@sema-agent/server 7.51.0 → 7.52.0

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -252,6 +252,15 @@ function optNumEnvStrict(name) {
         return undefined;
     return parseNumOrFail(name, raw);
 }
+function parseFileHistoryRetention() {
+    const raw = process.env.FILE_HISTORY_RETENTION_KEEP;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const keep = raw === "unbounded" ? "unbounded" : /^(?:0|[1-9]\d*)$/.test(raw) ? Number(raw) : raw;
+    const policy = { keep };
+    resolveFileHistoryRetention("FILE_HISTORY_RETENTION_KEEP", policy);
+    return { retention: policy };
+}
 function optFinitePositiveEnv(name) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -503,10 +512,10 @@ function parseStoreDomain(ctx) {
         sessionBackend,
         sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"),
         storeProbeIntervalMs: numEnvBounded("STORE_PROBE_INTERVAL_MS", "15000", 0, 3_600_000),
-        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"),
         dbBackend,
         dbBackendExplicit: dbBackendSet,
         localDataRoot,
+        runStoreStrictHydrate: parseRunStoreStrictHydrate(process.env.RUN_STORE_STRICT_HYDRATE),
         tidb: needsDb && dbBackend === "mysql"
             ? {
                 host: env("MYSQL_HOST"),
@@ -541,6 +550,7 @@ function parseStoreDomain(ctx) {
             : undefined,
         snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
         snapshotBlobAllowSql: boolEnv("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", false),
+        fileHistory: parseFileHistoryRetention(),
         sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
             ? {
                 endpoint: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT),
@@ -803,7 +813,7 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
 }
-function streamApprovalConfig() {
+function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
         windowMs: numEnv("STREAM_ASK_WINDOW_MS", "300000"),
@@ -814,10 +824,15 @@ function streamApprovalConfig() {
         pendingGraceMs: numEnvBounded("STREAM_APPROVAL_PENDING_GRACE_MS", "30000", 0, 3_600_000),
         adhocGraceMs: numEnvBounded("STREAM_APPROVAL_ADHOC_GRACE_MS", "60000", 0, 86_400_000),
         orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
+        unreachedTtlMs: numEnvBounded("UNREACHED_ASK_TTL_MS", String(60 * 60 * 1000), 60_000, 24 * 60 * 60 * 1000),
     };
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
+    const suspendedRowsPossible = cfg.enabled && gates.toolApprovalEnabled && gates.unattendedPolicy !== "deny";
+    if (suspendedRowsPossible && cfg.unreachedTtlMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
+        throw new Error(`env UNREACHED_ASK_TTL_MS=${cfg.unreachedTtlMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — an ask minted with NO live stream (case A: a workflow child ask) waits UNREACHED_ASK_TTL_MS, so its row expires at (createdAt + that window); the orphan backstop fires at (createdAt + ttl). If the backstop wins, every suspended row is attributed "orphan_ttl_exceeded" instead of its real cause (attribution honesty, same rule as the STREAM_ASK_WINDOW_MS line above)`);
+    }
     if (!Number.isInteger(cfg.reconcileBatch)) {
         throw new Error(`env STREAM_APPROVAL_RECONCILE_BATCH=${cfg.reconcileBatch} must be an INTEGER row count`);
     }
@@ -836,6 +851,8 @@ function unattendedApprovalPolicyEnv() {
 }
 function parseApprovalDomain(ctx) {
     const { postureOn } = ctx;
+    const unattendedPolicy = unattendedApprovalPolicyEnv();
+    const toolApprovalEnabled = postureOn("TOOL_APPROVAL_ENABLED");
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
     const durableApproval = boolEnv("DURABLE_APPROVAL", false);
@@ -903,12 +920,12 @@ function parseApprovalDomain(ctx) {
             maxTotalPerRun: numEnvBounded("QUESTION_MAX_TOTAL_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxTotalPerRun), 1, 10_000),
             ttlMs: numEnvBounded("QUESTION_TTL_MS", String(DEFAULT_QUESTION_THROTTLE.ttlMs), 1_000, 3_600_000),
         },
-        toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"),
+        toolApprovalEnabled,
         permissionRulesEnabled: boolEnv("PERMISSION_RULES_ENABLED", true),
         permissionRulesEnabledExplicit: parseBoolWord("PERMISSION_RULES_ENABLED", process.env["PERMISSION_RULES_ENABLED"]) !== undefined,
         streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
-        streamApproval: streamApprovalConfig(),
-        unattendedApprovalPolicy: unattendedApprovalPolicyEnv(),
+        streamApproval: streamApprovalConfig({ unattendedPolicy, toolApprovalEnabled }),
+        unattendedApprovalPolicy: unattendedPolicy,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
@@ -939,6 +956,20 @@ function parseMemoryPersistenceCapable(raw) {
         `\`# Memory\` write instruction on a remote execution lane) or ${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (it CANNOT — ` +
         `forces the read-only disclosure). Leave it UNSET to let the engine infer from the mounted roster.`);
 }
+function parseRunStoreStrictHydrate(raw) {
+    const w = (raw ?? "").trim().toLowerCase();
+    if (w === "")
+        return false;
+    if (MEMORY_ENGINE_ON_WORDS.includes(w))
+        return true;
+    if (MEMORY_ENGINE_OFF_WORDS.includes(w))
+        return false;
+    throw new Error(`env RUN_STORE_STRICT_HYDRATE="${raw}" is not a known on/off word — use one of: ${MEMORY_ENGINE_ON_WORDS.join(" | ")} ` +
+        "(the file run-store REFUSES TO BOOT when it cannot list its runs/ directory) or " +
+        `${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (the default: boot anyway with an empty ledger, disclosed by the ` +
+        "file_run_store_hydrate_unreadable error line + the server.run-store.file-hydrate-unreadable counter). " +
+        "An unrecognized value must not fold to the default: that would silently swallow an operator's explicit fail-closed request.");
+}
 const SANDBOX_PKG_SOURCES = ["global", "cn", "custom", "none"];
 function pkgSourceEnv() {
     const v = env("SANDBOX_PKG_SOURCE", "global");
@@ -1144,6 +1175,9 @@ function parseMemoryDomain(ctx) {
         ...(process.env.MEMORY_PROVENANCE !== undefined
             ? { memoryProvenance: enumEnv("MEMORY_PROVENANCE", "carry", ["off", "carry"]) }
             : {}),
+        ...(process.env.MEMORY_CAPTURE_POLICY !== undefined
+            ? { memoryCapturePolicy: enumEnv("MEMORY_CAPTURE_POLICY", "open", ["open", "governed", "capture-required"]) }
+            : {}),
         memoryConsolidationDriver: parseMemoryConsolidationDriver(),
         ...(process.env.DELEGATION_MAX_CONCURRENT !== undefined || process.env.DELEGATION_MAX_PER_SESSION !== undefined
             ? {
@@ -1669,8 +1703,9 @@ function parseA2aServeSkills(raw) {
     });
 }
 const STORE_GROUP_KEYS = [
-    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "rewindSnapshotMaxMb", "dbBackend", "dbBackendExplicit", "localDataRoot",
-    "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "sendUserFile",
+    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "dbBackend", "dbBackendExplicit", "localDataRoot",
+    "runStoreStrictHydrate",
+    "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "fileHistory", "sendUserFile",
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "models",
@@ -1684,7 +1719,7 @@ const APPROVAL_GROUP_KEYS = [
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
-    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
+    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
     "projectMemoryEnabled", "syncImportLeaseStaleSec",
 ];
 const AUTH_GROUP_KEYS = [
@@ -1792,7 +1827,7 @@ export function loadConfig() {
         if (dgOperators.length === 0)
             missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
         if (!requirePrincipal)
-            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the spoofable header governs owner/quota checks)");
+            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
         if (missing.length) {
             throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
         }

package/dist/deployment-governance.d.ts

@@ -57,7 +57,7 @@ export interface DurableApprovalSeat {
  */
 export declare function createDurableQuestionGate(live: LiveQuestionFace | undefined): ToolPolicy;
 /**
- * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 对抗复审 round1 finding 1,红先复现)。
+ * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 交叉复审 round1 finding 1,红先复现)。
  *
  * 缺口:沙箱 lane 的守卫策略拿不到 `rootPath`(沙箱 cwd 不是 server 能猜的,#165 裁定 1),而
  * `DeferredSandboxPathEnv.absolutePath` 对相对形一律报错。core 的 `canonicalizeTarget` 在

package/dist/device-enrollment.d.ts

@@ -52,7 +52,7 @@ export interface DeviceEnrollRateLimiter {
 export interface EnrollDeviceInput {
     /** 明文 token(**只**在这里出现,落库前立刻摘要)。 */
     token: string;
-    /** 请求方**验证过**的复合身份(SSO/凭据链产出,恒不取自可伪造头)。 */
+    /** 请求方**验证过**的复合身份(SSO/凭据链产出,恒不取自可自造头)。 */
     requester: DeviceOwner;
     /** 🔴 `deviceId` 与 `owner` **不在**这里:前者恒由 server 铸(调用方选 id = 让请求方挑自己的设备身份,
      *  与 §6「server 铸 dev_<ulid>」相悖),后者恒取自**验证过的** requester —— 两个字段都不接受请求体供给。
@@ -76,7 +76,7 @@ export interface AdmitSessionValue {
     /**
      * 判决**当刻**的连接世代(§4.6 fencing token)。
      *
-     * 🔴 **准入判决是一个快照,不是一把锁**(codex 对抗轮 F4,判真但归属下一车):`admitSession` 返回后、
+     * 🔴 **准入判决是一个快照,不是一把锁**(codex 交叉轮 F4,判真但归属下一车):`admitSession` 返回后、
      * 调用方真正下发指令前,一次 `revokeDevice` 可以提交 —— 它会作废租约并把 `conn_generation` 推进一格,
      * 但它**追不回**已经基于旧判决发出去的指令。这不是本层能关掉的窗(§6 注③ 刻意不落指令表,所以持久层
      * 没有「派发」这个写点可以带谓词);设计给的答案是**在下发边界重新断言世代**(§4.6 步 2/3:每一次带

package/dist/device-store.d.ts

@@ -146,7 +146,7 @@ export declare function assertIssueTokenShape(input: IssueEnrollTokenInput): voi
 export declare function assertRevokeShape(input: RevokeDeviceInput): void;
 export declare function assertAcquireShape(input: AcquireConnectionInput): void;
 /** token 摘要必须是**规范形**(小写 sha256 hex):大小写混形在 VARBINARY/COLLATE "C" 下是两个键,
- *  于是同一个明文 token 能被消费两次 —— 这是 §7-T5 ③「一次性 CAS」的直接绕过面。 */
+ *  于是同一个明文 token 能被消费两次 —— 这是 §7-T5 ③「一次性 CAS」的直接跳过面。 */
 export declare function assertEnrollTokenHashShape(tokenHash: string): void;
 /**
  * 闭集列的**读侧**解码 —— 三个 `parse*` 是这些词表的唯一解码点(SQL 店读回的字符串必须经此)。
@@ -154,7 +154,7 @@ export declare function assertEnrollTokenHashShape(tokenHash: string): void;
  * 🔴 认不出的值 = **抛**,不是静默 cast(#157:安全轴的未知词是 fail-loud 而不是 fail-open)。
  * 一行 `status='disabled'` 的设备如果被 `as DeviceStatus` 静默放行,准入链的 `status === "revoked"`
  * 判据就对它返回「不是吊销的」⇒ 一台被管理面停用的设备照常领活。写侧不可能产出这些值(入参是
- * TS 闭集),所以出现即「有人绕过本店直接写库」或「跨版本降级读新词」,两者都必须响亮。
+ * TS 闭集),所以出现即「有人跳过本店直接写库」或「跨版本降级读新词」,两者都必须响亮。
  */
 export declare function parseDeviceStatus(v: string): DeviceStatus;
 export declare function parseDevicePlatformOs(v: string): DevicePlatformOs;
@@ -189,7 +189,7 @@ export interface IssueEnrollTokenInput {
 }
 export interface ConsumeEnrollTokenInput {
     tokenHash: string;
-    /** 请求方**验证过**的复合身份(不取自可伪造头);与 token 的 target 逐字节比对。 */
+    /** 请求方**验证过**的复合身份(不取自可自造头);与 token 的 target 逐字节比对。 */
     requester: DeviceOwner;
     device: NewDeviceInput;
 }

package/dist/device-ws-protocol.d.ts

@@ -357,11 +357,11 @@ export type DeviceFrameParse = {
     detail: string;
 };
 /**
- * **规范** base64(codex 对抗轮 R1-F6,判真)。
+ * **规范** base64(codex 交叉轮 R1-F6,判真)。
  *
  * 🔴 为什么不能只判「是个字符串」再交给 `Buffer.from(v, "base64")`:Node 的解码是**宽松**的 ——
  * `"!!!!"` 解出一个**空** Buffer 而不抛,`"aG@k="` 悄悄丢掉非法字符照样解出两个字节。于是一条被
- * 传输层损坏(或被恶意构造)的流片会以「合法的空/短数据」进入交付路径,水位照常推进、chunkAck
+ * 传输层损坏(或被不可信构造)的流片会以「合法的空/短数据」进入交付路径,水位照常推进、chunkAck
  * 照常回给设备 —— 设备释放了它手上唯一的正本,调用方拿到的是**静默损坏**的输出。
  * 在协议边界判规范形 + 回编码自比,这条路就没了。跨仓同判据:cli 侧编码器必须产规范形。
  */

package/dist/env-facts.d.ts

@@ -76,7 +76,7 @@ export declare function ensureScratchpadDir(localDataRoot: string, sessionId: st
  *  fs-write gate exemptDirs + additionalDirectories 根围栏)。「没到货引擎忽略 = 无害 additive」。
  *
  *  信任边界:这是 exemptDirs **放宽**输入,验收 fail-closed(任何拒收形回落自算,不 fault 任务):
- *   - 多租户(requirePrincipal)一律拒——共享 worker 盘上租户自选豁免目录=越权面;
+ *   - 多租户(requirePrincipal)一律拒——共享 worker 盘上租户自选豁免目录=超范围面;
  *   - 仅 host-semantics lane——远程沙箱 lane 的 worker 本机路径对 hands 是谎言(honest-facts 同轴);
  *   - 绝对路径 + ≤{@link MAX_PATH}(core 渲染上限同源,超限=core 只能给模型假路径)+ canonical
  *     深度 ≥3(裸 /、/tmp、/home 一整块系统目录不能当豁免域;穿越形按 resolve 归一后判);

package/dist/execution-lane-caps.d.ts

@@ -1,7 +1,7 @@
 /**
  * 执行车道**闭集**与 per-lane 能力表(design device-executor-lane-v2 §4.1 收敛件,车A-1)。
  *
- * ## 病根:lane 词表是开放字符串上的十几处独立判别式
+ * ## 根本问题:lane 词表是开放字符串上的十几处独立判别式
  *
  * `config.remoteExec?.provider` 的静态型是 `string | undefined` 的判别联合,但消费面从来不是一处
  * switch —— 而是散在十几个文件里的**独立等式/集合/否定**:`cwdHonored` 比 `=== "host"`、

package/dist/fleet/fleet-bus.d.ts

@@ -102,7 +102,7 @@ export interface FleetTaskRow {
     transcriptId?: string;
     /** [1839]①/(a) 案:**终态行帧的残局键**——cli 实测裸 durable-run 完成时终态 task 帧键集只有
      *  [id,name,status,tokens,elapsedMs,description],idle 观察者(web 首屏形)从行卡拿不到终局。
-     *  (b) 案(为顶层 run 造 bg_notification)被否:那族语义=观察者眼里的**子代**,伪造事件族比丰富行帧
+     *  (b) 案(为顶层 run 造 bg_notification)被否:那族语义=观察者眼里的**子代**,自造事件族比丰富行帧
      *  更伤([1840]§二)。四键全部 ADDITIVE / tolerate-absent、**只在终态帧出现**:
      *  - `stoppedBy`:core open enum verbatim(与 BgNotification 同姿势);顶层 run 仅 cancel 路径有源
      *    (= "user",与 markStopSource 同源值),其余终态诚实缺席。

package/dist/fleet/fleet-reconciler.d.ts

@@ -64,7 +64,7 @@ export declare const FLEET_RECONCILE_INTERVAL_MS = 60000;
 /** 每周期的**点读上限**。超出的行留到下一周期(顺序稳定 = bus 的插入序),不把一次扫描变成全表点读风暴。 */
 export declare const FLEET_RECONCILE_MAX_ROWS = 200;
 /** 一个周期的 durable 读**时间预算**。超时 = 放弃这一轮(记 F 类 fail-open),行留在面板上。
- *  与 `FLEET_SNAPSHOT_TERMINAL_READ_BUDGET_MS` 同值同理由:慢查询不该把整条腿钉死。 */
+ *  与 `FLEET_SNAPSHOT_TERMINAL_READ_BUDGET_MS` 同值同理由:慢查询不该把整条腿卡住。 */
 export declare const FLEET_RECONCILE_READ_BUDGET_MS = 2000;
 /** 熔断冷却:一次读失败/超预算之后,这段时间内**不再发起任何读**。`RunStore`/`WorkflowRunStore` 契约
  *  都没有取消面(发出去的查询撤不回),挂死的后端不该被每周期继续加压。冷却一过自动重探(自愈)。 */

package/dist/fleet/fleet-terminal-window.d.ts

@@ -16,7 +16,7 @@
  * ## 为什么本模块有进程级可变状态(路由域刻意保持零状态,故不放在 `routes/fleet.ts`)
  * 三件都长在同一个事实上——**`WorkflowRunStore` 契约没有取消面**,`Promise.race` 只结束等待、撤不回
  * 已发出的查询:合流(重连风暴不按连接数放大,R1-H2)、合流窗有限(不把陈旧结果发给后来者、也不让
- * 一条永不 settle 的读把后续连接全钉死,R2-H1/R3-M2)、熔断冷却(挂死的后端不被每周期继续加压,
+ * 一条永不 settle 的读把后续连接全卡住,R2-H1/R3-M2)、熔断冷却(挂死的后端不被每周期继续加压,
  * R3-H1)。真解是店侧查询超时/取消 —— 要动契约与四个后端,已作移交项。
  *
  * ## scope

package/dist/http/active-run-conflict.d.ts

@@ -73,7 +73,7 @@ export interface PendingGateMaterial {
      *    ③ **材料读取失败**:整只 `pendingGate` 都不在(那时本键连位置都没有)。
      *  ⇒ 读作「不知道这道门叫什么」,**不是**「这道门没有身份」,更**不是**「这一定是条老行」。
      *
-     *  🔴 **它命名的是「本次 409 实际读到的那一行」,不是「activeTaskId 这条 run 的门」**(codex 对抗复审
+     *  🔴 **它命名的是「本次 409 实际读到的那一行」,不是「activeTaskId 这条 run 的门」**(codex 交叉复审
      *  R1-[high] 验真后如实登记):同 session 可以并存两条 pending checkpoint(表上**没有** per-session
      *  pending 唯一约束),而 `findPendingTokenBySession` 是**无序 `LIMIT 1`** —— 这个条件是本仓自己成文的
      *  已知事实(见 `src/http/server.ts` mintFreshRun 腿 409 那段的逐字论证:「两条 pending 并存时旧
@@ -147,7 +147,7 @@ export interface ActiveRunConflictDoneResult {
     /**
      * #316(c):与 409 body 同键同语义(见 {@link ActiveRunConflictBody.stale})。
      *
-     * 🔴 **跨仓欠账,如实登记**(codex 对抗复审 R1-[medium] 验真后的真形):sema-sdk 的
+     * 🔴 **跨仓欠账,如实登记**(codex 交叉复审 R1-[medium] 验真后的真形):sema-sdk 的
      * `spec/openapi.yaml` 里 `ActiveRunConflictDoneResult` 是 `additionalProperties: false` 的**封闭**
      * schema,今天只声明 `status/errorCode/errorMessage/activeTaskId/activeTaskStatus/pendingGate` 六键。
      * ⚠️ 亲验后的关键修正:这**不是本键引入的新问题** —— `msSinceLastActivity`(#245 S1)早就在这条

package/dist/http/principal-gate.d.ts

@@ -13,7 +13,7 @@ export declare function systemFor(req: IncomingMessage, config: ServiceConfig):
 export declare function bearerPresentedButUnverified(req: IncomingMessage, config: ServiceConfig): boolean;
 export declare function gatedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
 /** The EXPLICIT operator gate (IMAGE-API-DESIGN.md §P2.4a MUST-FIX) — NOT the bare `isOperator` (whose empty-list
- *  "true-for-all" is a world-writable RCE door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
+ *  "true-for-all" is an unrestricted-write exec door the instant OPERATOR_PRINCIPALS is empty). Requires a non-empty
  *  operator set AND a present principal IN it. The same form the preempt/resume endpoints already use.
  *  🔴 SINGLE mint point (E1): a byte-identical twin `explicitOperator` used to live below (image-visibility lane)
  *  and two more hand-inlined copies sat in approvals-assistant — a future hardening of this judgment would have

package/dist/http/route-ctx.d.ts

@@ -156,18 +156,38 @@ export interface RouteLegs {
      *
      *  `onTypedFailure` = 「typed 拒绝**别写响应**,交回给我」。默认(缺席)行为不变:`HttpError` 走
      *  `sendError` 连 `extra` 一起回显。DESIGN-269 车2 的 A2A 腿必须传它 —— 那些 `extra`(尤其
-     *  `scenario_unknown` 的**全部场景名**)对壳是指路材料,对一个外部 peer 是内部词表泄漏。 */
-    prepareSpec(req: IncomingMessage, res: ServerResponse, body?: TaskRequestBody, onTypedFailure?: (err: import("../security.js").HttpError) => void): Promise<PreparedTaskSubmission | null>;
+     *  `scenario_unknown` 的**全部场景名**)对壳是指路材料,对一个外部 peer 是内部词表外泄。 */
+    prepareSpec(req: IncomingMessage, res: ServerResponse, body?: TaskRequestBody, onTypedFailure?: (err: import("../security.js").HttpError) => void, 
+    /** S-46 件C:**腿身份**(不是能力表态)。`liveStream: true` 只由 `POST /v1/tasks/stream` 的装配点按
+     *  URL 传 —— 那是全树唯一挂 HITL 活流投递面的腿,逐腿 `interactionPosture` 判据的第一条合取项。
+     *  缺席 ⇒ 无人腿(bg / A2A / resume),行为字节不变。 */
+    legFacts?: {
+        liveStream?: boolean;
+    }): Promise<PreparedTaskSubmission | null>;
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
     finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
      *  `settledBy` = **这次结算的出处**(core `ApprovalSettledBy`),必填:本腿有两个调用方(HTTP
      *  `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
      *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。 */
-    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (overrideSessionId?: string) => Promise<void>, 
+    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
+    /** S-02 codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
+     *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
+     *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`
+     *  = 无可记)一并回传,路由只对这个逐字落店。`overrideSessionId` = parked 腿的 root/host 会话 grant 锚。 */
+    onResumeCommitted?: (grant: {
+        overrideSessionId?: string;
+        validatedToolName: string | null;
+    }) => Promise<void>, 
     /** #316:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/decide` 腿传 `true`;
      *  内部 D-D SLA deny-sweep 不传 —— 它没有在等响应的人,提前受理对它零收益而少一条同步失败面。 */
-    acceptEarly?: boolean): Promise<{
+    acceptEarly?: boolean, 
+    /** S-02:调用方已验身份的裁定 —— stale 臂铸 `currentPending` 指路键前在被读回的行上重跑 decide 门
+     *  同一属主判(缺席 ⇒ 恒不造键;判据属主=server.ts 铸键点注)。 */
+    decider?: {
+        principal?: string;
+        explicitOperator: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/routes/admin-memory-optout.d.ts

@@ -0,0 +1,48 @@
+/**
+ * design/383 §3.1 / S-50 §1.3(S-49 S-2)—— per-principal **memory-capture opt-out 授权表**的 operator 四口:
+ *
+ *   · `GET    /v1/admin/memory-optout`             → `{ deploymentDefault: Row|null, overrides: Row[] }`
+ *   · `PUT    /v1/admin/memory-optout`             body `{allow, note?}` → 部署缺省行 upsert(哨兵 `principal=''`)
+ *   · `PUT    /v1/admin/memory-optout/:principal`  body `{allow, note?}` → per-principal 覆盖行 upsert
+ *   · `DELETE /v1/admin/memory-optout/:principal`  → 撤覆盖(回落部署缺省);`{ deleted: boolean }` 诚实答
+ *
+ * Row = `{ principal, allow, updatedAtMs, updatedBy, note? }`(审计行内,S-50 §1.3;`updatedBy` = 调用方 operator
+ * principal,server 铸,body 不收)。
+ *
+ * ── 稿偏离两条(如实记)────────────────────────────────────────────────────────────────────────────
+ * ① S-50 §1.1/§1.3 写的是 `orgDefault` + `(org_id, principal)`。亲读本仓(2026-08-30 侦察):server **没有 org 身份维**
+ *    (租户维 = 单 principal;`org` 只是记忆 scope 目录里的词),给表/wire 铸一根没人能填的 `org_id` 是编数据。一台
+ *    worker = 一个租户面 ⇒ 「org 级缺省」落成**部署级缺省**,wire 键名随实体改叫 `deploymentDefault`。折叠律不变。
+ * ② S-50 §1.3 把部署缺省写成 `PUT …/memory-optout/default`。codex R1-[medium] 验真:`default` 是一个**合法 principal
+ *    拼写**,字面路径 `/default` 与 `%64efault`(解码后同为 `default`)在第一版里分派到**两个不同的行**(哨兵行 vs
+ *    一条名叫 default 的覆盖行)—— 命名空间碰撞,而且 DELETE 侧还不对称。修法不是「解码后再保留一个词」(那只是把
+ *    碰撞改成一条不可寻址的 principal),而是**让缺省行住在集合根**:`PUT /v1/admin/memory-optout`(集合本身的
+ *    「缺省」属性),`:principal` 面从此没有任何保留词,任何合法 principal(包括字面 `default`)都可寻址。
+ *
+ * ── 族属与门序 ────────────────────────────────────────────────────────────────────────────────────
+ * 与 `/v1/admin/drain` · `/v1/admin/config/refresh` · `/v1/admin/memory/consolidation` 逐字同族(operator lane:
+ * 同一条 `explicitOperatorOk` 门;billable=false;刻意不吃 drain / roster-pending 两道 503)。门序照 operator
+ * 面既有口径:身份(401)→ 授权(403)→ **能力(501)** → 验型(400)。授权在能力之前:一个够不着任何东西
+ * 的调用方不该从「这台有没有授权表」上读出部署形态。
+ * 🔴 四口都在 `isCredentialGatedRewrite`(server.ts)门内(codex R1-[high] 验真后补):授权的**唯一**输入是
+ * principal 头 ∧ 一次调用的爆炸半径跨租户(改缺省行 = 改整台部署每个 principal 的 verdict;读面 = 全部授权行 +
+ * operator 手写的 note)—— 无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的 worker 上那个头**可自造**,与
+ * `/v1/memory/erase` / `POST /v1/memory/export` 同一条论证。
+ *
+ * ── 为什么缺席形是 **501 `capability.*`** 而不是 404(与 consolidation 阀门刻意分家)──────────────────
+ * consolidation 的 404 说的是「旋钮没开」(运维表态,动作=开旋钮)。本面的缺席是「**这家店在本部署上不存在**」
+ * —— local 车道刻意不给授权表一个会遗忘的 in-memory twin(接口注),动作=换部署形态(接 SQL 后端)。那正是
+ * 本仓 501 `capability.*` 族的定义(`capability.memory_engine_required` / `capability.outcome_ledger_required`
+ * 同族)。能力位 `memoryOptOutGrant`(`GET /v1/capabilities`)读同一个事实 + operator 名单非空。
+ *
+ * ── 撤销窗(S-50 §1.4)──────────────────────────────────────────────────────────────────────────
+ * 写后**零缓存**:resolver 腿(`RuntimeCaps.allowMemoryOptOut`)每次 prepare 直读同一张表 ⇒ 下一次带声明的
+ * prepare 即读到新 verdict(撤权后新声明具名拒;已声明会话 record wins,core 判,server 零码)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx } from "../route-ctx.js";
+export declare const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
+/** 带参口(`:principal`)⇒ 名册门走 `ROUTE_LABEL_PATTERNS`(server.ts),不是 LITERALS。 */
+export declare const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE: RegExp;
+export declare function handleMemoryOptOut(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=admin-memory-optout.d.ts.map

package/dist/http/routes/admin-memory-optout.js

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { memoryOptOutPrincipalShapeProblem } from "../../plugins/memory-optout-grant-store-sql.js";
+export const ADMIN_MEMORY_OPTOUT_PATH = "/v1/admin/memory-optout";
+export const ADMIN_MEMORY_OPTOUT_OVERRIDE_RE = /^\/v1\/admin\/memory-optout\/([^/]+)$/;
+const PutBodySchema = z.object({ allow: z.boolean(), note: z.string().min(1).max(500).optional() }).strict();
+export async function handleMemoryOptOut(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+function decideVerb(method, path, safeDecode) {
+    if (path === ADMIN_MEMORY_OPTOUT_PATH) {
+        if (method === "GET")
+            return { kind: "list" };
+        if (method === "PUT")
+            return { kind: "putDefault" };
+        return undefined;
+    }
+    const m = ADMIN_MEMORY_OPTOUT_OVERRIDE_RE.exec(path);
+    if (m === null)
+        return undefined;
+    if (method !== "PUT" && method !== "DELETE")
+        return undefined;
+    const principal = safeDecode(m[1]);
+    if (principal === null)
+        return "malformed";
+    return method === "PUT" ? { kind: "putOverride", principal } : { kind: "deleteOverride", principal };
+}
+async function handleBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    const path = url.split("?")[0] ?? url;
+    const verb = decideVerb(req.method, path, ctx.helpers.safeDecode);
+    if (verb === undefined) {
+        miss.fell = true;
+        return;
+    }
+    const principal = gatedPrincipal(req, deps.config);
+    if (deps.config.requirePrincipal && !principal) {
+        sendError(res, 401, "auth.principal_required", `missing principal header '${deps.config.principalHeader}'`);
+        return;
+    }
+    if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+        sendError(res, 403, "auth.operator_only", "memory opt-out grant administration is operator-only: the caller principal is not in OPERATOR_PRINCIPALS (an empty list means NO one is an operator — configure it to enable these endpoints)");
+        return;
+    }
+    const operator = principal;
+    const store = deps.memoryOptOutGrant;
+    if (store === undefined) {
+        sendError(res, 501, "capability.memory_optout_grant_required", "this deployment has no memory opt-out grant table: the per-principal memory-capture opt-out authorization store lives on a SQL store backend (DB_BACKEND=mysql|pg) and the local backend deliberately keeps no forgetting twin — wire a SQL backend to administer opt-out grants");
+        return;
+    }
+    if (verb === "malformed" || ((verb.kind === "putOverride" || verb.kind === "deleteOverride") && memoryOptOutPrincipalShapeProblem(verb.principal) !== undefined)) {
+        sendError(res, 400, "request.path_malformed", "invalid memory opt-out grant principal — the path segment must percent-decode to a non-empty principal of at most 190 chars with no leading/trailing whitespace or control characters (the deployment default row is addressed by PUT on the collection root, not by a path segment)");
+        return;
+    }
+    if (verb.kind === "list") {
+        sendJson(res, 200, await store.list());
+        return;
+    }
+    if (verb.kind === "deleteOverride") {
+        sendJson(res, 200, { principal: verb.principal, deleted: await store.deleteOverride(verb.principal) });
+        return;
+    }
+    const parsed = PutBodySchema.safeParse(await ctx.helpers.readJson(req));
+    if (!parsed.success) {
+        sendError(res, 400, "request.body_shape", "invalid memory opt-out grant body — expected exactly { allow: boolean, note?: string (1..500 chars) }; unknown keys are refused (a mistyped `allow` must not silently become a no-op)");
+        return;
+    }
+    const input = { allow: parsed.data.allow, updatedBy: operator, ...(parsed.data.note !== undefined ? { note: parsed.data.note } : {}) };
+    const row = verb.kind === "putDefault" ? await store.putDefault(input) : await store.putOverride(verb.principal, input);
+    sendJson(res, 200, row);
+}
+//# sourceMappingURL=admin-memory-optout.js.map

package/dist/http/routes/agents-roster.d.ts

@@ -16,7 +16,7 @@
  *
  * ## 三条边界(逐条对着失败形写)
  *  · **principal 门 + 反枚举**:身份判在店可用性判**之前**(否则「这台有没有装店」会先于 401 泄出去,
- *    与 `GET /v1/sessions` 的同款注释);principal 调用方**钉死自己的 scope**(`?scope=` 对它无效),
+ *    与 `GET /v1/sessions` 的同款注释);principal 调用方**锁定自己的 scope**(`?scope=` 对它无效),
  *    于是别的租户的行不是「403」也不是「空 200 但 total 多 1」——它在这个名册里**根本不存在**,
  *    没有任何可判别面(`total` 同样是属主口径:一个多出来的计数就是存在性 oracle)。
  *  · **投影白名单**(照 `routes/fleet.ts` `stripT` 的姿势):逐键**显式拼**,并用

package/dist/http/routes/approvals-assistant.js

@@ -38,6 +38,8 @@ async function decideIdempotentReplay(cs, args) {
     const boundCallId = binding.boundCallId;
     if (boundCallId === undefined)
         return undefined;
+    if (binding.checkpointToken !== undefined)
+        return undefined;
     if (typeof cs.findDecidedApprovalsForBinding !== "function")
         return undefined;
     const rows = await cs.findDecidedApprovalsForBinding(sessionId, boundCallId);
@@ -463,30 +465,28 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     return;
                 }
             }
-            let rememberToolName = null;
-            if (remember) {
-                const tok = await cs.findPendingTokenBySession(sessionId);
-                const cp0 = tok ? await cs.get(tok) : null;
-                const pa0 = cp0?.pendingAction;
-                const tn = pa0 && pa0.kind === "tool_approval" ? pa0.toolName : null;
-                rememberToolName = tn && tn !== "AskUserQuestion" ? tn : null;
-            }
             let rememberApplied = false;
-            const grantOnCommit = remember && deps.approvalExemptionStore && rememberToolName
-                ? async (overrideSessionId) => {
-                    const grantSessionId = overrideSessionId ?? sessionId;
-                    try {
-                        const canonical = rememberToolName;
-                        await deps.approvalExemptionStore.grant(grantSessionId, canonical, deciderPrincipal ?? null);
-                        rememberApplied = true;
-                        deps.logger?.info?.("approval_exemption_granted", { sessionId: grantSessionId, toolName: canonical, grantedBy: deciderPrincipal ?? null });
-                    }
-                    catch (e) {
-                        deps.logger?.warn?.("approval_exemption_grant_failed", { sessionId: grantSessionId, toolName: rememberToolName, error: String(e).slice(0, 200) });
-                    }
+            let pendingGrant;
+            const grantOnCommit = remember && deps.approvalExemptionStore
+                ? async (grant) => {
+                    const canonical = grant.validatedToolName;
+                    if (!canonical)
+                        return;
+                    pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true);
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const outErrorCode = out.body.errorCode;
+            if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
+                try {
+                    await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
+                    rememberApplied = true;
+                    deps.logger?.info?.("approval_exemption_granted", { sessionId: pendingGrant.sessionId, toolName: pendingGrant.toolName, grantedBy: deciderPrincipal ?? null });
+                }
+                catch (e) {
+                    deps.logger?.warn?.("approval_exemption_grant_failed", { sessionId: pendingGrant.sessionId, toolName: pendingGrant.toolName, error: String(e).slice(0, 200) });
+                }
+            }
             const replay = await decideIdempotentReplay(cs, {
                 sessionId,
                 out,

package/dist/http/routes/capabilities.js

@@ -9,6 +9,7 @@ import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { projectMemoryEngineCapability } from "../../memory-posture.js";
+import { workflowModelAllowlistFor } from "../../task-workflow.js";
 import { centerEntitlementSourceWired } from "../../runtime-caps-resolver.js";
 import { gatedPrincipal } from "../principal-gate.js";
 function routePairingOf(deps, name, m) {
@@ -55,24 +56,21 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             fleet: deps.fleetBus
                 ? { stream: true, sessionScope: true, observe: true, resume: "snapshot", bgNotifyFailClosed: true, steerPriority: "advisory", hookFailureNotice: true }
                 : false,
-            workspace: (() => {
-                const wfs = deps.fileSnapshotStore;
-                return wfs && typeof wfs.listKeys === "function" && typeof wfs.exportManifest === "function" && typeof wfs.getBlob === "function" && Boolean(deps.sessionStorage?.ownerOf)
-                    ? { browse: true, archive: true, maxFileBytes: deps.config.workspaceFileMaxBytes ?? 8 * 1024 * 1024 }
-                    : false;
-            })(),
+            workspace: false,
             leader: Boolean(deps.leaderEndpoint),
             images: Boolean(deps.imageIndex),
             memory: false,
             memoryWrite: false,
             memoryEngine: projectMemoryEngineCapability(deps.memoryPosture),
             sessionBackgroundable: Boolean(deps.runStore),
+            runMemoryCaptureOptOut: Boolean(deps.runStore),
             sharedMemory: Boolean(deps.sharedMemoryStore && deps.orgMemoryDirectory),
             adoption: Boolean(deps.backend?.adoptionLog) && deps.config.operatorPrincipals.length > 0,
             memoryBundle: Boolean(deps.memoryBundleExport && deps.memoryBundleImport) && deps.config.operatorPrincipals.length > 0,
             memoryCompliance: Boolean(deps.memoryCompliance) && deps.config.operatorPrincipals.length > 0,
             memoryOrigin: Boolean(deps.memoryOriginFace) && deps.config.operatorPrincipals.length > 0,
             memoryConsolidationDriver: Boolean(deps.memoryConsolidation) && deps.config.operatorPrincipals.length > 0,
+            memoryOptOutGrant: Boolean(deps.memoryOptOutGrant) && deps.config.operatorPrincipals.length > 0,
             outcomeLedger: Boolean(deps.outcomeSink?.summary) && (deps.config.requirePrincipal !== true || deps.config.operatorPrincipals.length > 0),
             permissionRules: Boolean(deps.ruleConsent) && gatedPrincipal(req, deps.config) !== undefined,
             permissionRulesRevoke: Boolean(deps.ruleConsent),
@@ -135,15 +133,28 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             resumeAt: Boolean(deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
             promptSuggestions: true,
             sessionPolicy: Boolean(deps.sessionPolicyStore),
-            rewindFiles: Boolean(deps.fileSnapshotStore),
-            rewindFilesTo: Boolean(deps.fileSnapshotStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+            rewindFiles: Boolean(deps.fileHistoryStore),
+            restoreFiles: Boolean(deps.fileHistoryStore),
+            rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
             scheduler: Boolean(deps.config.schedulerEnabled && deps.config.requirePrincipal !== true && deps.config.remoteExec?.provider === "host"),
-            sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.sessionStorage?.beginImportStaging && deps.fileSnapshotStore),
+            sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.sessionStorage?.beginImportStaging && deps.fileHistoryStore),
             sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
             s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
             sendUserFileLedger: Boolean(deps.sendFileLedger),
             workflows: deps.workflowsCapable ?? Boolean(deps.workflowRunStore),
             workflowsList: Boolean(deps.workflowRunStore),
+            workflowModels: (() => {
+                const allow = deps.workflowModelAllowlist
+                    ?? workflowModelAllowlistFor({
+                        selfOrchestrationModels: deps.config.selfOrchestrationModels ?? [],
+                        requirePrincipal: deps.config.requirePrincipal,
+                        models: deps.config.models ?? {},
+                    })
+                    ?? [];
+                const bare = deps.config.models ?? {};
+                const live = expandTiers(bare, deps.config.tiers ?? {}) ?? bare;
+                return allow.filter((n) => Object.hasOwn(live, n));
+            })(),
             manualCompact: Boolean(deps.runStore),
         });
         return;