@sema-agent/server 5.13.0 → 6.0.0

package/USAGE.md

@@ -164,6 +164,11 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
 - `/health` 身份字段承诺:`pid`(= 引擎进程)与 `dataRoot`(= 生效数据根,解析恒回退 `~/.ai-agent`,
   与 DB_BACKEND 无关)**恒在**——宿主用它们验证「这个端口上的 /health 是不是我起的那个引擎」。
   钉:`test/health-identity-contract.test.ts`。
+- `/health` 活体 store 探测(5.14.0,SQL 后端专属 additive):后台探针(`STORE_PROBE_INTERVAL_MS`,
+  默认 15000;0=关;负/非数启动响亮拒)缓存一份 DB 真往返结果,`storeProbe:{live,ageMs,error?}` 在
+  探针接线时恒在,顶层告警键 `storeLive:false` 只在死时出现。**status 保持 "ok"**(liveness≠readiness
+  ——DB 死不是进程死,摘流语义留给读键的编排器/LB)。local/memory 部署形状不变。
+  钉:`test/health-store-live.test.ts` / `test/store-live-probe.test.ts`。
 - 数据驻留提示:`DB_BACKEND=local` 下显式 `SESSION_BACKEND=memory` 会被收编为 **durable(local)**
   (1.292+ 裸 boot 默认 durable;/health 的 `sessionBackend` 报 `durable(local)`)——session 行落盘在
   数据根下,清数据/隐私预期要按「sessions 在 engine-data 里」来做,不要按「只在内存」。
@@ -216,6 +221,9 @@ SEMA_REGISTRY_URL=http://<config-center-host>:3100   # 启动拉 GET /api/config
 SEMA_REGISTRY_TOKEN=<SERVICE_PULL_TOKEN 的值>   # 取自配置控制面主机 .env;只读拉取令牌
 SEMA_REGISTRY_DRY_RUN=true                     # 安全灰度:只 LOG 中心配置 vs env 推导的差异,不 apply
 SEMA_REGISTRY_WORKER=<worker名>                # 可选:拉取 /effective?worker=<名> 取该 worker 的 roster(reconciler 按 worker 注);不设=全局 roster(向后兼容)
+FLEET_ADVERTISE_ADDRESS=http://<本机可达IP>:8090  # 可选:设了才启 fleet 上报腿(announce/heartbeat+usage 批报到中心)。
+                                               # 必须是可解析的 http(s) base URL——host:port 等坏形 5.13.0 起 boot 响亮拒
+                                               # (此前静默每拍 announce 400,worker 永不注册)。
 ```
 - 中心**空/未发布** → `applyEffective` 回落 env + 内建 teams 并 warn `config_center_unpublished`,**不影响在跑的服务**(接了也安全)。
 - **灰度姿势**(配置控制面 AI 建议):先 `SEMA_REGISTRY_DRY_RUN=true` 起一轮,看日志 `sema_registry_dry_run`(中心给的 models/roles/teams + 会否覆盖 default、per-model apiKeyEnv)对得上 env 再去掉该 flag 真正 apply。

package/dist/bench/s1/arms.js

@@ -76,8 +76,8 @@ function emptyCostBreakdown() {
  * measurement was reward-hackable and never trustworthy) is ALSO non-scorable → excluded, never a withhold-credit.
  */
 export function classifyRunStatus(input) {
-    if (input.status === "failed" || input.status === "timeout")
-        return "infra-failed";
+    if (input.status === "failed")
+        return "infra-failed"; // core 5.8.0:status "timeout" 退役(walltime 形并入 failed)
     if (input.repairTerminal === "oracle.unprotected")
         return "infra-failed"; // broken/un-isolated oracle → not scorable
     return "scored";

package/dist/boot/resolve-spec.js

@@ -624,7 +624,30 @@ export function createResolveSpec(ctx) {
                 // 该字段,叠一条 host-declared 字符串值=同键双条矛盾帧(by-key 投影抹掉权威来源)。server 只
                 // 声明自己命名空间的键;来源语义(caller vs 墙钟)由 timeoutSec 的 spec provenance + 上面的
                 // Cap 声明组合可读。
-                return { ...(limits !== undefined ? { limits } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
+                // core 5.8.0:预算族(maxCostUsd/maxTokens/degrade)从 TaskSpec 顶层迁入 limits——顶层键已删,
+                // 继续写顶层=经宽类型静默死键(E-HIGH-1 病族)。wire 面不变:body 顶层 maxCostUsd/maxTokens 照收
+                //(SDK 在发),装配目标改到 limits。budgetStreamCancel 语义照 core 默认(maxCostUsd 在场即 true)。
+                const maxCostUsd = cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd);
+                const maxTokens = cappedCeiling(body.maxTokens, config.maxTaskTokens);
+                const degrade = (() => {
+                    if (!config.degrade || maxCostUsd === undefined)
+                        return undefined;
+                    if (Array.isArray(body.images) && body.images.length > 0 && !config.degrade.toSupportsImages) {
+                        // S14 (SILENT-FALLBACK P0-f): this drop was undetectable — the task keeps its vision-capable main
+                        // model and near-budget it hard-fails on cost instead of degrading. Surface it.
+                        metrics.inc("degrade_dropped_total", { reason: "vision_target" });
+                        logger.warn("degrade_dropped", { reason: "vision_target", model: picked.model, images: body.images.length });
+                        return undefined;
+                    }
+                    return { to: config.degrade.to, atCostFraction: config.degrade.atCostFraction };
+                })();
+                const merged = {
+                    ...(limits ?? {}),
+                    ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
+                    ...(maxTokens !== undefined ? { maxTokens } : {}),
+                    ...(degrade !== undefined ? { degrade } : {}),
+                };
+                return { ...(Object.keys(merged).length > 0 ? { limits: merged } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
             })(),
             // design/129: the TOC/interactive posture (single-user turnkey — the shell's
             // session lane) defaults background children to SESSION scope = CC Backgrounded semantics (a bg Agent/
@@ -632,30 +655,8 @@ export function createResolveSpec(ctx) {
             // deployments keep core's "task" default (no orphans burning tokens). Caller-trusted spec field
             // (systemPrompt tier), NEVER read from the request body. Same tenancy predicate as the wall clock above.
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
-            // ⑤ Per-task budget gate (1.37): honor a caller's requested ceiling but CAP it to the operator
-            // ceiling (a request can ask for less, never more). core fails the task with errorCode budget.*
-            // when crossed. budgetStreamCancel defaults true when maxCostUsd is set.
-            maxCostUsd: cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd),
-            maxTokens: cappedCeiling(body.maxTokens, config.maxTaskTokens),
-            // 1.40 near-budget degradation: only meaningful with a cost ceiling (the fraction is of it).
-            // When this task has one, switch to the cheaper model at atCostFraction instead of hard-failing.
-            // vision precheck (adversarial-review finding): DROP degrade for an image-carrying task when the
-            // degrade TARGET can't read images (toSupportsImages=false). The precheck only sees the picked model, not the
-            // external degrade target — so without this a runtime degrade would send the images to a text-only gateway (the
-            // opaque 400 the precheck prevents). The task keeps its vision-capable main model; near-budget it hard-fails on
-            // cost instead of image-failing. MODEL_DEGRADE_TO_VISION=true opts back in.
-            degrade: (() => {
-                if (!config.degrade || cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd) === undefined)
-                    return undefined;
-                if (Array.isArray(body.images) && body.images.length > 0 && !config.degrade.toSupportsImages) {
-                    // S14 (SILENT-FALLBACK P0-f): this drop was undetectable — the task keeps its vision-capable main
-                    // model and near-budget it hard-fails on cost instead of degrading (rationale above). Surface it.
-                    metrics.inc("degrade_dropped_total", { reason: "vision_target" });
-                    logger.warn("degrade_dropped", { reason: "vision_target", model: picked.model, images: body.images.length });
-                    return undefined;
-                }
-                return { to: config.degrade.to, atCostFraction: config.degrade.atCostFraction };
-            })(),
+            // ⑤ Per-task budget gate + 1.40 near-budget degrade:core 5.8.0 起全部在 limits(上方 IIFE 合成),
+            // 顶层键已随 core 类型删除。
             // Long-term memory (design/138 S1): enabled when the memory ENGINE is wired AND a scope was derived
             // (single-user only — multi-tenant derives none, memory dark). MF-30 PAUSE (option B, per-request —
             // clay 2026-06-27 confirmed with core): `body.memoryWrite:false` makes THIS run read-only over memory

package/dist/capabilities/code-review-council.js

@@ -86,7 +86,7 @@ async function runLensReviews(subRunner, repoTools, objective, signal, lenses) {
             modelRole: "subagent",
             tools: repoTools,
             systemPrompt: lensSystem(lens),
-            limits: { timeoutSec: 180 },
+            limits: { maxWalltimeMs: 180_000 },
             enableBlockedReport: false,
             signal,
         });
@@ -113,7 +113,7 @@ async function runConvergence(subRunner, repoTools, objective, findings, opts, s
             tools: repoTools, // members may verify a disputed claim against the real code (Tool-MAD)
             maxTranscriptTokens: 8000,
             synthesizer: { role: "arbiter", systemPrompt: ARBITER_SYSTEM },
-            limits: { timeoutSec: 400 },
+            limits: { maxWalltimeMs: 400_000 },
             signal, // 1.28: a parent abort now cascades into the debate members
         });
         // 1.32: synthesizer 两次都失败时 `conclusion` 是 `[unavailable…]` 垃圾串，与真结论无法区分。别当结论
@@ -134,7 +134,7 @@ async function runConvergence(subRunner, repoTools, objective, findings, opts, s
         // The arbiter grounds/dedups/ranks — keep it on the strong `synthesize` role (= main model).
         modelRole: "synthesize",
         systemPrompt: ARBITER_SYSTEM,
-        limits: { timeoutSec: 240 },
+        limits: { maxWalltimeMs: 240_000 },
         enableBlockedReport: false,
         signal,
     });

package/dist/capabilities/team.js

@@ -68,7 +68,7 @@ export function createTeamTool(subRunner, template, opts) {
                     ? { role: template.synthesizer.role, ...(template.synthesizer.model ? { model: template.synthesizer.model } : {}), modelRole: template.synthesizer.modelRole, systemPrompt: template.synthesizer.systemPrompt ?? "" }
                     : undefined,
                 maxTranscriptTokens: 8000,
-                limits: { timeoutSec: 600 },
+                limits: { maxWalltimeMs: 600_000 },
                 signal: ctx.signal, // 1.28: a team abort now cascades into the member runs (review D)
             });
             ctx.reportUsage?.({ tokens: team.stats.tokens, turns: team.stats.turns, tasks: template.members.length * template.rounds + 1 });

package/dist/config-types.d.ts

@@ -166,6 +166,9 @@ export interface ServiceConfigFlat {
     sessionBackend: "memory" | "tidb" | "auto";
     /** Warm-cache idle TTL (seconds) for woken TiDB sessions; 0 disables. Requires session affinity. */
     sessionCacheTtlSec: number;
+    /** B1 /health 活体 store 探测:后台缓存探针间隔 ms(STORE_PROBE_INTERVAL_MS;0=显式关,负/非数 boot
+     *  响亮拒)。只对 SQL 后端接线;探针原语=backend.dbNowMs()(S10 时钟探针的真 DB 往返,零新 SQL 面)。 */
+    storeProbeIntervalMs: number;
     /** Rewind snapshot bounds: byte cap in MB (env REWIND_SNAPSHOT_MAX_MB). Unset = core DEFAULT_SNAPSHOT_BOUNDS
      *  (256 MiB / 10000 files as of core 2026-06-26 — was 2000/64MiB). BYTE-ONLY knob: raises OR lowers just the byte
      *  cap; file-count/ignoreDirs stay core defaults (more knobs when a case shows up). */
@@ -873,7 +876,7 @@ export interface ServiceConfigFlat {
     configLocalDir?: string;
 }
 /** 组:store(持久化)—— DB 引擎三态、session 后端、SQL coords、快照 BLOB / SendUserFile 对象存储。 */
-export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "rewindSnapshotMaxMb" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "sendUserFile">;
+export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "sessionCacheTtlSec" | "storeProbeIntervalMs" | "rewindSnapshotMaxMb" | "dbBackend" | "dbBackendExplicit" | "localDataRoot" | "tidb" | "pg" | "dbQueryTimeoutMs" | "snapshotBlobStore" | "snapshotBlobSqlMaxBytes" | "snapshotBlobAllowSql" | "sendUserFile">;
 /** 组:modelPlane(模型面)—— 网关坐标、Anthropic 路线、韧性旋钮、主/廉价 model entry、role 表、降级梯。 */
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上

package/dist/config.js

@@ -449,6 +449,9 @@ function parseStoreDomain(ctx) {
     return {
         sessionBackend,
         sessionCacheTtlSec: numEnv("SESSION_CACHE_TTL_SEC", "300"), // A2 同族:NaN ⇒ `> 0` 假 ⇒ 缓存静默关
+        // B1(/health 活体 store 探测):后台探针间隔;0=显式关,负值/非数响亮拒(fail-loud 族)。
+        // 只在 SQL 后端接线(main.ts 门 backend.kind!=="local"),local/memory 部署恒不挂环。
+        storeProbeIntervalMs: numEnvBounded("STORE_PROBE_INTERVAL_MS", "15000", 0, 3_600_000),
         rewindSnapshotMaxMb: optFinitePositiveEnv("REWIND_SNAPSHOT_MAX_MB"), // soft knob (S20: bad value warns + default)
         dbBackend,
         dbBackendExplicit: dbBackendSet,
@@ -1305,7 +1308,7 @@ function parseIntegrationsDomain() {
     };
 }
 const STORE_GROUP_KEYS = [
-    "sessionBackend", "sessionCacheTtlSec", "rewindSnapshotMaxMb", "dbBackend", "dbBackendExplicit", "localDataRoot",
+    "sessionBackend", "sessionCacheTtlSec", "storeProbeIntervalMs", "rewindSnapshotMaxMb", "dbBackend", "dbBackendExplicit", "localDataRoot",
     "tidb", "pg", "dbQueryTimeoutMs", "snapshotBlobStore", "snapshotBlobSqlMaxBytes", "snapshotBlobAllowSql", "sendUserFile",
 ];
 const MODEL_PLANE_GROUP_KEYS = [

package/dist/http/routes/runs.js

@@ -228,7 +228,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 rootTaskId: taskId,
                 ...fleetRunLabels(prepared.spec.objective), // BC-1: name = short objective preview (description = live-activity, set by the publisher onEvent tool_start)
             });
-            void runInBackground(deps.runner, { ...prepared.spec, sessionId }, runStore, taskId, deps.metrics, prepared.auth?.principal, prepared.verify, prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, prepared.spec.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, // E23: per-run elicitation context (onElicit routes inbound MCP elicitations to this run's stream)
+            void runInBackground(deps.runner, { ...prepared.spec, sessionId }, runStore, taskId, deps.metrics, prepared.auth?.principal, prepared.verify, prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, // E23: per-run elicitation context (onElicit routes inbound MCP elicitations to this run's stream)
             gatedPrincipal(req, deps.config) ?? null, // E23: the VERIFIED principal that may answer (same source the respond gate uses — never the spoofable header)
             captureTurnAnchor, // E18: per-turn (message eventId → leaf entryId) anchor capture
             fleetPub, // MF-Fleet: the run-scoped fleet-row publisher (onStart/onEvent/onTerminal across all legs)
@@ -461,7 +461,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             // 并发腿可能先终态化(如 approval.expired),我方写打空却仍答 "cancelled" 就是响应与账本不一致。
             // 写后复读,照实际行应答(锁一样释放了;谁先写赢谁的 errorCode)。
             const finalRow = await rs.getRun(taskId).catch(() => undefined);
-            if (finalRow && finalRow.errorCode !== "cancelled" && (finalRow.status === "failed" || finalRow.status === "completed" || finalRow.status === "blocked" || finalRow.status === "timeout")) {
+            if (finalRow && finalRow.errorCode !== "cancelled" && (finalRow.status === "failed" || finalRow.status === "completed" || finalRow.status === "blocked")) {
                 sendJson(res, 202, { taskId, status: finalRow.status, errorCode: finalRow.errorCode ?? null, note: `session unlocked; the run was terminalized concurrently (${finalRow.errorCode ?? finalRow.status}) before this cancel's write — reporting the actual ledger state` });
                 return;
             }

package/dist/http/routes/tasks.js

@@ -1032,7 +1032,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     // (verify → cascade → plain)、短路语义、传参**逐字不变**;`runWithVerification` 仍是整对象
                     // 直传(快审 F1:cost 顶不在重建中丢失),`runCascade` 仍从操作员梯子 + 本任务预算现算配置。
                     const verifyLeg = (v) => runWithVerification(deps.runner, specWithSignal, v);
-                    const cascadeLeg = () => runCascade(deps.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.maxCostUsd));
+                    const cascadeLeg = () => runCascade(deps.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd));
                     const plainLeg = () => deps.runner.runTask(specWithSignal);
                     result = await withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg());
                 }

package/dist/http/server.d.ts

@@ -398,6 +398,17 @@ export interface ServiceDeploymentDeps {
         since: number;
         blocked?: string[];
     } | undefined;
+    /** B1(鲁棒性批3 设计件):后台**缓存**探针的读座——/health 绝不逐请求打 DB(center/k8s 高频面),
+     *  main.ts 只在 SQL 后端(backend.kind !== "local")挂环(createStoreLiveProbe,STORE_PROBE_INTERVAL_MS)。
+     *  缺席(local/memory/探针关)= /health 形状不变;接线 = `storeProbe{live,ageMs,error?}` 恒在
+     *  (「探过且活」与「没接线」机读可分),顶层告警键 `storeLive:false` 只在死时出现。status 恒 "ok"
+     *  ——liveness≠readiness,DB 死不是进程死;摘流语义留给读键的编排器(与 durable/ready 同姿势,
+     *  披露不代裁)。钉:test/health-store-live.test.ts。 */
+    storeLiveState?: () => {
+        live: boolean;
+        ageMs: number;
+        error?: string;
+    } | undefined;
     /** ① core ruling — SPLIT: `capabilities.workflows` = the ENGINE-CAN axis, boot-computed from core's own
      *  `workflowsCapability(deps)` (hardened script runner ∧ governance), NOT the `Boolean(workflowRunStore)` store
      *  proxy. Orthogonal to `workflowsList` (the durable-list axis = `workflowRunStore`). Falls back to the store

package/dist/http/server.js

@@ -402,6 +402,16 @@ export function createHttpServer(rawDeps) {
                     const stuck = deps.planeDeferredState?.();
                     return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
                 })(),
+                // B1 活体 store 探测(座注见 storeLiveState 声明;钉 test/health-store-live.test.ts)
+                ...(() => {
+                    const probe = deps.storeLiveState?.();
+                    if (!probe)
+                        return {};
+                    return {
+                        ...(probe.live ? {} : { storeLive: false }),
+                        storeProbe: { live: probe.live, ageMs: probe.ageMs, ...(probe.error !== undefined ? { error: probe.error } : {}) },
+                    };
+                })(),
             });
             return;
         }
@@ -937,23 +947,27 @@ export function createHttpServer(rawDeps) {
         if (body.limits !== undefined) {
             const l = body.limits;
             if (typeof l !== "object" || l === null || Array.isArray(l)) {
-                sendError(res, 400, "request.field_invalid", "limits must be an object { timeoutSec?, maxOutputTokens?, maxTurns? } (positive integers)");
+                sendError(res, 400, "request.field_invalid", "limits must be an object { maxWalltimeMs?, maxOutputTokens?, maxTurns? } (positive integers)");
                 return null;
             }
-            for (const k of ["timeoutSec", "maxOutputTokens", "maxTurns"]) {
-                const v = l[k];
-                if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} must be a positive integer`);
+            // core 5.8.0 时限重构:旧键响亮拒并点名替代(core 同姿势 config.limit_unknown_key;「勿自行兼容」是
+            // core 的公开指令)。timeoutSec(秒)→ maxWalltimeMs(毫秒,注意单位);deadline 族三 opt-out 随
+            // 机制整族退役(nudge/call-cap/graceful-finalize 已从引擎移除),无替代键。fresh fail-loud;resume
+            // 重放不过此门,normalizeLimits 对旧键 defensive DROP(存量 suspended 体降级为默认配速,方向安全)。
+            if (l.timeoutSec !== undefined) {
+                sendError(res, 400, "request.field_invalid", "limits.timeoutSec was retired in core 5.8.0 — use limits.maxWalltimeMs (milliseconds; opt-in wall clock)");
+                return null;
+            }
+            for (const k of ["deadlineNudge", "callCapByDeadline", "gracefulFinalize"]) {
+                if (l[k] !== undefined) {
+                    sendError(res, 400, "request.field_invalid", `limits.${k} was retired in core 5.8.0 (the deadline-pacing mechanism family is gone; there is no replacement key — remove it)`);
                     return null;
                 }
             }
-            // 快审 F2(1.254):deadline 族三 opt-out 在场必须 literal false——"false"/0 等畸形值此前 200 后被
-            // normalizeLimits 静默丢=调用方以为关了其实恒开(B1 同类故障)。fresh fail-loud;resume 重放不过
-            // 此门,normalizeLimits 保持 defensive。
-            for (const k of ["deadlineNudge", "callCapByDeadline", "gracefulFinalize"]) {
-                const v = body.limits[k];
-                if (v !== undefined && v !== false) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} accepts only literal false (it is an opt-out; omit to keep the default-on behavior)`);
+            for (const k of ["maxWalltimeMs", "maxOutputTokens", "maxTurns"]) {
+                const v = l[k];
+                if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {
+                    sendError(res, 400, "request.field_invalid", `limits.${k} must be a positive integer${k === "maxWalltimeMs" ? " (milliseconds)" : ""}`);
                     return null;
                 }
             }
@@ -2190,10 +2204,11 @@ export function createHttpServer(rawDeps) {
             deps.metrics?.inc("task_tokens_total", {}, result.stats.tokens);
         if (result.stats.cacheHitRate !== undefined)
             deps.metrics?.observe("task_cache_hit_rate", result.stats.cacheHitRate);
-        // ⑤ budget/limit cutoffs (1.37): count failures by their dotted code (budget.precall/exceeded,
-        // limit.timeout/max_turns) so an operator can alert on tenants hitting the cost/token ceiling.
+        // ⑤ budget/limit cutoffs:count failures by their dotted code — core 5.8.0 起统一 `limits.` 前缀
+        // (limits.max_{tokens,cost,turns,walltime}_exceeded;旧 budget.*/limit.* 双前缀同拍退役),
+        // operator 按此对租户撞顶告警。metric 名保留 budget_exceeded_total(时序连续性;code label 自述新码)。
         const code = result.errorCode;
-        if (code && (code.startsWith("budget.") || code.startsWith("limit."))) {
+        if (code && code.startsWith("limits.")) {
             deps.metrics?.inc("budget_exceeded_total", { code });
         }
         // Developer-mode verification gate (1.44): count the final verdict when this task was verified.

package/dist/http/wire-types.d.ts

@@ -153,19 +153,14 @@ export interface TaskRequestBody {
     };
     /** design/132 (core 1.249): one-shot end-game verification nudge — opt-in by the AUTONOMY caller. */
     finalVerification?: boolean;
-    /** [854]④ per-request 配速(core spec.limits 全链:timeoutSec 墙钟 + deadlineNudge/callCapByDeadline/
-     *  gracefulFinalize;maxOutputTokens = 每次模型调用的输出上限;maxTurns = 上游 parity 的回合上限)。
-     *  三键均为正整数(0 拒绝:core 侧 timeoutSec>0 才生效,放行 0 会绕过运营方封顶)。与 `maxTokens`
-     *  (per-task 总 token 预算,cappedCeiling 车道)不同物 —— maxOutputTokens 是单次调用配速。
-     *  每键各自被可选 env 上限封顶(TASK_TIMEOUT_MAX_SEC / TASK_MAX_OUTPUT_TOKENS_MAX / TASK_MAX_TURNS_MAX,
-     *  缺省不设=不封顶);timeoutSec 缺席时保持既有 tenancy 墙钟姿势(resolveTaskLimits,spec-fields.ts)。 */
+    /** [854]④ per-request 配速——core 5.8.0 时限重构后的键集(#124):`maxWalltimeMs`(毫秒,opt-in 墙钟)/
+     *  `maxOutputTokens`/`maxTurns`,均正整数;可选运营方上限旋钮各自封顶(TASK_TIMEOUT_MAX_SEC 保**秒**义,
+     *  对毫秒键封顶 ×1000)。旧键 `timeoutSec` 与 deadline 族三 opt-out(机制退役)fresh-submit 400 响亮
+     *  点名替代;`maxWalltimeMs` 缺席时保持既有 tenancy 墙钟姿势(resolveTaskLimits,spec-fields.ts)。 */
     limits?: {
-        timeoutSec?: number;
+        maxWalltimeMs?: number;
         maxOutputTokens?: number;
         maxTurns?: number;
-        deadlineNudge?: false;
-        callCapByDeadline?: false;
-        gracefulFinalize?: false;
     };
     /** design/133 (core 1.251) + G1 (core 1.253): turn-boundary attachment reminders (todo / changed-files /
      *  plan-mode) + one-shot boundary notices (post-compaction background-task recap / deferred-tools delta).

package/dist/leader/fanout.d.ts

@@ -38,8 +38,8 @@ export interface WorkerReport {
      *  it up to its bound but it didn't fully complete — e.g. the overall deadline hit or the slice cap). Present
      *  ⇒ resumable: the operator/leader can escalate (more budget) or accept the belt-diff partial progress. */
     checkpointGate?: TaskResult["checkpointGate"];
-    /** design/74 Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `budget.exceeded` on an exhausted
-     *  resume, `limit.max_turns`) — surfaced for /v1/leader observability. */
+    /** design/74 Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `limits.max_cost_exceeded` on an
+     *  exhausted resume, `limits.max_turns_exceeded` — core 5.8.0 码名轴) — surfaced for /v1/leader observability. */
     errorCode?: TaskResult["errorCode"];
     /** LEADER-REPAIRLOOP-INTEGRATION §10.6 (THE push chokepoint): the `runRepairLoop` terminal a single-agent
      *  worker resolved to, when the repair loop ran on this worker (LEADER_REPAIR_LOOP on). It MUST ride on the

package/dist/leader/leader.js

@@ -108,7 +108,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                             // Map the TaskResult status directly (like fanOut's own mapStatus) — a `suspended` result that the
                             // auto-resume left unresumed (a non-resource gate, e.g. human-approval) stays `suspended` so the
                             // leader's C4 surface/cancel reaction still fires; only completed/timeout pass through, else failed.
-                            status: r.status === "completed" ? "completed" : r.status === "suspended" ? "suspended" : r.status === "timeout" ? "timeout" : "failed",
+                            status: r.status === "completed" ? "completed" : r.status === "suspended" ? "suspended" : "failed", // core 5.8.0:TaskResult 无 "timeout"(内部词表的 timeout 仍由 fanout 墙钟臂生产)
                             stats: r.stats,
                             ...(r.status === "completed" ? {} : { error: r.errorMessage ?? r.blockedReason ?? `worker ${r.status}` }),
                             ...(r.checkpointGate ? { checkpointGate: r.checkpointGate } : {}),

package/dist/leader/wire.js

@@ -134,7 +134,8 @@ export function leaderResourceConfig(env = process.env) {
         leaderTimeoutMs,
         workerMaxTurns,
         workerBudgetUsd,
-        workerLimits: { limits: { maxTurns: workerMaxTurns, timeoutSec: Math.floor(leaderTimeoutMs / 1000) }, maxCostUsd: workerBudgetUsd },
+        // core 5.8.0:预算四键全入 limits(顶层 maxCostUsd 删);walltime 原生毫秒不再除
+        workerLimits: { limits: { maxTurns: workerMaxTurns, maxWalltimeMs: leaderTimeoutMs, maxCostUsd: workerBudgetUsd } },
         presignTtlSec: Math.ceil(leaderTimeoutMs / 1000) + 600, // URL/sandbox must outlive the worker (BUG1/BUG2)
         ...(resourceSuspendOn
             ? {
@@ -223,8 +224,7 @@ export function createLeaderRunner(cfg) {
                         .runTaskStream({
                         objective,
                         sessionId: `leader-repair-${Date.now()}-${round}`,
-                        maxCostUsd: repairBudgetUsd,
-                        limits: { timeoutSec: Math.max(300, Math.floor(leaderTimeoutMs / 1000 / 2)) },
+                        limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
                     })
                         .result();
                     // A non-completed repair (timeout/abort) may leave a process alive in the SAME Kata pod that would race
@@ -281,8 +281,7 @@ export function createLeaderRunner(cfg) {
                         .runTaskStream({
                         objective,
                         sessionId: `leader-conflict-${Date.now()}-${round}`,
-                        maxCostUsd: repairBudgetUsd,
-                        limits: { timeoutSec: Math.max(300, Math.floor(leaderTimeoutMs / 1000 / 2)) },
+                        limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
                     })
                         .result();
                     if (res.status !== "completed")
@@ -422,7 +421,10 @@ export function createLeaderRunner(cfg) {
                 resourceSpec = {
                     checkpointStore: cfg.durable.checkpointStore,
                     resourceSuspend: { scope: `_leader-resource-${sub.workerId}`, totalBudgetUsd: resourceCfg.totalBudgetUsd },
-                    maxCostUsd: resourceCfg.sliceMaxCostUsd,
+                    // core 5.8.0:maxCostUsd 入 limits 后,本 spread(spec: {...workerLimits, ..., ...resourceSpec})的
+                    // limits 键是**整体覆盖**——必须显式并回 workerLimits.limits(maxTurns/maxWalltimeMs),否则
+                    // per-slice 覆盖会顺手把 worker 的轮数/墙钟界丢掉(5.7 时代顶层键覆盖顶层键,无此陷阱)。
+                    limits: { ...workerLimits.limits, maxCostUsd: resourceCfg.sliceMaxCostUsd },
                     maxSuspends: resourceCfg.maxSuspends,
                 };
             }

package/dist/main.js

@@ -30,6 +30,7 @@ import { performMemorySync } from "./memory-sync.js";
 import { startOtlpExporter } from "./observability/otel-exporter.js";
 import { HEARTBEAT_MS, backgroundAgentOutput, taskHandleOutput, taskHandleStop } from "./runs.js";
 import { SQL_BLOB_DEFAULT_MAX_BYTES } from "./plugins/blob-backend.js";
+import { createStoreLiveProbe } from "./store-live-probe.js";
 import { counterStoreLabel } from "./plugins/store-backend.js";
 import { composeHooks } from "./hooks/hook-runner.js";
 import { createHookLlm } from "./hooks/hook-llm.js";
@@ -227,8 +228,8 @@ async function main() {
                 model: pick.catalogRef,
                 handsReadOnly: true,
                 enableFork: false,
-                maxCostUsd: 0.05,
-                limits: { maxTurns: 10, timeoutSec: Math.max(30, Math.ceil(timeoutMs / 1000)) },
+                // core 5.8.0:预算四键全入 limits(顶层 maxCostUsd 删);timeoutSec(秒)→ maxWalltimeMs(毫秒,原生同单位)
+                limits: { maxTurns: 10, maxCostUsd: 0.05, maxWalltimeMs: Math.max(30_000, timeoutMs) },
                 // spec 无 toolPolicy → core `hasEffectAwareGate` 为假 → 每次 agent hook 触发一条
                 // error 级 UNGATED 警告(非致命但纯噪声)。挂已裁决的 auto-accept 基线(与 singleUserAutoAcceptBaseline
                 // 同构;hook 子代理本就 handsReadOnly + 单用户信任面,auto-accept 是既定姿态,只是让闸机制在场)。
@@ -800,6 +801,10 @@ async function main() {
         costQuota,
         fleetLease: fleetLease ? fleetLease : undefined, // lease admission 门(提交面,镜像 quotaExceeded)
     };
+    // B1 活体 store 探测环(门与判据见 store-live-probe.ts 头注;探针原语=既有 S10 dbNowMs 真 DB 往返)
+    const storeLiveProbe = backend && backend.kind !== "local" && backend.dbNowMs && config.storeProbeIntervalMs > 0
+        ? createStoreLiveProbe({ probe: () => backend.dbNowMs(), intervalMs: config.storeProbeIntervalMs, logger })
+        : undefined;
     /** 部署自述面(/health + /v1/capabilities + 提交前置门读的部署事实;多为 live getter) */
     const deployment = {
         // 海外 pilot 实机发现:/health 曾 verbatim 回显 sessionBackend 枚举——auto/DB_BACKEND 收编把它
@@ -833,6 +838,11 @@ async function main() {
         // shared drain state — SIGTERM flips `draining`, createServer assigns `inflight`, /health mirrors it.
         drainState,
         storeDegraded: storeBackendDegraded, // S5: /health twin of the store_backend_degraded gauge
+        // B1 活体 store 探测:后台缓存环(座注见 http/server.ts storeLiveState;环判据见 store-live-probe.ts)。
+        // 门 = SQL 后端 ∧ dbNowMs 在场 ∧ 旋钮>0;local/memory 恒不挂(/health 形状不变)。timer 全 unref,
+        // 进程退出零阻塞;pool 生命周期归 backend.close()。直键非条件展开(deps-literal-shape 门:条件
+        // 展开旁路多余属性检查——E-HIGH-1 死键病族)。
+        storeLiveState: storeLiveProbe ? () => storeLiveProbe.state() : undefined,
     };
     /** 数值旋钮(缺省写在消费点,此处只承载覆写) */
     const knobs = {

package/dist/plugins/remote-env-host.js

@@ -534,27 +534,8 @@ export class RemoteHostExecutionEnv {
                 env: this.mergeEnv(options?.env),
                 ...spawnGroupOptions(),
             });
-            // core 1.321 cut-kill registry(三轮复审存量缺口):把杀柄交给上层(Bash 工具 cut 时强制终杀);
-            // 柄内 still-running 守卫(exitCode/signalCode)防对已亡组的 pgid 复用误杀(core 参考实现同语义)。
-            if (options?.onSpawn && child.pid != null) {
-                const spawnedPid = child.pid;
-                try {
-                    options.onSpawn({ pid: spawnedPid, kill: () => {
-                            if (child.exitCode !== null || child.signalCode !== null)
-                                return;
-                            try {
-                                killTreeHard(spawnedPid);
-                            }
-                            catch {
-                                try {
-                                    child.kill("SIGKILL");
-                                }
-                                catch { /* noop */ }
-                            }
-                        } });
-                }
-                catch { /* registry 回调失败不挡 exec(core 同姿势吞) */ }
-            }
+            // core 5.8.0:cut-kill registry seam(onSpawn/onDetachAdopted)随 tool-cut 机制退役(core 零生产者,
+            // 本臂为死码删除;1.321 时代的 still-running 守卫语义随之谢幕)。
             const finish = (r) => {
                 if (settled)
                     return;
@@ -629,11 +610,6 @@ export class RemoteHostExecutionEnv {
                     clearTimeout(forceSettleTimer);
                 options?.abortSignal?.removeEventListener("abort", onAbort);
                 settled = true;
-                // cut-kill registry 注销(所有权已移交 bgManager——cut 不该再杀后台 shell;core 参考实现同位)。
-                try {
-                    options?.onDetachAdopted?.();
-                }
-                catch { /* noop */ }
                 resolve(ok({ stdout: seedOut, stderr: seedErr, exitCode: 0, detached: { shellId } }));
             };
             // Named (not inline) so onDetach can `off` them when it hands the pipes to the adopted background shell.
@@ -874,26 +850,7 @@ export class RemoteHostExecutionEnv {
                 throw e;
             }
             closeSpoolFds(); // 父进程的 fd 副本立即关(文件 size/EOF 只反映子进程写;launch FILE 形同姿势)
-            // core 1.321 cut-kill registry(三轮复审存量缺口):同 pipe 径——杀柄带 still-running 守卫。
-            if (options?.onSpawn && child.pid != null) {
-                const spawnedPid = child.pid;
-                try {
-                    options.onSpawn({ pid: spawnedPid, kill: () => {
-                            if (child.exitCode !== null || child.signalCode !== null)
-                                return;
-                            try {
-                                killTreeHard(spawnedPid);
-                            }
-                            catch {
-                                try {
-                                    child.kill("SIGKILL");
-                                }
-                                catch { /* noop */ }
-                            }
-                        } });
-                }
-                catch { /* registry 回调失败不挡 exec */ }
-            }
+            // core 5.8.0:cut-kill registry seam 退役(pipe 径同注)。
             // 七轮复审:'error' 监听必须在任何可提前 return 的路径(下方 F5 already-aborted 查)之前装——异步
             // spawn 失败(如 cwd 不存在)以 ChildProcess 'error' 事件发出,无监听=uncaught 直接打死 worker 进程
             // (plain-node 最小形实证 crash;vitest/tsx 宿主会吸收,故该面无法用测试钉住,靠此排序保证)。
@@ -971,11 +928,6 @@ export class RemoteHostExecutionEnv {
                 if (shellId === undefined)
                     return; // 拒收(limit/无 pid)→ 继续 fg,泵照跑,close 正常 settle
                 handedOver = true; // spool 文件归 bg(dispose 面按 FILE 形清理)
-                // cut-kill registry 注销(所有权已移交 bgManager;pipe 径同位)。
-                try {
-                    options?.onDetachAdopted?.();
-                }
-                catch { /* noop */ }
                 const o = outBuf.result();
                 const e = errBuf.result();
                 finish(ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode: 0, detached: { shellId } }));

package/dist/run-local.js

@@ -469,7 +469,8 @@ export async function runLocal(argv, deps = {}) {
         // [849]→[2400] 场景层定死终验已无生产者(autonomous 退役);OR 折入形保留,与 resolveSpec 同语义。
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
-        ...(timeoutSec !== undefined ? { limits: { timeoutSec } } : {}),
+        // core 5.8.0:timeoutSec 键退役 → maxWalltimeMs(毫秒);taskWallClockSec 仍产秒,此处换算一次。
+        ...(timeoutSec !== undefined ? { limits: { maxWalltimeMs: timeoutSec * 1000 } } : {}),
     };
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: config.remoteExec?.provider ?? "in-process" });
     // ── Run ONE task to completion (the sync /v1/tasks path: plain runTask, no verify/cascade). ──

package/dist/spec-fields.d.ts

@@ -87,7 +87,8 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
 export declare function promptProfileFromBody(raw: unknown): "simple" | "classic" | undefined;
 /** [854]④ — 每键的运营方上限旋钮(env,缺省不设=不封顶)。 */
 export interface TaskLimitCaps {
-    /** TASK_TIMEOUT_MAX_SEC */ timeoutSec?: number;
+    /** TASK_TIMEOUT_MAX_SEC(env 名不动,仍按**秒**配置;core 5.8.0 起封顶对象是 limits.maxWalltimeMs,
+     *  封顶比较时 ×1000 换算——运维面零迁移)。 */ timeoutSec?: number;
     /** TASK_MAX_OUTPUT_TOKENS_MAX */ maxOutputTokens?: number;
     /** TASK_MAX_TURNS_MAX */ maxTurns?: number;
 }
@@ -98,12 +99,9 @@ export interface TaskLimitCaps {
  * 运营方上限旋钮 clamp(Math.min;旋钮缺省不设=不封顶)。全空 ⇒ undefined。
  */
 export declare function normalizeLimits(v: unknown, caps: TaskLimitCaps): {
-    timeoutSec?: number;
+    maxWalltimeMs?: number;
     maxOutputTokens?: number;
     maxTurns?: number;
-    deadlineNudge?: false;
-    callCapByDeadline?: false;
-    gracefulFinalize?: false;
 } | undefined;
 /**
  * [854]④ — body.limits 与 env 墙钟的合成规则(resolveSpec 的唯一 limits 装配点;run-local 无 body 车道不经此):

package/dist/spec-fields.js

@@ -359,6 +359,9 @@ export function promptProfileFromBody(raw) {
 export function normalizeLimits(v, caps) {
     if (v == null || typeof v !== "object" || Array.isArray(v))
         return undefined;
+    // core 5.8.0:键集换 maxWalltimeMs(毫秒)。旧键(timeoutSec/deadline 族三 opt-out)fresh-submit 已在
+    // HTTP 门响亮 400 点名替代;本层只走 resume 重放的持久化 body——旧键 defensive DROP(存量 suspended
+    // 体降级为默认配速,env 墙钟兜底仍在,方向安全;绝不静默换算=那是「自行兼容」,core 明令禁止)。
     const o = v;
     const pick = (raw, cap) => {
         if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 1)
@@ -367,14 +370,10 @@ export function normalizeLimits(v, caps) {
         return cap !== undefined ? Math.min(n, cap) : n;
     };
     const out = {
-        ...(() => { const n = pick(o.timeoutSec, caps.timeoutSec); return n !== undefined ? { timeoutSec: n } : {}; })(),
+        // caps.timeoutSec 是秒(env TASK_TIMEOUT_MAX_SEC 保名保义),封顶毫秒键时 ×1000。
+        ...(() => { const n = pick(o.maxWalltimeMs, caps.timeoutSec !== undefined ? caps.timeoutSec * 1000 : undefined); return n !== undefined ? { maxWalltimeMs: n } : {}; })(),
         ...(() => { const n = pick(o.maxOutputTokens, caps.maxOutputTokens); return n !== undefined ? { maxOutputTokens: n } : {}; })(),
         ...(() => { const n = pick(o.maxTurns, caps.maxTurns); return n !== undefined ? { maxTurns: n } : {}; })(),
-        // 历史复审轴B #4(1.254):deadline 族三个 **opt-out**(design/128/130,timeoutSec 在场即默认 ON;
-        // server 恒注 tenancy 墙钟 ⇒ 此前恒开且 wire 无法关)。只认 literal false(纯关闭旋钮,零扩权面)。
-        ...(o.deadlineNudge === false ? { deadlineNudge: false } : {}),
-        ...(o.callCapByDeadline === false ? { callCapByDeadline: false } : {}),
-        ...(o.gracefulFinalize === false ? { gracefulFinalize: false } : {}),
     };
     return Object.keys(out).length > 0 ? out : undefined;
 }
@@ -389,8 +388,11 @@ export function normalizeLimits(v, caps) {
  */
 export function resolveTaskLimits(bodyLimits, caps, envTimeoutSec, requirePrincipal, big) {
     const requested = normalizeLimits(bodyLimits, caps);
-    const timeoutSec = requested?.timeoutSec ?? taskWallClockSec(envTimeoutSec, requirePrincipal, big);
-    const out = { ...(requested ?? {}), ...(timeoutSec !== undefined ? { timeoutSec } : {}) };
+    // core 5.8.0:墙钟键=maxWalltimeMs(毫秒)。taskWallClockSec 仍以秒推导(tenancy 基值+env 只抬不降,
+    // 语义原样),装配处换算一次;body 显式给了 maxWalltimeMs 则直接生效(caller 意图,可低于 env 墙)。
+    const wallSec = taskWallClockSec(envTimeoutSec, requirePrincipal, big);
+    const maxWalltimeMs = requested?.maxWalltimeMs ?? (wallSec !== undefined ? wallSec * 1000 : undefined);
+    const out = { ...(requested ?? {}), ...(maxWalltimeMs !== undefined ? { maxWalltimeMs } : {}) };
     return Object.keys(out).length > 0 ? out : undefined;
 }
 //# sourceMappingURL=spec-fields.js.map

package/dist/store-live-probe.d.ts

@@ -0,0 +1,40 @@
+/**
+ * B1(鲁棒性批3 立案的设计件):/health 活体 store 探测的后台缓存环。
+ *
+ * 为什么是缓存环而不是逐请求探:/health 是 fleet center/k8s 的高频面(10-15s 一拍×N 消费方),
+ * 逐请求打 DB 会把健康检查本身变成负载源、且慢 store 直接拖垮 /health 的「必须回答此刻」承诺。
+ * 环产出的 state 由 /health 的 additive 键族消费(座注见 http/server.ts `storeLiveState`;
+ * 键形钉在 test/health-store-live.test.ts,本环判据钉在 test/store-live-probe.test.ts)。
+ *
+ * 判据:
+ * - 有界:单拍探针经 STORE_PROBE_TIMEOUT_MS race——挂死的 pool(半开连接)不得钉死环;
+ * - 翻转披露(§M):live→dead warn `store_probe_dead`、dead→live info `store_probe_recovered`,
+ *   只在翻转拍记(连续死不逐拍刷日志——down 的 DB 不该制造日志风暴);
+ * - 诚实缺席:首拍落地前 state() = undefined(/health 键缺席=「还没探过」,不冒充「活」)。
+ *
+ * 探针原语:调用方给 `probe`(main.ts 传 `() => backend.dbNowMs!()`——既有 S10 时钟探针的真 DB
+ * 往返,零新 SQL 面)。timer 全部 unref(环不得阻止进程退出)。
+ */
+/** 单拍探针上界——挂死连接的判死时间;3s 对 15s 默认间隔留足余量(环内串行,无叠拍)。 */
+export declare const STORE_PROBE_TIMEOUT_MS = 3000;
+export interface StoreLiveState {
+    live: boolean;
+    /** 距上一次探针**落地**(成功或失败)的毫秒——消费方判「这份缓存多旧」。 */
+    ageMs: number;
+    error?: string;
+}
+export interface StoreLiveProbe {
+    /** /health 读座:undefined = 首拍未落地。 */
+    state: () => StoreLiveState | undefined;
+    stop: () => void;
+}
+export declare function createStoreLiveProbe(opts: {
+    probe: () => Promise<unknown>;
+    intervalMs: number;
+    timeoutMs?: number;
+    logger?: {
+        info?: (msg: string, meta?: Record<string, unknown>) => void;
+        warn?: (msg: string, meta?: Record<string, unknown>) => void;
+    };
+}): StoreLiveProbe;
+//# sourceMappingURL=store-live-probe.d.ts.map

package/dist/store-live-probe.js

@@ -0,0 +1,65 @@
+/**
+ * B1(鲁棒性批3 立案的设计件):/health 活体 store 探测的后台缓存环。
+ *
+ * 为什么是缓存环而不是逐请求探:/health 是 fleet center/k8s 的高频面(10-15s 一拍×N 消费方),
+ * 逐请求打 DB 会把健康检查本身变成负载源、且慢 store 直接拖垮 /health 的「必须回答此刻」承诺。
+ * 环产出的 state 由 /health 的 additive 键族消费(座注见 http/server.ts `storeLiveState`;
+ * 键形钉在 test/health-store-live.test.ts,本环判据钉在 test/store-live-probe.test.ts)。
+ *
+ * 判据:
+ * - 有界:单拍探针经 STORE_PROBE_TIMEOUT_MS race——挂死的 pool(半开连接)不得钉死环;
+ * - 翻转披露(§M):live→dead warn `store_probe_dead`、dead→live info `store_probe_recovered`,
+ *   只在翻转拍记(连续死不逐拍刷日志——down 的 DB 不该制造日志风暴);
+ * - 诚实缺席:首拍落地前 state() = undefined(/health 键缺席=「还没探过」,不冒充「活」)。
+ *
+ * 探针原语:调用方给 `probe`(main.ts 传 `() => backend.dbNowMs!()`——既有 S10 时钟探针的真 DB
+ * 往返,零新 SQL 面)。timer 全部 unref(环不得阻止进程退出)。
+ */
+/** 单拍探针上界——挂死连接的判死时间;3s 对 15s 默认间隔留足余量(环内串行,无叠拍)。 */
+export const STORE_PROBE_TIMEOUT_MS = 3000;
+export function createStoreLiveProbe(opts) {
+    const timeoutMs = opts.timeoutMs ?? STORE_PROBE_TIMEOUT_MS;
+    let last;
+    let stopped = false;
+    const probeOnce = async () => {
+        let timer;
+        let error;
+        try {
+            await Promise.race([
+                opts.probe(),
+                new Promise((_resolve, reject) => {
+                    timer = setTimeout(() => reject(new Error(`store probe timed out after ${timeoutMs}ms`)), timeoutMs);
+                    timer.unref?.();
+                }),
+            ]);
+        }
+        catch (e) {
+            error = e instanceof Error ? e.message : String(e);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        if (stopped)
+            return; // stop() 与在飞拍竞速:停后不再改 state、不再记翻转
+        const live = error === undefined;
+        const prev = last;
+        last = { live, at: Date.now(), ...(error !== undefined ? { error } : {}) };
+        // 翻转披露:首拍即死也算翻转(prev undefined → dead);连续同态不刷。
+        if (!live && prev?.live !== false)
+            opts.logger?.warn?.("store_probe_dead", { error });
+        if (live && prev?.live === false)
+            opts.logger?.info?.("store_probe_recovered", { deadForMs: Date.now() - prev.at });
+    };
+    void probeOnce(); // 首拍立即(不等首个 interval——启动后 15s 盲窗没有必要)
+    const loop = setInterval(() => void probeOnce(), opts.intervalMs);
+    loop.unref?.();
+    return {
+        state: () => (last === undefined ? undefined : { live: last.live, ageMs: Date.now() - last.at, ...(last.error !== undefined ? { error: last.error } : {}) }),
+        stop: () => {
+            stopped = true;
+            clearInterval(loop);
+        },
+    };
+}
+//# sourceMappingURL=store-live-probe.js.map

package/dist/trace/project.d.ts

@@ -287,7 +287,7 @@ export declare function compactedEventData(ev: {
     modelFallback?: true;
     fallbackReason?: "window";
     clampedRatio?: number;
-    clampReason?: "budget" | "walltime" | "tolerance";
+    clampReason?: "budget" | "tolerance";
     tokensAfter?: number;
     triggerTokensBefore?: number;
     durationMs?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "5.13.0",
+  "version": "6.0.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.7.0",
+    "@sema-agent/core": "^5.8.0",
     "@sema-agent/registry-core": "^0.14.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",