@sema-agent/server 7.72.0 → 7.73.1

package/README.md

@@ -164,7 +164,7 @@ The server is configured entirely through environment variables. The most import
 | `SENSITIVE_WRITE_PATTERNS` | core's recommended set | Sensitive-path write deny list; comma-separated value replaces the set, `off` **or an empty value** disables. Applied unconditionally at the governance layer (independent of client permission mode, lane or settings presence) — including on the `run-local` leg. A value that cannot compile into a guard set (e.g. `/`, a pattern with no path segment) refuses to start |
 | `WRITE_PROTECTED_EXTRA` | unset (engine default table) | **Adds** rows to core's write-protection table (the literal-name table whose hit demotes a surviving `allow` to `ask` on Write/Edit/NotebookEdit). Comma-separated bare names (a bare name matches ANY path segment; a name containing `/` matches a consecutive segment run) or a JSON array of `"name"` strings / `{name, kind}` rows (`kind`: `basename` \| `segment` \| `segment-run`). The value is composed as `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`, so **no default row can be lost**. Unset = no seat is wired = the engine's default table is in force (this server never copies that table). Form discrimination is by content, not by first character: a value containing any JSON structural character (`[ ] { } "`) is parsed as JSON and **must** be a top-level array (a missing pair of brackets refuses to start instead of being split into junk bare names). An empty value, a malformed entry (glob metacharacter, unknown kind, kind/name mismatch) or setting this together with `WRITE_PROTECTED_TABLE_REPLACE` **refuses to start**. Read faces: `GET /v1/capabilities` → `writeProtection.{armed,rows,replaced}`; `GET /v1/diagnostics/wiring` → `writeProtection.{rows,source,droppedDefaultRows}` (operator-only) |
 | `WRITE_PROTECTED_TABLE_REPLACE` | unset (engine default table) | **Replaces the whole** write-protection table (core's seat is whole-table by contract). JSON array only — deliberately no comma shorthand, because a slipped bare string would swap 51 default rows for one. `[]` = the explicit "no write-protection table at all" posture. Replacing logs one **loud** boot line naming every default row you dropped (`write_protection_table_replaced`; the empty posture logs `write_protection_table_disabled`) — use `WRITE_PROTECTED_EXTRA` when you meant to ADD. Same refuse-to-start conditions as its sibling, plus: both knobs set = two writers on one surface = refuses to start |
-| `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → no gate, core's `off` default). This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
+| `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → core's `off` default). Since 7.73.0 (core 7.15.0) `off` no longer means "no gate at all": the READ BOUNDARY (built-in read-deny tiers + workspace containment) is judged under **every** doctrine, so on the `off` lane a deny-listed read, an out-of-root read or a recursive read form still raises exactly ONE mandated approval (no stored rule and no auto-mode classifier can clear it); `shellGate` now governs only the RESIDUAL shell risk. Non-readers (`rm`/`curl`/`git`/`npm`) and ordinary in-workspace reads stay unasked on that lane. This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
 | `PERMISSIONS_DISABLE_AUTO_MODE` | `false` | Local mirror of CC `permissions.disableAutoMode` — the **org deny** bit for `permissionMode:"auto"` (paired with core's intent-arming rule). **Tighten-only**: `true` folds every principal's `runtimeCaps.autoMode` to `false` (a center grant cannot flip it back); unset leaves caps untouched, so on a center-less box a shell asking for `auto` **arms** the classifier once the paired core (intent-arming rule "requested ∧ classifier seat ∧ `autoMode !== false`" — absence is not a deny) is installed; on core 7.2.0 the engine still uses the old "org grant" rule (`permissionModeAuto.intentArming:false`), so the self-check answers `armed:true` only for a center-granted principal and `deployment_incapable` on a center-less box. Boolean word table; any other value refuses to start. Self-check: `GET /v1/capabilities?permissionMode=auto` → `permissionModeAuto.{armed, reason, model}` (USAGE §9.4) |
 | `SCRATCHPAD_SWEEP_TTL_MS` | 7 days | Idle-reap window for per-session scratchpad dirs (by dir mtime; `0` disables). The scratchpad is **ephemeral by contract**: replica-local disk, NOT part of the durable-suspend persistence set — a resume on a different replica, or after a sweep, starts with an empty dir (same two-track posture as the Agent SDK hosting doc: conversation persists, working-directory artifacts don't). Raise/disable only on single-replica deployments that park approvals for longer than the window |
 | `MODEL_CONNECT_TIMEOUT_MS` | `30000` | Gateway connect timeout |

package/USAGE.md

@@ -1293,6 +1293,16 @@ tag 词表与每条的最坏后果见 `docs/FAIL-OPEN-CENSUS.md`。引擎装配
 "bypassPermissions"` 时是调用方要的姿态,降为 **info** 并标 `expected`——只有没表态落到引擎默认 off 的无壳直连
 形才 warn。
 
+🔴 **`shell-gate-off` 这条注的语义自 7.73.0(core 7.15.0)起收窄,文案由引擎改写**:`off` 档**不再**意味着
+「这条会话的 shell 完全没有门」。**读边界**(内建读拒表 + 工作区容纳面)现在**每一档都判**,`shellGate` 只管
+**剩余**风险 ⇒ `off` 车道下一条读拒表路径(`cat .claude/settings.json`)、工作区外路径,或递归读形
+(`grep -r … .` / `find .` / `ls -R` / `du .`)都会产**恰一个 mandated 审批**(规则与 auto 分类器都清不掉);
+**非读**命令(`rm` / `curl` / `git` / `npm`)与工作区内的普通读在 `off` 下仍然零审批。注文案里那句
+「the read boundary is still judged on every command」就是这件事。⇒ **运维侧后果**:一台把 `bypassPermissions`
+当「无人值守直跑」用的部署,现在会在这三类命令上落审批(无活体席 ⇒ durable park,出现在 `GET /v1/approvals`)。
+要让它们重新不问,得从**读面**下手(`READ_FACE` / `READ_DENY_BUILTIN_TIERS` / `READ_DENY_BUILTIN_EXCLUDE`,
+见 `docs/DEPLOY-PREREQS.md`),`permissionMode` 那根杆子够不着它。
+
 ### 9.1 limits.approachNotice(6.1.0 起)
 
 引擎默认在上下文用量到 80%/95% 时各注入一次接近提示(SSE 上是 `steering_injected` 帧、

package/dist/boot/config-center.d.ts

@@ -7,6 +7,7 @@ import { type ServiceConfig } from "../config.js";
 import { type ModelKeyRef } from "../key-resolver.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
+import type { UnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import { type RestartSignal } from "../config-center/facade.js";
 import { type ConfigApplyLedgerView } from "../config-center/apply-ledger.js";
 import type { LimitSync } from "./limit-sync.js";
@@ -45,12 +46,16 @@ export interface ConfigCenterRuntime {
      *  `swapRunnerDeps`(core 7.10.0 `Runner.swapDeps` 一扇门;5.49 起的 `swapModels` 口在 7.10.0 退役、
      *  本参数同语义改名)= **可换席**的换装口:模型面 plane 变更候选在 commit 前喂给全部 boot Runner
      *  原子换代(在场 ⇒ models-tiers defer/restart 臂退役,缺席 ⇒ 旧 defer 行为逐字保留);S-174 起
-     *  read **face** 席也走同一只函数(见 refresh 拍里的 `applyCenterReadFace` 调用点)。 */
+     *  read **face** 席也走同一只函数(见 refresh 拍里的 `applyCenterReadFace` 调用点)。
+     *  `ceilingVerdict`(S-232)= 「配了 $ 天花板但目录未定价」这条判决的活载体,与 `limitSync` **同族同序**
+     *  (commit 之后、零 await 内重判一次;判决不翻转就静默)。缺席 = 这条腿本部署没装配(run-local 一次性
+     *  CLI 之后不再有刷新拍,它继续用纯判据判一次)。 */
     startRefreshLoop(a: {
         runnerTierFrozen: boolean;
         pricing: ReturnType<typeof buildPricing>;
         limitSync?: LimitSync;
         swapRunnerDeps?: (next: SwappableDeps) => void;
+        ceilingVerdict?: UnpricedCeilingVerdict;
     }): void;
     /** [ref]-2:停刷新环(hardShutdown 收尾链;幂等,未起环时 no-op)。 */
     stopRefreshLoop(): void;

package/dist/boot/config-center.js

@@ -510,7 +510,7 @@ export async function createConfigCenterRuntime(ctx) {
             }
         },
         startRefreshLoop(a) {
-            const { runnerTierFrozen, pricing, limitSync, swapRunnerDeps } = a;
+            const { runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict } = a;
             if (configProvider) {
                 const ccRef = config.configCenter;
                 let refreshInFlight = false;
@@ -594,6 +594,7 @@ export async function createConfigCenterRuntime(ctx) {
                                 mutateInPlace(pricing, buildPricing(config.models));
                                 keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
                                 limitSync?.sync();
+                                ceilingVerdict?.judge();
                                 mcpRevocations.applyEnabledEntries(enabledMcpEntries(r.effective.mcp));
                                 applyLiveReadFace(r.effective, swapRunnerDeps, "refresh");
                                 applyLedger.applied(tickGen, r.effective.version);
@@ -741,6 +742,7 @@ export async function createConfigCenterRuntime(ctx) {
                     mutateInPlace(pricing, buildPricing(config.models));
                     keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
                     limitSync?.sync();
+                    ceilingVerdict?.judge();
                     applyLiveReadFace(r.effective, swapRunnerDeps, "boot-deferred");
                     applyLedger.applied(lateGen, r.effective.version);
                     if (planeDeferredLate)

package/dist/boot/memory-boundary.d.ts

@@ -9,10 +9,26 @@
  * `~/.ai-agent`(或 `AGENT_DATA_DIR`),默认围栏是任务 cwd —— 两者天然不相交:用户说「记住 X」,模型照
  * 提示词去 Write,拿回一个 `path_not_in_root`,而回执早就发出去了。
  *
- * 判据形态 = **纯函数 + 启动 warn,不拒启**。理由是诚实:共享挂载 / bind mount / operator 自己把根塞进
- * `additionalDirectories`,都是真实可行的部署形,而我方在 boot 期看不全。看得全的是「按我们自己接的线,
+ * 判据形态 = **纯函数 + 启动 warn,不拒启**。理由是诚实:共享挂载 / bind mount / 部署方自己在别处开了写通道,
+ * 都是真实可行的部署形,而我方在 boot 期看不全。看得全的是「按我们自己接的线,
  * 这条链**结构上**走不通」——那句必须说出来。围栏根算不出来时**不说话**(判不了就闭嘴,别把猜测当告警)。
  *
+ * 🔴 **已登记的判据限度(不在本批射程,别把它读成「判据已闭合」)**:② 号 warn 今天唯一算得出围栏根的
+ * 腿是 `REMOTE_EXEC` 未设的 in-process 形(`boot/stores.ts` 的 `containmentRoots`),而**恰恰是这条腿
+ * 没有文件工具** —— 亲读装的这台 core:`prepare-execution-env.js` 的
+ * `handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined`,本仓不设 `REMOTE_EXEC` 时
+ * `executionEnvFactory` 恒 `undefined` ⇒ `handsEnabled=false` ⇒ `prepareHandsMount` 整个不跑。所以这条
+ * warn 描述的失败形(「模型照提示词去 Write,拿回 `path_not_in_root`」)在该腿上并不成立:真相是**一只
+ * 文件工具都没有**,而按它给的第一条恢复路径(把根挪进 workspace)会让 warn 闭嘴却仍然写不成。
+ * 把判据换成「执行能力 + core 自己的 advertised-writable-dir 准入结局」是一次**新的探测臂**(要读 per-task
+ * 的准入结果,而本模块是 boot 期纯函数),按复审停机纪律不在提货批里开;登记在此,免下一位重新发现。
+ *
+ * 🔴 **不再劝 `additionalDirectories`**(core 7.16.0 [ref] 提货):每个 scope 的家是 `<挂载平面>/<label>`,
+ * 平面本身谁的家都不是。交配置根 = 连引擎控制面(`.engine`)一起放行;交平面 = 把每个兄弟 scope 的家
+ * (含 org 只读层)一起交给模型;交写家 operator 事前说不出口(label 的真源是引擎注册簿),而 core 的
+ * 准入席([ref])本来就自动把写家教给模型。三条路各自要么危险要么多余 ⇒ 整条建议删,只留「挪根」与
+ * 「表态 capable=false」两条。
+ *
  * ⚠️ 这不是 fail-open 的托词:真正的 fail-closed 归属面在别处(多租户记忆整体 dark、remote lane 默认 dark)。
  * 本模块判的是「已经决定要开记忆」之后的**可达性**,而可达性的证据一半在部署环境里,不在进程里。
  *
@@ -47,8 +63,8 @@
  * 工具就跑在**这台机器**的 fs 上(`hostSemanticsLane`,与 core 的 remote 判决是两根轴,见下方 facts 注),
  * 记忆根也在这台机器上,「执行车道与记忆根共享文件平面」这个 capable=true 所断言的**车道级事实**由
  * 构造成立。剩下的围栏维(记忆根是否落在该次任务的 fs 授权边界内)在 in-process 上**同样存在**而 core
- * 并不 withhold——它由本模块的 ② 号 warn、fs 门的 `path_not_in_root` 拒绝、`additionalDirectories`
- * 旋钮这套既有处置管,不归 withhold 判据管。所以 host 腿自动 true 与 in-process 的默认行为**同等诚实**。
+ * 并不 withhold——它由本模块的 ② 号 warn、fs 门的 `path_not_in_root` 拒绝、以及 core 准入席自动放行写家
+ * ([ref])这套既有处置管,不归 withhold 判据管。所以 host 腿自动 true 与 in-process 的默认行为**同等诚实**。
  * 沙箱腿(e2b/k8s/ssh/local-docker)文件平面在沙箱盘,withhold 是对的,恒不自动。
  *
  * ## 为什么不是「围栏覆盖记忆根」的更严合取
@@ -69,7 +85,13 @@ export declare function effectiveMemoryPersistenceCapable(config: {
 }): boolean | undefined;
 /** boot 期可知的全部事实。每一位都必须由调用点从真配置/真装配结果取,禁在本模块内重算(重算=第二真源)。 */
 export interface MemoryWriteBoundaryFacts {
-    /** 记忆引擎的根(`memoryEngine.root`)。`undefined` = 引擎未接 ⇒ 本判据整体不适用。 */
+    /** 引擎的**挂载平面**根 —— 引擎真正读写条目的那棵树,由 `memoryMountRootOf(backend, root)` 单铸点取
+     *  (file 腿 = `<配置根>/memory`,两只 SQL 孪生不钉平面 ⇒ 回到配置根)。`undefined` = 引擎未接 ⇒ 本判据
+     *  整体不适用。
+     *  🔴 **不是配置根**(2026 提货批订正):配置根比挂载平面高一层,拿它判包含会把「记忆目录在围栏里、
+     *  配置根不在」这一真实可行的部署形误报成「结构性写不进」——而那台机器上模型其实存得下。
+     *  core 7.16.0([ref])之后写家还要再深一层(`<平面>/<label>`),但 label 归引擎注册簿,boot 期说不出口;
+     *  平面是**包含关系上等价**的那一只(家恒为平面的直接子目录),所以判据停在平面,不猜 label。 */
     memoryRoot: string | undefined;
     /** 执行车道名,只进文案(`config.remoteExec?.provider ?? "in-process"`)。 */
     lane: string;

package/dist/boot/memory-boundary.js

@@ -45,12 +45,12 @@ export function buildMemoryWriteBoundaryAudit(facts) {
         warnings: [
             {
                 tag: "memory_root_outside_write_boundary",
-                detail: `the memory engine root (${memoryRoot}) is outside every file-tool containment root known at boot ` +
-                    `(${containmentRoots.join(", ")}). Memory has no write TOOL — the model saves by writing files into that root — ` +
-                    `so a "remember this" turn will be answered with a save the file tools structurally refuse (path_not_in_root). ` +
-                    `Fix it in one of three ways: ${relocateRoot}, hand the root to tasks via ` +
-                    `additionalDirectories, or declare MEMORY_PERSISTENCE_CAPABLE=false so the model is told up front that this ` +
-                    `deployment cannot save instead of receipting a write that never lands.`,
+                detail: `the memory engine mount plane (${memoryRoot}) is outside every file-tool containment root known at boot ` +
+                    `(${containmentRoots.join(", ")}). Memory has no write TOOL — the model saves by writing files into the write ` +
+                    `scope's home under that plane — so a "remember this" turn will be answered with a save the file tools ` +
+                    `structurally refuse (path_not_in_root). ` +
+                    `Fix it in one of two ways: ${relocateRoot}, or declare MEMORY_PERSISTENCE_CAPABLE=false so the model is told ` +
+                    `up front that this deployment cannot save instead of receipting a write that never lands.`,
             },
         ],
     };

package/dist/boot/memory-consolidation.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "../trace/redact.js";
+import { memoryMountRootOf } from "../memory-scope.js";
 import { expandTiers, MemoryEngine, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
@@ -109,7 +110,7 @@ export function buildStopDetailAudit(input) {
 export function createMemoryConsolidationFaces(store, input) {
     const engine = new MemoryEngine({
         backend: store.backend,
-        memoryDir: store.root,
+        memoryDir: memoryMountRootOf(store.backend, store.root),
         consolidation: {},
         ...(input.provenance !== undefined ? { provenance: input.provenance } : {}),
         ...(input.onIncident !== undefined ? { onIncident: input.onIncident } : {}),

package/dist/boot/runner-deps.js

@@ -2,6 +2,7 @@ import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
 import { listCollabWorkflows, resolveCollabWorkflow } from "../capabilities/collab-workflows.js";
 import { fleetBackgroundChildPublisher, FleetEventBus } from "../fleet/fleet-bus.js";
+import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
 import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
@@ -91,6 +92,7 @@ export function createSharedRunnerDeps(ctx) {
 }
 export function createRunnerDeps(ctx) {
     const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
+    const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -207,7 +209,7 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "memory") {
-                logger.warn("memory_consolidation_failed", { sessionId: ctx.sessionId, info: String(err) });
+                memoryEngineIncident(err, ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : undefined);
                 return;
             }
             if (ctx.phase === "mcp") {

package/dist/boot/stores.js

@@ -20,7 +20,8 @@ import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/tas
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
-import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor } from "../memory-scope.js";
+import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
+import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
 import { assertApprovalAskRuleMaterialSchema } from "../plugins/approval-ask-store-sql.js";
@@ -193,7 +194,7 @@ export async function openStores(ctx) {
         });
     }
     else {
-        memoryEngine = memoryEngineBackendFor(config);
+        memoryEngine = memoryEngineBackendFor(config, undefined, createMemoryEngineIncidentSink({ logger, metrics }));
         if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
             logger.warn("memory_engine_dir_defaulted", {
                 root: memoryEngine.root,
@@ -206,8 +207,9 @@ export async function openStores(ctx) {
         const hostSemanticsLane = lane === undefined || lane === "host";
         const coreRemoteExecutionEnv = config.remoteExec !== undefined;
         const containmentRoots = lane === undefined ? [process.cwd()] : [];
+        const memoryMountRoot = memoryEngine ? memoryMountRootOf(memoryEngine.backend, memoryEngine.root) : undefined;
         const audit = buildMemoryWriteBoundaryAudit({
-            memoryRoot: memoryEngine?.root,
+            memoryRoot: memoryMountRoot,
             lane: lane ?? "in-process",
             hostSemanticsLane,
             coreRemoteExecutionEnv,
@@ -216,7 +218,7 @@ export async function openStores(ctx) {
             engineBackend: config.memoryEngineBackend,
         });
         for (const w of audit.warnings)
-            logger.warn(w.tag, { detail: w.detail, lane: lane ?? "in-process", root: memoryEngine?.root ?? null });
+            logger.warn(w.tag, { detail: w.detail, lane: lane ?? "in-process", root: memoryMountRoot ?? null });
         if (config.memoryPersistenceCapable === undefined && effectiveMemoryPersistenceCapable(config) === true) {
             logger.info?.("memory_persistence_capable_auto_declared", {
                 lane: lane ?? "in-process",

package/dist/boot/unpriced-ceiling-verdict.d.ts

@@ -0,0 +1,15 @@
+import type { ServiceConfig } from "../config-types.js";
+import type { Logger } from "../observability/logger.js";
+export interface UnpricedCeilingVerdictCtx {
+    /** 活配置(config-center 热应用就地改写的**同一个**对象——所以每次 `judge()` 读到的是当代值)。 */
+    readonly config: Pick<ServiceConfig, "models" | "maxTaskCostUsd" | "maxPrincipalCostUsd">;
+    readonly logger?: Logger;
+}
+export interface UnpricedCeilingVerdict {
+    /** 按**当下**的目录与限额重判一次。判决与上一次相同 ⇒ 静默;翻成「有」⇒ 一条 warn;翻成「无」⇒
+     *  一条 info `cost_ceiling_warning_cleared{reason}`(告警为什么不再成立,是运维要看见的事实;静默回落
+     *  读不出来,而不带原因的「恢复」在护栏被撤光时是假话)。幂等、零抛。 */
+    judge(): void;
+}
+export declare function createUnpricedCeilingVerdict(ctx: UnpricedCeilingVerdictCtx): UnpricedCeilingVerdict;
+//# sourceMappingURL=unpriced-ceiling-verdict.d.ts.map

package/dist/boot/unpriced-ceiling-verdict.js

@@ -0,0 +1,39 @@
+import { buildUnpricedCeilingNotice, costCeilingPricingPosture, unpricedCeilingClearReasonOf } from "../config.js";
+function verdictKey(notice) {
+    return notice?.fields.ceilings;
+}
+export function createUnpricedCeilingVerdict(ctx) {
+    const { config, logger } = ctx;
+    let last;
+    let judged = false;
+    return {
+        judge() {
+            const notice = buildUnpricedCeilingNotice(config.models, config);
+            const key = verdictKey(notice);
+            const first = !judged;
+            judged = true;
+            if (!first && key === last)
+                return;
+            last = key;
+            if (notice) {
+                logger?.warn?.(notice.event, notice.fields);
+                return;
+            }
+            if (first)
+                return;
+            const reason = unpricedCeilingClearReasonOf(costCeilingPricingPosture(config.models, config));
+            if (reason === undefined)
+                throw new Error("unpriced-ceiling verdict: notice absent but no clear reason — judge and posture disagree");
+            logger?.info?.("cost_ceiling_warning_cleared", { reason, note: CLEAR_NOTE[reason] });
+        },
+    };
+}
+const CLEAR_NOTE = {
+    no_ceiling: "every $ ceiling (MAX_TASK_COST_USD / MAX_PRINCIPAL_COST_USD) is now unset — the earlier cost_ceiling_without_pricing " +
+        "warning no longer applies, but note this deployment has NO $ cost guardrail (by configuration, not by omission).",
+    empty_catalog: "the effective catalog is empty — there is nothing to price, so the earlier cost_ceiling_without_pricing warning is " +
+        "moot until models arrive; the $ ceilings still cannot fire.",
+    priced: "the effective catalog declares a price table again — the $ ceilings (MAX_TASK_COST_USD / MAX_PRINCIPAL_COST_USD) " +
+        "can fire once more. This reverses the earlier cost_ceiling_without_pricing warning.",
+};
+//# sourceMappingURL=unpriced-ceiling-verdict.js.map

package/dist/budget.d.ts

@@ -14,7 +14,12 @@ import { type PromptManifestTracker } from "./observability/prompt-manifest.js";
 /** ③ Per-model pricing keyed by model id (core falls back to each Model.cost when a model is absent).
  *  B-089:`m.cost` 运行期可缺席(未定价的模型不铸这个键 —— `config.ts` 的 `buildModelCostKey`),于是
  *  未定价模型在本表里**没有行**;core 的 `isModelPriced` 两边都读(`pricing[id]` 或 `model.cost`),
- *  两边同时缺席 = 这只模型未定价 ⇒ 成本读面整键缺席,而不是编造的 0。 */
+ *  两边同时缺席 = 这只模型未定价 ⇒ 成本读面整键缺席,而不是编造的 0。
+ *
+ *  🔴 S-231 —— 建行判据就是 core 那只谓词本身,不再同形手抄。第二参传 `undefined` 是**语义**不是省事:
+ *  这张表正是本函数在建,建之前它不存在,于是谓词落在它的另一半「模型自报价了吗」上。表建好之后
+ *  「本部署配没配价目表」这一问归 {@link isPricingConfigured}(它数的是行;每一行都只由本谓词放进来,
+ *  所以两问不可能漂成两个答案)。 */
 export declare function buildPricing(models: Record<string, Model>): Record<string, ModelPricing>;
 /**
  * 缝合审 M3:`capabilities.pricingConfigured` 的判据 —— 提成函数放在 pricing 自己的文件里,因为
@@ -34,7 +39,10 @@ export declare function buildPricing(models: Record<string, Model>): Record<stri
  * 本键在 wire 契约里的原话(「价目表是否已配」)一致。
  * 三态读回:未定价 ⇒ 空表 ⇒ false(与改前同值);声明免费 ⇒ 有行(全零)⇒ true(**唯一变的一格**);
  * 配了真价 ⇒ true(与改前同值)。
- */
+ *
+ * 🔴 S-231 —— 本函数**不是** `isModelPriced` 的第二份实现,它问的是**部署级**的另一问:「这张表里有行吗」。
+ * 「某一只模型定价了吗」只有 core 那一只谓词回答,而这张表的每一行都只由它放进来(见 {@link buildPricing}),
+ * 所以两问结构上不可能漂成两个答案。 */
 export declare function isPricingConfigured(pricing: Record<string, ModelPricing>): boolean;
 /**
  * Bound the cardinality of a free-form metric label value (BL-11/BL-21). A label fed by untrusted/unbounded

package/dist/budget.js

@@ -1,11 +1,11 @@
-import { modelCostToPricing } from "@sema-agent/core";
+import { isModelPriced, modelCostToPricing } from "@sema-agent/core";
 import { currentPrincipal } from "./observability/principal-context.js";
 import { isPermissionRuleEventKind, permissionRuleEventWordOf } from "./observability/permission-rule-events.js";
 import { promptManifestRecordOf, configAssembledRecordOf } from "./observability/prompt-manifest.js";
 export function buildPricing(models) {
     const pricing = {};
     for (const m of Object.values(models))
-        if (m.cost)
+        if (isModelPriced(m, undefined))
             pricing[m.id] = modelCostToPricing(m.cost);
     return pricing;
 }

package/dist/capabilities/tool-defer.d.ts

@@ -1,25 +1,31 @@
 /**
  * [ref]④ defer face — EXPERIMENTAL long-tail per-tool defer (default OFF, `TOOL_DEFER_LONGTAIL=true`).
  *
- * Mechanics recap (core 1.287+ `tool-disclosure.js`, read for this assessment):
- *  - candidates for deferral are ONLY `spec.tools` (scenario/user tools) + MCP tools — core's first-party
- *    roster (Bash/Read/Edit/Grep/Glob/Write/…) is structurally NEVER deferred, so the CC "12 core tools
- *    inline" posture holds without any server action;
+ * Mechanics (core 7.15.0 `core/runner/tool-defer-gate.ts`, 亲读装树 dist —— 规则从八条收成两条):
+ *  - 候选**只可能**是 caller spec 工具(scenario/user tools)、远端协议铸名(MCP / A2A)与内置自声明
+ *    defer 的那对;core 一方名册(Bash/Read/Edit/Grep/Glob/Write/…)结构上永不进候选,所以 CC「12 只
+ *    一方工具内联」的姿态**零 server 动作**即成立;
  *    ⚠️ **这句在中间那些世代上一度不成立**([ref] 件⑤ 对表):`deferMode:"auto"` 的压力阀曾把内建 fs 族
  *    也卷进候选,小窗模型上首用即激活错;core 5.40.0([ref] a 案,判据帖 [ref] 翻面清单 #3)把阀候选
  *    收回 caller specs,**内建恒 inline**,于是这句话重新为真。**对本仓零行为影响**——理由是下一条:
  *    我们从不开 auto。这一段留着是因为它是那次漂移的出处(数字对了而理由没对,是最难查的一类)。
- *  - MCP tool names are ALWAYS deferred (unconditional in `classifyDeferred`) — no server knob needed;
- *  - `RunnerDeps.deferMode:"auto"` is ALL-OR-NOTHING over the candidates (defers every spec tool once their
- *    combined inline chars exceed 10% of the window) — on our default scenario that would defer Agent and the
- *    Task quartet too, the OPPOSITE of the CC posture, so we deliberately do NOT enable it;
- *    🔴 该判断在 core 5.40.0 上**逐字仍成立**([ref] 件⑤ 亲验):5.40 收窄的是「内建卷不卷进来」,而
- *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 所以「开了 auto 就会 defer 掉
- *    CC 姿势工具」这条不开 auto 的理由没有被这次收窄消解。
+ *  - 🔴 **候选 ≠ 延迟**(core 7.15.0 [ref] 的行为面收窄,本仓两条真后果见下):候选集整体受**一道**
+ *    阈值门,全或无 —— 候选的内联字节(name+description+schema)≥ `floor(上下文 token × 10%) × 3`
+ *    才延迟,否则**全内联且不挂 `ToolSearch`**。远端协议铸名因此**不再无条件占位**:本仓缺省窗
+ *    (`MODEL_CONTEXT_WINDOW=262144`)下阈值 = 78 642 字符,一个中小 MCP 名册够不着 ⇒ 首请求带全 schema。
+ *    唯一不受门的是调用方的 `TaskSpec.deferTools` 字面名单(按字面恒延迟、不计量)。
+ *  - `RunnerDeps.deferMode:"auto"` 不是第二道门,而是把候选集**拓宽**到全部 caller spec 后走同一道门 ——
+ *    在本仓缺省场景下那会连 Agent 与 Task 四件一起卷进候选(与 CC 姿态相反),所以我们**刻意不开**;
+ *    🔴 该判断在 core 5.40.0 / 7.15.0 上**逐字仍成立**(亲验):两次收窄动的都是「候选集是谁」,而
+ *    Agent / Task 四件是 **caller spec 工具**,收窄后照样在候选池里 —— 不开 auto 的理由没有被消解。
  *    我方**从不接线**这个座:全树零 `RunnerDeps.deferMode` 赋值(`deferModelPlane` 是 config-center 的
  *    同形近名,与本轴无关)。机器钉见 test/tool-defer.test.ts 的 [ref] 件⑤ 格 —— 这条「零接线」正是本仓
  *    在两个 core 世代之间行为逐字不变的**全部**依据,所以它值一根钉而不只是一句注。
- *  - per-tool `ToolSpec.defer:true` is the precise instrument — that is what this helper applies.
+ *  - per-tool `ToolSpec.defer:true` 是本 helper 施加的那一位。**7.15.0 起它是一次「进候选集」的声明,
+ *    不再是「一定占位」的保证** —— 长尾集单独一只(下面实测 ≈842 字符)远在阈值之下,于是这根旋钮在
+ *    没有 MCP/A2A 名册的部署上是个 no-op;有名册时它把自己的字节并进同一张账,帮助(或不帮助)开门。
+ *    ⚠️ 不要为了「恢复旧效果」把它改挂 `TaskSpec.deferTools`:那是调用方的轴,由下游改写上游刚裁定的
+ *    语义,属于跨仓纪律明禁的旁路;要改口径请回 core 提。
  *
  * Measured inline surface (chars = description + JSON schema; ÷4 ≈ tokens), default scenario @ core 1.289:
  *   Agent 5400 · TaskUpdate 3286 · TaskCreate 2661 · SendUserFile 1282 · TaskList 1075 · SelectEnvironment 842 ·

package/dist/config-types.d.ts

@@ -1419,12 +1419,15 @@ export interface ServiceConfigFlat {
      *  settings ⇒ 整块跳过;bypassPermissions 臂不回 shellGate;非 host lane wiring 不建 ⇒ 沙箱 lane 全失效)。
      *  rank 合成:与 autonomy 派生值取大(`ask`→`"always"` 压过 `"classify"`),对 base 只升不降。
      *  客户端 settings 折叠在其后、tighten-only,拿不掉这个值;SUP 路由姿态只会把它抬到 `"always"`。
-     *  🔴 **语义随 core 版本演进(2026-07-31 核)**:`"classify"` 下「纯读自动放行」这句自 core 2.7.0 起
-     *  **不再无条件成立** —— [ref] 给 classifier 加了 root 边界扫描,core 内部自铸 boundary
+     *  🔴 **语义随 core 版本演进(2026-07-31 核;core 7.15.0 再核)**:`"classify"` 下「纯读自动放行」这句
+     *  自 core 2.7.0 起**不再无条件成立** —— [ref] 给 classifier 加了 root 边界扫描,core 内部自铸 boundary
      *  (`prepare-task.ts` 的 `shellReadBoundary`:roots=任务 root+additionalRoots+additionalReadRoots,
-     *  cwd=活 handsCwd),
-     *  **读到 roots 之外的路径同样会 ask**(server 侧零接线即得:我们只传 shellGate,边界是 core 自算的)。
-     *  旧 core(<2.7.0)下仍是名字级判定=越界读放行,两者都能工作、后者更严 ⇒ floor 不因此抬。
+     *  cwd=活 handsCwd),**读到 roots 之外的路径同样会 ask**(server 侧零接线即得:我们只传 shellGate,
+     *  边界是 core 自算的)。
+     *  🔴 **而自 core 7.15.0([ref])起,那道读边界不再是本旋钮买来的** —— 它**每一档都判**(`off` 含在内),
+     *  本旋钮买的只剩**剩余**风险那一半:`"classify"` = 可证只读且在界内的命令自动放行、其余发问;
+     *  `"always"` = 每条命令都发问。⇒ 别再把「越界读会问」写成开这根旋钮的理由(它在不开的部署上同样成立);
+     *  这根旋钮仍然是 tighten-only、仍然无条件施加,语义一字未改。
      *  Absent/unset = `undefined` = **zero behavior change** (this is a tighten-ONLY opt-in, never a
      *  default — a deployment must explicitly choose it); `"always"` = CC-strict parity (every Bash asks). Any
      *  other value (incl. `"off"`) is treated as unset — this knob has no "off" value to opt BACK OUT with once a
@@ -1452,8 +1455,13 @@ export interface ServiceConfigFlat {
      *  ToolSearch-loads the schema). Assessment says the win is marginal for us (spec.tools total ≈4.2k tokens, of
      *  which Agent + the Task quartet ≈3.2k are CC-core posture = must stay inline; the deferrable tail is
      *  ≈200-500 tokens/turn) and SendUserFile is deliberately NOT in the defer set (proactive-delivery tool —
-     *  hiding it behind ToolSearch suppresses exactly the spontaneous use it exists for). MCP tools are ALWAYS
-     *  auto-deferred by core regardless of this flag. `TOOL_DEFER_LONGTAIL=true` opts in. */
+     *  hiding it behind ToolSearch suppresses exactly the spontaneous use it exists for). `TOOL_DEFER_LONGTAIL=true`
+     *  opts in.
+     *  🔴 **core 7.15.0([ref])起 `defer:true` 只是「进候选集」的声明,不是「一定占位」的保证**:候选集
+     *  (caller spec 的 `defer:true` + 远端协议铸名 + 内置自声明 defer)整体受**一道**阈值门,全或无 ——
+     *  内联字节 ≥ 上下文窗的 **10%** 才延迟,否则全内联且不挂 `ToolSearch`。同一条收窄也让「MCP 工具恒被
+     *  core 自动延迟」这句(本行旧文案)作废:缺省窗下一个中小 MCP 名册够不着阈值,首请求带全 schema。
+     *  唯一不受门的是调用方的 `TaskSpec.deferTools` 字面名单。口径全文见 src/capabilities/tool-defer.ts 头注。 */
     toolDeferLongtail: boolean;
     /** LSP code-intelligence tool ([ref] §13.1): mount core's `lsp` tool, routed to an E2B LSP sidecar. Requires
      *  REMOTE_EXEC=e2b. Default OFF (the on-the-fly language-server install is heavy until an E2B template bakes it).

package/dist/config.d.ts

@@ -100,20 +100,17 @@ export declare function logConfigDiagnostics(logger: {
     debug?: (event: string, fields?: Record<string, unknown>) => void;
 }): void;
 /** B-089:`Model.cost` 的四项(per-1M USD)。类型从 core 的 `Model` 取,不在本仓重列一份。 */
-type ModelCost = Model["cost"];
+type ModelCost = NonNullable<Model["cost"]>;
 /**
  * 🔴 B-089 —— `Model.cost` 这**一个键**的唯一铸点(可展开片段):有价目表 ⇒ 键在;没配 ⇒ **键不出**。
  * 三个铸点(env 主槽 / env cheap 槽 / config-center 车道)共用它,所以「缺席怎么表达」在本仓只有一处答案。
  *
- * 为什么这里有一处 cast:`Model.cost` 在 core 7.13.0 的**类型面**上仍是必填
- * (`dist/engine/llm/types.d.ts:803`),而它的**运行期**判据读的正是这个键在不在
- * (`dist/core/pricing.js:15`,[ref] 的单一谓词)——「缺席」是 core 明文支持并依赖的运行期状态,
- * 只是类型面还没跟上(core 也未把 `isModelPriced` 从 index 导出,本仓无法直接复用那只谓词)。
- * 把这条唯一的类型让步收在这里,调用点一处不必再 cast。
+ * `Model.cost` 自 core 7.16.0([ref])起在**类型面**上也是可选的(`dist/engine/llm/types.d.ts` 的
+ * `cost?:`),与它一直以来的运行期读法([ref] 的 `isModelPriced`:这个键在不在)对齐 ——
+ * 于是本函数不再需要任何类型让步,返回 `{}` 就是「不写这个键」的字面表达。
  *
- * ⚠️ 连带纪律:既然运行期可缺席,**读** `Model.cost` 一律先判在场(`budget.ts` 的
- * `if (m.cost)`、catalog 行的 `c.model.cost?.input`),别写 `model.cost.input` —— 类型面不会拦你。
- * 终态是 core 把该键改成可选,届时本函数的 cast 与本段注一起删。
+ * ⚠️ 连带纪律仍在:**读** `Model.cost` 一律先判在场(catalog 行的 `c.model.cost?.input`),
+ * 别写 `model.cost.input`;而「这只模型定价了吗」这一问不许在本仓重写一遍,调 `isModelPriced`。
  */
 export declare function buildModelCostKey(cost: ModelCost | undefined): Pick<Model, "cost">;
 /**
@@ -130,10 +127,29 @@ export declare function buildModelCostKey(cost: ModelCost | undefined): Pick<Mod
  * (或天花板只由 center 的 limits 下发)⇒ **漏警**。故本函数只给判据,席位在两只入口各自的
  * **采纳之后**(`main.ts` 的 `createConfigCenterRuntime` 之后 / `run-local.ts` 的 `applyEffective` 之后)。
  *
- * 判据 = **目录里没有任何一只模型带 `cost`**,与 `budget.buildPricing` 的填表判据同一个(它只为带 cost
- * 的模型建行),而 core 的 `isModelPriced` 读的正是 `pricing[id] ?? model.cost` —— 两边同时缺席才是未定价。
- * 本模块刻意不 import `budget.ts`(那边挂着 metrics/fleet 一串运行期依赖,config 是纯解析层)。
+ * 判据 = **目录里没有任何一只带价模型**,问法与 `budget.buildPricing` 的填表判据是**同一只函数**
+ * (S-231:core 7.16.0 导出的 `isModelPriced`;第二参传 `undefined` = 这一问发生在注入表建起来之前,
+ * 谓词落在「模型自报价了吗」那一半)。本模块刻意不 import `budget.ts`(那边挂着 metrics/fleet 一串
+ * 运行期依赖,config 是纯解析层)—— 单源因此不是「谁 import 谁」,而是两边都问引擎那一只。
  */
+/** 「$ 天花板 × 价目表」的三位事实 —— 告警判据与清警原因的**同一只**读数(S-232 合并复审:清警要说得出为什么清)。 */
+export interface CostCeilingPricingPosture {
+    /** 配了的天花板旋钮名(空 = 一根都没配)。 */
+    ceilings: string[];
+    /** 生效目录里的模型 id(空 = 目录还空着)。 */
+    modelIds: string[];
+    /** 目录里至少一只模型自报了价(`isModelPriced(m, undefined)`,S-231 单源)。 */
+    anyPriced: boolean;
+}
+export declare function costCeilingPricingPosture(models: Record<string, Model>, limits: {
+    maxTaskCostUsd: number;
+    maxPrincipalCostUsd: number;
+}): CostCeilingPricingPosture;
+/** 「天花板告警此刻**不**成立」的原因(闭集三词);`undefined` = 告警成立。序 = 先判护栏在不在(`no_ceiling`),
+ *  再判有没有东西可计价(`empty_catalog`),最后才是「真配回了价」(`priced`)—— 只有最后一词可以说
+ *  「护栏能再触发」,前两词下这句话是假的。 */
+export type UnpricedCeilingClearReason = "no_ceiling" | "empty_catalog" | "priced";
+export declare function unpricedCeilingClearReasonOf(p: CostCeilingPricingPosture): UnpricedCeilingClearReason | undefined;
 export declare function buildUnpricedCeilingNotice(models: Record<string, Model>, limits: {
     maxTaskCostUsd: number;
     maxPrincipalCostUsd: number;

package/dist/config.js

@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, parseRuleText } from "@sema-agent/core";
+import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isModelPriced, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, parseRuleText } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -284,21 +284,38 @@ function buildCostOrAbsent(read, inherited) {
     };
 }
 export function buildModelCostKey(cost) {
-    return (cost === undefined ? {} : { cost });
+    return cost === undefined ? {} : { cost };
 }
-export function buildUnpricedCeilingNotice(models, limits) {
-    const ceilings = [
-        ...(limits.maxTaskCostUsd > 0 ? ["MAX_TASK_COST_USD"] : []),
-        ...(limits.maxPrincipalCostUsd > 0 ? ["MAX_PRINCIPAL_COST_USD"] : []),
-    ];
+export function costCeilingPricingPosture(models, limits) {
     const entries = Object.values(models);
-    if (ceilings.length === 0 || entries.length === 0 || entries.some((m) => m.cost !== undefined))
+    return {
+        ceilings: [
+            ...(limits.maxTaskCostUsd > 0 ? ["MAX_TASK_COST_USD"] : []),
+            ...(limits.maxPrincipalCostUsd > 0 ? ["MAX_PRINCIPAL_COST_USD"] : []),
+        ],
+        modelIds: [...new Set(entries.map((m) => m.id))],
+        anyPriced: entries.some((m) => isModelPriced(m, undefined)),
+    };
+}
+export function unpricedCeilingClearReasonOf(p) {
+    if (p.ceilings.length === 0)
+        return "no_ceiling";
+    if (p.modelIds.length === 0)
+        return "empty_catalog";
+    if (p.anyPriced)
+        return "priced";
+    return undefined;
+}
+export function buildUnpricedCeilingNotice(models, limits) {
+    const posture = costCeilingPricingPosture(models, limits);
+    if (unpricedCeilingClearReasonOf(posture) !== undefined)
         return undefined;
+    const { ceilings, modelIds } = posture;
     return {
         event: "cost_ceiling_without_pricing",
         fields: {
             ceilings: ceilings.join(","),
-            models: [...new Set(entries.map((m) => m.id))].join(","),
+            models: modelIds.join(","),
             note: `${ceilings.join(" / ")} is configured but NO model in the effective catalog declares a price table — an ` +
                 "unpriced model reports NO cost at all (core RB-368), so these $ ceilings can never fire and this deployment " +
                 "has no cost guardrail despite looking like it does. Set MODEL_COST_INPUT / MODEL_COST_OUTPUT / " +

package/dist/http/active-run-conflict.d.ts

@@ -14,6 +14,7 @@
  *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
  */
 import { type Autonomy } from "../runtime-governance.js";
+import type { ShellGateDoctrine } from "@sema-agent/core";
 import { type RunRecord } from "../plugins/store-contracts.js";
 import { type PendingRowBinding } from "../plugins/checkpoint-store-sql.js";
 /** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 `governanceMandatesShellGateAlways`)。 */
@@ -124,7 +125,7 @@ export declare function resumeEntryForGate(kind: string, ids: {
 }): string | null;
 export declare function governanceOriginOf(gate: {
     riskDescriptor?: {
-        shellGateDoctrine?: "classify" | "always";
+        shellGateDoctrine?: ShellGateDoctrine;
     };
 } | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** token 泛型:真身是 branded CheckpointToken(秘密能力,只在本函数内部流转,绝不进响应体)。 */
@@ -183,7 +184,7 @@ interface ConflictProbeDeps<TToken> {
             gate?: {
                 kind?: string;
                 riskDescriptor?: {
-                    shellGateDoctrine?: "classify" | "always";
+                    shellGateDoctrine?: ShellGateDoctrine;
                 };
             };
         } | null | undefined>;