@sema-agent/server 7.98.0 → 7.100.0

package/dist/http/routes/sessions.js

@@ -9,6 +9,7 @@ import { readSessionPermissionRules, describeSessionPermissionRulesProblem } fro
 import { sendJson, sendError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
@@ -499,6 +500,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
+                if (err instanceof MemoryLayerUnwritableError) {
+                    deps.logger?.warn?.("session_memory_erase_layer_unwritable", { sessionId, dirs: err.dirs });
+                    sendError(res, 409, "memory.layer_unwritable", "memory erasure refused: a memory layer directory on this server is not writable on disk, so the erase was stopped before anything was written (nothing was deleted, no journal was left). Ask whoever operates this deployment to restore the owner write bit on the memory layer directories (a known issue of the memory engine's mount), then retry with the same requestId");
+                    return;
+                }
                 const code = err.code;
                 if (code === "config.memory_erasure_request") {
                     sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");

package/dist/http/routes/tasks.js

@@ -1,12 +1,12 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
-import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
+import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
 import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
@@ -393,7 +393,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                                     }
                                     else if (deliverable) {
-                                        const key = taskNotificationStreamKey(n);
+                                        const key = taskNotificationDedupKey(n);
                                         if (syncNotifiedKeys.get(key) === undefined) {
                                             syncNotifiedKeys.set(key, Promise.resolve(true));
                                             sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
@@ -465,7 +465,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 }
                                 else if (ev.type === "task_notification") {
                                     const tnv = ev.notification;
-                                    const tnvKey = tnv?.task_id ? taskNotificationStreamKey({ task_type: tnv.task_type, task_id: tnv.task_id, status: String(tnv.status), seq: tnv.seq }) : undefined;
+                                    const tnvKey = taskNotificationStreamKeyOf(tnv);
                                     const tnvPrior = tnvKey !== undefined ? syncNotifiedKeys.get(tnvKey) : undefined;
                                     if (tnvPrior === undefined || !(await tnvPrior)) {
                                         if (tnvKey !== undefined)
@@ -553,8 +553,9 @@ export async function handleTasks(req, res, match, ctx) {
                         if (closed || res.writableEnded || res.destroyed)
                             throw new Error("stream ended before the completion frame was written");
                         const f = frame;
-                        if (f.type === "task_notification" && f.task_id)
-                            syncNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), Promise.resolve(true));
+                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                        if (fKey !== undefined)
+                            syncNotifiedKeys.set(fKey, Promise.resolve(true));
                         sseData(res, frame);
                     }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
                     const withElicit = deps.elicitation

package/dist/http/server.d.ts

@@ -659,7 +659,7 @@ export interface ServiceDeploymentDeps {
      *  registry 部署),现有部署零影响。main.ts 在 applyEffective 落模型后翻 true(one-way latch)。 */
     modelReady?: () => boolean;
     /** Sema-registry restart signal: the refresh loop sets this when a pull carries restart-to-apply
-     *  changes (skills/mcp/scenarios/runtime-gates baked at boot) that DIFFER from this process's boot config.
+     *  changes (skills/mcp/a2a/scenarios/… baked at boot — the `RestartSlice` closed set) that DIFFER from this process's boot config.
      *  Surfaced at GET /health as `restartRequired` + `restart{reasons,version,since}` so the orchestrator can
      *  auto rolling-restart the worker. Change-detected (not presence) — absent when nothing baked-at-boot
      *  changed, so polling it never causes a restart loop. */
@@ -686,10 +686,11 @@ export interface ServiceDeploymentDeps {
     mcpRevocationState?: () => {
         revoked: string[];
     } | undefined;
-    /** codex R18 (models-tiers deferral): the persistent "deferred WITHOUT a next-boot handoff" state — set when a
-     *  changed model plane could not hot-apply (tier-frozen Runner / tiered candidate) AND no restart-surviving LKG
-     *  exists to justify forcing a restart. Surfaced on /health (`modelPlaneDeferred`) so the stuck-degraded state
-     *  outlives the one-shot warn (the etag advances → later ticks 304 and never re-enter the defer branch). */
+    /** codex R18: the persistent "retained WITHOUT a next-boot handoff" state — a candidate whose restart signal is
+     *  withheld because no restart-surviving handoff exists yet (durable-declared LKG publication incomplete, or a
+     *  boot skills debt not yet proven repairable). Surfaced on /health (`modelPlaneDeferred` — the key keeps its birth
+     *  name: it was born for the model-plane deferral, which retired with the `models-tiers` slice in S-668 波 0) so
+     *  the stuck state outlives the one-shot warn (the etag advances → later ticks 304). */
     planeDeferredState?: () => {
         version: number;
         since: number;

package/dist/http/wire-types.d.ts

@@ -450,9 +450,12 @@ export interface TaskRequestBody {
     /** The caller's per-request settings stamp (the client-side `SemaSettings` shape). The KEY SET is deliberately
      *  NOT mirrored here — a hand-written second shape on this interface would be the classic mirror-drift form.
      *  Per-key ownership is split, not single: `parseTaskSettings` (src/task-settings.ts) defensively owns the
-     *  shared settings keys on every path, while `settings.webSearch` has its OWN validator on the single-user
-     *  scenario lane (capabilities/scenarios.ts `webSearchConfigFromSettings` — the multi-tenant lane ignores it
-     *  by design). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
+     *  shared settings keys on every path, while `settings.webSearch` has its OWN judge (plugins/web-search.ts
+     *  `judgeRequestWebSearch`, S-199): a malformed block — including a missing or unknown `provider` — 400s on submit
+     *  on every lane, and only the single-user
+     *  scenario lane honors a well-formed one (capabilities/scenarios.ts — the multi-tenant lane ignores it by design;
+     *  a malformed block replayed on resume mounts no WebSearch for that call — never a substitute destination — with a
+     *  fail-open count). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
      *  runtime drops garbage): a non-array object bag, or omit the key. A `null` reads as absence on both the
      *  fresh-submit wall (prepareSpec) and replay (parseTaskSettings), and malformed forms 400 on submit /
      *  no-op on replay. ([ref] 件1 leftover key, declared 2026-08-31; ownership wording per codex adversarial round.)

package/dist/leader/wire.d.ts

@@ -3,6 +3,15 @@ import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
 import type { LeaderRequestBody } from "./endpoint.js";
+/** leader worker 的 durable 审批座(`LeaderWireConfig.durable` 函数席每次产出的一份)。 */
+export interface LeaderDurableSeat {
+    readonly checkpointStore: CheckpointStoreFull;
+    readonly requireApproval: string[];
+    readonly deny?: string[];
+    readonly ttlMs?: number;
+    readonly autoBudget?: number;
+    readonly neverAuto?: string[];
+}
 export interface LeaderWireConfig {
     /** Static-env compat mode (E2B only): the leader provisions/owns each env. Required when `envFactory` unset. */
     e2bApiKey?: string;
@@ -10,18 +19,17 @@ export interface LeaderWireConfig {
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
-    /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when set, each worker task carries the durable
-     *  question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker (checkpoint +
-     *  paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's per-task
-     *  durable wiring; ctx is seeded at provision so the surfaced token is resumable on the single-agent path. */
-    durable?: {
-        checkpointStore: CheckpointStoreFull;
-        requireApproval: string[];
-        deny?: string[];
-        ttlMs?: number;
-        autoBudget?: number;
-        neverAuto?: string[];
-    };
+    /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when the seat yields a value, that worker task carries
+     *  the durable question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker
+     *  (checkpoint + paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's
+     *  per-task durable wiring; ctx is seeded at provision so the surfaced token is resumable on the single-agent path.
+     *
+     *  🔴 **函数席,不是快照**(S-668 波 2 ①;先例 = 下方 `deploymentPosture` 的 S-174 函数席):审批名单
+     *  (`governance.approvalRequire`)自本批起在进程内会被中心热换。boot 期取一次值会把这条腿钉在起服那一刻的名单上
+     *  —— 起服时名单为空 ⇒ 整块缺席、之后加进来的工具在 leader worker 上**永远**不被门住(fail-OPEN)。
+     *  `provisionWorker` 每只 worker 调一次(同一只 worker 的 toolPolicy / resource 停车 / ctx 保温读同一份);
+     *  返回 `undefined` = 这只 worker 不接 durable 审批(与修前「键缺席」同义)。 */
+    durable?: () => LeaderDurableSeat | undefined;
     /** Durable tool-result offload store (TiDB). REQUIRED for `durable` to actually suspend: core's suspend
      *  pre-commit refuses with the default InMemoryToolResultStore (offloaded results would deref to null after
      *  a cross-replica resume) and silently falls back to the synchronous onAsk gate — which the leader does not

package/dist/leader/wire.js

@@ -241,9 +241,10 @@ export function createLeaderRunner(cfg) {
         };
         const provisionWorker = async (sub) => {
             const sessionId = `leader-${sub.workerId}-${Date.now()}`;
+            const durable = cfg.durable?.();
             let durableSpec = {};
-            if (cfg.durable) {
-                const d = cfg.durable;
+            if (durable) {
+                const d = durable;
                 durableSpec = {
                     toolPolicy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({ requireApproval: d.requireApproval, ...(d.deny ? { deny: d.deny } : {}), ...(d.autoBudget ? { autoBudget: d.autoBudget } : {}), ...(d.neverAuto ? { neverAuto: d.neverAuto } : {}) })),
                     checkpointStore: d.checkpointStore,
@@ -259,9 +260,9 @@ export function createLeaderRunner(cfg) {
             if (repairLoopActive && resourceCfg) {
                 cfg.logger?.warn?.("leader_resource_suspend_disabled_for_repair_loop", { workerId: sub.workerId, reason: "LEADER_REPAIR_LOOP active — resource-suspend mutually exclusive with the repair loop (§10.5)" });
             }
-            if (resourceCfg && !repairLoopActive && cfg.durable && cfg.toolResultStore && cfg.sessionStore) {
+            if (resourceCfg && !repairLoopActive && durable && cfg.toolResultStore && cfg.sessionStore) {
                 resourceSpec = {
-                    checkpointStore: cfg.durable.checkpointStore,
+                    checkpointStore: durable.checkpointStore,
                     resourceSuspend: { scope: `_leader-resource-${sub.workerId}`, totalBudgetUsd: resourceCfg.totalBudgetUsd },
                     limits: { ...workerLimits.limits, maxCostUsd: resourceCfg.sliceMaxCostUsd },
                     maxSuspends: resourceCfg.maxSuspends,
@@ -270,7 +271,7 @@ export function createLeaderRunner(cfg) {
             else if (resourceCfg && !repairLoopActive) {
                 cfg.logger?.warn?.("leader_resource_suspend_inactive", {
                     workerId: sub.workerId,
-                    reason: !cfg.durable
+                    reason: !durable
                         ? "no durable checkpoint store"
                         : !cfg.toolResultStore
                             ? "no durable tool-result store"
@@ -278,7 +279,7 @@ export function createLeaderRunner(cfg) {
                 });
             }
             const keepCtxWarm = (runner) => {
-                const d = cfg.durable;
+                const d = durable;
                 if (!d)
                     return runner;
                 const orig = runner.runTaskStream.bind(runner);

package/dist/memory-layer-preflight.d.ts

@@ -0,0 +1,46 @@
+/** 一只挡路的目录。`mode` = 权限位的四位八进制(如 `"0555"`)。 */
+export interface UnwritableLayerDir {
+    readonly dir: string;
+    readonly mode: string;
+}
+/**
+ * 挂载面整棵树里挡路的目录(排序后返回,空数组 = 放行)。判据见文件头「判定集合」,逐目录三步:
+ *  ① 缺**搜索位**(X_OK)⇒ 挡路、不下钻 —— 经过它的任何查找都撞 EACCES(不存在的删除目标也一样,`force` 只吞
+ *     ENOENT),里面空不空都一样(codex 验修轮 V2:0400 / 0600 的空目录 + 账本仍绑定 ⇒ journal 卡盘);
+ *  ② 只缺**写位**(W_OK)⇒ 装着任何非目录项(文件 / 软链)或列不出内容 ⇒ 挡路;空的、只装子目录的不挡
+ *     (core 锁出来的 0555 有 x,「空的锁住 local 不拒」即此臂);
+ *  ③ 下钻:子目录照走;**指向挂载面内目录的软链也顺着走**(codex 验修轮 V1:删除路径可以穿过它),按目标的 `dev:ino` 去重防环;
+ *     目标在挂载面外 ⇒ 不下钻、抛 {@link MemoryLayerSymlinkEscapeError}(NP-4)。
+ *
+ * 挂载面本身不存在 ⇒ 空(店还没建出来,没有可删的东西)。可写可搜索却列不出内容的目录、判不了的软链 ⇒ 抛原错误
+ * (判不了子树 ⇒ 不放行;不借本码 —— 出路不是 `chmod u+w`)。
+ */
+export declare function unwritableLayerDirs(mountRoot: string): UnwritableLayerDir[];
+/**
+ * NP-4 —— 挂载面里一条指向**树外**目录的软链:预检判不了(树外那棵子树里会不会删到、删不删得掉,本层不下钻去猜),
+ * 按 P 类 fail-closed 响亮拒 —— 与 ELOOP / EACCES 那一臂同形(原样抛 ⇒ 路由的未分类 500 + `memory_*_failed` warn,
+ * 文案只进日志)。刻意**不**是 {@link MemoryLayerUnwritableError}:那一码的出路是 `chmod u+w <dir>`,对树外目录开这句出路
+ * 等于教运维改系统目录的权限位。出路 = 把这条软链移出记忆层(日志点名软链与目标)。没有 `code` 字段:它不是 wire 码。
+ */
+export declare class MemoryLayerSymlinkEscapeError extends Error {
+    readonly link: string;
+    readonly target: string;
+    constructor(link: string, target: string);
+}
+/**
+ * 预检拒绝(带结构字段的错误值)。路由按 `instanceof` 判别(不嗅文案、不裸 as-cast);409 文案写在**路由**的
+ * 内联模板里(文案冻结门只看得见路由站点),本类只供两串排好版的插值。
+ */
+export declare class MemoryLayerUnwritableError extends Error {
+    readonly dirs: readonly UnwritableLayerDir[];
+    readonly code = "memory.layer_unwritable";
+    /** 409 文案的「哪些目录」插值:`"<dir>" (mode 0555), …`,超过上限只报余数。 */
+    readonly dirList: string;
+    /** 409 文案的出路插值:`chmod u+w` 的参数串 —— POSIX 单引号转义(照抄进 shell 不执行、不展开;codex R1-F3:
+     *  JSON 双引号挡不住 `$()` / 反引号 / `$VAR`)。目录清单那一串用 JSON 引号只作展示。 */
+    readonly chmodTargets: string;
+    constructor(dirs: readonly UnwritableLayerDir[]);
+}
+/** 两个 seam 的唯一入口:挡路 ⇒ 带码拒绝;放行 ⇒ `undefined`。 */
+export declare function memoryLayerWriteRefusal(mountRoot: string): MemoryLayerUnwritableError | undefined;
+//# sourceMappingURL=memory-layer-preflight.d.ts.map

package/dist/memory-layer-preflight.js

@@ -0,0 +1,121 @@
+import { accessSync, constants as fsConstants, readdirSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
+const NAMED_DIRS_MAX = 8;
+function errnoOf(err) {
+    return err.code;
+}
+function accessState(dir, bit) {
+    try {
+        accessSync(dir, bit);
+        return "granted";
+    }
+    catch (err) {
+        return errnoOf(err) === "ENOENT" ? "gone" : "denied";
+    }
+}
+function symlinkTarget(path) {
+    let st;
+    try {
+        st = statSync(path);
+    }
+    catch (err) {
+        if (errnoOf(err) === "ENOENT")
+            return "dangling";
+        throw err;
+    }
+    return st.isDirectory() ? "directory" : "other";
+}
+export function unwritableLayerDirs(mountRoot) {
+    const out = [];
+    const seen = new Set();
+    const stack = [mountRoot];
+    let mountReal;
+    const mountRealOnce = () => (mountReal ??= realpathSync(mountRoot));
+    for (let dir = stack.pop(); dir !== undefined; dir = stack.pop()) {
+        const search = accessState(dir, fsConstants.X_OK);
+        if (search === "gone")
+            continue;
+        if (search === "denied") {
+            out.push(...blocker(dir));
+            continue;
+        }
+        const id = statSync(dir, { throwIfNoEntry: false });
+        if (id === undefined)
+            continue;
+        const key = `${id.dev}:${id.ino}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const write = accessState(dir, fsConstants.W_OK);
+        if (write === "gone")
+            continue;
+        let children;
+        try {
+            children = readdirSync(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            if (errnoOf(err) === "ENOENT")
+                continue;
+            if (write === "granted")
+                throw err;
+            out.push(...blocker(dir));
+            continue;
+        }
+        if (write === "denied" && children.some((c) => !c.isDirectory()))
+            out.push(...blocker(dir));
+        for (const c of children) {
+            const child = join(dir, c.name);
+            if (c.isDirectory())
+                stack.push(child);
+            else if (c.isSymbolicLink() && symlinkTarget(child) === "directory") {
+                assertInsideMount(child, mountRealOnce());
+                stack.push(child);
+            }
+        }
+    }
+    return out.sort((a, b) => (a.dir < b.dir ? -1 : a.dir > b.dir ? 1 : 0));
+}
+function assertInsideMount(link, mountReal) {
+    const target = realpathSync(link);
+    const rel = relative(mountReal, target);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+        throw new MemoryLayerSymlinkEscapeError(link, target);
+}
+export class MemoryLayerSymlinkEscapeError extends Error {
+    link;
+    target;
+    constructor(link, target) {
+        super(`memory layer preflight cannot judge the mount: ${JSON.stringify(link)} is a symlink to ${JSON.stringify(target)}, outside the memory mount — not followed; move the symlink out of the memory layer and retry`);
+        this.link = link;
+        this.target = target;
+        this.name = "MemoryLayerSymlinkEscapeError";
+    }
+}
+function blocker(dir) {
+    const st = statSync(dir, { throwIfNoEntry: false });
+    return st === undefined ? [] : [{ dir, mode: (st.mode & 0o7777).toString(8).padStart(4, "0") }];
+}
+function shellQuote(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+export class MemoryLayerUnwritableError extends Error {
+    dirs;
+    code = "memory.layer_unwritable";
+    dirList;
+    chmodTargets;
+    constructor(dirs) {
+        const named = dirs.slice(0, NAMED_DIRS_MAX);
+        const rest = dirs.length - named.length;
+        const dirList = named.map((d) => `${JSON.stringify(d.dir)} (mode ${d.mode})`).join(", ") + (rest > 0 ? `, and ${rest} more` : "");
+        super(`memory layer directories are not writable on disk: ${dirList}`);
+        this.dirs = dirs;
+        this.name = "MemoryLayerUnwritableError";
+        this.dirList = dirList;
+        this.chmodTargets = named.map((d) => shellQuote(d.dir)).join(" ");
+    }
+}
+export function memoryLayerWriteRefusal(mountRoot) {
+    const dirs = unwritableLayerDirs(mountRoot);
+    return dirs.length > 0 ? new MemoryLayerUnwritableError(dirs) : undefined;
+}
+//# sourceMappingURL=memory-layer-preflight.js.map

package/dist/memory-operator-faces.js

@@ -1,5 +1,6 @@
 import { MemoryEngine, } from "@sema-agent/core";
 import { memoryMountRootOf } from "./memory-scope.js";
+import { memoryLayerWriteRefusal } from "./memory-layer-preflight.js";
 export function backendOwnsControlPlane(backend) {
     const b = backend;
     return typeof b?.controlPlaneRoot === "string" && b.controlPlaneRoot !== "";
@@ -40,6 +41,7 @@ function erasureEnvelopeRefusal(input, allowedScopes) {
 export function createMemoryComplianceFaces(store, opts) {
     if (!backendOwnsControlPlane(store.backend))
         return undefined;
+    const mountRoot = memoryMountRootOf(store.backend, store.root);
     const engine = new MemoryEngine({
         backend: store.backend,
         memoryDir: memoryMountRootOf(store.backend, store.root),
@@ -57,6 +59,14 @@ export function createMemoryComplianceFaces(store, opts) {
             const refusal = erasureEnvelopeRefusal(input, opts?.allowedScopes);
             if (refusal !== undefined)
                 return Promise.reject(refusal);
+            try {
+                const locked = memoryLayerWriteRefusal(mountRoot);
+                if (locked !== undefined)
+                    return Promise.reject(locked);
+            }
+            catch (err) {
+                return Promise.reject(err);
+            }
             return engine.eraseMemoryEntries(input);
         },
     };
@@ -64,6 +74,7 @@ export function createMemoryComplianceFaces(store, opts) {
 export function createMemoryOriginFaces(store, opts) {
     if (!backendOwnsControlPlane(store.backend))
         return undefined;
+    const mountRoot = memoryMountRootOf(store.backend, store.root);
     const engine = new MemoryEngine({
         backend: store.backend,
         memoryDir: memoryMountRootOf(store.backend, store.root),
@@ -73,7 +84,12 @@ export function createMemoryOriginFaces(store, opts) {
     return {
         listExternal: (scopes) => engine.listExternalOriginEntries(scopes),
         listClearances: () => engine.listOriginClearances(),
-        clear: (entryId, input) => engine.clearEntryOrigin(entryId, input),
+        clear: async (entryId, input) => {
+            const locked = memoryLayerWriteRefusal(mountRoot);
+            if (locked !== undefined)
+                throw locked;
+            return engine.clearEntryOrigin(entryId, input);
+        },
     };
 }
 export function createSessionMemoryStatusFace(store, opts) {

package/dist/observability/corrupt-read-seat.d.ts

@@ -18,9 +18,10 @@
  *
  * 载荷形不是本仓铸的:`FileStorageCorruptReadInfo` 是 **core 的导出**,并且是 core 亲口说的**最宽**那一只
  * ——"the widest shape any store this backend constructs can deliver, so ONE sink reaches all of them…
- * the two-field store seats are satisfied by it"。于是本属主就按那只最宽形收参:两个窄座
- * (`CorruptReadInfo = {path, reason}`)与 roster/mailbox 的内联形都因**可选成员**而逐字接受它
- * (`{path,reason}` 可赋给最宽形 ⇒ 吃最宽形的函数可赋给窄座)。**本仓因此零镜像类型**。
+ * the two-field store seats are satisfied by it"。于是本属主就按那只最宽形收参 —— 窄座的载荷都可赋给它
+ * ⇒ 吃最宽形的函数可赋给窄座。**本仓因此零镜像类型**。
+ * ⚠️ core 7.30.0(#1041 三态,S-616 提货)起 `CorruptReadInfo` 不再是 `{path, reason}` 两键形,而是按 `kind`
+ * 分三级的 union(`record` / `replay` / `file`,`path` + `reason` 每级都在);逐级读法见 {@link corruptReadLevelFields}。
  *
  * ## 刻意不做的两件事
  * · **不在这里下统一结论**:后果按脸各不相同(少了会话规则这一层 / 列表静默少行 / rewind 边界读成缺席 /
@@ -35,7 +36,7 @@
  * 闭包,天然满足;但**不要**把某个对象的裸方法引用直接塞进座 —— 读 `this` 会抛,而那个抛会被 core 的
  * guard 吞掉,于是披露**静默丢失**(比没接座更难查)。
  */
-import type { FileStorageCorruptReadInfo } from "@sema-agent/core";
+import type { FileStorageCorruptReadInfo, readJsonlRecords } from "@sema-agent/core";
 import type { Logger } from "./logger.js";
 /**
  * 铸一只腐读披露座。
@@ -53,4 +54,20 @@ export declare function createCorruptReadSeat(warn: Logger["warn"], event: strin
  * 这一句从前在两处各抄一份、只差一个词;现在词从参数来,句子只有一份。
  */
 export declare function buildDurableAbsenceNote(thirdFace: string): string;
+/** core `readJsonlRecords` 的坏行回调入参(core 不从包根导出这两级的型名 ⇒ 从那只函数的签名派生,不手抄)。 */
+export type JsonlCorruptInfo = Parameters<NonNullable<Parameters<typeof readJsonlRecords>[1]>>[0];
+/** 其中「一条被跳过的记录」那一级。 */
+export type JsonlSkippedRecord = Extract<JsonlCorruptInfo, {
+    kind: "record";
+}>;
+/**
+ * S-616(core 7.30.0 #1041 提货)—— 本仓直接调 `readJsonlRecords` 的店(approval-ask 日志、permission-rule 两本日志)
+ * 的坏行回调**唯一**形。core 自这一版起对一次坏读报两级:每条被跳过的记录一发 `record`,这次重放的计数一发
+ * `replay`(`dropped` = 同一批 `record` 的条数)。这些店按**记录**计数、按记录告警 / 跳闸 —— 手写回调不分级就把同一条
+ * 坏行记两次(k3s8 实测:approval-ask 的「1 条解析不出」读成 2 条,permission-rule 的 onError 一行变两行)。
+ * 规则一句:**只按记录计,计数级是同一事实的汇总,不再计一次**;穷举 switch,core 加第三级 ⇒ 编译红。
+ * 与 {@link createCorruptReadSeat} 的分工:那只是 core 自带 File 店的**披露座**(两级都转发,日志按 `kind` 分桶);
+ * 本函数是本仓自有店**消费**坏行事实的口子(计数 / 跳闸只要记录级)。
+ */
+export declare function createSkippedRecordSink(onRecord: (info: JsonlSkippedRecord) => void): (info: JsonlCorruptInfo) => void;
 //# sourceMappingURL=corrupt-read-seat.d.ts.map

package/dist/observability/corrupt-read-seat.js

@@ -1,16 +1,47 @@
 export function createCorruptReadSeat(warn, event, note) {
     return (info) => warn(event, {
+        kind: info.kind,
         path: info.path,
         reason: info.reason,
+        ...corruptReadLevelFields(info),
         ...(info.sessionId !== undefined ? { sessionId: info.sessionId } : {}),
         ...(info.principal !== undefined ? { principal: info.principal } : {}),
         ...(note !== undefined ? { note } : {}),
     });
 }
+function corruptReadLevelFields(info) {
+    switch (info.kind) {
+        case "record":
+            return { line: info.line, form: info.form };
+        case "replay":
+            return { kept: info.kept, dropped: info.dropped, total: info.total };
+        case "file":
+            return {};
+        default: {
+            const unreachable = info;
+            return unreachable;
+        }
+    }
+}
 export function buildDurableAbsenceNote(thirdFace) {
     return ("a durable read was treated as ABSENT because the bytes were unreadable (never a plain ENOENT). " +
         "Consequence depends on which store read it: session-policy = that run lost its SUBTRACTIVE session-rule " +
         "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
         `rows; ${thirdFace}. Inspect the named path before deciding.`);
 }
+export function createSkippedRecordSink(onRecord) {
+    return (info) => {
+        switch (info.kind) {
+            case "record":
+                onRecord(info);
+                return;
+            case "replay":
+                return;
+            default: {
+                const unreachable = info;
+                return unreachable;
+            }
+        }
+    };
+}
 //# sourceMappingURL=corrupt-read-seat.js.map

package/dist/observability/fail-open.d.ts

@@ -39,7 +39,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.trace.projection-input-malformed": {
         readonly cls: "F";
-        readonly note: "7.78.0(core 7.18.0 #741/#786/#789/#790,`trace/project.ts` 的五张新投影脸共用一条规则):`tool_progress` / `tool_disclosure` 两帧的必需位读不出 ⇒ **整帧不发**;`wiring_manifest.hooks[]` / `wiring_manifest.lsp` / `context_usage.sections[]` 三段的容器形或成员形读不出 ⇒ 那一行/那一段被丢、全丢光即键缺席。规则一句话:**在场但读不出 ⇒ 计一次并丢弃;缺席从不计数**(缺席是这几张脸上的一等状态,契约把它定义成一个正面事实 —— `hooks` 缺席 = 「本条腿没有自己的钩子记录」、`sections` 缺席 = 「这条腿没装配出段 IR」、`lsp` 缺席 = 「本部署没接 LSP」)。放行的最坏后果=这条腿的消费端少一张观测/渲染面(壳退回上一份已知状态或通用卡片),**不影响任何裁决**——门在引擎里早已判完。反方向(半张脸照发)严格更坏:消费端会把读不出的行当成那个正面事实。计数是**唯一**能把「坏世代 / 第三方 producer 一直在发坏载荷」与那个正面事实分开的位。";
+        readonly note: "7.78.0(core 7.18.0 #741/#786/#789/#790,`trace/project.ts` 的五张新投影脸共用一条规则;之后逐版入族 —— NP-5 / 7.100.0 起含 `trace/task-notification-facets.ts` 的 S-616 委派终态 facet / 重供两键与 `compacted.summarizedCrossSessionMessages`,助手住叶模块 `trace/projection-drop.ts`,全表见普查表第 73 行):`tool_progress` / `tool_disclosure` 两帧的必需位读不出 ⇒ **整帧不发**;`wiring_manifest.hooks[]` / `wiring_manifest.lsp` / `context_usage.sections[]` 三段的容器形或成员形读不出 ⇒ 那一行/那一段被丢、全丢光即键缺席。规则一句话:**在场但读不出 ⇒ 计一次并丢弃;缺席从不计数**(缺席是这几张脸上的一等状态,契约把它定义成一个正面事实 —— `hooks` 缺席 = 「本条腿没有自己的钩子记录」、`sections` 缺席 = 「这条腿没装配出段 IR」、`lsp` 缺席 = 「本部署没接 LSP」)。放行的最坏后果=这条腿的消费端少一张观测/渲染面(壳退回上一份已知状态或通用卡片),**不影响任何裁决**——门在引擎里早已判完。反方向(半张脸照发)严格更坏:消费端会把读不出的行当成那个正面事实。计数是**唯一**能把「坏世代 / 第三方 producer 一直在发坏载荷」与那个正面事实分开的位。";
     };
     readonly "server.task-mcp.source-label-dropped": {
         readonly cls: "F";
@@ -121,6 +121,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint.risk_descriptor` 这一格**不是合法 JSON 文本**(手改过的行 / 回滚残留 / 列语义漂;与同一 `rows.map` 里的 `rule_suggestions` 是同族坏法,两方言都是 TEXT 列)。放行的最坏后果 = **这一行**的分诊 descriptor 落 null:severity 折 0 排到有 descriptor 的行之后、`shadowedRule` 无可脱敏、读面派生的 `governanceForced` 徽章不亮 —— 三者都是**展示/分诊**,不是执法判据(门早已 park,真按 `shellGateDoctrine` 判的 `active-run-conflict.ts` 读的是 checkpoint blob 的 `get()`,不经本读面),且 `governanceForced` 的成文语义本就是「缺席 = 没有治理来源的**证据**」。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 cell 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),连同其余所有行一起消失。故 F 类;tag 与候选那格**分开计**,并计会让「哪一格在坏」在遥测里读不出来。";
     };
+    readonly "server.approvals.park-row-blob-unreadable": {
+        readonly cls: "F";
+        readonly note: "S-700(`plugins/checkpoint-store-sql.ts` 的 `readParkRowFactsCell`):运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint` 列里寄存行的 **`pendingAction` 子树**(NP-3 / 7.100.0 起引擎内只取这一棵、整只快照不出库;只为 park 行事实 `requiresRealApproval` / `ruleOffersAbsence` 而读)**在场却不是一只对象**(JSON `null` 字面 / 串 / 数 —— 手改 / 迁移脚本改过)。子树**缺席**(SQL NULL:成员不在,或整只文档不是对象 —— 后者 `get()` 照旧拒;MariaDB 文本承载上的非 JSON 字节同样答 SQL NULL)⇒ 事实缺席、不计数。放行的最坏后果 = **这一行**的两位 park 行事实缺席(展示/分诊材料;core 定性 display metadata,resume 的带子读 gate 自己的位),队列其余部分照常 —— 而这一行本来就 resume 不了(`get()` 对同一格拒)。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 blob 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),与同一 `rows.map` 里 `rule_suggestions` / `risk_descriptor` 两格同族同判。故 F 类;tag 与那两格**分开计**(哪一格在坏要读得出来)。计数非零 = 这一行的 decide 同样读不动(`get()` 对同一格拒),去按 session 查那一行。";
+    };
     readonly "server.sql-json.checkpoint.pending-steer-queue-lossy": {
         readonly cls: "F";
         readonly note: "S-550(`plugins/checkpoint-store-sql.ts` 的 `get()`,core 5.14.0 #147 的耐久转向队列):一条挂起 run 的 `checkpoint.pending_steer_queue` 这一格**没能完整读出来**(不是合法 JSON 文本 / 不是数组 / 某一条目的四个必备键不合形)⇒ 读不出的那部分**丢掉**,run 照常 resume。放行的最坏后果 = 一条已经 park 的操作员转向指令**没有**在这次 resume 上注入(人以为说过的话没送到);不放行的代价是这条挂起的 run **永远不可 resume** —— resume 是它唯一的出路,为一格读不出的转向把整条 run 变成砖是错误的失败方向(写侧刻意相反:`setPendingSteer` 往一份读不全的队列上追加会把读不出的条目永久抹掉,那里 fail-loud)。故 F 类。留痕从一条 `logger.info` 升成登记 tag 的理由:日志行在**遥测轴**上是零信号,「这台机器的转向队列一直读不出来」与「这台机器本来就没人 steer」在指标上完全同形。计数非零 = 去按日志里的 token 指纹查那一行。";
@@ -227,7 +231,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approval.ambiguous-cas.expire": {
         readonly cls: "P-DEBT";
-        readonly note: "S-25(设计件 2026-08-31 §3 步骤 3;DEBTS S-25 / #290)→ S-69 收窄(S-25-R1 终局,core design/384 §4.3 七律 / §4.4 键形对表,[5934]):流内 ask 的**窗到期臂**打原子终局 claim(`claimTerminal(expire)`,S-69 前 `expireAsk` CAS)被 reject(抛错 / 超墙钟,什么也证明不了 —— 律 3 K2)之后,有界退避**重发同一 claim**(6 格 ⇒ 至多 7 把,在飞帽 2 按持久 askId 记、撞帽拍不计 attempt、让路探针读同帽同界、帽满或同 askId 尚有在飞操作时探针不计 rung、真相广播同 askId 全部登记(本登记已 done 亦广播)—— codex S-69 R2-1/R3-1/R3-2/R4-1/R5-1/R6-1/R6-2/R7-1;末格睡后仍再发 —— codex R1-F1 同律;总墙钟硬上界 TERMINAL_LADDER_WALL_MS ≈10.15s —— R2-2 修正算术 + R3-3 硬封顶)**全部 reject** ⇒ 按本臂意图投影结算 = park 路由(`\"unavailable\"`;`deny` 政策下 `{allow:false,settledBy:\"timeout\"}`)并留 park 墓碑。方向 fail-closed(无 DECIDED=approve 行绝不执行工具),但行**可能**已被另一副本判成 DECIDED(approve) 而本腿没兑现 —— 人批了、工具不跑、run 再挂起要人再批一次 = 丢一次人类决议,故记债不当合法兜底。补偿:core 侧仍 pending 的 checkpoint(人再批一次就走)+ 跨副本收敛器兜底(A-075.116②:其兜底覆盖本形经确认后本 tag 降 F)。**不计**的形(S-69 起命中条件收窄到「店对整条阶梯持续不可用」):claim 输 ⇒ 败方答案**携真相**(DECIDED ⇒ 按人的决议结算,零补读;PARKING/PARKED ⇒ park 路由;absent = 行不在/错 scope ⇒ K1 零退避投影),迟到回来的 claim 同样自足(迟到赢 ⇒ 副作用补做,迟到输 ⇒ 按真决议结算 —— 此前迟到回调只认 won 的那条残余窗即 S-25-R1,本批闭合);编辑在飞标记在场 ⇒ 有界让路(不重打 claim)、用尽走 park 路由(标记的事不是店的债,codex R1-F2/R2-F2;负终态与带载荷 approve 不受标记压制,R2-F1/R3-F1);阶梯里曾拿到真相而标记已放开 ⇒ 按那份真相结算。detail 带 askId 与 claim 把数。";
+        readonly note: "S-25(设计件 2026-08-31 §3 步骤 3;DEBTS S-25 / #290)→ S-69 收窄(S-25-R1 终局,core design/384 §4.3 七律 / §4.4 键形对表,[5934]):流内 ask 的**窗到期臂**打原子终局 claim(`claimTerminal(expire)`,S-69 前 `expireAsk` CAS;NP-2 / 7.100.0 起 `deny` 政策下意图是 `refuse` = 当场落 DECIDED(deny)+`settled_by=policy`,同一架阶梯、同一个 tag)被 reject(抛错 / 超墙钟,什么也证明不了 —— 律 3 K2)之后,有界退避**重发同一 claim**(6 格 ⇒ 至多 7 把,在飞帽 2 按持久 askId 记、撞帽拍不计 attempt、让路探针读同帽同界、帽满或同 askId 尚有在飞操作时探针不计 rung、真相广播同 askId 全部登记(本登记已 done 亦广播)—— codex S-69 R2-1/R3-1/R3-2/R4-1/R5-1/R6-1/R6-2/R7-1;末格睡后仍再发 —— codex R1-F1 同律;总墙钟硬上界 TERMINAL_LADDER_WALL_MS ≈10.15s —— R2-2 修正算术 + R3-3 硬封顶)**全部 reject** ⇒ 按本臂意图投影结算 = park 路由(`\"unavailable\"`;`deny` 政策下 `{allow:false,settledBy:\"timeout\"}`)并留 park 墓碑。方向 fail-closed(无 DECIDED=approve 行绝不执行工具),但行**可能**已被另一副本判成 DECIDED(approve) 而本腿没兑现 —— 人批了、工具不跑、run 再挂起要人再批一次 = 丢一次人类决议,故记债不当合法兜底。补偿:core 侧仍 pending 的 checkpoint(人再批一次就走)+ 跨副本收敛器兜底(A-075.116②:其兜底覆盖本形经确认后本 tag 降 F)。**不计**的形(S-69 起命中条件收窄到「店对整条阶梯持续不可用」):claim 输 ⇒ 败方答案**携真相**(DECIDED ⇒ 按人的决议结算,零补读;PARKING/PARKED ⇒ park 路由;absent = 行不在/错 scope ⇒ K1 零退避投影),迟到回来的 claim 同样自足(迟到赢 ⇒ 副作用补做,迟到输 ⇒ 按真决议结算 —— 此前迟到回调只认 won 的那条残余窗即 S-25-R1,本批闭合);编辑在飞标记在场 ⇒ 有界让路(不重打 claim)、用尽走 park 路由(标记的事不是店的债,codex R1-F2/R2-F2;负终态与带载荷 approve 不受标记压制,R2-F1/R3-F1);阶梯里曾拿到真相而标记已放开 ⇒ 按那份真相结算。detail 带 askId 与 claim 把数。";
     };
     readonly "server.approval.ambiguous-cas.cancel": {
         readonly cls: "P-DEBT";
@@ -235,7 +239,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approval.ambiguous-cas.unreachable": {
         readonly cls: "P-DEBT";
-        readonly note: "S-25 同族第三员 → S-69 收窄:**emit 全灭臂**(开卡帧两族都没送到任何连接)打 `claimTerminal(expire)`(S-69 前 `expireAsk` CAS)被 reject 之后,有界重发至多 7 把 claim(在飞帽 2,墙钟上界同 expire 员)全部 reject ⇒ 按本臂意图投影结算 = `emitFailed` ⇒ `\"unavailable\"`(park 路由;`deny` 政策下 deny),不留墓碑(卡没到任何人手上,无人持有这把 approvalId)。S-25 之前这条 catch 不读行直接强改 —— 正是 round2 finding A「durable 行已批准、活终局被 emit 全灭强改成 unavailable」的 catch 同形缺口;S-25 起行读出 DECIDED ⇒ 按人的决议结算;S-69 起真相随败方答案回来、迟到答案自足,只有店对整条阶梯持续 reject 才计数。";
+        readonly note: "S-25 同族第三员 → S-69 收窄:**emit 全灭臂**(开卡帧两族都没送到任何连接)打 `claimTerminal(expire)`(S-69 前 `expireAsk` CAS;NP-2 起 `deny` 政策下是 `refuse`,同窗到期员)被 reject 之后,有界重发至多 7 把 claim(在飞帽 2,墙钟上界同 expire 员)全部 reject ⇒ 按本臂意图投影结算 = `emitFailed` ⇒ `\"unavailable\"`(park 路由;`deny` 政策下 deny),不留墓碑(卡没到任何人手上,无人持有这把 approvalId)。S-25 之前这条 catch 不读行直接强改 —— 正是 round2 finding A「durable 行已批准、活终局被 emit 全灭强改成 unavailable」的 catch 同形缺口;S-25 起行读出 DECIDED ⇒ 按人的决议结算;S-69 起真相随败方答案回来、迟到答案自足,只有店对整条阶梯持续 reject 才计数。";
     };
     readonly "server.approval-ask-audit.append-failed": {
         readonly cls: "F";
@@ -271,7 +275,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approval-card.closed-word-out-of-set": {
         readonly cls: "F";
-        readonly note: "S-249(`approval-card.ts` 的边界窄读族;今天的唯一成员是 `readRuleOffersAbsence`):活卡帧 / `card_json` 的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40)。";
+        readonly note: "S-249(`approval-card.ts` 的边界窄读族;今天的唯一成员是 `readRuleOffersAbsence`):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。";
     };
     readonly "server.pg-pool.idle-client-error": {
         readonly cls: "F";