@sema-agent/server 7.91.2 → 7.92.0

package/README.md

@@ -170,7 +170,7 @@ The server is configured entirely through environment variables. The most import
 | `SENSITIVE_WRITE_PATTERNS` | core's recommended set | Sensitive-path write deny list; comma-separated value replaces the set, `off` **or an empty value** disables. Applied unconditionally at the governance layer (independent of client permission mode, lane or settings presence) — including on the `run-local` leg. A value that cannot compile into a guard set (e.g. `/`, a pattern with no path segment) refuses to start |
 | `WRITE_PROTECTED_EXTRA` | unset (engine default table) | **Adds** rows to core's write-protection table (the literal-name table whose hit demotes a surviving `allow` to `ask` on Write/Edit/NotebookEdit). Comma-separated bare names (a bare name matches ANY path segment; a name containing `/` matches a consecutive segment run) or a JSON array of `"name"` strings / `{name, kind}` rows (`kind`: `basename` \| `segment` \| `segment-run`). The value is composed as `[...WRITE_PROTECTED_DEFAULT_TABLE, …]`, so **no default row can be lost**. Unset = no seat is wired = the engine's default table is in force (this server never copies that table). Form discrimination is by content, not by first character: a value containing any JSON structural character (`[ ] { } "`) is parsed as JSON and **must** be a top-level array (a missing pair of brackets refuses to start instead of being split into junk bare names). An empty value, a malformed entry (glob metacharacter, unknown kind, kind/name mismatch) or setting this together with `WRITE_PROTECTED_TABLE_REPLACE` **refuses to start**. Read faces: `GET /v1/capabilities` → `writeProtection.{armed,rows,replaced}`; `GET /v1/diagnostics/wiring` → `writeProtection.{rows,source,droppedDefaultRows}` (operator-only) |
 | `WRITE_PROTECTED_TABLE_REPLACE` | unset (engine default table) | **Replaces the whole** write-protection table (core's seat is whole-table by contract). JSON array only — deliberately no comma shorthand, because a slipped bare string would swap 51 default rows for one. `[]` = the explicit "no write-protection table at all" posture. Replacing logs one **loud** boot line naming every default row you dropped (`write_protection_table_replaced`; the empty posture logs `write_protection_table_disabled`) — use `WRITE_PROTECTED_EXTRA` when you meant to ADD. Same refuse-to-start conditions as its sibling, plus: both knobs set = two writers on one surface = refuses to start |
-| `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → core's `off` default). Since 7.73.0 (core 7.15.0) `off` no longer means "no gate at all": the READ BOUNDARY (built-in read-deny tiers + workspace containment) is judged under **every** doctrine, so on the `off` lane a deny-listed read, an out-of-root read or a recursive read form still raises exactly ONE mandated approval (no stored rule and no auto-mode classifier can clear it); `shellGate` now governs only the RESIDUAL shell risk. Non-readers (`rm`/`curl`/`git`/`npm`) and ordinary in-workspace reads stay unasked on that lane. This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
+| `MANUAL_MODE_SHELL_GATE` | unset | `always`\|`classify` — tighten `Bash` into the approval chain, applied unconditionally at the governance layer (≥7.1.0: independent of client permission mode, lane, or settings presence). **Unset is not "off"**: since 7.12.0 the caller's explicit `permissionMode` supplies the baseline this knob tightens from (`bypassPermissions` → `off`, `auto`/`default`/`acceptEdits`/`plan` → `classify`; **no** mode stated → core's `off` default). Since 7.73.0 (core 7.15.0) `off` no longer means "no gate at all": the READ BOUNDARY (built-in read-deny tiers + workspace containment) is judged under **every** doctrine, and `shellGate` governs only the RESIDUAL shell risk. Since 7.92.0 (core 7.25.0) that boundary is ONE read station judged before approval, and its three outcomes differ: a **deny-listed read is REFUSED** on the `off` lane as on every other face — no card, no stored rule and no approver's yes can release it (`tool_end.errorCode`/`structured` = `read_path_denied` with the matched `target`/`pattern`, `gate.disposition.deniedBy = "read_boundary"`); a **recursive read form is ENUMERATED** — it runs with zero asks when no deny row sits under the tree, is refused naming that row when one does, and still raises ONE mandated approval when the tree is too large to enumerate; an **out-of-root read** is unchanged and still raises exactly ONE mandated approval (no stored rule and no auto-mode classifier can clear it). Non-readers (`rm`/`curl`/`git`/`npm`) and ordinary in-workspace reads stay unasked on that lane. This knob only ever raises that baseline — it has no relax half, so `off` is accepted as an explicit **no-op** (a boot line says so; not symmetric with `SENSITIVE_WRITE_PATTERNS=off`, which really does clear a set). **Any other value refuses to start** (7.12.0, BREAKING for a deployment that had a typo: it was previously treated as unset, i.e. silently no gate at all) |
 | `PERMISSIONS_DISABLE_AUTO_MODE` | `false` | Local mirror of CC `permissions.disableAutoMode` — the **org deny** bit for `permissionMode:"auto"` (paired with core's intent-arming rule). **Tighten-only**: `true` folds every principal's `runtimeCaps.autoMode` to `false` (a center grant cannot flip it back); unset leaves caps untouched, so on a center-less box a shell asking for `auto` **arms** the classifier once the paired core (intent-arming rule "requested ∧ classifier seat ∧ `autoMode !== false`" — absence is not a deny) is installed; on core 7.2.0 the engine still uses the old "org grant" rule (`permissionModeAuto.intentArming:false`), so the self-check answers `armed:true` only for a center-granted principal and `deployment_incapable` on a center-less box. Boolean word table; any other value refuses to start. Self-check: `GET /v1/capabilities?permissionMode=auto` → `permissionModeAuto.{armed, reason, model}` (USAGE §9.4) |
 | `SCRATCHPAD_SWEEP_TTL_MS` | 7 days | Idle-reap window for per-session scratchpad dirs (by dir mtime; `0` disables). The scratchpad is **ephemeral by contract**: replica-local disk, NOT part of the durable-suspend persistence set — a resume on a different replica, or after a sweep, starts with an empty dir (same two-track posture as the Agent SDK hosting doc: conversation persists, working-directory artifacts don't). Raise/disable only on single-replica deployments that park approvals for longer than the window |
 | `MODEL_CONNECT_TIMEOUT_MS` | `30000` | Gateway connect timeout |

package/USAGE.md

@@ -681,6 +681,14 @@ READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitiv
     零卡执行。**要老姿态就显式写** `READ_DENY_BUILTIN_TIERS=credentials,browser,wallet,agent-config`
     (运维面全文见 `docs/DEPLOY-PREREQS.md` 的 core 7.22.0 段)。`open` 与这张表仍是**两个并列机制**:
     `open` 放开的是「工作区外」那道围栏,内建表判的是名字 —— 只是后者现在默认空着。
+  · 🔴 **命中这三张表的结局自 core 7.25.0 起是「拒」,不是「问」**(三只旋钮的名字 / 语义 / 缺席读法一字
+    未变,变的是结局词):一条命中拒表的读在**每张脸每个时刻**都被拒 —— 不出审批卡、持久 allow 规则
+    清不掉、值守的人点「同意」也放不掉。拒因在 `tool_end` 上:`errorCode` 与 `structured` 都是
+    `read_path_denied`(带 `target` 与**命中的那条 pattern**),`gate.disposition.deniedBy = "read_boundary"`。
+    同批**根内的内容遍历**(`grep -r` / `diff -r` / `rg`)改成**枚举**:树下没有拒表行 ⇒ 零卡执行,
+    有 ⇒ 点名那一行拒。⇒ **要让某条路径重新读得到,就把它从这三张表里拿掉**(删掉那条自配模式 / 档位
+    不选 / 用 `READ_DENY_BUILTIN_EXCLUDE` 删掉那一行);三问与运维面全文见
+    `docs/DEPLOY-PREREQS.md` 的 `core 7.25.0 提货` 段。
   · 「这一档到底是谁定的」由 operator 面 `GET /v1/diagnostics/wiring` 的 `readFace` 段答:
     `{face, source, note}`,`source` ∈ `env`(本机 env 显式)/ `center`(组织下发)/ `posture`(单机派生)/
     `engine-default`(没钉,引擎当家),`note` 是指路句。

package/dist/approval-ask-machine.d.ts

@@ -23,7 +23,7 @@ export declare function canBatchTransition(from: BatchState, to: BatchState): bo
  * 被推翻)—— 这段注释是「为什么是这五个部件」的唯一书面记录:
  *
  * ── `runId`(新增轴,封死跨 run 复用)────────────────────────────────────────────────────────────────
- * core 给 `AskRequest.sourceTaskId` 填的是 **sessionId**(`prepare-task.js:2595` 的 `askSourceIdentity`),
+ * core 给 `AskRequest.sourceTaskId` 填的是 **sessionId**(`prepare-task.js` 的 `askSourceIdentity`),
  * 不是 wire run id。而原轴给每条新 run 的首腿都重置 `leg=0` ⇒ 同一会话的**下一次全新提交**若撞上同一
  * `toolCallId`([ref] 定稿 §3.1 记录了部分网关按**请求编号**而非全局编号铸它)会整组重现,
  * `ensureAsk` 的幂等 upsert 于是命中上一 run 已 `DECIDED(approve)` 的旧行并把它回放成 `true` ——

package/dist/approval-reconciler.d.ts

@@ -134,7 +134,7 @@ export interface ReconcileStats {
      * (下面每 tick 一条 warn),并被写成协议开关翻真的前置判据之一。
      *
      * ✅ **该前置判据已销账**([ref] 翻真验证车,2026-08-07 亲验 core 5.15.0):字段在
-     * `core/tool-policy.d.ts:83`,真码 `core/tool-policy.js:610` 每一只 ask 都填 ——
+     * `core/tool-policy.d.ts`,真码 `core/tool-policy.js` 每一只 ask 都填 ——
      * 判据 1 现在会真命中(钉:test/stream-approval-on-e2e.test.ts 件4 末条,同构两行只差 hash 一位,
      * 有 hash 的 bind 成 PARKED、无 hash 的进本计数)。
      *

package/dist/approval.d.ts

@@ -43,7 +43,7 @@ export declare function assertGateIntentServiceable(config: {
  * [ref] 件⑩ —— **center 的 `forceDurableGate` 在无 checkpoint 店的部署上会静默 inert**,补一条 boot 披露。
  *
  * 事实链(core 7.2.0 亲读):`RuntimeCaps.forceDurableGate:true` 让引擎**合成**一个
- * `durableApproval{scope: principal}`(`dist/core/types.d.ts:5279-5283`),好让 policy 的 `ask` 挂到
+ * `durableApproval{scope: principal}`(`dist/core/types.d.ts`),好让 policy 的 `ask` 挂到
  * durable wire 上。但「挂得上去」的前提是这台 worker 真有 checkpoint 店 —— 而本仓的构造条件逐字是
  * `backend?.checkpoint && config.durableApproval`(main.ts)。`DURABLE_APPROVAL` 关 ⇒ 店缺席 ⇒ 合成出来
  * 的那把锁**没有锁孔**:core 侧退化成非 durable 的 ask 链,center 那条「fleet-wide interactive runs gate」

package/dist/bench/s1/repair-oracle-adapter.d.ts

@@ -18,7 +18,7 @@
  * from scoring), never a withhold-credit.
  *
  * 🔴 The repair leg MUST still pass `workerEnv` to `runRepairLoop` (NOT just here) — the §5.1 identity check is
- * SKIPPED when `workerEnv` is undefined (`repair-loop.d.ts:148`), silently disabling the anti-reward-hack guard.
+ * SKIPPED when `workerEnv` is undefined (`repair-loop.d.ts`), silently disabling the anti-reward-hack guard.
  * arms.ts is responsible for that; this adapter only wires the oracle closure.
  */
 import type { ExecutionEnv, RepairOracle } from "@sema-agent/core";

package/dist/bench/s1/runner-ctx.d.ts

@@ -56,7 +56,7 @@ export interface BenchBudget {
 /**
  * An injectable deterministic clock (SPEC §2). EVERY Runner in EVERY arm is built with `now: ctx.now`, and the
  * reviewer's modeled think-time advances `advanceClock(ms)` — so `stats.humanReview.totalWaitMs` is reproducible
- * and NEVER consumes real wall-time (`RunnerDeps.now`, core types.d.ts:1002 / [ref] §4.3 flaky-guard).
+ * and NEVER consumes real wall-time (`RunnerDeps.now`, core types.d.ts / [ref] §4.3 flaky-guard).
  *
  * 🔴 CLOCK-ADVANCE OWNERSHIP (review #10 — HARNESS-OWNS-CLOCK, the single fold point per arm): the modeled review
  * wait is folded into ctx.clock by the HARNESS exactly once per arm — SUP in driveSupSuspendResume (per leg), TEAM

package/dist/boot/runner-deps.d.ts

@@ -64,7 +64,7 @@ export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordina
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 /** S-386:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
  *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
- *  `dist/index.d.ts:128`;实现在 `dist/core/cache-break-detector.d.ts`),于是 core 加词/删词 ⇒
+ *  `dist/index.d.ts`;实现在 `dist/core/cache-break-detector.d.ts`),于是 core 加词/删词 ⇒
  *  `Record<PromptCacheBreakCause, …>` 少键/多键 = **编译错**(CLAUDE.md [ref]「词表是闭集 + 穷举」)。
  *  ⚠️ 首版在这里**手抄**了五个字面量,并在本注与 CHANGELOG 里声称「core 加词 = 编译错」—— 复审实测
  *  证伪(给 core d.ts 加词后 tsc 照绿,只有一格正则扫描会红):抄来的联合与 core 无编译期联系。
@@ -107,8 +107,8 @@ export interface RunnerDepsCtx {
      *
      * 本键从「差异键」升进{@link createSharedRunnerDeps 共享基座}。修前它**只**挂在 subRunner 上,主
      * runner 靠 per-task `spec.checkpointStore` 拿店 —— 而 core 的 `run_workflow` 是挂在**主** Runner
-     * (`prepare-caps-and-workflow.js:279` 的 `runner: runnerSelf`;**core 7.14.0 亲核行号**,7.12.0 时是
-     * :244、B-060 票据引的 :249 是 7.11.2 的坐标 —— 这一格每版都在漂,引用前必须对着装树重读)上的。
+     * (`prepare-caps-and-workflow.js` 的 `runner: runnerSelf`;⚠️ S-516:这里**不写 dist 行号** ——
+     * B-060 票据当年引的那组坐标每版都在漂,复核一律按符号名搜)上的。
      *
      * ⚠️ **B-060 当初写下的病理有一半已被 core 7.14.0 消解,如实订正**([ref] 的 `CheckpointSeat` 重构):
      *  · **7.13.0 及以前**:`orchestration/workflow-primitives.js` 只在父侧
@@ -117,16 +117,16 @@ export interface RunnerDepsCtx {
      *    ⇒ `parkLane {capable:false, reasons:["no_checkpoint_store"]}` ⇒ 受门的调用不是 park 而是
      *    `delegation.ask_unresolvable{parkLaneExisted:false}` 直接拒(过度拒绝)。
      *  · **7.14.0 起**:core 在 prepare 一次铸出 `checkpointSeat = checkpointSeatOf(spec, resolved)`
-     *    (`prepare-task.js:262`),两条委派车道**逐字复制**它到子代 —— workflow 腿经
-     *    `parentCheckpointStore: checkpointSeat`(`prepare-caps-and-workflow.js:335`)落到
-     *    `workflow-primitives.js:80`(现在的条件是「父侧有座 ∧(座是 disabled ∨ 子 spec 没自带店)」⇒
+     *    (`prepare-task.js`),两条委派车道**逐字复制**它到子代 —— workflow 腿经
+     *    `parentCheckpointStore: checkpointSeat`(`prepare-caps-and-workflow.js`)落到
+     *    `workflow-primitives.js`(现在的条件是「父侧有座 ∧(座是 disabled ∨ 子 spec 没自带店)」⇒
      *    **真店也透传**),Task 腿经 `ToolExecuteContext.checkpointStoreForChildren`。
      *  ⇒ 「子代拿不到店」这条病路 core 侧已经堵死。**但本席仍然承重**,理由是那只座**本身**就从
      *    `resolveCheckpointStore(spec, deps)` 来:主 runner 这一格空着、而 spec 又没带店时,座就是
      *    `undefined`,子代照样什么都拿不到。本席不是 core 单源的第二个写者,它就是 core 读的那个 deps 格。
      *
      * 🔴 host 腿的读数判据是**core 侧硬的**,不是本仓的但愿:`resolveCheckpointStore`
-     * (`checkpoint-store.js:370`,7.14.0 亲核)**spec 优先**——`spec.checkpointStore` 在场就用它、
+     * (`checkpoint-store.js`,7.14.0 亲核)**spec 优先**——`spec.checkpointStore` 在场就用它、
      * `"disabled"` 就是关、只有缺席才落 deps。而本仓 host 腿恒经 `resolveSpec` 的 durableEnabled 分支盖上
      * **同一个实例**,且 `durableEnabled ⇔ checkpointStore !== undefined`(`boot/coordinators.ts:70` 与
      * main.ts 的构造条件同源)⇒ 每一条经 `resolveSpec` 的腿看到的店逐字同一只。
@@ -138,7 +138,7 @@ export interface RunnerDepsCtx {
      * 哪天有人给这两处接了不同的店,失败是响亮的而不是静默半场。
      *
      * ⚠️ **如实登记一处不经解析器的直读**(codex 交叉复审提名,亲读 core dist 确认):
-     * `core/runner/run-terminal-adoption.js:80`(7.14.0 亲核;7.13.0 时是 :74)读的是
+     * `core/runner/run-terminal-adoption.js`(7.14.0 亲核)读的是
      * `runner.deps.checkpointStore` **本身**,不走 `resolveCheckpointStore`,**也不走座** —— 所以 7.14.0
      * 的座重构对它一个字节都没改,本席对它仍是唯一来源。它是「宿主任务 park 时,把没排空的 steer /
      * follow-up 迁移到 park token 上」那一步 —— 修前主 runner 这一格是空的,于是**整段迁移静默不跑**
@@ -305,7 +305,7 @@ export declare function createEngineNoticeSeat(logger: {
  *
  * 纯数据(键值全是 config 透传,无闭包)⇒ `build*`(CLAUDE.md 工厂律)。键**恒在场**、缺席 = `undefined`
  * ([ref] S4 house style;core 消费点全按 `!== undefined` / `??` 判 —— dist
- * `prepare-hands-readface.js:96-97`、`prepare-config-doors.js:199/215/229`、`prepare-task.js:1487` 亲读,
+ * `prepare-hands-readface.js`、`prepare-config-doors.js`、`prepare-task.js` 亲读,
  * 「键为 undefined」与「键缺席」对引擎逐字等价)。**不复制引擎缺省**(`roots`/`static-face`/`carry`/`open`/
  * CC parity 20/200 一个都不抄):上游改缺省之日起本仓不会成为第二份真源。
  */

package/dist/capabilities/memory-notice.d.ts

@@ -18,19 +18,36 @@
  *    roster 把落盘路**整批**卸掉时,手带在场也等于没有写通道),但负控仍然成立:必须**全部**已知落盘路
  *    都不在才算断链 —— `excludeTools:["Write"]` 不算(Bash/Edit 还在),请求面摘一个工具名改不动结论。
  */
-import { type PromptProvider } from "@sema-agent/core";
+import { type PromptProvider, type ToolCatalogEntry } from "@sema-agent/core";
 import type { ScenarioHands } from "./hands-lane.js";
 /**
- * 「已知落盘路」的工具名闭集 —— 与 core 的 `rosterCanPersist` 同口径:**文件写工具**(Write/Edit/
- * NotebookEdit)或**可写 shell**(Bash)。刻意**不是** `HAND_TOOL_EFFECTS` 里 effect=write 的全集:
- * core 逐字裁过「a generic write-effect tool does NOT count — a mail sender's side effect is not a
- * memory store」,`TaskStop` 就是那种(有写副作用、不是落盘路)。
+ * 「已知落盘路」的判据,作用在 core **静态工具目录**的一行上(S-503 / [ref])—— 与 core 自己的
+ * `rosterCanPersist` 推断逐条同形,取的是同一批目录属性,不是它结论的抄件:
+ *  · `mountedBy` 落在 core 的 `HANDS_BAND_TAGS` 里 —— 手带 band 之外的定义(记忆面工具、调度族)
+ *    不在本判别式说得着的面上:本判别式的输入全是**手带事实**(`hands` / `handsReadOnly` /
+ *    `excludeTools`),把一只 band 外的写工具算进来,就是拿一条根本没挂的通道去撤回披露(fail-open);
+ *  · `face.effect !== "read"`(缺席读 `write`,与 core 同缺省)—— 只读 shell 壳在这里出局,它与全壳
+ *    共用 `Bash` 这个 wire 名,靠的正是这一位分开;
+ *  · `face.pathTarget.access !== "read"`(文件写工具)**或** `face.family === "shell"`(可写 shell)。
  *
- * 名字会漂,所以配一道防漂移钉(test/no-persistent-memory-notice.test.ts):每个名字必须在 core 的
- * `HAND_TOOL_EFFECTS` 里且 effect 为 `write` —— core 改名/改档位当场红,而不是让这里静默失配成
- * 「没有一个写工具被排除」(fail-open 方向)。
+ * 🔴 这条析取式**不是** effect=write 的全集:core 逐字裁过「a generic write-effect tool does NOT count
+ * — a mail sender's side effect is not a memory store」。`TaskStop` 正是那种(effect=write、没有路径
+ * 目标、不是 shell),它在这条判据下自己就出局 —— 改前那张手抄名单要靠人记得别把它写进去。
+ *
+ * 一条都派生不出来 ⇒ **抛**(不是回一个空集):空集会让下面那条判据读成「一条落盘路都不剩」⇒ 每台
+ * 有手的机器都开始披露「本部署没有持久记忆」,而那句话在那时是假的。目录换形是提货期事实(静态数据,
+ * 与请求/环境无关:要么恒抛要么恒不抛),所以这一抛是**提货门**,不是运行期风险。
+ */
+export declare function persistencePathToolNamesOf(entries: readonly ToolCatalogEntry[]): readonly string[];
+/**
+ * 「已知落盘路」的工具名闭集 —— **由 core 的静态工具目录派生**,本仓不再存第二份名表
+ * (S-503 / [ref];改前是手抄的四名表 Write / Edit / NotebookEdit / Bash,没有任何差集门)。
+ *
+ * 为什么手抄在这一位上特别危险:core 改名/加一只写工具,手抄表静默失配成「没有一个写工具被排除」
+ * (fail-open 方向)—— `excludeTools` 把真正的落盘路全排掉了,而我们对着一张旧名单答「还剩」。
+ * 判据的属主现在是 {@link persistencePathToolNamesOf},值的属主是 core 的目录行。
  */
-export declare const KNOWN_PERSISTENCE_TOOL_NAMES: readonly ["Write", "Edit", "NotebookEdit", "Bash"];
+export declare const KNOWN_PERSISTENCE_TOOL_NAMES: readonly string[];
 /** 披露段在 `prompt.assembled` 清单里的段 id(`core/` 命名空间是 core 保留的,部署段一律自家前缀)。 */
 export declare const NO_PERSISTENT_MEMORY_SECTION_ID = "sema/memory.no-persistent";
 /** 判别式的全部输入 —— 每一位都是**部署/装配期事实**,没有一位来自请求体的自我表态。 */
@@ -55,7 +72,7 @@ export interface MemoryFaceFacts {
      *  (core `prepareDeferClassify` 对它直接 `roster.unmountWhere(() => true)`)⇒ 手带在场也一条落盘路都不剩。
      *  🔴 它与下面那张名单是**同一个语义面**(「哪些工具不在 roster 上」)的两种声明,判据合成一只
      *  {@link isUnmounted} —— 上游同版的姊妹谓词 `fullShellReachable` 也正是把 `spec.excludeAllTools !== true`
-     *  当一个合取项(`prepare-inherited-gate.js:174` 亲读),本仓与它同口径。 */
+     *  当一个合取项(`prepare-inherited-gate.js` 亲读),本仓与它同口径。 */
     excludeAllTools: boolean;
     /** 折完之后的最终 `TaskSpec.excludeTools`(roster 真卸载,不是延迟披露)。**全部**已知落盘路都被排掉
      *  ⇒ 手带在场也等于没有写通道 —— core 的 `rosterCanPersist` 也是按排除后的 roster 算的,这里跟上。 */

package/dist/capabilities/memory-notice.js

@@ -1,6 +1,25 @@
-import { NO_PERSISTENT_MEMORY_NOTICE } from "@sema-agent/core";
+import { describeToolCatalog, HANDS_BAND_TAGS, NO_PERSISTENT_MEMORY_NOTICE } from "@sema-agent/core";
 import { hasConstitutionAnchors } from "../task-settings.js";
-export const KNOWN_PERSISTENCE_TOOL_NAMES = ["Write", "Edit", "NotebookEdit", "Bash"];
+export function persistencePathToolNamesOf(entries) {
+    const names = new Set();
+    for (const e of entries) {
+        if (!e.mountedBy.some((tag) => HANDS_BAND_TAGS.has(tag)))
+            continue;
+        if ((e.face.effect ?? "write") === "read")
+            continue;
+        const pt = e.face.pathTarget;
+        if (!((pt !== undefined && pt.access !== "read") || e.face.family === "shell"))
+            continue;
+        names.add(e.name);
+    }
+    if (names.size === 0) {
+        throw new Error("core tool catalog yields no hand-band persistence path (file-write target or writable shell) — " +
+            "the #148 disclosure would start claiming 'no persistent memory' on every machine that HAS hands. " +
+            "Re-read core's rosterCanPersist inference and re-derive persistencePathToolNamesOf.");
+    }
+    return Object.freeze([...names]);
+}
+export const KNOWN_PERSISTENCE_TOOL_NAMES = persistencePathToolNamesOf(describeToolCatalog());
 export const NO_PERSISTENT_MEMORY_SECTION_ID = "sema/memory.no-persistent";
 function isUnmounted(facts, name) {
     return facts.excludeAllTools || (facts.excludeTools?.includes(name) ?? false);

package/dist/config-catalog.js

@@ -2,6 +2,7 @@ import { CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES } fr
 import { THINKING_FORMATS } from "./model-compat.js";
 import { RESILIENCE_DEFAULTS } from "./config-types.js";
 import { webSearchConfigFromEnv, WEB_SEARCH_PROVIDERS } from "./plugins/web-search.js";
+import { AUTONOMY_MODES } from "./runtime-governance.js";
 import { REMOTE_EXEC_PROVIDER_WORDS } from "./execution-lane-caps.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./config-center/read-face.js";
 import { MODEL_PROVIDER_WORDS } from "./model-provider.js";
@@ -75,7 +76,7 @@ export const CONFIG_CATALOG = [
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
     r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 用 configCenter.baseUrl(配了 center 即默认开桥)" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
-    r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: ["read-only", "ask", "plan", "auto"], configKey: "autonomy", center: cGov("autonomy") }),
+    r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
     r("BAKE_CACHE_BASE", "orchestration", "url", "烤镜像 fetch-once 缓存源 base(注入 --cache-base;绝不受调用方控制)"),
     r("BAKE_IMAGE_REGISTRY", "orchestration", "string", "烤镜像自动登记的 registry host 前缀(repo=registry/profile)"),

package/dist/config-center/types.d.ts

@@ -253,7 +253,7 @@ export interface EffectiveConfig {
     version: number;
     updatedAt: string;
     /** [ref]B-6:default/tierGroups/activeTierGroup 收进类型面(registry-core 0.13.0 已声明,
-     *  types.d.ts:641/679/724)——此前 wire 面靠「JSON verbatim + 消费方结构读」逃逸,投影/消费两侧
+     *  types.d.ts)——此前 wire 面靠「JSON verbatim + 消费方结构读」逃逸,投影/消费两侧
      *  各自 as 宽铸。tierGroups 上游是 ZodDefault(合规 center 恒发),但本类型描述的是**到货 JSON**
      *  (含非合规/旧存量 center),故仍标 optional——消费方 resolveActiveTiers 自身容缺。 */
     models: {

package/dist/config.d.ts

@@ -16,7 +16,7 @@ export declare function parseAutonomy(raw: string | undefined): Autonomy | undef
 /** [ref]-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
  *  封闭形)。unset/空串 → undefined(关)。fail-loud 族(numEnv 同纪律):坏 JSON/非数组/空数组/
  *  坏值/未知 anchor 全部 boot throw 点名——「设了但无意义」静默关掉=部署方以为有治理实际没有。
- *  [ref](core 7.0.0 `UsageWindow.maxCostUsd`,dist/core/usage-window-store.d.ts:44-68 亲读):
+ *  [ref](core 7.0.0 `UsageWindow.maxCostUsd`,dist/core/usage-window-store.d.ts 亲读):
  *  `maxTokens` 与 `maxCostUsd` 是两只**独立** ceiling——each optional on its own、**at least one
  *  required**(双缺=拒:a window with neither admits nothing it can govern),whichever fills first
  *  即耗尽;缺席的 ceiling 不参与(非 0、非 ∞)。修前这里的白名单重铸只认三键,$ 键配了也被静默

package/dist/env-facts.d.ts

@@ -117,7 +117,7 @@ export declare function screenShellScratchpadDir(raw: unknown, opts: {
  * ## 病形(引擎侧的硬拒,不是判决期的宽严)
  * 写门的豁免域就是 scratchpad(`exemptDirs: [scratchpadDir]`,`task-settings.ts` 的
  * `createFsWriteGatePolicy` 那一句),而门的根是这条 task 的 cwd。core 7.20.0 起,**豁免域等于根或是
- * 根的祖先 ⇒ 构造期抛**(亲读安装树 `dist/core/fs-write-gate-policy.js:11-28`,
+ * 根的祖先 ⇒ 构造期抛**(亲读安装树 `dist/core/fs-write-gate-policy.js`,
  * `code = "config.write_exempt_dir_covers_root"`)——理由逐字:一条盖住根的豁免把根下**每一次写**都自动
  * 批准,那就是整个工作区,门宁可拒绝被建出来,也不肯带着一扇静默关掉的写治理去跑。
  *

package/dist/execution-lane-caps.d.ts

@@ -159,7 +159,7 @@ export interface LaneHomeDeployment {
  * 「**这条部署的执行环境**以哪个 home 运行」—— `~/…` 形权限规则(`Edit(~/.ssh/**)`)唯一的基。
  *
  * ## 病(接入审计 M13 / DEBTS S-213④)
- * core 的 `ExecutionEnv.homeDir` 是**由 adapter 声明**的座(`engine/harness/types.d.ts:511`,可选):
+ * core 的 `ExecutionEnv.homeDir` 是**由 adapter 声明**的座(`engine/harness/types.d.ts`,可选):
  * 缺席 ⇒ core 的 `resolvePathPattern` 回 `{missingBase:"home"}` ⇒ 该规则对这条腿判 `unreadable`
  * (fail-closed 的 ask)。四只远端 adapter(e2b/k8s/host/ssh)一个都没声明,而 server 侧的 422 前置门
  * (`task-settings.ts` 的 `rejectUnmatchableSettingsNames`)在 home 未知时整表拒 `~/` 形 ——

package/dist/file-history-disclosure.d.ts

@@ -8,12 +8,12 @@
  * 就只剩散文,**机器一位都读不到**。两条腿各自的后果:
  *
  * · **snapshot(边界捕获)腿**:引擎把失败包成一句散文交给 `RunnerDeps.onError({phase:"rewind"})`
- *   (core 7.20.0 `dist/core/runner/prepare-file-history.js:269`/`:275`),服务那条臂从文本里抠**第一个**
+ *   (core 7.20.0 `dist/core/runner/prepare-file-history.js` 的 `wrapFileHistoryEntry`),服务那条臂从文本里抠**第一个**
  *   括号词当 metric label —— 而第一个括号词恒是引擎自己的闭集码。实测:「这个文件永远存不进这口店」
  *   与「连接被重置」在 `rewind_snapshot_failed_total` 上**同形** `code="snapshot_failed"`。
  * · **trackEdit(首触备份)腿**:本服务用引擎默认的 `onTrackFailure:"refuse"`(`boot/runner-deps.ts` 亲读),
  *   那条路 **完全不走 onError** —— 引擎把 `(track_failed: <本店 message>)` 念给模型,末句是
- *   「Retry when the file-history store is healthy.」(`prepare-file-history.js:154`)。对这枚码那是永远
+ *   「Retry when the file-history store is healthy.」(`prepare-file-history.js`)。对这枚码那是永远
  *   不会到来的一天,而**运维面一个计数都没有**:这条腿今天在遥测上完全不可见。
  *
  * ## 修法(源头留痕,不走文本通道)

package/dist/fleet/fleet-bus.d.ts

@@ -9,7 +9,7 @@ import type { AssertAllKeysHandled } from "../trace/core-keyset-guard.js";
  *
  *  🔴 [ref]([ref]):判别**本体已换 core 的 {@link isDelegatedAgentTerminal}**。此前这里是一份手写语义
  *  孪生(自己枚举 `completed|failed|killed|cancelled`),头注自陈「与 core 语义同源——core 根导出后换装
- *  import 删本镜像」。core 现已从包根导出(`index.d.ts:109`),且它的终态集与 pending 店的驱逐偏好共用
+ *  import 删本镜像」。core 现已从包根导出(`index.d.ts`),且它的终态集与 pending 店的驱逐偏好共用
  *  同一份 `TERMINAL_STATUSES`(core 原话:「so "terminal" can never mean two things in this module」)——
  *  孪生留在这里等于让 fleet 面板对「终态」的理解可以和引擎分家。本函数保留为**具名的 fleet 语义位**
  *  (调用点读的是「这条通知该不该打 fleet 的 onChildTerminal」,不是「core 怎么判终态」)。 */
@@ -49,6 +49,12 @@ export interface FleetTaskRow {
      *  `name` (the objective-preview). Populated TODAY on SUBAGENT CHILD rows, where `task_progress.name` IS the type
      *  (BC-2). SECRET-SAFE: redacted before emit, same discipline as `name`. */
     agentType?: string;
+    /** 队友的**实例名** = `Agent({name})` 的显式出生名。源 = core 7.25.0 的 `BackgroundChildEvent.spawnName`
+     *  ([ref] S0;spawn/tick/terminal 三帧都带,出生点按 `^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$` 校验过、永不 `main`)。
+     *  🔴 与 `name` 分域:`name` 是**显示名**(源 `description ?? name`,模型自由文本);本键是**身份键**,
+     *  消费端按串相等把「@某个名字」绑到这一行(同类型两个子代在 `agentType` 上不可分,在本键上可分)。
+     *  ADDITIVE / tolerate-absent:**缺席 = 一次匿名委派**(不是「不知道它叫什么」)—— 7.25.0 之前本键在本仓
+     *  没有任何源,恒缺席。SECRET-SAFE:与 `name` 同一道边界(emit 前 redact)。 */
     agentName?: string;
     /** Owning principal (= the run's scope). The `/v1/fleet/stream` route filters to the caller's scope (owner-gated)
      *  unless the caller is fleet-wide (operator / trace-token). NOT rendered — a tenant-isolation field. */

package/dist/fleet/fleet-bus.js

@@ -463,8 +463,8 @@ export function fleetBackgroundChildPublisher(bus, log) {
         };
         remember(e.taskId, m);
         claimIfKnown(e, m);
-        const spawnName = e.description ?? e.name;
-        bus.publishTask({ id: e.taskId, ...(spawnName !== undefined ? { name: redactSecrets(spawnName) } : {}), ...(e.agentType ? { agentType: redactSecrets(e.agentType) } : {}), ...rowTags(m), status: "running", tokens: 0, ...(typeof e.seq === "number" ? { cycleSeq: e.seq } : {}), ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
+        const displayName = e.description ?? e.name;
+        bus.publishTask({ id: e.taskId, ...(displayName !== undefined ? { name: redactSecrets(displayName) } : {}), ...(e.agentType ? { agentType: redactSecrets(e.agentType) } : {}), ...(e.spawnName ? { agentName: e.spawnName } : {}), ...rowTags(m), status: "running", tokens: 0, ...(typeof e.seq === "number" ? { cycleSeq: e.seq } : {}), ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
         dlog("bg_child_event", { kind: "spawn", taskId: e.taskId, sessionScoped: e.sessionScoped, scope: m.tenantScope, hostSessionId: m.hostSessionId ?? null, parentTaskId: m.parentTaskId ?? null });
     };
     const handleTick = (e, m) => {
@@ -488,16 +488,18 @@ export function fleetBackgroundChildPublisher(bus, log) {
         const tokens = sumUsage(e.usage);
         const name = e.name ? redactSecrets(e.name) : undefined;
         const agentType = e.agentType ? redactSecrets(e.agentType) : undefined;
+        const agentName = e.spawnName;
         const currentAction = e.currentAction ? redactSecrets(e.currentAction) : undefined;
         const currentTool = e.currentTool
             ? { toolName: e.currentTool.toolName, ...(e.currentTool.target !== undefined ? { target: redactSecrets(e.currentTool.target).slice(0, 300) } : {}) }
             : undefined;
-        bus.publishTask({ id: e.taskId, ...rowTags(m), status: "running", ...(tokens !== undefined ? { tokens } : {}), ...(name ? { name } : {}), ...(agentType ? { agentType } : {}), ...(currentAction ? { currentAction } : {}), ...(currentTool ? { currentTool } : {}), ...(typeof e.seq === "number" ? { cycleSeq: e.seq } : {}), ...(e.usage?.toolUses !== undefined ? { toolUses: e.usage.toolUses } : {}), ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
+        bus.publishTask({ id: e.taskId, ...rowTags(m), status: "running", ...(tokens !== undefined ? { tokens } : {}), ...(name ? { name } : {}), ...(agentType ? { agentType } : {}), ...(agentName ? { agentName } : {}), ...(currentAction ? { currentAction } : {}), ...(currentTool ? { currentTool } : {}), ...(typeof e.seq === "number" ? { cycleSeq: e.seq } : {}), ...(e.usage?.toolUses !== undefined ? { toolUses: e.usage.toolUses } : {}), ...(e.transcriptId ? { transcriptId: e.transcriptId } : {}) });
     };
     const handleTerminal = (e, m) => {
         const status = e.status === "completed" ? "completed" : e.status === "killed" ? "killed" : "failed";
         bus.publishTask({
             id: e.taskId, ...rowTags(m), status,
+            ...(e.spawnName ? { agentName: e.spawnName } : {}),
             ...(typeof e.seq === "number" ? { cycleSeq: e.seq } : {}),
             ...(e.stoppedBy ? { stoppedBy: e.stoppedBy } : {}),
             ...(e.resumable !== undefined ? { resumable: e.resumable } : {}),

package/dist/http/admission.d.ts

@@ -9,7 +9,7 @@ import { HttpError } from "../security.js";
 import type { PreparedTaskSubmission, RouteHelpers } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
 /** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在
- *  dist/core/runner/synthetic-tools.js:84,未从 core 包根导出,故钉本地孪生+本出处注记)。修7 曾对齐旧
+ *  dist/core/runner/synthetic-tools.js,未从 core 包根导出,故钉本地孪生+本出处注记)。修7 曾对齐旧
  *  20k 截断门([ref] 飞轮考据:20k 是压缩保留区口径,invoke 时刻用错),core 1.293 撤门后本门跟随回收
  *  ([ref]① 收口)——HTTP 面与引擎加载门同值,超限 400 fail-loud 而非引擎侧整拒后难诊断。
  *

package/dist/http/idempotency.d.ts

@@ -1,3 +1,4 @@
+import type { WiringManifestReceipt } from "./wire-types.js";
 /**
  * In-memory, TTL'd dedup cache keyed by an opaque string (an Idempotency-Key).
  *
@@ -41,4 +42,30 @@ export declare class IdempotencyCache<T> {
  * three fields can't be confused. undefined raw key → undefined (no dedup, unchanged).
  */
 export declare function scopedIdempotencyKey(raw: string | undefined, source: string | null, principal: string | undefined): string | undefined;
+/**
+ * 提交腿的**运行结局**(进幂等缓存的那一只)—— `status` + `body` 是它一直以来的两位;S-528 起多一位
+ * `wiringManifest`。
+ *
+ * 🔴 **为什么回执挂在 outcome 上、不铸进 `body`**(codex 对抗复审 [medium],红先复现后修):
+ * `Idempotency-Key` 的作用域是 `(credential source, principal, raw key)`,**不含端点** —— 同一个 key 先
+ * 走 `/v1/tasks/stream`、再走 `/v1/tasks`,命中的是前者缓存的那份体。回执若铸在同步腿的体里,这条
+ * **确实产了帧**的 run 在非流式面上就成了「键缺席」,而 present-iff 的读法会把它读成「这台引擎不给
+ * 回执」。挂在 outcome 上 = 它是**这条 run 的属性**(哪条腿跑的都一样),由各腿自己的应答构造器在
+ * 送出那一刻按自己的 wire 形挂。拆缓存键也能消歧,但那会让换腿的重试**重复计费** —— 比缺一个键坏。
+ *
+ * 🔴 **租户面安全(别在复审里当成漏)**:缓存的那份回执是按**第一位调用方**的 `explicitOperatorOk` 投的,
+ * 而键本身就按 `principal` 分区(`scopedIdempotencyKey`)⇒ 命中它的只可能是**同一个** principal,同一份
+ * 部署 operator 名单下求值恒同 ⇒ operator 面不可能经重放落到租户手里。跨租户同 key 是**缓存未命中**
+ * (各自重跑、各自归账),这一位从 BL-3 起就是这么设计的。
+ *
+ * 对照:同一条 200 体上的 `notice` 仍铸在 `body` 里,因为它说的是**本次请求**带没带 verify/cascade
+ * (重放腿在 `prepareSpec` 之前就答了,结构上不知道这件事);回执说的是**那条 run**。两者的归属不同,
+ * 不是可以统一的两处写法。
+ */
+export interface SubmitOutcome {
+    status: number;
+    body: unknown;
+    /** S-528:本条 run 的起手接线回执(present-iff 引擎真产了 `wiring_manifest` 帧)。 */
+    wiringManifest?: WiringManifestReceipt;
+}
 //# sourceMappingURL=idempotency.d.ts.map

package/dist/http/route-ctx.d.ts

@@ -19,7 +19,7 @@ import type { HostDecision } from "../host-decision.js";
 import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, RunInternals, Runner, EngineNotice } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
-import type { IdempotencyCache } from "./idempotency.js";
+import type { IdempotencyCache, SubmitOutcome } from "./idempotency.js";
 import type { ImagesLocal } from "./routes/images.js";
 import type { SessionsLocal } from "./routes/sessions.js";
 import type { SessionSyncLocal } from "./routes/session-sync.js";
@@ -27,10 +27,7 @@ import type { PlanApprovePermissionModeAfter } from "../task-settings.js";
 import type { VerifyRoundsSpec } from "./verify-rounds.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。 */
 export interface RunRegistry {
-    idemCache: IdempotencyCache<{
-        status: number;
-        body: unknown;
-    }>;
+    idemCache: IdempotencyCache<SubmitOutcome>;
     inflightRuns: Map<string, AbortController>;
     preemptableRuns: Map<string, AbortController>;
     cancelledViaVerb: Set<string>;

package/dist/http/routes/memory-compliance.d.ts

@@ -9,7 +9,7 @@
  * ── 为什么是 operator-only ─────────────────────────────────────────────────────────────────────
  * 与 [ref] 的 bundle 两口同族(memory-bundle.ts 的同名段):
  *  · erase 是**治理写面**,而且是本族里爆炸半径最大的一口 —— 整 scope / 整会话删除是**合法**选择子,
- *    而 core 的大规模删除熔丝对它**显式不适用**(engine.d.ts:684 逐字:那道熔丝守的是「文件在 harvest
+ *    而 core 的大规模删除熔丝对它**显式不适用**(engine.d.ts 逐字:那道熔丝守的是「文件在 harvest
  *    时悄悄不见了」的事故形,一次显式授权的抹除靠在收执里逐 id 列举来自证);
  *  · provenance 是**跨租户治理读**:一条 entry 的绑定 / 贡献会话 / 污染标记 / 托管链事件全在里面,
  *    按定义超出任何单个 principal 的自助边界。

package/dist/http/routes/memory-origin.d.ts

@@ -97,7 +97,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
         detail?: string | undefined;
         eventId: string;
         at: number;
-        to: "done" | "failed";
+        to: "failed" | "done";
         requestId: string;
     }[];
     custodyBytes: number;
@@ -105,7 +105,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "pending" | "done" | "failed";
+    status: "failed" | "pending" | "done";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/http/routes/rules.js

@@ -312,7 +312,9 @@ async function handleRuleRevoke(res, rawBody, caller, lane, operatorPrincipals)
             sendJson(res, 200, { status: "removed", rev: outcome.rev, stillLive: outcome.stillLive });
             return;
         case "no-op": {
-            const stillLive = (await lane.listRules(target.principal)).rows.some((r) => sameWireRuleIdentity(r, { behavior: parsed.data.behavior, rule: parsed.data.rule, scope: serializeRuleScope(scope) }));
+            const stillLive = (await lane.listRules(target.principal)).rows.some((r) => sameWireRuleIdentity(r, { behavior: parsed.data.behavior, rule: parsed.data.rule, scope: serializeRuleScope(scope) }))
+                ? "yes"
+                : "no";
             sendJson(res, 200, { status: "no-op", rev: outcome.rev, stillLive });
             return;
         }

package/dist/http/routes/runs.js

@@ -1057,12 +1057,9 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const g14 = (() => {
             const d = out.details;
-            if (!d || d.error !== undefined || d.retrieval_status === "not_ready")
-                return {};
-            if (d.type === "background_bash")
-                return { cursorSemantics: d.details && "bytesDroppedBeforeCursor" in d.details ? "cursor" : "full" };
-            if (d.type === "monitor" || d.type === "background_agent")
-                return { cursorSemantics: "full" };
+            const replay = d?.details?.replay;
+            if (replay === "cursor" || replay === "full")
+                return { cursorSemantics: replay };
             return {};
         })();
         sendJson(res, 200, { taskId: runId, target, content: out.content, output: out.details, ...g14 });

package/dist/http/routes/session-sync.js

@@ -13,7 +13,7 @@ const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
-import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
+import { readSessionRulesRecords, describeSessionRulesRecordProblem, sessionPolicyErrorHttp } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -501,7 +501,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                     }
                     if (e instanceof SessionPolicyError) {
                         cleanupStaging(stagingId);
-                        sendError(res, e.code === "loosen_forbidden" ? 403 : 409, e.code, e.message);
+                        const h = sessionPolicyErrorHttp(e.code);
+                        sendError(res, h.status, h.errorCode, e.message);
                         return;
                     }
                     cleanupStaging(stagingId);

package/dist/http/routes/sessions.js

@@ -5,7 +5,7 @@ import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
-import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../../session-policy-wire.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem, sessionPolicyErrorHttp } from "../../session-policy-wire.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -768,7 +768,8 @@ export async function handleSessions(req, res, match, ctx) {
             }
             catch (e) {
                 if (e instanceof SessionPolicyError) {
-                    sendError(res, e.code === "conflict" ? 409 : 403, e.code, e.message);
+                    const h = sessionPolicyErrorHttp(e.code);
+                    sendError(res, h.status, h.errorCode, e.message);
                     return;
                 }
                 throw e;