@sema-agent/server 5.14.0 → 6.1.0

package/USAGE.md

@@ -53,7 +53,7 @@ ANTHROPIC_API_KEY=sk-ant-…   # 可选:ANTHROPIC_BASE_URL / ANTHROPIC_VERSION /
 
 **可选 — 韧性栈:分级超时 + 断路器(core 1.38，叠在 failover 之下)**
 ```bash
-# ③ 分级超时:任务级 timeoutSec 之下补两段,各记为可重试的 [network] → 触发重试/断路器/failover
+# ③ 分级超时:任务级 limits.maxWalltimeMs(6.0.0 起,毫秒)之下补两段,各记为可重试的 [network] → 触发重试/断路器/failover
 MODEL_CONNECT_TIMEOUT_MS=8000        # fetch 迟迟不返响应头(网关连不上)→ 中止
 MODEL_FIRST_TOKEN_TIMEOUT_MS=30000   # SSE 已开但迟迟不吐第一个 delta(网关 hang);reasoning 的首个 thinking 也算首 token
 MODEL_IDLE_TIMEOUT_MS=20000          # (1.40.1)出过 token 后中途卡死:每个 delta 重置,静默超时→中止(补 first-token 只管首字)
@@ -221,6 +221,9 @@ SEMA_REGISTRY_URL=http://<config-center-host>:3100   # 启动拉 GET /api/config
 SEMA_REGISTRY_TOKEN=<SERVICE_PULL_TOKEN 的值>   # 取自配置控制面主机 .env;只读拉取令牌
 SEMA_REGISTRY_DRY_RUN=true                     # 安全灰度:只 LOG 中心配置 vs env 推导的差异,不 apply
 SEMA_REGISTRY_WORKER=<worker名>                # 可选:拉取 /effective?worker=<名> 取该 worker 的 roster(reconciler 按 worker 注);不设=全局 roster(向后兼容)
+FLEET_ADVERTISE_ADDRESS=http://<本机可达IP>:8090  # 可选:设了才启 fleet 上报腿(announce/heartbeat+usage 批报到中心)。
+                                               # 必须是可解析的 http(s) base URL——host:port 等坏形 5.13.0 起 boot 响亮拒
+                                               # (此前静默每拍 announce 400,worker 永不注册)。
 ```
 - 中心**空/未发布** → `applyEffective` 回落 env + 内建 teams 并 warn `config_center_unpublished`,**不影响在跑的服务**(接了也安全)。
 - **灰度姿势**(配置控制面 AI 建议):先 `SEMA_REGISTRY_DRY_RUN=true` 起一轮,看日志 `sema_registry_dry_run`(中心给的 models/roles/teams + 会否覆盖 default、per-model apiKeyEnv)对得上 env 再去掉该 flag 真正 apply。
@@ -412,14 +415,47 @@ curl -N http://<host>:8090/v1/tasks/stream -H 'content-type: application/json' \
 | HTTP `200` + `status:"completed"` | 成功 | 取 `result` |
 | `status:"blocked"` | agent 主动报卡住 | 看 `blockedReason`,补信息再发 |
 | `status:"failed"` + `errorCode:"conflict"` | 跨实例乐观锁丢失 | 直接重试(幂等) |
-| `status:"timeout"` | 超时 | 拆小任务 / 提高超时(服务端 `limits`) |
+| `status:"failed"` + `errorCode:"limits.max_walltime_exceeded"` | 墙钟到限(6.0.0 起 `status:"timeout"` 退役) | 拆小任务 / 提高 `limits.maxWalltimeMs`(毫秒) |
 | HTTP `401` | 缺 `Authorization` / 缺 `x-agent-principal`(要求时) | 补头 |
 | HTTP `403` / `404`(session/run) | 不是该 principal 的资源 | 用正确身份 |
 | HTTP `409`(`/v1/runs`) | 同 session 已有活跃 run | 等它完成 / 用返回的 `activeTaskId` |
 | HTTP `429` | 限流 | 看 `Retry-After` 退避 |
+| HTTP `429` + `errorCode:"usage.window_exhausted"` | 部署级 token 治理窗耗尽(`USAGE_WINDOWS`) | 看响应体 `retryAfterSec` 退避;窗滑动/桶到期后放行 |
 | HTTP `501`(`/v1/runs`) | 内存模式不支持异步 | 配 MySQL 协议存储(`SESSION_BACKEND=mysql`) |
 
 **机器码**:每个 4xx/5xx 响应体都带一个 `errorCode`(与人类文案 `error` 并列),这是**唯一**该拿来做
 程序分支的字段——**别锚 `error` 文案**。前缀族固定:`auth.` / `request.` / `not_found.` / `conflict.` /
-`limit.` / `capability.`(本部署没接这个面)/ `feature.`(开关没开)/ `internal.` / `state.`;未知码按前缀
-兜底永远安全。完整码表见 `docs/ASSISTANT-WIRE-CONTRACT.md` §附录 A。
+`limit.` / `usage.`(部署级治理窗)/ `capability.`(本部署没接这个面)/ `feature.`(开关没开)/
+`internal.` / `state.`;未知码按前缀兜底永远安全。完整码表见 `docs/ASSISTANT-WIRE-CONTRACT.md` §附录 A。
+
+### 9.1 limits.approachNotice(6.1.0 起)
+
+引擎默认在上下文用量到 80%/95% 时各注入一次接近提示(SSE 上是 `steering_injected` 帧、
+`source:"limit_approach"`)。批处理场景嫌噪声:`limits:{approachNotice:false}` 关闭;调阈:
+`limits:{approachNotice:{at:[0.5,0.9]}}`(两分数 (0,1] 且 r1<=r2,相等合法;坏形 400 点名)。
+
+### 9.2 部署级 token 治理窗(USAGE_WINDOWS,6.1.0 起)
+
+跨任务的滑动 token 预算(core `usageWindows`),缺省不设=关。单键 JSON 数组:
+
+```bash
+USAGE_WINDOWS='[{"windowMs":18000000,"maxTokens":5000000,"anchor":"first-use"}]'   # 5h 窗 500 万 token
+# anchor:"first-use"=首次消费开桶、到期重开;"rolling"=滑动窗(最近 windowMs 内的消费之和)
+```
+
+- **key 语义是 per-key 而不是一口总锅**:带 principal 的请求计到各自 principal 的窗,匿名请求计到
+  GLOBAL 锅——`REQUIRE_PRINCIPAL=false` 的混流部署下,总放行量=(principal 数+1)×maxTokens。要 fleet
+  级总闸请用 quota/lease 面(那是按部署计费轴)。同一调用方有时带凭证有时不带,会在两口锅间劈叉计数。
+- 耗尽:提交面立即 `429 usage.window_exhausted`(体 `retryAfterSec` + `Retry-After` 头);已受理的
+  任务撞窗时,基建合格(checkpoint+durable approval)⇒ suspend(reason `usage_window`)等窗放行,
+  不合格 ⇒ 响亮失败同码落终态记录。
+- 计量覆盖:主任务、具名/委托 subagent、hook 内部任务全计(部署真花销都进窗)。
+- 坏形 `USAGE_WINDOWS` 拒启(fail-loud 点名第几项);**改窗形≈重开账**(first-use 桶按 windowMs
+  配对,改了窗长老桶下次记账即弃)。
+- 存储:SQL 后端=跨副本一致(`usage_window` 表,行锁守恒);local=文件;纯内存 dev=进程内。
+
+### 9.3 沙箱寿命声明(6.1.0 起)
+
+k8s 沙箱(pod `activeDeadlineSeconds` 真硬死线)向引擎声明 `lifetimeMs`——死线前 ~60s 引擎在 turn
+边界尝试 suspend(reason `env_lifetime`,基建合格时)而不是被平台杀在半途;单个 >60s 的工具调用仍可能
+冲过该窗口,声明是尽力座不是保证。e2b 沙箱有 keepalive 滚动续期、无固定死线,不声明(行为不变)。

package/dist/bench/s1/arms.js

@@ -76,8 +76,8 @@ function emptyCostBreakdown() {
  * measurement was reward-hackable and never trustworthy) is ALSO non-scorable → excluded, never a withhold-credit.
  */
 export function classifyRunStatus(input) {
-    if (input.status === "failed" || input.status === "timeout")
-        return "infra-failed";
+    if (input.status === "failed")
+        return "infra-failed"; // core 5.8.0:status "timeout" 退役(walltime 形并入 failed)
     if (input.repairTerminal === "oracle.unprotected")
         return "infra-failed"; // broken/un-isolated oracle → not scorable
     return "scored";

package/dist/boot/resolve-spec.js

@@ -624,7 +624,30 @@ export function createResolveSpec(ctx) {
                 // 该字段,叠一条 host-declared 字符串值=同键双条矛盾帧(by-key 投影抹掉权威来源)。server 只
                 // 声明自己命名空间的键;来源语义(caller vs 墙钟)由 timeoutSec 的 spec provenance + 上面的
                 // Cap 声明组合可读。
-                return { ...(limits !== undefined ? { limits } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
+                // core 5.8.0:预算族(maxCostUsd/maxTokens/degrade)从 TaskSpec 顶层迁入 limits——顶层键已删,
+                // 继续写顶层=经宽类型静默死键(E-HIGH-1 病族)。wire 面不变:body 顶层 maxCostUsd/maxTokens 照收
+                //(SDK 在发),装配目标改到 limits。budgetStreamCancel 语义照 core 默认(maxCostUsd 在场即 true)。
+                const maxCostUsd = cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd);
+                const maxTokens = cappedCeiling(body.maxTokens, config.maxTaskTokens);
+                const degrade = (() => {
+                    if (!config.degrade || maxCostUsd === undefined)
+                        return undefined;
+                    if (Array.isArray(body.images) && body.images.length > 0 && !config.degrade.toSupportsImages) {
+                        // S14 (SILENT-FALLBACK P0-f): this drop was undetectable — the task keeps its vision-capable main
+                        // model and near-budget it hard-fails on cost instead of degrading. Surface it.
+                        metrics.inc("degrade_dropped_total", { reason: "vision_target" });
+                        logger.warn("degrade_dropped", { reason: "vision_target", model: picked.model, images: body.images.length });
+                        return undefined;
+                    }
+                    return { to: config.degrade.to, atCostFraction: config.degrade.atCostFraction };
+                })();
+                const merged = {
+                    ...(limits ?? {}),
+                    ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
+                    ...(maxTokens !== undefined ? { maxTokens } : {}),
+                    ...(degrade !== undefined ? { degrade } : {}),
+                };
+                return { ...(Object.keys(merged).length > 0 ? { limits: merged } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
             })(),
             // design/129: the TOC/interactive posture (single-user turnkey — the shell's
             // session lane) defaults background children to SESSION scope = CC Backgrounded semantics (a bg Agent/
@@ -632,30 +655,8 @@ export function createResolveSpec(ctx) {
             // deployments keep core's "task" default (no orphans burning tokens). Caller-trusted spec field
             // (systemPrompt tier), NEVER read from the request body. Same tenancy predicate as the wall clock above.
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
-            // ⑤ Per-task budget gate (1.37): honor a caller's requested ceiling but CAP it to the operator
-            // ceiling (a request can ask for less, never more). core fails the task with errorCode budget.*
-            // when crossed. budgetStreamCancel defaults true when maxCostUsd is set.
-            maxCostUsd: cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd),
-            maxTokens: cappedCeiling(body.maxTokens, config.maxTaskTokens),
-            // 1.40 near-budget degradation: only meaningful with a cost ceiling (the fraction is of it).
-            // When this task has one, switch to the cheaper model at atCostFraction instead of hard-failing.
-            // vision precheck (adversarial-review finding): DROP degrade for an image-carrying task when the
-            // degrade TARGET can't read images (toSupportsImages=false). The precheck only sees the picked model, not the
-            // external degrade target — so without this a runtime degrade would send the images to a text-only gateway (the
-            // opaque 400 the precheck prevents). The task keeps its vision-capable main model; near-budget it hard-fails on
-            // cost instead of image-failing. MODEL_DEGRADE_TO_VISION=true opts back in.
-            degrade: (() => {
-                if (!config.degrade || cappedCeiling(body.maxCostUsd, config.maxTaskCostUsd) === undefined)
-                    return undefined;
-                if (Array.isArray(body.images) && body.images.length > 0 && !config.degrade.toSupportsImages) {
-                    // S14 (SILENT-FALLBACK P0-f): this drop was undetectable — the task keeps its vision-capable main
-                    // model and near-budget it hard-fails on cost instead of degrading (rationale above). Surface it.
-                    metrics.inc("degrade_dropped_total", { reason: "vision_target" });
-                    logger.warn("degrade_dropped", { reason: "vision_target", model: picked.model, images: body.images.length });
-                    return undefined;
-                }
-                return { to: config.degrade.to, atCostFraction: config.degrade.atCostFraction };
-            })(),
+            // ⑤ Per-task budget gate + 1.40 near-budget degrade:core 5.8.0 起全部在 limits(上方 IIFE 合成),
+            // 顶层键已随 core 类型删除。
             // Long-term memory (design/138 S1): enabled when the memory ENGINE is wired AND a scope was derived
             // (single-user only — multi-tenant derives none, memory dark). MF-30 PAUSE (option B, per-request —
             // clay 2026-06-27 confirmed with core): `body.memoryWrite:false` makes THIS run read-only over memory

package/dist/boot/runner-deps.d.ts

@@ -34,6 +34,8 @@ export interface RunnerDepsCtx {
     rosterStore: RunnerDeps["rosterStore"];
     backgroundAgentStore: RunnerDeps["backgroundAgentStore"];
     mailboxStore: RunnerDeps["mailboxStore"];
+    /** design/166-T1:治理窗账本店(USAGE_WINDOWS 配置时才在场;与 config.usageWindows 成对进 deps)。 */
+    usageWindowStore: RunnerDeps["usageWindowStore"];
     brain: ReturnType<typeof createBrain>;
     pricing: ReturnType<typeof buildPricing>;
     tracer: ReturnType<typeof createTracer>;
@@ -66,7 +68,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -95,7 +97,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "sessionPolicyStore" | "usageWindowStore">;
 export declare function createSharedRunnerDeps(ctx: SharedRunnerDepsCtx): SharedRunnerDeps;
 export declare function createRunnerDeps(ctx: RunnerDepsCtx): RunnerDeps;
 //# sourceMappingURL=runner-deps.d.ts.map

package/dist/boot/runner-deps.js

@@ -49,6 +49,12 @@ export function createSharedRunnerDeps(ctx) {
         // E6: operator-tightened session tool rules — core folds them into the ToolPolicy FIRST (subtract-only) for tasks
         // carrying a sessionId (a delegated subagent has none → inherits no rules). Opt-in: undefined ⇒ no rules read.
         sessionPolicyStore: ctx.sessionPolicyStore ? ctx.sessionPolicyStore : undefined,
+        // design/166-T1:治理窗两键**成对**且进共享基座——主/sub/hook 三 runner 全覆盖(漏挂 subRunner=
+        // 子代用量不进窗,治理可被 subagent 刷穿;双记不存在:core stats.nested 是旁路侧栏不折入
+        // stats.tokens,governance.commit 是 per-任务 delta 制)。store 只在 config.usageWindows 配置时
+        // 构造(boot/stores.ts),两键同真同假。
+        usageWindows: ctx.config.usageWindows ? ctx.config.usageWindows : undefined,
+        usageWindowStore: ctx.usageWindowStore ? ctx.usageWindowStore : undefined,
     };
     return shared;
 }

package/dist/boot/stores.d.ts

@@ -28,5 +28,6 @@ export declare function openStores(ctx: OpenStoresCtx): Promise<{
     memorySyncRunner: MemorySyncRunner | undefined;
     sessionStore: import("@sema-agent/core").SessionStore;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
 }>;
 //# sourceMappingURL=stores.d.ts.map

package/dist/boot/stores.js

@@ -13,7 +13,7 @@
  *  3. `breakerState` 放在段尾:brain(下一段)要它,而它要 backend。
  */
 import { join } from "node:path";
-import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore } from "@sema-agent/core";
+import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore } from "@sema-agent/core";
 import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
 import { PgMemoryEngineBackend, ensurePgMemoryEngineSchema } from "../plugins/memory-engine-pg.js";
 import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugins/memory-engine-tidb.js";
@@ -22,6 +22,7 @@ import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySch
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
+import { PgUsageWindowStore, TiDBUsageWindowStore, ensurePgUsageWindowSchema, ensureTiDBUsageWindowSchema } from "../plugins/usage-window-store-sql.js";
 import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterSchema } from "../plugins/roster-store-sql.js";
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
@@ -261,6 +262,31 @@ export async function openStores(ctx) {
         if (mailboxStore)
             logger.info("mailbox_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
     }
+    // design/166-T1:治理窗账本店——只在 USAGE_WINDOWS 配置时构造(两键成对进 RunnerDeps,core 的
+    // 「windows 有 store 无=INACTIVE 警告」在构造上被排除)。形态跟 mailbox:tidb/pg=SQL twins
+    // (ensure-first+行锁,真双库验证,usage-window-store-sql.ts 顶注);local=core FileUsageWindowStore
+    // (构造器内部自拼 usage-windows/,直传数据根——复审新6);纯内存 dev=core InMemoryUsageWindowStore
+    // (进程内计数,单进程 dev 的诚实形——治理窗设了就得生效,不因无持久层而静默失活)。
+    let usageWindowStore;
+    if (config.usageWindows) {
+        const mysqlPool = backend?.mysqlPool?.();
+        const pgPool = backend?.pgPool?.();
+        if (pgPool) {
+            await ensurePgUsageWindowSchema(async (text, params) => pgPool.query(text, params));
+            usageWindowStore = new PgUsageWindowStore(pgPool);
+        }
+        else if (mysqlPool) {
+            await ensureTiDBUsageWindowSchema(mysqlPool);
+            usageWindowStore = new TiDBUsageWindowStore(mysqlPool);
+        }
+        else if (backend?.kind === "local") {
+            usageWindowStore = new FileUsageWindowStore(config.localDataRoot ?? localRoot);
+        }
+        else {
+            usageWindowStore = new InMemoryUsageWindowStore();
+        }
+        logger.info("usage_window_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : backend?.kind === "local" ? "file" : "memory", windows: config.usageWindows.length });
+    }
     // 142-S5 §1.4: the per-scope export READ face lights up only on the DB memory plane (the multi-tenant
     // truth lives in the scope-partitioned tables; the file posture exports by copying the memory dir, so
     // the route 501s honestly there). History-table WRITE wiring: inside the backend construction above
@@ -365,6 +391,7 @@ export async function openStores(ctx) {
     return {
         backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore,
         taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState,
+        usageWindowStore,
     };
 }
 //# sourceMappingURL=stores.js.map

package/dist/capabilities/code-review-council.js

@@ -86,7 +86,7 @@ async function runLensReviews(subRunner, repoTools, objective, signal, lenses) {
             modelRole: "subagent",
             tools: repoTools,
             systemPrompt: lensSystem(lens),
-            limits: { timeoutSec: 180 },
+            limits: { maxWalltimeMs: 180_000 },
             enableBlockedReport: false,
             signal,
         });
@@ -113,7 +113,7 @@ async function runConvergence(subRunner, repoTools, objective, findings, opts, s
             tools: repoTools, // members may verify a disputed claim against the real code (Tool-MAD)
             maxTranscriptTokens: 8000,
             synthesizer: { role: "arbiter", systemPrompt: ARBITER_SYSTEM },
-            limits: { timeoutSec: 400 },
+            limits: { maxWalltimeMs: 400_000 },
             signal, // 1.28: a parent abort now cascades into the debate members
         });
         // 1.32: synthesizer 两次都失败时 `conclusion` 是 `[unavailable…]` 垃圾串，与真结论无法区分。别当结论
@@ -134,7 +134,7 @@ async function runConvergence(subRunner, repoTools, objective, findings, opts, s
         // The arbiter grounds/dedups/ranks — keep it on the strong `synthesize` role (= main model).
         modelRole: "synthesize",
         systemPrompt: ARBITER_SYSTEM,
-        limits: { timeoutSec: 240 },
+        limits: { maxWalltimeMs: 240_000 },
         enableBlockedReport: false,
         signal,
     });

package/dist/capabilities/team.js

@@ -68,7 +68,7 @@ export function createTeamTool(subRunner, template, opts) {
                     ? { role: template.synthesizer.role, ...(template.synthesizer.model ? { model: template.synthesizer.model } : {}), modelRole: template.synthesizer.modelRole, systemPrompt: template.synthesizer.systemPrompt ?? "" }
                     : undefined,
                 maxTranscriptTokens: 8000,
-                limits: { timeoutSec: 600 },
+                limits: { maxWalltimeMs: 600_000 },
                 signal: ctx.signal, // 1.28: a team abort now cascades into the member runs (review D)
             });
             ctx.reportUsage?.({ tokens: team.stats.tokens, turns: team.stats.turns, tasks: template.members.length * template.rounds + 1 });

package/dist/config-types.d.ts

@@ -642,6 +642,16 @@ export interface ServiceConfigFlat {
      *  Running rows are never reaped (that is the orphan-grace sweep's job). Default 30 days, floor 1m.
      *  `WORKFLOW_RUN_RETENTION_MS`. */
     workflowRunRetentionMs: number;
+    /** design/166-T1 — core 5.8.0 部署级 token 治理窗(`RunnerDeps.usageWindows`):滑动窗内跨任务
+     *  token 预算,key=principal(缺席=GLOBAL 一口锅,per-key 各一份额度——混流部署语义见 USAGE.md)。
+     *  `USAGE_WINDOWS` 单键 JSON 数组(每项 {windowMs,maxTokens,anchor:"first-use"|"rolling"});
+     *  缺省未设=关(零行为变化)。fail-loud:坏 JSON/空数组/非正整数/未知 anchor → boot throw
+     *  (parseUsageWindows)。窗形变更≈重开账(first-use 桶按 windowMs 配对,老桶下次 charge 即弃)。 */
+    usageWindows?: readonly {
+        windowMs: number;
+        maxTokens: number;
+        anchor: "first-use" | "rolling";
+    }[];
     /** core 1.364 durable background agents([1503] 提货单③):reaper 经 `TaskRegistry.reapDurableAgents`
      *  (联合 reap——条件删赢了才 release 转录 session;裸 store.reap 会 strand 转录)按 scope 清 TERMINAL
      *  `a*` 行,老于此值的删。SQL twins 走 DISTINCT-scope 枚举;local FileBackgroundAgentStore 单租户
@@ -888,7 +898,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.d.ts

@@ -11,6 +11,15 @@ export type { ServiceConfig, ScopedMcpServer, ImageBakeConfig, ServiceConfigFlat
  *  config overlay (config-center/facade.ts `applyRuntimeHot`) can re-derive the ENV BASELINE to revert to when center
  *  stops managing `autonomy` (a stale center override must not stick — see applyRuntimeHot). */
 export declare function parseAutonomy(raw: string | undefined): Autonomy | undefined;
+/** design/166-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
+ *  封闭形)。unset/空串 → undefined(关)。fail-loud 族(numEnv 同纪律):坏 JSON/非数组/空数组/
+ *  非正有限整数/未知 anchor 全部 boot throw 点名——「设了但无意义」静默关掉=部署方以为有治理实际没有。
+ *  server 严于 core(core 允 maxTokens=0=恒拒锅;这里要求正整数,0 配置显然是笔误不是意图)。 */
+export declare function parseUsageWindows(raw: string | undefined): readonly {
+    windowMs: number;
+    maxTokens: number;
+    anchor: "first-use" | "rolling";
+}[] | undefined;
 /** Numeric env with validation: a non-numeric value FAILS at startup instead of silently becoming `NaN`
  *  (which e.g. slips past the `runStaleSec` liveness guard and silently disables the reaper). */
 export declare function numEnv(name: string, fallback: string): number;

package/dist/config.js

@@ -26,6 +26,34 @@ export function parseAutonomy(raw) {
     }
     return v;
 }
+/** design/166-T1 — parse `USAGE_WINDOWS`(单键 JSON 数组;逐窗散键在窗数可变时组合爆炸,JSON 是唯一
+ *  封闭形)。unset/空串 → undefined(关)。fail-loud 族(numEnv 同纪律):坏 JSON/非数组/空数组/
+ *  非正有限整数/未知 anchor 全部 boot throw 点名——「设了但无意义」静默关掉=部署方以为有治理实际没有。
+ *  server 严于 core(core 允 maxTokens=0=恒拒锅;这里要求正整数,0 配置显然是笔误不是意图)。 */
+export function parseUsageWindows(raw) {
+    const v = raw?.trim();
+    if (!v)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(v);
+    }
+    catch (e) {
+        throw new Error(`env USAGE_WINDOWS is not valid JSON: ${String(e)} — expected e.g. [{"windowMs":18000000,"maxTokens":5000000,"anchor":"first-use"}]`);
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0) {
+        throw new Error(`env USAGE_WINDOWS must be a NON-EMPTY JSON array of {windowMs,maxTokens,anchor} (an empty array is a governance no-op nobody chose — unset the env to turn windows off)`);
+    }
+    const out = parsed.map((w, i) => {
+        const o = w;
+        const posInt = (n) => typeof n === "number" && Number.isInteger(n) && n > 0;
+        if (typeof w !== "object" || w === null || !posInt(o.windowMs) || !posInt(o.maxTokens) || (o.anchor !== "first-use" && o.anchor !== "rolling")) {
+            throw new Error(`env USAGE_WINDOWS[${i}] is invalid: expected {windowMs: positive int ms, maxTokens: positive int, anchor: "first-use"|"rolling"} (got ${JSON.stringify(w)})`);
+        }
+        return Object.freeze({ windowMs: o.windowMs, maxTokens: o.maxTokens, anchor: o.anchor });
+    });
+    return Object.freeze(out);
+}
 /** Resolve a CSV of env-var NAMES into a {NAME: value} map from THIS process's env (out-of-band secret
  *  forwarding into a sandbox). A name with no value set is skipped (not forwarded as undefined). The values
  *  are secrets — they live only in the returned map (in-memory), never logged. */
@@ -1023,6 +1051,8 @@ function parseOrchestrationDomain(ctx) {
         throw new Error(`WORKFLOW_SIZE_GUIDELINE must be small|medium|large|unrestricted, got "${workflowSizeGuidelineRaw}"`);
     }
     const workflowSizeGuideline = workflowSizeGuidelineRaw;
+    // design/166-T1:治理窗(fail-loud 解析;unset=undefined=关)。
+    const usageWindows = parseUsageWindows(process.env.USAGE_WINDOWS);
     const bakeRunnerPrincipal = env("BAKE_RUNNER_PRINCIPAL", "system:bake-runner");
     // ── design/158 B4 ② — the four knobs whose canonical name went from negative to positive. Only the first
     // lands on `ServiceConfig`; the other three are read lazily at their use sites (main.ts's LKG gate,
@@ -1193,6 +1223,7 @@ function parseOrchestrationDomain(ctx) {
         workflowOrphanGraceMs: Math.max(60_000, numEnv("WORKFLOW_ORPHAN_GRACE_MS", String(24 * 60 * 60 * 1000))), // SVC-1: 24h default, floor 1m
         workflowJournalRetentionMs: Math.max(60_000, numEnv("WORKFLOW_JOURNAL_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000))), // SVC-2: 7d default, floor 1m
         workflowRunRetentionMs: Math.max(60_000, numEnv("WORKFLOW_RUN_RETENTION_MS", String(30 * 24 * 60 * 60 * 1000))), // 30d default, floor 1m; SQL twins only
+        ...(usageWindows ? { usageWindows } : {}), // design/166-T1:USAGE_WINDOWS 治理窗(fail-loud 已在 parseUsageWindows)
         backgroundAgentRetentionMs: Math.max(60_000, numEnv("BG_AGENT_RETENTION_MS", String(7 * 24 * 60 * 60 * 1000))), // core 1.364: 7d default, floor 1m
         backgroundAgentStaleRunningMs: Math.max(10 * 60_000, numEnv("BG_AGENT_STALE_RUNNING_MS", String(15 * 60_000))), // core 契约 ≥10min 硬钳(60s 写者心跳)
         backgroundAgentParkClaimStaleMs: Math.max(60_000, numEnv("BG_AGENT_PARK_CLAIM_STALE_MS", String(60 * 60_000))), // [1575] F1 修:default 1h,floor 1m(零/负值都不该让整块清算失活)
@@ -1334,7 +1365,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "remoteExec", "worktreeIsolation", "leaderEnabled", "leaderFanoutEnabled", "routerEnabled", "selfOrchestrationEnabled",
     "selfOrchestrationModels", "selfOrchestrationWorkerIsolation", "forkEnabled", "experimentalObserverAgents",
     "schedulerEnabled", "schedulerSessionWakeup", "schedulerSessionLifetime", "schedulerStorePath", "planModeEnabled", "workflowRunStoreBackend",
-    "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "workflowAgentsReadOnly",
+    "workflowOrphanGraceMs", "workflowJournalRetentionMs", "workflowRunRetentionMs", "usageWindows", "workflowAgentsReadOnly",
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "rosterRetentionMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",

package/dist/http/route-ctx.d.ts

@@ -47,6 +47,8 @@ export interface RouteHelpers {
     rateLimited(req: IncomingMessage, res: ServerResponse): boolean;
     quotaExceeded(req: IncomingMessage, res: ServerResponse): boolean;
     leaseDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    /** design/166-T1:治理窗 pre-admission(异步 202 车道的唯一 429 出路;key 公式与 core 单源)。 */
+    usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
     isFleetWide(req: IncomingMessage): boolean;
     runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null): boolean;

package/dist/http/routes/runs.js

@@ -111,7 +111,7 @@ export async function handleRunVerbs(req, res, url, ctx) {
 async function handleRunsBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
     const { prepareSpec } = ctx.legs;
     const source = ctx.req.source;
     // Async run: create + return ids immediately, execute in the background.
@@ -171,7 +171,9 @@ async function handleRunsBody(req, res, url, ctx, miss) {
         }
         // 🔴 复审 C1:lease gate for a genuinely-NEW submission (past the idempotency replay above). Keyed on the
         // VERIFIED submitter = the principal billed for this run's spend (correct principal for the sync door).
-        if (await leaseDenied(req, res))
+        // design/166-T1:治理窗 pre-admission 同位(idempotency replay 之后——重放已建 run 必须拿回 202 收据,
+        // 不得因窗满改判 429;异步 202 车道的唯一 429 出路,core 进场拒是竞态窗兜底)。
+        if ((await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
             return;
         const resp = await idemCache.run(idemKey, async () => {
             const sessionId = prepared.spec.sessionId ?? uuidv7();
@@ -228,7 +230,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 rootTaskId: taskId,
                 ...fleetRunLabels(prepared.spec.objective), // BC-1: name = short objective preview (description = live-activity, set by the publisher onEvent tool_start)
             });
-            void runInBackground(deps.runner, { ...prepared.spec, sessionId }, runStore, taskId, deps.metrics, prepared.auth?.principal, prepared.verify, prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, prepared.spec.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, // E23: per-run elicitation context (onElicit routes inbound MCP elicitations to this run's stream)
+            void runInBackground(deps.runner, { ...prepared.spec, sessionId }, runStore, taskId, deps.metrics, prepared.auth?.principal, prepared.verify, prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, // E23: per-run elicitation context (onElicit routes inbound MCP elicitations to this run's stream)
             gatedPrincipal(req, deps.config) ?? null, // E23: the VERIFIED principal that may answer (same source the respond gate uses — never the spoofable header)
             captureTurnAnchor, // E18: per-turn (message eventId → leaf entryId) anchor capture
             fleetPub, // MF-Fleet: the run-scoped fleet-row publisher (onStart/onEvent/onTerminal across all legs)
@@ -461,7 +463,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             // 并发腿可能先终态化(如 approval.expired),我方写打空却仍答 "cancelled" 就是响应与账本不一致。
             // 写后复读,照实际行应答(锁一样释放了;谁先写赢谁的 errorCode)。
             const finalRow = await rs.getRun(taskId).catch(() => undefined);
-            if (finalRow && finalRow.errorCode !== "cancelled" && (finalRow.status === "failed" || finalRow.status === "completed" || finalRow.status === "blocked" || finalRow.status === "timeout")) {
+            if (finalRow && finalRow.errorCode !== "cancelled" && (finalRow.status === "failed" || finalRow.status === "completed" || finalRow.status === "blocked")) {
                 sendJson(res, 202, { taskId, status: finalRow.status, errorCode: finalRow.errorCode ?? null, note: `session unlocked; the run was terminalized concurrently (${finalRow.errorCode ?? finalRow.status}) before this cancel's write — reporting the actual ledger state` });
                 return;
             }

package/dist/http/routes/tasks.js

@@ -22,7 +22,7 @@ export async function handleTasks(req, res, url, ctx) {
 async function handleTasksBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, cancelledViaVerb, steerableRuns, counters } = ctx.registry;
-    const { rateLimited, quotaExceeded, leaseDenied } = ctx.helpers;
+    const { rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
     const { prepareSpec, finalizeTaskResult } = ctx.legs;
     const reqState = ctx.req;
     const source = ctx.req.source;
@@ -61,7 +61,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             }
             return;
         }
-        if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
+        if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
             return;
         const prepared = await prepareSpec(req, res);
         if (!prepared)
@@ -1032,7 +1032,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     // (verify → cascade → plain)、短路语义、传参**逐字不变**;`runWithVerification` 仍是整对象
                     // 直传(快审 F1:cost 顶不在重建中丢失),`runCascade` 仍从操作员梯子 + 本任务预算现算配置。
                     const verifyLeg = (v) => runWithVerification(deps.runner, specWithSignal, v);
-                    const cascadeLeg = () => runCascade(deps.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.maxCostUsd));
+                    const cascadeLeg = () => runCascade(deps.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd));
                     const plainLeg = () => deps.runner.runTask(specWithSignal);
                     result = await withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg());
                 }

package/dist/http/server.d.ts

@@ -344,6 +344,10 @@ export interface ServiceGovernanceDeps {
     costQuota?: QuotaTracker;
     /** D4 AP:worker 侧 quota-lease admission(协商式;center lane 未配 = 缺席 = 零行为)。 */
     fleetLease?: FleetLeaseManager;
+    /** design/166-T1:治理窗账本店(USAGE_WINDOWS 配置时在场,与 config.usageWindows 成对)——提交面
+     *  pre-admission 读窗用(主力 /v1/runs 是 202 异步,core 进场拒发生在 202 之后永远变不成 429;
+     *  这里是异步车道唯一的 429 出路)。enforcement 真源在 core(RunnerDeps 同店),此门是快速座。 */
+    usageWindowStore?: import("@sema-agent/core").UsageWindowStore;
 }
 /** **部署自述面**:只被 /health、/v1/capabilities 与提交前置门读的部署事实(多为 live getter,
  *  不是快照——/health 必须回答「此刻」)。 */

package/dist/http/server.js

@@ -1,7 +1,7 @@
 import http from "node:http";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, HAND_TOOL_EFFECTS, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow } from "@sema-agent/core";
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, HAND_TOOL_EFFECTS, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs } from "@sema-agent/core";
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
@@ -10,7 +10,7 @@ import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
-import { validateTaskAgents } from "../spec-fields.js";
+import { normalizeApproachNotice, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
@@ -297,7 +297,7 @@ export function createHttpServer(rawDeps) {
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, leaseDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal() },
         // A9 尾批:提交/续跑「腿」只装引用(实现仍在本闭包里,逐字未动)——tasks/runs 共用 prepareSpec,
         // approvals/assistant/notify-wake 共用 resume 家族;走这一格才不会造出 routes/* 互相值 import 的环。
@@ -947,23 +947,40 @@ export function createHttpServer(rawDeps) {
         if (body.limits !== undefined) {
             const l = body.limits;
             if (typeof l !== "object" || l === null || Array.isArray(l)) {
-                sendError(res, 400, "request.field_invalid", "limits must be an object { timeoutSec?, maxOutputTokens?, maxTurns? } (positive integers)");
+                sendError(res, 400, "request.field_invalid", "limits must be an object { maxWalltimeMs?, maxOutputTokens?, maxTurns? } (positive integers)");
                 return null;
             }
-            for (const k of ["timeoutSec", "maxOutputTokens", "maxTurns"]) {
+            // core 5.8.0 时限重构:旧键响亮拒并点名替代(core 同姿势 config.limit_unknown_key;「勿自行兼容」是
+            // core 的公开指令)。timeoutSec(秒)→ maxWalltimeMs(毫秒,注意单位);deadline 族三 opt-out 随
+            // 机制整族退役(nudge/call-cap/graceful-finalize 已从引擎移除),无替代键。fresh fail-loud;resume
+            // 重放不过此门,normalizeLimits 对旧键 defensive DROP(存量 suspended 体降级为默认配速,方向安全)。
+            if (l.timeoutSec !== undefined) {
+                sendError(res, 400, "request.field_invalid", "limits.timeoutSec was retired in core 5.8.0 — use limits.maxWalltimeMs (milliseconds; opt-in wall clock)");
+                return null;
+            }
+            // 166-T3(靶4b):deadlineNudge 的替代=approachNotice(core RETIRED 表同源);另两键随机制退役无替代。
+            if (l.deadlineNudge !== undefined) {
+                sendError(res, 400, "request.field_invalid", "limits.deadlineNudge was retired in core 5.8.0 — use limits.approachNotice (default on at 80%/95%; false turns it off, {at: [r1, r2]} tunes thresholds)");
+                return null;
+            }
+            for (const k of ["callCapByDeadline", "gracefulFinalize"]) {
+                if (l[k] !== undefined) {
+                    sendError(res, 400, "request.field_invalid", `limits.${k} was retired in core 5.8.0 (the deadline-pacing mechanism family is gone; there is no replacement key — remove it)`);
+                    return null;
+                }
+            }
+            for (const k of ["maxWalltimeMs", "maxOutputTokens", "maxTurns"]) {
                 const v = l[k];
                 if (v !== undefined && (typeof v !== "number" || !Number.isInteger(v) || v < 1)) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} must be a positive integer`);
+                    sendError(res, 400, "request.field_invalid", `limits.${k} must be a positive integer${k === "maxWalltimeMs" ? " (milliseconds)" : ""}`);
                     return null;
                 }
             }
-            // 快审 F2(1.254):deadline 族三 opt-out 在场必须 literal false——"false"/0 等畸形值此前 200 后被
-            // normalizeLimits 静默丢=调用方以为关了其实恒开(B1 同类故障)。fresh fail-loud;resume 重放不过
-            // 此门,normalizeLimits 保持 defensive。
-            for (const k of ["deadlineNudge", "callCapByDeadline", "gracefulFinalize"]) {
-                const v = body.limits[k];
-                if (v !== undefined && v !== false) {
-                    sendError(res, 400, "request.field_invalid", `limits.${k} accepts only literal false (it is an opt-out; omit to keep the default-on behavior)`);
+            // 166-T3:approachNotice fresh-submit fail-loud(判据单源 normalizeApproachNotice,阈值规则对齐 core a<=b)。
+            {
+                const v = l.approachNotice;
+                if (v !== undefined && normalizeApproachNotice(v) === undefined) {
+                    sendError(res, 400, "request.field_invalid", "limits.approachNotice accepts false (turn off) or {at?: [r1, r2]} with fractions in (0, 1], r1 <= r2 (default on at 80%/95%)");
                     return null;
                 }
             }
@@ -2200,10 +2217,11 @@ export function createHttpServer(rawDeps) {
             deps.metrics?.inc("task_tokens_total", {}, result.stats.tokens);
         if (result.stats.cacheHitRate !== undefined)
             deps.metrics?.observe("task_cache_hit_rate", result.stats.cacheHitRate);
-        // ⑤ budget/limit cutoffs (1.37): count failures by their dotted code (budget.precall/exceeded,
-        // limit.timeout/max_turns) so an operator can alert on tenants hitting the cost/token ceiling.
+        // ⑤ budget/limit cutoffs:count failures by their dotted code — core 5.8.0 起统一 `limits.` 前缀
+        // (limits.max_{tokens,cost,turns,walltime}_exceeded;旧 budget.*/limit.* 双前缀同拍退役),
+        // operator 按此对租户撞顶告警。metric 名保留 budget_exceeded_total(时序连续性;code label 自述新码)。
         const code = result.errorCode;
-        if (code && (code.startsWith("budget.") || code.startsWith("limit."))) {
+        if (code && code.startsWith("limits.")) {
             deps.metrics?.inc("budget_exceeded_total", { code });
         }
         // Developer-mode verification gate (1.44): count the final verdict when this task was verified.
@@ -2266,6 +2284,35 @@ export function createHttpServer(rawDeps) {
         sendError(res, 429, "quota_exhausted", "budget exhausted (quota lease)", { retryAfterSec: adm.retryAfterSec, ...(adm.detail ?? {}) });
         return true;
     }
+    /** design/166-T1 — 治理窗 pre-admission(quotaExceeded/leaseDenied 的兄弟门):key 公式与 core 单源
+     *  (`principal || GLOBAL_USAGE_KEY`,GLOBAL_USAGE_KEY 引 core 公共导出防漂移;principal=verified,
+     *  spoofable header 不进键)。窗耗尽 → 429 + retryAfterSec(族形一致,秒上取整)+ Retry-After 头。
+     *  读窗失败(DB 瞬断/坏 record)→ warn + fail-open:enforcement 真源在 core 进场检查(同店同键,
+     *  会响亮拒),此门只是异步车道的 429 快速座——门故障不该把提交面整个拖死。admission-pass 与
+     *  core entry-拒之间存在竞态窗:该形落终态 run 记录(errorCode usage.window_exhausted),契约文档在案。 */
+    async function usageWindowDenied(req, res) {
+        const store = deps.usageWindowStore;
+        const windows = deps.config.usageWindows;
+        if (!store || !windows || windows.length === 0)
+            return false;
+        const key = gatedPrincipal(req, deps.config) || GLOBAL_USAGE_KEY;
+        let retryAfterMs;
+        try {
+            retryAfterMs = usageRetryAfterMs(await store.read(key, windows, Date.now()));
+        }
+        catch (e) {
+            deps.logger?.warn?.("usage_window_admission_read_failed", { error: e instanceof Error ? e.message : String(e) });
+            return false;
+        }
+        if (retryAfterMs === undefined)
+            return false;
+        deps.metrics?.inc("usage_window_rejected_total");
+        deps.logger?.info?.("usage_window_exhausted", { hasPrincipal: key !== GLOBAL_USAGE_KEY, retryAfterMs });
+        const retryAfterSec = Math.max(1, Math.ceil(retryAfterMs / 1000));
+        res.setHeader("retry-after", String(retryAfterSec));
+        sendError(res, 429, "usage.window_exhausted", "usage window exhausted (deployment token governance)", { retryAfterSec });
+        return true;
+    }
     /** Apply the per-principal rate limit; responds 429 and returns true when the caller is over. */
     function rateLimited(req, res) {
         if (!deps.rateLimiter)

package/dist/http/wire-types.d.ts

@@ -153,19 +153,18 @@ export interface TaskRequestBody {
     };
     /** design/132 (core 1.249): one-shot end-game verification nudge — opt-in by the AUTONOMY caller. */
     finalVerification?: boolean;
-    /** [854]④ per-request 配速(core spec.limits 全链:timeoutSec 墙钟 + deadlineNudge/callCapByDeadline/
-     *  gracefulFinalize;maxOutputTokens = 每次模型调用的输出上限;maxTurns = 上游 parity 的回合上限)。
-     *  三键均为正整数(0 拒绝:core 侧 timeoutSec>0 才生效,放行 0 会绕过运营方封顶)。与 `maxTokens`
-     *  (per-task 总 token 预算,cappedCeiling 车道)不同物 —— maxOutputTokens 是单次调用配速。
-     *  每键各自被可选 env 上限封顶(TASK_TIMEOUT_MAX_SEC / TASK_MAX_OUTPUT_TOKENS_MAX / TASK_MAX_TURNS_MAX,
-     *  缺省不设=不封顶);timeoutSec 缺席时保持既有 tenancy 墙钟姿势(resolveTaskLimits,spec-fields.ts)。 */
+    /** [854]④ per-request 配速——core 5.8.0 时限重构后的键集(#124):`maxWalltimeMs`(毫秒,opt-in 墙钟)/
+     *  `maxOutputTokens`/`maxTurns`,均正整数;可选运营方上限旋钮各自封顶(TASK_TIMEOUT_MAX_SEC 保**秒**义,
+     *  对毫秒键封顶 ×1000)。旧键 `timeoutSec` 与 deadline 族三 opt-out(机制退役)fresh-submit 400 响亮
+     *  点名替代;`maxWalltimeMs` 缺席时保持既有 tenancy 墙钟姿势(resolveTaskLimits,spec-fields.ts)。 */
+    /** 166-T3:approachNotice——core 默认 ON(80%/95% 各提示一次);false 关,{at:[r1,r2]} 调阈((0,1] 且 r1<=r2)。 */
     limits?: {
-        timeoutSec?: number;
+        maxWalltimeMs?: number;
         maxOutputTokens?: number;
         maxTurns?: number;
-        deadlineNudge?: false;
-        callCapByDeadline?: false;
-        gracefulFinalize?: false;
+        approachNotice?: false | {
+            at?: [number, number];
+        };
     };
     /** design/133 (core 1.251) + G1 (core 1.253): turn-boundary attachment reminders (todo / changed-files /
      *  plan-mode) + one-shot boundary notices (post-compaction background-task recap / deferred-tools delta).

package/dist/leader/fanout.d.ts

@@ -38,8 +38,8 @@ export interface WorkerReport {
      *  it up to its bound but it didn't fully complete — e.g. the overall deadline hit or the slice cap). Present
      *  ⇒ resumable: the operator/leader can escalate (more budget) or accept the belt-diff partial progress. */
     checkpointGate?: TaskResult["checkpointGate"];
-    /** design/74 Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `budget.exceeded` on an exhausted
-     *  resume, `limit.max_turns`) — surfaced for /v1/leader observability. */
+    /** design/74 Slice 6: the worker's terminal `TaskResult.errorCode` (e.g. `limits.max_cost_exceeded` on an
+     *  exhausted resume, `limits.max_turns_exceeded` — core 5.8.0 码名轴) — surfaced for /v1/leader observability. */
     errorCode?: TaskResult["errorCode"];
     /** LEADER-REPAIRLOOP-INTEGRATION §10.6 (THE push chokepoint): the `runRepairLoop` terminal a single-agent
      *  worker resolved to, when the repair loop ran on this worker (LEADER_REPAIR_LOOP on). It MUST ride on the

package/dist/leader/leader.js

@@ -108,7 +108,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                             // Map the TaskResult status directly (like fanOut's own mapStatus) — a `suspended` result that the
                             // auto-resume left unresumed (a non-resource gate, e.g. human-approval) stays `suspended` so the
                             // leader's C4 surface/cancel reaction still fires; only completed/timeout pass through, else failed.
-                            status: r.status === "completed" ? "completed" : r.status === "suspended" ? "suspended" : r.status === "timeout" ? "timeout" : "failed",
+                            status: r.status === "completed" ? "completed" : r.status === "suspended" ? "suspended" : "failed", // core 5.8.0:TaskResult 无 "timeout"(内部词表的 timeout 仍由 fanout 墙钟臂生产)
                             stats: r.stats,
                             ...(r.status === "completed" ? {} : { error: r.errorMessage ?? r.blockedReason ?? `worker ${r.status}` }),
                             ...(r.checkpointGate ? { checkpointGate: r.checkpointGate } : {}),

package/dist/leader/wire.js

@@ -134,7 +134,8 @@ export function leaderResourceConfig(env = process.env) {
         leaderTimeoutMs,
         workerMaxTurns,
         workerBudgetUsd,
-        workerLimits: { limits: { maxTurns: workerMaxTurns, timeoutSec: Math.floor(leaderTimeoutMs / 1000) }, maxCostUsd: workerBudgetUsd },
+        // core 5.8.0:预算四键全入 limits(顶层 maxCostUsd 删);walltime 原生毫秒不再除
+        workerLimits: { limits: { maxTurns: workerMaxTurns, maxWalltimeMs: leaderTimeoutMs, maxCostUsd: workerBudgetUsd } },
         presignTtlSec: Math.ceil(leaderTimeoutMs / 1000) + 600, // URL/sandbox must outlive the worker (BUG1/BUG2)
         ...(resourceSuspendOn
             ? {
@@ -223,8 +224,7 @@ export function createLeaderRunner(cfg) {
                         .runTaskStream({
                         objective,
                         sessionId: `leader-repair-${Date.now()}-${round}`,
-                        maxCostUsd: repairBudgetUsd,
-                        limits: { timeoutSec: Math.max(300, Math.floor(leaderTimeoutMs / 1000 / 2)) },
+                        limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
                     })
                         .result();
                     // A non-completed repair (timeout/abort) may leave a process alive in the SAME Kata pod that would race
@@ -281,8 +281,7 @@ export function createLeaderRunner(cfg) {
                         .runTaskStream({
                         objective,
                         sessionId: `leader-conflict-${Date.now()}-${round}`,
-                        maxCostUsd: repairBudgetUsd,
-                        limits: { timeoutSec: Math.max(300, Math.floor(leaderTimeoutMs / 1000 / 2)) },
+                        limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
                     })
                         .result();
                     if (res.status !== "completed")
@@ -422,7 +421,10 @@ export function createLeaderRunner(cfg) {
                 resourceSpec = {
                     checkpointStore: cfg.durable.checkpointStore,
                     resourceSuspend: { scope: `_leader-resource-${sub.workerId}`, totalBudgetUsd: resourceCfg.totalBudgetUsd },
-                    maxCostUsd: resourceCfg.sliceMaxCostUsd,
+                    // core 5.8.0:maxCostUsd 入 limits 后,本 spread(spec: {...workerLimits, ..., ...resourceSpec})的
+                    // limits 键是**整体覆盖**——必须显式并回 workerLimits.limits(maxTurns/maxWalltimeMs),否则
+                    // per-slice 覆盖会顺手把 worker 的轮数/墙钟界丢掉(5.7 时代顶层键覆盖顶层键,无此陷阱)。
+                    limits: { ...workerLimits.limits, maxCostUsd: resourceCfg.sliceMaxCostUsd },
                     maxSuspends: resourceCfg.maxSuspends,
                 };
             }

package/dist/main.js

@@ -158,7 +158,7 @@ async function main() {
     await configCenter.applyLocalRemoteExec();
     // design/158 A10:持久层装配搬到 src/boot/stores.ts(逐字)。⚠️ 该段就地归一 `config.sessionBackend`
     // 且承载三条 fail-loud 拒启断言 —— 位置即契约,理由见该文件头注。
-    const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, } = await openStores({ config, logger, metrics, localRoot });
+    const { backend, storeBackendDegraded, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, } = await openStores({ config, logger, metrics, localRoot });
     // design/158 A10:计费/追踪/预算装配搬到 src/boot/budget-tracing.ts(逐字;tracer 与 side-query 同 sink 实例的
     // 「同段构造」契约见该文件头注)。
     const { brain, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker, fleetUsage, fleetLease, tracer, sideQueryAccounting, toolResultStore, sessionPolicyStore, fileSnapshotStore, } = createBudgetAndTracing({ config, logger, metrics, backend, breakerState });
@@ -185,7 +185,7 @@ async function main() {
     const { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver } = createRuntimeCaps({ config, logger });
     // design/158 A10:RunnerDeps 装配段搬到 src/boot/runner-deps.ts(逐字;runStore 晚绑改取值,见该文件头注)。
     const runnerDeps = createRunnerDeps({
-        config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, brain,
+        config, logger, metrics, localRoot, promptSource: configCenter.promptSource, rosterStore, backgroundAgentStore, mailboxStore, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         memorySyncRunner, toolResultStore, sessionPolicyStore, runtimeCapsResolver, fileSnapshotStore,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
@@ -228,8 +228,8 @@ async function main() {
                 model: pick.catalogRef,
                 handsReadOnly: true,
                 enableFork: false,
-                maxCostUsd: 0.05,
-                limits: { maxTurns: 10, timeoutSec: Math.max(30, Math.ceil(timeoutMs / 1000)) },
+                // core 5.8.0:预算四键全入 limits(顶层 maxCostUsd 删);timeoutSec(秒)→ maxWalltimeMs(毫秒,原生同单位)
+                limits: { maxTurns: 10, maxCostUsd: 0.05, maxWalltimeMs: Math.max(30_000, timeoutMs) },
                 // spec 无 toolPolicy → core `hasEffectAwareGate` 为假 → 每次 agent hook 触发一条
                 // error 级 UNGATED 警告(非致命但纯噪声)。挂已裁决的 auto-accept 基线(与 singleUserAutoAcceptBaseline
                 // 同构;hook 子代理本就 handsReadOnly + 单用户信任面,auto-accept 是既定姿态,只是让闸机制在场)。
@@ -329,6 +329,7 @@ async function main() {
             deploymentHooks,
             toolResultStore,
             sessionPolicyStore,
+            usageWindowStore,
         }),
         // ── 以下为 subRunner 差异键(不在共享基座;逐个有因)──────────────────────────────────────
         sessionStore: subRunnerSessions, // 子代转录=私有短 TTL fork 路由店,生命周期异于宿主 durable 店
@@ -800,6 +801,7 @@ async function main() {
         rateLimiter,
         costQuota,
         fleetLease: fleetLease ? fleetLease : undefined, // lease admission 门(提交面,镜像 quotaExceeded)
+        usageWindowStore: usageWindowStore ? usageWindowStore : undefined, // design/166-T1:治理窗 pre-admission(与 RunnerDeps 同店同键)
     };
     // B1 活体 store 探测环(门与判据见 store-live-probe.ts 头注;探针原语=既有 S10 dbNowMs 真 DB 往返)
     const storeLiveProbe = backend && backend.kind !== "local" && backend.dbNowMs && config.storeProbeIntervalMs > 0

package/dist/plugins/remote-env-host.js

@@ -534,27 +534,8 @@ export class RemoteHostExecutionEnv {
                 env: this.mergeEnv(options?.env),
                 ...spawnGroupOptions(),
             });
-            // core 1.321 cut-kill registry(三轮复审存量缺口):把杀柄交给上层(Bash 工具 cut 时强制终杀);
-            // 柄内 still-running 守卫(exitCode/signalCode)防对已亡组的 pgid 复用误杀(core 参考实现同语义)。
-            if (options?.onSpawn && child.pid != null) {
-                const spawnedPid = child.pid;
-                try {
-                    options.onSpawn({ pid: spawnedPid, kill: () => {
-                            if (child.exitCode !== null || child.signalCode !== null)
-                                return;
-                            try {
-                                killTreeHard(spawnedPid);
-                            }
-                            catch {
-                                try {
-                                    child.kill("SIGKILL");
-                                }
-                                catch { /* noop */ }
-                            }
-                        } });
-                }
-                catch { /* registry 回调失败不挡 exec(core 同姿势吞) */ }
-            }
+            // core 5.8.0:cut-kill registry seam(onSpawn/onDetachAdopted)随 tool-cut 机制退役(core 零生产者,
+            // 本臂为死码删除;1.321 时代的 still-running 守卫语义随之谢幕)。
             const finish = (r) => {
                 if (settled)
                     return;
@@ -629,11 +610,6 @@ export class RemoteHostExecutionEnv {
                     clearTimeout(forceSettleTimer);
                 options?.abortSignal?.removeEventListener("abort", onAbort);
                 settled = true;
-                // cut-kill registry 注销(所有权已移交 bgManager——cut 不该再杀后台 shell;core 参考实现同位)。
-                try {
-                    options?.onDetachAdopted?.();
-                }
-                catch { /* noop */ }
                 resolve(ok({ stdout: seedOut, stderr: seedErr, exitCode: 0, detached: { shellId } }));
             };
             // Named (not inline) so onDetach can `off` them when it hands the pipes to the adopted background shell.
@@ -874,26 +850,7 @@ export class RemoteHostExecutionEnv {
                 throw e;
             }
             closeSpoolFds(); // 父进程的 fd 副本立即关(文件 size/EOF 只反映子进程写;launch FILE 形同姿势)
-            // core 1.321 cut-kill registry(三轮复审存量缺口):同 pipe 径——杀柄带 still-running 守卫。
-            if (options?.onSpawn && child.pid != null) {
-                const spawnedPid = child.pid;
-                try {
-                    options.onSpawn({ pid: spawnedPid, kill: () => {
-                            if (child.exitCode !== null || child.signalCode !== null)
-                                return;
-                            try {
-                                killTreeHard(spawnedPid);
-                            }
-                            catch {
-                                try {
-                                    child.kill("SIGKILL");
-                                }
-                                catch { /* noop */ }
-                            }
-                        } });
-                }
-                catch { /* registry 回调失败不挡 exec */ }
-            }
+            // core 5.8.0:cut-kill registry seam 退役(pipe 径同注)。
             // 七轮复审:'error' 监听必须在任何可提前 return 的路径(下方 F5 already-aborted 查)之前装——异步
             // spawn 失败(如 cwd 不存在)以 ChildProcess 'error' 事件发出,无监听=uncaught 直接打死 worker 进程
             // (plain-node 最小形实证 crash;vitest/tsx 宿主会吸收,故该面无法用测试钉住,靠此排序保证)。
@@ -971,11 +928,6 @@ export class RemoteHostExecutionEnv {
                 if (shellId === undefined)
                     return; // 拒收(limit/无 pid)→ 继续 fg,泵照跑,close 正常 settle
                 handedOver = true; // spool 文件归 bg(dispose 面按 FILE 形清理)
-                // cut-kill registry 注销(所有权已移交 bgManager;pipe 径同位)。
-                try {
-                    options?.onDetachAdopted?.();
-                }
-                catch { /* noop */ }
                 const o = outBuf.result();
                 const e = errBuf.result();
                 finish(ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode: 0, detached: { shellId } }));

package/dist/plugins/remote-env-k8s.d.ts

@@ -129,6 +129,11 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     private readonly cfg;
     private readonly deps;
     constructor(config: K8sEnvConfig, deps?: K8sEnvDeps);
+    /** 166-T2 — ExecutionEnv 寿命声明:pod `activeDeadlineSeconds = ceil(timeoutMs/1000)` 是平台真硬死线
+     *  (k8s 到点杀 pod,无 keepalive 续期机制)⇒ 恒声明,core 在死线−60s 处 suspend(基建合格)或响亮
+     *  终局(env.lifetime_expired)。`lifetimeStartedAt` 有意不声明:core 只在 prepare 期读一次,lazy-connect
+     *  下 pod 尚未创建 ⇒ core 回落铸造时刻为锚——比 pod 真启动早,提早 suspend 是保守方向。 */
+    get lifetimeMs(): number;
     private resolve;
     workspaceHandle(): WorkspaceHandle;
     /** Resolved lazily so an in-cluster pod picks up its service account without explicit config. */

package/dist/plugins/remote-env-k8s.js

@@ -159,6 +159,13 @@ export class RemoteK8sExecutionEnv {
             supportsDetach: true,
         };
     }
+    /** 166-T2 — ExecutionEnv 寿命声明:pod `activeDeadlineSeconds = ceil(timeoutMs/1000)` 是平台真硬死线
+     *  (k8s 到点杀 pod,无 keepalive 续期机制)⇒ 恒声明,core 在死线−60s 处 suspend(基建合格)或响亮
+     *  终局(env.lifetime_expired)。`lifetimeStartedAt` 有意不声明:core 只在 prepare 期读一次,lazy-connect
+     *  下 pod 尚未创建 ⇒ core 回落铸造时刻为锚——比 pod 真启动早,提早 suspend 是保守方向。 */
+    get lifetimeMs() {
+        return this.cfg.timeoutMs;
+    }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));
     }

package/dist/plugins/usage-window-store-sql.d.ts

@@ -0,0 +1,42 @@
+/**
+ * UsageWindowStore SQL twins(design/166-T1)——core 5.8.0 部署级 token 治理窗
+ * (`RunnerDeps.usageWindows` + `usageWindowStore`)的 TiDB/PG 双方言实现。
+ *
+ * 语义单源 = core 纯函数(`chargeUsageRecord`/`readUsageRecord`,dist/core/usage-window-store.js):
+ * 本层只负责 record 的持久化与多副本并发正确性;窗算法(rolling slots 按最宽 horizon 自剪、
+ * first-use bucket lapsed 即弃)完全由 core 纯函数执行——SQL 层零窗语义。
+ *
+ * 并发正确性(本 store 的靶心;两副本同 key 并发 charge 绝不能丢账——丢账方向=治理窗漏放):
+ *  - **ensure-first + 行锁**(mailbox twin 正字先例,design/166 复审靶1):事务内先幂等
+ *    INSERT IGNORE / ON CONFLICT DO NOTHING 建空行 ⇒ SELECT ... FOR UPDATE 时行恒在,
+ *    「无行 FOR UPDATE + INSERT」的并发死锁(InnoDB gap-lock)/dup 撞车形整个消掉。
+ *  - charge 频率低(core 只在任务进场/turn 边界/收尾 delta 提交),悲观锁简单正确,不用乐观 CAS。
+ *  - `read` 无锁单 SELECT(readUsageRecord 纯函数);行缺席 = EMPTY_USAGE_WINDOW_RECORD。
+ *  - record JSON 坏形(手工污染)= **fail-loud throw**:治理窗算错=计费面撒谎,不 fail-open。
+ *
+ * 列型:record 用 MySQL 方言 LONGTEXT(rolling slots 高并发长窗可破 64K TEXT——复审新5,
+ * background-agent LONGTEXT 同案);PG TEXT 不限长。key 列 VARCHAR(190)(principal 或
+ * GLOBAL_USAGE_KEY,均为受控标识,无字节等价诉求——不是用户可写身份键)。
+ *
+ * residue(design/166 04 §复审处置在档):不再被 charge 的 key 行永存(单行成本可忽略);
+ * GLOBAL 单行=并发 charge 串一把行锁的吞吐热点(出现瓶颈再分片)。
+ */
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import type { UsageWindow, UsageWindowReading, UsageWindowStore } from "@sema-agent/core";
+export declare const USAGE_WINDOW_TABLE = "usage_window";
+export declare function ensureTiDBUsageWindowSchema(pool: MySqlPool): Promise<void>;
+export declare function ensurePgUsageWindowSchema(q: (text: string, params?: unknown[]) => Promise<unknown>): Promise<void>;
+export declare class TiDBUsageWindowStore implements UsageWindowStore {
+    private readonly pool;
+    constructor(pool: MySqlPool);
+    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[]): Promise<void>;
+    read(key: string, windows: readonly UsageWindow[], now: number): Promise<readonly UsageWindowReading[]>;
+}
+export declare class PgUsageWindowStore implements UsageWindowStore {
+    private readonly pool;
+    constructor(pool: PgPool);
+    charge(key: string, tokens: number, at: number, windows: readonly UsageWindow[]): Promise<void>;
+    read(key: string, windows: readonly UsageWindow[], now: number): Promise<readonly UsageWindowReading[]>;
+}
+//# sourceMappingURL=usage-window-store-sql.d.ts.map

package/dist/plugins/usage-window-store-sql.js

@@ -0,0 +1,113 @@
+import { EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord } from "@sema-agent/core";
+export const USAGE_WINDOW_TABLE = "usage_window";
+/** record 列 → UsageWindowRecord。坏形 fail-loud(治理窗算错=计费面撒谎;与快照/凭据类 store 的
+ *  onCorruptRead 披露座不同族——这里没有「跳过一行继续」的安全语义,账本坏=停)。 */
+function parseRecord(raw, key) {
+    let v;
+    try {
+        v = JSON.parse(String(raw));
+    }
+    catch (e) {
+        throw new Error(`usage_window record for key "${key}" is not valid JSON (${String(e)}) — refusing to mis-count a governance window`);
+    }
+    const r = v;
+    if (typeof v !== "object" || v === null || !Array.isArray(r.slots) || !Array.isArray(r.buckets)) {
+        throw new Error(`usage_window record for key "${key}" has an invalid shape (expected {slots[],buckets[]}) — refusing to mis-count a governance window`);
+    }
+    return v;
+}
+export async function ensureTiDBUsageWindowSchema(pool) {
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${USAGE_WINDOW_TABLE} (
+    k VARCHAR(190) NOT NULL,
+    record LONGTEXT NOT NULL,
+    updated_at_ms BIGINT NOT NULL,
+    PRIMARY KEY (k)
+  ) COLLATE utf8mb4_bin`);
+}
+export async function ensurePgUsageWindowSchema(q) {
+    await q(`CREATE TABLE IF NOT EXISTS ${USAGE_WINDOW_TABLE} (
+    k VARCHAR(190) NOT NULL,
+    record TEXT NOT NULL,
+    updated_at_ms BIGINT NOT NULL,
+    PRIMARY KEY (k)
+  )`);
+}
+export class TiDBUsageWindowStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async charge(key, tokens, at, windows) {
+        const c = await this.pool.getConnection();
+        try {
+            await c.beginTransaction();
+            // ensure-first:幂等建空行(EMPTY record)⇒ 下一步 FOR UPDATE 行恒在(锁语义干净,无 gap-lock 死锁形)。
+            await c.query(`INSERT IGNORE INTO ${USAGE_WINDOW_TABLE} (k, record, updated_at_ms) VALUES (?, ?, ?)`, [
+                key,
+                JSON.stringify(EMPTY_USAGE_WINDOW_RECORD),
+                at,
+            ]);
+            const [rows] = (await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = ? FOR UPDATE`, [key]));
+            if (rows.length === 0) {
+                // 本表无删除臂(不同于 mailbox 的 drop/reap),ensure 后空 = 真障碍 fail-loud。
+                throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
+            }
+            const record = parseRecord(rows[0].record, key);
+            const next = chargeUsageRecord(record, tokens, at, windows);
+            await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = ?, updated_at_ms = ? WHERE k = ?`, [JSON.stringify(next), at, key]);
+            await c.commit();
+        }
+        catch (e) {
+            await c.rollback().catch(() => { });
+            throw e;
+        }
+        finally {
+            c.release();
+        }
+    }
+    async read(key, windows, now) {
+        const [rows] = (await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = ?`, [key]));
+        const record = rows.length === 0 ? EMPTY_USAGE_WINDOW_RECORD : parseRecord(rows[0].record, key);
+        return readUsageRecord(record, windows, now);
+    }
+}
+export class PgUsageWindowStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async charge(key, tokens, at, windows) {
+        const c = await this.pool.connect();
+        try {
+            await c.query("BEGIN");
+            // ensure-first(TiDB 同注):ON CONFLICT DO NOTHING 幂等建空行,再锁——插入不带锁,锁只从
+            // FOR UPDATE 来(复审靶1 的 PG 交错:并发首充双双 ensure,后到方 DO NOTHING 后必须真锁行)。
+            await c.query(`INSERT INTO ${USAGE_WINDOW_TABLE} (k, record, updated_at_ms) VALUES ($1, $2, $3) ON CONFLICT (k) DO NOTHING`, [
+                key,
+                JSON.stringify(EMPTY_USAGE_WINDOW_RECORD),
+                at,
+            ]);
+            const { rows } = await c.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = $1 FOR UPDATE`, [key]);
+            if (rows.length === 0) {
+                throw new Error(`usage_window row for key "${key}" vanished between ensure and lock — refusing to drop a governance charge`);
+            }
+            const record = parseRecord(rows[0].record, key);
+            const next = chargeUsageRecord(record, tokens, at, windows);
+            await c.query(`UPDATE ${USAGE_WINDOW_TABLE} SET record = $1, updated_at_ms = $2 WHERE k = $3`, [JSON.stringify(next), at, key]);
+            await c.query("COMMIT");
+        }
+        catch (e) {
+            await c.query("ROLLBACK").catch(() => { });
+            throw e;
+        }
+        finally {
+            c.release();
+        }
+    }
+    async read(key, windows, now) {
+        const { rows } = await this.pool.query(`SELECT record FROM ${USAGE_WINDOW_TABLE} WHERE k = $1`, [key]);
+        const record = rows.length === 0 ? EMPTY_USAGE_WINDOW_RECORD : parseRecord(rows[0].record, key);
+        return readUsageRecord(record, windows, now);
+    }
+}
+//# sourceMappingURL=usage-window-store-sql.js.map

package/dist/run-local.js

@@ -469,7 +469,8 @@ export async function runLocal(argv, deps = {}) {
         // [849]→[2400] 场景层定死终验已无生产者(autonomous 退役);OR 折入形保留,与 resolveSpec 同语义。
         ...(cap.finalVerification === true ? { finalVerification: true } : {}),
         ...(mcp ? { mcp } : {}),
-        ...(timeoutSec !== undefined ? { limits: { timeoutSec } } : {}),
+        // core 5.8.0:timeoutSec 键退役 → maxWalltimeMs(毫秒);taskWallClockSec 仍产秒,此处换算一次。
+        ...(timeoutSec !== undefined ? { limits: { maxWalltimeMs: timeoutSec * 1000 } } : {}),
     };
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: config.remoteExec?.provider ?? "in-process" });
     // ── Run ONE task to completion (the sync /v1/tasks path: plain runTask, no verify/cascade). ──

package/dist/spec-fields.d.ts

@@ -87,7 +87,8 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
 export declare function promptProfileFromBody(raw: unknown): "simple" | "classic" | undefined;
 /** [854]④ — 每键的运营方上限旋钮(env,缺省不设=不封顶)。 */
 export interface TaskLimitCaps {
-    /** TASK_TIMEOUT_MAX_SEC */ timeoutSec?: number;
+    /** TASK_TIMEOUT_MAX_SEC(env 名不动,仍按**秒**配置;core 5.8.0 起封顶对象是 limits.maxWalltimeMs,
+     *  封顶比较时 ×1000 换算——运维面零迁移)。 */ timeoutSec?: number;
     /** TASK_MAX_OUTPUT_TOKENS_MAX */ maxOutputTokens?: number;
     /** TASK_MAX_TURNS_MAX */ maxTurns?: number;
 }
@@ -98,12 +99,17 @@ export interface TaskLimitCaps {
  * 运营方上限旋钮 clamp(Math.min;旋钮缺省不设=不封顶)。全空 ⇒ undefined。
  */
 export declare function normalizeLimits(v: unknown, caps: TaskLimitCaps): {
-    timeoutSec?: number;
+    maxWalltimeMs?: number;
     maxOutputTokens?: number;
     maxTurns?: number;
-    deadlineNudge?: false;
-    callCapByDeadline?: false;
-    gracefulFinalize?: false;
+    approachNotice?: false | {
+        at?: [number, number];
+    };
+} | undefined;
+/** 166-T3 — approachNotice 单键归一(normalizeLimits/HTTP 门共用判据源):合法 ⇒ 归一值,坏形 ⇒ undefined。
+ *  阈值规则对齐 core(prepare-task at 校验):二元组、(0,1] 有限数、a<=b(允许相等)。 */
+export declare function normalizeApproachNotice(raw: unknown): false | {
+    at?: [number, number];
 } | undefined;
 /**
  * [854]④ — body.limits 与 env 墙钟的合成规则(resolveSpec 的唯一 limits 装配点;run-local 无 body 车道不经此):

package/dist/spec-fields.js

@@ -359,6 +359,9 @@ export function promptProfileFromBody(raw) {
 export function normalizeLimits(v, caps) {
     if (v == null || typeof v !== "object" || Array.isArray(v))
         return undefined;
+    // core 5.8.0:键集换 maxWalltimeMs(毫秒)。旧键(timeoutSec/deadline 族三 opt-out)fresh-submit 已在
+    // HTTP 门响亮 400 点名替代;本层只走 resume 重放的持久化 body——旧键 defensive DROP(存量 suspended
+    // 体降级为默认配速,env 墙钟兜底仍在,方向安全;绝不静默换算=那是「自行兼容」,core 明令禁止)。
     const o = v;
     const pick = (raw, cap) => {
         if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 1)
@@ -367,17 +370,32 @@ export function normalizeLimits(v, caps) {
         return cap !== undefined ? Math.min(n, cap) : n;
     };
     const out = {
-        ...(() => { const n = pick(o.timeoutSec, caps.timeoutSec); return n !== undefined ? { timeoutSec: n } : {}; })(),
+        // caps.timeoutSec 是秒(env TASK_TIMEOUT_MAX_SEC 保名保义),封顶毫秒键时 ×1000。
+        ...(() => { const n = pick(o.maxWalltimeMs, caps.timeoutSec !== undefined ? caps.timeoutSec * 1000 : undefined); return n !== undefined ? { maxWalltimeMs: n } : {}; })(),
         ...(() => { const n = pick(o.maxOutputTokens, caps.maxOutputTokens); return n !== undefined ? { maxOutputTokens: n } : {}; })(),
         ...(() => { const n = pick(o.maxTurns, caps.maxTurns); return n !== undefined ? { maxTurns: n } : {}; })(),
-        // 历史复审轴B #4(1.254):deadline 族三个 **opt-out**(design/128/130,timeoutSec 在场即默认 ON;
-        // server 恒注 tenancy 墙钟 ⇒ 此前恒开且 wire 无法关)。只认 literal false(纯关闭旋钮,零扩权面)。
-        ...(o.deadlineNudge === false ? { deadlineNudge: false } : {}),
-        ...(o.callCapByDeadline === false ? { callCapByDeadline: false } : {}),
-        ...(o.gracefulFinalize === false ? { gracefulFinalize: false } : {}),
+        // 166-T3:approachNotice(core 默认 ON;false=唯一关闭形,{at:[a,b]} 调阈,core 允 a<=b)。坏形整键
+        // DROP(降级为 core 默认阈,方向安全)——不 throw,resume 重放通道同门。
+        ...(() => { const n = normalizeApproachNotice(o.approachNotice); return n !== undefined ? { approachNotice: n } : {}; })(),
     };
     return Object.keys(out).length > 0 ? out : undefined;
 }
+/** 166-T3 — approachNotice 单键归一(normalizeLimits/HTTP 门共用判据源):合法 ⇒ 归一值,坏形 ⇒ undefined。
+ *  阈值规则对齐 core(prepare-task at 校验):二元组、(0,1] 有限数、a<=b(允许相等)。 */
+export function normalizeApproachNotice(raw) {
+    if (raw === false)
+        return false;
+    if (raw == null || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const at = raw.at;
+    if (at === undefined)
+        return {};
+    if (!Array.isArray(at) || at.length !== 2)
+        return undefined;
+    const [a, b] = at;
+    const frac = (n) => typeof n === "number" && Number.isFinite(n) && n > 0 && n <= 1;
+    return frac(a) && frac(b) && a <= b ? { at: [a, b] } : undefined;
+}
 /**
  * [854]④ — body.limits 与 env 墙钟的合成规则(resolveSpec 的唯一 limits 装配点;run-local 无 body 车道不经此):
  *  - `timeoutSec`:body 给了就用 body(caller 明确配速;已在 normalizeLimits 里被 TASK_TIMEOUT_MAX_SEC 封顶)。
@@ -389,8 +407,11 @@ export function normalizeLimits(v, caps) {
  */
 export function resolveTaskLimits(bodyLimits, caps, envTimeoutSec, requirePrincipal, big) {
     const requested = normalizeLimits(bodyLimits, caps);
-    const timeoutSec = requested?.timeoutSec ?? taskWallClockSec(envTimeoutSec, requirePrincipal, big);
-    const out = { ...(requested ?? {}), ...(timeoutSec !== undefined ? { timeoutSec } : {}) };
+    // core 5.8.0:墙钟键=maxWalltimeMs(毫秒)。taskWallClockSec 仍以秒推导(tenancy 基值+env 只抬不降,
+    // 语义原样),装配处换算一次;body 显式给了 maxWalltimeMs 则直接生效(caller 意图,可低于 env 墙)。
+    const wallSec = taskWallClockSec(envTimeoutSec, requirePrincipal, big);
+    const maxWalltimeMs = requested?.maxWalltimeMs ?? (wallSec !== undefined ? wallSec * 1000 : undefined);
+    const out = { ...(requested ?? {}), ...(maxWalltimeMs !== undefined ? { maxWalltimeMs } : {}) };
     return Object.keys(out).length > 0 ? out : undefined;
 }
 //# sourceMappingURL=spec-fields.js.map

package/dist/trace/project.d.ts

@@ -287,7 +287,7 @@ export declare function compactedEventData(ev: {
     modelFallback?: true;
     fallbackReason?: "window";
     clampedRatio?: number;
-    clampReason?: "budget" | "walltime" | "tolerance";
+    clampReason?: "budget" | "tolerance";
     tokensAfter?: number;
     triggerTokensBefore?: number;
     durationMs?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "5.14.0",
+  "version": "6.1.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.7.0",
+    "@sema-agent/core": "^5.8.0",
     "@sema-agent/registry-core": "^0.14.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^5.2.0",
+    "@sema-agent/sdk": "^6.0.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",