@sema-agent/client-core 0.74.1 → 0.74.3

package/CHANGELOG.md

@@ -49,6 +49,46 @@
 > 挡住 ⇒ 本批把它机械化——④a0 对 `pending` 行**要求段头已是日期形**(`(未发布)` 直接红),阶段一
 > commit 漏转在发布前就红,不再靠人记。
 
+## 0.74.3(2026-09-19)
+
+> 主题:**面板子代身份归一**(CC-70;cli L-407 / test 定谳:同一后台子代在 wire 上两把身份)+ **run 记录取消现场读口与成因闭集**(CC-71;cli L-212 (a))+ **workflow 列表行 run 级 errorCode**(CC-72;core 7.23.5 #932)+ **reopen 族第二臂两件**(CC-73;cli L-56)。**patch**:型面纯 additive(+2 常量 +7 函数,公面 1052 → 1061;测试钩 50 → 51;`EngineAgentPanelEvent` 三臂各加可选键;零 wire 新键;peer 不动)。接入面 §71。
+
+### Added
+
+- **面板事件的子代身份归一(CC-70)**:`publishEngineAgentPanelEvent` 成为三条 lane 的唯一漏斗 —— `fleet-row` 登记两把钥匙(`transcriptId` 主 / `parentToolCallId` 退路),`tick` / `end` 上的 `task_progress` UUID 查得到就改写成 fleet 行 id 尾段(= 注册表 task_id = 宿主本地 agentId),原词进新键 `wireTaskId`,`taskIdOrigin:'fleet-row'`;查不到:绑卡的 tick(新提示键 `cardBound`,同步委派形)直发 `taskIdOrigin:'wire'`,未绑的 tick **缓一拍**等行帧(同 UUID 的 fleet-row 到 ⇒ 先行帧再放 tick;第二条 tick ⇒ 新的原样发旧的丢;`end` ⇒ 先 tick 后 end;满 64 条 ⇒ 最旧的原样发;别的 fleet-row / end / sweep 过了 `MAX_HELD_WIRE_TICK_BEATS`(16)拍 ⇒ 原样发;`sweep` 本身不放 —— 没行可结)。钥匙带周期身份:归一后的 `end` 自己不带 `cycleSeq` / `startedAt` 时借登记它的那条 fleet-row 的,复活后迟到的 `end{旧 UUID}` 因此带旧代际、`isStaleEngineAgentPanelEnd` 判得出;经退路键归一过的 UUID 记进主表,随后不带 `parentToolCallId` 的 `end{UUID}` 同样归一(三条皆异源对抗复审 R1 所抓)。常驻标随归一从 UUID 迁到尾段(此前 UUID 记、17 位清 ⇒ 永不清)。新读口 `resolveEnginePanelTaskId(wireTaskId, parentToolCallId?)`(带钥匙上的周期身份);`fleet-row` 事件与 `FleetAgentRowLike` +`parentToolCallId?`;tick 臂 +`parentToolCallId?` / `cardBound?`。**宿主零改**:面板按 `ev.taskId` 落表即可,同一子代不再长成两行。
+- **`src/runCancelContext.ts`(CC-71;server ≥7.87.3 `PersistedTaskResult.cancelContext` 四座,sdk 无型 ⇒ 结构读)**:`readRunCancelContext(record)` —— 缺席 ⇒ `not_reported`(**不折成「未取消」**);四座各自可缺席各自防御读(有 age 无 kind 合法;`elapsedMs` 绝不折 0;`lastBrainStatus` 原样带出);坏形 ⇒ `undefined`。`classifyRunAbortCause(record)` 成因闭集四词:`cancelled`(码 `cancelled`,带现场)/ `engine_error`(别的码,原码开集不枚举)/ `run_still_live`(记录仍非终态 —— 断连是客户端侧事实,不是 run 的成因)/ `unknown`(不猜)。常量 `RUN_CANCELLED_CODE`。
+- **`FleetWorkflowView.errorCode?`(CC-72)**:workflow 列表行的 run 级 errorCode 原词逐字过境(开集);缺席 = 无码,**不是成功也不是失败**;sdk 未声明前按结构读(空串 / 非串 ⇒ 缺席)。
+- **`lastFlagValue` 上公面(CC-80;归层)**:argv 末次旗值扫描原语(`--name v` / `--name=v`、裸 `--` 之后不扫、重复旗末次胜、缺值策略 `invalidate` / `latch-previous` 调用方选)—— 包内 limits / sandbox / scenario / headlessPermissionMode 四处早已收编,端侧仍在手写同一循环;现在从 `index` 导出,`FlagValue` / `OnMissingFlagValue` 型同出。
+- **reopen 族第二臂(CC-73)**:① `DecideReceiptView` +`errorCode?` / `retriable?`(`/decide` 200 **终局形**才有;在场逐字,`retriable` 严格布尔)+ `decideReceiptReopen(receipt)` —— 与 `resumeReopenFromError` **同一只**判官(`status === 'failed'` ∧ 码 ∈ `RESUME_REOPEN_CODES` ∧ `retriable === true`,缺一件 ⇒ null);② `suspendedReopenOf(ev)` 读 durable `suspended.reopened` 三态(`reopened{code}` / `not_reopened`(显式 null)/ `unstated`(键缺席 —— 不冒充 null));`HitlBridge.currentGateReopen()` 把它挂在挂起座上,每条 `suspended` 重读、随座清。
+
+### Fixed
+
+- **异源对抗复审两轮抓的六条(CC-70 / CC-71)**:① 经退路键归一的 tick 之后 `end{UUID}` 归不了一(行永不结、报告丢)⇒ 归一时把 UUID → 尾段记进主表;② 复活后迟到的 `end{旧 UUID}` 不带周期 ⇒ 钥匙带周期身份、`end` 借用;③ 缓着的 tick 无时限 ⇒ 节拍上限 `MAX_HELD_WIRE_TICK_BEATS`(别的 tick 不算拍);④ 钥匙表 FIFO 会把仍在飞的子代挤掉 ⇒ LRU 续命、上限 2048;⑤ 第 16 拍恰是自己的行帧(退路键)时先记拍会让它过期 ⇒ 行帧先登记先放再记拍;⑥ 终态 tick / 通知的清标只清 UUID ⇒ 两把键都清;⑦(R3)前代 UUID 的终态清掉复活行的常驻标 ⇒ 下一次 sweep 假结它 ⇒ 清标走 `clearEnginePanelTaskResidentByWire`:归一键只在终态属当代时才清(判据与 `end` 陈旧判据同一只)。`classifyRunAbortCause`:result 已终态而外层 `status` 仍在飞词 = 证据矛盾 ⇒ `unknown`(带终态词),不说「还活着」。
+- **0.74.2 补审(六只能力位读器)**:`projectDeviceExecutorManagementCapability` 外层 `deviceExecutor` 此前 undefined 判与取值各读一次 ⇒ 变化的 getter 把第一次观测到的「车道缺席」丢掉,现在只读一次;六只 doctor 的 `unobserved` 句此前说「还没收到 caps 回体」—— 坏形删格后也这么说 = 把解析失败说成没启动,改成「本进程没有可用的读数(没收到,或最后一次读不懂)」(措辞变化,消费方不接线零影响)。
+- 面板常驻标「UUID 记、17 位清」永不清(CC-70 同根):tick 臂现在把常驻标记在归一后的键下(`noteResidency(taskId, residentKey)`),通知车道按尾段清得掉。
+- `classifyRunAbortCause` 对平面 `running` / `queued` 记录:平面读器对在飞词答 `unknown{word}`,那不是「读不出」而是「还没结」⇒ 先看 `status` 再落 `unknown`。
+
+## 0.74.2(2026-09-19)
+
+> 主题:**`capabilities.deviceExecutor.management` 四态读口**(CC-69;server 7.88.0 点名本包)。**patch**:型面纯 additive(+6 函数,公面 1046 → 1052;测试钩 49 → 50;零 wire 新键;peer 不动)。
+
+### Added
+
+- **`src/deviceExecutorManagementCapability.ts`(CC-69;server ≥7.88.0,契约附录 B.1 `deviceExecutor` 行 + §14)**:「`/v1/devices/*` 的管理动词在不在」的四态读面,与 sql / writeProtection / webSearch.backend / executionLane / approvalsStreamLive 五只兄弟同构六导出 —— `projectDeviceExecutorManagementCapability` / `noteEngineCapsForDeviceExecutorManagement` / `observedDeviceExecutorManagement` / `forgetDeviceExecutorManagementReading` / `deviceExecutorManagementDoctorDetail` / `deviceManagementVerbsAvailable`(+ 测试钩)。sdk 9.7.1 对该位无型 ⇒ 按契约结构读,sdk 补型当拍对表。
+  - 🔴 读法:`management` **键缺席 ≠ false**(真字节:7.87.3 车道真开而无此键)⇒ `not_reported`(`why: 'management_absent'`);`deviceExecutor` 键整个不存在(更老 server)⇒ `not_reported`(`why: 'capability_absent'`,只有夹具、无真版本见证);`deviceExecutor: false`(键在、值为布尔 false)⇒ `lane_absent`;对象且 `management` 严格布尔 ⇒ `present`。判在场用 own-property,不用 `in` 判真值;畸形删格。
+  - 「管理动词能不能用」判据归包 `deviceManagementVerbsAvailable(reading)`:只有 present ∧ true 才 `'yes'`;present ∧ false 或 `lane_absent` ⇒ `'no'`(明确的否);其余 ⇒ `'unknown'`(端按 501 试探,不预判)。
+  - doctor 措辞单源六句;`not_reported` 两句都不暗示「没有管理面」。
+- 门:新 `scripts/run-device-executor-management-capability-test.mjs`(含 test 三形真字节夹具);变异反证八 + 六枚逐格见红。
+
+### Changed(记账)
+
+- **代际号的取值规则成文**(0.74.0 起的行为,补一句书面承诺):`fleet-row.cycleSeq` / `end.cycleSeq` / 后台通知 `seq` **只认正整数**;坏形(0 / 负数 / 小数 / 非数 / null)与缺席一律按**缺席**处理 —— 键不出,不钳、不编。去重键内部的归一(缺席归一成首周期)只服务去重,不上屏。
+
+### Fixed(六只能力位读器族扫)
+
+- **抛 getter / Proxy 的 caps 回体不再让上一台引擎的读数留在格里**:六只能力位读器(sql / writeProtection / webSearch.backend / executionLane / approvalsStreamLive / deviceExecutor.management)的 tee 此前把整段投影包在一个只求不抛的 `catch` 里,回体上一只抛出的 getter 会让投影中途退出而**格不动** —— 上一次的 `present` / `lane_absent` 继续答现在(与「投影答 undefined 就删格」的契约相反)。现在投影抛出与投影答 `undefined` 同一处置:删格 ⇒ `unobserved`;陈旧代际的抛体仍不动格;并且投影**之后再核一次代际**(投影会执行回体上不可信的 getter,它可以在中途让这一格换代)—— 换代后无论返回还是抛出,都不动新代际的格;代际只在入口**快照一次**(`opts` 是调用方的对象,回体 getter 改它也绕不过末核),读 opts / 读代际抛出一律不动格、不逃出 tee。
+- **校验与返回同一次读**(sql / writeProtection / deviceExecutor.management):此前对同一属性各读一次,变化的 getter 可以让校验读到合形、返回读到别的形,`present` 里带出非布尔 / 非串。现在读进局部量再校验再返回。
+
 ## 0.74.1(2026-09-19)
 
 > 主题:**审批卡的无决断收口**(CC-67)+ **流内帧腿的结局回交**(CC-68)+ headless 处置成文。**patch**:型面纯 additive(+1 常量,公面 1045 → 1046;`ApprovalCardDecision` +1 联合成员;`ToolApprovalFrameOutcome` / `FsApprovalOutcome` 各 +1;`AskGateWireDeps` +1 可选回调;零 wire 新键;peer 不动)。

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.74.1
+**Version:** 0.74.3
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -313,6 +313,10 @@ public-surface guard checks that last one).
 | `scripts/run-tool-disclosure-progress-projection-test.mjs` | The two wire arms sdk 9.6.0 adds — `tool_disclosure` (name-only tool census: open-set `policy`, `thresholdPercent` absent ≠ default, `deferred`/`activated` full snapshots) and `tool_progress` (one frame, two beats: Bash ticks carry an output tail with `totalLines`/`totalBytes` that come and go together; other tools carry only `elapsedSeconds`) — project to neutral internal arms plus chrome arms. Required keys missing ⇒ `malformed`; bad optional keys drop only themselves; the sub-flow three-key gate keeps child frames off the leader lane; both arms are `required: false` in the arm table with duties stated (the output tail is untrusted raw and must never be fed back to the model). |
 | `scripts/run-mcp-panel-projection-test.mjs` | The `GET /v1/sessions/:id/mcp` panel reader (`projectMcpPanel`; server >=7.77.0 adds the optional `lastLegMcp` key) and the single wording mint for its "last leg" line. Absence of `lastLegMcp` is one literal sentence that never blames the engine version (a new session, a leg outside the retention window, a leg without a manifest and an older engine all look the same on the wire); a key that is present but unreadable is a different sentence plus a `lastLegMcpUnreadable: true` mark, never folded into absence. The `mcp[]` roster goes through the same reader as the live `wiring_manifest` third section, so a replayed roster and a live one have one shape. The two faces of the panel (`servers[]` and the last-leg roster) may legitimately differ, so the view carries no agreement flag and none of the five sentences mentions `servers`. Required keys are pinned to the SDK `openapi.yaml` component bytes **0.69.0:** `fetchMcpPanel` fetches the panel through the SDK client's own `sessions.mcp` call (same transport and auth as every other read) and projects it; transport failure, an unreadable body and an empty session id all come back as `undefined`, never as a fabricated empty panel 0.71.0 adds section K: `mcpEngineLegPresence(view)` — the engine-side MCP presence tri-state read only off the panel view (`unknown` when the view could not be read, never rendered as "no MCP configured") |
 | `scripts/run-absence-fold-census-test.mjs` | A package-wide census of the "absence folded into a positive outcome" defect shape, so that fixing the six sites this release does not merely move the shape somewhere else. The defect is defined by position, not syntax: a fallback position (the unconditional tail return, the `default:` arm, the literal minted when there is nothing to pass on, the value returned from an error path) may only say `unknown` or stay absent, never a positive word. Detection walks the syntax tree of every source file, so comments, strings and multi-line spellings cannot hide or fake a hit, and covers five forms: the right arm of `??` / `||`, the else arm of a ternary, the first return of an explicit `default:`, a `catch` block or `.catch(() => …)` arrow returning a healthy value, and a function whose last statement returns a positive word after other returns. Every remaining hit must be registered with a written reason, an unregistered hit fails the gate naming the file and line, the registered count must equal the real count so a cleared site cannot leave a spare allowance behind, and the gate proves its own teeth behind a fence (a failed self-proof refuses to report any count): each form injected into an in-memory copy must add exactly one hit, two correct spellings are pinned as non-hits, and samples inside comments or strings do not count. It also pins the headline site: the fleet panel projection no longer mints an `end` with `isError: false` on absence |
+| `scripts/run-device-executor-management-capability-test.mjs` | The engine's device-management self-description (`capabilities.deviceExecutor.management`, engine ≥7.88.0), read the same four-state way as its five sibling capability readers: an absent `management` key is reported as not reported (never folded into `false`; an older engine really ships the lane object without it), an absent `deviceExecutor` key is likewise not reported, `deviceExecutor: false` is the lane being absent, presence is judged by own-property not truthiness, the value must be a strict boolean, the tee never throws and drops stale generations, and the package owns the verdict on whether the `/v1/devices` management verbs are usable (`yes` only when present and true, `no` when present-false or lane-absent, otherwise `unknown`) |
+| `scripts/run-run-cancel-context-test.mjs` | The run record's `cancelContext` side-note (engine ≥7.87.3) read structurally, and the cause of a `turn_aborted{engine_error}` classified from machine-readable evidence only: `cancelled` (code `cancelled`, with the cancel-time context when present) / `engine_error` (any other failure code, passed through verbatim) / `run_still_live` (the record is not terminal — a dropped stream is a client-side fact, not the run's cause) / `unknown` (never guessed). An absent `cancelContext` reads as *not reported*, never as "not cancelled"; `elapsedMs` is never folded to 0. |
+| `scripts/run-suspended-reopen-projection-test.mjs` | The durable `suspended` event's `reopened` key read as three distinct states — `reopened` (with the engine's code, verbatim), `not_reopened` (an explicit `null`), `unstated` (key absent or unreadable) — and carried on the HITL bridge's active gate (`currentGateReopen()`), re-read on every `suspended` and cleared with the gate. |
+| `scripts/run-panel-identity-normalization-test.mjs` | One background subagent has two ids on the wire — the fleet row id tail and the `task_progress` task id (its transcript id). Every panel event goes through one funnel that rewrites the `tick` / `end` task id onto the fleet row's id once a `fleet-row` has registered the key (`transcriptId` first, `parentToolCallId` as the fallback), carrying the original as `wireTaskId` and marking `taskIdOrigin`; an unbound tick whose row has not arrived yet waits one beat (bounded) and is released verbatim on the next tick / `end`, when the buffer is full, or after `MAX_HELD_WIRE_TICK_BEATS` other fleet-row / end / sweep events (a `sweep` itself leaves it alone: there is no row to settle yet); a normalized `end` that carries no cycle identity borrows the registering row's, so a late close of a revived task is recognized as stale; the key table is an LRU (a task that keeps ticking is never evicted by newer registrations); the residency mark migrates with the id and both keys are cleared on settle — except that a stale (previous-cycle) terminal never clears the revived row's mark — so the notification lane can clear it. |
 | `scripts/run-approval-card-retract-test.mjs` | The approval card's **decision-free retraction** and the in-stream frame leg's **outcome hand-back**: a host that must withdraw a card that no longer has a decision channel (session switch, engine switch, a tracker reporting the ask gone) answers `{ kind: 'retracted' }` and the package sends nothing on any of the three legs (in-stream frame, suspended ask, durable park), reporting `decision: 'unresolved'` with a `retracted` flag; `aborted` / `failed` / `deny` keep their meaning (a real deny is still posted), and `onToolApprovalOutcome` hands every in-stream outcome back to the host exactly once, tolerating a throwing or rejecting callback |
 | `scripts/run-panel-cycle-identity-test.mjs` | The **cycle identity** on agent-panel events and the fleet ledger's **departure read-out**: a background agent may be revived under the same id, so `fleet-row` and `end` events now carry the wire's own `cycleSeq` / `startedAt` when present (absent means the row has no notion of generations, never "generation one"), `isStaleEngineAgentPanelEnd` is the single rule for ignoring a late `end` from a previous cycle (only when both sides carry a comparable identity; absence never drops a real terminal), a changed `cycleSeq` is a new cycle for usage stickiness and buffer coalescing, the notification lane carries `cycleSeq` only when the wire really sent `seq`, and `task_remove` frames reach the host through `onTaskRemoved` with `removeReason` / `cycleSeq` verbatim, a stale previous-generation removal leaving the newer row in place |
 | `scripts/run-workflow-size-warning-test.mjs` | The **workflow size warning** verdict shared by every host footer / panel: a three-state result (`warn` / `ok` / `unknown`) read off the optional fleet view keys, where an unknown size is never reported as a normal one (absent `totalCount` / `tokens` without positive over-cap evidence is `unknown`, naming the missing keys), positive evidence on either axis wins regardless of absent keys, the per-agent denominator uses the engine's started count only when it is not below done+failed (a smaller value is a stale reading), otherwise falls back to the done+failed lower bound only when both keys are present — and a lower-bound denominator only yields an upper bound of the projection, which can prove *within cap* (`ok`, flagged) but never *over cap* (`unknown`, with the upper bound exposed) — and the prior is used only when the engine itself reports zero started agents; cap precedence env > explicit guideline > default, prototype keys never act as a guideline, the env reader is pure and does not fall through to the second name on a bad first value; caps, guideline table, env names and the three copy variants are single-sourced |

package/dist/adapt/arms.js

@@ -10,6 +10,7 @@ import { readAsyncLaunchedAgentReceipt } from '../toolResult.js';
 import { isWorkflowAgentTaskId, recordWorkflowAgentTaskId } from '../workflow.js';
 // L-215+(0.65.0;core [6908]):终局状态词的单铸谓词(三处同形一次改齐)。
 import { isTerminalStatus } from '../runTerminal.js';
+import { resolveEnginePanelTaskId } from '../engineAgentPanelStore.js';
 import { chrome, MAIN, transcript, messageIdentityOf } from './ids.js';
 import { CANCEL_MESSAGE, decisionOf, flattenWireOutput, REJECT_MESSAGE, sanitizeToolUseBlock, shortTaskLabel, TASK_TOOL_NAMES, WORKFLOW_TOOL_NAMES, } from './wireShapes.js';
 // ══ M2/M1 —— assistant(tool_use 半场 + durable 文本/思考半场)══════════════════════════════════
@@ -831,7 +832,9 @@ const taskProgressArm = function* (m, { ctx, cards, panel, inst }) {
         yield* panel.start(taskId, agentType);
     }
     // #6 常驻台账的两个写口整臂让位给 M3(module store 不许两个模块各写各的)。
-    panel.noteResidency(taskId);
+    // 0.74.3 CC-70:常驻标记在**归一后的键**下(fleet 尾段 = 通知车道清标用的那把);此前 UUID 记、17 位清 ⇒ 永不清。
+    const identity = resolveEnginePanelTaskId(taskId, explicitParent);
+    panel.noteResidency(taskId, identity.taskId);
     panel.markLive(taskId);
     yield chrome({
         kind: 'panel_task',
@@ -843,6 +846,9 @@ const taskProgressArm = function* (m, { ctx, cards, panel, inst }) {
             ...(description !== undefined ? { description } : {}),
             ...(prompt !== undefined ? { prompt } : {}),
             ...(currentAction !== undefined ? { currentAction } : {}),
+            // 0.74.3 CC-70:身份归一的两把钥匙 —— 退路键 + 发布方提示(绑卡 = 同步委派,漏斗不用等 fleet 行)。
+            ...(explicitParent !== undefined ? { parentToolCallId: explicitParent } : {}),
+            ...(panel.isLiveBound(taskId) ? { cardBound: true } : {}),
             // 🔴 这里的 `: 0` 与 `fleetAgentPanelProjection` 那句「绝不在本层 `?? 0`」**不矛盾**,
             // 因为不是同一条 lane 的同一种供给形(两层的分层实情写在 `engineAgentPanelStore.ts`
             // 的 `PANEL_TOOLUSES_LANE_POLICY` 上,两条 lane 的可选性由编译钉锁住):

package/dist/adapt/panelTasks.d.ts

@@ -59,7 +59,8 @@ export interface PanelTaskLedger {
     /** 登记「本 turn 发布过面板行」。 */
     markLive(taskId: string): void;
     /** #6 常驻台账:live-bound ⇒ 清常驻;inert/unbound ⇒ 记常驻(module store 的**唯一**写口之一)。 */
-    noteResidency(taskId: string): void;
+    /** 0.74.3 CC-70:`residentKey` = 常驻标该记在哪把键下(归一后的 fleet 尾段);缺省 = taskId。绑卡判定仍按 tick 的 taskId。 */
+    noteResidency(taskId: string, residentKey?: string): void;
     /** SubagentStart(类型恒记,fire 一生一次)。 */
     start(taskId: string, agentType: string): Generator<AdapterOutput>;
     /** 关卡 settle(cardId)或 turn 末/abort 防御 sweep(cardId===null)。 */

package/dist/adapt/panelTasks.js

@@ -1,4 +1,4 @@
-import { clearEnginePanelTaskResident, markEnginePanelTaskResident } from '../engineAgentPanelStore.js';
+import { clearEnginePanelTaskResident, clearEnginePanelTaskResidentByWire, markEnginePanelTaskResident } from '../engineAgentPanelStore.js';
 import { chrome, MAIN } from './ids.js';
 import { SUBAGENT_TOOL_NAMES } from './wireShapes.js';
 export function createPanelTaskLedger(ctx, cards, inst) {
@@ -16,6 +16,8 @@ export function createPanelTaskLedger(ctx, cards, inst) {
      * 与 unbound 行是 **session 常驻**:终态只认 task_notification / bg_notification。
      */
     const liveBoundPanelTasks = new Set();
+    /** 0.74.3 CC-70(异源复审 R2 [medium] / R3 [high]):常驻标可能记在归一键(fleet 尾段)下 —— 两把键都清,但前代终态不清当代的尾段键(判据在 store,单源)。 */
+    const clearResidencyBothKeys = (taskId) => clearEnginePanelTaskResidentByWire(taskId);
     /** taskId → 子代类型(Stop hook 查它;cli 同为 turn 局部)。 */
     const subagentTypeById = new Map();
     const laneOf = (taskId) => {
@@ -98,11 +100,11 @@ export function createPanelTaskLedger(ctx, cards, inst) {
         },
         // #6 session 常驻台账:live-bound(卡本 turn 开着)= 本 turn 生命周期,turn 末可 sweep;
         // inert/unbound(跨 turn bg 子代形)= 常驻,两处 sweep 都放行,终态只认通知帧。
-        noteResidency: (taskId) => {
+        noteResidency: (taskId, residentKey = taskId) => {
             if (liveBoundPanelTasks.has(taskId))
-                clearEnginePanelTaskResident(taskId);
+                clearEnginePanelTaskResident(residentKey);
             else
-                markEnginePanelTaskResident(taskId);
+                markEnginePanelTaskResident(residentKey);
         },
         /** SubagentStart(cli fireSubagentStartHook 的臂化):类型恒记,fire 一生一次。 */
         *start(taskId, agentType) {
@@ -173,7 +175,7 @@ export function createPanelTaskLedger(ctx, cards, inst) {
         *settleFromNotification(taskId, isError) {
             // #6 通知-settle 边(推送半场):session 常驻的 bg 子代行不再被 turn sweep 假结,
             // 真终态在此落行(failed/killed ⇒ isError 真归因)。
-            clearEnginePanelTaskResident(taskId);
+            clearResidencyBothKeys(taskId);
             if (endedPanelTasks.has(taskId))
                 return;
             endedPanelTasks.add(taskId);
@@ -209,7 +211,7 @@ export function createPanelTaskLedger(ctx, cards, inst) {
             if (endedPanelTasks.has(taskId))
                 return;
             endedPanelTasks.add(taskId);
-            clearEnginePanelTaskResident(taskId);
+            clearResidencyBothKeys(taskId);
             const lane = laneOf(taskId);
             const card = taskCardBinding.get(taskId);
             if (card !== undefined) {

package/dist/approvalsStreamLiveCapability.js

@@ -13,7 +13,7 @@
  *  ③ 「要不要对账」的判据归包:{@link livePendingNeedsReconcile} —— 只有 present 且 true 才 false;其余一律 true(少查一次 = 一只等人的 ask 迟迟不出现)。
  */
 import { engineWireTarget } from './engineWireTarget.js';
-import { engineCapsGeneration } from './engineCapsCache.js';
+import { snapshotCapsGeneration, capsGenerationStillCurrent } from './engineCapsGenerationGuard.js';
 /** caps 回体 → 本格读数;畸形一律 `undefined`(= 这一格不写 ⇒ 读口答 `unobserved`)。 */
 export function projectApprovalsStreamLiveCapability(caps) {
     if (caps === null || typeof caps !== 'object')
@@ -30,21 +30,32 @@ export function projectApprovalsStreamLiveCapability(caps) {
 const readingByBase = new Map();
 /** 宿主 caps probe 的读面 tee 落点(与四只兄弟并列)。绝不 throw;畸形 ⇒ 删格;`opts.generation` 关掉旧探测覆盖新读数的竞态。 */
 export function noteEngineCapsForApprovalsStreamLive(baseUrl, caps, opts) {
+    if (typeof baseUrl !== 'string' || baseUrl === '')
+        return;
+    // 🔴 代际只在入口**快照一次**(异源对抗复审 R3):opts 是调用方的对象,回体上的 getter 能在投影中途改它;首末两次核对都用这份快照,
+    //    读 opts / 读代际抛出 ⇒ 不动格(与陈旧代际同一处置)。
+    const gen = snapshotCapsGeneration(opts);
+    if (gen === null)
+        return; // 调用方 opts 的 getter 抛出 = 供给坏了 ⇒ 不动格
+    if (!capsGenerationStillCurrent(baseUrl, gen))
+        return;
+    let reading;
     try {
-        if (typeof baseUrl !== 'string' || baseUrl === '')
-            return;
-        if (opts?.generation !== undefined && opts.generation !== engineCapsGeneration(baseUrl))
-            return;
-        const reading = projectApprovalsStreamLiveCapability(caps);
-        if (reading === undefined) {
-            readingByBase.delete(baseUrl);
-            return;
-        }
-        readingByBase.set(baseUrl, reading);
+        reading = projectApprovalsStreamLiveCapability(caps);
     }
     catch {
-        /* fail-soft:本 tee 任何分支都不许打断 caps 探测链 */
+        // 🔴 0.74.2 同形存量(CC-69 复审 R1 族扫):抛 getter / Proxy 的回体 = 畸形,与「投影答 undefined」同一处置 —— 删格,不许留着上一台的读数。
+        reading = undefined;
+    }
+    // 🔴 投影之后**再核一次代际**(异源对抗复审 R2):投影会执行回体上不可信的 getter,它可以在中途让这一格换代
+    //    (invalidate + 新代际的 tee 已写入);此时无论投影返回还是抛出,都不许动新代际的格。
+    if (!capsGenerationStillCurrent(baseUrl, gen))
+        return;
+    if (reading === undefined) {
+        readingByBase.delete(baseUrl);
+        return;
     }
+    readingByBase.set(baseUrl, reading);
 }
 /** 本进程观测到的读数;这一格空缺 ⇒ `{kind:'unobserved'}`。 */
 export function observedApprovalsStreamLive(baseUrl = engineWireTarget()?.baseUrl) {
@@ -63,7 +74,7 @@ export function livePendingNeedsReconcile(reading) {
 export function approvalsStreamLiveDoctorDetail(reading) {
     switch (reading.kind) {
         case 'unobserved':
-            return 'live approval push not observed — the engine reports it on /v1/capabilities; this process has not received a capabilities response yet, so suspended asks are pulled by the reconcile cadence';
+            return 'live approval push not observed — the engine reports it on /v1/capabilities; this process has no usable capabilities reading cached for it (none received, or the last one was unreadable), so suspended asks are pulled by the reconcile cadence';
         case 'not_reported':
             return 'live approval push not reported by this engine — only newer engines advertise it; this does not say whether it pushes, so suspended asks are pulled by the reconcile cadence';
         case 'present':

package/dist/decideReceipt.d.ts

@@ -32,6 +32,7 @@
  *   消费端渲卡时:**在场**才说「执行时被放行/被否」,缺席一个字都不说。
  */
 import { type GateOutcomeView } from './gateOutcome.js';
+import { type ResumeReopenDetail } from './resumeRefusalCopy.js';
 /** 一次 `/decide` 200 的读数。**每一位都可能缺席**(四种形没有共同保证的键)。 */
 export interface DecideReceiptView {
     /** 回体上的 `status`(开集透传;受理形与 parked 回执上是 `"resuming"`,回放形上**没有**这一位)。 */
@@ -60,6 +61,13 @@ export interface DecideReceiptView {
      * 🔴 **缺席 = 未知,禁读成 allowed**(见模块顶注的两处上游逐字)。
      */
     executionOutcome?: GateOutcomeView;
+    /**
+     * 0.74.3 CC-73:**终局形**才有的两位(契约:`verify:true` / 无 run store 的同步长调用在 200 体上回
+     * `{ status:"failed", errorCode, retriable:true }`;受理形刻意不带)。在场逐字,缺席不落键;`retriable` 严格布尔,
+     * `false` 是 server 说的照带。判「这是不是 reopen 类失败」走 {@link decideReceiptReopen},别在端上凭码猜。
+     */
+    errorCode?: string;
+    retriable?: boolean;
 }
 /**
  * `/decide` 的 200 体 → {@link DecideReceiptView};不是一只对象 / 一位都读不出 ⇒ `undefined`,
@@ -70,6 +78,13 @@ export interface DecideReceiptView {
  * 🔴 **不补默认、不折缺席**:读不出 `status` 不等于终局,读不出 `executionOutcome` 不等于 allowed。
  */
 export declare function readDecideReceipt(result: unknown): DecideReceiptView | undefined;
+/**
+ * 0.74.3 CC-73(cli L-56 ①):`/decide` 200 **终局形**是不是 reopen 类失败 —— 三件合取,与 {@link resumeReopenFromError}
+ * **同一只**判官(码 ∈ `RESUME_REOPEN_CODES` ∧ `retriable === true`),外加终局形自己的 `status === 'failed'`。
+ * 任一件缺 ⇒ `null`:受理形带同码不算(它不是终局)、`retriable` 缺席 / false 不算(凭码不说「卡仍 pending」)。
+ * 读数在场 ⇒ 卡仍 pending、决定没被消费、可再决;文案走 `resumeReopenContent(detail)`。
+ */
+export declare function decideReceiptReopen(receipt: DecideReceiptView | undefined): ResumeReopenDetail | null;
 /**
  * 🔴 **这次 decide 的 200 有没有把门解决掉** —— 唯一的诚实答案是「**说不出来**」。
  *

package/dist/decideReceipt.js

@@ -32,6 +32,7 @@
  *   消费端渲卡时:**在场**才说「执行时被放行/被否」,缺席一个字都不说。
  */
 import { gateOutcomeOf } from './gateOutcome.js';
+import { resumeReopenFromError } from './resumeRefusalCopy.js';
 import { DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, } from './engineErrorCodes.js';
 /** 受理形/parked 回执上那个**唯一**表示「受理了、还没做完」的状态词(sdk README §9.0.0 逐字)。 */
 const STATUS_RESUMING = 'resuming';
@@ -63,11 +64,15 @@ export function readDecideReceipt(result) {
     const executionOutcome = Object.hasOwn(r, 'executionOutcome')
         ? gateOutcomeOf({ gate: r.executionOutcome })
         : undefined;
+    const errorCode = Object.hasOwn(r, 'errorCode') ? str(r.errorCode) : undefined;
+    const retriable = Object.hasOwn(r, 'retriable') && typeof r.retriable === 'boolean' ? r.retriable : undefined;
     if (status === undefined &&
         taskId === undefined &&
         sessionId === undefined &&
         idempotent === undefined &&
-        executionOutcome === undefined) {
+        executionOutcome === undefined &&
+        errorCode === undefined &&
+        retriable === undefined) {
         return undefined;
     }
     return {
@@ -77,8 +82,23 @@ export function readDecideReceipt(result) {
         ...(idempotent !== undefined ? { idempotent } : {}),
         ...(handoffTaskId !== undefined ? { handoffTaskId } : {}),
         ...(executionOutcome !== undefined ? { executionOutcome } : {}),
+        ...(errorCode !== undefined ? { errorCode } : {}),
+        ...(retriable !== undefined ? { retriable } : {}),
     };
 }
+/** 200 终局形上「这是不是 reopen 类失败」的判据词(契约:reopen 类失败仍 `suspended` 且锁在手,200 体 `status:"failed"`)。 */
+const STATUS_FAILED = 'failed';
+/**
+ * 0.74.3 CC-73(cli L-56 ①):`/decide` 200 **终局形**是不是 reopen 类失败 —— 三件合取,与 {@link resumeReopenFromError}
+ * **同一只**判官(码 ∈ `RESUME_REOPEN_CODES` ∧ `retriable === true`),外加终局形自己的 `status === 'failed'`。
+ * 任一件缺 ⇒ `null`:受理形带同码不算(它不是终局)、`retriable` 缺席 / false 不算(凭码不说「卡仍 pending」)。
+ * 读数在场 ⇒ 卡仍 pending、决定没被消费、可再决;文案走 `resumeReopenContent(detail)`。
+ */
+export function decideReceiptReopen(receipt) {
+    if (receipt === undefined || receipt.status !== STATUS_FAILED)
+        return null;
+    return resumeReopenFromError(receipt);
+}
 /**
  * 🔴 **这次 decide 的 200 有没有把门解决掉** —— 唯一的诚实答案是「**说不出来**」。
  *

package/dist/deviceExecutorManagementCapability.d.ts

@@ -0,0 +1,53 @@
+/**
+ * deviceExecutorManagementCapability — `GET /v1/capabilities.deviceExecutor.management`(server ≥7.88.0;契约附录 B.1
+ * `deviceExecutor` 行 + §14)的三端共用读面(0.74.2;与 sql / writeProtection / webSearch.backend / executionLane /
+ * approvalsStreamLive 五只兄弟同一套四态词汇)。sdk 对该位无型(9.7.1)⇒ 按契约结构读,sdk 补型当拍对表。
+ *
+ * ── 这一位答的是哪一个问题 ────────────────────────────────────────────────────────────────
+ * 「`/v1/devices/*` 的管理动词在这台 server 上在不在」(present-iff:与该族 501 判据逐字同源)。它挂在 `deviceExecutor`
+ * 对象里:`deviceExecutor === false` = 本部署**没有 device 车道**(管理面无从谈起,六动词一律 501 `capability.device_lane_required`);
+ * 对象在场但 `management` 键缺席 = 7.88.0 之前的 server,**判不出**,只能按 501 试探。
+ *
+ * ── 🔴 读法 ─────────────────────────────────────────────────────────────────────────────────
+ *  ① `management` **键缺席 ≠ false**(真字节:7.87.3 车道真开而无此键)⇒ `not_reported`;`deviceExecutor` 键整个不存在
+ *     (更老 server)同样 `not_reported`(判别子 `why` 分开记,后者只有夹具、无真版本见证)。
+ *  ② `deviceExecutor: false` 是**键在、值为布尔 false**(不是键被省掉)⇒ `lane_absent`;判在场用 `hasOwn`,不用 `in` 判真值。
+ *  ③ `management` 严格布尔;`null` / 串 / 数 / 数组 / 对象 ⇒ 畸形(删格 ⇒ `unobserved`);`deviceExecutor` 非 false 非对象同畸形。
+ *  ④ 「管理动词能不能用」的判据归包:{@link deviceManagementVerbsAvailable} —— 只有 present ∧ true 才 `'yes'`;
+ *     present ∧ false 与 `lane_absent` ⇒ `'no'`(明确的否);其余 ⇒ `'unknown'`(别当 no,也别当 yes)。
+ */
+/** 四态读数。`unobserved` 由读口在这一格空缺时铸,不由投影铸。 */
+export type DeviceExecutorManagementReading = {
+    kind: 'unobserved';
+}
+/** `why`:`capability_absent` = `deviceExecutor` 键整个不存在(更老 server);`management_absent` = 车道对象在场、位缺席(7.88.0 之前)。 */
+ | {
+    kind: 'not_reported';
+    why: 'capability_absent' | 'management_absent';
+}
+/** `deviceExecutor === false`:本部署没有 device 车道。 */
+ | {
+    kind: 'lane_absent';
+} | {
+    kind: 'present';
+    management: boolean;
+};
+/** caps 回体 → 本格读数;畸形一律 `undefined`(= 这一格不写 ⇒ 读口答 `unobserved`)。 */
+export declare function projectDeviceExecutorManagementCapability(caps: unknown): DeviceExecutorManagementReading | undefined;
+/** 宿主 caps probe 的读面 tee 落点(与五只兄弟并列)。绝不 throw;畸形 ⇒ 删格;`opts.generation` 关掉旧探测覆盖新读数的竞态。 */
+export declare function noteEngineCapsForDeviceExecutorManagement(baseUrl: string, caps: unknown, opts?: {
+    generation?: number;
+}): void;
+/** 本进程观测到的读数;这一格空缺 ⇒ `{kind:'unobserved'}`。 */
+export declare function observedDeviceExecutorManagement(baseUrl?: string | undefined): DeviceExecutorManagementReading;
+/**
+ * 「`/v1/devices/*` 管理动词能不能用」的判据单源(三态):只有引擎明说在场(present ∧ true)才 `'yes'`;
+ * 明说不在(present ∧ false)或没有 device 车道 ⇒ `'no'`;老 server / 从没观测 ⇒ `'unknown'`(端按 501 试探,不预判)。
+ */
+export declare function deviceManagementVerbsAvailable(reading: DeviceExecutorManagementReading): 'yes' | 'no' | 'unknown';
+/** doctor 那一行的 detail 串,唯一措辞真源。🔴 `not_reported` 句不许暗示「没有管理面」。 */
+export declare function deviceExecutorManagementDoctorDetail(reading: DeviceExecutorManagementReading): string;
+/** 换代失效口(引擎温切成功后调):清成未观测。空串 ⇒ no-op;绝不 throw。 */
+export declare function forgetDeviceExecutorManagementReading(baseUrl: string | undefined): void;
+/** 测试钩子。 */
+export declare function __resetDeviceExecutorManagementReadingsForTests(): void;

package/dist/deviceExecutorManagementCapability.js

@@ -0,0 +1,121 @@
+/**
+ * deviceExecutorManagementCapability — `GET /v1/capabilities.deviceExecutor.management`(server ≥7.88.0;契约附录 B.1
+ * `deviceExecutor` 行 + §14)的三端共用读面(0.74.2;与 sql / writeProtection / webSearch.backend / executionLane /
+ * approvalsStreamLive 五只兄弟同一套四态词汇)。sdk 对该位无型(9.7.1)⇒ 按契约结构读,sdk 补型当拍对表。
+ *
+ * ── 这一位答的是哪一个问题 ────────────────────────────────────────────────────────────────
+ * 「`/v1/devices/*` 的管理动词在这台 server 上在不在」(present-iff:与该族 501 判据逐字同源)。它挂在 `deviceExecutor`
+ * 对象里:`deviceExecutor === false` = 本部署**没有 device 车道**(管理面无从谈起,六动词一律 501 `capability.device_lane_required`);
+ * 对象在场但 `management` 键缺席 = 7.88.0 之前的 server,**判不出**,只能按 501 试探。
+ *
+ * ── 🔴 读法 ─────────────────────────────────────────────────────────────────────────────────
+ *  ① `management` **键缺席 ≠ false**(真字节:7.87.3 车道真开而无此键)⇒ `not_reported`;`deviceExecutor` 键整个不存在
+ *     (更老 server)同样 `not_reported`(判别子 `why` 分开记,后者只有夹具、无真版本见证)。
+ *  ② `deviceExecutor: false` 是**键在、值为布尔 false**(不是键被省掉)⇒ `lane_absent`;判在场用 `hasOwn`,不用 `in` 判真值。
+ *  ③ `management` 严格布尔;`null` / 串 / 数 / 数组 / 对象 ⇒ 畸形(删格 ⇒ `unobserved`);`deviceExecutor` 非 false 非对象同畸形。
+ *  ④ 「管理动词能不能用」的判据归包:{@link deviceManagementVerbsAvailable} —— 只有 present ∧ true 才 `'yes'`;
+ *     present ∧ false 与 `lane_absent` ⇒ `'no'`(明确的否);其余 ⇒ `'unknown'`(别当 no,也别当 yes)。
+ */
+import { engineWireTarget } from './engineWireTarget.js';
+import { snapshotCapsGeneration, capsGenerationStillCurrent } from './engineCapsGenerationGuard.js';
+/** caps 回体 → 本格读数;畸形一律 `undefined`(= 这一格不写 ⇒ 读口答 `unobserved`)。 */
+export function projectDeviceExecutorManagementCapability(caps) {
+    if (caps === null || typeof caps !== 'object')
+        return undefined;
+    const c = caps;
+    if (!Object.hasOwn(c, 'deviceExecutor'))
+        return { kind: 'not_reported', why: 'capability_absent' };
+    // 🔴 外层也只读一次(0.74.2 补审 [medium]):hasOwn 之后 `deviceExecutor` 读进局部量,undefined / false / 对象三判都对同一次读;
+    //    此前 undefined 判与取值各读一次,变化的 getter 会把第一次观测到的「车道缺席」丢掉。
+    const d = c.deviceExecutor;
+    if (d === undefined)
+        return { kind: 'not_reported', why: 'capability_absent' };
+    if (d === false)
+        return { kind: 'lane_absent' };
+    if (d === null || typeof d !== 'object' || Array.isArray(d))
+        return undefined;
+    const o = d;
+    if (!Object.hasOwn(o, 'management'))
+        return { kind: 'not_reported', why: 'management_absent' };
+    // 🔴 只读一次(异源对抗复审 R1):校验与返回若各读一次,变化的 getter 会让校验读到布尔、返回读到串。
+    const mgmt = o.management;
+    if (mgmt === undefined)
+        return { kind: 'not_reported', why: 'management_absent' };
+    if (typeof mgmt !== 'boolean')
+        return undefined;
+    return { kind: 'present', management: mgmt };
+}
+const readingByBase = new Map();
+/** 宿主 caps probe 的读面 tee 落点(与五只兄弟并列)。绝不 throw;畸形 ⇒ 删格;`opts.generation` 关掉旧探测覆盖新读数的竞态。 */
+export function noteEngineCapsForDeviceExecutorManagement(baseUrl, caps, opts) {
+    if (typeof baseUrl !== 'string' || baseUrl === '')
+        return;
+    // 🔴 代际只在入口**快照一次**(异源对抗复审 R3):opts 是调用方的对象,回体上的 getter 能在投影中途改它;首末两次核对都用这份快照,
+    //    读 opts / 读代际抛出 ⇒ 不动格(与陈旧代际同一处置)。
+    const gen = snapshotCapsGeneration(opts);
+    if (gen === null)
+        return; // 调用方 opts 的 getter 抛出 = 供给坏了 ⇒ 不动格
+    if (!capsGenerationStillCurrent(baseUrl, gen))
+        return;
+    let reading;
+    try {
+        reading = projectDeviceExecutorManagementCapability(caps);
+    }
+    catch {
+        // 🔴 抛 getter / Proxy 的回体 = 畸形(异源对抗复审 R1):与「投影答 undefined」同一处置 —— 删格,不许留着上一台的 yes / no。
+        reading = undefined;
+    }
+    // 🔴 投影之后**再核一次代际**(异源对抗复审 R2):投影会执行回体上不可信的 getter,它可以在中途让这一格换代
+    //    (invalidate + 新代际的 tee 已写入);此时无论投影返回还是抛出,都不许动新代际的格。
+    if (!capsGenerationStillCurrent(baseUrl, gen))
+        return;
+    if (reading === undefined) {
+        readingByBase.delete(baseUrl);
+        return;
+    }
+    readingByBase.set(baseUrl, reading);
+}
+/** 本进程观测到的读数;这一格空缺 ⇒ `{kind:'unobserved'}`。 */
+export function observedDeviceExecutorManagement(baseUrl = engineWireTarget()?.baseUrl) {
+    if (typeof baseUrl !== 'string' || baseUrl === '')
+        return { kind: 'unobserved' };
+    return readingByBase.get(baseUrl) ?? { kind: 'unobserved' };
+}
+/**
+ * 「`/v1/devices/*` 管理动词能不能用」的判据单源(三态):只有引擎明说在场(present ∧ true)才 `'yes'`;
+ * 明说不在(present ∧ false)或没有 device 车道 ⇒ `'no'`;老 server / 从没观测 ⇒ `'unknown'`(端按 501 试探,不预判)。
+ */
+export function deviceManagementVerbsAvailable(reading) {
+    if (reading.kind === 'present')
+        return reading.management ? 'yes' : 'no';
+    if (reading.kind === 'lane_absent')
+        return 'no';
+    return 'unknown';
+}
+/** doctor 那一行的 detail 串,唯一措辞真源。🔴 `not_reported` 句不许暗示「没有管理面」。 */
+export function deviceExecutorManagementDoctorDetail(reading) {
+    switch (reading.kind) {
+        case 'unobserved':
+            return 'device management face not observed — the engine reports it on /v1/capabilities (deviceExecutor.management); this process has no usable capabilities reading cached for it (none received, or the last one was unreadable)';
+        case 'not_reported':
+            return reading.why === 'management_absent'
+                ? 'device management face not reported by this engine — the device lane is advertised but only newer engines say whether the /v1/devices management verbs exist; this does not say whether they exist, probe them directly'
+                : 'device executor capability not reported by this engine — only newer engines advertise the device lane at all; this does not say whether it exists';
+        case 'lane_absent':
+            return 'no device lane on this deployment — the /v1/devices management verbs are unavailable (capability.device_lane_required)';
+        case 'present':
+            return reading.management
+                ? 'device management face on — the /v1/devices management verbs are available on this engine'
+                : 'device lane on but the /v1/devices management verbs are off on this deployment';
+    }
+}
+/** 换代失效口(引擎温切成功后调):清成未观测。空串 ⇒ no-op;绝不 throw。 */
+export function forgetDeviceExecutorManagementReading(baseUrl) {
+    if (typeof baseUrl !== 'string' || baseUrl === '')
+        return;
+    readingByBase.delete(baseUrl);
+}
+/** 测试钩子。 */
+export function __resetDeviceExecutorManagementReadingsForTests() {
+    readingByBase.clear();
+}

package/dist/engineAgentPanelStore.d.ts

@@ -37,6 +37,27 @@ export type EngineAgentPanelEvent = {
     currentAction?: string;
     toolUses: number;
     totalTokens: number;
+    /**
+     * 0.74.3 CC-70:tick 上带的委派卡 id(wire `task_progress.parentToolCallId`,在场才带)—— 身份归一的**退路键**
+     * (`transcriptId` 查不到时按它反查 fleet 尾段)。
+     */
+    parentToolCallId?: string;
+    /**
+     * 0.74.3 CC-70(**发布方提示键**,消费端忽略):`true` = 这条 tick 绑在本 turn 一张仍开着的委派卡上(同步委派形)。
+     * 身份归一的漏斗据此决定「查不到 fleet 尾段时直发还是缓一拍」:绑卡的子代不会有 fleet 行要等。
+     */
+    cardBound?: true;
+    /**
+     * 0.74.3 CC-70:**归一后**才有 —— 这条事件在 wire 上原来的 `taskId`(引擎 UUIDv7 = transcriptId);
+     * `taskId` 已改写成 fleet 行 id 尾段。在场 = 改写过;缺席 = 原样。
+     */
+    wireTaskId?: string;
+    /**
+     * 0.74.3 CC-70:这条 tick 的 `taskId` 是哪一把身份 —— `'fleet-row'` = 已归一到 fleet 尾段(与 fleet-row / 通知 end /
+     * 壳本地 agentId 同键);`'wire'` = 反查不到,原样发(同步委派子代 / 老 server 行帧无 transcriptId / fleet 行还没到)。
+     * tick 恒带(它只有一个铸点 = task_progress);`end` 只在归一时带。
+     */
+    taskIdOrigin?: 'fleet-row' | 'wire';
 } | {
     /**
      * 行帧 lane 投影(2026-07-26 「后台 Agent 子代不进 Background 面板」案)。
@@ -100,6 +121,11 @@ export type EngineAgentPanelEvent = {
      * 🔴 缺席 = 这一行**没有代际概念**(同步委派子代 / workflow agent / 顶层 run / 老引擎),**不是第一代**。
      */
     cycleSeq?: number;
+    /**
+     * 0.74.3 CC-70:行帧上的委派卡 id(sdk `FleetTaskRow.parentToolCallId`,在场才带)—— 与 tick 的同名键是同一把钥匙,
+     * 身份归一的退路(`transcriptId` 缺席时凭它把 task_progress 的 UUID 反查到本行)。
+     */
+    parentToolCallId?: string;
 } | {
     kind: 'end';
     taskId: string;
@@ -116,6 +142,10 @@ export type EngineAgentPanelEvent = {
      *  explicit close arm carries it; the defensive sweeps settle without one). The consumer persists it
      *  on the row (task.result) + appends it to a live-viewed transcript (拍1 查看态 seed). */
     report?: string;
+    /** 0.74.3 CC-70:同 tick 臂 —— 归一后才有(流内 close 臂 / 终态 tick 的 `end` 带的是 UUID,改写成 fleet 尾段时记原词)。 */
+    wireTaskId?: string;
+    /** 0.74.3 CC-70:只在归一时带 `'fleet-row'`;通知车道 / fleet 投影铸的 `end` 本来就是 fleet 尾段,不带。 */
+    taskIdOrigin?: 'fleet-row';
 } | {
     /** Exception-path safety net (published by seamQuery after every turn, throw or return):
      *  the consumer settles ALL rows it owns that are still running. Idempotent. */
@@ -146,6 +176,30 @@ export interface EngineAgentPanelCycleIdentity {
  * 陈旧的 `end`:忽略(不 settle、不写 report、不摘所有权)。
  */
 export declare function isStaleEngineAgentPanelEnd(end: EngineAgentPanelCycleIdentity | null | undefined, current: EngineAgentPanelCycleIdentity | null | undefined): boolean;
+/** 缓一拍的节拍上限:别的 fleet-row / end / sweep 每过一条算一拍(别的 tick 不算)。 */
+export declare const MAX_HELD_WIRE_TICK_BEATS = 16;
+/** 身份归一的读数:`taskId` = 该用的键;`origin` = 它是哪一把。 */
+export interface EnginePanelTaskIdentity {
+    readonly taskId: string;
+    readonly origin: 'fleet-row' | 'wire';
+    /** 钥匙上记的周期身份(登记它的那条 fleet-row 带的);`origin:'wire'` 时恒缺席。 */
+    readonly cycleSeq?: number;
+    readonly startedAt?: number;
+}
+/**
+ * 0.74.3 CC-70:把 wire 上的子代 id(task_progress 的 UUID)反查成 fleet 行 id 尾段;`transcriptId` 表优先,退 `parentToolCallId` 表;
+ * 都查不到 ⇒ 原样(`origin:'wire'`)。fleet 尾段本身传进来也原样(它就是目标键)。
+ */
+export declare function resolveEnginePanelTaskId(wireTaskId: string, parentToolCallId?: string): EnginePanelTaskIdentity;
+/**
+ * 0.74.3 CC-70(异源复审 R3 [high]):按 wire 上的子代 id 清常驻标 —— 原键照清;归一到 fleet 尾段的那把键**只在这条终态属当代时**才清:
+ * 复活后迟到的前代终态(旧 UUID 的流内 close / 终态 tick)归一后带旧代际,清了尾段键 = 撤掉复活行的 sweep 保护 ⇒ 下一次 sweep 假结它。
+ * 判据与 `end` 的陈旧判据同一只(`isStaleEngineAgentPanelEnd`,拿钥匙上的周期对最近一条行帧的周期);判不出 ⇒ 照清(不因缺席留下永久常驻)。
+ */
+export declare function clearEnginePanelTaskResidentByWire(wireTaskId: string): void;
+/** 测试钩:清两张钥匙表、缓一拍与周期水位。 */
+export declare function __resetEngineAgentPanelIdentityForTests(): void;
+/** 宿主的唯一发布口(三条 lane 都经这里):先归一身份,再进主通道(订阅者 / 缓冲)。 */
 export declare function publishEngineAgentPanelEvent(ev: EngineAgentPanelEvent): void;
 /** Single consumer (the panel hook). Replays any buffered events, returns an unsubscribe. */
 export declare function subscribeEngineAgentPanel(fn: Listener): () => void;