@sema-agent/server 7.150.0 → 7.152.0

package/dist/fleet/drain-entry.d.ts

@@ -87,6 +87,8 @@ export type DrainEntryAnswer = DrainReceipt | DrainDeadlineRefusal;
  * `session-resident-background.ts` 头注)· retain 的后台 shell · 只读订阅流(只进 `attachedStreams`)。
  * 四项在同一次读里求出(`http/server.ts` 的 `inflightBreakdown` 是唯一的分项函数,两个和都读它),`/health` 的 `inflight` 与 `inflightBreakdown` 因此永远自洽,
  * 判停与 `/health` 也不会各有一份算法。只有这两个函数各写一次这两个和,没有第三张计法表。
+ * 第三个读数 `/health.engineLease.attached`(附着流条数,[ref])进的是**同一张**计法表(契约「附着」一列:每一类活进不进它),不是第二套计数:
+ * 它读 {@link DrainState.attachedStreams} —— 自退判据第一合取读的那一只(`http/dispatch.ts` 的开放响应集 × SSE 章,定义只此一处)。
  */
 export interface InflightBreakdown {
     readonly http: number;
@@ -128,6 +130,8 @@ export interface DrainState {
     /** [ref]:首个**非探针**请求的单调时刻(`null` = 还没有过)。与 `lastActivityAt` 同一个写者(`http/server.ts` 的活性打点)、写一次就定;
      *  读者 = 租约腿的候首触态(`boot/engine-lease.ts`)与 `/health.engineLease.firstAttach.attachedAt`。 */
     firstActivityAt?: () => number | null;
+    /** 本副本此刻打开着的 SSE 流条数(`createHttpServer` 自赋;定义只此一处)。读者:附着租约自退判据的第一合取、`/health.engineLease.attached`(经租约腿的读数)—— 同一只读口,
+     *  不另数。语义是**附着流条数,不是活跃调用方**:订阅流与流式提交腿算,后台腿 / 无流同步腿不算(契约计法表「附着」列);纯轮询壳读到 0 合法。 */
     attachedStreams?: () => number;
     lastAttachEndedAt?: () => number;
     /** [ref]:附着租约窗的读口(`/health.engineLease`)。收尾链在**装了租约腿**时才装它,读口现读租约腿的把手 —— 腿还在观察才有读数,未装配的盒子里根本没有这只口。 */

package/dist/fleet/engine-signal.d.ts

@@ -20,22 +20,17 @@
  *     注入了读数也不读;所以「`/health` 不报 `leaseState` 而准入照按租约拒」这一形构造不出来。
  *     **身份不是引擎态**:`instanceId`(本进程起步自铸的那一只,`boot/stage-03` 的 uuidv7)是体的身份,只在两出口体的**顶层**说一次,
  *     铸点不读它、契约形里不重复它。
- *  5. **两形一读(展开 / 收缩)**:两出口今天各发两形 —— 嵌套键 {@link ENGINE_SIGNAL_KEY}(契约 `EngineSignal` 整只,{@link buildEngineSignal}),
- *     与 8.0 扁平方言(布尔 `draining` + `drainingSince`、`/health` 就绪时不带 `ready`、`restart`、成员三键、`/health` 的世代账)。两形读的是
- *     **同一次**铸点读数里的**同一个字段**,投影全在本模块({@link buildEngineSignal} / {@link heartbeatReadinessKeys} / {@link healthDrainingKeys} /
- *     {@link fleetMembershipKeys} / {@link healthConfigLedgerKeys}),出口文件不拼引擎态的键。排空在两形上读的都是排空**事实**(`EngineDraining`,
- *     三键齐才在),不是就绪原因 —— 所以「`engineSignal.draining` 在场 ⇔ 扁平 `draining` 为真、`drainingSince` = `engineSignal.draining.since`」
- *     是构造出来的,不靠「唯一入口整组写四键」这条运行时不变量(那条不变量只管就绪原因与事实一致)。
- *     心跳体 = 契约 `InstanceAnnouncement` + 嵌套键这一只:契约包 10.x 的心跳形还没有它的座位,10.x 中心按默认 strip 解析丢掉它、照收心跳;
- *     世代账扁平两键契约心跳形没有座位,只上 `/health`(嵌套形里有,两出口都带)。非 fleet 部署的扁平键与 7.122.0 逐字同。
- *     收缩:扁平布尔对(`draining` / `drainingSince`)settings-schema 12.0.0 从契约形删、本引擎 7.124.0+ 删发(届时删它们的投影);嵌套键名在
- *     契约包自有这只常量的那一版提货时改读它。
+ *  5. **一形**:引擎态只在体上的一只键 `engineSignal`(契约包 `ENGINE_SIGNAL_KEY`,本仓不另拼)下说,值 = 契约 `EngineSignal` 整只({@link buildEngineSignal})。
+ *     心跳体 = 契约 `InstanceAnnouncement`(身份 + `modelRefusals`)+ 这一只键 —— 8.0 扁平方言(平铺 `ready` / 布尔 `draining` / `restart` / 成员三键)
+ *     随契约包 26.0.0 从心跳形删除,本引擎同版停发;`/health` 的平铺排空对(布尔 `draining` + `drainingSince`)同版停发。`/health` 上其余与信号同名的顶层键
+ *     (`restart` / 成员三键 / 世代账)是本仓自己的诊断面 wire(契约 `InstanceHealth` 从未给它们座位,读方是 sdk 的 `/health` 读型),投影仍全在本模块
+ *     ({@link fleetMembershipKeys} / {@link healthConfigLedgerKeys}),出口文件不拼引擎态的键。
  *  6. **租约四态的词表属主是契约包**(`LeaseState`):本模块的读数型 {@link ServingLeaseView} 按它逐词对齐(下面的编译期断言两向钉),
  *     契约加一个词 ⇒ 本仓编译红,不会悄悄多出一个本仓读不出的态。
  *
- * 模块形:纯函数(契约包只 import 型;值 import 只有两只纯叶 `http/readiness.ts` 与 `fleet/drain-entry.ts`)—— `http/` 与 `fleet-client.ts` 都读它,不许长出回环。
+ * 模块形:纯函数(契约包只取型与键名常量 `ENGINE_SIGNAL_KEY`;本仓值 import 只有两只纯叶 `http/readiness.ts` 与 `fleet/drain-entry.ts`)—— `http/` 与 `fleet-client.ts` 都读它,不许长出回环。
  */
-import type { EngineDraining, EngineSignal, InstanceAnnouncement, LeaseState, RestartSignal } from "@sema-agent/settings-schema/fleet";
+import { ENGINE_SIGNAL_KEY, type EngineDraining, type EngineSignal, type LeaseState, type RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type ReadinessInputs, type ReadinessVerdict } from "../http/readiness.js";
 /**
  * 租约此刻的读数(租约客户端交出;纯数据)。态的词表 = 契约 `LeaseState`(四词的语义在契约注里:`none` 不生效 / `granted` 持有 /
@@ -52,8 +47,8 @@ export type ServingLeaseView = {
 } | {
     readonly state: Extract<LeaseState, "denied">;
 };
-/** 心跳体上的 fleet 成员三键 —— 类型取自契约心跳形(拼法与值域只有契约一个写者)。 */
-export type FleetMembershipKeys = Pick<InstanceAnnouncement, "generation" | "leaseState" | "leaseUntil">;
+/** `/health` 上的 fleet 成员三键 —— 类型取自契约 `EngineSignal` 的同名键(拼法与值域只有契约一个写者)。 */
+export type FleetMembershipKeys = Pick<EngineSignal, "generation" | "leaseState" | "leaseUntil">;
 /** 非 fleet 成员 / 没装租约客户端时的读数(唯一拼法)。成员的推定围栏只住在租约客户端里,不进这只缺省值。 */
 export declare const LEASE_NONE: ServingLeaseView;
 /**
@@ -148,12 +143,7 @@ export interface EngineSignalFacts {
 }
 /** **唯一**铸点(活判,每次调用现读输入)。 */
 export declare function mintEngineSignal(deps: EngineSignalInputs): EngineSignalFacts;
-/**
- * 两出口体上嵌套引擎信号的键名(规则 5;两出口同一只拼法)。契约包 10.x 没有这只常量(它的心跳形也没有这一座位);契约包自有它的那一版
- * 提货时,本常量删、改读契约包的。
- */
-export declare const ENGINE_SIGNAL_KEY = "engineSignal";
-/** 体上的嵌套引擎信号:键 {@link ENGINE_SIGNAL_KEY},值 = 契约 `EngineSignal`。 */
+/** 体上的嵌套引擎信号:键 = 契约包的 `ENGINE_SIGNAL_KEY`(两出口同一只拼法,本仓不另拼),值 = 契约 `EngineSignal`。 */
 export type EngineSignalCarrier = {
     readonly [ENGINE_SIGNAL_KEY]: EngineSignal;
 };
@@ -163,18 +153,11 @@ export type EngineSignalCarrier = {
  */
 export declare function buildEngineSignal(s: EngineSignalFacts): EngineSignal;
 /**
- * fleet 成员身份三键的**唯一**投影(两出口同调,同值同序):`generation` / `leaseState` / `leaseUntil`。
- * 在场律:非 fleet 成员(无 `generation`)⇒ 空对象(两出口逐字节同 7.120.0);成员 ⇒ `generation` + `leaseState` 恒在,
+ * fleet 成员身份三键的**唯一**投影(嵌套信号与 `/health` 顶层同调,同值同序):`generation` / `leaseState` / `leaseUntil`。
+ * 在场律:非 fleet 成员(无 `generation`)⇒ 空对象;成员 ⇒ `generation` + `leaseState` 恒在,
  * `leaseUntil` 只在 `granted`。
  */
 export declare function fleetMembershipKeys(s: EngineSignalFacts): FleetMembershipKeys;
-/** 心跳的 8.0 扁平方言 `ready` / `draining`(恒带,`false` 也带):`ready` = 就绪判,`draining` = 排空事实在场(规则 5,与嵌套形读同一个字段)。 */
-export declare function heartbeatReadinessKeys(s: EngineSignalFacts): Pick<InstanceAnnouncement, "ready" | "draining">;
-/** `/health` 的 8.0 扁平排空对:只在排空中带 —— `draining: true` + `drainingSince` = 排空事实的 `since`(规则 5,与嵌套形读同一个字段)。 */
-export declare function healthDrainingKeys(s: EngineSignalFacts): {
-    readonly draining?: true;
-    readonly drainingSince?: number;
-};
 /**
  * `/health` 的世代账扁平键(未接线 ⇒ 全缺席):target / applied 两版本(与嵌套形同一次读数)+ 两只收货序数(进程内单调,「见过多少代 / 停在哪一代」
  * 的推进判据)+ `configApplyStaleMs`(两者持续不等的时长,收敛即缺席)。只上 `/health`(契约心跳形没有这些座位)。

package/dist/fleet/engine-signal.js

@@ -1,3 +1,4 @@
+import { ENGINE_SIGNAL_KEY } from "@sema-agent/settings-schema/fleet";
 import { readinessOf } from "../http/readiness.js";
 import { drainingFactOf } from "./drain-entry.js";
 export const LEASE_NONE = Object.freeze({ state: "none" });
@@ -37,7 +38,6 @@ export function mintEngineSignal(deps) {
         ...(configApply !== undefined ? { configApply } : {}),
     };
 }
-export const ENGINE_SIGNAL_KEY = "engineSignal";
 export function buildEngineSignal(s) {
     return {
         ready: s.verdict.ready,
@@ -64,12 +64,6 @@ export function fleetMembershipKeys(s) {
         }
     }
 }
-export function heartbeatReadinessKeys(s) {
-    return { ready: s.verdict.ready, draining: s.draining !== undefined };
-}
-export function healthDrainingKeys(s) {
-    return s.draining === undefined ? {} : { draining: true, drainingSince: s.draining.since };
-}
 export function healthConfigLedgerKeys(s) {
     const g = s.configApply;
     if (g === undefined)

package/dist/fleet-client.js

@@ -1,5 +1,5 @@
-import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
-import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, heartbeatReadinessKeys } from "./fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY, InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS, readCapabilityReading } from "@sema-agent/settings-schema/fleet";
+import { buildEngineSignal } from "./fleet/engine-signal.js";
 import { centerFetch, centerLaneConfigured } from "./web-admin-client/center-request.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { createIdentityBins, pinAccountingIdentity } from "./center-credential.js";
@@ -153,11 +153,8 @@ export function startFleetClient(opts) {
                 worker: opts.center.worker,
                 address,
                 version: opts.version,
-                ...heartbeatReadinessKeys(signal),
                 heartbeatMs,
-                ...(signal.restart !== undefined ? { restart: signal.restart } : {}),
                 ...(modelRefusals !== undefined ? { modelRefusals } : {}),
-                ...fleetMembershipKeys(signal),
                 [ENGINE_SIGNAL_KEY]: engineSignal,
             };
             sending = true;

package/dist/gate-settlement.d.ts

@@ -12,8 +12,7 @@
  * 调用方对一条引擎续跑腿的分类({@link GateCommitment})只说「这条腿到边界时能证什么」,**从不单独铸位** —— 位要有边界作证。
  * 不铸的出口(都在调用点成文):`checkpoint.resume_aborted` 取消(拿不到 resolve 的返回值 ⇒ 证不出)、抛出臂的取消(受理之后也可能走到 ⇒
  * **刻意不带**证据,fail-closed)、4xx、交给宿主 / 新铸一跑 / 同一决定重投的回执(`delivered`,门由别人结清或仍待决)、停驻子代认领到的
- * token 不是选中的那一张(⇒ `409 decide.gate_moved`,不复活)。证据只随**同一次决定**的回放走:停驻赎回席的反向重试回放摘掉它
- * ({@link withoutSettlementEvidence})。
+ * token 不是选中的那一张(⇒ `409 decide.gate_moved`,不复活)。
  *
  * ## 读法(三句,契约 §4a「结清证据」同句)
  *  · 位在场 ⇒ 门已以此决定结清过(历史证据;与 `errorCode:"cancelled"` 或 `retriable:true` 并存时同样成立 —— 它不证明卡的**当前**状态、
@@ -57,12 +56,6 @@ export interface GateSettlementEvidence {
 export declare const NO_SETTLEMENT_EVIDENCE: GateSettlementEvidence;
 /** **唯一铸点**:一次边界跨越 → 体上的证据片段。 */
 export declare function buildSettlementEvidence(crossing: SettlementCrossing): GateSettlementEvidence;
-/**
- * 一张已带证据的回执被拿去答**另一个**决定(停驻赎回席的反向重试:回放首次受理的那一向、不改判)⇒ 证据两键都摘掉 ——
- * 证据说的是当初被结清的那次决定,这一次请求的决定从没被结清。同向重试是同一次请求的回放,体原样(证据随它)。
- * 只摘、不铸:本模块之外没有第二个写这两键的地方。
- */
-export declare function withoutSettlementEvidence<B extends Record<string, unknown>>(body: B): Omit<B, keyof GateSettlementEvidence>;
 /** **唯一读法**:这张回决应答说「门已以此决定结清过」吗(`200` 且体上的位为真)。两个读者同调这一只。 */
 export declare function decisionCommittedOf(out: {
     readonly status: number;

package/dist/gate-settlement.js

@@ -30,10 +30,6 @@ export function buildSettlementEvidence(crossing) {
         }
     }
 }
-export function withoutSettlementEvidence(body) {
-    const { decisionCommitted: _committed, checkpointId: _identity, ...rest } = body;
-    return rest;
-}
 export function decisionCommittedOf(out) {
     return out.status === 200 && out.body.decisionCommitted === true;
 }

package/dist/history-anchor.js

@@ -2,7 +2,7 @@ import { HttpError } from "./security.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { protocolEntry, readVisibleRun } from "./http/owner-access.js";
 const NO_ANCHOR = "no rewind anchor is recorded under that handle";
-const PROMPT_WITHOUT_ANCHOR = `${NO_ANCHOR}: it names a prompt of this session that recorded none (a prompt that carried attachments records none when its attachment frames were interrupted or their count did not match)`;
+const PROMPT_WITHOUT_ANCHOR = `${NO_ANCHOR}: it names a prompt of this session that recorded none`;
 export function anchorReaderOf(req, w, caller) {
     return protocolEntry(req, w, "run.anchor", caller);
 }

package/dist/hitl-delivery.d.ts

@@ -16,10 +16,9 @@
 import type { QuestionFrame } from "./question.js";
 import type { ElicitationFrame } from "./elicitation.js";
 import type { ApprovalCardLegFrame, ApprovalRevokeFrame } from "./approval-card.js";
-import type { ToolApprovalFrame } from "./tool-approval.js";
 import type { LedgerEventType } from "./trace/ledger-events.js";
-/** 三族的人在环帧(开 / 收 / 撤)。九个帧型全在账本闭集里(下面那条编译期断言)。 */
-export type HitlFrame = QuestionFrame | ElicitationFrame | ApprovalCardLegFrame | ApprovalRevokeFrame | ToolApprovalFrame;
+/** 三族的人在环帧(开 / 收 / 撤)。七个帧型全在账本闭集里(下面那条编译期断言)。 */
+export type HitlFrame = QuestionFrame | ElicitationFrame | ApprovalCardLegFrame | ApprovalRevokeFrame;
 /**
  * 一次投递在各只 sink 上的接下与否 —— **只有这一次投递涉及的 sink 才有键**(不在场 / 不在 `onto` 里的没有键)。
  * 也是 {@link HitlTransport.deliver} 的 `onto` 入参形:值为 `true` 的 sink 才写。

package/dist/hitl-delivery.js

@@ -17,8 +17,6 @@ function frameKey(frame) {
             return `elicitation=${frame.elicitationId}`;
         case "approval_request":
         case "approval_complete":
-        case "tool_approval":
-        case "tool_approval_complete":
             return `approval=${frame.approvalId}`;
         case "approval_revoke":
             return `batch=${frame.batchId}`;

package/dist/hooks/hook-llm.js

@@ -1,5 +1,6 @@
 import { admitRouteRequest, applyReasoningToRequest, AUTO_MODE_CLASSIFIER_LOW_REASONING_BUDGET_TOKENS, BrainError, joinRequestUrl, lowestReasoningSeat, mergeReasoningHeaders, resolveRouteCredential, routeKeyOf } from "@sema-agent/core";
-import { matchCatalogModel, refusedCatalogEntry, servedModelTableLeg } from "../model-select.js";
+import { modelRefusalLegOf, matchCatalogModel, refusedCatalogEntry, servedModelTableLeg } from "../model-select.js";
+import { configSourceKind } from "../config-provider.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { resolveOpenaiRouteEndpoint } from "../model-route-endpoint.js";
 import { anthropicLaneCredentialOf } from "../model-route-gap.js";
@@ -47,6 +48,7 @@ function routeCredentialHeader(credential) {
 }
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
+    const webAdminIsConfigSource = configSourceKind(config) === "remote";
     const anthropicRouteBaseUrl = () => anthropicRouteRoot(config.anthropic ?? {});
     const shapeFrom = (m, providerModelId = m.id) => {
         const catalogRef = m.name;
@@ -55,7 +57,7 @@ export function createHookLlm(deps) {
             case "anthropic":
                 return { ok: true, catalogRef, providerModelId, baseUrl: m.baseUrl || anthropicRouteBaseUrl(), api: "anthropic-messages", model: m };
             case "gateway": {
-                const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m, config.gatewayBaseUrl, servedModelTableLeg(config));
+                const endpoint = resolveOpenaiRouteEndpoint(catalogRef, m, config.gatewayBaseUrl, modelRefusalLegOf(servedModelTableLeg(config), webAdminIsConfigSource));
                 return endpoint.ok ? { ok: true, catalogRef, providerModelId, baseUrl: endpoint.baseUrl, api: "openai-completions", model: m } : unresolvedPick(endpoint.refusal);
             }
         }

package/dist/hooks/hook-runner.d.ts

@@ -37,7 +37,7 @@ export declare const MAX_HOOK_OUTPUT_BYTES: number;
  * 且 4096 的单条帽保证**前两条**钩子的话仍整段进得去(截断是配置广度的代价,不是常态)。
  */
 export declare const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10000;
-/** 契约里**引擎属主**的 `settings.hooks` 事件(契约包的九员字面量元组;壳属主的事件引擎不跑,owner-single)。 */
+/** 契约里**引擎属主**的 `settings.hooks` 事件(契约包的十员字面量元组;壳属主的事件引擎不跑,owner-single)。 */
 export type EngineOwnedHookEvent = (typeof ENGINE_OWNED_HOOK_EVENTS)[number];
 /**
  * 律二 · **事件对位只有一张表,一事件一站**:引擎属主的每个 `settings.hooks` 事件 → 它挂的那一个 `classic.*` 站(同名站)。
@@ -56,6 +56,7 @@ export declare const SETTINGS_HOOK_STATIONS: {
     readonly StopFailure: "classic.StopFailure";
     readonly PreCompact: "classic.PreCompact";
     readonly PostCompact: "classic.PostCompact";
+    readonly PermissionDenied: "classic.PermissionDenied";
 };
 /**
  * **一条车道一张注册**:每张的名字 —— wire 可见(`wiring_manifest.mods[].name`、`allowRuleShadowed[].entries`、问因项 `askReasons[].registration`),
@@ -170,7 +171,7 @@ export type ParseHooksConfigResult = {
  *    升级前被拦的 Bash 升级后放行(安全轴上的回退)。所以这条规则住在 fresh 专用的判据里,与 `taskSettingsKeyIssue` 同姿势
  *    (「fresh 400 / resume 宽容」双层:会砖存量的规则只咬 fresh)。resume 照旧整只采纳,别名那一组继续永不命中(与 7.111.0 逐字同),其余照跑。
  *  · **哪些事件** = 契约 `HOOK_EVENT_MATCHER_FIELD[event] === "tool_name"` ∧ 引擎属主 `HOOK_EVENT_OWNER[event] === "engine"`
- *    (今天恰是上面三个;`PermissionRequest` / `PermissionDenied` 也匹配 `tool_name` 但属壳,壳自己跑,不是本 runner 的读法)。**不手抄事件表**([ref])。
+ *    (今天 = 上面三个 + `PermissionDenied`(settings-schema 26.0.0 起引擎属主,名 = 同一次调用在门上的 wire 名,派生自动带上);`PermissionRequest` 也匹配 `tool_name` 但属壳,壳自己跑,不是本 runner 的读法)。**不手抄事件表**([ref])。
  *  · **哪些名字算别名** = core 静态目录(`describeToolCatalog()`)里某条 `face.aliases` 的成员,且它自己不是另一条目的 wire 名({@link engineToolAliases})。
  *    **只读这一只真源**([ref])。本仓自身不声明带别名的工具;嵌入方经 `resolveSpec` 席挂的别名与 MCP 工具名在受理面看不见(名册是每任务装配的),**不在射程**。
  *  · **正名同在则不拒**:`正名|别名` / `List.*` 会命中正名,不是「静默不命中」,且正是 7.107.0 CHANGELOG 给的「滚动期两名都写」补偿形。

package/dist/hooks/hook-runner.js

@@ -56,12 +56,13 @@ export const SETTINGS_HOOK_STATIONS = {
     StopFailure: "classic.StopFailure",
     PreCompact: "classic.PreCompact",
     PostCompact: "classic.PostCompact",
+    PermissionDenied: "classic.PermissionDenied",
 };
 function chainsBelowTaskOn(patterns, station) {
     return patterns.some((p) => p === station || (p.endsWith(".*") && station.startsWith(p.slice(0, -1))));
 }
-const REQUEST_HOOK_REWRITE_UNSHOWN_REASON = "a request PreToolUse hook rewrote this call's input, but this deployment runs its own handler for this call after the request's hooks and that handler never sees a rewrite made above it, so the rewrite cannot be honored and the call was not executed";
-const REQUEST_HOOK_ALLOW_UNJUDGED_REASON = "a request PreToolUse hook allowed this call, but this deployment runs its own handler for this call after the request's hooks, and a request hook's allow does not stand in for that handler's judgment, so the call was not executed";
+const REQUEST_HOOK_REWRITE_UNSHOWN_REASON = "a request PreToolUse hook rewrote this call's input, but a deployment-seat handler is admitted at the PreToolUse site below the request's hooks (admission is per site; whether its matcher fits this call is not read), and such a handler never sees a rewrite made above it, so request-hook rewrites are refused at this site and the call was not executed";
+const REQUEST_HOOK_ALLOW_UNJUDGED_REASON = "a request PreToolUse hook allowed this call, but a deployment-seat handler is admitted at the PreToolUse site below the request's hooks (admission is per site; whether its matcher fits this call is not read), and a request hook's allow does not stand in for that handler's judgment, so request-hook allows are refused at this site and the call was not executed";
 function hangTranslator(on, event, translators) {
     const translate = translators[event];
     if (translate === undefined)
@@ -1664,7 +1665,8 @@ function createLaneRegistration(lane, config, ctx, budgetMs) {
     const stopFailureEntries = lit("StopFailure");
     const preCompactEntries = lit("PreCompact");
     const postCompactEntries = lit("PostCompact");
-    if (!pre && !post && !postFailure && !postBatch && !promptSubmit && !stopEntries && !stopFailureEntries && !preCompactEntries && !postCompactEntries) {
+    const permissionDeniedEntries = lit("PermissionDenied");
+    if (!pre && !post && !postFailure && !postBatch && !promptSubmit && !stopEntries && !stopFailureEntries && !preCompactEntries && !postCompactEntries && !permissionDeniedEntries) {
         return undefined;
     }
     const onceSpent = new Set();
@@ -2178,6 +2180,19 @@ function createLaneRegistration(lane, config, ctx, budgetMs) {
             await runObserveOnlyEvent("PostCompact", postCompactEntries, cctx.trigger, payload, ctx, once, halt);
         });
     }
+    if (permissionDeniedEntries) {
+        translators.PermissionDenied = (dctx, halt) => settleOnce(onceSpent, async (once) => {
+            const payload = {
+                ...basePayload(ctx, dctx.permissionMode),
+                hook_event_name: "PermissionDenied",
+                tool_name: dctx.toolName,
+                tool_input: dctx.input,
+                tool_use_id: dctx.toolCallId,
+                reason: clipDataText(dctx.reason, MAX_HOOK_FEEDBACK_CHARS),
+            };
+            await runObserveOnlyEvent("PermissionDenied", permissionDeniedEntries, dctx.toolName, payload, ctx, once, halt);
+        });
+    }
     const events = Object.keys(translators);
     return {
         name: SETTINGS_HOOKS_REGISTRATIONS[lane],

package/dist/host-decision.d.ts

@@ -71,8 +71,8 @@ export type HostDecision = Extract<ResumeOutcome, {
  * ══ 决定体的出处位 `decidedBy`:一只闭集、一只读法、一只映射 ═══════════════════════════════════════════════
  *
  * 规则一句话:**一个审批决定用一只键说是谁做的** —— `decidedBy ∈ {"person","policy"}`,缺席 = `"person"`;读它的只有
- * {@link readDecider}(三条工具审批决定口共读:live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
- * `POST /v1/tasks/:id/asks/:askId/decision`、耐久 `POST /v1/approvals/:sessionId/decide`),把它交给引擎的只有
+ * {@link readDecider}(两条工具审批决定口共读:决断口
+ * `POST /v1/tasks/:taskId/asks/:askId/decision`、耐久 `POST /v1/approvals/:sessionId/decide`),把它交给引擎的只有
  * {@link liveHostSource}(同步座 `AskOutcome.settledBy`)与 {@link hostDecisionFacts}(停驻座 `hostDecision.decidedBy`)。
  *  · 词与决定动词**正交**:策略可以放行也可以拒(core 7.39.0 起引擎铸 `policy_allowed` / `policy_refused`)。唯一的例外是
  *    引擎自己的那一条 —— 一张要人的卡(`requiresRealApproval`)不归策略答,见 {@link heldAskOf}(判官是 core 的 `policyCannotAnswer`)。
@@ -103,14 +103,14 @@ export declare const DECIDED_BY_NOT_IN_PROOF = "decidedBy is not supported on a
 /** 一张要人的卡上策略的放行(两条决定口同一句;判官 core `policyCannotAnswer`,问形见 {@link heldAskOf})。 */
 export declare const POLICY_CANNOT_ALLOW_PERSON_ASK = "decidedBy \"policy\" cannot allow this ask \u2014 it demands a person's approval (risk.requiresRealApproval), and a policy's answer is not a person's; answer it as a person, or refuse it as the policy";
 /**
- * 退役键 `settledBy`(7.93.3–7.117.x 的「只配 deny」那一位)的拒句。三条决定口共用这一句,出句的铸点是 {@link retiredDecisionKeyFacts}(各口不直接引用本常量)。
- * live `/respond` 的解析不是键闭集的(未知键一律忽略),而这只键不是随便一个未知键:它是调用方在**明确陈述**「这是策略答的」—— 忽略它就是把缺席律(person)
- * 套在一个说了话的体上(旧壳的策略拒记成人拒;一张要人的卡上旧形的放行被读成人的放行,绕过「要人的卡不归策略答」那一判)。所以那条口
- * 在裁决之前响亮拒它,与同一只 parser 里 `scope` 的拒同一条先例;耐久两口本来就在键闭集 / strict 体上拒它,句子改由同一铸点出。
+ * 退役键 `settledBy`(7.93.3–7.117.x 的「只配 deny」那一位)的拒句。决定口共用这一句,出句的铸点是 {@link retiredDecisionKeyFacts}(各口不直接引用本常量)。
+ * 这只键不是随便一个未知键:它是调用方在**明确陈述**「这是策略答的」—— 忽略它就是把缺席律(person)套在一个说了话的体上(旧壳的策略拒记成人拒;
+ * 一张要人的卡上旧形的放行被读成人的放行,绕过「要人的卡不归策略答」那一判)。各口在键闭集 / strict 体上拒它,句子由同一铸点出
+ * (7.151.x 及以前的 live 应答口体不是键闭集的、在裁决之前专门拒它;那条口 7.152.0 起已删)。
  */
 export declare const SETTLED_BY_RETIRED = "settledBy is retired \u2014 send decidedBy: \"person\" | \"policy\" (who made this decision; absent = \"person\"); ignoring it would record a policy's answer as a person's";
 /**
- * 退役键 `settledBy` 的**拒绝事实** —— 三条工具审批决定口(live `POST /v1/tool-approvals/:id/respond`、耐久 ask 账
+ * 退役键 `settledBy` 的**拒绝事实** —— 两条工具审批决定口(决断口
  * `POST /v1/tasks/:taskId/asks/:askId/decision`、`POST /v1/approvals/:sessionId/decide`)对它的拒,**句**与**机读位**同出自这一处:
  *  · `error` = {@link SETTLED_BY_RETIRED}(三口同一句,没有哪一口自说一句 —— 此前耐久 ask 账说 strict 体的通用句、`/decide` 说键闭集句);
  *  · `extra` = `{ field: "settledBy" }`,直接作 `sendError` 的 `extra` / 并进 400 体。`field` 是 400 体上既有的那一把键(`request.field_invalid` 的
@@ -152,7 +152,7 @@ export type DeciderReading = {
  * 决定体决定者两格(`decidedBy` + `decidedVia`)的**唯一读法**。次序即契约:
  *  ① `decidedBy` 缺席 ⇒ `"person"`(缺席律:一条不说话的决定就是一个人按的 —— 与修前逐字同形);
  *  ② 直连门在场且 `decidedBy` 在场 ⇒ `not_in_proof`(不论值:它不在签名载荷里,能改线上字节的一方可以把人翻成策略;
- *     第二参给字面 `false` 的调用点 = 那条口没有决策证明,live `/respond` 即此);
+ *     各调用点交部署的 `directDoorActive`;7.151.x 及以前的 live 应答口没有决策证明、给字面 `false`,那条口 7.152.0 起已删);
  *  ③ `decidedBy` 闭集外(`"sla_timeout"`、结算词、别的串、非串、`null`)⇒ `outside_closed_set`({@link DECIDED_BY_OUTSIDE_CLOSED_SET});
  *  ④ `decidedVia` 在场(`undefined` 之外一律算在场,`null` 也是 —— 与 `decidedBy` 同一条在场口径)而它不在 core `DECIDED_VIA` 里,或旁边的决定者
  *     没有座位(人;含 ① 落成的缺席 person ⇒ 直连门上只带 `decidedVia` 也走这一臂,直连门从不受理它)⇒ `outside_closed_set`({@link DECIDED_VIA_OUTSIDE_SEAT});
@@ -176,11 +176,11 @@ export declare function readDecider(body: {
 export declare function liveHostSource(decider: ApprovalDecider): HostSource | undefined;
 /**
  * 引擎自己的那一条例外:**一张要人的卡不归策略答** —— 判官是 core 的 `policyCannotAnswer(question, decidedBy)`([ref] 包根导出;引擎的续跑入口、
- * 执行带与同步座读同一条)。本仓**只在自己的副作用先于引擎落地的两条口**上于裁决之前问它(live `/respond`:会话放行 / 常驻规则 / 一条按 approve
- * 回放的 DECIDED 行;耐久 ask 账:一条宣称 approve 的 DECIDED 行),并且只问**放行**那一向(与引擎续跑入口同:拒永远答得了)。耐久 `/decide` 不判:
+ * 执行带与同步座读同一条)。本仓**只在自己的副作用先于引擎落地的那一条口**上于裁决之前问它(决断口 `POST /v1/tasks/:taskId/asks/:askId/decision`:
+ * 会话放行 / 常驻规则 / 一条宣称 approve 的 DECIDED 行;7.151.x 及以前的 live 应答口也问,那条口 7.152.0 起已删),并且只问**放行**那一向(与引擎续跑入口同:拒永远答得了)。耐久 `/decide` 不判:
  * 引擎在 CAS 之前就拒(`checkpoint.invalid_outcome`,卡留 pending),本口的副作用全在引擎受理之后 —— 在那里再问一次就是第二个判官。
  *
- * 交给判官的「问」= {@link heldAskOf}:本仓两条口持有的都不是引擎的原物(活卡条目记的是铸条目那一次从 `AskRequest` 读定的那一位;耐久 ask 账行上是
+ * 交给判官的「问」= {@link heldAskOf}:决断口两形持有的都不是引擎的原物(活卡条目记的是铸条目那一次从 `AskRequest` 读定的那一位;ask 账行上是
  * 卡面 `risk.requiresRealApproval`,读不出按要人读),以引擎的问形(core `HeldQuestion` 的 `ask` 决定臂)交过去 —— 「谁答不了」只在引擎那一处判。
  */
 export declare function heldAskOf(demandsAPerson: boolean): Extract<PermissionResult, {

package/dist/host-lsp-manager.d.ts

@@ -6,8 +6,8 @@
  * `LSP_HOST_ENABLED`。理由:core 的 `NodeLspManager` 在 worker 上起本机子进程、在 worker 盘上找根,问的正是「这块盘是不是调用方的」;
  * 车道能力表不另存一位(同一个答案的第二个写者)。两个入口(服务装配 `boot/execution-env.ts`、纯本地 CLI `run-local.ts`)的 `lspManager`
  * 就是本函数的返回值,不再有任何条件(结构钉 `test/secret-env-scrub-disclosure.test.ts` 的 P1,逐格钉 `test/lsp-host-manager.test.ts` 的 P2)。
- * 「绑得住读」(`openBound`)不是运行期判据:它是「手在本 worker 盘上」的车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts`),
- * 运行期的不可绑拒由引擎答。
+ * 「绑得住读」(`openBound`)不是本铸点的判据:它是每条有手车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts` P3;本版 ssh 缓装),
+ * 运行期的不可绑由那一答答(远端目标给不出那一次观测 ⇒ `not_supported`,引擎读作缺席)。
  *
  * ## 子进程 env:病([ref],core 7.30.1 [ref] 提货;DEBTS [ref] 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
  * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的

package/dist/http/active-run-conflict.d.ts

@@ -15,6 +15,7 @@
  */
 import { type GovernancePosture } from "../runtime-governance.js";
 import type { ShellGateDoctrine } from "@sema-agent/core";
+import { type ParkedRunStatus } from "../plugins/store-contracts.js";
 import type { RunStore } from "../plugins/store-backend.js";
 import { type PendingRowBinding } from "../plugins/checkpoint-store-face.js";
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
@@ -71,11 +72,43 @@ export interface PendingGateMaterial {
      *  报的是同一行。残余如实记:这一位仍不是**跨 run** 的去重键 —— activeTaskId 换了,门自然也换。 */
     checkpointId?: string;
 }
+/**
+ * 持有者的状态词:run 状态表判为在跑或停驻的词(在跑 `running` ∪ 停驻词 —— 停驻词从表派生,今天 `suspended` / `needs_review`)。
+ * 收场词(完成 / 失败 / 阻断)不在其中:持有者行已收场而认领还在(收尾窗 / 崩溃残留),状态键不写。
+ */
+export type OccupantRunStatus = "running" | ParkedRunStatus;
+/**
+ * **会话占用两键**(wire):`activeTaskId` = 这只会话的单活认领此刻的持有者(认领已放 ⇒ `null`,键恒在);`activeTaskStatus` = 那条 run 行存着的状态,
+ * 在跑 / 停驻才写键({@link OccupantRunStatus})。唯一铸法 = {@link occupantOf};出现面:409 `conflict.session_active_run` 各体(提交 / 续跑 / 删除 / run 外回退)
+ * 与 SSE 冲突 done 帧、会话头探针 `GET /v1/sessions/:id/head` 的 200 体 —— 同一时刻两边的两键逐字相等。
+ */
+export type SessionOccupant = {
+    readonly activeTaskId: string | null;
+    readonly activeTaskStatus?: OccupantRunStatus;
+};
+/**
+ * 🔴 **占用两键的唯一投影**:认领持有者(任一处读到的那一格 —— 写口认领冲突里观察到的、删除围栏判到的、按会话读的认领)→ {@link SessionOccupant}。
+ * 状态 = 持有者那一行(不带属主的一格事实,经属主存取器 `runFactsOf` 读),在跑 / 停驻才写键。没有 run 店 ⇒ 只有持有者。
+ * 读店故障原样抛 —— 失败方向归调用方:提交面的 409 体降级成只带持有者({@link buildActiveRunConflict} 的留痕臂),读面响亮(500,不答一个看似诚实的少键体)。
+ */
+export declare function occupantOf(runStore: Pick<RunStore, "getRun"> | undefined, holder: string | null | undefined): Promise<SessionOccupant>;
+/**
+ * 拒体上的占用两键(409 的失败方向:拒体本身绝不被材料挡住):{@link occupantOf},持有者行读不出 ⇒ 只剩持有者 + F 类留痕(与提交面材料同一只 tag)。
+ * 读者:提交 / 续跑面的铸式({@link buildActiveRunConflict})、删除口与 run 外回退口的 409。
+ */
+export declare function refusalOccupantOf(runStore: Pick<RunStore, "getRun"> | undefined, holder: string | null | undefined): Promise<SessionOccupant>;
+/**
+ * 按会话读的那一读:run 店的单活认领(`getActiveTaskId`,跨副本 = 共享店里的那一格)→ {@link occupantOf}。读者:会话头探针(读面:任一读故障响亮)。
+ * 读的是存着的认领,不落死亡判决:心跳过期而还没被收割 / 观察的持有者照它行上存着的状态答(与「其余按认领判的门不判存活」同一条;
+ * 写口的认领冲突判官先判死它、所以提交不会因它 409)。
+ */
+export declare function readSessionOccupant(runStore: Pick<RunStore, "getActiveTaskId" | "getRun">, sessionId: string): Promise<SessionOccupant>;
 export interface ActiveRunConflictBody {
     error: string;
     errorCode: "conflict.session_active_run";
+    /** 占用两键({@link SessionOccupant},唯一投影 {@link occupantOf})。 */
     activeTaskId: string | null;
-    activeTaskStatus?: string;
+    activeTaskStatus?: OccupantRunStatus;
     /** [ref] S1([ref]):running 形专属的**活性证据**——本副本 ledger sink 最后一次 durable append 距今
      *  的毫秒数(「turn 真在推进」的判别材料;与行 updatedAt 的进程心跳语义刻意分离)。**同副本
      *  best-effort**:缺席 = 无法证明(跨副本/重启后),不是「不活」——诚实缺席,绝不铸 0。消费端
@@ -100,7 +133,7 @@ export interface ActiveRunConflictDoneResult {
     errorCode: "conflict.session_active_run";
     errorMessage: string;
     activeTaskId: string | null;
-    activeTaskStatus?: string;
+    activeTaskStatus?: OccupantRunStatus;
     /** [ref] S1:与 409 body 同键同语义(见 {@link ActiveRunConflictBody.msSinceLastActivity})。 */
     msSinceLastActivity?: number;
     pendingGate?: PendingGateMaterial;

package/dist/http/active-run-conflict.js

@@ -6,6 +6,28 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { refusalBody } from "./refusal-body.js";
 import { trustedCheckpointId } from "../checkpoint-identity.js";
 export const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
+function holderOf(holder) {
+    return holder ? holder : null;
+}
+export async function occupantOf(runStore, holder) {
+    const activeTaskId = holderOf(holder);
+    if (activeTaskId === null || runStore === undefined)
+        return { activeTaskId };
+    const status = (await runFactsOf(runStore, activeTaskId))?.status;
+    return status !== undefined && (status === "running" || isParkedRunStatus(status)) ? { activeTaskId, activeTaskStatus: status } : { activeTaskId };
+}
+export async function refusalOccupantOf(runStore, holder) {
+    try {
+        return await occupantOf(runStore, holder);
+    }
+    catch {
+        recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
+        return { activeTaskId: holderOf(holder) };
+    }
+}
+export async function readSessionOccupant(runStore, sessionId) {
+    return occupantOf(runStore, await runStore.getActiveTaskId(sessionId));
+}
 export function resumeEntryForGate(kind, ids) {
     switch (kind) {
         case "human":
@@ -42,24 +64,31 @@ function activeRunConflictBody(message, facts) {
     return body;
 }
 export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
-    const baseFacts = { activeTaskId: activeTaskId ?? null };
+    const baseFacts = { activeTaskId: holderOf(activeTaskId) };
     const base = activeRunConflictBody(ACTIVE_RUN_CONFLICT_BASE_TEXT, baseFacts);
-    if (!activeTaskId)
+    if (baseFacts.activeTaskId === null)
         return base;
-    try {
-        const status = deps.runStore === undefined ? undefined : (await runFactsOf(deps.runStore, activeTaskId))?.status;
-        if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
-            return base;
-        if (status === "running") {
-            const lastAt = deps.turnActivity?.(activeTaskId);
-            return activeRunConflictBody("session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", {
-                ...baseFacts,
-                activeTaskStatus: status,
-                ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
-            });
+    const holder = baseFacts.activeTaskId;
+    const occupant = await refusalOccupantOf(deps.runStore, holder);
+    const status = occupant.activeTaskStatus;
+    if (status === undefined)
+        return activeRunConflictBody(ACTIVE_RUN_CONFLICT_BASE_TEXT, occupant);
+    if (status === "running") {
+        let lastAt;
+        try {
+            lastAt = deps.turnActivity?.(holder);
+        }
+        catch {
+            recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
         }
+        return activeRunConflictBody("session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", {
+            ...occupant,
+            ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
+        });
+    }
+    let pendingGate;
+    try {
         const cs = deps.checkpointStore;
-        let pendingGate;
         if (cs?.findPendingTokenBySession) {
             const runBinding = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
             const scope = (await cs.peekPendingScope?.(sessionId, runBinding)) ?? undefined;
@@ -68,7 +97,7 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
             const gate = row?.gate;
             const kind = gate?.kind;
             const cardSessionId = row?.sessionId;
-            const decidePath = kind && cardSessionId ? resumeEntryForGate(kind, { sessionId: cardSessionId, taskId: activeTaskId }) : null;
+            const decidePath = kind && cardSessionId ? resumeEntryForGate(kind, { sessionId: cardSessionId, taskId: holder }) : null;
             const governanceForced = governanceOriginOf(gate, deps.governance);
             const checkpointId = trustedCheckpointId(row?.checkpointId, token);
             if (kind && decidePath) {
@@ -80,13 +109,13 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
                 };
             }
         }
-        return activeRunConflictBody(pendingGate
-            ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
-            : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`, { ...baseFacts, activeTaskStatus: status, ...(pendingGate ? { pendingGate } : {}) });
     }
     catch {
         recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
-        return base;
+        pendingGate = undefined;
     }
+    return activeRunConflictBody(pendingGate
+        ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
+        : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`, { ...occupant, ...(pendingGate ? { pendingGate } : {}) });
 }
 //# sourceMappingURL=active-run-conflict.js.map

package/dist/http/admission.js

@@ -1,7 +1,7 @@
 import { APPROVAL_REACH, IMAGE_ADMISSION, isApprovalReach, isPermissionMode, isThinkingLevel, expandTiers } from "@sema-agent/core";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
-import { HttpError, sessionIdShapeIssue } from "../security.js";
+import { HttpError, SESSION_KIND_UNRECORDABLE_MESSAGE, sessionIdShapeIssue } from "../security.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, appendFold, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS, PERMISSION_MODE_WORDS, autoCompactEnabledOk, parseTaskSettings, readSettingsEnv, settingsEnvComposeIssue, settingsEnvCredentialIssue, settingsPermissionBucketIssue, skillListingBudgetFractionOk, skillListingMaxDescOk, hooksKeyIssue, taskHooksHonored, taskSettingsKeyIssue } from "../task-settings.js";
 import { serverCredentialValueSources } from "../server-secret-env.js";
 import { tightenOnlySeatIssue } from "../tighten-only-seats.js";
@@ -9,7 +9,7 @@ import { approvalFrameFamiliesIssue } from "../tool-approval.js";
 import { buildEntryModeClampNotice } from "../entry-mode-clamp-notice.js";
 import { stampSubmissionEntryMode } from "../permission-mode-admission.js";
 import { taskBodyKeyIssue } from "../request-key-closure.js";
-import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
+import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, fileHistoryRestoreKeysInBody, inheritEnvFieldIssue, sessionKindFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import * as facts from "../capability-facts.js";
 import { buildHooksRefusal, buildHooksUrlCredentialRefusal, parseHooksConfig, hooksMatcherIssue, hooksUrlCredentialIssue } from "../hooks/hook-runner.js";
 import { judgeFreshRequestWebSearch } from "../plugins/web-search.js";
@@ -404,6 +404,10 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        if (body.cascade === true && fileHistoryRestoreKeysInBody(body).includes("rewindFilesTo")) {
+            sendError(res, 400, "request.field_conflict", "rewindFilesTo is not supported with cascade (every rung starts a fresh session, so there is no history to restore files from)", fieldConflictFacts("cascade_verify", ["rewindFilesTo", "cascade"]));
+            return null;
+        }
         if (body.resumeAtMode !== undefined) {
             if (body.resumeAtMode !== "at" && body.resumeAtMode !== "before") {
                 sendError(res, 400, "request.field_invalid", 'resumeAtMode must be "at" or "before"');
@@ -454,6 +458,17 @@ export function createAdmission(ctx) {
                 return null;
             }
         }
+        {
+            const kindIssue = sessionKindFieldIssue(body);
+            if (kindIssue) {
+                sendError(res, 400, "request.field_invalid", kindIssue);
+                return null;
+            }
+            if (body.sessionKind !== undefined && !facts.sessionKinds(deps).available) {
+                sendError(res, 400, "request.precondition_unmet", SESSION_KIND_UNRECORDABLE_MESSAGE);
+                return null;
+            }
+        }
         if (fileHistoryRestoreConflict(body)) {
             sendError(res, 400, "request.field_conflict", FILE_HISTORY_DISABLED_NO_RESTORE, fieldConflictFacts("file_history_restore", ["fileHistory", ...fileHistoryRestoreKeysInBody(body)]));
             return null;