@sema-agent/server 7.56.0 → 7.58.0

package/dist/runtime-caps-resolver.d.ts

@@ -6,9 +6,35 @@
  * `EntitlementRuntimeCaps` themselves stay as-is below: they are core's / registry-core's own contract type
  * names, not ours to rename.)
  * It is the ENFORCE last-link of the three-stage workflows gate
- * (engine-can ∧ center-may ∧ shell-show): core calls it ONCE per task at prepare time with `spec.principal`,
- * and the engine enforces the two caps it CAN enforce — `allowWorkflows` (deny self-orchestration) and
- * `forceDurableGate` (force a policy `ask` onto the durable-approval wire).
+ * (engine-can ∧ center-may ∧ shell-show): core calls it with `spec.principal`.
+ *
+ * ⚠️ **调用次数不是「每任务一次」**（[ref]① 随 codex r1-[medium] 亲验后纠：旧句写「ONCE per task at
+ * prepare time」）：prepare 期解析一次（prepare-task.js:1826），**并且** capture-opt-out 的 flip 动词每被打一次
+ * 就再解析一次（prepare-memory.js:572 的 `flip` → :538 `resolveCaptureEntitlementFresh` → :542 本 resolver）。
+ * 所以本 resolver 必须是**可重入、可多次调用**的，缓存的 TTL 语义对 flip 腿同样生效；把它当「每任务一次的
+ * 快照」来实现（例如在里面攒 per-task 状态）会在 flip 腿上出错。
+ *
+ * ⚠️ [ref]① 纠失实：核心那句曾写作「引擎只执法它能执法的**两**个 cap」—— 早已不属实。core 7.2.0
+ * 装树 dist **亲读**的消费点是**六**个（本仓 node_modules 实测；下列坐标除注明外均在 `dist/core/runner/` 下，
+ * `agents/subagent.js` 那一条已就地标出 —— 说「均在 runner 下」是 r1 抓到的第二处过头话）：
+ *  · `allowWorkflows`  — prepare-task.js:1917 `runtimeCaps?.allowWorkflows !== false`（deny 自编排；:1918-1919 另发 onError）
+ *  · `allowFork`       — prepare-task.js:1867 `forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork)`（+:2418 拒由，agents/subagent.js:1575 拒词）
+ *  · `allowObservers`  — prepare-task.js:1868 `=== true`（**极性与 allow* 相反**：显式 opt-in，默认 OFF）
+ *  · `forceDurableGate`— prepare-task.js:1644/1646 的 durable/content mandate、:2337 活 content-ask 抑制、
+ *                        :2365 durable question face（该行合取 `resolveCheckpointStore(spec, deps) !== undefined`
+ *                        ⇒ **无 checkpoint 店的部署上这一面本就不成立**，该键在那里 inert）
+ *  · `autoMode`        — prepare-task.js:1869 `=== true` **∧** `deps.autoMode !== undefined`（部署需先具备分类器；
+ *                        显式 opt-in 极性，且 [ref] 起本侧传的是三态 org deny 位，见 toCoreRuntimeCaps 头注）
+ *  · `allowMemoryOptOut` — prepare-memory.js:542-543 `resolveCaptureEntitlementFresh`（+prepare-task.js:2474-2475
+ *                        的 value/faulted 投影）；**极性反转，但只在 `open` 姿态下**——判决全表在
+ *                        `dist/core/runner/memory-capture-optout.js` 的 `adjudicateCaptureOptOut`，按
+ *                        `RunnerDeps.memoryCapturePolicy` 三姿态分叉（codex r1-[medium] 亲验后纠：旧句无条件
+ *                        写「fault 读作 ALLOW」，只对其中一姿态成立）：
+ *                        · `"open"`（缺省）:1 只有显式 `false` 拒；**fault ⇒ ALLOW** + `faultDisclosure`（:32-37）
+ *                        · `"governed"`     :14-23 要**显式 `true`** 才准；`false` / 缺席 / fault **一律拒**
+ *                          （拒由分「answered false」与「verdict absent / resolver fault」两句）
+ *                        · `"capture-required"`:4-12 **完全不看本 verdict**（逐字「resolver-independent」），恒拒
+ * 只有 `allowUltracode` 是被 DROP 的那一个（下文）。
  *
  * It pulls the PER-PRINCIPAL entitlement from center's `GET /api/config/effective?principal=` (via
  * {@link fetchPrincipalCaps}). center has ALREADY pre-resolved the tighten-only intersection (fleet defaults ∩
@@ -17,10 +43,16 @@
  * a per-principal TTL+ETag CACHE (so per-task prepare-time lookups don't hammer center) and FAIL-CLOSED degrade.
  *
  * 🔐 FAIL-CLOSED (core security mandate, prepare-task.ts): an entitlement-resolver outage must NEVER silently
- * GRANT a capability center may have denied. On a hard fetch error we return `{ allowWorkflows: false }` (deny the
- * OPTIONAL workflows privilege) and do NOT force the durable gate (that could strand an autonomous run on an
- * absent operator — the same minimal degrade core applies when the resolver throws). We never serve a STALE
- * cached GRANT past its TTL on a fresh-fetch failure (a revoked cap must not linger because center blipped).
+ * GRANT a capability center may have denied. On a hard fetch error we mint `{ allowWorkflows: false, allowFork: false,
+ * autoMode: false }` — the three OPTIONAL **amplification** caps — and do NOT force the durable gate (that could
+ * strand an autonomous run on an absent operator). We never serve a STALE cached GRANT past its TTL on a
+ * fresh-fetch failure (a revoked cap must not linger because center blipped).
+ * ⚠️ [ref]① 纠失实：这段曾写作「降级为 `{ allowWorkflows: false }`」，与真码不符 —— 真铸点在本文件
+ * `load()` 的 catch 臂（搜 `Caps face FAIL CLOSED`），逐字是上行那三键：`allowFork` 自提货批就在，
+ * `autoMode` 由 [ref] / core [ref] 同车加入（org deny 位不能因一次抖动在 denyTtl 窗内抬起）。
+ * 🔒 **三键以外的那三键刻意不铸**：`forceDurableGate` 同上（强挂人在环会搞死无人值守的 run）；
+ * `allowObservers` 是 `=== true` opt-in，缺席已等于关；`allowMemoryOptOut` 是隐私轴的 FAULT-TRANSIT 契约
+ * （core types.d.ts 逐字禁止在 fault 上自造一个显式值）—— 铸 false 就是把故障臂默默换成判决臂。
  *
  * The resolver maps center's `EntitlementRuntimeCaps` → the SUBSET core enforces ({@link RuntimeCaps}): center
  * also carries `allowUltracode` (a shell/UX reasoning-tier cap the engine has no primitive for), which we DROP —
@@ -55,8 +87,11 @@ export interface EntitlementsResolverOpts {
     onError?: (err: Error, principal: string) => void;
 }
 /** Map center's `EntitlementRuntimeCaps` → the subset core's engine enforces. `allowUltracode` (shell/UX) is
- *  dropped on purpose (not a core primitive); `allowWorkflows` / `forceDurableGate` / `allowFork` are the three the
- *  engine enforces. Returns undefined when no enforceable cap is set (= no restriction). FAIL-CLOSED defense-in-depth:
+ *  dropped on purpose (not a core primitive); `allowWorkflows` / `forceDurableGate` / `allowFork` are **three of the
+ *  six** the engine reads — the other three (`allowObservers` / `autoMode` / `allowMemoryOptOut`) are documented
+ *  below and forwarded by the same body; the full consumption-point table with core 7.2.0 dist coordinates is in this
+ *  module's header ([ref]①: this line used to say 「the three」, i.e. claimed the set was closed at three).
+ *  Returns undefined when no enforceable cap is set (= no restriction). FAIL-CLOSED defense-in-depth:
  *  do NOT trust the wire to be boolean. center serializes these as zod-validated booleans, but a schema drift / proxy
  *  mangling that sent a TRUTHY non-boolean (e.g. the STRING "false") would slip past core's strict `=== false` deny
  *  check and silently GRANT. So a cap that is PRESENT but not a real boolean is a contract breach → THROW (the
@@ -70,11 +105,20 @@ export interface EntitlementsResolverOpts {
  *  说过话」的显式判决,污染 env-baseline 合成序,见 applyObserverEnvOptIn)。非 boolean 虽然骗不过 core
  *  的 `=== true`(不会误 GRANT),但 PRESENT-非-boolean 与 allow* 同属同一 body 的契约破损信号 → 同款 THROW。
  *
- *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`):auto-mode 分类器 per-principal
- *  开闸线,极性同 allowObservers(`=== true` 显式 opt-in,默认 OFF;真执行还要 deployment 装配
- *  `RunnerDeps.autoMode` 分类器面=信任门,center 键只是 entitlement 半场)。[ref]B-6a:registry-core
- *  0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps(types.d.ts:1786)——宽读逃逸期结束,现为类型直读
- *  (allowObservers 同款收编先例)。 */
+ *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`;**[ref] / core [ref] 起三态**,黑板 [ref]/[ref]):
+ *  `undefined`(center 缺席/未答)= 不阻;`true` = 不阻;`false` = **org deny**(CC `permissions.disableAutoMode`
+ *  镜像)。core 武装式 = `spec.autoModeRequested === true ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`
+ *  ——「用户开 + org 拒」极性(此前是 `=== true` 的「org 授予」极性,无 center 的本地部署零授予路径 ⇒ auto 永不
+ *  武装,真实用户诊断的病根)。
+ *  🔴 **上面那条武装式是 [ref] 的目标形,不是「本仓现在装的那版 core 的形」——引用它之前先看装的是哪版**
+ *  ([ref]① 随 codex r2-[high] 补:我方在 WIRE 附录 F 照抄这一句,写成了「7.2.0 的行为」,而 npm **7.2.0
+ *  不含 [ref]** —— 它的 `dist/core/runner/prepare-task.js:1869` 逐字仍是 `runtimeCaps?.autoMode === true &&
+ *  deps.autoMode !== undefined`,即旧「org 授予」极性、**缺键 ⇒ 不武装**)。判「现在是哪套极性」的唯一判据 =
+ *  安装包探针 `CORE_ARMS_AUTO_ON_INTENT`(`src/auto-mode-face.ts`;实测本树 7.2.0 ⇒ **false** = 旧式臂),
+ *  代码侧已按它分臂,失实的只是散落各处的散文。⚠️ 同形措辞在本文件 :209 / :362-364 / :548 与
+ *  `src/boot/runtime-caps.ts:182` 还各有一处(均 [ref] 既有文字,本批未逐条改 —— 登记在 handoff 未闭环项)。
+ *  所以**缺键=不写键**在这条轴上是行为承重的(在新式 core 上):补一个 false 就是替 org 说了一句
+ *  它没说的 deny;在旧式 core 上两者同为「不武装」,差别不显形。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /**
  * #A5([ref] 件2)—— 「这台 worker 上**存在** per-principal entitlement 源吗」的**单一谓词**。
@@ -87,8 +131,9 @@ export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | u
  * `permissionModeAuto.entitlementSource` 披露位。两处各写一份条件,就是本仓在册的
  * 「诊断页说亮、能力位说暗」病族的入口(装配与披露对同一件事各算各的)。
  *
- * ⚠️ **辖域**:说的是「源在不在」,不是「某个 principal 被授权了」。授权是 per-principal 的
- * (`RuntimeCaps.autoMode === true` 逐 principal 解),任何部署级布尔都对它说不了话。
+ * ⚠️ **辖域**:说的是「源在不在」,不是「某个 principal 被授权/被拒了」。org deny 位是 per-principal 的
+ * (`RuntimeCaps.autoMode` 三态逐 principal 解,[ref] 起「缺席=不阻」),任何部署级布尔都对它说不了话——
+ * 所以本谓词为 false **不再**意味着 auto 不武装;「会不会武装」由 `auto-mode-face.ts` 的三项合取答。
  */
 export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig, "configCenter">): boolean;
 /** A MISCONFIG diagnostic (review MEDIUM): a worker-scoped `wpt_<self>` pull token REQUIRES `?worker=<self>` to
@@ -99,8 +144,39 @@ export declare function centerEntitlementSourceWired(config: Pick<ServiceConfig,
 export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
 /** The two per-principal faces served off ONE caps fetch + cache. */
 export interface PrincipalEntitlementsClient {
-    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork). */
+    /** core's `RunnerDeps.runtimeCapsResolver` seam — FAIL-CLOSED on error (deny workflows/fork/autoMode;
+     *  [ref]① 随批纠：此处是同一句降级声明的第二个写者，漏了 [ref] 加的 `autoMode`。真铸点同上）。 */
     resolveRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
+    /**
+     * 🔴 [ref] —— **只读**腿:与 {@link PrincipalEntitlementsClient.resolveRuntimeCaps} **同一只**缓存/同一条抓取/同一份
+     * fail-closed 判决,唯一的差别是 center 硬失败时它铸的降级项**只对自己算数**,提交腿不认。
+     *
+     * 病灶(合并重扫 finding):`/v1/capabilities` 的 auto 自查读面用的是提交腿那只 resolver,于是**一次 GET**
+     * 在 center 抖动的瞬间就会替这个 principal 铸下一条 `{allowWorkflows:false, allowFork:false, autoMode:false}`
+     * 的短窗 deny —— 随后 `denyTtlMs` 窗内该 principal 的**真提交**被这条读面留下的项拒掉。读面是纯披露,不该有
+     * 写副作用,更不该是别人任务被拒的原因。
+     *
+     * 姿态选择(为什么不是「读面改答 resolver_fault」):判决**逐字不变** —— 读面回答的是「此刻提交会不会武装」,
+     * 而 center 持续故障时提交腿确实看到 fail-closed 的 deny,所以答 `org_denied` 是当下真值;本修只摘掉副作用,
+     * 不改词、不改极性(`onError` 审计行照打,故障照样有可观察面)。
+     *
+     * 🔴 **界画在「这句话是谁说的」**(codex r2 [high] 逐条核后的定界,不是「读面完全不碰缓存」):
+     *  · **成功项 = center 亲口答的那份** —— 与提交腿自己抓到的**逐字同一份**、同一条 `ttlMs`、同一个**已验证**
+     *    身份(读面的 principal 走 `gatedPrincipal` → `verifiedPrincipal`,与提交腿同源,读不到别人的格)。读面
+     *    只是把这个 principal 自己那一格**预热**了一下;org 撤销后的陈旧窗由部署级 `ttlMs` 定义,与哪一腿预热
+     *    的无关(提交腿自己预热同样如此),本批**零改动**。
+     *  · **降级项 = server 自铸的判决** —— center 从没说过这句 deny,是本层在故障时替它说的。让一次**读**铸的
+     *    这句话去拒掉别人的**提交**,才是本修要摘的那件事。两者的差别不是「值一不一样」,是「谁是作者」。
+     *
+     * ⚠️ 两条缓存纪律(缺一就换出另一个病):
+     *  · **成功抓取照旧落缓存**,且命中提交腿刚拉的那份即用 —— 读面不是缓存旁路;
+     *  · **硬失败的降级项照旧落缓存,但标出处**(`readMintedDeny`):只读腿自己认(否则 center 持续故障时每次
+     *    GET 一个 8s RTT,读面成了对着故障 center 的放大面),提交腿忽略它、照常重抓。
+     * in-flight 去重与提交腿共用(同 principal 的并发只一次往返);提交腿**亲历**了这次抓取(自起 or 搭在途)
+     * 而它硬失败 ⇒ 该降级项当场升格为执法项(codex r1 [medium]:否则一条总抢在提交前面的轮询会让每次提交
+     * 都重抓,denyTtl 的界对提交腿失效)。让它升格的是一次真提交自己吃到的硬失败,不是那次读。
+     */
+    peekRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
     /** The resolved per-principal scenario ruling for resolveSpec's gateScenarioRequest —
      *  FAIL-OPEN on error / older center without scenario keys / no principal (undefined = no governance, legacy passthrough).
      *  Scenario switching is not a privilege-amplifying face; a center blip must not pin users to `default`. */
@@ -170,6 +246,33 @@ export interface MemoryOptOutVerdictSource {
 export declare function applyMemoryOptOutGrant(base: EntitlementsResolverFn | undefined, source: MemoryOptOutVerdictSource | undefined, opts: {
     onFault: (err: Error, principal: string | undefined) => void;
 }): EntitlementsResolverFn | undefined;
+/**
+ * [ref] —— `governed` 姿态 + **center-only** verdict 源那一形的**运行期**披露(纯观测,零判决改写)。
+ *
+ * 为什么单独存在:`allowMemoryOptOut` 在 settings-schema 的 `EntitlementRuntimeCaps` 里是**可选键**
+ * (`z.ZodOptional<z.ZodBoolean>`),而 {@link toCoreRuntimeCaps} 对缺席**不铸键**(FAULT-TRANSIT:缺席
+ * 原样过境,绝不铸 false)。于是「配了一个非 dry-run 的 center」只证**源在场**,不证 center 会**为这个
+ * principal 发这个键** —— 一台 center 从不发该键的 governed worker 会正常起动,然后把每一个
+ * `memory.capture:"off"` 都以 `memory.capture_optout_denied`(verdict absent)拒掉,而运维只看见「opt-out 全拒」。
+ * 启动期那一行 warn 说的是「这一形有风险」;这一行说的是「它**真的**发生了」。
+ *
+ * 姿态:**每因由一次**(防每任务刷屏)、**不改判**(caps 逐字返回,极性仍由 core 按姿态判)、
+ * 只在 `enabled`(= governed ∧ 无本地 grant 店 ∧ center 源在场)时挂;否则返回 **同一引用**(零行为差)。
+ * 缺席判据取最终合成结果:`typeof caps?.allowMemoryOptOut !== "boolean"` —— center 没发键、center 拉取
+ * 降级(fail-closed entry 不含本键)都算,两者对 core 是同一件事(verdict absent ⇒ 拒跑)。
+ *
+ * 🔴 **因由是闭集两员,各占各的格**(codex r1-[medium] 验真后修):`createPrincipalEntitlementsClient` 的
+ * `resolveRuntimeCaps` 对 `principal === undefined` **直接返回 undefined、根本不问 center**(匿名/系统 run
+ * 没有 per-principal 身份),而 core 对**每一个**任务都调这只 resolver(不只是带 opt-out 声明的那些)。
+ * 单格去重会让**第一个匿名任务**烧掉那一格,日志却说「center 省了键」——归因错、且此后真正的具名缺键
+ * 永不留证。两员分格,且两句话说的是两件不同的事:匿名腿在 center-only 源上**结构性**永远拿不到 verdict
+ * (本地 grant 表的部署缺省行才答匿名),具名腿则是「center 这次没发这个可选键」。
+ */
+export type GovernedVerdictAbsenceReason = "anonymous_lane" | "center_verdict_absent";
+export declare function applyGovernedVerdictAbsenceWarning(base: EntitlementsResolverFn | undefined, opts: {
+    enabled: boolean;
+    warn: (reason: GovernedVerdictAbsenceReason, principal: string | undefined) => void;
+}): EntitlementsResolverFn | undefined;
 /**
  * observer 开闸线的 env 半场:`EXPERIMENTAL_OBSERVER_AGENTS=true` 时把
  * `RuntimeCaps.allowObservers: true` 作为**部署基线**合成进 caps resolver(core 1.270.0/1.273.0 的
@@ -193,4 +296,17 @@ export declare function applyObserverEnvOptIn(centerResolver: EntitlementsResolv
     requirePrincipal: boolean;
     warn?: (msg: string, fields?: Record<string, unknown>) => void;
 }): EntitlementsResolverFn | undefined;
+/**
+ * [ref] ③(黑板 [ref]/[ref],core [ref] 合修)—— `PERMISSIONS_DISABLE_AUTO_MODE` 的合成层:CC
+ * `permissions.disableAutoMode` 的本地镜像(ANCHOR-250 §6.4 的只可更严棘轮),**tighten-only**:
+ *  · deny=true ⇒ 每个 principal 的 `caps.autoMode` 折成 `false`(org deny 位)。center 授予 `true` **翻不回**——
+ *    本层写在最外(boot/runtime-caps.ts 合成序:center → observer env 基线 → memory grant → 本层),后写者赢,
+ *    且只往严处写;center 对该 principal 无答(undefined)同样折 false(deny 是部署级表态,不看 principal)。
+ *  · deny 未设 ⇒ 原 resolver **同一引用**透传(零行为差;无 center 的部署仍是 `undefined` ⇒ caps 缺席 ⇒
+ *    三态之「缺席=不阻」,这正是 auto 在本地部署能武装起来的路径)。
+ *  · 极性与 applyObserverEnvOptIn 相反:那条是「env 开」的放宽基线(center 带键则 center 赢),本条是
+ *    「env 拒」的收紧棘轮(center 带键也不能赢)。两条不共用一只函数正是因为方向相反。
+ *  🔴 没有 fail-open 臂:本层是纯合成,不做 I/O;base 抛错原样上抛(base 各层自带 fail-closed/缺席臂)。
+ */
+export declare function applyLocalAutoModeDeny(base: EntitlementsResolverFn | undefined, deny: boolean): EntitlementsResolverFn | undefined;
 //# sourceMappingURL=runtime-caps-resolver.d.ts.map

package/dist/runtime-caps-resolver.js

@@ -80,6 +80,7 @@ export function createPrincipalEntitlementsClient(opts) {
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
     const cache = new Map();
     const inflight = new Map();
+    const readMintedDeny = new WeakSet();
     const MAX_CACHE = 10_000;
     const putCache = (key, entry) => {
         if (cache.size >= MAX_CACHE) {
@@ -90,9 +91,15 @@ export function createPrincipalEntitlementsClient(opts) {
         }
         cache.set(key, entry);
     };
-    async function load(principal) {
+    async function load(principal, recordDeny = true) {
+        const entry = await loadRaw(principal, recordDeny);
+        if (recordDeny)
+            readMintedDeny.delete(entry);
+        return entry;
+    }
+    async function loadRaw(principal, recordDeny) {
         const cached = cache.get(principal);
-        if (cached && cached.expiresAt > now())
+        if (cached && cached.expiresAt > now() && !(recordDeny && readMintedDeny.has(cached)))
             return cached;
         const dup = inflight.get(principal);
         if (dup)
@@ -135,7 +142,9 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, expiresAt: now() + denyTtlMs };
+                if (!recordDeny)
+                    readMintedDeny.add(entry);
                 putCache(principal, entry);
                 try {
                     onError(e, principal);
@@ -152,6 +161,7 @@ export function createPrincipalEntitlementsClient(opts) {
     }
     return {
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
+        peekRuntimeCaps: async (principal) => (principal ? (await load(principal, false)).caps : undefined),
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
@@ -183,6 +193,27 @@ export function applyMemoryOptOutGrant(base, source, opts) {
         return { ...(caps ?? {}), allowMemoryOptOut: allow };
     };
 }
+export function applyGovernedVerdictAbsenceWarning(base, opts) {
+    if (!opts.enabled)
+        return base;
+    const warned = new Set();
+    return async (principal) => {
+        const caps = base !== undefined ? await base(principal) : undefined;
+        if (typeof caps?.allowMemoryOptOut !== "boolean") {
+            const reason = principal === undefined ? "anonymous_lane" : "center_verdict_absent";
+            if (!warned.has(reason)) {
+                warned.add(reason);
+                try {
+                    opts.warn(reason, principal);
+                }
+                catch (hookErr) {
+                    recordFailOpen("server.memory-optout-verdict-absence.warn-hook-threw", String(hookErr));
+                }
+            }
+        }
+        return caps;
+    };
+}
 export function applyObserverEnvOptIn(centerResolver, opts) {
     if (!opts.experimentalObserverAgents)
         return centerResolver;
@@ -196,4 +227,11 @@ export function applyObserverEnvOptIn(centerResolver, opts) {
         return () => ({ allowObservers: true });
     return async (principal) => ({ allowObservers: true, ...(await centerResolver(principal)) });
 }
+export function applyLocalAutoModeDeny(base, deny) {
+    if (!deny)
+        return base;
+    if (base === undefined)
+        return () => ({ autoMode: false });
+    return async (principal) => ({ ...(await base(principal)), autoMode: false });
+}
 //# sourceMappingURL=runtime-caps-resolver.js.map

package/dist/task-settings.d.ts

@@ -66,6 +66,9 @@ export type SettingsPermissionMode = "default" | "acceptEdits" | "plan" | "bypas
  * two-layer posture — bricking a resume over a value that was legal at submit time is worse than the quiet fold).
  */
 export declare function coercePermissionMode(raw: unknown): SettingsPermissionMode | undefined;
+/** 五模式闭集的**严格**读法([ref] ④:`/v1/capabilities?permissionMode=` 查询串用它 —— 读面对词表外的值 400,
+ *  不走上面那条给 resume 重放留的 `default` 宽臂)。上面的宽读只是本函数外再包一层折叠,词表单点在此。 */
+export declare function coercePermissionModeStrict(raw: unknown): SettingsPermissionMode | undefined;
 /** L2 ultracode ([ref]): the effective `thinking` level given the explicit `reasoningEffort` and the ultracode
  *  preset. ultracode FLOORS at the "ultra" tier — core's single source `resolveReasoningProfile("ultra").thinking`
  *  (= "max"), never a hardcoded literal — so an explicit higher tier still wins (none exists above max today;
@@ -129,6 +132,18 @@ export interface ParsedTaskSettings {
         /** Carried for completeness; v1 folds `ask` into the gate via the deny-wins base (see {@link applyTaskSettings}). */
         ask?: string[];
         defaultMode?: SettingsPermissionMode;
+        /** [ref] 件⑥([ref] §3.4,[ref];PM 裁 [ref]):CC settings 的 kill-switch `permissions.disableAutoMode`,cli 投影
+         *  (settingsRulesWire.ts toWireSettings)而此前本白名单丢弃 ⇒ 用户/managed 层关 auto 到不了引擎。语义 = 只能关
+         *  不能开(tighten-only):把生效模式 auto 折 default(座不写 ⇒ 不武装)。折叠单点 = {@link effectivePermissionMode}。
+         *  `disableBypassPermissionsMode` 本批不做落点([ref] 另立)。
+         *
+         *  🔴 **受理集 = `"disable" | true | false`**([ref] 放宽一档,原为「只认字面 `"disable"`」)。两套拼写**都是已发布
+         *  契约**:CC 250 的 `Ct` 严极词 `"disable"`,与 `@sema-agent/sdk` 8.1.0 `SettingsPermissions.disableAutoMode?: boolean`
+         *  (`dist/settings.d.ts`)。按已发布 SDK 类型写 `true`/`false` 的客户端此前一律 400 —— [ref] 的「只认 disable」是
+         *  「拒非法**拼错**」,boolean 不是拼错。归一化**不做**:三形逐字过 parse(拒体/日志里看得见调用方真发的是哪一形),
+         *  语义归一只在折叠单点做(`"disable"` ≡ `true`)。受理集之外(别的词/数字/对象)= fresh 提交 HTTP 门 400,
+         *  resume 重放宽臂丢弃(两层姿势同 defaultMode)。 */
+        disableAutoMode?: "disable" | boolean;
     };
     model?: string;
     outputStyle?: string;
@@ -164,12 +179,51 @@ export declare const MAX_SETTINGS_PERMISSION_RULES = 1000;
 export declare const MAX_SETTINGS_ENV_VARS = 256;
 export declare const MAX_SETTINGS_ENV_VALUE_CHARS = 32768;
 export declare const MAX_SETTINGS_ENV_KEY_CHARS = 256;
+/** 本 service 真正**消费**的 `settings` 顶层键 —— 闭集。每一个都有消费点:
+ *  `env`/`hooks`/`model`/`outputStyle`/`permissions`/`ultracode` 在 {@link parseTaskSettings};
+ *  `webSearch` 在 `capabilities/scenarios.ts`(`webSearchConfigFromSettings`,单用户闸)。
+ *  加键必须同时加消费点,否则就是往闭集里塞一个新的静默丢。 */
+export declare const TASK_SETTINGS_KEYS: readonly ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
+/** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
+export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+/** CC/SDK 合约里合法、本 service **不接线**的顶层键(出处 = `@sema-agent/sdk` `SemaSettings` 尾注逐字点名的
+ *  三个 deferred CC 键)。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响文案,不影响判决。 */
+export declare const TASK_SETTINGS_UNSUPPORTED_KEYS: readonly ["apiKeyHelper", "sandbox", "statusLine"];
+/** 同上,`settings.permissions` 子层(出处 = SDK `SettingsPermissions` 的三个声明键)。
+ *  `additionalDirectories` 有**同请求替代面**:顶层 `body.additionalDirectories`([ref],resolve-spec 真消费)。 */
+export declare const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS: readonly ["additionalDirectories", "disableBypassPermissionsMode"];
+/** 拒体里逐字回显的键名条数上限。键名原样回显(不猜语义),但**条数有界** —— 一个塞满键的体不许把 400 响应
+ *  放大成流量面。超出部分只报数。 */
+export declare const MAX_SETTINGS_KEY_ECHO = 20;
+/** {@link taskSettingsKeyIssue} 的拒体:一句 wire 文案 + 两张分类键名表(消费端可机读,不必解析文案)。 */
+export interface TaskSettingsKeyIssue {
+    message: string;
+    /** 词表外的键(拼错/未来键),`settings.x` / `settings.permissions.x` 全路径形,已清洗+截断+排序+封顶。 */
+    unknownKeys: string[];
+    /** CC/SDK 合约合法但本 service 不接线的键,同形。 */
+    unsupportedKeys: string[];
+}
+/**
+ * FRESH 提交面的 `settings` 键闭集裁决:顶层或 `permissions` 子层出现受理集之外的键 ⇒ 返回拒体(调用方 400
+ * `request.body_shape`);全部受理 ⇒ `null`。
+ *
+ * 判据边界(有意窄):
+ *  · 只判**键名**。值形校验(outputStyle 上限 / permissions 数组上限 / env 形 / hooks 契约 / defaultMode 闭集)
+ *    仍归各自既有门,本门零改动、零抢话。
+ *  · `settings` 本身非对象、或 `permissions` 非对象(数组/标量/null)⇒ 本门**不判**,留给既有的
+ *    「settings must be an object」/「settings.permissions must be an object」两道门,免得同一个体被两句话抢答。
+ *  · `permissions: null` 是既有钉住的「容器缺席」形,照旧不咬。
+ */
+export declare function taskSettingsKeyIssue(raw: unknown): TaskSettingsKeyIssue | null;
 /**
  * Validate an untrusted `body.settings` (raw `unknown` off the wire) into the service-trusted {@link
- * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked; unknown keys are ignored
- * (forward-compatible, matching the SDK's open `[k: string]: unknown`). `defaultMode` accepts the FIVE modes
- * (post-[ref]; unknown values coerce to `default` — see the header note). Returns the
+ * ParsedTaskSettings}. NEVER trusts the wire type — every field is shape-checked. `defaultMode` accepts the FIVE
+ * modes (post-[ref]; unknown values coerce to `default` — see the header note). Returns the
  * present-but-deferred field names so the caller can warn/advertise rather than silently dropping `env`/`hooks`.
+ *
+ * 🔴 未知键在**本层**照旧忽略,而那**不是** wire 的现行为([ref] 件①,PM 裁「拒」[ref]):本层是 RESUME
+ * 重放也走的宽容层,一个 4xx 在这里会把存量 parked 任务永久砖死;FRESH 提交面由 {@link taskSettingsKeyIssue}
+ * 在 `server.ts` prepareSpec 里 400 响亮拒 + 逐字列名。双层姿势与 outputStyle / permissionMode 两处逐字相同。
  */
 export declare function parseTaskSettings(raw: unknown): ParseTaskSettingsResult;
 /** Defensive acceptance of the `appendSystemPrompt` rider ([ref] R2 + codex F2): the HTTP 400 gate (prepareSpec,

package/dist/task-settings.js

@@ -3,12 +3,18 @@ import { findCcRuleFormNames, findUnmatchableToolNames, formatUnmatchableToolNam
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
 export function coercePermissionMode(raw) {
-    if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
-        return raw;
+    const strict = coercePermissionModeStrict(raw);
+    if (strict !== undefined)
+        return strict;
     if (typeof raw === "string" && raw.length > 0)
         return "default";
     return undefined;
 }
+export function coercePermissionModeStrict(raw) {
+    if (raw === "plan" || raw === "acceptEdits" || raw === "default" || raw === "bypassPermissions" || raw === "auto")
+        return raw;
+    return undefined;
+}
 export function effectiveThinking(reasoningEffort, ultracode) {
     const explicit = isThinkingLevel(reasoningEffort) ? reasoningEffort : undefined;
     if (!ultracode)
@@ -21,7 +27,11 @@ export function withPermissionMode(settings, mode) {
     return { ...base, permissions: { ...base.permissions, defaultMode: mode } };
 }
 export function effectivePermissionMode(body, settings) {
-    return coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
+    const requested = coercePermissionMode(body.permissionMode) ?? settings?.permissions?.defaultMode;
+    const kill = settings?.permissions?.disableAutoMode;
+    if (requested === "auto" && (kill === "disable" || kill === true))
+        return "default";
+    return requested;
 }
 export function shellGateForMode(effMode) {
     switch (effMode) {
@@ -62,6 +72,61 @@ function cleanStringArray(v) {
     const out = v.filter((x) => typeof x === "string" && x.length > 0).slice(0, MAX_SETTINGS_PERMISSION_RULES);
     return out.length > 0 ? out : undefined;
 }
+export const TASK_SETTINGS_KEYS = ["env", "hooks", "model", "outputStyle", "permissions", "ultracode", "webSearch"];
+export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode"];
+export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "sandbox", "statusLine"];
+export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];
+export const MAX_SETTINGS_KEY_ECHO = 20;
+const MAX_SETTINGS_KEY_ECHO_CHARS = 64;
+const ACCEPTED_TOP = new Set(TASK_SETTINGS_KEYS);
+const ACCEPTED_PERM = new Set(TASK_SETTINGS_PERMISSION_KEYS);
+const UNSUPPORTED_TOP = new Set(TASK_SETTINGS_UNSUPPORTED_KEYS);
+const UNSUPPORTED_PERM = new Set(TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS);
+function echoSettingsKey(prefix, key) {
+    const clean = key.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return `${prefix}${clean.length > MAX_SETTINGS_KEY_ECHO_CHARS ? `${clean.slice(0, MAX_SETTINGS_KEY_ECHO_CHARS)}…` : clean}`;
+}
+export function taskSettingsKeyIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const unknown = [];
+    const unsupported = [];
+    const scan = (bag, prefix, accepted, tolerated) => {
+        for (const k of Object.keys(bag)) {
+            if (accepted.has(k))
+                continue;
+            (tolerated.has(k) ? unsupported : unknown).push(echoSettingsKey(prefix, k));
+        }
+    };
+    scan(raw, "settings.", ACCEPTED_TOP, UNSUPPORTED_TOP);
+    const perms = raw.permissions;
+    if (perms !== null && typeof perms === "object" && !Array.isArray(perms)) {
+        scan(perms, "settings.permissions.", ACCEPTED_PERM, UNSUPPORTED_PERM);
+    }
+    if (unknown.length === 0 && unsupported.length === 0)
+        return null;
+    unknown.sort();
+    unsupported.sort();
+    const clause = (names, label) => {
+        const shown = names.slice(0, MAX_SETTINGS_KEY_ECHO);
+        const more = names.length - shown.length;
+        return `${label}: ${shown.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
+    };
+    const parts = [
+        ...(unknown.length > 0 ? [clause(unknown, "unknown (not a settings key here — check the spelling)")] : []),
+        ...(unsupported.length > 0 ? [clause(unsupported, "unsupported (a CC settings key this service does not wire)")] : []),
+    ];
+    const dirHint = unsupported.some((n) => n.endsWith(".additionalDirectories"))
+        ? " Extra directories ride the top-level body.additionalDirectories instead."
+        : "";
+    return {
+        message: `settings: unrecognized key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller. ` +
+            `${parts.join("; ")}.${dirHint} ` +
+            `Accepted: settings.{${[...TASK_SETTINGS_KEYS].join(",")}} and settings.permissions.{${[...TASK_SETTINGS_PERMISSION_KEYS].join(",")}}`,
+        unknownKeys: unknown.slice(0, MAX_SETTINGS_KEY_ECHO),
+        unsupportedKeys: unsupported.slice(0, MAX_SETTINGS_KEY_ECHO),
+    };
+}
 export function parseTaskSettings(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object")
         return { deferred: [] };
@@ -90,8 +155,16 @@ export function parseTaskSettings(raw) {
         const ask = cleanStringArray(p.ask);
         const mode = p.defaultMode;
         const defaultMode = mode === "default" || mode === "acceptEdits" || mode === "plan" || mode === "bypassPermissions" || mode === "auto" ? mode : undefined;
-        if (allow || deny || ask || defaultMode) {
-            out.permissions = { ...(allow ? { allow } : {}), ...(deny ? { deny } : {}), ...(ask ? { ask } : {}), ...(defaultMode ? { defaultMode } : {}) };
+        const rawKill = p.disableAutoMode;
+        const disableAutoMode = rawKill === "disable" || rawKill === true || rawKill === false ? rawKill : undefined;
+        if (allow || deny || ask || defaultMode || disableAutoMode !== undefined) {
+            out.permissions = {
+                ...(allow ? { allow } : {}),
+                ...(deny ? { deny } : {}),
+                ...(ask ? { ask } : {}),
+                ...(defaultMode ? { defaultMode } : {}),
+                ...(disableAutoMode !== undefined ? { disableAutoMode } : {}),
+            };
         }
     }
     if (typeof s.model === "string" && s.model.length > 0)

package/dist/task-workflow.d.ts

@@ -15,13 +15,43 @@
  *    source must NOT leak the LLM-authored workflow engine). WITH a resolver, core enforces `allowWorkflows`
  *    per-principal (deny → fail-closed). Single-user (owns its own worker) honors directly. Three-gate: engine-can ∧
  *    center-may(allowWorkflows) ∧ shell-show.
+ *
+ * 🔴 [ref](2026-09-03):fail-closed 的**方向**从来是对的,错的是它**没人说**。多租户 + 无 entitlement 源
+ * 的部署上,这条腿把 `body.selfOrchestration:true`(以及 `settings.ultracode` 展开出来的同一个意图)静默
+ * 折成 `undefined`,而 `/v1/capabilities` 照报 `workflows:true` ⇒ 「壳显示支持、引擎按普通 run 跑」。修法
+ * 是把部署级半场抽成下面的 {@link selfOrchestrationDenial}(能力位与准入**同一只**谓词),提交面在拒因
+ * 在场时**响亮**拒(`routes` 的 501 `capability.self_orchestration_required`),不再静默折。
  */
 export declare function selfOrchestrationFromBody(body: {
     selfOrchestration?: unknown;
-}, config: {
+}, config: SelfOrchestrationGateConfig, hasEntitlementResolver: boolean): true | undefined;
+/** 本模块读的部署面(`selfOrchestrationEnabled` 恒在真 config 上;遗留双重断言 stub 可能真缺,故一律 `!== true` 读)。 */
+export interface SelfOrchestrationGateConfig {
     selfOrchestrationEnabled: boolean;
     requirePrincipal?: boolean;
-}, hasEntitlementResolver: boolean): true | undefined;
+}
+/**
+ * [ref](DEBTS,P1)—— 自编排准入的**部署级拒因**闭集。`null` = 本部署这一层不拒(是否真跑还看 engine-can
+ * 与 core 的 per-principal `allowWorkflows`)。
+ *
+ * 唯一成员 `"entitlement_resolver_absent"`:多租户(`requirePrincipal === true`)+ 运维**显式开了**
+ * `SELF_ORCHESTRATION_ENABLED` + 没有任何 per-principal entitlement 源(`hasEntitlementResolver` —— 判据由
+ * 调用方从 `centerEntitlementSourceWired(config)` / 装配好的 caps 客户端取)。这一形下上面的准入腿对
+ * **每一个** principal 都 fail-closed(理由见函数上方注:core 的 `allowWorkflows` 是 tighten-only,
+ * resolver 缺席 = 无限制,所以本层必须自己关死),于是这台机器上的自编排是**结构性死的**。
+ *
+ * 🔴 为什么这不是布尔而是**闭集拒因**:能力面要能对壳说清「为什么暗」——「这份二进制/这台机器没有工作流
+ * 引擎」与「引擎在、但本部署配不出 per-principal 授权」是两件事,壳对它们要做的事不同(前者别给这一格;
+ * 后者该提示运维接 center)。合成一个布尔就把这两件事打成同一个 false —— 与 `permissionModeAuto` 那一位
+ * 「三项不合成一个布尔」同判据。
+ *
+ * 🔴 为什么 `selfOrchestrationEnabled` 关着时返回 `null` 而不是另一个拒因:那是**运维刻意的姿态**
+ * (多租户缺省就是关),能力面的 engine-can 半场自己就已经诚实为假;而本拒因说的是**半配置**
+ * (阀门开着而配不出来),两者的处置不同——后者才需要点名。这也正是本件的补偿旋钮:把
+ * `SELF_ORCHESTRATION_ENABLED` 关掉(对这台机器而言是唯一诚实的姿态)即刻回到姿态形。
+ */
+export type SelfOrchestrationDenial = "entitlement_resolver_absent";
+export declare function selfOrchestrationDenial(config: SelfOrchestrationGateConfig, hasEntitlementResolver: boolean): SelfOrchestrationDenial | null;
 /**
  * §4 (Fork) — map the per-task `body.enableFork` intent onto `TaskSpec.enableFork`. core 1.257 ([ref] BREAKING)
  * RETIRED the standalone `Fork` tool; a fork is now `Agent(subagent_type:"fork")`, and `enableFork` is one of the two

package/dist/task-workflow.js

@@ -1,9 +1,14 @@
 export function selfOrchestrationFromBody(body, config, hasEntitlementResolver) {
-    if (body.selfOrchestration !== true || !config.selfOrchestrationEnabled)
+    if (body.selfOrchestration !== true || config.selfOrchestrationEnabled !== true)
         return undefined;
+    return selfOrchestrationDenial(config, hasEntitlementResolver) === null ? true : undefined;
+}
+export function selfOrchestrationDenial(config, hasEntitlementResolver) {
+    if (config.selfOrchestrationEnabled !== true)
+        return null;
     if (config.requirePrincipal !== true)
-        return true;
-    return hasEntitlementResolver ? true : undefined;
+        return null;
+    return hasEntitlementResolver ? null : "entitlement_resolver_absent";
 }
 export function enableForkFromBody(body, config, hasEntitlementResolver) {
     if (!config.forkEnabled)

package/dist/tool-approval.d.ts

@@ -541,6 +541,10 @@ export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput
  * `prepare-task.js` 的 durableMandate/contentMandate(:1415/:1417)与 durableQuestionFace(:2136)等),
  * 故不在本函数内。
  *
+ * 🔴 **[ref](半接线旋钮族)**:`windowZero` 的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在
+ * `streamApprovalOn` 后面** —— 那是部署级旋钮,它的语义不该因为这台机器有没有 durable ask 账而改变
+ * (`ApprovalLegAssembly.windowZero` 顶注写了那条病)。第三源(贴 deadline)照旧只在协议上场时参与。
+ *
  * **`windowZero` 的两件事必须同时做**(调用方契约):不包 ALS **且**注入 immediate-unavailable 闭包。
  * 只做一件另一条路仍会呈卡。⚠️ [ref] 起**三腿都有** per-task `spec.onAsk` 装配点(sync=routes/tasks.ts,
  * bg=runs.ts,resume=server.ts driveResumeLeg),windowZero 的第二件在三腿都是显式闭包 —— 旧文「bg/
@@ -554,7 +558,14 @@ export interface ApprovalLegAssembly {
      *  同 (owner, session) 活流呈活卡(sync 腿 [ref] 起本就如此;bg/resume 的这条行为差 = [ref] CHANGELOG
      *  披露的行为面变更)。旧文「本腿逐字保持协议之前的行为」只对协议件成立,别再把它读成「协议关 = 零呈卡」。 */
     active: boolean;
-    /** §8.3 窗=0 恒 park。`active` 为假时恒 false(协议都没上场,谈不上关窗)。 */
+    /** §8.3 窗=0 恒 park。
+     *  🔴 **[ref] 起它与 `active` 解耦**(旧文「`active` 为假时恒 false —— 协议都没上场,谈不上关窗」已
+     *  作废):`STREAM_ASK_WINDOW_MS` 是**部署级**旋钮,`0` 的语义(运维显式关窗 ⇒ 恒走
+     *  {@link ToolApprovalCoordinator.unattendedAskOutcome},连卡都不发)在两条车道上必须是同一个意思。
+     *  旧形下 local 车道(`volatile_ask_ledger`)/ 无 park 设施 / 显式关协议的部署配了 `0`,拿到的是一张
+     *  等满 5min 的活卡 —— 与它自己的域注正好相反,且没有任何一行说出来。
+     *  ⚠️ 「窗**缺席**」(`windowMs: undefined` = 这份装配根本没有 streamApproval 段,只出现在 stub-harness)
+     *  **不是**关窗:那时逐字保持活卡腿。 */
     windowZero: boolean;
     /** §7.3 本 leg 的 walltime deadline(`performance.now()` 单调基)。只在 `active ∧ ¬windowZero ∧
      *  有 walltime 墙` 时在场 —— 关着时供值会把既有 5min 活卡窗按三元公式缩短(§7.2 真行为变更)。 */
@@ -583,8 +594,13 @@ export declare function createApprovalCardEmitter(sinks: {
 export declare function resolveApprovalLeg(input: {
     /** = `resolveStreamApprovalGate(...).active`(协议在本 worker 上场没有)。 */
     streamApprovalOn: boolean;
-    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。 */
-    windowMs: number;
+    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。
+     *  🔴 [ref]:`undefined` = **这份装配没有 `streamApproval` 段**(只出现在只填被测键的 stub-harness ——
+     *  真实 boot 无条件铸该段,见 `config.ts`)。此前三个调用点各写 `?? 0` 把这一形折成「0」,在旧语义下
+     *  是死代码(`windowZero` 那时挂在 `streamApprovalOn` 后面,协议关就恒 false);[ref] 让 `0` 在协议关的
+     *  腿上也真生效之后,那个折算会把一台**什么都没配**的 harness 判成「运维显式关窗」。故本字段收成
+     *  `number | undefined`,由每个调用点如实交出「有没有这个值」,不许再就地编一个。 */
+    windowMs: number | undefined;
     /** `config.streamAskWindowMarginMs`(`STREAM_ASK_WINDOW_MARGIN_MS`)。 */
     windowMarginMs: number;
     /** `spec.limits.maxWalltimeMs`。缺席 = 没有 walltime 墙 ⇒ 第三源不参与(**缺席 ≠ 0**)。 */
@@ -802,6 +818,8 @@ export declare class ToolApprovalCoordinator {
     /** 两份候选是否**逐条逐键**相等(顺序即展示序 ⇒ 顺序敏感)。两侧都缺席 = 相等;一侧缺席 = 不等。
      *  用在幂等重入的「行 = 真源」对账上(见 `ensureAsk` 那段撤回臂)。 */
     private static ruleOffersEqual;
+    private static batchMemberEqual;
+    private static uncoveredDetailEqual;
     /**
      * [ref] / 5.58 复审 F-1 —— OFFER 的**文本座尺**(红先修)。
      *
@@ -824,6 +842,11 @@ export declare class ToolApprovalCoordinator {
      * 位置在**素材铸点**(与基数帽同一处):两族帧 + `card_json` + 回决口的等式左边从此拿的是**同一份**
      * 已截素材,而不是两处各截一遍。
      */
+    /** 兑付侧座(single 的 rule/command、command 成员的 rule/command、directoryRead 成员的 rule/directory)任一超尺?
+     *  `segment` 与 `uncoveredDetail[].segment` 是纯渲染座,不在此列(截长是诚实省略)。 */
+    private static ruleOfferTextsOverSize;
+    /** codex r1 [high]([ref]):offer 的自称座与 `parseAllowRuleText(rule)` 派生的三元组逐字一致?(理由见调用点) */
+    private static ruleOfferDerivedFactsAgree;
     private static boundRuleOfferTexts;
     private buildRuleLaneMaterial;
     /** [ref]([ref]/[ref] 双属主裁定):把某 wire run 的**流内未决 ask** 立即转 durable park——断连支专用。