@sema-agent/server 7.149.0 → 7.151.0

package/dist/http/active-run-conflict.js

@@ -1,5 +1,6 @@
 import { governanceOriginOf } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
+import { runFactsOf } from "./owner-access.js";
 import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-face.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { refusalBody } from "./refusal-body.js";
@@ -46,8 +47,7 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
     if (!activeTaskId)
         return base;
     try {
-        const row = await deps.runStore?.getRun?.(activeTaskId);
-        const status = row?.status;
+        const status = deps.runStore === undefined ? undefined : (await runFactsOf(deps.runStore, activeTaskId))?.status;
         if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
             return base;
         if (status === "running") {

package/dist/http/admission.js

@@ -1,15 +1,15 @@
 import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
-import { HttpError, sessionIdShapeIssue } from "../security.js";
-import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
+import { HttpError, SESSION_KIND_UNRECORDABLE_MESSAGE, sessionIdShapeIssue } from "../security.js";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, appendFold, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { stampSubmissionEntryMode } from "../permission-mode-admission.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
-import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, sessionKindFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
@@ -214,7 +214,7 @@ export function createAdmission(ctx) {
                 sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`, limitFacts("settings.outputStyle", "characters", st.outputStyle.length, MAX_SETTINGS_OUTPUT_STYLE_CHARS));
                 return null;
             }
-            const foldedChars = typeof st.outputStyle === "string" && st.outputStyle.length > 0 && typeof body.appendSystemPrompt === "string" ? body.appendSystemPrompt.length + 2 + st.outputStyle.length : 0;
+            const foldedChars = typeof st.outputStyle === "string" && st.outputStyle.length > 0 && typeof body.appendSystemPrompt === "string" ? appendFold([body.appendSystemPrompt, st.outputStyle]).chars : 0;
             if (foldedChars > MAX_SYSTEM_PROMPT_CHARS) {
                 sendError(res, 400, "request.field_conflict", `appendSystemPrompt + settings.outputStyle fold into one system-prompt block — combined they must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters (including the 2-char joiner)`, fieldConflictFacts("system_prompt_fold", ["appendSystemPrompt", "settings.outputStyle"], { count: foldedChars, cap: MAX_SYSTEM_PROMPT_CHARS }));
                 return null;
@@ -404,6 +404,10 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        if (body.cascade === true && fileHistoryRestoreKeysInBody(body).includes("rewindFilesTo")) {
+            sendError(res, 400, "request.field_conflict", "rewindFilesTo is not supported with cascade (every rung starts a fresh session, so there is no history to restore files from)", fieldConflictFacts("cascade_verify", ["rewindFilesTo", "cascade"]));
+            return null;
+        }
         if (body.resumeAtMode !== undefined) {
             if (body.resumeAtMode !== "at" && body.resumeAtMode !== "before") {
                 sendError(res, 400, "request.field_invalid", 'resumeAtMode must be "at" or "before"');
@@ -454,6 +458,17 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        {
+            const kindIssue = sessionKindFieldIssue(body);
+            if (kindIssue) {
+                sendError(res, 400, "request.field_invalid", kindIssue);
+                return null;
+            }
+            if (body.sessionKind !== undefined && !facts.sessionKinds(deps).available) {
+                sendError(res, 400, "request.precondition_unmet", SESSION_KIND_UNRECORDABLE_MESSAGE);
+                return null;
+            }
+        }
         if (fileHistoryRestoreConflict(body)) {
             sendError(res, 400, "request.field_conflict", FILE_HISTORY_DISABLED_NO_RESTORE, fieldConflictFacts("file_history_restore", ["fileHistory", ...fileHistoryRestoreKeysInBody(body)]));
             return null;

package/dist/http/approval-sweeps.js

@@ -7,10 +7,11 @@ import { hostDecisionFacts } from "../host-decision.js";
 import {} from "../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../approval-content-kind.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
-import { gatedPerson } from "./principal-gate.js";
-import { hasServiceAuth } from "../identity-source.js";
+import { gatedPerson, verifiedIdentitySource } from "./principal-gate.js";
+import { passesCredentialGate } from "../identity-source.js";
 import { costQuotaRefusalOf } from "./request-guards.js";
 import { admissionRefusalOf, readinessOf } from "./readiness.js";
+import { memberLeaseOf } from "../fleet/engine-signal.js";
 import { rowReadRefusalAnswer } from "./resume-legs.js";
 import { readResumeCtx } from "./resume-ctx-read.js";
 import { isResumeBlockedByPolicy } from "./checkpoint-ctx.js";
@@ -215,10 +216,10 @@ export function createApprovalSweeps(ctx) {
         if (!cs) {
             return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
-        if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
-            return { status: 503, body: refusalBody({ errorCode: "auth.service_token_required", message: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions" }) };
+        if (!passesCredentialGate(req.httpReq === undefined ? undefined : verifiedIdentitySource(req.httpReq, deps.config)) && !deps.config.allowUnauthedWrites) {
+            return { status: 503, body: refusalBody({ errorCode: "auth.service_token_required", message: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) or a verified registry sign-in token before accepting task submissions" }) };
         }
-        const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), "hitl-answer");
+        const refusal = admissionRefusalOf(readinessOf(deps), memberLeaseOf(deps), "hitl-answer");
         if (refusal !== undefined)
             return { status: refusal.status, body: refusal.body };
         if (deps.costQuota && req.httpReq) {
@@ -231,7 +232,7 @@ export function createApprovalSweeps(ctx) {
                 }
             }
         }
-        const answerer = { subject: recoveredSubject(req.principal), operator: false };
+        const answerer = { subject: recoveredSubject(req.principal), operator: req.operator };
         let cp;
         try {
             cp = await cs.get(req.gateToken);

package/dist/http/caller-trust.d.ts

@@ -11,7 +11,7 @@
  *  · 多租 · 部署的 service 凭据 ⇒ `global`:部署自己的凭据是运维档(契约给「启动方自己的行为」—— `SETTINGS_SOURCE_CONTRACT.flagSettings` —— 的档),持它的前端为自己转发的内容负责;
  *    出示的 Bearer 就是 service 凭据时,哪怕它同时也被鉴权桥验成登录令牌,也按 service 凭据读 —— 这不是本表的判:来源只有一只判定次序(`verifiedIdentitySource`,
  *    service 凭据先;凭据门的 401 / 归因 / run 行身份元组读同一次的答案),本表只按来源词分档;
- *  · 多租 · 中心登录令牌,scope 角色 ≥ 契约 `domainWriteRole("governance")` ⇒ `global`:能写 scope 治理域(autonomy / commandPolicy / approvalRequire,全组织的免问面)
+ *  · 多租 · 中心登录令牌,scope 角色 ≥ 契约 `writeRoleFor("governance", [])` ⇒ `global`:能写 scope 治理域(autonomy / commandPolicy / approvalRequire,全组织的免问面)
  *    的角色,放宽自己这一 run 是它的子集;门槛读契约,不手抄角色词;
  *  · 多租 · 其余(登录令牌角色低于它 / 不带 / 认不出;直连门 principal 令牌只证身份不证角色;没有验过的凭据)⇒ `project`:契约给非运维档作者的仓控来源的档,
  *    收紧成员照收、放宽成员不收 —— 没有可验的角色就落到这里(fail-closed)。
@@ -20,7 +20,7 @@
  * 自带技能的两只清单(引擎 `seedSkillGrants`:人点的名就是表态,不出 `Skill` 卡 ⇒ `allowedTools` 是 `allow` 成员的孪生、`disallowedTools` 是 `deny` 的孪生,键 → 成员一张表
  * {@link SKILL_LIST_MEMBER})。没点用的自带技能不判:它的清单要经 `Skill` 卡上的人点头才生效 —— 那正是契约给低于门槛的放宽指定的同意出口。
  * **部署 / 中心的技能不判**(点名了也不判):它们的两只清单是运维授权,与 `APPROVAL_GRANT` 同级 —— 来处只有部署的 `SKILLS_DIR` / 本地配置源与中心的 `skills` · `plugins` 域,
- * 契约给这两个域的写角色(`domainWriteRole`)不低于本表 `global` 的门槛(治理写角色),同名时部署的那只胜出、请求体那只被丢(`buildRunSkills`)⇒ 调用方没有改写它们清单的路;
+ * 契约给这两个域的写角色(`writeRoleFor(域, [])`)不低于本表 `global` 的门槛(治理写角色),同名时部署的那只胜出、请求体那只被丢(`buildRunSkills`)⇒ 调用方没有改写它们清单的路;
  * 点名只是选用。契约哪天把那两个域的写角色压到治理写角色之下,`test/caller-trust.test.ts` 的角色阶钉红,这条读法要重审。
  * 准入只经契约导出:桶非空且 `!isAtLeast(档, memberAdmission(…).minTrust)` ⇒ 不准入;不按方向开特例(契约的层准入同样先判 floor)。
  * 不准入 ⇒ 受理口 400,体与条目问题同形(`entry-problems.ts`:根上的 `field` + `problems` + `total`),原因词 = 契约 `LAYER_ADMISSION_VERDICTS` 的 `below_trust_floor`,

package/dist/http/caller-trust.js

@@ -1,4 +1,4 @@
-import { domainWriteRole, isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, } from "@sema-agent/settings-schema";
+import { isAtLeast, isRole, memberAdmission, membersOf, roleAtLeast, USER_ROLES, writeRoleFor, } from "@sema-agent/settings-schema";
 import { entryProblem, entryProblemsFacts } from "../entry-problems.js";
 import { ssoVerifiedRole } from "../security.js";
 import { ruleTextOf } from "../permission-rule-list.js";
@@ -14,7 +14,7 @@ export function callerTrust(req, config) {
             const role = ssoVerifiedRole(req);
             if (role === undefined || !isRole(role))
                 return { trust: "project", basis: "sign_in_role_unrecognized" };
-            return { trust: roleAtLeast(role, domainWriteRole("governance")) ? "global" : "project", basis: "sign_in_role", role };
+            return { trust: roleAtLeast(role, writeRoleFor("governance", [])) ? "global" : "project", basis: "sign_in_role", role };
         }
         case "direct_door_jwt":
             return { trust: "project", basis: "identity_without_role" };
@@ -117,7 +117,7 @@ function directionLoosens(direction) {
     }
 }
 function basisClause(reading) {
-    const governanceRole = domainWriteRole("governance");
+    const governanceRole = writeRoleFor("governance", []);
     const reach = `the deployment's service credential, or a registry sign-in token whose role in its active scope is "${governanceRole}" or higher (the role that may write the scope's governance), is admitted at "global"`;
     switch (reading.basis) {
         case "single_user":

package/dist/http/checkpoint-ctx.d.ts

@@ -1,5 +1,5 @@
 /**
- * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及「这条停驻行的持久化体在本版上能否重放」的四问与它们的答复。
+ * 续跑重建输入(`checkpoint_ctx` 的行体,{@link CheckpointCtx})的**写形**,以及「这条停驻行的持久化体在本版上能否重放」的三问与它们的答复。
  *
  * ## allow 读法问(常设规则,按行的写者版本;不是迁移、不读记号)
  * `settings.permissions.allow` 的读法换过两次:≤7.114.x 是「名单」(名单外的工具一律拒);7.115.0–7.116.x 是「表态」(只回答没人表态的那一问);
@@ -17,30 +17,20 @@
  * 7.42 什么也不拒的条目)、子代定义的 `denyTools` / `allowTools`、顶层 `excludeTools` / `allowTools`(7.131.0:限制侧近似名 / 大小写孪生、退役名、文法读不出,放行侧只近似名)—— 有引擎读成空的条目 ⇒ 提交 400(`resolveSpec`,拒点);
  * 存量停驻体重放 ⇒ 409 `resume_blocked_by_policy`(`blockedBy` = 该层的拒码)。判据函数 = `rule-entry-list.ts` `inertToolListEntryOf`。
  *
- * ## 模式词问(7.122.0):体里模式词的读法记号
- * 7.122.0 起一条 run 的模式词只有一个源 —— 存储的提交体顶层 `permissionMode`(提交入口把运维 `AUTONOMY=plan` 的地板盖进去一次;`plan_review` 写回改它),
- * 治理层不再在每一次续跑重钳。更早版本写下的行体里是**请求的原词**,运维的 plan 由治理层每段重新折上(7.121.x 及以前:只读手 + 写面 roots)。
- * 那种行在本版上按体里的原词重放 = 静默放宽(`acceptEdits` / `bypassPermissions` 原词直接生效;无词 ⇒ 引擎读 checkpoint 记下的词)。
- * ⇒ 同一条规则:**写模式词的人盖读法记号** —— 模式词的写者:每一个出生点(新的持久化写都经 {@link buildCheckpointCtx})与 `plan_review` 写回(经 {@link withPermissionModeRewritten}),各自写词的同一拍在 ctx 上写记号
-`permissionModeReading`(闭集只有当前一词 {@link PERMISSION_MODE_READINGS});续跑重放之前,**本部署此刻有入口地板**
- * (`runtime-governance.ts` `autonomyModeFloor`)而行上没有当前记号、且体的生效词被地板钳会变 ⇒ 拒(行字节不动)。没有地板的部署、体的词本就在地板之下(`plan`)的行
- * 不受影响:那两种行在新旧两种读法下答同一个词。出路:作为新任务重提(仍停驻的先取消),或在它们收尾之前把 `AUTONOMY` 设成 `read-only`(按段的只读围栏,
- * 与 7.121.x 的 `AUTONOMY=plan` 同一个结局,且没有入口地板 ⇒ 不拒)。删除条件登记在 `plugins/one-time-migrations.ts` 的 M12 行。
- *
  * ## 退役请求键问(7.137.0):体里的退役请求键
  * 请求键退役之后({@link RETIRED_REQUEST_KEYS}:今天两只 —— `promptProfile` 换成布尔 `promptLean`,`rewindFiles` 是退役的旧文件还原拼法),新提交带它在键闭集门 400。存体里的旧键怎么办,闭集里每个键有
  * **一个处置格**,住在哪张表就是哪个处置:**拒**表({@link REPLAY_REFUSED_RETIRED_KEYS},今天 `promptProfile`)是塑形过任务本身的键,**惰性**表({@link INERT_RETIRED_KEYS},今天 `rewindFiles`)是一次性键。
  *  · 拒表的键:存体里的旧键由一次性迁移在起服时原地改写
  *    (M30,`stored-request-prompt-profile-m30.ts`,行改写经本模块的 {@link rewriteStoredBodyKeys})。改写不到的残留行(窗内从没起过服的部署;起服扫描之后滚动升级里
- *    旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同模式词读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
+ *    旧副本才写下的行)体里仍带旧键 ⇒ 拒({@link retiredRequestKeyRefusal},码同 allow 读法拒:`checkpoint.unsupported_version`)。**没有**续跑时按旧键读的第二种读法,
  *    也**没有**「旧键无人读、静默续跑」的臂:旧键还在 = 这份体没被改写过,它当年要的形本版读不出来。
  *  · 惰性表的键:一次性键 —— 只在提交的那一拍起作用(文件还原的一次性动作),续跑重建里没有任何一条腿读它,存体里留着它不要求任何事、不改变重放要做的事 ⇒ 不拒、不改写、续跑照常。
  *    这不是上面那条「旧键无人读、静默续跑」的臂:那一臂的前提是读不出旧键会让续跑做一件提交时没要的事,惰性格的判据恰是「没有这个键,重放做的事一字不差」。
  * 加一个退役键必须选格 —— 进拒表 ⇒ {@link retiredRequestKeyRefusal} 的 switch 与 `stored-body-replay.ts` 的迁移 id 表编译红,直到给它一句拒句和改写它的迁移;进惰性表 ⇒ 改动里要写明它为什么是一次性的。
  *
  * ## 一只判据、五个问点(`http/stored-body-replay.ts` 的 `storedBodyReplayRefusal` / 本模块的 {@link storedBodyReplayAnswer})
- * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面四问(加 `settings.env` 凭据那一臂,规则在 `stored-request-env-credentials-m38.ts`)合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(allow 读法问的谓词在本模块;工具名清单问另读请求设置的解析层与
- * 执行车道 / 配置根两个属主、模式词问读请求设置与治理两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
+ * 「这条停驻行的持久化体在本版上能否重放」只有**一个**读法:上面三问(加 `settings.env` 凭据那一臂,规则在 `stored-request-env-credentials-m38.ts`)合在 `stored-body-replay.ts` 的 `storedBodyReplayRefusal` 一处(allow 读法问的谓词在本模块;工具名清单问另读请求设置的解析层与
+ * 执行车道 / 配置根两个属主 —— 本模块的值依赖要留在 node 内建 / 引擎包根之内,随包排空脚本经编译产物读它),答复合在 {@link storedBodyReplayAnswer} 一处。
  * 问点五个,同调同答:续跑驱动段(`resume-legs.ts` `resolveResumeSpecOrBlocked`,另四条腿的唯一判点)· plan_review 的 prepare 段(读类拒,在 nonce 消费之前)·
  * SLA 拒扫腿的跳过臂(`approval-sweeps.ts`)· 终态 run 的 steer 铸唤醒卡之前(`routes/runs.ts`:铸卡前先证明它赎得回,证不出 ⇒ 不铸、当场同一个拒)·
  * `resolveSpec` 本身留作真正的拒点(提交腿 400;续跑腿在到它之前已被本判据答掉)。再开第六个问点必须调这两只,不许各判各的 —— 此前铸卡前只判了
@@ -50,9 +40,10 @@
  * 体里请求面凭据位上的值在 ctx 里只以封签存在 —— 写:{@link buildCheckpointCtx} / {@link sealCheckpointCtx} 一只封口;读:续跑上下文读口里一只开口
  * {@link openCheckpointCtx};开不开 ⇒ `409 conflict.checkpoint_ctx_unsealable`。规则全文在本文件末段「凭据位密封」的头注。
  */
-import type { PermissionMode } from "@sema-agent/core";
 import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
+import type { ProjectContext } from "../project-context.js";
+import type { MemorySeed } from "../project-registry.js";
 import type { InertToolListEntry } from "../rule-entry-list.js";
 import { type Refusal } from "./refusal-body.js";
 /** allow 层读法从这一版起(7.117.0):此前的写者对 `settings.permissions.allow` 是另一种读法(≤7.114.x 名单 / 7.115.0–7.116.x 表态)。规则见顶注「allow 读法问」。 */
@@ -76,16 +67,10 @@ export declare function allowListWriterUnproven(ctx: CheckpointCtx): boolean;
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
  */
 export declare function allowListReadingRefusal(): ResumeRefusalAnswer;
-/** 体里模式词的读法记号闭集(一词 = 当前读法):这一行体的顶层 `permissionMode` 是这条 run 模式词**唯一的源**(提交入口盖过运维地板、`plan_review` 写回改它),
- *  续跑照它读、不再由治理层按段重钳。写点两个 = {@link buildCheckpointCtx}(每一次新的持久化写都写)与 {@link withPermissionModeRewritten}(`plan_review` 写回改词的那一拍写);
- *  **不改词**的续跑腿写回传原 ctx ⇒ 记号随行。 */
-export declare const PERMISSION_MODE_READINGS: readonly ["entry_word"];
-export type PermissionModeReading = (typeof PERMISSION_MODE_READINGS)[number];
 /**
- * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 写记号的唯一口。
+ * 一次**新的**持久化写的 ctx(提交腿 / `POST /v1/runs` 族 / leader worker)—— 构造口。
  *
- * 续跑腿的**写回**不经本函数:**不改词**的写回传读进来的 ctx(记号随行,不重新判 —— 在写回口重新判会把一条没记号的旧行「洗」成新行);
- * **改词**的写回(只有 `plan_review` 的批准 / 编辑)经 {@link withPermissionModeRewritten}。两种写回落盘之前都过同一只封口 {@link sealCheckpointCtx}。
+ * 续跑腿的**写回**不经本函数:写回传读进来的 ctx(或改了体的展开,其余位随行),落盘之前都过同一只封口 {@link sealCheckpointCtx}。
  *
  * `sealer` / `sessionId`:凭据位密封的两件(本文件末段)—— `sessionId` 是这一行的会话(绑进封签);`sealer` 必传,缺席也要说出来(`undefined`)。
  */
@@ -94,31 +79,10 @@ export declare function buildCheckpointCtx(fields: {
     memoryScope?: string | undefined;
     unattendedLeg?: true;
     promptScreened?: true;
+    projectContext?: ProjectContext | undefined;
+    memorySeed?: MemorySeed | null | undefined;
     writerVersion: string;
 }, sealer: CheckpointCtxSealer | undefined, sessionId: string): SealedCheckpointCtx;
-/**
- * 模式词的**第二个写者** —— `plan_review` 的批准 / 编辑把这条 run 的体词从 `plan` 写成批准的档(`resume-legs.ts` `drivePlanReview`,调用点只有那一处;
- * `test/allow-list-reading-park-refusal.test.ts` 枚举调用点,多一处即红)。与 {@link buildCheckpointCtx} **同一条规则**:按当前读法写下的词,盖当前读法记号。
- *
- * 为什么记号必须随词一起写,而不是留给读的一侧去豁免:模式词问问的是「体的词是不是按当前读法写下的」,记号就是这句话的证据。改写之后体里的词是本版的 `plan_review`
- * 刚写下的(一个人刚批准的档),它确实是 `entry_word` 读法的词;若只改体、记号缺席,重建段的同一问把它读成「7.121.x 的请求原词」,被地板钳回 `plan` ≠ 所写词 ⇒ 误拒
- * 一条刚被批准的 run。判据侧(`stored-body-replay.ts`)**不为「plan_review 之后」另开特判臂** —— 读的一侧只有一个读法,写的一侧各自负责盖章。
- *
- * 为什么这不是在「洗」旧行:走到写回口的行,其**原体**已过 prepare 段的同一问(词被地板钳不变:词已是 `plan`,或本部署没有地板);原体的词会被地板钳的旧行
- * (`acceptEdits` / `bypassPermissions` / 无词)在 prepare 段就被拒,到不了这里。入参 `ctx` 的其余位(memoryScope / 无人值守标)原样随行,只换体与模式词记号。
- *
- * 本模块零值依赖的闭包纪律不变(随包排空脚本经编译产物 import;`test/drain-check-local.test.ts`):本函数只用本模块内的东西。
- */
-export declare function withPermissionModeRewritten(ctx: CheckpointCtx, body: TaskRequestBody): CheckpointCtx;
-/** 行上带的是不是当前的模式词读法记号(模式词问的记号那一半;另一半 —— 体的生效词被地板钳会不会变 —— 读请求设置的解析层,住在 `http/stored-body-replay.ts`)。
- *  记号缺席或认不得 ⇒ 不是「按当前读法写下」的证据。 */
-export declare function permissionModeReadingStated(ctx: CheckpointCtx): boolean;
-/**
- * 模式词问的拒答复 —— 码 `checkpoint.unsupported_version`,409(卡仍 pending 时体上的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
- * 句子说原因(更早的版本在每次续跑重钳运维的 AUTONOMY、没把它记进任务;本版只在提交时记一次 ⇒ 续跑会按任务提交时的原词跑)与两条出路。
- * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: "<整句双引号字面>"`,中间只许有空白。
- */
-export declare function permissionModeReadingRefusal(): ResumeRefusalAnswer;
 /**
  * 退役请求键问:**退役的请求键**闭集 = 两张处置表之并(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下的)。键住在哪张表就是它的处置格,规则全文见头注「退役请求键问」。
  * 拒表:存体仍带它 ⇒ 续跑重放拒({@link retiredRequestKeyRefusal});加一个 ⇒ 加一行,那只函数的 switch 编译红直到给它一句拒句。今天一只:`promptProfile`(7.137.0 起换成布尔 `promptLean`;存体由 M30 起服改写)。
@@ -132,7 +96,7 @@ export type RetiredRequestKey = (typeof RETIRED_REQUEST_KEYS)[number];
 /** 存体顶层带的第一只**需要拒**的退役请求键(拒表序);惰性键不算,没有 ⇒ `undefined`。只看自有键(原型上的同名不算)。 */
 export declare function retiredRequestKeyOf(body: unknown): ReplayRefusedRetiredKey | undefined;
 /**
- * 退役请求键问的拒答复 —— 码与落点同模式词读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
+ * 退役请求键问的拒答复 —— 码与落点同 allow 读法拒(`checkpoint.unsupported_version`,409;卡仍 pending 时的 `retriable:true` 由 {@link resumeRefusalWithCard} 追加,本铸点不带)。
  * 句子说键、它换成了什么、为什么不续跑,与两条出路(运维在一次性迁移的窗内重启本服务 ⇒ 起服改写存体、同一请求可再发;否则作为新任务重提,仍停驻的先取消)。不回显值。
  * 🔴 形是给冻结门看的:`status: <三位数>, body: refusalBody({ errorCode: "<码>", message: <整句双引号字面 或 一只模板串>`,中间只许有空白(模板串形冻结的是骨架,`${…}` 折成一个洞)。
  * **窗的日期不手写**:`rewriteWindowEnd` 由调用方交 —— 判据(`stored-body-replay.ts`)按「退役键 → 改写它的迁移」那张表读登记表该行的 `removableAfter`,窗只写在登记表一处;
@@ -142,7 +106,7 @@ export declare function retiredRequestKeyOf(body: unknown): ReplayRefusedRetired
 export declare function retiredRequestKeyRefusal(key: ReplayRefusedRetiredKey, rewriteWindowEnd: string): ResumeRefusalAnswer;
 /**
  * 一条停驻行的持久化体在本版上**不能**重放时,是哪一条规则拒的(闭集;加一条 ⇒ {@link storedBodyReplayAnswer} 的 switch 编译红)。
- * 答 `checkpoint.unsupported_version` 的三臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
+ * 答 `checkpoint.unsupported_version` 的两臂随带这一行的写者版本(续跑上下文的 `writerVersion`,缺席 = 本版之前写下的行)—— 那一码的两版本键由它铸({@link buildCheckpointVersionKeys})。
  */
 export type StoredBodyReplayRefusal = 
 /** 体里带非空 `settings.permissions.allow`、写者版本证不出 ≥ {@link ALLOW_LAYER_READING_SINCE}(顶注「allow 读法问」)。 */
@@ -165,11 +129,6 @@ export type StoredBodyReplayRefusal =
     readonly refusal: Refusal;
     readonly members: readonly string[];
     readonly memberCount: number;
-} | {
-    readonly kind: "permission_mode_reading";
-    readonly stored: PermissionMode | undefined;
-    readonly floor: PermissionMode;
-    readonly writerVersion?: string;
 } | {
     readonly kind: "retired_request_key";
     readonly key: ReplayRefusedRetiredKey;
@@ -178,8 +137,8 @@ export type StoredBodyReplayRefusal =
     readonly writerVersion?: string;
 };
 /**
- * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的三只拒
- * = {@link storedBodyReplayAnswer} 的 allow 读法 / 模式词读法 / 退役请求键三臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
+ * 🔴 **`checkpoint.unsupported_version` 的 409 体上两个版本键 —— 唯一铸法;本码每一个铸点同一条律**(core 原码镜像 = `resume-legs.ts` 的 catch 臂;本服务自铸的两只拒
+ * = {@link storedBodyReplayAnswer} 的 allow 读法 / 退役请求键两臂):续跑上下文带写者版本 ⇒ `{ writerVersion, readerVersion }`;不带(本版之前写下的行)⇒ `{}`,不编值。
  * 两值相等也照带 —— 那是事实(不是版本问题,出路照码与报文);写者比读者新才是「回到写它的那一版去决」。`readerVersion` 由调用方传本进程的服务版本
  * (本模块零值依赖,不自取)。纯数据。
  */
@@ -203,7 +162,7 @@ export interface ResumeRefusalAnswer {
  *
  * 🔴 **句尾点名出口**:这一拒不消费卡(卡仍 pending、run 行留停驻),被挡在一张 deny 不掉的卡前面的调用方需要知道怎么收场 ——
  * `POST /v1/runs/:id/cancel` 对停驻的 run 直接结算(CAS 过期该卡再终局 run 行,不跑模型轮)。句子写「若仍停驻」而不是随卡有无换话:有卡 / 无卡(终态 run 的 steer 在铸唤醒卡之前拒)
- * 两种处境除 `retriable` 外逐字同体(同判同答),与另两类存量体拒(allow 读法 / 模式词读法)句子里的出口是同一个端点、同一种写法。
+ * 两种处境除 `retriable` 外逐字同体(同判同答),与 allow 读法那一类存量体拒句子里的出口是同一个端点、同一种写法。
  *
  * 本铸点**不带** `retriable`:那是调用点的事实(有没有一张待批卡仍在等),由 {@link resumeRefusalWithCard} 一处追加 —— 续跑入口(卡仍 pending、run 行留 `suspended`)
  * 带 `retriable:true`,终态 run 的 steer 在铸唤醒卡之前拒(没有卡)不带。键集 = `errorCode` · `error` · `blockedBy` · (`field` · `reason` · 其余 `extra`,有才在)
@@ -241,16 +200,14 @@ export declare function storedBodyReplayLogFields(refusal: StoredBodyReplayRefus
     kind: StoredBodyReplayRefusal["kind"];
     writerVersion?: string;
     layer?: InertToolListEntry["layer"];
-    storedMode?: PermissionMode | null;
-    floor?: PermissionMode;
     key?: ReplayRefusedRetiredKey;
     members?: readonly string[];
     memberCount?: number;
     note: string;
 };
 /**
- * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 读法 ⇒ {@link allowListReadingRefusal};模式词记号 ⇒ {@link permissionModeReadingRefusal};
- * 退役请求键 ⇒ {@link retiredRequestKeyRefusal};这三只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
+ * `stored-body-replay.ts` `storedBodyReplayRefusal` 的答复:每条规则一只既有铸点(allow 读法 ⇒ {@link allowListReadingRefusal};
+ * 退役请求键 ⇒ {@link retiredRequestKeyRefusal};这两只答 `checkpoint.unsupported_version`,体按那一码的键律补两版本键,`readerVersion` = 调用方传的本进程服务版本;工具名清单 ⇒ {@link resumeBlockedByPolicyAnswer},与提交腿的 400
  * (该层的拒码:`request.field_invalid` / `config.agent.unknown_tool` / `config.tool_face_control`)同码同句 —— 体上只有这一个问题时;存量体同时还踩中 `resolveSpec` 更早的拒〔三桶超帽 / 托管姿态〕时,提交侧答更早那条、续跑侧答本句,两边都是拒,指路不同)。
  *
  * 🔴 `cardPending` —— **调用方交出的事实**:这一次拒的时候,有没有一张待批卡仍在等。`retriable:true` 说的恰是「卡仍 pending」,所以它只在卡在时在场(经
@@ -268,7 +225,7 @@ export declare function storedBodyReplayAnswer(refusal: StoredBodyReplayRefusal,
  *    封签里装的是那个 JSON 值本身,开封逐字还原。字典位上的容器本身不是字典(串 / 数组 / `null` / 封签形对象)⇒ 整只容器当一个值封。
  *    于是落盘形里凭据位上**只有本封口铸的封签**,没有哪个值能「原样存下、续跑时被开成别的东西」(调用方送一只封签形对象 ⇒ 存的是再封一层,
  *    开出来还是那只对象 —— 与新提交腿看到的同一个值)。没有封签器而有值要封 ⇒ 抛 {@link CheckpointCtxUnsealableError}(`no_key_store`,调用方在写之前拒)。
- *  · **读法记号**(与本文件另两只记号同一条「写的人盖章」):封口铸出的每一份落盘形都带 `credentialSeal: CHECKPOINT_CTX_SEAL_ALG` 与
+ *  · **读法记号**(与写者版本同一条「写的人盖章」):封口铸出的每一份落盘形都带 `credentialSeal: CHECKPOINT_CTX_SEAL_ALG` 与
  *    `credentialSlotGeneration`(= 这一行里**带值的**凭据位最新的那一代,最小 1)—— 这一行的凭据位全部由本封口封过,且它用到的位不比这一代新。
  *    代数取「用到的」而不取「本版的」:不带新位值的行与上一代的写者写下的同形,回滚到上一代照读;代数比读者新 ⇒ 这一行**一定**带着读者不认识的位 ⇒ 读者整行拒。没有记号的行是 7.134.0 之前的写者写下的:
  *    那时没有任何写者封值,所以它凭据位上的封签形对象只可能是调用方原样送来的,不是封签。代数缺席的带记号行是 7.134.0 的写者写下的 —— 它封的是第 1 代
@@ -447,7 +404,7 @@ export declare function sealedCredentialFieldOf(stored: unknown): string | undef
  *  · 带当前记号、而某一位比行封过的代数新的行(7.134.0 的写者封第 1 代,没封第 2 代的 `plugin.options`)—— 那一位上的值不论长什么样都是明文 ⇒ 封
  *    (恰好长成封签形的选项字典按字典容器整只封,开出来还是那只字典);行封过的那一代里的封签不动。改写后的行盖「带值的位最新的那一代」(与封口同一条)。
  * 读口会答 `seal` / `unrecognized_seal` 的值不动(认不得的留给读口拒);一个值都没封 ⇒ `undefined`(不写:第二跑零命中;记号认不得的行因此一个字节不动);
- * 体不是对象 ⇒ `undefined`(读口自己的形判接住)。其余位(另两只记号、写者版本、非凭据字段)原样。
+ * 体不是对象 ⇒ `undefined`(读口自己的形判接住)。其余位(写者版本、非凭据字段)原样。
  */
 export declare function sealStoredCheckpointCtxM28(stored: object, sealer: CheckpointCtxSealer, sessionId: string): {
     readonly ctx: SealedCheckpointCtx;
@@ -455,7 +412,7 @@ export declare function sealStoredCheckpointCtxM28(stored: object, sealer: Check
 } | undefined;
 /**
  * 🔴 **一次性迁移对存量行非凭据顶层体键的改写**(品牌铸点之三;今天的调用方 = M30 的行改写 `stored-request-prompt-profile-m30.ts`):在一行落盘形的体上删 `drop` 里的顶层键、
- * 设 `set` 里的顶层键,其余一个字节不动 —— 行上的读法记号(凭据封口的 `credentialSeal` / `credentialSlotGeneration` 与另两只记号)与凭据位上的值原样随行:封好的行仍是封好的,
+ * 设 `set` 里的顶层键,其余一个字节不动 —— 行上的读法记号(凭据封口的 `credentialSeal` / `credentialSlotGeneration`)与凭据位上的值原样随行:封好的行仍是封好的,
  * 更早写者留下的明文行仍是明文(读口照旧拒 `plaintext`,本口不替它洗白)。`drop` / `set` 碰到凭据位的根键(闭集各行路径的第一段)或 `__proto__` ⇒ 抛(程序错,不是数据错)。
  * 体不是对象 ⇒ 抛(店的判形保证 ctx 是对象;体坏形的行由调用方先判、不交来)。
  */

package/dist/http/checkpoint-ctx.js

@@ -36,7 +36,6 @@ export function allowListReadingRefusal() {
         body: refusalBody({ errorCode: "checkpoint.unsupported_version", message: "this task's stored request carries settings.permissions.allow and was written by a server version that is earlier than 7.117.0 or that did not record its version (versions before 7.124.0 did not), so this server cannot tell how that list was meant to be read: 7.114.0 and earlier read it as a whitelist (every tool not on it was refused) and 7.115.0 to 7.116.x as a statement that answered only the question nobody else had answered, while this version hands it to the engine's allow layer, where each entry is a standing yes for the calls it covers, so continuing could give the task more tools or fewer questions than it was submitted with. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel)." }),
     };
 }
-export const PERMISSION_MODE_READINGS = ["entry_word"];
 export function buildCheckpointCtx(fields, sealer, sessionId) {
     const ctx = {
         body: fields.body,
@@ -44,26 +43,11 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
         ...(fields.promptScreened === true ? { promptScreened: true } : {}),
-        permissionModeReading: "entry_word",
+        ...(fields.projectContext !== undefined ? { projectContext: fields.projectContext } : {}),
+        ...(fields.memorySeed !== undefined ? { memorySeed: fields.memorySeed } : {}),
     };
     return sealCheckpointCtx(ctx, sealer, sessionId);
 }
-export function withPermissionModeRewritten(ctx, body) {
-    return { ...ctx, body, permissionModeReading: "entry_word" };
-}
-export function permissionModeReadingStated(ctx) {
-    const reading = ctx.permissionModeReading;
-    return typeof reading === "string" && PERMISSION_MODE_READINGS.includes(reading);
-}
-export function permissionModeReadingRefusal() {
-    return {
-        status: 409,
-        body: refusalBody({
-            errorCode: "checkpoint.unsupported_version",
-            message: "this task was suspended by an earlier server version that re-applied this deployment's AUTONOMY on every resume instead of recording it in the task; this version records the operator's plan floor once, when a task is submitted, so continuing would run this task under the permission mode it was submitted with rather than the one it ran under. Nothing was decided and nothing was resumed, and retrying will be refused the same way: submit the work again as a new task, and if this task is still suspended cancel it first (POST /v1/runs/:id/cancel); to let it finish with read-only hands instead, set AUTONOMY=read-only until it does.",
-        }),
-    };
-}
 export const REPLAY_REFUSED_RETIRED_KEYS = ["promptProfile"];
 export const INERT_RETIRED_KEYS = ["rewindFiles"];
 export const RETIRED_REQUEST_KEYS = [...REPLAY_REFUSED_RETIRED_KEYS, ...INERT_RETIRED_KEYS];
@@ -116,8 +100,6 @@ export function storedBodyReplayLogFields(refusal) {
             return { kind: refusal.kind, note: "this session's stored request carries credentials in settings.env (a credential variable name of this engine, or a value shaped like a secret) and the one-time window that dropped them on resume has closed; it is not replayed — the task stays suspended until someone cancels it and resubmits with the credentials moved into the engine's environment" };
         case "unread_members":
             return { kind: refusal.kind, members: refusal.members, memberCount: refusal.memberCount, note: "this session's stored request carries members this version's readers cannot take as written (named in the refusal: settings.hooks / settings.env / an MCP server's transport / an A2A peer's headers …) and this deployment would apply them; replaying it would run without them, so it is not replayed — the task stays suspended until someone cancels it and resubmits with those members in the current form" };
-        case "permission_mode_reading":
-            return { kind: refusal.kind, storedMode: refusal.stored ?? null, floor: refusal.floor, note: "this session's stored request was written before the operator's AUTONOMY plan floor was recorded in the task (earlier versions re-applied it on every resume); replaying it now would run under its submitted permission mode — the task stays suspended until someone cancels it, or AUTONOMY is set to read-only so it can finish with read-only hands" };
         case "retired_request_key":
             return { kind: refusal.kind, key: refusal.key, note: "this session's stored request still carries a request key this version retired, and the one-time rewrite at startup did not reach it (no startup of this version inside its window since the row was written); it is not replayed — the task stays suspended until someone cancels it, or a restart of this version inside the window rewrites the row" };
         default: {
@@ -140,10 +122,6 @@ function storedBodyReplayArmAnswer(refusal, readerVersion) {
         case "settings_env_credential":
         case "unread_members":
             return resumeBlockedByPolicyAnswer(refusal.refusal);
-        case "permission_mode_reading": {
-            const answer = permissionModeReadingRefusal();
-            return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };
-        }
         case "retired_request_key": {
             const answer = retiredRequestKeyRefusal(refusal.key, refusal.rewriteWindowEnd);
             return { status: answer.status, body: { ...answer.body, ...buildCheckpointVersionKeys(refusal.writerVersion, readerVersion) } };

package/dist/http/claim-heartbeat.d.ts

@@ -14,7 +14,7 @@ import type { FlatServiceDeps } from "./server.js";
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { type RefusalBody } from "./refusal-body.js";
-import { headReadOf } from "../session-incarnation.js";
+import type { OwnerAwareSessionStore } from "../security.js";
 /** 认领赢的那一拍起心跳(与后台腿 `runInBackground` 同一只周期、同一条带属主的刷新);交回停表。行已不在跑 ⇒ 心跳自停(起跑之前的复核随后答失认领)。刷新失败不抛(计数),下一拍再刷。 */
 export declare function startClaimHeartbeat(runStore: RunHeartbeatStore, taskId: string, owner: string | null, metrics: {
     inc(name: string, labels?: Record<string, string>): void;
@@ -26,12 +26,12 @@ export declare function claimStillHeld(runStore: ClaimFenceStore, sessionId: str
  * 先按 {@link withdrawClaimedRun} 撤掉本请求刚认领的这条 run(删掉本请求铸的这一行 —— `legId` = 建行交回的持有腿,不留一条没起跑的 `running` 行占着会话等收割),再原样上抛。
  */
 export declare function recheckClaimBeforeLaunch(deps: Pick<FlatServiceDeps, "checkpointStore" | "config" | "logger"> & LostClaimSessionFace, runStore: ClaimFenceStore & LostClaimStore, sessionId: string, taskId: string, legId: string): Promise<Awaited<ReturnType<typeof refusalAfterLostClaim>> | undefined>;
-/** 失认领答复读会话店的那一面:只问头读(`headReadOf` 判店有没有它)—— 不要整只会话店。 */
+/** 失认领答复读会话店的那一面:只问头读(店有没有它由属主存取器的 `sessionFactsReadOf` 判)—— 不要整只会话店。 */
 export interface LostClaimSessionFace {
-    readonly sessionStorage?: Parameters<typeof headReadOf>[0];
+    readonly sessionStorage?: Pick<OwnerAwareSessionStore, "headOf"> | undefined;
 }
 /** 失认领答复与撤回本次 run 读写的那几面。 */
-export type LostClaimStore = Pick<RunStore, "getActiveTaskId" | "getRun" | "withdrawMintedRun">;
+export type LostClaimStore = Pick<RunStore, "getActiveTaskId" | "withdrawMintedRun" | "getRun">;
 /**
  * 起跑之前认领复核没过的答复(三条提交腿同一只;三臂按「此刻是谁的事实」分,各读各的):
  *  · 认领此刻在别的 run 上 ⇒ 409 冲突体(与建行时认领输同一只材料,`conflict.session_active_run`);

package/dist/http/claim-heartbeat.js

@@ -5,7 +5,7 @@ import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { readTurnActivityMs } from "../turn-activity.js";
 import { withdrawClaimedRun } from "./claimed-run.js";
 import { refusalBody } from "./refusal-body.js";
-import { headReadOf } from "../session-incarnation.js";
+import { sessionFactsReadOf } from "./owner-access.js";
 export function startClaimHeartbeat(runStore, taskId, owner, metrics) {
     const timer = setInterval(() => {
         beatRunHeartbeat(runStore, taskId, owner, () => clearInterval(timer), () => {
@@ -38,8 +38,8 @@ export async function refusalAfterLostClaim(deps, runStore, sessionId, taskId) {
     if (holder !== undefined && holder !== taskId) {
         return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, holder) };
     }
-    const headOf = headReadOf(deps.sessionStorage);
-    if (headOf !== undefined && (await headOf(sessionId)) === undefined)
+    const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
+    if (sessionFactsOf !== undefined && (await sessionFactsOf(sessionId)) === undefined)
         return rootSessionAbsentAnswer();
     return { status: 409, body: refusalBody({ errorCode: "conflict.claim_lost", message: "the run this request claimed was settled by the stale-run verdict before the engine started it (its claim heartbeat did not land within the reap window) — nothing ran" }) };
 }

package/dist/http/dispatch.d.ts

@@ -33,7 +33,8 @@ export interface HealthDeploymentModsSection {
  * 配了 service token、没开 REQUIRE_PRINCIPAL 的部署上,`POST /v1/tasks` 吃凭据,这三族读路对端口全开。
  *
  * 规则(一条,三族同读;fail-closed):
- *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 与全局门对 `/v1/tasks` 同判(run-local 形);
+ *  · 部署**没配**任何 service 凭据(`hasServiceAuth` 假)⇒ 放行 —— 问的是「全局凭据门武装没有」,与门后各口同判(门不武装 ⇒ 门后的读口也不要凭据;
+ *    写门是另一问,问的是请求,见 `identity-source.ts` 头注律 5);
  *  · 否则要么出示了**服务凭据**(service token 单 / 多,或只读 `TRACE_TOKEN` —— 后者正是这几族在门前的理由),
  *    要么带着**验过的** principal(registry 登录令牌 / direct-door 签名 principal 令牌;判据 = `verifiedIdentitySource`,
  *    与 off-box operator 读面同一只)。调用方自己写的 principal 头不是凭据。