@sema-agent/client-core 0.72.4 → 0.72.6

package/CHANGELOG.md

@@ -49,6 +49,28 @@
 > 挡住 ⇒ 本批把它机械化——④a0 对 `pending` 行**要求段头已是日期形**(`(未发布)` 直接红),阶段一
 > commit 漏转在发布前就红,不再靠人记。
 
+## 0.72.6(2026-09-18)
+
+> 主题:**steer 之后谁续听那条 run**(cli L-379 P1 包侧半场;server 7.81.0 S-384 副作用 [7495] ④′)。**patch**:型面纯 additive(+1 函数 `steerFollowIntent` + `activeRunSelfHealRow` 第五个可选参;公面 968 → 969;零 wire 键;peer 不动)。接入面 §53。
+
+### Added
+
+- **`steerFollowIntent(outcome)`**(`src/adapter/activeRunSelfHeal.ts`):`running-steered` 结局 → 续听意图三态,按 SDK `SteerReceipt.delivery` 判 —— `applied` 与读不出 / 未知词 ⇒ `{ kind: 'tail', taskId }`(run 在跑,现在就 tail 至终局 / park;保守当活);`queued` ⇒ `{ kind: 'after-decision', taskId }`(run 停在待决 checkpoint,答卡后 resume 出的流才是要听的);`parked_for_wake` ⇒ `{ kind: 'after-wake', taskId }`(run 已终局,wake 之前什么都不会发生);其余结局 ⇒ `null`。病形:server 7.81.0 起 plan_review 决断后 run 立刻回 running、撞下一道门活着等卡,壳的跟进注入件撞活 run 被折成 steer,行文案说「watch that run」后 turn 收尾,**没有人 tail 那条 run** ⇒ 它新弹的决断卡永不上屏(实测 400 s 零事件;7.80.1 差分 3.3 s 上屏)。「该不该 tail、什么时候 tail」是三端同一判据,归包。`fromEventId` 包侧算不出(回执不带),壳用自己的 Last-Event-ID 续。🔴 `held-for-decision` 档刻意不加位:宿主答卡后重投注入件,那次提交要么开新 turn 要么再撞 409 回到这里。
+- **`activeRunSelfHealRow(outcome, signal?, copy?, origin?, follow?)` 第五参 `SelfHealFollowDeclaration { following?: boolean }`**:宿主传 `{ following: true }`(= 真的按上面的意图挂上了续听)时,handed-off 三句(注入形 / 用户形 applied / 用户形 delivery 读不出)从「watch that run …」换成事实陈述「sema is following that run and will surface whatever it asks for next」;不传 / false ⇒ 逐字节同 0.72.5。文案与行为同一前提:没接线的端不许替用户说「sema 在看着」。`queued` / `parked_for_wake` 两臂不换句(它们本就不说 watch;续听挂在 decide / wake 之后)。门 `run-terminal-identity-copy-test.mjs` G3 段 +34 格(红先绿后;异源对抗复审一轮 [medium] 真修:注入形对 queued / parked_for_wake 也换了句 ⇒ 只在意图为 tail 时换,加格钉住)。
+
+## 0.72.5(2026-09-18)
+
+> 主题:**server 7.82.1 提货 —— `capabilities.webSearch.backend` 部署默认 WebSearch 后端四态读面**(CC-31;server S-382 契约附录 B.1;cli [7418] ② 点名 / 本包 [7420] 认领)。**patch**:型面纯 additive(+1 常量 +5 函数,公面 962 → 968;零 wire 新键,本包只读;peer 不动)。接入面 §52。
+
+### Added
+
+- **`src/webSearchBackendCapability.ts`**:`projectWebSearchBackendCapability(caps)` / `observedWebSearchBackend(baseUrl?)` / `noteEngineCapsForWebSearchBackend(baseUrl, caps, { generation? })` / `forgetWebSearchBackendReading(baseUrl)` / `webSearchBackendDoctorDetail(reading)` + 常量 `WEB_SEARCH_BACKEND_NONE`。四态 `unobserved` / `not_reported` / `none` / `present { backend }`,与 `sqlEngineCapability` / `writeProtectionCapability` 同构同纪律(per-base 读账 + probe tee + 代际闸 + 换代失效口 + doctor 措辞单源)。🔴 键缺席 = 老引擎(<7.82.1)**判不了**,契约逐字不许读作「没有后端」;`backend: "none"` = 引擎明说本部署没有默认搜索后端(正面事实),但调用方自带 `settings.webSearch` 时工具仍装配 —— `none` 那句话把两半都说了。🔴 `backend` 按**开集**读(server 闭集取型自它的 provider 元组,加一只后端自动跟着长;本包不手抄三词当判据);`webSearch: null` / 非对象 / `backend` 非非空串 ⇒ 畸形删格(本位铸点永远铸对象,不折 `none`);多余成员不过境;开集词呈前消毒封长。门 `run-web-search-backend-capability-test.mjs` 44 格(红先绿后:index 未导出前 S0 红);singleton 清单 +1;typeshape `unknownExport` 344 → 346(两只 `caps: unknown` 入参)。sdk 9.6.0 `Capabilities` 尚未声明该键 ⇒ 本包按结构读,能力位台账门在 sdk 出键当天自动红逼一次登记。
+
+### Notes(零码改动的读法钉)
+
+- **resume reopen 的 HTTP 200 成功体可直接读**(cli 1.0.118 黑盒 G-L211-3 → L-377):server 在 checkpoint 真重开时不抛,200 体带 `errorCode` + `retriable: true`;`resumeReopenFromError` 一直按结构读、不认 `status`,200 体原样命中,不出第二个读口。`run-terminal-facts-projection-test.mjs` C4b–C4d 钉住:200 体 ≡ 409 抛错形逐字段相同 / `{ ok, body }` 包装形 ⇒ null(端要交 body 本身)/ `retriable` 缺席 ⇒ null。
+- **`wiring_manifest.autoConsolidation` 耐久腿恒缺席**(server [7487]):该段只在实时 stream 首帧对 operator 连接投出,`GET /v1/runs/:id/events` 重放结构性不带;§51「缺席 = indeterminate 不折 false」读法不变,§52 把这一形写进缺席语义。
+
 ## 0.72.4(2026-09-17)
 
 > 主题:**core 7.21.x 三件经 server 7.82.0 提货**(CC-35;发车帖 [7477] @client-core;判据 [7450] G3–G5)。**patch**:型面纯 additive(一个 `_sema_` 超集键 + 一个 chrome 可选臂;零运行期导出变化,公面 962;peer 不动)。接入面 §51。

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.72.4
+**Version:** 0.72.6
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -298,6 +298,7 @@ public-surface guard checks that last one).
 | `scripts/run-sdk-floor-test.mjs` | The SDK version floor — and, more to the point, that the *installed* type declarations still carry the keys this package reads |
 | `scripts/run-engine-caps-ledger-test.mjs` | A per-key disposition ledger for `GET /v1/capabilities`. The SDK's `Capabilities` grew from 74 keys to 93 in one release and nothing on the board could see it: this package consumes that table through four synchronous readers, and *nineteen new positions arriving while the package does not move* is exactly the disease shape this repo keeps logging on other axes — the fact is already on the wire, the package boundary is the cell that swallows it, and no client can read it however they write their side. So the ledger is reconciled **element-wise against the SDK interface in both directions**: a key the SDK added with no ledger row is red (someone must classify it), and a row for a key the SDK removed is red too (a registration that no longer does anything). Each row then has to survive its own claim — a `read` row names the source file, and the **code** there (comments stripped) must really mention the key, because prose asserting an alignment is the classic way these guards go hollow; a `not_read` row must have **zero** read sites in the tree, so wiring one up while the ledger still says the package ignores it is red rather than invisible. The census behind those two directions recognises five call shapes, each of which really occurs here — a reader whose base argument carries its own parentheses, a direct `caps.<key>`, a narrowing cast, an own-property read helper, and a `*_CAP` constant — and proves it on fabricated samples first, since a census that recognises one shape reports "nothing here" for the other four. What the guard deliberately does **not** judge is whether a position *ought* to be read: that is a design call, and the ledger only pins that every capability was looked at once by a person and that what they wrote down does not contradict the code |
 | `scripts/run-sql-engine-capability-test.mjs` | The SQL-posture read face and the four-state capability reader underneath it. One capability cell here carries **four different things**, and each one points an operator somewhere else: nothing has been observed yet in this process (a one-shot doctor run is always in that state), the response arrived but carries no such key (an older engine), the engine explicitly answered `null` — *this deployment has no SQL backend*, which is a **positive fact** rather than an absence — and a full reading. Fold any two together and the screen states something flatly, confidently, and wrongly, so every positive control here is paired with a control pointing the opposite way, and the four sentences the doctor row can print are checked to be pairwise distinct and non-implying. The reading itself is narrowed no tighter than the mint: `txnMode: null` is a **legal value** — two of the three engines always report it that way, and the upstream type note names reading it as "optimistic" as the error — so treating it as malformed would throw away the entire reading for ordinary deployments, which is the same disease this repo logged when a consumer's domain was narrower than the producer's. A response that cannot be parsed **clears** the cell rather than leaving the previous engine's answer in place, and a separate invalidation port exists for the case the generation latch cannot catch — a same-port respawn whose new probe never succeeded, where the stale reading would otherwise be answered as current fact. Untrusted values (the isolation string is read back from a database server variable) are sanitised and bounded before display, and the bound is applied **before** escaping so a visible escape never gets cut in half. Finally the export names are themselves a guard: the shell still carries a copy that is meant to go red on the package's same-named export and be swapped out, so renaming anything here would silently disarm that lock |
+| `scripts/run-web-search-backend-capability-test.mjs` | The deployment-default WebSearch backend read face (`capabilities.webSearch.backend`, engine ≥7.82.1). Same four-state discipline as the SQL and write-protection cells, with two things that are specific here and therefore guarded: a **missing key** (an older engine) and an explicit **`"none"`** (the engine says this deployment has no default search backend) point an operator in opposite directions — "cannot tell" versus "not configured" — and must never be folded; and the `none` sentence has to say both halves of the contract at once: the default scenario mounts no WebSearch tool, **and** a caller-supplied `webSearch` setting can still mount it on a single-user lane, because the capability advertises the deployment default, not whether this request has search. The backend word is read as an **open set** — the engine's closed set is typed from its own provider tuple and grows with it, so hand-copying three words here would turn a newly configured backend into "unreadable" (the narrower-than-the-mint disease this repo already logged once). `webSearch: null` is malformed rather than `none` (the mint never emits `null`), extra members never cross, an unparseable response clears the cell, a stale probe generation is dropped, the invalidation port clears to "not observed", and the open-set word is sanitised and bounded before display |
 | `scripts/run-terminal-cause-projection-test.mjs` | The `7.64.0` wire reshape, projected. A run's ending stopped being eight parallel flat keys and became **one tagged cause** (`completed | failed | blocked | paused`), and a tool call's gate stopped being four orthogonal words and became **one record** (`disposition` / `settlement?` / `origin?`). Both are read in exactly one place in this package, and this guard pins them at **two levels**, because the dangerous seam is "the reader was updated, the consumer was not": each terminal arm is checked on the reader *and* on the `subtype` / `is_error` / `errors[]` the projector actually emits. Two properties carry most of the weight. First, a terminal word this reader does not know is **never** laundered into an empty success — it lands on an `unknown` arm carrying the word verbatim, while a payload with no terminal word at all (the mock lane) keeps the success arm exactly as before, which is the one and only case the reader answers `null`. Second, the three window words (`approval_window_expired`, `denial_limit_window_expired`, `park_sla_expired`) must each be told apart by a different predicate: the previous generation collapsed all three onto one `timeout`, and re-merging them would throw away the discrimination this reshape just restored. Two byte generations are read by one reader, keyed on the discriminator upstream nailed (`"terminal" in result`): the current cause form, and the **flat** form that a current engine still emits on two lanes — replayed persisted bytes, which the service passes through verbatim rather than back-filling, and the service's own rejection envelope. A cause-form payload that also carries stale flat keys must ignore them entirely: keeping one compatibility read is what gives a single fact two sources. The same file also pins the MCP delivery verdict and HTTP status riding the wiring manifest, the four-state write-protection reading (where three of the four states mean *cannot tell*, and none of them may be printed as "there is no table"), and the park-reopen fetch identity: that predicate is asserted through the **real entry point**, since the defect being fixed was precisely a call site wired to a different predicate than the one that routed the row there |
 | `scripts/run-auto-mode-unavailable-test.mjs` | The fact behind "you are being asked because the auto-mode classifier could not run", and the one place its sentence is minted. The cause table is a **copy**, reconciled word for word in both directions against the installed engine's own bytes — it narrowed upstream, and the guard follows rather than keeping the old shape: a table checked against something nobody ships any more is the oldest way for a guard to be green and wrong. The retirement is held from both sides — the removed table must really be gone upstream, and the removed reader and word must really be gone here — while the word that left keeps arriving cleanly from an older engine, because the reader takes the cause as an **open set**: the vocabulary belongs upstream, so a copied list here would discard a legal value the day one is added, and the value discarded is precisely "this outage is a NEW kind". The reader's one exclusion is the word the engine says it never stamps here — the classifier did run and did answer, just outside its contract, so reading it as a failure would invent an event the engine denies. That exclusion used to be derived from a second table which no longer exists; the reason for it never lived in that table, so it is now stated where it actually comes from, pinned as a **named** set (a magic literal scattered through the reader reds) and cross-checked against the engine's own verdict declaration and against the reader having exactly one such comparison. One reader serves both the live ask and its durable parked twin, since the two carry the same key path and a second copy is how two ledgers drift apart. Absence is pinned as absence — most asks never consulted a classifier at all — and the sentences are checked mutually distinct, prototype-safe, and walked end to end: an unknown word reaches the sentence a person reads (the fallback that names it verbatim) and the status reading (unavailable for this round, never a fallback to "available"), with counter-controls proving neither assertion is vacuous |
 | `scripts/run-engine-notice-catalog-test.mjs` | The engine-notice catalog and its audience table. Whether a notice deserves a person's attention is not decided by whether this end happens to have a phrasing for it — that drifts with each client's build order — but by whether the engine minted the code into its own written catalog; the audience row answers the separate question of *who* the fact is for, since an operations fact pushed at an end user is noise and a user-facing fact buried in an operator log is something withheld from the person who could act on it. Both tables are reconciled against the installed engine's own artefacts in both directions and pinned in lockstep with each other, unknown codes fall back to the conservative operator side, and catalog membership is tested on the raw value so a code carrying control characters cannot impersonate a registered one after sanitizing. The reader for a dropped MCP injection keys on its own code alone and treats a missing session, server or reason as absence rather than throwing at a read site. A reverse pin enforces the upstream's single-mint contract: the engine composes those sentences from the host's facts, so a copy of them appearing in this package's source or build is a second source that would drift, and fails |
@@ -347,7 +348,7 @@ public-surface guard checks that last one).
 | `scripts/run-rules-side-test.mjs` | The persisted-permission-rules lane's shared decision half. The two capability bits are checked as **two independent gates** — a worker can honestly advertise the rules lane while predating the revoke routes, and that shape must *hide* the governance surface rather than render a dead entry. Failure classification is by **disposition, not cause**: the two 404s (route missing vs. dead ticket) never share a bucket, a 503 `rule_import_retry` means *the ticket is still alive* (the opposite handling of a dead one), and a stale-cursor 400 drops the cursor and re-lists from the top exactly once — never resuming a stale keyset, never surfacing a partial governance list, and never paging past the hard cap. The persist-ack reader is **merged into** `readToolApprovalRespondAck`: the three-state verdict (`persisted` / `refused` / `unknown`) is derived only from an ack that passed the package's structural narrowing, and a half-shaped object such as `{rulePersisted: true}` with no `delivery` reads as `unknown` — the pre-merge shell read would have said `persisted`, which is precisely the double-ledger drift this file closes, so that case is pinned in reverse. The local-allow-rule skeleton pins all five narrowings (whole-tool, tool-name match, literal anchor with the escaped-star counter-example, bare interpreter prefix consulted only for Bash, and the canonical dangerous-pattern overlay) **with their refusal strings byte-for-byte** — the cli's 128-assertion suite anchors the same strings, so a one-character edit here changes observable behaviour on three clients — and asserts the parse is a pure function of its input, because the same call backs both "render the option" and "resolve the selected value" |
 | `scripts/run-park-decision-layer-test.mjs` | The decision layer behind the "stuck behind a card" family, shared by every client. A pending row that is **not in the queue** is three states, not one: a bounded, interruptible re-probe loop distinguishes *a decidable row*, *not born yet* (no positive evidence that anything settled — an empty queue proves nothing) and *settled elsewhere*, always probes at least once so a zero budget keeps the pre-fix semantics verbatim, cuts a hung read face off at the window rather than only noticing afterwards, and reports the honest failure when the window is spent instead of inventing a decision. The decision-note reader is likewise three-state: an explicit `noteRecorded: false` outranks an echoed note body, absence renders **no line at all**, and untrusted note text is flattened and bounded before it ever reaches a renderer. Row routing anchors on the deciding quantity — a row carrying `gateKind: "human"` with `toolName: "Write"` is a tool gate, because `human` is the engine's *generic* "someone must decide", not a synonym for a question — and the queue scan refuses to surface a row it cannot positively prove belongs to this session. A chain that fails after the row vanished is split by whether a card was ever presented: decided-elsewhere, or not-its-turn-yet. A row-level single-flight makes "at most one card per pending item" structural rather than incidental. The resume three-way card pins the option **order** (the zero-effect choice sits at index 0, because the frame carries no default-focus field and a stray Enter must not attach or cancel), renders only options the wired verbs can honour, collapses every ambiguous answer to zero action, omits the liveness line entirely when the engine gave no evidence, and — when there is no card lane at all — prints three real routes and exits on a dedicated code rather than reporting success |
 | `scripts/run-selfheal-reopen-test.mjs` | The 409 active-run self-heal decision chain: `governanceForced` narrows on strict `true` only; triage prefers the wire's `pendingGate.kind` and falls back to the status table (an off-table kind is never guessed into a card arm — hands-off plus the honest wording); a first-sight card makes zero closed/reopened claims and a host presentation receipt of `presented: false` demotes the outcome to reopen-failed; park-row ownership is a fail-closed positive proof (own-run ledger or session id — unprovable is not owned); the three gate-identity key literals live in exactly one mint (`hitl/gateIdentity.ts`, AST string-token scan); the armed-gate presentation ledger is per-session; and the `plan_review` reopen arm shares the arm arm's card body, three-state verdict and delivery pipe, consuming the presentation history once a decision is delivered. The same chain also carries the `running` three-way card: both plan-family gate kinds route to the plan arm and all four ask-family kinds to the ask arm (an off-table kind still never gets guessed into either); the card is offered only for verbs that can actually be honoured and a missing presenter means zero action rather than a silent cancel; a steer is sent **exactly once** with its three delivery outcomes worded apart (a `queued` receipt is the wire correcting the triage input, so the named park word decides which card gets reopened, and an unrecognised park word drives neither arm), and a steer failure is split into *provably not delivered* (4xx) and *delivery unknown*, because telling a user to resend a non-idempotent instruction that may already have landed is how duplicates get made. After a user-chosen cancel, "the session is free" is asserted only from a whitelist of terminal states — park states hold the claim, an unrecognised state word is not a release, a failed read is *unknown* rather than a release, and only a 404 counts as one — and the honest timeout line quotes how long it really waited |
-| `scripts/run-terminal-identity-copy-test.mjs` | Terminal-state **identity**, in both lanes where a stop gets a name. A run stopped by this deployment's own governance knobs — the open-set `limits.*` family, `output.invalid`, and the `blocked` contract terminal a ReportBlocked agent produces — is not a provider failure, and labelling it `API Error:` sends the reader to check the network, the key and the quota when the handle is the `--max-turns` they passed themselves. Those terminals now render a neutral row; the reverse direction is guarded just as hard, because asserting "this is *not* an API error" on a code the package does not recognise is the same misfiling pointed the other way — a real `gateway HTTP 502`, a `conflict.session_active_run` and any unknown code all keep the `API Error:` prefix, and the row keeps its `isApiErrorMessage` class flag so brief-mode visibility filtering does not silently drop it. The second half is who the rejected submission belonged to: the self-heal copy told every caller "Your message was NOT sent … send it again", which is three separate untruths for a system injection (a plan-review outcome, a cron wake-up, a task notification) — not the user's message, and not re-sendable, since a host queue marks those non-editable and non-recallable. The injected form says so instead, and the one sentence that promises re-delivery is pinned to the single disposition that earns it: `selfHealSubmissionDisposition` is the same function the host consults before putting the item back on its queue, so the promise and the behaviour cannot drift apart, and the arms where no card could be surfaced state plainly that nothing was delivered and nothing will retry |
+| `scripts/run-terminal-identity-copy-test.mjs` | Terminal-state **identity**, in both lanes where a stop gets a name. A run stopped by this deployment's own governance knobs — the open-set `limits.*` family, `output.invalid`, and the `blocked` contract terminal a ReportBlocked agent produces — is not a provider failure, and labelling it `API Error:` sends the reader to check the network, the key and the quota when the handle is the `--max-turns` they passed themselves. Those terminals now render a neutral row; the reverse direction is guarded just as hard, because asserting "this is *not* an API error" on a code the package does not recognise is the same misfiling pointed the other way — a real `gateway HTTP 502`, a `conflict.session_active_run` and any unknown code all keep the `API Error:` prefix, and the row keeps its `isApiErrorMessage` class flag so brief-mode visibility filtering does not silently drop it. The second half is who the rejected submission belonged to: the self-heal copy told every caller "Your message was NOT sent … send it again", which is three separate untruths for a system injection (a plan-review outcome, a cron wake-up, a task notification) — not the user's message, and not re-sendable, since a host queue marks those non-editable and non-recallable. The injected form says so instead, and the one sentence that promises re-delivery is pinned to the single disposition that earns it: `selfHealSubmissionDisposition` is the same function the host consults before putting the item back on its queue, so the promise and the behaviour cannot drift apart, and the arms where no card could be surfaced state plainly that nothing was delivered and nothing will retry. Since 0.72.6 the same gate pins the **follow intent** after a steer (L-379): a message handed to a live run only pays off if someone tails that run's own event stream, so `steerFollowIntent` decides from the delivery word whether to tail now, after the pending decision, or only after a wake — and the "watch that run" sentence turns into a factual "sema is following that run" **only** when the host declares it attached that tail, so a shell that did not wire it can never claim it did |
 | `scripts/run-additive-key-passthrough-test.mjs` | The one disease shape behind two legs: a **closed whitelist / flattening arm** dropping a fact that is already on the wire, while both sides of the seam look correct. (1) The `task_progress` projection carries a registered **key ledger** — a frame populated with every key the service really projects is pushed through the shipped `eventToSdkMessage`, and the set of wire keys that survive must equal the registered pass-through list **name for name in both directions**, so quietly forwarding one more key is as red as quietly dropping one. `model` (the child run's model id, minted by core as `prepared.model.id` and projected by the server since 7.52.1) is the key this batch adds, with the same conditional the server itself applies: a non-empty string or no key at all — an empty string is neither a model id nor "unknown". The ledger is also checked against the fenced list in `docs/INTEGRATION-CLIENTS.md` §3d, so a doc that still says seven keys while the code forwards eight is red rather than merely stale. (2) The decide-failure arms carry the server's S-02 `currentPending` pointer key from a 409 `approval_stale` refusal onto the outcome the host reads. The reader is structural rather than `instanceof`, because the client is host-injected and the class identity is not this package's to assume; a half triple never mints (half a pointer cannot relocate anything), an empty string is not presence, and `checkpointToken` never transits. Both the allow and the deny leg are driven end to end through the real durable approval path — as is the accept-session leg, where a refusal carrying the pointer key must now re-raise instead of silently re-sending the human's answer for the **old** card as a plain approve (one decide call, pointer preserved), while a legacy 400 still falls back exactly as before — and all three flattening points must call the one shared reader — the same-shape residue check that makes "fixed one arm and left the twin" red instead of invisible. (3) The same disease growing on the REQUEST side: the `.mcp.json` → server-spec projection rebuilds each server key by key, and the settings schema deliberately leaves some keys parse-transparent — whatever JSON the file carries reaches the engine untouched, because validating them where the whole domain parses all-or-nothing would let one bad declaration take every server down silently. The whitelist had no row for the newest of them, so an operator's per-tool declarations — the ones the write fence reads — were stripped at the package boundary while both sides looked correct. The criterion is not "is that key handled" but the transparent-key table read out of the INSTALLED schema at runtime, reconciled name-for-name against this leg's ledger, so the day upstream adds a third one this turns red and forces an explicit decision. Behaviour is pinned on both transports, by object identity rather than deep equality (a rebuild would be a second judge), and malformed values must transit UNCHANGED rather than be refused here — the engine refuses them loudly and names the server, whereas a package-side judge can only swallow a declared protection quietly. Absence still mints no key, unknown keys still never reach the wire (the fix is the dropped key, not the gate), and the one transparent key this leg deliberately does not forward is a ledger entry with its own exit condition: it belongs to the deployment plane, and the day the request-plane type declares it the entry's premise is gone and the gate says so |
 | `scripts/run-esc-halt-plan-test.mjs` | The Esc stop decision every client shares: fire the **turn-level** halt first, and escalate to a **run-level** cancel in exactly two cases — the engine itself answered with a 409 from the closed code set (it is saying "there is no in-flight turn here; use cancel for a run-level stop"), or that shot came back with no verdict at all *and* the shell can independently prove a permission card was on screen. Everything else does not escalate. The asymmetry is the whole point and every negative control guards the same direction — deciding *not* to escalate costs the user one more choice on a busy-session card (recoverable), deciding to escalate wrongly tears down a run that was alive and takes every in-flight tool with it (not). So: the closed code set is a **frozen** value, not a `ReadonlySet` — type-level immutability does not stop a consumer's `.add()`, and the guard proves it by really trying to mutate the exported value and then checking the verdict did not drift; the escalation gate is the **conjunction** of that closed set and the 409 status, since honouring the code alone lets a 500 that merely quotes it drive a destructive call; `interrupt.not_held` and `steering.not_running` are deliberately outside the set (the first means *this replica* has no live face — the run may be perfectly alive on another); an unreadable code falls to the no-escalation side; a `parked` flag never overrides a verdict the engine did give, and only strict `true` counts when it did not. The first shot is unconditional by construction — it does not consult `parked`, because the 409 it earns is exactly the verdict the gate wants — and the verdict itself is a closed machine-readable reason word, not display copy. A third escalating case was added once tearing the stream stopped reaping the run: with detach armed, a shot that never lands leaves the run going all the way to the end of the turn, so the Esc the user pressed has no effect at all and nothing on screen says so — the old behaviour had a silent backstop (tearing the stream ended the run) and that backstop is gone. The new fact is held to the same three disciplines as `parked`: it is read only where the engine gave no verdict, it is judged **after** `parked` so an existing host's reason word does not change under it, and only strict `true` counts. Absence is proven to be a no-op rather than asserted — the guard carries its own reference implementation of the previous version's table, runs the full grid through both, requires zero divergence when the new field is omitted, and first shows the comparison really does report a difference on the one cell where the two versions are meant to differ |
 | `scripts/run-peer-frame-projection-test.mjs` | The three engine-injected lanes design/385 puts on the **one** `task_notification` carrier, which are not the same kind of thing at all: a delegated child's uplink (`agentMessage`), another session's message drained from this session's own box (`crossSessionMessage`), and a receipt about one of *this* session's own outbound messages (`crossSessionNotice`). The engine renders none of them inside a `<task-notification>` shell, so a client that projects them as the generic completion card shows "background task finished" while the model read a colleague's sentence — two faces describing different events. The discriminator is pinned to the **typed carrier being present**, never to the `summary` text: those carriers can only be minted by the engine's injection legs (the external `notify()` input is a strict subset of the payload and can wear none of them), while `summary` is filled by every notification there is — so anchoring on text would let any background task impersonate a colleague's message by writing `<agent-message from="…">` into its own summary, and a positive control asserts exactly that payload still projects as the generic card. Fail-closed has two tiers rather than one: a broken **required** field (empty `from`, a non-string `body`, a notice `kind` outside the closed set) returns absence so the caller falls back to the generic card — an honest downgrade where the user still sees the notification — while a broken **optional** field drops only itself, because losing an attribution note and losing a colleague's whole message are not the same magnitude. The provenance side record is **required and must agree on four points** (`kind` matches the lane; `from`/`taskId`/`seq` are present and equal the carrier/payload — each equality is anchored on a core mint site and pinned by the cli wire-anchor A-K24), so a carrier signed with a trusted name but a disagreeing provenance falls back to the generic card; peer bodies pass the same authority-envelope neutralization core applies (`<task-notification>` etc. are defused) so a colleague's text can never seed the resume dedup ledger. Lane precedence copies the engine renderer's own order, because the model already read the frame in that order and a client ordering of its own would put a card on screen that disagrees with the frame the model saw. Rendering and parsing of the transcript line live in the same module and are round-tripped in both directions, including a body carrying a forged closing tag (a parser fooled there hands half a message to the next row) and a quote inside the sender label (which must not forge a second attribute); the notice lane is deliberately kept **out** of the parser, since recognising it would mean anchoring the `[Cross-session …]` prefix and a user typing that same line would be rendered as engine speech. Hostile carriers are read as own **data** descriptors only and accessors are never invoked at all — `catch` catches throwing, not never returning — proven by a counting getter that must stay at zero calls, alongside a revoked proxy and a prototype-only carrier; and four legacy payload shapes assert the no-carrier path is byte-identical to before, which is the executable form of "zero difference for an older host" |

package/dist/adapter/activeRunSelfHeal.d.ts

@@ -513,6 +513,48 @@ export type SelfHealSubmissionDisposition = 'held-for-decision' | 'resending' |
  * 「已解锁」证不出,自动重投可能撞回仍锁着的会话。
  */
 export declare function selfHealSubmissionDisposition(outcome: SelfHealOutcome): SelfHealSubmissionDisposition;
+/**
+ * steer 之后**谁续听那条 run、从哪一拍续听**(0.72.6;cli L-379 包侧半场)。
+ *
+ * ── 病形 ────────────────────────────────────────────────────────────────────────────────────
+ * server 7.81.0 起 local 车道的 bg/resume 腿是活审批目标:plan_review 决断后 run **立刻回 running**、撞到
+ * 下一道门时**活着等卡**(不再 park → 新流接管)。壳的跟进提交(系统注入件)撞活 run ⇒ 本文件折成 steer ⇒
+ * `running-steered` ⇒ 行文案说「watch that run」⇒ 壳 turn 收尾 —— **没有人 tail 那条 run**。那条 run 的
+ * 后续(含它新弹出的决断卡)只出现在它自己的 `GET /v1/runs/:id/events` 上,没人听就没人看见:卡永不上屏,
+ * 用户被丢在原地(实测 400 s 零事件零卡;7.80.1 差分 3.3 s 上屏)。
+ *
+ * ── 为什么是包侧判据 ────────────────────────────────────────────────────────────────────────
+ * 「该不该 tail、什么时候 tail」由 `delivery` 决定,三端各自猜必漂。判据锚在 SDK `SteerReceipt` 头注逐字:
+ *   · `applied`         —— 注入到活着的 run,下一步就消化 ⇒ **现在就 tail** 至终局 / park。
+ *   · `queued`          —— run 停在待决 checkpoint,消息 park 在上面;答卡后 resume 出的那条流才是要听的
+ *                          ⇒ 续听挂在 **decide 之后**(reopen 那张卡的路径已在本文件里,decide 是壳的事)。
+ *   · `parked_for_wake` —— run 已终局,消息卡在 `task_done` checkpoint;**wake 之前什么都不会发生** ⇒ 现在
+ *                          tail 只会空等;续听挂在 wake 之后(本客户端不 wake,如实说)。
+ *   · 读不出 / 未知词    —— **保守当活 ⇒ tail**:不 tail 的代价是卡永不上屏,空 tail 的代价只是多一条订阅。
+ * `fromEventId` 包侧算不出(回执不带),壳用自己手上的 Last-Event-ID 续;缺席 = 从 live 起听。
+ * 🔴 `held-for-decision` 档**刻意不加位**:宿主答卡后按原优先级重投注入件,那次提交要么开新 turn(自己的流),
+ *    要么再撞 409 ⇒ 回到这里 ⇒ `running-steered` ⇒ 本函数。谁听 = 重投那次提交的流。
+ */
+export type SteerFollowIntent = {
+    kind: 'tail';
+    taskId: string;
+} | {
+    kind: 'after-decision';
+    taskId: string;
+} | {
+    kind: 'after-wake';
+    taskId: string;
+};
+/** 结局 → 续听意图;非 `running-steered` 结局(含非对象入参)⇒ `null`。纯函数,不改 {@link SelfHealOutcome} 型面。 */
+export declare function steerFollowIntent(outcome: SelfHealOutcome | null | undefined): SteerFollowIntent | null;
+/**
+ * 宿主对 {@link activeRunSelfHealRow} 的**续听声明**:`following: true` = 「我已经按 {@link steerFollowIntent}
+ * 挂上了续听」。只有这时 handed-off 那两句才从「watch that run」换成事实陈述 —— 文案与行为同一前提,没接线的端
+ * 不许替用户说「sema 在看着」。缺席 / false ⇒ 逐字节同旧。
+ */
+export interface SelfHealFollowDeclaration {
+    following?: boolean;
+}
 /**
  * cancel 回执(202 体)/ run 行上的 `cancelRequested`(0.68.0 / L-230;server 7.73.0 S-122 P-45)。
  *
@@ -638,7 +680,7 @@ export declare const INTERACTIVE_WAY_OUT = "run /clear to keep working in a fres
  * wire 真到得了端的两个 additive 键是 `activeTaskStatus` 与 `pendingGate`,各自有真消费点;
  * 不为「说不定哪天上游会发」的键留悬空分支。
  */
-export declare function activeRunSelfHealRow(outcome: SelfHealOutcome, signal?: ActiveRunBusySignal | null, copy?: ActiveRunSelfHealCopy, origin?: RejectedSubmissionOrigin): string;
+export declare function activeRunSelfHealRow(outcome: SelfHealOutcome, signal?: ActiveRunBusySignal | null, copy?: ActiveRunSelfHealCopy, origin?: RejectedSubmissionOrigin, follow?: SelfHealFollowDeclaration): string;
 /**
  * 非交互车道(headless `-p` 等)对同一事实的诚实说法:那里没有 `/clear`,默认串指的是「别再
  * `--resume` 到这个会话」和引擎自己的 cancel/decide 端点 —— 都是真的存在、真的能做的动作。

package/dist/adapter/activeRunSelfHeal.js

@@ -153,6 +153,17 @@ export function selfHealSubmissionDisposition(outcome) {
             return 'not-delivered';
     }
 }
+/** 结局 → 续听意图;非 `running-steered` 结局(含非对象入参)⇒ `null`。纯函数,不改 {@link SelfHealOutcome} 型面。 */
+export function steerFollowIntent(outcome) {
+    if (typeof outcome !== 'object' || outcome === null || outcome.kind !== 'running-steered')
+        return null;
+    const taskId = outcome.taskId;
+    if (outcome.delivery === 'queued')
+        return { kind: 'after-decision', taskId };
+    if (outcome.delivery === 'parked_for_wake')
+        return { kind: 'after-wake', taskId };
+    return { kind: 'tail', taskId };
+}
 /** 会话作用域位的透传口(缺席即不置键 —— `exactOptionalPropertyTypes` 下 `{session: undefined}`
  *  与「没有这个键」不是一回事,而 SDK 那一侧读的正是「在不在场」)。 */
 function sessionOpts(deps) {
@@ -1072,15 +1083,19 @@ function lastActivityClause(signal) {
  * wire 真到得了端的两个 additive 键是 `activeTaskStatus` 与 `pendingGate`,各自有真消费点;
  * 不为「说不定哪天上游会发」的键留悬空分支。
  */
-export function activeRunSelfHealRow(outcome, signal, copy, origin) {
+export function activeRunSelfHealRow(outcome, signal, copy, origin, follow) {
     const override = copy?.rowFor?.(outcome, signal);
     if (typeof override === 'string')
         return override;
+    // 0.72.6(L-379):宿主声明已挂续听 **且**本结局的续听意图确是「现在 tail」⇒ handed-off 句换成事实陈述;
+    // 不声明 ⇒ 逐字节同旧。🔴 意图为 after-decision / after-wake 时**不换**(异源对抗复审 [medium]:那两形的续听是
+    // 延后登记,不是正在续听;注入形此前没按 delivery 分臂,这里在入口统一收口,两种来源同一前提)。
+    const following = follow?.following === true && steerFollowIntent(outcome)?.kind === 'tail';
     // #289 批面② —— 系统注入件的低噪形。整块**前置**于默认串:注入形与用户形是两句完全不同的话,
     // 不是在同一句上加定语(见 {@link injectedSubmissionRow} 头注)。缺省 'user' ⇒ 下面逐字节原样。
     if (origin === 'injected')
-        return injectedSubmissionRow(outcome);
-    const base = activeRunSelfHealBaseRow(outcome, signal, copy?.wayOut ?? DEFAULT_WAY_OUT);
+        return injectedSubmissionRow(outcome, following);
+    const base = activeRunSelfHealBaseRow(outcome, signal, copy?.wayOut ?? DEFAULT_WAY_OUT, following);
     switch (outcome.kind) {
         // 这两条是「用户此刻卡住了、而且没有别的把手」的结局 —— wire 给的 decide 入口在这里才有用。
         // not-parked(running 形)另挂活性证据([4664] 判别位):「它到底还活着吗」在这一行被问出来。
@@ -1113,7 +1128,7 @@ export function activeRunSelfHealRow(outcome, signal, copy, origin) {
  * 一句话说清三件事:是系统件、当时什么挡住了它、接下来会不会自己再来。不给出路半句 —— 用户此刻
  * 该做的事是答那张卡,而那张卡就在屏幕上。
  */
-function injectedSubmissionRow(outcome) {
+function injectedSubmissionRow(outcome, following = false) {
     const handle = 'taskId' in outcome && outcome.taskId ? ` (run ${outcome.taskId})` : '';
     switch (selfHealSubmissionDisposition(outcome)) {
         case 'held-for-decision':
@@ -1122,14 +1137,19 @@ function injectedSubmissionRow(outcome) {
         case 'resending':
             return `A system notification was held while the earlier run${handle} was cancelled; sema is delivering it now.`;
         case 'handed-off':
-            return (`A system notification was handed to the run that is already working${handle} instead of starting ` +
-                `a new turn — watch that run for what it does with it.`);
+            // 🔴 「watch that run」只在宿主**没有**挂续听时说(那时确实只能靠用户看);挂上了就说事实 ——
+            //    那条 run 接下来要的东西(含决断卡)会由 sema 从它自己的流上端上来(L-379)。
+            return following
+                ? `A system notification was handed to the run that is already working${handle} instead of starting ` +
+                    `a new turn — sema is following that run and will surface whatever it asks for next.`
+                : `A system notification was handed to the run that is already working${handle} instead of starting ` +
+                    `a new turn — watch that run for what it does with it.`;
         case 'not-delivered':
             return (`A system notification was NOT delivered: this session is still held by an earlier run${handle} and ` +
                 `sema could not put a decision for it on screen, so it did not retry. The model was not told about it.`);
     }
 }
-function activeRunSelfHealBaseRow(outcome, signal, wayOut) {
+function activeRunSelfHealBaseRow(outcome, signal, wayOut, following = false) {
     switch (outcome.kind) {
         case 'decision-pending':
             return (`This session is held by an earlier turn${outcome.taskId ? ` (run ${outcome.taskId})` : ''} that ` +
@@ -1197,7 +1217,10 @@ function activeRunSelfHealBaseRow(outcome, signal, wayOut) {
             if (outcome.delivery === 'applied') {
                 return (`sema handed your message to the run that is already working (${handle}) — the engine applied it to ` +
                     `that run, so it is picked up at that run's next step. ${textOnly} Nothing was cancelled, and your ` +
-                    `message did NOT start a new turn — watch that run for what it does with it.`);
+                    `message did NOT start a new turn — ` +
+                    (following
+                        ? `sema is following that run and will surface whatever it asks for next.`
+                        : `watch that run for what it does with it.`));
             }
             if (outcome.delivery === 'queued') {
                 const parked = outcome.status ? `parked (status ${outcome.status})` : 'parked';
@@ -1228,7 +1251,10 @@ function activeRunSelfHealBaseRow(outcome, signal, wayOut) {
             }
             return (`sema handed your message to ${handle}, but the engine did not say how it will be delivered` +
                 `${outcome.status ? ` (it reported that run as ${outcome.status})` : ''}. ${textOnly} Nothing was ` +
-                `cancelled, and your message did NOT start a new turn — watch that run before sending it again.`);
+                `cancelled, and your message did NOT start a new turn — ` +
+                (following
+                    ? `sema is following that run and will surface whatever it asks for next before you send it again.`
+                    : `watch that run before sending it again.`));
         }
         case 'running-steer-failed':
             // 🔴 明确拒收 vs 送达未知,两句话不能互换(见 outcome 注):对一条**可能已经注入**的非幂等

package/dist/index.d.ts

@@ -154,6 +154,7 @@ export * from './printToolResultFrame.js';
 export * from './engineCapsCache.js';
 export * from './sqlEngineCapability.js';
 export * from './writeProtectionCapability.js';
+export * from './webSearchBackendCapability.js';
 export * from './runTerminal.js';
 export * from './readFacePosture.js';
 export * from './mcpPanel.js';

package/dist/index.js

@@ -184,6 +184,9 @@ export * from './sqlEngineCapability.js';
 // operator 面 `diagnostics.wiring.writeProtection` 的行表投影。与 `sqlEngineCapability` 同构同纪律
 // (四态词汇 / tee+换代失效口 / 唯一措辞铸点),端零自铸 —— 壳的 doctor 两处留位由它填。
 export * from './writeProtectionCapability.js';
+// S-382(0.72.5;server ≥7.82.1,sdk 尚未声明):`Capabilities.webSearch.backend` 的四态窄读器 ——
+// 部署默认 WebSearch 后端(`none` = 正面事实 / 键缺席 = 老引擎判不了,两者处置相反)。与上两只同构同纪律。
+export * from './webSearchBackendCapability.js';
 // 0.60.0(engine ≥7.64.0 / sdk 8.4.0):终局因由与门记录两只**判定归包**的读器。
 export * from './runTerminal.js';
 // 0.61.0(engine ≥7.65.0 / sdk 8.5.0 / S-167):READ 容纳面档位 + 来源的 operator 面窄读器

package/dist/webSearchBackendCapability.d.ts

@@ -0,0 +1,94 @@
+/**
+ * webSearchBackendCapability — **部署默认 WebSearch 后端**的三端共用读面(0.72.5;server ≥7.82.1 / S-382
+ * 的 `GET /v1/capabilities.webSearch`,契约附录 B.1;sdk 9.6.0 的 `Capabilities` 尚未声明该键)。
+ *
+ * ── 这一格答的是哪一个问题 ────────────────────────────────────────────────────────────────
+ * 「我的工具面里为什么只有 WebFetch、没有 WebSearch?」装不装 WebSearch 工具由两个互不相干的旋钮决定:
+ *   ① 引擎**部署**自己的默认后端(`WEB_SEARCH_PROVIDER`;是 provider 词表之一才装配);
+ *   ② 调用方盖在请求上的 `settings.webSearch`(本包 `webSearchWireCaps` 投影;单用户车道上压过 ①)。
+ * 本格只广告 **①**:server 逐字「广告的是部署默认,不是这次调用有没有搜索」—— 每请求覆盖**刻意不回显**
+ * (回显等于让能力面随调用方漂)。所以 `none` 与「这次任务没有 WebSearch 工具」**不等价**:单用户车道上调用方
+ * 自带 `settings.webSearch` 时工具照常装配,而本格仍读 `none`。消费端渲这一行时两段各渲各的,绝不互推。
+ *
+ * ── 🔴 四态,不是两态([honest-absence-not-fabricated-zero])──────────────────────────────────
+ * 与 `sqlEngineCapability` / `writeProtectionCapability` 逐字同一套词汇(通用读口 `engineCapValue` 答「这一格
+ * 上有没有值」,窄读器答「值成不成形」):
+ *   ① `unobserved`   —— **本进程一次 caps 响应都没观测到**(一次性 doctor 就是这一档)。
+ *   ② `not_reported` —— caps 观测到了,而回体上**没有** `webSearch` 这个键 ⇒ 老引擎(<7.82.1)。
+ *      🔴 契约逐字:**不许读作「本部署没有后端」** —— 那是 `"none"` 在说的话;两者的处置相反(一个渲
+ *      「不可用」,一个渲「判不了」)。老引擎上只能按改前的办法判(跑一个真任务 / 读引擎启动日志)。
+ *   ③ `none`         —— 引擎**明确说** `backend: "none"`:本部署没有默认搜索后端(`WEB_SEARCH_PROVIDER`
+ *      未设 / 拼错)。**正面事实**,不是缺席;调用方没自带配置时默认场景**不装配** WebSearch 工具。
+ *   ④ `present`      —— 一个 provider 词,原样渲。
+ *
+ * ── 🔴 窄读域只许等于或宽于铸点域 ────────────────────────────────────────────────────────────
+ * server 的闭集**取型**自它的 provider 元组(加一只后端那一位自动跟着长)。本包**不**手抄那三个词当判据:
+ * 抄一份就是给自己立第二个判官 —— 上游哪天加一只后端,手抄的那份会把新词判成畸形、把一台配好了的部署
+ * 渲成「读不出」(消费域比铸点域更窄的病形,S-131 那一格已经付过一次代价)。`backend` 按**非空串**读,
+ * 只有 `"none"` 这一个词带独立语义;别的词一律 `present` 并按 UNTRUSTED-for-display 消毒封长后上屏。
+ *
+ * ── 🔴 与 SQL 那一格的一处刻意不同:`webSearch: null` 是畸形 ────────────────────────────────
+ * SQL 位的铸点会铸 `null`(「没有 SQL 后端」),所以那边 `null ⇒ none`。本位的铸点**永远铸一个对象**
+ * (provider 缺席时铸 `{ backend: "none" }`,不铸 `null`)⇒ wire 上出现 `null` 不是任何一种已知读数,
+ * 按畸形处置(删格 ⇒ `unobserved`),不替它编一个「none」。
+ *
+ * ── 与能力位台账门的关系 ───────────────────────────────────────────────────────────────────
+ * `run-engine-caps-ledger-test.mjs` 的台账按 sdk `Capabilities` 键集对表;sdk 今天还没声明 `webSearch`,
+ * 所以台账**刻意没有**这一行。sdk 出键当天该门自动红,逼一次显式处置(登 `read` 行指向本文件)。
+ */
+/** `backend: "none"` —— 唯一带独立语义的词(见文件头);其余词按开集读。 */
+export declare const WEB_SEARCH_BACKEND_NONE = "none";
+/** `present` 时的读数:部署默认后端的 provider 词(开集;`"none"` 不会出现在这里 —— 它是 `none` 档)。 */
+export interface WebSearchBackendCapabilityView {
+    backend: string;
+}
+/** 四态读数(见文件头)。`unobserved` 由**读口**在这一格空缺时铸,不由投影铸。 */
+export type WebSearchBackendReading = {
+    kind: 'unobserved';
+} | {
+    kind: 'not_reported';
+} | {
+    kind: 'none';
+} | {
+    kind: 'present';
+    view: WebSearchBackendCapabilityView;
+};
+/**
+ * caps 回体 → 本格读数;**畸形一律 `undefined`**(= 这一格不写 ⇒ 读口答 `unobserved`)。
+ *
+ * 🔴 键不在(`undefined`)⇒ `not_reported`(老引擎);`null` ⇒ 畸形(本位铸点从不铸 `null`,见文件头)。
+ * 🔴 `backend` 不是非空串 ⇒ 整条畸形;`"none"` ⇒ `none`;其余词 ⇒ `present`(开集,不手抄闭集)。
+ * 🔴 对象上的**多余成员不过境**(本包只读 `backend`;端点 / 密钥 / 配额契约上一个字都不上 wire,
+ *    真出现了也不是本读面该带出去的东西)。
+ */
+export declare function projectWebSearchBackendCapability(caps: unknown): WebSearchBackendReading | undefined;
+/**
+ * 宿主 caps probe 的**读面 tee** 落点(与 `noteEngineCapsForSqlEngine` / `noteEngineCapsForWriteProtection`
+ * 并列;宿主在同一处按序调三只)。绝不 throw —— 读面腿不许反噬 caps 探测链。
+ *
+ * 🔴 投影 `undefined`(caps 畸形)⇒ 这一格**被删**而不是留着上一台引擎的旧值。
+ * 🔴 **不按 principal 分域**:部署默认后端是**这台 worker 的 boot 产物**,与调用者是谁无关。
+ * 🔴 `opts.generation` = 关掉「旧探测覆盖新读数」竞态的唯一正确供给(与两只兄弟逐字同律):宿主在起探测
+ *    那一刻 `engineCapsGeneration(baseUrl)` 抓号、在这里原样交回,陈旧那一发整只丢掉;不传 ⇒ 照写。
+ */
+export declare function noteEngineCapsForWebSearchBackend(baseUrl: string, caps: unknown, opts?: {
+    generation?: number;
+}): void;
+/** 本进程观测到的部署默认后端;这一格空缺 ⇒ `{kind:'unobserved'}`(**绝不**折成 `none`)。 */
+export declare function observedWebSearchBackend(baseUrl?: string | undefined): WebSearchBackendReading;
+/**
+ * 四态 → doctor 那一行「部署默认后端」这一段的 detail 串。**唯一措辞真源**(三端共用;端只拼接不另写)。
+ *
+ * 🔴 四句话刻意**互不相同、也互不蕴含**:「未观测」「老引擎不报」两种「读不出」都**不等于**「没有后端」;
+ *    `none` 那一句必须同时说出两件事 —— 部署默认场景不装配这只工具,**以及**调用方自带配置仍可装配
+ *    (契约 🔴 蕴含只对「没自带配置」那一形成立)。少说后半句,用户会在 `/websearch` 配好之后仍以为没用。
+ * 🔴 `present` 只渲 provider 一个词(消毒 + 封长);每请求覆盖不在此回显 —— 那是请求方自己送进来的。
+ */
+export declare function webSearchBackendDoctorDetail(reading: WebSearchBackendReading): string;
+/**
+ * **换代失效口**(与 `forgetSqlEngineReading` / `forgetWriteProtectionReading` 并列,由宿主在引擎温切成功后调)。
+ * 处置是**清成未观测**,不是留旧值也不是铸一个 `none`。空串 ⇒ no-op;绝不 throw。
+ */
+export declare function forgetWebSearchBackendReading(baseUrl: string | undefined): void;
+/** 测试钩子。 */
+export declare function __resetWebSearchBackendReadingsForTests(): void;

package/dist/webSearchBackendCapability.js

@@ -0,0 +1,143 @@
+/**
+ * webSearchBackendCapability — **部署默认 WebSearch 后端**的三端共用读面(0.72.5;server ≥7.82.1 / S-382
+ * 的 `GET /v1/capabilities.webSearch`,契约附录 B.1;sdk 9.6.0 的 `Capabilities` 尚未声明该键)。
+ *
+ * ── 这一格答的是哪一个问题 ────────────────────────────────────────────────────────────────
+ * 「我的工具面里为什么只有 WebFetch、没有 WebSearch?」装不装 WebSearch 工具由两个互不相干的旋钮决定:
+ *   ① 引擎**部署**自己的默认后端(`WEB_SEARCH_PROVIDER`;是 provider 词表之一才装配);
+ *   ② 调用方盖在请求上的 `settings.webSearch`(本包 `webSearchWireCaps` 投影;单用户车道上压过 ①)。
+ * 本格只广告 **①**:server 逐字「广告的是部署默认,不是这次调用有没有搜索」—— 每请求覆盖**刻意不回显**
+ * (回显等于让能力面随调用方漂)。所以 `none` 与「这次任务没有 WebSearch 工具」**不等价**:单用户车道上调用方
+ * 自带 `settings.webSearch` 时工具照常装配,而本格仍读 `none`。消费端渲这一行时两段各渲各的,绝不互推。
+ *
+ * ── 🔴 四态,不是两态([honest-absence-not-fabricated-zero])──────────────────────────────────
+ * 与 `sqlEngineCapability` / `writeProtectionCapability` 逐字同一套词汇(通用读口 `engineCapValue` 答「这一格
+ * 上有没有值」,窄读器答「值成不成形」):
+ *   ① `unobserved`   —— **本进程一次 caps 响应都没观测到**(一次性 doctor 就是这一档)。
+ *   ② `not_reported` —— caps 观测到了,而回体上**没有** `webSearch` 这个键 ⇒ 老引擎(<7.82.1)。
+ *      🔴 契约逐字:**不许读作「本部署没有后端」** —— 那是 `"none"` 在说的话;两者的处置相反(一个渲
+ *      「不可用」,一个渲「判不了」)。老引擎上只能按改前的办法判(跑一个真任务 / 读引擎启动日志)。
+ *   ③ `none`         —— 引擎**明确说** `backend: "none"`:本部署没有默认搜索后端(`WEB_SEARCH_PROVIDER`
+ *      未设 / 拼错)。**正面事实**,不是缺席;调用方没自带配置时默认场景**不装配** WebSearch 工具。
+ *   ④ `present`      —— 一个 provider 词,原样渲。
+ *
+ * ── 🔴 窄读域只许等于或宽于铸点域 ────────────────────────────────────────────────────────────
+ * server 的闭集**取型**自它的 provider 元组(加一只后端那一位自动跟着长)。本包**不**手抄那三个词当判据:
+ * 抄一份就是给自己立第二个判官 —— 上游哪天加一只后端,手抄的那份会把新词判成畸形、把一台配好了的部署
+ * 渲成「读不出」(消费域比铸点域更窄的病形,S-131 那一格已经付过一次代价)。`backend` 按**非空串**读,
+ * 只有 `"none"` 这一个词带独立语义;别的词一律 `present` 并按 UNTRUSTED-for-display 消毒封长后上屏。
+ *
+ * ── 🔴 与 SQL 那一格的一处刻意不同:`webSearch: null` 是畸形 ────────────────────────────────
+ * SQL 位的铸点会铸 `null`(「没有 SQL 后端」),所以那边 `null ⇒ none`。本位的铸点**永远铸一个对象**
+ * (provider 缺席时铸 `{ backend: "none" }`,不铸 `null`)⇒ wire 上出现 `null` 不是任何一种已知读数,
+ * 按畸形处置(删格 ⇒ `unobserved`),不替它编一个「none」。
+ *
+ * ── 与能力位台账门的关系 ───────────────────────────────────────────────────────────────────
+ * `run-engine-caps-ledger-test.mjs` 的台账按 sdk `Capabilities` 键集对表;sdk 今天还没声明 `webSearch`,
+ * 所以台账**刻意没有**这一行。sdk 出键当天该门自动红,逼一次显式处置(登 `read` 行指向本文件)。
+ */
+import { capForDisplay } from './fleetTaskDesc.js';
+import { engineWireTarget } from './engineWireTarget.js';
+import { engineCapsGeneration } from './engineCapsCache.js';
+/** `backend: "none"` —— 唯一带独立语义的词(见文件头);其余词按开集读。 */
+export const WEB_SEARCH_BACKEND_NONE = 'none';
+/**
+ * caps 回体 → 本格读数;**畸形一律 `undefined`**(= 这一格不写 ⇒ 读口答 `unobserved`)。
+ *
+ * 🔴 键不在(`undefined`)⇒ `not_reported`(老引擎);`null` ⇒ 畸形(本位铸点从不铸 `null`,见文件头)。
+ * 🔴 `backend` 不是非空串 ⇒ 整条畸形;`"none"` ⇒ `none`;其余词 ⇒ `present`(开集,不手抄闭集)。
+ * 🔴 对象上的**多余成员不过境**(本包只读 `backend`;端点 / 密钥 / 配额契约上一个字都不上 wire,
+ *    真出现了也不是本读面该带出去的东西)。
+ */
+export function projectWebSearchBackendCapability(caps) {
+    if (caps === null || typeof caps !== 'object')
+        return undefined;
+    if (!('webSearch' in caps))
+        return { kind: 'not_reported' };
+    const ws = caps.webSearch;
+    if (ws === undefined)
+        return { kind: 'not_reported' };
+    if (ws === null || typeof ws !== 'object' || Array.isArray(ws))
+        return undefined;
+    const backend = ws.backend;
+    if (typeof backend !== 'string' || backend === '')
+        return undefined;
+    if (backend === WEB_SEARCH_BACKEND_NONE)
+        return { kind: 'none' };
+    return { kind: 'present', view: { backend } };
+}
+const readingByBase = new Map();
+/**
+ * 宿主 caps probe 的**读面 tee** 落点(与 `noteEngineCapsForSqlEngine` / `noteEngineCapsForWriteProtection`
+ * 并列;宿主在同一处按序调三只)。绝不 throw —— 读面腿不许反噬 caps 探测链。
+ *
+ * 🔴 投影 `undefined`(caps 畸形)⇒ 这一格**被删**而不是留着上一台引擎的旧值。
+ * 🔴 **不按 principal 分域**:部署默认后端是**这台 worker 的 boot 产物**,与调用者是谁无关。
+ * 🔴 `opts.generation` = 关掉「旧探测覆盖新读数」竞态的唯一正确供给(与两只兄弟逐字同律):宿主在起探测
+ *    那一刻 `engineCapsGeneration(baseUrl)` 抓号、在这里原样交回,陈旧那一发整只丢掉;不传 ⇒ 照写。
+ */
+export function noteEngineCapsForWebSearchBackend(baseUrl, caps, opts) {
+    try {
+        if (typeof baseUrl !== 'string' || baseUrl === '')
+            return;
+        if (opts?.generation !== undefined && opts.generation !== engineCapsGeneration(baseUrl))
+            return;
+        const reading = projectWebSearchBackendCapability(caps);
+        if (reading === undefined) {
+            readingByBase.delete(baseUrl);
+            return;
+        }
+        readingByBase.set(baseUrl, reading);
+    }
+    catch {
+        /* fail-soft:本 tee 任何分支都不许打断 caps 探测链 */
+    }
+}
+/** 本进程观测到的部署默认后端;这一格空缺 ⇒ `{kind:'unobserved'}`(**绝不**折成 `none`)。 */
+export function observedWebSearchBackend(baseUrl = engineWireTarget()?.baseUrl) {
+    if (typeof baseUrl !== 'string' || baseUrl === '')
+        return { kind: 'unobserved' };
+    return readingByBase.get(baseUrl) ?? { kind: 'unobserved' };
+}
+/** provider 词的展示上限(UTF-16 单元;与两只兄弟同值同理由 —— 开集词按 UNTRUSTED-for-display 处置)。 */
+const WS_DETAIL_MAX = 40;
+/** 部署侧那个旋钮的名字 —— 用户要去改的就是它,所以逐字写出来而不是说「部署配置」。 */
+const DEPLOY_ENV = 'WEB_SEARCH_PROVIDER';
+/**
+ * 四态 → doctor 那一行「部署默认后端」这一段的 detail 串。**唯一措辞真源**(三端共用;端只拼接不另写)。
+ *
+ * 🔴 四句话刻意**互不相同、也互不蕴含**:「未观测」「老引擎不报」两种「读不出」都**不等于**「没有后端」;
+ *    `none` 那一句必须同时说出两件事 —— 部署默认场景不装配这只工具,**以及**调用方自带配置仍可装配
+ *    (契约 🔴 蕴含只对「没自带配置」那一形成立)。少说后半句,用户会在 `/websearch` 配好之后仍以为没用。
+ * 🔴 `present` 只渲 provider 一个词(消毒 + 封长);每请求覆盖不在此回显 —— 那是请求方自己送进来的。
+ */
+export function webSearchBackendDoctorDetail(reading) {
+    switch (reading.kind) {
+        case 'unobserved':
+            return ('deployment default backend not observed — the engine reports it on /v1/capabilities; ' +
+                'this process has not received a capabilities response from the engine yet');
+        case 'not_reported':
+            return ('deployment default backend not reported by this engine — only newer engines advertise it; ' +
+                'this does not say whether the deployment has a search backend');
+        case 'none':
+            return (`deployment default backend none — ${DEPLOY_ENV} is unset or not a provider word on the engine, ` +
+                'so a request that brings no webSearch setting of its own runs without the WebSearch tool; ' +
+                'a caller-supplied webSearch setting can still mount it on a single-user lane');
+        case 'present':
+            return (`deployment default backend ${capForDisplay(reading.view.backend, WS_DETAIL_MAX)} ` +
+                '(per-request overrides are not echoed here)');
+    }
+}
+/**
+ * **换代失效口**(与 `forgetSqlEngineReading` / `forgetWriteProtectionReading` 并列,由宿主在引擎温切成功后调)。
+ * 处置是**清成未观测**,不是留旧值也不是铸一个 `none`。空串 ⇒ no-op;绝不 throw。
+ */
+export function forgetWebSearchBackendReading(baseUrl) {
+    if (typeof baseUrl !== 'string' || baseUrl === '')
+        return;
+    readingByBase.delete(baseUrl);
+}
+/** 测试钩子。 */
+export function __resetWebSearchBackendReadingsForTests() {
+    readingByBase.clear();
+}

package/docs/INTEGRATION-CLIENTS.md

@@ -19,11 +19,11 @@
 
 | 项 | 值 | 真源 |
 |---|---|---|
-| 本包 | `@sema-agent/client-core` **0.72.4**(本批发布版 = **patch**:core 7.21.x 三件经 server 7.82.0 提货 —— `wiring_manifest.autoConsolidation` 第八段 `_sema_autoConsolidation`(缺席 = indeterminate 不折 false);型面纯 additive、公面 962、peer 不动;§51。上一版 0.72.3 = **patch**:core #863 记忆单系统半场 ① —— `projectAgentsForWire` 投影 `agents[].memory`(user|project|local 三词同映射引擎平面 agent:<type>);型面纯 additive、公面 962、零 wire 新键、peer 不动;§50。上一版 0.72.2 = **patch**:workflow 视图两票 —— `LiveWorkflowController.resolution()` 六态(snapshot() 的 null 三义拆开)+ `noteOwnWorkflowRun` own 台账同拍登记;型面纯 additive、公面 961、零 wire 键、peer 不动;§49。上一版 0.72.1 = **patch**:server 7.80.1 提货 —— 409 `conflict.resume_context_unavailable` 结构读数(`staleAfterSec` / `runId`;sdk 9.6.0 尚未带键,经 sdk 今天恒缺席)+ `SkillSpec.baseDir`(只在本机车道带);型面纯 additive、公面 960、peer 不动;§48。上一版 0.72.0 = **minor**:型面 BREAKING —— 39 个零消费导出退出公面(CC-32 退役批,[7419] §45 预告 / cli [7422] 同意 / web-client·desktop 过节拍沉默 = 同意;名单见 §47a S-1);运行期零 BREAKING、公面 956、peer 不动、devDep core ~7.20.1;随批:已退役名账 `removed` + export-liveness 门 G 段 + 冻结账门 ⑧c;§47。上一版 0.71.4 = **patch**:core 7.20.1 提货 —— `ENGINE_NOTICE_CODES` 65 + `wiring_manifest.writeProtection` 第七段 `_sema_writeProtection`;型面纯 additive、公面 995、peer 不动、devDep core `~7.20.1`;§46。上一版 0.71.3 = **patch**:门体系清账批 —— CC-24 export-liveness 门 + 39 个导出退役预告(0.72.0 删,表态制)/ CC-26 `as unknown as` 铸链棘轮 / CC-25 冻结账门 ⑧ 段 / CC-06 B-081 包侧半场(终帧 `_sema_effective_reasoning` / `_sema_effective_memory_scopes` + resume reopen 族 + `routePairingVerdict`);型面纯 additive、公面 986 → 995、peer 不动;§45。上一版 0.71.2 = **patch**:接入方验收两票归包 —— CC-28 B-132 decide 拒体三句去内部车道词 / CC-29 B-133 committedUuids 唯一性(重复 ⇒ 形 f);零型面变化、公面 986、peer 不动;§44。上一版 0.71.1 = **patch**:接入档打回修正 —— CC-27 `ApprovalCardRequest.readRootCandidate?` 帧→卡透传位 + 新导出型 `ReadRootCandidateView`;型面纯 additive、公面 986 不变、peer 不动;§43。上一版 0.71.0 = **minor**:型面 BREAKING 六件 —— peer sdk 地板 >=9.6.0 + agent-types >=0.3.0 / `SkillsListingTruncatedFactsView` 删 `requestedBudgetBytes?`·`laneClamped?` / `WiringManifestMcpEntry` → `WiringManifestMcpEntryView` / `MAX_AGENT_SKILLS` 删 / `decide.workflow_host_not_parked` 退役;运行期零 BREAKING。内容:core 7.20.0 提货(闭集 +5 六十四码)/ 🔴 CC-16 `text_segment_end.committedUuids[]` / CC-08 全五件(tool_disclosure / tool_progress 两 chrome 臂、wiring_manifest tools·hooks·lsp 进切片、tool_roster_delta 接上、context_usage 进切片、`readRootCandidate` 镜像)/ CC-19 `mcpEngineLegPresence` 归包 / CC-20 not_parked clean-cut;公面 986;§42 / 42y 八条)|
+| 本包 | `@sema-agent/client-core` **0.72.6**(本批发布版 = **patch**:cli L-379 包侧半场 —— `steerFollowIntent` steer 后续听意图三态(tail / after-decision / after-wake)+ `activeRunSelfHealRow` 续听声明第五参;型面纯 additive、公面 969、peer 不动;§53。上一版 0.72.5 = **patch**:server 7.82.1 提货 —— `capabilities.webSearch.backend` 部署默认 WebSearch 后端四态读面(键缺席 = 老引擎判不了 ≠ `none`);型面纯 additive、公面 968、peer 不动;§52。上一版 0.72.4 = **patch**:core 7.21.x 三件经 server 7.82.0 提货 —— `wiring_manifest.autoConsolidation` 第八段 `_sema_autoConsolidation`(缺席 = indeterminate 不折 false);型面纯 additive、公面 962、peer 不动;§51。上一版 0.72.3 = **patch**:core #863 记忆单系统半场 ① —— `projectAgentsForWire` 投影 `agents[].memory`(user|project|local 三词同映射引擎平面 agent:<type>);型面纯 additive、公面 962、零 wire 新键、peer 不动;§50。上一版 0.72.2 = **patch**:workflow 视图两票 —— `LiveWorkflowController.resolution()` 六态(snapshot() 的 null 三义拆开)+ `noteOwnWorkflowRun` own 台账同拍登记;型面纯 additive、公面 961、零 wire 键、peer 不动;§49。上一版 0.72.1 = **patch**:server 7.80.1 提货 —— 409 `conflict.resume_context_unavailable` 结构读数(`staleAfterSec` / `runId`;sdk 9.6.0 尚未带键,经 sdk 今天恒缺席)+ `SkillSpec.baseDir`(只在本机车道带);型面纯 additive、公面 960、peer 不动;§48。上一版 0.72.0 = **minor**:型面 BREAKING —— 39 个零消费导出退出公面(CC-32 退役批,[7419] §45 预告 / cli [7422] 同意 / web-client·desktop 过节拍沉默 = 同意;名单见 §47a S-1);运行期零 BREAKING、公面 956、peer 不动、devDep core ~7.20.1;随批:已退役名账 `removed` + export-liveness 门 G 段 + 冻结账门 ⑧c;§47。上一版 0.71.4 = **patch**:core 7.20.1 提货 —— `ENGINE_NOTICE_CODES` 65 + `wiring_manifest.writeProtection` 第七段 `_sema_writeProtection`;型面纯 additive、公面 995、peer 不动、devDep core `~7.20.1`;§46。上一版 0.71.3 = **patch**:门体系清账批 —— CC-24 export-liveness 门 + 39 个导出退役预告(0.72.0 删,表态制)/ CC-26 `as unknown as` 铸链棘轮 / CC-25 冻结账门 ⑧ 段 / CC-06 B-081 包侧半场(终帧 `_sema_effective_reasoning` / `_sema_effective_memory_scopes` + resume reopen 族 + `routePairingVerdict`);型面纯 additive、公面 986 → 995、peer 不动;§45。上一版 0.71.2 = **patch**:接入方验收两票归包 —— CC-28 B-132 decide 拒体三句去内部车道词 / CC-29 B-133 committedUuids 唯一性(重复 ⇒ 形 f);零型面变化、公面 986、peer 不动;§44。上一版 0.71.1 = **patch**:接入档打回修正 —— CC-27 `ApprovalCardRequest.readRootCandidate?` 帧→卡透传位 + 新导出型 `ReadRootCandidateView`;型面纯 additive、公面 986 不变、peer 不动;§43。上一版 0.71.0 = **minor**:型面 BREAKING 六件 —— peer sdk 地板 >=9.6.0 + agent-types >=0.3.0 / `SkillsListingTruncatedFactsView` 删 `requestedBudgetBytes?`·`laneClamped?` / `WiringManifestMcpEntry` → `WiringManifestMcpEntryView` / `MAX_AGENT_SKILLS` 删 / `decide.workflow_host_not_parked` 退役;运行期零 BREAKING。内容:core 7.20.0 提货(闭集 +5 六十四码)/ 🔴 CC-16 `text_segment_end.committedUuids[]` / CC-08 全五件(tool_disclosure / tool_progress 两 chrome 臂、wiring_manifest tools·hooks·lsp 进切片、tool_roster_delta 接上、context_usage 进切片、`readRootCandidate` 镜像)/ CC-19 `mcpEngineLegPresence` 归包 / CC-20 not_parked clean-cut;公面 986;§42 / 42y 八条)|
 | peer:wire 契约 | `@sema-agent/sdk` **>=9.6.0**(value-level,非 type-only;**0.71.0 抬版**:`tool_disclosure` / `tool_progress` 两帧型与 `ToolApprovalFrame.readRootCandidate` 自 9.6.0 起;0.69.0 曾抬到 >=9.4.0(`reasoning_end` / `lastLegMcp`),0.60.0 抬到 >=8.4.0;地板由 `scripts/run-sdk-floor-test.mjs` 的 `FLOOR` 与 public-surface 门 C-CC-3「不低于见证到的最低实装版」双钉)| `package.json` `peerDependencies` |
 | peer:会话词汇表 | `@sema-agent/agent-types` **>=0.3.0**(type-only,零运行时;0.71.0 抬版:devDep 与 peer 同步,type-superset 门 ④ 撞名预警对着 0.3.0 的 .d.ts 求值) | 同上 |
 | runtime dep | `diff` ^9.0.0(**唯一**一条;portability 门按**等值**钉死) | `package.json` `dependencies` |
-| 公开导出面 | **962** 个运行期符号(+ 44 个测试钩;= 0.72.3 的值:相对 0.72.2 +1 —— CC-39① `AGENT_MEMORY_WORDS`;0.72.2 相对 0.72.1 +1 —— CC-37 `noteOwnWorkflowRun`;0.72.1 相对 0.72.0 +4 —— CC-33 server 7.80.1 提货:`RESUME_CONTEXT_UNAVAILABLE` / `resumeContextUnavailableFromError` / `resumeContextUnavailableContent` / `skillBaseDirOf`;0.72.0 相对 0.71.4 −39 —— CC-32 退役批删 export-liveness 登记 retire 的 39 个零消费导出(23 常量 + 16 函数,名单见 §47);995 = 0.71.3 的值:相对 0.71.2 +9 —— CC-06 `readEffectiveReasoning` / `readEffectiveMemoryScopes` / `resumeReopenFromError` / `resumeReopenContent` / `routePairingVerdict` 五函数 + `RESUME_REOPEN_CODES` / `RESUME_ENV_FAILED` / `RESUME_TOOL_UNAVAILABLE` / `RESUME_TOOL_CONTRACT_MISMATCH` 四常量;986 = 0.71.0 的值:相对 0.70.2 −`MAX_AGENT_SKILLS` −`DECIDE_WORKFLOW_HOST_NOT_PARKED` +`projectToolRosterDelta` +`mcpEngineLegPresence`;986 = 0.70.0 的值:相对 0.69.2 **一件 additive(`readSkillsListingTruncated`,§39)、零删除**;985 = 0.69.2 的值:相对 0.69.1 **三件 additive、零删除**(CC-13 `isSubFlowSegmentEnd` / `SEGMENT_END_IDENTITY_KEYS` / `droppedWhySentence`,§38);982 = 0.69.0 未发布版的值(原排 0.68.3,因 peer 地板抬升改 minor)= 相对 0.68.2 **十七件 additive、零删除**:`fetchMcpPanel`(CC-03 补件,§36e)+ `readWorkflowResumeAdmissionIncomplete`(CC-05 core 7.18.0 #755)+ `installCoreValuePorts`/`hasCoreValuePorts`/`hasCoreValuePort`/`coreValuePortMisses`/`CORE_VALUE_PORT_NAMES` + 十读口(CC-07 core 值级端口,§36d);0.68.2 相对 0.68.1 十三件 additive:`SEMA_SEGMENT_ID_KEY`(CC-01 段身份键,§35f)/ `projectMcpPanel`+`mcpPanelLastLegDetail`+`projectMcpSection`(CC-03 `/mcp` 面板读视图,§35g)/ `resolveTextSegmentAuthority`/`createTextSegmentLedger`(L-318 `text_end` 权威段替换的判决单源 + print 形段账,详见 §35b/§35c)/ `memoryCaptureDeclarationField`/`MEMORY_CAPTURE_OFF`(L-316 会话级隐私声明的字面唯一铸点,§35d)/ `engineUrl`/`probeHealth`(L-61 件④ SDK 纯工具面原样转口,§35d)/ `AgentClient`/`isApprovalRequestFrameV1`/`isApprovalRevokeFrameV1`(L-61 存量清零:SDK **wire 面**原样转口,§35e)。`0.68.1`/`0.68.0` 是 **952**,那批是相对 0.67.2 **二十件 additive、🔴 两件删除(BREAKING)**:additive = `TERMINAL_CAUSE_KINDS`/`isTerminalCauseKind`/`RUN_TERMINAL_NOT_SUCCESS_STATUSES`/`RUN_TERMINAL_STATUSES`(L-247 终态词两表分源,详见 §33b)/ `SEMA_SUBAGENT_USAGE_PARTIAL_KEY`/`subagentUsageIsPartial`(L-244 子代下界位自有名,§33g)/ `ASK_UNRESOLVABLE_CAUSES`/`readAskUnresolvable`/`DURABLE_MANDATE_SOURCES`/`readDurableGateUnavailable`(core 7.17.0 #709 ①② 两只通告事实窄读器,§33c)/ `WORKFLOW_PARK_TRUTH_UNREADABLE`/`WORKFLOW_PARK_NOT_PENDING`/`WORKFLOW_PARK_BINDING_BROKEN`/`WORKFLOW_PARK_REQUIRES_RUN_STORE`(四个单码常量 🔧 0.72.0 退役)/`WORKFLOW_PARK_REFUSAL_CODES`/`isWorkflowParkRefusalCode`/`readWorkflowParks`(core 7.17.0 #652 park 真相四码 + parks 三键读器,§33d)/ `ENGINE_STOP_REASONS`/`engineStopReasonToCc`(L-246 A13 停止原词映射下沉,§33g)/ `readCancelRequested`(L-230 读面,§33f);🔴 **删除两件** `TERMINAL_NOT_SUCCESS_STATUSES`/`TERMINAL_STATUSES`(随 L-247 两表分源更名成 `RUN_TERMINAL_*`,clean-cut **不留别名** —— 留一个别名等于让端可以继续按合起来的那张表读,分源就白做了,详见 §33b)。`0.67.0` 是 **934**,那批是相对 0.66.0 **七件 additive、🔴 两件删除**:additive = `CLASSIFIER_DENY_CAUSES`/`isClassifierDenyCause`/`classifierDenyCauseOf`/`classifierDenyCauseDetail`(core 7.14.0 退役 `classifierUnavailable` 之后的**拒绝面**继任读器与措辞,详见 §32b)/ `RULE_STORE_UNREADABLE_KINDS`/`isRuleStoreUnreadableKind`/`ruleStoreUnreadableDetail`(core 7.14.0 #688 C3 的规则店机制位三件,详见 §32d);🔴 **删除两件** `classifierUnavailableOf`/`classifierUnavailableDetail`(随 core 7.14.0 的 Retired keys 表整族退役,clean-cut 不留别名,详见 §32b;同批删的还有**型** `ClassifierUnavailableView`、卡位与帧位 `classifierUnavailable`、以及一条恒真的型面钉 `_askOriginWordsPin`)。`0.66.0` 是 **929**,那批是一件 additive、零删除:`readRunCostFacts`(终局成本事实的唯一读器:`costBreakdown` / `nested` 窄读 + 对账三段与两个判别位,终帧超集键与 chrome 对账臂共用它;详见 §31c);已发的 **0.65.x 十一件 additive、两件删除**:additive = `DECIDE_WORKFLOW_HOST_UNKNOWN`/`DECIDE_WORKFLOW_HOST_NOT_PARKED`/`DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED`/`DECIDE_WORKFLOW_LANE_CODES`/`readDecideReceipt`/`decideAcceptedNotResolved`/`decideRefusalFromError`(B-070 `/decide` 回执读面与三码人话,详见 §30h)/ `TERMINAL_NOT_SUCCESS_STATUSES`/`isTerminalNotSuccess`/`TERMINAL_STATUSES`/`isTerminalStatus`(L-215② 终局词汇单铸谓词,详见 §30j);🔴 **删除两件** `AUTO_MODE_BREAKER_CAUSES`/`classifierBreakerOf`(熔断族随 core 7.12.0 的 Removed(BREAKING) 整只退役,clean-cut 不留别名,详见 §30k②;同批删的还有**型** `ClassifierBreakerView` 与 `ClassifierStatusView.breaker` 一位)。`0.64.2` 是 **919**,那批是一件 additive、零删除:`readDenialLimitFallback`(限额回落卡的窄读器上公面,壳侧同判据副本退役,详见 §29③);`0.64.0` 是 **918**,那批是件①+件② 十三件 additive、零删除:`CLASSIFIER_STATUS_STATES`/`classifierBreakerOf`/`classifierStatusOf`/`classifierStatusDetail`(分类器状态面,详见 §28②)/ `THINKING_FORMATS`/`THINKING_FORMAT_WIRE_TWINS`/`THINKING_DISABLE_PROBE_ORDER`/`MODEL_PROBE_VERDICTS`/`PROBE_PROMPT`/`PROBE_MAX_TOKENS`(两个探针常量 🔧 0.72.0 退役)/`probeRequestBody`/`probeModelCapability`/`applyProbeToEntry`(模型思考能力探测,详见 §28①);`0.63.0` 是 **905**,那批是八件 additive、零删除:`projectServerGateKnobs`/`postureKnobSourceOf`/`postureSourceIsOperatorPinned`/`postureKnobDetail`/`POSTURE_SOURCE_WORDS`(S-178 三根 posture 旋钮读数,详见 §27b)/ `PERSISTED_RULE_BEHAVIORS`/`PERSISTED_RULE_BEHAVIOR_UNKNOWN`/`persistedRuleBehaviorOf`/`persistedRuleBehaviorLabel`/`revokeTargetFromPersistedRule`(三态规则身份,§27c)/ `engineIdentityOf`/`engineIdentityVerdict`/`engineIdentityChanged`/`engineIdentityChangedBy`/`ENGINE_IDENTITY_ANCHORS`(S-179 代际锚,§27d)/ `GATE_DENIED_BY_WORDS`/`gateDeniedByDetail`/`ASK_ORIGIN_WORDS`/`askOriginDetail`(门词汇 +2,§27e)/ `PERMISSION_RULE_ISSUE_CODES`/`RETIRED_PERMISSION_RULE_ISSUE_CODES`/`permissionRuleIssueDetail`(规则 lint 码表,§27f)/ `projectToolRoster`/`toolRosterNames`/`toolShimFromRoster`/`applyToolRosterDelta`(L-161 工具名册,§27g)/ `ENGINE_NOTICE_CODES`/`ENGINE_NOTICE_AUDIENCE`/`noticeAudienceOf`/`engineNoticeInCatalog`/`MCP_INJECTION_DROP_REASONS`/`readMcpInjectionDrop`(L-167 通告码册,§27h)/ `AUTO_MODE_UNAVAILABLE_CAUSES`/`AUTO_MODE_BREAKER_CAUSES`/`classifierUnavailableOf`/`classifierUnavailableDetail`(件⑧ 分类器不可用事实,§27h2);`0.62.0` 是 **869**,那批是五件 additive、**零删除**:`capForDisplay`(呈前消毒 + 封长的共用铸点,详见 §26⑦)/ `SEAT_SEND_MESSAGE_KEY_ORIGINS`(座位载荷逐键出身表,详见 §26③)/ `configureSubagentContentStore`+`subagentContentStoreConfig`+`SUBAGENT_CONTENT_STORE_DEFAULTS`(子代内容账本字节预算,测试钩 `__resetSubagentContentStoreConfigForTests` +1,详见 §26②);`0.61.0` 是 **864**,那批是三件 additive、**零删除**:`projectReadFacePosture`/`readFacePostureDetail`/`readFaceDisagreement`(S-167 READ 容纳面 operator 读器,详见 §25);`0.60.0` 是 **861**,那批是二十五件 additive、**零删除**:`readRunTerminal`/`runTerminalCode`/`runTerminalGateKind`/`runTerminalGateToolName`/`isReviewPark`/`REVIEW_PARK_GATE_KINDS` 六件终局因由读器 + `gateOutcomeOf`/`isDeniedGate`/`gateDeniedBy`/`gateApprover`/`isApprovalWindowExpiredGate`/`isDenialLimitAutoDeniedGate`/`isParkSlaExpiredGate`/`isHumanSettledGate` 八件门记录读器 + `projectWriteProtectionCapability`/`noteEngineCapsForWriteProtection`/`observedWriteProtection`/`forgetWriteProtectionReading`/`writeProtectionDoctorDetail`/`projectWriteProtectionPosture`/`writeProtectionPostureDetail` 七件写保护读面(测试钩 `__resetWriteProtectionReadingsForTests` +1)+ `readWireErrorCode` + 真机边界①的两件 `isGateParkedToolEnd`/`GATE_PARKED_ERROR_CODE` + 异源复审逼出的 `engineCapsGeneration`;`0.59.0` 是 **836**,那批是八件 additive:`RULE_OFFERS_ABSENCE_REASONS`/`DENIAL_LIMIT_KINDS` 两张闭词表再导出 + `engineCapValue` 能力位四态通用读口 + `projectSqlEngineCapability`/`observedSqlEngine`/`noteEngineCapsForSqlEngine`/`forgetSqlEngineReading`/`sqlEngineDoctorDetail` 五件 SQL 姿态读面(测试钩 `__resetSqlEngineReadingsForTests` +1);`0.58.0` 是 **828**,那批是三件 additive:`RULE_OFFER_MATCHES`/`RULE_OFFER_BATCH_MEMBER_KINDS`/`RULE_OFFER_UNCOVERED_REASONS` 三张闭词表再导出 + `RESUME_REFUSAL_CODES`/`RESUME_PLACEMENT_MISMATCH`/`resumeRefusalFromError`/`resumeRefusalContent` 四件文案铸点;`0.57.0` 是 **821**;`0.56.0`/`0.55.0` 是 **815**;已发 `0.54.0`(design/385 十件 additive 含 `AUTHORITY_ENVELOPE_TAGS` 🔧 0.72.0 退役);`0.52.0` 是 **805**(L-69⑨ 两件);`0.51.0` 是 **803**;`0.50.0` 是 **800**(S-81 五件);`0.49.0` 是 **795**;`0.48.0` 是 **794**;npm `0.47.0` 是 **790**,`0.46.0` 是 **787**,`0.44.0` 是 **783**,`0.43.1`/`0.43.0` 是 **776**,`0.42.0` 是 **771**,`0.41.0` 是 **767**,`0.39.0` 是 **766**,`0.38.0` 是 **764**;`0.37.0` 是 **753**,见 `CHANGELOG.md`) | `scripts/public-export-baseline.json` 的 `count` / `testHookCount` —— **别手抄进别处,以该文件为准** |
+| 公开导出面 | **969** 个运行期符号(+ 45 个测试钩;= 0.72.6 的值:相对 0.72.5 +1 —— CC-40 `steerFollowIntent`;968 = 0.72.5 的值:相对 0.72.4 +6 —— CC-31 server 7.82.1 提货 `capabilities.webSearch.backend` 四态读面:`WEB_SEARCH_BACKEND_NONE` / `projectWebSearchBackendCapability` / `observedWebSearchBackend` / `noteEngineCapsForWebSearchBackend` / `forgetWebSearchBackendReading` / `webSearchBackendDoctorDetail`;962 = 0.72.3 的值:相对 0.72.2 +1 —— CC-39① `AGENT_MEMORY_WORDS`;0.72.2 相对 0.72.1 +1 —— CC-37 `noteOwnWorkflowRun`;0.72.1 相对 0.72.0 +4 —— CC-33 server 7.80.1 提货:`RESUME_CONTEXT_UNAVAILABLE` / `resumeContextUnavailableFromError` / `resumeContextUnavailableContent` / `skillBaseDirOf`;0.72.0 相对 0.71.4 −39 —— CC-32 退役批删 export-liveness 登记 retire 的 39 个零消费导出(23 常量 + 16 函数,名单见 §47);995 = 0.71.3 的值:相对 0.71.2 +9 —— CC-06 `readEffectiveReasoning` / `readEffectiveMemoryScopes` / `resumeReopenFromError` / `resumeReopenContent` / `routePairingVerdict` 五函数 + `RESUME_REOPEN_CODES` / `RESUME_ENV_FAILED` / `RESUME_TOOL_UNAVAILABLE` / `RESUME_TOOL_CONTRACT_MISMATCH` 四常量;986 = 0.71.0 的值:相对 0.70.2 −`MAX_AGENT_SKILLS` −`DECIDE_WORKFLOW_HOST_NOT_PARKED` +`projectToolRosterDelta` +`mcpEngineLegPresence`;986 = 0.70.0 的值:相对 0.69.2 **一件 additive(`readSkillsListingTruncated`,§39)、零删除**;985 = 0.69.2 的值:相对 0.69.1 **三件 additive、零删除**(CC-13 `isSubFlowSegmentEnd` / `SEGMENT_END_IDENTITY_KEYS` / `droppedWhySentence`,§38);982 = 0.69.0 未发布版的值(原排 0.68.3,因 peer 地板抬升改 minor)= 相对 0.68.2 **十七件 additive、零删除**:`fetchMcpPanel`(CC-03 补件,§36e)+ `readWorkflowResumeAdmissionIncomplete`(CC-05 core 7.18.0 #755)+ `installCoreValuePorts`/`hasCoreValuePorts`/`hasCoreValuePort`/`coreValuePortMisses`/`CORE_VALUE_PORT_NAMES` + 十读口(CC-07 core 值级端口,§36d);0.68.2 相对 0.68.1 十三件 additive:`SEMA_SEGMENT_ID_KEY`(CC-01 段身份键,§35f)/ `projectMcpPanel`+`mcpPanelLastLegDetail`+`projectMcpSection`(CC-03 `/mcp` 面板读视图,§35g)/ `resolveTextSegmentAuthority`/`createTextSegmentLedger`(L-318 `text_end` 权威段替换的判决单源 + print 形段账,详见 §35b/§35c)/ `memoryCaptureDeclarationField`/`MEMORY_CAPTURE_OFF`(L-316 会话级隐私声明的字面唯一铸点,§35d)/ `engineUrl`/`probeHealth`(L-61 件④ SDK 纯工具面原样转口,§35d)/ `AgentClient`/`isApprovalRequestFrameV1`/`isApprovalRevokeFrameV1`(L-61 存量清零:SDK **wire 面**原样转口,§35e)。`0.68.1`/`0.68.0` 是 **952**,那批是相对 0.67.2 **二十件 additive、🔴 两件删除(BREAKING)**:additive = `TERMINAL_CAUSE_KINDS`/`isTerminalCauseKind`/`RUN_TERMINAL_NOT_SUCCESS_STATUSES`/`RUN_TERMINAL_STATUSES`(L-247 终态词两表分源,详见 §33b)/ `SEMA_SUBAGENT_USAGE_PARTIAL_KEY`/`subagentUsageIsPartial`(L-244 子代下界位自有名,§33g)/ `ASK_UNRESOLVABLE_CAUSES`/`readAskUnresolvable`/`DURABLE_MANDATE_SOURCES`/`readDurableGateUnavailable`(core 7.17.0 #709 ①② 两只通告事实窄读器,§33c)/ `WORKFLOW_PARK_TRUTH_UNREADABLE`/`WORKFLOW_PARK_NOT_PENDING`/`WORKFLOW_PARK_BINDING_BROKEN`/`WORKFLOW_PARK_REQUIRES_RUN_STORE`(四个单码常量 🔧 0.72.0 退役)/`WORKFLOW_PARK_REFUSAL_CODES`/`isWorkflowParkRefusalCode`/`readWorkflowParks`(core 7.17.0 #652 park 真相四码 + parks 三键读器,§33d)/ `ENGINE_STOP_REASONS`/`engineStopReasonToCc`(L-246 A13 停止原词映射下沉,§33g)/ `readCancelRequested`(L-230 读面,§33f);🔴 **删除两件** `TERMINAL_NOT_SUCCESS_STATUSES`/`TERMINAL_STATUSES`(随 L-247 两表分源更名成 `RUN_TERMINAL_*`,clean-cut **不留别名** —— 留一个别名等于让端可以继续按合起来的那张表读,分源就白做了,详见 §33b)。`0.67.0` 是 **934**,那批是相对 0.66.0 **七件 additive、🔴 两件删除**:additive = `CLASSIFIER_DENY_CAUSES`/`isClassifierDenyCause`/`classifierDenyCauseOf`/`classifierDenyCauseDetail`(core 7.14.0 退役 `classifierUnavailable` 之后的**拒绝面**继任读器与措辞,详见 §32b)/ `RULE_STORE_UNREADABLE_KINDS`/`isRuleStoreUnreadableKind`/`ruleStoreUnreadableDetail`(core 7.14.0 #688 C3 的规则店机制位三件,详见 §32d);🔴 **删除两件** `classifierUnavailableOf`/`classifierUnavailableDetail`(随 core 7.14.0 的 Retired keys 表整族退役,clean-cut 不留别名,详见 §32b;同批删的还有**型** `ClassifierUnavailableView`、卡位与帧位 `classifierUnavailable`、以及一条恒真的型面钉 `_askOriginWordsPin`)。`0.66.0` 是 **929**,那批是一件 additive、零删除:`readRunCostFacts`(终局成本事实的唯一读器:`costBreakdown` / `nested` 窄读 + 对账三段与两个判别位,终帧超集键与 chrome 对账臂共用它;详见 §31c);已发的 **0.65.x 十一件 additive、两件删除**:additive = `DECIDE_WORKFLOW_HOST_UNKNOWN`/`DECIDE_WORKFLOW_HOST_NOT_PARKED`/`DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED`/`DECIDE_WORKFLOW_LANE_CODES`/`readDecideReceipt`/`decideAcceptedNotResolved`/`decideRefusalFromError`(B-070 `/decide` 回执读面与三码人话,详见 §30h)/ `TERMINAL_NOT_SUCCESS_STATUSES`/`isTerminalNotSuccess`/`TERMINAL_STATUSES`/`isTerminalStatus`(L-215② 终局词汇单铸谓词,详见 §30j);🔴 **删除两件** `AUTO_MODE_BREAKER_CAUSES`/`classifierBreakerOf`(熔断族随 core 7.12.0 的 Removed(BREAKING) 整只退役,clean-cut 不留别名,详见 §30k②;同批删的还有**型** `ClassifierBreakerView` 与 `ClassifierStatusView.breaker` 一位)。`0.64.2` 是 **919**,那批是一件 additive、零删除:`readDenialLimitFallback`(限额回落卡的窄读器上公面,壳侧同判据副本退役,详见 §29③);`0.64.0` 是 **918**,那批是件①+件② 十三件 additive、零删除:`CLASSIFIER_STATUS_STATES`/`classifierBreakerOf`/`classifierStatusOf`/`classifierStatusDetail`(分类器状态面,详见 §28②)/ `THINKING_FORMATS`/`THINKING_FORMAT_WIRE_TWINS`/`THINKING_DISABLE_PROBE_ORDER`/`MODEL_PROBE_VERDICTS`/`PROBE_PROMPT`/`PROBE_MAX_TOKENS`(两个探针常量 🔧 0.72.0 退役)/`probeRequestBody`/`probeModelCapability`/`applyProbeToEntry`(模型思考能力探测,详见 §28①);`0.63.0` 是 **905**,那批是八件 additive、零删除:`projectServerGateKnobs`/`postureKnobSourceOf`/`postureSourceIsOperatorPinned`/`postureKnobDetail`/`POSTURE_SOURCE_WORDS`(S-178 三根 posture 旋钮读数,详见 §27b)/ `PERSISTED_RULE_BEHAVIORS`/`PERSISTED_RULE_BEHAVIOR_UNKNOWN`/`persistedRuleBehaviorOf`/`persistedRuleBehaviorLabel`/`revokeTargetFromPersistedRule`(三态规则身份,§27c)/ `engineIdentityOf`/`engineIdentityVerdict`/`engineIdentityChanged`/`engineIdentityChangedBy`/`ENGINE_IDENTITY_ANCHORS`(S-179 代际锚,§27d)/ `GATE_DENIED_BY_WORDS`/`gateDeniedByDetail`/`ASK_ORIGIN_WORDS`/`askOriginDetail`(门词汇 +2,§27e)/ `PERMISSION_RULE_ISSUE_CODES`/`RETIRED_PERMISSION_RULE_ISSUE_CODES`/`permissionRuleIssueDetail`(规则 lint 码表,§27f)/ `projectToolRoster`/`toolRosterNames`/`toolShimFromRoster`/`applyToolRosterDelta`(L-161 工具名册,§27g)/ `ENGINE_NOTICE_CODES`/`ENGINE_NOTICE_AUDIENCE`/`noticeAudienceOf`/`engineNoticeInCatalog`/`MCP_INJECTION_DROP_REASONS`/`readMcpInjectionDrop`(L-167 通告码册,§27h)/ `AUTO_MODE_UNAVAILABLE_CAUSES`/`AUTO_MODE_BREAKER_CAUSES`/`classifierUnavailableOf`/`classifierUnavailableDetail`(件⑧ 分类器不可用事实,§27h2);`0.62.0` 是 **869**,那批是五件 additive、**零删除**:`capForDisplay`(呈前消毒 + 封长的共用铸点,详见 §26⑦)/ `SEAT_SEND_MESSAGE_KEY_ORIGINS`(座位载荷逐键出身表,详见 §26③)/ `configureSubagentContentStore`+`subagentContentStoreConfig`+`SUBAGENT_CONTENT_STORE_DEFAULTS`(子代内容账本字节预算,测试钩 `__resetSubagentContentStoreConfigForTests` +1,详见 §26②);`0.61.0` 是 **864**,那批是三件 additive、**零删除**:`projectReadFacePosture`/`readFacePostureDetail`/`readFaceDisagreement`(S-167 READ 容纳面 operator 读器,详见 §25);`0.60.0` 是 **861**,那批是二十五件 additive、**零删除**:`readRunTerminal`/`runTerminalCode`/`runTerminalGateKind`/`runTerminalGateToolName`/`isReviewPark`/`REVIEW_PARK_GATE_KINDS` 六件终局因由读器 + `gateOutcomeOf`/`isDeniedGate`/`gateDeniedBy`/`gateApprover`/`isApprovalWindowExpiredGate`/`isDenialLimitAutoDeniedGate`/`isParkSlaExpiredGate`/`isHumanSettledGate` 八件门记录读器 + `projectWriteProtectionCapability`/`noteEngineCapsForWriteProtection`/`observedWriteProtection`/`forgetWriteProtectionReading`/`writeProtectionDoctorDetail`/`projectWriteProtectionPosture`/`writeProtectionPostureDetail` 七件写保护读面(测试钩 `__resetWriteProtectionReadingsForTests` +1)+ `readWireErrorCode` + 真机边界①的两件 `isGateParkedToolEnd`/`GATE_PARKED_ERROR_CODE` + 异源复审逼出的 `engineCapsGeneration`;`0.59.0` 是 **836**,那批是八件 additive:`RULE_OFFERS_ABSENCE_REASONS`/`DENIAL_LIMIT_KINDS` 两张闭词表再导出 + `engineCapValue` 能力位四态通用读口 + `projectSqlEngineCapability`/`observedSqlEngine`/`noteEngineCapsForSqlEngine`/`forgetSqlEngineReading`/`sqlEngineDoctorDetail` 五件 SQL 姿态读面(测试钩 `__resetSqlEngineReadingsForTests` +1);`0.58.0` 是 **828**,那批是三件 additive:`RULE_OFFER_MATCHES`/`RULE_OFFER_BATCH_MEMBER_KINDS`/`RULE_OFFER_UNCOVERED_REASONS` 三张闭词表再导出 + `RESUME_REFUSAL_CODES`/`RESUME_PLACEMENT_MISMATCH`/`resumeRefusalFromError`/`resumeRefusalContent` 四件文案铸点;`0.57.0` 是 **821**;`0.56.0`/`0.55.0` 是 **815**;已发 `0.54.0`(design/385 十件 additive 含 `AUTHORITY_ENVELOPE_TAGS` 🔧 0.72.0 退役);`0.52.0` 是 **805**(L-69⑨ 两件);`0.51.0` 是 **803**;`0.50.0` 是 **800**(S-81 五件);`0.49.0` 是 **795**;`0.48.0` 是 **794**;npm `0.47.0` 是 **790**,`0.46.0` 是 **787**,`0.44.0` 是 **783**,`0.43.1`/`0.43.0` 是 **776**,`0.42.0` 是 **771**,`0.41.0` 是 **767**,`0.39.0` 是 **766**,`0.38.0` 是 **764**;`0.37.0` 是 **753**,见 `CHANGELOG.md`) | `scripts/public-export-baseline.json` 的 `count` / `testHookCount` —— **别手抄进别处,以该文件为准** |
 | 常驻门 | 以 `scripts/gates-manifest.json` 的 `suites` 长度为准(**本档不抄这个数**) | `scripts/gates-manifest.json`;`npm test` 的名单等值门与它逐名对账 |
 | 沿革档 | 0.29.0 起建 `CHANGELOG.md`;更早批次记账在 `src/index.ts` 文件头 + `docs/REFACTOR-LEDGER.md` | — |
 
@@ -121,7 +121,7 @@ SDK 核对「本包 import 的每个值级符号仍然导出」「`TaskStats.cos
 
 ## §2 公共导出面地图(按域)
 
-> 全集真源 = `scripts/public-export-baseline.json` 的 `names`(**962** 项)。
+> 全集真源 = `scripts/public-export-baseline.json` 的 `names`(**969** 项)。
 > 本节**不逐名抄**,只给「域 → 承重导出 → 用途 → 实现锚」。承重导出 = 一个端为了让这个域干活
 > **必须**直接调到的那几个符号;其余是它们的类型、变体与辅助位。
 > 单一入口:`import { … } from '@sema-agent/client-core'`(`exports` 只有 `.` 一个;
@@ -145,12 +145,12 @@ SDK 核对「本包 import 的每个值级符号仍然导出」「`TaskStats.cos
   `WorkflowsGateUnknownDenial` 四形**不在**基线里,`src/selfOrchestrationDenial.ts` 对基线贡献
   **4** 项运行期导出(三个函数 + `SELF_ORCHESTRATION_RETRY_WITHOUT`)。
 
-962 项的内部构成(帮助端估读表大小;0.72.3 +1 常量(CC-39①);0.72.2 +1 函数(CC-37);0.72.1 +1 常量 +3 函数(CC-33);0.72.0 −23 常量 −16 函数(CC-32 退役批);0.71.3 +4 常量 +5 函数(CC-06);0.71.0 −2 常量 `MAX_AGENT_SKILLS` / `DECIDE_WORKFLOW_HOST_NOT_PARKED` +2 函数 `projectToolRosterDelta` / `mcpEngineLegPresence`;0.70.0 起 +1 函数;0.69.2 起 +3:常量 1 / 函数 2):**280** 项是 `SCREAMING_SNAKE` 常量数据表/词汇表
+969 项的内部构成(帮助端估读表大小;0.72.6 +1 函数(CC-40);0.72.5 +1 常量 +5 函数(CC-31);0.72.3 +1 常量(CC-39①);0.72.2 +1 函数(CC-37);0.72.1 +1 常量 +3 函数(CC-33);0.72.0 −23 常量 −16 函数(CC-32 退役批);0.71.3 +4 常量 +5 函数(CC-06);0.71.0 −2 常量 `MAX_AGENT_SKILLS` / `DECIDE_WORKFLOW_HOST_NOT_PARKED` +2 函数 `projectToolRosterDelta` / `mcpEngineLegPresence`;0.70.0 起 +1 函数;0.69.2 起 +3:常量 1 / 函数 2):**281** 项是 `SCREAMING_SNAKE` 常量数据表/词汇表
 (矩阵、键集、env 名、锚串)而非可调用物;**6** 项是 PascalCase 运行期值
 (`ControlRouter` / `ControlSafetyError` / `HitlBridge` / `HitlSafetyError` / `DecideTransportRetryExhaustedError`);
 **37** 项是 `*For(sessionKey, …)` 的 per-session 变体(0.72.0 −4:`clearArmedGateFor` / `onGateArmedFor` / `registerArmedGateFromQuestionIdFor` / `notePlanReviewAnsweredIfDecisiveFor` 退出公面)(§6;其中 `engineNamespaceKeyFor` 是命名巧合 —— 参数是 baseUrl 不是 sessionKey,见域 14)。
 
-### 2b. 域图(16 域,逐域计数之和 = 982)
+### 2b. 域图(16 域,逐域计数之和 = 969)
 
 | # | 域 | 名数 | 承重导出 | 用途 | 实现锚 |
 |---|---|---|---|---|---|
@@ -168,7 +168,7 @@ SDK 核对「本包 import 的每个值级符号仍然导出」「`TaskStats.cos
 | 12 | **workflow 与后台工作视图** | 21 | `projectWorkflowRun` · `readWorkflowResumeAdmissionIncomplete`(0.68.3 CC-05:core 7.18.0 `resumeAdmissionIncomplete` 在场 = 不是 resume 基,与 `readWorkflowParks` 同一条投影义务)· `createLiveWorkflowSource` · `ensureWorkflowActivityLedger` · `readWorkflowActivityLedger` · `stopWorkflowActivityLedger` · `resetWorkflowActivityLedgers` · `createBackgroundView` · `projectBackgroundView` · `recordWorkflowAgentTaskId` · `agentDisplayStatus` | 活过一个 turn 的长任务读面:workflow run + 跨 session 后台任务归一表(`assistant.tasks` 与 fleet SSE **两源独立降级**) | `src/workflow.ts`、`src/workflowClient.ts`、`src/workflowMonitor.ts`、`src/agentSession/backgroundView.ts`(+ 纯类型 `src/agentSession/contract.ts`) |
 | 13 | **座位 IPC 契约** | 34 | `LOCAL_SESSIONS_SPEC` · `SEAT_METHOD_NAMES` · `SEAT_EVENT_TYPES` · `isLocalSessionEvent` · `isToolPermissionRequest` · `toolPermissionRequestId` · `SEAT_VALIDATOR_KEY_COVERAGE` · `SEAT_SEND_MESSAGE_KEY_ORIGINS`(0.62.0:座位载荷**逐键出身**登记 —— 每个位要么写明转投哪个引擎请求位、要么写明为什么不上 wire;常驻门对**装在盘上的** sdk 型面逐名核,详见 §26③)| desktop↔web 座位 IPC 契约的**单一真源**(此前两边各一份、名字零重合 ⇒ 编译器永远不会告诉你它们漂了)。🔴 加 verb 忘了加 `LOCAL_SESSIONS_SPEC` **不报错**:preload 不注册 channel、渲染端读到 `undefined` | `src/seatContract.ts`(**零 import**,纯类型 + 常量 + 纯谓词)。🔴 **证据等级标注(0.42.0,test [5087] 的「语料**种类**缺口」/ cli [5088] 认领件)**:该文件里所有以「CC 如何如何」为形的断言(`212 methods` / `854-channel census` / 方法名逐字保留 / `fQe` 逐字段对照 / 一切 `.vite/build/index.chunk-*.js` 坐标)**证据等级 = 桌面 unpack,本地语料库不可复验** —— 本仓手边可复验的参照语料**只覆盖终端 CLI 形态**的静态产物,拿它去 grep 桌面壳里的符号只会零命中,而零命中在这里**既不证真也不证伪**。复核这些断言**不得**拿本仓语料当反证 |
 | 14 | **宿主端口与会话槽** | 41 | `installHost` · `installHostFor` · `installCoreValuePorts` + 十读口 + 三存在性口(0.69.0 CC-07:core 值级面端口注入,Node 宿主装配根装、浏览器 lane 恒缺席)· `hostPortMisses(For)` · `DEFAULT_SESSION_KEY` · `hostEnv` · `unrefTimer` · `parseLocaleTag` / `pickUiLanguage`(#244 F4 族D A-028.20:locale tag 手术单源 + UI 语言判定;与 `resolveRegionHint` 双出口成文 —— 语言偏好域 en/zh ≠ 地址可达域 cn/intl/unknown,`zh-Hant` 前者 zh 后者 intl 是设计)· `engineNamespaceKeyFor` / `mergeSessionMapRecord` / `mergeEngineEntry`(A-028.12:会话 id 映射单一键形 + merge 判定;存储经 `SessionMapStorePort` 归端 —— cli 文件锁/原子写,web localStorage)| 进程/端级装配层(settings/fs/queue/timers/session/log/probe),与 per-turn 的 `AdapterContext` **分层**。头注的判定规则:**这个能力每 turn 都会变吗?** 会 ⇒ `ctx`;不会 ⇒ `installHost` | `src/host.ts`、`src/hostEnv.ts`、`src/sessionSlot.ts`、`src/unrefTimer.ts`、`src/env/{localeGeo,localeTag,uiLanguage}.ts`、`src/sessionMap.ts` |
-| 15 | **控制面与传输** | 124 | `resumeContextUnavailableFromError` / `resumeContextUnavailableContent`(0.72.1 CC-33:409 `conflict.resume_context_unavailable` 读数 `{ code, staleAfterSec?, runId? }` + 三句人话;§48)· `mcpEngineLegPresence`(0.71.0 CC-19:引擎侧 MCP 在场三值,只从面板视图求;§42)· `ControlRouter`(+ `ControlSafetyError`)· `fetchMcpPanel`(0.69.0:经 sdk `sessions.mcp` 取体 + 投视图,不裸 fetch)· `projectMcpPanel` + `mcpPanelLastLegDetail`(0.68.2 CC-03:`GET /v1/sessions/:id/mcp` 面板体防御读视图 + `lastLegMcp` 一行措辞铸点;缺席 = 键不铸、读不懂 = `lastLegMcpUnreadable`、禁与 `servers[]` 对账)· `makeEngineWireClient` + `resolveWireAuth` · `installEngineWireTarget` · `diagnoseSseIdleTear` / `isSseIdleError` · `attemptActiveRunSelfHeal` + `activeRunBusySignal` + `activeRunSelfHealRow` / `activeRunBusyHeadlessRow` · `kickEngineCapsProbe` / `engineCapTrue` / `invalidateEngineCaps(baseUrl, probe?)`(#307 S25:引擎温切后的 caps 生产失效口 —— kick 自带幂等闸,同 baseUrl 重启后不显式失效就永远读到旧引擎那一版能力位;调用方 = 壳的 respawn/restartEngine。🔴 **推荐两参形**:第二参给替代探测则「推进代际 + 注册新探测」在同一同步块内完成,失效与下一次 kick 之间那个「等待者读到未判」的窗按构造不存在;单参形保留给「只丢缓存、这一刻没有替代探测」的调用方,那种情形下读到未判是诚实结局) · `engineCapValue`(S-131,0.59.0:能力位的**四态**通用读口 `unobserved`/`not_reported`/`null`/`value` —— 既有三口把四种「读不出」全折成 fail-closed 一档,对**放行**问题是对的、对**读面/诊断**问题是错的:`null`(引擎明确说没有,正面事实)会与「老引擎不报」「还没探到」在屏上同形。`value` 位刻意不做形校验,形归各能力位自己的窄读器,详见 §23b)· `projectSqlEngineCapability` / `observedSqlEngine` / `noteEngineCapsForSqlEngine` / `forgetSqlEngineReading` / `sqlEngineDoctorDetail`(S-131,0.59.0:`Capabilities.sql`(server ≥7.60.0)的四态读面**从壳侧上收** —— 归层债,0.58.0 时它长在壳里正是因为包侧没有嵌套对象读口。🔴 **导出名与壳侧那份逐字同名 = drift-lock**;`txnMode: null` 是铸点域内的合法值不是畸形;换代失效口清成未观测而不是留旧值,详见 §23b)· `mapBrainStatusToRetry` · `waitForClaimRelease` + `CLAIM_RELEASED_STATES` / `CLAIM_HELD_STATES` · `atMostOnceFailureClass` / `readSteerDelivery` · `clearRunningChoiceOffer`(Inkglow-1085 P0b①:「Do nothing」登记的清口 —— 端的「重新打开操作菜单」入口;登记在场时 attemptActiveRunSelfHeal 不整卡重弹,not-parked 结局带 `alreadyOffered: true` 判别位,端据此降级渲一行)· `INTERACTIVE_WAY_OUT`(默认出路串单源)· `engineSessionParamFor`(design/285 批 0:`?session=` 派生的 **per-key** 形 —— `hostSessionFor(sessionKey)?.currentSessionId()` + [1501] 空串归一;零参 `engineSessionParam()` = 默认槽兼容层,取值链逐字等价)· `normalizeWirePrincipal`(A-028.10:principal 在场性 trim 原语 —— 全空白=缺席不发头,engineWireTarget 两臂/makeEngineWireClient/壳 livePrincipal 同尺)· `readSessionMemoryStatus` / `classifyMemoryStatusFailure` / `readCaptureOptOut` / `readLastCapture`(S-53 会话记忆姿态读面,0.48.0:失败分诊**码优先**——两个 404 分道 `not_found.session` / `not_found.route`,无码 404 不猜落 failed;五键逐键缺席语义两个合读器,`lastCapture` 三态的判别材料是 `committedCount` 不是本键;IO 归宿主注入 `MemoryStatusClientLike`,详见 §11) · `classifyTurnWireError` / `isWireTransportError` / `isPreStreamDrainingReject` / `isResumeAtRejection` / `drainingRetryDelayMs` / `scenarioDenyFromError` + `WIRE_NETWORK_ERROR_PATTERN`(A-028.11/.13:turn 错误分型判定半场,人话文案与渲染归端)· `resumeRetryLaterFromError`(L-102,0.57.0:resume 族**时间性拒绝**二码的判型半场 —— 这一族里唯一**带得出「等多久」**(`retryAfterSec`)的两个码。🔴 闭集**不是**「哪些码可以等」的名单:同族 `resume.row_recycling` 同样可等(窗口自清)只是没有秒数 ⇒ 本读口返回 `null` 只意味着没命中这两码,详见 §21) · `projectWriteProtectionCapability` / `observedWriteProtection` / `noteEngineCapsForWriteProtection` / `forgetWriteProtectionReading` / `writeProtectionDoctorDetail` / `projectWriteProtectionPosture` / `writeProtectionPostureDetail`(S-138,0.60.0:`Capabilities.writeProtection` (engine ≥7.63.0)的**四态**读面 + operator 面行表 —— 与上面 S-131 那一格**同构同纪律**。🔴 三位刻意不合成一个布尔;`not_reported` **不是**「这台部署没有写保护表」(座位缺席恰是缺省表在岗);逐行 name/kind 走**最小披露**只上 operator 面,详见 §24e)· `projectReadFacePosture` / `readFacePostureDetail` / `readFaceDisagreement`(S-167,0.61.0:operator 面 `diagnostics.wiring.readFace`(engine ≥7.65.0)的窄读器 —— 与上面S-138 那一格**同构同纪律**。🔴 三句「答不出来」逐字互异且没有一句等于「没有 READ 档」;`source` 按开集读;与租户面 `capabilities.readFace` 刻意不合流,只带一个纯比较函数,详见 §25)| 上行通道的**监管**半场(submit / steer / kill / 队列命令定序)+ 传输构造、caps 探测、SSE 断流分诊、**409 active-run 自愈** | `src/controlRouter.ts`、`steering.ts`、`sseIdleTriage.ts`、`retryStatus.ts`、`diagnostics.ts`、`engineWireSdk.ts`、`engineWireTarget.ts`、`src/principalWire.ts`、`src/wireErrorTriage.ts`、`engineSessionParam.ts`、`engineCapsCache.ts`、`liveInitToolFace.ts`、`adapter/activeRunSelfHeal.ts`、`src/sessionMemoryStatus.ts`、`src/writeProtectionCapability.ts`、`src/readFacePosture.ts` |
+| 15 | **控制面与传输** | 131 | `steerFollowIntent`(0.72.6 CC-40:steer 后续听意图三态 tail / after-decision / after-wake,按 `SteerReceipt.delivery` 判;§53)· `projectWebSearchBackendCapability` / `observedWebSearchBackend` / `noteEngineCapsForWebSearchBackend` / `forgetWebSearchBackendReading` / `webSearchBackendDoctorDetail` + `WEB_SEARCH_BACKEND_NONE`(0.72.5 CC-31:`capabilities.webSearch.backend` 四态读面 —— 键缺席 = 老引擎判不了 ≠ `none` = 引擎明说没有默认后端;与 `sqlEngineCapability` / `writeProtectionCapability` 同构;§52)· `resumeContextUnavailableFromError` / `resumeContextUnavailableContent`(0.72.1 CC-33:409 `conflict.resume_context_unavailable` 读数 `{ code, staleAfterSec?, runId? }` + 三句人话;§48)· `mcpEngineLegPresence`(0.71.0 CC-19:引擎侧 MCP 在场三值,只从面板视图求;§42)· `ControlRouter`(+ `ControlSafetyError`)· `fetchMcpPanel`(0.69.0:经 sdk `sessions.mcp` 取体 + 投视图,不裸 fetch)· `projectMcpPanel` + `mcpPanelLastLegDetail`(0.68.2 CC-03:`GET /v1/sessions/:id/mcp` 面板体防御读视图 + `lastLegMcp` 一行措辞铸点;缺席 = 键不铸、读不懂 = `lastLegMcpUnreadable`、禁与 `servers[]` 对账)· `makeEngineWireClient` + `resolveWireAuth` · `installEngineWireTarget` · `diagnoseSseIdleTear` / `isSseIdleError` · `attemptActiveRunSelfHeal` + `activeRunBusySignal` + `activeRunSelfHealRow` / `activeRunBusyHeadlessRow` · `kickEngineCapsProbe` / `engineCapTrue` / `invalidateEngineCaps(baseUrl, probe?)`(#307 S25:引擎温切后的 caps 生产失效口 —— kick 自带幂等闸,同 baseUrl 重启后不显式失效就永远读到旧引擎那一版能力位;调用方 = 壳的 respawn/restartEngine。🔴 **推荐两参形**:第二参给替代探测则「推进代际 + 注册新探测」在同一同步块内完成,失效与下一次 kick 之间那个「等待者读到未判」的窗按构造不存在;单参形保留给「只丢缓存、这一刻没有替代探测」的调用方,那种情形下读到未判是诚实结局) · `engineCapValue`(S-131,0.59.0:能力位的**四态**通用读口 `unobserved`/`not_reported`/`null`/`value` —— 既有三口把四种「读不出」全折成 fail-closed 一档,对**放行**问题是对的、对**读面/诊断**问题是错的:`null`(引擎明确说没有,正面事实)会与「老引擎不报」「还没探到」在屏上同形。`value` 位刻意不做形校验,形归各能力位自己的窄读器,详见 §23b)· `projectSqlEngineCapability` / `observedSqlEngine` / `noteEngineCapsForSqlEngine` / `forgetSqlEngineReading` / `sqlEngineDoctorDetail`(S-131,0.59.0:`Capabilities.sql`(server ≥7.60.0)的四态读面**从壳侧上收** —— 归层债,0.58.0 时它长在壳里正是因为包侧没有嵌套对象读口。🔴 **导出名与壳侧那份逐字同名 = drift-lock**;`txnMode: null` 是铸点域内的合法值不是畸形;换代失效口清成未观测而不是留旧值,详见 §23b)· `mapBrainStatusToRetry` · `waitForClaimRelease` + `CLAIM_RELEASED_STATES` / `CLAIM_HELD_STATES` · `atMostOnceFailureClass` / `readSteerDelivery` · `clearRunningChoiceOffer`(Inkglow-1085 P0b①:「Do nothing」登记的清口 —— 端的「重新打开操作菜单」入口;登记在场时 attemptActiveRunSelfHeal 不整卡重弹,not-parked 结局带 `alreadyOffered: true` 判别位,端据此降级渲一行)· `INTERACTIVE_WAY_OUT`(默认出路串单源)· `engineSessionParamFor`(design/285 批 0:`?session=` 派生的 **per-key** 形 —— `hostSessionFor(sessionKey)?.currentSessionId()` + [1501] 空串归一;零参 `engineSessionParam()` = 默认槽兼容层,取值链逐字等价)· `normalizeWirePrincipal`(A-028.10:principal 在场性 trim 原语 —— 全空白=缺席不发头,engineWireTarget 两臂/makeEngineWireClient/壳 livePrincipal 同尺)· `readSessionMemoryStatus` / `classifyMemoryStatusFailure` / `readCaptureOptOut` / `readLastCapture`(S-53 会话记忆姿态读面,0.48.0:失败分诊**码优先**——两个 404 分道 `not_found.session` / `not_found.route`,无码 404 不猜落 failed;五键逐键缺席语义两个合读器,`lastCapture` 三态的判别材料是 `committedCount` 不是本键;IO 归宿主注入 `MemoryStatusClientLike`,详见 §11) · `classifyTurnWireError` / `isWireTransportError` / `isPreStreamDrainingReject` / `isResumeAtRejection` / `drainingRetryDelayMs` / `scenarioDenyFromError` + `WIRE_NETWORK_ERROR_PATTERN`(A-028.11/.13:turn 错误分型判定半场,人话文案与渲染归端)· `resumeRetryLaterFromError`(L-102,0.57.0:resume 族**时间性拒绝**二码的判型半场 —— 这一族里唯一**带得出「等多久」**(`retryAfterSec`)的两个码。🔴 闭集**不是**「哪些码可以等」的名单:同族 `resume.row_recycling` 同样可等(窗口自清)只是没有秒数 ⇒ 本读口返回 `null` 只意味着没命中这两码,详见 §21) · `projectWriteProtectionCapability` / `observedWriteProtection` / `noteEngineCapsForWriteProtection` / `forgetWriteProtectionReading` / `writeProtectionDoctorDetail` / `projectWriteProtectionPosture` / `writeProtectionPostureDetail`(S-138,0.60.0:`Capabilities.writeProtection` (engine ≥7.63.0)的**四态**读面 + operator 面行表 —— 与上面 S-131 那一格**同构同纪律**。🔴 三位刻意不合成一个布尔;`not_reported` **不是**「这台部署没有写保护表」(座位缺席恰是缺省表在岗);逐行 name/kind 走**最小披露**只上 operator 面,详见 §24e)· `projectReadFacePosture` / `readFacePostureDetail` / `readFaceDisagreement`(S-167,0.61.0:operator 面 `diagnostics.wiring.readFace`(engine ≥7.65.0)的窄读器 —— 与上面S-138 那一格**同构同纪律**。🔴 三句「答不出来」逐字互异且没有一句等于「没有 READ 档」;`source` 按开集读;与租户面 `capabilities.readFace` 刻意不合流,只带一个纯比较函数,详见 §25)| 上行通道的**监管**半场(submit / steer / kill / 队列命令定序)+ 传输构造、caps 探测、SSE 断流分诊、**409 active-run 自愈** | `src/controlRouter.ts`、`steering.ts`、`sseIdleTriage.ts`、`retryStatus.ts`、`diagnostics.ts`、`engineWireSdk.ts`、`engineWireTarget.ts`、`src/principalWire.ts`、`src/wireErrorTriage.ts`、`engineSessionParam.ts`、`engineCapsCache.ts`、`liveInitToolFace.ts`、`adapter/activeRunSelfHeal.ts`、`src/sessionMemoryStatus.ts`、`src/writeProtectionCapability.ts`、`src/webSearchBackendCapability.ts`、`src/readFacePosture.ts` |
 | 16 | **引擎词汇表与包自检** | 91 | `RESUME_CONTEXT_UNAVAILABLE`(0.72.1 CC-33;不进两个 resume 闭集:不可等、也不是换参数)· `RESUME_REOPEN_CODES` / `RESUME_ENV_FAILED` / `RESUME_TOOL_UNAVAILABLE` / `RESUME_TOOL_CONTRACT_MISMATCH` · `resumeReopenFromError` / `resumeReopenContent`(0.71.3 CC-06:resume reopen 族三码闭集 + 读口 + 三句,§45)· `readSkillsListingTruncated`(0.70.0 CC-04:`skills.listing_truncated` 事实读器,§39)· `CONFIG_REFUSAL_CODES` / `isConfigRefusalCode` · `DECIDE_WORKFLOW_LANE_CODES`(+ 三个具名码;`/decide` workflow 车道,三条出路刻意不合并,详见 §30h)· `STOP_CONFLICT_CODES` · `isInterruptedToolEndCode` · `isRewindFamilyCode` · `CLIENT_VERBS` · `compensationSplitViolations` · `DELEGATION_CAP_CODES` / `isDelegationCapCode` / `DELEGATION_CONCURRENCY_CAP` / `DELEGATION_SESSION_CAP`(0.38.0 #318 件④:core 5.48.0 design/323 委派席位到限**两码,处置不对称禁合并** —— 并发帽=**可等**(兄弟结束即有位)/ 会话累计帽=**等也没用**(这条会话的配额用尽))· `CONFIG_DELEGATION_ENTRY_CAPS`(同批入 `CONFIG_REFUSAL_CODES` 识别表)· `delegationCapDispositionOf` / `MCP_SERVER_REVOKED`(0.39.0 载体到货消费件:core 5.50.0 补 `{ error: code, code }` 孪生拼法后两码真上 `tool_end.errorCode`,0.38.0「先立词不落消费分支」的已知局限自此解除;处置轴 `wait-for-slot` / `reuse-existing-or-await-reap` 机器可读(累计帽=retained-window 帐,行回收配额即回,处置=SendMessage 复用,**非**「换会话/永久耗尽」——0.38.0 段该句系勘误),未知 `delegation.*` 码 ⇒ `undefined`;`mcp.server_revoked` = 操作员 mid-session 吊销 server 后的工具面本地闸(被吊销的 server **名**今天不过 wire 境:detail.server 是进程内位,抬升腿只 lift code——归因渲染候 core 补 typed detail,已点名);载体门 = engine-vocab G3 腿锚 core dist 铸点)· `CAPABILITY_SELF_ORCHESTRATION_REQUIRED`(S-81,server 7.57.0:提交面的 selfOrchestration 准入拒绝码。🔴 **复用码** —— 与其它 `capability.*` 501 同体形而处置不同,消费点必须按**恰等**判、绝不放宽成前缀判;判型与「去键重发一次」归 `src/selfOrchestrationDenial.ts`,详见 §13) · `GATE_PARKED_ERROR_CODE`(0.60.0:「门把这次调用 park 了」的机读码单源 —— `frameRouter` 的连坐/中断判据与 `gateOutcome.isGateParkedToolEnd` 读同一个常量;真机黑盒直证 park 短路帧上**没有 `gate`**,这个码是那一形唯一的信号,详见 §24c)| 三端分臂共用的**去字面化** `errorCode` 词表(病根正是三端各抄一份字面);编译期 verb 闭合门;搬迁补偿登记表 | `src/engineErrorCodes.ts`(计数以 `scripts/public-export-baseline.json` 为准,别手抄;A-028.11/.13 补 `DRAINING_ERROR_CODE`/`SCENARIO_NOT_ALLOWED_ERROR_CODE`/`RESUME_AT_ERROR_CODE_PREFIX`;#318 件④ 补 `delegation.*` 族四位 + `config.delegation_entry_caps`;0.39.0 补三新码消费件三位);S-81 补 `capability.self_orchestration_required` 一位;L-102 补 `resume.*` 时间性拒绝二码 + 闭集 `RESUME_RETRY_LATER_CODES` 三位)、`src/classifierVerdictWire.ts`、`src/compensations.ts`、`src/clientSlice.ts`;**0.67.0 补锚**(这三件的导出一直计在本域,而本表此前没有它们的锚行 —— 如实补上,不是搬家):`src/gateVocabulary.ts`(`GATE_DENIED_BY_WORDS`/`gateDeniedByDetail`/`ASK_ORIGIN_WORDS`/`askOriginDetail` + 🆕 `RULE_STORE_UNREADABLE_KINDS`/`isRuleStoreUnreadableKind`/`ruleStoreUnreadableDetail`,详见 §32d)、`src/autoModeUnavailable.ts`(`AUTO_MODE_UNAVAILABLE_CAUSES` + 🆕 `CLASSIFIER_DENY_CAUSES`/`isClassifierDenyCause`/`classifierDenyCauseOf`/`classifierDenyCauseDetail`;🔴 同批**删**`classifierUnavailableOf`/`classifierUnavailableDetail`,详见 §32b)、`src/classifierStatus.ts`(`CLASSIFIER_STATUS_STATES`/`classifierStatusOf`/`classifierStatusDetail`)|
 
 🔴 **`engineErrorCodes` 的开集纪律**(该文件头注逐字):这些 `ReadonlySet` / 前缀谓词一律是**识别表**,
@@ -8404,3 +8404,61 @@ installCoreValuePorts({ resolveAutonomousLoopPrompt, loosenReasons, combinePolic
 3. peer sdk >=9.6.0 / agent-types >=0.3.0 不动;sdk 未声明该段(与 writeProtection 同况,cli [7461] 已点名 sdk)。
 
 **包侧缺口:** ① CC-39②③(memory-status `consolidation?` 切片判定 / `REQUEST_FIELD_MATRIX` memory 行;候 server 片1b);② CC-30 MCP 会话内重连消费口(候 core #857 + server S-381);③ CC-31 WebSearch 后端名读口(候 server S-382);④ CC-34 `permission_denials` 自动升级验证(候 server S-394);⑤ CC-36 托管 MCP 活性三态读口(候 core #874 + server 转发半场);⑥ `staleAfterSec` / `runId` 经 sdk 到端(候 sdk 出键);⑦ `agents.listing_truncated` detail 读器候消费场景(by-design);⑧ `ClassifierSeat.defaulted?` 候 sdk 出键(by-design);⑨ §NNz「declined 键真零命中」机读第二刀(候形式化)。
+
+## §52 🆕 0.72.5 server 7.82.1 提货(CC-31:`capabilities.webSearch.backend` 部署默认 WebSearch 后端四态读面;patch)
+
+> **patch**:型面纯 additive(+6 运行期导出,公面 962 → 968;零 wire 新键 —— 键由 server 7.82.1 铸,本包只读;peer 不动;sdk 9.6.0 的 `Capabilities` 尚未声明 `webSearch`,本包按结构读,sdk 出键当天能力位台账门自动红逼一次登记)。server 7.82.1 S-382 契约附录 B.1 `webSearch` 行 / cli [7418] ② 点名 / 本包 [7420] 认领。同批两条零码改动的读法钉:resume reopen 的 HTTP 200 成功体(cli [7488] L-377)与 `autoConsolidation` 耐久腿恒缺席(server [7487])。
+
+### 52a. 处置表
+
+| # | 面 | 本包做了什么 | 端要做什么 |
+|---|---|---|---|
+| S-1 | `GET /v1/capabilities.webSearch = { backend }`(server ≥7.82.1;契约 B.1:闭集取型自 server 的 provider 元组 ∪ `"none"`;广告的是**部署默认**,每请求 `settings.webSearch` 覆盖不回显) | **consumed**:`src/webSearchBackendCapability.ts` 四态读面 `unobserved` / `not_reported` / `none` / `present { backend }`,与 `sqlEngineCapability` / `writeProtectionCapability` 同构(per-base 读账 + probe tee + 代际闸 + 换代失效口 + doctor 措辞单源)。🔴 `backend` 按**开集**读(不手抄三词;上游加一只后端照收 `present`);`"none"` 是唯一带独立语义的词(`WEB_SEARCH_BACKEND_NONE`);`webSearch: null` / 非对象 / `backend` 非非空串 ⇒ 畸形删格(本位铸点永远铸对象,不折 `none`);对象上多余成员不过境 | ① caps probe 处与 SQL / 写保护两只 tee 并列调 `noteEngineCapsForWebSearchBackend(baseUrl, caps, { generation })`;② 引擎温切成功后调 `forgetWebSearchBackendReading(baseUrl)`;③ doctor 的 WebSearch 行加一段 `webSearchBackendDoctorDetail(observedWebSearchBackend())`(与既有「名册挂没挂」「这一端盖不盖」两段并列,**三段各渲各的不互推**);🔴 `not_reported` 不渲「没有后端」(老 server 判不了);🔴 `none` 不推成「这次任务没有搜索」(单用户车道上调用方自带 `settings.webSearch` 仍装配 —— 措辞句已把两半都说了,端别删) |
+| S-2 | resume 决断的 **HTTP 200 成功体** `{ taskId, sessionId, status, bindingEnforced, errorCode?, errorMessage?, retriable? }`(server `resume-legs` checkpoint 真重开时**不抛**,200 体带 `errorCode` + `retriable: true`;cli 1.0.118 黑盒 G-L211-3 → L-377) | **零码改动,门钉读法**:`resumeReopenFromError` 一直按结构读(`errorCode` ∈ 三码 ∧ `retriable === true`,不认 `status`),200 体**原样**可读;`run-terminal-facts-projection-test.mjs` C4b–C4d 三格钉住(200 体 ≡ 409 抛错形逐字段相同 / `{ ok, body }` 包装形 ⇒ null / `retriable` 缺席 ⇒ null)。不出第二个读口 | 决断的 resolved 分支把 **body 本身**交 `resumeReopenFromError`(不是 `{ ok, body }` 包装),命中即走 warning 档渲 `resumeReopenContent` 三句;未命中照旧按成功渲 |
+| S-3 | `wiring_manifest.autoConsolidation` 只在实时 `POST /v1/tasks/stream` 首帧对 operator 连接投出;两条耐久腿(`GET /v1/runs/:id/events` 重放)**恒缺席**(server [7487] 设计说明) | **零码改动**:§51 的「缺席 = indeterminate 不折 false」读法已覆盖这一形;本段只把「耐久腿恒缺席」写进缺席语义 | 从 `/events` 重放读 manifest 的 operator 面板:该段**结构性**不会出现,不得据此渲「未武装」;要渲武装态只能读 stream 首帧。若面板必须走耐久腿,回帖 server 开债(重放期按读者投影) |
+| S-4 | sdk 9.6.0 `Capabilities` 未声明 `webSearch` | **零动作**:按结构读;`run-engine-caps-ledger-test.mjs` 台账按 sdk 键集对表,sdk 出键当天红 ⇒ 登 `read` 行指向本文件 | 零动作 |
+
+### 52z. 逐键处置表
+
+| # | 键 / 面 | 处置 | 坐标 / 理由 |
+|---|---|---|---|
+| 1 | `capabilities.webSearch.backend` | **consumed** | `src/webSearchBackendCapability.ts` `projectWebSearchBackendCapability`;门 `run-web-search-backend-capability-test.mjs`(S0 导出名 / S1 四态 + 开集 + null 畸形 + 多余成员不过境 / S2 读账 + 代际闸 + 失效口 + fail-soft / S3 四句互不蕴含 + `none` 双义 + 消毒封长,44 格);singleton 清单 +1(`readingByBase`);typeshape `unknownExport` 344 → 346(两只 `caps: unknown` 入参,与兄弟同形) |
+| 2 | `capabilities.webSearch.*` 其余成员 | **declined** | 契约只有 `backend` 一座;端点 / 密钥 / 配额契约上不上 wire,真出现了也不过境(门 S1k) |
+| 3 | 200 决断体 `bindingEnforced` / `taskId` / `sessionId` / `status` / `errorMessage` | **declined(本读口)** | `resumeReopenFromError` 只读 `errorCode` + `retriable`;其余键各有既有读口(`bindingEnforced` 见 §NN HITL-12),本段不重述 |
+
+### 52y. 🔴 三端升级必读(固定段式,[C295])
+
+1. 换钉 `^0.72.5`:caps probe 处并列接第三只 tee `noteEngineCapsForWebSearchBackend`,温切处接 `forgetWebSearchBackendReading`,doctor WebSearch 行加 `webSearchBackendDoctorDetail(observedWebSearchBackend())` 一段;`not_reported` ≠ 没有后端、`none` ≠ 这次任务没搜索。
+2. resume 决断 200 成功体直接交 `resumeReopenFromError`(交 body 本身),零新读口;`autoConsolidation` 耐久腿恒缺席,不渲「未武装」。
+3. peer sdk >=9.6.0 / agent-types >=0.3.0 不动;server <7.82.1 上本格恒 `not_reported`。
+
+**包侧缺口:** ① CC-39②③(memory-status `consolidation?` 切片判定 / `REQUEST_FIELD_MATRIX` memory 行;候 server 片1b);② CC-30 MCP 会话内重连消费口(候 core #857 + server S-381);③ CC-34 `permission_denials` 自动升级验证(候 server S-394);④ CC-36 托管 MCP 活性三态读口(候 core #874 + server 转发半场);⑤ `staleAfterSec` / `runId` 经 sdk 到端(候 sdk 出键);⑥ `Capabilities.webSearch` 经 sdk 声明(候 sdk 出键;本包按结构读已就位);⑦ `agents.listing_truncated` detail 读器候消费场景(by-design);⑧ `ClassifierSeat.defaulted?` 候 sdk 出键(by-design);⑨ §NNz「declined 键真零命中」机读第二刀(候形式化)。
+
+## §53 🆕 0.72.6 steer 之后谁续听那条 run(CC-40:`steerFollowIntent` 三态 + `activeRunSelfHealRow` 续听声明;patch)
+
+> **patch**:型面纯 additive(+1 函数,`activeRunSelfHealRow` 第五个可选参;公面 968 → 969;零 wire 键;peer 不动)。cli L-379(P1)包侧半场;根因 = server 7.81.0 S-384 副作用([7495] ④′ 勘误:local 车道 bg/resume 腿成活审批目标后,plan_review 决断的续跑腿撞下一道门**活着等卡**不再 park,壳原先「park → 新流取卡」的路径从此不成立)。
+
+### 53a. 处置表
+
+| # | 面 | 本包做了什么 | 端要做什么 |
+|---|---|---|---|
+| S-1 | 注入件 / 用户消息撞活 run ⇒ steer ⇒ `running-steered` 之后,那条 run 的后续(含新弹的决断卡)只在它自己的 `GET /v1/runs/:id/events` 上 | **consumed**:`steerFollowIntent(outcome)` ⇒ `tail` / `after-decision` / `after-wake` / `null`,按 `delivery` 判(applied 与读不出 ⇒ tail;queued ⇒ after-decision;parked_for_wake ⇒ after-wake) | `kind: 'tail'` ⇒ **当拍**用既有续听机对 `taskId` tail 至终局 / park(Last-Event-ID 自持;缺席从 live 起);`after-decision` ⇒ 续听挂在答卡之后的 decide 路径上;`after-wake` ⇒ 不 tail、不 wake(本客户端不 wake),照旧渲 parked_for_wake 那句;`null` ⇒ 零动作 |
+| S-2 | handed-off 行文案「watch that run」 | **consumed**:`activeRunSelfHealRow(…, follow: { following: true })` 时换成「sema is following that run and will surface whatever it asks for next」;不传逐字节同旧 | **只在真挂上续听那一拍**传 `{ following: true }`(文案与行为同前提);`rowFor` 覆盖仍优先 |
+| S-3 | `held-for-decision` 档「决断后注入件送出去之后那条 run 谁听」 | **declined(不加位)**:宿主答卡后按原优先级重投,那次提交要么开新 turn(自己的流)要么再撞 409 ⇒ self-heal ⇒ `running-steered` ⇒ S-1 | 零动作:重投那次提交的流就是要听的 |
+| S-4 | server 7.83.0 [7495] ④ leader 终局 `needs_human` + `result.conflict` 渲染面 | **pending → CC-41(0.72.7)**:结构读视图 + 缺席语义 + 三端一句措辞 | 候 0.72.7;`salvaged[]` 落盘口子由 cli 定形 |
+
+### 53z. 逐键处置表
+
+| # | 键 / 面 | 处置 | 坐标 / 理由 |
+|---|---|---|---|
+| 1 | `SteerReceipt.delivery`(applied / queued / parked_for_wake / 读不出 / 未知词) | **consumed** | `steerFollowIntent`;门 `run-terminal-identity-copy-test.mjs` G3a–G3g(未知词按开集保守 tail,不判畸形) |
+| 2 | decide 200 体 `taskId` / `status`、409 体 `activeTaskId` / `activeTaskStatus`([7495] ④′ 点名的显式信号) | **consumed(既有)** | 本包 `ActiveRunBusySignal` 已读;本段不加新读口 |
+| 3 | `fromEventId` 续听起点 | **declined** | 回执不带;壳自持 Last-Event-ID |
+
+### 53y. 🔴 三端升级必读(固定段式,[C295])
+
+1. 换钉 `^0.72.6`:提交被折成 steer 后读 `steerFollowIntent(outcome)`,`tail` 当拍续听 `taskId`,`after-decision` 挂 decide 之后,`after-wake` 不动;续听真挂上那一拍再给 `activeRunSelfHealRow` 传 `{ following: true }`。
+2. 不接线的端零变化:不传第五参 ⇒ 文案逐字节同 0.72.5;`held-for-decision` 无新位。
+3. peer sdk >=9.6.0 / agent-types >=0.3.0 不动;零 wire 键。
+
+**包侧缺口:** ① CC-41 leader `needs_human` + `result.conflict` 渲染面(0.72.7);② CC-39②③(memory-status `consolidation?` 切片判定 / `REQUEST_FIELD_MATRIX` memory 行;候 server 片1b);③ CC-30 MCP 会话内重连消费口(候 core #857 + server S-381);④ CC-34 `permission_denials` 自动升级验证(候 server S-394);⑤ CC-36 托管 MCP 活性三态读口(候 core #874 + server 转发半场);⑥ `staleAfterSec` / `runId` 经 sdk 到端(候 sdk 出键);⑦ `Capabilities.webSearch` 经 sdk 声明(候 sdk 出键);⑧ `agents.listing_truncated` detail 读器候消费场景(by-design);⑨ `ClassifierSeat.defaulted?` 候 sdk 出键(by-design);⑩ §NNz「declined 键真零命中」机读第二刀(候形式化)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/client-core",
-  "version": "0.72.4",
+  "version": "0.72.6",
   "description": "Client-side session runtime shared by every sema human client (TUI / web / desktop): sema wire frames (AgentEvent) -> CC session vocabulary (SDKMessage) with dual-plane output (transcript/chrome), deterministic transcript ids, lane discipline as a type, and the notification/dedup ledgers. Every CC-skin shape is collected here so the wire itself stays neutral. Renamed from @sema-agent/wire-cc-adapter (0.1.x).",
   "license": "MIT",
   "type": "module",