@sema-agent/server 7.57.0 → 7.58.0

package/dist/boot/stores.js

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore } from "@sema-agent/core";
+import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
 import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
@@ -299,19 +299,26 @@ export async function openStores(ctx) {
         const pgPool = backend?.pgPool?.();
         if (pgPool) {
             await ensurePgMailboxSchema(async (text, params) => pgPool.query(text, params));
-            mailboxStore = new PgMailboxStore(pgPool);
+            mailboxStore = new PgMailboxStore(pgPool, logger);
         }
         else if (mysqlPool) {
             await ensureTiDBMailboxSchema(mysqlPool);
-            mailboxStore = new TiDBMailboxStore(mysqlPool);
+            mailboxStore = new TiDBMailboxStore(mysqlPool, logger);
         }
         else if (backend?.kind === "local") {
             mailboxStore = new FileMailboxStore(config.localDataRoot ?? localRoot, {
                 onCorruptRead: (info) => logger.warn("mailbox_corrupt_read", { path: info.path, reason: info.reason }),
             });
         }
-        if (mailboxStore)
-            logger.info("mailbox_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
+        if (mailboxStore) {
+            const laneVerdict = mailboxCrossProcessMountVerdict(mailboxStore);
+            logger.info("mailbox_store_enabled", {
+                backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file",
+                crossProcessSafe: mailboxStore.crossProcessSafe,
+                peerLaneMountable: laneVerdict.ok,
+                ...(laneVerdict.ok ? {} : { peerLaneRefusal: laneVerdict.code }),
+            });
+        }
     }
     let usageWindowStore;
     if (config.usageWindows) {

package/dist/config-center/http-client.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
+import { foldEffectiveReadWarning } from "./read-warnings.js";
 export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
     const scheme = new URL(baseUrl).protocol;
     if (scheme !== "http:" && scheme !== "https:")
@@ -21,17 +22,12 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
         delete wire.prompts;
     else
         wire.prompts = centerPrompts;
-    const domainErrors = warnings
-        .map((w) => w.kind === "domain-defaulted"
-        ? { domain: w.domain, error: (w.error instanceof Error ? w.error.message : String(w.error)).slice(0, 600) }
-        : w.kind === "unknown-keys-dropped"
-            ? { domain: w.domain, error: `unknown keys dropped by domain schema: ${w.keys.join(", ")}`.slice(0, 600) }
-            : w.kind === "unknown-keys-carried"
-                ? { domain: w.domain, error: `unknown keys carried to consumer (spelling?): ${w.keys.join(", ")}`.slice(0, 600) }
-                : w.kind === "unread-config-file"
-                    ? { domain: w.domain ?? "config.d", error: `unread config file ${w.file} (${w.why})`.slice(0, 600) }
-                    : undefined)
-        .filter((r) => r !== undefined);
+    const domainErrors = [];
+    for (const w of warnings) {
+        const f = foldEffectiveReadWarning(w);
+        if (f !== null)
+            domainErrors.push(f);
+    }
     const effective = wire;
     return { effective, etag: res.headers.get("etag") ?? undefined, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
 }

package/dist/config-center/read-warnings.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `EffectiveReadWarning` → 候选门口径的**单点**折叠(本地腿 `config-provider.ts` 与远程腿 `http-client.ts` 共用;
+ * 两腿各抄一份映射正是漂移的成因——远程腿曾漏掉一次改动,版本超前的 center 多一个字段就整份远程 refresh 整拒)。
+ *
+ * **律只有一条:未知键 = 候选门错误,零特例。** 「别的写者按契约放的扩展键」(壳写在 models 条目上的 `sema*`)
+ * 不是本函数要分辨的事——那由 settings-schema 的 `EXTENSION_NAMESPACES` 在**声明处**说清(登记的键既不点名也不计数,
+ * 1.5.0 起);到了这里的每一个键都是「写了没生效」的拼错或越界,与 domain-defaulted 同级。此前本仓在下游按 kind/
+ * 按域/按键路径闭集/按 64 满额四层猜意图,每层都被下一轮复审打穿——意图只能在声明处说,消费方不猜。
+ *
+ * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
+ * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
+ */
+import type { EffectiveReadWarning } from "@sema-agent/settings-schema";
+export type FoldedReadWarning = {
+    readonly domain: string;
+    readonly error: string;
+};
+/** null = 不入诊断面(`hosts-grandfathered`:值已被收编接受,与本地店同口径)。 */
+export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
+//# sourceMappingURL=read-warnings.d.ts.map

package/dist/config-center/read-warnings.js

@@ -0,0 +1,36 @@
+const MAX_ERROR_CHARS = 600;
+const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
+const keyList = (prefix, keys, truncatedFrom) => {
+    const total = truncatedFrom ?? keys.length;
+    const budget = MAX_ERROR_CHARS - prefix.length;
+    const shown = [];
+    let used = 0;
+    const suffixFor = (n) => (n < total ? ` (+${total - n} more, list truncated)` : "");
+    for (const k of keys) {
+        const piece = (shown.length > 0 ? ", " : "") + k;
+        if (used + piece.length + suffixFor(shown.length + 1).length > budget)
+            break;
+        shown.push(k);
+        used += piece.length;
+    }
+    return `${prefix}${shown.join(", ")}${suffixFor(shown.length)}`;
+};
+export function foldEffectiveReadWarning(w) {
+    switch (w.kind) {
+        case "hosts-grandfathered":
+            return null;
+        case "domain-defaulted":
+            return { domain: w.domain, error: cap(w.error instanceof Error ? w.error.message : String(w.error)) };
+        case "unknown-keys-dropped":
+            return { domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
+        case "unknown-keys-carried":
+            return { domain: w.domain, error: keyList("unknown keys carried to consumer (spelling?): ", w.keys, w.truncatedFrom) };
+        case "unread-config-file":
+            return { domain: w.domain ?? "config.d", error: cap(`unread config file ${w.file} (${w.why})`) };
+        default: {
+            const never = w;
+            throw new Error(`unhandled EffectiveReadWarning kind: ${JSON.stringify(never)}`);
+        }
+    }
+}
+//# sourceMappingURL=read-warnings.js.map

package/dist/config-provider.d.ts

@@ -7,6 +7,9 @@ import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetc
  *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
  *  per-domain warn 点名坏域。gate 域(governance/rosters/…)坏文件 tolerant 仍 throw(READ 容错不放宽
  *  gate fail-loud,registry-core 半场精化)——那条路走既有的整包 catch。 */
+/** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
+ *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
+ *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;

package/dist/config-provider.js

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes } from "node:crypto";
+import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
@@ -62,14 +63,9 @@ export class LocalConfigProvider {
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
                 onWarning: (w) => {
-                    if (w.kind === "domain-defaulted")
-                        parseWarnings.push({ domain: w.domain, error: w.error instanceof Error ? w.error.message : String(w.error) });
-                    else if (w.kind === "unknown-keys-dropped")
-                        parseWarnings.push({ domain: w.domain, error: `unknown keys dropped by domain schema: ${w.keys.join(", ")}` });
-                    else if (w.kind === "unknown-keys-carried")
-                        parseWarnings.push({ domain: w.domain, error: `unknown keys carried to consumer (spelling?): ${w.keys.join(", ")}` });
-                    else if (w.kind === "unread-config-file")
-                        parseWarnings.push({ domain: w.domain ?? "config.d", error: `unread config file ${w.file} (${w.why})` });
+                    const f = foldEffectiveReadWarning(w);
+                    if (f !== null)
+                        parseWarnings.push(f);
                 },
             });
         const { effective: eff, domainErrors } = await store.getEffective({ tolerant: true });

package/dist/hooks/hook-runner.js

@@ -673,7 +673,7 @@ async function runObserveOnlyEvent(event, groups, matchValue, payload, ctx, once
         if (!out)
             continue;
         if (typeof out.systemMessage === "string")
-            ctx.logger.warn("hook_system_message", { event, message: clip(out.systemMessage, 500) });
+            ctx.logger.info("hook_system_message", { event, message: clip(out.systemMessage, 500) });
         if (out.decision !== undefined || out.continue === false || out.hookSpecificOutput !== undefined) {
             ctx.logger.warn("hook_result_unsupported", { event });
         }
@@ -747,7 +747,7 @@ export function createTaskHooks(config, ctx) {
                     if (!out)
                         continue;
                     if (typeof out.systemMessage === "string")
-                        ctx.logger.warn("hook_system_message", { event: "PreToolUse", message: clip(out.systemMessage, 500) });
+                        ctx.logger.info("hook_system_message", { event: "PreToolUse", message: clip(out.systemMessage, 500) });
                     if (out.continue === false) {
                         const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                         return { action: "deny", message: reason, ...buildHookContextField(contexts) };
@@ -845,7 +845,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolUse", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolUse", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolUse" });
                 }
@@ -895,7 +895,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolUseFailure", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolUseFailure", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolUseFailure" });
                 if (out.decision === "block" && typeof out.reason === "string")
@@ -942,7 +942,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PostToolBatch", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PostToolBatch", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PostToolBatch" });
                 if (out.decision === "block" && typeof out.reason === "string")
@@ -974,7 +974,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "UserPromptSubmit", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "UserPromptSubmit", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     const reason = clip(typeof out.stopReason === "string" ? out.stopReason : "hook requested stop", MAX_HOOK_FEEDBACK_CHARS);
                     return { block: reason, ...buildHookContextField(contexts) };
@@ -1063,7 +1063,7 @@ export function createTaskHooks(config, ctx) {
                     continue;
                 }
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "Stop", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "Stop", message: clip(out.systemMessage, 500) });
                 if (out.continue === false)
                     sawContinueFalse = true;
                 if (out.decision === "block" && block === undefined) {
@@ -1122,7 +1122,7 @@ export function createTaskHooks(config, ctx) {
                 if (!out)
                     continue;
                 if (typeof out.systemMessage === "string")
-                    ctx.logger.warn("hook_system_message", { event: "PreCompact", message: clip(out.systemMessage, 500) });
+                    ctx.logger.info("hook_system_message", { event: "PreCompact", message: clip(out.systemMessage, 500) });
                 if (out.continue === false) {
                     ctx.logger.warn("hook_continue_false_unsupported", { event: "PreCompact" });
                 }

package/dist/observability/metrics.js

@@ -235,7 +235,7 @@ export function createMetrics() {
     m.counter("remote_env_resume_total", "E2B remote-env resumeVM outcomes (v1.5, provider/result)");
     m.counter("remote_env_exec_stream_read_timeout_total", "E2B execStream idle read-timeouts (#1128, provider)");
     m.counter("resume_anchor_capture_failed", "E18 resume-at per-turn anchor captures that failed (best-effort, run unaffected)");
-    m.counter("brain_retry_total", "Brain-layer status events (S4), by phase (rate_limited/retrying/reconnecting/circuit_open)");
+    m.counter("brain_retry_total", "Brain-layer status events (S4), by phase (rate_limited/retrying/reconnecting/circuit_open/waiting_first_token/recovered/gave_up)");
     m.gauge("store_backend_degraded", "1 when the auto DB probe failed at boot and this replica degraded to in-memory (S5)");
     m.counter("images_omitted_total", "Tasks whose images will be degraded to text placeholders (no-vision model), by model (S6)");
     m.counter("runs_reaped_total", "Run rows flipped by the background reapers (S7), by kind (stale/suspended/expired_checkpoint)");

package/dist/observability/run-terminal-log.js

@@ -177,7 +177,7 @@ export const OVERSIZED_PATCH_PLACEHOLDER = "«redacted:oversized-patch-not-inlin
 function diffScanRefusal(patch, direct) {
     if (/^diff --(?:cc|combined) |^@{3,} /m.test(patch))
         return "combined-diff";
-    const fence = /-{4,5} ?BEGIN[^\n-]*PRIVATE KEY(?: BLOCK)?[^\n-]*-{4,5}/;
+    const fence = /-{4,5} ?BEGIN(?:[^\n-]|-(?!-))*PRIVATE KEY(?: BLOCK)?(?:[^\n-]|-(?!-))*-{4,5}/;
     if (fence.test(direct))
         return "pem-fence-survived";
     const ppkField = /Private-(?:MAC|Hash): [0-9a-fA-F]{32}/;

package/dist/plugins/mailbox-store-sql.d.ts

@@ -7,15 +7,19 @@
  * 终版文本,conformance 无两可):
  *  1. **同主重 claim = 续期 + 纳新**(crash-retry 正形):活 lease 只挡**别的** owner;同 owner 任意
  *     时刻重 claim 重设 TTL 并拿到当前全部未 ack 消息(maxSeq 随最新行走)。
- *  2. **seq = 盒生命周期内不复用**:box 行携 `next_seq`,分配与 append 同事务;`drop`/`reap` 删整盒
- *     (含 box 行)= 生命周期终结,重建从 1(core 定谳:行随盒亡,dedup 键携 handle)。
+ *  2. **seq = 盒生命周期内不复用**:box 行携 `next_seq`,分配与 append 同事务;`drop` 删整盒(含 box 行)
+ *     = 生命周期终结,重建从 1(core 定谳:行随盒亡,dedup 键携 handle)。⚠️ **`reap` 自 [ref](core
+ *     2026-07-25)起不再与 drop 同句**:reap 是收件人活着时的龄扫,**清箱保高水位**(删消息、清租约、盒行与
+ *     next_seq 留着)——本文件 2026-09-03(车BF,codex r1 [high])才跟上;此前 reap 删盒行 ⇒ 下一条 append 从 1
+ *     重铸,陈旧 ack 可删掉一条没人见过的新消息。跨进程试剂盒明钉此条。
  *  3. **ack 无 owner 守卫**(信任 claim 赢者链):`seq <= upToSeq` 删行;lease 的 `maxSeq <= upToSeq`
  *     时顺带清 lease(全量 ack = 释放)。
  *  4. **lease 过期判 = 严格 `expiresAt > now` 才挡**;`releaseLease` 只在 owner 匹配时清。
  *  5. `peekCount` 含已 lease 消息(可见性 ≠ lease 态);空盒 claim = null(box 行在而消息 0 也 null)。
  *  6. **reap = SQL 全量真扫**(core File 实现只扫已加载盒 = 进程内 backstop,[ref] 确认 SQL 是全量
- *     真扫的正确层):`maxAgeMs` 缺省 → 0;按盒 newest `sentAt < now - maxAgeMs` 删整盒;空盒(有
- *     box 行无消息)不删(InMemory 同形——`newest === undefined` 不删)。
+ *     真扫的正确层):`maxAgeMs` 缺省 → 0;按盒 newest `sentAt < now - maxAgeMs` **清箱**(删消息 + 清租约,
+ *     盒行/高水位保留,见定谳 2 的 [ref] 半句);空盒(有 box 行无消息)不清(InMemory 同形——`newest ===
+ *     undefined` 不动)。
  *
  * 键列 = 字节等价(TiDB VARBINARY / PG COLLATE "C",roster F2 案):scope/handle/lease_owner 的
  * `=` 必须纯字节——PAD SPACE 近撞不得穿隔离/抢别人 lease。PG unstorable bytes([ref] 三层定谳):
@@ -37,15 +41,28 @@
  */
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { MailboxLease, MailboxStore } from "@sema-agent/core";
-type MailboxAppendMessage = Parameters<MailboxStore["append"]>[2];
+import type { MailboxAppendMessage, MailboxLease, MailboxStore } from "@sema-agent/core";
 export declare const MAILBOX_TABLE = "mailbox";
 export declare const MAILBOX_MSG_TABLE = "mailbox_message";
+/** 店侧日志座(可选;boot 注入 `Logger`)。7.58.0 合并重扫 [medium]:坏 `peer_meta` 行的 fail-closed 抛必须**响亮**——core 唯一的
+ *  claimLease 调用方(peer-session-drain)吞掉该错,店不记这一笔就成了「静默永久卡箱」。抛之前记 `mailbox_peer_meta_corrupt`
+ *  (scope/handle/seq/code),运维按 seq 修行。 */
+export interface MailboxStoreLogger {
+    warn(event: string, fields: Record<string, unknown>): void;
+}
 export declare function ensureTiDBMailboxSchema(pool: MySqlPool): Promise<void>;
 export declare function ensurePgMailboxSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
 export declare class TiDBMailboxStore implements MailboxStore {
     private readonly pool;
-    constructor(pool: MySqlPool);
+    private readonly logger?;
+    /** [ref]([ref] §1.2⑥):跨进程安全**显式**声明 —— core 的 `mailboxCrossProcessMountVerdict` 只对字面 `true` 放行
+     *  peer lane(缺席/false/畸形一律响亮拒挂 `config.peer_lane_unmounted`)。真值前提 = 本文件头注「并发正确性」段:seq
+     *  在事务内经盒行 FOR UPDATE 单铸、lease/ack/drop/reap 统一盒行锁序、reap 事务内逐盒当前读重验 —— 多副本(=多 OS
+     *  进程)共享一个盒本就是 SQL 双生的设计象限。**终验** = core 跨进程试剂盒 `mailboxCrossProcessContract` 跑在真第二个
+     *  OS 进程上:`test/mailbox-cross-process-kit.test.ts`(file 腿恒跑验 harness;tidb/pg 腿 ENV-GATED,发车前双库门必跑,
+     *  红即摘本声明——core 契约逐字「declares true AFTER passing」,声明不许先于试剂盒长期悬空)。 */
+    readonly crossProcessSafe = true;
+    constructor(pool: MySqlPool, logger?: MailboxStoreLogger | undefined);
     private tx;
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
@@ -59,7 +76,10 @@ export declare class TiDBMailboxStore implements MailboxStore {
 }
 export declare class PgMailboxStore implements MailboxStore {
     private readonly pool;
-    constructor(pool: PgPool);
+    private readonly logger?;
+    /** [ref] 跨进程安全显式声明(TiDB 孪生同注:事务 + 盒行 FOR UPDATE 锁序是真值前提;终验 = test/mailbox-cross-process-kit.test.ts pg 腿)。 */
+    readonly crossProcessSafe = true;
+    constructor(pool: PgPool, logger?: MailboxStoreLogger | undefined);
     private tx;
     /** 身份键拒绝式([ref] 协议纪律):scope/handle/owner/from 清洗形变 = 路由/attribution 错位。 */
     private assertIdentity;
@@ -73,5 +93,4 @@ export declare class PgMailboxStore implements MailboxStore {
         maxAgeMs?: number;
     }): Promise<number>;
 }
-export {};
 //# sourceMappingURL=mailbox-store-sql.d.ts.map

package/dist/plugins/mailbox-store-sql.js

@@ -1,3 +1,4 @@
+import { MAILBOX_INVALID_PEER_META_CODE, MailboxStoreError, readMailboxPeerMeta } from "@sema-agent/core";
 import { pgHasUnstorable, pgSanitizeText, PgUnstorableError } from "./pg-safe-json.js";
 export const MAILBOX_TABLE = "mailbox";
 export const MAILBOX_MSG_TABLE = "mailbox_message";
@@ -43,14 +44,61 @@ function decodeHopChain(raw) {
         return undefined;
     return parsed;
 }
+const PEER_META_MAX_BYTES = 60_000;
+function encodePeerMeta(raw) {
+    const meta = readMailboxPeerMeta(raw);
+    if (meta === undefined)
+        return null;
+    const text = JSON.stringify(meta);
+    if (Buffer.byteLength(text, "utf8") > PEER_META_MAX_BYTES) {
+        throw new Error(`MailboxStore: peerMeta exceeds the ${PEER_META_MAX_BYTES}-byte column (refusing — a truncated record would silently read back as ABSENT, which the drain treats as a foreign record)`);
+    }
+    return text;
+}
+function decodePeerMeta(raw) {
+    if (raw === null || raw === undefined)
+        return undefined;
+    const text = bufToStr(raw);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore: stored peer_meta is not JSON (refusing the lease — a corrupt typed record must not be read as "no metadata"): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        return readMailboxPeerMeta(parsed);
+    }
+    catch (err) {
+        if (err instanceof MailboxStoreError)
+            throw err;
+        throw new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore: stored peer_meta failed validation (refusing the lease): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function rowsToMessages(rows, scope, handle, logger) {
+    const out = [];
+    for (const r of rows) {
+        try {
+            out.push(rowToMessage(r));
+        }
+        catch (err) {
+            if (err instanceof MailboxStoreError)
+                logger?.warn("mailbox_peer_meta_corrupt", { scope, handle, seq: Number(r.seq), code: err.code, note: "claimLease refused for the whole box (fail-closed); repair or NULL the peer_meta column of this row" });
+            throw err;
+        }
+    }
+    return out;
+}
 function rowToMessage(r) {
     const hopChain = decodeHopChain(r.hop_chain);
+    const peerMeta = decodePeerMeta(r.peer_meta);
     return {
         seq: Number(r.seq),
         ...(r.from_id !== null && r.from_id !== undefined ? { from: bufToStr(r.from_id) } : {}),
         content: String(r.content),
         sentAt: Number(r.sent_at_ms),
         ...(hopChain !== undefined ? { hopChain } : {}),
+        ...(peerMeta !== undefined ? { peerMeta } : {}),
     };
 }
 export async function ensureTiDBMailboxSchema(pool) {
@@ -75,6 +123,11 @@ export async function ensureTiDBMailboxSchema(pool) {
     -- 见 encodeHopChain 头注:缺席 vs 空数组绝不互折)。TEXT 而非 LONGTEXT——链上界在 core(28 跳,
     -- 短 token),写入面另有 HOP_CHAIN_MAX_BYTES fail-loud 守卫关掉静默截断类。
     hop_chain TEXT NULL,
+    -- peer_meta(S-90;core fc52b4d4 design/385 片2b):drain 点权威判断读的 typed peer 记录,JSON 文本;
+    -- NULL = 缺席(**有语义**:pre-385/foreign 记录,drain 永不回溯准入;与空对象绝不互折)。写入面先过 core
+    -- readMailboxPeerMeta(坏值带码拒于任何副作用前)+ PEER_META_MAX_BYTES 守卫关掉静默截断类。
+    -- 新列按 2026-07-26 schema policy 直接折进 CREATE(不开 ALTER seam,存量库删库重建)。
+    peer_meta TEXT NULL,
     PRIMARY KEY (scope_key, handle, seq),
     KEY idx_mbm_sent (scope_key, handle, sent_at_ms)
   ) COLLATE utf8mb4_bin`);
@@ -98,14 +151,18 @@ export async function ensurePgMailboxSchema(q) {
     content TEXT COLLATE "C" NOT NULL,
     sent_at_ms BIGINT NOT NULL,
     hop_chain TEXT COLLATE "C", -- core 5.17.0 design/176(TiDB twin 同注:NULL = 缺席且有语义)
+    peer_meta TEXT COLLATE "C", -- S-90 core fc52b4d4 design/385 片2b(TiDB twin 同注:typed peer 记录 JSON;NULL = 缺席且有语义)
     PRIMARY KEY (scope_key, handle, seq)
   )`);
     await q(`CREATE INDEX IF NOT EXISTS idx_mbm_sent ON ${MAILBOX_MSG_TABLE} (scope_key, handle, sent_at_ms)`);
 }
 export class TiDBMailboxStore {
     pool;
-    constructor(pool) {
+    logger;
+    crossProcessSafe = true;
+    constructor(pool, logger) {
         this.pool = pool;
+        this.logger = logger;
     }
     async tx(fn) {
         const c = await this.pool.getConnection();
@@ -130,6 +187,7 @@ export class TiDBMailboxStore {
         assertKeyBytes("scope", scope);
         assertKeyBytes("handle", handle);
         const hopChain = encodeHopChain(msg.hopChain);
+        const peerMeta = encodePeerMeta(msg.peerMeta);
         return this.tx(async (c) => {
             await c.query(`INSERT IGNORE INTO ${MAILBOX_TABLE} (scope_key, handle, scope, next_seq) VALUES (?, ?, ?, 1)`, [scope, handle, scope]);
             let [rows] = (await c.query(`SELECT next_seq FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]));
@@ -139,7 +197,7 @@ export class TiDBMailboxStore {
             }
             const seq = Number(rows[0].next_seq);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET next_seq = ? WHERE scope_key = ? AND handle = ?`, [seq + 1, scope, handle]);
-            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain) VALUES (?, ?, ?, ?, ?, ?, ?)`, [scope, handle, seq, msg.from ?? null, msg.content, msg.sentAt, hopChain]);
+            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain, peer_meta) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [scope, handle, seq, msg.from ?? null, msg.content, msg.sentAt, hopChain, peerMeta]);
             return seq;
         });
     }
@@ -154,12 +212,12 @@ export class TiDBMailboxStore {
                 bufToStr(box.lease_owner) !== owner) {
                 return null;
             }
-            const [msgs] = (await c.query(`SELECT seq, from_id, content, sent_at_ms, hop_chain FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY seq FOR UPDATE`, [scope, handle]));
+            const [msgs] = (await c.query(`SELECT seq, from_id, content, sent_at_ms, hop_chain, peer_meta FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY seq FOR UPDATE`, [scope, handle]));
             if (msgs.length === 0)
                 return null;
             const maxSeq = Number(msgs[msgs.length - 1].seq);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = ?, lease_expires_at_ms = ?, lease_max_seq = ? WHERE scope_key = ? AND handle = ?`, [owner, now + ttlMs, maxSeq, scope, handle]);
-            return { messages: msgs.map(rowToMessage), maxSeq };
+            return { messages: rowsToMessages(msgs, scope, handle, this.logger), maxSeq };
         });
     }
     async ack(scope, handle, owner, upToSeq) {
@@ -203,8 +261,8 @@ export class TiDBMailboxStore {
                 const [newest] = (await c.query(`SELECT sent_at_ms FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY sent_at_ms DESC LIMIT 1 FOR UPDATE`, [scope, h]));
                 if (newest.length === 0 || Number(newest[0].sent_at_ms) >= cutoff)
                     continue;
-                await c.query(`DELETE FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ?`, [scope, h]);
                 await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ?`, [scope, h]);
+                await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL WHERE scope_key = ? AND handle = ?`, [scope, h]);
                 dropped++;
             }
             return dropped;
@@ -213,8 +271,11 @@ export class TiDBMailboxStore {
 }
 export class PgMailboxStore {
     pool;
-    constructor(pool) {
+    logger;
+    crossProcessSafe = true;
+    constructor(pool, logger) {
         this.pool = pool;
+        this.logger = logger;
     }
     async tx(fn) {
         const c = await this.pool.connect();
@@ -245,6 +306,7 @@ export class PgMailboxStore {
         assertKeyBytes("scope", scope);
         assertKeyBytes("handle", handle);
         const hopChain = encodeHopChain(msg.hopChain);
+        const peerMeta = encodePeerMeta(msg.peerMeta);
         return this.tx(async (c) => {
             await c.query(`INSERT INTO ${MAILBOX_TABLE} (scope_key, handle, scope, next_seq) VALUES ($1, $2, $3, 1) ON CONFLICT (scope_key, handle) DO NOTHING`, [
                 scope,
@@ -262,7 +324,7 @@ export class PgMailboxStore {
             }
             const seq = Number(rows[0].next_seq);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET next_seq = $1 WHERE scope_key = $2 AND handle = $3`, [seq + 1, scope, handle]);
-            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain) VALUES ($1, $2, $3, $4, $5, $6, $7)`, [scope, handle, seq, msg.from ?? null, content, msg.sentAt, hopChain]);
+            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain, peer_meta) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [scope, handle, seq, msg.from ?? null, content, msg.sentAt, hopChain, peerMeta]);
             return seq;
         });
     }
@@ -275,12 +337,12 @@ export class PgMailboxStore {
             const box = boxes[0];
             if (box.lease_owner !== null && Number(box.lease_expires_at_ms) > now && String(box.lease_owner) !== owner)
                 return null;
-            const { rows: msgs } = await c.query(`SELECT seq, from_id, content, sent_at_ms, hop_chain FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY seq FOR UPDATE`, [scope, handle]);
+            const { rows: msgs } = await c.query(`SELECT seq, from_id, content, sent_at_ms, hop_chain, peer_meta FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY seq FOR UPDATE`, [scope, handle]);
             if (msgs.length === 0)
                 return null;
             const maxSeq = Number(msgs[msgs.length - 1].seq);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = $1, lease_expires_at_ms = $2, lease_max_seq = $3 WHERE scope_key = $4 AND handle = $5`, [owner, now + ttlMs, maxSeq, scope, handle]);
-            return { messages: msgs.map((r) => rowToMessage(r)), maxSeq };
+            return { messages: rowsToMessages(msgs, scope, handle, this.logger), maxSeq };
         });
     }
     async ack(scope, handle, owner, upToSeq) {
@@ -327,8 +389,8 @@ export class PgMailboxStore {
                 const { rows: newest } = await c.query(`SELECT sent_at_ms FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY sent_at_ms DESC LIMIT 1 FOR UPDATE`, [scope, h]);
                 if (newest.length === 0 || Number(newest[0].sent_at_ms) >= cutoff)
                     continue;
-                await c.query(`DELETE FROM ${MAILBOX_TABLE} WHERE scope_key = $1 AND handle = $2`, [scope, h]);
                 await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2`, [scope, h]);
+                await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL WHERE scope_key = $1 AND handle = $2`, [scope, h]);
                 dropped++;
             }
             return dropped;

package/dist/trace/core-keyset-guard.d.ts

@@ -17,11 +17,11 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxStore, TaskSpec, TaskResult } from "@sema-agent/core";
+import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult } from "@sema-agent/core";
 /** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
 type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
-type NotificationExcluded = "peer";
+type NotificationExcluded = "peer" | "crossSessionMessage";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
@@ -33,10 +33,9 @@ type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "is
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
-type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain";
+type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
-type MailboxAppendMessage = Parameters<MailboxStore["append"]>[2];
-type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain";
+type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
 type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable";
@@ -49,7 +48,7 @@ type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<Permiss
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -15,6 +15,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.capture_optout_unpersisted",
     "task.halt_unconsumed",
     "task.late_approval",
+    "config.durable_gate_unavailable",
+    "peer.inbound_disposition",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/project.d.ts

@@ -343,8 +343,47 @@ export declare function workspaceChangedEventData(ev: {
  *    ⚠️ 与 `storeWired` **不同**:本仓这两条至今未接(`RunnerDeps.permissionRuleSyncWired` /
  *    `permissionRuleOrg` 全树零声明点,2026-08-10 [ref] 复扫亲验)⇒ 今天恒 `false`,这是**真值**不是
  *    缺席。哪天接上其中任一条,连本句一起改 —— 这一行是它的登记处。
+ *  · `modelGate`(可选段 `{ class, removed[], restore }`;core fc52b4d4 [ref] / [ref] 片2b,[ref] 提货件,
+ *    黑板 [ref] @server①)—— **裁:租户可见**。它是 per-session 的**读面**:「我这条 session 因为工具-模型门卸掉了
+ *    哪些工具」——与 operator 通告 `config.tool_model_gate_removed` **同决策同源**(core 从同一张 trim 表铸两面),
+ *    但通告归 operator 车道(engine_notice 白名单,附录 D),本段归租户:消费端(cli L-70 [ref])要在**首帧一次读**
+ *    里知道自己少了哪些工具、怎么恢复,否则只能等到调用被拒才发现。三键都是引擎派生值:`class` = 合并 gate 表的 class 行键
+ *    (prepare-task 对表外 class 响亮拒),`removed` = 工具 wire 名(core 表键,非用户内容),`restore` = core 铸的一句恢复指引(引擎文案)
+ *    ⇒ 不脱敏、逐字。多 class 同卸 ⇒ core 报首 class + removed **并集**(core 合并律;本仓不按 class 过滤)。
+ *    仅本 run 有门卸时在场:**缺席 = 本 run 没卸**,不铸空段、不铸 `removed: []`。畸形(三键任一缺席/形不合)
+ *    ⇒ 整段按缺席 —— 不铸半段,半段会被读成「只卸了这些」。它不构成 governance 四布尔的侧信道(门卸由
+ *    模型/门 class 决定,与 lockedConfig/compliance/memoryAdmission/retention 无函数关系)。
+ *  · `autoMode`(`{ armed: boolean, reason: AutoModeArmReason }`;core 7.3.1 [ref],147③ 提货件,黑板 [ref])
+ *    —— **裁:租户可见**。它是 per-leg 的**读面**:「我这条腿的 auto 模式武装了吗?没武装是卡在哪一臂?」
+ *    ① **同主体同受众**:本仓早已把同一件事投在租户面上 —— `/v1/capabilities.permissionModeAuto.{armed,reason}`
+ *       ([ref],7.57.0 已发)答的是「**若此刻提交**会不会武装」,本段答的是「**这条真跑起来的腿**武装了吗」;
+ *       同一个主体(调用方自己的 run)、同一条轴,只差事前/事后。剥掉它,壳就只能拿事前预测冒充事后事实;
+ *    ② **两个值都是引擎派生的闭形**:`armed` 布尔,`reason` 是 core 的闭集词(`AUTO_MODE_ARM_REASONS`:
+ *       armed / no_intent / no_face / denied / resolver_fault / latch_open)—— 非用户内容,不脱敏、逐字;
+ *    ③ **不是 governance 侧信道**:它描述的是**本腿**的武装结论,与 lockedConfig/compliance/memoryAdmission/
+ *       retention 四位无函数关系;而 `denied` 这一词所披露的「组织把这一位关了」在 [ref] 读面上**本就已经**
+ *       对同一租户可见(`org_denied`),本段没有扩大任何受众。
+ *    🔴 **逐字透传,不映射**:core 的六词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
+ *       —— 两张表回答的是两个问题、粒度也不同(core 的 `denied` 一词对应本仓的 `org_denied` / `local_denied`
+ *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
+ *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):
+ *       settings 层的 kill-switch 折的是**模式**(`effectivePermissionMode`:auto → default),于是 resolve-spec
+ *       阶段④ 压根不写意图座 `TaskSpec.autoModeRequested` ⇒ core 的武装谓词第一项就落空;而本地 env 腿折的是
+ *       **caps**(`applyLocalAutoModeDeny`),模式不动、座照写 ⇒ core 才报 `denied`。两条腿在 manifest 上
+ *       **分不开**,要分辨得读 `/v1/capabilities`。对照表与保鲜钉在 `test/wiring-manifest-projection.test.ts`
+ *       的 147③ 节,分岔的行为面格在 `test/permission-mode-shell-gate-translation.test.ts`;
+ *       本函数**只透传**,一个字都不换。
+ *    ⚠️ 缺席 ≠ 「不适用」:core 顶注逐字「absence here means an older mint or an external derivation, never
+ *       "not applicable"」⇒ 缺席时**不铸** `armed:false`(那会把「老 mint 写的行」谎报成「这条腿确实没武装」)。
+ *    ⚠️ **自相矛盾按缺席**:core 把 `armed ⇔ reason === "armed"` 写成段内不变量并在 derive 点拒(`readAutoModeFact`
+ *       抛)。账本回放/第三方 producer 送来的矛盾对若原样上 wire,按 `armed` 读与按 `reason` 读的消费端会得到
+ *       **相反**的答案 —— 这条轴上(@cli `sema doctor permissions` 正读它)两个答案比没答案更坏 ⇒ 整段不铸。
+ *       这不是改语义:它与本函数「畸形值一律按缺席」是同一条规则,而这条不变量是 core 自己写的段内契约。
  * 未来 core 加一段而它没有 audience 标签时,**先在这里补一条裁定再决定挑不挑键** —— 段级完备性钉
- * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来。
+ * (test/wiring-manifest-projection.test.ts)会在那一刻先把人拦下来 —— ⚠️ **但那条钉是夹具驱动的**:它只看
+ * `deriveWiringManifest(EFFECTIVE_FACTS)` 真铸出来的段,facts 不带的可选段(147③ 的 `autoMode` 就是)它一格
+ * 都红不了(2026-09-04 实测:该钉 26/26 全绿,红出 `autoMode` 的是编译期门)。段级 + 成员级的**编译期**门在
+ * `core-keyset-guard.ts` ⑥b —— 那才是「core 加了段/加了成员」的可靠红点,两道并用缺一不可。
  */
 export declare function wiringManifestEventData(ev: {
     manifest?: unknown;
@@ -410,8 +449,9 @@ export declare function humanInputEventData(ev: {
 }): Record<string, unknown>;
 /** S4 (SILENT-FALLBACK P0-a): the durable `brain_status` observation row, shared by the bg + resume append
  *  sites. core marks the live `status` frame EPHEMERAL (never replayed by core on resume) — this row is the
- *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open),
- *  not a core event replay. Whitelist: the closed phase union + neutral bounded detail (redacted) + retryInSec. */
+ *  SERVICE's own observation record (why a turn stalled: rate_limited/retrying/reconnecting/circuit_open, and
+ *  since core 7.3.1 / [ref] the pre-failure `waiting_first_token` wait), not a core event replay.
+ *  Whitelist: the closed phase union verbatim + neutral bounded detail (redacted) + the bounded numeric seats. */
 export declare function brainStatusEventData(ev: {
     phase: string;
     detail?: string;
@@ -422,6 +462,8 @@ export declare function brainStatusEventData(ev: {
     errClass?: string;
     retryAtMs?: number;
     errorStatus?: number;
+    elapsedMs?: number;
+    timeoutMs?: number;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -250,6 +250,25 @@ export function wiringManifestEventData(ev) {
         ...(bool(rulesIn.syncWired) !== undefined ? { syncWired: rulesIn.syncWired } : {}),
         ...(bool(rulesIn.orgGoverned) !== undefined ? { orgGoverned: rulesIn.orgGoverned } : {}),
     });
+    const gateIn = sec(m.modelGate);
+    const modelGate = (() => {
+        if (gateIn === undefined)
+            return undefined;
+        const cls = str(gateIn.class);
+        const restore = str(gateIn.restore);
+        const removed = Array.isArray(gateIn.removed) && gateIn.removed.every((r) => typeof r === "string") ? [...gateIn.removed] : undefined;
+        return cls !== undefined && restore !== undefined && removed !== undefined ? { class: cls, removed, restore } : undefined;
+    })();
+    const autoIn = sec(m.autoMode);
+    const autoMode = (() => {
+        if (autoIn === undefined)
+            return undefined;
+        const armed = bool(autoIn.armed);
+        const reason = str(autoIn.reason);
+        if (armed === undefined || reason === undefined)
+            return undefined;
+        return armed === (reason === "armed") ? { armed, reason } : undefined;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
@@ -261,6 +280,8 @@ export function wiringManifestEventData(ev) {
         ...(str(sessionIn.store) !== undefined ? { session: { store: sessionIn.store } } : {}),
         ...(fleet !== undefined ? { fleet } : {}),
         ...(permissionRules !== undefined ? { permissionRules } : {}),
+        ...(modelGate !== undefined ? { modelGate } : {}),
+        ...(autoMode !== undefined ? { autoMode } : {}),
         ...identityFields(ev),
     };
 }
@@ -314,6 +335,8 @@ export function brainStatusEventData(ev) {
         ...(num(ev.maxRetries) ? { maxRetries: ev.maxRetries } : {}),
         ...(num(ev.retryInMs) ? { retryInMs: ev.retryInMs } : {}),
         ...(num(ev.retryAtMs) ? { retryAtMs: ev.retryAtMs } : {}),
+        ...(num(ev.elapsedMs) ? { elapsedMs: ev.elapsedMs } : {}),
+        ...(num(ev.timeoutMs) ? { timeoutMs: ev.timeoutMs } : {}),
         ...(num(ev.errorStatus) ? { errorStatus: ev.errorStatus } : {}),
         ...(typeof ev.errClass === "string" && ev.errClass.length > 0 ? { errClass: ev.errClass } : {}),
         ...identityFields(ev),

package/dist/trace/redact.js

@@ -1,7 +1,7 @@
 import { recordFailOpen } from "../observability/fail-open.js";
 const REDACTION_TOKEN_RE_SRC = String.raw `«redacted(?::[a-z-]{1,16}){0,2}»`;
 const FULL_SECRET_PATTERNS = [
-    [/-----BEGIN[^-]+PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END[^-]+PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
+    [/-----BEGIN[^-](?:[^-](?:[^-]|-(?!-))*)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END[^-](?:[^-](?:[^-]|-(?!-))*)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
     [/\bsk-[A-Za-z0-9_-]{16,}\b/g, "«redacted:key»"],
     [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, "«redacted:gh-token»"],
@@ -220,8 +220,12 @@ function isPemFenceLabel(s, from, to) {
         return false;
     if (!s.startsWith(PEM_KEY_WORD, end - PEM_KEY_WORD.length))
         return false;
-    for (let i = from; i < to; i++)
-        if (s.charCodeAt(i) === 45)
+    if (s.charCodeAt(from) === 45)
+        return false;
+    if (s.charCodeAt(from + 1) === 45)
+        return false;
+    for (let i = from + 1; i < to; i++)
+        if (s.charCodeAt(i) === 45 && s.charCodeAt(i + 1) === 45)
             return false;
     return true;
 }

package/dist/trace/sema-provenance.d.ts

@@ -11,7 +11,16 @@
  * (它是渲染判别,不是 lane 词)。
  */
 import type { SemaProvenance } from "@sema-agent/core";
+/** wire 放行的 lane 词(PROJECTED)。 */
 export declare const SEMA_PROVENANCE_KINDS: readonly ["agent_message"];
+/**
+ * 有意**不**放行的 lane 词(EXCLUDED,逐词记账;运行期落到「丢整键」臂 —— 与闭集外的未知词同臂,但这里的词是
+ * core 词表**内**的、经人裁定不上 wire 的):
+ *  · `cross_session_message` —— core fc52b4d4 [ref] §4.1(session-box drain 铸;`from` 是对端**地址**、`peerMeta`
+ *    携 typed peer 记录)。[ref] 候:本仓不可达(`RunnerDeps.peerDirectory` 零声明点)+ 注入帧渲染形候 [ref] @server③
+ *    表态;与 core-keyset-guard.ts ① 的 `crossSessionMessage` / ①-nested 的 `peerMeta` 同批同判,接线时三处同翻。
+ */
+export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message"];
 /** 本仓两条腿入参的**形**(不是 core 类型:入参是运行期载荷,`kind` 先当 string 收、经闭集才成 typed)。 */
 export interface SemaProvenanceInput {
     kind: string;

package/dist/trace/sema-provenance.js

@@ -1,6 +1,9 @@
 export const SEMA_PROVENANCE_KINDS = ["agent_message"];
+export const SEMA_PROVENANCE_KINDS_EXCLUDED = ["cross_session_message"];
 const _semaProvenanceExhaustive = true;
 void _semaProvenanceExhaustive;
+const _semaProvenanceNoDoubleBook = true;
+void _semaProvenanceNoDoubleBook;
 export function semaProvenanceOrAbsent(p) {
     if (!SEMA_PROVENANCE_KINDS.includes(p.kind))
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.57.0",
+  "version": "7.58.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.2.0",
-    "@sema-agent/settings-schema": "1.4.0",
+    "@sema-agent/core": "7.3.1",
+    "@sema-agent/settings-schema": "1.5.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",