@sema-agent/server 7.4.0 → 7.5.0

package/dist/hooks/hook-runner.js

@@ -65,6 +65,24 @@ export const MAX_HOOK_HTTP_HEADERS = 32;
 export const MAX_HOOK_OUTPUT_BYTES = 1024 * 1024;
 /** 喂给模型的 deny 原因/additionalContext 的单条长度上限(字符)。 */
 const MAX_HOOK_FEEDBACK_CHARS = 4_096;
+/**
+ * 一次事件里所有 hook 上下文片段**聚合后**喂给模型的总量上限(字符)。
+ *
+ * 为什么单条帽不够:一次事件最多 {@link MAX_HOOK_ENTRIES_PER_EVENT} 条(parseHooksConfig 的广度闸),
+ * 每条最多推两段(`decision:"block"` 的 reason + `hookSpecificOutput.additionalContext`),
+ * {@link composeHooks} 再把部署槽与 task 槽的**成品**拼一次 —— 单条 4096 相乘后一次注入可达 ~256KB,
+ * 而这些字符是**逐次工具调用**进模型可见文本的(core `hooks.js` 的 preToolContext / `prepare-task.js`
+ * 的 tool_result 追加 / `runtask.js` 的 Stop follow-up),不是日志。
+ *
+ * 帽值取 10_000 的依据:模型可见文本在本栈的既有预算量纲就是 10k —— core `truncateError`
+ * (`src/core/tool-errors.ts`)的 10k 中截,逐字锚 CC 序列化器 `A7e` 的 `1e4`;#181 战役里 core 还要给
+ * `beforeToolCall` block reason 补一道同值兜底闸。取同一量级 = 「一次 hook 注入 ≤ 一份错误文本预算」,
+ * 且 4096 的单条帽保证**前两条**钩子的话仍整段进得去(截断是配置广度的代价,不是常态)。
+ */
+export const MAX_HOOK_CONTEXT_TOTAL_CHARS = 10_000;
+/** 帽满时仍值得保留的最短残段(字符)。比这更短的尾巴不是信息:模型会把半句话读成完整指令,
+ *  宁可整条落进"省略"计数。 */
+const MIN_HOOK_CONTEXT_PARTIAL_CHARS = 256;
 /** PostToolUse payload 里 tool_response 文本投影的上限(字符)——工具结果可能是 MB 级。 */
 const MAX_TOOL_RESPONSE_CHARS = 32_768;
 /** stdin payload 里 tool_input JSON 投影的上限(字符;巨大 tool_input 经 JSON.stringify 造成
@@ -233,6 +251,104 @@ const DEFAULT_AGENT_HOOK_TIMEOUT_SECONDS = 120;
 function clip(s, n) {
     return s.length > n ? `${s.slice(0, n)}…(${s.length})` : s;
 }
+/**
+ * hook 上下文片段 → 喂给模型的单串。**所有** `additionalContext` 聚合点的唯一属主(此前是同一个
+ * `contexts.join("\n")` 表达式抄在二十余处,总量帽无处可挂 —— 那正是漂移成因)。
+ *
+ * 三条语义,都是承重的:
+ *  1. **顺序保留、只截尾**:先来的钩子先说话;一旦装不下就停,后面的条目一律不再挤进来(哪怕更短)。
+ *     按长度重排会让"第 3 条钩子的话"随别人的长度忽隐忽现,排障时无从复现。
+ *  2. **截断可见**:尾巴挂一行标记说明省了几条、丢了多少字符。静默丢弃会让 hook 作者以为自己的
+ *     context 生效了,而模型那头根本没见过 —— 这类"以为配好了"的缺席比长文本本身更贵。
+ *  3. **标记不计预算**:与 core `truncateError` / CC `A7e` 同姿势(marker 不占那 10k),否则帽值的
+ *     含义会随标记文案长度漂。
+ */
+export function buildHookContext(parts) {
+    const present = parts.filter((p) => p.length > 0).map(readHookContextPart);
+    if (present.length === 0)
+        return undefined;
+    const kept = [];
+    let used = 0;
+    let truncating = false;
+    let messages = 0;
+    let omitted = 0;
+    let droppedChars = 0;
+    for (const part of present) {
+        // 内层的账先并进来(标记读回,见 {@link readHookContextPart}),再谈这一轮自己丢了什么。
+        messages += part.messages;
+        omitted += part.omitted;
+        droppedChars += part.dropped;
+        if (!truncating) {
+            const sep = kept.length > 0 ? 1 : 0; // join 的 "\n" 也占预算
+            const room = MAX_HOOK_CONTEXT_TOTAL_CHARS - used - sep;
+            if (room >= part.body.length) {
+                if (part.body.length > 0) {
+                    kept.push(part.body);
+                    used += sep + part.body.length;
+                }
+                continue;
+            }
+            truncating = true;
+            // 只有**单条**发言可以切尾:切了它仍是"部分在场",账目诚实(dropped 记尾巴,omitted 不变)。
+            // 已聚合的成品代表内层多条、正文里却没有条目边界 —— 切一刀会把第 2..N 条整个抹掉却记 0 条省略,
+            // 标记恰好在最常走的两层合流路上说谎(codex 复审 R4,亲核属实)。⇒ 它要么整段留,要么整条丢。
+            if (part.messages === 1 && room >= MIN_HOOK_CONTEXT_PARTIAL_CHARS) {
+                kept.push(part.body.slice(0, room));
+                used += sep + room;
+                droppedChars += part.body.length - room;
+                continue;
+            }
+        }
+        // 整条不见 = 它代表的**全部**条目都不见。内层已经报过的那几条上面加过了,这里只补差额
+        // ——否则一个"3 of 5"的成品被整条丢掉会记成 8 条,报出"省掉的比总数还多"这种自相矛盾的账。
+        omitted += part.messages - part.omitted;
+        droppedChars += part.body.length;
+    }
+    const body = kept.join("\n");
+    if (droppedChars === 0)
+        return body;
+    const marker = `[hook context truncated at ${MAX_HOOK_CONTEXT_TOTAL_CHARS} chars: ${omitted} of ${messages} hook messages omitted, ${droppedChars} characters dropped]`;
+    return kept.length > 0 ? `${body}\n${marker}` : marker;
+}
+/** 截断标记的尾锚形。帽值**逐字写进模式**(不是 `\d+`):只认"我们自己这一版才会写出的那一份",
+ *  别处飘来的同类文字连模式都不匹配。 */
+const HOOK_CONTEXT_MARKER_RE = new RegExp(`\\n\\[hook context truncated at ${MAX_HOOK_CONTEXT_TOTAL_CHARS} chars: (\\d+) of (\\d+) hook messages omitted, (\\d+) characters dropped\\]$`);
+/** 读回标记时接受的数字上界(2^42)。比任何真值大若干数量级,又小到几十条相加也绝不越过安全整数
+ *  —— 伪造的巨数因此根本进不来,合并加法也不必每一步复验溢出。 */
+const MAX_HOOK_CONTEXT_PARSED_COUNT = 2 ** 42;
+/**
+ * 片段 → 内容 + 它自带的截断账。
+ *
+ * 为什么必须能**读回**自己写的标记:`composeHooks` 会把 {@link buildHookContext} 的成品当片段再喂一次
+ * (部署槽在场即走这条路 —— 是常态不是边角)。标记按内容处理会犯两桩:①切在标记中间 ⇒ 模型读到半截
+ * 标记;②外层重新记账 ⇒ 内层丢掉的那一万多字符凭空消失,标记数字变成谎。标记既然不计预算,读回时也
+ * 不能算内容;把它携带的账并进外层,函数对自己的输出就是幂等的。
+ *
+ * 🔴 这把尺子对着的是**不可信文本**(钩子想吐什么就吐什么),所以只认"我们自己才写得出的那一份":
+ * 帽值逐字相等(在模式里)、`dropped ≥ 1`(我们从不在零丢弃时写标记)、`omitted ≤ messages`、
+ * `messages ≥ 1`、数字都在 {@link MAX_HOOK_CONTEXT_PARSED_COUNT} 内。任一条不合 ⇒ **整段当普通内容**。
+ * 认下之后也不会有"内容静默少一行":认下 ⇒ `dropped > 0` ⇒ 输出必然带标记 —— 摘掉的那一行总是被
+ * **重写**回去(数字可能被合并),从不是被删掉。伪造得刚好合规只会让记账口径偏,不改任何裁决;
+ * 而且钩子配置在单用户闸内,伪造者就是这份账的读者本人。
+ */
+function readHookContextPart(part) {
+    const m = HOOK_CONTEXT_MARKER_RE.exec(part);
+    if (!m)
+        return { body: part, messages: 1, omitted: 0, dropped: 0 };
+    const omitted = Number(m[1]);
+    const messages = Number(m[2]);
+    const dropped = Number(m[3]);
+    const sane = (n) => Number.isSafeInteger(n) && n <= MAX_HOOK_CONTEXT_PARSED_COUNT;
+    if (!sane(omitted) || !sane(messages) || !sane(dropped) || messages < 1 || omitted > messages || dropped < 1) {
+        return { body: part, messages: 1, omitted: 0, dropped: 0 };
+    }
+    return { body: part.slice(0, part.length - m[0].length), messages, omitted, dropped };
+}
+/** {@link buildHookContext} 的字段形(聚合点全是 `...spread` 进结果对象):空 → 不产字段。 */
+function buildHookContextField(parts) {
+    const text = buildHookContext(parts);
+    return text === undefined ? {} : { additionalContext: text };
+}
 /** 跑一条 command hook:sh -c,stdin=payload JSON(CC-verbatim),超时 SIGKILL,输出各限 1MiB。 */
 function runCommandHook(entry, payload, ctx) {
     return new Promise((resolve) => {
@@ -736,7 +852,7 @@ export function createTaskHooks(config, ctx) {
                     if (run.code === 2) {
                         // CC:exit 2 = 阻断,stderr 喂给模型
                         const reason = clip(run.stderr.trim(), MAX_HOOK_FEEDBACK_CHARS) || "blocked by a PreToolUse hook";
-                        return { action: "deny", message: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                        return { action: "deny", message: reason, ...buildHookContextField(contexts) };
                     }
                     if (run.code !== 0) {
                         ctx.logger.warn("hook_command_failed", { event: "PreToolUse", code: run.code, stderr: clip(run.stderr, 300) });
@@ -750,11 +866,11 @@ export function createTaskHooks(config, ctx) {
                     if (out.continue === false) {
                         const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                         // core 的 preToolUse seam 无"终止整个 run"能力(阶段一诚实近似:deny 本次调用)。
-                        return { action: "deny", message: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                        return { action: "deny", message: reason, ...buildHookContextField(contexts) };
                     }
                     if (out.decision === "block") {
                         const reason = clip(typeof out.reason === "string" ? out.reason : "blocked by a PreToolUse hook", MAX_HOOK_FEEDBACK_CHARS);
-                        return { action: "deny", message: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                        return { action: "deny", message: reason, ...buildHookContextField(contexts) };
                     }
                     const hso = out.hookSpecificOutput;
                     if (hso !== null && typeof hso === "object" && hso.hookEventName === "PreToolUse") {
@@ -764,7 +880,7 @@ export function createTaskHooks(config, ctx) {
                         const decision = h.permissionDecision;
                         if (decision === "deny") {
                             const reason = clip(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "denied by a PreToolUse hook", MAX_HOOK_FEEDBACK_CHARS);
-                            return { action: "deny", message: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                            return { action: "deny", message: reason, ...buildHookContextField(contexts) };
                         }
                         if (decision === "ask") {
                             asked = clip(typeof h.permissionDecisionReason === "string" ? h.permissionDecisionReason : "a PreToolUse hook requires approval", MAX_HOOK_FEEDBACK_CHARS);
@@ -798,7 +914,7 @@ export function createTaskHooks(config, ctx) {
                     action: "ask",
                     message: asked,
                     ...(rewritten ? { updatedInput: currentInput } : {}),
-                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                    ...buildHookContextField(contexts),
                 };
             }
             if (unknownDecision) {
@@ -814,14 +930,14 @@ export function createTaskHooks(config, ctx) {
                     action: "ask",
                     message: "a PreToolUse hook returned an unrecognized permissionDecision — approval required",
                     ...(rewritten ? { updatedInput: currentInput } : {}),
-                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                    ...buildHookContextField(contexts),
                 };
             }
             if (rewritten || contexts.length > 0) {
                 return {
                     action: "allow",
                     ...(rewritten ? { updatedInput: currentInput } : {}),
-                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                    ...buildHookContextField(contexts),
                 };
             }
             return undefined; // 无意见(≠ allow 短路;core 门照常裁决)
@@ -879,7 +995,8 @@ export function createTaskHooks(config, ctx) {
                     }
                 }
             }
-            return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
+            const additionalContext = buildHookContext(contexts);
+            return additionalContext === undefined ? undefined : { additionalContext };
         };
         hooks.postToolUse = postToolUseHook;
     }
@@ -927,7 +1044,8 @@ export function createTaskHooks(config, ctx) {
                         contexts.push(clip(h.additionalContext, MAX_HOOK_FEEDBACK_CHARS));
                 }
             }
-            return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
+            const additionalContext = buildHookContext(contexts);
+            return additionalContext === undefined ? undefined : { additionalContext };
         };
         hooks.postToolUseFailure = postToolUseFailureHook;
     }
@@ -973,7 +1091,8 @@ export function createTaskHooks(config, ctx) {
                 if (out.hookSpecificOutput !== undefined)
                     ctx.logger.warn("hook_result_unsupported", { event: "PostToolBatch" });
             }
-            return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
+            const additionalContext = buildHookContext(contexts);
+            return additionalContext === undefined ? undefined : { additionalContext };
         };
         hooks.postToolBatch = postToolBatchHook;
     }
@@ -989,7 +1108,7 @@ export function createTaskHooks(config, ctx) {
             for (const { run } of singles) {
                 if (run.code === 2) {
                     const reason = clip(run.stderr.trim(), MAX_HOOK_FEEDBACK_CHARS) || "blocked by a UserPromptSubmit hook";
-                    return { block: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                    return { block: reason, ...buildHookContextField(contexts) };
                 }
                 if (run.code !== 0) {
                     ctx.logger.warn("hook_command_failed", { event: "UserPromptSubmit", code: run.code, stderr: clip(run.stderr, 300) });
@@ -1003,11 +1122,11 @@ export function createTaskHooks(config, ctx) {
                 if (out.continue === false) {
                     // continue:false=终止整个 run;userPromptSubmit 的 block 语义正是"任务带理由收场"——同义直映射。
                     const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
-                    return { block: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                    return { block: reason, ...buildHookContextField(contexts) };
                 }
                 if (out.decision === "block") {
                     const reason = clip(typeof out.reason === "string" ? out.reason : "blocked by a UserPromptSubmit hook", MAX_HOOK_FEEDBACK_CHARS);
-                    return { block: reason, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                    return { block: reason, ...buildHookContextField(contexts) };
                 }
                 const hso = out.hookSpecificOutput;
                 if (hso !== null && typeof hso === "object" && hso.hookEventName === "UserPromptSubmit") {
@@ -1016,7 +1135,8 @@ export function createTaskHooks(config, ctx) {
                         contexts.push(clip(h.additionalContext, MAX_HOOK_FEEDBACK_CHARS));
                 }
             }
-            return contexts.length > 0 ? { additionalContext: contexts.join("\n") } : undefined;
+            const additionalContext = buildHookContext(contexts);
+            return additionalContext === undefined ? undefined : { additionalContext };
         };
         hooks.userPromptSubmit = userPromptSubmitHook;
     }
@@ -1180,7 +1300,7 @@ export function createTaskHooks(config, ctx) {
                 return undefined;
             return {
                 ...(block !== undefined ? { block } : {}),
-                ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                ...buildHookContextField(contexts),
             };
         };
         hooks.stop = stopHook;
@@ -1288,7 +1408,7 @@ export function composeHooks(deployment, task) {
                 if (r.additionalContext)
                     contexts.push(r.additionalContext);
                 if (r.action === "deny")
-                    return { ...r, ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+                    return { ...r, ...buildHookContextField(contexts) };
                 if (r.action === "ask")
                     asked = r;
                 if (r.action === "allow" && r.updatedInput !== undefined) {
@@ -1301,14 +1421,14 @@ export function composeHooks(deployment, task) {
                 return {
                     ...asked,
                     ...(askedUpdated === undefined && current !== input ? { updatedInput: current } : {}),
-                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                    ...buildHookContextField(contexts),
                 };
             }
             if (current !== input || contexts.length > 0) {
                 return {
                     action: "allow",
                     ...(current !== input ? { updatedInput: current } : {}),
-                    ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                    ...buildHookContextField(contexts),
                 };
             }
             return undefined;
@@ -1324,7 +1444,7 @@ export function composeHooks(deployment, task) {
             const updatedOutput = rt?.updatedOutput ?? rd?.updatedOutput;
             return {
                 ...(updatedOutput ? { updatedOutput } : {}),
-                ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}),
+                ...buildHookContextField(contexts),
             };
         };
     }
@@ -1333,7 +1453,8 @@ export function composeHooks(deployment, task) {
             const rd = d.postToolUseFailure ? await d.postToolUseFailure(toolName, input, failure, ctx) : undefined;
             const rt = t.postToolUseFailure ? await t.postToolUseFailure(toolName, input, failure, ctx) : undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);
-            return contexts.length ? { additionalContext: contexts.join("\n") } : undefined;
+            const additionalContext = buildHookContext(contexts);
+            return additionalContext === undefined ? undefined : { additionalContext };
         };
     }
     if (d.postToolBatch || t.postToolBatch) {
@@ -1341,19 +1462,22 @@ export function composeHooks(deployment, task) {
             const rd = d.postToolBatch ? await d.postToolBatch(calls) : undefined;
             const rt = t.postToolBatch ? await t.postToolBatch(calls) : undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);
-            return contexts.length ? { additionalContext: contexts.join("\n") } : undefined;
+            const additionalContext = buildHookContext(contexts);
+            return additionalContext === undefined ? undefined : { additionalContext };
         };
     }
     if (d.userPromptSubmit || t.userPromptSubmit) {
         out.userPromptSubmit = async (prompt) => {
             const rd = d.userPromptSubmit ? await d.userPromptSubmit(prompt) : undefined;
+            // 短路的是**槽序**(部署拦下就不再跑 task 槽),不是预算:`additionalContext` 与 `block` 在 core
+            // 是解耦两字段(见下方 stop 注),原样外送就是一条绕过总帽的道。
             if (rd?.block)
-                return rd;
+                return { ...rd, ...buildHookContextField(rd.additionalContext ? [rd.additionalContext] : []) };
             const rt = t.userPromptSubmit ? await t.userPromptSubmit(prompt) : undefined;
             if (!rd && !rt)
                 return undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);
-            return { ...(rt?.block ? { block: rt.block } : {}), ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+            return { ...(rt?.block ? { block: rt.block } : {}), ...buildHookContextField(contexts) };
         };
     }
     if (d.stop || t.stop) {
@@ -1362,12 +1486,12 @@ export function composeHooks(deployment, task) {
         out.stop = async (sctx) => {
             const rd = d.stop ? await d.stop(sctx) : undefined;
             if (rd?.block)
-                return rd;
+                return { ...rd, ...buildHookContextField(rd.additionalContext ? [rd.additionalContext] : []) };
             const rt = t.stop ? await t.stop(sctx) : undefined;
             if (!rd && !rt)
                 return undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);
-            return { ...(rt?.block ? { block: rt.block } : {}), ...(contexts.length ? { additionalContext: contexts.join("\n") } : {}) };
+            return { ...(rt?.block ? { block: rt.block } : {}), ...buildHookContextField(contexts) };
         };
     }
     if (d.preCompact || t.preCompact) {

package/dist/http/routes/diagnostics.js

@@ -58,14 +58,19 @@ export function buildStaticWiringAudit(facts) {
     // park 车道的**持久性读数**(codex 交叉复审 2026-08-07 R2-F2,验真后部分采纳)。`capable` 说的是
     // 「有没有 checkpoint 店」、`effective` 说的是「这条部署形会不会真 park」—— 两者都为真时仍可能是一个
     // 重启即丢的店,那样窗到期后被 park 的审批在重启后无法赎回,而流内审批协议正是拿 park 当降级目的地。
-    // 🔴 为什么是 **warn 而不是拒启**:本仓的 SQL/local checkpoint 店**都还没有 `durability` 声明**,core
-    // 因此对每一个真持久部署都读出 `process_local`。据此拒启会拿一个不可信信号挡住 100% 的现存 durable
-    // 部署 —— 那不是查出矛盾。根治在店侧补声明;在那之前,把「这个读数不可信」响亮说出来,不静默。
+    // ✅ **读数已转可信**(#168 件5,2026-08-07):树上三条 checkpoint 店(SQL 双生 + local 文件形)现在都
+    // 如实声明了 `durability`,所以这条读数不再对真持久部署恒假 —— 它现在说的就是字面意思。
+    //
+    // 🔴 仍然是 **warn 而不是拒启**,判据与 session 那条**刻意不同**,理由写在这里免得下一个人以为是漏改:
+    // session 那条对表的是「声明 durable × 介质不 durable」——两个已知量互相矛盾,拒启是查出了谎。这一条
+    // 对表的是「有没有人声明」,而 core 把**缺席**折成 `process-local`;一个合法的第三方/新增 checkpoint
+    // 店没表态时,拒启会挡住一个本来跑得好好的部署,而**没有任何旋钮**能让它继续启动(补偿为零 ⇒ 不升格)。
+    // 升格的前置件 = core 把「未声明」与「声明为进程内」分成两个可区分读数,或本仓给出一个显式承认旋钮。
     if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
         warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +
             `(parkLane.checkpointDurability=${JSON.stringify(facts.manifest.parkLane.checkpointDurability ?? null)}). ` +
-            `A parked approval survives a restart only on a durable store — and the in-tree checkpoint adapters currently declare no durability at all, so this reading cannot yet distinguish "really process-local" from "nobody declared it". ` +
-            `Treat park-lane recovery as unproven until the adapter declares its durability.`);
+            `A parked approval survives a restart only on a durable store, and this reading folds "declared process-local" together with "declared nothing" — every in-tree adapter declares "durable", so a non-durable reading here means a store this build does not own. ` +
+            `Treat park-lane recovery as unproven until that adapter declares its durability.`);
     }
     if (facts.manifest.interaction.posture === "interactive" && facts.manifest.question.wired !== "wired") {
         warnings.push(`interactionPosture declares "interactive" but no question delivery face is wired (question.wired=${JSON.stringify(facts.manifest.question.wired)}) — ` +

package/dist/http/routes/memory-policy.d.ts

@@ -2,7 +2,8 @@
  * design/158 A9 域模块 —— memory 导出/同步 + 只读策略面。
  *
  * 路由:`GET /v1/memory/export`、`POST /v1/memory/sync/:scope`、`GET /v1/policy`。
- * owner 门 = 「本人 user scope 或显式 operator」,越界一律 404(零存在性 oracle)。本域零可变状态。
+ * owner 门 = 「本人 user scope / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
+ * 越界一律 404(零存在性 oracle)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx } from "../route-ctx.js";

package/dist/http/routes/memory-policy.js

@@ -2,6 +2,70 @@ import { formatUserScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+const ORG_PREFIX = "org:";
+/** 本面是否让目录参与判决。闭集穷举 switch:新增第三个模式是**编译**错误,不会静默落进某个默认臂
+ *  ——这条门在授权轴上,静默默认值正是它不许有的东西。 */
+function directoryDecidesThisFace(mode) {
+    switch (mode) {
+        case "enforce":
+            return true;
+        case "audit":
+            return false; // 见 gateMemoryScope 顶注的 codex R1 段
+    }
+}
+/**
+ * memory-policy 两面(export 读 / sync 写)共用的属主门 —— design/170 件A §7「第二消费者收编」。
+ *
+ * 收编前本门把 `org:*` 写死 operator-only(注逐字「membership waits for the S3 登记簿」),于是同一进程里
+ * 「谁属于 org:acme」有两个答案:core 准入门问授权目录、本面问 operatorPrincipals。收编后 `org:` 成员性
+ * 只由 `deps.orgMemoryDirectory` 回答(与准入 seam 同一个实例、同一份缓存)。
+ *
+ * 判决序(前两级刻意在目录之前 —— 它们不需要目录也成立,顺带让常路零额外 I/O):
+ *  ① 本人 user 盘逐字匹配 ⇒ 通过;② 显式 operator ⇒ 通过(ops/迁移面不依赖目录在场);
+ *  ③ `org:` 键 + 目录在场 + **enforce 模式** ⇒ 查目录:瞬时不可用照原样上抛;取数成功但无该键 ⇒
+ *     `not_found`;`need==="write"` 另要条目 `write === true`(读授予不隐含写授予,与准入面 writeScope
+ *     收窄同源);④ 其余(`userproj:` 等目录没有答案的键、无目录源的部署、audit 模式)⇒ `not_found`。
+ *
+ * **audit 模式为什么在本面等于「不接目录」**(codex 对抗审 R1,2026-08-07):`audit` 是 operator 表态
+ * 「这份目录还没被验证过,先别拿它做判决」。拿未验证的目录去开真数据面(读)甚至写面,是这条表态能
+ * 造成的最严重后果——方向恰好反了;`audit=零行为变化` 的公开契约在本面因此读作「逐字保持收编前的
+ * operator-only」,连额外那一跳目录 I/O 和 enforce 才有的 503 响应形都不引入。org 面的诊断信号属于
+ * 准入侧的 `memory_admission_total{outcome,mode}`,不在本面另开一路。
+ *
+ * 拒绝一律 `not_found` 而非 403:本面的零存在性 oracle 纪律不变(与 run/trace 属主门同口径),
+ * 「不是成员」和「没这个 scope」对调用方必须不可区分。
+ */
+async function gateMemoryScope(deps, principal, scope, need) {
+    if (scope === formatUserScope(principal))
+        return { kind: "allow" };
+    if (explicitOperatorOk(principal, deps.config.operatorPrincipals))
+        return { kind: "allow" };
+    const directory = deps.orgMemoryDirectory;
+    if (!scope.startsWith(ORG_PREFIX) || directory === undefined || !directoryDecidesThisFace(deps.config.memoryOrgAdmissionMode)) {
+        return { kind: "not_found" };
+    }
+    const lookup = await directory.lookup(principal);
+    if (lookup.kind === "unavailable")
+        return { kind: "unavailable", retryAfterMs: lookup.retryAfterMs };
+    const grant = lookup.scopes[scope];
+    if (grant === undefined)
+        return { kind: "not_found" };
+    return need === "write" && grant.write !== true ? { kind: "not_found" } : { kind: "allow" };
+}
+/** 门的拒绝臂下发:瞬时 ⇒ 503 `memory.admission_required` + `retryAfterSec`(秒上取整,永不 0 —— C6;
+ *  族形与 sync 提交腿的同码响应逐字一致);终局 ⇒ 404 零 oracle。返回 true = 已应答,调用方须 return。 */
+function sendScopeGateRefusal(res, gate) {
+    if (gate.kind === "allow")
+        return false;
+    if (gate.kind === "unavailable") {
+        const retryAfterSec = Math.max(1, Math.ceil(gate.retryAfterMs / 1000));
+        res.setHeader("retry-after", String(retryAfterSec)); // 体里有等待提示 ⇒ 标准头同值(与同步提交腿的同码应答逐字一致)
+        sendError(res, 503, "memory.admission_required", "org memory directory unavailable — authorization could not be established", { retryAfterSec });
+        return true;
+    }
+    sendError(res, 404, "not_found.memory_scope", "not found"); // owner gate: no existence oracle
+    return true;
+}
 export async function handleMemoryPolicy(req, res, url, ctx) {
     const miss = { fell: false };
     await handleMemoryPolicyBody(req, res, url, ctx, miss);
@@ -17,11 +81,13 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
     // C-additive 落点). After the global service-credential gate (a credential/SSO-JWT is already
     // verified); the OWNER gate here is the tenant boundary: the verified principal may export exactly its OWN
     // user disk (`scope === formatUserScope(principal)` — core's mint, byte-identical to memoryScopeFor's) or be
-    // an explicit operator (explicitOperatorOk, ops/migration face). Anything else = 404, NEVER 403 (zero
-    // existence oracle, run/trace owner-gate parity). org:*/userproj:* membership waits for the S3 登记簿
-    // (design §1.4) — until then those keys are operator-only by construction. proj:* keys of repo-backed
-    // projects never live in this DB (铁律: git is their authority) — an owner asking for one just gets
-    // an empty set, honestly.
+    // an explicit operator (explicitOperatorOk, ops/migration face), or — design/170 件A §7 收编 — a
+    // DIRECTORY MEMBER of an `org:` key (the same org-memory directory instance core's admission seam reads,
+    // so one process holds ONE answer to "who belongs to org:acme"). Anything else = 404, NEVER 403 (zero
+    // existence oracle, run/trace owner-gate parity); a directory that cannot answer = 503, never 404.
+    // `userproj:*` stays operator-only by construction (the directory has no answer for that key shape).
+    // proj:* keys of repo-backed projects never live in this DB (铁律: git is their authority) — an owner
+    // asking for one just gets an empty set, honestly.
     if (url === "/v1/memory/export" && req.method === "GET") {
         // Auth BEFORE availability (501-before-auth precedent): the backend posture must not oracle
         // to a caller who couldn't read anything anyway.
@@ -39,10 +105,8 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
             sendError(res, 400, "request.query_invalid", "missing ?scope=<key>");
             return;
         }
-        if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-            sendError(res, 404, "not_found.memory_scope", "not found"); // owner gate: no existence oracle
+        if (sendScopeGateRefusal(res, await gateMemoryScope(deps, principal, scope, "read")))
             return;
-        }
         try {
             const entries = await deps.memoryExport(scope);
             sendJson(res, 200, { scope, exportedAt: new Date().toISOString(), entries });
@@ -57,8 +121,8 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
     // plan 随数据走——reconcile/nextSyncBaseline 是 core 纯函数,由持数据的本 server 在 performMemorySync
     // (memory-sync.ts) 里直接调用;此处只持 HTTP 半场). Gate ORDER mirrors the export face verbatim:
     // auth (401) → backend posture (501, file 形态诚实拒绝——单用户 file 面自己就是 TOC 侧,没有中心
-    // 权威半场可服务) → owner gate (404 zero-oracle: verified principal 的 user 盘逐字匹配,或 explicit
-    // operator;org:/userproj: 键在 S3 登记簿前 = operator-only by construction) → 验型 (422 typed)。
+    // 权威半场可服务) → owner gate (404 zero-oracle: verified principal 的 user 盘逐字匹配 / explicit
+    // operator / `org:` 键的目录成员且条目 write:true;userproj: 仍 operator-only) → 验型 (422 typed)。
     if (req.method === "POST" && url.startsWith("/v1/memory/sync/")) {
         const principal = gatedPrincipal(req, deps.config); // direct-door safe: verified identity, never the spoofable header
         if (!principal) {
@@ -83,10 +147,10 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
             sendError(res, 400, "memory_sync_invalid_scope", "missing :scope");
             return;
         }
-        if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-            sendError(res, 404, "not_found.memory_scope", "not found"); // owner gate: no existence oracle (export-face parity)
+        // 写面:门与 export 面同一个 `gateMemoryScope`,只在 `need` 上分家 —— org 条目须 `write === true`
+        // 才放行(读授予不隐含写授予)。属主/operator 两级与读面逐字同判。
+        if (sendScopeGateRefusal(res, await gateMemoryScope(deps, principal, scope, "write")))
             return;
-        }
         const body = await readJson(req); // 413/400 (oversize / bad JSON) via the typed top-level catch — auth already done
         const parsed = parseMemorySyncRequest(body, scope);
         if (!parsed.ok) {

package/dist/http/routes/runs.js

@@ -157,7 +157,7 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         // 🔴 开关谓词是**必须**的(codex 复审第二轮 high,2026-08-06):原按「关的时候表里本就没行 ⇒
         // 无需分支」落地,但这个前提在**回滚**下不成立 —— 开着协议的副本(或更新版本)已经落下的
         // `STREAM_PENDING` 行在关掉开关后**仍在表里**,无谓词的重放腿会把它们照常投上 wire,
-        // 「默认关 = 逐字零变化」(§6.5/§7.2)当场破。谓词同时省掉了关闭态每次开流的一次 store 往返
+        // 「开关关 = 逐字零变化」(§6.5/§7.2)当场破。谓词同时省掉了关闭态每次开流的一次 store 往返
         // 与那份 store 故障暴露面。钉:场景9(零帧 **且** 零 store 读 —— 只钉零帧会放过「读了但没投」)。
         preamble: async (signal) => {
             if (!deps.config.streamApproval.enabled)