@sema-agent/server 6.4.0 → 6.6.0

package/dist/boot/resolve-spec.js

@@ -280,6 +280,15 @@ export function createResolveSpec(ctx) {
         if (rawAddDirs !== undefined && !cwdHonored(config)) {
             logger.warn("task_additional_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
         }
+        // core 5.11.0([2625] Added①,[2597] P0 案三决③A):`additionalReadDirectories` —— 只读围栏拓宽。
+        // 与 additionalDirectories 同门(host 单用户车道)、同形校验(parseAdditionalDirectories:绝对路径
+        // 数组 fail-loud)、同「忽略必留声」纪律;差异只在语义:只进 READ 面(classify 读边界 auto-allow +
+        // read_file/grep 等 containment),写面照旧拒——读授权永不静默变写授权(core 侧保证,我们只透传)。
+        const rawAddReadDirs = body.additionalReadDirectories;
+        const additionalReadDirectories = cwdHonored(config) ? parseAdditionalDirectories(rawAddReadDirs) : undefined;
+        if (rawAddReadDirs !== undefined && !cwdHonored(config)) {
+            logger.warn("task_additional_read_directories_ignored", { honored: false, sessionId: auth?.sessionId ?? null });
+        }
         // body.model (explicit /model picker or run --model) WINS over settings.model (the config default); both gate
         // against the catalog allow-list via resolveTaskModel (a settings.model not in the catalog is ignored, never injected).
         // 🔴 TOB 档位联跑曾 FAIL(坐标级):the gate must see the TIER-EXPANDED catalog — expandTiers
@@ -320,7 +329,7 @@ export function createResolveSpec(ctx) {
             metrics.inc("images_omitted_total", { model: picked.model });
             logger.warn("images_omitted_no_vision_model", { model: picked.model, count: body.images.length });
         }
-        return { taskHooks, additionalDirectories, wireCatalog, picked };
+        return { taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked };
     };
     /** 阶段③(anchors):吃 请求体 + auth,吐 两个历史锚解析后的 entryId(resumeAt / rewindFilesTo —— eventId→entryId
      *  过 anchor store,未知锚在此 4xx 而不是交给 core)与 142-S4 项目登记簿种子 s4DefaultScopes。 */
@@ -374,7 +383,7 @@ export function createResolveSpec(ctx) {
     /** 阶段④(spec 字面量):吃 请求体 + auth + `opts.leg` + 前三阶段的全部产出,吐**尚未过治理层**的 TaskSpec
      *  字面量 —— 部署方拥有的 body→TaskSpec 映射本体(compactionModel 的 fresh 腿 400 也在这一段)。 */
     const assembleSpecLiteral = (body, auth, opts, parts) => {
-        const { scenarioName, cap, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
+        const { scenarioName, cap, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
         const spec = {
             // D-1:附件告知随 objective 进 durable 流(只有名字/mime/尺寸——**内容永不进流**,这正是
             // 「拼进 objective 是伪方案」的账要划清的线;文件名已消毒为安全字符集,无注入面)。
@@ -464,6 +473,8 @@ export function createResolveSpec(ctx) {
             // design/119 (CC --add-dir): extra host dirs the FILE tools may access (core canonicalizes each into the
             // containment allowlist + lists them in the `# Environment` block). Single-user host lane only (gated above).
             additionalDirectories,
+            // core 5.11.0:只读围栏(见上方 parse 段注)。缺席=字节等价([2625] 自查③)。
+            additionalReadDirectories,
             // EnterPlanMode (core 1.167): MODEL-DRIVEN plan — `enablePlanMode:true` alone (writable
             // start, NO handsReadOnly) auto-mounts `enter_plan_mode`/`present_plan` so the model can self-enter read-only
             // plan AT ANY TIME it judges a task needs planning. 🆕 DEFAULT ON (clay: resident; PLAN_MODE_ENABLED=false opts

package/dist/http/routes/session-sync.js

@@ -404,8 +404,11 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                     // **不是内容寻址**,所以「同 id 异载荷」结构上完全可能。此时 entries 被**整段跳过**,客户端拿到 200,
                     // 目的端却仍是它自己那份内容(探针用真 HTTP 复现过:本地改过内容再 push,云端保持原样、200)。
                     // 现在把判据写进响应(`basis`)并显式声明**未验证载荷**,这样客户端不会把它读成"内容已同步"。
-                    // ⚠️ 这只是止谎,**不是修**:真修要 Phase A 能拿到内容摘要(Phase A 只收 entryIds,载荷在 Phase B),
-                    // 那是跨仓 wire 契约改动,已带证据上黑板与 cli/core 对齐。别把 `basis` 当成问题已解决。
+                    // ✅ 状态更新(2026-08-05,[2557] 2-i 核账):上面说的「真修」——Phase A 拿内容摘要——**已经落了**
+                    // (`logDigest` 就在本函数上方,三态钉=fanout-characterization §H2/F3);commit 半场的载荷判据也齐
+                    // (identical=照常改写、fast_forward 分叉=409,见 session-sync-content.ts)。仍到不了这里的只剩
+                    // **不送 digest 的老客户端**(按设计永久保留的老路,现状钉=G1)——对它们 `basis:"entry-ids"` 的
+                    // 未验声明就是全部真相。
                     sendJson(res, 200, {
                         relation: "identical",
                         // 判据如实:调用方送了可比摘要且相等 ⇒ 内容**真的**验过;否则仍只是 id 集合相等。

package/dist/http/routes/tasks.js

@@ -6,12 +6,21 @@ import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-t
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { buildActiveRunConflict, toDoneFrameResult } from "../active-run-conflict.js";
 import { headerStr, gatedPrincipal } from "../principal-gate.js";
+/** #135([C95]/[C96]):live 腿 SSE 数据帧的**唯一**出口 —— 载荷带账本可锚 `eventId`(非空 string)的帧
+ *  前缀 `id: <eventId>` 行(SSE 游标=账本 eventId,壳/SDK 拿它锚进账本或断线换道 events tail 续读);
+ *  无 eventId 的帧**不发行**,EventSource 沿用上一游标 —— 绝不合成占位 id(那会把不可锚的位置伪装成可锚)。
+ *  durable 腿的 `id:` 行在 sse-log.ts(同一契约的另半);行为钉=test/live-sse-cursor.test.ts(规则式全流判据)。 */
+function sseData(res, payload) {
+    const anchor = payload.eventId;
+    const idLine = typeof anchor === "string" && anchor.length > 0 ? `id: ${anchor}\n` : "";
+    res.write(`${idLine}data: ${JSON.stringify(payload)}\n\n`);
+}
 export async function handleTasks(req, res, url, ctx) {
     const miss = { fell: false };
     await handleTasksBody(req, res, url, ctx, miss);
@@ -52,7 +61,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 try {
                     const resp = await cached;
                     if (!res.writableEnded)
-                        res.write(`data: ${JSON.stringify({ type: "done", result: resp.body, replay: true })}\n\n`);
+                        sseData(res, { type: "done", result: resp.body, replay: true });
                 }
                 finally {
                     clearInterval(hb);
@@ -226,7 +235,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         // Headers are already SSE — encode the rejection as the stream's terminal event; the 409 in
                         // the returned resp is for a deduplicated concurrent caller (and is never idem-cached).
                         // done 帧 additive 携带同一份材料 —— 形状铸在 toDoneFrameResult(有名字有类型),不在这行内联挑键。
-                        res.write(`data: ${JSON.stringify({ type: "done", result: toDoneFrameResult(conflict) })}\n\n`);
+                        sseData(res, { type: "done", result: toDoneFrameResult(conflict) });
                         return { status: 409, body: conflict };
                     }
                     durableTaskId = tid;
@@ -399,7 +408,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         return;
                                     const t = e.type;
                                     if (t === "task_progress") {
-                                        res.write(`data: ${JSON.stringify({ type: "task_progress", ...taskProgressEventData(e) })}\n\n`);
+                                        sseData(res, { type: "task_progress", ...taskProgressEventData(e) });
                                     }
                                     else if (t === "tool_start") {
                                         // C1 (core 1.219, spec.forwardSubagentEvents): a delegated child's live CONTENT events now
@@ -407,22 +416,22 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         // delegation card). Echo through the SAME shared whitelist+redact builders as the top
                                         // stream (§E1 — forwarded events are UNTRUSTED RAW; redaction is ours at the wire).
                                         const tsv = e;
-                                        res.write(`data: ${JSON.stringify({ type: "tool_start", ...toolStartEventData(tsv) })}\n\n`);
+                                        sseData(res, { type: "tool_start", ...toolStartEventData(tsv) });
                                     }
                                     else if (t === "tool_end") {
                                         const te = e;
-                                        res.write(`data: ${JSON.stringify({ type: "tool_end", ...toolEndEventData(te) })}\n\n`); // label 现由 builder 自带,外拼冗余已清
+                                        sseData(res, { type: "tool_end", ...toolEndEventData(te) }); // label 现由 builder 自带,外拼冗余已清
                                     }
                                     else if (t === "text_delta") {
                                         // Child text is plain model output (same trust class as the top stream's text_delta, which
                                         // rides verbatim); parentToolCallId attributes it. Whitelist the three fields explicitly.
                                         const td = e;
-                                        res.write(`data: ${JSON.stringify({ type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) })}\n\n`);
+                                        sseData(res, { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) });
                                     }
                                     else if (t === "reasoning_delta") {
                                         // §E1 parity with the top stream's live CoT: redactSecrets before echo.
                                         const rd = e;
-                                        res.write(`data: ${JSON.stringify({ type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) })}\n\n`);
+                                        sseData(res, { type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) });
                                     }
                                 },
                                 // background-completion observer — flip the child's fleet
@@ -472,7 +481,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         const key = taskNotificationStreamKey(n);
                                         if (syncNotifiedKeys.get(key) === undefined) {
                                             syncNotifiedKeys.set(key, Promise.resolve(true));
-                                            res.write(`data: ${JSON.stringify({ type: "task_notification", ...taskNotificationEventData({ notification: n }) })}\n\n`);
+                                            sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n }) });
                                         }
                                     }
                                 },
@@ -552,7 +561,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         await ledgerSink.onDone(finalResult);
                                         ledgerTerminal = true;
                                     }
-                                    res.write(`data: ${JSON.stringify({ ...ev, result: finalResult })}\n\n`);
+                                    sseData(res, { ...ev, result: finalResult });
                                     continue;
                                 }
                                 // [900]① detach 车道逐事件落账(await 保序 —— 与 bg 腿同代价姿势;message_committed/未知型
@@ -581,18 +590,18 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     // 可能回显 provider 的 rate-limit/retry 报文)此前落裸 catch-all 未脱敏,与 durable 两腿
                                     // (ledger-sink.onEvent + resume switch)共用的 brainStatusEventData 脱敏不一致——同类
                                     // 「留在 catch-all」教训(1.72 task_progress),现挪显式分支,三腿同门同形。
-                                    res.write(`data: ${JSON.stringify({ type: "status", ...brainStatusEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "status", ...brainStatusEventData(ev) });
                                 }
                                 else if (ev.type === "tool_end") {
                                     const te = ev;
-                                    res.write(`data: ${JSON.stringify({ type: "tool_end", ...toolEndEventData(te) })}\n\n`); // label 现由 builder 自带,外拼冗余已清
+                                    sseData(res, { type: "tool_end", ...toolEndEventData(te) }); // label 现由 builder 自带,外拼冗余已清
                                 }
                                 else if (ev.type === "tool_start") {
                                     // 🔒 E1 parity (TOC adversarial review): redact tool_start.args on the LIVE wire too — the model's
                                     // tool-call inputs can echo a secret it read (e.g. a value from a redacted tool_end fed into the
                                     // next call). Whitelist for the same reason as tool_end (shared durable builder = one shape).
                                     const tsv = ev;
-                                    res.write(`data: ${JSON.stringify({ type: "tool_start", ...toolStartEventData(tsv) })}\n\n`);
+                                    sseData(res, { type: "tool_start", ...toolStartEventData(tsv) });
                                 }
                                 else if (ev.type === "task_notification") {
                                     // core 1.202 (design/115 P2): a background task (workflow) finished while THIS harness was live —
@@ -614,7 +623,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     if (tnvPrior === undefined || !(await tnvPrior)) {
                                         if (tnvKey !== undefined)
                                             syncNotifiedKeys.set(tnvKey, Promise.resolve(true)); // stream delivered this key
-                                        res.write(`data: ${JSON.stringify({ type: "task_notification", ...taskNotificationEventData(ev) })}\n\n`);
+                                        sseData(res, { type: "task_notification", ...taskNotificationEventData(ev) });
                                     }
                                 }
                                 else if (ev.type === "reasoning_delta" && typeof ev.delta === "string") {
@@ -626,41 +635,41 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     // re-proven here: a spread forwards an unknown/future field RAW; this arm was the one
                                     // sibling branch that still spread — the FORWARDED twin below [t === "reasoning_delta"]
                                     // already used the narrow form, this now matches it byte-for-byte).
-                                    res.write(`data: ${JSON.stringify({ type: "reasoning_delta", delta: redactSecrets(ev.delta), ...(ev.eventId ? { eventId: ev.eventId } : {}), ...(ev.parentToolCallId ? { parentToolCallId: ev.parentToolCallId } : {}) })}\n\n`);
+                                    sseData(res, { type: "reasoning_delta", delta: redactSecrets(ev.delta), ...(ev.eventId ? { eventId: ev.eventId } : {}), ...(ev.parentToolCallId ? { parentToolCallId: ev.parentToolCallId } : {}) });
                                 }
                                 else if (ev.type === "task_progress") {
                                     // 🔒 E1 live-wire parity: explicit whitelist via the SHARED builder (UNTRUSTED
                                     // `name` redacted; 1.78: E2 identity rides — the shell binds concurrent subagent ticks by
                                     // eventId/parentToolCallId) — parity with the durable runs.ts + resume legs.
-                                    res.write(`data: ${JSON.stringify({ type: "task_progress", ...taskProgressEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "task_progress", ...taskProgressEventData(ev) });
                                 }
                                 else if (ev.type === "compacted") {
                                     // core 1.219 (attachWorkingFiles default ON): `compacted` now carries `attachedFiles` — route it
                                     // through the SHARED whitelist builder (paths redactSecrets'd) instead of the raw catch-all, so
                                     // the live wire matches the durable legs' shape exactly (one builder, no drift).
-                                    res.write(`data: ${JSON.stringify({ type: "compacted", ...compactedEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "compacted", ...compactedEventData(ev) });
                                 }
                                 else if (ev.type === "diagnostics") {
                                     // core 1.220 (design/121): the shell's render source for CC's diagnostics row.
                                     // Shared whitelist builder (§E1: language-server output UNTRUSTED RAW → redactSecrets).
-                                    res.write(`data: ${JSON.stringify({ type: "diagnostics", ...diagnosticsEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "diagnostics", ...diagnosticsEventData(ev) });
                                 }
                                 else if (ev.type === "steering_injected") {
                                     // [1550]/[1552]: core's mid-run system-reminder injection — shared whitelist builder
                                     // (§E1: preview is UNTRUSTED free text → redactSecrets). Previously fell through to the
                                     // raw catch-all below (unredacted `{...ev}`) — moved to an explicit builder for the same
                                     // reason every other content type left the catch-all (the 1.72 task_progress lesson).
-                                    res.write(`data: ${JSON.stringify({ type: "steering_injected", ...steeringInjectedEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "steering_injected", ...steeringInjectedEventData(ev) });
                                 }
                                 else if (ev.type === "workspace_changed") {
                                     // [1559]二 core 裁定:bash cd/EnterWorktree 移动任务逻辑 cwd 后一帧,给 shell UI 的路径
                                     // 提示行。cwd 与已展示的工具 args 同信任级 → 共享白名单构造器(redactSecrets + bound)。
-                                    res.write(`data: ${JSON.stringify({ type: "workspace_changed", ...workspaceChangedEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "workspace_changed", ...workspaceChangedEventData(ev) });
                                 }
                                 else if (ev.type === "compaction_outcome") {
                                     // core 2.5.0([2105]②)压缩非 compacted 结局帧。[2373]C-2:内联挑键收进共享 builder,
                                     // 与两条 durable 腿同源(它曾是唯一不走 builder 的内容帧=三方普查共同盲区)。
-                                    res.write(`data: ${JSON.stringify({ type: "compaction_outcome", ...compactionOutcomeEventData(ev) })}\n\n`);
+                                    sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
                                 }
                                 else if (ev.type === "text_delta" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                     // 裸 catch-all 白名单化收官(probe-wire-1 表征钉的根治半场):最后四个已知臂离开
@@ -684,10 +693,10 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                             : ev.type === "message_committed"
                                                 ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
                                                 : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
-                                    res.write(`data: ${JSON.stringify(arm)}\n\n`);
+                                    sseData(res, arm);
                                 }
                                 else {
-                                    res.write(`data: ${JSON.stringify(ev)}\n\n`);
+                                    sseData(res, ev);
                                 }
                             }
                         });
@@ -728,7 +737,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         const f = frame;
                         if (f.type === "task_notification" && f.task_id)
                             syncNotifiedKeys.set(taskNotificationStreamKey({ task_type: f.task_type, task_id: f.task_id, status: String(f.status), seq: f.seq }), Promise.resolve(true));
-                        res.write(`data: ${JSON.stringify(frame)}\n\n`);
+                        sseData(res, frame);
                     }, 
                     // emit-target diagnostics — this drain rides the caller's OWN live SSE response.
                     { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
@@ -950,7 +959,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             }
             // A concurrent caller the cache deduplicated (ranLive=false) received no live events — hand it the terminal.
             if (!ranLive && resp && !res.writableEnded) {
-                res.write(`data: ${JSON.stringify({ type: "done", result: resp.body, replay: true })}\n\n`);
+                sseData(res, { type: "done", result: resp.body, replay: true });
             }
             res.end();
         }

package/dist/http/server.js

@@ -691,6 +691,24 @@ export function createHttpServer(rawDeps) {
                 return null;
             }
         }
+        // core 5.11.0:additionalReadDirectories(只读围栏)—— 与 additionalDirectories 同形 fail-loud
+        // (绝对路径数组、无 `..`、同条数上限);语义差异(只进 READ 面)在 core,形校验在此对齐。
+        const addReadDirsRaw = body.additionalReadDirectories;
+        if (addReadDirsRaw !== undefined) {
+            if (!Array.isArray(addReadDirsRaw)) {
+                sendError(res, 400, "request.field_invalid", "additionalReadDirectories must be an array of absolute host paths");
+                return null;
+            }
+            if (addReadDirsRaw.length > MAX_ADDITIONAL_DIRS) {
+                sendError(res, 400, "request.field_invalid", `additionalReadDirectories must have at most ${MAX_ADDITIONAL_DIRS} entries`);
+                return null;
+            }
+            const badRead = addReadDirsRaw.find((d) => !isValidCwd(d));
+            if (badRead !== undefined) {
+                sendError(res, 400, "request.field_invalid", "each additionalReadDirectories entry must be a non-empty absolute host path (no '..' segments)");
+                return null;
+            }
+        }
         // body.settings (client SemaSettings stamp) — fail-loud shape/size caps on submit, matching the sibling
         // fields' posture (parseTaskSettings is also defensive on every path incl. resume; this 400s a bad submit early
         // rather than silently coercing — adversarial review). The semantic projection (tighten-only) happens in resolveSpec.

package/dist/leader/wire.d.ts

@@ -131,7 +131,11 @@ export declare function leaderResourceConfig(env?: NodeJS.ProcessEnv): {
     /** design/74 Slice 6: opt-in (LEADER_RESOURCE_SUSPEND=true) resource-slice suspend for workers. When set, a
      *  worker SUSPENDS at the per-slice window (`sliceMaxCostUsd`) instead of failing at the budget, and the
      *  leader auto-resumes (resumeWithVerification) until the TOTAL (`totalBudgetUsd` = workerBudgetUsd) is spent
-     *  — a budget overrun becomes a resumable pause, not a worker failure. `maxSuspends` is sized to the slice
+     *  — a budget overrun becomes a resumable pause, not a worker failure. ⚠️ 语义更新(core 5.11.0 B3,
+     *  2026-08-06):`maxSuspends` 现在只数「连续无进展」park(批准+执行后链基归零),不再是总 park 数上限
+     *  ——下面按预算切片总数放大的 sizing 公式因此从「必要」变「保守冗余」(合法的资源续跑链永不触 cap,
+     *  cap 只剩防空转环职责);公式保留是无害的(上限只会更松不误杀),别再按「总数预算」理解它。
+     *  原注:`maxSuspends` is sized to the slice
      *  count (+margin) so the suspend-loop cap doesn't fire before the budget is legitimately spent. */
     resourceSuspend?: {
         totalBudgetUsd: number;

package/dist/observability/metrics.d.ts

@@ -18,6 +18,12 @@ export declare class Metrics {
     setGauge(name: string, value: number, labels?: Labels): void;
     addGauge(name: string, delta: number, labels?: Labels): void;
     observe(name: string, value: number, labels?: Labels): void;
+    /** [2557] 2-j:dynamic gauge 求值抛错不再折成 0 —— 0 是该 gauge 的合法读数,折 0 让故障态与真实 0
+     *  在 wire 上逐字节不可区分(与上方 inc 静默 no-op 同族:观测面的 fail-silent 正是观测要消灭的东西)。
+     *  披露方向:错帧**不发样本行**(缺席=读数未知,面板显示 no data 而非假 0)+ 计
+     *  `metric_gauge_eval_errors_total{name}`(响亮、可告警)。每次求值(每次刮取/snapshot)错一次计一次;
+     *  仍然绝不 propagate(/metrics 不因单个读数器坏而 500)。 */
+    private evalDynamic;
     /** Prometheus text exposition (content-type text/plain; version=0.0.4). */
     render(): string;
     /** Structured snapshot of the whole registry — the OTLP exporter maps this to OTel data points

package/dist/observability/metrics.js

@@ -87,8 +87,30 @@ export class Metrics {
         s.count += 1;
         h.series.set(k, s);
     }
+    /** [2557] 2-j:dynamic gauge 求值抛错不再折成 0 —— 0 是该 gauge 的合法读数,折 0 让故障态与真实 0
+     *  在 wire 上逐字节不可区分(与上方 inc 静默 no-op 同族:观测面的 fail-silent 正是观测要消灭的东西)。
+     *  披露方向:错帧**不发样本行**(缺席=读数未知,面板显示 no data 而非假 0)+ 计
+     *  `metric_gauge_eval_errors_total{name}`(响亮、可告警)。每次求值(每次刮取/snapshot)错一次计一次;
+     *  仍然绝不 propagate(/metrics 不因单个读数器坏而 500)。 */
+    evalDynamic(name, fn) {
+        try {
+            return fn();
+        }
+        catch {
+            this.inc("metric_gauge_eval_errors_total", { name });
+            return undefined;
+        }
+    }
     /** Prometheus text exposition (content-type text/plain; version=0.0.4). */
     render() {
+        // dynamic 先求值(2-j):错帧的 inc 要落进**本次**刮取的 counters 段,不能等下一次。
+        const dyn = [];
+        for (const [name, d] of this.dynamic) {
+            const v = this.evalDynamic(name, d.fn);
+            dyn.push(`# HELP ${name} ${d.help}`, `# TYPE ${name} gauge`);
+            if (v !== undefined)
+                dyn.push(`${name} ${v}`);
+        }
         const out = [];
         for (const [name, c] of this.counters) {
             out.push(`# HELP ${name} ${c.help}`, `# TYPE ${name} counter`);
@@ -100,9 +122,7 @@ export class Metrics {
             for (const s of g.series.values())
                 out.push(`${name}${renderLabels(s.labels)} ${s.value}`);
         }
-        for (const [name, d] of this.dynamic) {
-            out.push(`# HELP ${name} ${d.help}`, `# TYPE ${name} gauge`, `${name} ${safe(d.fn)}`);
-        }
+        out.push(...dyn);
         for (const [name, h] of this.histos) {
             out.push(`# HELP ${name} ${h.help}`, `# TYPE ${name} histogram`);
             for (const s of h.series.values()) {
@@ -119,6 +139,8 @@ export class Metrics {
     /** Structured snapshot of the whole registry — the OTLP exporter maps this to OTel data points
      *  (counters→Sum monotonic, gauges/dynamic→Gauge, histograms→Histogram). Read-only copy. */
     snapshot() {
+        // dynamic 先求值(2-j,同 render):错帧的 inc 要进本次快照的 counters。
+        const dynVals = [...this.dynamic].map(([name, d]) => ({ name, help: d.help, v: this.evalDynamic(name, d.fn) }));
         const counters = [...this.counters].map(([name, c]) => ({
             name,
             help: c.help,
@@ -129,8 +151,9 @@ export class Metrics {
             help: g.help,
             series: [...g.series.values()].map((s) => ({ labels: s.labels, value: s.value })),
         }));
-        for (const [name, d] of this.dynamic)
-            gauges.push({ name, help: d.help, series: [{ labels: {}, value: safe(d.fn) }] });
+        // 错帧 series 空:名字/HELP 仍披露(指标存在),但绝不铸 {value:0} 假数据点。
+        for (const { name, help, v } of dynVals)
+            gauges.push({ name, help, series: v === undefined ? [] : [{ labels: {}, value: v }] });
         const histograms = [...this.histos].map(([name, h]) => ({
             name,
             help: h.help,
@@ -192,17 +215,10 @@ export class Metrics {
         };
     }
 }
-function safe(fn) {
-    try {
-        return fn();
-    }
-    catch {
-        return 0;
-    }
-}
 /** Register the service's standard metric set. */
 export function createMetrics() {
     const m = new Metrics();
+    m.counter("metric_gauge_eval_errors_total", "Dynamic gauge eval errors by gauge name (an erroring gauge emits NO sample that scrape — absence means unknown, not 0)");
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");

package/dist/plugins/local-session-store.js

@@ -30,7 +30,7 @@ import { join, resolve } from "node:path";
 // 版本掩盖」这个缺陷机制仍值得后人读;宣称"待办"的部分已按实况改写(注释宣称≠代码实做是本仓
 // 已立案的病族,过期待办比没有更有害)。
 import { SessionError, validateEntriesForImport } from "@sema-agent/core";
-import { identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
+import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
 import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, } from "../session-sync-kernel.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const isNotFound = (e) => e instanceof SessionError && e.code === "not_found";
@@ -692,6 +692,15 @@ class LocalStagingHandle {
         if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
             throw new SyncConflictError(this.realSessionId, rel);
         }
+        // 🔴 [2557] A5/F2(2026-08-05):fast_forward 的**载荷**盲区 —— dst ⊆ src 按 id,但共享 id 的
+        // 内容可能已分叉(目的端纠正过某条、源端拿旧版+追加)。整段换装会静默销毁目的端的纠正,
+        // §7 在载荷层同样要求 409(除非显式 overwrite-dst)。判据与铸形见 session-sync-content.ts。
+        if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstEntries !== null && dstEntries.length > 0) {
+            const dstSet = new Set(dstEntries.map((e) => e.id));
+            const diverged = fastForwardSharedContentDiverged(this.staged.filter((e) => dstSet.has(e.id)), dstEntries);
+            if (diverged)
+                throw new SyncConflictError(this.realSessionId, contentForkRelation(diverged, rel.newEntryIds));
+        }
         // 🔴 2026-07-26:`identical` 不再等于"内容相同"。id 是 uuidv7、不是内容寻址 ⇒ 同 id 异载荷完全可能,
         // 而 commit 这里**手上同时有两份日志**,所以内容比较不需要调用方配合(见 `session-sync-content.ts` 顶注:
         // 我在黑板 [1701] 说过"server 单方面修不了",那句只对 Phase A 成立,对这一半是错的)。

package/dist/plugins/pg-session-storage.js

@@ -23,6 +23,7 @@ import { BaseSessionStorage, StoredSession, SessionError, uuidv7, validateEntrie
 import { escapeLike } from "./sql-escape.js";
 import { pgSafeJsonStringify } from "./pg-safe-json.js";
 import { toIso } from "./sql-row-helpers.js";
+import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
 /** Staging-row reaper grace window (twin of the TiDB store's STAGING_GC_GRACE_MS) — see that store for the rationale. */
 const STAGING_GC_GRACE_MS = 3_600_000;
@@ -609,6 +610,20 @@ class PgStagingHandle {
                 await conn.query("ROLLBACK");
                 throw new SyncConflictError(this.realSessionId, rel);
             }
+            // 🔴 [2557] A5/F2(2026-08-05):fast_forward 的**载荷**判据(tidb twin 同注)——共享段分叉 ⇒ 409,
+            // 除非显式 overwrite-dst;载荷只在这条臂上读,行已被 FOR UPDATE 锁住,同 txn 重读是一致读。
+            if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
+                const dstFull = await conn.query("SELECT payload FROM session_event WHERE session_id = $1 ORDER BY seq ASC", [this.realSessionId]);
+                const stagedFull = await conn.query("SELECT entry_id, payload FROM session_event WHERE session_id = $1 ORDER BY seq ASC", [this.stagingId]);
+                const dstSet = new Set(dstIds);
+                const dstEntries = dstFull.rows.map((r) => parseEntry(r.payload));
+                const stagedShared = stagedFull.rows.filter((r) => dstSet.has(String(r.entry_id))).map((r) => parseEntry(r.payload));
+                const diverged = fastForwardSharedContentDiverged(stagedShared, dstEntries);
+                if (diverged) {
+                    await conn.query("ROLLBACK");
+                    throw new SyncConflictError(this.realSessionId, contentForkRelation(diverged, rel.newEntryIds));
+                }
+            }
             await conn.query("DELETE FROM session_event WHERE session_id = $1", [this.realSessionId]);
             await conn.query("UPDATE session_event SET session_id = $1 WHERE session_id = $2", [this.realSessionId, this.stagingId]);
             const lastRes = await conn.query("SELECT payload FROM session_event WHERE session_id = $1 ORDER BY seq DESC LIMIT 1", [this.realSessionId]);

package/dist/plugins/store-backend.js

@@ -158,7 +158,9 @@ class PgBackend {
  * The session store stays the §0.5 owner-aware {@link LocalSessionStore} wrapper, but over a fresh `FileSessionRepo`
  * (NOT `fileBackend.sessionStore`, which is core's bare `TtlSessionStore` lacking the §0.5 owner/list/fork/delete
  * ops); policy/snapshot delegate to the fileBackend's own file stores. The fileBackend takes a coarse boot
- * `flock` on `root/LOCK` (single-instance per data dir) — `close()` MUST `dispose()` it so a graceful restart can
+ * single-instance lock on `root/LOCK` (an `O_EXCL`+`linkSync` PIDFILE, not flock — [2557] F4; same-host only:
+ * liveness = `process.kill(pid,0)`, so a foreign PID namespace or NFS defeats it, see DEPLOY-PREREQS) —
+ * `close()` MUST `dispose()` it so a graceful restart can
  * re-acquire (a stale lock from a dead PID is pruned by core, but graceful restart relies on the release).
  *
  * P0.5 variant-1 (clay 2026-06-26): `run()`/`resumeAnchor()` are now FILE-backed too (FileRunStore /
@@ -184,7 +186,7 @@ class LocalBackend {
     /** design/73 §1 — owner-only JSONL outcome-fact sink (stateless append; no fd held). */
     outcomeSinkInst;
     constructor(root, config) {
-        // The fileBackend ctor mkdirs `root` + takes the boot flock — a SECOND instance over the same dir FAILS FAST.
+        // The fileBackend ctor mkdirs `root` + takes the boot pidfile lock — a same-host SECOND instance FAILS FAST.
         // Re-throw with a clear operator message (the raw core error is "another instance owns this data dir").
         try {
             this.fileBackend = new FileStorageBackend({ root, ...(config.rewindSnapshotMaxMb !== undefined ? { snapshotBounds: { maxBytes: Math.round(config.rewindSnapshotMaxMb * 1024 * 1024) } } : {}) }); // REWIND_SNAPSHOT_MAX_MB

package/dist/plugins/tidb-session-store.js

@@ -14,6 +14,7 @@
 import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./tidb-session-storage.js";
 import { escapeLike } from "./sql-escape.js";
+import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
 /** Staging-row reaper grace window — a staging session's rows are GC'able only if it has NO session_meta (never
  *  committed) AND its OLDEST row is older than this (an in-flight stream keeps appending fresh rows → safe). Mirrors
@@ -573,6 +574,24 @@ class TiDBStagingHandle {
                 await conn.rollback();
                 throw new SyncConflictError(this.realSessionId, rel);
             }
+            // (1b) 🔴 [2557] A5/F2(2026-08-05):fast_forward 的**载荷**判据 —— dst ⊆ src 按 id,但共享 id 的
+            // 内容可能已分叉(目的端纠正过某条、源端拿旧版+追加);整段换装会静默销毁目的端版本,§7 在载荷层
+            // 同样要求 409(除非显式 overwrite-dst)。共享段载荷只在这条臂上读(commit 本就是 O(total) 行操作
+            // ——DELETE dst + rename staged——所以这次成比例的载荷读不改变量级);行已被上面的 FOR UPDATE 锁住,
+            // 同 txn 重读载荷是一致读。判据与 fork 铸形见 session-sync-content.ts。
+            if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
+                const [dstFull] = await conn.query("SELECT payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [this.realSessionId]);
+                const [stagedFull] = await conn.query("SELECT entry_id, payload FROM session_event WHERE session_id = ? ORDER BY seq ASC", [this.stagingId]);
+                const parseEntry = (p) => (typeof p === "string" ? JSON.parse(p) : p);
+                const dstSet = new Set(dstIds);
+                const dstEntries = dstFull.map((r) => parseEntry(r.payload));
+                const stagedShared = stagedFull.filter((r) => dstSet.has(String(r.entry_id))).map((r) => parseEntry(r.payload));
+                const diverged = fastForwardSharedContentDiverged(stagedShared, dstEntries);
+                if (diverged) {
+                    await conn.rollback();
+                    throw new SyncConflictError(this.realSessionId, contentForkRelation(diverged, rel.newEntryIds));
+                }
+            }
             // (2) purge the dst's existing log (the replaceEntries purge; idempotent — fresh deletes 0).
             await conn.query("DELETE FROM session_event WHERE session_id = ?", [this.realSessionId]);
             // (3) RENAME the staged rows onto the real session id (row-key UPDATE — metadata only, NO payload re-copy). seq is

package/dist/session-sync-content.d.ts

@@ -46,4 +46,33 @@ import { type SessionTreeEntry } from "@sema-agent/core";
  * 不符只意味着"多干一趟活",而不是"这次同步非法"。
  */
 export declare function identicalIdsAlsoIdenticalContent(staged: readonly SessionTreeEntry[], dst: readonly SessionTreeEntry[] | null): boolean;
+/**
+ * `fast_forward` 的**内容判据**([2557] 审计 A5/F2,2-i)——id 分类器的另一格盲区:
+ * `dst ⊆ src` 只说明 **id 集合**是子集,共享 id 的**载荷**可能已分叉(目的端把某条 entry
+ * 补写/纠正过、id 不变,源端拿着旧版本 + 新追加)。此时按「clean append」整段换装,
+ * 目的端那几条纠正会被**静默销毁** —— §7「会丢目的端历史必须 409(除非显式 overwrite-dst)」
+ * 在载荷层同样成立。与 `identical` 格的口径**方向不同**是刻意的:identical 格 core 已定
+ * 「不符=多干一趟活、照常改写」(那里 src 按 id 完整覆盖 dst,push 语义=以源为准);本格
+ * dst 的共享版本与 src 的追加互为对方没有的东西,是真分叉,归 409 那一族。
+ *
+ * 入参:`stagedShared` = staged 里 id ∈ dst 集合的那部分(**staged 顺序**);`dst` = 目的端全量
+ * (**dst 顺序**)。两侧都保留各自顺序 —— 摘要顺序显著,共享段的**乱序**同样是分叉。
+ *
+ * 返回 `null` = 无分叉(安全 append);返回非空数组 = 分叉的 entry id(dst 顺序):
+ * 逐条单 entry 摘要不等的 id;若逐条全等而整段摘要不等(纯乱序),列出位置错开的 id。
+ */
+export declare function fastForwardSharedContentDiverged(stagedShared: readonly SessionTreeEntry[], dst: readonly SessionTreeEntry[]): string[] | null;
+/**
+ * 把 fast_forward 的内容级分叉铸成 §7 冲突载荷(SyncConflictError.relation,wire 上是 409 的
+ * `{relation}` 详情)。用现有 `fork` 成员而不是扩词表:内容层它**就是** fork(双方各握着对方
+ * 没有的东西),且 SDK/客户端的关系词表是闭集,扩成员=BREAKING。字段口径(内容级,与 id 级
+ * 注释的措辞差异在此登记):`srcExclusive` = 源端要追加的新 id;`dstExclusive` = 目的端将被
+ * 销毁的共享版本的 id;`commonAncestor` = null(未逐条定位分叉点 —— 定位成本与收益不配)。
+ */
+export declare function contentForkRelation(divergedIds: readonly string[], newEntryIds: readonly string[]): {
+    relation: "fork";
+    commonAncestor: null;
+    srcExclusive: string[];
+    dstExclusive: string[];
+};
 //# sourceMappingURL=session-sync-content.d.ts.map

package/dist/session-sync-content.js

@@ -50,4 +50,46 @@ export function identicalIdsAlsoIdenticalContent(staged, dst) {
         return false; // 目的端没有日志 ⇒ 谈不上"内容相同",按需改写
     return sessionLogDigest(staged) === sessionLogDigest(dst);
 }
+/**
+ * `fast_forward` 的**内容判据**([2557] 审计 A5/F2,2-i)——id 分类器的另一格盲区:
+ * `dst ⊆ src` 只说明 **id 集合**是子集,共享 id 的**载荷**可能已分叉(目的端把某条 entry
+ * 补写/纠正过、id 不变,源端拿着旧版本 + 新追加)。此时按「clean append」整段换装,
+ * 目的端那几条纠正会被**静默销毁** —— §7「会丢目的端历史必须 409(除非显式 overwrite-dst)」
+ * 在载荷层同样成立。与 `identical` 格的口径**方向不同**是刻意的:identical 格 core 已定
+ * 「不符=多干一趟活、照常改写」(那里 src 按 id 完整覆盖 dst,push 语义=以源为准);本格
+ * dst 的共享版本与 src 的追加互为对方没有的东西,是真分叉,归 409 那一族。
+ *
+ * 入参:`stagedShared` = staged 里 id ∈ dst 集合的那部分(**staged 顺序**);`dst` = 目的端全量
+ * (**dst 顺序**)。两侧都保留各自顺序 —— 摘要顺序显著,共享段的**乱序**同样是分叉。
+ *
+ * 返回 `null` = 无分叉(安全 append);返回非空数组 = 分叉的 entry id(dst 顺序):
+ * 逐条单 entry 摘要不等的 id;若逐条全等而整段摘要不等(纯乱序),列出位置错开的 id。
+ */
+export function fastForwardSharedContentDiverged(stagedShared, dst) {
+    if (sessionLogDigest([...stagedShared]) === sessionLogDigest([...dst]))
+        return null;
+    const byId = new Map(stagedShared.map((e) => [e.id, e]));
+    const diverged = [];
+    for (const d of dst) {
+        const s = byId.get(d.id);
+        if (!s || sessionLogDigest([s]) !== sessionLogDigest([d]))
+            diverged.push(d.id);
+    }
+    if (diverged.length === 0) {
+        for (let i = 0; i < dst.length; i++)
+            if (stagedShared[i]?.id !== dst[i].id)
+                diverged.push(dst[i].id);
+    }
+    return diverged;
+}
+/**
+ * 把 fast_forward 的内容级分叉铸成 §7 冲突载荷(SyncConflictError.relation,wire 上是 409 的
+ * `{relation}` 详情)。用现有 `fork` 成员而不是扩词表:内容层它**就是** fork(双方各握着对方
+ * 没有的东西),且 SDK/客户端的关系词表是闭集,扩成员=BREAKING。字段口径(内容级,与 id 级
+ * 注释的措辞差异在此登记):`srcExclusive` = 源端要追加的新 id;`dstExclusive` = 目的端将被
+ * 销毁的共享版本的 id;`commonAncestor` = null(未逐条定位分叉点 —— 定位成本与收益不配)。
+ */
+export function contentForkRelation(divergedIds, newEntryIds) {
+    return { relation: "fork", commonAncestor: null, srcExclusive: [...newEntryIds], dstExclusive: [...divergedIds] };
+}
 //# sourceMappingURL=session-sync-content.js.map

package/dist/session-sync.d.ts

@@ -118,6 +118,13 @@ export interface SessionManifest {
  * 覆盖与一笔**仍然有效**的欠账记账,那正是本仓 `vitest.config.ts` 里写死的判据「覆盖丢失伪装成绿,
  * 比假红更坏」。⇒ **删除的前置条件**是先把 B4/G1 重锚到活的流式路径上;做完那件,这两个函数连同它们的
  * 测试可一并摘除。判定与机器门见 `test/session-sync-routes.test.ts` 的「死码判定」describe。
+ *
+ * ✅ **前置条件已达成**(2026-08-05,[2557] 审计 2-i):B4 已重锚活路由(fanout-characterization §H ×3 +
+ * sync-commit-write-parity 三后端判据,commit 半场的 fast_forward 载荷缺口**已修**)并销账;G1 改性质为
+ * 「老客户端路现状钉」(wire 级、不依赖本模块)。⇒ 本模块 + 依赖它的测试段现在**可以整体摘除**——
+ * 剩余依赖=fanout-characterization §A/§B/§F 与 crash-recovery 全文件(§8 扇出切点矩阵的死码腿;活路由的
+ * 崩溃/重试语义已由 E 系列 + staging reaper 钉覆盖,摘除前需逐段核对该等价性)。单独排一班机械车做,
+ * 别混进行为修的车。
  */
 export declare function exportSession(sessionId: string, srcBackend: StoreBackend): Promise<{
     bundle: SessionBundle;

package/dist/session-sync.js

@@ -52,6 +52,13 @@ function ownerAware(backend) {
  * 覆盖与一笔**仍然有效**的欠账记账,那正是本仓 `vitest.config.ts` 里写死的判据「覆盖丢失伪装成绿,
  * 比假红更坏」。⇒ **删除的前置条件**是先把 B4/G1 重锚到活的流式路径上;做完那件,这两个函数连同它们的
  * 测试可一并摘除。判定与机器门见 `test/session-sync-routes.test.ts` 的「死码判定」describe。
+ *
+ * ✅ **前置条件已达成**(2026-08-05,[2557] 审计 2-i):B4 已重锚活路由(fanout-characterization §H ×3 +
+ * sync-commit-write-parity 三后端判据,commit 半场的 fast_forward 载荷缺口**已修**)并销账;G1 改性质为
+ * 「老客户端路现状钉」(wire 级、不依赖本模块)。⇒ 本模块 + 依赖它的测试段现在**可以整体摘除**——
+ * 剩余依赖=fanout-characterization §A/§B/§F 与 crash-recovery 全文件(§8 扇出切点矩阵的死码腿;活路由的
+ * 崩溃/重试语义已由 E 系列 + staging reaper 钉覆盖,摘除前需逐段核对该等价性)。单独排一班机械车做,
+ * 别混进行为修的车。
  */
 export async function exportSession(sessionId, srcBackend) {
     const session = ownerAware(srcBackend);

package/dist/tool-approval.js

@@ -382,18 +382,19 @@ export class ToolApprovalCoordinator {
         // [1559]三:emit 完成 vs TTL/abort/respond 三选一落定——显式 race,不让挂死的 emit 独占执行权。
         await Promise.race([emitAllP, allowedP]);
         const settled = await allowedP;
-        // Completion breadcrumb (card dismiss) — fire-and-forget to every target that actually got the OPEN frame
-        // (aliveCtxs — a ctx filtered out at entry as already-dead never saw `tool_approval` in the first place, so
-        // it has nothing to dismiss), so a slow/hung emit never delays returning to core AND every connection in
-        // the set learns the card resolved elsewhere([1559]四「其余连接收 resolved/dismissed 通知」的直接落点——
-        // 单连接场景退化为原来的一次 emit)。**per-ctx 链在该 ctx 自己的 openP 之后**(F2 修的落点)——
-        // `openByCtx.get(c)!` 永不 reject(emitOne 内部已吸收),所以不需要额外 `.catch` 才能继续链下去;
-        // `.then(() => c.emit(...))` 包一层是必须的:该 ctx 的 complete emit 若同步 throw,要先转成
-        // rejection 才能被后面的 `.catch` 接住,否则会在此处同步抛出、跳过 catch。
+        // Completion breadcrumb (card dismiss) — fire-and-forget to every target that actually got the OPEN frame,
+        // so a slow/hung emit never delays returning to core AND every connection that saw the card learns it
+        // resolved elsewhere([1559]四「其余连接收 resolved/dismissed 通知」的直接落点——单连接场景退化为
+        // 原来的一次 emit)。**per-ctx 链在该 ctx 自己的 openP 之后且看它的布尔结果**([2557] 批3 F2 D1 修,
+        // 2026-08-06):emitOne 失败是 resolve(false) 不是 reject,旧形 `.then(() => emit(complete))` 对
+        // resolve 值全放行 ⇒ open 没送达的连接(瞬断型 emit 目标)也收 `tool_approval_complete` = 孤儿
+        // close,注释与代码曾不符(红先=wire-pairing-approval D1,修后翻正)。`delivered` 门后:
+        // `.then((delivered) => delivered ? c.emit(...) : undefined)` —— complete emit 若同步 throw,
+        // `.then` 回调内抛出转成 rejection 由尾部 `.catch` 吸收(链形不变)。
         for (const c of aliveCtxs) {
             void openByCtx
                 .get(c)
-                .then(() => c.emit({ type: "tool_approval_complete", approvalId: id, outcome: lastOutcome }))
+                .then((delivered) => (delivered ? c.emit({ type: "tool_approval_complete", approvalId: id, outcome: lastOutcome }) : undefined))
                 .catch(() => undefined);
         }
         // emit 全灭 = 卡从未送达任何人(≠人拒绝/TTL 走人)——同属「无活人可达」类 ⇒ "unavailable" 交 durable

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "6.4.0",
+  "version": "6.6.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.10.0",
+    "@sema-agent/core": "^5.11.0",
     "@sema-agent/registry-core": "^0.14.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.3.0",
+    "@sema-agent/sdk": "^6.4.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",