@sema-agent/server 7.103.2 → 7.105.0

package/dist/observability/corrupt-read-seat.js

@@ -1,13 +1,18 @@
-export function createCorruptReadSeat(warn, event, note) {
-    return (info) => warn(event, {
-        kind: info.kind,
-        path: info.path,
-        reason: info.reason,
-        ...corruptReadLevelFields(info),
-        ...(info.sessionId !== undefined ? { sessionId: info.sessionId } : {}),
-        ...(info.principal !== undefined ? { principal: info.principal } : {}),
-        ...(note !== undefined ? { note } : {}),
-    });
+import { readJsonlRecords } from "@sema-agent/core";
+import { recordFailOpen } from "./fail-open.js";
+export function createCorruptReadSeat(warn, event, note, leg) {
+    return (info) => {
+        leg?.(info);
+        return warn(event, {
+            kind: info.kind,
+            path: info.path,
+            reason: info.reason,
+            ...corruptReadLevelFields(info),
+            ...(info.sessionId !== undefined ? { sessionId: info.sessionId } : {}),
+            ...(info.principal !== undefined ? { principal: info.principal } : {}),
+            ...(note !== undefined ? { note } : {}),
+        });
+    };
 }
 function corruptReadLevelFields(info) {
     switch (info.kind) {
@@ -29,19 +34,157 @@ export function buildDurableAbsenceNote(thirdFace) {
         "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
         `rows; ${thirdFace}. Inspect the named path before deciding.`);
 }
-export function createSkippedRecordSink(onRecord) {
+const RULE_LANE_REMEDY = "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)";
+export const JSONL_REPLAY_SEATS = {
+    "approval-nonce": {
+        direction: "fail-closed",
+        event: "approval_nonce_corrupt_read",
+        face: "approval-nonce ledger",
+        note: "S-582 fail-closed: an unreadable consumption record may be a SPENT plan_review nonce — replaying the rest would accept that proof again. " +
+            "The ledger refuses every consume/reap until a person inspects the file (direct-door plan_review answers 5xx meanwhile; /decide is unaffected).",
+        remedy: "direct-door plan_review is refused until a person inspects the file. Moving it aside forgets every consumption in it — each of those proofs " +
+            "could be replayed until it expires (PRINCIPAL_JWT_MAX_TTL_SEC plus skew after it was recorded) — so move it aside only once that window has passed, then restart",
+    },
+    "approval-exemption": {
+        direction: "fail-closed",
+        event: "approval_exemption_corrupt_read",
+        face: "approval-exemption log",
+        note: "S-582 fail-closed: an unreadable record may be a REVOKE tombstone — replaying the rest would resurrect a revoked \"don't ask again\". " +
+            "That session's exemptions are refused (every tool asks) until a person inspects the file; other sessions are unaffected.",
+        remedy: "this session's exemptions are refused (the tool asks every time) until a person inspects the file; deleting the session, or moving the file " +
+            "aside and restarting, drops this session's exemptions (they will be asked for again)",
+    },
+    "permission-rule-approvals": {
+        direction: "fail-closed",
+        event: "permission_rule_approvals_corrupt_read",
+        face: "permission-rule approval log",
+        note: "S-582 fail-closed: an unreadable snapshot would roll a rule-approval record (and its rev) back to an earlier state. The face refuses every read and write until a person inspects the file.",
+        remedy: RULE_LANE_REMEDY,
+    },
+    "permission-rule-tickets": {
+        direction: "fail-closed",
+        event: "permission_rule_tickets_corrupt_read",
+        face: "permission-rule import-ticket log",
+        note: "S-582 fail-closed: an unreadable consume/release line would resurrect a claimed import ticket as unclaimed (one human consent redeemed twice). The face refuses every read and write until a person inspects the file.",
+        remedy: RULE_LANE_REMEDY,
+    },
+    "approval-ask-journal": {
+        direction: "fail-open",
+        event: "approval_ask_journal_corrupt_read",
+        tag: "server.approval-ask-journal.corrupt-record-skipped",
+        note: "F: a skipped ask-journal record loses an ask transition's PROGRESS, never a gate (every write is CAS-guarded); the original is quarantined next to the journal.",
+    },
+    "run-store": {
+        direction: "fail-open",
+        event: "run_store_corrupt_read",
+        tag: "server.run-store.corrupt-record-skipped",
+        note: "F: a skipped run.json reads that run as ABSENT ('no such run'); a skipped events.jsonl line is one trace event missing from replay; " +
+            "a skipped claim record sends that claim down the torn-claim path (adopted by its live row, else quarantined).",
+    },
+    "resume-anchor": {
+        direction: "fail-open",
+        event: "resume_anchor_corrupt_read",
+        tag: "server.resume-anchor.corrupt-record-skipped",
+        note: "F: a skipped anchor means that eventId no longer resolves (resumeAt / rewindFilesTo answer 404 unknown_event for it; the next put re-records it).",
+    },
+    "send-file-ledger": {
+        direction: "fail-open",
+        event: "send_file_ledger_corrupt_read",
+        tag: "server.send-file-ledger.corrupt-record-skipped",
+        note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).",
+    },
+};
+function corruptRefusalSentence(seat, path, reason) {
+    const entry = JSONL_REPLAY_SEATS[seat];
+    return `refusing to use a corrupt ${entry.face} (${path}): ${reason} — ${entry.remedy}`;
+}
+export class JsonlStoreCorruptError extends Error {
+    kind = "corrupt";
+    seat;
+    path;
+    reason;
+    constructor(seat, path, reason) {
+        super(corruptRefusalSentence(seat, path, reason));
+        this.name = "JsonlStoreCorruptError";
+        this.seat = seat;
+        this.path = path;
+        this.reason = reason;
+    }
+}
+export class JsonlStoreGate {
+    seat;
+    path;
+    reason;
+    constructor(seat, path) {
+        this.seat = seat;
+        this.path = path;
+    }
+    trip(reason) {
+        this.reason ??= reason;
+    }
+    get tripped() {
+        return this.reason !== undefined;
+    }
+    assertUsable() {
+        if (this.reason !== undefined)
+            throw new JsonlStoreCorruptError(this.seat, this.path, this.reason);
+    }
+}
+const warnToConsole = (event, fields) => console.warn(event, fields);
+const isThenable = (v) => typeof v === "object" && v !== null && typeof v.then === "function";
+function guardDisclosure(disclose, event) {
+    const reportSinkFailure = (info, err) => warnToConsole(`${event}_sink_failed`, { kind: info.kind, path: info.path, reason: info.reason, sinkError: err instanceof Error ? err.name : typeof err });
     return (info) => {
+        let out;
+        try {
+            out = disclose(info);
+        }
+        catch (err) {
+            reportSinkFailure(info, err);
+            return;
+        }
+        if (isThenable(out))
+            out.then(undefined, (err) => reportSinkFailure(info, err));
+    };
+}
+function replayJsonl(path, seat, shape, warn, onSkipped) {
+    const entry = JSONL_REPLAY_SEATS[seat];
+    const disclose = guardDisclosure(createCorruptReadSeat(warn ?? warnToConsole, entry.event, entry.note), entry.event);
+    const judge = { what: shape.what, accepts: (record) => shape.read(record) !== undefined };
+    const kept = readJsonlRecords(path, (info) => {
         switch (info.kind) {
             case "record":
-                onRecord(info);
-                return;
+                onSkipped(info);
+                break;
             case "replay":
-                return;
+                break;
             default: {
                 const unreachable = info;
                 return unreachable;
             }
         }
-    };
+        disclose(info);
+    }, judge);
+    return kept.map((record) => {
+        const value = shape.read(record);
+        if (value === undefined) {
+            throw new Error(`JSONL replay seat ${seat}: the shape reader accepted a record of ${path} and then refused it — a shape reader must be a pure function of the record`);
+        }
+        return value;
+    });
+}
+export function replayJsonlGuarded(path, seat, shape, warn) {
+    const gate = new JsonlStoreGate(seat, path);
+    const records = replayJsonl(path, seat, shape, warn, (info) => gate.trip(info.reason));
+    return { records, gate };
+}
+export function replayJsonlSkipping(path, seat, shape, warn) {
+    const { tag } = JSONL_REPLAY_SEATS[seat];
+    let skipped = 0;
+    const records = replayJsonl(path, seat, shape, warn, (info) => {
+        skipped += 1;
+        recordFailOpen(tag, `path=${info.path} reason=${info.reason}`);
+    });
+    return { records, skipped };
 }
 //# sourceMappingURL=corrupt-read-seat.js.map

package/dist/observability/fail-open.d.ts

@@ -259,7 +259,11 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.run-terminal.redact-threw": {
         readonly cls: "F";
-        readonly note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
+        readonly note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形由 S-219 的 atLeast 铸点闭掉;JSON 秘密字段臂的转义对循环与 PEM 栅栏臂的标签交替循环由 S-265 换成手写线性扫描器闭掉 —— 已知形全部闭掉,本臂留作结构性兜底,计数恒零是证据、不归零即新形)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。";
+    };
+    readonly "server.run-terminal.provider-echo-shaped": {
+        readonly cls: "F";
+        readonly note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 / 7.34.1 源头闸同一条):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;空串与非串值都在外)⇒ **缺席**(键删掉 / 不铸)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。";
     };
     readonly "server.run-terminal.redact-capped": {
         readonly cls: "F";
@@ -301,6 +305,18 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-609(`routes/approvals-assistant.ts` 的 `GET /v1/assistant/inbox`):某一行的续跑上下文(checkpoint_ctx)读出来是**坏体**(店的拒绝契约 `StoreCorruptError`;local = 档不是 JSON / 信封不合形,SQL = 列是合法 JSON 但不是一只对象)⇒ **这一行**的 `objective` 落 `null`,列表其余照常。放行的最坏后果 = inbox 上这一张卡不显示它属于哪个任务(纯展示位;这一格不参与任何决裁、续跑或门判 —— 续跑腿与 plan_review 门对同一行各自走读口、坏体一律响亮 500)。不放行的代价是整只 `summaries.map` 抛出 ⇒ 一行坏体打掉整个用户的 inbox。故 F 类;必须留痕,因为修前那句 `.catch(() => null)` 让「坏体」与「本来就没有」同形无痕(detail = 读口转述的 `where`,人拿它去修那一行)。缺席(行不在 / 店抖动)**不**记本 tag:那是读口的刻意保守,不是失败开放。";
     };
+    readonly "server.run-store.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-582(`plugins/file-run-store.ts`,local 车道的 File 形 run 店;三个盘面同一只座):盘上一条记录读不出形 —— 一行 `42` / 缺本店必填键的对象 / 中间的半截 JSON(撕尾不走本 tag,那是崩溃的正常落盘形)⇒ 跳过它继续。三个盘面各自的最坏后果:`run.json` 坏 ⇒ 那条 run 读成**缺席**(`GET /v1/runs/:id` 404,listRuns 少一行;它若占着 claim,EEXIST 路按「行不在」判残骸接管);`events.jsonl` 一行坏 ⇒ 回放少一个事件(其余照读、按 seq 去重不变);claim 记录坏 ⇒ 走既有的撕裂 claim 路(有非终局行就收编,否则隔离出 activeDir)。都是**可用性**损失,不开任何门 ⇒ F。修前三面全零披露(店自己的 `typeof … continue` 与 core 的静默跳过);计数让「这台机器的 run 账在腐」在遥测里显形。⚠️ `RUN_STORE_STRICT_HYDRATE=on` 的射程是「文件读不出」,不含「文件里有坏行」—— strict 档下坏行照走本 tag(未改 strict 语义,见普查表第 96 行)。";
+    };
+    readonly "server.resume-anchor.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-582(`plugins/file-resume-anchor-store.ts`,local 车道的 E18 续跑锚日志):一条锚记录读不出形(`42` / 缺 eventId·entryId / 中间半截 JSON)⇒ 跳过它继续重放。最坏后果 = 那个 eventId 不再解析得出(`resumeAt` / `rewindFilesTo` 对它答 404 `resume_at.unknown_event` / `rewind_files_to.unknown_event` —— `boot/resolve-spec.ts` 的解析腿;下一次 put 会把它重记)。锚是**定位**事实,不是授权事实(属主守卫在行上另有 `owner` 列)⇒ F。修前零披露。";
+    };
+    readonly "server.send-file-ledger.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -250,7 +250,11 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.run-terminal.redact-threw": {
         cls: "F",
-        note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形已由 S-219 的 atLeast 铸点闭掉,仍能抛的是 JSON 秘密字段臂的转义对循环,既有未闭,S-106)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
+        note: "三个发射座(errorMessage 终态文案 / 诊断文本 diag / 工件 artifact,probe 前缀判别;普查 56 行;补丁头 patch-head 那座随 7.83.0 / S-113 的 redactPatchHead 一并退役):S-105 最终轮 [medium]:终态 errorMessage/blockedReason/remoteEnvFailures[].message 脱敏抛出(RangeError:关键字/前缀臂那一形由 S-219 的 atLeast 铸点闭掉;JSON 秘密字段臂的转义对循环与 PEM 栅栏臂的标签交替循环由 S-265 换成手写线性扫描器闭掉 —— 已知形全部闭掉,本臂留作结构性兜底,计数恒零是证据、不归零即新形)⇒ 落固定占位 «redacted:oversized»——绝不落原文(安全轴 fail-closed),也绝不阻断终态翻转与 claim 释放(可用性)。方向刻意:一条超大错误体不得把 run 卡在 running。",
+    },
+    "server.run-terminal.provider-echo-shaped": {
+        cls: "F",
+        note: "S-283(7.105.0,`observability/run-terminal.ts` 的 `admitProviderEcho`,唯一判决口;S-889 起动作与 core #1204 / 7.34.1 源头闸同一条):模型服务商回声、引擎逐字转交的不透明 id(`apiFailure.requestId` / `responseModel`,以及账本孪生 `turn_end.responseModel`、子代通告 `task_notification.apiFailure.requestId` 与 `POST /v1/side-query` 200 体的 `responseModel`;铸点 + 账本汇点两口)越出形状(字符串、长度 1–128、每个码元是可见 ASCII 0x21–0x7E;空串与非串值都在外)⇒ **缺席**(键删掉 / 不铸)。方向是 **fail-closed**(越界字节不上 wire / 不落库 / 不进日志),不截断、不过脱敏器(不透明 id,脱敏会改坏它 —— 与 S-270 structuredOutput 同方向)。放行的最坏后果 = 这枚 id / 模型名在 wire 上缺席(`apiFailure` 留 `{}` = 「provider 故障、无可补充标签」,core 契约原句),运维拿不到它去服务商那边对单;detail 只带座位 / 原长或类型,**不带值**。计数非零 = 这台部署接的端点(或中间网关)在回显越界字节,运维按座位去查那一跳;读面不改写存量行,存量越界行每次回放各计一次。",
     },
     "server.run-terminal.redact-capped": { cls: "F", note: "S-107:终态自由文本(errorMessage/blockedReason/remoteEnvFailures[].message/error 列/done·failed 行)长度 > REDACT_INPUT_CAP(64KB)⇒ 整段换 «redacted:oversized»(fail-closed 取证丢弃,不截断不扫);计数=多少条终态文案被整段丢弃" },
     "server.run-terminal.artifact-capped": { cls: "F", note: "S-107:leader_run 行上的工件字节(salvaged[].patch / candidatePatch.patch / merge.candidatePatch / merge.rej)长度 > ARTIFACT_INPUT_CAP(256KB)⇒ 整份换 «redacted:oversized-artifact»(fail-closed 取证丢弃;原字节仍在 worker 分支/merge 咽喉);计数=多少份工件被整份丢弃" },
@@ -274,6 +278,18 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-609(`routes/approvals-assistant.ts` 的 `GET /v1/assistant/inbox`):某一行的续跑上下文(checkpoint_ctx)读出来是**坏体**(店的拒绝契约 `StoreCorruptError`;local = 档不是 JSON / 信封不合形,SQL = 列是合法 JSON 但不是一只对象)⇒ **这一行**的 `objective` 落 `null`,列表其余照常。放行的最坏后果 = inbox 上这一张卡不显示它属于哪个任务(纯展示位;这一格不参与任何决裁、续跑或门判 —— 续跑腿与 plan_review 门对同一行各自走读口、坏体一律响亮 500)。不放行的代价是整只 `summaries.map` 抛出 ⇒ 一行坏体打掉整个用户的 inbox。故 F 类;必须留痕,因为修前那句 `.catch(() => null)` 让「坏体」与「本来就没有」同形无痕(detail = 读口转述的 `where`,人拿它去修那一行)。缺席(行不在 / 店抖动)**不**记本 tag:那是读口的刻意保守,不是失败开放。",
     },
+    "server.run-store.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-582(`plugins/file-run-store.ts`,local 车道的 File 形 run 店;三个盘面同一只座):盘上一条记录读不出形 —— 一行 `42` / 缺本店必填键的对象 / 中间的半截 JSON(撕尾不走本 tag,那是崩溃的正常落盘形)⇒ 跳过它继续。三个盘面各自的最坏后果:`run.json` 坏 ⇒ 那条 run 读成**缺席**(`GET /v1/runs/:id` 404,listRuns 少一行;它若占着 claim,EEXIST 路按「行不在」判残骸接管);`events.jsonl` 一行坏 ⇒ 回放少一个事件(其余照读、按 seq 去重不变);claim 记录坏 ⇒ 走既有的撕裂 claim 路(有非终局行就收编,否则隔离出 activeDir)。都是**可用性**损失,不开任何门 ⇒ F。修前三面全零披露(店自己的 `typeof … continue` 与 core 的静默跳过);计数让「这台机器的 run 账在腐」在遥测里显形。⚠️ `RUN_STORE_STRICT_HYDRATE=on` 的射程是「文件读不出」,不含「文件里有坏行」—— strict 档下坏行照走本 tag(未改 strict 语义,见普查表第 96 行)。",
+    },
+    "server.resume-anchor.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-582(`plugins/file-resume-anchor-store.ts`,local 车道的 E18 续跑锚日志):一条锚记录读不出形(`42` / 缺 eventId·entryId / 中间半截 JSON)⇒ 跳过它继续重放。最坏后果 = 那个 eventId 不再解析得出(`resumeAt` / `rewindFilesTo` 对它答 404 `resume_at.unknown_event` / `rewind_files_to.unknown_event` —— `boot/resolve-spec.ts` 的解析腿;下一次 put 会把它重记)。锚是**定位**事实,不是授权事实(属主守卫在行上另有 `owner` 列)⇒ F。修前零披露。",
+    },
+    "server.send-file-ledger.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/observability/metrics.js

@@ -241,7 +241,7 @@ export function createMetrics() {
     m.counter("task_model_not_allowlisted_resume_total", "Resumed legs whose model/compactionModel is outside the @-mention allowlist (allowed to keep running by design — the allowlist gates fresh picks only)");
     m.counter("task_model_unavailable_fallback_total", "Resumed legs whose explicit model pick names a catalog entry that is unavailable on this deployment (no brain mounted for its provider / entry fails its schema) — the leg runs on the default model; fresh submits get 400 request.model_unavailable");
     m.counter("prompt_constitution_total", "Prompt assembly constitution mode per task (core 1.243 提示词主权): steady state = core; provider-assembled/replaced/legacy warrant eyes");
-    m.counter("rewind_snapshot_failed_total", "Per-turn rewind file snapshots that failed, by the engine's FileHistoryResult.error.code (snapshot_failed/aborted/…; `unknown` = the disclosure text carried no readable code). COARSE on purpose — whether a failure is permanent (the same file will fail every turn until the deployment changes) is counted by file_history_permanent_failure_total instead, from the typed error object rather than from prose");
+    m.counter("rewind_snapshot_failed_total", "Per-turn rewind file snapshots that failed, by the engine's FileHistoryResult.error.code (snapshot_failed/aborted/…; `unknown` = the text carried no word of that closed set, e.g. the boundary-timeout arm). COARSE on purpose — whether a failure is permanent (the same file will fail every turn until the deployment changes) is counted by file_history_permanent_failure_total instead, from the typed error object rather than from prose");
     m.counter("verifications_total", "Tasks run through the verification gate (1.44), by final verdict");
     m.counter("cascade_total", "Tasks run through the model cascade (1.45), by outcome (passed/exhausted)");
     m.counter("degenerate_total", "Degenerate-output failures (1.59), by salvage class (a/b/unknown)");

package/dist/observability/run-terminal.d.ts

@@ -1,4 +1,4 @@
-import { type RunRecord } from "../plugins/store-contracts.js";
+import { type PersistedTaskResult, type RunRecord } from "../plugins/store-contracts.js";
 /** 一次终局写口交给观测面的原料(store 侧装配,**未脱敏** —— 脱敏在本模块内做,见 {@link notifyRunTerminal})。 */
 export interface RunTerminalRecord {
     /** 这条 run 的账本 id = `GET /v1/runs/:id` 的 id(本仓 run 行主键名为 taskId,同一个值)。 */
@@ -78,10 +78,12 @@ export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
 /** S-105(test [ref] 旁生):终态**持久化**的 `errorMessage` 与日志副本同一脱敏口——provider 错误体(403 体带回显请求头/
  *  订阅链接)里的密钥形不得原文落 run 行再由 `GET /v1/runs/:id` 直出。三 run store 的 `setTerminal` 写入前同调此函数;
  *  `undefined` 透传(缺席仍缺席),不截断(日志上限是日志的事,行上保留全文供取证)。 */
-/** r4 最终轮 [medium]:`redactSecrets` 会抛 `RangeError`(关键字/前缀臂那一形已由 S-219 的 `atLeast` 铸点闭掉;仍能抛的是
- *  JSON 秘密字段臂的转义对循环,既有未闭,S-106 登记);S-105 把脱敏
+/** r4 最终轮 [medium]:`redactSecrets` 曾会抛 `RangeError`(关键字/前缀臂那一形由 S-219 的 `atLeast` 铸点闭掉;JSON 秘密字段臂的
+ *  转义对循环与 PEM 栅栏臂的标签交替循环由 S-265 换成手写线性扫描器闭掉 —— 已知形全部闭掉);S-105 把脱敏
  *  挪到 `setTerminal` **入口**后,这个抛会先于 CAS/claim 释放 ⇒ run 卡 `running`、会话 claim 悬挂到 reaper。这里 **fail-closed
- *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。 */
+ *  不抛**:脱敏失败 ⇒ 落固定占位 `«redacted:oversized»`(绝不落原文,也绝不阻断终态翻转),并走既有 fail-open 遥测 tag。
+ *  🔴 S-265 之后这条 throw 臂**照留**(结构性兜底,不依赖「脱敏器今天抛不抛」):它守的是「终态翻转不被一次脱敏异常拦下」,
+ *  而脱敏器是一张会长新臂的表 —— 计数 `server.run-terminal.redact-threw` 恒零是证据,不归零就是新形,运维按 detail 回溯。 */
 export declare const OVERSIZED_REDACTION_PLACEHOLDER = "\u00ABredacted:oversized\u00BB";
 /** S-107 窄范围重扫 [medium]:`redactSecrets` 对 PEM 起始栅栏密集的多 MB 文案**不抛但慢**(实测 1MB 1.4s / 8MB 7.9s 同步阻塞
  *  事件循环),而终态座每次写要扫两遍(appendEvent + setTerminal 入口)、每次读再扫一遍。超过本上限的自由文本**整段**换占位
@@ -111,20 +113,26 @@ export declare function redactErrorMessage(raw: string | undefined): string | un
  *    ⚠️ **命中那一次仍然给剥后文本**(S-103 的「先扫描后渲染」不动摇):把零宽字符塞进密钥中间的那条文本,
  *    渲染的必须是剥后那份,否则消费端把残片拼回原钥。
  * ② **扫描器抛 ⇒ 登记过的占位(fail-closed),不把整条 run 拖下水**(codex r1 [high],亲核实测后修)。
- *    `redactSecrets` 的 JSON 秘密字段臂仍含多字符循环体(S-106 既有未闭:`(?:\\.[^"\\]*)*`),实测
+ *    立案时 `redactSecrets` 的 JSON 秘密字段臂含多字符循环体(`(?:\\.[^"\\]*)*`),实测
  *    `{"password":"<400 万个 \\n 转义对>"}`(8MB)抛 `RangeError`。`result` 接进来之前这条路不存在;接进来之后,
  *    裸调用会让异常穿过 `redactTerminalResult` → 三孪生 `setTerminal`,**一条跑成功的 run 落成 failed + result:null**
  *    (实测读数)。⇒ 与本文件既有的 {@link redactErrorMessage} / `redactDiagnosticText` / `redactArtifactText`
  *    三座**同一条**处置:抛就换占位、计数、留痕([ref] 的 loud,不是静默 fail-open)。丢的是这一条病态文本,
- *    不是这条 run。根因(那条正则)是 S-106 的独立车,本函数不在复审轮里改它。
+ *    不是这条 run。根因(那条正则)由 S-265(7.105.0)换成手写线性扫描器闭掉(同批闭掉同类第二例 PEM 栅栏标签循环);
+ *    本处置**照留** —— 理由同 {@link OVERSIZED_REDACTION_PLACEHOLDER} 顶注末句。
  * ③ **不设体量上限**(裁定):`result` 住在 `result` JSON/JSONB 列(亲核 `plugins/tidb-pool.ts` 与
  *    `plugins/pg-pool.ts` 的 DDL),数 MB 终稿是正常形 —— {@link redactErrorMessage} 的两道上限是为
  *    `task_run.error` 那一列 `TEXT(65 535 字节)` 定的,套到这里等于用静默的数据损坏换一次脱敏。
  */
 export declare function redactModelText(raw: string): string;
-/** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形的 `"redacted"` 行 ∪ 旧形平面键;
- *  `memoRedactTerminalResult` 的记忆键由它派生(两处同源,见 `RESULT_KEY_TREATMENT` 顶注)。 */
-export declare const REDACTABLE_RESULT_LEAVES: readonly string[];
+/** 回声座上的值留不留:形内 ⇒ `true`(原样留);`undefined` ⇒ `false`(缺席本身,不计数);其余越界 ⇒ `false` + 计数。
+ *  调用方按 `false` 删键 / 不铸键 —— 本函数是全部回声座(结果面 / 账本孪生 / 子代通告 / side-query 200 体)的**唯一**判决口。 */
+export declare function admitProviderEcho(value: unknown, seat: string): value is string;
+/** {@link redactTerminalResult} 会碰的全部顶层键 = 现行形里**不是** `"verbatim"` 的行(`"redacted"` ∪ S-283 的
+ *  `"provider-echo"`)∪ 旧形平面键;`memoRedactTerminalResult` 的记忆键由它派生(两处同源,见 `RESULT_KEY_TREATMENT` 顶注)。
+ *  🔴 S-283 起改名(原 `REDACTABLE_RESULT_LEAVES`):回声键不脱敏但**会被改**(越界 ⇒ 删键),漏进记忆键集 = 读面记忆腿对存量行
+ *  O(1) 原样直返,读面纵深对那几片恒不生效([ref] 立案时 `editedFiles` 那一格的同一个病)。 */
+export declare const TREATED_RESULT_LEAVES: readonly string[];
 export declare function redactTerminalResult<T extends {
     terminal?: unknown;
     /** 旧形(≤7.63.0)的三个顶层座;形上取 `unknown` —— 读盘面对盘上字节不作假设。 */
@@ -144,7 +152,25 @@ export declare function redactTerminalResult<T extends {
     editedFiles?: unknown;
     /** S-394:形上同样 `unknown` —— 本函数是读盘面,`stats` 的树形逐层现判(见 {@link redactStats})。 */
     stats?: unknown;
+    /** S-283:provider 回声三键(形上 `unknown`,读盘面纪律同上;处置见 {@link PROVIDER_ECHO_SHAPERS})。 */
+    apiFailure?: unknown;
+    strandedHumanAnswers?: unknown;
+    responseModel?: unknown;
 } | null | undefined>(result: T): T;
+/**
+ * 🔴 **S-173 —— run 行 `result` 列的唯一入口**:先过出口封口({@link sealResultForExit}:摘恢复凭据 + 折域外码),
+ * 再过 {@link redactTerminalResult}。三家 run 店(SQL 两方言 / file / memory)的**三个**写口 —— `setTerminal` 与
+ * park 两口 `setSuspended` / `setNeedsReview` —— 入口各调一次,列上的字节因此只有一条来路。
+ *
+ * 为什么封口也挪到店的入口(而不只靠调用方):S-173 之前这一列只收终局结果,而终局结果上凭据只可能藏在
+ * `failed.nestedPause` 一处、且每个调用点都已先封口。park 两口收的是 **`paused` 因由** —— 那一臂按 core 的
+ * 类型**必带** `token`(引擎内契约)。凭据挂在「每个调用点都记得先封口」上 = 漏一处就是一次凭据落盘、且
+ * 不会红([ref] 安全轴:fail-closed,不是约定)。两件事都**幂等**(封过口的再封是同形、脱过的再脱是同一引用),
+ * 所以调用点已封过口的腿零行为变化。
+ *
+ * `null` 原样(= 这条腿没有结果可落:引擎没给终局就收流 / 断连竞态 park / 重开 re-park)。
+ */
+export declare function sealRunRowResult(result: PersistedTaskResult | null): PersistedTaskResult | null;
 /** S-107(第五轮合并重扫 wf_f00c00bc 两根 [high]):同一个 `TaskResult` 除 run 行外还被逐字追加进 run_events 的 `done` 行
  *  (bg/verify/cascade/stream/resume 五腿),`failed` 行带原文 `errorMessage`,`GET /v1/runs/:id/events` 原样回放。
  *  三孪生 `appendEvent` 入口 + 事件读面(旧行纵深)同调本函数:只认 `done.result`(整块走 `redactTerminalResult`)与
@@ -188,7 +214,7 @@ export declare function redactLeaderResultWithFlag(result: unknown): {
     changed: boolean;
 };
 export declare function memoRedactedRead<T>(seat: string, raw: T, redact: (v: T) => T): T;
-/** run 终态 result 的读面记忆只按**可脱敏的那几叶**({@link REDACTABLE_RESULT_LEAVES},属主是
+/** run 终态 result 的读面记忆只按**本函数会改字节的那几叶**({@link TREATED_RESULT_LEAVES}:脱敏叶 ∪ S-283 回声叶 ∪ 旧形平面键,属主是
  *  `RESULT_KEY_TREATMENT`)做键与留体——
  *  第十六轮重扫:按整块 result 摘要每次轮询要 stringify 一份可能数 MB 的 result,且大 result 的脏行永远存不进去。叶全缺席
  *  ⇒ O(1) 直返(`redactTerminalResult` 本就同引用)。
@@ -201,6 +227,30 @@ export declare function memoRedactedRead<T>(seat: string, raw: T, redact: (v: T)
  *  `editedFiles` 那一格的病)。读数:8MB result 的一次摘要 ~10ms 量级,远小于一次全扫;干净行仍只摘要
  *  一次即进 clean 集,脏行超过 {@link READ_MEMO_DIRTY_MAX_ENTRY_BYTES} 时退化为每次重扫(既有形)。 */
 export declare function memoRedactTerminalResult<T extends Parameters<typeof redactTerminalResult>[0]>(seat: string, result: T): T;
+/**
+ * 🔴 **账本行的读面口 —— 全部耐久读腿共用这一只**(S-269,7.105.0)。
+ *
+ * 脱敏的**属主**仍是 {@link redactLedgerEventData}(写读共用的唯一汇点,规则一张:哪些行型有自由文本座、怎么脱);
+ * 本函数**不是第二只脱敏器**,只在汇点外面加一层**按型记忆**(读面每次轮询 / 每个观看者 / 每次重连都重放同一批
+ * 不可变的行):
+ *  · `done` 行 —— 只按 `result` 的可脱敏叶记忆({@link memoRedactTerminalResult};整块 result 可能数 MB);
+ *  · `failed` 行与模型自由文本两行(`text` / `reasoning`,词表属主 `trace/ledger-events.ts`)—— 按内容摘要记忆({@link memoRedactedRead});
+ *  · 其余行型 —— 直调汇点(park 行只有一个小 gate,扫一次的代价远低于摘要 + 记忆表位;其余型汇点逐字透传)。
+ *
+ * **三条耐久读腿同调**:`GET /v1/runs/:id/events`(账本裸回放)、`GET /v1/tasks/:id/turns`(`projectEvents`)、
+ * trace SSE `GET /v1/tasks/:id/stream`(`mapTraceEvent`)。此前只有第一条在 `formatEvent` 里手写了这段分派,后两条
+ * **直吃原行** —— 新行在三孪生 `appendEvent` 落库前已脱,所以只打在**存量行**上:7.75.1(B-106)之前 `text` 行的写口
+ * 不脱,那批行在两条 trace 腿上原字节回放(S-269,车EC U-2)。分派收进本函数、三条腿同调 ⇒ 读面纵深一条规则。
+ *
+ * **性能取舍(读实现后定)**:汇点对已脱行在**输出**上幂等(`redactModelText` 认不出凭据形就回同一引用),但**代价不是
+ * 空过** —— 每次都整段重扫(`redactSecrets` 全池一遍)。所以读面走记忆:同一行第二次起只付一次 sha256 摘要 + 集合查找
+ * (车QO 本机实测,8.6MB 散文 min-of-5:整段重扫 112ms vs 摘要〔含 `JSON.stringify`〕31ms,约 3.6×);记忆表有界(干净 8192 条 / 脏 512 条且总字节封顶,见 {@link memoRedactedRead})。
+ * **没**选「行上打已脱标记 ⇒ 跳过」:那要在三孪生写口加一个持久字段,而需要读面纵深的恰恰是**没有**标记的存量行 ——
+ * 标记只能省新行的扫描;记忆对新旧行一视同仁,且不新开一张持久面。
+ * trace 两腿对 `done` 行只投 `seq`(不投 `result`),它的摘要是**白付**的那一份;**刻意**不按「这条腿投哪些键」裁掉 ——
+ * 那等于在读腿里手抄一份汇点的行型表([ref]),汇点将来加一种带自由文本的行型时读腿静默漏。
+ */
+export declare function redactLedgerEventForRead(type: string, data: unknown): unknown;
 export declare function diffScanShadowCountForTest(): number;
 export declare function resetDiffScanShadowCountForTest(): void;
 export declare function resetReadRedactionMemoForTest(): void;

package/dist/observability/run-terminal.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { redactSecrets, normalizeForRedaction } from "../trace/redact.js";
 import { isModelTextLedgerEventType, isParkLedgerEventType } from "../trace/ledger-events.js";
 import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
+import { sealResultForExit } from "../terminal.js";
 import { errorText } from "./err-text.js";
 import { recordFailOpen } from "./fail-open.js";
 const MESSAGE_CAP = 1024;
@@ -96,28 +97,72 @@ export function redactModelText(raw) {
         return OVERSIZED_REDACTION_PLACEHOLDER;
     }
 }
+const PROVIDER_ECHO_SHAPE = /^[\x21-\x7E]{1,128}$/;
+function isProviderEchoShape(value) {
+    return PROVIDER_ECHO_SHAPE.test(value);
+}
+export function admitProviderEcho(value, seat) {
+    if (value === undefined)
+        return false;
+    if (typeof value === "string" && isProviderEchoShape(value))
+        return true;
+    const what = typeof value === "string" ? `len=${value.length}` : `type=${value === null ? "null" : typeof value}`;
+    recordFailOpen("server.run-terminal.provider-echo-shaped", `seat=${seat} ${what}`);
+    return false;
+}
+function shapeEchoMembers(node, table, seat) {
+    if (node === null || typeof node !== "object" || Array.isArray(node))
+        return node;
+    const n = node;
+    let out;
+    for (const [key, treatment] of Object.entries(table)) {
+        const v = n[key];
+        if (v === undefined)
+            continue;
+        switch (treatment) {
+            case "verbatim":
+            case "provider-join-key":
+                break;
+            case "provider-echo":
+                if (!admitProviderEcho(v, `${seat}.${key}`))
+                    delete (out ??= { ...n })[key];
+                break;
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled echo-member treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return out ?? node;
+}
+function shapeEchoRows(rows, table, seat) {
+    if (!Array.isArray(rows))
+        return rows;
+    const next = rows.map((row) => shapeEchoMembers(row, table, seat));
+    return next.every((x, i) => x === rows[i]) ? rows : next;
+}
 const MAX_EDITED_FILES = 1000;
 const RESULT_KEY_TREATMENT = {
     terminal: "redacted",
     remoteEnvFailures: "redacted",
     editedFiles: "redacted",
+    responseModel: "provider-echo",
+    apiFailure: "provider-echo",
+    strandedHumanAnswers: "provider-echo",
     taskId: "verbatim",
     runId: "verbatim",
     sessionId: "verbatim",
     model: "verbatim",
-    responseModel: "verbatim",
     compaction: "verbatim",
     effectiveReasoning: "verbatim",
     result: "redacted",
     salvagedOutput: "redacted",
-    apiFailure: "verbatim",
     retryAfterMs: "verbatim",
     degraded: "verbatim",
     structuredOutput: "verbatim",
     rewindNotes: "redacted",
     haltedOnUserRejection: "verbatim",
     haltedByUser: "verbatim",
-    strandedHumanAnswers: "verbatim",
     pendingApproval: "verbatim",
     approvalWaitedMs: "verbatim",
     effectiveReadFace: "verbatim",
@@ -126,9 +171,28 @@ const RESULT_KEY_TREATMENT = {
     effectiveMemoryScopes: "verbatim",
     stats: "redacted",
 };
+const API_FAILURE_TREATMENT = {
+    status: "verbatim",
+    requestId: "provider-echo",
+};
+const STRANDED_ANSWER_TREATMENT = {
+    deliveryId: "verbatim",
+    toolCallId: "provider-join-key",
+};
+const PROVIDER_ECHO_SHAPERS = {
+    responseModel: (v) => (admitProviderEcho(v, "responseModel") ? v : undefined),
+    apiFailure: (v) => shapeEchoMembers(v, API_FAILURE_TREATMENT, "apiFailure"),
+    strandedHumanAnswers: (v) => shapeEchoRows(v, STRANDED_ANSWER_TREATMENT, "strandedHumanAnswers[]"),
+};
+{
+    const judged = Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "provider-echo").map(([k]) => k).sort();
+    const wired = Object.keys(PROVIDER_ECHO_SHAPERS).sort();
+    if (judged.join(",") !== wired.join(","))
+        throw new Error(`run-terminal: provider-echo classification [${judged.join(",")}] ≠ shaper table [${wired.join(",")}]`);
+}
 const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
-export const REDACTABLE_RESULT_LEAVES = [
-    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "redacted").map(([k]) => k),
+export const TREATED_RESULT_LEAVES = [
+    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t !== "verbatim").map(([k]) => k),
     ...LEGACY_RESULT_LEAVES,
 ];
 export function redactTerminalResult(result) {
@@ -234,8 +298,25 @@ export function redactTerminalResult(result) {
             changed = true;
         }
     }
+    const rr = result;
+    for (const [key, shape] of Object.entries(PROVIDER_ECHO_SHAPERS)) {
+        const v = rr[key];
+        if (v === undefined || shape === undefined)
+            continue;
+        const next = shape(v);
+        if (next === v)
+            continue;
+        if (next === undefined)
+            delete out[key];
+        else
+            out[key] = next;
+        changed = true;
+    }
     return changed ? out : result;
 }
+export function sealRunRowResult(result) {
+    return result === null ? null : redactTerminalResult(sealResultForExit(result));
+}
 export function redactLedgerEventData(type, data) {
     if (data === null || typeof data !== "object" || Array.isArray(data))
         return data;
@@ -263,8 +344,18 @@ export function redactLedgerEventData(type, data) {
         const next = redactCheckpointGate(gate);
         return next === gate ? data : { ...data, gate: next };
     }
+    if (type === "turn_end")
+        return shapeEchoMembers(data, TURN_END_ECHO_TREATMENT, "turn_end");
+    if (type === "task_notification") {
+        const af = data.apiFailure;
+        if (af === undefined)
+            return data;
+        const next = shapeEchoMembers(af, API_FAILURE_TREATMENT, "task_notification.apiFailure");
+        return next === af ? data : { ...data, apiFailure: next };
+    }
     return data;
 }
+const TURN_END_ECHO_TREATMENT = { responseModel: "provider-echo" };
 export function redactWorkerReportError(report) {
     const gate = redactCheckpointGate(report.checkpointGate);
     const error = report.error === undefined ? undefined : (redactErrorMessage(report.error) ?? "");
@@ -385,7 +476,7 @@ const STATS_GATE_ROW_TREATMENT = {
     decision: "verbatim",
     toolName: "verbatim",
     toolArg: "model-text",
-    toolCallId: "verbatim",
+    toolCallId: "provider-join-key",
 };
 const STATS_REPETITION_EVENT_TREATMENT = {
     turn: "verbatim",
@@ -416,6 +507,8 @@ function redactStatsNode(node, table) {
         switch (treatment) {
             case "verbatim":
                 break;
+            case "provider-join-key":
+                break;
             case "model-text":
                 if (typeof v === "string")
                     next = redactModelText(v);
@@ -670,15 +763,32 @@ export function memoRedactTerminalResult(seat, result) {
     if (result === undefined || result === null)
         return result;
     const r = result;
-    if (REDACTABLE_RESULT_LEAVES.every((k) => r[k] === undefined))
+    if (TREATED_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;
     const leaves = {};
-    for (const k of REDACTABLE_RESULT_LEAVES)
+    for (const k of TREATED_RESULT_LEAVES)
         leaves[k] = r[k];
     const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
     if (redacted === leaves)
         return result;
-    return { ...result, ...redacted };
+    const merged = { ...result, ...redacted };
+    for (const k of TREATED_RESULT_LEAVES)
+        if (!Object.hasOwn(redacted, k))
+            delete merged[k];
+    return merged;
+}
+export function redactLedgerEventForRead(type, data) {
+    if (type === "done" && data !== null && typeof data === "object") {
+        const result = data.result;
+        if (result && typeof result === "object") {
+            return { ...data, result: memoRedactTerminalResult("ev.done.result", result) };
+        }
+    }
+    if (type === "failed")
+        return memoRedactedRead("ev.failed", data, (d) => redactLedgerEventData(type, d));
+    if (isModelTextLedgerEventType(type))
+        return memoRedactedRead("ev.model-text", data, (d) => redactLedgerEventData(type, d));
+    return redactLedgerEventData(type, data);
 }
 let shadowScans = 0;
 export function diffScanShadowCountForTest() { return shadowScans; }