@sema-agent/server 7.53.0 → 7.55.0

package/dist/config-center/types.d.ts

@@ -1,6 +1,6 @@
 /**
  * config-center wire types — the config-center `/api/config/effective` payload shapes (`CenterModel`,
- * `CenterTeam`, `CenterSkillManifest`, `CenterMcpServer`, `EffectiveConfig`) plus the per-principal
+ * `CenterSkillManifest`, `CenterMcpServer`, `CenterA2aPeer`, `EffectiveConfig`) plus the per-principal
  * execution/session-mirror ruling shapes riding the caps view (`ExecutionRuling`/`SessionMirrorRuling`).
  * Pure type/interface declarations — no runtime logic. Split out of `facade.ts` ([ref] A13,
  * internal-lossless: the facade re-exports every symbol below unchanged).
@@ -71,24 +71,6 @@ export type CenterRoleTarget = {
 } | {
     select: unknown;
 };
-export interface CenterTeam {
-    name: string;
-    members: {
-        role: string;
-        modelRole?: string;
-        model?: string;
-        systemPrompt?: string;
-    }[];
-    rounds: number;
-    synthesizer?: {
-        role: string;
-        modelRole?: string;
-        systemPrompt?: string;
-    };
-    scenario?: string;
-    maxTranscriptTokens?: number;
-    enabled?: boolean;
-}
 /** Skill MANIFEST entry (content is NOT inline — fetched by hash; see `fetchSkillContent`). */
 export interface CenterSkillManifest {
     name: string;
@@ -250,14 +232,8 @@ export interface EffectiveConfig {
         tierGroups?: unknown;
         activeTierGroup?: string;
     };
-    /** OPTIONAL since registry-core 0.7 deleted the teams domain: a 0.7+ center /effective payload
-     *  has NO teams key (collab is its successor). Absent/empty ⇒ registerTeams resets to BUILTIN_TEAMS (the
-     *  permanent builtin base). */
-    teams?: {
-        teams: CenterTeam[];
-    };
-    /** registry-core 0.7 collab domain (teams' successor) — consumed by the slice-① read-only
-     *  projection (projectCollabToTeams → registerTeams). Both lanes carry it: the remote worker /effective view
+    /** registry-core 0.7 collab domain (teams' successor) — consumed by the slice-1.5 projection
+     *  (projectCollabToWorkflows → registerCollabWorkflows). Both lanes carry it: the remote worker /effective view
      *  ships collab, and local FileConfigStore reads config.d/collab.json (PORTABLE_DOMAINS includes collab). */
     collab?: {
         templates: CollabTemplateWire[];
@@ -285,22 +261,23 @@ export interface EffectiveConfig {
             enabled?: boolean;
         }>;
     };
-    /** Fleet governance/limit gates (phase-2, center SERVICE-INTEGRATION「Runtime 治理/限额闸」). All restart-to-apply,
-     *  non-secret, all center `.optional()` (center `f95438a`): absent = unmanaged → keep env; present (incl. an
-     *  explicit 0/[] = "publish OFF") = override. Consumption precedence is in `applyRuntimeGates`. */
+    /** `runtime` 域 = **限额残余五键**,与 settings-schema `RuntimeConfig` 的键集逐字相等([ref] 件3 对账门
+     *  test/settings-schema-consumption-gates.test.ts 读 dist `RuntimeConfig.shape` 钉集合等式)。全部 center
+     *  `.optional()`(center `f95438a`):缺席 = 不管 → 保 env;在场(含显式 0 = "publish OFF")= 覆盖。
+     *  [ref] 批1 起五键全是**热**键(属主 stage-limits,boot+refresh 双腿);`limits` 域是它们的继任发布位
+     *  (两处同现 ⇒ limits 赢,见 {@link EffectiveConfig.limits})。
+     *
+     *  🔴 治理三件(autonomy / commandPolicy / approvalRequire)**不在这里**([ref] 件3 退役键清除):它们自
+     *  settings-schema 0.6 起住 `governance` 域,0.7.1 撤了 runtime 位的双写镜像;此后 `RuntimeConfig` 是 strip
+     *  的 zod object,两条腿(远端 `readEffectiveWire` / 本地 FileConfigStore→`buildEffective`)都把旧位 strip
+     *  掉、由 `legacyGovernanceFromRuntime` 抬进 governance ⇒ 本仓在 runtime 位上读它们的每一行都是死码。
+     *  旧类型面上留着这三键,让 `runtime-gates` 重启片一直读着一个生产上恒缺席的位(审批闸收紧静默不生效)。 */
     runtime?: {
         rateLimitPerMin?: number;
-        approvalRequire?: string[];
         maxTaskCostUsd?: number;
         maxTaskTokens?: number;
         maxPrincipalCostUsd?: number;
         costQuotaWindowSec?: number;
-        /** Runtime governance second baton (center §10): autonomy mode + per-command rules. UNLIKE the 6 gates above,
-         *  these are per-request HOT (read live in resolveSpec, not baked into boot middleware) → applied on boot AND
-         *  refresh by `applyRuntimeHot` (NOT in RUNTIME_GATE_KEYS / restart-to-apply). Same presence rule (undefined =
-         *  unmanaged → keep). */
-        autonomy?: Autonomy;
-        commandPolicy?: CommandRule[];
     };
     /**
      * [ref] 批1 —— **limitsHttp 组的热更新发布域**([ref] §6 批1)。
@@ -330,9 +307,11 @@ export interface EffectiveConfig {
     projects?: {
         projects?: Record<string, unknown>;
     };
-    /** registry-core 0.6:治理三件(autonomy/commandPolicy/approvalRequire)拆新 governance 域=真值;
-     *  过渡期 effective 在 runtime 位双写镜像。读取优先 governance 新位、runtime 旧位 fallback(顺序契约:
-     *  消费端先切换、确认后 center 才撤双写,治理闸零 fail-open 窗口)。 */
+    /** settings-schema 0.6 起治理三件(autonomy/commandPolicy/approvalRequire)的**唯一**承运域(0.7.1 撤
+     *  runtime 位双写镜像;顺序契约当年已走完:消费端先切、center 再撤)。键集与 schema `GovernanceConfig.shape`
+     *  逐字相等([ref] 件3 对账门钉)。消费:autonomy/commandPolicy 逐请求热(`stageRuntimeHot`,boot+refresh);
+     *  approvalRequire boot-baked(`stageApprovalGate`,refresh 不写)⇒ 变更由 `runtime-gates` 重启片通告。
+     *  同一 presence 规则(undefined = 不管 → 保 env / 回基线)。 */
     governance?: {
         autonomy?: Autonomy;
         commandPolicy?: CommandRule[];

package/dist/config-lkg.js

@@ -47,7 +47,7 @@ export async function loadLkg(path, worker) {
     const eff = p.effective;
     if (typeof eff.version !== "number")
         return { reason: "bad effective.version" };
-    for (const [domain, arrayKey] of [["models", "models"], ["teams", "teams"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
+    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
@@ -59,6 +59,12 @@ export async function loadLkg(path, worker) {
                 return { reason: `bad effective.${domain}.${arrayKey}` };
         }
     }
+    {
+        const rt = eff.runtime;
+        if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
+            return { reason: "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance" };
+        }
+    }
     const promptsRaw = p.effective.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
         return { reason: "prompts face fails re-validation" };

package/dist/config-provider.js

@@ -126,8 +126,8 @@ export function mapToServiceEffective(eff, version) {
             ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
             ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
         },
-        teams: { teams: [] },
         ...(eff.collab?.templates?.length ? { collab: { templates: eff.collab.templates } } : {}),
+        ...(eff.plugins?.plugins?.length ? { plugins: { plugins: eff.plugins.plugins } } : {}),
         skills: {
             skills: (eff.skills.skills ?? []).map((s) => ({
                 name: s.name,

package/dist/device-enrollment.d.ts

@@ -23,13 +23,15 @@
  * 判定);②吊销同事务把连接租约作废并把 `conn_generation` 推进一格 ⇒ 在途连接的每一次带世代谓词的写
  * 都会影响 0 行,设备侧因此立刻失权(§4.6 步 2);③重新 enrollment = 新 deviceId,不复活旧行。
  */
-import { DEVICE_RATE_LIMIT_CODE, type DeviceErrorCode, type DeviceOwner, type DeviceRow, type DeviceSessionRow, type DeviceStore, type NewDeviceInput } from "./device-store.js";
+import { type DeviceOwner, type DeviceRejectCode, type DeviceRow, type DeviceSessionRow, type DeviceStore, type NewDeviceInput } from "./device-store.js";
 /** typed 拒绝 —— 端点层只负责把它翻成 HTTP(status 已在体内,不许调用方另算)。 */
 export interface DeviceRejection {
-    code: DeviceErrorCode | typeof DEVICE_RATE_LIMIT_CODE;
+    /** [ref]:含两个借用位(`limit.rate_exceeded` 429 / `draining` 503);enrollment 本文件只铸前者,
+     *  `draining` 的唯一铸造点在 device-ws-hub 的排空/停机两臂。 */
+    code: DeviceRejectCode;
     status: number;
     message: string;
-    /** 限流专用:`Retry-After` 的秒值(附录 A 的 429 族纪律)。 */
+    /** 限流/排空专用:`Retry-After` 的秒值(附录 A 的 429/503 族纪律)。 */
     retryAfterSec?: number;
 }
 export type DeviceOutcome<T> = {

package/dist/device-store.d.ts

@@ -28,6 +28,13 @@ export declare const DEVICE_ERROR_CODES: {
     readonly ENROLLMENT_INVALID: "device.enrollment_invalid";
     /** 反枚举 404:设备不存在 **与** 设备不是你的,逐字节同形。 */
     readonly NOT_FOUND: "not_found.device";
+    /** O4 换绑动词(2026-08-30 v2 稿 §2 步 3):前态 CAS 输 —— 体带当前 rev(`currentRev`,[ref]
+     *  currentPending 哲学,壳一跳重定位)。**唯一铸造点 = `POST /v1/devices/sessions/:rootSessionId/rebind`**
+     *  (管理面,`http/routes/devices.ts`);adapter/准入链结构上不产它。 */
+    readonly REBIND_REV_CONFLICT: "device.rebind_rev_conflict";
+    /** O4 换绑动词(v2 稿 §2 步 4):该根会话名下有非终态 run(durable 判据 = run store 的 session
+     *  claim;hub 内存在途计数**不作门**——跨副本不可见)—— 体带 `activeTaskId`。铸造点同上一条。 */
+    readonly REBIND_ACTIVE_RUN: "device.rebind_active_run";
 };
 /** {@link DEVICE_ERROR_CODES} 的值联合 —— 闭集(未知码 = 编译错误,[ref] 词表纪律)。 */
 export type DeviceErrorCode = (typeof DEVICE_ERROR_CODES)[keyof typeof DEVICE_ERROR_CODES];
@@ -39,16 +46,34 @@ export type DeviceErrorCode = (typeof DEVICE_ERROR_CODES)[keyof typeof DEVICE_ER
  * 同义码 = 消费端要认两套。`device.busy`(429)留给**在途指令数**上限,不是这里。
  */
 export declare const DEVICE_RATE_LIMIT_CODE: "limit.rate_exceeded";
+/**
+ * 排空/停机拒绝复用**既有**的通用码(`draining`,`docs/ASSISTANT-WIRE-CONTRACT.md` 附录 A 已收录,503)。
+ *
+ * 🔴 刻意不铸 `device.draining`([ref]/[ref]):§4.8 的 device 闭集**冻结**且无 draining 成员,而排空
+ * 语义面全部署早有属主词 —— HTTP 计费提交拒臂(`sendError(res, 503, "draining", …)`,SDK spec 逐字引用
+ * 的冻结字面)、drain 期新 upgrade 拒(503)、WS hello 拒帧 / bye 帧的 `draining` 分支键。为同一语义再铸
+ * `device.*` 同义码 = 消费端要认两套(上面 rate-limit 条的同一判据);且 `device.draining` 在 HTTP 层
+ * 零发送点,写进附录 A 即幽灵行(`error-code-catalog-live` 的「文档多码」臂当场红)。
+ * 与 `device.busy` 的分工自此可判:`device.busy`(429)= 在途满,稍后重试**同设备**;`draining`(503)=
+ * **本副本**在退,重试同副本不会好 —— 该去替换副本/等设备重连。
+ */
+export declare const DEVICE_DRAINING_CODE: "draining";
+/** device 拒绝面的码全集 = §4.8 闭集 + 两个借用位(限流 429 / 排空 503)。 */
+export type DeviceRejectCode = DeviceErrorCode | typeof DEVICE_RATE_LIMIT_CODE | typeof DEVICE_DRAINING_CODE;
 /** 拒绝码 → HTTP 状态。**穷举 map**(缺一个成员 = 编译错误),不是运行时 switch 的默认臂。 */
-export declare const DEVICE_ERROR_STATUS: Readonly<Record<DeviceErrorCode | typeof DEVICE_RATE_LIMIT_CODE, number>>;
+export declare const DEVICE_ERROR_STATUS: Readonly<Record<DeviceRejectCode, number>>;
 /**
  * `device_audit.event` 的闭集(v2 §6 DDL 的 CHECK 清单 + §4.8「标审计行者」,两处逐字对齐)。
  *
  * ⚠️ §4.8 的**遥测**清单比这张表长(`device_connected`/`device_disconnected`/`device_heartbeat_lost`/
  * `device_instruction_dispatched`/`device_outcome_unknown`)—— 那些是**计数器/日志**面,不落审计表。
- * 只有下面这 8 个是「安全轴事件,必须可追溯查询」。加成员 = 同时改这里 + 两侧 DDL 的 CHECK。
+ * 只有下面这 9 个是「安全轴事件,必须可追溯查询」。加成员 = 同时改这里 + 两侧 DDL 的 CHECK
+ * (`AUDIT_EVENT_CHECK` 由本数组生成,DDL 自动跟);**且**存量表的旧 CHECK 不会被
+ * `CREATE TABLE IF NOT EXISTS` 更新 —— 升级探针见 `device-store-sql.ts` 的
+ * `assertDeviceAuditRebindEventSchema`(能力探测:PG 强制 CHECK、TiDB 默认不执行,探的是**行为**
+ * 不是元数据 —— memory `capability-detection-not-impl-names` 同判)。
  */
-export declare const DEVICE_AUDIT_EVENTS: readonly ["device_enrolled", "device_revoked", "device_token_rotated", "device_enroll_token_reuse", "device_frame_unexpected", "device_identity_mismatch", "device_superseded", "device_attached_elsewhere"];
+export declare const DEVICE_AUDIT_EVENTS: readonly ["device_enrolled", "device_revoked", "device_token_rotated", "device_enroll_token_reuse", "device_frame_unexpected", "device_identity_mismatch", "device_superseded", "device_attached_elsewhere", "session_rebound"];
 export type DeviceAuditEvent = (typeof DEVICE_AUDIT_EVENTS)[number];
 /** v1 平台闭集(AR-R1-8)。win32 = follow-on(§10 车A-4 的 flavor 注)。 */
 export declare const DEVICE_PLATFORM_OS: readonly ["darwin", "linux"];
@@ -144,6 +169,10 @@ export declare function assertDevicePubkeyShape(pubkey: string): void;
 export declare function assertNewDeviceShape(input: NewDeviceInput): void;
 export declare function assertIssueTokenShape(input: IssueEnrollTokenInput): void;
 export declare function assertRevokeShape(input: RevokeDeviceInput): void;
+/** O4 换绑入参的整形门(三形共用)。`expectedRev` 收窄为非负整数:它要进 SQL 等值谓词,小数/负数/NaN
+ *  在两方言的 BIGINT 比对下不是「不匹配」而是各自的隐式转换歧义面 —— 在门口拒,方言分歧面消失。
+ *  ⚠️ HTTP 层对坏形先答 400(业务拒绝);这里的抛是**编程/装配错误**的兜底,不是 wire 分支。 */
+export declare function assertRebindShape(input: RebindSessionInput): void;
 export declare function assertAcquireShape(input: AcquireConnectionInput): void;
 /** token 摘要必须是**规范形**(小写 sha256 hex):大小写混形在 VARBINARY/COLLATE "C" 下是两个键,
  *  于是同一个明文 token 能被消费两次 —— 这是 §7-T5 ③「一次性 CAS」的直接跳过面。 */
@@ -259,6 +288,47 @@ export type BindSessionResult = {
 } | {
     outcome: "device_revoked";
 };
+/**
+ * O4 显式换绑(2026-08-30 v2 稿 §2)。`owner` = **绑定行的**复合身份(HTTP 层已裁决:属主同域或
+ * explicit operator;operator 代操作时传的也是行的 owner,不是操作员自己)——店内所有谓词恒带它,
+ * 判别位在店里就消失(反枚举,文件头注)。`expectedRev` = 壳从 S-4 读面拿到的前态(强制显式,
+ * 防两操作员并发换绑互踩)。
+ */
+export interface RebindSessionInput {
+    rootSessionId: string;
+    toDeviceId: string;
+    expectedRev: number;
+    owner: DeviceOwner;
+}
+/**
+ * O4 换绑的判别式结果(门序 = v2 稿 §2:目标设备在场 → 幂等短路 → 前态 CAS → 审计;活跃 run 门在
+ * **HTTP 层**、CAS 之前判 —— run store 是另一只店,CAS 语句不兼职)。
+ */
+export type RebindSessionResult = 
+/** CAS 赢家:`rev+1` + `bound_at` 刷新 + `session_rebound` 审计行**同一事务**提交。 */
+{
+    outcome: "rebound";
+    row: DeviceSessionRow;
+}
+/** 真幂等:`toDeviceId` ≡ 当前绑定 ∧ `expectedRev` ≡ 当前 rev ⇒ 回显不加 rev、不写审计。 */
+ | {
+    outcome: "idempotent";
+    row: DeviceSessionRow;
+}
+/** 前态输(rev 不符,含「toDeviceId 同但 rev 错」——前态错就是错)⇒ 携当前行供壳一跳重定位。 */
+ | {
+    outcome: "rev_conflict";
+    row: DeviceSessionRow;
+}
+/** 绑定行不在**或**不是该 owner 的 —— 反枚举同形(HTTP 层折 404 同串)。 */
+ | {
+    outcome: "binding_not_found";
+}
+/** 目标设备不在 / 不是该 owner 的 / **已吊销** —— v2 稿 §2 步 2:三臂同折 404(设备 id 也是
+ *  不可枚举面);吊销不单列 = 判别位在店里就消失,消费层想泄也泄不出来。 */
+ | {
+    outcome: "device_not_found";
+};
 export interface RevokeDeviceInput {
     deviceId: string;
     owner: DeviceOwner;
@@ -330,12 +400,18 @@ export interface DeviceStore {
     /** 管理面/测试用的无 owner 谓词读口 —— **不得**接到任何 principal-scoped 的 wire 面上。 */
     getDeviceUnscoped(deviceId: string): Promise<DeviceRow | null>;
     listDevicesByOwner(owner: DeviceOwner): Promise<DeviceRow[]>;
+    /** O4/S-4:全量列表(operator 面专用;`getDeviceUnscoped` 同一条纪律 —— 不得接到任何
+     *  principal-scoped 的 wire 面上,消费点必须先过 explicit operator 门)。 */
+    listDevicesUnscoped(): Promise<DeviceRow[]>;
     revokeDevice(input: RevokeDeviceInput): Promise<RevokeDeviceResult>;
     acquireConnection(input: AcquireConnectionInput): Promise<AcquireConnectionResult>;
     /** 世代谓词命中 = true;0 行 = 已失权。 */
     heartbeatConnection(input: HeartbeatConnectionInput): Promise<boolean>;
     releaseConnection(deviceId: string, generation: number): Promise<boolean>;
     bindSession(input: BindSessionInput): Promise<BindSessionResult>;
+    /** O4 显式换绑(v2 稿 §2 步 2/3/5):目标设备门 + 前态 CAS + `session_rebound` 审计行同一事务。
+     *  活跃 run 门**不在这里**(run store 是另一只店)—— 由 HTTP 层在调用前判(v2 稿 §2 步 4)。 */
+    rebindSession(input: RebindSessionInput): Promise<RebindSessionResult>;
     getSessionBinding(rootSessionId: string): Promise<DeviceSessionRow | null>;
     /** purge coordinator 座(§6 注②:core 的会话删除是**逐 store 显式调用**,不是 DB 自动扫;
      *  只建表不接 purge = 删会话后绑定残留 ⇒ sessionId 重用致旧设备粘连/claim conflict/隐私残留)。 */
@@ -366,11 +442,13 @@ export declare class InMemoryDeviceStore implements DeviceStore {
     readDeviceForAdmission(deviceId: string, owner: DeviceOwner): Promise<DeviceAdmissionView | null>;
     getDeviceUnscoped(deviceId: string): Promise<DeviceRow | null>;
     listDevicesByOwner(owner: DeviceOwner): Promise<DeviceRow[]>;
+    listDevicesUnscoped(): Promise<DeviceRow[]>;
     revokeDevice(input: RevokeDeviceInput): Promise<RevokeDeviceResult>;
     acquireConnection(input: AcquireConnectionInput): Promise<AcquireConnectionResult>;
     heartbeatConnection(input: HeartbeatConnectionInput): Promise<boolean>;
     releaseConnection(deviceId: string, generation: number): Promise<boolean>;
     bindSession(input: BindSessionInput): Promise<BindSessionResult>;
+    rebindSession(input: RebindSessionInput): Promise<RebindSessionResult>;
     getSessionBinding(rootSessionId: string): Promise<DeviceSessionRow | null>;
     deleteByRootSession(rootSessionId: string): Promise<number>;
     appendAudit(input: AppendAuditInput): Promise<void>;

package/dist/device-store.js

@@ -10,8 +10,11 @@ export const DEVICE_ERROR_CODES = {
     BUSY: "device.busy",
     ENROLLMENT_INVALID: "device.enrollment_invalid",
     NOT_FOUND: "not_found.device",
+    REBIND_REV_CONFLICT: "device.rebind_rev_conflict",
+    REBIND_ACTIVE_RUN: "device.rebind_active_run",
 };
 export const DEVICE_RATE_LIMIT_CODE = "limit.rate_exceeded";
+export const DEVICE_DRAINING_CODE = "draining";
 export const DEVICE_ERROR_STATUS = {
     "device.not_bound": 409,
     "device.offline": 409,
@@ -23,7 +26,10 @@ export const DEVICE_ERROR_STATUS = {
     "device.busy": 429,
     "device.enrollment_invalid": 403,
     "not_found.device": 404,
+    "device.rebind_rev_conflict": 409,
+    "device.rebind_active_run": 409,
     "limit.rate_exceeded": 429,
+    "draining": 503,
 };
 export const DEVICE_AUDIT_EVENTS = [
     "device_enrolled",
@@ -34,6 +40,7 @@ export const DEVICE_AUDIT_EVENTS = [
     "device_identity_mismatch",
     "device_superseded",
     "device_attached_elsewhere",
+    "session_rebound",
 ];
 export const DEVICE_PLATFORM_OS = ["darwin", "linux"];
 export const DEVICE_STATUSES = ["active", "revoked"];
@@ -112,6 +119,14 @@ export function assertRevokeShape(input) {
     assertBoundedText("revokedBy", input.revokedBy, DEVICE_TEXT_LIMITS.actor);
     assertBoundedText("revokeReason", input.reason ?? "", DEVICE_TEXT_LIMITS.revokeReason);
 }
+export function assertRebindShape(input) {
+    assertRootSessionIdShape(input.rootSessionId);
+    assertDeviceIdShape(input.toDeviceId);
+    assertDeviceOwnerShape(input.owner);
+    if (!Number.isInteger(input.expectedRev) || input.expectedRev < 0) {
+        throw new Error(`device-store: expectedRev must be a non-negative integer (got ${input.expectedRev}) — it enters a byte-exact BIGINT equality predicate`);
+    }
+}
 export function assertAcquireShape(input) {
     assertDeviceIdShape(input.deviceId);
     assertDeviceOwnerShape(input.owner);
@@ -282,6 +297,9 @@ export class InMemoryDeviceStore {
         assertDeviceOwnerShape(owner);
         return [...this.devices.values()].filter((d) => sameOwner(d.owner, owner)).sort((a, b) => (a.deviceId < b.deviceId ? -1 : 1)).map((d) => this.snapshotDevice(d));
     }
+    async listDevicesUnscoped() {
+        return [...this.devices.values()].sort((a, b) => (a.deviceId < b.deviceId ? -1 : 1)).map((d) => this.snapshotDevice(d));
+    }
     async revokeDevice(input) {
         assertRevokeShape(input);
         const row = this.devices.get(input.deviceId);
@@ -363,6 +381,25 @@ export class InMemoryDeviceStore {
         this.sessions.set(row.rootSessionId, row);
         return { outcome: "bound", row: this.snapshotSession(row) };
     }
+    async rebindSession(input) {
+        assertRebindShape(input);
+        const device = this.devices.get(input.toDeviceId);
+        if (!device || !sameOwner(device.owner, input.owner) || device.status !== "active")
+            return { outcome: "device_not_found" };
+        const row = this.sessions.get(input.rootSessionId);
+        if (!row || !sameOwner(row.owner, input.owner))
+            return { outcome: "binding_not_found" };
+        if (row.deviceId === input.toDeviceId && row.rev === input.expectedRev)
+            return { outcome: "idempotent", row: this.snapshotSession(row) };
+        if (row.rev !== input.expectedRev)
+            return { outcome: "rev_conflict", row: this.snapshotSession(row) };
+        const from = row.deviceId;
+        row.deviceId = input.toDeviceId;
+        row.boundAtMs = this.now();
+        row.rev += 1;
+        this.pushAudit({ event: "session_rebound", deviceId: input.toDeviceId, owner: row.owner, detail: { from, to: input.toDeviceId, rev: row.rev } });
+        return { outcome: "rebound", row: this.snapshotSession(row) };
+    }
     async getSessionBinding(rootSessionId) {
         assertRootSessionIdShape(rootSessionId);
         const row = this.sessions.get(rootSessionId);

package/dist/device-ws-hub.d.ts

@@ -56,6 +56,14 @@ export type DeviceDispatchInput = {
     [K in DeviceInstructionKind]: {
         rootSessionId: string;
         requester: DeviceOwner;
+        /**
+         * O4 §3 投递门**身份重断言**(codex 轮2 R2-[high],红先 R4b 实证):调用方 env **铸造时**钉住的
+         * 设备。准入在 dispatch 内解出的是**当前**绑定 —— 显式换绑与在飞 turn 竞态时两者可以不同,而
+         * adapter 的 connect 身份检查罩不住已连接 env 的后续调用(它们不再过 connect)。差异 ⇒ 恒拒
+         * `device.identity_mismatch`(cwd/能力面是从铸造设备读的,静默改道 = 在错误机器的工作区上执行)。
+         * **必填**:可选会让漏传静默([ref] `originTaskId` 同判)。
+         */
+        expectedDeviceId: string;
         kind: K;
         args: DeviceInstructionArgsByKind[K];
         cwd?: string;
@@ -162,8 +170,13 @@ export interface DeviceWsHub {
     dispatch(input: DeviceDispatchInput): Promise<DeviceDispatchResult>;
     /** 幂等:重复 cancel 同一指令 = no-op(§5.3)。 */
     cancel(instructionId: string): Promise<void>;
-    /** §8-R7:停发新指令 + 拒新 upgrade,但**保持既有 WS**,在途结果帧照收。 */
-    beginDrain(): void;
+    /** §8-R7:停发新指令 + 拒新 upgrade,但**保持既有 WS**,在途结果帧照收。
+     *  [ref]:装配层可带 `graceMs`(= shutdown 的 drainGraceMs 上界)——排空拒体借它给出「drain 窗最迟
+     *  何时收窗」的指路;getter 形每次活读(drainGraceMs 是热改键,一次性快照会在窗中热调后失真,
+     *  codex-S09-F2);不带 = 拒体不造数(测试宿主/嵌入形没有这个事实)。 */
+    beginDrain(opts?: {
+        graceMs?: number | (() => number);
+    }): void;
     isDraining(): boolean;
     connectedDeviceIds(): string[];
     /**

package/dist/device-ws-hub.js

@@ -1,10 +1,11 @@
 import http from "node:http";
 import { createHash } from "node:crypto";
 import { WebSocketServer } from "ws";
-import { DEVICE_ERROR_CODES, DEVICE_ERROR_STATUS, assertDeviceIdShape, } from "./device-store.js";
+import { DEVICE_DRAINING_CODE, DEVICE_ERROR_CODES, DEVICE_ERROR_STATUS, assertDeviceIdShape, } from "./device-store.js";
 import { DEVICE_MIN_PROTOCOL_VERSION, DEVICE_WS_LIMITS, DEVICE_WS_PATH, DEVICE_PROTOCOL_VERSION, asInstructionKind, buildHelloSignaturePayload, formatGeneration, mintChallengeNonce, mintInstructionId, parseDeviceFrameText, verifyHelloSignature, } from "./device-ws-protocol.js";
 const OUTCOME_UNKNOWN_SENTENCE = "outcome unknown — the command may have already executed on the device; verify its effect before re-running";
 const SETTLED_MEMO_MAX = 512;
+const DRAIN_RETRY_AFTER_SEC = 15;
 function rejection(code, message, retryAfterSec) {
     return { code, status: DEVICE_ERROR_STATUS[code], message, ...(retryAfterSec === undefined ? {} : { retryAfterSec }) };
 }
@@ -73,6 +74,8 @@ export function createDeviceWsHub(options) {
     const settledMemo = new Map();
     let draining = false;
     let closed = false;
+    let drainGraceMs;
+    let drainStartMono;
     function auditFrame(deviceId, owner, reason, detail) {
         metrics?.inc("device_frame_unexpected_total", { reason });
         void store
@@ -775,6 +778,12 @@ export function createDeviceWsHub(options) {
         }
         sendServerFrame(conn, { t: "payload", gen: conn.genStr, instructionId, part: "commit", totalLen: body.length, sha256 });
     }
+    function drainingRejectResult() {
+        const graceNow = typeof drainGraceMs === "function" ? drainGraceMs() : drainGraceMs;
+        const remainMs = graceNow === undefined || drainStartMono === undefined ? undefined : Math.max(0, graceNow - (performance.now() - drainStartMono));
+        const drainHint = remainMs === undefined ? "" : `; the drain window ends within ~${Math.ceil(remainMs / 1000)}s`;
+        return { kind: "rejected", reject: rejection(DEVICE_DRAINING_CODE, "this replica is draining for shutdown/upgrade and no longer issues new device instructions — the instruction was never dispatched (safe to retry once the device reconnects on a replacement replica)" + drainHint, DRAIN_RETRY_AFTER_SEC) };
+    }
     async function dispatch(input) {
         if (input.payloadPartBytes !== undefined) {
             const n = input.payloadPartBytes;
@@ -793,15 +802,21 @@ export function createDeviceWsHub(options) {
         if (abortedNow())
             return abortedBeforeCommit();
         if (closed)
-            return { kind: "rejected", reject: rejection(DEVICE_ERROR_CODES.BUSY, "this device hub is shutting down", 1) };
+            return { kind: "rejected", reject: rejection(DEVICE_DRAINING_CODE, "this device hub is closed for shutdown — the instruction was never dispatched (safe to retry once the device reconnects on a replacement replica)", DRAIN_RETRY_AFTER_SEC) };
         if (draining)
-            return { kind: "rejected", reject: rejection(DEVICE_ERROR_CODES.BUSY, "this replica is draining for shutdown/upgrade and no longer issues new device instructions", 1) };
+            return drainingRejectResult();
         const admitted = await enrollment.admitSession({ rootSessionId: input.rootSessionId, requester: input.requester });
         if (!admitted.ok)
             return { kind: "rejected", reject: admitted.reject };
         if (abortedNow())
             return abortedBeforeCommit();
         const { deviceId, connGeneration } = admitted.value;
+        if (deviceId !== input.expectedDeviceId) {
+            return {
+                kind: "rejected",
+                reject: rejection(DEVICE_ERROR_CODES.IDENTITY_MISMATCH, `this session is now bound to a different device (${deviceId}) than the one this instruction's environment was minted for — refusing to silently re-target; re-initiate the work on the currently bound device (O4 v2 §3)`),
+            };
+        }
         const conn = conns.get(deviceId);
         if (!conn || conn.phase !== "active" || conn.goodbye) {
             return { kind: "rejected", reject: rejection(DEVICE_ERROR_CODES.OFFLINE, "the bound device has no dispatchable connection on this replica") };
@@ -820,12 +835,18 @@ export function createDeviceWsHub(options) {
         }
         const granted = await acquireSlot(deviceId);
         if (!granted) {
+            if (closed || draining)
+                return drainingRejectResult();
             return { kind: "rejected", reject: rejection(DEVICE_ERROR_CODES.BUSY, `the device already has ${maxInflightPerDevice} instructions in flight`, 1) };
         }
         if (abortedNow()) {
             releaseSlot(deviceId);
             return abortedBeforeCommit();
         }
+        if (closed) {
+            releaseSlot(deviceId);
+            return drainingRejectResult();
+        }
         {
             const drift = driftNow();
             if (drift.length > 0) {
@@ -975,9 +996,14 @@ export function createDeviceWsHub(options) {
         deliverCancel(p);
         return Promise.resolve();
     }
-    function beginDrain() {
+    function beginDrain(opts) {
+        if (!draining) {
+            drainStartMono = performance.now();
+            drainGraceMs = opts?.graceMs;
+        }
         draining = true;
-        logger?.info?.("device_hub_draining", { connections: conns.size, pending: pending.size });
+        const graceNow = typeof drainGraceMs === "function" ? drainGraceMs() : drainGraceMs;
+        logger?.info?.("device_hub_draining", { connections: conns.size, pending: pending.size, ...(graceNow === undefined ? {} : { graceMs: graceNow }) });
     }
     async function close() {
         closed = true;

package/dist/http/routes/approvals-assistant.js

@@ -108,6 +108,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
                 ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
+                ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
             });
             return;
         }

package/dist/http/routes/devices.d.ts

@@ -0,0 +1,64 @@
+/**
+ * O4 设备换绑 wire + S-4 additive 投影(DEBTS [ref];设计真源 = sema-internal
+ * `server/designs/2026-08-30-o4-device-rebind-wire-v2.md`,冻结稿)—— `/v1/devices/*` 管理面的
+ * **首批三动词**(capabilities.ts 那条「车C 的 `/v1/devices/*`」预留注所指的族,本文件开族):
+ *
+ *   · `GET  /v1/devices` —— 设备列表(owner 域过滤;explicit operator 全量)。行 =
+ *     `{ deviceId, name?, status: "online"|"offline", lastSeenAt? }`(v2 稿 §4 冻结形;`status` 由
+ *     **hub 在场性**判 —— v1 部署形 = 单副本(基线稿 §4.6),汇聚端的活连接集就是本副本的 presence
+ *     真源;`name` = displayName,空串诚实缺席;`lastSeenAt` ISO-8601)。**吊销行不列**:revoked 是
+ *     终态(重注册 = 新 deviceId),列出来只会被壳当换绑目标然后撞 404。
+ *   · `GET  /v1/devices/sessions/:rootSessionId` —— S-4 绑定读面(壳换绑 UX 的全部材料):
+ *     `{ rootSessionId, boundDevice: { deviceId, rev, boundAt } }`。稿 §4 允许「并入 session 读面」或
+ *     「独立读面」两形,选**独立读面**:sessions 的 GET 面承诺「无参请求字节不变」(routes/sessions.ts
+ *     的 additive contract 注),且 audit 投影由 boot/session-faces 组装、不持 device 店 —— 并入即跨
+ *     装配缝加一次店读;独立读面把 device wire 族收在一个文件里,户口与门序自洽。
+ *   · `POST /v1/devices/sessions/:rootSessionId/rebind` —— 显式换绑动词(v2 稿 §2 门序五步,逐字):
+ *     ① gatedPrincipal + owner 门(非属主 404 反枚举同串,[ref] 纪律)
+ *     ② 目标设备在场门(不存在 / 不是该域的 / 已吊销 ⇒ 404 **同串** —— 设备 id 也是不可枚举面)
+ *     ③ 无活跃 run 门(**CAS 前判、CAS 语句不兼职**;durable 判据 = run store 的 session claim
+ *        `getActiveTaskId`,hub 内存在途计数不作门 —— 内存态跨副本不可见;拒 = 409
+ *        `device.rebind_active_run` 体带 `activeTaskId`)
+ *     ④ 前态 CAS(店内单事务:`rev` 恒变列 + `session_rebound` 审计行;输 = 409
+ *        `device.rebind_rev_conflict` 体带 `currentRev` —— [ref] currentPending 哲学,壳一跳重定位)
+ *     ⑤ 赢 = 200 `{ rootSessionId, deviceId, rev, workspaceCarryover: "none" }`。
+ *     幂等形:toDeviceId ≡ 当前 ∧ expectedRev ≡ 当前 rev ⇒ 200 回显不加 rev(真幂等,不写审计)。
+ *     `workspaceCarryover: "none"` 是 **wire 冻结字面**(v2 稿 §5):换绑只改路由,不搬字节 —— 壳据
+ *     此渲「新设备上是全新工作区」的诚实披露;两个 200 形恒带。
+ *
+ * ── 调用方域(owner domain)的唯一铸造点 ─────────────────────────────────────────────────────────
+ * device lane 的三表自持 O11 复合身份 `{owner_tenant, owner_subject}`(device-store.ts 头注;全局
+ * principal 一个字节不动)。基线稿 §11-O11 的落法:「认证需在 SSO 校验点把 tenant+subject 传到 device
+ * placement 校验腿」——对位到本仓的真源即:subject = `gatedPrincipal`(verified 链),tenant =
+ * `ssoVerifiedScope`(registry-JWT 的 `scope` claim,security.ts:同为签名真源、非自报头)。两者齐备
+ * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
+ * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的
+ * 同向裁定是「缺 tenant/global scope 明确拒注册」。将来的 enrollment/管理端点(车C 余件)**必须**从
+ * 这同一个函数取域,不得手抄第二份派生。
+ *
+ * ── 反枚举 404 的单一铸造点 ──────────────────────────────────────────────────────────────────────
+ * 「绑定不在 / 不是你的 / 目标设备不在 / 不是该域的 / 已吊销」五臂共用 {@link sendDeviceNotFound} ——
+ * 判别位在一个函数里就消失,memory `anti-enum-404-ambiguity` 的教训(判别位留在上层 = 迟早有一个
+ * 调用点忘记归一)在结构上关掉。码/文案与 device-enrollment.ts 的 `rejectNotFound` 同串
+ * (`not_found.device` + "device not found")。
+ *
+ * ── 门与失败方向 ────────────────────────────────────────────────────────────────────────────────
+ * 活跃 run 门的 store 读**不吞错**(server.ts 有两处 `getActiveTaskId(...).catch(() => undefined)`,
+ * 那是观测面;这里是门 —— store 打不通就 500,绝不当「没有活跃 run」放行,[ref])。run store 缺席 =
+ * 501 `capability.run_store_required`(门无判据即拒,不是跳过)。
+ *
+ * billable = false 全族(纯管理/读面,零模型工作);刻意不吃 drain 503(读面与管理动作在排空期
+ * 照常有效 —— 换绑本身正是「设备要换了」的运维动作)。错误码登记:附录 A + error-code-catalog-live
+ * (send 点全部写**字面量** + `satisfies DeviceErrorCode` 钉闭集 —— 目录门扫的是字面量,闭集纪律由
+ * 编译器执行,两道门同时成立;device-store.ts「禁手抄」条的本义是禁**脱离闭集**的字面量)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx } from "../route-ctx.js";
+import { type DeviceOwner } from "../../device-store.js";
+/**
+ * 调用方 device 域的**唯一铸造点**(文件头注)。undefined = 判不出域(无 principal,或无 tenant
+ * claim)——消费点必须走 explicit operator 或响亮 403,禁静默空视图。
+ */
+export declare function deviceOwnerDomainOf(req: IncomingMessage, config: RouteCtx["deps"]["config"]): DeviceOwner | undefined;
+export declare function handleDevices(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=devices.d.ts.map