@sema-agent/server 7.20.0 → 7.21.0-rc.1

package/dist/boot/resolve-spec.js

@@ -46,13 +46,13 @@ import { memorySpecForRequest } from "../memory-scope.js";
 import { mcpForScenario } from "../config-center/facade.js";
 import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, normalizeSuggestNextPrompts, promptProfileFromBody, resolveTaskLimits, retainBackgroundProcessesFromBody, taskAgentsSpecFragment, toolMaterializeStrategyFromBody, toolNameListFromBody } from "../spec-fields.js";
 import { cwdHonored, effectiveHostWorkspace, inProcessSingleUserLane, isValidCwd, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
-import { resolveRequestMcp } from "../task-mcp.js";
+import { assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, acceptAppendSystemPrompt, applyTaskSettings, effectivePermissionMode, effectiveThinking, hasConstitutionAnchors, parseTaskSettings, providerDropsAppend, shellGateForMode, withPermissionMode } from "../task-settings.js";
 import { enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, lockedKeys, } = ctx;
     // ── #177 的两件 boot 期收口(把守卫集搬到 governance 拍之后才成立的两条)────────────────────────
     //
     // ① 守卫集的**编译**从此每个请求都发生(旧家只在 default/auto/acceptEdits 三个模式臂里发生)。
@@ -75,6 +75,12 @@ export function createResolveSpec(ctx) {
     // design/158 A8:从 createHttpServer 实参里提出来(原地占该字面量 1,093 行中的 967 行)——
     // 类型标注 `ServiceDeps["resolveSpec"]` 顶替了原来的上下文推导,签名不变。
     const resolveSpec = async (body, _req, auth, opts) => {
+        // design/170 件C §4.3 —— **锁的拒排在最前**(codex 对抗复审 F3,验真后采纳)。
+        // 判据不是「在哪一阶段读到这个字段」而是「在**任何副作用**之前」:①阶段最先跑的
+        // `gateScenarioAndAppend` 会把上传的附件行**持久绑定**到 session,②阶段会写 per-session 的 cwd/env 表
+        // —— 一个最终 400 的请求若已经改掉了这两样,它就改变了**后续被接受的**任务会物化什么、在哪里执行。
+        // core 对同一把锁的裁定原话是「Runs BEFORE any side effect of task preparation」,server 侧同姿势。
+        assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         // A10 留档件#2:六阶段流水线。顺序=原文顺序(每一阶段的体逐字搬运),阶段之间只传显式产出;
         // 六个阶段函数定义在本 `return` 之后(自上而下先读骨架、再读各阶段)。
         const gated = await gateScenarioAndAppend(body, auth, opts);
@@ -801,6 +807,8 @@ export function createResolveSpec(ctx) {
             // worker; the stdio MCP runs on the worker, not the exec env, so the lane is irrelevant → seamless TOC↔cloud);
             // a multi-tenant deployment returns the baseline unchanged (gate closed → ignored, advertised via
             // capabilities.mcpInjection). Baseline wins on a name clash (a caller can ADD a server, never SHADOW a configured one).
+            // design/170 件C:锁形下本行不可达 —— `resolveSpec` 腿首已整拒(见那里的 F3 注)。`resolveRequestMcp`
+            // 收下的 config 带着 `lockedConfigKeys`,所以即使将来有人绕开腿首那道门,honored 谓词也会翻假。
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger),
             // center prompts 投影([1057]①f):center 下发的场景终形(overrides[s] ?? 基线)赢过内置 provider
             // (center-wins,scenario overlay 同先例);无 pack/该场景空声明 ⇒ 内置照旧。声明数组逐字喂 typed

package/dist/boot/runner-deps.d.ts

@@ -75,6 +75,10 @@ export interface RunnerDepsCtx {
      *  基座**——主/sub 两 Runner 必须同源:委托子代的 prepare 同样跑准入(委托冻结的重判腿),漏挂
      *  subRunner=子代平面绕过目录判决。 */
     orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
+    /** design/170 件B/C/D(#252 件1):三个部署治理座席的装配产物(boot/governance-seams.ts)。进**共享
+     *  基座** —— 合规否决与锁定层必须同样管住委托子代那条腿(子代 prepare 走同一套 preflight;漏挂
+     *  subRunner = 子代平面绕过档位与锁,与件A 同一个理由)。`retentionPolicy` 是纯声明,同源携带。 */
+    governanceSeams: import("./governance-seams.js").GovernanceSeams;
     /** design/177 —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores`)。在场即挂载
      *  `memory_list`/`memory_read` 两只工具(core 没有 TaskSpec 伴生旋钮:dep 的在场**就是**部署意图);
      *  缺席 ⇒ 两只都不挂,连占位都没有。装配点按「SQL 供给面 ∧ org 折叠面」双在场才铸它,与 HTTP 面
@@ -116,7 +120,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "onNotice">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -145,7 +149,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams">;
 /**
  * core `EngineNotice` → 结构化 `engine_notice` 行的**唯一**转发体(#240②)。
  *

package/dist/boot/runner-deps.js

@@ -88,6 +88,12 @@ export function createSharedRunnerDeps(ctx) {
         // Runner 必须同源同席([1543] 纪律,与 onNotice 同理);缺席=undefined=core 引擎默认(roots+内建表)。
         readFace: ctx.config.readFace ? ctx.config.readFace : undefined,
         readDenyPatterns: ctx.config.readDenyPatterns ? ctx.config.readDenyPatterns : undefined,
+        // #253 件 G5(core 5.33.0 #245,clay 裁定件):**内建** deny 表的档位/删行两座席——与上面两键同席
+        // 同源(主/子 Runner 必须同姿态)。缺席=undefined=core 自默认档位(除 shell-history 外全开)。
+        // 🔴 `?? undefined` 而不是真值判:`readDenyBuiltinTiers: []` 是**显式的空姿态**(env 写 `none`),
+        // 真值判会把它折回「缺席=默认全开」——正好把运维显式关掉的档位偷偷开回去。
+        readDenyBuiltinTiers: ctx.config.readDenyBuiltinTiers ?? undefined,
+        readDenyBuiltinExclude: ctx.config.readDenyBuiltinExclude ?? undefined,
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
         // core 1.364 durable bg agents 读半场(写半场=scenarioDeps.backgroundAgentStore 同实例,组装区注释)。
@@ -120,6 +126,13 @@ export function createSharedRunnerDeps(ctx) {
         // 「主 runner 挂了、subRunner 漏挂」那个病族。授权按 per-request principal 折叠(子代同宿主身份),
         // 所以共享同一个 provider 实例既正确又是唯一能让两只 Runner 看到同一份库集合的做法。
         sharedMemoryStores: ctx.sharedMemoryStores ? ctx.sharedMemoryStores : undefined,
+        // design/170 件B/C/D(#252 件1)—— 三个部署治理座席,同样必须进**共享基座**:合规档位的判决沿委托
+        // 树继承(core 按 principal 冻结一次),而委托子代在本仓跑在**另一只 Runner** 上 —— 那只 Runner 不
+        // 挂 resolver 就等于子代平面没有档位;`lockedConfig` 同理(§4.2 明写「覆盖 resume / refresh / 子代
+        // 构造三条路径」)。三键的缺席形都是 undefined = core 契约的「无限制/无锁/无策略」,诚实缺席。
+        compliancePostureResolver: ctx.governanceSeams.compliancePostureResolver,
+        lockedConfig: ctx.governanceSeams.lockedConfig,
+        retentionPolicy: ctx.governanceSeams.retentionPolicy,
     };
     return shared;
 }

package/dist/boot/stores.d.ts

@@ -29,5 +29,6 @@ export declare function openStores(ctx: OpenStoresCtx): Promise<{
     sessionStore: import("@sema-agent/core").SessionStore;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
     usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
 }>;
 //# sourceMappingURL=stores.d.ts.map

package/dist/boot/stores.js

@@ -33,6 +33,14 @@ import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "..
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { buildMemoryWriteBoundaryAudit } from "./memory-boundary.js";
+import { buildMemoryPosture } from "../memory-posture.js";
+/** #252:dark 三词 → 启动日志的人话(词表是机器面的真源,散文是它的**投影**,不是第二个真源)。
+ *  穷举 `Record<MemoryDarkReason, …>`:词表加员 ⇒ 这里编译红,不会静默漏一句人话。 */
+const DARK_REASON_PROSE = {
+    engine_off: () => "MEMORY_ENGINE=off",
+    multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|tidb to light up)",
+    remote_lane_split: (lane) => `remote exec lane "${lane}" (worker/sandbox file planes split; MEMORY_ENGINE_REMOTE_LANE=allow overrides)`,
+};
 export async function openStores(ctx) {
     const { config, logger, metrics, localRoot } = ctx;
     // One shared SQL store backend for L1 + L2 (TiDB/MySQL or PostgreSQL per DB_BACKEND). Owned here.
@@ -101,6 +109,8 @@ export async function openStores(ctx) {
     // 142-S2.5:per-(scope,peer) 同步游标面(sync_cursors)——POST /v1/memory/sync/:scope 的持久化半场。
     // 只在 DB memory plane 上点亮(file 形态路由 501,不接);与 entry plane 同池同方言。
     let memorySyncCursors;
+    /** #252:两支 SQL 后端从实例 getter 读到的档位真值;file/off 腿留 undefined(该腿无此指示面)。 */
+    let vectorMode;
     if (config.memoryEngineBackend !== "file" && config.memoryEngineEnabled) {
         const dialect = config.memoryEngineBackend;
         // 142-S5.1 production history sink: every applied patch appends one
@@ -121,7 +131,8 @@ export async function openStores(ctx) {
         // #228:检索档位(lexical|portable|native)是「后端上限 × embedder 在场」的**推断结果**,不是旋钮
         // ([3590] 裁①)。下面两支各自从**实例的 getter** 读真值——不在这里自己推断,推断出的档与实际跑的档
         // 一旦分家,启动日志就成了另一句谎([3606]①:lexical 在跑必须运维可见)。
-        let vectorMode;
+        // ⚠️ #252:声明上移到函数作用域(启动日志之外,`buildMemoryPosture` 也要读这个真值)——两支的赋值
+        // 逐字不变,file/off 那一臂照旧留 `undefined`(file 引擎没有档位指示面,不折成 lexical)。
         if (dialect === "pg") {
             const pool = backend?.pgPool();
             if (!pool)
@@ -404,15 +415,23 @@ export async function openStores(ctx) {
     // (S5.1, opts.history — the write point lives in the handed-over backend code).
     const memoryExportBackend = config.memoryEngineBackend !== "file" ? memoryEngine?.backend : undefined;
     const memoryLane = memoryEngineRemoteLanePosture(config); // N0: worker/sandbox file-plane split posture
+    // #252 件2/件3:记忆面姿态 —— **单一推导点**(纯,memory-posture.ts),两个读面(operator 诊断 /
+    // 能力位)都投影它,启动日志的 dark 报因也走它的闭集词,于是「日志说暗、能力位说亮」不可能发生。
+    // 位置:两支引擎装配都结束之后(要 `memoryEngine` 与 `vectorMode` 两件装配结果)。
+    const memoryPosture = buildMemoryPosture({
+        config,
+        engineWired: memoryEngine !== undefined,
+        vectorMode,
+        remoteLaneDark: memoryLane?.posture === "dark",
+    });
     if (config.memoryEngineBackend === "file" || !config.memoryEngineEnabled) {
         logger.info("memory_engine_enabled", memoryEngine
             ? { enabled: true, backend: "file", dir: memoryEngine.root }
             : {
                 enabled: false,
                 // 复审 F-11:按最终门结果报因,多租户 file=隔离判据,其余照旧。
-                reason: config.requirePrincipal === true ? "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|tidb to light up)"
-                    : !config.memoryEngineEnabled ? "MEMORY_ENGINE=off"
-                        : `remote exec lane "${memoryLane?.lane}" (worker/sandbox file planes split; MEMORY_ENGINE_REMOTE_LANE=allow overrides)`,
+                // #252:散文由**闭集词**派生(`memoryPosture.darkReason`)——机器面与人面从此不会各报各的因。
+                reason: DARK_REASON_PROSE[memoryPosture.darkReason ?? "engine_off"](memoryLane?.lane),
             });
     }
     // N0 boot warn: loud in BOTH postures — "dark" so an upgrade that silently turns memory off is visible,
@@ -502,7 +521,7 @@ export async function openStores(ctx) {
     return {
         backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore,
         taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
-        usageWindowStore,
+        usageWindowStore, memoryPosture,
     };
 }
 //# sourceMappingURL=stores.js.map

package/dist/config-types.d.ts

@@ -6,7 +6,7 @@
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
 import type { SealedKeyPoison } from "./sealed-key.js";
-import type { McpServerSpec, Model, ModelRoles } from "@sema-agent/core";
+import type { CompliancePosture, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
 import type { QuestionThrottle } from "./question.js";
@@ -603,6 +603,38 @@ export interface ServiceConfigFlat {
      *  filter, NOT a sandbox (sh -c/$()/pipes bypass argv[0] → fail toward ask). Per-request HOT; sourced from
      *  sema-registry `EffectiveConfig.runtime` (structured config, not an env scalar). undefined = unmanaged. */
     commandPolicy?: CommandRule[];
+    /**
+     * design/170 件B —— 本部署的**合规档位**(core `RunnerDeps.compliancePostureResolver` 的供数)。
+     * env `COMPLIANCE_PROFILE`(闭集 `hipaa|zdr`)+ `COMPLIANCE_ADDITIONAL_DENIES`(闭集能力名 csv,
+     * **只能收紧** profile 的内建 floor)。两个词表都是 core 的闭集,拼错一律 boot 拒 —— 一个拼错的
+     * 能力名等于「标着 hipaa 的部署根本没在执行那一条」(design/170 §3.2)。
+     *
+     * 🔴 **档位是部署级、不是 per-principal**:core 的座席按 principal 取值,但本仓能拿到的**唯一真源**
+     * 是部署配置面(design/170 §1 表:center 侧的档位真源标着「新建」= 尚不存在)。所以 resolver 对每个
+     * principal 返回同一份档位 —— 诚实的窄实现,而不是一条永远查不到值的 center 假腿。
+     * 缺席 = 无合规限制(core 契约),现存部署逐字零影响。
+     */
+    compliancePosture?: CompliancePosture;
+    /**
+     * design/170 件C —— **管理员锁定层**的部署声明(core `RunnerDeps.lockedConfig.keys`)。
+     * env `LOCKED_CONFIG_KEYS`(csv;词表 = core 的 `LOCKED_KEY_REGISTRY` 闭集,未知键 boot 拒 =
+     * `config.locked_registry`「不解析的安全控件不得半开」)。
+     *
+     * ⚠️ 本仓的两条**装配相容性**判据在 boot/governance-seams.ts(`assertLockAssemblable`):
+     * `toolPolicy` 锁与本仓「每条腿自铸 spec.toolPolicy」的装配形结构性冲突,`mcp` 锁与「部署自带 MCP
+     * 基线」冲突 —— 两者都在启动期拒,而不是让每条任务腿在 prepare 期各撞一次 `config.locked_key`。
+     */
+    lockedConfigKeys?: readonly LockedKey[];
+    /**
+     * design/170 件D —— **托管留存期**声明(core `RunnerDeps.retentionPolicy`)。env `RETENTION_MAX_AGE_DAYS`
+     * (有限非负数;坏值 boot 拒 —— 删数据的旋钮不许 NaN 流通)。
+     *
+     * 🔴 语义边界(成文,别当成"数据会被删"):core **只**拿它做启动期能力校验(锁着 + 店未声明
+     * `retention:"managed"` ⇒ 拒启),引擎自己在任务路径上从不删数据;真执行(调度/重试/副本协调/审计)
+     * 是部署侧的活,本仓**尚未**建(design/170 §5.2「server 半场四件皆新建」)。所以配了策略而没有任何
+     * managed 店时,启动会打一条 `retention_policy_not_executed` 的响亮 warn。
+     */
+    retentionPolicy?: RetentionPolicy;
     /** Tool names that require operator approval before running (F4). Empty = no approval gate. */
     approvalRequire: string[];
     /** Principals allowed to act as OPERATORS on the F4 approval queue (`/v1/approvals`): list ANY
@@ -1054,6 +1086,16 @@ export interface ServiceConfigFlat {
         pattern: string;
         caseSensitive: boolean;
     }[];
+    /** #253 件 G5(core 5.33.0 #245,clay 裁定件):**内建** deny 表的档位选择(闭集四档:credentials /
+     *  shell-history / browser / wallet)。`READ_DENY_BUILTIN_TIERS`=逗号分隔;`none`=显式空姿态(core 的
+     *  `[]`:一档内建都不要);坏档名 / 空串**启动期响亮拒**(校验用 core 自己的 `resolveReadDenyBuiltins`)。
+     *  缺席=不铸 ⇒ core 自默认(除 shell-history 外全开)。**仅 deployment 席**:TaskSpec 上没有同名键,
+     *  任务/受治脚本无法据此放宽自己的部署(core 侧的设计,与本仓「部署级旋钮无条件施加」同向)。 */
+    readDenyBuiltinTiers?: readonly string[];
+    /** #253 件 G5:按**行名**(内建表的 canonical pattern)删内建条目,在档位选择**之后**生效。
+     *  `READ_DENY_BUILTIN_EXCLUDE`=逗号分隔;不在表里的行名 / 空串**启动期响亮拒**。
+     *  🔴 不变量(判据帖 G5b):删内建**绝不**削弱任务自己显式声明的 deny —— 那是另一层(additions)。 */
+    readDenyBuiltinExclude?: readonly string[];
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
     /** Per-principal request cap per minute on task/run endpoints. 0 disables. */
@@ -1163,10 +1205,14 @@ export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" |
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
- *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+ *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
+ *  design/170 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:
+ *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
+ *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
+ *  config 这一层它只是一句声明。 */
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileReadDeny, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveLockedKeys } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -505,6 +505,52 @@ function parseReadDenyPatternsEnv(raw) {
     compileReadDeny(entries); // 引擎规则预验;抛错原样上抛=拒启
     return entries;
 }
+/**
+ * #253 件 G5(core 5.33.0 #245,clay 裁定件)—— 内建 deny 表管理面两键的 env 形:**逗号分隔的名字表**。
+ *
+ * 形状选择的理由:两个值域都是**短的、闭集或表内的名字**(四个档名 / 内建表的行名),JSON 数组在这里
+ * 只会让运维多写一层引号;`READ_DENY_PATTERNS` 用 JSON 是因为它的元素是**带可选字段的对象**。
+ *
+ * 🔴 **空串拒启,不折成 `[]`**:core 把 `tiers: []` 定义成一个合法姿态(「一档内建都不要」),但一个
+ * **空 env**(`READ_DENY_BUILTIN_TIERS=` / 变量没展开)在运维现场几乎总是手滑,而它的后果是**整张内建
+ * 敏感路径表被关掉** —— 让手滑与显式意图长得一样,正是 #157「安全轴上禁静默 fail-open」要禁的形。
+ * 要那个姿态就显式写 `none`(本仓的哨兵词,不是 core 词表的一员 —— 它在解析层就被翻成 `[]`)。
+ * exclude 侧没有对应的哨兵:一个「什么都不删」的 exclude 就是**不设这个 env**。
+ */
+function parseNameListEnv(name, raw, opts) {
+    const parts = raw.split(",").map((s) => s.trim());
+    if (opts?.emptySentinel !== undefined && parts.length === 1 && parts[0] === opts.emptySentinel)
+        return [];
+    const names = parts.filter((s) => s.length > 0);
+    if (names.length !== parts.length || names.length === 0) {
+        throw new Error(`env ${name}="${raw}" must be a comma-separated list of non-empty names` +
+            (opts?.emptySentinel !== undefined ? ` (write "${opts.emptySentinel}" for the explicit empty posture — an EMPTY value is refused so a mis-expanded variable cannot silently switch the built-in table off)` : "") +
+            " — refusing to start rather than silently applying a half-parsed list (#157).");
+    }
+    return names;
+}
+/**
+ * #253 件 G5 —— 两键的**引擎规则预验**:交给 core 自己的 `resolveReadDenyBuiltins`(闭集档名 + 表内行名
+ * 两类坏值它都响亮抛),宿主**不自造第二份判定语义**(与 `READ_DENY_PATTERNS` 走 `compileReadDeny` 的
+ * 姿势逐字同款)。抛出的文案前面缀上出问题的 env 名 —— core 的原文点名的是那个非法值,运维还需要知道
+ * 是哪一个变量写错了。
+ */
+function assertReadDenyBuiltinsResolvable(tiers, exclude) {
+    // 分两次校验(而不是一次喂两键):core 的文案点名的是**那个非法值**,而运维还需要知道是**哪个变量**
+    // 写错了 —— 一次喂两键就只能在文案里同时挂两个名字,把排查面又糊回去。
+    const check = (which, config) => {
+        try {
+            resolveReadDenyBuiltins(config);
+        }
+        catch (e) {
+            throw new Error(`env ${which}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    };
+    if (tiers !== undefined)
+        check("READ_DENY_BUILTIN_TIERS", { tiers });
+    if (exclude !== undefined)
+        check("READ_DENY_BUILTIN_EXCLUDE", { ...(tiers !== undefined ? { tiers } : {}), exclude });
+}
 function enumEnv(name, fallback, allowed) {
     const v = (process.env[name] ?? fallback);
     if (!allowed.includes(v))
@@ -1553,6 +1599,73 @@ function parseMemoryDomain(ctx) {
         syncImportLeaseStaleSec: clampEnvWithWarn("SYNC_IMPORT_LEASE_STALE_SEC", "600", 0), // #210 B 档
     };
 }
+/**
+ * design/170 件B/C/D —— 三条**部署治理声明**的 env 解析(auth 域的一段,fail-loud 全在这里)。
+ *
+ * 三条的词表真源都在 core(`ComplianceProfile` / `ComplianceCapability` / `LOCKED_KEY_REGISTRY`),本函数
+ * 只负责「env 文本 → 闭集值」这一步,并且**每一步坏值都拒启**:这三根旋钮全在安全/治理轴上,一个静默
+ * 不生效的档位或一个拼错的锁键,是「以为在管、其实没管」——比没配更贵(#210 A 档 + design/170 §3.4)。
+ *
+ * 半配也拒:`COMPLIANCE_ADDITIONAL_DENIES` 没有 profile 可收紧时是一句无处安放的话,静默丢掉它等于
+ * 让 operator 以为多禁了一条(与 `MEMORY_EMBEDDER_*` 的半配拒启同族)。
+ */
+function parseGovernanceDeclarations() {
+    const out = {};
+    /**
+     * codex 对抗复审 F1(high,验真后采纳)——**「未定义」与「定义了但是空」必须分开**。
+     *
+     * 病:模板化部署(k8s manifest、compose 的 `env_file`、`KEY=$(VAR)` 替换)极易产出一个**定义了但值为
+     * 空**的变量。若照本仓其它 env 的惯例把它折成「未设」,一个明明写下了档位/锁声明的部署会**静默**以
+     * 零档位零锁启动 —— 治理面静默失效正是这一族旋钮存在的理由,它不能自己犯这个病。
+     *
+     * 判据因此是:**未定义 = 文档化的缺省姿态(零 warn,#210「缺席不在律内」);已定义但解析不出内容 =
+     * 配错了 ⇒ 拒启 + 指路「要缺省就 unset,别留空」。** 迁移代价为零:三根都是本批新增的旋钮,现存部署
+     * 一个都没设过,所以这条更严的判据不会打到任何在跑的部署。
+     */
+    const requireNonBlank = (name, raw) => {
+        if (raw === undefined)
+            return undefined; // 未定义 = 缺省姿态
+        const trimmed = raw.trim();
+        if (trimmed === "" || trimmed.split(",").every((t) => t.trim() === "")) {
+            throw new Error(`env ${name} is set but empty (or has no parseable value) — a governance declaration that arms nothing must not boot silently. ` +
+                `UNSET ${name} to take the documented default, or give it a real value.`);
+        }
+        return trimmed;
+    };
+    // 件B:合规档位。profile 闭集由 core 的内建 deny 表的键集给出(词表单一真源,不在这里抄一份)。
+    const profileRaw = requireNonBlank("COMPLIANCE_PROFILE", process.env.COMPLIANCE_PROFILE) ?? "";
+    requireNonBlank("COMPLIANCE_ADDITIONAL_DENIES", process.env.COMPLIANCE_ADDITIONAL_DENIES);
+    const denyRaw = csv("COMPLIANCE_ADDITIONAL_DENIES");
+    if (profileRaw !== "") {
+        const profiles = Object.keys(BUILTIN_COMPLIANCE_DENIES);
+        if (!profiles.includes(profileRaw)) {
+            throw new Error(`COMPLIANCE_PROFILE must be one of ${profiles.join("|")}, got "${profileRaw}" — a misspelled compliance profile would run as NO profile at all`);
+        }
+        for (const cap of denyRaw) {
+            if (!COMPLIANCE_CAPABILITIES.includes(cap)) {
+                throw new Error(`COMPLIANCE_ADDITIONAL_DENIES contains "${cap}", not one of ${COMPLIANCE_CAPABILITIES.join("|")} — a misspelled capability name means that deny is simply not enforced`);
+            }
+        }
+        out.compliancePosture = { profile: profileRaw, ...(denyRaw.length > 0 ? { additionalDenies: denyRaw } : {}) };
+    }
+    else if (denyRaw.length > 0) {
+        throw new Error("COMPLIANCE_ADDITIONAL_DENIES is set but COMPLIANCE_PROFILE is not — additional denies only ever TIGHTEN a profile's builtin floor, so half of this configuration cannot be applied");
+    }
+    // 件C:锁定层声明。校验走 core 的 `resolveLockedKeys`(注册表是它的,未知键抛 config.locked_registry)。
+    requireNonBlank("LOCKED_CONFIG_KEYS", process.env.LOCKED_CONFIG_KEYS);
+    const lockedRaw = csv("LOCKED_CONFIG_KEYS");
+    if (lockedRaw.length > 0) {
+        resolveLockedKeys({ keys: lockedRaw }); // fail-loud;顺序保留交给下一行
+        out.lockedConfigKeys = lockedRaw;
+    }
+    // 件D:留存期。删数据的旋钮 ⇒ A 档拒启(`0` 合法:立即可删,是可评估的显式表达)。
+    // ⚠️ 空串必须走上面那道门:`Number("")` 是 **0**(有限!)—— 折成「立即可删」比折成「未设」更坏。
+    const retentionRaw = requireNonBlank("RETENTION_MAX_AGE_DAYS", process.env.RETENTION_MAX_AGE_DAYS);
+    if (retentionRaw !== undefined) {
+        out.retentionPolicy = { maxAgeDays: parseNumOrFailNonNegative("RETENTION_MAX_AGE_DAYS", retentionRaw) };
+    }
+    return out;
+}
 /** 域:auth(身份/凭证/绑址)—— service token 面、CORS、principal 头与开关、JWT 锚、autonomy、绑址。 */
 function parseAuthDomain(ctx) {
     const { requirePrincipal } = ctx; // 装配层已解析(它是四个域的共同入参),本域只负责把它落到字段上
@@ -1589,6 +1702,9 @@ function parseAuthDomain(ctx) {
         // Runtime governance second baton (center §10): AUTONOMY env for the env/local path; sema-registry overlays
         // it (applyRuntimeHot). commandPolicy is structured config — sema-registry-only (no flat env scalar form).
         autonomy: parseAutonomy(process.env.AUTONOMY),
+        // design/170 件B/C/D:三条部署治理声明(解析与 fail-loud 全在 parseGovernanceDeclarations;
+        // 三键都是可选的,未配 = 键不在 = 现存部署逐字零影响)。
+        ...parseGovernanceDeclarations(),
         operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
         principalJwtPubkeys,
         principalJwtIss,
@@ -1673,6 +1789,15 @@ function parseOrchestrationDomain(ctx) {
         // 逃过该函数返回型的多余属性检查,分组闭集校验从此看不见这两键。
         ...(process.env.READ_FACE !== undefined ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]) } : {}),
         ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
+        // #253 件 G5(core 5.33.0 #245):内建 deny 表的部署管理面。铸造与校验分两步——先按名字表解析
+        // (空串/半空拒启,见 `parseNameListEnv` 顶注),再交 core 的 `resolveReadDenyBuiltins` 判档名/行名
+        // (引擎同一套规则,宿主不自造第二份)。两键各自可单独设:只设 exclude 时 core 用默认档位。
+        ...(() => {
+            const tiers = process.env.READ_DENY_BUILTIN_TIERS !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_TIERS", process.env.READ_DENY_BUILTIN_TIERS, { emptySentinel: "none" }) : undefined;
+            const exclude = process.env.READ_DENY_BUILTIN_EXCLUDE !== undefined ? parseNameListEnv("READ_DENY_BUILTIN_EXCLUDE", process.env.READ_DENY_BUILTIN_EXCLUDE) : undefined;
+            assertReadDenyBuiltinsResolvable(tiers, exclude);
+            return { ...(tiers !== undefined ? { readDenyBuiltinTiers: tiers } : {}), ...(exclude !== undefined ? { readDenyBuiltinExclude: exclude } : {}) };
+        })(),
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
@@ -2040,7 +2165,8 @@ const MEMORY_GROUP_KEYS = [
 ];
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
-    "commandPolicy", "operatorPrincipals", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
+    "commandPolicy", "compliancePosture", "lockedConfigKeys", "retentionPolicy",
+    "operatorPrincipals", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
     "principalJwtMaxTtlSec", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
@@ -2051,7 +2177,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "rosterRetentionMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
-    "imageBakes", "readFace", "readDenyPatterns",
+    "imageBakes", "readFace", "readDenyPatterns", "readDenyBuiltinTiers", "readDenyBuiltinExclude",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",

package/dist/fleet/fleet-bus.d.ts

@@ -1,4 +1,5 @@
 import type { TaskNotificationPayload, WorkflowRun } from "@sema-agent/core";
+import type { RunRecord } from "../plugins/store-contracts.js";
 /** [2687-cli] 幽灵行案的单源判别:一条 `task_notification` 只有在 **agent 族 × 终态** 时才允许打
  *  `onChildTerminal`(fleet「subagent 树」只渲 agent 子代)。`background_bash`/`monitor`/`external`
  *  不属 agent fleet 树——它们此前每条都打,fleet-bus 的「无 tick 无 claim」臂给 b\* 与 m\* handle 合成
@@ -384,7 +385,7 @@ export declare function fleetRunPublisher(bus: FleetEventBus | undefined, run: {
     /** [1839]①/(a) 案:`residuals` = 顶层 run 的终局残局键(有源才传,见 FleetTaskRow 上的键注)。
      *  只有**真终态**(completed/failed/killed)帧带残局——parked(suspended/needs_review)的行还活着,
      *  没有「终局」可言,误传也不上帧。 */
-    onTerminal: (status: string, residuals?: {
+    onTerminal: (status: RunStatusForFleet, residuals?: {
         usage?: FleetTaskRow["usage"];
         stoppedBy?: string;
         transcriptId?: string;
@@ -438,8 +439,28 @@ export declare function fleetBackgroundChildPublisher(bus?: FleetEventBus, log?:
 export declare function fleetRunLabels(objective: string | undefined): {
     name: string;
 };
+/**
+ * `runStatusToFleet` 的入参**闭集**(A-032 P1-④)。两段:
+ *  · `RunRecord["status"]` = `"running" | core.TaskStatus` —— run **行**状态词表,属主
+ *    `plugins/store-contracts.ts`(core 加成员 ⇒ 下面那条 switch 的 `never` 臂收不敛 ⇒ tsc 红);
+ *  · 四个**非行状态**的结算词:`queued`(未落行的排队态)、`error`(历史别名)、`killed`/`cancelled`
+ *    (取消腿自己传,不是行上会出现的词)。
+ *
+ * 🔴 为什么必须是闭集而不是 `string`:开集签名让「词表加成员 ⇒ 编译红」在结构上不可能,而这条映射的
+ * miss 臂代价是**不可见的**(行折成 idle、removal 集不收 ⇒ fleet 永久滞留 stale 行)。2026-06-28
+ * on-box e2e 逮到的 `blocked` 泄漏就是这么来的;单员回归钉只钉住昨天的成员。
+ */
+export type RunStatusForFleet = RunRecord["status"] | "queued" | "killed" | "cancelled" | "error";
+/**
+ * fleet 行的**离场**判据(`onTerminal` 的 removal 集)—— `FleetTaskStatus` 的穷举 switch。
+ *
+ * 与 {@link runStatusToFleet} 同族(A-032 P1-④ 证据段点名):此前是消费点手抄的
+ * `=== "completed" || === "failed" || === "killed"` 三词字面比对,fleet 词表加成员时同样没有编译期钉。
+ * park 态(`waiting` / `awaiting approval`)判 false 是承重的:行还活着,必须留在 fleet 上。
+ */
+export declare function isTerminalFleetStatus(status: FleetTaskStatus): boolean;
 /** Map a service run status onto the neutral fleet vocabulary the shell renders. */
-export declare function runStatusToFleet(status: string, opts?: {
+export declare function runStatusToFleet(status: RunStatusForFleet, opts?: {
     awaitingPlanApproval?: boolean;
 }): FleetTaskStatus;
 //# sourceMappingURL=fleet-bus.d.ts.map

package/dist/fleet/fleet-bus.js

@@ -455,7 +455,7 @@ export function fleetRunPublisher(bus, run) {
             settledLeg = true; // freeze — nothing publishes on this leg's publisher after the settle
             const fleetStatus = runStatusToFleet(status);
             // [1839]①/(a) 案:真终态帧带残局键(有源才带,键逐挑不 spread);parked 帧不带(行还活着)。
-            const terminal = fleetStatus === "completed" || fleetStatus === "failed" || fleetStatus === "killed";
+            const terminal = isTerminalFleetStatus(fleetStatus); // A-032 P1-④:removal 集不再手抄(穷举属主谓词)
             const res = terminal && residuals
                 ? {
                     ...(residuals.usage ? { usage: residuals.usage } : {}),
@@ -950,6 +950,36 @@ export function fleetRunLabels(objective) {
     const name = oneLine.length > 48 ? `${oneLine.slice(0, 47)}…` : oneLine;
     return { name };
 }
+/**
+ * fleet 行的**离场**判据(`onTerminal` 的 removal 集)—— `FleetTaskStatus` 的穷举 switch。
+ *
+ * 与 {@link runStatusToFleet} 同族(A-032 P1-④ 证据段点名):此前是消费点手抄的
+ * `=== "completed" || === "failed" || === "killed"` 三词字面比对,fleet 词表加成员时同样没有编译期钉。
+ * park 态(`waiting` / `awaiting approval`)判 false 是承重的:行还活着,必须留在 fleet 上。
+ */
+export function isTerminalFleetStatus(status) {
+    switch (status) {
+        case "completed":
+        case "failed":
+        case "killed":
+            return true;
+        case "queued":
+        case "running":
+        case "waiting":
+        case "stopping":
+        case "awaiting approval":
+        case "idle":
+            return false;
+        default: {
+            const unhandled = status; // FleetTaskStatus 加成员 ⇒ tsc 红,加成员的人当场回答「这个态算不算离场」
+            void unhandled;
+            // 运行期保守:未知 ⇒ 不摘行(误摘 = 把一条还在跑的任务从面板上抹掉;漏摘只是多一行)。
+            // 这条臂与 runStatusToFleet 的 miss 臂**不同源**:`FleetTaskStatus` 是本仓自有词表,只会被本仓
+            // 自己加成员,而那是编译期就红的事 —— 所以这里不接留痕(没有"运行期冒出个新词"的来路)。
+            return false;
+        }
+    }
+}
 /** Map a service run status onto the neutral fleet vocabulary the shell renders. */
 export function runStatusToFleet(status, opts) {
     if (opts?.awaitingPlanApproval)
@@ -975,8 +1005,17 @@ export function runStatusToFleet(status, opts) {
         case "killed":
         case "cancelled":
             return "killed";
-        default:
+        default: {
+            // 🔴 编译期执法点:词表加成员 ⇒ 这里收不敛到 `never` ⇒ tsc 红,加成员的人必须当场回答
+            // 「这个新态在 fleet 上长什么样、行该不该离场」。
+            const unhandled = status;
+            // 运行期防线(#157:runtime miss 臂必须自陈)。这条臂**运行期仍可达**:`rowToRun` 把无约束的
+            // SQL 文本列裸 cast 成联合,滚动升级里更新的副本写入的新状态词会被旧副本读到。方向照旧折 `idle`
+            // (不改行为,改的是「静默」),但每次 miss 必须留痕 —— 否则「fleet 上为什么有一行永远不走的 idle」
+            // 在遥测里没有任何痕迹,只能靠人眼在面板上发现。
+            recordFailOpen("server.fleet.run-status-unmapped", String(unhandled));
             return "idle";
+        }
     }
 }
 //# sourceMappingURL=fleet-bus.js.map