@sema-agent/server 7.71.0 → 7.73.0

package/README.md

@@ -164,7 +164,7 @@ The server is configured entirely through environment variables. The most import
 | `SENSITIVE_WRITE_PATTERNS` | core's recommended set | Sensitive-path write deny list; comma-separated value replaces the set, `off` **or an empty value** disables. Applied unconditionally at the governance layer (independent of client permission mode, lane or settings presence) — including on the `run-local` leg. A value that cannot compile into a guard set (e.g. `/`, a pattern with no path segment) refuses to start |
 | `WRITE_PROTECTED_EXTRA` | unset (engine default table) | **Adds** rows to core's write-protection table (the literal-name table whose hit demotes a surviving `allow` to `ask` on Write/Edit/NotebookEdit). Comma-separated bare names (a bare name matches ANY path segment; a name containing `/` matches a consecutive segment run) or a JSON array of `"name"` strings / `{name, kind}` rows (`kind`: `basename` \| `segment` \| `segment-run`). The value is composed as `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`, so **no default row can be lost**. Unset = no seat is wired = the engine's default table is in force (this server never copies that table). Form discrimination is by content, not by first character: a value containing any JSON structural character (`[ ] { } "`) is parsed as JSON and **must** be a top-level array (a missing pair of brackets refuses to start instead of being split into junk bare names). An empty value, a malformed entry (glob metacharacter, unknown kind, kind/name mismatch) or setting this together with `WRITE_PROTECTED_TABLE_REPLACE` **refuses to start**. Read faces: `GET /v1/capabilities` → `writeProtection.{armed,rows,replaced}`; `GET /v1/diagnostics/wiring` → `writeProtection.{rows,source,droppedDefaultRows}` (operator-only) |
 | `WRITE_PROTECTED_TABLE_REPLACE` | unset (engine default table) | **Replaces the whole** write-protection table (core's seat is whole-table by contract). JSON array only — deliberately no comma shorthand, because a slipped bare string would swap 51 default rows for one. `[]` = the explicit "no write-protection table at all" posture. Replacing logs one **loud** boot line naming every default row you dropped (`write_protection_table_replaced`; the empty posture logs `write_protection_table_disabled`) — use `WRITE_PROTECTED_EXTRA` when you meant to ADD. Same refuse-to-start conditions as its sibling, plus: both knobs set = two writers on one surface = refuses to start |
-| `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → no gate, core's `off` default). This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
+| `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → core's `off` default). Since 7.73.0 (core 7.15.0) `off` no longer means "no gate at all": the READ BOUNDARY (built-in read-deny tiers + workspace containment) is judged under **every** doctrine, so on the `off` lane a deny-listed read, an out-of-root read or a recursive read form still raises exactly ONE mandated approval (no stored rule and no auto-mode classifier can clear it); `shellGate` now governs only the RESIDUAL shell risk. Non-readers (`rm`/`curl`/`git`/`npm`) and ordinary in-workspace reads stay unasked on that lane. This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
 | `PERMISSIONS_DISABLE_AUTO_MODE` | `false` | Local mirror of CC `permissions.disableAutoMode` — the **org deny** bit for `permissionMode:"auto"` (paired with core's intent-arming rule). **Tighten-only**: `true` folds every principal's `runtimeCaps.autoMode` to `false` (a center grant cannot flip it back); unset leaves caps untouched, so on a center-less box a shell asking for `auto` **arms** the classifier once the paired core (intent-arming rule "requested ∧ classifier seat ∧ `autoMode !== false`" — absence is not a deny) is installed; on core 7.2.0 the engine still uses the old "org grant" rule (`permissionModeAuto.intentArming:false`), so the self-check answers `armed:true` only for a center-granted principal and `deployment_incapable` on a center-less box. Boolean word table; any other value refuses to start. Self-check: `GET /v1/capabilities?permissionMode=auto` → `permissionModeAuto.{armed, reason, model}` (USAGE §9.4) |
 | `SCRATCHPAD_SWEEP_TTL_MS` | 7 days | Idle-reap window for per-session scratchpad dirs (by dir mtime; `0` disables). The scratchpad is **ephemeral by contract**: replica-local disk, NOT part of the durable-suspend persistence set — a resume on a different replica, or after a sweep, starts with an empty dir (same two-track posture as the Agent SDK hosting doc: conversation persists, working-directory artifacts don't). Raise/disable only on single-replica deployments that park approvals for longer than the window |
 | `MODEL_CONNECT_TIMEOUT_MS` | `30000` | Gateway connect timeout |

package/USAGE.md

@@ -161,7 +161,8 @@ MODEL_DEGRADE_ON=rate_limit,breaker_open   # 可选,反应式触发器子集;词
   **坏形/坏词/未知键 ⇒ 丢掉这条 `compat` 声明、模型本体保留**,并打一条 `model_compat_dropped`
   点名 warn(引擎回落到自己的推断 = 今天的行为);一条写坏的声明**不会**让这只模型或整套目录消失。
 - 反应式降级 brain 包在**最外层**;fallback brain 用自己的凭据(decorator 清掉主模型的 per-call key 防外泄给别的 provider)。**坑**:`MODEL_DEGRADE_TO` 最好别和被限流的是同一网关/账号,否则反应式切过去照样撞同一个 rate_limit。
-- **定价怎么设**:`model.cost` 来自 `MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE`(**USD per 1M tokens**,默认 0 = `costUsd` 读 0)。云模型(如 review-gw 的 deepseek-v4-flash)必须设,否则 spend 恒为 $0;本地自托管(qwen)留 0 即对(无 per-token 外部花费)。字段名是 `costUsd`,**非美元计价的网关要先折算**(如 DeepSeek 官方 CNY ÷ 汇率)。配置控制面管的模型走 `CenterModel.cost`(中心存价、不存 secret)。
+- **定价怎么设**:`model.cost` 来自 `MODEL_COST_INPUT/OUTPUT/CACHE_READ/CACHE_WRITE`(**USD per 1M tokens**)。**四键一个都不设 = 未定价**:成本读面**缺席**(`result.stats.costMicroUsd` 整键不出、`costBreakdown` 不产、`/v1/capabilities.pricingConfigured=false`),不是 `$0` —— 消费端应渲成「未知」。设其中任一键 ⇒ 四键在场(未设的按 0)。本地自托管(qwen)真的没有 per-token 外部花费时,请**显式**把四键设成 `0`:那是一次「声明免费」,读面照常发 `costMicroUsd:0` 且 `pricingConfigured=true`。云模型(如 review-gw 的 deepseek-v4-flash)必须设真价,否则 spend 无从计算。字段名是 `costUsd`,**非美元计价的网关要先折算**(如 DeepSeek 官方 CNY ÷ 汇率)。配置控制面管的模型走 `CenterModel.cost`(中心存价、不存 secret;名册行不带 `cost` = 该模型未定价,同上)。
+- **成本天花板要有价才咬得住**:`MAX_TASK_COST_USD` / `MAX_PRINCIPAL_COST_USD` 量的是 `costUsd`,未定价的模型算不出成本 ⇒ 这两道闸**永不触发**。目录里一只带价模型都没有却配了天花板时,boot 会打一条 `cost_ceiling_without_pricing` 告警(不拒启);token 轴的 `MAX_TASK_TOKENS` 不受影响。
 - 成本计量**自动开**:从 config 的 `model.cost`(per-1M 绝对 USD)注入 `pricing`,core 算出权威的整数 `costMicroUsd`(避免浮点累计误差)。`/metrics` 新增:`model_cost_micro_usd_total{model}`(覆盖所有 brain 调用=主任务+异步+council 子任务的总花费)、`brain_first_token_ms`(网关 hang 早警)、`brain_call_latency_ms`、`tool_calls_total{name,ok}`、`budget_exceeded_total{code}`、`cost_quota_rejected_total`、`degraded_total{reason}`(1.40 降级)。
 - **近预算降级 vs 硬闸**:降级(`MODEL_DEGRADE_TO`,到 `atCostFraction` 切便宜模型)是**撑长**预算、任务仍完成(出口质量下降、发 `task.degraded` 事件可告警);硬闸(`maxCostUsd` 全额)仍在,切了便宜模型还超全额 → `limits.max_cost_exceeded` 停。
 - **`METRICS_TOKEN`**(可选,只读):设了它,`GET /metrics`+`/metrics/summary` 接受**它或** `SERVICE_AUTH_TOKEN`。**全 fleet 设同一个值** → 管理端(sema-web,规划名 sema-admin)用**一个** token 拉所有 worker 的指标,**无需持有各 worker 的全权 `SERVICE_AUTH_TOKEN`**(不破坏 secret 边界)。即使外泄也只暴露指标(只读)。
@@ -1292,6 +1293,16 @@ tag 词表与每条的最坏后果见 `docs/FAIL-OPEN-CENSUS.md`。引擎装配
 "bypassPermissions"` 时是调用方要的姿态,降为 **info** 并标 `expected`——只有没表态落到引擎默认 off 的无壳直连
 形才 warn。
 
+🔴 **`shell-gate-off` 这条注的语义自 7.73.0(core 7.15.0)起收窄,文案由引擎改写**:`off` 档**不再**意味着
+「这条会话的 shell 完全没有门」。**读边界**(内建读拒表 + 工作区容纳面)现在**每一档都判**,`shellGate` 只管
+**剩余**风险 ⇒ `off` 车道下一条读拒表路径(`cat .claude/settings.json`)、工作区外路径,或递归读形
+(`grep -r … .` / `find .` / `ls -R` / `du .`)都会产**恰一个 mandated 审批**(规则与 auto 分类器都清不掉);
+**非读**命令(`rm` / `curl` / `git` / `npm`)与工作区内的普通读在 `off` 下仍然零审批。注文案里那句
+「the read boundary is still judged on every command」就是这件事。⇒ **运维侧后果**:一台把 `bypassPermissions`
+当「无人值守直跑」用的部署,现在会在这三类命令上落审批(无活体席 ⇒ durable park,出现在 `GET /v1/approvals`)。
+要让它们重新不问,得从**读面**下手(`READ_FACE` / `READ_DENY_BUILTIN_TIERS` / `READ_DENY_BUILTIN_EXCLUDE`,
+见 `docs/DEPLOY-PREREQS.md`),`permissionMode` 那根杆子够不着它。
+
 ### 9.1 limits.approachNotice(6.1.0 起)
 
 引擎默认在上下文用量到 80%/95% 时各注入一次接近提示(SSE 上是 `steering_injected` 帧、

package/dist/approval-card.d.ts

@@ -328,27 +328,26 @@ declare const DenialLimitFallbackSchema: z.ZodObject<{
     autoDenyAfterMs: z.ZodNumber;
 }, z.core.$strict>;
 export type DenialLimitFallback = z.infer<typeof DenialLimitFallbackSchema>;
-/** S-185(core 7.10.0 [ref])—— **分类器为什么答不了**。`cause` 是 core 的闭集词
- *  (`AUTO_MODE_UNAVAILABLE_CAUSES`;core 7.12.0 起 = error | timeout,`breaker_open` 随熔断族退役),
- *  本仓**刻意不枚举**它:词表的单一
- *  属主在 core,抄一份的形会在 core 加词那天把新词静默吞成缺席 —— 而丢的正是「这次不可用是新出现的那
- *  一类」这条信息(与 `AskRequest.origin` 顶注同一条纪律)。判据只到「非空串」这一层形门。
- *  `.strict()` + 单成员必填:core 将来给这只对象加成员时本读面当场判假、**整键不铸**,新成员必须由人
- *  处置过才上 wire;而一个**没有 cause** 的空壳等于说「分类器坏了但说不出为什么」,比不说更坏。 */
+/**
+ * ⚰️ **退役成员的形(server 7.69.0–7.71.0 铸过,7.72.0 起永不再铸)** —— core 7.14.0 [ref] 把
+ * `classifierUnavailable` 从 ask 侧**整族**删掉(事实改骑 `GateDisposition.denied.cause`),所以本仓
+ * 的**铸造**腿(`buildApprovalCard` / 活卡帧 / inbox 行)本批全部摘掉;窄读函数
+ * `readClassifierUnavailable` 与对 core 型面的合规钉连同它们的素材一起删(素材没了,钉的两端只剩一端)。
+ *
+ * 🔴 **这只 schema 本身留着,而且是承重的,不是没删干净**:`ApprovalCardSchema` 是 `.strict()`,
+ * 而它同时是 `approval_ask.card_json` 这张**耐久列**的读契约(读侧三个 `safeParse`:重放腿、幂等重入、
+ * 对账扫描)。把成员从 strict schema 上删掉 ⇒ 7.69.0–7.71.0 铸下、升级时**仍然 pending** 的那些行
+ * 当场判假 ⇒ 「跳过 + 一次 warn」:人手上那张卡在重连后变不回来、幂等重入退成 park。
+ * ⇒ 一条耐久投影的 schema **必须读得懂它自己写过的每一版**;写侧只写当前引擎供得出的键,读侧接受
+ * 全部历史成员。这不是给退役键开特例,这是 strict + durable 这一组合的内生义务(同样的处置将适用于
+ * 未来任何一次键退役)。
+ *
+ * 形保持原样(单成员 `cause` 必填、`.strict()`):它描述的是**已经写在库里的字节**,不许再动。
+ */
 declare const ClassifierUnavailableSchema: z.ZodObject<{
     cause: z.ZodString;
 }, z.core.$strict>;
 export type ClassifierUnavailable = z.infer<typeof ClassifierUnavailableSchema>;
-/**
- * `AskRequest.classifierUnavailable`(core 7.10.0 [ref])的**边界窄读** —— 活卡帧与 `card_json` 的唯一
- * 铸造点(与 {@link readDenialLimitFallback} 同款分工),两面结构性同值。
- *
- * 🔴 **缺席不是断言**:缺席同时覆盖「分类器答上了」「这只 ask 没资格走分类器」「本部署没接分类器」
- * 三形(core d.ts 逐字:read presence, never absence),消费端禁读成「分类器好着呢」。
- * 🔴 **echo-only**:server 不据它做任何裁决 —— 熔断/超时的处置全在 core 的分类器站,据本键在本仓自铸
- * 第二套回落判据就是同一语义面两个写者(源头修复纪律)。
- */
-export declare function readClassifierUnavailable(req: unknown): ClassifierUnavailable | undefined;
 /**
  * `AskRequest.denialLimitFallback`(core 7.4.0 [ref])的**边界窄读** —— 活卡帧与 `card_json` 的唯一铸造点
  * (与 {@link readRuleOffersAbsence} / {@link readProbeCause} 同款分工),两面结构性同值。

package/dist/approval-card.js

@@ -238,13 +238,6 @@ const _denialLimitFallbackConformance = [true, true];
 void _denialLimitFallbackConformance;
 const DenialLimitFallbackEnvelopeSchema = z.object({ denialLimitFallback: DenialLimitFallbackSchema.optional() });
 const ClassifierUnavailableSchema = z.object({ cause: z.string().min(1).max(MAX_IDENT) }).strict();
-const _classifierUnavailableConformance = [true];
-void _classifierUnavailableConformance;
-const ClassifierUnavailableEnvelopeSchema = z.object({ classifierUnavailable: ClassifierUnavailableSchema.optional() });
-export function readClassifierUnavailable(req) {
-    const parsed = ClassifierUnavailableEnvelopeSchema.safeParse(req);
-    return parsed.success ? parsed.data.classifierUnavailable : undefined;
-}
 export function readDenialLimitFallback(req) {
     const parsed = DenialLimitFallbackEnvelopeSchema.safeParse(req);
     return parsed.success ? parsed.data.denialLimitFallback : undefined;
@@ -312,7 +305,6 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
     const ruleEvidence = readRuleEvidence(req);
     const ruleOffersAbsence = readRuleOffersAbsence(req);
     const denialLimitFallback = readDenialLimitFallback(req);
-    const classifierUnavailable = readClassifierUnavailable(req);
     const toolCallId = clip(source.toolCallId, MAX_IDENT);
     const sourceTaskId = clip(source.sourceTaskId, MAX_IDENT);
     const sourceAgentName = clip(source.sourceAgentName, MAX_AGENT_NAME);
@@ -335,7 +327,6 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
         ...(source.ruleOffers !== undefined && source.ruleOffers.length > 0 ? { ruleOffers: source.ruleOffers.map(copyRuleOffer) } : {}),
         ...(ruleOffersAbsence !== undefined ? { ruleOffersAbsence } : {}),
         ...(denialLimitFallback !== undefined ? { denialLimitFallback } : {}),
-        ...(classifierUnavailable !== undefined ? { classifierUnavailable } : {}),
         ...(source.fromSubagent === true ? { fromSubagent: true } : {}),
         ...(sourceTaskId !== undefined ? { sourceTaskId } : {}),
         ...(sourceAgentName !== undefined ? { sourceAgentName } : {}),

package/dist/boot/config-center.d.ts

@@ -7,6 +7,7 @@ import { type ServiceConfig } from "../config.js";
 import { type ModelKeyRef } from "../key-resolver.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
+import type { UnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import { type RestartSignal } from "../config-center/facade.js";
 import { type ConfigApplyLedgerView } from "../config-center/apply-ledger.js";
 import type { LimitSync } from "./limit-sync.js";
@@ -45,12 +46,16 @@ export interface ConfigCenterRuntime {
      *  `swapRunnerDeps`(core 7.10.0 `Runner.swapDeps` 一扇门;5.49 起的 `swapModels` 口在 7.10.0 退役、
      *  本参数同语义改名)= **可换席**的换装口:模型面 plane 变更候选在 commit 前喂给全部 boot Runner
      *  原子换代(在场 ⇒ models-tiers defer/restart 臂退役,缺席 ⇒ 旧 defer 行为逐字保留);S-174 起
-     *  read **face** 席也走同一只函数(见 refresh 拍里的 `applyCenterReadFace` 调用点)。 */
+     *  read **face** 席也走同一只函数(见 refresh 拍里的 `applyCenterReadFace` 调用点)。
+     *  `ceilingVerdict`(S-232)= 「配了 $ 天花板但目录未定价」这条判决的活载体,与 `limitSync` **同族同序**
+     *  (commit 之后、零 await 内重判一次;判决不翻转就静默)。缺席 = 这条腿本部署没装配(run-local 一次性
+     *  CLI 之后不再有刷新拍,它继续用纯判据判一次)。 */
     startRefreshLoop(a: {
         runnerTierFrozen: boolean;
         pricing: ReturnType<typeof buildPricing>;
         limitSync?: LimitSync;
         swapRunnerDeps?: (next: SwappableDeps) => void;
+        ceilingVerdict?: UnpricedCeilingVerdict;
     }): void;
     /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。 */
     stopRefreshLoop(): void;

package/dist/boot/config-center.js

@@ -510,7 +510,7 @@ export async function createConfigCenterRuntime(ctx) {
             }
         },
         startRefreshLoop(a) {
-            const { runnerTierFrozen, pricing, limitSync, swapRunnerDeps } = a;
+            const { runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict } = a;
             if (configProvider) {
                 const ccRef = config.configCenter;
                 let refreshInFlight = false;
@@ -594,6 +594,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 mutateInPlace(pricing, buildPricing(config.models));
                                 keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
                                 limitSync?.sync();
+                                ceilingVerdict?.judge();
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
                                 applyLedger.applied(tickGen, r.effective.version);
@@ -741,6 +742,7 @@ export async function createConfigCenterRuntime(ctx) {
                     mutateInPlace(pricing, buildPricing(config.models));
                     keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
                     limitSync?.sync();
+                    ceilingVerdict?.judge();
                     applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
                     applyLedger.applied(lateGen, r.effective.version);
                     if (planeDeferredLate)

package/dist/boot/memory-boundary.d.ts

@@ -9,10 +9,26 @@
  * `~/.ai-agent`(或 `AGENT_DATA_DIR`),默认围栏是任务 cwd —— 两者天然不相交:用户说「记住 X」,模型照
  * 提示词去 Write,拿回一个 `path_not_in_root`,而回执早就发出去了。
  *
- * 判据形态 = **纯函数 + 启动 warn,不拒启**。理由是诚实:共享挂载 / bind mount / operator 自己把根塞进
- * `additionalDirectories`,都是真实可行的部署形,而我方在 boot 期看不全。看得全的是「按我们自己接的线,
+ * 判据形态 = **纯函数 + 启动 warn,不拒启**。理由是诚实:共享挂载 / bind mount / 部署方自己在别处开了写通道,
+ * 都是真实可行的部署形,而我方在 boot 期看不全。看得全的是「按我们自己接的线,
  * 这条链**结构上**走不通」——那句必须说出来。围栏根算不出来时**不说话**(判不了就闭嘴,别把猜测当告警)。
  *
+ * 🔴 **已登记的判据限度(不在本批射程,别把它读成「判据已闭合」)**:② 号 warn 今天唯一算得出围栏根的
+ * 腿是 `REMOTE_EXEC` 未设的 in-process 形(`boot/stores.ts` 的 `containmentRoots`),而**恰恰是这条腿
+ * 没有文件工具** —— 亲读装的这台 core:`prepare-execution-env.js` 的
+ * `handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined`,本仓不设 `REMOTE_EXEC` 时
+ * `executionEnvFactory` 恒 `undefined` ⇒ `handsEnabled=false` ⇒ `prepareHandsMount` 整个不跑。所以这条
+ * warn 描述的失败形(「模型照提示词去 Write,拿回 `path_not_in_root`」)在该腿上并不成立:真相是**一只
+ * 文件工具都没有**,而按它给的第一条恢复路径(把根挪进 workspace)会让 warn 闭嘴却仍然写不成。
+ * 把判据换成「执行能力 + core 自己的 advertised-writable-dir 准入结局」是一次**新的探测臂**(要读 per-task
+ * 的准入结果,而本模块是 boot 期纯函数),按复审停机纪律不在提货批里开;登记在此,免下一位重新发现。
+ *
+ * 🔴 **不再劝 `additionalDirectories`**(core 7.16.0 [ref] 提货):每个 scope 的家是 `<挂载平面>/<label>`,
+ * 平面本身谁的家都不是。交配置根 = 连引擎控制面(`.engine`)一起放行;交平面 = 把每个兄弟 scope 的家
+ * (含 org 只读层)一起交给模型;交写家 operator 事前说不出口(label 的真源是引擎注册簿),而 core 的
+ * 准入席([ref])本来就自动把写家教给模型。三条路各自要么危险要么多余 ⇒ 整条建议删,只留「挪根」与
+ * 「表态 capable=false」两条。
+ *
  * ⚠️ 这不是 fail-open 的托词:真正的 fail-closed 归属面在别处(多租户记忆整体 dark、remote lane 默认 dark)。
  * 本模块判的是「已经决定要开记忆」之后的**可达性**,而可达性的证据一半在部署环境里,不在进程里。
  *
@@ -47,8 +63,8 @@
  * 工具就跑在**这台机器**的 fs 上(`hostSemanticsLane`,与 core 的 remote 判决是两根轴,见下方 facts 注),
  * 记忆根也在这台机器上,「执行车道与记忆根共享文件平面」这个 capable=true 所断言的**车道级事实**由
  * 构造成立。剩下的围栏维(记忆根是否落在该次任务的 fs 授权边界内)在 in-process 上**同样存在**而 core
- * 并不 withhold——它由本模块的 ② 号 warn、fs 门的 `path_not_in_root` 拒绝、`additionalDirectories`
- * 旋钮这套既有处置管,不归 withhold 判据管。所以 host 腿自动 true 与 in-process 的默认行为**同等诚实**。
+ * 并不 withhold——它由本模块的 ② 号 warn、fs 门的 `path_not_in_root` 拒绝、以及 core 准入席自动放行写家
+ * ([ref])这套既有处置管,不归 withhold 判据管。所以 host 腿自动 true 与 in-process 的默认行为**同等诚实**。
  * 沙箱腿(e2b/k8s/ssh/local-docker)文件平面在沙箱盘,withhold 是对的,恒不自动。
  *
  * ## 为什么不是「围栏覆盖记忆根」的更严合取
@@ -69,7 +85,13 @@ export declare function effectiveMemoryPersistenceCapable(config: {
 }): boolean | undefined;
 /** boot 期可知的全部事实。每一位都必须由调用点从真配置/真装配结果取,禁在本模块内重算(重算=第二真源)。 */
 export interface MemoryWriteBoundaryFacts {
-    /** 记忆引擎的根(`memoryEngine.root`)。`undefined` = 引擎未接 ⇒ 本判据整体不适用。 */
+    /** 引擎的**挂载平面**根 —— 引擎真正读写条目的那棵树,由 `memoryMountRootOf(backend, root)` 单铸点取
+     *  (file 腿 = `<配置根>/memory`,两只 SQL 孪生不钉平面 ⇒ 回到配置根)。`undefined` = 引擎未接 ⇒ 本判据
+     *  整体不适用。
+     *  🔴 **不是配置根**(2026 提货批订正):配置根比挂载平面高一层,拿它判包含会把「记忆目录在围栏里、
+     *  配置根不在」这一真实可行的部署形误报成「结构性写不进」——而那台机器上模型其实存得下。
+     *  core 7.16.0([ref])之后写家还要再深一层(`<平面>/<label>`),但 label 归引擎注册簿,boot 期说不出口;
+     *  平面是**包含关系上等价**的那一只(家恒为平面的直接子目录),所以判据停在平面,不猜 label。 */
     memoryRoot: string | undefined;
     /** 执行车道名,只进文案(`config.remoteExec?.provider ?? "in-process"`)。 */
     lane: string;

package/dist/boot/memory-boundary.js

@@ -45,12 +45,12 @@ export function buildMemoryWriteBoundaryAudit(facts) {
         warnings: [
             {
                 tag: "memory_root_outside_write_boundary",
-                detail: `the memory engine root (${memoryRoot}) is outside every file-tool containment root known at boot ` +
-                    `(${containmentRoots.join(", ")}). Memory has no write TOOL — the model saves by writing files into that root — ` +
-                    `so a "remember this" turn will be answered with a save the file tools structurally refuse (path_not_in_root). ` +
-                    `Fix it in one of three ways: ${relocateRoot}, hand the root to tasks via ` +
-                    `additionalDirectories, or declare MEMORY_PERSISTENCE_CAPABLE=false so the model is told up front that this ` +
-                    `deployment cannot save instead of receipting a write that never lands.`,
+                detail: `the memory engine mount plane (${memoryRoot}) is outside every file-tool containment root known at boot ` +
+                    `(${containmentRoots.join(", ")}). Memory has no write TOOL — the model saves by writing files into the write ` +
+                    `scope's home under that plane — so a "remember this" turn will be answered with a save the file tools ` +
+                    `structurally refuse (path_not_in_root). ` +
+                    `Fix it in one of two ways: ${relocateRoot}, or declare MEMORY_PERSISTENCE_CAPABLE=false so the model is told ` +
+                    `up front that this deployment cannot save instead of receipting a write that never lands.`,
             },
         ],
     };

package/dist/boot/memory-consolidation.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "../trace/redact.js";
+import { memoryMountRootOf } from "../memory-scope.js";
 import { expandTiers, MemoryEngine, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
@@ -109,7 +110,7 @@ export function buildStopDetailAudit(input) {
 export function createMemoryConsolidationFaces(store, input) {
     const engine = new MemoryEngine({
         backend: store.backend,
-        memoryDir: store.root,
+        memoryDir: memoryMountRootOf(store.backend, store.root),
         consolidation: {},
         ...(input.provenance !== undefined ? { provenance: input.provenance } : {}),
         ...(input.onIncident !== undefined ? { onIncident: input.onIncident } : {}),

package/dist/boot/runner-deps.d.ts

@@ -84,26 +84,42 @@ export interface RunnerDepsCtx {
      *
      * 本键从「差异键」升进{@link createSharedRunnerDeps 共享基座}。修前它**只**挂在 subRunner 上,主
      * runner 靠 per-task `spec.checkpointStore` 拿店 —— 而 core 的 `run_workflow` 是挂在**主** Runner
-     * (`prepare-caps-and-workflow.js:244` 的 `runner: runnerSelf`;core 7.12.0 亲核行号,B-060 票据引的
-     * :249 是 7.11.2 的坐标)上的,workflow 子代的 childSpec 不带
-     * `checkpointStore`(`orchestration/workflow-primitives.js:80-81` 只透传 `"disabled"` 这一种状态),
-     * 于是子代的 `resolveCheckpointStore(spec, deps)` 落到主 runner 这一格 = `undefined`
-     * ⇒ `parkLane {capable:false, reasons:["no_checkpoint_store"]}` ⇒ 受门的调用不是 park 而是
-     * `delegation.ask_unresolvable{parkLaneExisted:false}` 直接拒(过度拒绝,S-185 的 `/decide`
-     * 第三车道在这条路径上结构性不可达)。
+     * (`prepare-caps-and-workflow.js:279` 的 `runner: runnerSelf`;**core 7.14.0 亲核行号**,7.12.0 时是
+     * :244、B-060 票据引的 :249 是 7.11.2 的坐标 —— 这一格每版都在漂,引用前必须对着装树重读)上的。
+     *
+     * ⚠️ **B-060 当初写下的病理有一半已被 core 7.14.0 消解,如实订正**([ref] 的 `CheckpointSeat` 重构):
+     *  · **7.13.0 及以前**:`orchestration/workflow-primitives.js` 只在父侧
+     *    `parentCheckpointStoreDisabled === true` 时给子代盖 `"disabled"`,**不把父侧真店透传给子代**
+     *    ⇒ 子代的 `resolveCheckpointStore(spec, deps)` 落到主 runner 这一格 = `undefined`
+     *    ⇒ `parkLane {capable:false, reasons:["no_checkpoint_store"]}` ⇒ 受门的调用不是 park 而是
+     *    `delegation.ask_unresolvable{parkLaneExisted:false}` 直接拒(过度拒绝)。
+     *  · **7.14.0 起**:core 在 prepare 一次铸出 `checkpointSeat = checkpointSeatOf(spec, resolved)`
+     *    (`prepare-task.js:262`),两条委派车道**逐字复制**它到子代 —— workflow 腿经
+     *    `parentCheckpointStore: checkpointSeat`(`prepare-caps-and-workflow.js:335`)落到
+     *    `workflow-primitives.js:80`(现在的条件是「父侧有座 ∧(座是 disabled ∨ 子 spec 没自带店)」⇒
+     *    **真店也透传**),Task 腿经 `ToolExecuteContext.checkpointStoreForChildren`。
+     *  ⇒ 「子代拿不到店」这条病路 core 侧已经堵死。**但本席仍然承重**,理由是那只座**本身**就从
+     *    `resolveCheckpointStore(spec, deps)` 来:主 runner 这一格空着、而 spec 又没带店时,座就是
+     *    `undefined`,子代照样什么都拿不到。本席不是 core 单源的第二个写者,它就是 core 读的那个 deps 格。
      *
      * 🔴 host 腿的读数判据是**core 侧硬的**,不是本仓的但愿:`resolveCheckpointStore`
-     * (`checkpoint-store.js:367`)**spec 优先**——`spec.checkpointStore` 在场就用它、`"disabled"` 就是
-     * 关、只有缺席才落 deps。而本仓 host 腿恒经 `resolveSpec` 的 durableEnabled 分支盖上**同一个实例**,
-     * 且 `durableEnabled ⇔ checkpointStore !== undefined`(`boot/coordinators.ts:70` 与 main.ts 的构造
-     * 条件同源)⇒ 每一条经 `resolveSpec` 的腿看到的店逐字同一只。
+     * (`checkpoint-store.js:370`,7.14.0 亲核)**spec 优先**——`spec.checkpointStore` 在场就用它、
+     * `"disabled"` 就是关、只有缺席才落 deps。而本仓 host 腿恒经 `resolveSpec` 的 durableEnabled 分支盖上
+     * **同一个实例**,且 `durableEnabled ⇔ checkpointStore !== undefined`(`boot/coordinators.ts:70` 与
+     * main.ts 的构造条件同源)⇒ 每一条经 `resolveSpec` 的腿看到的店逐字同一只。
+     *
+     * 🔴 **core 7.14.0 新加的响亮拒(装配纪律,本仓已合规但必须知道)**:`agents/subagent.js` 在
+     * `wantsBackground` 臂上会检查「`ScenarioDeps.checkpointStore`(→ `bg.checkpointStore`)与本 run 的座
+     * **不是同一只**」⇒ `configError("config.invalid_checkpoint_store")` **抛**。本仓 main.ts 的
+     * `scenarioDeps.checkpointStore` 与本席是同一个 `const`,run-local 两边都不接 ⇒ 两条腿都不触发;
+     * 哪天有人给这两处接了不同的店,失败是响亮的而不是静默半场。
      *
      * ⚠️ **如实登记一处不经解析器的直读**(codex 交叉复审提名,亲读 core dist 确认):
-     * `core/runner/run-terminal-adoption.js:74` 读的是 `runner.deps.checkpointStore` **本身**,不走
-     * `resolveCheckpointStore`。它是「宿主任务 park 时,把没排空的 steer / follow-up 迁移到 park token 上」
-     * 那一步 —— 修前主 runner 这一格是空的,于是**整段迁移静默不跑**(那些输入随本腿一起丢,只留
-     * `task.user_followup_undrained` 一类通告)。接上之后它开始真的跑。方向是修好一条本就该在的腿,
-     * 但它**不是**「host 腿字节不变」的一部分,所以写在这里而不是混进上面那句。
+     * `core/runner/run-terminal-adoption.js:80`(7.14.0 亲核;7.13.0 时是 :74)读的是
+     * `runner.deps.checkpointStore` **本身**,不走 `resolveCheckpointStore`,**也不走座** —— 所以 7.14.0
+     * 的座重构对它一个字节都没改,本席对它仍是唯一来源。它是「宿主任务 park 时,把没排空的 steer /
+     * follow-up 迁移到 park token 上」那一步 —— 修前主 runner 这一格是空的,于是**整段迁移静默不跑**
+     * (那些输入随本腿一起丢,只留 `task.user_followup_undrained` 一类通告)。接上之后它开始真的跑。
      *
      * 🔴 这一席是**部署腿级**的答案,不是「哪只 Runner」的属性:一条腿要么有赎回口(HTTP 面的
      * `/v1/approvals/:id/decide` + resume 家族)、于是它的每只 Runner 都该有店;要么没有(`run-local`

package/dist/boot/runner-deps.js

@@ -2,6 +2,7 @@ import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
 import { listCollabWorkflows, resolveCollabWorkflow } from "../capabilities/collab-workflows.js";
 import { fleetBackgroundChildPublisher, FleetEventBus } from "../fleet/fleet-bus.js";
+import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
@@ -91,6 +92,7 @@ export function createSharedRunnerDeps(ctx) {
 }
 export function createRunnerDeps(ctx) {
     const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
+    const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -207,7 +209,7 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "memory") {
-                logger.warn("memory_consolidation_failed", { sessionId: ctx.sessionId, info: String(err) });
+                memoryEngineIncident(err, ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : undefined);
                 return;
             }
             if (ctx.phase === "mcp") {

package/dist/boot/stores.js

@@ -20,7 +20,8 @@ import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/tas
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
-import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor } from "../memory-scope.js";
+import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
+import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
@@ -193,7 +194,7 @@ export async function openStores(ctx) {
         });
     }
     else {
-        memoryEngine = memoryEngineBackendFor(config);
+        memoryEngine = memoryEngineBackendFor(config, undefined, createMemoryEngineIncidentSink({ logger, metrics }));
         if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
             logger.warn("memory_engine_dir_defaulted", {
                 root: memoryEngine.root,
@@ -206,8 +207,9 @@ export async function openStores(ctx) {
         const hostSemanticsLane = lane === undefined || lane === "host";
         const coreRemoteExecutionEnv = config.remoteExec !== undefined;
         const containmentRoots = lane === undefined ? [process.cwd()] : [];
+        const memoryMountRoot = memoryEngine ? memoryMountRootOf(memoryEngine.backend, memoryEngine.root) : undefined;
         const audit = buildMemoryWriteBoundaryAudit({
-            memoryRoot: memoryEngine?.root,
+            memoryRoot: memoryMountRoot,
             lane: lane ?? "in-process",
             hostSemanticsLane,
             coreRemoteExecutionEnv,
@@ -216,7 +218,7 @@ export async function openStores(ctx) {
             engineBackend: config.memoryEngineBackend,
         });
         for (const w of audit.warnings)
-            logger.warn(w.tag, { detail: w.detail, lane: lane ?? "in-process", root: memoryEngine?.root ?? null });
+            logger.warn(w.tag, { detail: w.detail, lane: lane ?? "in-process", root: memoryMountRoot ?? null });
         if (config.memoryPersistenceCapable === undefined && effectiveMemoryPersistenceCapable(config) === true) {
             logger.info?.("memory_persistence_capable_auto_declared", {
                 lane: lane ?? "in-process",

package/dist/boot/unpriced-ceiling-verdict.d.ts

@@ -0,0 +1,15 @@
+import type { ServiceConfig } from "../config-types.js";
+import type { Logger } from "../observability/logger.js";
+export interface UnpricedCeilingVerdictCtx {
+    /** 活配置(config-center 热应用就地改写的**同一个**对象——所以每次 `judge()` 读到的是当代值)。 */
+    readonly config: Pick<ServiceConfig, "models" | "maxTaskCostUsd" | "maxPrincipalCostUsd">;
+    readonly logger?: Logger;
+}
+export interface UnpricedCeilingVerdict {
+    /** 按**当下**的目录与限额重判一次。判决与上一次相同 ⇒ 静默;翻成「有」⇒ 一条 warn;翻成「无」⇒
+     *  一条 info `cost_ceiling_warning_cleared{reason}`(告警为什么不再成立,是运维要看见的事实;静默回落
+     *  读不出来,而不带原因的「恢复」在护栏被撤光时是假话)。幂等、零抛。 */
+    judge(): void;
+}
+export declare function createUnpricedCeilingVerdict(ctx: UnpricedCeilingVerdictCtx): UnpricedCeilingVerdict;
+//# sourceMappingURL=unpriced-ceiling-verdict.d.ts.map

package/dist/boot/unpriced-ceiling-verdict.js

@@ -0,0 +1,39 @@
+import { buildUnpricedCeilingNotice, costCeilingPricingPosture, unpricedCeilingClearReasonOf } from "../config.js";
+function verdictKey(notice) {
+    return notice?.fields.ceilings;
+}
+export function createUnpricedCeilingVerdict(ctx) {
+    const { config, logger } = ctx;
+    let last;
+    let judged = false;
+    return {
+        judge() {
+            const notice = buildUnpricedCeilingNotice(config.models, config);
+            const key = verdictKey(notice);
+            const first = !judged;
+            judged = true;
+            if (!first && key === last)
+                return;
+            last = key;
+            if (notice) {
+                logger?.warn?.(notice.event, notice.fields);
+                return;
+            }
+            if (first)
+                return;
+            const reason = unpricedCeilingClearReasonOf(costCeilingPricingPosture(config.models, config));
+            if (reason === undefined)
+                throw new Error("unpriced-ceiling verdict: notice absent but no clear reason — judge and posture disagree");
+            logger?.info?.("cost_ceiling_warning_cleared", { reason, note: CLEAR_NOTE[reason] });
+        },
+    };
+}
+const CLEAR_NOTE = {
+    no_ceiling: "every $ ceiling (MAX_TASK_COST_USD / MAX_PRINCIPAL_COST_USD) is now unset — the earlier cost_ceiling_without_pricing " +
+        "warning no longer applies, but note this deployment has NO $ cost guardrail (by configuration, not by omission).",
+    empty_catalog: "the effective catalog is empty — there is nothing to price, so the earlier cost_ceiling_without_pricing warning is " +
+        "moot until models arrive; the $ ceilings still cannot fire.",
+    priced: "the effective catalog declares a price table again — the $ ceilings (MAX_TASK_COST_USD / MAX_PRINCIPAL_COST_USD) " +
+        "can fire once more. This reverses the earlier cost_ceiling_without_pricing warning.",
+};
+//# sourceMappingURL=unpriced-ceiling-verdict.js.map

package/dist/brain.js

@@ -1,6 +1,6 @@
 import { adjudicateModelRoute, createAnthropicBrain, createCircuitBreakerBrain, createDegradingBrain, createFailoverBrain, createOpenAIBrain, createRoutingBrain, hasAuthCarrier, resolveRouteCredential, routeRefusalText, } from "@sema-agent/core";
 import { normalizeBaseUrl } from "@sema-agent/core";
-import { MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT } from "./config-types.js";
+import { buildDefaultResilience } from "./config-types.js";
 import { resolveModelApiKey } from "./key-resolver.js";
 function isOffDeploymentRoot(baseUrl, config) {
     if (!baseUrl)
@@ -15,14 +15,7 @@ function degradeDeclaredRoot(fallbackBaseUrl, config) {
     return armed ? config.gatewayBaseUrl : (fallbackBaseUrl || config.gatewayBaseUrl);
 }
 export const FAST_FAIL_MAX_RETRIES = 2;
-const DEFAULT_RESILIENCE = {
-    connectTimeoutMs: 30_000,
-    firstTokenTimeoutMs: MODEL_FIRST_TOKEN_TIMEOUT_MS_DEFAULT,
-    idleTimeoutMs: 300_000,
-    circuitBreaker: false,
-    failureThreshold: 5,
-    cooldownMs: 30_000,
-};
+const DEFAULT_RESILIENCE = buildDefaultResilience();
 export function createBrain(config, deps = {}) {
     const { fetchImpl, breakerState } = deps;
     const r = config.resilience ?? DEFAULT_RESILIENCE;

package/dist/budget.d.ts

@@ -11,7 +11,15 @@ import type { QuotaTracker } from "./observability/cost-quota.js";
 import type { FleetUsageAccumulator } from "./fleet-client.js";
 import type { FleetLeaseManager } from "./fleet-lease.js";
 import { type PromptManifestTracker } from "./observability/prompt-manifest.js";
-/** ③ Per-model pricing keyed by model id (core falls back to each Model.cost when a model is absent). */
+/** ③ Per-model pricing keyed by model id (core falls back to each Model.cost when a model is absent).
+ *  B-089:`m.cost` 运行期可缺席(未定价的模型不铸这个键 —— `config.ts` 的 `buildModelCostKey`),于是
+ *  未定价模型在本表里**没有行**;core 的 `isModelPriced` 两边都读(`pricing[id]` 或 `model.cost`),
+ *  两边同时缺席 = 这只模型未定价 ⇒ 成本读面整键缺席,而不是编造的 0。
+ *
+ *  🔴 S-231 —— 建行判据就是 core 那只谓词本身,不再同形手抄。第二参传 `undefined` 是**语义**不是省事:
+ *  这张表正是本函数在建,建之前它不存在,于是谓词落在它的另一半「模型自报价了吗」上。表建好之后
+ *  「本部署配没配价目表」这一问归 {@link isPricingConfigured}(它数的是行;每一行都只由本谓词放进来,
+ *  所以两问不可能漂成两个答案)。 */
 export declare function buildPricing(models: Record<string, Model>): Record<string, ModelPricing>;
 /**
  * 缝合审 M3:`capabilities.pricingConfigured` 的判据 —— 提成函数放在 pricing 自己的文件里,因为
@@ -23,7 +31,18 @@ export declare function buildPricing(models: Record<string, Model>): Record<stri
  *
  * 同一条论证在同一个字面量里**已经执行过一次**:紧邻的 `restartState: () => configCenter.restartState()`
  * 带着注释「A live getter (not a snapshot) so /health always reads current」—— 兄弟键漏了。本仓第 7 例同形。
- */
+ *
+ * 🔴 B-089(判据本身,同一条「0 不是缺席」的病):此前判的是「**有没有一项正价**」
+ * (`some(v > 0)`),于是一台把四项单价**显式**配成 0 的部署(= 运营者声明这个模型免费)被报成
+ * 「没配价目表」—— 正好是本键要消歧的两态被折成同一个 false,消费端把一个可信的 $0 渲成 unknown。
+ * 判据改为**表在不在**:与 core [ref] 的 `isModelPriced`(「price table 是否 EXIST」)同向,也与
+ * 本键在 wire 契约里的原话(「价目表是否已配」)一致。
+ * 三态读回:未定价 ⇒ 空表 ⇒ false(与改前同值);声明免费 ⇒ 有行(全零)⇒ true(**唯一变的一格**);
+ * 配了真价 ⇒ true(与改前同值)。
+ *
+ * 🔴 S-231 —— 本函数**不是** `isModelPriced` 的第二份实现,它问的是**部署级**的另一问:「这张表里有行吗」。
+ * 「某一只模型定价了吗」只有 core 那一只谓词回答,而这张表的每一行都只由它放进来(见 {@link buildPricing}),
+ * 所以两问结构上不可能漂成两个答案。 */
 export declare function isPricingConfigured(pricing: Record<string, ModelPricing>): boolean;
 /**
  * Bound the cardinality of a free-form metric label value (BL-11/BL-21). A label fed by untrusted/unbounded

package/dist/budget.js

@@ -1,16 +1,16 @@
-import { modelCostToPricing } from "@sema-agent/core";
+import { isModelPriced, modelCostToPricing } from "@sema-agent/core";
 import { currentPrincipal } from "./observability/principal-context.js";
 import { isPermissionRuleEventKind, permissionRuleEventWordOf } from "./observability/permission-rule-events.js";
 import { promptManifestRecordOf, configAssembledRecordOf } from "./observability/prompt-manifest.js";
 export function buildPricing(models) {
     const pricing = {};
     for (const m of Object.values(models))
-        if (m.cost)
+        if (isModelPriced(m, undefined))
             pricing[m.id] = modelCostToPricing(m.cost);
     return pricing;
 }
 export function isPricingConfigured(pricing) {
-    return Object.values(pricing).some((p) => Object.values(p).some((v) => typeof v === "number" && v > 0));
+    return Object.keys(pricing).length > 0;
 }
 export function cardinalityGuard(cap, onOverflow) {
     const seen = new Set();

package/dist/capabilities/tool-defer.d.ts

@@ -1,25 +1,31 @@
 /**
  * [ref]④ defer face — EXPERIMENTAL long-tail per-tool defer (default OFF, `TOOL_DEFER_LONGTAIL=true`).
  *
- * Mechanics recap (core 1.287+ `tool-disclosure.js`, read for this assessment):
- *  - candidates for deferral are ONLY `spec.tools` (scenario/user tools) + MCP tools — core's first-party
- *    roster (Bash/Read/Edit/Grep/Glob/Write/…) is structurally NEVER deferred, so the CC "12 core tools
- *    inline" posture holds without any server action;
+ * Mechanics (core 7.15.0 `core/runner/tool-defer-gate.ts`, 亲读装树 dist —— 规则从八条收成两条):
+ *  - 候选**只可能**是 caller spec 工具(scenario/user tools)、远端协议铸名(MCP / A2A)与内置自声明
+ *    defer 的那对;core 一方名册(Bash/Read/Edit/Grep/Glob/Write/…)结构上永不进候选,所以 CC「12 只
+ *    一方工具内联」的姿态**零 server 动作**即成立;
  *    ⚠️ **这句在中间那些世代上一度不成立**([ref] 件⑤ 对表):`deferMode:"auto"` 的压力阀曾把内建 fs 族
  *    也卷进候选,小窗模型上首用即激活错;core 5.40.0([ref] a 案,判据帖 [ref] 翻面清单 #3)把阀候选
  *    收回 caller specs,**内建恒 inline**,于是这句话重新为真。**对本仓零行为影响**——理由是下一条:
  *    我们从不开 auto。这一段留着是因为它是那次漂移的出处(数字对了而理由没对,是最难查的一类)。
- *  - MCP tool names are ALWAYS deferred (unconditional in `classifyDeferred`) — no server knob needed;
- *  - `RunnerDeps.deferMode:"auto"` is ALL-OR-NOTHING over the candidates (defers every spec tool once their
- *    combined inline chars exceed 10% of the window) — on our default scenario that would defer Agent and the
- *    Task quartet too, the OPPOSITE of the CC posture, so we deliberately do NOT enable it;
- *    🔴 该判断在 core 5.40.0 上**逐字仍成立**([ref] 件⑤ 亲验):5.40 收窄的是「内建卷不卷进来」,而
- *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 所以「开了 auto 就会 defer 掉
- *    CC 姿势工具」这条不开 auto 的理由没有被这次收窄消解。
+ *  - 🔴 **候选 ≠ 延迟**(core 7.15.0 [ref] 的行为面收窄,本仓两条真后果见下):候选集整体受**一道**
+ *    阈值门,全或无 —— 候选的内联字节(name+description+schema)≥ `floor(上下文 token × 10%) × 3`
+ *    才延迟,否则**全内联且不挂 `ToolSearch`**。远端协议铸名因此**不再无条件占位**:本仓缺省窗
+ *    (`MODEL_CONTEXT_WINDOW=262144`)下阈值 = 78 642 字符,一个中小 MCP 名册够不着 ⇒ 首请求带全 schema。
+ *    唯一不受门的是调用方的 `TaskSpec.deferTools` 字面名单(按字面恒延迟、不计量)。
+ *  - `RunnerDeps.deferMode:"auto"` 不是第二道门,而是把候选集**拓宽**到全部 caller spec 后走同一道门 ——
+ *    在本仓缺省场景下那会连 Agent 与 Task 四件一起卷进候选(与 CC 姿态相反),所以我们**刻意不开**;
+ *    🔴 该判断在 core 5.40.0 / 7.15.0 上**逐字仍成立**(亲验):两次收窄动的都是「候选集是谁」,而
+ *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 不开 auto 的理由没有被消解。
  *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(`deferModelPlane` 是 config-center 的
  *    同形近名,与本轴无关)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
  *    在两个 core 世代之间行为逐字不变的**全部**依据,所以它值一根钉而不只是一句注。
- *  - per-tool `ToolSpec.defer:true` is the precise instrument — that is what this helper applies.
+ *  - per-tool `ToolSpec.defer:true` 是本 helper 施加的那一位。**7.15.0 起它是一次「进候选集」的声明,
+ *    不再是「一定占位」的保证** —— 长尾集单独一只(下面实测 ≈842 字符)远在阈值之下,于是这根旋钮在
+ *    没有 MCP/A2A 名册的部署上是个 no-op;有名册时它把自己的字节并进同一张账,帮助(或不帮助)开门。
+ *    ⚠️ 不要为了「恢复旧效果」把它改挂 `TaskSpec.deferTools`:那是调用方的轴,由下游改写上游刚裁定的
+ *    语义,属于跨仓纪律明禁的旁路;要改口径请回 core 提。
  *
  * Measured inline surface (chars = description + JSON schema; ÷4 ≈ tokens), default scenario @ core 1.289:
  *   Agent 5400 · TaskUpdate 3286 · TaskCreate 2661 · SendUserFile 1282 · TaskList 1075 · SelectEnvironment 842 ·