@sema-agent/server 7.50.0 → 7.52.0

package/dist/brain.js

@@ -1,8 +1,6 @@
-import { createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, } from "@sema-agent/core";
+import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, hasAuthCarrier, resolveRouteCredential, routeRefusalText, } from "@sema-agent/core";
 import { normalizeBaseUrl } from "@sema-agent/core";
 import { resolveModelApiKey } from "./key-resolver.js";
-import { isSealedKeyPoison } from "./sealed-key.js";
-import { recordFailOpen } from "./observability/fail-open.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
         return false;
@@ -11,6 +9,10 @@ function isOffDeploymentRoot(baseUrl, config) {
         return false;
     return ![config.gatewayBaseUrl, ...config.gatewayFallbackUrls].some((u) => normalizeBaseUrl(u) === entry);
 }
+function degradeDeclaredRoot(fallbackBaseUrl, config) {
+    const armed = Boolean(config.gatewayApiKey) && isOffDeploymentRoot(fallbackBaseUrl, config);
+    return armed ? config.gatewayBaseUrl : (fallbackBaseUrl || config.gatewayBaseUrl);
+}
 export const FAST_FAIL_MAX_RETRIES = 2;
 const DEFAULT_RESILIENCE = {
     connectTimeoutMs: 30_000,
@@ -61,7 +63,7 @@ export function createBrain(config, deps = {}) {
             ...(config.anthropic.authToken
                 ? { headers: { Authorization: `Bearer ${config.anthropic.authToken}` } }
                 : { apiKey: config.anthropic.apiKey }),
-            baseUrl: config.anthropic.baseUrl,
+            baseUrl: config.anthropic.baseUrl ?? "https://api.anthropic.com",
             version: config.anthropic.version,
             cacheBreakpoints: config.anthropic.cacheBreakpoints,
             ...(config.anthropic.maxRetries !== undefined ? { maxRetries: config.anthropic.maxRetries } : {}),
@@ -76,44 +78,42 @@ export function createBrain(config, deps = {}) {
         const degradeTo = config.degrade.to;
         const fallbackModel = config.models[degradeTo];
         if (fallbackModel) {
-            const fbApiKey = () => {
-                const own = resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
-                    resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
-                return own ?? config.gatewayApiKey;
-            };
-            const hopBorrowsGatewayKey = () => {
-                const keys = config.modelApiKeys ?? {};
-                if (isSealedKeyPoison(keys[fallbackModel.name]) || isSealedKeyPoison(keys[degradeTo]))
-                    return false;
-                const own = resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, keys) ??
-                    resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, keys);
-                return own === undefined && config.gatewayApiKey !== undefined && isOffDeploymentRoot(fallbackModel.baseUrl, config);
-            };
+            const fbOwnApiKey = () => resolveModelApiKey(fallbackModel.name, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {}) ??
+                resolveModelApiKey(degradeTo, config.modelApiKeyEnv ?? {}, process.env, config.modelApiKeys ?? {});
             const anthropicLaneHop = fallbackModel.provider === "anthropic" && anthropicBrain !== undefined;
             const fallback = fallbackModel.provider === "anthropic" && anthropicBrain
                 ?
                     anthropicBrain
                 : createOpenAIBrain({
-                    baseUrl: fallbackModel.baseUrl || config.gatewayBaseUrl,
+                    get baseUrl() {
+                        return degradeDeclaredRoot(fallbackModel.baseUrl, config);
+                    },
                     get apiKey() {
-                        return fbApiKey();
+                        return config.gatewayApiKey || undefined;
                     },
                     ...(config.gatewayMaxRetries !== undefined ? { maxRetries: config.gatewayMaxRetries } : {}),
                     fetchImpl,
                     ...timeouts,
                 });
-            const fallbackWithDebtProbe = anthropicLaneHop
-                ? fallback
-                : {
-                    stream: (m, c, o) => {
-                        if (hopBorrowsGatewayKey())
-                            recordFailOpen("server.model-key.degrade-hop-borrows-gateway-key", fallbackModel.name);
-                        return fallback.stream(m, c, o);
-                    },
-                    ...(fallback.adjudicateRoute !== undefined ? { adjudicateRoute: (m, a) => fallback.adjudicateRoute?.(m, a) } : {}),
-                    ...(fallback.complete !== undefined ? { complete: (m, c, o) => fallback.complete(m, c, o) } : {}),
-                };
-            brain = createDegradingBrain({ primary: brain, fallbacks: [{ brain: fallbackWithDebtProbe, model: fallbackModel }], downgradeOn: config.degrade.downgradeOn });
+            const degradeEntryModel = {
+                ...fallbackModel,
+                get headers() {
+                    const own = fbOwnApiKey();
+                    if (own === undefined)
+                        return fallbackModel.headers;
+                    const kept = {};
+                    for (const [k, v] of Object.entries(fallbackModel.headers ?? {})) {
+                        if (!hasAuthCarrier({ [k]: v }))
+                            kept[k] = v;
+                    }
+                    return { ...kept, authorization: `Bearer ${own}` };
+                },
+            };
+            brain = createDegradingBrain({
+                primary: brain,
+                fallbacks: [{ brain: fallback, model: anthropicLaneHop ? fallbackModel : degradeEntryModel }],
+                downgradeOn: config.degrade.downgradeOn,
+            });
         }
     }
     return brain;
@@ -143,6 +143,26 @@ export function brainSummary(config) {
         reactiveDegradeBaseUrl: config.degrade?.reactive && config.models?.[config.degrade.to]
             ? config.models[config.degrade.to].baseUrl || config.gatewayBaseUrl
             : null,
+        ...((() => {
+            const target = config.degrade?.reactive ? config.models?.[config.degrade.to] : undefined;
+            if (!target)
+                return { reactiveDegradeRoutePairing: null, reactiveDegradeRouteRefusal: null };
+            if (target.provider === "anthropic" && config.anthropic) {
+                return { reactiveDegradeRoutePairing: "anthropic-lane", reactiveDegradeRouteRefusal: null };
+            }
+            const declaresOwnCredential = config.modelApiKeyEnv?.[target.name] !== undefined ||
+                config.modelApiKeyEnv?.[config.degrade.to] !== undefined ||
+                config.modelApiKeys?.[target.name] !== undefined ||
+                config.modelApiKeys?.[config.degrade.to] !== undefined ||
+                hasAuthCarrier(target.headers);
+            if (declaresOwnCredential) {
+                return { reactiveDegradeRoutePairing: "per-model-declared", reactiveDegradeRouteRefusal: null };
+            }
+            const verdict = adjudicateModelRoute({ id: target.id, baseUrl: target.baseUrl }, resolveRouteCredential({ ...(config.gatewayApiKey ? { configApiKey: config.gatewayApiKey } : {}) }), { baseUrl: degradeDeclaredRoot(target.baseUrl, config) });
+            return verdict.ok
+                ? { reactiveDegradeRoutePairing: `ok:${verdict.posture}`, reactiveDegradeRouteRefusal: null }
+                : { reactiveDegradeRoutePairing: `broken:${verdict.code}`, reactiveDegradeRouteRefusal: routeRefusalText(verdict) };
+        })()),
     };
 }
 //# sourceMappingURL=brain.js.map

package/dist/budget.d.ts

@@ -27,7 +27,7 @@ export declare function buildPricing(models: Record<string, Model>): Record<stri
 export declare function isPricingConfigured(pricing: Record<string, ModelPricing>): boolean;
 /**
  * Bound the cardinality of a free-form metric label value (BL-11/BL-21). A label fed by untrusted/unbounded
- * input — MCP tool names (a misconfigured/malicious server can emit thousands of dynamic names) or center
+ * input — MCP tool names (a misconfigured/untrusted server can emit thousands of dynamic names) or center
  * model ids (a malformed roster) — would otherwise mint an unbounded number of metric series: a slow memory
  * leak in the registry + a /metrics scrape blow-up. We track the DISTINCT values seen; once the cap is hit,
  * further NEW values collapse into one `__other__` bucket (already-seen values still report exactly). The
@@ -66,7 +66,7 @@ export declare class ModelUsageTracker {
     private readonly active;
     /** Mark a TOP-LEVEL run active so its `brain.call` usage is tracked. **Required** — `record` ignores any taskId
      *  that isn't registered. This is the leak fence: delegated SUB-TASKS (team members,
-     *  adversarial verifiers) run on throwaway core-minted sessionIds that the run lifecycle never registers/drains,
+     *  independent verifiers) run on throwaway core-minted sessionIds that the run lifecycle never registers/drains,
      *  so without this gate their usage would accumulate under ids nothing ever clears → an unbounded process-lifetime
      *  leak. Sub-task spend is intentionally NOT in the per-run `modelUsage` echo (it lands in `TaskStats.nested`);
      *  `modelUsage` is the TOP-LEVEL run's own per-model usage. Call at run start; {@link clear} unregisters. */

package/dist/capabilities/center-plugins.d.ts

@@ -29,7 +29,7 @@ export type PluginValidation = {
 };
 /** 条款 1/2/4:https-only、host 全等白名单、sha 40hex。纯函数,worker 侧纵深复验(不信任 wire 已验过)。 */
 export declare function validatePluginDecl(decl: PluginDeclWire, allowHosts: readonly string[]): PluginValidation;
-/** 条款 3/5:clone 计划(argv 序列 + 隔离 env)。纯数据,让"姿势"可被钉死。 */
+/** 条款 3/5:clone 计划(argv 序列 + 隔离 env)。纯数据,让"姿势"可被锚定。 */
 export declare function gitClonePlan(o: {
     url: string;
     dest: string;

package/dist/capabilities/collab-workflows.d.ts

@@ -37,7 +37,7 @@ export declare function registerCollabWorkflows(workflows: Record<string, Collab
 /** composite WorkflowScriptStore 的 resolveName 前段:collab 命中 ⇒ 内置 team-discussion 脚本+本模板
  *  defaultArgs(同名 SHADOW core 内置,design/140 §6 1c)。🔴 Object.hasOwn — `name` 是模型供给的
  *  (run-workflow-tool 原样传 rawName):裸索引会让 Object.prototype 成员名("constructor"/"toString"/
- *  "__proto__"…)假命中 ⇒ 零模板注册也能烧真讨论、且同名文件 store 条目被遮蔽(对抗评审 2026-07-11 MED)。 */
+ *  "__proto__"…)假命中 ⇒ 零模板注册也能烧真讨论、且同名文件 store 条目被遮蔽(交叉评审 2026-07-11 MED)。 */
 export declare function resolveCollabWorkflow(name: string): {
     script: string;
     defaultArgs: unknown;

package/dist/capabilities/hands-lane.d.ts

@@ -1,7 +1,7 @@
 /**
  * #196 场景 hands lane —— 「要手的场景」与「无手的场景」在装配层分家。
  *
- * 病根(设计小票 §1,案源 [3208]/[3209]/[3212]):core 的手带工具面是 **per-Runner 表态**
+ * 根本问题(设计小票 §1,案源 [3208]/[3209]/[3212]):core 的手带工具面是 **per-Runner 表态**
  * (`prepare-task`:`handsEnabled = ownedEnv || deps.executionEnv`,ownedEnv 只要挂了
  * `executionEnvFactory` 就每任务必铸)。server 此前全场景共享一只 runner + 一只 subRunner,
  * 于是任何 REMOTE_EXEC 部署里,声明 clone-free 的 `scan`、只有 `run_council` 的评审团、
@@ -37,7 +37,7 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
  *
  * 两段来源,都不是拍脑袋:
  *  · `HAND_TOOL_EFFECTS`(core 导出面,`tools/fs`)—— band 的 effect 表,11 名。
- *  · 下方钉死补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
+ *  · 下方锚定补集 —— `createHandsToolkit` / 手带块还会铸但**不在** effect 表里的 5 名(实测差集,见
  *    test/scenario-hands-lane.test.ts 的对表格:它用真 Runner 跑「有手 roster ∖ 无手 roster」,与本常量逐名对账,
  *    core 加/改 band 成员时红,防漂移)。
  *
@@ -50,7 +50,7 @@ export declare function pickHandsRunner(hands: ScenarioHands, pair: HandsRunnerP
  * `hands: none` 三场景(scan/code-review/team)在**所有部署**上零 turn 全灭。core 5.21.1 已删
  * 那条死条目([3249]),这道 filter 是结构性防御:将来 core 再退役任何 band 名都不会重演
  * (test/scenario-hands-lane.test.ts 格7/格8 双钉:真 Runner 过审计 + 零交集门)。
- * filter 打在**整表**(effect 表 + 钉死补集)之后 —— caret floor 下装置会解析到更新的 core,
+ * filter 打在**整表**(effect 表 + 锚定补集)之后 —— caret floor 下装置会解析到更新的 core,
  * 补集名哪天被退役,只滤前半就是同一次故障换个名字(codex 复审 finding,2026-08-09)。
  */
 export declare const HANDS_BAND_TOOL_NAMES: readonly string[];

package/dist/capabilities/scenarios.d.ts

@@ -65,7 +65,7 @@ export interface ScenarioDeps {
     skills: LoadedSkill[];
     repoClient?: RepoReadClient;
     /** Multi-tenant deployment (REQUIRE_PRINCIPAL). Gates the full-body `WebFetch` tool out of the
-     *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/malicious tenant model
+     *  default roster — core says a multi-tenant deployment MUST allowlist hosts (an injected/untrusted tenant model
      *  could exfil via an arbitrary public URL; the SSRF floor only blocks internal). Single-user TOC keeps WebFetch. */
     requirePrincipal?: boolean;
     /** Deployment-injected WebSearch backend (Brave/Tavily/SearXNG via `WEB_SEARCH_PROVIDER`). When set,
@@ -164,7 +164,7 @@ export declare function semaIdentityProvider(): PromptProvider;
  * `code` 场景的提示词提供者([849] 造,[891] clay 裁定改名 autonomous→code):role 基底 = core
  * {@link CODE_SYSTEM_PROMPT}(core 1.298 [891] 改名批正名,旧名 FULL_BODY_SYSTEM_PROMPT=恒等
  * 别名过渡窗;CODE_AGENT persona + AUTONOMY_SELF_AUDIT + ANTI_VERBOSITY +
- * TOOL_PARAM_JSON;[891] 血缘定论 = CC 生产编码提示词的蒸馏去牌版,底本随 CC 版本对表 cc-anchors,
+ * TOOL_PARAM_JSON;[891] 谱系定论 = CC 生产编码提示词的蒸馏去牌版,底本随 CC 版本对表 cc-anchors,
  * 非自研)——与 bench 的请求组装完全同源,引用 core 常量随版本走,绝不复制字符串(tb bench 实测:
  * 产品默认请求与同引擎 bench 态的差距根因就在这三件 persona/自检/终验)。品牌层与
  * {@link semaIdentityProvider} 同构:brandIdentity 开时 SEMA_IDENTITY 叠在 role 基底之上;任务自带
@@ -252,7 +252,7 @@ export declare function centerScenarios(deps: ScenarioDeps, specs: CenterScenari
  * by the HTTP layer (validateUserSkills); this stays pure merge policy.
  */
 export declare function mergeUserSkills(scenarioSkills: SkillSpec[] | undefined, userSkills: SkillSpec[] | undefined, logger?: Logger): SkillSpec[] | undefined;
-/** center caps view 的解析结果两键(形状钉死)。`scenario` null = 三层皆未配。 */
+/** center caps view 的解析结果两键(形状锚定)。`scenario` null = 三层皆未配。 */
 export interface ScenarioRuling {
     scenario: string | null;
     /** 纯场景名集合(principal/组名不上 wire);空 = 该 principal 无任何指派 = 无治理。 */

package/dist/capabilities/skills.d.ts

@@ -35,7 +35,7 @@ export interface LoadedSkill {
  *  ——那个便利是有意的(`foo.md -> 共享文件`)。`confineTo` 在场(**不可信 lane**:第三方 git checkout,
  *  见 center-plugins 的 plugin 装载)= 每个被读条目 realpath 后必须仍在该根之内,逃逸即抛。
  *  🔴 为什么信任级必须是**参数**而不是注释里的假设:本函数的头注原写着「skills dir 全受控」,而
- *  center-plugins 把它原样复用在 attacker-controlled 的 git checkout 上——git 原样保留仓里的 symlink,
+ *  center-plugins 把它原样复用在 不可信来源的 git checkout 上——git 原样保留仓里的 symlink,
  *  于是 checkout 里某个 skill 条目(`任意 .md -> /宿主/任意文件`)会被读进 spec.files 进入提示词。resolvePluginSkillsRoot
  *  只 realpath 守了 skills **根**,根下逐条目没守。 */
 export interface LoadSkillsOptions {

package/dist/config-center/hot-keys-registry.js

@@ -17,6 +17,11 @@ export const BATCH1_LIMIT_KEYS = [
 ];
 const B_SETTER_KEYS = ["rateLimitPerMin", "maxPrincipalCostUsd"];
 export const DEFERRED_LIMIT_KEYS = [
+    {
+        key: "workspaceFileMaxBytes",
+        restartReason: "workspace-face-retired",
+        why: "the workspace browse face was retired with the whole-tree snapshot epoch (S-15) — this knob has no consumer left; the value is still validated and recorded for center-push compatibility, but applies to nothing (restart does not change that). Removal follows the settings-schema deprecation lane",
+    },
     {
         key: "costQuotaWindowSec",
         restartReason: "cost-quota-window",

package/dist/config-center/http-client.d.ts

@@ -68,7 +68,7 @@ export declare class ConfigCenterHttpError extends Error {
 }
 /**
  * Fetch one skill's body by content hash (`GET /api/config/skills/content/<hash>`, Bearer) and VERIFY its
- * sha256 matches the manifest hash (integrity + tamper check). The content is immutable per hash, so the
+ * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
  * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
@@ -77,7 +77,7 @@ export declare class ConfigCenterHttpError extends Error {
 export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
 /** [985]b / [1285]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
  *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
- *  本函数只做传输与形读,不越权解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
+ *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
  *  digest 参数收带前缀/裸 hex 两形([1285] 参数口径)。 */
 export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
 export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;

package/dist/config-center/read-face.d.ts

@@ -8,7 +8,7 @@ import type { CenterReadFace, EffectiveConfig } from "./types.js";
  * 返回值 = **本机 env 显式占住的 center 键名**(与本次发布内容无关的部署事实)。调用方把它喂给
  * `RestartSliceCtx.readFaceEnvHeld`,`read-face` restart 片于是只指纹「真会 boot-bake 的那部分」——
  * 否则 center 改一个本机永远用不上的键,整片 fleet 会为一次对自己毫无影响的发布滚动重启一遍
- * (codex 对抗复审 finding 2,验真后采纳的那一半)。
+ * (codex 交叉复审 finding 2,验真后采纳的那一半)。
  */
 export declare function applyCenterReadFace(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): readonly (keyof CenterReadFace)[];
 //# sourceMappingURL=read-face.d.ts.map

package/dist/config-center/restart-signal.d.ts

@@ -7,7 +7,7 @@ export interface RestartSliceCtx {
     /** `config.degrade.to` when REACTIVE degrade is on (env `MODEL_DEGRADE_TO` + `MODEL_DEGRADE_REACTIVE`);
      *  undefined = the lane is off ⇒ no degrading brain was composed ⇒ nothing is boot-frozen. */
     reactiveDegradeTo?: string;
-    /** #A4(codex 对抗复审 finding 2,验真后采纳):本机 env **显式占住**的 readFace 键
+    /** #A4(codex 交叉复审 finding 2,验真后采纳):本机 env **显式占住**的 readFace 键
      *  (`applyCenterReadFace` 的返回值,由 boot 存下)。这些键的 center 值在本机**永不 boot-bake**,
      *  所以它们的变化不该产生 restart 理由 —— 否则 center 改一个本机用不上的键,整片 fleet 会为一次
      *  对自己毫无影响的发布滚动重启一遍。缺席 = 没有 env 覆盖 ⇒ 整域都算数(与旧行为一致)。 */

package/dist/config-center/types.d.ts

@@ -353,10 +353,17 @@ export interface EffectiveConfig {
 /** (stage7 P5,registry-core 0.8 `execution` 域): the center-resolved per-principal execution
  *  ruling riding the caps view. `required=false` / ruling absent = no enforcement (legacy). `allowedLanes` is
  *  an OPEN value domain (adding one is never BREAKING; consumers tolerate unknown names). Known lane names:
- *  `host`/`e2b`/`k8s`/`ssh`/`adb`/`local-docker` (the REMOTE_EXEC providers) **plus `in-process`** — the
- *  REMOTE_EXEC-unset fleet posture (OA/review-style workers; named distinctly from the explicit
+ *  `host`/`e2b`/`k8s`/`ssh`/`adb`/`local-docker`/`device` (the REMOTE_EXEC providers) **plus `in-process`**
+ *  — the REMOTE_EXEC-unset fleet posture (OA/review-style workers; named distinctly from the explicit
  *  `host` lane on purpose). ⚠️ Admins writing `required=true` policies must include `in-process` when such
- *  workers should stay admittable — center UI/doc 词表待补齐。 */
+ *  workers should stay admittable — center UI/doc 词表待补齐。
+ *
+ *  🔴 **`device` 是 per-principal 执行面上最需要写清的一条**(device-executor-lane-v2 §4.1 的 config-center
+ *  行,车A-4 补):它是「在**员工自己的机器**上执行」的那条车道 —— 允许它 ≠ 允许一台云沙箱,而是允许
+ *  这个 principal 把裁决过的指令投到一台**受管设备**上。⚠️ 但**别把它当设备准入门用**:本 ruling 的
+ *  粒度是 lane 名,它表达不了 principal×device 绑定,而且 no-ruling 是 **fail-open** 的
+ *  (`runtime-caps-resolver.ts` 的 P 类债)。device lane 的真准入是自建的 fail-closed 查表
+ *  (绑定行 owner 谓词 + 设备 active + presence,§4.3.2)—— center 白名单是**外加**的一层,不是替代。 */
 export interface ExecutionRuling {
     required: boolean;
     allowedLanes: string[];

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "dbBackend">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "dbBackend" | "tidb" | "pg">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -111,6 +111,24 @@ export const CONFIG_CROSS_INVARIANTS = [
             ? `LEADER_ENABLED with DB_BACKEND=${next.dbBackend} (no external SQL store) degrades the leader-run registry to a per-process Map`
             : undefined,
     },
+    {
+        id: "device-durable-store",
+        keys: ["remoteExec", "dbBackend", "tidb", "pg"],
+        restartReason: "device-lane",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:device-durable-store" },
+        check: ({ next }) => next.remoteExec?.provider === "device" && !((next.dbBackend === "mysql" && next.tidb !== undefined) || (next.dbBackend === "pg" && next.pg !== undefined))
+            ? `REMOTE_EXEC=device with DB_BACKEND=${next.dbBackend} and no SQL connection coordinates leaves the device registry/binding/audit in a per-process map — a restart forgets which device a parked run must resume onto (DB_BACKEND alone is only an engine selector)`
+            : undefined,
+    },
+    {
+        id: "device-durable-approval",
+        keys: ["remoteExec", "durableApproval"],
+        restartReason: "device-lane",
+        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:device-durable-approval" },
+        check: ({ next }) => next.remoteExec?.provider === "device" && !next.durableApproval
+            ? "REMOTE_EXEC=device without DURABLE_APPROVAL=true has no park exit for an approval that outlives the device's offline window"
+            : undefined,
+    },
 ];
 export function checkCrossInvariants(input) {
     for (const inv of CONFIG_CROSS_INVARIANTS) {

package/dist/config-types.d.ts

@@ -6,7 +6,7 @@
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
 import type { SealedKeyPoison } from "./sealed-key.js";
-import type { A2aServerSpec, CompliancePosture, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
+import type { A2aServerSpec, CompliancePosture, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
 import type { QuestionThrottle } from "./question.js";
@@ -183,6 +183,26 @@ export interface StreamApprovalConfig {
     /** 判据 5(遗孤最终可判)的上界,量 immutable 的 `createdAtMs`。`STREAM_APPROVAL_ORPHAN_TTL_MS`,
      *  默认 **7d**,有界 [60000, 90d]。 */
     orphanTtlMs: number;
+    /**
+     * S-43(案A,#374 / core #481)—— **零活流铸造**的 ask 的悬挂窗。`UNREACHED_ASK_TTL_MS`,
+     * 默认 **3600000**(1h),有界 [60000, 86400000](60s ~ 24h),坏值/越界**拒启**(#210 A 档)。
+     *
+     * 三问(behavior-facing 硬条款):
+     *  · **谁需要**:workflow 恒后台跑(CC 220 parity)⇒ 子代 ask 到达时 (owner, session) 键域常无活 SSE。
+     *    改形前那一刻即答 `"unavailable"`,合成整条命令死拒([5443] 车道2 实证)。悬挂让人稍后经
+     *    `/v1/approvals` / 壳队列 / attach 补投三通道回来答它。1h 是「人不在场但当天会回来」的尺度。
+     *  · **谁被伤**:悬挂 ask 占一格写侧准入配额(`STREAM_APPROVAL_ADMIT_MAX_PER_TASK`,默认 32)且占一条
+     *    持久行,窗越长积压越久;显式声明无人值守的部署(`UNATTENDED_APPROVAL_POLICY=deny`)**完全不受
+     *    本键影响**(那条腿在铸造时刻即拒,追记 F1)。
+     *  · **补偿**:本键本身(调小即回到接近旧行为;60s 下界不给「等于零窗」的形——那等价于关掉案A,
+     *    要那个语义请用 `deny` 政策或 `STREAM_ASK_WINDOW_MS=0` 的 windowZero 腿)。
+     *
+     * 🔴 跨旋钮不变量(与 `WINDOW + ADHOC_GRACE < ORPHAN_TTL` 同族、同理由):
+     * **`UNREACHED_ASK_TTL_MS + ADHOC_GRACE` 必须严格小于 `ORPHAN_TTL`** —— 悬挂行的 `expiresAtMs ≈
+     * createdAtMs + 本键`,判据 4 在 `expiresAtMs + 宽限` 触发而判据 5 在 `createdAtMs + orphanTtl` 触发;
+     * 不等式不成立 ⇒ 遗孤兜底必先到,每条悬挂行的归因都被写成 `orphan_ttl_exceeded`。boot 期校验,拒启。
+     */
+    unreachedTtlMs: number;
 }
 export interface ImageBakeConfig {
     enabled: boolean;
@@ -251,7 +271,7 @@ export interface ServiceConfigFlat {
         /** Prompt-cache breakpoints on system + last tool (stable prefix). Default true. */
         cacheBreakpoints: boolean;
         /** `ANTHROPIC_MAX_RETRIES` —— **缺席不铸键**,同 `gatewayMaxRetries` 的理由(见其顶注):
-         *  env 没配时以前会铸成 `2` 再显式传给引擎,把引擎默认钉死在 server 这一层。 */
+         *  env 没配时以前会铸成 `2` 再显式传给引擎,把引擎默认写死在 server 这一层。 */
         maxRetries?: number;
     };
     /** Resilience brain stack (1.38, design/27): tiered timeouts + an optional circuit breaker layered
@@ -348,10 +368,6 @@ export interface ServiceConfigFlat {
     /** B1 /health 活体 store 探测:后台缓存探针间隔 ms(STORE_PROBE_INTERVAL_MS;0=显式关,负/非数 boot
      *  响亮拒)。只对 SQL 后端接线;探针原语=backend.dbNowMs()(S10 时钟探针的真 DB 往返,零新 SQL 面)。 */
     storeProbeIntervalMs: number;
-    /** Rewind snapshot bounds: byte cap in MB (env REWIND_SNAPSHOT_MAX_MB). Unset = core DEFAULT_SNAPSHOT_BOUNDS
-     *  (256 MiB / 10000 files as of core 2026-06-26 — was 2000/64MiB). BYTE-ONLY knob: raises OR lowers just the byte
-     *  cap; file-count/ignoreDirs stay core defaults (more knobs when a case shows up). */
-    rewindSnapshotMaxMb?: number;
     /** Long-term memory (design/138 S1, clay 2026-07-08): the injection-first file-based memory ENGINE
      *  (core `RunnerDeps.memoryBackend` + `MemoryEngine`) is the ONLY memory plane — the legacy MemoryStore
      *  path (MEMORY_BACKEND/EMBEDDING_* SQL/file note stores) was dropped without migration. Default ON;
@@ -378,13 +394,13 @@ export interface ServiceConfigFlat {
      *   · `true` ⇒ 部署自证有推断**看不见**的持久通道(自定义 writer / MCP 记忆服务 / remote lane 与记忆根
      *     共享挂载)。它撤回引擎的只读披露,并在 remote lane 上**恢复** `# Memory` 写指令(core 5.26.0 r13/r14
      *     收窄的官方恢复路径);
-     *   · `false` ⇒ 强制披露只读/无持久面,并关掉文件工具往记忆根的写通道(披露不会被存储事实打脸)。
+     *   · `false` ⇒ 强制披露只读/无持久面,并关掉文件工具往记忆根的写通道(披露不会被存储事实推翻)。
      *
      *  🔴 **`false` 自 core 5.27.0 起还多一层**([3612] F2,#231 提货):declared-false 的会话是**受限会话**
      *  —— materialize/search/harvest 一律按**已提交账**(ledger + shadow)供给,磁盘上无事务背书的分歧
      *  既不收编也不供给,而是留盘 + 响亮点名(`restricted_divergence`,`HarvestRejectionCode` 新成员),
      *  等下一次**非受限**会话走正常门收编。这补上了 5.26.0 自己登记的那条残余(读侧入站同步收编磁盘分歧
-     *  **与会话意图无关**)——在那之前,这里写的「披露不会被存储事实打脸」只是半真话:披露说「本机存不下」,
+     *  **与会话意图无关**)——在那之前,这里写的「披露不会被存储事实推翻」只是半真话:披露说「本机存不下」,
      *  引擎却仍可能把别处落进记忆根的字节收进这次会话的账。
      *  ⚠️ **这一层的射程 = file 记忆引擎**(`MEMORY_ENGINE_BACKEND` 未设的默认单机形):受限视图是
      *  `FileMemoryEngineBackend.restrictedAdoptionView` 的实装,而 `engine.materialize` 取它走的是
@@ -482,6 +498,28 @@ export interface ServiceConfigFlat {
      *  ⚠️ **不冻进 checkpoint**:resume 的那条腿跟**当前**部署配置走(core 成文)。
      *  运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.provenance`(`null`=本部署未设)。 */
     memoryProvenance?: "off" | "carry";
+    /** design/383 §3.1(core 7.0.0 片3,S-49 S-1b):本部署的记忆 **capture 姿态** —— per-principal
+     *  `RuntimeCaps.allowMemoryOptOut` verdict 被读进的那个框。env `MEMORY_CAPTURE_POLICY`,三词闭集:
+     *   · `open`(≡ 缺席时 core 的缺省)—— `TaskSpec.memory.capture:"off"` 声明按面值生效;只有 resolver 的
+     *     **显式** `false` 拒它(`memory.capture_optout_denied`,terminal)。resolver **故障**(throw / 非
+     *     boolean / 缺席)⇒ opt-out **仍生效** + `onError({phase:"config"})` 具名披露 —— 极性反转臂:隐私轴上
+     *     不可逆的一侧是「把用户明说不要记的会话记进去」,fail-safe 朝它的反面;
+     *   · `governed` —— per-principal verdict **必答**(混合车队:部分用户强制留存)。`true` 放行、`false` 拒;
+     *     resolver 故障/verdict 缺席 ⇒ **拒跑任务**(fail-closed:部署显式声明合规侧的不可逆更重);
+     *   · `capture-required` —— 全体声明具名拒(部署级强制留存,一行配置,不依赖 resolver)。
+     *
+     *  🔴 **缺席 = 不铸键**(不复制上游缺省;`memoryProvenance` 同姿态)。坏值 ⇒ 启动期响亮拒:`governed` 与
+     *  `open` 的故障极性**相反**,一个被静默折成缺省的拼写错误会让合规部署在故障窗里放行留存必需用户的 opt-out。
+     *  core 侧 `prepareConfigDoors` 另有同判门(`config.memory_capture_policy`),两道同向不冲突。
+     *
+     *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。本批唯一源 = SQL 后端上的
+     *  `memory_optout_grant` 表(S-2;center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema
+     *  的独立小件,到货前不算源)。governed 而无源 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
+     *  `boot/runtime-caps.ts` 的 `assertMemoryCapturePolicyWirable` 在启动期拒启(与 consolidation 阀门 D1 同姿态)。
+     *
+     *  ⚠️ **部署席 ONLY**:TaskSpec 无同名键;不冻进 checkpoint(resume 腿跟当前部署配置走,core 成文)。
+     *  运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.capturePolicy`(`null`=本部署未设)。 */
+    memoryCapturePolicy?: "open" | "governed" | "capture-required";
     /**
      * design/378(core 5.58 design/376 片②)—— 记忆 **consolidation driver 阀门**的三根旋钮。
      * **恒在场**(不是可选块,与 {@link retentionSweep} 同姿态):三根都有文档化的缺省,而缺省本身
@@ -577,6 +615,18 @@ export interface ServiceConfigFlat {
         provider: "host";
         workspaceBase?: string;
         commandTimeoutMs?: number;
+    } | {
+        provider: "device";
+        /** `DEVICE_DELIVERY_TIMEOUT_MS`(默认 10s)= 等在途槽的上限;到期 = `device.busy`(§5.5)。 */
+        deliveryTimeoutMs?: number;
+        /** `DEVICE_RECONNECT_GRACE_MS`(默认 120s)= 断连后在途不判丢的窗(§5.4 同 epoch 重连)。 */
+        reconnectGraceMs?: number;
+        /** `DEVICE_EXEC_TIMEOUT_MS`(默认 1800s)= 指令级默认超时;core 的 per-command `timeout` 可收紧。 */
+        execTimeoutMs?: number;
+        /** `DEVICE_MAX_INFLIGHT_PER_DEVICE`(§11-O3 clay 已裁 = 4)。 */
+        maxInflightPerDevice?: number;
+        /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
+        supersede?: "stale_only" | "deny";
     } | {
         provider: "local-docker";
         image: string;
@@ -650,6 +700,19 @@ export interface ServiceConfigFlat {
      *  service and a run-local on the same box agree on one data dir (boot-locked single-instance). Only the
      *  `local` backend reads it. */
     localDataRoot?: string;
+    /**
+     * S-46 件B(`RUN_STORE_STRICT_HYDRATE`,普查表第 29 行的**终局格**)—— file 后端的**可选** fail-closed
+     * 启动门。`true` ⇒ `FileRunStore.hydrate()` 列不出 `runs/` 时**拒启**(error 级遗言带绝对路径 + 异常
+     * 文案,然后抛);缺省 **false** ⇒ 件6 的既有形逐字不变(带病起动 + 一行 error + P-DEBT 计数)。
+     *
+     * 为什么默认是 off:件6 当年把「不拒启」写成了刻意保留的行为,默认翻面等于替所有存量部署做主。
+     * 为什么值得有这根旋钮:空账起动之后每一次 `getRun` 恒 miss,而「恒 miss」与「本来就没有这条 run」
+     * 在 wire 上同形(#43 现场就是这么被误读的)—— 把 run 账本当真账本用的部署有权要求「读不出就别起」。
+     * 坏值**拒启**(#210 A 档):静默回默认会让 operator 要的 fail-closed 被无声吃掉。
+     *
+     * 只有 `local`(file)后端读它;SQL 后端的 hydrate 不经这条路。
+     */
+    runStoreStrictHydrate: boolean;
     /** PostgreSQL connection (used iff dbBackend === "pg"). Mirror of `tidb`. Env: PG_HOST/PG_PORT/PG_USER/
      *  PG_PASSWORD/PG_DATABASE/PG_POOL_SIZE. */
     pg?: {
@@ -691,6 +754,15 @@ export interface ServiceConfigFlat {
      *  实证,大字节归对象存储);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` 显式接受 SQL 店 + (a) 的帽
      *  (单机/测试台形)。严格 "true" 判——这是安全姿势开关,不收宽松真值。 */
     snapshotBlobAllowSql: boolean;
+    /** S-15 twin 保留条款(core design/381 §片2):per-file rewind 历史的**边界上限**,键形与 core
+     *  `FileStorageBackendOptions.fileHistory.retention.keep` **同域同名**(local 腿原样透传给 core 的 File 店;
+     *  SQL 双生店构造期同调 core `resolveFileHistoryRetention` —— 一套语义,三条车道)。缺席 = core 缺省
+     *  (100,由 core 兑现,本仓不复制那个数);`{ keep: "unbounded" }` 是唯一的「不剪」拼法。坏值在
+     *  loadConfig 就以 core 的 `config.retention_policy_invalid` 拒(运维接线处),绝不静默回落。
+     *  env:`FILE_HISTORY_RETENTION_KEEP`。 */
+    fileHistory?: {
+        retention?: FileHistoryRetentionPolicy;
+    };
     /** plugins 域 clone host 白名单(`PLUGINS_ALLOW_HOSTS`,缺省 github.com;契约 [1361]① 双保险面,
      *  消费在 capabilities/center-plugins.ts)。 */
     pluginsAllowHosts: string[];
@@ -706,8 +778,8 @@ export interface ServiceConfigFlat {
      *  复审 F10:同 tick 邻居(workflowOrphanGraceMs/attachmentUnboundTtlMs/scratchpadSweepTtlMs)都有
      *  旋钮——存量对象巨大的部署要调慢/停掉,不该被迫取消 MinIO 配置(那会连带关掉整个附件面)。 */
     attachmentOrphanGraceMs: number;
-    /** workspace 浏览面(#3,[1894]①)单文件读上限(字节;`WORKSPACE_FILE_MAX_BYTES`,默认 8MiB)。
-     *  超限=413 结构化信封 {sizeBytes, limit} 指路 archive 口。软旋钮:坏值走默认。 */
+    /** ⚠️ INERT since S-15(workspace 浏览面随整树快照纪元退役,消费点归零)。键**保留**:center 热推
+     *  可能仍携带它,删键会让整份推送按未知键处置——正式摘除走 settings-schema 的弃用车道。 */
     workspaceFileMaxBytes: number;
     /** SendUserFile dual-track public-link issuance (design settled cross-repo 2026-07-14; S3_PUBLIC_* are
      *  [766]② cross-repo contract names — never rename). Enabled iff the adapter-held MinIO/S3 creds are set:
@@ -752,7 +824,7 @@ export interface ServiceConfigFlat {
      *  service-to-service token, else anything in-cluster can submit & bill directly). `ALLOW_UNAUTHED_WRITES`.
      *  有意设计(文档化):本开关只豁免「零凭证形态」的 fail-closed 503;一旦配了凭证
      *  (SERVICE_AUTH_TOKEN 或 TOKENS 名录),凭证必须使用——unauthed 仍 401,两 env 不叠加
-     *  (半配置绕行=后门,刻意优先级)。 */
+     *  (半配置绕行=隐藏入口,刻意优先级)。 */
     allowUnauthedWrites?: boolean;
     /** Optional READ-ONLY token that ALSO authorizes GET /metrics + /metrics/summary (in addition to
      *  authToken). Set the SAME value fleet-wide so a control plane (sema-registry) can pull every worker's
@@ -881,7 +953,7 @@ export interface ServiceConfigFlat {
      * 它是**零进展 slice 循环**的兜底(两条总额才是主约束),与重启环的 `maxSuspends` 是两个独立计数。
      * core 的 JSDoc 逐字点名了本仓这个角色:"a host driving resumes unattended **should set this**"。
      *
-     * 🔴 **它与两条 totals 的冻结语义不同**(codex 对抗复审 R1-[medium],验真后改口):core **不把它写进
+     * 🔴 **它与两条 totals 的冻结语义不同**(codex 交叉复审 R1-[medium],验真后改口):core **不把它写进
      * 账本**(`debitLedger` 的返回形里没有这一格),每片现读 `spec.resourceSuspend.maxSlices` 去比账本上
      * 累计的 `sliceCount`。⇒ 本仓在**每一片**(含续跑)供值是**载荷不是冗余**:只在首片供值等于让续跑腿
      * 供 `undefined` = 上限当场消失。代价如实登记:滚动部署改这根 env,已 park 的链按**新**值判 —— 部署
@@ -1277,7 +1349,7 @@ export interface ServiceConfigFlat {
      * 放行、不会减**,而车二**没有撤销面**——列出 / 删除自己已存规则的口子没建,core 的
      * `removePersistedRule` 在包里但本仓零调用点。一次误导入的全局规则因此会一直生效,租户自己拿它没
      * 办法,只能找运维改库。#203 交付的正是那条撤销面本身(`GET /v1/rules` + `DELETE /v1/rules`,后者
-     * 恒经 `removePersistedRule` 产墓碑)加上 operator 的越权回收腿 ⇒ **前置条件兑现,默认翻转**。
+     * 恒经 `removePersistedRule` 产墓碑)加上 operator 的超范围回收腿 ⇒ **前置条件兑现,默认翻转**。
      * 记这段史不是怀旧:哪天有人想把某条「只加放行」的车道默认打开,判据就是这一条 —— 收得回来才敢开。
      *
      * 显式 `PERMISSION_RULES_ENABLED=false` 仍然关得掉(默认翻转不吃部署侧的表态);升级到本版的既有
@@ -1345,7 +1417,7 @@ export interface ServiceConfigFlat {
      * 🔴 **射程边界(成文,不是遗漏)**:
      *  · 唯一让本旋钮**无处施加**的键是 `TOOL_APPROVAL_ENABLED=false`(协调器整体不构造,core 走它自己的
      *    headless 姿态)。**不造推断腿**:旋钮只在协调器在场时有意义,这一句是成文而不是代码分支。
-     *  · ⚠️ **与 `STREAM_APPROVAL_ENABLED` 正交**(codex 对抗复审 R2-F2 验真后纠正 —— 本注上一版把两者
+     *  · ⚠️ **与 `STREAM_APPROVAL_ENABLED` 正交**(codex 交叉复审 R2-F2 验真后纠正 —— 本注上一版把两者
      *    写成了一回事,是错的):协议开关关掉只是不注入 `askStore`/协议窗,协调器照常在场,于是 R-13 的
      *    D1 窗到期臂**照样**走 park 路由。这不是漏网:设计稿 §2 明写 park 的承载是 **core checkpoint**
      *    而不是 server 的 ask 行,「无 askStore 但有 durable 设施」正是 R-13 点名的**主受益部署**。
@@ -1370,7 +1442,7 @@ export interface ServiceConfigFlat {
     workflowAgentsReadOnly: boolean;
     /** Sandbox-image-pool BAKE job API (IMAGE-API-DESIGN.md §P2): enable /v1/images/bakes* (operator-submit + the
      *  bake-runner claim/ingest control plane). Requires a TiDB pool (the durable bake row/event/lease tables) AND
-     *  a NON-EMPTY `operatorPrincipals` (boot-asserted — never a world-writable build-host-RCE door). Default OFF.
+     *  a NON-EMPTY `operatorPrincipals` (boot-asserted — never an unrestricted-write build-host exec door). Default OFF.
      *  `IMAGE_BAKES_ENABLED=true`. */
     imageBakes: ImageBakeConfig;
     /** prove-before-scale stopgap: log every tool call (pre+post, incl. resumed legs) for diagnosis. `TOOL_TRACE=true`. Default OFF. */
@@ -1378,7 +1450,7 @@ export interface ServiceConfigFlat {
     /** Task Trace API (S1): persist the agent's reasoning/thinking into the durable run event log (for the CC-style
      *  trace UI). Default ON; `TRACE_THINKING=false` disables capture for sensitive deployments. Redacted on persist. */
     traceThinking: boolean;
-    /** #246(core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不钉死
+    /** #246(core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不写死
      *  上游默认);显式坏词启动期响亮拒。只影响读面,写面永不受它管(core 契约)。 */
     readFace?: "open" | "roots";
     /** #246:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
@@ -1497,14 +1569,14 @@ export interface ServiceConfigFlat {
     configLocalDir?: string;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
-export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "rewindSnapshotMaxMb" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "sendUserFile">;
+export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
-export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
+export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  design/170 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组: