@sema-agent/server 7.44.0 → 7.45.0

package/dist/config-types.d.ts

@@ -518,6 +518,10 @@ export interface ServiceConfigFlat {
         username: string;
         privateKey: string;
         mountPath?: string;
+        hostKey?: {
+            fingerprintSha256?: string;
+            knownHostsPath?: string;
+        };
     } | {
         provider: "adb";
         serial: string;
@@ -965,6 +969,17 @@ export interface ServiceConfigFlat {
      *  set `PLAN_MODE_ENABLED=false` to opt out. USER-driven plan (`body.permissionMode=plan` → enablePlanMode +
      *  handsReadOnly, read-only from start) is unaffected/independent. */
     planModeEnabled: boolean;
+    /**
+     * [5118]⑥(core 5.56 `Hooks.timeoutMs` 座)—— **每一只 hook 席位单次调用的时间上限**(ms)。
+     * `HOOKS_TIMEOUT_MS`;**缺席 = 不铸键**,由 core 自默认(600s = CC 自己的数;server 不复制上游默认)。
+     *
+     * 🔴 `0` 是有效值(core 契约逐字:写下零的部署说了一件事 —— 每个席位立即到期),不是「未设」;
+     * 坏值(非整数 / 负 / 超 `setTimeout` 32 位上限)**拒启**,解析见 config.ts `parseHooksTimeoutEnv`。
+     * 施加点 = `main.ts` 的 `deploymentHooks`(server 车道)与 `run-local.ts` 的同名记录(CLI 本地车道,
+     * merge-rescan 745 补折:该腿今日仅同步计数器席位、折上为防倒退)。server 车道一处施加两条腿同时
+     * 生效:既是 `RunnerDeps.hooks`,又是 `resolve-spec` 折进 task hooks 的部署基线。
+     */
+    hooksTimeoutMs?: number;
     /** SVC-2 (adversarial-review): the workflow_journal GC retention — the reaper purges journal rows older than
      *  this (bounds the heaviest, TaskResult-bearing table; a resume older than it re-runs live). Default 7 days.
      *  `WORKFLOW_JOURNAL_RETENTION_MS`. */
@@ -1401,7 +1416,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  config 这一层它只是一句声明。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -9,6 +10,7 @@ import { isV2ScopeKey } from "./memory-scope.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { RETENTION_MODES } from "./config-types.js";
+import { normalizeSshFingerprint } from "./ssh-host-key.js";
 export { RETENTION_MODES } from "./config-types.js";
 function csv(name) {
     return (process.env[name] ?? "")
@@ -362,6 +364,35 @@ function headerNameEnv(name, fallback) {
         throw new Error(`env ${name}="${v}" must be a single header name ([A-Za-z0-9_-]+)`);
     return v;
 }
+function parseHooksTimeoutEnv() {
+    const raw = process.env.HOOKS_TIMEOUT_MS;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const n = parseNumOrFail("HOOKS_TIMEOUT_MS", raw);
+    if (!Number.isInteger(n) || n < 0 || n > 2147483647) {
+        throw new Error(`env HOOKS_TIMEOUT_MS="${raw}" must be an integer in [0, 2147483647] ms (0 = every hook seat expires immediately; unset = core's own default)`);
+    }
+    return n;
+}
+function parseSshHostKeyEnv() {
+    const fpRaw = process.env.SSH_HOST_FINGERPRINT;
+    const khRaw = process.env.SSH_KNOWN_HOSTS;
+    const fingerprintSha256 = fpRaw !== undefined && fpRaw !== "" ? normalizeSshFingerprint(fpRaw) : undefined;
+    let knownHostsPath;
+    if (khRaw !== undefined && khRaw !== "") {
+        try {
+            readFileSync(khRaw, "utf8");
+        }
+        catch (e) {
+            throw new Error(`SSH_KNOWN_HOSTS=${JSON.stringify(khRaw)} is not a readable file (${e instanceof Error ? e.message : String(e)}) — ` +
+                `refusing to start rather than pretending host-key verification is configured (#296 / C-R21).`);
+        }
+        knownHostsPath = khRaw;
+    }
+    if (fingerprintSha256 === undefined && knownHostsPath === undefined)
+        return undefined;
+    return { ...(fingerprintSha256 !== undefined ? { fingerprintSha256 } : {}), ...(knownHostsPath !== undefined ? { knownHostsPath } : {}) };
+}
 function normalizeSshPrivateKey(raw) {
     const v = raw.trim();
     if (v.includes("BEGIN ") && v.includes("PRIVATE KEY")) {
@@ -416,6 +447,22 @@ export function applyAutoCompactWindow(m, explicit) {
     delete target.autoCompactTokens;
     return was1m ? "removed-1m" : "removed";
 }
+function noticeAutoCompactAboveWindow(slot, envName, m) {
+    const act = m.autoCompactTokens;
+    const window = m.contextWindow ?? 0;
+    if (act === undefined || window <= 0 || act <= window)
+        return;
+    CONFIG_NOTICES.push({
+        event: "auto_compact_tokens_above_context_window",
+        fields: {
+            slot,
+            model: m.id,
+            value: String(act),
+            contextWindow: String(window),
+            note: `${envName}=${act} is ABOVE the ${slot} model "${m.id}" physical context window (${window}) — core uses autoCompactTokens as the TRIGGER-side window, so a value above the physical window means autocompaction effectively never fires and the destructive context guard truncates history instead (the opposite of what this knob is for). The value is applied as configured (not clamped, not rejected); lower it below the window — CC's own shape is window-33000.`,
+        },
+    });
+}
 function parseStoreDomain(ctx) {
     const { requirePrincipal } = ctx;
     const dbBackendSet = !!process.env.DB_BACKEND;
@@ -577,12 +624,28 @@ function parseModelDomain() {
         CONFIG_NOTICES.push({
             event: "auto_compact_window_not_derived_1m",
             fields: {
+                slot: "main",
+                model: model.id,
                 note: `model "${model.id}" declares a >=1M context window but no autoCompactTokens — earlier versions implicitly applied 967000 here, which is CC's claude-sonnet-5-only per-model value (A-065 P2-6 rescinded the width-based derivation). Set MODEL_AUTO_COMPACT_TOKENS for a dual-window trigger; without it core uses its plain W-33000 trigger geometry on the full window.`,
             },
         });
     }
-    if (cheapModel)
-        applyAutoCompactWindow(cheapModel);
+    noticeAutoCompactAboveWindow("main", "MODEL_AUTO_COMPACT_TOKENS", model);
+    if (cheapModel) {
+        const cheapAct = optFinitePositiveEnv("MODEL_CHEAP_AUTO_COMPACT_TOKENS");
+        if (applyAutoCompactWindow(cheapModel, cheapAct) === "removed-1m") {
+            const inherited = process.env.MODEL_CHEAP_CONTEXT_WINDOW === undefined || process.env.MODEL_CHEAP_CONTEXT_WINDOW === "";
+            CONFIG_NOTICES.push({
+                event: "auto_compact_window_not_derived_1m",
+                fields: {
+                    slot: "cheap",
+                    model: cheapModel.id,
+                    note: `cheap slot model "${cheapModel.id}" declares a >=1M context window (${cheapModel.contextWindow}${inherited ? ", inherited from the main model — MODEL_CHEAP_CONTEXT_WINDOW is unset" : ""}) but no autoCompactTokens — earlier versions implicitly applied 967000 to this slot too, which is CC's claude-sonnet-5-only per-model value (A-065 P2-6 rescinded the width-based derivation). Set MODEL_CHEAP_AUTO_COMPACT_TOKENS for a dual-window trigger on this slot (MODEL_AUTO_COMPACT_TOKENS is the MAIN slot's knob and is deliberately NOT inherited — it is declared against the main model's id/window); without it core uses its plain W-33000 trigger geometry on the full window for the subagent/summarize roles.`,
+                },
+            });
+        }
+        noticeAutoCompactAboveWindow("cheap", "MODEL_CHEAP_AUTO_COMPACT_TOKENS", cheapModel);
+    }
     const models = { default: model, [model.id]: model };
     if (cheapModel)
         models[cheapModel.id] = cheapModel;
@@ -1189,6 +1252,7 @@ function parseOrchestrationDomain(ctx) {
                                 privateKey: normalizeSshPrivateKey(process.env.SSH_PRIVATE_KEY),
                                 ...((n) => (n !== undefined ? { port: n } : {}))(optNumEnvStrict("SSH_PORT")),
                                 ...(process.env.SSH_MOUNT_PATH ? { mountPath: process.env.SSH_MOUNT_PATH } : {}),
+                                ...((hk) => (hk !== undefined ? { hostKey: hk } : {}))(parseSshHostKeyEnv()),
                             }
                             :
                                 process.env.REMOTE_EXEC === "adb" && process.env.ADB_SERIAL
@@ -1244,6 +1308,7 @@ function parseOrchestrationDomain(ctx) {
         experimentalObserverAgents: boolEnv("EXPERIMENTAL_OBSERVER_AGENTS", false),
         schedulerEnabled: postureOn("SCHEDULER_ENABLED"),
         planModeEnabled: boolEnv("PLAN_MODE_ENABLED", true),
+        ...((n) => (n !== undefined ? { hooksTimeoutMs: n } : {}))(parseHooksTimeoutEnv()),
         ...(process.env.SCHEDULER_STORE_PATH ? { schedulerStorePath: process.env.SCHEDULER_STORE_PATH } : {}),
         schedulerSessionWakeup: boolEnv("SCHEDULER_SESSION_WAKEUP", true),
         schedulerSessionLifetime: boolEnv("SCHEDULER_SESSION_LIFETIME", true),
@@ -1514,7 +1579,7 @@ const AUTH_GROUP_KEYS = [
 const ORCHESTRATION_GROUP_KEYS = [
     "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
-    "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "workflowRunStoreBackend",
+    "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "hooksTimeoutMs", "workflowRunStoreBackend",
     "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "delegationEntryCaps", "rosterRetentionMs", "leaderRunStaleMs", "scratchpadSweepTtlMs", "sandboxPkgSource",

package/dist/hooks/hook-llm.js

@@ -1,3 +1,4 @@
+import { adjudicateModelRoute, normalizeBaseUrl, resolveRouteCredential, routeRefusalText } from "@sema-agent/core";
 import { matchCatalogModel } from "../model-select.js";
 export function createHookLlm(deps) {
     const { config, metrics } = deps;
@@ -34,6 +35,25 @@ export function createHookLlm(deps) {
             return shapeFrom(requested, config.model, requested);
         return { ok: false, error: `hook model "${requested}" is not in this deployment's catalog` };
     };
+    const judgeRoute = (pick, perModelKey, deploymentKey, declaredRoot) => {
+        const credential = resolveRouteCredential({
+            ...(perModelKey !== undefined ? { optionsApiKey: perModelKey } : {}),
+            ...(deploymentKey !== undefined ? { configApiKey: deploymentKey } : {}),
+        });
+        const verdict = adjudicateModelRoute({ id: pick.catalogRef, baseUrl: pick.baseUrl }, credential, { ...(declaredRoot !== undefined ? { baseUrl: declaredRoot } : {}) });
+        if (!verdict.ok) {
+            return { ok: false, error: `hook model "${pick.catalogRef}" cannot be routed — ${routeRefusalText(verdict)}` };
+        }
+        if ((verdict.posture === "unpinned" || verdict.posture === "keyless") && normalizeBaseUrl(pick.baseUrl) !== normalizeBaseUrl(declaredRoot)) {
+            return {
+                ok: false,
+                error: `hook model "${pick.catalogRef}" points at ${pick.baseUrl}, which this deployment did not declare as its own endpoint, ` +
+                    `and no per-model credential resolved — refusing to send the prompt there (it embeds user content; an unauthenticated ` +
+                    `request still hands that content to whoever operates that URL)`,
+            };
+        }
+        return { ok: true, credential };
+    };
     const fetchImpl = deps.fetchImpl ?? fetch;
     const hookLlm = async ({ prompt, model, timeoutMs, system, maxOutputTokens }) => {
         const pick = hookModelFor(model);
@@ -52,30 +72,20 @@ export function createHookLlm(deps) {
                     return { ok: false, error: `per-model key resolution for "${pick.catalogRef}" failed — refusing to fall back to the shared route credential (${String(e)})` };
                 }
             }
-            const normUrl = (u) => {
-                try {
-                    const x = new URL(u);
-                    return `${x.protocol}//${x.host}${x.pathname.replace(/\/+$/, "")}`;
-                }
-                catch {
-                    return u.replace(/\/+$/, "");
-                }
-            };
             let url;
             let headers;
             let body;
             if (pick.api === "anthropic-messages") {
                 const routeBase = anthropicRouteBaseUrl();
-                const sameRoute = routeBase !== undefined && normUrl(pick.baseUrl) === normUrl(routeBase);
-                if (!perModelKey && !sameRoute) {
-                    return { ok: false, error: `hook model "${pick.catalogRef}" points at a foreign anthropic baseUrl with no per-model key — refusing to send the prompt off-route` };
-                }
+                const routed = judgeRoute(pick, perModelKey, config.anthropic?.authToken ?? config.anthropic?.apiKey, routeBase);
+                if (!routed.ok)
+                    return routed;
                 url = `${pick.baseUrl.replace(/\/+$/, "")}/v1/messages`;
                 headers = {
                     "content-type": "application/json",
                     "anthropic-version": config.anthropic?.version ?? "2023-06-01",
-                    ...(perModelKey
-                        ? { "x-api-key": perModelKey }
+                    ...(routed.credential.source === "per-model"
+                        ? { "x-api-key": routed.credential.apiKey ?? "" }
                         : config.anthropic?.authToken
                             ? { authorization: `Bearer ${config.anthropic.authToken}` }
                             : config.anthropic?.apiKey
@@ -87,11 +97,10 @@ export function createHookLlm(deps) {
                 body = JSON.stringify({ model: pick.providerModelId, max_tokens: maxTokens, ...(system ? { system } : {}), messages: [{ role: "user", content: prompt }] });
             }
             else {
-                const sameGateway = normUrl(pick.baseUrl) === normUrl(config.gatewayBaseUrl);
-                const hookKey = perModelKey ?? (sameGateway ? config.gatewayApiKey : undefined);
-                if (!sameGateway && !hookKey) {
-                    return { ok: false, error: `hook model "${pick.catalogRef}" points at a foreign baseUrl with no per-model key — refusing to send the prompt off-gateway` };
-                }
+                const routed = judgeRoute(pick, perModelKey, config.gatewayApiKey, config.gatewayBaseUrl);
+                if (!routed.ok)
+                    return routed;
+                const hookKey = routed.credential.apiKey;
                 url = `${pick.baseUrl.replace(/\/+$/, "")}/chat/completions`;
                 headers = { "content-type": "application/json", ...(hookKey ? { authorization: `Bearer ${hookKey}` } : {}) };
                 body = JSON.stringify({ model: pick.providerModelId, ...(maxOutputTokens !== undefined ? { max_tokens: maxOutputTokens } : {}), messages: [...(system ? [{ role: "system", content: system }] : []), { role: "user", content: prompt }], stream: false });

package/dist/hooks/hook-runner.js

@@ -1035,6 +1035,9 @@ export function composeHooks(deployment, task) {
     const d = deployment;
     const t = task;
     const out = {};
+    const timeoutMs = d.timeoutMs ?? t.timeoutMs;
+    if (timeoutMs !== undefined)
+        out.timeoutMs = timeoutMs;
     if (d.preToolUse || t.preToolUse) {
         const bothObservational = (d.preToolUse === undefined || d.preToolUseObservational === true) &&
             (t.preToolUse === undefined || t.preToolUseObservational === true);

package/dist/http/routes/capabilities.js

@@ -1,5 +1,7 @@
-import { DEFAULT_EFFORT_LEVELS, expandTiers } from "@sema-agent/core";
+import { DEFAULT_EFFORT_LEVELS, expandTiers, routePairingStatus } from "@sema-agent/core";
 import { isModelAllowlisted } from "../../model-select.js";
+import { resolveModelApiKey } from "../../key-resolver.js";
+import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored } from "../../task-cwd.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
@@ -8,6 +10,12 @@ import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { gatedPrincipal } from "../principal-gate.js";
+function routePairingOf(deps, name, m) {
+    if (isSealedKeyPoison(deps.config.modelApiKeys?.[name]))
+        return "unknown";
+    const key = resolveModelApiKey(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {});
+    return routePairingStatus(deps.routeJudgeBrain ?? {}, m, key !== undefined ? { apiKey: key } : undefined);
+}
 function retentionAdvertisement(config) {
     const sweep = config.retentionSweep;
     const policy = config.retentionPolicy;
@@ -146,6 +154,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
             ...(m.reasoning ? { supportedEffortLevels: [...DEFAULT_EFFORT_LEVELS] } : {}),
             ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
+            routePairing: routePairingOf(deps, name, m),
         }));
         const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
         const defaultName = (nonAlias.find(([, m]) => m === deps.config.model) ?? nonAlias.find(([, m]) => m.id === deps.config.model.id))?.[0];

package/dist/http/routes/runs.js

@@ -1069,6 +1069,10 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
             return;
         }
         const { status, body: respBody } = await deps.toolApproval.respond(id, principal, body, req);
+        const retryAfterSec = respBody.retryAfterSec;
+        if (status === 429 && typeof retryAfterSec === "number" && Number.isFinite(retryAfterSec) && retryAfterSec >= 0) {
+            res.setHeader("retry-after", String(Math.ceil(retryAfterSec)));
+        }
         sendJson(res, status, respBody);
         return;
     }

package/dist/http/server.d.ts

@@ -1,6 +1,6 @@
 import http from "node:http";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult } from "@sema-agent/core";
+import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult, type Brain } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
@@ -293,6 +293,17 @@ export interface ServiceSeamDeps {
      *  backend). Enables GET /v1/memory/export — present ONLY on a DB memory plane (MEMORY_ENGINE_BACKEND=
      *  pg|tidb); absent / file posture ⇒ 501 (single-user file memory exports by copying the memory dir). */
     memoryExport?: (scope: string) => Promise<MemoryEntry[]>;
+    /**
+     * #345(core 5.57.0 `routePairingStatus`)—— **key↔URL 配对读面**:`GET /v1/models` 每行的
+     * `routePairing` 标注就是拿这一只判的。main.ts 接的是**装配好的那只 brain 本身**(不是摘出来的
+     * 函数引用:A-057.2 那条「裸摘引用丢接收者」的教训同款,且 core 的装饰器族是按 `stream` 的同一条
+     * 路再分派 `adjudicateRoute` 的,整只传才不会绕过路由/快切层)。
+     *
+     * 🔴 缺席 ⇒ 该面每行标 `"unknown"`,**绝不猜**:一只没有 `adjudicateRoute` 面的自定义 brain 是
+     * core 明令「callers must treat that as 'no judgment', never as OK or as broken」的形。测试夹具
+     * 不接这一件时读面字节逐字不变(标注仍在,值恒 `"unknown"`)。
+     */
+    routeJudgeBrain?: Pick<Brain, "adjudicateRoute">;
     /** 142-S2.5(设计 §2.5;裁定 plan 随数据走,core 零运行时半场):one full sync round for one
      *  (scope, peer) — main.ts wires `performMemorySync` over the DB memory backend + the sync-cursor
      *  store. Enables POST /v1/memory/sync/:scope — present ONLY on a DB memory plane

package/dist/http/server.js

@@ -1277,7 +1277,7 @@ export function createHttpServer(rawDeps) {
                             await appendPromptManifest(ap, deps.promptManifests, taskId);
                             if (reSuspended || vrReopened) {
                                 await appendModelUsageDelta(ap, deps.modelUsage, taskId);
-                                const vrParkCallId = reSuspended ? await parkToolCallId(vr, deps.checkpointStore) : undefined;
+                                const vrParkCallId = reSuspended ? await parkToolCallId({ ...vr, status: reParkStatus }, deps.checkpointStore) : undefined;
                                 await ap(reSuspended ? reParkStatus : "suspended", { gate: vr.checkpointGate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: vr.errorCode ?? null } : {}) });
                             }
                             else {
@@ -1532,9 +1532,12 @@ export function createHttpServer(rawDeps) {
                         ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
                     }, driveResume)
                     : driveResume();
-                return await (deps.elicitation && taskId
+                const withElicitation = () => deps.elicitation && taskId
                     ? deps.elicitation.runWithContext({ taskId, owner: principal ?? null, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); }, abortSignal: cancelCtrl.signal }, withApproval)
-                    : withApproval());
+                    : withApproval();
+                return await (deps.sendUserFile && taskId
+                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
+                    : withElicitation());
             });
         }
         catch (e) {

package/dist/leader/merge.js

@@ -61,7 +61,9 @@ export async function mergeBranches(reports, baseSha, deps) {
                     deps.logger?.warn?.("integration_repair_error", { round: round + 1, err: e instanceof Error ? e.message : String(e) });
                     break;
                 }
+                repairMeta = { rounds: round + 1, fixed: false, costUsd: cost };
                 test = await env.exec(deps.testCmd, { cwd: repo });
+                repairMeta = { rounds: round + 1, fixed: test.exitCode === 0, costUsd: cost };
             }
             repairMeta = { rounds: round, fixed: test.exitCode === 0, costUsd: cost };
             deps.logger?.info?.("integration_repair_done", { ...repairMeta });
@@ -88,7 +90,7 @@ export async function mergeBranches(reports, baseSha, deps) {
         if (!integrated.stdout.trim()) {
             return { ok: false, phase: "push", reason: "integrated patch is empty (nothing applied over base) — refusing to push", quarantine: mergeable.map((r) => r.workerId), ...costTail };
         }
-        const evald = await evaluatePushHold(env, repo, mergeable, measure, integrated.stdout, deps);
+        const evald = await evaluatePushHold(mergeable, measure, integrated.stdout, deps);
         if (evald.measure !== undefined)
             measure = evald.measure;
         if (evald.hold) {
@@ -126,7 +128,7 @@ export async function mergeBranches(reports, baseSha, deps) {
             await destroy().catch(() => { });
     }
 }
-async function evaluatePushHold(env, repo, mergeable, observeMeasure, integratedPatch, deps) {
+async function evaluatePushHold(mergeable, observeMeasure, integratedPatch, deps) {
     const heldCandidate = () => delimitUntrusted("CANDIDATE PATCH (untrusted worker code)", integratedPatch);
     const carried = mergeable.map((r) => r.repairTerminal).filter((t) => t !== undefined && t !== "fixed");
     if (carried.length > 0) {

package/dist/main.js

@@ -136,7 +136,10 @@ async function main() {
     const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
     if (toolTracer)
         logger.info("tool_trace_enabled", {});
-    const deploymentHooks = toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics);
+    const deploymentHooks = {
+        ...(toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics)),
+        ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
+    };
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     let parkedAskRedeem;
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({
@@ -533,6 +536,7 @@ async function main() {
     };
     const seams = {
         sessionAudit,
+        routeJudgeBrain: brain,
         purgeSession: purgeSession ? purgeSession : undefined,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
@@ -723,7 +727,7 @@ async function main() {
     else {
         resolveFleetRecovery();
     }
-    installShutdownHandlers({
+    void installShutdownHandlers({
         config, logger, server, reaper, fleetReconcile, otelExporter, breakerState, costQuota, rateLimiter,
         version: serviceVersion(),
         runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState,

package/dist/memory-sync.js

@@ -154,15 +154,28 @@ export function parseMemorySyncRequest(body, scope) {
 function baselineStub(id, rev, scope, slug) {
     return { id, rev, scope, slug: slug ?? `sync-baseline-stub/${id}`, frontmatter: {}, body: "" };
 }
+function malformedEntryReason(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `malformed_entry: core cannot read this entry's frontmatter shape (${msg.slice(0, 200)}) — the entry is refused and never stored; fix the frontmatter (a present \`distilled\` block needs planId/at/carrierRev/inputs[]) and resend`;
+}
 export async function performMemorySync(backend, cursors, scope, req, now = Date.now) {
     const conflicts = [];
     const rejected = new Map();
+    const malformed = new Set();
     for (const e of req.entries) {
-        const computed = computeEntryRev(e);
+        let computed;
+        try {
+            computed = computeEntryRev(e);
+        }
+        catch (err) {
+            malformed.add(e.id);
+            rejected.set(e.id, malformedEntryReason(err));
+            continue;
+        }
         if (computed !== e.rev)
             rejected.set(e.id, `rev_mismatch: claimed ${JSON.stringify(e.rev)} but the content hashes to ${JSON.stringify(computed)} (rev is core's computeEntryRev content-hash contract)`);
     }
-    for (const f of screenInboundEntries(req.entries)) {
+    for (const f of screenInboundEntries(malformed.size === 0 ? req.entries : req.entries.filter((e) => !malformed.has(e.id)))) {
         const gate = `inbound_gate: ${f.findings.map((x) => `${x.code}: ${x.reason}`).join("; ")}`;
         const prior = rejected.get(f.id);
         rejected.set(f.id, prior !== undefined ? `${prior}; ${gate}` : gate);

package/dist/observability/fail-open.d.ts

@@ -121,9 +121,17 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "[4913]:durable park 投影腿在 strip 之前拿结果里的 checkpointToken 换 `pendingAction.toolCallId`(cs.get 一次读),那次读**抛了**(store 抖动 / 滚动升级期 checkpoint 格式 version guard / 行已被并发消费)⇒ 本次 park 的 wire 投影**缺 `toolCallId` 键**,其余键(gate/checkpointId)照旧。放行的最坏后果 = 消费方(cli 判别子 v3 写者②)退回该键到货前的行为——同族多兄弟 durable park 分不出主角、诚实全不标(cli 侧 S3 局限,成文的旧现状),纯展示/关联面,不参与任何门/CAS/resume 判定,故 F 类。绝不挡终局路径是承重的:park 投影点全在 done/suspended 事件写链上,让它抛会把一次 store 抖动升级成整条 run 终局写失败。必须留痕:键缺席与「tool-less park 本就无键」([1995]② OMITTED 契约)在 wire 上同形,不计数则「投影为什么总缺」在遥测里永不显形。";
     };
-    readonly "server.model-key.off-route-model-uses-gateway-key": {
+    readonly "server.model-key.degrade-hop-borrows-gateway-key": {
         readonly cls: "P-DEBT";
-        readonly note: "A-057.59:一只 **baseUrl 指向别家主机**(非本部署 `gatewayBaseUrl`)的目录模型**没有** per-model key ⇒ `createPerModelAuthSeat` 回 `undefined`(side-query 面 = core 5.46.0 的 `SideQuerySpec.getApiKeyAndHeaders` 座位;WebFetch 摘要面 = 同一只座位包在 `createPerModelKeyBrain` 里,那面 core 至今无座位)⇒ core 的 `options?.apiKey ?? config.apiKey` 回落**主网关 key**,而同一行下面的 `model.baseUrl || config.baseUrl` 仍把请求路由到那台外部主机 —— 这一次调用真把共享网关凭据发给了运维在 config-center 里指定的另一家。方向明知不对(hook 面对逐字同形的场景是 TRUE fail-closed:「refusing to send the prompt off-gateway」),之所以记债而不是当场收严:该缺席语义与**主推理链**(`dist/engine/harness/agent-harness.js` 的 `auth?.apiKey !== undefined` 臂)逐字同语义,只收严 wrapper 这两面会造成「同一只模型跑任务能用、问一句 401」,且「同账号多网关主机/多区域」是既有且正当的部署形、无旋钮可退。计数覆盖两面(side-query / WebFetch 摘要),`detail` = 模型名。⚠️ 判据需要参照系:调用方没给 `gatewayBaseUrl` ⇒ **不计**(宁可漏计不可错计),故计数是**下限**。终局收口 = 跨面收严件 #309(三面同批 + 旋钮 + 表态制),届时本 tag 同批销。";
+        readonly note: "[4998] BROKEN 实锤的**留痕半场**(#345 codex 对抗复审 R1-[high] 的可采纳部分,亲验落实)。`brain.ts` 的反应式降级 hop 在降级目标**没有自己的凭据**时回落主网关 key(`own ?? config.gatewayApiKey`),而那只 fallback brain 是用 `fallbackModel.baseUrl` 当 `config.baseUrl` 造的 —— 于是 core 5.57.0 的配对裁决器看到的是「部署凭据 + 它自己的声明根」⇒ 判 `paired` ⇒ 照发。🔴 **上游的法在这条路上结构性看不见问题**:不是 core 漏判,是**本仓把一个撒谎的 config 递给了它**(把主网关的 key 与降级目标的根说成一对)。真读数:`test/brain.test.ts` 的「既有腿不回归」格实测 `Bearer primary-gateway-key` 打到 `http://degrade-gw.test/v1/chat/completions`。为什么记债而不是本批修:正解要么是「off-root 且无自 key ⇒ 降级链按不可用后退」(改的是**可用性**轴,会让一类既有部署的降级当场失效),要么是「把目标自己的凭据改走 per-model 位(`Model.headers`)让 core 判得见」(改核心装配 + 既有钉字节),两者都是独立设计件、不是提货批的尾巴。判据 = 解不出目标自己的 key ∧ 目标 baseUrl 既不是 `gatewayBaseUrl` 也不在 `gatewayFallbackUrls`(后者按同文件成文契约 = 同一逻辑网关/同一 key 有效域,不算换家),归一用 core 的 `normalizeBaseUrl`(与本仓其它配对判定同一只)。⚠️ 与已撤线的 `off-route-model-uses-gateway-key` **不是同一条路**:那条的铸点是 side-query/WebFetch 的 per-model auth 座,而座位恒以**被请求的那只**模型被调用、位置在装饰器栈**之外** —— 它从来没有、也不可能观察到降级 hop 换上的 `fallbackModel`。所以这不是「撤早了」,是一条**一直没人看**的姊妹路。";
+    };
+    readonly "server.exec-lane.ssh-host-key-unverified": {
+        readonly cls: "P-DEBT";
+        readonly note: "#296(A-052.2,clay 裁定 C-R21):`REMOTE_EXEC=ssh` 且**两只主机密钥旋钮都缺席**(`SSH_HOST_FINGERPRINT` / `SSH_KNOWN_HOSTS`)⇒ 本次连接接受**任何**主机密钥,等价 `ssh -o StrictHostKeyChecking=no`。放行的最坏后果:一次中间人拿到这条会话的**全部命令、全部产物、以及 agent 在那台机器上的全部动作**(私钥仍在控制面手里、拿不走,design/61 §5 #2)。⇒ 保护型欠账,不是体验回退。**方向是裁定的、不是遗漏**:本 lane 的既有部署形是「AI 编排批量部署到一批 SSH 可达的机器」,那些机器的指纹通常不在任何 known_hosts 里,默认拒连 = 一次静默的可用性断裂;C-R21 裁「在场即严格,缺席即响亮」。补偿三件:①**每连接**一条 `ssh_host_key_unverified` warn(不是每进程一次 —— 一条长期裸连的 lane 必须在每条连接上都看得见);②本计数(遥测里「有多少条连接是裸连」是一个可观测的数,曲线应当只降不升);③两旋钮任一在场即**严格校验、不符拒连**(拒因带两半指纹 + `ssh-keyscan` 指路)。终局 = 部署把旋钮配上(那时本计数归零);旋钮不配而想收紧的部署级开关(「无旋钮即拒启」)是下一件,不在 C-R21 射程。";
+    };
+    readonly "server.approval.park-tombstone-global-cap-refused": {
+        readonly cls: "F";
+        readonly note: "#343(黑板 [5100] Q3):park 墓碑表(#329 迟到回决的 wire approvalId → 店内坐标指路条)**全局帽已满、而本 principal 还没到自己的 per-principal 子帽** ⇒ 这条新墓碑**不落**(拒新,一格都不挤别人)。放行的最坏后果 = 这一只 ask 的 **live 腿指路便利**缺席,壳按 Yes 拿到的是 404 `unknown_or_other_replica` —— 也就是 #329 之前的那一格逐字行为,既不会错兑也不会双兑;**完整兑付面一个字节没动**(park 行本体在 durable 店未失,`GET /v1/approvals` 列表 + `/v1/approvals/:sessionId/decide` 仍可回决),故 F 类而不是保护型。为什么方向是「拒新」而不是修前的「FIFO 挤最旧」:那个形让**甲的用量决定乙的可用性**(已鉴权租户量产 park 终局 ask 即可把别家墓碑全部挤出,merge-rescan 744 confirmed),而 park 是常态路由、不需要任何异常手法。必须留痕:「表被别人打满」与「这张卡本来就没有墓碑」在 wire 上完全同形,不计数则运维只能靠「用户说按 Yes 老是 404」这种间接症状发现,而那正是 [4845] 排障代价实证过的那条路。detail 带 owner(判「压力来自谁」的第一手线索)。本 tag 有**两条臂、两个根因**,detail 判别:(a) 全局帽满且本 principal 未超子帽 ⇒ 拒新(detail 带 owner);(b) 本 principal 超子帽但名下条目**全在飞**、无一可逐 ⇒ 拒新(detail 带 `reason=all-inflight`)。超子帽且**有**可逐条目的常态臂逐自己最旧的一条(量产者自伤,设计内有界表纪律)才不走本 tag。";
     };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */

package/dist/observability/fail-open.js

@@ -112,9 +112,17 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "[4913]:durable park 投影腿在 strip 之前拿结果里的 checkpointToken 换 `pendingAction.toolCallId`(cs.get 一次读),那次读**抛了**(store 抖动 / 滚动升级期 checkpoint 格式 version guard / 行已被并发消费)⇒ 本次 park 的 wire 投影**缺 `toolCallId` 键**,其余键(gate/checkpointId)照旧。放行的最坏后果 = 消费方(cli 判别子 v3 写者②)退回该键到货前的行为——同族多兄弟 durable park 分不出主角、诚实全不标(cli 侧 S3 局限,成文的旧现状),纯展示/关联面,不参与任何门/CAS/resume 判定,故 F 类。绝不挡终局路径是承重的:park 投影点全在 done/suspended 事件写链上,让它抛会把一次 store 抖动升级成整条 run 终局写失败。必须留痕:键缺席与「tool-less park 本就无键」([1995]② OMITTED 契约)在 wire 上同形,不计数则「投影为什么总缺」在遥测里永不显形。",
     },
-    "server.model-key.off-route-model-uses-gateway-key": {
+    "server.model-key.degrade-hop-borrows-gateway-key": {
         cls: "P-DEBT",
-        note: "A-057.59:一只 **baseUrl 指向别家主机**(非本部署 `gatewayBaseUrl`)的目录模型**没有** per-model key ⇒ `createPerModelAuthSeat` 回 `undefined`(side-query 面 = core 5.46.0 的 `SideQuerySpec.getApiKeyAndHeaders` 座位;WebFetch 摘要面 = 同一只座位包在 `createPerModelKeyBrain` 里,那面 core 至今无座位)⇒ core 的 `options?.apiKey ?? config.apiKey` 回落**主网关 key**,而同一行下面的 `model.baseUrl || config.baseUrl` 仍把请求路由到那台外部主机 —— 这一次调用真把共享网关凭据发给了运维在 config-center 里指定的另一家。方向明知不对(hook 面对逐字同形的场景是 TRUE fail-closed:「refusing to send the prompt off-gateway」),之所以记债而不是当场收严:该缺席语义与**主推理链**(`dist/engine/harness/agent-harness.js` 的 `auth?.apiKey !== undefined` 臂)逐字同语义,只收严 wrapper 这两面会造成「同一只模型跑任务能用、问一句 401」,且「同账号多网关主机/多区域」是既有且正当的部署形、无旋钮可退。计数覆盖两面(side-query / WebFetch 摘要),`detail` = 模型名。⚠️ 判据需要参照系:调用方没给 `gatewayBaseUrl` ⇒ **不计**(宁可漏计不可错计),故计数是**下限**。终局收口 = 跨面收严件 #309(三面同批 + 旋钮 + 表态制),届时本 tag 同批销。",
+        note: "[4998] BROKEN 实锤的**留痕半场**(#345 codex 对抗复审 R1-[high] 的可采纳部分,亲验落实)。`brain.ts` 的反应式降级 hop 在降级目标**没有自己的凭据**时回落主网关 key(`own ?? config.gatewayApiKey`),而那只 fallback brain 是用 `fallbackModel.baseUrl` 当 `config.baseUrl` 造的 —— 于是 core 5.57.0 的配对裁决器看到的是「部署凭据 + 它自己的声明根」⇒ 判 `paired` ⇒ 照发。🔴 **上游的法在这条路上结构性看不见问题**:不是 core 漏判,是**本仓把一个撒谎的 config 递给了它**(把主网关的 key 与降级目标的根说成一对)。真读数:`test/brain.test.ts` 的「既有腿不回归」格实测 `Bearer primary-gateway-key` 打到 `http://degrade-gw.test/v1/chat/completions`。为什么记债而不是本批修:正解要么是「off-root 且无自 key ⇒ 降级链按不可用后退」(改的是**可用性**轴,会让一类既有部署的降级当场失效),要么是「把目标自己的凭据改走 per-model 位(`Model.headers`)让 core 判得见」(改核心装配 + 既有钉字节),两者都是独立设计件、不是提货批的尾巴。判据 = 解不出目标自己的 key ∧ 目标 baseUrl 既不是 `gatewayBaseUrl` 也不在 `gatewayFallbackUrls`(后者按同文件成文契约 = 同一逻辑网关/同一 key 有效域,不算换家),归一用 core 的 `normalizeBaseUrl`(与本仓其它配对判定同一只)。⚠️ 与已撤线的 `off-route-model-uses-gateway-key` **不是同一条路**:那条的铸点是 side-query/WebFetch 的 per-model auth 座,而座位恒以**被请求的那只**模型被调用、位置在装饰器栈**之外** —— 它从来没有、也不可能观察到降级 hop 换上的 `fallbackModel`。所以这不是「撤早了」,是一条**一直没人看**的姊妹路。",
+    },
+    "server.exec-lane.ssh-host-key-unverified": {
+        cls: "P-DEBT",
+        note: "#296(A-052.2,clay 裁定 C-R21):`REMOTE_EXEC=ssh` 且**两只主机密钥旋钮都缺席**(`SSH_HOST_FINGERPRINT` / `SSH_KNOWN_HOSTS`)⇒ 本次连接接受**任何**主机密钥,等价 `ssh -o StrictHostKeyChecking=no`。放行的最坏后果:一次中间人拿到这条会话的**全部命令、全部产物、以及 agent 在那台机器上的全部动作**(私钥仍在控制面手里、拿不走,design/61 §5 #2)。⇒ 保护型欠账,不是体验回退。**方向是裁定的、不是遗漏**:本 lane 的既有部署形是「AI 编排批量部署到一批 SSH 可达的机器」,那些机器的指纹通常不在任何 known_hosts 里,默认拒连 = 一次静默的可用性断裂;C-R21 裁「在场即严格,缺席即响亮」。补偿三件:①**每连接**一条 `ssh_host_key_unverified` warn(不是每进程一次 —— 一条长期裸连的 lane 必须在每条连接上都看得见);②本计数(遥测里「有多少条连接是裸连」是一个可观测的数,曲线应当只降不升);③两旋钮任一在场即**严格校验、不符拒连**(拒因带两半指纹 + `ssh-keyscan` 指路)。终局 = 部署把旋钮配上(那时本计数归零);旋钮不配而想收紧的部署级开关(「无旋钮即拒启」)是下一件,不在 C-R21 射程。",
+    },
+    "server.approval.park-tombstone-global-cap-refused": {
+        cls: "F",
+        note: "#343(黑板 [5100] Q3):park 墓碑表(#329 迟到回决的 wire approvalId → 店内坐标指路条)**全局帽已满、而本 principal 还没到自己的 per-principal 子帽** ⇒ 这条新墓碑**不落**(拒新,一格都不挤别人)。放行的最坏后果 = 这一只 ask 的 **live 腿指路便利**缺席,壳按 Yes 拿到的是 404 `unknown_or_other_replica` —— 也就是 #329 之前的那一格逐字行为,既不会错兑也不会双兑;**完整兑付面一个字节没动**(park 行本体在 durable 店未失,`GET /v1/approvals` 列表 + `/v1/approvals/:sessionId/decide` 仍可回决),故 F 类而不是保护型。为什么方向是「拒新」而不是修前的「FIFO 挤最旧」:那个形让**甲的用量决定乙的可用性**(已鉴权租户量产 park 终局 ask 即可把别家墓碑全部挤出,merge-rescan 744 confirmed),而 park 是常态路由、不需要任何异常手法。必须留痕:「表被别人打满」与「这张卡本来就没有墓碑」在 wire 上完全同形,不计数则运维只能靠「用户说按 Yes 老是 404」这种间接症状发现,而那正是 [4845] 排障代价实证过的那条路。detail 带 owner(判「压力来自谁」的第一手线索)。本 tag 有**两条臂、两个根因**,detail 判别:(a) 全局帽满且本 principal 未超子帽 ⇒ 拒新(detail 带 owner);(b) 本 principal 超子帽但名下条目**全在飞**、无一可逐 ⇒ 拒新(detail 带 `reason=all-inflight`)。超子帽且**有**可逐条目的常态臂逐自己最旧的一条(量产者自伤,设计内有界表纪律)才不走本 tag。",
     },
 };
 export function failOpenTagForDroppedFrame(frameType) {

package/dist/orchestration/hardened-vm-runner.d.ts

@@ -62,6 +62,35 @@ export interface HardenedVmLimits {
      *  A script exceeding it OOMs the WORKER (killed), never the shared main process. Default 128. */
     maxHeapMb?: number;
 }
+/**
+ * The realm test itself, exported so there is exactly ONE ruler for "did this rejection come from an untrusted
+ * script?" in the process. A promise minted INSIDE a vm context fails `instanceof` against the HOST `Promise`
+ * (different intrinsic per realm) — that is the whole judgement.
+ *
+ * 🔴 Why it is exported (A-070 二轮重扫, lifecycle-pairing, double-opus CONFIRMED): the guard below is NOT the
+ * only `unhandledRejection` listener in a real boot. `src/boot/shutdown.ts` installs one at boot (#320① crash
+ * last words) that exits(1); Node walks EVERY listener for the event, so containment cannot be expressed by
+ * one listener returning early — whoever exits wins regardless of registration order. The containment DECISION
+ * therefore lives in the boot handler, and it must use this same ruler rather than minting a second one.
+ */
+export declare function isScriptRealmRejection(promise: unknown): boolean;
+/**
+ * Summarize an unhandled rejection reason for a log line WITHOUT running anything the (untrusted) script
+ * controls. Both rejection listeners in this process use it.
+ *
+ * 🔴 Why not `String(reason)` / `${reason}` / `reason.message` (codex adversarial-review F1, REPRODUCED):
+ * the reason of a script-realm rejection is a LIVE object from the vm context, and every readout path is
+ * script-controlled code running in the HOST turn with no vm timeout over it:
+ *   · `String(x)` / template literals invoke `Symbol.toPrimitive` / `toString` / `valueOf`;
+ *   · a property read invokes a getter, and on a Proxy even `getOwnPropertyDescriptor` is a trap.
+ * `Promise.reject({ toString() { throw ... } })` therefore threw OUT of the guard, became an
+ * `uncaughtException` and exited(1) — i.e. an untrusted script could escape containment and kill the process
+ * by choosing its rejection value; the loop variant (`toString(){ for(;;){} }`) wedges the event loop instead.
+ * So: PRIMITIVES only (their coercion cannot run user code), everything else gets a fixed placeholder. The
+ * cost is honest and stated — an operator sees "a script rejection was contained", not its message; the
+ * message channel for a rejection nobody awaited does not exist anyway.
+ */
+export declare function describeRejectionReason(reason: unknown): string;
 export declare function installScriptRealmRejectionGuard(): void;
 /**
  * The membrane handed to a surface's `buildGlobals` callback to construct the CONTEXT-LOCAL bindings the