@sema-agent/server 7.149.0 → 7.150.0

package/dist/capability-facts.d.ts

@@ -25,7 +25,6 @@ import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/sto
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
-import { type HeadRead } from "./session-incarnation.js";
 import type { HistoryAnchorReaders } from "./history-anchor.js";
 import type { EngineHandoverDoor } from "./boot/engine-lease.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
@@ -120,29 +119,40 @@ type Store<K extends keyof Deps> = NonNullable<Deps[K]>;
 type WithMethods<T, K extends keyof T> = T & {
     [P in K]-?: NonNullable<T[P]>;
 };
+/**
+ * 见证里的 run 店 / 会话店 / 会话视图读**随调用方交来的 deps**(`D`):路由层交的是封住的视图(`route-ctx.ts` 的 `RouteDeps`:带属主的读口在型上调不了)⇒ 见证照样封着
+ * (方法在不在照判,见证交给属主存取器的口照读);装配层交完整的店 ⇒ 见证完整。事实不另开一扇读口(视图只在 `owner-access.ts` 的 `sealRouteDeps` 铸一次)。
+ */
+type Held<D, K extends keyof D> = NonNullable<D[K]>;
+/** 判过在场的方法(`K`)在见证上必有;封住的读口在场照样封着(`never`)。 */
+type Present<T, K extends PropertyKey> = T & {
+    [P in K]-?: NonNullable<P extends keyof T ? T[P] : never>;
+};
 /** 持久 run 账面在场 —— `/v1/runs/*` 族、trace / 用量统计、assistant 的 preempt / resume / plan-review、
  *  会话 detach、设备换绑都站在这一只事实上。 */
-export declare function durableRuns(d: Pick<Deps, "runStore">): Fact<"run_store_absent", {
-    runStore: Store<"runStore">;
+export declare function durableRuns<D extends Pick<Deps, "runStore">>(d: D): Fact<"run_store_absent", {
+    runStore: Held<D, "runStore">;
 }>;
-export declare function subagentSteer(d: Pick<Deps, "runStore" | "subagentSteerRegistry">): Fact<"run_store_absent" | "subagent_registry_absent", {
-    runStore: Store<"runStore">;
+export declare function subagentSteer<D extends Pick<Deps, "runStore" | "subagentSteerRegistry">>(d: D): Fact<"run_store_absent" | "subagent_registry_absent", {
+    runStore: Held<D, "runStore">;
     registry: Store<"subagentSteerRegistry">;
 }>;
-export declare function subagentOutput(d: Pick<Deps, "runStore" | "subagentTaskOutput">): Fact<"run_store_absent" | "subagent_output_face_absent", {
-    runStore: Store<"runStore">;
+export declare function subagentOutput<D extends Pick<Deps, "runStore" | "subagentTaskOutput">>(d: D): Fact<"run_store_absent" | "subagent_output_face_absent", {
+    runStore: Held<D, "runStore">;
     output: Store<"subagentTaskOutput">;
 }>;
-export declare function taskHandles(d: Pick<Deps, "runStore" | "taskHandleOutput" | "taskHandleStop">): Fact<"run_store_absent" | "task_handle_faces_absent", {
-    runStore: Store<"runStore">;
+export declare function taskHandles<D extends Pick<Deps, "runStore" | "taskHandleOutput" | "taskHandleStop">>(d: D): Fact<"run_store_absent" | "task_handle_faces_absent", {
+    runStore: Held<D, "runStore">;
     output: Store<"taskHandleOutput">;
     stop: Store<"taskHandleStop">;
 }>;
 /** 会话店按 id 读一行的唯一读口在场(core `headOf`:属主 / 住客 / 叶子一次读;「有没有」与 `session-incarnation.ts` 的 `headReadOf` 同判)。 */
-type HeadReadingSessionStore = WithMethods<OwnerAwareSessionStore, "headOf">;
+type SessionDeps = Pick<Deps, "sessionStorage">;
+type SessionWith<D extends SessionDeps, K extends PropertyKey> = Present<Held<D, "sessionStorage">, K>;
+type HeadReadingSessionStore<D extends SessionDeps> = SessionWith<D, "headOf">;
 /** 会话属主面在场(入站 owner 门的地基;缺它,带会话的门一律 fail-closed)。属主 = `headOf(id)?.owner`。 */
-export declare function sessionOwnership(d: Pick<Deps, "sessionStorage">): Fact<"session_head_face_absent", {
-    sessionStorage: HeadReadingSessionStore;
+export declare function sessionOwnership<D extends SessionDeps>(d: D): Fact<"session_head_face_absent", {
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /**
  * 执行放置读面在场:会话店带执行席(`executionPlacement`:一次行读 = 住客 + 执行放置格;SQL 两孪生与 local 恒带,引擎缺省的内存会话店没有)。
@@ -151,66 +161,62 @@ export declare function sessionOwnership(d: Pick<Deps, "sessionStorage">): Fact<
 export declare function executionPlacementRead(d: Pick<Deps, "sessionStorage">): Fact<"execution_placement_seat_absent", {
     seat: NonNullable<OwnerAwareSessionStore["executionPlacement"]>;
 }>;
-export declare function mcpReconnect(d: Pick<Deps, "runStore" | "sessionStorage">): Fact<"run_store_absent" | "session_head_face_absent", {
-    runStore: Store<"runStore">;
-    sessionStorage: HeadReadingSessionStore;
+export declare function mcpReconnect<D extends Pick<Deps, "runStore" | "sessionStorage">>(d: D): Fact<"run_store_absent" | "session_head_face_absent", {
+    runStore: Held<D, "runStore">;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /**
  * 在飞 run 的切档口(`POST /v1/runs/:id/permission-mode`)= 持久 run 账面 ∧ checkpoint 店(ctx 面)。后一格是承重的:切档要读这条 run 的
  * **存储体**(本任务 settings 的 kill-switch 由受理判官折,与提交口同一份事实),也要把准入的词写回存储体(run 模式词的唯一来源,续跑腿读它);
  * 没有 ctx 面的部署两件都做不了 ⇒ 不提供这一口(能力位 `permissionModeWrite` 同读本事实)。
  */
-export declare function permissionModeWrite(d: Pick<Deps, "runStore" | "checkpointStore">): Fact<"run_store_absent" | "checkpoint_store_absent", {
-    runStore: Store<"runStore">;
+export declare function permissionModeWrite<D extends Pick<Deps, "runStore" | "checkpointStore">>(d: D): Fact<"run_store_absent" | "checkpoint_store_absent", {
+    runStore: Held<D, "runStore">;
     checkpointStore: Store<"checkpointStore">;
 }>;
-export declare function sessionAuditView(d: Pick<Deps, "sessionAudit">): Fact<"session_audit_absent", {
-    sessionAudit: Store<"sessionAudit">;
+export declare function sessionAuditView<D extends Pick<Deps, "sessionAudit">>(d: D): Fact<"session_audit_absent", {
+    sessionAudit: Held<D, "sessionAudit">;
 }>;
 /** 会话 SSE(watch 注册表 ∧ 头读:属主门与叶子都是 `headOf` 的投影)。 */
-export declare function sessionEventStream(d: Pick<Deps, "sessionWatch" | "sessionStorage">): Fact<"session_watch_absent" | "session_head_face_absent", {
+export declare function sessionEventStream<D extends Pick<Deps, "sessionWatch" | "sessionStorage">>(d: D): Fact<"session_watch_absent" | "session_head_face_absent", {
     watch: Store<"sessionWatch">;
-    sessionStorage: HeadReadingSessionStore;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 type SessionLister = NonNullable<OwnerAwareSessionStore["listSessions"]>;
 /** 会话枚举面:会话店的 `listSessions` —— 唯一的会话 lister(run 店不列会话:只有 run 行、没有会话行的面答不了「有哪些会话」)。见证 = 已绑好宿主的那一只。 */
 export declare function sessionList(d: Pick<Deps, "sessionStorage">): Fact<"session_lister_absent", {
     lister: SessionLister;
 }>;
-export declare function sessionFork(d: Pick<Deps, "sessionStorage">): Fact<"session_fork_face_absent" | "session_head_face_absent", {
-    sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "fork">;
+export declare function sessionFork<D extends SessionDeps>(d: D): Fact<"session_fork_face_absent" | "session_head_face_absent", {
+    sessionStorage: SessionWith<D, "headOf" | "fork">;
 }>;
 /** 会话行可写位(`PATCH /v1/sessions/:id`):会话店的头读(属主 + 化身一次读 —— 门判属主,那一读就是写原语的行期望)∧ 行格写原语(锁内判、提交后另读应答行)。
  *  三只 durable 店(SQL 双生 / local)都带;内存 dev 店没有行写口 ⇒ 501。
  *  本面**没有**独立能力位(契约附录 B.2c 登记):老 worker 对这一动词答 405,本事实为假的部署答 501;条件写也没有 —— 列表行上有 `rowTag` 即支持。 */
-export declare function sessionPatch(d: Pick<Deps, "sessionStorage">): Fact<"session_row_faces_absent", {
-    sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "writeSessionRowCells">;
+export declare function sessionPatch<D extends SessionDeps>(d: D): Fact<"session_row_faces_absent", {
+    sessionStorage: SessionWith<D, "headOf" | "writeSessionRowCells">;
 }>;
-/** 删除门读的会话店视图:按 id 读 = 删除门那一只头读,行格的 placement 问询 = 店自己的那一只。门照旧由属主存取器读头(`admitSessionById`),读的就是这一只。 */
-type DeletionGateStore = Pick<OwnerAwareSessionStore, "placementOf"> & {
-    readonly headOf: HeadRead;
-};
 /**
- * 会话删除面(purge 协调器 ∧ 删除门的头读)。见证 = 协调器 + 删除门的店视图 {@link DeletionGateStore}:按 id 读是 `deletionHeadReadOf`(local 店删到一半的行也答得出属主,
- * 开始删它的那位重发收得完;别的店 = `headOf`)—— 与协调器围栏读同一只。
+ * 会话删除面(purge 协调器 ∧ 会话店的头读)。见证 = 协调器 + 判过头读在场的会话店;删除门读哪一只头(删到一半的行也答得出属主的那一只,与协调器围栏读同一只)
+ * 只由属主存取器的删除口判(`owner-access.ts` 的 `admitSessionForDeletion`)。
  */
-export declare function sessionDelete(d: Pick<Deps, "purgeSession" | "sessionStorage">): Fact<"session_purge_absent" | "session_head_face_absent", {
+export declare function sessionDelete<D extends Pick<Deps, "purgeSession" | "sessionStorage">>(d: D): Fact<"session_purge_absent" | "session_head_face_absent", {
     purge: Store<"purgeSession">;
-    gateStore: DeletionGateStore;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
-export declare function sessionPolicy(d: Pick<Deps, "sessionPolicyStore" | "sessionStorage">): Fact<"session_policy_store_absent" | "session_head_face_absent", {
+export declare function sessionPolicy<D extends Pick<Deps, "sessionPolicyStore" | "sessionStorage">>(d: D): Fact<"session_policy_store_absent" | "session_head_face_absent", {
     policyStore: Store<"sessionPolicyStore">;
-    sessionStorage: HeadReadingSessionStore;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
-type SyncSessionStore = WithMethods<OwnerAwareSessionStore, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "writeSessionRowCells">;
+type SyncSessionStore<D extends SessionDeps> = SessionWith<D, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "writeSessionRowCells">;
 type SessionSyncWhy = "store_backend_absent" | "file_history_store_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
 /** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端 ∧ 文件历史店 ∧ 导出两面 ∧ staged 导入面 ∧
  *  会话行三口(门读头 `headOf` —— 属主 + 化身一次读,属主判门、化身给 identical 短路腿;manifest 带 `title` / `pinned`;导入经行格写原语以 `replay` 写者
  *  按导入落定的那一位住客重放它们)∧ policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。
  *  文件历史的 blob 搬运是另一只事实。 */
-export declare function sessionSync(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy, {
-    backend: Store<"backend">;
-    sessionStorage: SyncSessionStore;
+export declare function sessionSync<D extends Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">>(d: D): Fact<SessionSyncWhy, {
+    backend: Held<D, "backend">;
+    sessionStorage: SyncSessionStore<D>;
     historyStore: ServiceFileHistoryStore;
 }>;
 /** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带 blob 交换组(只有 SQL 两只店有)。「店能不能交换 blob」只在 `blobExchangeOf` 判一次(core 判官),
@@ -231,10 +237,12 @@ type RewindFilesWhy = "file_history_store_absent" | "session_head_face_absent" |
  * 动词本身是引擎 `Runner` 的必有成员(型上必在),不是一格。
  * 见证 = 判过在场的设施(历史店 · 手柄翻译的两只读店 · 会话店);路由在拒臂之后只读见证。
  */
-export declare function sessionRewindFiles(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "runStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy, {
+export declare function sessionRewindFiles<D extends Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "runStore" | "sessionStorage" | "config" | "backend">>(d: D): Fact<RewindFilesWhy, {
     historyStore: ServiceFileHistoryStore;
-    anchors: HistoryAnchorReaders;
-    sessionStorage: HeadReadingSessionStore;
+    anchors: HistoryAnchorReaders & {
+        readonly runs: Held<D, "runStore">;
+    };
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /**
  * 同一口的 `dryRun` **带不带改动统计** —— 能力位 `sessionRewindFilesPreview`。= 立即回退可用 ∧ 店实现了 core 契约的可选座 `diffStats`
@@ -291,11 +299,11 @@ export declare function deviceLane(d: Pick<Deps, "deviceHub">): Fact<"device_hub
     hub: Store<"deviceHub">;
 }>;
 /** 设备管理三动词(列 / 读 / 换绑):hub ∧ 设备店 ∧ 入网 ∧ 持久 run 账面(换绑的「无在飞 run」门要它)。 */
-export declare function deviceManagement(d: Pick<Deps, "deviceHub" | "deviceStore" | "deviceEnrollment" | "runStore">): Fact<"device_hub_absent" | "device_store_absent" | "device_enrollment_absent" | "run_store_absent", {
+export declare function deviceManagement<D extends Pick<Deps, "deviceHub" | "deviceStore" | "deviceEnrollment" | "runStore">>(d: D): Fact<"device_hub_absent" | "device_store_absent" | "device_enrollment_absent" | "run_store_absent", {
     hub: Store<"deviceHub">;
     store: Store<"deviceStore">;
     enrollment: Store<"deviceEnrollment">;
-    runStore: Store<"runStore">;
+    runStore: Held<D, "runStore">;
 }>;
 export declare function fleetStream(d: Pick<Deps, "fleetBus">): Fact<"fleet_bus_absent", {
     fleetBus: Store<"fleetBus">;
@@ -344,10 +352,10 @@ export declare function memorySyncServe(d: Pick<Deps, "memorySync" | "config">):
  * 会话记忆同步触发口(`POST /v1/sessions/:id/memory/sync`):本机同步腿在场 ∧ 持久 run 账面(读集 = 会话最近一条已结腿的记忆观测;收割栅栏读会话的 run 认领)
  * ∧ 会话头读(属主门与 `sourceRevision` = 同一次头读的叶子)。
  */
-export declare function sessionMemorySync(d: Pick<Deps, "memorySyncLeg" | "runStore" | "sessionStorage">): Fact<"memory_sync_leg_absent" | "run_store_absent" | "session_head_face_absent", {
+export declare function sessionMemorySync<D extends Pick<Deps, "memorySyncLeg" | "runStore" | "sessionStorage">>(d: D): Fact<"memory_sync_leg_absent" | "run_store_absent" | "session_head_face_absent", {
     leg: Store<"memorySyncLeg">;
-    runStore: Store<"runStore">;
-    sessionStorage: HeadReadingSessionStore;
+    runStore: Held<D, "runStore">;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /** 跨主体投递门在座(`POST /v1/principal-inbox/messages` 的可用性门与能力位 `principalInboxDelivery` 同读这一只)。门的装配本身是
  *  一道合取(收件箱消费方声明 ∧ 耐久 mailbox ∧ org 成员目录 ∧ 配额店,缺一拒启 —— `boot/stage-06-runners.ts`),
@@ -368,20 +376,21 @@ export declare function engineHandover(d: Pick<Deps, "drainState">): Fact<"engin
 export declare function operatorLane(d: {
     readonly config: Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
 }): Fact<"operator_principals_empty">;
-type AdoptionCapableBackend = Store<"backend"> & {
+/** 带收编日志的后端(见证随调用方的 deps:路由层的后端视图上店工厂照样封着)。 */
+type AdoptionCapableBackend<D extends Pick<Deps, "backend">> = Held<D, "backend"> & {
     adoptionLog(): ReturnType<NonNullable<Store<"backend">["adoptionLog"]>>;
 };
-export declare function adoption(d: Pick<Deps, "config" | "backend">): Fact<"operator_principals_empty" | "adoption_store_absent", {
-    backend: AdoptionCapableBackend;
+export declare function adoption<D extends Pick<Deps, "config" | "backend">>(d: D): Fact<"operator_principals_empty" | "adoption_store_absent", {
+    backend: AdoptionCapableBackend<D>;
 }>;
-type AdoptionImportSessionStore = WithMethods<OwnerAwareSessionStore, "beginImportStaging">;
+type AdoptionImportSessionStore<D extends SessionDeps> = SessionWith<D, "beginImportStaging">;
 /**
  * 收编批量导入(`POST /v1/adoption/:id/sessions`)与能力位 `adoptionImport` 的部署半:收编日志 ∧ 会话店的暂存导入面(派生 id 那一格占没占由提交的属主判答,不另要头读面)。
  * **不判运维名册**:这扇门不是 operator 面 —— 调用者是那条收编行的源主体本人(名单空了,已收编的行照样在)。
  */
-export declare function adoptionSessionImport(d: Pick<Deps, "backend" | "sessionStorage">): Fact<"adoption_store_absent" | "session_import_staging_absent", {
-    backend: AdoptionCapableBackend;
-    sessionStorage: AdoptionImportSessionStore;
+export declare function adoptionSessionImport<D extends Pick<Deps, "backend" | "sessionStorage">>(d: D): Fact<"adoption_store_absent" | "session_import_staging_absent", {
+    backend: AdoptionCapableBackend<D>;
+    sessionStorage: AdoptionImportSessionStore<D>;
 }>;
 export declare function memoryBundle(d: Pick<Deps, "config" | "memoryBundleExport" | "memoryBundleImport">): Fact<"operator_principals_empty" | "memory_bundle_faces_absent", {
     exportScopes: Store<"memoryBundleExport">;
@@ -417,9 +426,9 @@ export declare function ruleLaneForCaller(d: Pick<Deps, "ruleConsent">, principa
 export declare function mcpInjection(d: Pick<Deps, "config">): Fact<"caller_mcp_injection_refused">;
 /** server-as-peer:旋钮开 ∧ 持久 run 账面在场。两只 JSON-RPC 方法(`message/send` / `tasks/get`)都要 run 店 ——
  *  没有它,这个 peer 什么都做不了,对外就不该存在(卡与 RPC 一起 404)。 */
-export declare function a2aServe(d: Pick<Deps, "config" | "runStore">): Fact<"a2a_serve_off" | "run_store_absent", {
+export declare function a2aServe<D extends Pick<Deps, "config" | "runStore">>(d: D): Fact<"a2a_serve_off" | "run_store_absent", {
     serve: NonNullable<ServiceConfig["a2aServe"]>;
-    runStore: Store<"runStore">;
+    runStore: Held<D, "runStore">;
 }>;
 /** 引擎能不能自编排(core 单源 `workflowsCapability`,boot 算好经 `workflowsCapable` 递来;缺席回落行店代理)。 */
 export declare function selfOrchestrationEngine(d: Pick<Deps, "workflowsCapable" | "workflowRunStore">): Fact<"workflow_engine_absent">;

package/dist/capability-facts.js

@@ -7,7 +7,7 @@ import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { blobExchangeOf, overwriteWipeIncapable } from "./session-sync.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
-import { deletionHeadReadOf, headReadOf } from "./session-incarnation.js";
+import { headReadPresent } from "./session-incarnation.js";
 import { laneWiresExecutionEnv } from "./execution-lane-caps.js";
 export const CAPABILITY_FACT_WHY = {
     run_store_absent: "no durable run store is wired (DB_BACKEND=mysql|pg|local)",
@@ -95,25 +95,28 @@ export function subagentSteer(d) {
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return d.subagentSteerRegistry !== undefined ? yes({ runStore: runs.runStore, registry: d.subagentSteerRegistry }) : no("subagent_registry_absent");
+    const registry = d.subagentSteerRegistry;
+    return registry !== undefined ? yes({ runStore: runs.runStore, registry }) : no("subagent_registry_absent");
 }
 export function subagentOutput(d) {
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return d.subagentTaskOutput !== undefined ? yes({ runStore: runs.runStore, output: d.subagentTaskOutput }) : no("subagent_output_face_absent");
+    const output = d.subagentTaskOutput;
+    return output !== undefined ? yes({ runStore: runs.runStore, output }) : no("subagent_output_face_absent");
 }
 export function taskHandles(d) {
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return d.taskHandleOutput !== undefined && d.taskHandleStop !== undefined
-        ? yes({ runStore: runs.runStore, output: d.taskHandleOutput, stop: d.taskHandleStop })
+    const { taskHandleOutput: output, taskHandleStop: stop } = d;
+    return output !== undefined && stop !== undefined
+        ? yes({ runStore: runs.runStore, output, stop })
         : no("task_handle_faces_absent");
 }
 export function sessionOwnership(d) {
     const s = d.sessionStorage;
-    return headReadOf(s) !== undefined ? yes({ sessionStorage: s }) : no("session_head_face_absent");
+    return headReadPresent(s) ? yes({ sessionStorage: s }) : no("session_head_face_absent");
 }
 export function executionPlacementRead(d) {
     const seat = d.sessionStorage?.executionPlacement;
@@ -141,12 +144,13 @@ export function sessionAuditView(d) {
     return d.sessionAudit !== undefined ? yes({ sessionAudit: d.sessionAudit }) : no("session_audit_absent");
 }
 export function sessionEventStream(d) {
-    if (d.sessionWatch === undefined)
+    const watch = d.sessionWatch;
+    if (watch === undefined)
         return no("session_watch_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ watch: d.sessionWatch, sessionStorage: owned.sessionStorage });
+    return yes({ watch, sessionStorage: owned.sessionStorage });
 }
 export function sessionList(d) {
     const lister = d.sessionStorage?.listSessions?.bind(d.sessionStorage);
@@ -156,52 +160,51 @@ export function sessionFork(d) {
     const s = d.sessionStorage;
     if (s?.fork === undefined)
         return no("session_fork_face_absent");
-    if (headReadOf(s) === undefined)
+    if (!headReadPresent(s))
         return no("session_head_face_absent");
     return yes({ sessionStorage: s });
 }
 export function sessionPatch(d) {
     const s = d.sessionStorage;
-    if (headReadOf(s) === undefined || s?.writeSessionRowCells === undefined)
+    if (!headReadPresent(s) || s?.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
     return yes({ sessionStorage: s });
 }
 export function sessionDelete(d) {
-    if (d.purgeSession === undefined)
+    const purge = d.purgeSession;
+    if (purge === undefined)
         return no("session_purge_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    const store = owned.sessionStorage;
-    const headOf = deletionHeadReadOf(store);
-    if (headOf === undefined)
-        return no("session_head_face_absent");
-    const placementOf = store.placementOf?.bind(store);
-    return yes({ purge: d.purgeSession, gateStore: { headOf, ...(placementOf !== undefined ? { placementOf } : {}) } });
+    return yes({ purge, sessionStorage: owned.sessionStorage });
 }
 export function sessionPolicy(d) {
-    if (d.sessionPolicyStore === undefined)
+    const policyStore = d.sessionPolicyStore;
+    if (policyStore === undefined)
         return no("session_policy_store_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ policyStore: d.sessionPolicyStore, sessionStorage: owned.sessionStorage });
+    return yes({ policyStore, sessionStorage: owned.sessionStorage });
 }
 export function sessionSync(d) {
-    if (d.backend === undefined)
+    const { fileHistoryStore: historyStore, sessionPolicyStore } = d;
+    const backend = d.backend;
+    if (backend === undefined)
         return no("store_backend_absent");
-    if (d.fileHistoryStore === undefined)
+    if (historyStore === undefined)
         return no("file_history_store_absent");
     const s = d.sessionStorage;
     if (s?.exportEntries === undefined || s.exportEntriesStream === undefined)
         return no("session_export_absent");
     if (s.beginImportStaging === undefined)
         return no("session_import_staging_absent");
-    if (headReadOf(s) === undefined || s.sessionSummaryOf === undefined || s.writeSessionRowCells === undefined)
+    if (!headReadPresent(s) || s.sessionSummaryOf === undefined || s.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
-    if (overwriteWipeIncapable(d.sessionPolicyStore))
+    if (overwriteWipeIncapable(sessionPolicyStore))
         return no("policy_purge_absent");
-    return yes({ backend: d.backend, sessionStorage: s, historyStore: d.fileHistoryStore });
+    return yes({ backend, sessionStorage: s, historyStore });
 }
 export function sessionSyncFileHistory(d) {
     const sync = sessionSync(d);
@@ -211,20 +214,22 @@ export function sessionSyncFileHistory(d) {
     return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
 }
 export function sessionRewindFiles(d) {
-    if (d.fileHistoryStore === undefined)
+    const { fileHistoryStore: historyStore, resumeAnchorStore: anchors, config, backend } = d;
+    if (historyStore === undefined)
         return no("file_history_store_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    if (d.resumeAnchorStore === undefined || d.runStore === undefined)
+    const runs = durableRuns(d);
+    if (anchors === undefined || !runs.available)
         return no("resume_anchor_store_absent");
-    if (!laneWiresExecutionEnv(d.config.remoteExec.provider))
+    if (!laneWiresExecutionEnv(config.remoteExec.provider))
         return no("execution_lane_handless");
-    if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(d.config))
+    if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(config))
         return no("workspace_rebuilt_per_task");
-    if (d.backend?.kind !== "local")
+    if (backend?.kind !== "local")
         return no("session_store_shared");
-    return yes({ historyStore: d.fileHistoryStore, anchors: { anchors: d.resumeAnchorStore, runs: d.runStore }, sessionStorage: owned.sessionStorage });
+    return yes({ historyStore, anchors: { anchors, runs: runs.runStore }, sessionStorage: owned.sessionStorage });
 }
 export function sessionRewindFilesPreview(d) {
     const rewind = sessionRewindFiles(d);
@@ -294,14 +299,15 @@ export function deviceManagement(d) {
     const lane = deviceLane(d);
     if (!lane.available)
         return lane;
-    if (d.deviceStore === undefined)
+    const { deviceStore: store, deviceEnrollment: enrollment } = d;
+    if (store === undefined)
         return no("device_store_absent");
-    if (d.deviceEnrollment === undefined)
+    if (enrollment === undefined)
         return no("device_enrollment_absent");
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return yes({ hub: lane.hub, store: d.deviceStore, enrollment: d.deviceEnrollment, runStore: runs.runStore });
+    return yes({ hub: lane.hub, store, enrollment, runStore: runs.runStore });
 }
 export function fleetStream(d) {
     return d.fleetBus !== undefined ? yes({ fleetBus: d.fleetBus }) : no("fleet_bus_absent");
@@ -341,7 +347,8 @@ export function memorySyncServe(d) {
     return identity !== undefined ? yes({ perform: d.memorySync, identity }) : no("memory_sync_identity_undeclared");
 }
 export function sessionMemorySync(d) {
-    if (d.memorySyncLeg === undefined)
+    const leg = d.memorySyncLeg;
+    if (leg === undefined)
         return no("memory_sync_leg_absent");
     const runs = durableRuns(d);
     if (!runs.available)
@@ -349,7 +356,7 @@ export function sessionMemorySync(d) {
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ leg: d.memorySyncLeg, runStore: runs.runStore, sessionStorage: owned.sessionStorage });
+    return yes({ leg, runStore: runs.runStore, sessionStorage: owned.sessionStorage });
 }
 export function principalInboxDelivery(d) {
     return d.orgDeliveryGate !== undefined ? yes({ gate: d.orgDeliveryGate }) : no("org_delivery_gate_absent");

package/dist/config-catalog.js

@@ -179,7 +179,7 @@ export const CONFIG_CATALOG = [
     r("FLEET_ADVERTISE_ADDRESS", "integrations", "url", `fleet 面向 center 公告的本 worker 可达地址(中心车道配齐 + 本键 ⇒ 公告环;空串 = 未设;用量环不看本键)。中心往它后面拼路径,与中心基址三席同一条判据:${CENTER_BASE_URL_RULE}`, { credentialPolicy: "refuse", configKey: "fleetAdvertiseAddress" }),
     r("FLEET_GENERATION", "integrations", "string", "fleet 成员的代际(配置渲染器写;引擎回声到心跳与 /health 的 generation)。缺席 ⇔ 非 fleet 成员(不续服务租约、不受围栏);在场必须是规范十进制串(\"0\" / \"7\";空串、前导零、符号、空白拒启)", { danger: SEC, configKey: "fleetGeneration" }),
     r("FLEET_LEASE_FAIL_CLOSED", "integrations", "boolean", "租约连接级失败(中心鉴权拒 / 凭证不可读 / 不可达 / 5xx / 超时 / 坏体)时计费入口拒 503 fleet.lease_unavailable(true)还是放行(false);409 not-lease 与耗尽 429 不受它管;词表外拒启", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 按部署姿态派生:REQUIRE_PRINCIPAL=true ⇒ true(多租:额度是安全轴);单用户 ⇒ false(AP 姿态)。显式值压过派生。生效值见 caps centerWiring.failMode", configKey: "fleetLeaseFailClosed" }),
-    r("FLEET_LEASE_OUTAGE_MAX_MS", "integrations", "number", "一台实例「活着而不服务」的最长时长 T_max(ms),两处读它:① 服务租约中心不可达的容忍上限 —— 租约过期满这么久 ⇒ 新计费提交 503 state.lease_expired(取消 / HITL 应答 / 续跑 / 读面照放行,在飞不动,/readyz 不翻),只在 fleet 成员 ∧ 中心宣告 servingLease 能力位时生效;② 排空口 POST /v1/admin/drain 的期限上界 —— deadlineAt 离此刻超过它 ⇒ 400 request.field_invalid,成员与非成员同读;< 60000(租约 TTL 地板)或非整数拒启", { danger: SEC, staticDefault: String(FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS), configKey: "fleetLeaseOutageMaxMs" }),
+    r("FLEET_LEASE_OUTAGE_MAX_MS", "integrations", "number", "一台实例「活着而不服务」的最长时长 T_max(ms),两处读它:① 服务租约中心不可达的容忍上限 —— 租约过期(从没被授予过的:从围栏生效那一刻;一直没听到中心的成员从本进程起点)满这么久 ⇒ 新计费提交 503 state.lease_expired(取消 / HITL 应答 / 续跑 / 读面照放行,在飞不动,/readyz 不翻),只在 fleet 成员 ∧ 中心没有声明不执行租约(心跳答复的 capabilities 声明不带 servingLease)时生效;② 排空口 POST /v1/admin/drain 的期限上界 —— deadlineAt 离此刻超过它 ⇒ 400 request.field_invalid,成员与非成员同读;< 60000(租约 TTL 地板)或非整数拒启", { danger: SEC, staticDefault: String(FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS), configKey: "fleetLeaseOutageMaxMs" }),
     r("FLEET_SCOPE", "integrations", "string", "本引擎所在的租户 scope(配置渲染器对每台受管引擎写,缺省 scope 也写;手接的引擎缺席 = 缺省 scope;唯一读者 = 排空口 POST /v1/admin/drain 的身份比对,请求不带 scope 也读成缺省 scope)。在场必须是 scope id 形(小写字母 / 数字 / 内部连字符,1–64;空串拒启);与 FLEET_GENERATION 不联动(成员缺席 ⇒ 缺省 scope)。续租体与心跳不带它(scope 由中心凭证绑定)", { danger: SEC, staticDefault: GLOBAL_SCOPE, configKey: "fleetScope" }),
     r("FORK_ENABLED", "orchestration", "boolean", "CC /fork(core Fork 工具)装配开关", { derivedDefaultNote: "posture 三态:缺席 = 单用户 ⇒ on / 多租户 ⇒ off(per-principal entitlement 另判)", configKey: "forkEnabled" }),
     r("GATEWAY_MAX_RETRIES", "modelPlane", "number", "openai 兼容腿每次调用重试上限", {

package/dist/config-types.d.ts

@@ -331,7 +331,7 @@ export interface CenterMcp {
     servers: ScopedMcpServer[];
     reservedNames: readonly string[];
 }
-/** DESIGN-269 §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already read and registered on the peer desk
+/** [ref] §2.1 —— an A2A PEER resolved to a core spec (header-NAME refs already read and registered on the peer desk
  *  under the roster lease: the spec carries the minted reference, never the values) plus
  *  the scenarios it applies to (empty = all). Exact sibling of {@link ScopedMcpServer}: `resolveSpec`
  *  filters by scenario (`a2aForScenario`) and passes `spec` to core as `TaskSpec.a2a`.
@@ -344,7 +344,7 @@ export interface ScopedA2aPeer {
     spec: A2aServerSpec;
 }
 /**
- * DESIGN-269 §3.1 车2 —— ONE declared skill on the agent card this deployment publishes when it acts as
+ * [ref] §3.1 车2 —— ONE declared skill on the agent card this deployment publishes when it acts as
  * an A2A **peer** (server-as-peer half). v1 is a **static declaration**: the operator writes the list,
  * the server never enumerates its own scenarios into it.
  *
@@ -369,7 +369,7 @@ export interface A2aServeSkill {
     audience?: readonly string[];
 }
 /**
- * DESIGN-269 §3.3 车2 —— the server-as-peer block. **Absence IS the OFF state** (`A2A_SERVE_ENABLED`
+ * [ref] §3.3 车2 —— the server-as-peer block. **Absence IS the OFF state** (`A2A_SERVE_ENABLED`
  * default OFF): with this field undefined both `/.well-known/agent-card.json` and `POST /v1/a2a` 404,
  * i.e. "卡都不发=对外不存在" — not "publish a card but refuse the calls". Modelling OFF as absence
  * (rather than an `enabled:false` member) makes the half-state structurally unrepresentable.
@@ -1108,14 +1108,14 @@ export interface ServiceConfigFlat {
      *  present (restart-to-apply, like models/roles); undefined = no center MCP (scenarios use no MCP).
      *  Carries both the mounted list and the full declared-name set — see {@link CenterMcp}. */
     mcpServers?: CenterMcp;
-    /** DESIGN-269 §2.1 —— A2A peers from the web-admin (`/effective.a2a`), resolved at startup
+    /** [ref] §2.1 —— A2A peers from the web-admin (`/effective.a2a`), resolved at startup
      *  (header-NAME refs → values) and filtered per scenario in `resolveSpec` (`a2aForScenario`). Same
      *  posture as {@link mcpServers}: not env-derived (no A2A_* env leg — a peer is a structured record,
      *  not a scalar), populated by the web-admin adapter when present, restart-to-apply.
      *  undefined = no center peers ⇒ **the whole leg does not exist** for a task (`TaskSpec.a2a` stays
      *  absent unless a single-user caller injects `body.a2aPeers`). */
     a2aPeers?: ScopedA2aPeer[];
-    /** DESIGN-269 §3.3 车2 —— server-as-peer. **undefined = OFF** (the default), and OFF means both the
+    /** [ref] §3.3 车2 —— server-as-peer. **undefined = OFF** (the default), and OFF means both the
      *  card and the JSON-RPC endpoint 404. See {@link A2aServeConfig}. Env-derived (`A2A_SERVE_*`), unlike
      *  {@link a2aPeers}: the serve block is a handful of scalars an operator sets on the worker, not a
      *  center-distributed record. */
@@ -1371,7 +1371,7 @@ export interface ServiceConfigFlat {
      */
     retentionPolicy?: RetentionPolicy;
     /**
-     * [ref] 车2 —— 托管留存 **sweep lane** 的两个旋钮(设计稿 `DESIGN-270-retention-lane.md` §3/§4)。
+     * [ref] 车2 —— 托管留存 **sweep lane** 的两个旋钮(设计稿 `[ref]-retention-lane.md` §3/§4)。
      * `retentionPolicy` 说的是「保留多久」(一句声明),本格说的是「谁在什么节律上按那句话删」。
      * **恒在场**(不是可选块):两根都有文档化的缺省,而缺省本身是一条要能被读出来的姿态 ——
      * `{mode:"audit-only", intervalSec:0}` = 「lane 关着,真开起来也先只记账」。被要的车道必须齐(`intervalSec > 0` 或 `mode:"enforce"` ⇒
@@ -1401,7 +1401,7 @@ export interface ServiceConfigFlat {
      */
     serviceTokenActsForDeployment: boolean;
     /**
-     * DESIGN-278 §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
+     * [ref] §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
      * 默认 **ON**(设计稿 §0.5:合规部署可关)。端点本身已是 operator-only(`explicitOperatorOk`,
      * 空名单=谁都不是),本键给的是「即便 operator 也不许从 wire 读部署事实」的合规姿态:关 ⇒ 路径
      * 不存在(404 族,与 memory-consolidation 阀门同判:旋钮没开 ≠ 能力缺失)、能力位 `configCatalog`
@@ -2019,7 +2019,8 @@ export interface ServiceConfigFlat {
      *  ON; multi-tenant opt-in); `ASK_QUESTION_ENABLED=true/false` overrides. */
     askQuestionEnabled: boolean;
     /** [ref] 裁2:AskUserQuestion 的**裁量窗**——每 run 腿的并发帽 / 总量帽 / 无人应答的释放窗。窗用尽或到期
-     *  不是拒绝、也不是替人作答:协调器报 `unavailable`,落点(durable park / 非 durable 合成续跑)归 core。
+     *  不是拒绝、也不是替人作答:协调器报 `unavailable`,落点(durable park / 非 durable 合成续跑)归 core;卡由活面呈出而窗到期 ⇒
+     *  协调器抛(core 的投递失败臂,不改道)。
      *  `QUESTION_MAX_CONCURRENT_PER_RUN`(默认 2)/ `QUESTION_MAX_TOTAL_PER_RUN`(20)/ `QUESTION_TTL_MS`
      *  (300000),越界值启动期响亮拒(照 `MCP_ELICITATION_*` 同门,不静默夹取)。缺席 ⇒ 协调器出厂窗
      *  {@link import("./question.js").DEFAULT_QUESTION_THROTTLE}(与本旋钮族默认逐字同值)。 */
@@ -2368,9 +2369,9 @@ export interface ServiceConfigFlat {
     fleetAdvertiseAddress?: string;
     /** 编排器片 2:一台实例「活着而不服务」的最长时长 `T_max`(ms;env `FLEET_LEASE_OUTAGE_MAX_MS`)。缺省 86 400 000(24 h);地板 = 服务租约
      *  TTL 地板(settings-schema `SERVING_LEASE_TTL_FLOOR_MS`,60 s);不许 0 / 无穷,坏值拒启。`loadConfig` 无条件解析(成员与非成员同读)。两个读者:
-     *  ① 服务租约**中心不可达的容忍上限**(`fleet/serving-lease.ts`;只在 fleet 成员 ∧ 中心宣告了 `servingLease` 能力位时生效):租约过期(中心
-     *  不可达 / 答 unknown)之后照常服务,直到过期满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、
-     *  不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
+     *  ① 服务租约**中心不可达的容忍上限**(`fleet/serving-lease.ts`;只在 fleet 成员 ∧ 中心没有声明不执行租约时生效 —— 没听到中心的成员也算,
+     *  起步即推定在围栏内):租约过期(中心不可达 / 答 unknown;从没被授予过的,从围栏生效那一刻 —— 一直没听到中心的成员从本进程起点)之后照常服务,
+     *  直到满这么久 ⇒ 新计费提交 503 `state.lease_expired`(取消 / HITL 应答 / 续跑 / 读面照放行),在飞不动、不自停;中心恢复授予即恢复。② 排空口 `POST /v1/admin/drain` 的**期限准入上界**(`fleet/drain-entry.ts` 规则 2):`deadlineAt` 离此刻超过它 ⇒
      *  400 `request.field_invalid`。 */
     fleetLeaseOutageMaxMs: number;
     /** [ref](design-325 §2):中心凭证**续签提前量**(ms)—— `SEMA_WEB_ADMIN_TOKEN_FILE` 指向人的登录会话信封

package/dist/deployment-governance.d.ts

@@ -58,15 +58,12 @@ export interface PathAdjudication {
      *  `task-settings.ts` 的 `FsWriteGateWiring.taskHome`。 */
     readonly taskHome?: string;
 }
-/** [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门的活体面探针(QuestionCoordinator 的切面)。 */
-export interface LiveQuestionFace {
-    hasLiveContext(): boolean;
-}
 /**
  * [ref] —— 审批基线的**席**:这条腿上「一个名单产的 `ask` 由谁来服」。闭集三形,每条腿**显式**说出自己那一形
  * ({@link createApprovalBaselinePolicy} 的席参数必填、按 `kind` 穷举 —— 闭集 +1 = 编译红):
- *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。AskUserQuestion 的问答门
- *    **只**叠在这一形上(它的 `ask` 语义就是 durable park)。
+ *  · `durable` —— checkpoint suspend/resume 服 ask(HTTP 腿 durable 开、park 赎回腿)。core 的问答策略
+ *    (`createDurableQuestionPolicy()`,原形逐字)**只**叠在这一形上:它对引擎的问题工具答 `ask`,落点归 core 的同步优先
+ *    (有问题席 ⇒ 先投卡、席在窗内拿到答即交答;没拿到 ⇒ 停驻 —— 卡由活面呈出而窗走完的那一问除外:席抛,引擎的投递失败臂不停驻)。
  *  · `live`    —— Runner 的活 onAsk 席当场服 ask(run-local 的 `createLocalApprover`:TTY 问 y/N / 无 TTY 当场拒;
  *    core `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退,ask 落回调)。三张名单与 durable 席**同一只**策略。
  *  · `absent`  —— 没有谁服 ask ⇒ adjudicated allow-all;**只**服务零名单(HTTP 腿「durable 关 ∧ 单用户零意图」)。
@@ -79,11 +76,9 @@ export interface LiveQuestionFace {
 export type ApprovalSeat = DurableApprovalSeat | LiveApprovalSeat | AbsentApprovalSeat;
 /** 席的形名(补偿 warn 等只需要「哪一形」的读者读它,不必铸整只席)。 */
 export type ApprovalSeatKind = ApprovalSeat["kind"];
-/** durable 席:checkpoint suspend/resume 服 ask,问答门叠在名单策略上。 */
+/** durable 席:checkpoint suspend/resume 服 ask,core 的问答策略叠在名单策略上。 */
 export interface DurableApprovalSeat {
     readonly kind: "durable";
-    /** 活体问答面;`undefined` ⇒ 恒 durable park 的原形门。 */
-    readonly question: LiveQuestionFace | undefined;
     /** 本会话的「本会话放行」读面(部署名单那一问的站着的答案;铸点 `approval.ts` 的 `createSessionExemptionRead`)。缺席 = 这条腿没有会话 / 没有豁免店 ⇒ 名单照问。 */
     readonly exemption?: SessionExemptionRead;
 }
@@ -95,23 +90,6 @@ export interface LiveApprovalSeat {
 export interface AbsentApprovalSeat {
     readonly kind: "absent";
 }
-/**
- * [ref]([ref] 案二):durable 部署上的 AskUserQuestion 门。活体面(QuestionCoordinator)缺席 ⇒ 原形
- * `createDurableQuestionPolicy()`(恒 ask ⇒ 恒 durable park)。在场 ⇒ **判决时**按活流上下文分腿:
- * 活流腿(bg/SSE,coordinator.runWithContext 包裹且投递面此刻可达,ALS 判)allow——工具执行落到
- * RunnerDeps.onQuestion 的 coordinator,问正在 tail 流的活人;无活流腿(sync /v1/tasks、verify/cascade、
- * durable resume 驱动、断连后的 detach 腿)ask——durable park 原语义逐字保留([ref] 后无活流腿放行执行
- * 也不会产出空答:coordinator 无 ALS ctx ⇒ 冻结 `{kind:"unavailable"}`(src/question.ts),永不悬挂;
- * park 仍是把问题送到人面前的唯一那条腿,正当性不变、只是反事实前提换了)。
- * 「是不是引擎的问题工具」不在本层判:core 7.56.0 [ref] 起本门**组合** core 原形的答(它读调用的脸 —— 引擎挂载点 + 目录契约 id,不读名字;
- * 它答 `ask` ⇒ 是;本层只在那之上按活流分腿)。决断口的 pre-CAS 守卫(「批准问答必须带答」)仍按保留名读(core 同版「Not changed here」那一条)。
- * ⚠️ **单一属主**(复审 A2):AskUserQuestion 的 durable 判决只有这一处。任何需要「同参重建」这条判决的
- * 地方(main.ts 的 parkedReviveInheritedGate 父约束链)必须调本工厂,不得自折 core 原形——两份拷贝里
- * 只改一份正是本条 finding 的成因。**登记豁免一处**:leader worker 腿(src/leader/wire.ts provisionWorker)
- * 自折 core 原形——该腿无活体问答面可装且 leader 不 import boot 层(分层),core 原形+sentinel 即其完整
- * 语义;豁免注在彼处互指,接活体面之日必须并回本工厂。
- */
-export declare function createDurableQuestionGate(live: LiveQuestionFace | undefined): ToolPolicy;
 /**
  * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 交叉复审 round1 finding 1,红先复现)。
  *
@@ -266,8 +244,9 @@ export declare function buildApprovalGrantNotice(config: {
  * `undefined`**:治理层是 tighten-only 的叠加层,没有基线可叠时它自己也产不出「门在场」这件事。
  *
  * 三形,按席穷举([ref],席的定义见 {@link ApprovalSeat}):
- *  · `durable` ⇒ AskUserQuestion 判决门 + 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
- *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend。
+ *  · `durable` ⇒ core 的问答策略(原形逐字,不包)+ 三张名单的审批门(deny/neverAuto/预算/本会话的豁免行全在
+ *    `createDurableAskPolicy` 里)。gated `ask` 由 core 变成 durable checkpoint suspend;问题族的 `ask` 先过 core 的同步优先
+ *    (问题席在窗内拿到答 ⇒ 交答;没拿到 ⇒ 停驻;活面呈出而窗走完 ⇒ 投递失败臂)—— 「有没有人」本口不预判,唯一判官是那一次投递的结局。
  *  · `live`    ⇒ **同一只**三张名单审批门,不叠问答门。gated `ask` 由 core 交给 Runner 的活 onAsk 席
  *    (本口**不**做 ask→deny 映射:无人可问时的拒由那只席说,判据与文案都归它)。
  *  · `absent`  ⇒ **adjudicated allow-all**(`createAllowDenyPolicy({})`):一条**在场的**、