@sema-agent/server 7.51.0 → 7.52.1

package/dist/config-types.d.ts

@@ -6,7 +6,7 @@
  *  compiling unchanged. All imports below are top-level `import type` (erased — never a load edge,
  *  see test/module-cycle-gate.test.ts header on verbatimModuleSyntax). */
 import type { SealedKeyPoison } from "./sealed-key.js";
-import type { A2aServerSpec, CompliancePosture, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
+import type { A2aServerSpec, CompliancePosture, FileHistoryRetentionPolicy, LockedKey, McpServerSpec, Model, ModelRoles, RetentionPolicy } from "@sema-agent/core";
 import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 import type { ElicitationThrottle } from "./elicitation.js";
 import type { QuestionThrottle } from "./question.js";
@@ -183,6 +183,26 @@ export interface StreamApprovalConfig {
     /** 判据 5(遗孤最终可判)的上界,量 immutable 的 `createdAtMs`。`STREAM_APPROVAL_ORPHAN_TTL_MS`,
      *  默认 **7d**,有界 [60000, 90d]。 */
     orphanTtlMs: number;
+    /**
+     * S-43(案A,#374 / core #481)—— **零活流铸造**的 ask 的悬挂窗。`UNREACHED_ASK_TTL_MS`,
+     * 默认 **3600000**(1h),有界 [60000, 86400000](60s ~ 24h),坏值/越界**拒启**(#210 A 档)。
+     *
+     * 三问(behavior-facing 硬条款):
+     *  · **谁需要**:workflow 恒后台跑(CC 220 parity)⇒ 子代 ask 到达时 (owner, session) 键域常无活 SSE。
+     *    改形前那一刻即答 `"unavailable"`,合成整条命令死拒([5443] 车道2 实证)。悬挂让人稍后经
+     *    `/v1/approvals` / 壳队列 / attach 补投三通道回来答它。1h 是「人不在场但当天会回来」的尺度。
+     *  · **谁被伤**:悬挂 ask 占一格写侧准入配额(`STREAM_APPROVAL_ADMIT_MAX_PER_TASK`,默认 32)且占一条
+     *    持久行,窗越长积压越久;显式声明无人值守的部署(`UNATTENDED_APPROVAL_POLICY=deny`)**完全不受
+     *    本键影响**(那条腿在铸造时刻即拒,追记 F1)。
+     *  · **补偿**:本键本身(调小即回到接近旧行为;60s 下界不给「等于零窗」的形——那等价于关掉案A,
+     *    要那个语义请用 `deny` 政策或 `STREAM_ASK_WINDOW_MS=0` 的 windowZero 腿)。
+     *
+     * 🔴 跨旋钮不变量(与 `WINDOW + ADHOC_GRACE < ORPHAN_TTL` 同族、同理由):
+     * **`UNREACHED_ASK_TTL_MS + ADHOC_GRACE` 必须严格小于 `ORPHAN_TTL`** —— 悬挂行的 `expiresAtMs ≈
+     * createdAtMs + 本键`,判据 4 在 `expiresAtMs + 宽限` 触发而判据 5 在 `createdAtMs + orphanTtl` 触发;
+     * 不等式不成立 ⇒ 遗孤兜底必先到,每条悬挂行的归因都被写成 `orphan_ttl_exceeded`。boot 期校验,拒启。
+     */
+    unreachedTtlMs: number;
 }
 export interface ImageBakeConfig {
     enabled: boolean;
@@ -251,7 +271,7 @@ export interface ServiceConfigFlat {
         /** Prompt-cache breakpoints on system + last tool (stable prefix). Default true. */
         cacheBreakpoints: boolean;
         /** `ANTHROPIC_MAX_RETRIES` —— **缺席不铸键**,同 `gatewayMaxRetries` 的理由(见其顶注):
-         *  env 没配时以前会铸成 `2` 再显式传给引擎,把引擎默认钉死在 server 这一层。 */
+         *  env 没配时以前会铸成 `2` 再显式传给引擎,把引擎默认写死在 server 这一层。 */
         maxRetries?: number;
     };
     /** Resilience brain stack (1.38, design/27): tiered timeouts + an optional circuit breaker layered
@@ -348,10 +368,6 @@ export interface ServiceConfigFlat {
     /** B1 /health 活体 store 探测:后台缓存探针间隔 ms(STORE_PROBE_INTERVAL_MS;0=显式关,负/非数 boot
      *  响亮拒)。只对 SQL 后端接线;探针原语=backend.dbNowMs()(S10 时钟探针的真 DB 往返,零新 SQL 面)。 */
     storeProbeIntervalMs: number;
-    /** Rewind snapshot bounds: byte cap in MB (env REWIND_SNAPSHOT_MAX_MB). Unset = core DEFAULT_SNAPSHOT_BOUNDS
-     *  (256 MiB / 10000 files as of core 2026-06-26 — was 2000/64MiB). BYTE-ONLY knob: raises OR lowers just the byte
-     *  cap; file-count/ignoreDirs stay core defaults (more knobs when a case shows up). */
-    rewindSnapshotMaxMb?: number;
     /** Long-term memory (design/138 S1, clay 2026-07-08): the injection-first file-based memory ENGINE
      *  (core `RunnerDeps.memoryBackend` + `MemoryEngine`) is the ONLY memory plane — the legacy MemoryStore
      *  path (MEMORY_BACKEND/EMBEDDING_* SQL/file note stores) was dropped without migration. Default ON;
@@ -378,13 +394,13 @@ export interface ServiceConfigFlat {
      *   · `true` ⇒ 部署自证有推断**看不见**的持久通道(自定义 writer / MCP 记忆服务 / remote lane 与记忆根
      *     共享挂载)。它撤回引擎的只读披露,并在 remote lane 上**恢复** `# Memory` 写指令(core 5.26.0 r13/r14
      *     收窄的官方恢复路径);
-     *   · `false` ⇒ 强制披露只读/无持久面,并关掉文件工具往记忆根的写通道(披露不会被存储事实打脸)。
+     *   · `false` ⇒ 强制披露只读/无持久面,并关掉文件工具往记忆根的写通道(披露不会被存储事实推翻)。
      *
      *  🔴 **`false` 自 core 5.27.0 起还多一层**([3612] F2,#231 提货):declared-false 的会话是**受限会话**
      *  —— materialize/search/harvest 一律按**已提交账**(ledger + shadow)供给,磁盘上无事务背书的分歧
      *  既不收编也不供给,而是留盘 + 响亮点名(`restricted_divergence`,`HarvestRejectionCode` 新成员),
      *  等下一次**非受限**会话走正常门收编。这补上了 5.26.0 自己登记的那条残余(读侧入站同步收编磁盘分歧
-     *  **与会话意图无关**)——在那之前,这里写的「披露不会被存储事实打脸」只是半真话:披露说「本机存不下」,
+     *  **与会话意图无关**)——在那之前,这里写的「披露不会被存储事实推翻」只是半真话:披露说「本机存不下」,
      *  引擎却仍可能把别处落进记忆根的字节收进这次会话的账。
      *  ⚠️ **这一层的射程 = file 记忆引擎**(`MEMORY_ENGINE_BACKEND` 未设的默认单机形):受限视图是
      *  `FileMemoryEngineBackend.restrictedAdoptionView` 的实装,而 `engine.materialize` 取它走的是
@@ -482,6 +498,28 @@ export interface ServiceConfigFlat {
      *  ⚠️ **不冻进 checkpoint**:resume 的那条腿跟**当前**部署配置走(core 成文)。
      *  运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.provenance`(`null`=本部署未设)。 */
     memoryProvenance?: "off" | "carry";
+    /** design/383 §3.1(core 7.0.0 片3,S-49 S-1b):本部署的记忆 **capture 姿态** —— per-principal
+     *  `RuntimeCaps.allowMemoryOptOut` verdict 被读进的那个框。env `MEMORY_CAPTURE_POLICY`,三词闭集:
+     *   · `open`(≡ 缺席时 core 的缺省)—— `TaskSpec.memory.capture:"off"` 声明按面值生效;只有 resolver 的
+     *     **显式** `false` 拒它(`memory.capture_optout_denied`,terminal)。resolver **故障**(throw / 非
+     *     boolean / 缺席)⇒ opt-out **仍生效** + `onError({phase:"config"})` 具名披露 —— 极性反转臂:隐私轴上
+     *     不可逆的一侧是「把用户明说不要记的会话记进去」,fail-safe 朝它的反面;
+     *   · `governed` —— per-principal verdict **必答**(混合车队:部分用户强制留存)。`true` 放行、`false` 拒;
+     *     resolver 故障/verdict 缺席 ⇒ **拒跑任务**(fail-closed:部署显式声明合规侧的不可逆更重);
+     *   · `capture-required` —— 全体声明具名拒(部署级强制留存,一行配置,不依赖 resolver)。
+     *
+     *  🔴 **缺席 = 不铸键**(不复制上游缺省;`memoryProvenance` 同姿态)。坏值 ⇒ 启动期响亮拒:`governed` 与
+     *  `open` 的故障极性**相反**,一个被静默折成缺省的拼写错误会让合规部署在故障窗里放行留存必需用户的 opt-out。
+     *  core 侧 `prepareConfigDoors` 另有同判门(`config.memory_capture_policy`),两道同向不冲突。
+     *
+     *  🔴 **`governed` 的半配置拒启**:该姿态要求本部署有 per-principal verdict 源。本批唯一源 = SQL 后端上的
+     *  `memory_optout_grant` 表(S-2;center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema
+     *  的独立小件,到货前不算源)。governed 而无源 ⇒ 每个 opt-out 声明都被 core 拒且没人知道为什么 ⇒
+     *  `boot/runtime-caps.ts` 的 `assertMemoryCapturePolicyWirable` 在启动期拒启(与 consolidation 阀门 D1 同姿态)。
+     *
+     *  ⚠️ **部署席 ONLY**:TaskSpec 无同名键;不冻进 checkpoint(resume 腿跟当前部署配置走,core 成文)。
+     *  运维读面 = `GET /v1/diagnostics/wiring` 的 `memoryPosture.capturePolicy`(`null`=本部署未设)。 */
+    memoryCapturePolicy?: "open" | "governed" | "capture-required";
     /**
      * design/378(core 5.58 design/376 片②)—— 记忆 **consolidation driver 阀门**的三根旋钮。
      * **恒在场**(不是可选块,与 {@link retentionSweep} 同姿态):三根都有文档化的缺省,而缺省本身
@@ -587,6 +625,11 @@ export interface ServiceConfigFlat {
         execTimeoutMs?: number;
         /** `DEVICE_MAX_INFLIGHT_PER_DEVICE`(§11-O3 clay 已裁 = 4)。 */
         maxInflightPerDevice?: number;
+        /** `DEVICE_MAX_PREAUTH_PER_REMOTE`(默认 8;字面 `off` = 显式停用 per-remote 层)= 未鉴权
+         *  握手的 per-remote 并发帽(S-04/A-075.52:帽键是裸 remoteAddress——XFF 反代 / 公司 NAT 部署
+         *  形会把全员折叠成单键,per-remote 层退化成共享预算而非公平层,`off` + 全局帽 64 是诚实形)。
+         *  坏值拒启(#210 A 档),词表与拒因见 config.ts `parseDevicePreAuthPerRemoteEnv`。 */
+        maxPreAuthPerRemote?: number | "off";
         /** `DEVICE_SUPERSEDE`(默认 `stale_only`)= 同 deviceId 二连的顶替策略(§5.2)。 */
         supersede?: "stale_only" | "deny";
     } | {
@@ -662,6 +705,19 @@ export interface ServiceConfigFlat {
      *  service and a run-local on the same box agree on one data dir (boot-locked single-instance). Only the
      *  `local` backend reads it. */
     localDataRoot?: string;
+    /**
+     * S-46 件B(`RUN_STORE_STRICT_HYDRATE`,普查表第 29 行的**终局格**)—— file 后端的**可选** fail-closed
+     * 启动门。`true` ⇒ `FileRunStore.hydrate()` 列不出 `runs/` 时**拒启**(error 级遗言带绝对路径 + 异常
+     * 文案,然后抛);缺省 **false** ⇒ 件6 的既有形逐字不变(带病起动 + 一行 error + P-DEBT 计数)。
+     *
+     * 为什么默认是 off:件6 当年把「不拒启」写成了刻意保留的行为,默认翻面等于替所有存量部署做主。
+     * 为什么值得有这根旋钮:空账起动之后每一次 `getRun` 恒 miss,而「恒 miss」与「本来就没有这条 run」
+     * 在 wire 上同形(#43 现场就是这么被误读的)—— 把 run 账本当真账本用的部署有权要求「读不出就别起」。
+     * 坏值**拒启**(#210 A 档):静默回默认会让 operator 要的 fail-closed 被无声吃掉。
+     *
+     * 只有 `local`(file)后端读它;SQL 后端的 hydrate 不经这条路。
+     */
+    runStoreStrictHydrate: boolean;
     /** PostgreSQL connection (used iff dbBackend === "pg"). Mirror of `tidb`. Env: PG_HOST/PG_PORT/PG_USER/
      *  PG_PASSWORD/PG_DATABASE/PG_POOL_SIZE. */
     pg?: {
@@ -703,6 +759,15 @@ export interface ServiceConfigFlat {
      *  实证,大字节归对象存储);`SNAPSHOT_BLOB_ALLOW_SQL_BYTES=true` 显式接受 SQL 店 + (a) 的帽
      *  (单机/测试台形)。严格 "true" 判——这是安全姿势开关,不收宽松真值。 */
     snapshotBlobAllowSql: boolean;
+    /** S-15 twin 保留条款(core design/381 §片2):per-file rewind 历史的**边界上限**,键形与 core
+     *  `FileStorageBackendOptions.fileHistory.retention.keep` **同域同名**(local 腿原样透传给 core 的 File 店;
+     *  SQL 双生店构造期同调 core `resolveFileHistoryRetention` —— 一套语义,三条车道)。缺席 = core 缺省
+     *  (100,由 core 兑现,本仓不复制那个数);`{ keep: "unbounded" }` 是唯一的「不剪」拼法。坏值在
+     *  loadConfig 就以 core 的 `config.retention_policy_invalid` 拒(运维接线处),绝不静默回落。
+     *  env:`FILE_HISTORY_RETENTION_KEEP`。 */
+    fileHistory?: {
+        retention?: FileHistoryRetentionPolicy;
+    };
     /** plugins 域 clone host 白名单(`PLUGINS_ALLOW_HOSTS`,缺省 github.com;契约 [1361]① 双保险面,
      *  消费在 capabilities/center-plugins.ts)。 */
     pluginsAllowHosts: string[];
@@ -718,8 +783,8 @@ export interface ServiceConfigFlat {
      *  复审 F10:同 tick 邻居(workflowOrphanGraceMs/attachmentUnboundTtlMs/scratchpadSweepTtlMs)都有
      *  旋钮——存量对象巨大的部署要调慢/停掉,不该被迫取消 MinIO 配置(那会连带关掉整个附件面)。 */
     attachmentOrphanGraceMs: number;
-    /** workspace 浏览面(#3,[1894]①)单文件读上限(字节;`WORKSPACE_FILE_MAX_BYTES`,默认 8MiB)。
-     *  超限=413 结构化信封 {sizeBytes, limit} 指路 archive 口。软旋钮:坏值走默认。 */
+    /** ⚠️ INERT since S-15(workspace 浏览面随整树快照纪元退役,消费点归零)。键**保留**:center 热推
+     *  可能仍携带它,删键会让整份推送按未知键处置——正式摘除走 settings-schema 的弃用车道。 */
     workspaceFileMaxBytes: number;
     /** SendUserFile dual-track public-link issuance (design settled cross-repo 2026-07-14; S3_PUBLIC_* are
      *  [766]② cross-repo contract names — never rename). Enabled iff the adapter-held MinIO/S3 creds are set:
@@ -764,7 +829,7 @@ export interface ServiceConfigFlat {
      *  service-to-service token, else anything in-cluster can submit & bill directly). `ALLOW_UNAUTHED_WRITES`.
      *  有意设计(文档化):本开关只豁免「零凭证形态」的 fail-closed 503;一旦配了凭证
      *  (SERVICE_AUTH_TOKEN 或 TOKENS 名录),凭证必须使用——unauthed 仍 401,两 env 不叠加
-     *  (半配置绕行=后门,刻意优先级)。 */
+     *  (半配置绕行=隐藏入口,刻意优先级)。 */
     allowUnauthedWrites?: boolean;
     /** Optional READ-ONLY token that ALSO authorizes GET /metrics + /metrics/summary (in addition to
      *  authToken). Set the SAME value fleet-wide so a control plane (sema-registry) can pull every worker's
@@ -893,7 +958,7 @@ export interface ServiceConfigFlat {
      * 它是**零进展 slice 循环**的兜底(两条总额才是主约束),与重启环的 `maxSuspends` 是两个独立计数。
      * core 的 JSDoc 逐字点名了本仓这个角色:"a host driving resumes unattended **should set this**"。
      *
-     * 🔴 **它与两条 totals 的冻结语义不同**(codex 对抗复审 R1-[medium],验真后改口):core **不把它写进
+     * 🔴 **它与两条 totals 的冻结语义不同**(codex 交叉复审 R1-[medium],验真后改口):core **不把它写进
      * 账本**(`debitLedger` 的返回形里没有这一格),每片现读 `spec.resourceSuspend.maxSlices` 去比账本上
      * 累计的 `sliceCount`。⇒ 本仓在**每一片**(含续跑)供值是**载荷不是冗余**:只在首片供值等于让续跑腿
      * 供 `undefined` = 上限当场消失。代价如实登记:滚动部署改这根 env,已 park 的链按**新**值判 —— 部署
@@ -1081,20 +1146,30 @@ export interface ServiceConfigFlat {
      *  Running rows are never reaped (that is the orphan-grace sweep's job). Default 30 days, floor 1m.
      *  `WORKFLOW_RUN_RETENTION_MS`. */
     workflowRunRetentionMs: number;
-    /** design/166-T1 — core 5.8.0 部署级 token 治理窗(`RunnerDeps.usageWindows`):滑动窗内跨任务
-     *  token 预算,key=principal(缺席=GLOBAL 一口锅,per-key 各一份额度——混流部署语义见 USAGE.md)。
-     *  `USAGE_WINDOWS` 单键 JSON 数组(每项 {windowMs,maxTokens,anchor:"first-use"|"rolling"});
-     *  缺省未设=关(零行为变化)。fail-loud:坏 JSON/空数组/非正整数/未知 anchor → boot throw
-     *  (parseUsageWindows)。窗形变更≈重开账(first-use 桶按 windowMs 配对,老桶下次 charge 即弃)。 */
+    /** design/166-T1 — core 5.8.0 部署级治理窗(`RunnerDeps.usageWindows`):滑动窗内跨任务预算,
+     *  key=principal(缺席=GLOBAL 一口锅,per-key 各一份额度——混流部署语义见 USAGE.md)。
+     *  `USAGE_WINDOWS` 单键 JSON 数组(每项 {windowMs, maxTokens?, maxCostUsd?, anchor});
+     *  缺省未设=关(零行为变化)。S-18(core 7.0.0):`maxCostUsd` 是与 maxTokens **对等**的第二只
+     *  ceiling(绝对美元;whichever fills first 即耗尽;缺席的 ceiling 不参与——非 0、非 ∞)——两者
+     *  each optional on its own、**at least one required**(双缺=parseUsageWindows 响亮拒)。fail-loud:
+     *  坏 JSON/空数组/坏值/未知 anchor → boot throw(parseUsageWindows)。窗形变更≈重开账(first-use
+     *  桶按 windowMs 配对,老桶下次 charge 即弃)。$ 窗要求 run 可计价:无价目模型撞 $ 窗=core 门口拒
+     *  (`config.usage_window_unpriced`),USAGE.md §9.2。 */
     usageWindows?: readonly {
         windowMs: number;
-        maxTokens: number;
+        maxTokens?: number;
+        maxCostUsd?: number;
         anchor: "first-use" | "rolling";
     }[];
     /** core 1.364 durable background agents([1503] 提货单③):reaper 经 `TaskRegistry.reapDurableAgents`
      *  (联合 reap——条件删赢了才 release 转录 session;裸 store.reap 会 strand 转录)按 scope 清 TERMINAL
      *  `a*` 行,老于此值的删。SQL twins 走 DISTINCT-scope 枚举;local FileBackgroundAgentStore 单租户
-     *  scope="default"。Default 7 days, floor 1m。`BG_AGENT_RETENTION_MS`。 */
+     *  scope="default"。Default 7 days, floor 1m。`BG_AGENT_RETENTION_MS`。
+     *  🔴 S-03(#292②,设计判定 2026-08-30):这根旋钮**同时是子代转录(placed 分区)的生效留存视界**——
+     *  联合 reap 行赢删才 release 转录,分区孤儿腿 `olderThanMs` 同源(core `reapDurableAgentsLane` 亲核),
+     *  retention lane 对 placed 显式让权(retention-store-sql.ts 第五腿)。core 词表常量
+     *  `SUBAGENT_TRANSCRIPT_RETENTION_DAYS_DEFAULT`(30d)在 core dist 零消费,本服务未按它跑;天数形
+     *  专用旋钮无 core policy 座,候 core 扩座后再铸(生效值已投 wiring_static 日志)。 */
     backgroundAgentRetentionMs: number;
     /** 同批:stale-running 翻转窗——running 行的写者心跳(core 60s)断更超过此值 = 宿主进程死,行翻
      *  failed/stoppedBy=system(诚实终态,跨实例读面永不虚构存活)。core 契约要求 ≥10min(60s 心跳的
@@ -1289,7 +1364,7 @@ export interface ServiceConfigFlat {
      * 放行、不会减**,而车二**没有撤销面**——列出 / 删除自己已存规则的口子没建,core 的
      * `removePersistedRule` 在包里但本仓零调用点。一次误导入的全局规则因此会一直生效,租户自己拿它没
      * 办法,只能找运维改库。#203 交付的正是那条撤销面本身(`GET /v1/rules` + `DELETE /v1/rules`,后者
-     * 恒经 `removePersistedRule` 产墓碑)加上 operator 的越权回收腿 ⇒ **前置条件兑现,默认翻转**。
+     * 恒经 `removePersistedRule` 产墓碑)加上 operator 的超范围回收腿 ⇒ **前置条件兑现,默认翻转**。
      * 记这段史不是怀旧:哪天有人想把某条「只加放行」的车道默认打开,判据就是这一条 —— 收得回来才敢开。
      *
      * 显式 `PERMISSION_RULES_ENABLED=false` 仍然关得掉(默认翻转不吃部署侧的表态);升级到本版的既有
@@ -1357,7 +1432,7 @@ export interface ServiceConfigFlat {
      * 🔴 **射程边界(成文,不是遗漏)**:
      *  · 唯一让本旋钮**无处施加**的键是 `TOOL_APPROVAL_ENABLED=false`(协调器整体不构造,core 走它自己的
      *    headless 姿态)。**不造推断腿**:旋钮只在协调器在场时有意义,这一句是成文而不是代码分支。
-     *  · ⚠️ **与 `STREAM_APPROVAL_ENABLED` 正交**(codex 对抗复审 R2-F2 验真后纠正 —— 本注上一版把两者
+     *  · ⚠️ **与 `STREAM_APPROVAL_ENABLED` 正交**(codex 交叉复审 R2-F2 验真后纠正 —— 本注上一版把两者
      *    写成了一回事,是错的):协议开关关掉只是不注入 `askStore`/协议窗,协调器照常在场,于是 R-13 的
      *    D1 窗到期臂**照样**走 park 路由。这不是漏网:设计稿 §2 明写 park 的承载是 **core checkpoint**
      *    而不是 server 的 ask 行,「无 askStore 但有 durable 设施」正是 R-13 点名的**主受益部署**。
@@ -1382,7 +1457,7 @@ export interface ServiceConfigFlat {
     workflowAgentsReadOnly: boolean;
     /** Sandbox-image-pool BAKE job API (IMAGE-API-DESIGN.md §P2): enable /v1/images/bakes* (operator-submit + the
      *  bake-runner claim/ingest control plane). Requires a TiDB pool (the durable bake row/event/lease tables) AND
-     *  a NON-EMPTY `operatorPrincipals` (boot-asserted — never a world-writable build-host-RCE door). Default OFF.
+     *  a NON-EMPTY `operatorPrincipals` (boot-asserted — never an unrestricted-write build-host exec door). Default OFF.
      *  `IMAGE_BAKES_ENABLED=true`. */
     imageBakes: ImageBakeConfig;
     /** prove-before-scale stopgap: log every tool call (pre+post, incl. resumed legs) for diagnosis. `TOOL_TRACE=true`. Default OFF. */
@@ -1390,7 +1465,7 @@ export interface ServiceConfigFlat {
     /** Task Trace API (S1): persist the agent's reasoning/thinking into the durable run event log (for the CC-style
      *  trace UI). Default ON; `TRACE_THINKING=false` disables capture for sensitive deployments. Redacted on persist. */
     traceThinking: boolean;
-    /** #246(core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不钉死
+    /** #246(core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不写死
      *  上游默认);显式坏词启动期响亮拒。只影响读面,写面永不受它管(core 契约)。 */
     readFace?: "open" | "roots";
     /** #246:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
@@ -1509,14 +1584,14 @@ export interface ServiceConfigFlat {
     configLocalDir?: string;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
-export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "rewindSnapshotMaxMb" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "sendUserFile">;
+export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "runStoreStrictHydrate" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "fileHistory" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
 export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "manualModeShellGate">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
-export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
+export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。
  *  design/170 的三件部署治理声明(`compliancePosture`/`lockedConfigKeys`/`retentionPolicy`)同归本组:

package/dist/config.d.ts

@@ -15,11 +15,19 @@ export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
 /** design/166-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
  *  封闭形)。unset/空串 → undefined(关)。fail-loud 族(numEnv 同纪律):坏 JSON/非数组/空数组/
- *  非正有限整数/未知 anchor 全部 boot throw 点名——「设了但无意义」静默关掉=部署方以为有治理实际没有。
- *  server 严于 core(core 允 maxTokens=0=恒拒锅;这里要求正整数,0 配置显然是笔误不是意图)。 */
+ *  坏值/未知 anchor 全部 boot throw 点名——「设了但无意义」静默关掉=部署方以为有治理实际没有。
+ *  S-18(core 7.0.0 `UsageWindow.maxCostUsd`,dist/core/usage-window-store.d.ts:44-68 亲读):
+ *  `maxTokens` 与 `maxCostUsd` 是两只**独立** ceiling——each optional on its own、**at least one
+ *  required**(双缺=拒:a window with neither admits nothing it can govern),whichever fills first
+ *  即耗尽;缺席的 ceiling 不参与(非 0、非 ∞)。修前这里的白名单重铸只认三键,$ 键配了也被静默
+ *  剥掉——正是本函数要消灭的那族病自己。
+ *  server 严于 core(core 允两 ceiling 取 0=恒满锁死窗;这里都要求正数,0 配置显然是笔误不是意图);
+ *  `maxCostUsd` 另提前执行 core 的 micro-USD 门(×1e6 仍有限——超界 ceiling 在账本单位里读作 ∞,
+ *  「看起来被治理、实际什么都不拦」,core 在门口拒,这里拒在 boot)。 */
 export declare function parseUsageWindows(raw: string | undefined): readonly {
     windowMs: number;
-    maxTokens: number;
+    maxTokens?: number;
+    maxCostUsd?: number;
     anchor: "first-use" | "rolling";
 }[] | undefined;
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -38,18 +38,38 @@ export function parseUsageWindows(raw) {
         parsed = JSON.parse(v);
     }
     catch (e) {
-        throw new Error(`env USAGE_WINDOWS is not valid JSON: ${String(e)} — expected e.g. [{"windowMs":18000000,"maxTokens":5000000,"anchor":"first-use"}]`);
+        throw new Error(`env USAGE_WINDOWS is not valid JSON: ${String(e)} — expected e.g. [{"windowMs":18000000,"maxTokens":5000000,"anchor":"first-use"}] or [{"windowMs":604800000,"maxCostUsd":25,"anchor":"rolling"}]`);
     }
     if (!Array.isArray(parsed) || parsed.length === 0) {
-        throw new Error(`env USAGE_WINDOWS must be a NON-EMPTY JSON array of {windowMs,maxTokens,anchor} (an empty array is a governance no-op nobody chose — unset the env to turn windows off)`);
+        throw new Error(`env USAGE_WINDOWS must be a NON-EMPTY JSON array of {windowMs, maxTokens?, maxCostUsd?, anchor} (an empty array is a governance no-op nobody chose — unset the env to turn windows off)`);
     }
     const out = parsed.map((w, i) => {
         const o = w;
         const posInt = (n) => typeof n === "number" && Number.isInteger(n) && n > 0;
-        if (typeof w !== "object" || w === null || !posInt(o.windowMs) || !posInt(o.maxTokens) || (o.anchor !== "first-use" && o.anchor !== "rolling")) {
-            throw new Error(`env USAGE_WINDOWS[${i}] is invalid: expected {windowMs: positive int ms, maxTokens: positive int, anchor: "first-use"|"rolling"} (got ${JSON.stringify(w)})`);
+        const posUsd = (n) => typeof n === "number" && Number.isFinite(n) && n > 0 && Number.isFinite(n * 1e6);
+        if (typeof w !== "object" || w === null || !posInt(o.windowMs) || (o.anchor !== "first-use" && o.anchor !== "rolling")) {
+            throw new Error(`env USAGE_WINDOWS[${i}] is invalid: expected {windowMs: positive int ms, maxTokens?: positive int, maxCostUsd?: positive USD, anchor: "first-use"|"rolling"} (got ${JSON.stringify(w)})`);
         }
-        return Object.freeze({ windowMs: o.windowMs, maxTokens: o.maxTokens, anchor: o.anchor });
+        for (const k of Object.keys(w)) {
+            if (k !== "windowMs" && k !== "maxTokens" && k !== "maxCostUsd" && k !== "anchor") {
+                throw new Error(`env USAGE_WINDOWS[${i}] is invalid: unknown key \`${k}\` — the window shape is the CLOSED set {windowMs, maxTokens?, maxCostUsd?, anchor}; a misspelled ceiling (e.g. \`maxCostUSD\`) must not silently leave the deployment ungoverned (got ${JSON.stringify(w)})`);
+            }
+        }
+        if (o.maxTokens === undefined && o.maxCostUsd === undefined) {
+            throw new Error(`env USAGE_WINDOWS[${i}] is invalid: at least one ceiling is required — \`maxTokens\` (tokens) and/or \`maxCostUsd\` (absolute USD); a window with neither admits nothing it can govern (got ${JSON.stringify(w)})`);
+        }
+        if (o.maxTokens !== undefined && !posInt(o.maxTokens)) {
+            throw new Error(`env USAGE_WINDOWS[${i}] is invalid: \`maxTokens\` (when present) must be a positive integer (got ${JSON.stringify(w)})`);
+        }
+        if (o.maxCostUsd !== undefined && !posUsd(o.maxCostUsd)) {
+            throw new Error(`env USAGE_WINDOWS[${i}] is invalid: \`maxCostUsd\` (when present) must be a positive finite USD amount that stays finite in micro-USD (× 1e6) (got ${JSON.stringify(w)})`);
+        }
+        return Object.freeze({
+            windowMs: o.windowMs,
+            ...(o.maxTokens !== undefined ? { maxTokens: o.maxTokens } : {}),
+            ...(o.maxCostUsd !== undefined ? { maxCostUsd: o.maxCostUsd } : {}),
+            anchor: o.anchor,
+        });
     });
     return Object.freeze(out);
 }
@@ -252,6 +272,35 @@ function optNumEnvStrict(name) {
         return undefined;
     return parseNumOrFail(name, raw);
 }
+function parseDevicePreAuthPerRemoteEnv() {
+    const raw = process.env.DEVICE_MAX_PREAUTH_PER_REMOTE;
+    if (raw === undefined || raw === "")
+        return undefined;
+    if (raw === "off")
+        return "off";
+    if (!/^[1-9]\d*$/.test(raw)) {
+        throw new Error(`env DEVICE_MAX_PREAUTH_PER_REMOTE=${JSON.stringify(raw)} must be a positive integer or the literal "off" — ` +
+            `a malformed cap would otherwise run as the default (8) while the operator believes their value is in force ` +
+            `(#210: deployment knobs never fall back silently). "0" is not a valid cap (it would refuse every device handshake); ` +
+            `use "off" to disable the per-remote layer explicitly (reverse-proxy / NAT deployments collapse source IPs, A-075.52).`);
+    }
+    const n = Number(raw);
+    if (!Number.isSafeInteger(n)) {
+        throw new Error(`env DEVICE_MAX_PREAUTH_PER_REMOTE=${raw.length > 24 ? `${raw.slice(0, 24)}…(${raw.length} digits)` : raw} overflows the safe-integer range — ` +
+            `Number() would read it as ${n}, and a cap of Infinity silently disables the per-remote layer without taking the explicit "off" arm. ` +
+            `Use a value within Number.MAX_SAFE_INTEGER, or the literal "off".`);
+    }
+    return n;
+}
+function parseFileHistoryRetention() {
+    const raw = process.env.FILE_HISTORY_RETENTION_KEEP;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const keep = raw === "unbounded" ? "unbounded" : /^(?:0|[1-9]\d*)$/.test(raw) ? Number(raw) : raw;
+    const policy = { keep };
+    resolveFileHistoryRetention("FILE_HISTORY_RETENTION_KEEP", policy);
+    return { retention: policy };
+}
 function optFinitePositiveEnv(name) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -503,10 +552,10 @@ function parseStoreDomain(ctx) {
         sessionBackend,
         sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"),
         storeProbeIntervalMs: numEnvBounded("STORE_PROBE_INTERVAL_MS", "15000", 0, 3_600_000),
-        rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"),
         dbBackend,
         dbBackendExplicit: dbBackendSet,
         localDataRoot,
+        runStoreStrictHydrate: parseRunStoreStrictHydrate(process.env.RUN_STORE_STRICT_HYDRATE),
         tidb: needsDb && dbBackend === "mysql"
             ? {
                 host: env("MYSQL_HOST"),
@@ -541,6 +590,7 @@ function parseStoreDomain(ctx) {
             : undefined,
         snapshotBlobSqlMaxBytes: optFinitePositiveEnv("SNAPSHOT_BLOB_SQL_MAX_BYTES"),
         snapshotBlobAllowSql: boolEnv("SNAPSHOT_BLOB_ALLOW_SQL_BYTES", false),
+        fileHistory: parseFileHistoryRetention(),
         sendUserFile: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT) && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
             ? {
                 endpoint: (process.env.MINIO_ENDPOINT || process.env.S3_ENDPOINT),
@@ -803,7 +853,7 @@ export function formatUnmatchableToolNames(source, bad) {
     return (`${source} names tool(s) that can never match a live tool (these lists are RAW whole-name comparisons — core 5.0.0 RB-476 removed the alias/auto-prefix folds): ` +
         bad.map((b) => `${presentToolName(b.name)} → ${b.guidance}`).join("; ")).replace(CONTROL_AND_BIDI_STRIP_RE, "");
 }
-function streamApprovalConfig() {
+function streamApprovalConfig(gates) {
     const cfg = {
         enabled: boolEnv("STREAM_APPROVAL_ENABLED", true),
         windowMs: numEnv("STREAM_ASK_WINDOW_MS", "300000"),
@@ -814,10 +864,15 @@ function streamApprovalConfig() {
         pendingGraceMs: numEnvBounded("STREAM_APPROVAL_PENDING_GRACE_MS", "30000", 0, 3_600_000),
         adhocGraceMs: numEnvBounded("STREAM_APPROVAL_ADHOC_GRACE_MS", "60000", 0, 86_400_000),
         orphanTtlMs: numEnvBounded("STREAM_APPROVAL_ORPHAN_TTL_MS", String(7 * 24 * 60 * 60 * 1000), 60_000, 90 * 24 * 60 * 60 * 1000),
+        unreachedTtlMs: numEnvBounded("UNREACHED_ASK_TTL_MS", String(60 * 60 * 1000), 60_000, 24 * 60 * 60 * 1000),
     };
     if (cfg.windowMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
         throw new Error(`env STREAM_ASK_WINDOW_MS=${cfg.windowMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — the adhoc arm fires at (createdAt + window + grace) while the orphan backstop fires at (createdAt + ttl); if the backstop wins, every adhoc-leg row is attributed "orphan_ttl_exceeded" instead of "adhoc_leg_no_durable_domain" (attribution honesty, design/172 §6.1)`);
     }
+    const suspendedRowsPossible = cfg.enabled && gates.toolApprovalEnabled && gates.unattendedPolicy !== "deny";
+    if (suspendedRowsPossible && cfg.unreachedTtlMs + cfg.adhocGraceMs >= cfg.orphanTtlMs) {
+        throw new Error(`env UNREACHED_ASK_TTL_MS=${cfg.unreachedTtlMs} + STREAM_APPROVAL_ADHOC_GRACE_MS=${cfg.adhocGraceMs} must be STRICTLY LESS than STREAM_APPROVAL_ORPHAN_TTL_MS=${cfg.orphanTtlMs} — an ask minted with NO live stream (case A: a workflow child ask) waits UNREACHED_ASK_TTL_MS, so its row expires at (createdAt + that window); the orphan backstop fires at (createdAt + ttl). If the backstop wins, every suspended row is attributed "orphan_ttl_exceeded" instead of its real cause (attribution honesty, same rule as the STREAM_ASK_WINDOW_MS line above)`);
+    }
     if (!Number.isInteger(cfg.reconcileBatch)) {
         throw new Error(`env STREAM_APPROVAL_RECONCILE_BATCH=${cfg.reconcileBatch} must be an INTEGER row count`);
     }
@@ -836,6 +891,8 @@ function unattendedApprovalPolicyEnv() {
 }
 function parseApprovalDomain(ctx) {
     const { postureOn } = ctx;
+    const unattendedPolicy = unattendedApprovalPolicyEnv();
+    const toolApprovalEnabled = postureOn("TOOL_APPROVAL_ENABLED");
     const directApprovalDoor = boolEnv("DIRECT_APPROVAL_DOOR", false);
     const dgHmacKeys = parseApprovalHmacKeys(process.env.APPROVAL_HMAC_KEYS, announceKeySetRejection("APPROVAL_HMAC_KEYS"));
     const durableApproval = boolEnv("DURABLE_APPROVAL", false);
@@ -903,12 +960,12 @@ function parseApprovalDomain(ctx) {
             maxTotalPerRun: numEnvBounded("QUESTION_MAX_TOTAL_PER_RUN", String(DEFAULT_QUESTION_THROTTLE.maxTotalPerRun), 1, 10_000),
             ttlMs: numEnvBounded("QUESTION_TTL_MS", String(DEFAULT_QUESTION_THROTTLE.ttlMs), 1_000, 3_600_000),
         },
-        toolApprovalEnabled: postureOn("TOOL_APPROVAL_ENABLED"),
+        toolApprovalEnabled,
         permissionRulesEnabled: boolEnv("PERMISSION_RULES_ENABLED", true),
         permissionRulesEnabledExplicit: parseBoolWord("PERMISSION_RULES_ENABLED", process.env["PERMISSION_RULES_ENABLED"]) !== undefined,
         streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
-        streamApproval: streamApprovalConfig(),
-        unattendedApprovalPolicy: unattendedApprovalPolicyEnv(),
+        streamApproval: streamApprovalConfig({ unattendedPolicy, toolApprovalEnabled }),
+        unattendedApprovalPolicy: unattendedPolicy,
         approvalTimeoutSec: numEnv("APPROVAL_TIMEOUT_SEC", "0"),
     };
 }
@@ -939,6 +996,20 @@ function parseMemoryPersistenceCapable(raw) {
         `\`# Memory\` write instruction on a remote execution lane) or ${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (it CANNOT — ` +
         `forces the read-only disclosure). Leave it UNSET to let the engine infer from the mounted roster.`);
 }
+function parseRunStoreStrictHydrate(raw) {
+    const w = (raw ?? "").trim().toLowerCase();
+    if (w === "")
+        return false;
+    if (MEMORY_ENGINE_ON_WORDS.includes(w))
+        return true;
+    if (MEMORY_ENGINE_OFF_WORDS.includes(w))
+        return false;
+    throw new Error(`env RUN_STORE_STRICT_HYDRATE="${raw}" is not a known on/off word — use one of: ${MEMORY_ENGINE_ON_WORDS.join(" | ")} ` +
+        "(the file run-store REFUSES TO BOOT when it cannot list its runs/ directory) or " +
+        `${MEMORY_ENGINE_OFF_WORDS.join(" | ")} (the default: boot anyway with an empty ledger, disclosed by the ` +
+        "file_run_store_hydrate_unreadable error line + the server.run-store.file-hydrate-unreadable counter). " +
+        "An unrecognized value must not fold to the default: that would silently swallow an operator's explicit fail-closed request.");
+}
 const SANDBOX_PKG_SOURCES = ["global", "cn", "custom", "none"];
 function pkgSourceEnv() {
     const v = env("SANDBOX_PKG_SOURCE", "global");
@@ -1144,6 +1215,9 @@ function parseMemoryDomain(ctx) {
         ...(process.env.MEMORY_PROVENANCE !== undefined
             ? { memoryProvenance: enumEnv("MEMORY_PROVENANCE", "carry", ["off", "carry"]) }
             : {}),
+        ...(process.env.MEMORY_CAPTURE_POLICY !== undefined
+            ? { memoryCapturePolicy: enumEnv("MEMORY_CAPTURE_POLICY", "open", ["open", "governed", "capture-required"]) }
+            : {}),
         memoryConsolidationDriver: parseMemoryConsolidationDriver(),
         ...(process.env.DELEGATION_MAX_CONCURRENT !== undefined || process.env.DELEGATION_MAX_PER_SESSION !== undefined
             ? {
@@ -1400,6 +1474,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { reconnectGraceMs: n } : {}))(optNumEnvStrict("DEVICE_RECONNECT_GRACE_MS")),
                                                                 ...((n) => (n !== undefined ? { execTimeoutMs: n } : {}))(optNumEnvStrict("DEVICE_EXEC_TIMEOUT_MS")),
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(optNumEnvStrict("DEVICE_MAX_INFLIGHT_PER_DEVICE")),
+                                                                ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
                                                             :
@@ -1669,8 +1744,9 @@ function parseA2aServeSkills(raw) {
     });
 }
 const STORE_GROUP_KEYS = [
-    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "rewindSnapshotMaxMb", "dbBackend", "dbBackendExplicit", "localDataRoot",
-    "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "sendUserFile",
+    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "dbBackend", "dbBackendExplicit", "localDataRoot",
+    "runStoreStrictHydrate",
+    "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "fileHistory", "sendUserFile",
 ];
 const MODEL_PLANE_GROUP_KEYS = [
     "gatewayBaseUrl", "gatewayApiKey", "gatewayFallbackUrls", "gatewayMaxRetries", "anthropic", "resilience", "model", "models",
@@ -1684,7 +1760,7 @@ const APPROVAL_GROUP_KEYS = [
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",
-    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
+    "memoryPersistenceCapable", "memorySync", "memoryEmbedder", "memoryOrgAdmissionMode", "memoryDelegationEvidence", "memoryProvenance", "memoryCapturePolicy", "memoryConsolidationDriver", "memoryOrgDirectoryJson", "memoryOrgGrantTtlMs", "memoryOrgUnavailableBackoffMs",
     "projectMemoryEnabled", "syncImportLeaseStaleSec",
 ];
 const AUTH_GROUP_KEYS = [
@@ -1792,7 +1868,7 @@ export function loadConfig() {
         if (dgOperators.length === 0)
             missing.push("OPERATOR_PRINCIPALS (else isOperator is true-for-all)");
         if (!requirePrincipal)
-            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the spoofable header governs owner/quota checks)");
+            missing.push("REQUIRE_PRINCIPAL=true (a direct door is multi-tenant; without it an absent principal is anonymous and the self-asserted header governs owner/quota checks)");
         if (missing.length) {
             throw new Error(`DIRECT_APPROVAL_DOOR=true but D-G anchors are missing: ${missing.join(", ")} — refusing to start a half-open direct door (design/80 D-G boot invariant)`);
         }

package/dist/deployment-governance.d.ts

@@ -57,7 +57,7 @@ export interface DurableApprovalSeat {
  */
 export declare function createDurableQuestionGate(live: LiveQuestionFace | undefined): ToolPolicy;
 /**
- * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 对抗复审 round1 finding 1,红先复现)。
+ * 沙箱 lane 上**相对形**写目标的守卫补层用 env(codex 交叉复审 round1 finding 1,红先复现)。
  *
  * 缺口:沙箱 lane 的守卫策略拿不到 `rootPath`(沙箱 cwd 不是 server 能猜的,#165 裁定 1),而
  * `DeferredSandboxPathEnv.absolutePath` 对相对形一律报错。core 的 `canonicalizeTarget` 在

package/dist/device-enrollment.d.ts

@@ -52,7 +52,7 @@ export interface DeviceEnrollRateLimiter {
 export interface EnrollDeviceInput {
     /** 明文 token(**只**在这里出现,落库前立刻摘要)。 */
     token: string;
-    /** 请求方**验证过**的复合身份(SSO/凭据链产出,恒不取自可伪造头)。 */
+    /** 请求方**验证过**的复合身份(SSO/凭据链产出,恒不取自可自造头)。 */
     requester: DeviceOwner;
     /** 🔴 `deviceId` 与 `owner` **不在**这里:前者恒由 server 铸(调用方选 id = 让请求方挑自己的设备身份,
      *  与 §6「server 铸 dev_<ulid>」相悖),后者恒取自**验证过的** requester —— 两个字段都不接受请求体供给。
@@ -76,7 +76,7 @@ export interface AdmitSessionValue {
     /**
      * 判决**当刻**的连接世代(§4.6 fencing token)。
      *
-     * 🔴 **准入判决是一个快照,不是一把锁**(codex 对抗轮 F4,判真但归属下一车):`admitSession` 返回后、
+     * 🔴 **准入判决是一个快照,不是一把锁**(codex 交叉轮 F4,判真但归属下一车):`admitSession` 返回后、
      * 调用方真正下发指令前,一次 `revokeDevice` 可以提交 —— 它会作废租约并把 `conn_generation` 推进一格,
      * 但它**追不回**已经基于旧判决发出去的指令。这不是本层能关掉的窗(§6 注③ 刻意不落指令表,所以持久层
      * 没有「派发」这个写点可以带谓词);设计给的答案是**在下发边界重新断言世代**(§4.6 步 2/3:每一次带

package/dist/device-store.d.ts

@@ -146,7 +146,7 @@ export declare function assertIssueTokenShape(input: IssueEnrollTokenInput): voi
 export declare function assertRevokeShape(input: RevokeDeviceInput): void;
 export declare function assertAcquireShape(input: AcquireConnectionInput): void;
 /** token 摘要必须是**规范形**(小写 sha256 hex):大小写混形在 VARBINARY/COLLATE "C" 下是两个键,
- *  于是同一个明文 token 能被消费两次 —— 这是 §7-T5 ③「一次性 CAS」的直接绕过面。 */
+ *  于是同一个明文 token 能被消费两次 —— 这是 §7-T5 ③「一次性 CAS」的直接跳过面。 */
 export declare function assertEnrollTokenHashShape(tokenHash: string): void;
 /**
  * 闭集列的**读侧**解码 —— 三个 `parse*` 是这些词表的唯一解码点(SQL 店读回的字符串必须经此)。
@@ -154,7 +154,7 @@ export declare function assertEnrollTokenHashShape(tokenHash: string): void;
  * 🔴 认不出的值 = **抛**,不是静默 cast(#157:安全轴的未知词是 fail-loud 而不是 fail-open)。
  * 一行 `status='disabled'` 的设备如果被 `as DeviceStatus` 静默放行,准入链的 `status === "revoked"`
  * 判据就对它返回「不是吊销的」⇒ 一台被管理面停用的设备照常领活。写侧不可能产出这些值(入参是
- * TS 闭集),所以出现即「有人绕过本店直接写库」或「跨版本降级读新词」,两者都必须响亮。
+ * TS 闭集),所以出现即「有人跳过本店直接写库」或「跨版本降级读新词」,两者都必须响亮。
  */
 export declare function parseDeviceStatus(v: string): DeviceStatus;
 export declare function parseDevicePlatformOs(v: string): DevicePlatformOs;
@@ -189,7 +189,7 @@ export interface IssueEnrollTokenInput {
 }
 export interface ConsumeEnrollTokenInput {
     tokenHash: string;
-    /** 请求方**验证过**的复合身份(不取自可伪造头);与 token 的 target 逐字节比对。 */
+    /** 请求方**验证过**的复合身份(不取自可自造头);与 token 的 target 逐字节比对。 */
     requester: DeviceOwner;
     device: NewDeviceInput;
 }

package/dist/device-ws-hub.d.ts

@@ -151,8 +151,10 @@ export interface DeviceWsHubOptions {
     chunkBufferMaxBytes?: number;
     /** codex R1-F3:本副本**未鉴权**连接的并发帽(超额在 upgrade 阶段就 503 拒)。 */
     maxPreAuthConnections?: number;
-    /** codex R1-F3:单来源地址的未鉴权连接并发帽。 */
-    maxPreAuthConnectionsPerRemote?: number;
+    /** codex R1-F3:单来源地址的未鉴权连接并发帽。S-04(A-075.52):字面 `off` = 显式停用该层——
+     *  帽键是裸 remoteAddress,XFF 反代 / 公司 NAT 部署形把全员折叠成单键,这层从公平层退化成
+     *  「全员共享一份预算」;停层后全局帽(`maxPreAuthConnections`)照常兜底。 */
+    maxPreAuthConnectionsPerRemote?: number | "off";
 }
 export interface DeviceWsHub {
     /** 把 `GET /v1/device/ws` 的 upgrade 处理器挂到裸 `http.Server` 上。 */