@sema-agent/server 7.43.0 → 7.44.0

package/dist/http/server.js

@@ -14,7 +14,7 @@ import { normalizeApproachNotice, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
-import { publicStoreProbeError } from "../store-live-probe.js"; // #305:免鉴权 /health 面的探针错误闭集词表
+import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -27,15 +27,12 @@ import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
-import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js"; // #253:resume-verify 臂的账本写口 = 与 bg/sync 两腿同一只投影件;#310:本腿账本写口的单写串行链
-import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js"; // #310:通告 wire 腿(resume 半场)
-import { recordFailOpen } from "../observability/fail-open.js"; // #310:通告 durable 写失败的留痕口
+import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
+import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
 import { streamSseLog } from "./sse-log.js";
-// design/97 R9: the shape's neutral leaf (route-ctx.ts type-imports VerifyRoundsSpec from here, not from this file).
-// `clampVerifyRounds` used to be re-exported from here for the tests; that re-export was deleted (8566348) and the
-// import sat on as a dead name — tests import it from `verify-rounds.js` directly, which is the single owner.
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { RUN_NOT_FOUND_MESSAGE } from "./route-ctx.js";
 import { handleCapabilities } from "./routes/capabilities.js";
@@ -44,7 +41,7 @@ import { handleDiagnostics } from "./routes/diagnostics.js";
 import { handleAdoption } from "./routes/adoption.js";
 import { handleRetention } from "./routes/retention-ops.js";
 import { handleAdminDrain } from "./routes/admin-drain.js";
-import { handleAdminConfigRefresh } from "./routes/admin-config-refresh.js"; // #322 批1 追加件:配置手动刷新口(operator lane)
+import { handleAdminConfigRefresh } from "./routes/admin-config-refresh.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
 import { handleMemoryBundle } from "./routes/memory-bundle.js";
 import { handleSharedMemory } from "./routes/shared-memory.js";
@@ -69,33 +66,20 @@ import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
-// design/158 A9:装配器缝——发送器/身份门下沉到 http/ 叶子模块,routes/* 与 server.ts 共用同一实现
-// (routes/* 绝不可值 import server.ts:那条边会闭合运行时环,见 test/module-cycle-gate.test.ts)。
 import { sendJson, sendError, httpErrorCode, msg } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 export { explicitOperatorOk, isOperator };
-/** 分组入参 → 平铺视图(createHttpServer 的第一件事)。一组都没给 ⇒ 原样返回(存量调用零开销、零形变)。 */
 export function flattenServiceDeps(deps) {
     const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
     if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
         return deps;
     return { ...stores, ...coordinators, ...seams, ...observability, ...governance, ...deployment, ...knobs, ...flat };
 }
-// design/158 A4: TaskRequestBody lives in ./wire-types.ts (a type-only leaf) — import it from there
-// ([2354] 兼容面全清:此处的兼容 re-export 已删;index.ts 公共面直接从 wire-types 转出)。
-/** Personalization caps: server-pinned hard limits — a UI may be stricter, never looser. */
 export const MAX_USER_SKILLS = 10;
-/** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在
- *  dist/core/runner/synthetic-tools.js:84,未从 core 包根导出,故钉本地孪生+本出处注记)。修7 曾对齐旧
- *  20k 截断门([845] 飞轮考据:20k 是压缩保留区口径,invoke 时刻用错),core 1.293 撤门后本门跟随回收
- *  ([853]① 收口)——HTTP 面与引擎加载门同值,超限 400 fail-loud 而非引擎侧整拒后难诊断。 */
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
-/** Cap on a request's `outputSchema` (JSON-serialized) — an uncapped schema bloats the prompt + the per-turn
- *  validation cost. 32KB comfortably holds a rich nested schema while bounding the abuse surface. */
 export const MAX_OUTPUT_SCHEMA_CHARS = 32_768;
-/** Validate `body.skills` (caps + shape). Returns an error string (→ 400) or null when acceptable. */
 export function validateUserSkills(skills) {
     if (skills === undefined)
         return null;
@@ -116,89 +100,26 @@ export function validateUserSkills(skills) {
     return null;
 }
 const MAX_BODY = 8 * 1024 * 1024;
-/** Caps on `body.images`: inline base64 `data` is otherwise passed RAW to the
- *  spec (URL images are SSRF+size-gated by core, inline aren't). The whole JSON body is already ≤ MAX_BODY, but with NO
- *  COUNT cap a request could carry thousands of tiny images (a decode/processing DoS), and there was no explicit
- *  per-image error. The two-axis gate belongs in the server (shell carries content, server gates it). */
 const MAX_IMAGES_PER_REQUEST = 20;
-const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024; // a single inline image's base64 ≤ 6 MiB (< MAX_BODY, so REACHABLE — one image can't hog the whole 8 MiB budget); ~4.5 MiB decoded, generous for a screenshot/photo
-// Task Trace API (S1): GET /v1/tasks (list) | /v1/tasks/:id/turns | /v1/tasks/:id/stream. The `:id` group +
-// sub-route are both-or-neither, so a GET /v1/tasks/stream (no :id) does NOT match — the POST sync stream is unshadowed.
-// Hand (executionEnv) tool names core mounts at the runner when an executionEnvFactory is configured. These are
-// NEVER in spec.tools, so the durable-resume satisfiability pre-check must union them when remote exec is on.
-// #244([3751]): the authoritative set is the FULL band `HANDS_BAND_TOOL_NAMES` (capabilities/hands-lane.ts —
-// effects table + the mounted complement Monitor/EnterWorktree/ExitWorktree/SendMessage/AgentTranscript, retired
-// names filtered at the single owner). The old effects-only derivation left the complement out, so approving a
-// parked complement-tool ask (the disconnect force-park population, e.g. Monitor on the cli host lane) was a
-// permanent 422 conflict.pending_action_unsatisfiable — the re-presented card's answer could never propagate.
+const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
 const HAND_TOOL_NAMES = HANDS_BAND_TOOL_NAMES;
-/** #233 / A-002.8 —— 未知模型 400 里 `available` 列表的**名单过滤**:不给用户广告他点不了的模型。
- *  名单缺席/空 ⇒ 与本件之前逐字同集(全目录去 `default` 别名);名单在场 ⇒ 只留名单准的那些。
- *  判定单源 `isModelAllowlisted`(与三个执法点同一只),所以"列出来的"与"点了不被拒的"恒为同一批。 */
 function mentionableNames(config, catalog) {
     const allowlist = config.atModelAllowlist ?? [];
     return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
 }
-/** [1245] codex-3/4 — the REOPEN-class resume failures: core's runtask reopened the checkpoint (store.reopen,
- *  dist-read) BEFORE returning this failed result, so the park is STILL PENDING and decidable. Everything
- *  downstream must treat these as a re-park, never terminal: the durable event log writes `suspended` (not
- *  `done`), the run row re-parks (keeps task_active), and /decide surfaces retriable:true. A reopen that
- *  itself failed surfaces as `checkpoint.reopen_failed` — deliberately NOT matched here (terminal). */
 function isCheckpointReopenedFailure(r) {
     return r.status === "failed" && (r.errorCode === "resume.env_failed" || r.errorCode === "resume.tool_unavailable");
 }
-/**
- * 一条 verify/cascade 腿的结果**是不是嵌套 durable park**,以及 park 落在哪个词上(扫描P2 + codex 复审
- * round1 [high] 一,2026-08-12 亲读 core 验真)。`undefined` = 不是 park(照常走终局)。
- *
- * 🔴 判据是 **errorCode**,不是 `verification.unverifiedReason` —— 后者**不覆盖修复轮**:
- *  · `verify.js:201/208`(runWithVerification / resumeWithVerification 的**立即** park)铸的 outcome 带
- *    `unverifiedReason: status === "needs_review" ? "needs_review" : "suspended"`;
- *  · 但 `verify.js:191`(verifier 判 FAIL 后的**修复轮** `runTask` 又停在门上)返回的是
- *    `{ ...mapNestedSuspend(current), verification: outcome }`,那个 `outcome` 是**上一轮验证器的
- *    FAIL 判决** —— `verdict:"FAIL"` 的臂根本不填 `unverifiedReason`(`verify.js:166` 只在
- *    no_verdict / PARTIAL 两种情况填)。于是「按 reason 判 park」对修复轮恒为假,而结果里
- *    checkpointToken 还活着 ⇒ 写 `done` + setTerminal ⇒ 释放 task_active 锁 + 孤儿化那张卡。
- *
- * `mapNestedSuspend`(core `agents/suspend-guard.js`)是**每一条**嵌套 park 的必经点,它无条件盖这两个
- * 码之一,并且码本身就带 park 的词 —— 所以它同时是「是不是 park」和「是哪个 park」的单一真源。
- * 两个字面量在 core 的 index 里没有导出,只能照字面锚(与 `runs.ts` / `resource-suspend.ts` 顶注同姿势)。
- *
- * ⚠️ 边界:`checkpoint.reopen_failed` 与 `resume.*` 两类 reopen 失败**不在**这里(它们不是 gate 再停,
- * 由 {@link isCheckpointReopenedFailure} + 店内复核那条腿处置);`verifier_paused` 也不在(那是验证器
- * 自己的会话与凭据,本 run 的活已经做完)。
- */
 function nestedParkStatusOf(r) {
     switch (r.errorCode) {
-        case "unexpected.needs_review": // core UNEXPECTED_NEEDS_REVIEW —— 内层 status 是 needs_review 的 park
+        case "unexpected.needs_review":
             return "needs_review";
-        case "unexpected.suspended": // core UNEXPECTED_SUSPENDED —— 内层 status 是 suspended 的 park
+        case "unexpected.suspended":
             return "suspended";
         default:
             return undefined;
     }
 }
-/** The TRUSTED end-user principal for an owner-gated / per-tenant request. On a direct-door worker the
- *  trusted-header path is OFF (x-agent-principal is client-spoofable), so identity comes from the crypto-VERIFIED
- *  principal JWT (`x-approval-principal-token`, principal-only proof — no cnf.bnd action binding); otherwise the
- *  BFF-minted trusted header. undefined when absent/invalid (fail-closed → callers map to 401 / scope "__none__").
- *  🔴 Use this for ANY endpoint that reads or gates PER-TENANT data — NOT `principalFrom` directly, which trusts
- *  the spoofable header on a direct door (/v1/usage + the trace owner-gate
- *  had drifted to a bare principalFrom, unlike the leader/images/approvals identity paths). One source of truth
- *  so a future per-tenant endpoint can't re-introduce the bypass. The action-BOUND decide/answer paths keep their
- *  own verifyDirectDoorProof (cnf.bnd) — this is the identity-only twin. */
-// F-fix: a thin delegate to the single source of the verified identity (security.ts `verifiedPrincipal`). Kept as a
-// named alias so the existing call sites read clearly; the JWT logic now lives in one place that createAuthorizer
-// shares, so spec.principal (governance + cost) and these observability/owner sites can never drift apart again.
-/** design/158 A9 装配表(顺序 = 拆分前 `handle()` 里各域出现的先后,逐行同序;真正的 `return` 在 handle 内,
- *  这里只做**签名一致性**的编译期钉:任何域入口漂了形,是编译红,不是运行时静默 404)。
- *
- *  🔴 A-010.24(验真后修):上面那句「逐行同序」此前是**一句自述,没有任何东西执法**,而它已经不成立 ——
- *  `handleDiagnostics` 从来没进过这张表,车二着陆后 `handleRules` / `handleSharedMemory` 的先后也反了。
- *  类型钉不住这两类漂:少一个成员、调换两个成员,`RouteHandler[]` 全都收下。而这张表是评审时唯一会被
- *  当成「域全集 + 域次序」来读的清单(新域该插哪儿、某域在谁之后才可达),它给错答案是要害。
- *  执法面现在真的有了:`test/route-shape-roster.test.ts` 的**层D**从 `handle()` 的真源码抽出域调用序,
- *  与本表**逐项**对拍 —— 漏员或乱序都指名道姓地红。改 handle() 的次序时,这张表要跟着改。 */
 const ROUTE_DOMAINS = [
     handleTraceUsage,
     handleWorkflows,
@@ -232,81 +153,17 @@ const ROUTE_DOMAINS = [
     handleNotifyWake,
 ];
 void ROUTE_DOMAINS;
-/**
- * Managed-Agents-style HTTP/SSE service surface.
- *   GET  /health
- *   POST /v1/tasks            → run to completion, TaskResult JSON (synchronous)
- *   POST /v1/tasks/stream     → SSE of TaskEvent, live tokens (synchronous, same instance)
- *   POST /v1/runs             → async: 202 {taskId, sessionId, status}, runs in background (S1)
- *   GET  /v1/runs/:id         → run status + result (poll)
- *   GET  /v1/runs/:id/events  → SSE replay from Last-Event-ID, then tail to terminal (S2)
- *   POST /v1/sessions/:id/notify → inject an out-of-session event (design/144 §2): live stream ⇒ core
- *                                  `TaskStream.notify()`; idle ⇒ parked in the session inbox, drained
- *                                  as a `task_notification` on the next stream open
- *   POST /v1/sessions/:id/wake   → wake a `task_done` pure park with a message and resume it
- *                                  (design/144 §3). NOT a gate decision — a pending gate is refused
- *                                  (`wake.gate_pending`). Goes through `resumeWake`, which reuses the
- *                                  resume family's lease/CAS/run-log leg, so it BURNS MODEL TOKENS and
- *                                  is subject to the billable-submit gates (`SESSION_WAKE_RE`).
- *   (both live in `http/routes/notify-wake.ts` — design/158 A9 domain split)
- */
 export function createHttpServer(rawDeps) {
-    // design/158 A8:分组装配 → 平铺视图。**分组是装配面的形,不是消费面的形**——下面 ~700 处 `deps.x`
-    // 消费点原样保留(平铺入参零形变、零开销:没给任何组时 flatten 原样返回同一个对象)。
     const deps = flattenServiceDeps(rawDeps);
-    // Idempotency-Key dedup for task submission (center review-routing blocker: exactly-once billing). One
-    // cache per server instance, shared by the sync /v1/tasks and async /v1/runs create paths.
     const idemCache = new IdempotencyCache();
-    // In-flight durable runs on THIS instance → their cancel controller. POST /v1/runs/:id/cancel landing here
-    // aborts immediately (fast path); a cancel landing on another replica uses the durable flag + heartbeat poll.
     const inflightRuns = new Map();
-    // [1.207 codex H2] taskIds whose abort came from the CANCEL VERB (fast path or flag poll) — the interactive
-    // legs consult this at settle time to label an abort-shaped failed result `errorCode:"cancelled"` (core's
-    // external-signal abort yields failed WITHOUT an errorCode; first-writer-wins would then pin the unlabeled
-    // form). A genuine completion that raced the abort is NOT relabeled (only status==="failed" gets the code).
-    // Entries are dropped in each leg's finally (same lifecycle as its inflightRuns registration).
     const cancelledViaVerb = new Set();
-    // design/80 seam #2 (preemption): in-flight PREEMPTIBLE runs on THIS instance → their preempt controller (the
-    // graceful-yield twin of inflightRuns' kill). POST /v1/assistant/tasks/:id/preempt landing here aborts it
-    // immediately (fast path → core durably suspends at the next clean turn boundary); a preempt landing on another
-    // replica uses the durable `preempt_requested` flag + heartbeat poll. Only plain-stream + resumed legs register.
     const preemptableRuns = new Map();
-    // design/47 + design/80 D-A (steering): in-flight STEERABLE runs on THIS instance → their live core TaskStream
-    // handle. POST /v1/runs/:id/steer landing here injects a mid-task message via the stream's `steer()` (applied at
-    // the next turn-boundary drain → 200). A run that is NOT here is either durably suspended (→ park the steer on its
-    // checkpoint via setPendingSteer → 202) or streaming on another replica (cross-replica live-steer is a fast-follow,
-    // single-replica today → 409). Only the plain-stream + resumed legs hold a live stream, so only they register
-    // (the verify/cascade legs return a result, not a stream — nothing to steer, parity with preemptableRuns).
     const steerableRuns = new Map();
-    // design/144 wake 半场:终态 steer 铸 park 的 per-session 串行链(复审 HIGH:tryPark→put 非原子,
-    // 并发双 steer 双铸两个 pending park)。单副本部署(本仓 steer 跨副本 seam 同款现实)进程锁即闭环;
-    // 跨副本残窗由 put 后赢家复核收敛兜底(见 (d) 分支),与 cross-replica live-steer 同列 fast-follow。
     const wakeParkMints = new Map();
-    // design/158 A9:两条「裸 number 登记簿」装盒——`let` 拆不出闭包,域模块要自增/自减必须共享同一个对象。
-    // 语义与计数时机逐字不变(uncountedBillableInflight = B-1: sync /v1/tasks + leader bg runs,无 map 身份,
-    // drain 靠它看见;admittedInflight = 修1 的 admission 期计数,见下方注释)。
     const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
-    // 修1(三路复审 B3 HIGH,迟登记窗):ADMISSION-time in-flight counter. Every non-probe request is counted
-    // SYNCHRONOUSLY in handle()'s first statements (before ANY await — auth/prepareSpec/lease/claim all happen
-    // later) and released once, on whichever of finish/close fires first. Closes the window where a request that
-    // just entered the handler was invisible to inflight() and a SIGHUP idle check (or SIGTERM drain read)
-    // misjudged the replica idle → hardShutdown mid-admission. Deliberately OVERLAPS the leg registries below
-    // (a registered leg counts twice) — every consumer only tests inflight()===0, so overcount is conservative,
-    // never a false-idle.
-    // drain: expose this replica's in-flight leg count as a LIVE getter on the shared drain state. Union of
-    // taskIds (a resumed leg registers in BOTH maps) — bg/resume durable legs (inflightRuns) + live streams
-    // (steerableRuns, sync leg included since 1.78). main.ts polls this after SIGTERM to know when drain is done.
-    // 对抗复查 B-1(CRITICAL):the SYNC /v1/tasks await and the leader background run register in NEITHER map —
-    // a SIGTERM during either read inflight=0 and hard-shut mid-model-work. Count them explicitly (a plain
-    // counter: they have no steer/resume identity to key a map on).
     if (deps.drainState)
         deps.drainState.inflight = () => new Set([...inflightRuns.keys(), ...steerableRuns.keys()]).size + counters.uncountedBillableInflight + counters.admittedInflight + (deps.leaderEndpoint?.inflight?.() ?? 0);
-    // B3 复审(codex HIGH):admission 计数之外再补一条粗粒度活性时钟:任何非探针请求(/health、/metrics*
-    // 除外——探针/抓取是常态噪音)都推进时间戳;SIGHUP 空闲窗要求「inflight 归零 + 活性静默」双满足才关停。
-    // 顺带把 idle-but-live 的 peer(还在 list/浏览的壳)也保住。
-    // ⚠️ 时基契约(三路复审修3):performance.now() 单调域,与 sighup-idle.ts 的 `now` seam 同域——挂钟
-    // (Date.now)跳变(NTP 回拨/夏令时)会把空闲窗判定拉爆。对外报告的 epoch 时间戳(请求日志/drainState.since)
-    // 不受影响,仍走 Date.now。
     let lastBillableActivityAt = performance.now();
     const noteActivity = (url) => {
         if (url === "/health" || url.startsWith("/metrics"))
@@ -315,22 +172,13 @@ export function createHttpServer(rawDeps) {
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
-    // asyncRewake wake 管道(hooks 阶段二挂账兑现):hook-runner 的 ctx.wake 经 main.ts 的 hookWakeBus holder
-    // 到这里——session → 本副本活流(steerableRuns 是 taskId 键,反查经 run 行;活流数=本副本并发数,量小;
-    // wake 是稀有事件[async hook exit 2],逐行 get 可接受)。找到即 steer(操作者 hook 的 stderr,trusted
-    // 与 explicitOperator 同源语义;下个 turn 边界注入)。无活流 → 挂起腿 park fallback(与 HTTP steer 的
-    // tryPark 同一原语:pending checkpoint 是权威,CAS on status='pending';落上=resume 时 core 注入)。
-    // park 也不上 → false(别副本 live/已结束——调用方记账)。
     if (deps.hookWakeBus) {
         deps.hookWakeBus.deliver = async (sessionId, text) => {
-            // hook stderr 不是操作者亲笔——是 hook 脚本运行时输出(可能回显下载物/工具输出),
-            // 【内容】不升 trusted(与 HTTP steer 的非-explicitOperator 姿势一致),且先过同一 validatePendingSteer
-            // 校验(break-out/控制字符即拒,不静默换流)。围栏 provenance 在 main.ts 闭包侧(注入前缀标明来源)。
             try {
                 validatePendingSteer({ text, trusted: false });
             }
             catch {
-                return false; // steering.invalid_content:内容不合法,不投递(调用方按 dropped 记账)
+                return false;
             }
             for (const [tid, stream] of steerableRuns) {
                 try {
@@ -341,12 +189,9 @@ export function createHttpServer(rawDeps) {
                     return true;
                 }
                 catch {
-                    continue; // not_running race / 行读失败 → 试下一个;全空 → 挂起腿 park
+                    continue;
                 }
             }
-            // 挂起腿:任务 durably suspended 时 async hook 才收场(如慢 lint 收尾)——
-            // wake park 到 session 的 pending checkpoint(镜像 POST /v1/runs/:id/steer 的 tryPark:scope/token
-            // 缺失或 CAS 失手=没有真挂起的 checkpoint → false)。resume 时 core 把它作为 pending steer 注入。
             try {
                 const cs = deps.checkpointStore;
                 if (!cs)
@@ -360,17 +205,12 @@ export function createHttpServer(rawDeps) {
                 return await cs.setPendingSteer(token, scope, { text, trusted: false });
             }
             catch {
-                // park 面任何失败=诚实 false(调用方按 dropped 记账),绝不 throw 回 hook 收尾路径。
-                // core 5.14.0(#147)新增的 `steering.queue_full` 也落这里:队列满 ⇒ 这条 hook 输出确实没投出去,
-                // `false` 就是它的真实结局。**不给它 wire 码**——本通道是进程内 hook 收尾,没有 HTTP 应答面。
                 return false;
             }
         };
     }
     const server = http.createServer((req, res) => {
         void handle(req, res).catch((err) => {
-            // A typed HttpError (e.g. a malformed JSON body → 400) carries its own status — a client mistake is a
-            // 4xx, not a 500. Everything else is a genuine internal error: log the cause, never echo it (info disclosure).
             if (err instanceof HttpError) {
                 if (!res.headersSent)
                     sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
@@ -385,38 +225,22 @@ export function createHttpServer(rawDeps) {
                 res.end();
         });
     });
-    // design/158 A9 装配缝:服务级 ctx 建**一次**(deps 平铺视图 / 跨域运行期登记簿 / 无状态助手 / 单域状态)。
-    // 每请求只再加一格 `req`(见 handle 内)。助手全是 `function` 声明,提升后此处引用安全。
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal() },
-        // A9 尾批:提交/续跑「腿」只装引用(实现仍在本闭包里,逐字未动)——tasks/runs 共用 prepareSpec,
-        // approvals/assistant/notify-wake 共用 resume 家族;走这一格才不会造出 routes/* 互相值 import 的环。
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, resumePlanReview },
     };
     async function handle(req, res) {
         const startedAt = Date.now();
         const method = req.method ?? "GET";
         const url = (req.url ?? "/").split("?")[0];
-        noteActivity(url); // B3: admission-time activity stamp (before any await — no gap for the idle watch to miss)
-        // 修1(三路复审 B3 HIGH):admission-time inflight registration — SYNCHRONOUS, before the first await, so a
-        // request still in its pre-registration phase (auth/prepareSpec/lease/claim) is already visible to
-        // drainState.inflight(). Released exactly once in `record` below (finish/close latch — the same lifecycle
-        // that covers aborted SSE streams). Probes (/health, /metrics*) and CORS preflight stay uncounted (constant
-        // sampling noise must not hold the SIGHUP idle window open).
+        noteActivity(url);
         const admitted = method !== "OPTIONS" && url !== "/health" && !url.startsWith("/metrics");
         if (admitted)
             counters.admittedInflight++;
-        // Record on whichever of finish/close fires FIRST (a `logged` latch prevents double-count): a client that
-        // aborts (esp. an SSE stream) fires `close` WITHOUT `finish`, so a finish-only handler never counts it —
-        // exactly the abnormal traffic most worth observing. An abort mid-response is logged as 499 (client closed).
         let logged = false;
-        // [854]⑥ 纯观测:tasks/stream 断连(499)日志此前无 task 上下文,排查「谁的流断了」只能对时间戳。
-        // 流路由把 X-Task-Id(earlyDurableTid)stash 到这两个 handle 作用域变量;record 只在 499 行带上——
-        // 不动计费/inflight(admittedInflight 的 latch 语义原样)。detached 标记见 [854]①b(断连宽限 opt-in)。
-        // design/158 A9:每请求局部量收进 reqState(域模块经 ctx.req 读写同一个盒子),ctx = 服务级四格 + 本格。
         const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
         const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
         const record = (viaClose) => {
@@ -424,7 +248,7 @@ export function createHttpServer(rawDeps) {
                 return;
             logged = true;
             if (admitted)
-                counters.admittedInflight--; // 修1: paired release (latched — one decrement per admitted request)
+                counters.admittedInflight--;
             const route = routeLabel(method, url);
             const seconds = (Date.now() - startedAt) / 1000;
             const aborted = viaClose && !res.writableEnded;
@@ -443,69 +267,32 @@ export function createHttpServer(rawDeps) {
             return;
         }
         if (req.method === "GET" && url === "/health") {
-            // Sema-registry restart signal: additive, present ONLY when a restart-to-apply slice changed
-            // since boot — so a normal worker's /health shape is unchanged. `restartRequired` is the boolean the
-            // orchestrator polls; `restart` carries which slices + the version + when it first became required.
             const restart = deps.restartState?.();
-            // TOC integration (#1 /health contract — INTEGRATION-DESIGN): identity fields so the shell's Lifecycle
-            // Manager can verify it connected to the RIGHT engine (instance + data dir + config fingerprint + pid/port), not
-            // a stale/wrong one. configHash = a STABLE fingerprint of the restart-relevant config shape (NO secrets — only
-            // model id / backends / data root / provider / port), so the shell detects a config drift without reading values.
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
                 .slice(0, 16);
             sendJson(res, 200, {
                 status: "ok",
-                // build self-description — "did the restart actually pick up new code" judgement for the
-                // shell/orchestrator (same source as GET /v1/capabilities.version; absent only if capabilities wiring is).
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                // additive draining flag — k8s readiness / shell Lifecycle Manager摘流 signal. Absent when not draining.
-                // #291:drainReason = POST /v1/admin/drain 声明的停机因由(additive,未声明=键缺席)。
                 ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
-                // #320②([4728] 五点令):in-flight 腿数**恒报**(不只 draining 时)——排空观测「还剩几条腿」
-                // 与日常容量观察同一个键;additive,getter 未接线(drainState 缺席部署)= 键缺席形状不变。
-                // 值取 createServer 自赋的同一只 getter(durable bg/resume inflightRuns ∪ live 流 steerableRuns
-                // ∪ admission 高水位,见 drainState.inflight 契约注)——不另立第二判据。
                 ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
-                // S5: additive degradation flag — present ONLY when the boot auto-probe fell back to in-memory, so a
-                // healthy worker's /health shape is unchanged. durable:false = "this replica is NOT persisting although
-                // a DB was configured" (the orchestrator's restart/alarm signal; an in-memory-by-choice worker omits it).
                 ...(deps.storeDegraded ? { durable: false, storeDegraded: true } : {}),
-                // boot ready 门(b):additive — absent = ready(正常形状不变);false = roster 未落地,
-                // 计费提交在 503(orchestrator/壳读此旗决定摘流/重试;编排器侧「pull 成功才 ready」增强不互斥)。
                 ...(deps.modelReady && !deps.modelReady() ? { ready: false, readyReason: "model roster pending (first effective-config pull)" } : {}),
                 model: deps.config.model.id,
-                sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend, // effective store, not the coerced enum
+                sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
                 sessions: deps.runner.sessions.size,
                 ...(deps.instanceId ? { instanceId: deps.instanceId } : {}),
-                // 🔴 `dataRoot`/`pid` 是**公开承诺字段**(2026-07-28 起,USAGE「嵌入形契约」段):桌面宿主的
-                // 引擎身份验证(「这个 /health 是不是我起的那个进程」)整个押在这两个键上——pid 必须等于所
-                // spawn 子进程、dataRoot 必须等于所配数据根,缺任一=判外来。localDataRoot 的解析恒回退
-                // `~/.ai-agent`(config.ts,与 DB_BACKEND 无关)⇒ 此条件 spread 实为恒真;改动这两个键的
-                // 在场性/语义前先看 test/health-identity-contract.test.ts。
                 ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
                 configHash,
                 pid: process.pid,
                 port: deps.config.port,
-                // D-G: a POSITIVE go-live signal that this worker is a crypto-bound direct-door worker (trusted-header
-                // path disabled) — additive, only present when active, so a normal worker's /health shape is unchanged.
-                // Surfaced for the DG-M2 go-live runbook (was previously inferrable only behaviorally via a 401).
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
                 ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
-                // codex R18 (models-tiers deferral): additive DEGRADED state — the model plane is deferred but no
-                // next-boot handoff exists (LKG not restart-surviving), so no restart is forced and the plane stays
-                // unapplied. Present ⇒ the operator must either mount restart-surviving LKG storage (+ set
-                // CONFIG_LKG_DURABLE) or restart manually after ensuring the candidate will be re-pulled at boot.
                 ...(() => {
                     const stuck = deps.planeDeferredState?.();
                     return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
                 })(),
-                // #322 世代账三键(additive;未接线 ⇒ 键全缺席,/health 形状逐字不变)。
-                // 语义:target = 本副本**最后**见到的源版本(身份标);applied = 最后一次真的 commit 的版本;
-                // staleMs = 两者**持续**不等的时长(收敛即缺席)。#325 起 additive 补两 ordinal 键(收货序数,
-                // 进程内单调)——local 腿 version 是内容哈希无序承诺,「见过多少代/停在哪一代」的推进判断
-                // 用 ordinal 键;跨副本「同不同代」的对账仍用 version 身份标。
                 ...(() => {
                     const gen = deps.configApplyState?.();
                     if (!gen)
@@ -518,25 +305,18 @@ export function createHttpServer(rawDeps) {
                         ...(gen.configApplyStaleMs !== undefined ? { configApplyStaleMs: gen.configApplyStaleMs } : {}),
                     };
                 })(),
-                // B1 活体 store 探测(座注见 storeLiveState 声明;钉 test/health-store-live.test.ts)
                 ...(() => {
                     const probe = deps.storeLiveState?.();
                     if (!probe)
                         return {};
                     return {
                         ...(probe.live ? {} : { storeLive: false }),
-                        // #305:error 过闭集词表 —— 这一整个响应体在鉴权门**之前**发出,而座席给的是驱动原始
-                        // message(DSN/主机/账号常在其中)。消毒钉在**这个 wire 装配点**而不是探针环里:座席是
-                        // 可注入接缝,只有边界上的这一道对**任何**生产者成立(fail-closed 方向)。原文留日志轴。
                         storeProbe: { live: probe.live, ageMs: probe.ageMs, ...(probe.error !== undefined ? { error: publicStoreProbeError(probe.error) } : {}) },
                     };
                 })(),
             });
             return;
         }
-        // Metrics (read-only): authorized by EITHER the full authToken OR a read-only metricsToken — so a
-        // control plane (config-center) can pull metrics fleet-wide with one token, never holding each
-        // worker's full authToken. Handled BEFORE the global gate so metricsToken-only callers aren't 401'd.
         if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
             if (!deps.metrics) {
                 sendError(res, 404, "feature.metrics_disabled", "metrics disabled");
@@ -544,10 +324,6 @@ export function createHttpServer(rawDeps) {
             }
             const { authToken: t, metricsToken: mt } = deps.config;
             const anyT = Boolean(t) || Object.keys(deps.config.authTokens ?? {}).length > 0;
-            // 🔴 第一臂的 `!requirePrincipal` 是 2026-07-31 缝合审补的:同族单源 `isFleetWide` 早就带着它
-            // (连同那段「多租户下 token 的缺席不得开放全网」的审计注释),这一处停在了旧形。要紧在于
-            // `/metrics/plan-cache` 的 dump **按 principal 分键** ⇒ 它是租户名册而不是聚合数;而「多租 + 无
-            // service token + 无 metrics token」并不是 boot 会拒的形(main.ts 只 warn)。dev-open 只在单用户形成立。
             const devOpen = !anyT && !mt && !deps.config.requirePrincipal;
             const ok = devOpen || (anyT && systemFor(req, deps.config) !== undefined) || (!!mt && authorized(req, mt));
             if (!ok) {
@@ -558,7 +334,6 @@ export function createHttpServer(rawDeps) {
                 sendJson(res, 200, { model: deps.config.model.id, ...deps.metrics.summarize() });
                 return;
             }
-            // Per-scope objective-recurrence detail (core design/42 handoff). Same token gate as /metrics.
             if (url === "/metrics/plan-cache") {
                 sendJson(res, 200, { scopes: deps.planCacheProbe?.dump() ?? {} });
                 return;
@@ -567,14 +342,7 @@ export function createHttpServer(rawDeps) {
             res.end(deps.metrics.render());
             return;
         }
-        // 鉴权桥预认证:在任何 principal-gated 路由(trace/fleet/workflows/authorizer)读取身份之【前】,
-        // 若 Authorization bearer 形似 registry-JWT 且 verifier 在位,验它——通过则把 sub 挂进 request-local
-        // (setSsoPrincipal),verifiedPrincipal 单一真源随后优先读它(directDoor 与 BFF 两部署同效),并同时写入
-        // principalHeader(小写键)供 principalFrom 直读处使用。验证不通过=不设身份,后续 systemFor 因 bearer 不匹配
-        // 任何静态 token 而 401(恒 generic,R9:错误码只进日志)。非 JWT-形 bearer(静态 token)= looksLikeJwt
-        // 跳过,零开销,既有调用方字节不变。
         if (deps.registryJwtVerifier) {
-            // 只认 Bearer scheme(异源复审 INFO:`Basic a.b.c` 之前会白跑一次 verify + 一条 rejected 记账噪声)。
             const authz = req.headers.authorization ?? "";
             const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
             if (rawBearer && looksLikeJwt(rawBearer)) {
@@ -582,41 +350,25 @@ export function createHttpServer(rawDeps) {
                 if (v.ok) {
                     setSsoPrincipal(req, v.identity.principal);
                     req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
-                    // scope claim 也挂 request-local(多租户活动租户;registry-core 0.3.0+ VerifiedIdentity.scope)。
-                    // 用途=审计归因 + 未来 scope 级 quota/过滤的读取地基。同时记一条 info 审计锚(每认证请求一条):
-                    // 此前 principal 入了 owner 但 scope 全程不落任何日志/审计(grep 实证零命中 scope)——补齐。
                     if (v.identity.scope)
                         setSsoScope(req, v.identity.scope);
                     deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
                 }
             }
         }
-        // design/158 A9 域模块:Task Trace 只读面 + 用量统计面(routes/trace-usage.ts)。
-        // ⚠️ 位置即契约:必须留在下面的全局 service-credential 门**之前**(traceToken-only 调用方否则先被 401)。
         if (await handleTraceUsage(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:S8 自编排 workflow 只读三路(routes/workflows.ts)。
-        // 位置同 trace/fleet:全局 service-credential 门之前,块内 scope 门=这些读的唯一租户边界。
         if (await handleWorkflows(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:MF-Fleet 实时舰队流(routes/fleet.ts)。服务凭据门之前,按 principal 自门。
         if (await handleFleet(req, res, url, ctx))
             return;
-        // DESIGN-269 车2 件1 域模块:A2A agent card(routes/a2a-serve.ts)。
-        // ⚠️ 位置即契约:必须留在下面的全局 service-credential 门**之前** —— 卡是 R-11 裁定的「公网匿名
-        // 可发现」面(挂在门后=要凭据才能发现,A2A 协商第一步就断)。它**零存量披露**(纯 config 投影,
-        // 不读任何 task/run/session),所以匿名可读不构成披露;同域的 JSON-RPC 调用面在门**内**(下方)。
         if (await handleA2aServe(req, res, url, ctx))
             return;
-        // Service-credential gate + SOURCE derivation: which system's token authenticated this request.
-        // `source` is set ONLY here, from the credential — a caller cannot claim another system's identity.
         let source = null;
-        const anyServiceAuth = hasServiceAuth(deps.config); // 单一属主(#329 的 parked 赎回席读同一句)
+        const anyServiceAuth = hasServiceAuth(deps.config);
         if (anyServiceAuth) {
             const sys = systemFor(req, deps.config);
             if (sys === undefined) {
-                // 鉴权桥:静态 service-token 都不匹配 → 若入口预认证已把一个验过的 registry-JWT principal
-                // 挂进 request-local(ssoVerifiedPrincipal),即用户直连(source="sso");否则无凭据 401。
                 if (ssoVerifiedPrincipal(req)) {
                     source = "sso";
                 }
@@ -629,22 +381,7 @@ export function createHttpServer(rawDeps) {
                 source = sys;
             }
         }
-        // design/158 A9:`source` 的**唯一**赋值段就在上面;域模块经 ctx.req.source 读到同一个值(单向镜像,
-        // 此行之后 handle() 不再改它)。
         reqState.source = source;
-        // Mandatory service token on submission endpoints (center: a worker MUST validate a service-to-service
-        // token on task creation — not "if auth is configured" — else anything in-cluster can submit & bill
-        // directly, bypassing config-center's auth/audit). Fail-closed: the POST task/run/leader endpoints refuse
-        // when no authToken is set, unless explicitly opted out for local dev (ALLOW_UNAUTHED_WRITES=true).
-        // The bake door (POST /v1/images/bakes*) is build-host-RCE-capable and authed by the Bearer-token-no-cookie
-        // model (§P2.4b) — it MUST also refuse when no service token is configured (else a forged principal header
-        // alone could reach an operator-gated RCE door).
-        // A-010.23 (#209 件5) adds the same sibling arm for the REWRITE doors (`isCredentialGatedRewrite`:
-        // adoption + rules/cc-import + rules revoke) — same sentence, same threat, different verbs: one rekeys every
-        // row a principal owns, one mints that principal's DURABLE allow rules, one deletes them. They stay OUT of
-        // `isBillableSubmitPath` on purpose (billable=false; see that predicate's twin comment), and that family is
-        // METHOD-AWARE (its revoke verb is DELETE) so it is evaluated OUTSIDE the POST conjunct — same shape as
-        // `isDestructiveSessionWrite` below.
         if (!anyServiceAuth &&
             !deps.config.allowUnauthedWrites &&
             ((req.method === "POST" && (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) ||
@@ -652,190 +389,99 @@ export function createHttpServer(rawDeps) {
             sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
             return;
         }
-        // DRAINING — this instance is shutting down gracefully (SIGTERM received, in-flight turns being
-        // waited on). Refuse NEW model-running work (the same billable submit set: task/stream/runs/leader + the
-        // resume-flavored assistant verbs + approvals responds — each starts a model turn) with 503 + Retry-After so
-        // the shell/orchestrator retries against the replacement. Everything else stays open: reads (events/health/
-        // trace), cancel, steer/respond on in-flight runs — those help the drained turns finish, they don't start new ones.
         if (deps.drainState?.draining && req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
             res.setHeader("retry-after", "15");
-            // errorCode 补齐(2026-07-28 核查:cli 的 pre-stream drain 重试只能靠 `error` 文案字面判型——
-            // SDK 的 code 臂恒 undefined 是死码;server 改文案=对端重试静默失效)。`error:"draining"` 字面
-            // 自此视为**冻结的 wire 契约**(旧消费端判的就是它),errorCode 是机器码正门。
-            // #291:`reason` = 声明的停机因由(additive 键;`message` 字面冻结不动——SDK/壳按 error:"draining" 判)。
             sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance", ...(deps.drainState.reason ? { reason: deps.drainState.reason } : {}) });
             return;
         }
-        // boot ready 门(b)(E3 workers.model 废除的 fail-closed 半场):registry 部署且无显式 env 模型时,
-        // 首次 effective pull 落 roster 之前 worker 只有占位模型——计费提交打占位=垃圾任务,503 让编排器/壳重试
-        // 到 roster 落地(通常 <秒)。镜像 draining 姿势(同 billable 集合;读面/cancel/steer 全开);/health 带
-        // ready:false 加性旗。env 模型在(操作员显式声明)或非 registry 部署=恒 ready,现有部署零影响。
         if (deps.modelReady && !deps.modelReady() && req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
             res.setHeader("retry-after", "5");
             sendError(res, 503, "state.model_roster_pending", "model_roster_pending", { message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
             return;
         }
-        // E6 fail-closed:对**既有会话**的破坏性写,在「无 service token + 未开 ALLOW_UNAUTHED_WRITES」
-        // 这一形下一律拒。此形下 `sessionOwnerScopeForWrite` 判 fleet-wide ⇒ 集群内任意调用方可对任意
-        // session 动手;policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」。
-        //
-        // 🔴 2026-08-01 复审:这里原本是**逐条路由白名单**(PUT …/policy 与 POST …/sync/import 两块),
-        //    而 `DELETE /v1/sessions/:id`(删整条会话)**不在其中** —— 同一威胁形、爆炸半径更大却没门。
-        //    改成族判定(`isDestructiveSessionWrite`),新增破坏性会话路由自动落进门内。
-        //    import 腿仍拦在 **Phase A**(建 staging 之前),因为族判据匹配的就是那个 URL,不是 Phase B。
         if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
             sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
             return;
         }
-        // design/158 A9:能力/场景/模型目录域(routes/capabilities.ts)。位置=全局 service-credential 门之后、
-        // 任务提交面之前,与拆分前逐行同序。
         if (await handleCapabilities(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:sideQuery 一次性问答面(routes/side-query.ts)。
         if (await handleSideQuery(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:同步提交面 POST /v1/tasks · /v1/tasks/stream(routes/tasks.ts;B3 三腿具名化在内)。
         if (await handleTasks(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:异步 run 面 + run 级动词(routes/runs.ts)。与 tasks 域共用 ctx.legs.prepareSpec。
         if (await handleRuns(req, res, url, ctx))
             return;
-        // DESIGN-269 车2 件2 域模块:A2A JSON-RPC 端点 POST /v1/a2a(routes/a2a-serve.ts)。
-        // ⚠️ 位置即契约:服务凭据门**之后**(R-11「持凭据才可调」),且在 drain / model-roster-pending 两道
-        // 503 之后 —— `/v1/a2a` 在 isBillableSubmitPath 里(message/send 会烧模型)。排在 handleRuns 之后是
-        // 因为它**复用** runs 域导出的提交腿(createDurableRun):次序上先让原生 run 面各就各位,再挂它的
-        // 协议门面,评审读这张链时的因果方向才与实现一致。
         if (await handleA2a(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:SVC-5 workflow agent steer(routes/workflows.ts,与上面的只读三路同域)。
         if (await handleWorkflowAgentSteer(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:子代理 / 任务句柄 / 三条 HITL 应答口(routes/runs.ts,与上面的 run 面同域)。
         if (await handleRunVerbs(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:v2 leader 端点(routes/leader.ts)。
         if (await handleLeader(req, res, url, ctx))
             return;
-        // design/158 A9:sandbox-image-pool 控制面(routes/images.ts;bakes 段在 images 段之前的顺序由域模块内部保住)。
         if (await handleImages(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:人在环审批面(durable F4 + legacy)与 assistant-scheduler 三动词
-        // (routes/approvals-assistant.ts)。续跑一律经 ctx.legs 的 resume 家族。
         if (await handleApprovalsAssistant(req, res, url, ctx))
             return;
-        // design/158 A9:观测只读面(routes/observability.ts):/v1/outcomes + /v1/usage。
         if (await handleObservability(req, res, url, ctx))
             return;
-        // #154 件三:装配自证只读面(routes/diagnostics.ts):GET /v1/diagnostics/wiring(operator-only)。
         if (await handleDiagnostics(req, res, url, ctx))
             return;
-        // design/183 §4.3:收编面(routes/adoption.ts,operator lane;POST /v1/adoption + GET /v1/adoption/:id)。
         if (await handleAdoption(req, res, url, ctx))
             return;
-        // #270 车2:托管留存的 operator 治理面(routes/retention-ops.ts,operator lane;hold PUT/DELETE +
-        // 审计读)。位置跟着 adoption —— 同族(部署级 operator 动作、同一条 `explicitOperatorOk` 门、
-        // 同样 billable=false 且刻意不吃 drain / model-roster-pending 两道 503)。
         if (await handleRetention(req, res, url, ctx))
             return;
-        // #291(C17):停机因由声明口(routes/admin-drain.ts,operator lane;POST /v1/admin/drain)。
-        // 同族(operator 门、billable=false、不吃 drain 503——它正是 drain 前要调的口),位置跟着 retention。
         if (await handleAdminDrain(req, res, url, ctx))
             return;
-        // #322 批1 追加件:配置手动刷新口(routes/admin-config-refresh.ts,operator lane;POST
-        // /v1/admin/config/refresh)。与 drain 同族同门同 billable 姿势,位置紧跟它。
         if (await handleAdminConfigRefresh(req, res, url, ctx))
             return;
-        // design/158 A9:memory 导出/同步 + /v1/policy 只读面(routes/memory-policy.ts)。
         if (await handleMemoryPolicy(req, res, url, ctx))
             return;
-        // #264 v2-c:治理携出 bundle 的 operator 面(routes/memory-bundle.ts;POST 两口)。
-        // 🔴 位置在 memory-policy **之后**是有意的:`/v1/memory/export` 这条路径上住着两个不同的面 ——
-        // GET = 142-S5 的属主自助条目读(owner 门,零存在性 oracle),POST = 本件的治理包(operator-only)。
-        // 两者按**方法**互斥,谁先谁后都不改判;把既有的 GET 面留在前面,是让新面在任何情况下都不可能
-        // 遮住它(本模块只认 POST,一个字都不碰 GET 的匹配式)。族属上它与 adoption / retention-ops 同类:
-        // 部署级 operator 动作、同一条 explicitOperatorOk 门、同样 billable=false。
         if (await handleMemoryBundle(req, res, url, ctx))
             return;
-        // #154 车二:CC settings 导入两口(lane=principal,billable=false)。
         if (await handleRules(req, res, url, ctx))
             return;
-        // design/177 共享记忆库只读面(routes/shared-memory.ts)。🔴 域头的合取式**就是**挂载条件:供给面
-        // 与 org 折叠面双在场才有这个域,缺一个则请求落到本函数尾的全局 404(诚实缺席,不是 501)。
-        // `capabilities.sharedMemory` 读同一个合取式 ——「说 yes ⟺ 面真能用」因此是结构性的,不靠人盯。
         if (deps.sharedMemoryStore && deps.orgMemoryDirectory && (await handleSharedMemory(req, res, url, ctx)))
             return;
-        // design/158 A9:会话/发件链接列表面(routes/sessions-list.ts)。
         if (await handleSessionsList(req, res, url, ctx))
             return;
-        // #A1([4147] 件3):后台 agent 名册读面(routes/agents-roster.ts)。位置跟着 sessions-list —— 同一族
-        // (租户只读列举面、同一只 `sessionOwnerScope` 门、同样在全局服务凭据门之后)。
         if (await handleAgentRoster(req, res, url, ctx))
             return;
-        // design/158 A9:单会话面(routes/sessions.ts:init/settings/mcp/head/events/audit/fork/delete/policy/workspace)。
         if (await handleSessions(req, res, url, ctx))
             return;
-        // design/158 A9:2c session-sync 面(routes/session-sync.ts)。
         if (await handleSessionSync(req, res, url, ctx))
             return;
-        // design/158 A9:D-1 通用附件面(routes/attachments.ts)。
         if (await handleAttachments(req, res, url, ctx))
             return;
-        // design/158 A9 域模块:会话外事件注入 / 唤醒(routes/notify-wake.ts)。
         if (await handleNotifyWake(req, res, url, ctx))
             return;
         sendError(res, 404, "not_found.route", "not found");
     }
-    /** #196:本任务跑哪只 Runner —— 由装配点按场景 hands 判别位裁定(main.ts 的 `runnerFor` 闭包)。
-     *  seam 缺席 = 单 Runner 部署形(#196 之前的行为逐字不变),不是降级臂。 */
     function runnerFor(spec) {
         return deps.runnerFor?.(spec) ?? deps.runner;
     }
-    /** Read + validate the body, authorize, and build the spec. Returns null if it already responded.
-     *
-     *  `bodyIn` (DESIGN-269 车2):调用方**已经**把体解析出来了(A2A 的 JSON-RPC 腿 —— 那条请求的正文是
-     *  一次 `message/send`,腿把它翻成 `TaskRequestBody` 再进这条链)。缺席 ⇒ 照旧 `readJson(req)`。
-     *  分歧只在**入口**:往下的每一条校验/授权/resolveSpec 都是同一段代码,这正是本参数的全部意义
-     *  (给 A2A 抄一份校验 = 抄一份会漂的 400 语义)。 */
     async function prepareSpec(req, res, bodyIn, onTypedFailure) {
         const body = bodyIn ?? (await readJson(req));
         if (!body || typeof body.objective !== "string") {
             sendError(res, 400, "request.field_invalid", "missing 'objective' string");
             return null;
         }
-        // [920] 空毒帧第一道门:空/纯空白 objective 会成为持久历史里的空 user 帧——严格网关(anthropic/kimi)
-        // 对空 content 400,且一帧毒全 session(同角色 merge 后残留空 block,存量救不了)。core 半场(装配
-        // 自愈+intake 拒)在修;HTTP 面 fail-loud 是宪法「诚实优先」形:空任务无合法用例,静默吞掉才是坑。
         if (body.objective.trim().length === 0) {
             sendError(res, 400, "request.field_invalid", "objective must not be empty or whitespace-only (an empty user message poisons the session history on strict providers)");
             return null;
         }
-        // jobId (work-view correlation): optional, but if present must be a non-empty string ≤64 chars (the column
-        // width) — reject a malformed one up front rather than silently truncating/dropping it at the INSERT.
         if (body.jobId !== undefined && (typeof body.jobId !== "string" || body.jobId.length === 0 || body.jobId.length > 64)) {
             sendError(res, 400, "request.field_invalid", "jobId must be a non-empty string of at most 64 characters");
             return null;
         }
-        // [#15] sessionId: a client MAY supply an ARBITRARY id (deliberate asymmetry vs fork/delete — see security.ts
-        // `isUuidV7` doc: run-local `--session`, dev anonymous-share ids; the wire contract types sessionId as an opaque
-        // string), but it must fit the `session_id VARCHAR(64)` column. Reject an over-long one up front rather than
-        // 500/truncating at the INSERT (the authorizer's register() runs later in this function, after this block via the
-        // deps.authorize() call — so the cap fires before any INSERT). LENGTH-ONLY — NOT a uuidv7 shape
-        // check (that would break the permissive submit contract); submit stays lenient, fork/delete keep the uuidv7 gate.
         if (typeof body.sessionId === "string" && body.sessionId.length > 64) {
             sendError(res, 400, "request.field_invalid", "sessionId must be at most 64 characters");
             return null;
         }
-        // Personalization caps: once users can edit these, an uncapped prompt/skill body is a
-        // cost hole — reject up front, server-pinned (a UI may be stricter, never looser).
         if (typeof body.systemPrompt === "string" && body.systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
             sendError(res, 400, "request.field_invalid", `systemPrompt must be at most ${MAX_SYSTEM_PROMPT_CHARS} characters`);
             return null;
         }
-        // appendSystemPrompt ([1478] R2 + codex R7 F2): fail-loud SHAPE gate on fresh submits — a defined value must
-        // be a non-empty string within the systemPrompt cap. A non-string/empty value would be silently normalized to
-        // "absent" by resolveSpec's defensive accept (a client serialization bug then runs the task WITHOUT its
-        // product-knowledge block — the silent-drop class again); the cap matches systemPrompt (same prompt surface,
-        // same per-turn cost hole). Stored resume bodies stay on the defensive drop+warn (acceptAppendSystemPrompt).
         if (body.appendSystemPrompt !== undefined) {
             if (typeof body.appendSystemPrompt !== "string" || body.appendSystemPrompt.length === 0) {
                 sendError(res, 400, "request.field_invalid", "appendSystemPrompt must be a non-empty string");
@@ -846,23 +492,10 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // codex F3/R3/R4 (capability honesty): the append-less-pack combos (rider / settings.outputStyle meeting an
-        // already-assembled systemPrompt or a center assembled-identity pack) are adjudicated INSIDE resolveSpec —
-        // it alone derives the effective scenario (principal ruling + defaultScenario) and holds the center-pack
-        // snapshot the provider pick uses, so an HTTP-side probe could disagree with the actual assembly (R4:
-        // scenario mismatch / centerPrompts refresh TOCTOU). This route passes `leg:"fresh"` below, which makes
-        // resolveSpec 400 fail-loud (HttpError, surfaced by the catch around prepareSpec's caller); resume families
-        // omit it and get the drop+warn mirror instead.
-        // [#40 / TOC cwd seam] body.cwd must be an ABSOLUTE host path — fail-loud (a relative cwd would silently resolve
-        // against the SERVICE process cwd, not the user's project — TOC review #12). Whether it is HONORED is separately
-        // gated to the single-user host lane (resolveSpec); validating shape here is independent of that gate.
         if (body.cwd !== undefined && !isValidCwd(body.cwd)) {
             sendError(res, 400, "request.field_invalid", "cwd must be a non-empty absolute host path");
             return null;
         }
-        // design/119 (CC --add-dir) body.additionalDirectories — fail-loud shape on submit (mirrors cwd; each entry is a
-        // host path with the SAME absolute/no-`..` rule). Whether it is HONORED is separately gated to the host lane
-        // (resolveSpec). An empty array is fine (no-op); a non-array or an entry failing the cwd shape is a client error.
         const addDirsRaw = body.additionalDirectories;
         if (addDirsRaw !== undefined) {
             if (!Array.isArray(addDirsRaw)) {
@@ -879,8 +512,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // core 5.11.0:additionalReadDirectories(只读围栏)—— 与 additionalDirectories 同形 fail-loud
-        // (绝对路径数组、无 `..`、同条数上限);语义差异(只进 READ 面)在 core,形校验在此对齐。
         const addReadDirsRaw = body.additionalReadDirectories;
         if (addReadDirsRaw !== undefined) {
             if (!Array.isArray(addReadDirsRaw)) {
@@ -897,9 +528,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // body.settings (client SemaSettings stamp) — fail-loud shape/size caps on submit, matching the sibling
-        // fields' posture (parseTaskSettings is also defensive on every path incl. resume; this 400s a bad submit early
-        // rather than silently coercing — adversarial review). The semantic projection (tighten-only) happens in resolveSpec.
         const settingsRaw = body.settings;
         if (settingsRaw !== undefined && settingsRaw !== null) {
             if (typeof settingsRaw !== "object" || Array.isArray(settingsRaw)) {
@@ -911,8 +539,6 @@ export function createHttpServer(rawDeps) {
                 sendError(res, 400, "request.field_invalid", `settings.outputStyle must be at most ${MAX_SETTINGS_OUTPUT_STYLE_CHARS} characters`);
                 return null;
             }
-            // codex R14: BOTH append carriers fold into ONE spec field (applyTaskSettings: `append\n\nstyle`) — two
-            // individually-valid values can exceed the documented cap combined. One aggregate gate, same bound.
             if (typeof st.outputStyle === "string" &&
                 st.outputStyle.length > 0 &&
                 typeof body.appendSystemPrompt === "string" &&
@@ -921,9 +547,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
             const perms = st.permissions;
-            // F1(#157 复审车B 留裁,裁修 2026-08-05):出现但形错(数组/标量)⇒ 400,与 settings 自身门(上方
-            // :1097)同姿势——此前数组形被本门与 #157-③ 枚举门的 `!Array.isArray` 双双跳过、parse 层再静默
-            // drop = 保护型配置(deny 规则)端到端无效且无声。null 保持「容器缺席」不咬(既有钉)。
             if (perms !== undefined && perms !== null && (typeof perms !== "object" || Array.isArray(perms))) {
                 sendError(res, 400, "request.field_invalid", "settings.permissions must be an object");
                 return null;
@@ -937,8 +560,6 @@ export function createHttpServer(rawDeps) {
                     }
                 }
             }
-            // settings.env (R-survey) — fail-loud on submit, parity with outputStyle/permissions (adversarial-review LOW). The
-            // defensive parse `cleanEnvMap` also caps these on every path (resume re-runs WITHOUT this gate), this just 400s a fresh submit.
             const envRaw = st.env;
             if (envRaw !== undefined && envRaw !== null) {
                 if (typeof envRaw !== "object" || Array.isArray(envRaw)) {
@@ -957,16 +578,10 @@ export function createHttpServer(rawDeps) {
                     }
                 }
             }
-            // L2 ultracode (design/111): fail-loud on a non-boolean (parity with the other settings caps; parseTaskSettings
-            // silently ignores non-true on the resume paths the HTTP gate doesn't cover).
             if (st.ultracode !== undefined && typeof st.ultracode !== "boolean") {
                 sendError(res, 400, "request.field_invalid", "settings.ultracode must be a boolean");
                 return null;
             }
-            // settings.hooks(hook-runner 阶段一)— fail-loud on submit(131/132/133 邻居姿势):一个 malformed
-            // hooks 配置被静默丢弃 = 用户以为在生效的 deny 钩子其实没跑(安全预期破坏),必须 400。契约校验 =
-            // registry-core 0.1.51 HooksConfig + 服务侧上限(parseHooksConfig);resume 路径由 parseTaskSettings 防御
-            // (malformed → deferred 报告+warn)。是否 HONOR 另由单用户闸在 resolveSpec 决定(多租户=忽略非 400)。
             if (st.hooks !== undefined && st.hooks !== null) {
                 const hooksParsed = parseHooksConfig(st.hooks);
                 if (!hooksParsed.config) {
@@ -980,9 +595,6 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", skillsErr);
             return null;
         }
-        // body.images (CC parity): cap COUNT + per-image inline base64 size → 413 (the inline
-        // `data` is otherwise passed raw to the spec; URL images are core-gated). MAX_BODY already bounds total bytes; this
-        // adds the missing count cap (anti decode-DoS) + an explicit per-image 413. Fail-loud parity with the settings caps.
         if (Array.isArray(body.images)) {
             if (body.images.length > MAX_IMAGES_PER_REQUEST) {
                 sendError(res, 413, "request.payload_too_large", `at most ${MAX_IMAGES_PER_REQUEST} images per request`);
@@ -996,10 +608,6 @@ export function createHttpServer(rawDeps) {
                 }
             }
         }
-        // design/112 C1: validate the client context shape + cap each field. The body is untrusted and timeZone/userEmail
-        // flow into core's env block — an object with optional string timeZone/userEmail; reject non-strings / over-long
-        // values (anti-DoS + anti env-block-injection bloat). core additionally validates timeZone semantically (invalid
-        // IANA zone → UTC, never mislabeled). locale was removed in core 1.186 (dead field) so it is not accepted here.
         if (body.clientContext !== undefined) {
             const cc = body.clientContext;
             if (typeof cc !== "object" || cc === null || Array.isArray(cc)) {
@@ -1015,9 +623,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // §7 P0.5 sandbox image selection: shape-validate here (a non-empty profile string; capabilitiesNeeded a
-        // string[]). The per-principal visibility re-admit + profile→digest resolution happen in resolveSpec (it
-        // holds the imageIndex + the trusted principal); a 400/404 there surfaces via the HttpError catch below.
         if (body.sandboxImageProfile !== undefined && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0 || body.sandboxImageProfile.length > 128)) {
             sendError(res, 400, "request.field_invalid", "sandboxImageProfile must be a non-empty string of at most 128 characters");
             return null;
@@ -1026,23 +631,14 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "capabilitiesNeeded must be an array of strings");
             return null;
         }
-        // capabilitiesNeeded is a constraint ON the selected image — meaningless without a profile to select (it would
-        // otherwise be silently ignored while the task runs the unchecked worker-global default). Adversarial-review LOW.
         if (Array.isArray(body.capabilitiesNeeded) && body.capabilitiesNeeded.length > 0 && (typeof body.sandboxImageProfile !== "string" || body.sandboxImageProfile.length === 0)) {
             sendError(res, 400, "request.field_conflict", "capabilitiesNeeded requires sandboxImageProfile (it constrains the selected image)");
             return null;
         }
-        // §7 P0.5 + the multi-run orchestration gates don't compose in v1: the per-task image binds by sessionId, but
-        // `cascade` strips sessionId per rung and `verify` runs its verifier on a separate session — both would
-        // silently fall back to the worker-global default image. Reject the combo FAIL-LOUD rather than run the wrong
-        // image (adversarial-review round-2 MEDIUM). Lift when core propagates the image binding to those sub-runs.
         if (typeof body.sandboxImageProfile === "string" && body.sandboxImageProfile.length > 0 && (body.cascade === true || body.verify === true)) {
             sendError(res, 400, "request.field_conflict", "sandboxImageProfile is not supported together with cascade/verify in v1 (the per-task image would not bind to the cascade rungs / verifier sub-run)");
             return null;
         }
-        // Structured output (CC --json-schema): a plain JSON-schema OBJECT, size-capped (an uncapped schema is a
-        // prompt-bloat / cost hole, same posture as systemPrompt/skills). Deep schema validity is core's job — a
-        // malformed schema fails the task with a typed core error, not a 400 here. Threaded into spec by resolveSpec.
         if (body.outputSchema !== undefined) {
             if (typeof body.outputSchema !== "object" || body.outputSchema === null || Array.isArray(body.outputSchema)) {
                 sendError(res, 400, "request.field_invalid", "outputSchema must be a JSON Schema object");
@@ -1053,19 +649,10 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // E7 (shell-host contract): reasoning-effort selection (the `/effort` picker), mapped to core's ThinkingLevel in
-        // resolveSpec. Validate FAIL-LOUD — a provided-but-unknown level is a 400, never silently dropped (the body.model
-        // silent-drop bug class). The accepted set is core's tier scale; the picker's default set is advertised on
-        // /v1/models (supportedEffortLevels). Absent ⇒ core uses the resolved role's default thinking.
         if (body.reasoningEffort !== undefined && !isThinkingLevel(body.reasoningEffort)) {
             sendError(res, 400, "request.field_invalid", "reasoningEffort must be one of: off, minimal, low, medium, high, xhigh, max");
             return null;
         }
-        // E18 (shell-host contract): resume-at handle shape. A non-empty string ≤64 (the uuidv7 eventId / entry_id column
-        // width). resolveSpec resolves it to a SessionTreeEntry.id (eventId→entryId anchor map) — an unknown handle 4xx's
-        // there. Reject combos core forbids (resumeAt + a fresh verify/cascade leg replaces/strips the session per
-        // rung/sub-run, so resume-at is meaningless there — fail-loud rather than silently branch a session that's about
-        // to be replaced), mirroring the sandboxImageProfile+cascade/verify reject.
         if (body.resumeAt !== undefined) {
             if (typeof body.resumeAt !== "string" || body.resumeAt.length === 0 || body.resumeAt.length > 64) {
                 sendError(res, 400, "request.field_invalid", "resumeAt must be a non-empty message eventId string (≤64 chars)");
@@ -1076,8 +663,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // [833] rewind exclusive mode: two enum values only, and only riding a resumeAt (alone it qualifies nothing — a
-        // silent no-op is the body.model silent-drop bug class, so fail loud). Absent ⇒ core default "at" (zero regression).
         if (body.resumeAtMode !== undefined) {
             if (body.resumeAtMode !== "at" && body.resumeAtMode !== "before") {
                 sendError(res, 400, "request.field_invalid", 'resumeAtMode must be "at" or "before"');
@@ -1088,9 +673,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // E12 (shell-host contract): prompt-suggestions opt-in. `true`/`false` or an object `{count?, role?}`. Validate
-        // FAIL-LOUD (a malformed value is a 400, not a silent off — the body.model silent-drop bug class); resolveSpec then
-        // normalizes (and re-normalizes defensively on resume, which skips this HTTP validation).
         if (body.suggestNextPrompts !== undefined && typeof body.suggestNextPrompts !== "boolean") {
             const s = body.suggestNextPrompts;
             if (typeof s !== "object" || s === null || Array.isArray(s)) {
@@ -1107,33 +689,22 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // E19 (shell-host contract): rewind-files opt-in must be a boolean (fail-loud, not silently dropped).
         if (body.rewindFiles !== undefined && typeof body.rewindFiles !== "boolean") {
             sendError(res, 400, "request.field_invalid", "rewindFiles must be a boolean");
             return null;
         }
-        // MF-30 memory PAUSE (option B): the per-request write toggle must be a boolean (fail-loud — a malformed value
-        // silently writing to memory when the user asked to pause is exactly the silent-drop bug class).
         if (body.memoryWrite !== undefined && typeof body.memoryWrite !== "boolean") {
             sendError(res, 400, "request.field_invalid", "memoryWrite must be a boolean (false = pause memory writes for this run)");
             return null;
         }
-        // design/114 Phase3: requireExistingSession opt-in must be a boolean (fail-loud — a truthy non-boolean silently
-        // NOT triggering the fail-loud is the very "silent fresh run" this flag exists to prevent).
         if (body.requireExistingSession !== undefined && typeof body.requireExistingSession !== "boolean") {
             sendError(res, 400, "request.field_invalid", "requireExistingSession must be a boolean");
             return null;
         }
-        // §4 (Fork): enableFork opt-in must be a boolean (fail-loud, not silently dropped — mirrors selfOrchestration).
         if (body.enableFork !== undefined && typeof body.enableFork !== "boolean") {
             sendError(res, 400, "request.field_invalid", "enableFork must be a boolean");
             return null;
         }
-        // design/131/132/133 (1.127.0): fresh-submit shape validation for the three new opt-ins — a
-        // malformed value must 400 here, not silently normalize to "off" (the body.model silent-drop bug class).
-        // resolveSpec's normalizers stay defensive for the RESUME path (which re-enters without HTTP validation).
-        // NOTE: `resilience.bypassBreaker=true` from a NON-operator is a shape-valid permission downgrade (dropped
-        // by the normalizer, not a 400) — the field's authz, not its type.
         if (body.resilience !== undefined) {
             const r = body.resilience;
             if (typeof r !== "object" || r === null || Array.isArray(r)) {
@@ -1152,28 +723,16 @@ export function createHttpServer(rawDeps) {
             sendError(res, 400, "request.field_invalid", "finalVerification must be a boolean");
             return null;
         }
-        // [854]④: fresh-submit shape validation for per-request 配速 —— 已知三键必须是正整数,否则 400 fail-loud
-        // (body.model silent-drop 同类教训:静默 normalize 成「没配速」正是本件要防的假成功)。0 也拒绝:core 侧
-        // `timeoutSec > 0` 才生效(0=不设墙,会绕过 TASK_TIMEOUT_MAX_SEC 封顶),maxTurns/maxOutputTokens 的 0 无意义。
-        // 枚举外键与 resilience/attachments 同口径:容忍(只校验已知键)——但退役键与预算族错位键**点名 400**
-        // (它们是「caller 有明确意图、本层却不会采纳」的已知键形,容忍=静默吞意图)。resolveSpec 的
-        // normalizeLimits 对 RESUME 重放路径保持 defensive(按键 DROP,不 throw)。
         if (body.limits !== undefined) {
             const l = body.limits;
             if (typeof l !== "object" || l === null || Array.isArray(l)) {
                 sendError(res, 400, "request.field_invalid", "limits must be an object { maxWalltimeMs?, maxOutputTokens?, maxTurns? } (positive integers)");
                 return null;
             }
-            // core 5.8.0 时限重构:旧键响亮拒并点名替代(core 同姿势 config.limit_unknown_key;「勿自行兼容」是
-            // core 的公开指令)。timeoutSec(秒)→ maxWalltimeMs(毫秒,注意单位);deadline 族三 opt-out 随
-            // 机制整族退役(nudge/call-cap/graceful-finalize 已从引擎移除),无替代键。fresh fail-loud;resume
-            // 重放不过此门,resolveTaskLimits 对旧键 defensive DROP + 具名留痕(task_limits_legacy_key_dropped:
-            // 存量 suspended 体降级为默认配速——单用户无 env 墙时=整任务无墙,多租=延到租户墙,非「方向安全」)。
             if (l.timeoutSec !== undefined) {
                 sendError(res, 400, "request.field_invalid", "limits.timeoutSec was retired in core 5.8.0 — use limits.maxWalltimeMs (milliseconds; opt-in wall clock)");
                 return null;
             }
-            // 166-T3(靶4b):deadlineNudge 的替代=approachNotice(core RETIRED 表同源);另两键随机制退役无替代。
             if (l.deadlineNudge !== undefined) {
                 sendError(res, 400, "request.field_invalid", "limits.deadlineNudge was retired in core 5.8.0 — use limits.approachNotice (default on at 80%/95%; false turns it off, {at: [r1, r2]} tunes thresholds)");
                 return null;
@@ -1184,11 +743,6 @@ export function createHttpServer(rawDeps) {
                     return null;
                 }
             }
-            // 预算族错位键(core 5.8.0「预算入 limits」的单向缺口):caller 按 core 键形写 limits.maxCostUsd/
-            // maxTokens/degrade/budgetStreamCancel 时,本服务的采纳面在 body **顶层**(resolve-spec.ts
-            // cappedCeiling)/运营方 env(MODEL_DEGRADE_*)/core 默认(budgetStreamCancel=maxCostUsd 在场即
-            // true)——不点名拒则被静默吞掉,方向「更松」(caller 以为封了 0.5 刀,实际无成本上限)。
-            // 退役键同姿势 fail-loud;resume 重放不过此门,normalizeLimits 对这四键维持 defensive DROP。
             for (const k of ["maxCostUsd", "maxTokens"]) {
                 if (l[k] !== undefined) {
                     sendError(res, 400, "request.field_invalid", `limits.${k} is not read from limits here — send it at the request body top level (${k}); it is capped by the operator ceiling ${k === "maxCostUsd" ? "MAX_TASK_COST_USD" : "MAX_TASK_TOKENS"}`);
@@ -1210,7 +764,6 @@ export function createHttpServer(rawDeps) {
                     return null;
                 }
             }
-            // 166-T3:approachNotice fresh-submit fail-loud(判据单源 normalizeApproachNotice,阈值规则对齐 core a<=b)。
             {
                 const v = l.approachNotice;
                 if (v !== undefined && normalizeApproachNotice(v) === undefined) {
@@ -1219,11 +772,6 @@ export function createHttpServer(rawDeps) {
                 }
             }
         }
-        // [876] per-task subagents(core 1.295 TaskSpec.agents):fresh-submit 白名单门 fail-loud。与 resilience/
-        // limits 的「容忍未知键」取舍相反 —— agents 是能力定义,静默丢字段=定义被悄悄削(丢一个 denyTools/
-        // isolation 就是放宽),400 点名未知键更安全。permissionMode 有意不纳(core 拍,独立批)——出现按未知键拒。
-        // 形状细则(name 必填且数组内唯一/各字段浅形状/≤32 条)单源在 spec-fields.ts validateTaskAgents;RESUME
-        // 重放不过这道门 → resolveSpec 侧 taskAgentsFromBody defensive(非法项按条 DROP+warn,不砖 resume)。
         if (body.agents !== undefined) {
             const agentsErr = validateTaskAgents(body.agents);
             if (agentsErr) {
@@ -1231,27 +779,18 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // [922]①/[915]② interactiveTools(core 1.296 三态旋钮):boolean fail-loud 同邻居姿势。per-run 工具面
-        // 选择(AskUserQuestion/present_plan 挂载判据覆写),无跨租户面 ⇒ 不设租户门;undefined=core 自动判据。
         if (body.interactiveTools !== undefined && typeof body.interactiveTools !== "boolean") {
             sendError(res, 400, "request.field_invalid", "interactiveTools must be a boolean");
             return null;
         }
-        // [1909]⑧ oneShot(core 5.23.0):boolean fail-loud,与它的姊妹旋钮 interactiveTools 逐字同姿势 ——
-        // 两者说的是同一件事的两半(这次提交是不是 `-p` 一次性形)。非 boolean 静默丢会让调用方以为已经声明
-        // 了一次性、模型却照旧被告知「结束回合等通知」= 后台结果丢失,正是本键存在的那个失败形。
         if (body.oneShot !== undefined && typeof body.oneShot !== "boolean") {
             sendError(res, 400, "request.field_invalid", "oneShot must be a boolean");
             return null;
         }
-        // [854]② retainBackgroundProcesses:boolean fail-loud(邻居姿势 —— 非 boolean 静默变「不驻留」正是
-        // silent-drop 病灶);单用户闸/多租忽略在 resolveSpec(retainBackgroundProcessesFromBody)。
         if (body.retainBackgroundProcesses !== undefined && typeof body.retainBackgroundProcesses !== "boolean") {
             sendError(res, 400, "request.field_invalid", "retainBackgroundProcesses must be a boolean");
             return null;
         }
-        // [1052]② excludeTools/deferTools:数组-of-非空-string fail-loud(邻居姿势——坏形静默丢=工具面照旧,
-        // 调用方以为收窄了却没收=silent-drop 病灶同族)。per-run 收窄无跨租户面 ⇒ 无租户门(interactiveTools 同)。
         for (const key of ["excludeTools", "deferTools"]) {
             const v = body[key];
             if (v !== undefined && (!Array.isArray(v) || v.some((n) => typeof n !== "string" || n.length === 0))) {
@@ -1259,7 +798,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // [1144]/[1146] promptProfile:枚举 fail-loud(坏值静默丢=调用方以为切了形没切,silent-drop 病灶同族)。
         {
             const v = body.promptProfile;
             if (v !== undefined && v !== "simple" && v !== "classic") {
@@ -1267,8 +805,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // [2856]② toolMaterializeStrategy:枚举 fail-loud(邻居 promptProfile 同款,同一条理由——静默折缺省
-        // 会让调用方以为切了策略却没切,而这个键的整个存在理由就是 #181 那条「缺省下无界循环」)。
         {
             const v = body.toolMaterializeStrategy;
             if (v !== undefined && v !== "static" && v !== "swap") {
@@ -1276,11 +812,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // #157-② permissionMode:枚举 fail-loud(邻居 promptProfile 同款)。此前开放 string + coercePermissionMode
-        // 未知词静默折 "default"(最爱问档)——方向对(收紧)但静默:拼错(大小写 "Plan")的调用方以为进了 plan
-        // 模式,实拿恒询问,silent-drop 病灶同族([2759] cli settings.json 同源病)。RESUME 重放持久化 body 不过
-        // 此门(coercePermissionMode 宽容层护存量,双层与 [854]/outputStyle 同姿势);bundle 的
-        // settings.permissions.defaultMode drop 臂本批不动(候 [2759] 跨仓对表统一裁,task-settings.ts:216 注)。
         {
             const v = body.permissionMode;
             if (v !== undefined && v !== "default" && v !== "acceptEdits" && v !== "plan" && v !== "bypassPermissions" && v !== "auto") {
@@ -1288,10 +819,6 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
-        // #157-③([2766] cli 对表裁决):bundle 的 settings.permissions.defaultMode 与顶层同形 400 —— 经壳的
-        // 流量上 wire 前已过闭集校验(壳侧对人手编辑面走「降级+响亮」b979f74),server 收到未知词只可能来自
-        // 旧版壳或第三方直连=程序化入口,严格拒合理。parseTaskSettings 的 drop 臂保留护 RESUME 存量
-        // (task-settings.ts:216 双层,同 permissionMode/outputStyle 姿势)。
         {
             const s = body.settings;
             if (s !== null && typeof s === "object" && !Array.isArray(s)) {
@@ -1305,30 +832,18 @@ export function createHttpServer(rawDeps) {
                 }
             }
         }
-        // [865]② fresh-submit 未知模型 400 fail-loud(clay 生产实锤:未知 body.model 静默落 default = 用户不知情
-        // 换模型)。🔴 门目录必须与 resolveSpec 同源 = expandTiers 增广视图(codex H1:裸 config.models 会把合法
-        // 档位词 "pro"/CC alias "sonnet" 当未知 400 误杀——SDK 契约明确允许它们;增广后 matchCatalogModel 对
-        // name/tier 词/alias/id 四形一体裁决)。restart 窗口注记与 main.ts wireCatalog 同款:tiers 热刷新 vs
-        // Runner 构造期快照,门短暂超前=fail-loud 而非静默降级,诚实。"default" 是合法目录键(hasOwn 命中)。
-        // RESUME 重放持久化 body 不过这道门(模型事后被移出目录时砖死 resume 比降级糟)——resolveSpec 侧对未知
-        // ref warn 降级,双层与 [854] limits 同姿势。settings.model 保持 lenient(文档化,picker 路径 =
-        // body.model 才是本病灶面)。
         if (body.model !== undefined) {
             if (typeof body.model !== "string" || body.model.length === 0) {
                 sendError(res, 400, "request.field_invalid", "model must be a non-empty string (a configured catalog name, tier word, or model id)");
                 return null;
             }
-            const bare = deps.config.models ?? {}; // 防御:极简 stub deps 可无 models 域(真 loadConfig 恒有)
+            const bare = deps.config.models ?? {};
             const catalog = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
             if (matchCatalogModel(body.model, catalog) === undefined) {
                 sendError(res, 400, "request.unknown_reference", `unknown model "${body.model.slice(0, 120)}" — not in the configured catalog (name, tier word, or id)`, { available: mentionableNames(deps.config, catalog) });
                 return null;
             }
         }
-        // [1479]① compactionModel — the SAME fail-loud posture + gate catalog as body.model (an unknown cheap-gear pick
-        // silently burning the MAIN model's price is exactly the silent-drop bug class this train exists to kill).
-        // RESUME replays skip this gate (resolveSpec drops+warns there — core's resolveModel throws on an unknown ref,
-        // which would brick the resume).
         if (body.compactionModel !== undefined) {
             if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0) {
                 sendError(res, 400, "request.field_invalid", "compactionModel must be a non-empty string (a configured catalog name, tier word, or model id)");
@@ -1371,17 +886,12 @@ export function createHttpServer(rawDeps) {
                 }
             }
         }
-        // 历史复审轴A #3(1.254):verify 环补 cost 顶——cascade 腿一直映 costCeilingMicroUsd,verify 腿漏了
-        // (每轮独立 runTask,总花费此前仅受 maxRounds 约束);同源 body.maxCostUsd,同换算。
         const verify = verifyRoundsFromBody(body);
         const cascade = body.cascade === true;
         if (cascade && verify) {
             sendError(res, 400, "request.field_conflict", "verify and cascade are mutually exclusive (verify = adversarial gate; cascade = cheap→strong ladder)");
             return null;
         }
-        // E12: suggestNextPrompts is meaningless on the verify/cascade wrappers — they return a TaskResult, not
-        // a stream with core's post-completion suggestions() pass, so the suggestion event would never be produced. Reject
-        // the combo fail-loud rather than silently accept-and-drop it (mirrors the resumeAt + verify/cascade reject above).
         if (body.suggestNextPrompts && (verify || cascade)) {
             sendError(res, 400, "request.field_conflict", "suggestNextPrompts is not supported with verify or cascade (those return a result, not a streamed run)");
             return null;
@@ -1393,88 +903,26 @@ export function createHttpServer(rawDeps) {
         try {
             const auth = deps.authorize ? await deps.authorize({ req, body }) : undefined;
             const spec = await deps.resolveSpec(body, req, auth, { leg: "fresh" });
-            // #196:执行 Runner 与 spec 同一次解析产出 —— 两个消费域(tasks 同步/流式、runs 异步)拿的都是这一只,
-            // 不各自再问一遍(再问 = 两处判别,正是漂移的成因)。
             return { spec, runner: runnerFor(spec), auth, verify, cascade, jobId: body.jobId, body };
         }
         catch (err) {
             if (err instanceof HttpError) {
-                // 🔴 codex 轮2 R2-4(验真后修):`onTypedFailure` 在场 ⇒ **不写响应**,把 typed 失败交回调用方。
-                // 为什么必须有这个口:本仓的 typed 拒绝会把结构化 `extra` 一起回显(`scenario_unknown` 的
-                // extra 是**本部署的全部场景名**)。那对壳/SDK 是指路材料,对一个 **A2A 外部 peer** 却是内部
-                // 词表泄漏 —— 而 DESIGN-269 车2 的整条 skill 声明制,存在的理由就是不把场景名给公网。
-                // 加钩子而不是重构响应形:三个既有调用方一字不传 ⇒ 行为逐字节不变(仍是这一行 sendError)。
                 if (onTypedFailure) {
                     onTypedFailure(err);
                     return null;
                 }
-                // Typed rejection: echo the stable `code` + any structured extras (e.g. the scenario
-                // allowlist) beside the human message — machine code on the wire, prose stays with the shell/web.
                 sendError(res, err.status, httpErrorCode(err.status, err.code), err.message, { ...(err.extra ?? {}) });
                 return null;
             }
             throw err;
         }
     }
-    // design/158 A9:`DecideBinding` 已上提到 `http/wire-types.ts` 叶子(approvals 域模块与 resume 腿同名一形),
-    // 本处仅留指路;形状逐字未变。
-    /**
-     * The VERIFIED fleet scope for a resume publish (TOC review #6 parity with the create paths). Prefer the
-     * crypto-verified `gatedPrincipal(req)` — the SAME identity GET /v1/fleet/stream filters by — on a real HTTP
-     * door; fall back to the checkpoint's own scope (`auth.principal`) only when there is NO request (the internal
-     * D-D SLA deny-sweep, which has no caller to verify). NEVER the spoofable `auth.principal` on a live door:
-     * a spoofed header would re-publish the resumed row under a victim's scope or under "default" (vanishing from
-     * its real owner's stream). Mirrors the sync/create sites' `gatedPrincipal(req, deps.config) ?? "default"`.
-     *
-     * ✅ FIDELITY EDGE — CLOSED by the F-fix (2026-07-01, direct-door principal spoofing). On the REQ-LESS leg (the
-     * internal D-D SLA deny-sweep, `req===undefined`) we fall back to `auth.principal` = the checkpoint's stored scope.
-     * Since the F-fix, createAuthorizer derives `auth.principal` (hence spec.principal, hence the checkpoint scope core
-     * persists at suspend) from `verifiedPrincipal` — the VERIFIED JWT sub on a direct door, the SAME identity the
-     * create path's `gatedPrincipal` tags the row with. So the earlier caveat — a misconfigured direct door where the
-     * raw `x-agent-principal` ≠ the verified sub could surface a swept row under the wrong tenant's /v1/fleet/stream —
-     * is GONE: the checkpoint scope is now always the verified identity, identical to what the create path tagged. The
-     * "TRUE fix" once deferred here (persist the verified principal on the checkpoint at create) is exactly what the
-     * F-fix did upstream at createAuthorizer; the req-less fallback and the create-path scope now agree on every posture.
-     */
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
-    /**
-     * Durable F4 resume (design/45): map a session → its pending checkpoint token INTERNALLY,
-     * rebuild the taskConfig via the same `resolveSpec` path (from the sessionId-keyed checkpoint_ctx), then
-     * `runner.resume`. The capability token never leaves the service. Updates the parked run row to its new state.
-     */
-    async function resumeCheckpoint(sessionId, decision, reason, 
-    // core `ApprovalSettledBy`(5.23.0):**这次结算的出处**,由调用方命名。REQUIRED —— core 的字段
-    // 文档把义务钉在结算点上(「Fill it at every settlement site」),并说明集中推导正是「窗到期被报成
-    // 另一个人拒绝」的成因。本函数有两个调用方且函数内**无从分辨**(sweep 与人为 decide 在这里唯一
-    // 的差别是 `req` 缺席,那是「有没有 HTTP 请求」不是「谁结算的」),所以只能穿参。
-    // ⚠️ core 的相容规则:`decision:"approve"` 只接受 `"human"` 或缺席 —— 「没人答所以它跑了」不是
-    // 任何事实的记录。今天唯一传非 `"human"` 的调用方(SLA sweep)恒 deny,故不冲突;将来若有一个
-    // 会 approve 的非人调用方,它该传的是**缺席**而不是一个自造的词。
-    settledBy, req, // absent on the internal D-D SLA deny-sweep (resolveSpec rebuilds auth from the checkpoint, not req)
-    answer, binding, onResumeCommitted, // codex M2: fires post-markResuming-CAS, pre-model-drive (decide leg's exemption grant); MUST NOT throw the resume down — callers swallow internally. overrideSessionId = parked 腿的 root-会话 grant 锚([1591] 候裁②),legacy 腿不传。
-    // #316:200 受理语义(HTTP `/decide` 传 true;内部 D-D SLA deny-sweep 不传 —— 没有在等响应的人)。
-    // 语义与判据的唯一属主 = `DriveResumeArgs.acceptEarly` 顶注。
-    acceptEarly) {
+    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly) {
         const cs = deps.checkpointStore;
-        // No scope filter here BY DESIGN (council): an operator may view/decide ANY tenant's pending approval.
-        // This load-before-CAS only READS; the definitive multi-tenant guard is the
-        // `AND scope = ?` inside the atomic resolve CAS — a wrong-scope decision can never EXECUTE.
         const token = await cs.findPendingTokenBySession(sessionId);
-        // D-1 approval_stale (opt-in, only when the operator echoed the checkpointToken they saw): if it no longer
-        // matches the current pending — resolved, superseded by a re-mint, or expired — they are deciding a STALE
-        // view. Reject distinctly from the markResuming session-CAS 409 below: the SDK keys ApprovalStaleError on
-        // errorCode:"approval_stale" while the CAS 409 stays bare (→ ConflictError), so the two 409s never collide.
         if (binding?.checkpointToken && binding.checkpointToken !== token) {
             const seen = await cs.get(binding.checkpointToken).catch(() => null);
-            // 🔴 `terminal` 只在该 token **确实属于本会话**时披露(2026-07-26 修)。
-            // 此前是 `seen ? "resolved" : "expired_abort"` —— 而这次 `cs.get` 用的是**调用方给的** token 且
-            // 存储层**没有 scope 谓词**(`WHERE token = ?`,连 status 都不过滤),这一步还跑在下面那个
-            // `if (!token) → 404` **之前**。于是任何持凭据者都能拿一串 token 来问「它在库里吗」:
-            // 命中 ⇒ `terminal:"resolved"`,不命中 ⇒ `terminal:"expired_abort"` —— **一位跨租户存在性 oracle**,
-            // 与本文件自述的「no existence oracle」相反。token 本身不可猜(uuid 级),所以这不是枚举面;
-            // 真实伤害是**泄漏出去的 token 可被免费确认有效性**(从日志/截图/工单捡到一串,不必也不能用它 resume,
-            // 却能确认它对应一条真实 checkpoint 行、以及它是否已被解决)。
-            // 归属不上就**省略这个键**(SDK 侧 `terminal?:` 本来可选)——不撒谎、也不泄露;真实原因照旧进日志。
             const attributable = seen !== null && seen.sessionId === sessionId;
             if (!attributable && seen !== null) {
                 deps.logger?.warn?.("approval_stale_token_foreign", { sessionId, tokenSession: seen.sessionId ?? null });
@@ -1489,47 +937,23 @@ export function createHttpServer(rawDeps) {
             };
         }
         if (!token) {
-            // 🔴 文案与 owner 门那条统一(2026-07-26 修)。此前两句可区分:owner 门拒 ⇒ "approval not found";
-            // 本会话**没有** pending ⇒ 这条更详细的。而 `peekPendingScope` 在没有 pending 时返回 `null`、`null` 被当作
-            // "开放"放过门 ⇒ 两句文案精确区分「这儿有**别人的** pending」与「这儿没有 pending」。
-            // 后果:任何持凭据的租户可逐个 sessionId 判定「此刻有一条别人的待决审批」,拼出一张跨租户的
-            // 「谁正卡在审批上」活动图(时序/规模情报)—— 而本文件自述承诺的正是不给这个。
-            // 统一成同一句;**诊断不丢**,只是挪进日志(部署方有日志权限,外部调用方没有)。
             deps.logger?.info?.("approval_decide_no_pending", { sessionId });
             return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
         }
-        // get (checkpoint table) + getCtx (checkpoint_ctx table) are independent — load concurrently (council).
-        const cpPromise = cs.get(token); // throws if the checkpoint format is newer than this build (version guard)
+        const cpPromise = cs.get(token);
         const ctxPromise = cs.getCtx(sessionId);
         let cp;
         try {
             cp = await cpPromise;
         }
         catch (e) {
-            void ctxPromise.catch(() => { }); // don't leak an unhandled rejection from the parallel load
+            void ctxPromise.catch(() => { });
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        // 🔴 GATE-KIND GUARD ([1995]①,`gate_not_resumable` / `gate_not_plan_review` 的**反方向镜像**):这条腿
-        // 只解 TOOL 审批门(core gateMatch:`human` / `irreversible_ask` ↔ outcome.gate "policy_ask")。此前它无
-        // 条件铸 outcome{gate:"policy_ask"} 交给 core —— 一个 plan_review / resource_limit / task_done park 被误
-        // 路由到 /decide(而 /v1/approvals 把它们与工具审批**混在同一个队列**里、toolName 同为 null)就会深入到
-        // core 的 `checkpoint.gate_mismatch`。那是 core 的 **pre-CAS** 拒绝(checkpoint 仍 pending),但 server 的
-        // CheckpointError 分类表把 gate_mismatch 归为 TERMINAL ⇒ 行被 setTerminal 成 failed + 释放 task_active,
-        // 于是「行说这活死了、park 却还活着」:claim 泄漏(同 session 可并发起第二个 run)、事后用正确的腿救能
-        // 200 真跑完却拿不到 taskId、run 行永停 failed(账本与现实分叉)。这里 pre-CAS 纯拒绝:不动 checkpoint、
-        // 不动 run 行、不烧模型腿,与另外两条腿的守卫同姿势(core 的 gate-match 仍是 fail-closed 兜底)。
-        // ⚠️ 门放在 parked 赎回腿**之前**:赎回腿同样只铸 policy_ask outcome,错门 cp 在那条链上只会更深地炸。
-        // D-D SLA deny-sweep 不受影响:它的取行查询本就只选 gate_kind ∈ APPROVAL_GATE_KINDS(tool-approval.ts 单一属主)。
         const decideGateKind = cp.gate?.kind;
-        if (!isApprovalGateKind(decideGateKind)) { // A-002.1 单一属主
-            // [2400] HITL-6(clay 裁 2026-08-03,不做兼容):补机读指路——与 [2255]① 的 409 材料同形
-            // (pendingGate{kind, decidePath},resumeEntryForGate 单源表),客户端凭 decidePath 直达对的
-            // resume 入口,不再解析人话文案。taskId 源=账本活行(getActiveTaskId,与 active-run-conflict.ts
-            // 的 409 材料同源)——cp.sourceTaskId 是 core 契约里 issuing worker 的 **session id**(ECHO-ONLY
-            // triage,checkpoint-store.d.ts),拿它当 run taskId 铸路径=打出去必 404([3683]-1 同病族,
-            // 扫描 P1 修)。账本无活行 ⇒ 只带 kind,诚实不铸假路径。
+        if (!isApprovalGateKind(decideGateKind)) {
             const activeForPath = decideGateKind
                 ? await deps.runStore?.getActiveTaskId(sessionId).catch(() => undefined)
                 : undefined;
@@ -1545,10 +969,6 @@ export function createHttpServer(rawDeps) {
                 },
             };
         }
-        // [2400] HITL-12(clay 裁 2026-08-03:不兼容老客户端):HTTP 腿强制决策-动作绑定——无 checkpointToken
-        // 且无 boundCallId 的 decide 拒收(此前静默回落 current-pending:并发窗口下 A 想批的门刚被 B 的新门顶掉
-        // 就裁错对象)。内部 D-D SLA deny-sweep(req 缺席)豁免:系统腿 deny 过期行,无并发歧义。位置刻意在
-        // gate-kind 守卫**之后**:错门型先得 409+pendingGate 指路(HITL-6),而不是被本门的 400 遮蔽。
         if (req !== undefined && !binding?.checkpointToken && !binding?.boundCallId) {
             return {
                 status: 400,
@@ -1559,12 +979,6 @@ export function createHttpServer(rawDeps) {
                 },
             };
         }
-        // design/153 件3d parked 赎回腿([1574]/[1584]/[1588] core 裁定;src/parked-decide.ts):该 pending
-        // checkpoint 若属于一个 parked 后台子代,decide 必须走 claim→裸 execute(reviveClaim) 链——legacy 腿的
-        // resumeStream 会绕开 bg registry(无 consumeParkedFlip、行永 parked、生命周期分叉),故 parked-first。
-        // 判别 miss(undefined)= 任务级 suspend,原样落到下方 legacy 腿(零回归)。⚠️ 门在 `req !== undefined`:
-        // 内部 D-D SLA deny-sweep(req 缺席)对 parked 子代 cp 保持现状(getCtx null → 409 跳过本 tick)——
-        // 过期 parked 的收割属 reaper 的 expire+reconcileParkedAgents 车道,sweep 不做重活赎回。
         if (req !== undefined && deps.backgroundAgentStore !== undefined && deps.parkedReviveTool !== undefined) {
             const parked = await decideParkedAgent({
                 agentStore: deps.backgroundAgentStore,
@@ -1576,24 +990,16 @@ export function createHttpServer(rawDeps) {
                 ...(deps.logger ? { warn: (event, fields) => deps.logger?.warn?.(event, fields) } : {}),
             }, {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
-                // #204 件6③:赎回腿是**另一个**结算点,出处同样穿参(它自己不猜)。今天走到这里的恒是人为
-                // /decide —— 上面那道门写着 `req !== undefined`,而 sweep 恰是 req 缺席的那条腿。
                 decision, settledBy, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
-                // remember 的 grant 闭包(onResumeCommitted 的唯一现役来源)在 parked 腿以行的 root/host
-                // 会话为锚透传([1591] 候裁② server 修——落子代会话则探针键永不相交,见 grantOnCommit 注);
-                // answer 原样透传(RB-459,core 5.7.0 起 revive 侧有挂点;形状校验已在路由层 isQuestionAnswer)。
                 ...(onResumeCommitted ? { grantRemember: (rootSessionId) => onResumeCommitted(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
             });
             if (parked !== undefined) {
-                void ctxPromise.catch(() => { }); // 并行 ctx 读不再被消费,吞掉可能的 rejection
+                void ctxPromise.catch(() => { });
                 return parked;
             }
         }
-        // Guard the ctx await too (council): if cpPromise resolved but ctxPromise REJECTS (a TiDB blip on the
-        // checkpoint_ctx read), an unguarded await would escape to the generic 500 — inconsistent with the 409 the
-        // cpPromise branch returns for the same class of transient load failure.
         let ctx;
         try {
             ctx = await ctxPromise;
@@ -1603,18 +1009,7 @@ export function createHttpServer(rawDeps) {
         }
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        // Rebuild taskConfig via resolveSpec with auth reconstructed from the checkpoint (sessionId + scope).
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        // E18: STRIP resumeAt before re-resolving on a durable resume — the leaf is already set by the checkpoint, and
-        // resumeAt + a durable resume is rejected by core (resume_at.conflicts_resume); also avoids re-resolving a stale
-        // anchor (which could 404 if the session was purged). A resume-at run that suspended stored its body with resumeAt.
-        // 对抗评审 2026-07-11(MED):resolveSpec re-runs the ADMISSION gates (scenario/execution ruling — resume does
-        // NOT freeze governance, the established precedent posture; a deny is ALSO a model run, so it is gated too). But an
-        // escaping HttpError here was (a) attributed to the OPERATOR's /decide request as a bare 400/403 — undiagnosable
-        // from that contract — and (b) swallowed by the D-D SLA deny-sweep's catch, silently failing EVERY tick. Fold it
-        // into a typed 409 result instead: the operator sees "this parked task is blocked by a policy change" (retry
-        // after the policy is restored, or let terminal_at_ms abort it); the sweep skips the row this tick (retried next
-        // tick, terminal_at_ms backstop — its documented per-call-failure semantics).
         let spec;
         try {
             spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
@@ -1628,41 +1023,14 @@ export function createHttpServer(rawDeps) {
             }
             throw e;
         }
-        // Typed pre-check: the pending tool must still exist in the rebuilt config; a scenario
-        // redeploy that removed it means the approval can no longer be applied — fail clearly, never a 500/silent.
-        // The "hand" tools are NOT in spec.tools — core mounts them at the runner from the executionEnvFactory
-        // (`HAND_TOOL_NAMES` above = hands-lane.ts `HANDS_BAND_TOOL_NAMES`, the single owner; nothing is mirrored here).
-        // When this deployment has remote exec configured the rebuilt task WILL expose them, so union them in; else
-        // gating a hand tool (the common code-agent case) would always 422 on resume.
-        // #196 旁注:本 union 只看部署有没有 remoteExec,不看本任务的 hands lane —— 对 hands=none 的任务这是
-        // **过近似**(那些工具根本没 mount,也就不可能有它们的 park 行),只影响 422 的 UX 宽严,不放大任何权限。
-        // #244:union 必须是 band **全**名单——effects 表外的挂载补集(Monitor/EnterWorktree/…)当年漏了,
-        // 断连 force-park 人群第一个踩中(approve 恒 422,重呈卡回答永不传导;test legB1-durable 实测指纹)。
-        // [2380] RB-476(5.0.0):Q6 折叠预检退役——满足性匹配按 RAW 名。pre-floor 旧名 checkpoint
-        // (`bash`/`run_workflow` 等)在此 422 诚实拒,与 core 自己的 resume.tool_unavailable 同方向
-        // ([2364] 令:耐久面响亮牺牲 + P-7 重开,不静默兜)。现役名恒自映射。
         const pendingTool = cp.pendingAction.toolName;
         const pendingToolCanon = pendingTool;
         const availableTools = new Set((spec.tools ?? []).map((t) => t.name));
         if (deps.config.remoteExec)
             for (const name of HAND_TOOL_NAMES)
                 availableTools.add(name);
-        // AskUserQuestion (durable ask, TC-5.4) is ALSO not in spec.tools — core mounts it from `onQuestion`
-        // (#152: the QUESTION_AWAITS_RESUME sentinel when no live coordinator is wired, else RunnerDeps.onQuestion's
-        // coordinator serves the seat). Without this it 422s on resume exactly like a hand tool would. Gated on
-        // checkpointStore = durable mode is active.
         if (deps.checkpointStore)
             availableTools.add("AskUserQuestion");
-        // Workflow (codex round-2 on [1245]/[1248]②): `run_workflow` is ALSO mounted at the runner, never in
-        // spec.tools — core mounts it when `spec.selfOrchestration === true` and the deployment wires the workflow
-        // deps (isSelfOrchestrationActive, dist-read). Without this, approving a durably-parked workflow ask
-        // (the new mode-derived leg) 422s here and the suspend can only ever be denied. Same over-approximation
-        // posture as the hand-tools union above (a per-principal allowWorkflows=false revoked between suspend and
-        // approve slips this pre-check; core's own resume path then fails loudly — the pre-check is a UX guard,
-        // not the authority).
-        // A-033.1(#256):名字从 core 的 `RUN_WORKFLOW_TOOL_NAME` 取,不再手抄 —— 手抄的名字在 core 改名后
-        // 与实挂名分家,这一格会把**每一次**已批准的 workflow 赎回打成 422(pendingTool 是实挂名,集合里
-        // 却是旧名),而 task-settings 那三处同族手抄的后果更重(ask/deny 门整条静默不触发)。
         if (spec.selfOrchestration === true && deps.config.selfOrchestrationEnabled) {
             availableTools.add(RUN_WORKFLOW_TOOL_NAME);
         }
@@ -1672,25 +1040,6 @@ export function createHttpServer(rawDeps) {
                 body: { error: `pending action no longer satisfiable: tool "${pendingToolCanon}" is not in the current task config (scenario changed since suspend)`, errorCode: "conflict.pending_action_unsatisfiable" },
             };
         }
-        // Durable-ask request/state coherence (TC-5.4), all pre-CAS so a mismatched request never consumes the
-        // checkpoint:
-        //  - approving a pending AskUserQuestion REQUIRES body.answer. Without it the redeemed call executes against
-        //    whatever question face the rebuilt spec has, and the operator's question is unrecoverably LOST (checkpoint
-        //    consumed, no answer ever delivered). Fail the request instead; the operator retries with the answer.
-        //    🔴 #152: this check is now the ONLY one on this route. core has its own pre-CAS refusal for
-        //    "approve a content-ask with no answer" (runtask.js: `taskConfig.onQuestion ?? deps.onQuestion` is
-        //    `undefined` or QUESTION_AWAITS_RESUME), but on an ASK_QUESTION_ENABLED deployment the spec no longer
-        //    stamps the sentinel and `deps.onQuestion` is the coordinator, so core's condition is never met and it
-        //    does NOT refuse.
-        //    ⚠️ The ORIGINAL rationale — "the redeemed leg would take the coordinator's empty 'no human' default" —
-        //    is DISPROVED and must not be repeated: since #166 QuestionCoordinator never synthesizes an empty answer
-        //    set (every no-human arm returns `{kind:"unavailable"}`), and core 5.16 answers a redeemed AskUserQuestion
-        //    with an isError ("will not silently self-answer") rather than a fabricated verdict. The guard STAYS on a
-        //    cheaper rationale: the checkpoint is consumed by the CAS BEFORE that revive can report unavailable, so
-        //    the operator loses the parked question for a revive that could only fail — refusing pre-CAS costs nothing
-        //    and gives a precise error. Do not delete it (parked twin: src/parked-decide.ts, same rationale).
-        //  - an answer is only meaningful on an approve of a question gate; on a deny or a non-question gate it
-        //    signals the operator is deciding a different pending action than the one parked — reject, don't guess.
         if (decision === "approve" && pendingTool === "AskUserQuestion" && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
         }
@@ -1698,17 +1047,6 @@ export function createHttpServer(rawDeps) {
             return { status: 400, body: { error: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, errorCode: "request.field_conflict" } };
         }
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        // Durable ask (TC-5.4 → RB-459, core 5.7.0): the operator's answer rides the ResumeOutcome — core's
-        // answerFaceForRedeemedCall replays it to the REDEEMED question call only, so a NEW question on the
-        // resumed leg gets an honest error instead of a silently replayed stale answer (which the pre-5.7.0
-        // `onQuestion = async () => answer` closure form did). Absent answer ⇒ outcome unchanged (an F4 tool
-        // approval resumes exactly as before). The onQuestion seat is left alone.
-        // D-1 decision-action binding (core 1.101, design/80 §2): echo the boundCallId + boundInputHash the operator
-        // saw back into the outcome — core verifies opaque STRING equality against the persisted suspend-mint values
-        // (fail-closed, PRE-CAS), so "saw action A, resolve B" is rejected. boundInputHash is NEVER recomputed here
-        // (the engine minted it once via canonical-json; a second runtime re-serializing would false-mismatch and
-        // fail-closed reject a legit approval). Legacy callers that omit the fields fall back to the current persisted
-        // values (no human binding — pre-D-1 behavior). resource_limit pendings carry no action → empty (core gate_mismatch).
         const pa = cp.pendingAction;
         const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
         const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
@@ -1720,74 +1058,24 @@ export function createHttpServer(rawDeps) {
             ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
             ...(reason ? { reason } : {}),
             ...(answer !== undefined ? { answer } : {}),
-            // #204 件6:结算出处逐字上 outcome(见参数顶注)。core 只接受它自己那三个词,server 不派生、不缺省。
             settledBy,
         };
-        // Developer-mode verify (1.44) survives suspend/resume (core `resumeWithVerification`, design/51 P1-b): a
-        // task submitted with verify:true that hit an F4 gate must STILL be gated by the adversarial verifier on
-        // completion — a plain resumeStream would silently drop the gate. The flag rides in the persisted ctx.body
-        // (same source the spec was rebuilt from). Like first-run verify it's multi-attempt (not a live stream), so
-        // we await the result + write a single terminal event rather than streaming post-resume deltas.
         const verifyRounds = verifyRoundsFromBody(ctx.body);
-        // taskId up-front: the resumed leg streams its post-resume events into the SAME durable run log, CONTINUING
-        // the seq past the suspend (core 1.70 `resumeStream`) — so GET /v1/runs/:id/events covers post-resume too,
-        // observability parity with runInBackground (closed by core 1.70).
-        // ── Drive the resume into the durable run log via the SHARED machinery (driveResumeIntoRunLog): markResuming
-        // CAS, the cancel + preempt controllers (same-replica fast path + cross-replica flag polls), the resume
-        // heartbeat, the resumeStream / resumeWithVerification loop, CheckpointError classification, re-suspend vs
-        // terminal drive. This HITL /decide path supplies a `policy_ask` outcome; the scheduler preempt path supplies
-        // a `resource_limit`/continue one — sharing this prevents the two resume entries from drifting.
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(onResumeCommitted ? { onResumeCommitted } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}) });
     }
-    /**
-     * The resume-drive machinery SHARED by `resumeCheckpoint` (operator /decide, `policy_ask`) and `resumePreempted`
-     * (scheduler resume, `resource_limit`/continue). Given the already-located `token`, the rebuilt
-     * `taskConfig`/`resumeObjective`, the gate-specific `outcome`, and optional `verifyRounds`, it: markResuming-
-     * CASes the parked row to `running` (idempotent across replicas), registers the leg in BOTH `inflightRuns`
-     * (cancel) and `preemptableRuns` (re-preempt) for the same-replica fast path, runs a heartbeat that polls the
-     * durable cancel + preempt flags (cross-replica), resumes via resumeStream / resumeWithVerification threading a
-     * FRESH cancel signal AND a FRESH preemptSignal (so a resumed leg is itself cancel-able + RE-preempt-able —
-     * never the consumed suspend-time signal), classifies a CheckpointError, handles a re-suspend
-     * (setSuspended, keep the lock) vs a terminal (setTerminal), and returns the HTTP {status, body}.
-     *
-     * #316:**200 受理形的分派器**。`args.acceptEarly !== true` ⇒ 逐字旧行为(整条腿 await 完再回)。
-     * 传 `true` ⇒ 在受理点(`driveResumeLeg` 里 `resumeStream` 解析之后)先把受理体交回,模型腿继续在
-     * 同一条 promise 链上跑完。判据(受理点为什么在那里、哪三类判定必须留在同步侧)见
-     * {@link DriveResumeArgs.acceptEarly} 的顶注 —— 那是这条语义的唯一属主,别在这里第二次成文。
-     *
-     * 🔴 **受理之后的失败绝不静默**:HTTP 已经走了,行/账本是权威可见面(腿内部各分支照旧驱行终局),
-     * 但那条链的**结局**在这里必须留痕 —— 否则「受理了然后呢」在遥测里没有任何线索。
-     *
-     * 🔴 **如实登记的一条能见度差额**(codex 对抗复审 R1-[high],验真后按真形收窄):受理之后**行驱动写**
-     * (`setTerminal`/`setSuspended`,腿尾那段)如果自己炸了,调用方拿不到任何东西 —— 修前那一形是 500。
-     * ⚠️ 但**持久状态的分歧是既存的、两形逐字相同**:同步形下 500 并不会修好任何东西(账本可能已落
-     * `done` 而行仍 `running` 且攥着 session claim,靠 reapStale 收;LOCAL/file 车道无周期腿 ⇒ 上界 ∞,
-     * [4664]② 洞 (d))。⇒ 本批的真差额 = **调用方能见度**,不是新增的数据分歧;补偿 = 下面这条 error 级
-     * 留痕 + `resume_post_accept_failed_total` 计数(受理前的 4xx **不**计入,见 `accepted` 标志)。
-     * 真正的根治(受理前durable 记一条可续的续跑意图 + 行驱动重试对账)是**另一批**的设计件,已上报。
-     */
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
             return await driveResumeLeg(args);
         let settleAccepted;
-        // 🔴 codex 对抗复审 R1-[medium](验真后修):遥测必须能分辨「受理前的正常拒绝」与「受理后的脱手
-        // 失败」。处理器挂在 race **之前**(它必须无条件挂:否则受理前就 reject 的腿会变成进程级
-        // unhandledRejection),所以判别位不能靠「处理器有没有跑」——用受理回调**同步**置起的这个标志。
-        // 没有它:每一次 429 admission 拒 / 409 CAS 输 / pre-CAS 绑定不符都会被记成「受理后失败」,把这条
-        // 新信号淹掉(常态冲突远多于真脱手失败)。
         let wasAccepted = false;
         const accepted = new Promise((resolve) => { settleAccepted = resolve; });
         const leg = driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); });
         void leg.then((out) => {
-            // 受理前的 4xx = 正常的同步拒绝(它就是调用方拿到的那个响应),不是本信号的事。
             if (wasAccepted && out.status >= 400) {
                 deps.logger?.warn?.("resume_leg_failed_after_accept", { sessionId: args.sessionId, status: out.status, body: out.body });
                 deps.metrics?.inc("resume_post_accept_failed_total");
             }
         }, (err) => {
-            // 腿内部对「普通异常」已经驱行终局(claimedRow 守卫那支),这里补的是**可观察性**那一半。
-            // 受理**前**抛的(race 会把它原样传给调用方 ⇒ 500)同样不计入本信号——那条路的可观察性归
-            // 路由层的错误面,重复计数只会让「脱手失败」这个读数失去判别力。
             if (!wasAccepted)
                 return;
             deps.logger?.error?.("resume_leg_threw_after_accept", { sessionId: args.sessionId, err: err instanceof Error ? err.message : String(err) });
@@ -1795,33 +1083,15 @@ export function createHttpServer(rawDeps) {
         });
         return await Promise.race([accepted, leg]);
     }
-    /**
-     * {@link driveResumeIntoRunLog} 的**腿本体**(实现逐字未动,只多了一个受理回调)。
-     *
-     * `onAccepted` = #316 的受理点回调:在 `resumeStream` 解析之后、流迭代之前触发**一次**(有 run 行时
-     * 才触发 —— 没有行就没有可 poll 的终态面,那时提前受理等于把结果扔了)。缺席 ⇒ 全同步旧形。
-     */
     async function driveResumeLeg(args, onAccepted) {
-        // #196:`runner` = 本次续跑的执行 Runner(场景 hands 判别位裁定,与首跑同源;见 DriveResumeArgs 注)。
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds } = args;
-        // ── #151 车3 刀 3b:resume 腿的 `legKey` 真值(设计稿 §3.2′)──────────────────────────────────
-        // 一次 park→resume 的 checkpoint token **就是**这条腿的天然身份:同一 token 重投 = 同一条腿(幂等,
-        // askId 不变);新 park ⇒ 新 token ⇒ 新腿 ⇒ 新 askId ⇒ **重新征询**(§3.3「resume 只重放未完成兄弟」)。
-        // 🔴 存**摘要**不存原文:token 是能力凭据(本仓有 `stripCheckpointToken` 专门把它从可重放账本/结果里
-        // 剥掉),而 `askId` 是 wire 可见值 —— 摘要单向,原始 token 不进任何行、不进任何帧。
-        // 入口算一次(这里就是唯一持有 `args.token` 的地方),下面随 ctx 走。
         const legKey = createHash("sha256").update(String(token)).digest("hex");
-        // §7.3:本 leg 的 walltime deadline —— 取值点 = 本腿开始执行之前(`resumeStream` 调用在下方)。
-        // 与 sync/bg 两腿同一条判据:只在协议上场时供值,误差方向偏短(安全侧),理由见 routes/tasks.ts 同处注。
         const streamApprovalOn = resolveStreamApprovalGate({
             toolApprovalEnabled: Boolean(deps.toolApproval),
             streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
             backend: deps.backend,
             parkFacility: deps.checkpointStore !== undefined,
         }).active;
-        // 🔴 codex 交叉复审 F4(2026-08-06 真 finding)的修:本腿此前**无条件**包 approval ALS(只把新协议的
-        // 口与轴挂在 `streamApprovalOn` 后面)⇒ ①协议关时本腿凭空多了一条活卡投递路(此前恒 park,A-1 破)、
-        // ②窗=0 在本腿上不生效。裁定走**三腿共用**的 `resolveApprovalLeg`,一份判据三处消费。
         const approvalLeg = resolveApprovalLeg({
             streamApprovalOn,
             windowMs: deps.config.streamApproval?.windowMs ?? 0,
@@ -1830,11 +1100,6 @@ export function createHttpServer(rawDeps) {
             nowMonotonicMs: performance.now(),
         });
         const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-        // 🔴 复审 C2:lease admission for EVERY resume family (/decide, /answer, /plan_review, preempt-resume)
-        // funnels through here — keyed on `principal` = the CHECKPOINT OWNER, the SAME identity the resumed model spend
-        // is billed to via `withPrincipal(principal)` below. The route guards deliberately do NOT lease-gate (they'd
-        // key on the request principal = a possibly-cross-tenant operator). A live lease admits locally; center-judged
-        // exhaustion of the OWNER's budget returns 429 (mirroring leaseDenied's shape); an unreachable center fails open.
         if (deps.fleetLease && principal) {
             const adm = await deps.fleetLease.admit(principal);
             if (!adm.ok) {
@@ -1843,20 +1108,7 @@ export function createHttpServer(rawDeps) {
             }
         }
         let taskId = await deps.runStore?.getActiveTaskId(sessionId);
-        // [3829]/[3830] wake 腿(mintFreshRun 声明位):task_done 纯 park 的终局 finalize 已删 task_active
-        // claim——本腿在此恒拿不到 taskId,曾经整腿无行裸跑(不可取消/无计费归因/无 durable append/fleet
-        // 不可见),而 core `spec.taskId ?? sessionId` fallback 还会把 lastRunId 铸成 sessionId(续听恒 404,
-        // cli 7.18 提货围栏首撞)。wake 续跑=同 session 新一轮 turn(原任务已终局),正确形=铸新 canonical
-        // taskId + createRun 全生命周期行;createRun 的 task_active 唯一键 claim 同时补上 double-text 互斥
-        // (getActiveTaskId 读后另一提交抢建行的竞态窗 ⇒ 与 sync 腿同形 409 真出路)。未声明该位的腿
-        // (decide/answer/plan_review)语义不变:claim 缺席=行被 reap 的竞态,checkpoint token 同拍过期兜底。
         let freshRunClaimed = false;
-        // 🔴 codex R1-F1(2026-08-14):mintFreshRun 腿对「claim 有值」**只有 409 一条出路**,绝不落入下方的
-        // markResuming 复用臂。本腿的 park 是终局后纯 park——它自己的行早已终局并释放 claim,此刻 claim 里
-        // 的必是**别的 run**(典型:task_done park 之后同 session 又提交了新任务且其已 park 成 suspended,
-        // claim 保留)。旧路径会用**本 park 的旧 token**对**对方的行**赢下 markResuming CAS 并驱动续跑——
-        // 错误终局化对方的行、孤儿化对方仍 pending 的卡(checkpoint 表无 per-session pending 唯一约束,
-        // findPendingTokenBySession 又是无序 LIMIT 1,两条 pending 并存时旧 task_done park 完全可能被选中)。
         if (args.mintFreshRun && taskId && deps.runStore) {
             return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, taskId) };
         }
@@ -1872,54 +1124,23 @@ export function createHttpServer(rawDeps) {
             taskId = freshId;
             freshRunClaimed = true;
         }
-        // MF-Fleet (TOC review #7): a HITL resume (/decide, /answer, /plan_review, /preempt-resume, /wake) drives the
-        // SAME durable run row that suspended — so it must re-publish to the fleet bus under the SAME runId, or the run
-        // VANISHES from GET /v1/fleet/stream the moment it resumes (the original publisher's row was last touched at
-        // suspend; nothing keeps it live or settles it after). Reuse `taskId` (the existing suspended run id) so the row
-        // RE-APPEARS as the same fleet row; scope = `principal` (the checkpoint/run-owner scope persisted at suspend —
-        // the original submitter, NOT spoofable; matches the run row's owner). rootTaskId = taskId(codex F3,2026-08-13):
-        // resume 的 taskConfig 自此携带 spec.taskId=run 行 id(下方注入点),core canonical 随之——[3806] 修完 sync
-        // 两腿后本腿曾是最后一条 sessionId fallback 腿(resume 后 noteTaskRun 再铸 lastRunId 污染)。No-op when no
-        // fleetBus / no taskId.
-        // 🔒 scope = `fleetScope` (the VERIFIED `gatedPrincipal(req)` the calling route computed) — the SAME identity
-        // GET /v1/fleet/stream filters by, mirroring the create-path #6 fix. NOT `principal` (= the spoofable
-        // checkpoint/auth header from `principalFrom`): a spoofed header would re-publish the resumed row under a
-        // victim's scope (cross-tenant leak) or under "default" while the real owner's stream filters it OUT (the row
-        // vanishes on resume). Tenant-isolation parity with the stream filter on the direct resume door (TOC review #6).
-        // onForwardEvent parity: core 1.210 added the RunInternals 4th arg to `resumeStream` — the
-        // resume leg now feeds the forward sink like the sync/bg legs (fleet child rows at any depth + the durable
-        // task_progress append; see the resumeStream call in driveResume).
         const fleetPub = taskId && deps.fleetBus
             ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, ...fleetRunLabels(resumeObjective) })
             : undefined;
-        // codex F3(2026-08-13):resume 重建的 taskConfig 必须携带 run 行 tid——缺席时 core `spec.taskId ??
-        // sessionId` fallback 喂 noteTaskRun,resume 一次 lastRunId 就再被污染成 sessionId([3806] sync 两腿
-        // 修复的 resume 腿孪生)。canonical taskId 迁移的三个同源消费点(fleet rootTaskId / stoppedBy owner /
-        // model-usage 归因键)本批同改,勿单点回退。
         const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
-        // C (TOC adversarial review): settle the resumed fleet row EXACTLY once. A plain Error thrown out of the
-        // resume (not CheckpointError/cancel) hits the catch's `throw e` BEFORE the final onTerminal below → the
-        // re-published row leaks as a stale "running". Route every onTerminal through this guard so the finally can
-        // settle a row no branch reached, without double-settling one that did.
         let fleetSettled = false;
         const settleFleet = (status, residuals) => {
             if (fleetSettled)
                 return;
             fleetSettled = true;
-            fleetPub?.onTerminal(status, residuals); // [1839]①/(a):真终态帧带残局键(publisher 侧对 parked 再挡一层)
+            fleetPub?.onTerminal(status, residuals);
         };
         let result;
-        // [1245] codex-5: the resume.* code ALONE does not prove the reopen landed — installed core (1.330) only
-        // rewrites to checkpoint.reopen_failed when store.reopen returned FALSE; a THROWING reopen (plain DB error)
-        // keeps the resume.* code with the checkpoint still resolved. Confirm against the store before re-parking:
-        // this token pending again ⇒ real re-park; not pending ⇒ fall through to the terminal/done leg; probe error
-        // ⇒ re-park anyway (the safer side under uncertainty: a wrongly-suspended row is reaper-bounded
-        // (reapSuspended), a wrongly-terminal row orphans a live park until TTL — the round-3 bug shape).
         let reopenConfirmedPark = false;
         const confirmCheckpointReopened = async () => {
             const store = deps.checkpointStore;
             if (!store)
-                return true; // durable resume required the store; absence here = cannot confirm → the safer side
+                return true;
             try {
                 return (await store.findPendingTokenBySession(sessionId)) === token;
             }
@@ -1927,59 +1148,22 @@ export function createHttpServer(rawDeps) {
                 return true;
             }
         };
-        // Protect the in-flight resume from the reaper: flip the parked row to `running` + heartbeat for the
-        // duration of the resume. The run row otherwise stays `suspended`/updated_at=suspend-time the whole time
-        // (resume neither rewrites the row nor heartbeats), so `reapSuspended` would mark a live resume `failed`
-        // and release its session lock once it crossed the approval TTL. Cleared in the finally below.
         let resumeHeartbeat;
-        let resumeManifestLease = 0; // [998]②: this leg's tracker lease (assigned at register, checked by the finally's clear)
-        // 1.78 (review LOW, pre-existing): THIS leg's live TaskStream — held so the finally can identity-guard its
-        // steerableRuns deregistration (an unconditional delete could clobber a handle a FASTER sibling leg just
-        // registered under the same taskId across a suspend→fast-resume).
+        let resumeManifestLease = 0;
         let resumeStreamRef;
-        let resumeLegLive = false; // true only while the resumed leg is live (set at resumeStream, cleared in the finally)
-        // design/122 ③: this leg's subagent-handle unregister thunks — run at leg end (finally), not on settle.
+        let resumeLegLive = false;
         const subagentHandleEvictions = [];
         let claimedRow = false;
-        // Cancel parity with runInBackground: the resumed leg is registered in `inflightRuns` (same-replica fast
-        // path) and its heartbeat polls the durable cancel flag (cross-replica) — without this a resumed run was
-        // un-cancellable (cancel 202'd + flagged the row, but nothing honored it). markResuming reset the flag,
-        // so only a cancel issued DURING this leg aborts it.
         const cancelCtrl = new AbortController();
-        // 🔴 stoppedBy 归因的注册点在**下面**(markResuming 认领成功之后),不在这里 —— #168 件3,见那里的注。
-        // design/80 seam #2: a resumed leg is itself preempt-able. Register a FRESH preempt controller (markResuming
-        // also reset preempt_requested), thread a LIVE preemptSignal into the resume taskConfig below, and poll the
-        // durable preempt flag in the heartbeat — so the scheduler can preempt the RESUMED work once it makes
-        // progress. 🔴 Never re-supply the consumed suspend-time signal (core strips a pre-aborted one).
         const preemptCtrl = new AbortController();
         if (taskId && deps.runStore) {
-            // The CAS fails (false) only if the row is no longer `suspended` — the reaper already expired this
-            // approval (and released the session lock), the run is terminal, or a concurrent resume already claimed
-            // it. Bail rather than run a resume whose run row is gone / a sibling owns; the checkpoint reaper expires
-            // the token in the same tick so resumeStream would reject anyway. Closes the window the heartbeat can't.
-            // [3829]:fresh 行由上面的 createRun 事务铸出即 `running` + claim 在手——markResuming 的 CAS 只认
-            // suspended/needs_review,对它恒败;跳过=行本来就是本腿自己的,资格等价于 CAS 赢。
             claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId);
             if (!claimedRow)
                 return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
-            // stoppedBy — resume leg NOW marked (core 1.256 delivered the mark-by-owner seam): codex F3(2026-08-13)
-            // 起本腿 canonical taskId == run 行 taskId(resumeTaskConfig 注入 spec.taskId),task-scoped 子代的 owner
-            // 键值随之与 session-scoped 的分开——但 seam 仍按 EXPLICIT flag 过滤(`skipSessionScoped:true` inside
-            // the helper),only task-scoped children take the "user" marker; session-scoped ones a cancelled parent
-            // deliberately does NOT stop stay unmarked (CC Backgrounded semantics). Owner = taskId(this leg's
-            // canonical key since the F3 injection), NOT sessionId.
-            //
-            // 🔴 位置(#168 件3,与 /v1/tasks/stream 同族):归因规则只有**抢到这条 run 的腿**才有资格挂 ——
-            // `markResuming` 输掉的那一支(别的副本已经在 resume,或行已被 reap)在上面就 409 走人,从此一次
-            // 都不注册。本腿此前把它挂在 CAS 之前,只是因为 `cancelCtrl` 的唯一 abort 源(inflightRuns / 心跳
-            // 轮询)也都在 CAS 之后注册才没出事 —— 那是巧合不是保证。
-            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal); // owner=canonical taskId(codex F3:resumeTaskConfig 带 spec.taskId=run 行 id,core 子代 owner 键随之;此臂在 if(taskId) 块内恒真)
-            // MF-Fleet (#7): the row is now `running` again → re-publish it LIVE to the fleet (re-appears as the same row
-            // that was sitting "waiting" while parked). After onStart only — never if markResuming lost the CAS (a sibling
-            // owns the row). onTerminal at every settle below keeps the row's lifecycle in lock-step with the run-store row.
+            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
             fleetPub?.onStart();
             const rs = deps.runStore;
-            const owner = principal ?? null; // the resumed run's owner (the original submitter) — single-DB null-safe guard
+            const owner = principal ?? null;
             inflightRuns.set(taskId, cancelCtrl);
             preemptableRuns.set(taskId, preemptCtrl);
             resumeHeartbeat = setInterval(() => {
@@ -1994,98 +1178,39 @@ export function createHttpServer(rawDeps) {
                 }
             }, HEARTBEAT_MS);
             resumeHeartbeat.unref?.();
-            deps.modelUsage?.register(taskId); // E8 leak fence: track the resumed leg's brain.calls (sub-tasks excluded); cleared in the finally
-            resumeManifestLease = deps.promptManifests?.register(taskId) ?? 0; // [998]②: the resumed prepare re-fires prompt.assembled — this leg drains its own manifest; lease guards the finally's clear (B-3 window)
+            deps.modelUsage?.register(taskId);
+            resumeManifestLease = deps.promptManifests?.register(taskId) ?? 0;
         }
-        // codex M2 hook point: the CAS (when a run row exists) is decided above — a lost race already returned 409 and
-        // never reaches here. Awaited BEFORE the model drive so the resumed leg's first ask observes the side-effects.
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
-        // #310 `engine_notice` wire 腿(三腿之一:**resume**)。声明在 try 之外、赋值在 `append` 铸出之后
-        // (账本写口在 withPrincipal 闭包里才成形),注销在下方同一个 finally —— 任何退出路径都过它。
         let unregisterEngineNotice;
         try {
-            // Wrap in withPrincipal so the resumed leg's LLM spend is attributed to the tenant's CostQuota — parity
-            // with the sync/async paths (council: otherwise maxPrincipalCostUsd is silently bypassed on resume).
             result = await withPrincipal(principal, async () => {
-                // P1 ①② follow-on: drain the async-workflow completion inbox on the RESUME leg — hoisted
-                // ABOVE the verify/stream fork so BOTH resume flavors get it (parity with runs.ts, whose drain runs
-                // "before ANY branch"; review round 2 caught the verify-leg gap). A workflow that finished while this run
-                // sat suspended surfaces as a durable `workflow_complete` event the tailing client replays (at-least-once
-                // + shell runId-dedup). Owner gate = the original submitter (the checkpoint scope) — the identity the
-                // entries were stamped with at enqueue. 🔒 ONLY when a durable log exists (`deps.runStore && taskId`):
-                // without one there is nowhere to persist the frame, and `drain` REMOVES entries — draining there would
-                // EAT the completions. One-shot appender off maxSeq; each branch below re-reads maxSeq, so seq stays safe.
-                // option A: keys this leg already delivered (turn-open drain, loop case OR observer) — hoisted ABOVE the
-                // drain so the drained frames' keys register here too (core [784]④b: the same idle-arrival is also parked
-                // core-side; its pend-drain replay rides the resumed stream as a task_notification event — the loop's key
-                // check below folds that second durable append). codex F1: NotifiedKeys — the observer arm appends
-                // fire-and-forget, so claims carry the write's outcome promise (bg-leg twin's rationale).
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
                     const rs0 = deps.runStore;
                     let drainSeq = (await rs0.maxSeq(taskId)) + 1;
                     await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, sessionId, principal ?? null, (frame) => {
-                        // 🔴 本仓唯一的**动态**账本写口:`type` 逐字来自 core 帧,不是本仓字面量,所以闭集
-                        // `LedgerEventType` 在这里只能是**声明**而非证明(A-032 P1-③ 射程上限,ledger-events.ts 顶注
-                        // 有同款自陈)。今天这条腿产出的是 `task_notification`;core 换帧名时**本处不会红**,对齐由
-                        // core 帧集的消费门(`trace/core-keyset-guard.ts` 一族)负责。
                         const { type, ...rest } = frame;
-                        // codex F1 + 修2(三路复审 notify-1):the claim must carry the WRITE OUTCOME, not a pre-resolved
-                        // true — a transient append failure with a `Promise.resolve(true)` claim would fake-suppress the
-                        // stream/core-side replay of the SAME key while the durable row never landed (the un-acked inbox
-                        // entry re-delivers next leg, but this leg's replay was eaten). Mirror of the bg-leg/runs.ts twin.
-                        // codex F2: task_type rides the key (external 帧独立键域 — bg twin's note).
                         const f = frame;
                         const write = rs0.appendEvent(taskId, drainSeq++, type, rest);
                         if (f.type === "task_notification" && f.task_id)
                             resumeNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
                         return write;
-                    }, 
-                    // emit-target diagnostics — this drain appends to the resumed run's durable event log
-                    // (a tailing GET /v1/runs/:id/events client replays it; nothing is written to a live socket here).
-                    { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
+                    }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
                 }
-                // Verify task → resume AND re-gate (core resumeWithVerification): resume the impl, and if it COMPLETES
-                // run the identical adversarial verifier + fix loop; if it re-suspends it comes back failed-with-token
-                // (handled like any re-suspend below). 🔴 Freshness (BUG5, design/53 §2.B): we pass NO `evidence` diff,
-                // so the verifier judges the POST-resume working tree directly — there is no stale pre-suspend diff to
-                // grade, which closes the "approve then plant a backdoor" window by construction.
                 if (verifyRounds !== undefined) {
-                    // ── #253(core 5.33.0 #246 提货):**这条腿的供给座席**。5.32 及以前 `resumeWithVerification`
-                    //    的签名里没有 internals 那一位 ⇒ 带 verify 的 resume 对子代进度 / 活性 / bg 终态通知全盲
-                    //    (旁边 resumeStream 臂自 core 1.210 起就有);5.33.0 开了尾可选 `internals`,逐字转发给
-                    //    **恢复实现腿 + 验证器腿 + 每一轮修复腿**。这里把 resumeStream 臂**同一套**供给链接上去。
-                    //    ⚠️ `isolation` 一位永不传(core 在这道门上双相位响亮拒 `config.verify_internals_invalid`)。
                     const rsV = deps.runStore;
-                    // 🔴 **本臂的账本写口 = 共享 `LedgerSink`**(codex 对抗复审 R1 [high],验真后修)。为什么是它
-                    //    而不是在这里手写三行 append:
-                    //     ① **提交序 == 序号序**:sink 的单写串行链在**链步内**分配序号(它的 [1.211 codex H2] 注)。
-                    //        此前这条臂的 forward 写是 fire-and-forget、终局/manifest 是 awaited,各自独立发起 ⇒
-                    //        池化 SQL 后端上**高序号可以先提交**,游标读方(`afterSeq`)推进过去之后,迟到的低序号
-                    //        行**永久读不到**;
-                    //     ② 序号**一次铸定**:此前在腿跑完之后才 `maxSeq()+1` 现读,与运行期的 forward 写撞号 ——
-                    //        改成腿开跑前读一次当**基址**,sink 的 1..N 加上去(零 forward 帧时与旧写法逐字等价);
-                    //     ③ forward 帧的**投影**(task_progress / tool_start / tool_end 三型 + 白名单 builder + §E1
-                    //        脱敏)也归它,本臂不再抄一份 —— 三腿同源正是那个模块存在的理由。
-                    //    ⚠️ **不设「终局即封口」的准入闸**(codex R1/R2 都提了「终局后不该再落行」,**验真后驳回**):
-                    //    本仓已有属主裁定 —— `runs-coverage` 的 [1840]§三定性钉(mock-anthropic 确定性复现器取证):
-                    //    `run_in_background` **收养形**子代的整个生命周期在宿主腿终态**之后**,live 流按设计 terminal
-                    //    break,帧**照落账**、消费端 done 后重拉即全见;「leg teardown 撕掉 sink」对那一族子代就是
-                    //    **真丢帧**(施工期实测:在 bg 腿加同款围栏,那条钉当场红)。⇒ 本臂与 bg 腿同一条语义:
-                    //    晚到照落、序号单调。
                     const vSeqBase = rsV && taskId ? await rsV.maxSeq(taskId) : 0;
                     const verifySink = createLedgerSink({
                         appendEvent: (seq, type, data) => (rsV && taskId ? rsV.appendEvent(taskId, vSeqBase + seq, type, data) : Promise.resolve()),
                         persistThinking: deps.config.traceThinking,
-                        notifiedKeys: resumeNotifiedKeys, // 与本腿其余臂共享「已投递的通知键」(bg 腿同款)
+                        notifiedKeys: resumeNotifiedKeys,
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                     });
                     const vAppend = (type, data) => verifySink.append(type, data);
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
-                        // 活性打点:这条臂没有事件循环(stream 臂的 `recordTurnActivity` 在 for-await 里),
-                        // 不接 ⇒ 一条长跑的 verify-resume 腿在活性面上从 suspend 那刻起就冻住。
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -2100,32 +1225,15 @@ export function createHttpServer(rawDeps) {
                                     }
                                 }
                             }
-                            // 三型投影 + 白名单 builder + 单写串行链全在共享 sink 里(见上面的顶注);写失败留痕由
-                            // sink 自己的 catch 兜(它对失败步不断链)。
                             if (rsV && taskId)
                                 verifySink.onForwardEvent(e);
                         },
-                        // 🔴 **#255(core 5.34.0 #253 / 判据帖 [3967] G1):status 第五席**。这条臂没有事件循环 ——
-                        //    旁边 resumeStream 臂的顶层 status 走它自己那条 for-await 的 `case "status"`(driveResume
-                        //    switch),本臂在 5.33 时代整段重试期是**黑的**(座位那时还不存在)。core 5.34.0 的
-                        //    `statusEmit` 双写(queue 照旧 + 座位喂**同一个** frozen 帧)把这条腿补齐,这里接的是
-                        //    **同一条**投影链:`brain_retry_total` 计数 + 共享 `verifySink` 的白名单 builder/单写串行链。
-                        //    ⚠️ 帧 frozen ⇒ 这条链上不许写帧字段;同步回调不能 await ⇒ fire-and-forget。下面那个
-                        //    `.catch` 买的是**留痕**不是进程安全:`appendStatus` 返回的链步在 `LedgerSink.append` 内部
-                        //    已被挂上处理器(「失败不断链」)⇒ 没有逃逸的 rejection(实测:摘掉它 §4⑥b 仍绿);
-                        //    判别力由 §4⑥b 的「诊断行在场」断言看守(与 `src/runs.ts` 的 `statusSeat` 同款注)。
-                        //    ⚠️ 与 `src/runs.ts` 的 `statusSeat` 同一条纪律:**只**挂在「只回结果」的这条臂上,
-                        //    旁边 resumeStream 臂那只 internals 不带它(带了就是同一帧两行账本 + 计数翻倍)。
-                        //    🔴 走 sink 的 **`appendStatus` 同步入链门**,不是 `onEvent` —— 后者先 `await flush()`
-                        //    才入链,同一拍后到的 `onForwardEvent`(同步入链)会抢到更小的序号,账本时间线倒挂
-                        //    (codex 对抗复审 R2 [medium],红先复现后修;本臂与 `src/runs.ts` 的 `statusSeat` 同病同修)。
                         onStatusEvent: (e) => {
                             deps.metrics?.inc("brain_retry_total", { phase: String(e.phase) });
                             if (rsV && taskId) {
                                 void verifySink.appendStatus(e).catch((err) => deps.logger?.warn?.("status_event_append_failed", { route: "resume-verify", taskId, err: err instanceof Error ? err.message : String(err) }));
                             }
                         },
-                        // bg 子代终态:与 resumeStream 臂逐字同款(理由全在那份孪生注里)。
                         onTaskNotification: (n) => {
                             if (n.task_type === "workflow")
                                 return;
@@ -2146,7 +1254,6 @@ export function createHttpServer(rawDeps) {
                                 }
                             }
                         },
-                        // 子代 steer 句柄登记:与 resumeStream 臂同款(腿末尾统一撤,见 finally)。
                         ...(deps.subagentSteerRegistry && taskId
                             ? {
                                 onSubagentSpawn: (handle) => {
@@ -2155,122 +1262,64 @@ export function createHttpServer(rawDeps) {
                             }
                             : {}),
                     };
-                    // resumeWithVerification runs the SAME pre-CAS guard + atomic CAS as resume() internally, so a lost
-                    // CAS rejects with CheckpointError before any work — handled by the catch below, same as the stream path.
-                    resumeLegLive = true; // 与 stream 臂同义:腿在跑 ⇒ bg 终态走 live 落账而非 durable park(finally 清)
-                    const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals); // 快审 F1:整对象直传;codex F3:带 taskId 的形
+                    resumeLegLive = true;
+                    const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
                     let safe = stripCheckpointToken(vr);
-                    // 🔴 A re-suspend on a LATER gate is NOT terminal: core maps it to status:"failed" +
-                    // verification.unverifiedReason with the checkpoint token still live. Treat it exactly like
-                    // the stream path's park branches — write the matching park event and return the park status so the
-                    // outer block calls setSuspended/setNeedsReview (keeps the session lock + resumable row). Driving it
-                    // terminal would release the lock and orphan the second checkpoint (next /decide → 409, task abandoned).
-                    //
-                    // 🔴 park 是**两个词**(扫描P2,status/kind 同名词混淆病族),而且判据必须取 **errorCode** 而不是
-                    // `verification.unverifiedReason` —— 完整理由(含修复轮那条 reason 恒缺席的腿)见
-                    // {@link nestedParkStatusOf} 的顶注,它是这条判据的唯一属主。只认 `unverifiedReason === "suspended"`
-                    // 会漏掉两类真 park:plan_review / dry_run 的 `needs_review` 再停,以及 verifier 判 FAIL 后修复轮
-                    // 的**任一**再停 —— 两类都会被写成 `done` + setTerminal:锁被释放、活卡成孤儿。
-                    // ⚠️ `verifier_paused` 不进这个集合:那是**验证器自己**的会话/凭据(见 core `VerificationOutcome
-                    // .verifierPause`),本 run 的活已经做完,与「本 run 再停在自己的门上」是两件事。
                     const reParkStatus = nestedParkStatusOf(vr);
                     const reSuspended = reParkStatus !== undefined;
-                    // [1245] codex-4: reopen-class twin of the stream path (store-confirmed, codex-5) — the checkpoint
-                    // is pending again, so the durable log must record a park, never `done` (the outer row drive
-                    // re-parks via checkpointReopened; the response keeps status:"failed"+retriable, unlike reSuspended
-                    // which surfaces "suspended").
                     const vrReopened = isCheckpointReopenedFailure(vr) && (await confirmCheckpointReopened());
                     if (vrReopened)
                         reopenConfirmedPark = true;
                     if (taskId && deps.runStore) {
                         const rs2 = deps.runStore;
-                        // codex-6/7 (vrReopened leg): EVERYTHING here is observability — best-effort once the reopen is
-                        // confirmed (maxSeq + manifest + usage + suspended event): a thrown append must not rethrow past
-                        // the authoritative row re-park below (stream twin). reSuspended-only keeps its fail-loud shape.
                         try {
-                            // #253:序号来自腿开跑前铸的**同一个**分配器(`vseq`/`vChain`),不再在这里二次 `maxSeq()`
-                            // ——腿运行期间 forward sink 可能已经写过行,二次现读会与那些 fire-and-forget 写撞号。
                             const ap = vAppend;
-                            await appendPromptManifest(ap, deps.promptManifests, taskId); // [998]②: the verified-resume leg has no stream — persist the re-fired manifest before its terminal/suspend event
+                            await appendPromptManifest(ap, deps.promptManifests, taskId);
                             if (reSuspended || vrReopened) {
-                                await appendModelUsageDelta(ap, deps.modelUsage, taskId); // E8: persist pre-re-suspend per-model usage
-                                // reopen 腿恒落 `suspended`(它不是 gate 再停,是同一张卡被重开);reSuspended 腿按真 park 词落名。
-                                // [4913]:再停事件带待批 toolCallId(源=新 checkpoint 的 pendingAction;tool-less/读失败=键缺席)。
+                                await appendModelUsageDelta(ap, deps.modelUsage, taskId);
                                 const vrParkCallId = reSuspended ? await parkToolCallId(vr, deps.checkpointStore) : undefined;
                                 await ap(reSuspended ? reParkStatus : "suspended", { gate: vr.checkpointGate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: vr.errorCode ?? null } : {}) });
                             }
                             else {
-                                // E8: this verified-resume leg is the run's final done → flush the last delta + SUM model_usage into stats.modelUsage
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
-                                await ap("done", { result: safe }); // verify is not a live stream → one terminal event
+                                await ap("done", { result: safe });
                             }
                         }
                         catch (e) {
                             if (!vrReopened)
-                                throw e; // best-effort ONLY on the confirmed-reopen leg — see the boundary note above
+                                throw e;
                         }
                     }
                     if (reSuspended)
                         return { ...safe, status: reParkStatus };
-                    // Count the gate verdict only when the verifier actually ran (a re-suspend never reached it).
                     if (vr.verification?.verdict)
                         deps.metrics?.inc("verifications_total", { verdict: vr.verification.verdict });
                     return safe;
                 }
-                // resumeStream runs the SAME pre-CAS guard + atomic CAS as resume(), then returns a live stream; a
-                // lost CAS rejects (CheckpointError) BEFORE any stream → never re-runs a resolved action.
-                // E23: core's resumeStream is EAGER (runtask.js:1710 — once it resolves the resumed run is already
-                // executing), so the per-run elicitation context MUST exist BEFORE the stream is created, or an inbound MCP
-                // elicitation early in the resumed leg finds no ALS store and fail-closed declines. Hoist the durable-append
-                // machinery, then create + drain the stream INSIDE runWithContext (emit = append → events tail). The owner is
-                // the ORIGINAL submitter (`principal` = the checkpoint scope), NOT the operator who /decided — they answer.
                 const rs = deps.runStore;
                 const startSeq = rs && taskId ? await rs.maxSeq(taskId) : 0;
                 let text = "";
                 let reasoning = "";
                 const persistThinking = deps.config.traceThinking;
-                // 🔴 **单写串行链**(#310 codex 对抗复审 R1-[high],验真后修)。此前本腿是裸写口
-                // (`rs.appendEvent(taskId, ++seq, …)`,同步分配 seq、立刻发起 insert)—— 主循环 await 自己的写
-                // 所以主循环内部有序,但本腿有**两族 fire-and-forget 写者**:子代 forward 帧(下方 `warnAppend`
-                // 那三处,既有)与 #310 的通告口(新增)。它们的 N 号 insert 在池化 SQL 后端上可能晚于后发的
-                // N+1 号提交,而 events tail 读 `getEvents(id, afterSeq)`:读到 N+1 就把游标推过 N,那一行
-                // **此后永远不会被投递**(重连也不会,游标只前进)。bg / sync 两腿早就有这条链(`LedgerSink`
-                // 顶注 [1.211 codex H2] 逐字记着同一个病),本腿是漏掉的第三条 —— 判据抽成共享件,三腿同源。
                 const serialAppend = createSerialLedgerAppend((s, type, data) => rs.appendEvent(taskId, s, type, data), startSeq);
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
-                // #310:本腿同样**没有 live SSE**(续跑的消费方走 `GET /v1/runs/:id/events` 的 durable tail),
-                // 故只挂 durable 口 —— 与本腿的 elicit/question/approval 三族帧姿态逐字相同。无账本(无 rs/taskId)
-                // 时 `append` 本就是 resolve() 空写,注册它不产生任何行(与本腿其它帧同一条退化路径)。
                 unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId,
-                    // 写失败留痕不裸吞(codex 对抗复审 R1-[medium]):本腿账本同样是通告的唯一用户可见终点,
-                    // 与下方子代 forward 写口的 `warnAppend` 同一条纪律(C2/C5 批2)。
                     durable: (row) => void append("engine_notice", row).catch((err) => {
                         recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
-                        // 字段名是 `noticeCode` 不是 `code`:`error-code-key-gate` 按词法扫 http/ 全树的 `code:` 键
-                        // (3.0.0 起 wire 错误体只认 `errorCode`),一条日志行也不给它留歧义面。
                         deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
                     }),
                 });
-                // (resumeNotifiedKeys — this leg's delivered-notification keys — is hoisted above the inbox drain, see top)
-                // E18: anchor POST-resume turns too (a resumed conversation's new messages are rewindable). Same capture as
-                // runInBackground via the SHARED TurnAnchorCapture (only a settled assistant-text turn is anchored — see its
-                // doc). owner = the original submitter (the checkpoint scope), not the operator who /decided. undefined
-                // captureTurnAnchor ⇒ no anchor store / no getLeafId.
                 const anchorOwner = principal ?? null;
                 const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
                 const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
                     ? async (eventId) => { const leaf = await getLeafId(sessionId); if (leaf)
                         await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
                     : undefined;
-                // R8 (CC-parity rewind): USER-message anchor keyed by taskId (parity with the first-run path). A resume leg
-                // rarely commits a new user message, but wiring it is harmless (only `message_committed{role:"user"}` fires it).
                 const captureUserMessageAnchor = deps.resumeAnchorStore && taskId
                     ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
                     : undefined;
                 const anchor = new TurnAnchorCapture(captureTurnAnchor, () => deps.metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
-                // Parity with runInBackground (src/runs.ts): the resume leg must capture thinking + per-turn usage too,
-                // else a suspend→resume loses them on post-resume turns. Reasoning flushed before content, redacted.
                 const flush = async () => {
                     if (reasoning) {
                         await append("reasoning", { text: redactSecrets(reasoning) });
@@ -2279,31 +1328,17 @@ export function createHttpServer(rawDeps) {
                     if (text) {
                         await append("text", { text, ...(anchor.firstTextEventId ? { eventId: anchor.firstTextEventId } : {}) });
                         text = "";
-                    } // E18: per-message resume handle
+                    }
                 };
                 const driveResume = async () => {
-                    // (the workflow-completion inbox drain for this leg is hoisted ABOVE the verify/stream fork — see top)
-                    // core 1.210: the resume leg now has the RunInternals seam — fan a subagent's task_progress
-                    // tick (child-isolated stream; the forward sink is its ONLY exit) out to the fleet AND the durable log
-                    // (shared whitelist+redact builder + E2 identity), parity with the sync/bg legs. Fire-and-forget append
-                    // (`++seq` is a sync increment — sink-vs-loop appends get unique seqs); only when a durable log exists.
-                    // false once this leg settles — notifications after that take the durable-inbox path.
                     resumeLegLive = true;
-                    // [3911] 定谳(bg/sync 两腿 twin):per-agent tail 的**内容帧供给**由本腿 spec 的
-                    // forwardSubagentEvents 决定(core prepare-task 的 forward 门)。逐帧按**句柄**登记
-                    // (键为什么是句柄:SubagentTailBus.modeByHandle 顶注)。⚠️ 旧注这里写的「verify 腿不传
-                    // internals ⇒ 无帧 ⇒ meta 出 unknown」自 #253(core 5.33.0 #246)起**已过期**:verify 臂
-                    // 现在也传 internals(见上面那段),两条 resume 臂的供给形因此同形。
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
-                            // S2 live tail(复审 #1:forward sink 有三条腿——resume 腿上 spawn 的 bg 子代同样带
-                            // bgAgentId,漏挂=同副本开流只见 heartbeat)。publish 在 rs/taskId 门之前(tail 独立于账本)。
                             {
                                 const bg = e.bgAgentId;
                                 if (bg !== undefined) {
-                                    // 登记在 hasSubscribers 快门**之前**:没人在听时也要学,否则晚开的 tail 读不到供给形。
                                     defaultSubagentTailBus.noteHandleContentMode(bg, tailContentMode);
                                     if (defaultSubagentTailBus.hasSubscribers(bg)) {
                                         const f = projectTailFrame(e);
@@ -2315,60 +1350,37 @@ export function createHttpServer(rawDeps) {
                             if (!rs || !taskId)
                                 return;
                             const t = e.type;
-                            // C2/C5(v3.1 批2):写失败留痕——同函数 onTaskNotification 的 park-enqueue 早按 2026-07-11
-                            // 对抗评审补了 warn(false park 指纹),这三处同构 fire-and-forget 此前裸吞:子代 tool 生命周期
-                            // 事件从 durable log 永久消失且零信号。结构上仍不能 await(同步回调),留痕不改调用形。
                             const warnAppend = (kind) => (err) => deps.logger?.warn?.("forward_event_append_failed", { type: kind, taskId, err: err instanceof Error ? err.message : String(err) });
                             if (t === "task_progress") {
                                 void append("task_progress", taskProgressEventData(e)).catch(warnAppend(t));
                             }
                             else if (t === "tool_start") {
-                                // C1 (core 1.219): a delegated child's forwarded tool lifecycle — durable via the SAME shared
-                                // whitelist+redact builders as the top stream (parity with the bg leg; deltas not persisted per-chunk).
                                 void append("tool_start", toolStartEventData(e)).catch(warnAppend(t));
                             }
                             else if (t === "tool_end") {
                                 void append("tool_end", toolEndEventData(e)).catch(warnAppend(t));
                             }
                         },
-                        // background-completion observer — flip the child's fleet row +
-                        // park an idle-arrival in the durable inbox (workflow-type skipped). Rationale in runs.ts (bg twin).
-                        // core 1.283 `seq` (per-stop-cycle counter) rides into the dedup key + parked entry — sync twin's note.
-                        // 白名单排查(2026-07-24,「彻查 as {} 连环坑」):手写窄类型换 core 真实类型,理由同 runs.ts twin。
                         onTaskNotification: (n) => {
                             if (n.task_type === "workflow")
                                 return;
-                            // S2 复审 #3(sync 腿同注):中途终态信号。
-                            // [3911] 终态即撤供给形登记:同一 a* 句柄可进入下一个**复活周期**,而新周期的宿主腿模式
-                            // 可能相反——不撤会把上一周期的答案报给新周期的首帧前窗口(理由全文见 forgetHandleContentMode)。
                             defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
                             if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                                 defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                             }
-                            // id-domain alias: flip by payload.sessionId (= the tick's uuid domain), fallback task_id.
-                            // [2687-cli] 幽灵行案:只对 agent 族终态打(isFleetAgentTerminalNotification 单源判别,
-                            // 病灶链见其 doc 注);bash/monitor 的通知帧/park 面照走。孪生:runs.ts bg 腿、routes/tasks.ts sync 腿。
                             const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
-                            // diagnosability (rationale in runs.ts twin).
                             deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                // 对抗评审 2026-07-11(MED):log the enqueue failure (false park✓ fingerprint otherwise; sync twin's note).
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                // option A: teardown-time reap notification → durable display frame NOW (bg-leg twin's note).
-                                // core [784]④a: seq-folded shared key — the seq-less shape reverse-swallowed cycle 2's frame.
-                                // codex F1 (HIGH): fire-and-forget append — claim the key with its REAL outcome so a failed
-                                // write doesn't eat the stream replay of the same key (bg twin's note).
                                 const key = taskNotificationStreamKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n })).then(() => true, () => false));
                                 }
                             }
                         },
-                        // C2 (core 1.219) + design/122 (core 1.225 ③): the resumed leg re-registers sync-delegation steer
-                        // handles under the SAME taskId. NOT evicted on settle (resume legality) — evicted at leg end.
                         ...(deps.subagentSteerRegistry && taskId
                             ? {
                                 onSubagentSpawn: (handle) => {
@@ -2379,29 +1391,19 @@ export function createHttpServer(rawDeps) {
                     });
                     resumeStreamRef = stream;
                     if (taskId)
-                        steerableRuns.set(taskId, stream); // the resumed leg is in-flight again → live-steerable (parity with the first-run plain-stream path; taskId-guarded like the finally)
+                        steerableRuns.set(taskId, stream);
                     if (!taskId || !rs)
-                        return await stream.result(); // no durable log to persist into → just drain
-                    // ── #316 **受理点**([4660] Inkglow 60s 雪崩首环的修)──────────────────────────────────
-                    // 到这一行为止,所有「会变成拒绝」的判定都已经落定:lease admission(429)、markResuming CAS
-                    // (409)、以及 `resumeStream` 内部 core 的 pre-CAS 守卫 + 原子 CAS(绑定不符 409 / 卡不在 404
-                    // ——它们在 `await legRunner.resumeStream(...)` 处就 reject 了,根本到不了这里)。剩下的只有
-                    // **模型往返**,时长无上限。⇒ 声明了受理语义的调用方在此拿走 `200 {status:"resuming"}`,本腿
-                    // 继续在同一条 promise 链上跑到停点(账本写口逐字还是上面那条 `createSerialLedgerAppend`
-                    // 单写串行链 —— 本改动**不新增任何写口**,也就不引入 fire-and-forget 的低 seq 竞态)。
-                    // 🔴 `taskId && rs` 之后才受理(上一行的早退已经把无行形滤走):没有 durable 行就没有 poll/SSE
-                    // 可跟的终态面,那种部署形上提前受理等于把结果扔掉 —— 它维持同步形(受理回调不触发 ⇒ 分派器
-                    // 的 race 自然落到腿本身的返回值上)。
+                        return await stream.result();
                     onAccepted?.({ status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } });
                     for await (const ev of stream) {
-                        recordTurnActivity(taskId); // codex F5:S1 活性打点网的 resume 腿(sync/bg 双腿在 ledger-sink onActivity,本腿 append 不走那条链)——漏打则 resume 后 msSinceLastActivity 冻在 suspend 前,活跑的 run 被读成僵死
-                        fleetPub?.onEvent(ev); // MF-Fleet (#7): turn_end → tokens, tool_start → live activity, in-stream task_progress → child row (parity with the sync leg's onEvent)
-                        await appendPromptManifest(append, deps.promptManifests, taskId); // [998]②: the resumed prepare's manifest lands ahead of its first event (runs.ts twin)
+                        recordTurnActivity(taskId);
+                        fleetPub?.onEvent(ev);
+                        await appendPromptManifest(append, deps.promptManifests, taskId);
                         switch (ev.type) {
                             case "text_delta":
                                 text += ev.delta;
                                 anchor.onText(ev.eventId);
-                                break; // E18: latch first-text eventId = message handle
+                                break;
                             case "reasoning_delta":
                                 if (persistThinking)
                                     reasoning += ev.delta;
@@ -2410,7 +1412,7 @@ export function createHttpServer(rawDeps) {
                                 anchor.onTool();
                                 await flush();
                                 await append("tool_start", toolStartEventData(ev));
-                                break; // E18: tool ran → not anchorable
+                                break;
                             case "tool_end":
                                 await flush();
                                 await append("tool_end", toolEndEventData(ev));
@@ -2421,78 +1423,69 @@ export function createHttpServer(rawDeps) {
                                 await flush();
                                 await append("status", brainStatusEventData(st));
                                 break;
-                            } // S4 P0-a: durable brain-liveness observation (rationale in runs.ts twin — flush first so a mid-text reconnect doesn't invert the timeline); design/158 B2: row type aligned to the live frame name ("status", was "brain_status" — ledger-sink.ts twin's note has the full rationale + compat contract); 白名单排查 2026-07-24: 手写字面量换 Parameters<> 防未来漂移
+                            }
                             case "context_usage":
                                 await flush();
                                 await append("context_usage", contextUsageEventData(ev));
-                                break; /* core 1.414 一等分支;两条口径见 builder 旁注 */
+                                break;
                             case "compacted":
                                 await flush();
                                 await append("compacted", compactedEventData(ev));
-                                break; // MF-18 trigger + core 1.219 attachedFiles/preserved_segment (shared whitelist builder)
+                                break;
                             case "diagnostics":
                                 await flush();
                                 await append("diagnostics", diagnosticsEventData(ev));
-                                break; // core 1.220 design/121: NEW LSP diagnostics (shared whitelist builder, §E1 redact)
+                                break;
                             case "steering_injected":
                                 await flush();
                                 await append("steering_injected", steeringInjectedEventData(ev));
-                                break; // [1550]/[1552]: shared whitelist builder, §E1 redact — resume twin of the sync + ledger-sink legs
+                                break;
                             case "compaction_outcome":
                                 await flush();
                                 await append("compaction_outcome", compactionOutcomeEventData(ev));
-                                break; // [2373]A-2/C-2: durable 双腿补齐(此前回放即消失);共享 builder,差集门看守
+                                break;
                             case "workspace_changed":
                                 await flush();
                                 await append("workspace_changed", workspaceChangedEventData(ev));
-                                break; // [1559]二: cwd move (bash cd/EnterWorktree) — shared whitelist builder, §E1 redact — resume twin of the sync + ledger-sink legs
+                                break;
                             case "wiring_manifest":
                                 await flush();
                                 await append("wiring_manifest", wiringManifestEventData(ev));
-                                break; // 🔴 core 5.14.0 design/173:resume 腿自证清单(每条腿发自己那份)。本腿与 durable 账本腿共用**同一个**租户面构造器,剥 `governance` 段(audience:"operator",no projection ⇒ do not disclose)——账本写时不知道未来读者是谁,存全量 = 把 operator-only 面写进租户可读介质。⚠️ 「三腿同源」自 #154 件一起不再成立:live sync 腿(routes/tasks.ts)按连接身份分叉,operator 连接走 `wiringManifestOperatorEventData`。所以判据是「**durable 两腿恒剥、live 腿按身份分叉**」,不是「分头挑键即泄露」——别照旧注把已落地的 operator 面当泄露删掉,也别给第四条腿抄错构造器:先问这条腿知不知道读者是谁
+                                break;
                             case "human_input":
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
-                                break; // core 5.14.0 design/171:人类输入生命周期账本(parked-steer 续跑帧正是在这条腿上出现);身份串脱敏在共享构造器里
+                                break;
                             case "message_committed":
                                 await anchor.onMessageCommitted(ev.role, ev.entryId);
-                                break; // R8: USER-message rewind anchor (CC "rewind to the prompt")
+                                break;
                             case "task_progress":
                                 await append("task_progress", taskProgressEventData(ev));
-                                break; // shared whitelist+redact builder (+E2 identity, 1.78) — parity with the runs.ts + sync legs
+                                break;
                             case "task_notification": {
                                 await flush();
-                                // core [784]④a+④b: seq-folded shared key + skip keys this leg already delivered (turn-open inbox
-                                // drain or observer arm) — core's pend-drain replays a double-parked idle arrival as a stream event
-                                // on the resumed leg; appending it again doubles the frame in the durable events tail (sync twin).
-                                // codex F1: await the claiming write's outcome — a failed observer claim must not eat this
-                                // replay (write anyway + promote the key with THIS write's outcome; bg twin's note).
                                 const tnr = ev.notification;
                                 const tnrKey = tnr?.task_id ? taskNotificationStreamKey({ task_type: tnr.task_type, task_id: tnr.task_id, status: String(tnr.status), seq: tnr.seq }) : undefined;
                                 const tnrPrior = tnrKey !== undefined ? resumeNotifiedKeys.get(tnrKey) : undefined;
                                 if (tnrPrior === undefined || !(await tnrPrior)) {
-                                    const write = append("task_notification", taskNotificationEventData(ev)); // core 1.202 design/115 P2: display projection (shared whitelist+redact builder — parity with the runs.ts + sync legs)
+                                    const write = append("task_notification", taskNotificationEventData(ev));
                                     if (tnrKey !== undefined)
-                                        resumeNotifiedKeys.set(tnrKey, write.then(() => true, () => false)); // stream delivered this key
+                                        resumeNotifiedKeys.set(tnrKey, write.then(() => true, () => false));
                                     await write;
                                 }
                                 break;
                             }
                             case "turn_end": {
                                 await flush();
-                                await append("turn_end", turnEndEventData(ev)); /* 白名单 builder:此前手写 {usage},剥掉了 stopReason/usageMissing */
+                                await append("turn_end", turnEndEventData(ev));
                                 await appendModelUsageDelta(append, deps.modelUsage, taskId);
                                 await anchor.onTurnEnd();
                                 break;
-                            } // E18: anchor a settled assistant-text turn only
-                            // "done" handled below via result() + the run-row drive (terminal event written once)
+                            }
                         }
                     }
                     await flush();
                     const r = await stream.result();
-                    // Close the durable stream with the matching terminal event (mirrors runInBackground). Never the
-                    // capability token — only the non-secret gate on a re-suspend.
-                    // [4913]:再停事件带待批 toolCallId(源=新 checkpoint 的 pendingAction;tool-less/读失败=键缺席)。
                     if (r.status === "suspended") {
                         const parkCallId = await parkToolCallId(r, deps.checkpointStore);
                         await append("suspended", { gate: r.checkpointGate ?? null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
@@ -2503,34 +1496,19 @@ export function createHttpServer(rawDeps) {
                         await append("needs_review", { gate: r.checkpointGate ?? null });
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
-                    } // D-B: a resumed plan_review re-gated to another review pause
-                    // [1245] codex-4: a CONFIRMED reopen-class failure (core reopened the checkpoint — store-verified,
-                    // codex-5) is NOT terminal: logging `done` here would make the append-only log say terminal while
-                    // the park stays decidable (trace projection + events tailers treat `done` as final and would miss
-                    // the retry). Log the park, keep E8's terminal usage-SUM reserved for genuinely terminal results
-                    // (`checkpoint.reopen_failed` and an unconfirmed reopen stay on the done leg).
+                    }
                     if (isCheckpointReopenedFailure(r) && (await confirmCheckpointReopened())) {
                         reopenConfirmedPark = true;
-                        // codex-6: best-effort — the ROW re-park below is the authority once the reopen is confirmed. A
-                        // thrown append here would otherwise rethrow past the row drive and strand a `running` row (no
-                        // heartbeat) over a pending park until reapStale; a missing suspended event is merely a log gap
-                        // (nothing terminal was written — tailers keep waiting), strictly recoverable.
                         try {
                             await append("suspended", { gate: null, reopened: r.errorCode ?? null });
                             await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         }
                         catch {
-                            /* row drive is authoritative */
                         }
                         return r;
                     }
-                    // E8: terminal — this resumed leg is the run's final done, so flush the last delta + SUM model_usage across
-                    // ALL legs (pre-suspend + post-resume) into stats.modelUsage. setTerminal (below, ~2619) stores this result.
-                    const safe = await attachModelUsage(stripCheckpointToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId }); // structural fence (strip no-op today)
+                    const safe = await attachModelUsage(stripCheckpointToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
                     await append("done", { result: safe });
-                    // E12 (shell-host contract): a resumed leg that COMPLETES can also emit post-completion suggestions (parity with the
-                    // first-run path + the completed-only gate). suspended/needs_review returned above; a failed leg is
-                    // skipped here. Redact + persist as a `suggestions` event (UNTRUSTED UI-only, never re-fed to a model).
                     if (taskConfig.suggestNextPrompts && safe.status === "completed") {
                         const suggestions = await stream.suggestions().catch(() => []);
                         if (suggestions.length)
@@ -2538,17 +1516,10 @@ export function createHttpServer(rawDeps) {
                     }
                     return safe;
                 };
-                // #151 车3 刀 3b(design/172 §4.3(b)):resume 腿的**审批 ALS** —— 此前这条腿只有 elicitation ctx,
-                // 审批 ask 恒 `"unavailable"` ⇒ 恒 park,一张卡都不产。投递面 = 本腿的 durable events tail
-                // (与 bg 腿同形:`append(type, rest)`,`emitCard` 同口;撤卡帧 live-only 故不接)。
-                // `legKey` = 上面算好的 token 摘要 —— 这是 resume 腿与 sync/bg 首腿的唯一区别,也正是「新 park ⇒
-                // 新腿 ⇒ 重新征询」这条安全语义的承载轴。
                 const approvalEmit = (frame) => {
                     const { type, ...rest } = frame;
                     return append(type, rest);
                 };
-                // 包 ALS ⟺ 协议在本腿上场且窗不为 0(F4 修;`windowZero` 在没有 per-task `spec.onAsk` 装配点的
-                // 腿上,「不包 ALS」就是 immediate-unavailable 闭包的等价形,见 resolveApprovalLeg 顶注)。
                 const withApproval = () => deps.toolApproval && taskId && approvalLeg.active && !approvalLeg.windowZero
                     ? deps.toolApproval.runWithContext({
                         taskId,
@@ -2556,7 +1527,6 @@ export function createHttpServer(rawDeps) {
                         emit: approvalEmit,
                         abortSignal: cancelCtrl.signal,
                         sessionId,
-                        // 同 bg 腿:唯一 sink 是本腿的 durable tail,append 失败如实算未送达(R2-1)。
                         emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),
                         legKey,
                         ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
@@ -2569,166 +1539,68 @@ export function createHttpServer(rawDeps) {
         }
         catch (e) {
             if (e instanceof CheckpointError) {
-                // ── A-010.2:`checkpoint.resume_aborted` = 取消终局(既非 terminal-failed,也**不是** retriable)──
-                // core 只在 `taskConfig.signal.aborted === true` 时铸这个码(四个铸造点:pre-CAS 入口 / 编辑复裁
-                // 竞速两处 / consumed 后 / reopen 成功后),而本腿递进去的 `signal` 只有 `cancelCtrl.signal` ——
-                // 其唯一 abort 源是取消(inflightRuns 句柄 + 心跳轮询的持久取消旗)。所以收到该码 ⟺ 这条 run
-                // 被取消了,四形的正确落点因此**同一个**:按取消结算(下面那道 pending/consumed 的判别式,在
-                // 「该做什么」这个问题上是无差别的,故不做)。
-                //  · 归下面的 terminal 支(修前现状)= 200 的取消出路(本 catch 更下面的 `cancelCtrl.signal.aborted`
-                //    分支)被本 CheckpointError 分支**遮蔽**:运维拿到 409 + core 裸报文,行虽落 failed 但
-                //    `errorCode` 不是 `cancelled` 且 `setTerminal` 连 TaskResult 都不写(null),pre-CAS 三形的
-                //    卡还留 pending = 行终局 + 卡 pending 的孤儿对。
-                //  · 归 retriable(把该码加进下面的闭集)= 把一条**用户已取消**的 run 重新 park 成 `suspended`;
-                //    下一次 /decide 的 markResuming 会重置取消旗并把活真跑起来 —— 取消被静默打败,执行车道回归。
-                // ⛔ 修法刻意是「只给该码开一条臂」而不是把 `cancelCtrl.signal.aborted` 分支上提到本分支之前:
-                //    同在 abort 期铸的 `checkpoint.reopen_failed` 两形(store 拒 reopen = 审批已终局消耗;reopen
-                //    在飞失败 = 卡的状态从这里无法证明)带的信息比 "cancelled" 多,上提会把它们折没。
                 if (e.code === "checkpoint.resume_aborted") {
-                    // 序与 /v1/runs/:id/cancel 的 cancelSuspended 逐字同向:**先**按 cancel 语义结算卡,**再**驱行
-                    // 终局(行终局会释放 task_active;反序会开一个「卡还 pending 而行已死」的窗)。cancel 的卡结算
-                    // 语义是 expire(≈ deny 的 reaper 终局),不是 resolve —— 取消意味着 run 死掉,deny-RESUME 会
-                    // 把拒绝喂回模型烧 token。consumed 那一形(core 3894)在这里天然是 no-op:CAS 只翻 pending。
-                    // ⚠️ 与 `/v1/runs/:id/cancel` 的 `cancelSuspended` **刻意分道**的一点(codex 对抗复审 R2-高2
-                    // 的处置):那只在 CAS 输掉时会改答 409,因为它站在腿**外面**——输掉意味着「可能有一条 decide
-                    // 腿正在跑」,它没资格驱行终局。本臂站在腿**里面**:markResuming 已经赢过、这条 run 归我们,
-                    // 而本码的语义是「它被取消了」。此刻 CAS 输掉只可能是卡已离开 pending(自己那次 resume 消费掉
-                    // 的 consumed 形,或 reaper 先收了)——两种都意味着**没有活审批留在外面**,行照驱终局才是对的:
-                    // 不驱才会把会话锁一直攥着(这正是 [868] 那条事故)。故不改结果面,但**必须留痕**。
                     const cs2 = deps.checkpointStore;
                     if (cs2) {
                         try {
                             const live = await cs2.get(token);
                             if (live?.status === "pending" && !(await cs2.expire(token, live.scope))) {
-                                // CAS 输了:卡在我们读它与写它之间被别人(自己的 resume / reaper)settle 了。行为面无变化,
-                                // 但「取消时这张卡到底是谁收的」不留痕就永远查不出来。
                                 deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
                             }
                         }
                         catch (cancelSettleErr) {
-                            // 卡结算是尽力而为:行终局才是释放锁的权威写,残留的 pending 卡另有 reaper 车道兜底。
-                            // 但**必须留痕** —— 静默吞掉的话「取消之后卡为什么还在」在遥测里没有任何线索。
                             deps.logger?.warn?.("resume_cancel_checkpoint_settle_failed", {
                                 taskId, sessionId, err: cancelSettleErr instanceof Error ? cancelSettleErr.message : String(cancelSettleErr),
                             });
                         }
                     }
-                    // `claimedRow &&` 与下面那道分支**同一个**守卫,不是多余的:驱行终局是有资格才做的写(只有
-                    // 抢到这条 run 的腿才有资格),而「本码只可能在 markResuming 之后铸」这件事是当前控制流的
-                    // 巧合、不是结构保证。守卫写出来,这条臂就不依赖那个巧合。
                     if (claimedRow && taskId && deps.runStore) {
                         const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: e.message, stats: { turns: 0, tokens: 0 } };
                         await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
                     }
-                    settleFleet("failed"); // MF-Fleet (#7): 取消结算终局 → 行从 fleet 摘除
+                    settleFleet("failed");
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
                 }
-                // We flipped the row to `running` (claimedRow). Two CheckpointError classes diverge here (D-1, core 1.101):
-                //  • TERMINAL (already_resolved / not_found / gate_mismatch): the checkpoint is
-                //    consumed or gone — drive the row terminal now (releasing task_active) instead of leaving a zombie
-                //    `running` row for reapStale to mislabel and hold the session lock for ~runStaleSec. (Original case.)
-                //    ⚠️ `unsupported_version` USED to sit in this bullet unconditionally (its checkpoint does NOT go
-                //    away — that was the registered orphan debt). As of #209 / core 5.25.0 it SPLITS on
-                //    `detail.reason`: a recognised worker-swap word joins the retriable class below; an absent /
-                //    unrecognised word stays TERMINAL. Read the block under the closed set before touching it.
-                //  • RETRIABLE PRE-CAS (invalid_outcome = binding mismatch / reopen_revote = env_failed must replay the
-                //    persisted winner / reopened_concurrently = a concurrent resolve-reopen advanced the rev): the
-                //    checkpoint STAYS pending and the operator re-fetches + re-/decides. Driving the row terminal would
-                //    release task_active and ORPHAN the still-pending checkpoint (next /decide → 404). Re-park it
-                //    `suspended` so the corrected retry can claim it again.
                 const retriable = e.code === "checkpoint.invalid_outcome" ||
                     e.code === "checkpoint.reopen_revote" ||
                     e.code === "checkpoint.reopened_concurrently" ||
-                    e.code === "resume.parent_constraint_missing" || // 历史复审轴A #4(1.254):core 新增两码同为
-                    e.code === "resume.parent_constraint_mismatch" || // PRE-CAS(checkpoint 保持 pending)——按本块 doctrine 归 retriable;当前 /decide 面只 resume 顶层 checkpoint 应不可达,前瞻补齐防嵌套 resume 面开放时踩中
-                    // core 5.22.0(BREAKING「编辑复裁前移 pre-CAS」)闭集加员:审批人**改写**入参时,继承祖先链
-                    // 的冻结投影先静态复裁 —— 判 deny ⇒ constraint_rejected;链上有 opaque 层/声明 live remainder
-                    // ⇒ constraint_unprojectable。两者与上面两码同族:PRE-CAS、checkpoint 留 pending 且**同 token
-                    // 仍可再决**(core 明写 fresh-redecision 语义:照原样批 / deny / 改别的都还点得动)。归 terminal
-                    // 会释放 task_active 并孤儿化那条仍 pending 的卡 —— 一张还能点的卡当场变死件。
+                    e.code === "resume.parent_constraint_missing" ||
+                    e.code === "resume.parent_constraint_mismatch" ||
                     e.code === "resume.constraint_rejected" ||
                     e.code === "resume.constraint_unprojectable" ||
-                    e.code.startsWith("wake.") || // design/144:wake 拒绝(gate_pending/nothing_to_deliver)全是 PRE-CAS,checkpoint 保持 pending——驱 terminal 会孤儿化仍在等的 park
-                    // 🟢 **`checkpoint.unsupported_version` 的一臂精确 retriable**(#209 件2,core 5.25.0 提货批
-                    // [3443];取代 #205 件4② 那条「维持 TERMINAL + 孤儿代价在案」的登记账)。
-                    //
-                    // 旧账的形状(留着,因为它解释了为什么这条臂长这样):该码在 core 上有**三个** PRE-CAS 铸点
-                    // (版本超上限 / org 治理行落到无 `permissionRuleOrg` 的 worker / 带 remote `workspaceHandle` 的行
-                    // 落到无 `executionEnvFactory` 的 Runner),三形卡一律留 pending 但**可恢复性不同**,而 core 当时
-                    // 同码同 `detail`(都不带)⇒ 下游只剩「按报文文案猜」或「按 checkpoint 形状反推」两条路,两版修法
-                    // 各被一轮 codex 对抗复审验伪(blanket-retriable 让无手臂永挂 task_active;按 `gate.realApproval`
-                    // 分流不健全 —— core 把该位放 gate、`workspaceHandle` 放 state,同一条行可以两样都带)。按宪法
-                    // 「源头修复,禁下游旁路」全回退,并把判别式列成上游请托([3434] 请托 1)。
-                    //
-                    // 请托已兑现:core 5.25.0 起三个铸点各带 `detail.reason`(`runtask.js:3706/3721/3733` 亲读),
-                    // d.ts 逐字说三者都是「retryable on a newer / factory-wired / org-wired worker」。⇒ 本臂**读词表**
-                    // (`WORKER_SWAP_REDEEMABLE`,闭集、新词 tsc 红),不做任何形状推断:
-                    //  · 认得的三个词 ⇒ retriable:行重新 park suspended,那条仍 pending 的卡不再被孤儿化
-                    //    (旧账里「行 failed 而卡活着、下一次 /decide → 404、只能等 `terminal_at_ms`」的代价至此销掉)。
-                    //  · 词缺席 / 认不得 ⇒ **维持 TERMINAL**(旧行为逐字保留)。这不是保守的装饰:旧引擎的裸抛与
-                    //    将来某个我们还没读过的新臂都落在这一支,而把它们默认成 retriable 会把一条**真的没救**的行
-                    //    永久 park 在 suspended 上攥着 task_active —— 那正是 codex R1-[high] 验伪掉的那一版。
-                    // 🔴 形③(`env_factory_missing`)按 core 的词判 retriable,而不是按 #205 那条「选 Runner 由
-                    // `handsLanes.laneOf(spec)` 按场景判,重投永远同样失败」的推断:那条推断说的是**同一份部署配置下**
-                    // 重投无用,而 core 的词说的是「接上 `executionEnvFactory` 的 worker 兑得掉」—— 那是一次运维动作,
-                    // 与 `governed_unwired` 要求接 `permissionRuleOrg` 完全同族。两者都不是「换个副本再点一次」。
-                    // 期间行停在 suspended 攥着会话锁,与它 park 时的状态**逐字相同**(这条腿只是没能把它推进),
-                    // 而 TERMINAL 那一支要用「释放锁」换「卡变死件」,方向更坏。
-                    // 行为面钉:`test/durable-resume-http.test.ts` 的「#209 件2」三正格 + 三反极格。
+                    e.code.startsWith("wake.") ||
                     (e.code === "checkpoint.unsupported_version" && checkpointRowRedeemableElsewhere(e.detail?.reason));
                 if (claimedRow && taskId && deps.runStore) {
-                    // Re-park on the SAME gate family the outcome targeted: a plan_review retry must re-park `needs_review`
-                    // (keep the row's review status + the lock), not `suspended` — else GET /v1/assistant/tasks mislabels it.
                     if (retriable) {
                         await (outcome.gate === "plan_review" ? deps.runStore.setNeedsReview(taskId) : deps.runStore.setSuspended(taskId)).catch(() => undefined);
                         settleFleet(outcome.gate === "plan_review" ? "needs_review" : "suspended");
-                    } // MF-Fleet (#7): re-park keeps the row
+                    }
                     else {
                         await deps.runStore.setTerminal(taskId, "failed", null, e.message).catch(() => undefined);
                         settleFleet("failed");
-                    } // MF-Fleet (#7): terminal removes the row
+                    }
                 }
                 const status = e.code === "checkpoint.not_found" ? 404 : 409;
                 return {
                     status,
                     body: {
                         error: e.message,
-                        // invalid_outcome means DIFFERENT things per gate: for policy_ask it IS the D-1 action-binding
-                        // mismatch; for plan_review/dry_run_review it is a content-sanitize reject (editedPlan/reason carried a
-                        // forbidden tag) — give those a gate-appropriate code so the UI routes to the right recovery, not the
-                        // action-binding flow (adversarial-review medium finding).
-                        // 归一(clay 大改版窗 2026-07-28):errorCode **恒在**——改铸臂保持优先,其余=原码镜像
-                        // (「code 单轨」历史形从此退役;SDK 的 ?? b.code 兜底只为老 server 保留)。
                         errorCode: e.code === "checkpoint.invalid_outcome"
                             ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
                             : e.code,
-                        // [2422] HITL-2 裁 (a),core 5.3.0:invalid_outcome 同码两义(动作被换 vs 输入被换)——
-                        // detail.field 是唯一机读判别式,透传给 UI 路由恢复动作(boundCallId=重取 pending 列表,
-                        // boundInputHash=重审同动作的新输入)。缺席=core 未铸(非绑定类 invalid_outcome),不造键。
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
                         ...(retriable ? { retriable: true } : {}),
                     },
                 };
             }
-            // Cancelled mid-resume (the abort threw out of the resumed stream): settle the row to the cancelled
-            // terminal (parity with runInBackground) instead of bubbling a 500 that leaves a zombie `running` row
-            // for the reaper. The operator's /decide gets the run's final state, not an opaque error. (A preempt mid-
-            // resume is NOT an abort — it durably suspends and surfaces above as status:"suspended", not here.)
             if (cancelCtrl.signal.aborted) {
                 if (taskId && deps.runStore) {
                     const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: "cancelled by user", stats: { turns: 0, tokens: 0 } };
                     await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
                 }
-                settleFleet("failed"); // MF-Fleet (#7): a cancel mid-resume settles the row terminal → removed from the fleet
+                settleFleet("failed");
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
             }
-            // C: a plain Error (not CheckpointError, not a cancel) is about to propagate before the post-catch
-            // `settleFleet(result.status)` can run → settle the re-published row to "failed" first so it doesn't leak
-            // as a stale "running" (no-op if a CheckpointError/cancel branch above already settled it).
-            // 🔴 codex R1-F2(2026-08-14):行也要落终局,不只 fleet 帧——本腿在 markResuming/createRun 赢下行后
-            // 普通异常一路 throw 出去,行曾一直留 running+claim 在手直到 reapStale(期间 session 被锁死,最终被
-            // 误记 instance-lost)。cancel 分支(上方)早为同一理由落行,本臂是漏掉的孪生。claimedRow 守卫=只有
-            // 抢到行的腿才有资格驱终局(与 CheckpointError 臂同一条纪律)。
             if (claimedRow && taskId && deps.runStore) {
                 await deps.runStore.setTerminal(taskId, "failed", null, e instanceof Error ? e.message : String(e)).catch(() => undefined);
             }
@@ -2736,78 +1608,45 @@ export function createHttpServer(rawDeps) {
             throw e;
         }
         finally {
-            unregisterEngineNotice?.(); // #310:腿结束即注销 wire 口
+            unregisterEngineNotice?.();
             if (taskId) {
-                // [1.207 codex H3] identity-guarded like steerableRuns below — a retriable-CheckpointError re-park
-                // (setSuspended) opens a window where a fast sibling resume markResuming's + registers its OWN
-                // controllers under the same taskId before this finally runs; an unconditional delete killed the
-                // fresh handles (cancel/preempt would 409 "another replica" until re-registration).
                 if (inflightRuns.get(taskId) === cancelCtrl)
                     inflightRuns.delete(taskId);
                 if (preemptableRuns.get(taskId) === preemptCtrl)
                     preemptableRuns.delete(taskId);
-                // Identity-guarded (1.78 review LOW): only delete the handle THIS leg registered (and only if it is
-                // still ours) — a faster sibling resume may have re-registered the same taskId already; never registered
-                // ⇒ nothing of ours to delete.
                 if (resumeStreamRef !== undefined && steerableRuns.get(taskId) === resumeStreamRef)
                     steerableRuns.delete(taskId);
                 for (const evict of subagentHandleEvictions)
-                    evict(); // design/122 ③: leg-end handle eviction (identity-guarded)
-                deps.modelUsage?.clear(taskId); // E8: parity with runInBackground's finally — unregister + drop any un-drained accumulation (no leak / no cross-resume contamination)
-                deps.promptManifests?.clear(taskId, resumeManifestLease); // [998]②: lease-guarded (a fast sibling's fresh registration survives our teardown)
+                    evict();
+                deps.modelUsage?.clear(taskId);
+                deps.promptManifests?.clear(taskId, resumeManifestLease);
             }
             if (resumeHeartbeat)
                 clearInterval(resumeHeartbeat);
-            resumeLegLive = false; // notifications from here on take the durable-inbox path
+            resumeLegLive = false;
         }
-        // A session-CAS conflict can surface as a failed result on resume too — evict the stale warm-cache entry so
-        // the next task on this session re-wakes from TiDB instead of re-conflicting (parity with runInBackground /
-        // sync POST / cascade; the only terminal-result path that was missing this — council).
         evictIfConflict(deps.runner, sessionId, result);
-        // [1245] codex-3: the two REOPEN-class resume failures (`resume.env_failed` / `resume.tool_unavailable` —
-        // core dist-read: runtask reopens the checkpoint via store.reopen BEFORE returning this failed result; a
-        // reopen that itself fails surfaces as `checkpoint.reopen_failed`, NOT these codes) leave the checkpoint
-        // PENDING. Driving the row terminal here would release task_active and orphan the still-decidable park
-        // (the exact class the CheckpointError `retriable` branch above re-parks) — e.g. Workflow entitlement
-        // revoked between suspend and approve. Re-park `suspended` so the operator's retry can claim it again.
-        const checkpointReopened = reopenConfirmedPark; // codex-5: store-confirmed inside the resume paths — never inferred from the code alone
-        // Drive the parked run row to its new state (terminal, or re-suspended on a further gate). Strip the token
-        // from the persisted result — structural fence (no-op today; GET /v1/runs/:id reads this row back).
+        const checkpointReopened = reopenConfirmedPark;
         if (taskId && deps.runStore) {
             if (result.status === "suspended" || checkpointReopened)
                 await deps.runStore.setSuspended(taskId);
             else if (result.status === "needs_review")
-                await deps.runStore.setNeedsReview(taskId); // D-B: a resumed leg re-gated to a review pause — re-park, keep the lock
+                await deps.runStore.setNeedsReview(taskId);
             else
                 await deps.runStore.setTerminal(taskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
         }
-        // MF-Fleet (#7): settle the fleet row in lock-step with the run row — suspended/needs_review KEEP the row (it stays
-        // "waiting"/"awaiting approval"); a terminal status REMOVES it (onTerminal does this mapping). Mirrors the sync leg.
-        settleFleet(checkpointReopened ? "suspended" : result.status, fleetRunResiduals(result)); // [1839]①/(a):终态残局键(parked 时 publisher 不上帧)
-        // Surface the failure code/message to the deciding operator (never the token): a resumed leg that fails
-        // otherwise returns an opaque {status:"failed"} — undiagnosable without a run row (leader sub-workers).
+        settleFleet(checkpointReopened ? "suspended" : result.status, fleetRunResiduals(result));
         return {
             status: 200,
             body: {
                 taskId, sessionId, status: result.status,
-                // [2400] HITL-12:世代探测位——本 server 强制决策-动作绑定(无绑定 decide 已在上方 400 拒),
-                // 客户端凭它机器确认「我裁的就是我看到的那个动作」,不再有静默回落窗口。
                 bindingEnforced: true,
                 ...(result.errorCode ? { errorCode: result.errorCode } : {}),
                 ...(result.errorMessage ? { errorMessage: redactSecrets(result.errorMessage) } : {}),
-                ...(checkpointReopened ? { retriable: true } : {}), // the park is still pending — re-fetch + re-decide
+                ...(checkpointReopened ? { retriable: true } : {}),
             },
         };
     }
-    /**
-     * design/80 seam #2 (scheduler resume): resume a task that durably SUSPENDED on a `resource_limit` gate — a
-     * scheduler PREEMPT (reason "preempt") or a budget/turns/walltime slice boundary (design/74). Distinct from the
-     * operator `/decide` path (`resumeCheckpoint`, `policy_ask`): there is NO human decision, NO binding, NO answer
-     * — just `{gate:"resource_limit", decision:"continue"}` (core computes the next slice's allowance from the
-     * ledger). 🔴 GATE-KIND GUARD: it REFUSES to resume a `policy_ask`/human gate via this path (that would bypass
-     * the human approval) — a non-resource gate returns 409 and must go through `/decide`. Owner-scoped by the
-     * caller; `scope` is the checkpoint's own (multi-tenant). Returns the HTTP {status, body}.
-     */
     async function resumePreempted(sessionId, req) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
@@ -2815,18 +1654,13 @@ export function createHttpServer(rawDeps) {
             return { status: 404, body: { error: "no resumable suspension for this task (already running, resumed, or expired)", errorCode: "not_found.suspension" } };
         let cp;
         try {
-            cp = await cs.get(token); // throws if the checkpoint format is newer than this build (version guard)
+            cp = await cs.get(token);
         }
         catch (e) {
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        // 🔴 GATE-KIND GUARD (security): this "continue" path must ONLY advance a resource_limit suspend. A
-        // policy_ask / human / irreversible_ask gate requires a HUMAN decision via POST /v1/approvals/:id/decide —
-        // resuming it here with decision:"continue" would BYPASS the approval. Reject it distinctly (core's resume
-        // gate-match is the fail-closed backstop, but we reject pre-CAS for a clear error + to never consume the
-        // checkpoint). dry_run_review / plan_review likewise are not "continue"-resumable here.
         const gateKind = cp.gate?.kind;
         if (gateKind !== "resource_limit") {
             return { status: 409, body: { error: `task is suspended on a '${gateKind ?? "unknown"}' gate, not a resumable resource/preempt suspension — an approval gate must be decided via POST /v1/approvals/:id/decide`, errorCode: "gate_not_resumable" } };
@@ -2834,33 +1668,23 @@ export function createHttpServer(rawDeps) {
         const ctx = await cs.getCtx(sessionId).catch(() => null);
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        // Rebuild taskConfig via resolveSpec with auth reconstructed from the checkpoint scope (mirrors resumeCheckpoint).
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        // E18: STRIP resumeAt before re-resolving on a durable resume — the leaf is already set by the checkpoint, and
-        // resumeAt + a durable resume is rejected by core (resume_at.conflicts_resume); also avoids re-resolving a stale
-        // anchor (which could 404 if the session was purged). A resume-at run that suspended stored its body with resumeAt.
         const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        // A resource-suspended task that was submitted with verify:true is re-gated on completion (parity with the
-        // HITL path — the flag rides the persisted ctx.body).
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds });
     }
-    /** design/144 §3:wake 一个 task_done 纯 park——非门决策,解除 park 消费消息续跑。owner 门:非 operator
-     *  只能 wake 自己 scope 的 park(404 无 oracle);core 端 gate_pending/nothing_to_deliver 双拒兜底。 */
     async function resumeWake(sessionId, message, caller, req) {
         const cs = deps.checkpointStore;
         const token = await cs.findPendingTokenBySession(sessionId);
         if (!token)
             return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
-        // owner 门先于 get(复审 finding:get 对损坏/新版行会抛,若 gate 在后,非 owner 能用 409 错误详情
-        // 区分「存在但坏」vs「不存在」= 存在性 oracle)。scope 走 peekPendingScope(轻读,不碰行体)。
         const operator = explicitOperatorOk(caller, deps.config.operatorPrincipals);
         if (!operator) {
             const scope = await cs.peekPendingScope(sessionId).catch(() => undefined);
             const decodedScope = scope != null ? decodeCheckpointScope(scope) : undefined;
             if (decodedScope !== undefined && decodedScope !== caller) {
-                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } }; // 无 oracle
+                return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
             }
         }
         let cp;
@@ -2872,18 +1696,14 @@ export function createHttpServer(rawDeps) {
         }
         if (!cp)
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
-        // 纵深(peek 缺席面兜底)。比较留在 scope 空间(常量比较,不 decode):行体可能来自不做形状校验的
-        // JSON 读取,scope 越契约为 nullish 时 decode 形会把「畸形行」折成「公开」= 放行;旧码对该支是拒绝
-        // 方向,常量形逐字节保持它(codex 码审 finding,#97 α 车)。
         if (!operator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== caller) {
             return { status: 404, body: { error: "no parked checkpoint for this session (nothing to wake)", errorCode: "not_found.parked_checkpoint" } };
         }
-        // 预检(core 兜底同码):非纯 park = 有未决门,wake 永不绕审批。
         const gateKind = cp.gate?.kind;
         if (gateKind !== "task_done") {
             return { status: 409, body: { error: `cannot wake: this checkpoint awaits a pending gate decision (gate "${gateKind ?? "unknown"}") — resolve it through its own decide entry`, errorCode: "wake.gate_pending" } };
         }
-        const trusted = operator; // steer 同款:operator 消息可携 <system-reminder> 权威
+        const trusted = operator;
         if (message !== undefined) {
             try {
                 validatePendingSteer({ text: message, trusted });
@@ -2910,29 +1730,12 @@ export function createHttpServer(rawDeps) {
             taskConfig,
             resumeObjective,
             outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
-            verifyRounds: undefined, // wake 续跑不重开 verify 门(原任务已终局;新工作要 verify 走新 run)
-            mintFreshRun: { source: "wake" }, // [3829]:终局纯 park 的 claim 已删,声明铸新行(注释见 DriveResumeArgs)
+            verifyRounds: undefined,
+            mintFreshRun: { source: "wake" },
         });
     }
-    /**
-     * design/80 D-B: resolve a PRE-ACTION `plan_review` gate (3-state approve | edit | reject) and drive the resumed
-     * leg into the durable run log via the SHARED machinery. DISTINCT from `resumeCheckpoint` (a `policy_ask` tool
-     * approval, allow/deny + binding) and `resumePreempted` (`resource_limit` continue). The `edit` decision carries
-     * the operator's REVISED plan (core threads `editedPlan` into the resumed run). 🔴 GATE-KIND GUARD (security):
-     * refuses any non-`plan_review` gate — an approve/edit/reject must NEVER resolve a tool-approval / resource_limit
-     * suspend (that would bypass the correct /decide allow-deny + action binding). Rejects PRE-CAS so a wrong-gate
-     * call never consumes the checkpoint (core's resume gate-match is the fail-closed backstop).
-     */
-    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, 
-    /** [4277]/[4288] 件5:判别日志的两个附加位。调用方(plan_review 端点)手上有 taskId 与 gatedPrincipal,
-     *  本函数只有 sessionId —— 穿进来是为了让 `decide_404` 的**四个 reason 共用同一套字段**(联调 grep 一条
-     *  msg 就拿到同一个 id 键与同一个 principalPresent 口径,不必按 reason 分两种形)。
-     *  缺席 ⇒ id 退回 sessionId 并如实换键名(不假装那是 taskId)。 */
-    log) {
+    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, log) {
         const cs = deps.checkpointStore;
-        // [4268]/[4274]/[4277]/[4288] 件5:404 成因判别位——**只进服务端日志,不上 wire**(响应体一字不改,
-        // 反枚举不破)。词表四值全在本函数与 approvals-assistant.ts 两处铸,合起来覆盖 plan_review 一条决裁
-        // 路径的全部 404 出口。`principalPresent` 只记**有无**:身份串一个都不许进日志(日志读者面比 wire 宽)。
         const log404 = (r) => deps.logger?.info?.("decide_404", {
             reason: r,
             ...(log?.taskId !== undefined ? { taskId: log.taskId } : { sessionId }),
@@ -2945,7 +1748,7 @@ export function createHttpServer(rawDeps) {
         }
         let cp;
         try {
-            cp = await cs.get(token); // throws if the checkpoint format is newer than this build (version guard)
+            cp = await cs.get(token);
         }
         catch (e) {
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
@@ -2954,9 +1757,6 @@ export function createHttpServer(rawDeps) {
             log404("checkpoint-missing");
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
         }
-        // 🔴 GATE-KIND GUARD: a plan_review decision must ONLY resolve a plan_review gate. A human/irreversible_ask
-        // (tool approval) or resource_limit/needs_review gate routed here would let approve/edit/reject bypass the
-        // correct wire (a tool approval needs /decide's allow/deny + action binding; resource_limit needs /resume).
         const gateKind = cp.gate?.kind;
         if (gateKind !== "plan_review") {
             return {
@@ -2970,15 +1770,9 @@ export function createHttpServer(rawDeps) {
         const ctx = await cs.getCtx(sessionId).catch(() => null);
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
-        // Rebuild taskConfig via resolveSpec with auth reconstructed from the checkpoint scope (mirrors resumeCheckpoint).
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        // E18: STRIP resumeAt before re-resolving on a durable resume — the leaf is already set by the checkpoint, and
-        // resumeAt + a durable resume is rejected by core (resume_at.conflicts_resume); also avoids re-resolving a stale
-        // anchor (which could 404 if the session was purged). A resume-at run that suspended stored its body with resumeAt.
         const spec = await deps.resolveSpec({ ...ctx.body, resumeAt: undefined }, req, auth);
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        // A plan_review-suspended task submitted with verify:true is re-gated on completion (parity with the other
-        // resume paths — the flag rides the persisted ctx.body).
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const outcome = {
             gate: "plan_review",
@@ -2994,40 +1788,26 @@ export function createHttpServer(rawDeps) {
             deps.metrics?.inc("task_tokens_total", {}, result.stats.tokens);
         if (result.stats.cacheHitRate !== undefined)
             deps.metrics?.observe("task_cache_hit_rate", result.stats.cacheHitRate);
-        // ⑤ budget/limit cutoffs:count failures by their dotted code — core 5.8.0 起统一 `limits.` 前缀
-        // (limits.max_{tokens,cost,turns,walltime}_exceeded;旧 budget.*/limit.* 双前缀同拍退役),
-        // operator 按此对租户撞顶告警。metric 名保留 budget_exceeded_total(时序连续性;code label 自述新码)。
         const code = result.errorCode;
         if (code && code.startsWith("limits.")) {
             deps.metrics?.inc("budget_exceeded_total", { code });
         }
-        // Developer-mode verification gate (1.44): count the final verdict when this task was verified.
         const verdict = result.verification?.verdict;
         if (verdict)
             deps.metrics?.inc("verifications_total", { verdict });
-        // Cascade (1.45): count the outcome (passed / exhausted) when this task ran the ladder.
         const cascadeOutcome = result.cascadeOutcome;
         if (cascadeOutcome)
             deps.metrics?.inc("cascade_total", { outcome: cascadeOutcome });
-        // Degenerate-repetition salvage classifier (1.59): a/b/unknown — see degenerate-instrument.ts.
         deps.instrumentDegenerate?.(result);
     }
-    /** The terminal-result side-effect trio (metrics, plan-cache recurrence probe, warm-cache eviction) in ONE
-     *  place so a terminal path can't silently omit one (council DESIGN-6 — the omissions caused tracking gaps). */
     function finalizeTaskResult(result, principal, objective, sessionId) {
         recordTaskResult(result);
         deps.planCacheProbe?.record(principal, objective, result.status === "completed");
         evictIfConflict(deps.runner, sessionId, result);
     }
-    /** Per-principal cumulative cost quota: 429 + retry-after when the principal is over for the window.
-     *  No principal → not gated (the rate limiter + REQUIRE_PRINCIPAL still apply). */
     function quotaExceeded(req, res) {
         if (!deps.costQuota)
             return false;
-        // 🔴 F-fix: the VERIFIED principal (gatedPrincipal), never the spoofable header. Spend ACCRUES to the verified
-        // principal (budget.ts `costQuota.add(currentPrincipal())` = auth.principal), so checking a header-keyed bucket
-        // while the verified bucket fills would let a direct-door caller dodge its quota by rotating x-agent-principal.
-        // The sibling rateLimited keys on the socket on a direct door for the same reason — this was its overlooked twin.
         const principal = gatedPrincipal(req, deps.config);
         if (!principal)
             return false;
@@ -3039,12 +1819,6 @@ export function createHttpServer(rawDeps) {
         sendError(res, 429, "limit.cost_quota_exceeded", "cost quota exceeded", { usedMicroUsd: d.usedMicroUsd, limitMicroUsd: d.limitMicroUsd, retryAfterSec: d.retryAfterSec });
         return true;
     }
-    /** lease admission(D4 AP)— the quotaExceeded sibling for lease-enforced principals: first
-     *  touch negotiates with center (single-flight; 409 not-lease-enforced → negative-cached pass-through to
-     *  the local CostQuota path), a live lease admits locally, center-judged exhaustion denies 429+Retry-After
-     *  (same shape as the cost-quota deny), and an unreachable center FAILS OPEN (AP posture — reconciliation
-     *  is the backstop). Keys on the VERIFIED principal only (gatedPrincipal — the quotaExceeded F-fix twin);
-     *  no principal (single-user turnkey) → no lease surface. */
     async function leaseDenied(req, res) {
         if (!deps.fleetLease)
             return false;
@@ -3056,17 +1830,9 @@ export function createHttpServer(rawDeps) {
             return false;
         deps.metrics?.inc("fleet_lease_rejected_total");
         res.setHeader("retry-after", String(adm.retryAfterSec));
-        // E4 定稿:429 带 typed code + center 结构化字段 verbatim 透传(windowType/remaining/resetAt/
-        // isEstimate/pool)——人话文案归壳/web(契约如此),error 串保留旧消费者兼容。
         sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
         return true;
     }
-    /** design/166-T1 — 治理窗 pre-admission(quotaExceeded/leaseDenied 的兄弟门):key 公式与 core 单源
-     *  (`principal || GLOBAL_USAGE_KEY`,GLOBAL_USAGE_KEY 引 core 公共导出防漂移;principal=verified,
-     *  spoofable header 不进键)。窗耗尽 → 429 + retryAfterSec(族形一致,秒上取整)+ Retry-After 头。
-     *  读窗失败(DB 瞬断/坏 record)→ warn + fail-open:enforcement 真源在 core 进场检查(同店同键,
-     *  会响亮拒),此门只是异步车道的 429 快速座——门故障不该把提交面整个拖死。admission-pass 与
-     *  core entry-拒之间存在竞态窗:该形落终态 run 记录(errorCode usage.window_exhausted),契约文档在案。 */
     async function usageWindowDenied(req, res) {
         const store = deps.usageWindowStore;
         const windows = deps.config.usageWindows;
@@ -3090,13 +1856,9 @@ export function createHttpServer(rawDeps) {
         sendError(res, 429, "usage.window_exhausted", "usage window exhausted (deployment token governance)", { retryAfterSec });
         return true;
     }
-    /** Apply the per-principal rate limit; responds 429 and returns true when the caller is over. */
     function rateLimited(req, res) {
         if (!deps.rateLimiter)
             return false;
-        // 🔴 D-G (DeepSeek council Bug#2): on a direct-mode worker x-agent-principal is UNTRUSTED, so keying the limiter
-        // on it lets a client rotate the header to evade its own bucket OR set a victim's principal to poison theirs
-        // (DoS). Key on the socket address instead (the verified principal isn't known until post-body JWT verify).
         const key = (deps.config.directDoorActive ? undefined : principalFrom(req, deps.config)) ?? req.socket.remoteAddress ?? "anon";
         const d = deps.rateLimiter.check(key);
         if (d.allowed)
@@ -3106,14 +1868,6 @@ export function createHttpServer(rawDeps) {
         sendError(res, 429, "limit.rate_exceeded", "rate limit exceeded", { retryAfterSec: d.retryAfterSec });
         return true;
     }
-    /**
-     * §0.5 session-scoped owner scope — the SAME model as GET /v1/sessions, reused by the fork/delete routes so
-     * all three agree on "who may touch this session". A system/traceToken caller is FLEET-WIDE (ops, any session);
-     * a principal caller is PINNED to `gateOwner` (its own). Identity is `gatedPrincipal` (direct-door safe), never
-     * the spoofable header. Caller checks: `!fleetWide && gateOwner===null` ⇒ 401; otherwise compare the session's
-     * stored owner to `gateOwner` (principal path) or allow (fleetWide).
-     */
-    /** Decode a URL path segment, returning null on a malformed %-sequence (a client error → 400, never a 500). */
     function safeDecode(seg) {
         try {
             return decodeURIComponent(seg);
@@ -3122,11 +1876,6 @@ export function createHttpServer(rawDeps) {
             return null;
         }
     }
-    // 🔒 Single source for the fleet-wide (all-tenant) gate. dev-open (no service/trace token ⇒ fleet-wide) is honored
-    // ONLY on a single-user deployment. On MULTI-TENANT (requirePrincipal=true), the ABSENCE of a token must NOT open the
-    // fleet — that would leak every tenant's sessions/runs/fleet rows to ANY caller (HIGH tenant-isolation gap, systematic
-    // audit 2026-06-30). Multi-tenant without a token ⇒ NOT fleet-wide ⇒ owner-gated by principal (and main.ts boot-guards
-    // it to fail FAST). A system authToken or the read-only traceToken still grant fleet-wide on any deployment.
     function isFleetWide(req) {
         const { authToken: at, traceToken: tt } = deps.config;
         const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
@@ -3137,11 +1886,6 @@ export function createHttpServer(rawDeps) {
         const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
         return { fleetWide, gateOwner };
     }
-    /** 🔴 WRITE-grade fleet-wide (2026-07-13): the READ-ONLY traceToken must never authorize a
-     *  cross-tenant WRITE (delete/fork/sync import) — isFleetWide deliberately grants it fleet-wide for the trace/
-     *  list READ surfaces, but consuming that same bit on destructive routes turned a read credential into write
-     *  authority. Write routes use THIS gate: dev-open (single-user, no tokens) and the SYSTEM authToken keep their
-     *  authority; a traceToken-only caller falls through to the principal owner gate (or 401). */
     function sessionOwnerScopeForWrite(req) {
         const { authToken: at, traceToken: tt } = deps.config;
         const anyAt = Boolean(at) || Object.keys(deps.config.authTokens ?? {}).length > 0;
@@ -3149,41 +1893,19 @@ export function createHttpServer(rawDeps) {
         const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
         return { fleetWide, gateOwner };
     }
-    /** Reject when the caller's principal does not own the run (null owner = open, dev). */
     function runOwnerOk(req, res, owner) {
-        // 🔴 F-fix: the VERIFIED principal (gatedPrincipal), never the spoofable header — `owner` was persisted from the
-        // verified principal at create, so comparing it to a spoofable header would let a direct-door caller read/cancel a
-        // victim's run (and its event stream) by sending x-agent-principal:<victim> with NO JWT. Same model as
-        // sessionOwnerScope. (BFF/gated: gatedPrincipal === principalFrom, byte-identical.)
         const principal = gatedPrincipal(req, deps.config);
         if (deps.config.requirePrincipal && !principal) {
             sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
             return false;
         }
-        // [3273] C8:窄互认的读面半场——[3262] 只修了提交/续发面(createAuthorizer),head/audit/events
-        // 三读面走本函数,7.8.0 未同窗 ⇒ cli 停发哨兵头后存量会话「能续跑但看不见」,且 404 与「压根
-        // 不存在」黑盒同形(test [3273] 实测)。同 security.ts 三条件窄臂,语义/墓碑注同源(存量随会话
-        // 生命周期消亡后可整删);带具名 principal 的请求对哨兵行仍走下方 404 无 oracle 形。
         const legacyShellOwner = !deps.config.requirePrincipal && owner === "anon:shell-live" && (principal === undefined || principal === null);
         if (!legacyShellOwner && owner !== null && principal !== owner) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE); // #262:与 unknown 臂同串——「don't reveal existence」的意图此前被长短文差打穿
+            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
             return false;
         }
         return true;
     }
-    /** [1499] G — session-scoping ACCEPT phase on the run faces ([1498]⑥ soft rollout, 第一拍). principal answers
-     *  "whose data" (authz axis); session answers "which conversation" (content axis, [1493]). These faces deliver
-     *  conversation content (poll/events) or act on a conversation (cancel/steer/compact/detach, subagent
-     *  steer/resume) but were principal-gated only. Enforcement (absent ⇒ 404, subagentOutput-style) needs every
-     *  caller migrated first, so THIS phase 404s ONLY a PRESENT-but-MISMATCHED `?session=`: an honest caller
-     *  asserting its own session never mismatches on its own run — a mismatch IS the accidental cross-session
-     *  touch. Absent ⇒ allowed + warn-once per face (migration observability for the enforcement train). NB the
-     *  operator branch below is only REACHABLE where the preceding owner gate admits the caller: on faces whose
-     *  owner gate carries its own trusted arm (steer/compact/detach/subagent verbs) it is fully live; on the
-     *  runOwnerOk faces (poll/events/cancel — no operator arm, [1498]⑥ ledger) a cross-owner operator 404s at
-     *  the owner gate first, so here it covers only owner-null runs or an operator who IS the owner. Widening
-     *  those owner gates is a deliberate [1498]⑥ decision, not this phase's. A session-unbound run has nothing
-     *  to assert against. */
     const sessionAssertAbsentWarned = new Set();
     function runSessionAcceptOk(req, res, run, face, notFoundError = RUN_NOT_FOUND_MESSAGE) {
         if (!run.sessionId)
@@ -3200,7 +1922,7 @@ export function createHttpServer(rawDeps) {
             return true;
         if (explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals))
             return true;
-        sendError(res, 404, "not_found.run", notFoundError); // byte-identical to the face's own owner-gate wording (no distinguishable arm)
+        sendError(res, 404, "not_found.run", notFoundError);
         return false;
     }
     async function readJson(req) {
@@ -3218,13 +1940,9 @@ export function createHttpServer(rawDeps) {
             return JSON.parse(Buffer.concat(chunks).toString("utf8"));
         }
         catch {
-            // F1 (center K3S report): a malformed body is a client error → 400, not an uncaught 500.
             throw new HttpError(400, "invalid JSON body");
         }
     }
-    /** 2c session-sync: read a RAW request body (binary blob bytes) with a running per-request size cap — the bytes are
-     *  NEVER buffered unboundedly (the §5 "reject, not OOM" guard). Throws HttpError(413) the instant `max` is exceeded
-     *  (mid-stream, before the whole body is in memory). Returns the concatenated Buffer (≤ max). */
     async function readRawBody(req, max) {
         const chunks = [];
         let size = 0;
@@ -3236,15 +1954,6 @@ export function createHttpServer(rawDeps) {
         }
         return Buffer.concat(chunks);
     }
-    /**
-     * design/80 D-D (SLA-timer deny-sweep): resolve-DENY every pending human/irreversible_ask approval past its
-     * deadline (the per-approval SLA) — re-resume each with decision=deny so the model CONTINUES with the denial
-     * (graceful; vs the abort the reaper's expire() gives resource_limit/needs_review). Reuses resumeCheckpoint,
-     * so the markResuming CAS makes it idempotent across replicas (one replica wins each resume) and the parked
-     * run row is driven correctly. A per-call failure (e.g. a redeployed scenario) is swallowed → the row stays
-     * pending and is retried next tick, with the terminal_at_ms backstop as the eventual abort if the deny never
-     * succeeds. Bounded per tick by the store query's LIMIT. Wired into main.ts's reaper.
-     */
     const denySweepClockGuard = createWallClockJumpGuard({
         slaMs: deps.config.approvalTimeoutSec > 0 ? deps.config.approvalTimeoutSec * 1000 : undefined,
         onJump: ({ jumpMs, graceMs }) => deps.logger?.warn?.("deny_sweep_wall_clock_jump", {
@@ -3255,8 +1964,6 @@ export function createHttpServer(rawDeps) {
                 : "the wall clock stepped BACKWARD relative to the monotonic clock; the deny-sweep needs no grace for this direction (a receding deadline only DELAYS a deny) but the step itself is an operational fact worth recording.",
         }),
         onSuppressed: ({ remainingMs }) => deps.logger?.info?.("deny_sweep_clock_grace", { remainingMs }),
-        // codex R2 [high] 五:连续跳变撞上累计上限 ⇒ 守卫**响亮**恢复判定。这一行是运维必须看见的:
-        // 它说的是「本机墙钟在持续抖,我不再为它让路了,接下来的 deny 判定基于一个不稳的钟」。
         onGraceCapped: ({ totalGraceMs }) => deps.logger?.warn?.("deny_sweep_clock_grace_capped", {
             totalGraceMs,
             note: "the wall clock kept stepping forward; the approval SLA deny-sweep has stood down for the maximum cumulative grace and now RESUMES on a demonstrably unstable clock — a fail-closed leg that never runs is worse than one running on a bad clock. Fix NTP on this host.",
@@ -3266,18 +1973,9 @@ export function createHttpServer(rawDeps) {
         const cs = deps.checkpointStore;
         if (!cs)
             return;
-        // [4232]①/[4235]:**判定**钟的单调佐证。`now` 是墙钟(生产由 reaper 传 `Date.now()`),而
-        // `checkpoint.deadline` 是 core 按铸卡当时的墙钟算的绝对时刻 —— 墙钟凭空前跳 ⇒ 判定钟凭空多走同样的量,
-        // 人还没走开窗就没了(真机实测:SLA 45s,真实等 14s 即被自动拒)。守卫按单调钟宽限整拍让开;
-        // **记账钟一律不动**(下面 resumeCheckpoint 的审计/时间戳仍是真墙钟,core 的 totalWaitMs 账面同样不碰)。
         if (!denySweepClockGuard.admit(now))
             return;
         const expired = await cs.listExpiredApprovalGates(now).catch(() => []);
-        // [1591] 候裁③ 静默臂:parked 后台子代的过期 cp 不走 sweep 的重活赎回(deadline→terminal_at_ms 窗内
-        // 每行每 tick 一条 warn 的噪声源)——其收割属 reaper 的 expire+reconcileParkedAgents 车道。判别在
-        // resume 尝试之前做(省掉注定 409 的整条 ctx/resolveSpec 重建尝试;代价=每过期行两次店读,过期集
-        // 本就被店查询 LIMIT 界住);命中聚合为单条 info 留痕。判别自身故障 ⇒ 按非 parked 处理(保留 warn,
-        // fail-loud 方向)。
         const isParkedOwned = async (sessionId) => {
             if (deps.backgroundAgentStore === undefined)
                 return false;
@@ -3296,55 +1994,21 @@ export function createHttpServer(rawDeps) {
         };
         let parkedSkipped = 0;
         for (const { sessionId } of expired) {
-            // 对抗评审 2026-07-11: log the swallow — a per-tick failure retried forever (e.g. a policy change now folded
-            // into a 409 by resumeCheckpoint, or a redeployed scenario) was fully silent; the row sat pending to its
-            // terminal_at_ms with zero operator-visible signal. Behavior unchanged (skip + retry next tick), now diagnosable.
             if (await isParkedOwned(sessionId)) {
                 parkedSkipped += 1;
                 continue;
             }
-            // #204 件6②:出处 = `"timeout"`(窗到期,**没有人**答)。此前这里与人为 /decide 共用一个不带
-            // 出处的构造,于是下游把一次自动拒渲染成「有人拒绝了你」。
-            // 🕐 **#316 同族登记(本批刻意不改)**:末位 `acceptEarly` 不传 —— 本腿没有在等响应的 HTTP 客户端
-            // (它是内部 SLA 车道),受理化对它零收益;而且这条 for 循环**靠 await 串行**来给每 tick 的重活
-            // 限流,改成受理即返会让一个 tick 把整批过期卡的模型腿同时点着(下一个问题,不是本批的修)。
             await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", "timeout").then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, body: r.body }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: e instanceof Error ? e.message : String(e) }));
         }
         if (parkedSkipped > 0)
             deps.logger?.info?.("deny_sweep_parked_skipped", { count: parkedSkipped });
     }
-    /**
-     * #329 —— live 回决腿(`POST /v1/tool-approvals/:id/respond`)对一条**已 park** 的 ask 的赎回席。
-     *
-     * 语义 = 「壳本来要人手做的那件事,server 替它做完」:PARKED 行上的 gate 三坐标就是
-     * `/v1/approvals/:sessionId/decide` 里操作员回显的那三件,于是本席把它们原样喂回**同一条**
-     * `resumeCheckpoint` 腿(parked 子代赎回 / 任务级 resume 由那条腿自己 parked-first 分流)。
-     * [4872] 锚①「同腿新调用方,零新终局语义」:这里没有第二个终局写点,单赢者仍是那条腿的 CAS
-     * (`markResuming` / `claimParkedAgent`),本席只是又一个调用方。
-     *
-     * 三件刻意的姿势:
-     *  ① **binding 逐字回显、绝不重算** —— `checkpointToken` 给的是行上的 `gateToken`(= park 那一刻从
-     *     checkpoint 抄回的那一把):它同时是 D-1 的 stale 判据(gate 已被重铸/已解决 ⇒ 那条腿自己回
-     *     `approval_stale` 409),所以「决议投给了一张过期的卡」在这条链上是被**拒**的,不是被猜的;
-     *  ② **sessionId 取 checkpoint 自己的那一个**,不是 ask 行的 —— 委派子代的 park 落在子代会话上,
-     *     而 ask 行的 `sessionId` 是**投递上下文**(宿主流)的会话,拿后者去 resume 会打到别人的门上;
-     *  ③ **acceptEarly=true**(#316):有人正卡在 respond 的 HTTP 上等答复,受理语义是这条腿既有的形。
-     */
     async function redeemParkedAsk(req) {
         const cs = deps.checkpointStore;
         if (!cs) {
-            // 结构上到不了(协调器的 askStore 与 park 设施同在同不在);诚实拒,绝不假装受理。
             return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
         }
-        // 🔴 **计费提交三道门**(codex 对抗复审 R1-[high] 二,验真后修)。`POST /v1/tool-approvals/:id/respond`
-        // 刻意**不在** `isBillableSubmitPath` 里,而且必须留在外面:活卡回决是「让在飞的那一轮跑完」,排空期
-        // 恰恰要放行(那道门的自注写着 read/cancel/steer/respond 全开)。但**本席不是活卡回决** —— 它开一条新的
-        // resume 腿(烧模型),与 `/v1/approvals/:sessionId/decide` 同一件事;那条 url 在名单里、吃这三道门。
-        // 于是门贴在**这条臂**上,而不是整条路由上:文案与 errorCode 逐字取 `handle()` 的同三处(同一件事在
-        // wire 上只该有一种说法),真值也取同三个 dep(不另立判据)。⚠️ 唯一的形差如实记:那三处是
-        // `sendError` + `retry-after` 头,本席只产生**响应体**(路由用 `sendJson` 送),所以没有那个头 ——
-        // 体里的码/文案足以让消费端分型,退避节奏由它自己的通用 503 处置管。
         if (!hasServiceAuth(deps.config) && !deps.config.allowUnauthedWrites) {
             return { status: 503, body: { error: "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions", errorCode: "auth.service_token_required" } };
         }
@@ -3369,12 +2033,6 @@ export function createHttpServer(rawDeps) {
                 },
             };
         }
-        // 🔴 A-058 F0(7.40 合并窗重扫,high,opus 证伪 CONFIRMED):第四道 = **成本配额门**。`/decide` 对
-        // 同一动作吃 `quotaExceeded`(approvals-assistant 路由挂);respond 路由刻意只有 rateLimited(活卡
-        // 回决=resolve 在飞 promise,确实无新计费,路由注释如实),但本席开的是一条新的烧模型 resume 腿——
-        // 修前超窗租户可以「攒一张会 park 的卡、park 后再赎」绕开成本上限。判据与文案逐字取 `quotaExceeded`
-        // 的同三件(gatedPrincipal 验证身份 / costQuota.check / 429 同码同文案);无 principal = not gated
-        // 是那道门自己的成文语义(单用户 turnkey 形),此处同判不另立。
         if (deps.costQuota && req.httpReq) {
             const quotaPrincipal = gatedPrincipal(req.httpReq, deps.config);
             if (quotaPrincipal !== undefined) {
@@ -3396,14 +2054,8 @@ export function createHttpServer(rawDeps) {
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
         if (!cp) {
-            // 行说 PARKED,checkpoint 却没了(过期清算 / 已被消费)——answer 无处兑现。用与「本会话没有 pending」
-            // 同一句同一码(不给存在性谕示,与 decide 腿的 404 口径一致)。
             return { status: 404, body: { error: "approval not found", errorCode: "not_found.approval" } };
         }
-        // 🔴 属主门第三道:**checkpoint 当下的 scope**(codex R1-[high] 一的另一半)。判据逐字取 `/decide` 路由
-        // 的非 operator 支(`"_"`/null = 匿名单用户形,开放;否则必须与已验证调用方逐字相等)—— 本席绝不比那条
-        // 腿宽。收编把行与 cp 的身份一起改写之后,持旧 approvalId 的前属主到这里被挡下(协调器那边还有一道
-        // 行属主门,两道各判各的持久事实)。**不加 operator 越权臂**:活卡是终端用户自己的。
         const cpPrincipal = decodeCheckpointScope(cp.scope);
         if (cpPrincipal !== undefined && cpPrincipal !== req.principal) {
             deps.logger?.warn?.("parked_late_decision_scope_mismatch", { askId: req.askId });
@@ -3415,22 +2067,10 @@ export function createHttpServer(rawDeps) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        // #204 件6③:出处 = `"human"` —— 走到这里的恒是壳上那张卡被**人**按下的那一次 respond
-        // (窗到期/取消/SLA sweep 都不经本席)。
         const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true);
         return { status: out.status, body: out.body };
     }
-    /**
-     * #261 §1(a):**副本本地活体谓词** —— 这条 taskId 现在是不是本副本手上的活腿。
-     *
-     * 交出的是一个 `(taskId) => boolean` **探针**,不是 Map:登记面的属主仍是本模块(它们是 cancel /
-     * steer / preempt 的权威表),对账腿只问一个是非题。搬 Map 会造出第二份活性判据,而两份判据必漂移。
-     * 并集口径与 `drainState.inflight` 逐字同源(`inflightRuns` = 在飞 durable 腿、`steerableRuns` =
-     * 持活 core 流的腿;一条 resume 腿同时在两表里),所以「本副本认为它活着」在两条消费线上是同一句话。
-     */
     const isRunLiveOnThisReplica = (taskId) => inflightRuns.has(taskId) || steerableRuns.has(taskId);
-    // Augment the http.Server with the D-D deny-sweep handle (back-compat: all 12 callers keep using the return
-    // value AS an http.Server — listen/close/etc. — while main.ts's reaper reads server.denyExpiredApprovals).
     return Object.assign(server, { denyExpiredApprovals, isRunLiveOnThisReplica, redeemParkedAsk });
 }
 const WORKER_SWAP_REDEEMABLE = {
@@ -3439,114 +2079,37 @@ const WORKER_SWAP_REDEEMABLE = {
     governed_unwired: true,
     real_approval_damaged: false,
     real_approval_forged: false,
-    // core 5.30.0(#246 提货):v9 read-face 段的行完整性两词——d.ts 逐字与 real_approval 两词同列
-    // 「terminal for the row's current bytes」,换 worker 不可兑,归属同前(invalid_outcome 臂,行留 pending)。
     read_face_damaged: false,
     read_face_forged: false,
     constraint_chain_missing: false,
 };
-/** 判别符缺席(旧引擎裸抛)或词表不认得 ⇒ **false**,即维持修前的 TERMINAL 归属。fail-closed 的方向在
- *  这里是「不宽容默认」:一个我们还没读过的新臂不该因为一个 `?? true` 被悄悄改判成「重试吧」。 */
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
 }
-/** POST endpoints that trigger BILLABLE work — the fail-closed auth guard must cover ALL of them (council: the
- *  guard's inline list had drifted from the handlers and missed `/v1/approvals/:id/decide`, which resumes a run
- *  via resumeCheckpoint/store.decide → paid tokens). Keep this in sync when adding a billable POST route. */
-// [#104/#87-A3] exported for the declaration gate (test/billable-route-declaration.test.ts):每条路由
-// 标签必须显式申明 billable,与本谓词逐样本对账——「Keep this in sync」从注释请求变成机器断言。
-/**
- * 「这条 url **是**计费提交面,但它到底提不提交由**请求体里的方法**决定」—— 目前只有 A2A 的
- * JSON-RPC 端点(单 URL 承载 `message/send` 写 + `tasks/get` 读,因为 agent card 只能公告一个 `url`)。
- *
- * 用途:两道**可用性** 503(drain / model-roster-pending)按 url 一刀切会把 `tasks/get` 这条纯读一起
- * 关掉,而单副本部署恰好在重启/依赖降级窗口里最需要取回已完成的结果(codex 轮2 R2-3,验真后修)。
- * 本谓词让 `handle()` 对这条 url **跳过**那两道,改由域模块在 `message/send` 分支里施加同样的两道
- * (`routes/a2a-serve.ts` 的 `submitUnavailable`,文案逐字同源)。
- *
- * 🔴 **只豁免那两道,不豁免安全轴**:`isBillableSubmitPath` 本身**不变**(它仍答 true),所以
- *  ① 无 service token 的部署上那道 fail-closed 503 照旧罩着这条 url —— 它判的是「这台机能不能收写」,
- *    与方法无关,而且门必须在解析请求体**之前**;
- *  ② billable 申明门钉的仍是那只纯谓词(表里 `/v1/a2a` 依旧 billable=true)。
- * 新成员进本表 = 承诺「该域在自己的方法分支里补齐那两道」,漏补就是一条静默旁路;所以本表只该有
- * 「单 URL 多方法」这一种成员,加一条要连同它的域内补门一起过评审。
- */
 export function isMethodDispatchedSubmitPath(url) {
     return url === "/v1/a2a";
 }
-/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源。**单一属主**:`handle()` 的
- *  凭证门与 #329 的 parked 赎回席读同一句(两处手抄迟早只改一处,而这条判据决定的是「无凭证部署上写口
- *  开不开」)。 */
 function hasServiceAuth(config) {
     return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
 }
 export function isBillableSubmitPath(url) {
-    return (url === "/v1/side-query" || // [1469] one-shot brain call — runs the model, so it rides every billable-submit gate
+    return (url === "/v1/side-query" ||
         url === "/v1/tasks" ||
         url === "/v1/tasks/stream" ||
         url === "/v1/runs" ||
         url === "/v1/leader" ||
-        // DESIGN-269 车2:A2A JSON-RPC 端点。`message/send` 走的是与 /v1/runs **同一条**提交腿 ⇒ 它烧模型
-        // ⇒ 三道 503 门(drain / model-roster-pending / 无 service-token)必须对它生效,否则一台正在下线的
-        // 副本会照收外部 peer 的新任务(wake 当年漏在名单外犯的就是这一条)。
-        // ⚠️ 端点是**单 URL** 的(A2A 卡只公告一个 url),所以同一道门也会在排空期挡下 `tasks/get` 的读。
-        // 方向取「宁紧」:开新模型工作不可回滚,而读面有现成补偿(行是 durable 的,换一台副本读同一条)。
         url === "/v1/a2a" ||
-        ASSISTANT_RESUME_RE.test(url) || // resource_limit/preempt resume runs the model → BILLABLE (preempt is not)
-        ASSISTANT_PLAN_REVIEW_RE.test(url) || // plan_review approve/edit resumes + runs the model → BILLABLE
-        RUN_SUBAGENT_RESUME_RE.test(url) || // 对抗复查 B-2(HIGH):subagent revive (handle.resume) STARTS model work → BILLABLE
-        // 缝合审 2026-07-31:wake 走的是 assistant resume 那条同一个 `driveResumeIntoRunLog` 驱动腿
-        // (`routes/notify-wake.ts` 头注:「wake 会**烧模型**(续跑)」),resume 在名单里而它一直不在 ⇒
-        // 同一条模型腿从 wake 进来时 drain / model-roster-pending / 无 service-token 三道门全不生效。
-        // 正则从 notify-wake 单源导入,免得又漂开。钉在 test/drain.test.ts。
+        ASSISTANT_RESUME_RE.test(url) ||
+        ASSISTANT_PLAN_REVIEW_RE.test(url) ||
+        RUN_SUBAGENT_RESUME_RE.test(url) ||
         SESSION_WAKE_RE.test(url) ||
         url.startsWith("/v1/approvals"));
 }
-/**
- * A-010.23(#209 件5)—— **改写门**:不烧模型、但在**没有任何 service credential** 的部署形下必须与
- * billable / bake 两族一样 fail-closed 的写门。谓词与 `isBillableSubmitPath` **刻意分开**:这几扇门
- * `billable=false`(零模型工作),塞进那张名单会让它们连带吃 drain 与 model-roster-pending 两道 503 ——
- * 而收编与规则读写在排空期/roster 未落时做完全无害。
- *
- * 判据(两个合取项,缺一不进本表)= 「授权的唯一输入是 principal 头」∧「动作是**持久改写**」:
- *  · `POST /v1/adoption` —— operator-only 的一次性部署级动作,把一个 principal 名下**每一行**重写到另一个
- *    身份;授权判据 `explicitOperatorOk(gatedPrincipal(...))`。
- *  · `POST /v1/rules/cc-import/*` —— principal lane 的**持久 allow 规则**铸造口;一条持久 allow 规则对后续
- *    同命令的 classify 档 ask 常驻消音(core #144 之后仍然如此,只是不再消 mandated 的那些)。
- *  · `DELETE /v1/rules` —— 同一个规则店的**撤销**口。方向相反(收紧)但同样是持久改写,而且它多一条
- *    operator 越权域(`?principal=` / body 的 `principal` 让 operator 收回**任一**租户的规则)⇒ 伪造一个
- *    列在 `OPERATOR_PRINCIPALS` 里的头,就能把每一位租户的规则一次清空。
- * 无 service token 的部署上 `verifiedPrincipal` 走的是「BFF/gated:头已由上游验过」那一支,而这一形恰恰
- * 是**没有**那个上游 —— 于是伪造一个头就能收编别人、替任意租户种下常驻放行、或替他们全删。bake 门当年
- * 补的就是同一句话,`isDestructiveSessionWrite` 从逐条路由白名单改成族判定也是同一句话(那次的措辞逐字是
- * 「a forged principal header alone could **tighten/DoS** a session's tools」——撤销口落的正是 DoS 那一半)。
- *
- * 🔴 **方法感知**(codex 对抗复审 R2-[high],验真后修):撤销走的是 `DELETE`,而本门最初只挂在 `POST` 的
- * 合取里 —— 于是一个自称「持久改写」的谓词把爆炸半径最大的那条动词漏在门外,正是 `isDestructiveSessionWrite`
- * 当年被抓到的同一形。签名因此收方法,与那只谓词逐字同形。
- * 🔴 读面**原则上**不进本表:`GET /v1/adoption/:id` 与 `GET /v1/rules` 各有自己的**属主门**兜底,本门只拦写。
- *
- * 🔴 **第二个合取项的加宽**(codex 对抗复审 [high],#277 提货批,验真后修)——判据现在是
- * 「持久改写 **或** 授权唯一输入是 principal 头的**跨租户治理读**」。加宽是为了收进 #264 v2-c 的两口:
- *  · `POST /v1/memory/import` —— 直接落在**原**判据上,而且是本仓最深的那一种持久改写:它把别处铸的
- *    条目 / 挑战 / 污染标记 / 托管链落进本部署的记忆平面。伪造一个在册 operator 头 ⇒ 一份**攻击者自制的
- *    治理史**成为本店的账;而记忆是模型**每次挂载都读**的面,比种一条常驻 allow 规则更深(那条只影响
- *    ask 会不会问,这条影响模型相信什么)。
- *  · `POST /v1/memory/export` —— 是**读**,按原措辞本不该进。但被点名豁免的那两条读各有属主门兜底,
- *    而本条**没有**:它的授权判据就是 `explicitOperatorOk`,过了就是**全库**——一次调用取走每个 scope 的
- *    条目正文 + 托管链 + 跨会话污染标记 + lineage。把一次全租户记忆外泄留在门外、只为守住「本门只拦写」
- *    这句措辞,是把措辞看得比它要保护的东西更重。加宽后的判据仍然是**闭**的(不是「写门以外都进」):
- *    它要求「授权的唯一输入是那个头」∧「一次调用的爆炸半径跨租户」,`GET /v1/rules` 那种属主门读不满足。
- * 行为面钉:`test/rewrite-door-service-token-gate.test.ts`(六扇门各一正一反 + 逃生口格 + 读面负控)。
- */
 export function isCredentialGatedRewrite(method, url) {
     const m = method.toUpperCase();
     if (m === "POST") {
         return (url === "/v1/adoption" ||
             url.startsWith("/v1/rules/cc-import/") ||
-            // #264 v2-c 的两口(codex 对抗复审 [high],验真后修)。判据见上方头注**加宽**的那一段:
-            // import 是本仓最深的持久改写(外来治理史成为本店的账,而记忆是模型每次挂载都读的面);
-            // export 虽是读,但它是**没有属主门兜底**的跨租户治理外泄——两者的授权唯一输入都是那个头。
             url === "/v1/memory/import" ||
             url === "/v1/memory/export");
     }
@@ -3554,13 +2117,6 @@ export function isCredentialGatedRewrite(method, url) {
         return url === "/v1/rules";
     return false;
 }
-// ⚠️ SSE 帧纪律(2026-07-12):center BFF 中继凭「data 无 type 字段」识别心跳帧并吞掉
-// (AgentEvent 是 closed oneof 全带 type,故可控)。**未来新增任何 SSE data 帧必须带 type 字段**,否则会被
-// 中继当心跳吞掉、永远到不了前端。heartbeat 帧(`event: heartbeat` + `data: {}`)是唯一豁免。
-/** 路由标签表(表驱动;[2061] 批1 层A 重写)。顺序=具体先于泛化。
- *  🔴 本表由 `test/route-shape-roster.test.ts` 棘轮看守:门机器枚举源码全部路由模式并断言每条都映射到
- *  非 "other"——新路由不补此表该门当场红(census 抓获本表曾漂掉 56 条模式:session-sync/workspace/
- *  workflows/subagents/attachments/images/leader 等整族全折 "other",metrics 不可分桶)。 */
 const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
     [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
@@ -3593,23 +2149,16 @@ const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
     [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
     [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],
-    // #151 车4:durable 回决口。必须排在 `/v1/tasks/:id/$sub` **之前**?—— 不必(那条只认三个字面动词),
-    // 但仍按「具体先于泛化」的表序纪律放在它前面,免得日后 $sub 放宽成 `[^/]+` 时静默吞掉本条。
     [/^\/v1\/tasks\/[^/]+\/asks\/[^/]+\/decision$/, "/v1/tasks/:id/asks/:askId/decision"],
-    // [3321] tool-results 读面:同样排在 `/v1/tasks/:id/$sub` 之前(具体先于泛化的表序纪律;$sub 那条
-    // 只认三个字面动词,今日不冲突,但它日放宽成 `[^/]+` 时本条不会被静默吞掉)。
     [/^\/v1\/tasks\/[^/]+\/tool-results\/[^/]+$/, "/v1/tasks/:id/tool-results/:ref"],
     [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
     [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
     [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
     [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
     [/^\/v1\/adoption\/[^/]+$/, "/v1/adoption/:id"],
-    // #270 车2:留存 legal-hold 的放置/解除。`*` 不是 `+` —— 空段 = 无主桶(单用户部署里它是唯一的域;
-    // 理由逐字见 routes/retention-ops.ts 的「域的两个边界」)。
     [/^\/v1\/ops\/retention\/holds\/[^/]*$/, "/v1/ops/retention/holds/:domain"],
     [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
     [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
-    // design/177 共享记忆库只读面。两条各自成桶(列举是窗口读、正文是单文档读,延迟分布不同族)。
     [/^\/v1\/shared-memory\/stores\/[^/]+\/documents$/, "/v1/shared-memory/stores/:store/documents"],
     [/^\/v1\/shared-memory\/stores\/[^/]+\/document$/, "/v1/shared-memory/stores/:store/document"],
 ];
@@ -3620,55 +2169,20 @@ const ROUTE_LABEL_LITERALS = new Set([
     "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities",
     "/v1/images", "/v1/images/bakes", "/v1/images/bakes/claim", "/v1/images/select", "/v1/images/register",
     "/v1/workflows", "/v1/attachments", "/v1/leader", "/v1/outcomes", "/v1/side-query",
-    // 2026-07-31 缝合审:它一直不在表里,而它是**每个壳一条的长连接** —— 那种 duration 落进 `other`
-    // 桶会把该桶的 P99 拉爆,运营看不出是谁。批1 建表时漏掉它不是遗忘:fleet 域用 `pathname === …` 判路,
-    // 名册门的枚举器当时只认 `url === …`,整条路由对门隐形(枚举器已一并补上)。
     "/v1/fleet/stream",
-    // ⚠️ `/v1/memory/export` 是**两个面**共用的标签(GET=142-S5 属主自助条目读,POST=#264 治理包)——
-    // 标签粒度粗于面的边界,但两面同 billable(false)、同为低频运维/壳读,合桶不会掩盖任何一方的信号。
     "/v1/memory/export", "/v1/sendfile-links",
-    // #264 v2-c:治理包的导入口(operator-only,POST)。低频,但它是**治理写面** —— 它的 4xx/5xx 分布
-    // 是「这批迁移到底成没成」的第一手机器信号,落进 `other` 桶等于迁移现场看不见它。同族纪律:写
-    // **字面量**不引常量(名册门与 billable 申明门都扫源码文本)。
     "/v1/memory/import",
-    // design/177:共享记忆库清单面(具名两条走上面的模式表)。
     "/v1/shared-memory/stores",
-    // #154:装配自证读面(operator-only)。低频但**每次都在排障现场被打**,落进 `other` 桶等于排障时看不见。
     "/v1/diagnostics/wiring",
-    // design/183:收编发起口(operator-only,一次性部署级动作)。低频、但它的 duration 与失败率是
-    // 迁移现场唯一的机器信号,落进 `other` 桶就看不见了。
     "/v1/adoption",
-    // #291:停机因由声明口(operator-only,drain 前一次性动作)。同 adoption 判:低频但只在停机现场被打。
     "/v1/admin/drain",
-    // #322 批1 追加件:配置手动刷新口(operator-only)。同判:低频,但它的 duration 与失败率正是「这次
-    // 配置到底拉没拉下来」的第一手信号,落进 other 桶就看不见了。同族纪律:写**字面量**不引常量。
     "/v1/admin/config/refresh",
-    // #154 车二:CC settings 导入两口。字面量(无 id 段)⇒ 进 LITERALS 表而不是模式表。
-    // 🔴 写**字面量**而不是引 `RULES_CC_IMPORT_*_PATH` 常量:名册门与 billable 申明门都是**扫源码文本**
-    // 的(它们正则抓本表里的双引号词),引常量会让两条新路由对两道门隐形 —— 那不是「过了门」,是绕过门。
-    // ⚠️ 本段注释里也不许出现方括号后紧跟右圆括号的字符对:billable 门的表捕获正则是**非贪婪**的,
-    //    那两个字符会让它在这里提前收尾,后面的字面量整段落在门的视野外(写这条注时真的踩到过)。
     "/v1/rules/cc-import/prepare", "/v1/rules/cc-import/redeem",
-    // #203 §2:撤销面两口(GET 列举 / DELETE 撤销)共用一个字面路径。同样写字面量而不是引 `RULES_PATH`
-    // 常量,理由与上一条逐字相同(名册门与 billable 申明门都扫源码文本)。
     "/v1/rules",
-    // DESIGN-269 车2:server-as-peer 两口。卡是**公网匿名**面(唯一一条不吃服务凭据的 2xx 路由),
-    // 它的 QPS 与 duration 是判断「有没有人在扫我们」的第一手材料;RPC 口是外部 peer 的提交面。
-    // 两条都落进 `other` 桶 = 对外暴露面在 metrics 上不可分。同上,写**字面量**不引常量(两道门扫源码文本)。
     "/.well-known/agent-card.json", "/v1/a2a",
-    // #A1([4147] 件3):后台 agent 名册读面。壳每次开面板打一次,是**每用户高频**的租户读 ——
-    // 落进 `other` 桶会把它的 duration 和 4xx 混进一堆低频运维口里。同上,写字面量不引常量。
     "/v1/agents/roster",
-    // #270 车2:留存审计读面(operator-only)。低频,但它是「留存到底删没删、按哪档删的」的唯一读口
-    // —— 落进 `other` 桶等于合规排障现场看不见它。同上,写**字面量**不引常量(名册门与 billable
-    // 申明门都扫源码文本)。
     "/v1/ops/retention/audit",
 ]);
-/** Stable, low-cardinality route label for metrics/logs (ids collapsed to `:id`).
- *  [#104] 字面量**先于**模式:此前模式先查,五条精确路由被形状桶吞掉(`/v1/approvals/stream`
- *  落 ":id"、`/v1/images/{bakes,select,register}` 落 ":profile"、`/v1/images/bakes/claim` 落
- *  "bakes/:id")——长连接 stream 的 duration 混进 :id 桶正是 fleet/stream 案的同族错桶病。
- *  精确匹配恒比形状匹配更对,序修零反例(billable-route-declaration 门逐样本钉)。 */
 export function routeLabel(_method, url) {
     if (ROUTE_LABEL_LITERALS.has(url))
         return url;
@@ -3677,13 +2191,9 @@ export function routeLabel(_method, url) {
             return label;
     return "other";
 }
-/** CORS v2: allowlist semantics. A SINGLE configured origin keeps the v1 posture
- *  (echoed unconditionally — non-browser callers see it too, byte-compat); MULTIPLE origins match the
- *  request's Origin header (echo the matched one, `Vary: Origin` so a shared cache never serves origin-A's
- *  grant to origin-B; no match ⇒ no allow-origin header ⇒ the browser refuses). Empty list = CORS off. */
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
-        return; // defensive undefined: a hand-built test config may omit the field
+        return;
     let allow;
     if (origins.length === 1) {
         allow = origins[0];
@@ -3696,23 +2206,8 @@ function cors(res, req, origins, principalHeader) {
     if (allow === undefined)
         return;
     res.setHeader("access-control-allow-origin", allow);
-    // 🔴 这三行自 2026-07-14 公开快照起逐字未动,而这期间进来的路由与请求头它一个都不认
-    // (2026-08-01 缝合审)。浏览器前端撞的不是"请求失败"而是**请求根本发不出去** —— OPTIONS 预检就被拒。
-    // 维护纪律:**新增 PUT/DELETE 路由、或新读一个自定义请求头时,这里必须同步**;
-    // `test/cors-v2.test.ts` 的三条钉逐个断言方法与头名,漏一个当场红。
     res.setHeader("access-control-allow-methods", "GET, POST, PUT, DELETE, OPTIONS");
-    // Include the principal header so a browser front-end that sends it isn't rejected by the OPTIONS preflight
-    // (which would otherwise drop identity → an owner=null session under requirePrincipal=false).
-    // 后五项都是**真被 handler 读**的自定义头:`idempotency-key`(tasks/runs/images)、
-    // `x-detach-on-disconnect`(tasks 断连不中止)、direct-door 决策证明三件套(approvals /decide 的
-    // crypto 绑定腿 —— 缺了它,direct-door worker 上的 web 审批面在浏览器里根本用不了)。
-    res.setHeader("access-control-allow-headers", 
-    // direct-door 三件套用 security.ts 的具名导出插值(与同句的 `${principalHeader}` 同姿势)——手抄的
-    // 头名漏改在这一行是**静默**的:预检挡下 ⇒ 请求到不了 handler,任何一处都不会报错。
-    `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
-    // 🔴 expose-headers 此前**整个缺席** ⇒ fetch 类客户端读不到 `X-Task-Id`(routes/tasks.ts 经 sseHeaders
-    // 下发的 durable rewind handle)。tasks.ts 的 G15 meta 帧注释把这归因为「EventSource 与部分代理读不到
-    // 响应头」—— 对 EventSource 成立,但对 fetch 客户端真因是这里缺 expose,meta 帧只是绕过。
+    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
     res.setHeader("access-control-expose-headers", "x-task-id, retry-after");
 }
 //# sourceMappingURL=server.js.map