@sema-agent/server 7.108.0 → 7.110.0

package/dist/leader/leader.js

@@ -201,7 +201,7 @@ export async function runLeaderTask(task, durableBaseSha, deps) {
                     }
                     deps.logger?.info?.("module_repair", { workerId: r.workerId, attempt: attempt + 1, reason: redactHead(verdict.reason ?? "", 500) });
                     try {
-                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` }, deps.unattendedLeg)).result();
+                        const rr = await w.runner.runTaskStream(withUnattendedLeg({ ...sub.spec, objective: deps.moduleGate.repairObjective(sub, safeVerdictReason), sessionId: `${w.sessionId}-r${attempt + 1}` })).result();
                         if (r.stats && rr?.stats)
                             r.stats = { ...r.stats, tokens: (r.stats.tokens ?? 0) + (rr.stats.tokens ?? 0), costMicroUsd: (r.stats.costMicroUsd ?? 0) + (rr.stats.costMicroUsd ?? 0) };
                     }

package/dist/leader/repair-wire.js

@@ -87,7 +87,7 @@ export function attachRepairLoopDeps(deps, resolve) {
     deps.repairLoop = {
         run: async (solo, sub) => {
             const cfg = await resolve(solo, sub);
-            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId }, deps.unattendedLeg);
+            const implSpec = withUnattendedLeg({ ...sub.spec, sessionId: solo.sessionId });
             return runRepairLoopForLeader(solo, implSpec, cfg);
         },
     };

package/dist/leader/wire.d.ts

@@ -1,4 +1,4 @@
-import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps, type PermissionMode } from "@sema-agent/core";
+import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore, type ExecutionEnv, type RunnerDeps } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import { type DeploymentPostureSeats } from "../boot/runner-deps.js";
@@ -19,14 +19,6 @@ export interface LeaderWireConfig {
      *  REMOTE_EXEC (e2b or k8s/Kata) — workers and the integration sandbox run on envs from THIS factory.
      *  Requires `s3` (diff-out is the worker's self-upload; there is no leader-held env to pull from). */
     envFactory?: ExecutionEnvFactory;
-    /**
-     * S-877 候裁 15 → B —— 本车道**有手**的每一条 run(worker 两车道、集成沙箱修复、模块门修复、单代理修复环)的
-     * `TaskSpec.permissionMode`。**必填**:缺席 = core「Absent = `default`」⇒ 写与非只读命令在无人可答的这条腿上被
-     * headless 当场拒(codex F1 的病);必填让每一个构造本配置的地方都得表态,不许静默落回那一形。
-     * 唯一取值点 = `boot/leader.ts` 调 `unattendedPermissionMode(config)`(`src/unattended-permission-mode.ts`,与 run-local 同一只);
-     * 本文件经 `createUnattendedLeg` / `withUnattendedLeg` 铸并(模式 + 写面 roots + 候裁 18 的写保护拒层)。planner 路由无手,不读。
-     */
-    unattendedPermissionMode: PermissionMode;
     /** Durable suspend/resume for SUB-WORKERS ([ref] C4): when the seat yields a value, that worker task carries
      *  the durable question/ask policy + checkpoint store, so a gated ask/AskUserQuestion SUSPENDS the worker
      *  (checkpoint + paused env) instead of failing — the trigger replan-lite C4 arbitrates on. Mirrors main.ts's
@@ -165,7 +157,8 @@ export interface LeaderWireConfig {
 /** The env surface wire needs (both the E2B and k8s adapters implement core's RemoteExecutionEnv). */
 type WireEnv = Pick<RemoteExecutionEnv, "exec" | "writeFile">;
 /**
- * [ref] —— leader 自铸沙盒的**回收闸**(集成沙盒 / repair-loop grader 各一只)。
+ * [ref] —— leader 自铸沙盒的**回收闸**(集成沙盒 / repair-loop grader 各一只;判据本身 S-949 起抽成下方
+ * {@link assertLeaderOwnedEnvReapable},worker 腿同判)。
  *
  * core 契约:`ExecutionEnv` 基面**没有** `destroy`;只有实现了 `RemoteExecutionEnv` 的适配器才有
  * (`core/remote-env.d.ts`),而「这只 env 到底有没有」是**运行期结构事实**,core 自己也只用结构探测

package/dist/leader/wire.js

@@ -5,13 +5,13 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { Runner, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, delimitUntrusted, hasDestroy, } from "@sema-agent/core";
-import { createUnattendedLeg, withUnattendedLeg } from "../unattended-permission-mode.js";
+import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { RemoteContainerExecutionEnv } from "../plugins/remote-env-e2b.js";
 import { E2B_SANDBOX_HOME } from "../execution-lane-caps.js";
 import { createDurableAskPolicy } from "../approval.js";
 import { gitSubprocessEnv } from "../server-secret-env.js";
 import { presignS3Url } from "../plugins/s3-presign.js";
-import { buildUploadScript, uploadStepSuffix, fetchUploadedDiff, withStaging } from "./diffup.js";
+import { buildUploadScript, buildUploadLoopScript, uploadLoopCommand, uploadLoopScriptPath, uploadStepSuffix, fetchUploadedDiff, withStaging, UPLOAD_LOOP_PERIOD_SEC } from "./diffup.js";
 import { pullDiff, safeRev } from "./diffout.js";
 import { runLeaderTask } from "./leader.js";
 import { attachRepairLoopDeps } from "./repair-wire.js";
@@ -37,10 +37,13 @@ const asIntegrationEnv = (env) => ({
         throw r.error; },
 });
 export function createEnvReaper(env, what) {
+    assertLeaderOwnedEnvReapable(env, what);
+    return async () => void (await env.destroy());
+}
+function assertLeaderOwnedEnvReapable(env, what) {
     if (!hasDestroy(env)) {
-        throw new Error(`${what}: the execution-env factory returned an env with no destroy() — the leader OWNS this dedicated sandbox and this closure is its only teardown, so it would leak (and keep billing) until the backend's own timeout reaps it. Deploy a factory whose env implements RemoteExecutionEnv.destroy for the leader lane.`);
+        throw new Error(`${what}: the execution-env factory returned an env with no destroy() — the leader OWNS this dedicated sandbox and destroy() is its only teardown (the leader's own reaper for the integration / grader sandboxes; core's run teardown for a worker, where the staged incremental-upload loop and the belt upload ride it), so without it the sandbox and whatever the leader started inside it leak until the backend's own timeout reaps them — and a host-shell env has no such timeout. Deploy a factory whose env implements RemoteExecutionEnv.destroy for the leader lane.`);
     }
-    return async () => void (await env.destroy());
 }
 export async function stageWorkerEnv(env, opts) {
     const { seedCmd, repo, branch, uploadScriptPath, uploadScript } = opts;
@@ -133,13 +136,32 @@ export function createCoordinatorPush(durableRemote, targetRef, ident) {
 export function createLeaderRunner(cfg) {
     const W = cfg.workspace ?? "/home/user";
     const repo = `${W}/repo`;
+    const uploadLoopScript = buildUploadLoopScript({ workDir: W, periodSec: UPLOAD_LOOP_PERIOD_SEC });
+    const startUploadLoop = async (env, workerId) => {
+        try {
+            const wr = await env.writeFile(uploadLoopScriptPath(W), uploadLoopScript);
+            if (!wr.ok)
+                throw wr.error;
+            await sh(env)(uploadLoopCommand(W, "start"));
+        }
+        catch (e) {
+            cfg.logger?.warn?.("leader_upload_loop_start_failed", { workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
+        }
+    };
+    const stopUploadLoop = async (env, workerId) => {
+        try {
+            await sh(env)(uploadLoopCommand(W, "stop"));
+        }
+        catch (e) {
+            cfg.logger?.warn?.("leader_upload_loop_stop_failed", { workerId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
+        }
+    };
     const ident = cfg.git ?? { name: "leader", email: "leader@local" };
     const { leaderTimeoutMs, workerLimits, presignTtlSec, resourceSuspend: resourceCfg } = leaderResourceConfig();
     const { repairRounds, repairBudgetUsd, repairLoopOn, measureGatesOn, repairLoopAttempts, oracleFlakyK, replanBudgetUsd, } = leaderLoopConfig({ repairRounds: cfg.repairRounds });
     const onNoticeSeat = createEngineNoticeSeat(cfg.logger);
     const governanceSeat = cfg.governance ?? {};
     const deploymentPostureSeat = () => cfg.deploymentPosture?.() ?? {};
-    const unattendedLeg = () => createUnattendedLeg(cfg.unattendedPermissionMode, deploymentPostureSeat());
     const tracerSeat = cfg.tracer ? { tracer: cfg.tracer } : {};
     const usageWindowSeat = cfg.usageWindows && cfg.usageWindowStore ? { usageWindows: cfg.usageWindows, usageWindowStore: cfg.usageWindowStore } : {};
     const promptSourceSeat = cfg.promptSource ? { promptSource: cfg.promptSource } : {};
@@ -176,7 +198,7 @@ export function createLeaderRunner(cfg) {
                         ...principalSpec(),
                         sessionId: `leader-repair-${Date.now()}-${round}`,
                         limits: { maxCostUsd: repairBudgetUsd, maxWalltimeMs: Math.max(300_000, Math.floor(leaderTimeoutMs / 2)) },
-                    }, unattendedLeg()))
+                    }))
                         .result();
                     if (res.terminal.kind !== "completed")
                         throw new Error(`repair round ${round} did not complete (status=${outwardPlane(res.terminal).status})`);
@@ -311,7 +333,7 @@ export function createLeaderRunner(cfg) {
                 const script = buildUploadScript({ repoDir: repo, baseSha, putUrl, workDir: W });
                 const stage = async (env) => {
                     await stageWorkerEnv(env, { seedCmd, repo, branch: sub.branch, uploadScriptPath: `${W}/.leader-upload.sh`, uploadScript: script });
-                    void sh(env)(`nohup sh -c 'while true; do sleep 90; sh ${W}/.leader-upload.sh >/dev/null 2>&1 || true; done' </dev/null >/dev/null 2>&1 &`).catch(() => { });
+                    await startUploadLoop(env, sub.workerId);
                 };
                 return {
                     workerId: sub.workerId, sessionId, branch: sub.branch,
@@ -320,12 +342,17 @@ export function createLeaderRunner(cfg) {
                         brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat,
                         ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}),
                         ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}),
-                        executionEnvFactory: async (ctx) => withStaging(await envFactory(ctx), stage, async (e) => {
-                            await sh(e)(`cd ${repo} && git add -A && git -c user.name='leader-belt' -c user.email='belt@leader' commit -qm 'belt: auto-commit uncommitted worker output' || true; sh ${W}/.leader-upload.sh`);
-                        }),
+                        executionEnvFactory: async (ctx) => {
+                            const env = await envFactory(ctx);
+                            assertLeaderOwnedEnvReapable(env, "leader worker sandbox");
+                            return withStaging(env, stage, async (e) => {
+                                await stopUploadLoop(e, sub.workerId);
+                                await sh(e)(`cd ${repo} && git add -A && git -c user.name='leader-belt' -c user.email='belt@leader' commit -qm 'belt: auto-commit uncommitted worker output' || true; sh ${W}/.leader-upload.sh`);
+                            });
+                        },
                     })),
                     fetchDiff: () => fetchUploadedDiff(getUrl),
-                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }, unattendedLeg()),
+                    spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec(), objective: `${sub.spec.objective}${uploadStepSuffix(W)}` }),
                 };
             }
             if (!cfg.e2bApiKey)
@@ -340,7 +367,7 @@ export function createLeaderRunner(cfg) {
                 runner: keepCtxWarm(new Runner({ brain: cfg.brain, models: cfg.models, roles: cfg.roles, pricing: cfg.pricing, ...onNoticeSeat, ...governanceSeat, ...deploymentPostureSeat(), ...tracerSeat, ...usageWindowSeat, ...promptSourceSeat, ...onErrorSeat, ...(cfg.toolResultStore ? { toolResultStore: cfg.toolResultStore } : {}), ...(cfg.sessionStore ? { sessionStore: cfg.sessionStore } : {}), executionEnv: env })),
                 diffEnv: env,
                 destroy: () => env.destroy().then(() => { }),
-                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }, unattendedLeg()),
+                spec: withUnattendedLeg({ ...workerLimits, ...sub.spec, ...durableSpec, ...resourceSpec, ...principalSpec() }),
             };
         };
         const provisionIntegrationSandbox = async () => {
@@ -382,7 +409,6 @@ export function createLeaderRunner(cfg) {
         const deps = {
             plan,
             provisionWorker,
-            unattendedLeg: unattendedLeg(),
             provisionIntegrationSandbox,
             push,
             testCmd: body.testCmd,

package/dist/memory-layer-legacy-lock.d.ts

@@ -1,6 +1,6 @@
-import type { EngineNotice } from "@sema-agent/core";
-import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
-export declare const MEMORY_LAYER_LOCKED_LEGACY: ServerNoticeCode;
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+/** 码常量型 = core 码册(#1240 入册:受众 operator、铸者 `NOTICE_MINTER` = `"server"`;不上会话流,只落转发体的运维日志)。 */
+export declare const MEMORY_LAYER_LOCKED_LEGACY: EngineNoticeCode;
 /** 探测读数:锁住的层名(排序)+ 看不全的目录条数。挂载面不存在(新数据根)⇒ 两者皆空。 */
 export interface LockedLegacyLayerProbe {
     readonly layers: readonly string[];

package/dist/model-entry-headers.d.ts

@@ -1,10 +1,13 @@
 /**
  * 白名单 = 名字 → 读它的线路(闭集;**加一个名字 = 加一行并写明哪条线路读它、为什么是部署的事**)。
  * `anthropic-beta`:Anthropic Messages 的 beta 开关(逗号分隔的 beta 名;core anthropic 腿会把自己的 beta 并进同一个头)。
+ *
+ * S-963:本表与 {@link CATALOG_ENTRY_HEADER_NAMES} / {@link CatalogEntryHeaderName} 从包根 `src/index.ts` 原对象导出(web-admin 目录编辑页构建期取白名单,
+ * 不手抄;`RETIRED_ENVS` 同族)—— 它是**本进程准入判据的活表**,所以三只(表 / 每行线路数组 / 名字数组)在这里一次冻结:导出面上的嵌入方改不了它。
  */
-export declare const CATALOG_ENTRY_HEADER_LANES: {
+export declare const CATALOG_ENTRY_HEADER_LANES: Readonly<{
     readonly "anthropic-beta": readonly ["anthropic-messages"];
-};
+}>;
 export type CatalogEntryHeaderName = keyof typeof CATALOG_ENTRY_HEADER_LANES;
 export declare const CATALOG_ENTRY_HEADER_NAMES: readonly CatalogEntryHeaderName[];
 /** 判过的袋(只含白名单里的名字,值逐字)。 */

package/dist/model-entry-headers.js

@@ -1,8 +1,8 @@
 import { redactSecrets } from "./trace/redact.js";
-export const CATALOG_ENTRY_HEADER_LANES = {
-    "anthropic-beta": ["anthropic-messages"],
-};
-export const CATALOG_ENTRY_HEADER_NAMES = Object.keys(CATALOG_ENTRY_HEADER_LANES);
+export const CATALOG_ENTRY_HEADER_LANES = Object.freeze({
+    "anthropic-beta": Object.freeze(["anthropic-messages"]),
+});
+export const CATALOG_ENTRY_HEADER_NAMES = Object.freeze(Object.keys(CATALOG_ENTRY_HEADER_LANES));
 export const MAX_HEADER_VALUE_CHARS = 1024;
 const HEADER_VALUE_SHAPE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
 const HEADER_NAME_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;

package/dist/model-unreachable-notice.d.ts

@@ -5,8 +5,8 @@
  * ## 病
  * 运营用户看不到日志 / 诊断面:VPN 中途切换之后模型网关建连超时,用户只拿到一句 undici 原句(`fetch failed (connect …)`),
  * 分不清是网络断了还是起服时读进的代理已经失效,也没有「查 VPN / 代理、代理变过就重启」这条出路。只落运维日志不算闭环
- * (test 立案原话)。core 没有现成的「模型不可达」用户通告码(`ENGINE_NOTICE_CODES` 亲查零命中)⇒ 本仓自铸,走既有的
- * `SERVER_NOTICE_AUDIENCE` 族(S-690 形:白名单 / 归属 / 消毒 / 隔离四件判据一个不绕),不开第二条通道。
+ * (test 立案原话)。core 没有现成的「模型不可达」用户通告码 ⇒ 本仓铸,走既有的本仓铸码族(S-690 形:白名单 / 归属 / 消毒 / 隔离四件判据
+ * 一个不绕),不开第二条通道。core 7.38.0(#1240)起本码在 core 码册里:受众 `NOTICE_AUDIENCE` = user、铸者 `NOTICE_MINTER` = `"server"`。
  *
  * ## 判据(一句):**这一次模型调用的终局是 `stopReason: "error"`,且它发出的最后一条请求在建连时就失败了**
  * 「最后一条请求落在哪」由出网观察者记在调用作用域上(`model-reach-scope.ts`,undici 诊断通道,见 `outbound-dispatcher.ts`)——

package/dist/observability/corrupt-read-seat.d.ts

@@ -150,6 +150,12 @@ export declare const JSONL_REPLAY_SEATS: {
         readonly tag: "server.send-file-ledger.corrupt-record-skipped";
         readonly note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).";
     };
+    readonly "user-input-ledger": {
+        readonly direction: "fail-open";
+        readonly event: "user_input_ledger_corrupt_read";
+        readonly tag: "server.user-input-ledger.corrupt-record-skipped";
+        readonly note: "F: a skipped user-input ledger record can only bend the crash-loss ANNOUNCEMENT (a lost settle announces one steer that was handled; a lost accept leaves a real loss unannounced; a lost announce repeats it once) — it gates nothing and changes no run.";
+    };
 };
 /** 登记名(闭集)。 */
 export type JsonlReplaySeat = keyof typeof JSONL_REPLAY_SEATS;

package/dist/observability/corrupt-read-seat.js

@@ -93,6 +93,12 @@ export const JSONL_REPLAY_SEATS = {
         tag: "server.send-file-ledger.corrupt-record-skipped",
         note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).",
     },
+    "user-input-ledger": {
+        direction: "fail-open",
+        event: "user_input_ledger_corrupt_read",
+        tag: "server.user-input-ledger.corrupt-record-skipped",
+        note: "F: a skipped user-input ledger record can only bend the crash-loss ANNOUNCEMENT (a lost settle announces one steer that was handled; a lost accept leaves a real loss unannounced; a lost announce repeats it once) — it gates nothing and changes no run.",
+    },
 };
 function corruptRefusalSentence(seat, path, reason) {
     const entry = JSONL_REPLAY_SEATS[seat];

package/dist/observability/fail-open.d.ts

@@ -25,10 +25,6 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-297(`http/routes/sessions.ts lastLegMcpFor`,`/mcp` 面板的可选键 `lastLegMcp`):按会话取最近 run 的索引读 / 那条 run 的账本读**抛错或超期** ⇒ 该键缺席,面板本体照常 200。放行的最坏后果=这一屏少一格「上一次真挂上了什么」(壳退回翻账本),不是门、不是权限、不是凭证 —— 而反方向(让附加键的读失败打掉整张面板)会给一口此前零 MCP 配置下根本不碰账本的**既有**读面新加一条挂掉的理由。缺席本就是本键 wire 上的一等状态(消费端必须会读),所以这条兜底不产生任何新的消费端形态;计数让「某台部署的账本一直读不出来」显形。";
     };
-    readonly "server.unattended-leg.mode-releases-protective-asks": {
-        readonly cls: "P-DEBT";
-        readonly note: "S-877 四续 ⑧(候裁 18 D 的已披露残余,`unattended-permission-mode.ts` 的 `createUnattendedLeg`):无人值守腿(leader worker / 修复腿 / run-local / 续跑重挂)的旋钮 `UNATTENDED_PERMISSION_MODE` 缺省 `bypassPermissions` 释放六类保护问(`probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` / `artifact_shared_read`;写保护一类已改拒)—— 7.105.0 这些腿上它们照问、无人答即拒。放行的最坏后果=无人值守的写 / 读 / MCP·A2A 标记工具调用不再被这几道保护问拦下,`rule_unreadable` 是「规则店读不出照放」(安全轴 fail-open 方向)。core 对这几类没有拒座;S-906(core 7.37.0 按类作答)到货后本臂与旋钮一并硬删。计数 = 铸出的这类腿条数,detail = `mode=<词> released=<类…>`。";
-    };
     readonly "server.workflow-park-index.sync-failed": {
         readonly cls: "P-DEBT";
         readonly note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。";
@@ -295,7 +291,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approval-card.closed-word-out-of-set": {
         readonly cls: "F";
-        readonly note: "S-249(`approval-card.ts` 的边界窄读族;今天两个成员:`readRuleOffersAbsence`,与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。";
+        readonly note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。";
     };
     readonly "server.pg-pool.idle-client-error": {
         readonly cls: "F";
@@ -321,6 +317,18 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
     };
+    readonly "server.user-input-ledger.append-failed": {
+        readonly cls: "F";
+        readonly note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。";
+    };
+    readonly "server.user-input-ledger.read-failed": {
+        readonly cls: "F";
+        readonly note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。";
+    };
+    readonly "server.user-input-ledger.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。";
+    };
     readonly "server.outbound.connect-observer-threw": {
         readonly cls: "F";
         readonly note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。";

package/dist/observability/fail-open.js

@@ -16,10 +16,6 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-297(`http/routes/sessions.ts lastLegMcpFor`,`/mcp` 面板的可选键 `lastLegMcp`):按会话取最近 run 的索引读 / 那条 run 的账本读**抛错或超期** ⇒ 该键缺席,面板本体照常 200。放行的最坏后果=这一屏少一格「上一次真挂上了什么」(壳退回翻账本),不是门、不是权限、不是凭证 —— 而反方向(让附加键的读失败打掉整张面板)会给一口此前零 MCP 配置下根本不碰账本的**既有**读面新加一条挂掉的理由。缺席本就是本键 wire 上的一等状态(消费端必须会读),所以这条兜底不产生任何新的消费端形态;计数让「某台部署的账本一直读不出来」显形。",
     },
-    "server.unattended-leg.mode-releases-protective-asks": {
-        cls: "P-DEBT",
-        note: "S-877 四续 ⑧(候裁 18 D 的已披露残余,`unattended-permission-mode.ts` 的 `createUnattendedLeg`):无人值守腿(leader worker / 修复腿 / run-local / 续跑重挂)的旋钮 `UNATTENDED_PERMISSION_MODE` 缺省 `bypassPermissions` 释放六类保护问(`probe` / `tool_marks_mcp` / `tool_marks_a2a` / `transcript_write` / `rule_unreadable` / `artifact_shared_read`;写保护一类已改拒)—— 7.105.0 这些腿上它们照问、无人答即拒。放行的最坏后果=无人值守的写 / 读 / MCP·A2A 标记工具调用不再被这几道保护问拦下,`rule_unreadable` 是「规则店读不出照放」(安全轴 fail-open 方向)。core 对这几类没有拒座;S-906(core 7.37.0 按类作答)到货后本臂与旋钮一并硬删。计数 = 铸出的这类腿条数,detail = `mode=<词> released=<类…>`。",
-    },
     "server.workflow-park-index.sync-failed": {
         cls: "P-DEBT",
         note: "S-185 车CM(codex r1-F2 [high],验真后登记):workflow 出身 park 的 join 索引(`workflow_agent_session` / local 账本)在**一次成功的 run 写之后**同步失败 ⇒ 该次同步被吞,重试要等这条 run 的**下一次**写。而 park 恰好常常是这条 run 的**最后**一次写(park = run 终局 `failed`)⇒ 那条 park 可能永久 join 不到,`/decide` 结构性退回本批之前的行为(409 `conflict.resume_context_unavailable`)——**方向是 fail-closed**(不误配、不伪造、不放行任何东西),丢的是「人能不能把这条批准送出去」这个能力。归 P 类的理由是它决定**车道选择**(缺行 ⇒ 选中 legacy 腿),归 DEBT 的理由是真正的解要一条**按子代 checkpoint 键的耐久决议回执 + 重启期回填**(与 codex r1-F3 同一件欠账,另车)。计数非零 = 有 park 因此决不掉,运维要按 detail 里的 runId 去查。",
@@ -268,7 +264,7 @@ export const FAIL_OPEN_TAGS = {
     "server.redact.ppk-eat-to-end": { cls: "F", note: "S-107 第三十二轮重扫:PuTTY .ppk 容器扫描器(redact.ts redactPpkContainers)在「无合格终止 / 收口后同容器范围再见私钥字段 / 收口后到下一版本头之间夹非空白」三形下从头**吃到输入末尾**(fail-closed 取证丢弃)——终态 errorMessage 座上=整条错误文案变成 «redacted:private-key»,与 redactions_applied_total{private-key} 的诚实替换同形不可分,故要有自己的计数/探针;影子扫不计;计数=多少次整段吃尾。" },
     "server.approval-card.closed-word-out-of-set": {
         cls: "F",
-        note: "S-249(`approval-card.ts` 的边界窄读族;今天两个成员:`readRuleOffersAbsence`,与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
+        note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
     },
     "server.pg-pool.idle-client-error": {
         cls: "F",
@@ -294,6 +290,18 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
     },
+    "server.user-input-ledger.append-failed": {
+        cls: "F",
+        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
+    },
+    "server.user-input-ledger.read-failed": {
+        cls: "F",
+        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
+    },
+    "server.user-input-ledger.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
+    },
     "server.outbound.connect-observer-threw": {
         cls: "F",
         note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。",

package/dist/observability/metrics.js

@@ -215,7 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
-    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
+    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel|apiErrorCode — the last is the provider's own refusal word on a 4xx, core 7.38.0); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
     m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
@@ -265,6 +265,7 @@ export function createMetrics() {
     m.counter("images_omitted_total", "Tasks whose images will be degraded to text placeholders (no-vision model), by model (S6)");
     m.counter("runs_reaped_total", "Run rows flipped by the background reapers (S7), by kind (stale/suspended/expired_checkpoint)");
     m.counter("checkpoints_reaped_total", "Durable checkpoints expired by the backstop reaper (S7)");
+    m.counter("user_input_converged_total", "User-input acceptances (S-928 ledger) converged to crashed by the maintenance tick (the boot pass reports its count on the user_input_ledger_crash_converged warn line instead): steers accepted whose writer process ended before the run settled");
     m.counter("bakes_reaped_total", "Image bakes failed by the stale-lease reaper (S7)");
     m.counter("counter_flush_failed_total", "Write-behind counter flush/refresh failures (S9), by table and kind");
     m.gauge("counter_flush_fail_streak", "Current consecutive write-behind flush/refresh failures (S9), by table and kind");

package/dist/observability/run-terminal.js

@@ -176,6 +176,11 @@ const STRANDED_ANSWER_TREATMENT = {
     deliveryId: "verbatim",
     toolCallId: "provider-join-key",
 };
+const TERMINAL_FAILURE_DETAIL_TREATMENT = {
+    kind: "verbatim",
+    status: "verbatim",
+    code: "provider-echo",
+};
 const PROVIDER_ECHO_SHAPERS = {
     responseModel: (v) => (admitProviderEcho(v, "responseModel") ? v : undefined),
     apiFailure: (v) => shapeEchoMembers(v, API_FAILURE_TREATMENT, "apiFailure"),
@@ -238,6 +243,11 @@ export function redactTerminalResult(result) {
             const g = gateOf(np);
             if (g?.changed === true)
                 nt = { ...base, nestedPause: { ...np, gate: g.gate } };
+            const cur = nt ?? base;
+            const detail = cur.detail;
+            const shaped = shapeEchoMembers(detail, TERMINAL_FAILURE_DETAIL_TREATMENT, "terminal.detail");
+            if (shaped !== detail)
+                nt = { ...cur, detail: shaped };
         }
         if (nt !== undefined) {
             out.terminal = nt;

package/dist/operator-ask.d.ts

@@ -33,7 +33,7 @@
  *    (`dist/core/gate-fold.js`),那是 `allowLayerMayClear` 的另一条独立豁免;本仓再盖一次是第二个写者。
  *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
  */
-import type { PermissionResult } from "@sema-agent/core";
+import { type PermissionResult, type ToolPolicy } from "@sema-agent/core";
 /** 本文件两只铸点的返回形 = core `PermissionResult` 的 ask 臂(窄型:`authoredBy` 只长在这一臂上)。 */
 export type OperatorAskResult = Extract<PermissionResult, {
     action: "ask";
@@ -63,12 +63,13 @@ export declare function operatorAsk(rule: string, message: string): OperatorAskR
  */
 export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
 /**
- * core 部署出身位 `authoredBy:"deployment"` 的**唯一**盖位函数(S-897 起收成一处):给一只**部署自己的声明**产的 ask 盖上出身 ⇒
- * core 类读 `operator_forced`、`mandated`、不铸 `mandate` 词(表外的门;缺词 = 另有门在)⇒ bypassPermissions 放不掉、站着的答案
- * 退不掉、壳也不会按单个强制词替人答。三个调用者:{@link operatorAlwaysHumanAsk}(`APPROVAL_NEVER_AUTO` / 预算耗尽)、
- * 治理层包装(`runtime-governance.ts` 的 `createGovernanceAskMarkingPolicy`)、SUP 路由姿态(`router/route-orchestration.ts`,
- * 经 {@link operatorAlwaysHumanAsk})。修前前两处各写一份 `{ ...d, authoredBy: "deployment" }`(两个写者),S-897 若再抄就是第三份。
- * 只作用于 ask 臂(类型上就只收 ask);其余键逐字透传。
+ * 🔴 **S-958 —— 治理层的叶策略包装**:`leaf` 产的每一只 ask 盖部署出身(经 {@link withDeploymentAuthorship}),allow / deny 原物交回;
+ * 成员(`projection` / `pathDenyRules` / `writeTargetGuard` / `nameSets`)经 core `wrapToolPolicy` 随行(契约「包装至少拒内层所拒」:
+ * 只加一位、从不放宽)。同步叶保持同步返回;叶抛照抛(fail-closed 的属主仍是叶)。
+ *
+ * **只收叶**:治理层(`runtime-governance.ts` `applyRuntimeGovernance`)对每一片叶各盖一次,再交 core `combinePolicies` 折**一次**
+ * (折叠是最外层,其输出原样交回 —— core 把落选 ask 的类(含本位带出的 `operator_forced`)写进 `foldedAskClasses` 并担保那只对象)。
+ * 把一只折叠交给本函数 = 在折叠的输出上展开 —— 那正是 S-958 修掉的病(7.39.0 起按名拒,响亮、fail-closed,不是静默)。
  */
-export declare function withDeploymentAuthorship<A extends OperatorAskResult>(ask: A): A;
+export declare function createDeploymentAuthoredPolicy(leaf: ToolPolicy): ToolPolicy;
 //# sourceMappingURL=operator-ask.d.ts.map

package/dist/operator-ask.js

@@ -1,10 +1,18 @@
+import { wrapToolPolicy } from "@sema-agent/core";
 export function operatorAsk(rule, message) {
     return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
 }
 export function operatorAlwaysHumanAsk(rule, message) {
     return withDeploymentAuthorship(operatorAsk(rule, message));
 }
-export function withDeploymentAuthorship(ask) {
+function withDeploymentAuthorship(ask) {
     return { ...ask, authoredBy: "deployment" };
 }
+export function createDeploymentAuthoredPolicy(leaf) {
+    const authored = (d) => (d.action === "ask" ? withDeploymentAuthorship(d) : d);
+    return wrapToolPolicy(leaf, (req, signal) => {
+        const decision = leaf.check(req, signal);
+        return decision instanceof Promise ? decision.then(authored) : authored(decision);
+    });
+}
 //# sourceMappingURL=operator-ask.js.map

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,6 +1,6 @@
 import type { Logger } from "../observability/logger.js";
 import type { AskState } from "../approval-ask-machine.js";
-import type { AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
+import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /** 数据根下的目录名。**按店命名**,与兄弟 File 店同规(`approval-nonces` / `approval-ask-audit` /
  *  `approval-exemptions` / `resume-anchors` / `checkpoint-ctx` / …)—— 首版写的是族名 `approvals`,而那
  *  正是读者会去找**持久 park 行**的地方(它们其实在 `checkpoint-ctx`),且持久数据面的名字按硬 breaking
@@ -175,6 +175,7 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     listByState(state: AskState, limit: number): Promise<AskRow[]>;
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
+    listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     getBatch(batchId: string): Promise<BatchRow | null>;

package/dist/plugins/approval-ask-store-file.js

@@ -253,6 +253,9 @@ export class FileApprovalAskStore {
     listPendingBySession(sessionId, owner, signal) {
         return this.core.listPendingBySession(sessionId, owner, signal);
     }
+    listByCall(call) {
+        return this.core.listByCall(call);
+    }
     getAsk(askId) {
         return this.core.getAsk(askId);
     }

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -25,7 +25,7 @@
  *  - resolveProvisional 故意不经 canAskTransition(同 SQL twin 头注：这是版本化补偿的例外通道）。
  */
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
-import type { AskDecision, AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, EnsureAskResult, DecideResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
+import type { AskCallCoordinate, AskDecision, AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, EnsureAskResult, DecideResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /**
  * [ref] 的 `updatedInput` **入店编码**——两 twin 共用的那一只(本函数是唯一真源)。
  *
@@ -98,6 +98,7 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
      *  已 abort 就一条都不读、如实抛,与 SQL twin 的第①条语义逐字一致(第②条在这里天然平凡成立)。 */
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
+    listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;

package/dist/plugins/approval-ask-store-memory.js

@@ -1,5 +1,5 @@
 import { canAskTransition } from "../approval-ask-machine.js";
-import { assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
+import { askRowOnCall, assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -304,6 +304,12 @@ export class InMemoryApprovalAskStore {
             .sort((a, b) => a.createdAtMs - b.createdAtMs)
             .map((r) => ({ ...r }));
     }
+    async listByCall(call) {
+        return [...this.asks.values()]
+            .filter((r) => askRowOnCall(r, call))
+            .sort((a, b) => a.createdAtMs - b.createdAtMs || (a.askId < b.askId ? -1 : a.askId > b.askId ? 1 : 0))
+            .map((r) => ({ ...r }));
+    }
     async getAsk(askId) {
         const r = this.asks.get(askId);
         return r ? { ...r } : null;

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -410,6 +410,10 @@ export interface BatchRow {
     updatedAtMs: number;
 }
 /** design 定稿 §4 的持久层接口。协调器接线(车2)、恢复扫描消费(车5)不在本车范围——本车只落这些方法。 */
+/** 一次调用在一条腿上的坐标({@link ApprovalAskStore.listByCall} 的四列;型从 {@link AskRow} 派生,不手抄)。 */
+export type AskCallCoordinate = Pick<AskRow, "taskId" | "legKey" | "toolCallId" | "sourceTaskId">;
+/** 「这一行在这次调用上」的唯一判据(四列逐字相等):InMemory twin 的筛子与 SQL twin 的出口对齐读同一只。 */
+export declare function askRowOnCall(row: AskRow, call: AskCallCoordinate): boolean;
 export interface ApprovalAskStore {
     /** 幂等 upsert。返回**行 + 本次是否真插入**(判别位语义见 {@link EnsureAskResult})。 */
     ensureAsk(row: NewAskRow): Promise<EnsureAskResult>;
@@ -464,6 +468,19 @@ export interface ApprovalAskStore {
      *  等待」只被**部分**缓解(不再叠加调用方侧的等待,池侧仍会堆)。真正的取消要 driver 级 seam,登记为
      *  后续件。 */
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
+    /**
+     * 🔴 S-944 / SN-C1:**这次调用在这条腿上的全部行** —— 任意状态、任意 ask 身份(同一调用不同类集 = 不同 askId 的几只问、升级前按旧派生
+     * 写的行,都在其中)。坐标 = {@link AskCallCoordinate} 四列**精确**匹配;序 = `created_at_ms ASC, ask_id ASC`(确定性)。
+     *
+     * 唯一消费者 = 会话授权短路的争议判据(`tool-approval.ts` `sessionGrantUncontestedByRow`):「这次调用在腿内有行 ⇒ 一揽子放行不得代答」。
+     * 为什么按调用而不是按 askId 点读:争议的真源是**调用**(人对这次调用说过什么 / 这次调用还有一张卡挂着),ask 身份只是其中一问的主键;
+     * 身份可以加轴(S-944 加了类集),争议判据不得依赖身份 —— 按身份点读在身份加轴的那一刻就把同调用的别的问、旧派生的行读成「不存在」。
+     *
+     * 三 twin 同答:SQL twin 读后按四列逐字再滤一遍 —— MySQL 协议的 VARCHAR 等值带 PAD SPACE(`'tc'` = `'tc '`),PG(`COLLATE "C"`)与
+     * InMemory 严格比较;不在入口拒(调用 id 是引擎铸的原值,首尾空白不归本店判),在出口对齐。索引:走 `idx_ask_task_state`
+     * `(task_id, state)` 的 `task_id` 前缀(一条 run 的行数 = 真出过卡的问数;grant 代答的问不落行),不另加索引。
+     */
+    listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     /** 回决幂等回放的读口。🔴 `taskId` **必填**且是键的第一维——UNIQUE 已改 `(task_id, idempotency_key)`
      *  (车4 §12-E),裸按 key 全局查在多租户库上既可能回**别人 task** 的行(存在性外泄),也可能在同 key
@@ -621,6 +638,7 @@ export declare class SqlApprovalAskStore implements ApprovalAskStore {
     listByState(state: AskState, limit: number): Promise<AskRow[]>;
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
+    listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;

package/dist/plugins/approval-ask-store-sql.js

@@ -81,6 +81,9 @@ export function projectAskTerminalClaimTruth(row) {
         settledBy: row.settledBy,
     };
 }
+export function askRowOnCall(row, call) {
+    return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceTaskId === call.sourceTaskId;
+}
 export const APPROVAL_ASK_TABLE = "approval_ask";
 export const APPROVAL_BATCH_TABLE = "approval_batch";
 export const TIDB_APPROVAL_ASK_STATEMENTS = [
@@ -675,6 +678,10 @@ export class SqlApprovalAskStore {
             : this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'STREAM_PENDING' AND owner = ? ORDER BY created_at_ms ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'STREAM_PENDING' AND owner = $2 ORDER BY created_at_ms ASC`), owner === null ? [sessionId] : [sessionId, owner]), signal, "listPendingBySession");
         return rows.map(mapAskRow);
     }
+    async listByCall(call) {
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND leg_key = ? AND tool_call_id = ? AND source_task_id = ? ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND leg_key = $2 AND tool_call_id = $3 AND source_task_id = $4 ORDER BY created_at_ms ASC, ask_id ASC`), [call.taskId, call.legKey, call.toolCallId, call.sourceTaskId]);
+        return rows.map(mapAskRow).filter((r) => askRowOnCall(r, call));
+    }
     async getAsk(askId) {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("tidb")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [
             askId,