@sema-agent/server 7.99.0 → 7.100.0

package/dist/config-center/restart-signal.js

@@ -1,7 +1,8 @@
 import { resolveActiveTiers } from "@sema-agent/settings-schema";
+import { DEFAULT_PLUGIN_ALLOW_HOSTS, materializablePlugins } from "../capabilities/center-plugins.js";
 import { resolveDefaultModelName } from "./apply-effective.js";
 import { CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
-const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "runtime-gates", "models-tiers", "degrade-route", "read-face"];
+const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "degrade-route", "read-face", "memory-consolidation"];
 export function stableStringify(v) {
     if (v === null || typeof v !== "object")
         return JSON.stringify(v) ?? "null";
@@ -26,31 +27,29 @@ function planeEntriesFingerprint(rows) {
     const enabled = enabledOnly(rows);
     return enabled ? enabled.map((m) => catalogEntryFingerprint(m)) : null;
 }
+function restartSlicePair(boot, current, slice, ctx) {
+    if (slice === "memory-consolidation") {
+        const seat = ctx?.consolidationSeat;
+        return seat === undefined ? [null, null] : [seat.baked, seat.current];
+    }
+    return [restartSliceValue(boot, slice, ctx), restartSliceValue(current, slice, ctx)];
+}
 function restartSliceValue(eff, slice, ctx) {
     if (!eff)
         return null;
     switch (slice) {
-        case "skills":
-            return enabledOnly(eff.skills?.skills);
+        case "skills": {
+            const skills = enabledOnly(eff.skills?.skills);
+            const materialized = materializablePlugins(eff, ctx?.pluginsAllowHosts ?? DEFAULT_PLUGIN_ALLOW_HOSTS);
+            const plugins = materialized.length > 0 ? materialized : null;
+            return skills === null && plugins === null ? null : { skills, plugins };
+        }
         case "mcp":
             return enabledOnly(eff.mcp?.servers);
         case "a2a":
             return enabledOnly(eff.a2a?.peers);
         case "scenarios":
             return enabledOnly(eff.scenarios?.scenarios);
-        case "runtime-gates": {
-            const ar = eff.governance?.approvalRequire;
-            return Array.isArray(ar) ? { approvalRequire: ar } : null;
-        }
-        case "models-tiers": {
-            const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
-            if (!active || Object.keys(active).length === 0)
-                return null;
-            const enabled = enabledOnly(eff.models?.models);
-            const names = new Set((enabled ?? []).map((m) => m.name));
-            const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
-            return { models: planeEntriesFingerprint(eff.models?.models), tiers: active, default: def.name };
-        }
         case "read-face": {
             const d = eff.readFace;
             if (!d)
@@ -70,8 +69,7 @@ function restartSliceValue(eff, slice, ctx) {
 }
 export function restartReasons(boot, current, ctx) {
     return RESTART_SLICES.filter((s) => {
-        const b = restartSliceValue(boot, s, ctx);
-        const c = restartSliceValue(current, s, ctx);
+        const [b, c] = restartSlicePair(boot, current, s, ctx);
         if (stableStringify(b) === stableStringify(c))
             return false;
         if (s === "mcp" && ctx?.mcpRevocationLive === true && Array.isArray(b) && Array.isArray(c) && c.length < b.length) {
@@ -89,10 +87,6 @@ export function restartReasons(boot, current, ctx) {
         return true;
     });
 }
-export function planeHasActiveTiers(eff) {
-    const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
-    return active !== undefined && Object.keys(active).length > 0;
-}
 export function modelPlaneChanged(prev, next) {
     if (!prev)
         return true;

package/dist/config-center/types.d.ts

@@ -303,7 +303,7 @@ export interface EffectiveConfig {
      *  settings-schema 0.6 起住 `governance` 域,0.7.1 撤了 runtime 位的双写镜像;此后 `RuntimeConfig` 是 strip
      *  的 zod object,两条腿(远端 `readEffectiveWire` / 本地 FileConfigStore→`buildEffective`)都把旧位 strip
      *  掉、由 `legacyGovernanceFromRuntime` 抬进 governance ⇒ 本仓在 runtime 位上读它们的每一行都是死码。
-     *  旧类型面上留着这三键,让 `runtime-gates` 重启片一直读着一个生产上恒缺席的位(审批闸收紧静默不生效)。 */
+     *  旧类型面上留着这三键,让(已于 S-668 波 2 退役的)`runtime-gates` 重启片一直读着一个生产上恒缺席的位(审批闸收紧静默不生效)。 */
     runtime?: {
         rateLimitPerMin?: number;
         maxTaskCostUsd?: number;
@@ -342,8 +342,8 @@ export interface EffectiveConfig {
     /** settings-schema 0.6 起治理三件(autonomy/commandPolicy/approvalRequire)的**唯一**承运域(0.7.1 撤
      *  runtime 位双写镜像;顺序契约当年已走完:消费端先切、center 再撤)。键集与 schema `GovernanceConfig.shape`
      *  逐字相等([ref] 件3 对账门钉)。消费:autonomy/commandPolicy 逐请求热(`stageRuntimeHot`,boot+refresh);
-     *  approvalRequire boot-baked(`stageApprovalGate`,refresh 不写)⇒ 变更由 `runtime-gates` 重启片通告。
-     *  同一 presence 规则(undefined = 不管 → 保 env / 回基线)。 */
+     *  approvalRequire 自 S-668 波 2 起同样热(`stageApprovalGate`,boot+refresh 双腿,有自己的拒绝臂)。
+     *  同一 presence 规则(undefined = 不管 → 回 env 基线,非粘)。 */
     governance?: {
         autonomy?: Autonomy;
         commandPolicy?: CommandRule[];

package/dist/config-types.d.ts

@@ -472,8 +472,9 @@ export interface ServiceConfigFlat {
     /** registry-core 0.9.0 档位组: the resolved active tier table (`tier word → catalog model name`,
      *  e.g. `{pro: "ds-pro"}`) fed to `RunnerDeps.tiers` (core 1.265 expandTiers — tier words + CC aliases become
      *  catalog keys). NO env source — populated ONLY by applyEffective from `models.tierGroups`/`activeTierGroup`
-     *  via registry-core `resolveActiveTiers` (single semantic source). Empty = INERT (core contract). Consumed at
-     *  Runner CONSTRUCTION (restart-to-apply, same tier as models/roles); mutateInPlace keeps the reference. */
+     *  via registry-core `resolveActiveTiers` (single semantic source). Empty = INERT (core contract). Expanded at
+     *  Runner construction and re-expanded on every refresh-time plane swap (`Runner.swapDeps`) — HOT, same as
+     *  models/roles; mutateInPlace keeps the reference. */
     tiers: Record<string, string>;
     /** 142-S4(registry-core 0.10.0 projects 域):center 项目登记簿的 service 消费面 —
      *  键=projectId(PROJECT_ID_REGEX,generic lowercase UUID)。消费点:①`memoryScopeFor` 第三参数
@@ -1738,6 +1739,12 @@ export interface ServiceConfigFlat {
      * 位:与「查无活流」同一件事实的两个时刻,详见 `askBroadcast` 的该臂注))。`"timeout"` 宿主自报只留在 (b)(c) ——
      * 结束等待的确实是本仓的窗;其余三臂结束等待的是容量/连接/装配,自报恒缺席。
      *
+     * 🔴 **`deny` 交给引擎的形(S-689)**:部署政策拒对象臂 `{allow:false, settledBy:"policy", reason}` ⇒ 引擎结算
+     * `policy_refused`(`who.party:"none"`)、模型读策略句(「部署政策拒了、此处没有交互审批,别重试、做不需审批的
+     * 部分」)、run 不以「用户拒绝」收束而是继续。修前是裸 `false` —— 引擎契约里那就是「一个人拒了」
+     * (`human_refused` / `haltedOnUserRejection`),与本键「没有人会来」的自声明正好相反。(b)(c) 两臂照旧带
+     * `"timeout"` 自报(`approval_window_expired`)。
+     *
      * 🔴 **射程边界(成文,不是遗漏)**:
      *  · 唯一让本旋钮**无处施加**的键是 `TOOL_APPROVAL_ENABLED=false`(协调器整体不构造,core 走它自己的
      *    headless 姿态)。**不造推断腿**:旋钮只在协调器在场时有意义,这一句是成文而不是代码分支。
@@ -1747,16 +1754,24 @@ export interface ServiceConfigFlat {
      *    而不是 server 的 ask 行,「无 askStore 但有 durable 设施」正是 R-13 点名的**主受益部署**。
      *    要回滚 R-13 的行为面,键是 `UNATTENDED_APPROVAL_POLICY=deny`,**不是**协议开关。
      *    射程钉:`test/unattended-approval-policy.test.ts` 的 codex R2-F2 两格。
-     *  · APPROVAL_REQUIRE 名单工具走 `createApprovalBaselinePolicy` 的 durable gate 类,**不经流内臂**,
-     *    结构上不受本旋钮影响(裁定「非名单工具」的限定因此无需码内名单分支)。
+     *  · APPROVAL_REQUIRE 名单工具:**要不要 ask** 由 `createApprovalBaselinePolicy` 的 durable gate 类裁决,那一层
+     *    结构上读不到本旋钮;但那只 ask 的**答法**在协调器在场时与治理 ask 同走流内臂、同政策(引擎先问活席
+     *    `onAsk`,答 `"unavailable"` 才 park)⇒ `deny` 部署对名单工具同样当场拒。旧注「不经流内臂、不受本旋钮
+     *    影响」失实(test 黑盒证伪;S-689 的真 HTTP 格 `test/unattended-deny-settlement-e2e.test.ts` 用的正是
+     *    名单工具)。
      *  · **持久回放**(窗到期后向真源收敛、`ensureAsk` 幂等重入撞上已终结的行)读出 PARKING/PARKED 时
      *    **同样按旋钮改判** —— 它们与 (a) 是同一件事(赢家可能是别的副本或上一次调用),不统一的话同一只
      *    ask 的终局会取决于「谁赢了那把 CAS / 重试没重试」。人的真决议回放不受影响。
      *  · 唯一**不受**改判的是 `ensureAsk` 身份未定 / 坏行两臂(「身份不确定」的处置,不是「没有人」的
      *    处置),于是 `deny` 部署上仍可能落极少数 park(店抖动期),已知且有意的残余。
-     *  · `deny` 部署上 ask **行**仍会经 PARKING 记账(旋钮改的是交给引擎的终局,不是店语义)。收敛器只把
-     *    PARKING 行绑到**已经存在的** checkpoint 上,而 deny 部署里引擎从不 park ⇒ 绑不上,行按 run 终局
-     *    自行收敛成 DENIED/VOID,不会凭空生出 park;残余 = 那类行的归因记成 `routing_failure`。
+     *  · 🔴 `deny` 部署上政策结算**当场落行**(NP-2,7.100.0):窗到期 / emit 全灭两臂的店终局 claim 是 `refuse` 意图
+     *    —— 这一只 ask 行 CAS 成 DECIDED(deny) + `settled_by="policy"`(按 ask 作用域,不碰批、不连坐兄弟),与交给
+     *    引擎的那一只同一个来源词 ⇒ 重入 / 收敛后重入回放同一个政策拒,不退化成裸 `false`(人拒)。修前行停 PARKING,
+     *    run 完成后收敛器转 DENIED 且不带来源。仍按 PARKING 记账的只剩别的写者推进的行(park 政策副本 / 切换政策之前)
+     *    与崩溃后收敛器孤儿腿代打 expire 的行(后者 run 终局后成 DENIED、归因 `routing_failure`,已知残余)。
+     *  · 🔴 `deny` 部署上**批是单 ask 批**(S-689 codex R1-F1;`deriveAskScopedBatchId`):批是 park 路由的单位,
+     *    整腿一批的前提是「批一关腿就随 park 结束」;deny 下引擎拿到部署政策拒后腿继续跑,整腿一批会让首只到期
+     *    把批关掉(同腿后续的卡人批不动)、把兄弟连坐成 VOID(裸 `false` = 人拒)。
      */
     unattendedApprovalPolicy: UnattendedApprovalPolicy;
     /** [ref]① (clay A 案 = workflow 权限全面 CC parity): workflow 子 agent 的默认权限基线与主 LLM 同权(base `{}`)。

package/dist/cross-session-settings.js

@@ -1,7 +1,7 @@
 export const CROSS_SESSION_INBOUND_LAYER_NAMES = ["managed", "user", "repo"];
 export const CROSS_SESSION_INBOUND_LAYER_SOURCES = {
     managed: {
-        source: "CROSS_SESSION_INBOUND —— 部署/组织层旋钮(词表 accept|hold|refuse,未设=本层不设)",
+        source: "CROSS_SESSION_INBOUND —— 部署/组织层旋钮(词表取自 core CROSS_SESSION_INBOUND_SETTINGS:7.30.0 起 wake|next-turn|hold|refuse,旧词 accept 拒启;未设=本层不设)",
         wired: true,
     },
     user: {

package/dist/host-lsp-manager.d.ts

@@ -0,0 +1,29 @@
+/**
+ * S-616(core 7.30.1 #1073 提货)—— **宿主车道本地语言服务器**的唯一构造点。
+ *
+ * ## 病(DEBTS S-684 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
+ * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的
+ * `process.env`,脑钥 / 仓库令牌 / 本仓自己的凭据键全在里面,而语言服务器会执行仓里的代码(构建脚本、插件、
+ * 工作区配置)。7.30.1 起 core 默认改成 `scrubSecretEnv(process.env)`(按键名**形状**剥),并开了
+ * `NodeLspManagerOptions.env` 一格让宿主自己交 env(core 帖 [ref] ④;core 确认本仓的正确读法 = 交 host 车道**同一只**
+ * `scrubServerSecrets` 的结果)。
+ *
+ * ## 规则(一句)
+ * 语言服务器子进程的 env = {@link scrubServerSecrets}(process.env) —— 与模型可驱动的 host shell(`inheritEnv:"scrub"`)
+ * 和 project-memory 的 git 子进程**同一只函数**:目录 `type:"secret"` 键按名剥 ∘ core 形状规则按形剥。只交 core 的默认
+ * 会漏掉形状规则认不出的本仓凭据键(今天是 `OTEL_EXPORTER_OTLP_HEADERS`),那正是 S-684 当初的病形。
+ * 剥掉了什么经既有观测面留痕(site = `server.lsp.spawn-env`,每 site×key 一次披露 + 逐次计数)—— core 那侧
+ * 刻意不报(无收集器,KL),本仓这一格补上。
+ *
+ * ## 时刻
+ * env 在**构造时**取一次快照(boot / run-local 起腿时),而不是 core 默认那样每次 spawn 现取:`NodeLspManagerOptions.env`
+ * 是一份静态记录。本仓的 `process.env` 是 boot 期输入(热配置走配置中心,不改 `process.env`),两者在本仓部署上同值。
+ *
+ * ## 两个调用点
+ * `boot/execution-env.ts`(服务的 host 车道)与 `run-local.ts`(纯本地 CLI)此前各写一遍 `new NodeLspManager({ log })`;
+ * 现在都经本函数 —— 构造形只有一份,剥除规则也就只能有一份(源码对账钉在 `test/secret-env-scrub-disclosure.test.ts`)。
+ */
+import { NodeLspManager } from "@sema-agent/core";
+/** 构造宿主车道的本地语言服务器管理器(`create*`:返回活对象)。`log` = 管理器的观测钩(open/heal/degrade/evict 事件)。 */
+export declare function createHostLspManager(log: (event: string, fields: Record<string, unknown>) => void): NodeLspManager;
+//# sourceMappingURL=host-lsp-manager.d.ts.map

package/dist/host-lsp-manager.js

@@ -0,0 +1,14 @@
+import { NodeLspManager } from "@sema-agent/core";
+import { recordSecretEnvScrub } from "./observability/secret-env-scrub.js";
+import { scrubServerSecrets } from "./server-secret-env.js";
+export function createHostLspManager(log) {
+    const findings = [];
+    const scrubbed = scrubServerSecrets(process.env, findings);
+    recordSecretEnvScrub("server.lsp.spawn-env", findings);
+    const env = {};
+    for (const [k, v] of Object.entries(scrubbed))
+        if (v !== undefined)
+            env[k] = v;
+    return new NodeLspManager({ log, env });
+}
+//# sourceMappingURL=host-lsp-manager.js.map

package/dist/http/active-run-conflict.d.ts

@@ -13,15 +13,10 @@
  *    (`gate_not_tool_approval`/`gate_not_resumable`/`wake.gate_pending` 的指路句)。三处文案与本表若漂移,
  *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
  */
-import { type Autonomy } from "../runtime-governance.js";
+import { type GovernancePosture } from "../runtime-governance.js";
 import type { ShellGateDoctrine } from "@sema-agent/core";
 import { type RunRecord } from "../plugins/store-contracts.js";
 import { type PendingRowBinding } from "../plugins/checkpoint-store-sql.js";
-/** [ref] 归因的部署侧入参(两个治理旋钮;判据属主见 `governanceMandatesShellGateAlways`)。 */
-export interface GovernancePosture {
-    autonomy?: Autonomy;
-    manualModeShellGate?: "always" | "classify";
-}
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run \u2014 POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
 /**
@@ -123,11 +118,6 @@ export declare function resumeEntryForGate(kind: string, ids: {
     sessionId: string;
     taskId: string;
 }): string | null;
-export declare function governanceOriginOf(gate: {
-    riskDescriptor?: {
-        shellGateDoctrine?: ShellGateDoctrine;
-    };
-} | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** token 泛型:真身是 branded CheckpointToken(秘密能力,只在本函数内部流转,绝不进响应体)。 */
 /**
  * SSE 车道的 done 帧 result(拒绝形)。与 409 body **同一铸体处** —— 此前 tasks.ts 在 res.write 里
@@ -177,7 +167,7 @@ interface ConflictProbeDeps<TToken> {
         findPendingTokenBySession?: (sessionId: string, scope?: string, binding?: PendingRowBinding) => Promise<TToken | null | undefined>;
         /** 结构形(不 import core 的 `Checkpoint`):只声明本模块**真读**的几格。`riskDescriptor` 是
          *  core 在 mint 时挂到升级门上的判读元数据(display/triage only),`shellGateDoctrine` 是 2026-08-05
-         *  裁定加的取证格 —— 见下方 `governanceOriginOf` 的推导论证。`checkpointId`([ref],core 5.42.0)
+         *  裁定加的取证格 —— 见 `runtime-governance.ts` 的 `governanceOriginOf` 推导论证。`checkpointId`([ref],core 5.42.0)
          *  是行的非秘密稳定身份,可选 —— legacy 行没有它(见 `PendingGateMaterial.checkpointId`)。 */
         get?: (token: TToken) => Promise<{
             checkpointId?: string;

package/dist/http/active-run-conflict.js

@@ -1,4 +1,4 @@
-import { governanceMandatesShellGateAlways } from "../runtime-governance.js";
+import { governanceOriginOf } from "../runtime-governance.js";
 import { isParkedRunStatus } from "../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -27,11 +27,6 @@ function safeCheckpointIdOf(raw, token) {
         return undefined;
     return raw;
 }
-export function governanceOriginOf(gate, governance) {
-    if (gate?.riskDescriptor?.shellGateDoctrine !== "always")
-        return undefined;
-    return governanceMandatesShellGateAlways(governance ?? {}) ? true : undefined;
-}
 export function toDoneFrameResult(body) {
     return {
         status: "failed",

package/dist/http/admission.js

@@ -7,6 +7,7 @@ import { singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
+import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
@@ -193,6 +194,13 @@ export function createAdmission(ctx) {
                     return null;
                 }
             }
+            {
+                const webSearchVerdict = judgeRequestWebSearch(st.webSearch);
+                if (webSearchVerdict.kind === "malformed") {
+                    sendError(res, 400, "request.field_invalid", webSearchVerdict.issue);
+                    return null;
+                }
+            }
         }
         const skillsErr = validateUserSkills(body.skills);
         if (skillsErr) {

package/dist/http/resume-legs.d.ts

@@ -29,7 +29,7 @@ export declare function createResumeLegs(ctx: {
     routeCtxBase: RouteCtxBase;
     resumeCheckpoint: (sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, onResumeCommitted?: (grant: {
         overrideSessionId?: string;
-        validatedToolName: string | null;
+        rememberableToolName: string | null;
     }) => Promise<void>, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;

package/dist/http/resume-legs.js

@@ -1,6 +1,6 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
-import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
+import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, denyWorkflowParksUnreadable, findParkOrigin, planWorkflowParkedDecide } from "../parked-decide.js";
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
@@ -9,10 +9,10 @@ import { mintCancelledResult } from "../run-cancel-context.js";
 import {} from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS, createApprovalCardEmitter, isApprovalGateKind, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerMayRetire } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
@@ -198,11 +198,14 @@ export function createResumeLegs(ctx) {
             };
         }
         const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
-        const loadedGrantTool = paForGrant !== undefined && paForGrant.toolName && paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME
+        const rememberableTool = paForGrant !== undefined &&
+            paForGrant.toolName &&
+            paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
+            standingAnswerMayRetire(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config))
             ? paForGrant.toolName
             : null;
         const boundGrant = onResumeCommitted
-            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), validatedToolName: loadedGrantTool })
+            ? (overrideSessionId) => onResumeCommitted({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), rememberableToolName: rememberableTool })
             : undefined;
         const lateSettleSink = deps.approvalLateSettle;
         const lateSettleAnchor = lateSettleSink !== undefined && req !== undefined && token
@@ -496,8 +499,9 @@ export function createResumeLegs(ctx) {
                         const { type, ...rest } = frame;
                         const f = frame;
                         const write = rs0.appendEvent(taskId, drainSeq++, type, rest);
-                        if (f.type === "task_notification" && f.task_id)
-                            resumeNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), write.then(() => true, () => false));
+                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                        if (fKey !== undefined)
+                            resumeNotifiedKeys.set(fKey, write.then(() => true, () => false));
                         return write;
                     }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
                 }
@@ -544,7 +548,7 @@ export function createResumeLegs(ctx) {
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
+                                const key = taskNotificationDedupKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
@@ -671,7 +675,7 @@ export function createResumeLegs(ctx) {
                                 void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
-                                const key = taskNotificationStreamKey(n);
+                                const key = taskNotificationDedupKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
                                     resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
@@ -780,7 +784,7 @@ export function createResumeLegs(ctx) {
                             case "task_notification": {
                                 await flush();
                                 const tnr = ev.notification;
-                                const tnrKey = tnr?.task_id ? taskNotificationStreamKey({ task_type: tnr.task_type, task_id: tnr.task_id, status: String(tnr.status), seq: tnr.seq }) : undefined;
+                                const tnrKey = taskNotificationStreamKeyOf(tnr);
                                 const tnrPrior = tnrKey !== undefined ? resumeNotifiedKeys.get(tnrKey) : undefined;
                                 if (tnrPrior === undefined || !(await tnrPrior)) {
                                     const write = append("task_notification", taskNotificationEventData(ev));

package/dist/http/route-ctx.d.ts

@@ -357,11 +357,11 @@ export interface RouteLegs {
     resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
-     *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`
+     *  载入 cp** 的可记工具名(`rememberableToolName`,非 tool_approval / AskUserQuestion / legacy null / S-663 强制卡 ⇒ `null`
      *  = 无可记)一并回传,路由只对这个逐字落店。`overrideSessionId` = parked 腿的 root/host 会话 grant 锚。 */
     onResumeCommitted?: (grant: {
         overrideSessionId?: string;
-        validatedToolName: string | null;
+        rememberableToolName: string | null;
     }) => Promise<void>, 
     /** [ref]:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/decide` 腿传 `true`;
      *  内部 D-D SLA deny-sweep 不传 —— 它没有在等响应的人,提前受理对它零收益而少一条同步失败面。 */

package/dist/http/routes/approvals-assistant.d.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
-import { type GovernancePosture } from "../active-run-conflict.js";
+import { type GovernancePosture } from "../../runtime-governance.js";
 import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 /**

package/dist/http/routes/approvals-assistant.js

@@ -16,7 +16,7 @@ import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
-import { governanceOriginOf } from "../active-run-conflict.js";
+import { governanceOriginOf } from "../../runtime-governance.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import { readResumeCtx, resumeCtxCorruptAnswer } from "../resume-ctx-read.js";
@@ -689,7 +689,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             let pendingGrant;
             const grantOnCommit = remember && deps.approvalExemptionStore
                 ? async (grant) => {
-                    const canonical = grant.validatedToolName;
+                    const canonical = grant.rememberableToolName;
                     if (!canonical)
                         return;
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };

package/dist/http/routes/memory-compliance.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { erasureInputSmugglesPrototypeKey } from "../../memory-operator-faces.js";
+import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
@@ -35,6 +36,10 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
+    if (face === "erase" && err instanceof MemoryLayerUnwritableError) {
+        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
+        return true;
+    }
     const coreCode = codeOf(err);
     if (coreCode !== undefined && sentCoreCode(res, coreCode, err instanceof Error ? err.message : String(err)))
         return true;

package/dist/http/routes/memory-origin.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { ControlPlaneCorruptError } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { buildOriginFence, readOriginAware } from "../../memory-origin-fence.js";
+import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 export const MEMORY_ORIGIN_EXTERNAL_PATH = "/v1/memory/origin/external";
@@ -47,6 +48,10 @@ function codeOf(err) {
     return typeof code === "string" ? code : undefined;
 }
 function sentClassifiedFailure(res, ctx, face, err) {
+    if (face === "clear" && err instanceof MemoryLayerUnwritableError) {
+        sendError(res, 409, "memory.layer_unwritable", `memory layer directories are not writable on disk: ${err.dirList} — refused before the engine was called: nothing was written and no journal was left. Restore the owner write bit with \`chmod u+w ${err.chmodTargets}\` and retry. This is a known issue of the memory engine's mount: it leaves a layer that a session reads but does not write read-only on disk (directories 0555, entries 0444) and does not restore it, so a later project session can lock it again`);
+        return true;
+    }
     if (face === "clear") {
         const coreCode = codeOf(err);
         if (coreCode !== undefined && sentClearCode(res, coreCode, err instanceof Error ? err.message : String(err)))

package/dist/http/routes/sessions.js

@@ -9,6 +9,7 @@ import { readSessionPermissionRules, describeSessionPermissionRulesProblem } fro
 import { sendJson, sendError, sendSessionPolicyError, sseHeaders } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
+import { MemoryLayerUnwritableError } from "../../memory-layer-preflight.js";
 const MCP_STATUS_TTL_MS = 5_000;
 const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
 const A2A_STATUS_TTL_MS = 5_000;
@@ -499,6 +500,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
             }
             catch (err) {
+                if (err instanceof MemoryLayerUnwritableError) {
+                    deps.logger?.warn?.("session_memory_erase_layer_unwritable", { sessionId, dirs: err.dirs });
+                    sendError(res, 409, "memory.layer_unwritable", "memory erasure refused: a memory layer directory on this server is not writable on disk, so the erase was stopped before anything was written (nothing was deleted, no journal was left). Ask whoever operates this deployment to restore the owner write bit on the memory layer directories (a known issue of the memory engine's mount), then retry with the same requestId");
+                    return;
+                }
                 const code = err.code;
                 if (code === "config.memory_erasure_request") {
                     sendError(res, 400, "config.memory_erasure_request", err instanceof Error ? err.message : "invalid memory erasure request");

package/dist/http/routes/tasks.js

@@ -1,12 +1,12 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
-import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
+import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
 import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
-import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
+import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
@@ -393,7 +393,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                                     }
                                     else if (deliverable) {
-                                        const key = taskNotificationStreamKey(n);
+                                        const key = taskNotificationDedupKey(n);
                                         if (syncNotifiedKeys.get(key) === undefined) {
                                             syncNotifiedKeys.set(key, Promise.resolve(true));
                                             sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
@@ -465,7 +465,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 }
                                 else if (ev.type === "task_notification") {
                                     const tnv = ev.notification;
-                                    const tnvKey = tnv?.task_id ? taskNotificationStreamKey({ task_type: tnv.task_type, task_id: tnv.task_id, status: String(tnv.status), seq: tnv.seq }) : undefined;
+                                    const tnvKey = taskNotificationStreamKeyOf(tnv);
                                     const tnvPrior = tnvKey !== undefined ? syncNotifiedKeys.get(tnvKey) : undefined;
                                     if (tnvPrior === undefined || !(await tnvPrior)) {
                                         if (tnvKey !== undefined)
@@ -553,8 +553,9 @@ export async function handleTasks(req, res, match, ctx) {
                         if (closed || res.writableEnded || res.destroyed)
                             throw new Error("stream ended before the completion frame was written");
                         const f = frame;
-                        if (f.type === "task_notification" && f.task_id)
-                            syncNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), Promise.resolve(true));
+                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                        if (fKey !== undefined)
+                            syncNotifiedKeys.set(fKey, Promise.resolve(true));
                         sseData(res, frame);
                     }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
                     const withElicit = deps.elicitation

package/dist/http/server.d.ts

@@ -659,7 +659,7 @@ export interface ServiceDeploymentDeps {
      *  registry 部署),现有部署零影响。main.ts 在 applyEffective 落模型后翻 true(one-way latch)。 */
     modelReady?: () => boolean;
     /** Sema-registry restart signal: the refresh loop sets this when a pull carries restart-to-apply
-     *  changes (skills/mcp/scenarios/runtime-gates baked at boot) that DIFFER from this process's boot config.
+     *  changes (skills/mcp/a2a/scenarios/… baked at boot — the `RestartSlice` closed set) that DIFFER from this process's boot config.
      *  Surfaced at GET /health as `restartRequired` + `restart{reasons,version,since}` so the orchestrator can
      *  auto rolling-restart the worker. Change-detected (not presence) — absent when nothing baked-at-boot
      *  changed, so polling it never causes a restart loop. */
@@ -686,10 +686,11 @@ export interface ServiceDeploymentDeps {
     mcpRevocationState?: () => {
         revoked: string[];
     } | undefined;
-    /** codex R18 (models-tiers deferral): the persistent "deferred WITHOUT a next-boot handoff" state — set when a
-     *  changed model plane could not hot-apply (tier-frozen Runner / tiered candidate) AND no restart-surviving LKG
-     *  exists to justify forcing a restart. Surfaced on /health (`modelPlaneDeferred`) so the stuck-degraded state
-     *  outlives the one-shot warn (the etag advances → later ticks 304 and never re-enter the defer branch). */
+    /** codex R18: the persistent "retained WITHOUT a next-boot handoff" state — a candidate whose restart signal is
+     *  withheld because no restart-surviving handoff exists yet (durable-declared LKG publication incomplete, or a
+     *  boot skills debt not yet proven repairable). Surfaced on /health (`modelPlaneDeferred` — the key keeps its birth
+     *  name: it was born for the model-plane deferral, which retired with the `models-tiers` slice in S-668 波 0) so
+     *  the stuck state outlives the one-shot warn (the etag advances → later ticks 304). */
     planeDeferredState?: () => {
         version: number;
         since: number;

package/dist/http/wire-types.d.ts

@@ -450,9 +450,12 @@ export interface TaskRequestBody {
     /** The caller's per-request settings stamp (the client-side `SemaSettings` shape). The KEY SET is deliberately
      *  NOT mirrored here — a hand-written second shape on this interface would be the classic mirror-drift form.
      *  Per-key ownership is split, not single: `parseTaskSettings` (src/task-settings.ts) defensively owns the
-     *  shared settings keys on every path, while `settings.webSearch` has its OWN validator on the single-user
-     *  scenario lane (capabilities/scenarios.ts `webSearchConfigFromSettings` — the multi-tenant lane ignores it
-     *  by design). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
+     *  shared settings keys on every path, while `settings.webSearch` has its OWN judge (plugins/web-search.ts
+     *  `judgeRequestWebSearch`, S-199): a malformed block — including a missing or unknown `provider` — 400s on submit
+     *  on every lane, and only the single-user
+     *  scenario lane honors a well-formed one (capabilities/scenarios.ts — the multi-tenant lane ignores it by design;
+     *  a malformed block replayed on resume mounts no WebSearch for that call — never a substitute destination — with a
+     *  fail-open count). The declared type is the INTENDED caller form (sibling convention: `oneShot` declares boolean,
      *  runtime drops garbage): a non-array object bag, or omit the key. A `null` reads as absence on both the
      *  fresh-submit wall (prepareSpec) and replay (parseTaskSettings), and malformed forms 400 on submit /
      *  no-op on replay. ([ref] 件1 leftover key, declared 2026-08-31; ownership wording per codex adversarial round.)