ *
+ * 两格都取自装配点手里**同一只**执行上下文(`http/execution-context.ts` 的 `ExecutionContext`:解析器步 ① 那一次行读的住客 + 由此定的车道)。三条提交腿
+ * (同步 · 后台 · 续跑)与 parked 赎回腿经 {@link approvalLegOriginOf} 一处读、一处展开进 `ToolApprovalRunContext` / `boundAsk` / `boundUnattendedAsk` /
+ * `approverSeatFor` 的身份 —— 出处的新格只在这一处加,不会有哪个装配点漏带。读者:协调器的「本会话放行」进程内表(`tool-approval.ts` `sessionAllowKey`),
+ * 键含 {@link ApprovalLegOrigin.incarnation} ⇒ 会话删了再登记(同一个 id、新的一位住客)之后,上一位住客点的放行读不中。
+ *
+ * 叶模块(只有类型位的 import):装配点的各层模块都从这里取,不经协调器本体,不构成运行时环。
+ */
+import type { ExecutionLane } from "./execution-lane-caps.js";
+export interface ApprovalLegOrigin {
+    /**
+     * 这条腿的执行车道(必填:出处没有车道的问不可表示)—— 每只席的身份都从所在边界的执行上下文铸(`ctx.lane`)。铸入三句:新行 ⇒ 本出处的车道;
+     * 既有行命中 / 收养 ⇒ 行上的车道(派生只对新行有意义,既有行一律采信行上的);无问店的活登记 ⇒ 本出处的车道。
+     */
+    readonly executionLane: ExecutionLane;
+    /**
+     * 这条腿的会话(`sessionId`)此刻的**住客令牌**(化身,`session-incarnation.ts`)—— 装配点写所在边界执行上下文那一读的住客(`ctx.occupant.incarnation`,
+     * 与 {@link executionLane} 同一只上下文、同一次行读;不另读第二次)。出处带化身:「本会话放行」(协调器的进程内授权表)的键含它,读写两点都取这一格
+     * (与 `sessionId` 同源同理由随**出处**走,不取投递连接的)⇒ 会话删了再登记(同一个 id、新的一位住客)之后,上一位住客点的放行读不中。
+     * 缺席 = 这条腿读不出这位住客(会话店不带执行席 / 腿没有会话):这条腿上**不读也不铸**进程内授权(点 `allow_session` 只放行这一次,回执 `rememberApplied:false`)。
+     */
+    readonly incarnation?: string;
+}
+/** 执行上下文 → 这条腿的出处两格({@link ApprovalLegOrigin})。形参只取两样(车道、住客),不依赖 http 层的类型。 */
+export declare function approvalLegOriginOf(execution: {
+    readonly lane: ExecutionLane;
+    readonly occupant?: {
+        readonly incarnation: string;
+    } | undefined;
+}): ApprovalLegOrigin;
+//# sourceMappingURL=approval-leg-origin.d.ts.map

package/dist/approval-leg-origin.js

@@ -0,0 +1,4 @@
+export function approvalLegOriginOf(execution) {
+    return { executionLane: execution.lane, ...(execution.occupant !== undefined ? { incarnation: execution.occupant.incarnation } : {}) };
+}
+//# sourceMappingURL=approval-leg-origin.js.map

package/dist/audit.d.ts

@@ -36,7 +36,7 @@ export interface SessionAudit {
  * 真源 = `resume_anchor`(锚店 `listBySession` 的读数),本表只是它对**一位读者**的一次投影。
  */
 export type RewindHandles = ReadonlyMap<string, string>;
-/** 会话视图读口(`ServiceDeps.sessionAudit`)的读者参数:`reader` = 读这张视图的**已验身份**(无身份 = `null`)。给了 ⇒ 这是一次**视图读**:用户消息行投回退手柄、体顶层投 `agent`(`session-agent.ts` 的 `readSessionAgent`);
+/** 会话视图读口(`ServiceDeps.sessionAudit`)的读者参数:`reader` = 读这张视图的**已验身份**(无身份 = `null`)。给了 ⇒ 这是一次**视图读**:用户消息行投回退手柄、体顶层投 `agent`(`http/owner-access.ts` 的 `readSessionAgent`);
  *  不给(只要归属的调用方:memory-status / 自助抹除)⇒ 两样投影的读都不付。 */
 export interface SessionAuditReadOpts {
     readonly reader: Subject | null;

package/dist/audit.js

@@ -4,7 +4,7 @@ import { PgSessionStorage } from "./stores-sql/pg-session-storage.js";
 import { LocalSessionWindow } from "./plugins/local-session-window.js";
 import { redactModelText } from "./observability/run-terminal.js";
 import { redactDeepWith } from "./trace/redact.js";
-import { projectToolStructured } from "./trace/tool-output-media.js";
+import { projectToolCard } from "./trace/tool-card.js";
 import { INJECTED_BLOCK_RE, isAttachmentFrame } from "./user-authored-text.js";
 import { ownerKeyOf, sameKey } from "./owner-faces.js";
 export function buildRewindHandles(anchors, reader) {
@@ -68,7 +68,7 @@ function withRewindHandles(messages, entries, handles) {
 }
 const deepScrub = (v) => redactDeepWith(v, redactModelText);
 const textSlot = (v) => (typeof v === "string" ? redactModelText(v) : deepScrub(v));
-const readToolCard = (v) => projectToolStructured(v, deepScrub);
+const readToolCard = (v) => projectToolCard(v, deepScrub);
 function readLeaf(treatment, v) {
     switch (treatment) {
         case "text": return textSlot(v);

package/dist/auth-bridge.d.ts

@@ -58,14 +58,22 @@ type ReportedOutcome = {
  * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
-/** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */
+/**
+ * The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache, and the issuer it verifies for.
+ * This is also the type of the injected seat (`ServiceDeps.webAdminJwtVerifier`): an embedder's verifier states which issuer it verifies, so `createHttpServer`
+ * can pair it with the config's bridge ("which issuer does this deployment accept" has one source — the config — and one comparison, at that seat).
+ */
 export interface WebAdminJwtVerifier {
+    /** The issuer this verifier verifies tokens for, in {@link normalizeBridgeIssuer} form (what the R4 `iss` check compares against). The factory mints it from its own option; the seat compares it with the config's reading. */
+    readonly issuer: string;
     verify: (bearer: string) => Promise<VerifyOutcome>;
 }
 /** 缓存键的常规刷新周期缺省(秒):过期后下一发在后台重拉,当前请求不等。 */
 export declare const DEFAULT_JWKS_TTL_SEC: number;
 /** 一次 JWKS 拉取的时限(毫秒):kid 未知、超离线宽限、后台刷新三条路用同一只拉取,同一个时限。 */
 export declare const JWKS_FETCH_TIMEOUT_MS = 10000;
+/** The one normal form of a bridge issuer: trailing slashes folded. The R4 `iss` check compares both sides in this form, and the `createHttpServer` pairing seat compares the verifier's {@link WebAdminJwtVerifier.issuer} with the config's reading in this same form (one reading, so the two can never disagree about what "the same issuer" means). */
+export declare const normalizeBridgeIssuer: (s: string) => string;
 /**
  * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为拒因闭集
  * {@link AuthBridgeRefusal}(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。

package/dist/auth-bridge.js

@@ -40,9 +40,9 @@ function b64urlJson(seg) {
         return undefined;
     }
 }
-const stripSlash = (s) => s.replace(/\/+$/, "");
+export const normalizeBridgeIssuer = (s) => s.replace(/\/+$/, "");
 export function createWebAdminJwtVerifier(opts) {
-    const issuer = stripSlash(opts.issuer);
+    const issuer = normalizeBridgeIssuer(opts.issuer);
     const displayIssuer = buildDisplaySafeUrl(issuer);
     const jwksUrl = opts.jwksUrl ?? `${issuer}${WEB_ADMIN_JWKS_PATH}`;
     const clockSkewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
@@ -122,7 +122,7 @@ export function createWebAdminJwtVerifier(opts) {
         const kid = typeof header.kid === "string" ? header.kid : undefined;
         if (!kid)
             return fail("malformed");
-        const iss = typeof payload.iss === "string" ? stripSlash(payload.iss) : undefined;
+        const iss = typeof payload.iss === "string" ? normalizeBridgeIssuer(payload.iss) : undefined;
         if (iss !== issuer)
             return fail("unknown_issuer", kid);
         if (classifyTimeClaims(payload, Math.floor(now() / 1000), clockSkewSec) !== "ok")
@@ -163,6 +163,6 @@ export function createWebAdminJwtVerifier(opts) {
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: "ok" });
         return { ok: true, identity: { ...mapped.identity, scope: scoped.scope } };
     }
-    return { verify };
+    return { issuer, verify };
 }
 //# sourceMappingURL=auth-bridge.js.map

package/dist/auth-keys.d.ts

@@ -2,7 +2,8 @@
  * AUTH KEY-SET parsing ([ref] A4) — the env→key-set decoders for the two D-G credential planes, moved VERBATIM
  * out of security.ts: {@link parseApprovalHmacKeys} (APPROVAL_HMAC_KEYS — the rotating HMAC secret set, decision
  * INTEGRITY) and {@link parsePrincipalJwks} (PRINCIPAL_JWT_PUBKEYS — the rotating issuer public-key set, principal
- * IDENTITY). config.ts consumes ONLY these two functions + their row types at env-load time, and importing them from
+ * IDENTITY), plus {@link parseServiceAuthTokens} (SERVICE_AUTH_TOKENS — the per-system service token table). config.ts consumes
+ * these decoders + their row types at env-load time, and importing them from
  * security.ts made the base config layer value-depend on the whole 55KiB auth module (lens2 §F). This file is a pure
  * leaf (JSON.parse + shape filters, zero repo imports); the VERIFIERS that consume the parsed key-sets
  * (verifyApprovalHmac / verifyPrincipalJwt) stay in ./approval-hmac.ts and ./principal-jwt.ts; consumers import these four names from HERE ([ref] 兼容面全清).
@@ -54,4 +55,12 @@ export interface PrincipalJwtKey {
  *  [ref]: fail-closed 语义逐字不变,但每条被丢弃的条目经 `onReject` 报出(序号 + 缺陷字段名,不带值)——
  *  这里的 key 是**公**钥,但 reason 仍只说字段名,与 HMAC 那条同形(两个出口的口径不该分岔)。 */
 export declare function parsePrincipalJwks(raw: string | undefined, onReject: OnKeySetRejection): PrincipalJwtKey[];
+/**
+ * Parse SERVICE_AUTH_TOKENS — the per-system service credential table, `tok=system` pairs separated by commas (token →
+ * system name; the `source` of a run is derived from the token, never self-asserted). Each pair is trimmed and split at
+ * its FIRST `=` (a system name may hold `=`); a pair without `=`, or with an empty token or system, is not an entry.
+ * THE one reading: `loadConfig` builds `authTokens` from it, and the withheld table declares each token as a credential
+ * value of its own (`server-secret-env.ts`) — a copy of one token under another variable name is the same credential.
+ */
+export declare function parseServiceAuthTokens(raw: string | undefined): Record<string, string>;
 //# sourceMappingURL=auth-keys.d.ts.map

package/dist/auth-keys.js

@@ -63,4 +63,12 @@ export function parsePrincipalJwks(raw, onReject) {
     });
     return out;
 }
+export function parseServiceAuthTokens(raw) {
+    return Object.fromEntries((raw ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.includes("="))
+        .map((s) => [s.slice(0, s.indexOf("=")).trim(), s.slice(s.indexOf("=") + 1).trim()])
+        .filter(([tok, sys]) => tok.length > 0 && sys.length > 0));
+}
 //# sourceMappingURL=auth-keys.js.map

package/dist/background-session-reap.d.ts

@@ -48,7 +48,7 @@ export interface SessionHardReap {
  * 两处调用(见文件头 ①),都 `await`:E21 删除级联 `includeRetained:false`(显式活服务照留);停止口照传请求体。应答在硬面之后发,
  * 代价 = 有 shell 行刚被软停的会话,DELETE / 停止口的应答慢到最后一行的「软停 + 宽限」(通常一次宽限;操作员旋钮 `HOST_BG_KILL_GRACE_MS`,缺省 1000;要几乎不等写 `1` ——
  * `numEnvOr` 把 `0` 读作缺席、回落缺省,与它供的其余执行车道旋钮同一条语义)。
- * 受委托帮手的 shell 挂在帮手自己的会话上,本函数碰不到(core KL-1107a / [ref],候 core)。
+ * 受委托帮手的 shell 挂在帮手自己的会话上,本函数碰不到(core [ref] / [ref],候 core)。
  * 注册表是**进程内**的:只收本副本上的行(多副本部署里别的副本上的行由那个副本自己的出口收)。
  */
 export declare function reapSessionBackgroundHard(sessionId: string, scope: string, opts: {

package/dist/boot/deferred-sandbox-path-env.d.ts

@@ -17,7 +17,9 @@
  *
  * ## 三条不可动的裁定
  *
- *  1. **`absolutePath` 一面不转发**,沿用词法规则(POSIX 绝对形归一 / NUL 拒 / 非绝对形 err)。
+ *  1. **`absolutePath` 一面不转发**,只读执行缝路径律(`plugins/exec-path-law.ts`):POSIX 绝对形**原样**交出(`..` / `.` 不折 ——
+ *     不折才与工具同读:七条车道的工具也原样把它交给沙箱的文件系统,`..` 由那块盘解;门的真身判决随后经下面四腿转发问的正是这只拼法)/
+ *     NUL 拒 / 非绝对形 err。
  *     真 env 的 `absolutePath` 会按 **env 自己的 cwd** 解析相对路径,而工具真写处按 engine 跟踪的
  *     cwd 解析——两个基准不同,转发它等于拿错基准铸 canonical key,而**错误的 allow 比没有门更糟**。
  *     相对形 / `~` / 盘符形因此照旧 err ⇒ `canonicalizeTarget` 失败 ⇒ 写门 `ask`(fail-closed)。
@@ -115,7 +117,7 @@ export interface DeferredSandboxPathEnvOptions {
     logger?: SandboxPathEnvLogger;
 }
 /**
- * 写门用的 ExecutionEnv 代理(见文件头)。fs **读**原语转发 slot 里的真 env,`absolutePath` 保留词法形,
+ * 写门用的 ExecutionEnv 代理(见文件头)。fs **读**原语转发 slot 里的真 env,`absolutePath` 绝对形原样(不折,见裁定 1),
  * 其余一切(写面 / shell 面 / listDir …)继承 `StubExecutionEnv` 的 `not_supported`。
  *
  * **继承而非逐一手写**是刻意的:core 日后给 `ExecutionEnv` 加必填面时,新面会随 `StubExecutionEnv`
@@ -130,7 +132,7 @@ export declare class DeferredSandboxPathEnv extends StubExecutionEnv {
     constructor(opts: DeferredSandboxPathEnvOptions);
     /** 取真 env;取不到就地铸 fail-closed 错误(并留痕一次)。 */
     private bound;
-    /** 词法一面,**不**转发 —— 理由见文件头裁定 1。 */
+    /** 只读路径律的一面,**不**转发 —— 理由见文件头裁定 1。绝对形原样:门与工具读同一只拼法,`..` 交给沙箱的文件系统(经四腿转发的真身判决)。 */
     absolutePath(path: string): Promise<Result<string, FileError>>;
     exists(path: string, abortSignal?: AbortSignal): Promise<Result<boolean, FileError>>;
     canonicalPath(path: string, abortSignal?: AbortSignal): Promise<Result<string, FileError>>;

package/dist/boot/deferred-sandbox-path-env.js

@@ -1,5 +1,4 @@
 import { FileError, StubExecutionEnv, err, ok } from "@sema-agent/core";
-import { normalizeAbsolutePathLexically } from "../task-cwd.js";
 const MAX_BOUND_SESSIONS = 4096;
 export class SandboxPathEnvSlots {
     bySession = new Map();
@@ -128,7 +127,7 @@ export class DeferredSandboxPathEnv extends StubExecutionEnv {
         if (!path.startsWith("/")) {
             return Promise.resolve(err(new FileError("not_supported", "this gate cannot resolve a non-absolute path (the sandbox working directory is not the gate's to guess)", path)));
         }
-        return Promise.resolve(ok(normalizeAbsolutePathLexically(path)));
+        return Promise.resolve(ok(path));
     }
     async exists(path, abortSignal) {
         const b = this.bound(path, "exists");

package/dist/boot/execution-env.js

@@ -40,7 +40,7 @@ import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
 import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
-import { warnReadDenyFloorUnkept } from "./execution-lane.js";
+import { settleReadDenyFloor } from "./execution-lane.js";
 import { seatText } from "../trace/exit-seat.js";
 import { countSessionResidentBackground } from "../session-resident-background.js";
 function boundedSessionSetter(map, maxEntries) {
@@ -384,22 +384,21 @@ export function createExecutionEnv(ctx) {
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
-                backgroundShell: config.requirePrincipal !== true,
+                backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config),
             };
-            executionEnvFactory = (ctx) => {
+            executionEnvFactory = hostExecutionEnvFactory(hostCfg, (ctx) => {
                 if (ctx.isolation === "worktree")
                     throw hostWorktreeUnwrappedRefusal();
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
                 const inheritEnv = perSessionInheritEnv.get(ctx.sessionId);
-                const env = hostExecutionEnvFactory({
-                    ...hostCfg,
+                return {
                     ...(cwd ? { workspaceDir: cwd } : {}),
                     ...(shellEnv ? { env: shellEnv } : {}),
                     ...(inheritEnv !== undefined ? { inheritEnv } : {}),
-                })(ctx);
-                return lspManager && !cwd ? evictLspOnDestroy(env, lspManager) : env;
-            };
+                    ...(lspManager && !cwd ? { minted: (env) => void evictLspOnDestroy(env, lspManager) } : {}),
+                };
+            });
         }
     }
     else if (config.remoteExec.provider === "local-docker") {
@@ -441,14 +440,14 @@ export function createExecutionEnv(ctx) {
             });
         }
         else if (config.remoteExec.provider === "host") {
-            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true, gitBase: true });
+            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config), gitBase: true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),
                 ...(config.worktreeIsolation.commit ? { commit: config.worktreeIsolation.commit } : {}),
                 baseEnvForGit: gitBaseEnv,
                 rootEnvAt: (dir) => {
-                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: config.requirePrincipal !== true });
+                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config) });
                     return lspManager ? evictLspOnDestroy(env, lspManager) : env;
                 },
                 logger,
@@ -501,7 +500,7 @@ export function createExecutionEnv(ctx) {
         if (config.remoteExec.provider === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
-    warnReadDenyFloorUnkept(config, logger);
+    settleReadDenyFloor(config, logger);
     const unreadableReported = new Set();
     let stallReapFailureReported = false;
     const stallMs = config.backgroundAgentStallMs;

package/dist/boot/execution-lane.d.ts

@@ -58,12 +58,14 @@ export declare function composeDeclaredExecutionLane(loaded: LoadedConfig, logge
  */
 export declare function settleHostLaneShell(config: Pick<ServiceConfig, "remoteExec">, logger: Pick<Logger, "info" | "warn">): Promise<void>;
 /**
- * **读地板的起服一行**:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
- * 起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`)。
+ * **读拒字节地板在本部署上怎么说** —— 两件事,一个入口:
+ *  ① 把部署的执行车道装给说法的属主(`read-deny-floor-notice.ts` 的 `installReadDenyFloorDeployment`):每条 run 的通告 / 结果格 / 拒句由它点名 `REMOTE_EXEC=<车道>`;
+ *  ② 起服一行:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
+ *     起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`,句子 = 每条 run 的拒句)。
  * 两个入口调同一只(与 {@link settleHostLaneShell} 同形):HTTP 服务在执行环境装配里(`boot/execution-env.ts`,有没有执行环境工厂都调),`run-local` 在宿主车道定下之后 ——
- * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先说。不要求 / 车道守地板 ⇒ 零动作。
+ * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先装、先说。不要求 / 车道守地板 ⇒ 不出那一行(装照装:车道名是每条 run 的说法要的)。
  */
-export declare function warnReadDenyFloorUnkept(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
+export declare function settleReadDenyFloor(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
 /**
  * 车道合成之后的跨域不变量 —— 表(`config-invariants.ts`)里读 `remoteExec.provider` 的那几条,boot 期 `live === next`。
  * 同步、纯判据:只读 config,不碰文件(测试可以对 `loadConfig()` 的产物直接调它)。

package/dist/boot/execution-lane.js

@@ -3,6 +3,7 @@ import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
 import { entryDeclarableRemoteExec } from "../config.js";
 import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { installReadDenyFloorDeployment } from "../read-deny-floor-notice.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 import { seatText } from "../trace/exit-seat.js";
@@ -70,7 +71,8 @@ export async function settleHostLaneShell(config, logger) {
         return;
     await settleHostShellAtBoot(logger);
 }
-export function warnReadDenyFloorUnkept(config, logger) {
+export function settleReadDenyFloor(config, logger) {
+    installReadDenyFloorDeployment(config);
     const note = buildReadDenyFloorUnkeptNote(config);
     if (note !== undefined)
         logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec.provider, note });