@sema-agent/settings-schema 1.3.0 → 1.4.1

package/dist/safety-merge-spec.d.ts

@@ -14,7 +14,7 @@
  * admitted or rejected as one value under its `minTrust`. A resolver reads this table and has NO per-key
  * special-casing.
  *
- * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, board [5797] ④;
+ * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, [ref] ④;
  * the executing layer is core's `prepareCcImport` door + `RuleAddOrigin`, the resolver/shell halves are cli's):
  *   A category may declare `members`, each with its own admission floor and DIRECTION. Today only `permissions`
  *   does — `allow` / `deny` / `ask`, a CLOSED set ({@link SafetyMergeMember}; an unknown member is a compile error
@@ -39,7 +39,7 @@
  *   requiresRealApproval). Consumers read admission through {@link memberAdmission} / {@link memberMinTrust} /
  *   {@link membersOf} — never through a hardcoded allow/deny/ask table of their own (single source).
  *
- * TRUST ORDERING PRIMITIVES (1.2.0 — board [5796] ordering question → [5805] claim / [5807] consumer statement):
+ * TRUST ORDERING PRIMITIVES (1.2.0 — [ref] ordering question → claim / consumer statement):
  *   The floor words are only meaningful against a LADDER, and that ladder is v2-design §1:29, verbatim:
  *   `MANAGED 6 > GLOBAL 5 > PROJECT 4 > LOCAL 3 > SESSION 2 > TASK 1`. {@link trustRank} publishes exactly those
  *   numbers and {@link isAtLeast} the comparison a resolver makes (`rank(layer) ≥ rank(floor)` ⇒ admitted), so no
@@ -83,16 +83,44 @@ export declare function isAtLeast(layer: MinTrust, minTrust: MinTrust): boolean;
 export declare const MemberDirection: z.ZodEnum<["loosen", "tighten"]>;
 export type MemberDirection = z.infer<typeof MemberDirection>;
 /** One member's admission row. `minTrust` ABSENT ⇒ the category's `minTrust` applies: a row can refine the floor
- *  only by SAYING so; omission never lowers it (fail-closed by construction). */
+ *  only by SAYING so; omission never lowers it (fail-closed by construction).
+ *
+ *  `boolPole` (S-59 件八, 对抗复审 r3 [high]) — VALUE-DIRECTIONAL admission for a boolean member whose two poles
+ *  point opposite ways (`enabled:true` narrows the sandbox, `enabled:false` opens it): a write EQUAL to
+ *  `boolPole.strict` (strict equality, never truthiness — a string "true" is not the pole) is the tightening
+ *  write and is admitted at `boolPole.minTrust`; ANY other write — the loose pole, a non-boolean, or a
+ *  valueless query — is admitted at the ROW floor. 🔴 Vintage-safety law: a boolPole row's OWN `minTrust`
+ *  must be the LOOSEN floor (the category's), so a consumer that predates this field (its schema strips
+ *  `boolPole`) reads the row as tighten@<loosen-floor> and withholds BOTH poles from low-trust layers —
+ *  fail-closed (it loses only the convenience of low-trust tightening, it can never admit a loosening write).
+ *  Resolution is value-aware: pass the candidate value to {@link memberAdmission} / {@link memberMinTrust}. */
 export declare const MemberAdmission: z.ZodObject<{
     direction: z.ZodEnum<["loosen", "tighten"]>;
     minTrust: z.ZodOptional<z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>>;
+    boolPole: z.ZodOptional<z.ZodObject<{
+        strict: z.ZodBoolean;
+        minTrust: z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>;
+    }, "strip", z.ZodTypeAny, {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    }, {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    }>>;
 }, "strip", z.ZodTypeAny, {
     direction: "loosen" | "tighten";
     minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+    boolPole?: {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    } | undefined;
 }, {
     direction: "loosen" | "tighten";
     minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+    boolPole?: {
+        strict: boolean;
+        minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+    } | undefined;
 }>;
 export type MemberAdmission = z.infer<typeof MemberAdmission>;
 /** The RESOLVED admission a consumer branches on — the category fallback already applied, so `minTrust` is never
@@ -100,6 +128,12 @@ export type MemberAdmission = z.infer<typeof MemberAdmission>;
 export interface ResolvedMemberAdmission {
     readonly direction: MemberDirection;
     readonly minTrust: MinTrust;
+    /** Present iff the row is value-directional; `minTrust` above already reflects the VALUE handed in (row floor
+     *  when no value / not the strict pole). Exposed for presentation faces; enforcement should pass the value. */
+    readonly boolPole?: {
+        readonly strict: boolean;
+        readonly minTrust: MinTrust;
+    };
 }
 /** WHERE the category is enforced (STRENGTH) — MUST stay in lockstep with `EffectiveKey.enforcement` (types.ts).
  *  gate=data-plane engine, server=control-plane/TOB boundary, resolver=merger correctness, client=UI only. */
@@ -202,12 +236,30 @@ export declare const MergeCategorySpec: z.ZodObject<{
     members: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         direction: z.ZodEnum<["loosen", "tighten"]>;
         minTrust: z.ZodOptional<z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>>;
+        boolPole: z.ZodOptional<z.ZodObject<{
+            strict: z.ZodBoolean;
+            minTrust: z.ZodEnum<["local", "session", "project", "global", "managed", "task"]>;
+        }, "strip", z.ZodTypeAny, {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        }, {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        }>>;
     }, "strip", z.ZodTypeAny, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }>>>;
 }, "strip", z.ZodTypeAny, {
     enforcement: "gate" | "server" | "resolver" | "client";
@@ -231,6 +283,10 @@ export declare const MergeCategorySpec: z.ZodObject<{
     members?: Record<string, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }> | undefined;
     coreAxis?: "permissionDecision" | "toolEffect" | "egress" | "irreversibility" | "safetyAxis" | "severity" | "shellGate" | undefined;
 }, {
@@ -255,6 +311,10 @@ export declare const MergeCategorySpec: z.ZodObject<{
     members?: Record<string, {
         direction: "loosen" | "tighten";
         minTrust?: "local" | "session" | "global" | "project" | "managed" | "task" | undefined;
+        boolPole?: {
+            strict: boolean;
+            minTrust: "local" | "session" | "global" | "project" | "managed" | "task";
+        } | undefined;
     }> | undefined;
     coreAxis?: "permissionDecision" | "toolEffect" | "egress" | "irreversibility" | "safetyAxis" | "severity" | "shellGate" | undefined;
 }>;
@@ -341,6 +401,88 @@ export declare const SAFETY_MERGE_SPEC: {
         readonly fail: "closed";
         readonly seam: "ExecutionEnv (fs+net) + sensitive-path";
         readonly coreAxis: "egress";
+        readonly members: {
+            readonly enabled: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly allowUnsandboxedCommands: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly autoAllowBashIfSandboxed: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly enableWeakerNestedSandbox: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly enableWeakerNetworkIsolation: {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "network.allowManagedDomainsOnly": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "network.allowAllUnixSockets": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "network.allowLocalBinding": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: false;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "filesystem.allowManagedReadPathsOnly": {
+                readonly direction: "tighten";
+                readonly minTrust: "global";
+                readonly boolPole: {
+                    readonly strict: true;
+                    readonly minTrust: "local";
+                };
+            };
+            readonly "filesystem.denyWrite": {
+                readonly direction: "tighten";
+                readonly minTrust: "local";
+            };
+            readonly "filesystem.denyRead": {
+                readonly direction: "tighten";
+                readonly minTrust: "local";
+            };
+        };
     };
     readonly hooks: {
         readonly mergeShape: "runAll";
@@ -449,7 +591,7 @@ export type SafetyMergeCategory = keyof typeof SAFETY_MERGE_SPEC;
  *  DISTRIBUTIVE over `C` on purpose: a resolver holds a WIDENED `SafetyMergeCategory` (out of its key→category
  *  map), and a non-distributive form would index the whole union at once, fail the `members` check on the
  *  whole-key categories and collapse to `never` — typing `membersOf(category)` as `readonly never[]` at exactly
- *  the seam these helpers exist for (codex R2-F1). */
+ *  the seam these helpers exist for (对抗复审 R2-F1). */
 export type SafetyMergeMember<C extends SafetyMergeCategory> = C extends SafetyMergeCategory ? (typeof SAFETY_MERGE_SPEC)[C] extends {
     readonly members: infer M;
 } ? Extract<keyof M, string> : never : never;
@@ -462,12 +604,16 @@ export declare function membersOf<C extends SafetyMergeCategory>(category: C): r
  * Fail-CLOSED and loud on both misuse arms — a category without `members` has no member to name, and a member
  * outside the declared set is a caller bug, not "use the category floor" (that silent arm is exactly what would
  * let a typo admit a bucket under the wrong rule).
+ * Value-aware (对抗复审 r3): pass the CANDIDATE VALUE being written for a value-directional (`boolPole`) member —
+ * the strict pole resolves to `boolPole.minTrust`, everything else (loose pole / non-boolean / no value) to the
+ * row floor. Rows without `boolPole` ignore the value entirely.
  * @param categoryLabel only decorates the error message (the spec value carries no name of its own).
  */
-export declare function resolveMemberAdmission(spec: MergeCategorySpec, member: string, categoryLabel?: string): ResolvedMemberAdmission;
+export declare function resolveMemberAdmission(spec: MergeCategorySpec, member: string, categoryLabel?: string, value?: unknown): ResolvedMemberAdmission;
 /** A member's resolved admission (direction + floor, category fallback applied) from the published table.
- *  Unknown category or member ⇒ RangeError (never a fallback). */
-export declare function memberAdmission<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>): ResolvedMemberAdmission;
+ *  Unknown category or member ⇒ RangeError (never a fallback). Value-aware: pass the candidate value for a
+ *  `boolPole` member (see {@link resolveMemberAdmission}); omitting it answers the fail-closed row floor. */
+export declare function memberAdmission<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>, value?: unknown): ResolvedMemberAdmission;
 /** A member's admission FLOOR from the published table — the word a resolver compares the layer's trust against
  *  (`isAtLeast(layer, floor)` ⇒ admitted; the ladder is {@link trustRank}). Convenience over {@link memberAdmission}. */
-export declare function memberMinTrust<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>): MinTrust;
+export declare function memberMinTrust<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>, value?: unknown): MinTrust;

package/dist/safety-merge-spec.js

@@ -14,7 +14,7 @@
  * admitted or rejected as one value under its `minTrust`. A resolver reads this table and has NO per-key
  * special-casing.
  *
- * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, board [5797] ④;
+ * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, [ref] ④;
  * the executing layer is core's `prepareCcImport` door + `RuleAddOrigin`, the resolver/shell halves are cli's):
  *   A category may declare `members`, each with its own admission floor and DIRECTION. Today only `permissions`
  *   does — `allow` / `deny` / `ask`, a CLOSED set ({@link SafetyMergeMember}; an unknown member is a compile error
@@ -39,7 +39,7 @@
  *   requiresRealApproval). Consumers read admission through {@link memberAdmission} / {@link memberMinTrust} /
  *   {@link membersOf} — never through a hardcoded allow/deny/ask table of their own (single source).
  *
- * TRUST ORDERING PRIMITIVES (1.2.0 — board [5796] ordering question → [5805] claim / [5807] consumer statement):
+ * TRUST ORDERING PRIMITIVES (1.2.0 — [ref] ordering question → claim / consumer statement):
  *   The floor words are only meaningful against a LADDER, and that ladder is v2-design §1:29, verbatim:
  *   `MANAGED 6 > GLOBAL 5 > PROJECT 4 > LOCAL 3 > SESSION 2 > TASK 1`. {@link trustRank} publishes exactly those
  *   numbers and {@link isAtLeast} the comparison a resolver makes (`rank(layer) ≥ rank(floor)` ⇒ admitted), so no
@@ -95,10 +95,21 @@ export function isAtLeast(layer, minTrust) {
  *  contract. */
 export const MemberDirection = z.enum(["loosen", "tighten"]);
 /** One member's admission row. `minTrust` ABSENT ⇒ the category's `minTrust` applies: a row can refine the floor
- *  only by SAYING so; omission never lowers it (fail-closed by construction). */
+ *  only by SAYING so; omission never lowers it (fail-closed by construction).
+ *
+ *  `boolPole` (S-59 件八, 对抗复审 r3 [high]) — VALUE-DIRECTIONAL admission for a boolean member whose two poles
+ *  point opposite ways (`enabled:true` narrows the sandbox, `enabled:false` opens it): a write EQUAL to
+ *  `boolPole.strict` (strict equality, never truthiness — a string "true" is not the pole) is the tightening
+ *  write and is admitted at `boolPole.minTrust`; ANY other write — the loose pole, a non-boolean, or a
+ *  valueless query — is admitted at the ROW floor. 🔴 Vintage-safety law: a boolPole row's OWN `minTrust`
+ *  must be the LOOSEN floor (the category's), so a consumer that predates this field (its schema strips
+ *  `boolPole`) reads the row as tighten@<loosen-floor> and withholds BOTH poles from low-trust layers —
+ *  fail-closed (it loses only the convenience of low-trust tightening, it can never admit a loosening write).
+ *  Resolution is value-aware: pass the candidate value to {@link memberAdmission} / {@link memberMinTrust}. */
 export const MemberAdmission = z.object({
     direction: MemberDirection,
     minTrust: MinTrust.optional(),
+    boolPole: z.object({ strict: z.boolean(), minTrust: MinTrust }).optional(),
 });
 /** WHERE the category is enforced (STRENGTH) — MUST stay in lockstep with `EffectiveKey.enforcement` (types.ts).
  *  gate=data-plane engine, server=control-plane/TOB boundary, resolver=merger correctness, client=UI only. */
@@ -157,7 +168,56 @@ export const SAFETY_MERGE_SPEC = {
     handsReadOnly: { mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed", seam: "handsReadOnly" },
     shellGate: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["off", "classify", "always"] }, enforcement: "gate", fail: "closed", seam: "shellGate", coreAxis: "shellGate" },
     approver: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "onAsk (conflict → reject)" },
-    sandboxNetwork: { mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "gate", fail: "closed", seam: "ExecutionEnv (fs+net) + sensitive-path", coreAxis: "egress" },
+    // S-59 件八 — member-level admission for the sandbox category (the shell's temporary "which sub-key counts
+    // as tightening" table lifts upstream; its gate keeps only the VALUE-pole half as executing detail).
+    // The members below are the CLOSED SET a low-trust settings layer may still set — restricting needs no trust,
+    // so each is tighten@"local" (the lowest settings-FILE tier, same law as permissions.deny/ask). Direction
+    // evidence, per member, from the shell's sandbox schema `.describe()` texts (its `SandboxSettingsSchema`):
+    //   · enabled                    the sandbox being ON confines commands ⇒ setting `true` tightens (false = loosen pole);
+    //   · allowUnsandboxedCommands   `false` = the unsandboxed escape hatch is refused ⇒ tighten (true = loosen pole);
+    //   · autoAllowBashIfSandboxed   `false` = no auto-allow just for being sandboxed ⇒ tighten;
+    //   · enableWeakerNestedSandbox  `false` = the weaker nested sandbox stays off ⇒ tighten;
+    //   · enableWeakerNetworkIsolation `false` = the "Reduces security" switch stays off ⇒ tighten;
+    //   · network.allowManagedDomainsOnly `true` = only managed-layer domains honoured ⇒ tighten (its CONSUMER
+    //     additionally reads policy settings only — that is the shell schema's own semantics, not admission law);
+    //   · network.allowAllUnixSockets / network.allowLocalBinding `false` = the opening stays shut ⇒ tighten;
+    //   · filesystem.allowManagedReadPathsOnly `true` ⇒ tighten (same managed-only consumer caveat);
+    //   · filesystem.denyWrite / filesystem.denyRead — deny arrays only ever narrow ⇒ tighten in every write.
+    // A boolean member's admission is VALUE-directional and the pole is MODELED (对抗复审 r3 [high]): each boolean
+    // row carries `boolPole {strict, minTrust:"local"}` and keeps its ROW floor at the loosen floor "global" —
+    // value-aware consumers admit the strict pole at "local"; pole-blind consumers (whose schema strips boolPole)
+    // read tighten@global and withhold BOTH poles from low-trust layers (fail-closed: convenience lost, never a
+    // loosening write admitted). The two deny arrays narrow in every write, so they are plain tighten@"local".
+    // DELIBERATELY NOT members (⇒ the 1.1.0 header law: an undeclared member stays under the category minTrust
+    // "global" — exactly the consumer's fail-closed withhold arm, so FUTURE sub-keys are withheld by default):
+    //   · the loosen face — network.allowedDomains / network.allowUnixSockets / filesystem.allowWrite /
+    //     filesystem.allowRead (re-allow within denyRead = a loosener) / excludedCommands (named commands escape
+    //     the sandbox) / ignoreViolations / ripgrep (binary override) — widening is a privilege;
+    //   · failIfUnavailable — tightening on the security axis but its consequence is REFUSING TO START: admitted
+    //     low, a cloned repo writing {enabled:true, failIfUnavailable:true} turns a "tighten" key into a
+    //     denial-of-service primitive on any sandbox-less machine. An availability hard-gate is an operator's
+    //     decision ⇒ it rides the loosen floor. ("Tightening is always safe" holds INSIDE this boundary — the
+    //     boundary is written down rather than the sentence deleted.)
+    //   · INDETERMINATE (flagged for the shell to confirm, fail-closed meanwhile): network.httpProxyPort /
+    //     network.socksProxyPort (strictly routing, but they can steer sandboxed traffic to an arbitrary local
+    //     port) and enabledPlatforms (platform-set edits cut both ways) — unlisted ⇒ category floor.
+    sandboxNetwork: {
+        mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "gate", fail: "closed",
+        seam: "ExecutionEnv (fs+net) + sensitive-path", coreAxis: "egress",
+        members: {
+            enabled: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            allowUnsandboxedCommands: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            autoAllowBashIfSandboxed: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            enableWeakerNestedSandbox: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            enableWeakerNetworkIsolation: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            "network.allowManagedDomainsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            "network.allowAllUnixSockets": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            "network.allowLocalBinding": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+            "filesystem.allowManagedReadPathsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            "filesystem.denyWrite": { direction: "tighten", minTrust: "local" },
+            "filesystem.denyRead": { direction: "tighten", minTrust: "local" },
+        },
+    },
     hooks: { mergeShape: "runAll", minTrust: "project", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "hooks (single source or adapter-composed)" },
     mcpServers: { mergeShape: "overrideByName", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "spec.mcp + allowTools" },
     rulesInstructions: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "appendSystemPrompt / memory (GLOBAL→PROJECT→SESSION)" },
@@ -191,9 +251,12 @@ export function membersOf(category) {
  * Fail-CLOSED and loud on both misuse arms — a category without `members` has no member to name, and a member
  * outside the declared set is a caller bug, not "use the category floor" (that silent arm is exactly what would
  * let a typo admit a bucket under the wrong rule).
+ * Value-aware (对抗复审 r3): pass the CANDIDATE VALUE being written for a value-directional (`boolPole`) member —
+ * the strict pole resolves to `boolPole.minTrust`, everything else (loose pole / non-boolean / no value) to the
+ * row floor. Rows without `boolPole` ignore the value entirely.
  * @param categoryLabel only decorates the error message (the spec value carries no name of its own).
  */
-export function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)") {
+export function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)", value) {
     if (spec.members === undefined) {
         throw new RangeError(`SAFETY_MERGE_SPEC: category '${categoryLabel}' has no member-level admission — its minTrust applies to the whole key`);
     }
@@ -201,15 +264,21 @@ export function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed c
         throw new RangeError(`SAFETY_MERGE_SPEC: unknown member '${member}' of category '${categoryLabel}' (members: ${Object.keys(spec.members).join(", ")})`);
     }
     const row = spec.members[member];
-    return { direction: row.direction, minTrust: row.minTrust ?? spec.minTrust };
+    const rowFloor = row.minTrust ?? spec.minTrust;
+    if (row.boolPole !== undefined) {
+        const floor = value === row.boolPole.strict ? row.boolPole.minTrust : rowFloor;
+        return { direction: row.direction, minTrust: floor, boolPole: row.boolPole };
+    }
+    return { direction: row.direction, minTrust: rowFloor };
 }
 /** A member's resolved admission (direction + floor, category fallback applied) from the published table.
- *  Unknown category or member ⇒ RangeError (never a fallback). */
-export function memberAdmission(category, member) {
-    return resolveMemberAdmission(categorySpec(category), member, category);
+ *  Unknown category or member ⇒ RangeError (never a fallback). Value-aware: pass the candidate value for a
+ *  `boolPole` member (see {@link resolveMemberAdmission}); omitting it answers the fail-closed row floor. */
+export function memberAdmission(category, member, value) {
+    return resolveMemberAdmission(categorySpec(category), member, category, value);
 }
 /** A member's admission FLOOR from the published table — the word a resolver compares the layer's trust against
  *  (`isAtLeast(layer, floor)` ⇒ admitted; the ladder is {@link trustRank}). Convenience over {@link memberAdmission}. */
-export function memberMinTrust(category, member) {
-    return memberAdmission(category, member).minTrust;
+export function memberMinTrust(category, member, value) {
+    return memberAdmission(category, member, value).minTrust;
 }

package/dist/scheduler-store-node.d.ts

@@ -30,7 +30,7 @@ export type SchedulerStoreMutation = {
     reason: 'aborted';
 };
 /**
- * The ONE cross-process mutation primitive for the shared scheduler store (board [1001]①/[1003]② —
+ * The ONE cross-process mutation primitive for the shared scheduler store ([ref]①/② —
  * server L1-2 + shell 对抗评审 F1 双向合流后的契约层统一原语). Every WRITER (engine backend, resident
  * daemon fire/reap, session reap, sweeps) must go through this instead of hand-rolled
  * load→filter→save — the naked sequence is a lost-update race: two writers load the same base

package/dist/scheduler-store-node.js

@@ -47,7 +47,7 @@ export function fileSchedulerStore(path) {
     };
 }
 /**
- * The ONE cross-process mutation primitive for the shared scheduler store (board [1001]①/[1003]② —
+ * The ONE cross-process mutation primitive for the shared scheduler store ([ref]①/② —
  * server L1-2 + shell 对抗评审 F1 双向合流后的契约层统一原语). Every WRITER (engine backend, resident
  * daemon fire/reap, session reap, sweeps) must go through this instead of hand-rolled
  * load→filter→save — the naked sequence is a lost-update race: two writers load the same base

package/dist/scheduler-store.js

@@ -44,7 +44,7 @@ export function isSchedulerRecord(v) {
  * record must leave a trace reachable by whoever can act on it).
  */
 /**
- * core 5.5.0 durable 键分叉的迁移半场(board [2439]/[2440]/[2444];server 裁 (a) 一次性迁移,拒读侧
+ * core 5.5.0 durable 键分叉的迁移半场([ref];server 裁 (a) 一次性迁移,拒读侧
  * 双键容忍窗)。旧铸键链 `sessionId ?? principal ?? taskId ?? "default"` 让 durable 行的隔离键随会话
  * 走——新会话新 sessionId ⇒ 旧 durable job 永远 not_found。core 5.5.0 起 durable 铸键=
  * `principal ?? "default"`;存量旧键行由**本层**在 parse 时重铸(纯函数,幂等:重写后判据自不满足)。