@sema-agent/server 7.99.0 → 7.101.0

package/dist/boot/memory-consolidation.js

@@ -16,6 +16,41 @@ export function resolveConsolidationDriverSeat(deps) {
     }
     return { options, seat: seatLabel(deps), model: options.model };
 }
+export function createConsolidationSeatWatch(plane) {
+    const baked = consolidationSeatFingerprint(plane());
+    return { read: () => ({ baked, current: consolidationSeatFingerprint(plane()) }) };
+}
+function consolidationSeatFingerprint(plane) {
+    const stop = new Error("consolidation seat probe: stopped before any request");
+    const refuse = () => {
+        throw stop;
+    };
+    const probeBrain = { stream: refuse, complete: refuse };
+    const seen = {};
+    let options;
+    try {
+        options = resolveMemoryConsolidationDriver({
+            ...plane,
+            brain: probeBrain,
+            getApiKeyAndHeaders: (model) => {
+                seen.model = model;
+                throw stop;
+            },
+        });
+    }
+    catch (err) {
+        return { unresolvable: err instanceof Error ? err.message : String(err) };
+    }
+    void options.chat({ system: "", user: "", maxTokens: 1, temperature: 0 }).catch(() => undefined);
+    if (seen.model === undefined) {
+        throw new Error("MEMORY_CONSOLIDATION_DRIVER=on, but the consolidation seat's restart probe could not observe which model the " +
+            "engine's seat resolver chose (the resolved chat seat no longer asks the per-model credential seat before its " +
+            "first await) — refusing rather than leave this seat's restart signal blind. This is an engine-pickup defect " +
+            "in boot/memory-consolidation.ts (createConsolidationSeatWatch), not a deployment setting.");
+    }
+    const { cost: _cost, ...route } = seen.model;
+    return route;
+}
 function seatLabel(deps) {
     if (deps.memoryConsolidationDriver?.chat !== undefined)
         return "explicit";

package/dist/boot/parked-revive-gate.js

@@ -29,6 +29,7 @@ export function createParkedReviveInheritedGate(deps) {
             : { env: createHostAdjudicationEnv(config, localRoot), ...homeBase };
         const rootSessionId = row.rootSessionId;
         const baseline = createApprovalBaselinePolicy(config, {
+            kind: "durable",
             question,
             ...(approvalExemptionStore && rootSessionId
                 ? {

package/dist/boot/reapers.js

@@ -120,6 +120,7 @@ export function startReapers(ctx) {
             pendingGraceMs: config.streamApproval.pendingGraceMs,
             adhocGraceMs: config.streamApproval.adhocGraceMs,
             orphanTtlMs: config.streamApproval.orphanTtlMs,
+            unattendedPolicy: config.unattendedApprovalPolicy,
             ...(toolApproval ? { emitRevoke: (frame, target) => void toolApproval.emitRevoke(frame, target) } : {}),
         });
     })();

package/dist/boot/resolve-spec.d.ts

@@ -79,7 +79,6 @@ export interface ResolveSpecCtx {
      */
     approverSeat: RunnerDepsOnAsk | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;
     deploymentHooks: NonNullable<RunnerDeps["hooks"]>;
     imageIndex: ReturnType<NonNullable<StoreBackend["imageIndex"]>> | undefined;

package/dist/boot/resolve-spec.js

@@ -10,13 +10,15 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
+import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
 import { HOST_POSTURE_REFUSED_CODE, taskApproverPostureHonored, taskWriteFaceRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
-import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, resolveTaskModel, terminalCatalogName } from "../model-select.js";
+import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
+import { modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { isRemoteScratchpadLane, remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
 import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
@@ -40,9 +42,12 @@ import { executionLaneCaps, executionLaneHomeDir, executionLaneOf } from "../exe
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 import { memoryFaceMounted } from "../memory-scope.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, noteSessionShellGate, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
-    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
+    const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, {
+        approvalSeat: durableEnabled ? "durable" : "absent",
+        singleUserAutoAcceptBaseline: singleUserAutoAcceptBaselineApplies(config),
+    });
     const realTaskRootOf = (auth) => {
         if (isSandboxPathAdjudicationLane(config.remoteExec?.provider))
             return undefined;
@@ -216,8 +221,16 @@ export function createResolveSpec(ctx) {
         if (rawAddReadDirs !== undefined && !cwdHonored(config)) {
             logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
-        const wireCatalog = expandTiers(config.models, config.tiers) ?? config.models;
-        const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atModelAllowlist);
+        const wireCatalog = selectableCatalog(config.models, config.tiers, config.modelRefusals);
+        const picked = resolveTaskModel(body.model ?? parsedSettings.settings?.model, objective, wireCatalog, config.atModelAllowlist, config.modelRefusals);
+        if (picked.unavailable !== undefined) {
+            const { requested, name, refusal, source } = picked.unavailable;
+            if (opts?.leg === "fresh") {
+                throw new HttpError(400, modelUnavailableMessage(source === "mention" ? "@-mention" : "model", requested.slice(0, 120), name, refusal), { code: "request.model_unavailable" });
+            }
+            metrics.inc("task_model_unavailable_fallback_total");
+            logger.warn("task_model_unavailable_fallback", { requested: requested.slice(0, 120), name, code: refusal.code, source, fallback: picked.model, sessionId: auth?.sessionId ?? null });
+        }
         if (picked.notAllowed !== undefined) {
             const { requested, resolved, source } = picked.notAllowed;
             if (opts?.leg === "fresh") {
@@ -339,7 +352,11 @@ export function createResolveSpec(ctx) {
             ...((() => {
                 if (typeof body.compactionModel !== "string" || body.compactionModel.length === 0)
                     return {};
-                const cm = matchCatalogModel(body.compactionModel, wireCatalog);
+                const cm = matchCatalogModel(body.compactionModel, wireCatalog, config.modelRefusals);
+                const refusedCm = cm === undefined ? refusedCatalogEntry(body.compactionModel, config.modelRefusals) : undefined;
+                if (refusedCm !== undefined && opts?.leg === "fresh") {
+                    throw new HttpError(400, modelUnavailableMessage("compactionModel", body.compactionModel.slice(0, 120), refusedCm.name, refusedCm.refusal), { code: "request.model_unavailable" });
+                }
                 if (cm === undefined) {
                     if (opts?.leg === "fresh") {
                         throw new HttpError(400, `unknown compactionModel "${body.compactionModel.slice(0, 120)}" — not in the configured catalog (name, tier word, or id; a catalog refresh may have removed it mid-request)`);
@@ -348,8 +365,8 @@ export function createResolveSpec(ctx) {
                     logger.warn("compaction_model_unknown_fallback", { requested: body.compactionModel.slice(0, 120), sessionId: auth?.sessionId ?? null });
                     return {};
                 }
-                if (!isModelAllowlisted(cm, wireCatalog, config.atModelAllowlist)) {
-                    const terminal = terminalCatalogName(cm, wireCatalog) ?? cm;
+                if (!isModelAllowlisted(cm, wireCatalog, config.atModelAllowlist, config.modelRefusals)) {
+                    const terminal = terminalCatalogName(cm, wireCatalog, config.modelRefusals) ?? cm;
                     if (opts?.leg === "fresh") {
                         throw new HttpError(400, `compactionModel "${body.compactionModel.slice(0, 120)}" is not in this deployment's @-mention allowlist (it resolves to catalog model "${terminal}") — the allowlist is configured by the operator (config-center models.atModelAllowlist)`, { code: "request.model_not_allowed" });
                     }
@@ -413,6 +430,7 @@ export function createResolveSpec(ctx) {
             promptProvider: centerDecls ? centerPromptProvider(centerDecls, scenarioName) : cap.promptProvider,
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
+                    kind: "durable",
                     question: liveQuestionFace,
                     ...(approvalExemptionStore && auth?.sessionId
                         ? {
@@ -421,8 +439,8 @@ export function createResolveSpec(ctx) {
                         }
                         : {}),
                 })
-                : singleUserAutoAcceptBaseline
-                    ? createApprovalBaselinePolicy(config)
+                : singleUserAutoAcceptBaselineApplies(config)
+                    ? createApprovalBaselinePolicy(config, { kind: "absent" })
                     : undefined),
             ...(durableEnabled
                 ? {

package/dist/boot/runner-deps.d.ts

@@ -5,8 +5,8 @@
  * `deps-literal-shape-gate` 的顶层条件展开门覆盖面不变);新增的只有 import 与包壳。
  *
  * ⚠️ **位置即契约**:必须晚于 stores/exec-env/coordinators/workflow 段(所有键都是它们的产物),
- * 且早于 `new Runner(runnerDeps)` —— Runner 构造会冻结 tier 展开后的私有目录副本
- * (`runnerTierFrozen` 判据就取自构造那一刻的 `config.tiers`)。
+ * 且早于 `new Runner(runnerDeps)` —— Runner 构造时展开 tier 表成私有目录副本(之后的换代经
+ * `Runner.swapDeps` 换进,见 boot/stage-08-reapers.ts)。
  * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
  */
 import { type CacheBreakFinding, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";

package/dist/boot/runner-deps.js

@@ -11,9 +11,11 @@ import { resolveServedSession } from "../orchestration/workflow-completion-inbox
 import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
+import { createInstructionSourceSeat } from "../instruction-source-notice.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../cross-session-settings.js";
 import { createPeerDirectory } from "../peer-directory.js";
+import { targetOutsideStoreInIncident } from "../memory-store-refusal.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
         return undefined;
@@ -188,8 +190,10 @@ export function createRunnerDeps(ctx) {
                 metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
                 if (report.patches)
                     metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
-                if (report.incident)
-                    logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
+                if (report.incident) {
+                    const code = targetOutsideStoreInIncident(report.incident);
+                    logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase, ...(code !== undefined ? { code } : {}) });
+                }
                 const byCode = new Map();
                 for (const r of [...(report.rejections ?? []), ...(report.inboundFindings ?? [])])
                     byCode.set(r.code, (byCode.get(r.code) ?? 0) + 1);
@@ -209,7 +213,9 @@ export function createRunnerDeps(ctx) {
         fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled ? makeLoadProjectMemory({ logger }) : undefined,
+        loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled
+            ? makeLoadProjectMemory({ logger, instructionSource: createInstructionSourceSeat(sessionStore, sharedRunnerDeps.onNotice) })
+            : undefined,
         probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && config.projectMemoryEnabled
             ? makeProbeInstructionSources()
             : undefined,

package/dist/boot/stage-02-registry-pull.js

@@ -1,8 +1,17 @@
 import { createUnpricedCeilingVerdict } from "./unpriced-ceiling-verdict.js";
 import { createConfigCenterRuntime } from "./config-center.js";
+import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 export async function runStage02(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
     const configCenter = await createConfigCenterRuntime({ config, logger, metrics, localRoot });
+    const noDefaultModel = defaultModelRefusal(config, "env");
+    if (noDefaultModel !== undefined) {
+        throw new Error(noDefaultModel);
+    }
+    const mintedRefused = refusedNameMintedRefusal(config);
+    if (mintedRefused !== undefined) {
+        throw new Error(mintedRefused);
+    }
     await configCenter.applyLocalRemoteExec();
     const ceilingVerdict = createUnpricedCeilingVerdict({ config, logger });
     ceilingVerdict.judge();

package/dist/boot/stage-05-execution-env.d.ts

@@ -5,7 +5,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-06-runners.d.ts

@@ -13,6 +13,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -33,7 +34,6 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -66,7 +66,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-06-runners.js

@@ -10,7 +10,7 @@ import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { backendOwnsControlPlane } from "../memory-operator-faces.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
-import { assertConsolidationDriverWirable, buildConsolidationValveAudit, createMemoryConsolidationFaces, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
+import { assertConsolidationDriverWirable, buildConsolidationValveAudit, createConsolidationSeatWatch, createMemoryConsolidationFaces, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
@@ -72,6 +72,7 @@ export function runStage06(ctx) {
             getApiKeyAndHeaders: createPerModelAuthSeat(() => configCenter.getKeyResolver()),
         })
         : undefined;
+    const consolidationSeatWatch = consolidationSeat ? createConsolidationSeatWatch(() => ({ models: config.models, tiers: config.tiers, roles: config.roles })) : undefined;
     const memoryConsolidationFaces = consolidationSeat && memoryEngine
         ? createMemoryConsolidationFaces(memoryEngine, {
             seat: consolidationSeat,
@@ -130,7 +131,6 @@ export function runStage06(ctx) {
     });
     const runner = new Runner(runnerDeps);
     const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
-    const runnerTierFrozen = Object.keys(config.tiers).length > 0;
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => configCenter.getKeyResolver(), metrics });
     const hookAgentRunner = new Runner({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) });
     const agentHookCall = async ({ prompt, model, timeoutMs, system }) => {
@@ -212,6 +212,6 @@ export function runStage06(ctx) {
     };
     const subRunner = new Runner(subRunnerDeps);
     const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    return { ...ctx, approvalAskAudit, centerRuntimeCapsResolver, checkpointStore, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runnerTierFrozen, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionShellGateRegistry, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, centerRuntimeCapsResolver, checkpointStore, consolidationSeatWatch, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionShellGateRegistry, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -17,7 +17,6 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../capabilities/scenarios.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -28,6 +27,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -48,7 +48,6 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -81,7 +80,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -6,7 +6,7 @@ import { parseCapEnv, parseNumOrFailNonNegative } from "../config.js";
 import { ensureChildSessionDurableWithPromotion } from "../plugins/session-store.js";
 import { webSearchConfigFromEnv, createWebSearchBackend, shouldProbeWebSearchOnBoot } from "../plugins/web-search.js";
 import { createAuthorizer } from "../security.js";
-import { assertGateIntentServiceable, buildForceDurableGateInertNotice, buildNoResponderBootWarns, hasOperatorGateIntent } from "../approval.js";
+import { buildForceDurableGateInertNotice, buildNoResponderBootWarns, gateIntentUnserviceableReason, singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { executionLaneOf } from "../execution-lane-caps.js";
 import { loadDeploymentSkills } from "../capabilities/skills.js";
 import { createRepoClient } from "../capabilities/repo-tools.js";
@@ -46,9 +46,9 @@ export async function runStage07(ctx) {
         maxOutputTokens: capEnv("TASK_MAX_OUTPUT_TOKENS_MAX"),
         maxTurns: capEnv("TASK_MAX_TURNS_MAX"),
     };
-    const operatorGateIntent = hasOperatorGateIntent(config);
-    assertGateIntentServiceable(config, checkpointStore !== undefined);
-    const singleUserAutoAcceptBaseline = config.requirePrincipal !== true && !operatorGateIntent;
+    const gateRefusal = gateIntentUnserviceableReason(config, checkpointStore !== undefined);
+    if (gateRefusal !== undefined)
+        throw new Error(gateRefusal);
     await reclaimOrphansAtBoot(runStore, checkpointStore, logger);
     const imageIndex = backend?.imageIndex ? backend.imageIndex() : undefined;
     const selectEnvTool = config.selectEnvironmentTool && config.remoteExec?.provider === "k8s" && imageIndex
@@ -79,7 +79,7 @@ export async function runStage07(ctx) {
         approvalFaceWired: toolApproval !== undefined || durableEnabled,
     }))
         logger.warn(w.event, w.fields);
-    if (singleUserAutoAcceptBaseline) {
+    if (singleUserAutoAcceptBaselineApplies(config)) {
         logger.info("tool_policy_single_user_default", {
             posture: "adjudicated auto-accept — ALL write/hand/MCP tool surfaces auto-allowed (core per-surface UNGATED enumeration suppressed for single-user turnkey)",
             tighten: "APPROVAL_REQUIRE / AUTONOMY / commandPolicy (re-surfaces + gates specific surfaces)",
@@ -155,6 +155,6 @@ export async function runStage07(ctx) {
     const builtinScenarioNames = Object.keys(scenarioDetails);
     configCenter.applyCenterScenarios({ scenarioDeps, scenarios, scenarioDetails, builtinScenarioNames });
     logger.info("capabilities", { skills: skills.length, scenarios: Object.keys(scenarios), repoTools: Boolean(repoClient) });
-    return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveTool, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, singleUserAutoAcceptBaseline, taskLimitCaps, taskTimeoutSec, webSearchProvider: webSearchCfg?.provider };
+    return { ...ctx, approvalExemptionStore, approvalNonceStore, authorize, imageBakes, imageIndex, parkedReviveInheritedGate, parkedReviveTool, rateLimiter, resumeAnchorStore, runStore, scenarioDetails, scenarios, selectEnvTool, taskLimitCaps, taskTimeoutSec, webSearchProvider: webSearchCfg?.provider };
 }
 //# sourceMappingURL=stage-07-capability-layer.js.map

package/dist/boot/stage-08-reapers.d.ts

@@ -2,7 +2,7 @@
  * 装配第 8 段 —— **后台 reaper**(§3-8)。
  * 维护 tick(startReapers)+ 托管留存 lane(独立定时器)+ OTLP 导出 + 限额座换代口 + 五只 boot Runner 的
  * 原子换代闭包 + config-center 刷新环与 key resolver 首建。
- * ⚠️ 位置即契约:刷新环必须在 `new Runner` 之后(runnerTierFrozen 与构造函数读同一 config 代际);
+ * ⚠️ 位置即契约:刷新环必须在 `new Runner` 之后(它要五只 boot Runner 的换代口 `swapRunnerDeps`);
  * key resolver 首建读的必须是 boot apply 之后的 config。
  * 🔴 `runDenySweep` 的 holder 住在 `late-binds.ts`(赋值点在第十段的 server 之后)。
  */
@@ -30,7 +30,6 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../index.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -41,6 +40,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -61,7 +61,6 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -94,7 +93,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-08-reapers.js

@@ -5,7 +5,7 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, config, configCenter, costQuota, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, runnerTierFrozen, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, config, configCenter, consolidationSeatWatch, costQuota, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
@@ -71,7 +71,7 @@ export function runStage08(ctx) {
             }
         }
     };
-    configCenter.startRefreshLoop({ runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict });
+    configCenter.startRefreshLoop({ pricing, limitSync, swapRunnerDeps, ceilingVerdict, checkpointStorePresent: checkpointStore !== undefined, ...(consolidationSeatWatch !== undefined ? { consolidationSeat: consolidationSeatWatch } : {}) });
     configCenter.initKeyResolver();
     return { ...ctx, otelExporter, reaper, retentionLaneStarted };
 }

package/dist/boot/stage-09-leader.d.ts

@@ -64,7 +64,6 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../index.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -75,6 +74,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -95,7 +95,6 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -128,7 +127,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-10-http-server.d.ts

@@ -64,7 +64,6 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
     scenarios: Record<string, import("../index.js").Scenario>;
     selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
-    singleUserAutoAcceptBaseline: boolean;
     taskLimitCaps: {
         timeoutSec: number | undefined;
         maxOutputTokens: number | undefined;
@@ -75,6 +74,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
     checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    consolidationSeatWatch: import("./memory-consolidation.js").ConsolidationSeatWatch | undefined;
     durableEnabled: boolean;
     elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
@@ -95,7 +95,6 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
     runner: import("@sema-agent/core").Runner;
     runnerDeps: import("@sema-agent/core").RunnerDeps;
-    runnerTierFrozen: boolean;
     runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
     sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
     sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
@@ -128,7 +127,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     dropSessionScoped: (sid: string) => void;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
-    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-10-http-server.js

@@ -23,7 +23,7 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export async function runStage10(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveTool, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionShellGateRegistry, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, singleUserAutoAcceptBaseline, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storeBackendDegraded, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, config, configCenter, costQuota, deploymentHooks, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportBackend, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveTool, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, registryJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionShellGateRegistry, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngineFacts, sqlWorkflowRunStore, staticWiring, storeBackendDegraded, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable } = ctx;
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
@@ -171,7 +171,7 @@ export async function runStage10(ctx) {
         hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
         noteSessionShellGate: sessionShellGateRegistry.note,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
-        singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
+        checkpointStore, deploymentHooks, imageIndex, perTaskImage,
         sessionEnvSelection,
         lockedKeys: governanceSeams.lockedKeys,
         liveQuestionFace: question,

package/dist/boot/stores.js

@@ -24,6 +24,8 @@ import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDev
 import { mysqlDriver, pgDriver } from "../plugins/sql-driver.js";
 import { assertCloudSnapshotBlobPosture, openStoreBackendWithFallback } from "../plugins/store-backend.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
+import { announceLockedLegacyMemoryLayers } from "../memory-layer-legacy-lock.js";
+import { createEngineNoticeForwarder } from "./runner-deps.js";
 import { buildMemoryRemoteLaneWarn, memoryEngineBackendFor, memoryEngineRemoteLanePosture, memoryEngineRootFor, memoryMountRootOf } from "../memory-scope.js";
 import { assertToolResultProvenanceSchema } from "../plugins/tool-result-store-sql.js";
 import { assertPermissionRuleApprovalSchema, assertPermissionRuleTicketSchema } from "../plugins/permission-rule-store-sql.js";
@@ -186,6 +188,8 @@ export async function openStores(ctx) {
     }
     else {
         memoryEngine = memoryEngineBackendFor(config, undefined, createMemoryEngineIncidentSink({ logger, metrics }));
+        if (memoryEngine)
+            announceLockedLegacyMemoryLayers(memoryMountRootOf(memoryEngine.backend, memoryEngine.root), createEngineNoticeForwarder(logger));
         if (memoryEngine && process.env.LOCAL_DATA_ROOT && !config.memoryEngineDir) {
             logger.warn("memory_engine_dir_defaulted", {
                 root: memoryEngine.root,

package/dist/capabilities/center-plugins.d.ts

@@ -78,8 +78,20 @@ export interface ApplyPluginsResult {
     /** 本轮拉取失败、沿用上次成功物化的插件名。 */
     lkgUsed: string[];
 }
-/** 总入口(条款 3/7/8):逐条物化 + 装载 + 让位合并。materialize 盘位 = `<cacheRoot>/<name>/live`
- *  (成功后原子 rename 替换,失败保留旧盘位 = LKG)。 */
+/**
+ * 装载器**会物化**的插件(按声明序)—— 每条声明过**同一只**判定 {@link validatePluginDecl},只留 `ok` 的
+ * `{name, url, sha?}`。restart 指纹(`config-center/restart-signal.ts` 的 skills 片,S-668 波 0)读的就是它:
+ * 装载器不读的字段(notes / version)、整条跳过的声明(`enabled:false` / marketplace 源 / 白名单外 host / 坏形)
+ * 在这里一并消失,于是「重启之后什么都不会变」的发布不签重启(codex 对抗复审 r1 [medium]);顺序保留 ——
+ * 撞名让位按声明序,对调两条是真变化。`allowHosts` 与装载时同一份(部署事实 `PLUGINS_ALLOW_HOSTS`)。
+ */
+export declare function materializablePlugins(eff: {
+    plugins?: unknown;
+}, allowHosts: readonly string[]): Array<{
+    name: string;
+    url: string;
+    sha?: string;
+}>;
 export declare function applyCenterPlugins(baseline: LoadedSkill[], eff: {
     plugins?: unknown;
 }, opts: {

package/dist/capabilities/center-plugins.js

@@ -113,12 +113,20 @@ export function resolvePluginSkillsRoot(cloneRoot) {
     }
     return { ok: true, dir: candidate };
 }
+function declaredPlugins(eff) {
+    if (Array.isArray(eff.plugins))
+        return eff.plugins;
+    const wrapped = eff.plugins?.plugins;
+    return Array.isArray(wrapped) ? wrapped : [];
+}
+export function materializablePlugins(eff, allowHosts) {
+    return declaredPlugins(eff).flatMap((decl) => {
+        const v = validatePluginDecl(decl, allowHosts);
+        return v.ok ? [{ name: v.name, url: v.url, ...(v.sha !== undefined ? { sha: v.sha } : {}) }] : [];
+    });
+}
 export async function applyCenterPlugins(baseline, eff, opts) {
-    const declared = Array.isArray(eff.plugins)
-        ? (eff.plugins)
-        : Array.isArray(eff.plugins?.plugins)
-            ? (eff.plugins.plugins)
-            : [];
+    const declared = declaredPlugins(eff);
     const out = { skills: [...baseline], failures: [], letGo: [], lkgUsed: [] };
     if (declared.length === 0)
         return out;