@sema-agent/server 7.109.0 → 7.110.0

package/dist/hooks/hook-runner.js

@@ -648,12 +648,12 @@ async function runMatchingEntries(event, groups, matchValue, payload, ctx, onceF
     }
     return results;
 }
-function basePayload(ctx) {
+function basePayload(ctx, permissionMode) {
     return {
         session_id: ctx.sessionId,
         transcript_path: "",
         cwd: ctx.cwd,
-        ...(ctx.permissionMode ? { permission_mode: ctx.permissionMode } : {}),
+        ...(permissionMode !== undefined ? { permission_mode: permissionMode } : {}),
     };
 }
 function ignoreMatchers(groups) {
@@ -732,7 +732,7 @@ export function createTaskHooks(config, ctx) {
                 if (!m)
                     continue;
                 const payload = {
-                    ...basePayload(ctx),
+                    ...basePayload(ctx, tctx.permissionMode),
                     hook_event_name: "PreToolUse",
                     tool_name: toolName,
                     tool_input: currentInput,
@@ -827,7 +827,7 @@ export function createTaskHooks(config, ctx) {
                 .map((c) => (c && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
                 .join("");
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, tctx.permissionMode),
                 hook_event_name: "PostToolUse",
                 tool_name: toolName,
                 tool_input: input,
@@ -876,7 +876,7 @@ export function createTaskHooks(config, ctx) {
         const postToolUseFailureHook = async (toolName, input, f, tctx) => {
             const contexts = [];
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, tctx.permissionMode),
                 hook_event_name: "PostToolUseFailure",
                 tool_name: toolName,
                 tool_input: input,
@@ -919,10 +919,10 @@ export function createTaskHooks(config, ctx) {
         hooks.postToolUseFailure = postToolUseFailureHook;
     }
     if (postBatch) {
-        const postToolBatchHook = async (calls) => {
+        const postToolBatchHook = async (calls, _meta, bctx) => {
             const contexts = [];
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, bctx?.permissionMode),
                 hook_event_name: "PostToolBatch",
                 tool_calls: calls.map((c) => ({
                     tool_name: c.toolName,
@@ -962,9 +962,9 @@ export function createTaskHooks(config, ctx) {
         hooks.postToolBatch = postToolBatchHook;
     }
     if (promptSubmit) {
-        const userPromptSubmitHook = async (prompt) => {
+        const userPromptSubmitHook = async (prompt, uctx) => {
             const contexts = [];
-            const payload = { ...basePayload(ctx), hook_event_name: "UserPromptSubmit", prompt: clip(prompt, MAX_TOOL_INPUT_CHARS) };
+            const payload = { ...basePayload(ctx, uctx?.permissionMode), hook_event_name: "UserPromptSubmit", prompt: clip(prompt, MAX_TOOL_INPUT_CHARS) };
             const singles = await runMatchingEntries("UserPromptSubmit", ignoreMatchers(promptSubmit), "", payload, ctx, onceFired, Date.now() + MAX_HOOK_EVENT_TOTAL_SECONDS * 1000);
             for (const { entry, run } of singles) {
                 if (run.code === 2) {
@@ -1003,7 +1003,7 @@ export function createTaskHooks(config, ctx) {
     }
     if (stopEntries) {
         const stopHook = async (sctx) => {
-            const payload = { ...basePayload(ctx), hook_event_name: "Stop", stop_hook_active: sctx.stopHookActive };
+            const payload = { ...basePayload(ctx, sctx.permissionMode), hook_event_name: "Stop", stop_hook_active: sctx.stopHookActive };
             let llmExtra;
             const wantsPrompt = stopEntries.some((g) => g.hooks.some((h) => h.type === "prompt"));
             if (wantsPrompt) {
@@ -1097,7 +1097,7 @@ export function createTaskHooks(config, ctx) {
         const stopFailureHook = async (fctx) => {
             const turnError = toAssistantTurnError(fctx.errorKind);
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, undefined),
                 hook_event_name: "StopFailure",
                 error: turnError,
                 ...(fctx.error ? { error_details: clip(redactSecrets(fctx.error), MAX_HOOK_FEEDBACK_CHARS) } : {}),
@@ -1109,7 +1109,7 @@ export function createTaskHooks(config, ctx) {
     if (preCompactEntries) {
         const preCompactHook = async (pctx) => {
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, undefined),
                 hook_event_name: "PreCompact",
                 trigger: pctx.trigger,
                 custom_instructions: pctx.customInstructions ?? null,
@@ -1143,7 +1143,7 @@ export function createTaskHooks(config, ctx) {
     if (postCompactEntries) {
         const postCompactHook = async (cctx) => {
             const payload = {
-                ...basePayload(ctx),
+                ...basePayload(ctx, undefined),
                 hook_event_name: "PostCompact",
                 trigger: cctx.trigger,
                 compact_summary: clip(cctx.summary, MAX_TOOL_RESPONSE_CHARS),
@@ -1191,16 +1191,30 @@ export function composeHooks(deployment, task) {
                 if (!slot)
                     continue;
                 const r = await slot(toolName, current, ctx);
-                if (!r)
+                if (r === undefined || Object.is(r, null) || Object.is(r, false))
                     continue;
+                if (typeof r !== "object")
+                    return r;
                 if (r.additionalContext)
                     contexts.push(r.additionalContext);
-                if (r.action === "deny")
-                    return { ...r, ...buildHookContextField(contexts) };
-                if (r.action === "ask")
-                    asked = r;
-                if (r.action === "allow" && r.updatedInput !== undefined) {
-                    current = r.updatedInput;
+                const action = r.action;
+                const updatedInput = r.updatedInput;
+                switch (action) {
+                    case "deny":
+                        return { ...r, ...buildHookContextField(contexts) };
+                    case "ask":
+                        asked = r;
+                        break;
+                    case "allow":
+                    case undefined:
+                        if (updatedInput !== undefined)
+                            current = updatedInput;
+                        break;
+                    default: {
+                        const unread = action;
+                        void unread;
+                        return r;
+                    }
                 }
             }
             if (asked) {
@@ -1245,20 +1259,20 @@ export function composeHooks(deployment, task) {
         };
     }
     if (d.postToolBatch || t.postToolBatch) {
-        out.postToolBatch = async (calls) => {
-            const rd = d.postToolBatch ? await d.postToolBatch(calls) : undefined;
-            const rt = t.postToolBatch ? await t.postToolBatch(calls) : undefined;
+        out.postToolBatch = async (calls, meta, bctx) => {
+            const rd = d.postToolBatch ? await d.postToolBatch(calls, meta, bctx) : undefined;
+            const rt = t.postToolBatch ? await t.postToolBatch(calls, meta, bctx) : undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);
             const additionalContext = buildHookContext(contexts);
             return additionalContext === undefined ? undefined : { additionalContext };
         };
     }
     if (d.userPromptSubmit || t.userPromptSubmit) {
-        out.userPromptSubmit = async (prompt) => {
-            const rd = d.userPromptSubmit ? await d.userPromptSubmit(prompt) : undefined;
+        out.userPromptSubmit = async (prompt, uctx) => {
+            const rd = d.userPromptSubmit ? await d.userPromptSubmit(prompt, uctx) : undefined;
             if (rd?.block)
                 return { ...rd, ...buildHookContextField(rd.additionalContext ? [rd.additionalContext] : []) };
-            const rt = t.userPromptSubmit ? await t.userPromptSubmit(prompt) : undefined;
+            const rt = t.userPromptSubmit ? await t.userPromptSubmit(prompt, uctx) : undefined;
             if (!rd && !rt)
                 return undefined;
             const contexts = [rd?.additionalContext, rt?.additionalContext].filter((c) => typeof c === "string" && c.length > 0);

package/dist/http/durable-run-leg.js

@@ -63,7 +63,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             windowMs: deps.config.streamApproval?.windowMs,
             windowMarginMs: deps.config.streamAskWindowMarginMs,
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals);
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, args.trustedInternals, deps.userInputLedger);
     return { status: 202, body: { taskId, sessionId, status: "running" } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/resume-legs.js

@@ -622,11 +622,14 @@ export function createResumeLegs(ctx) {
                 unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId,
                     ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
-                    durable: (row) => void append("engine_notice", row).catch((err) => {
+                    durable: (row) => append("engine_notice", row).then(() => true, (err) => {
                         recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
                         deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
+                        return false;
                     }),
                 });
+                if (deps.userInputLedger && taskId)
+                    await deps.userInputLedger.announceUndrained({ sessionId, taskId });
                 const anchorOwner = principal ?? null;
                 const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
                 const captureTurnAnchor = deps.resumeAnchorStore && getLeafId
@@ -964,6 +967,8 @@ export function createResumeLegs(ctx) {
         finally {
             unregisterEngineNotice?.();
             if (taskId) {
+                if (resumeStreamRef !== undefined)
+                    await deps.userInputLedger?.settleLeg(resumeStreamRef);
                 if (inflightRuns.get(taskId) === cancelCtrl)
                     inflightRuns.delete(taskId);
                 if (preemptableRuns.get(taskId) === preemptCtrl)

package/dist/http/routes/runs.d.ts

@@ -6,7 +6,6 @@ import type { RouteCtx, PreparedTaskSubmission, RouteMatch, RouteIdsOf } from ".
  *  —— 导出的是**行为**而不是 schema 对象:schema 的推断类型会牵出 registry-core 内嵌的 zod 路径
  *  (TS2742,不可移植),而这道门要钉的本来就是行为。非 wire 面。 */
 export declare function projectDecisionActor(raw: unknown): ActorAssertionWire | undefined;
-/** 子代理 / 任务句柄 / HITL 应答段——`handle()` 里它在 SVC-5 workflow steer **之后**,故是独立的域入口。 */
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
  *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 export declare function handleRuns(req: IncomingMessage, res: ServerResponse, match: RouteMatch<RunsRouteId>, ctx: RouteCtx): Promise<void>;

package/dist/http/routes/runs.js

@@ -134,6 +134,18 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
 }
+async function acceptLiveUserInput(deps, res, at) {
+    if (!deps.userInputLedger)
+        return undefined;
+    try {
+        return await deps.userInputLedger.accept({ input: "steer", messageId: at.messageId, sessionId: at.sessionId, taskId: at.taskId, leg: at.leg });
+    }
+    catch (e) {
+        deps.logger?.warn?.("user_input_ledger_accept_failed", { taskId: at.taskId, sessionId: at.sessionId, err: e instanceof Error ? e.message : String(e) });
+        sendError(res, 503, "steering.ledger_unavailable", "this steer was NOT delivered: the server could not record it in its user-input ledger (an acceptance receipt is only given once the acceptance is durable, so a crash before the run consumes it can be announced) — nothing reached the engine; retry later");
+        return "refused";
+    }
+}
 export async function handleRuns(req, res, match, ctx) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints } = ctx.registry;
@@ -468,12 +480,17 @@ export async function handleRuns(req, res, match, ctx) {
         const sendNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
         const live = steerableRuns.get(taskId);
         if (live) {
+            const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId, leg: live });
+            if (acceptance === "refused")
+                return;
             try {
                 await live.steer(text, { trusted, ...(steerInputId !== undefined ? { inputId: steerInputId } : {}) });
                 sendJson(res, 200, { taskId, status: "running", delivery: "applied", messageId, ...(priority ? { priority } : {}) });
                 return;
             }
             catch (e) {
+                if (acceptance !== undefined)
+                    await deps.userInputLedger.withdraw(acceptance);
                 const code = e.code;
                 if (code === "steering.invalid_content") {
                     sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
@@ -776,10 +793,15 @@ export async function handleRuns(req, res, match, ctx) {
             });
             return;
         }
+        const acceptance = await acceptLiveUserInput(deps, res, { messageId: interruptMessageId, sessionId: run.sessionId, taskId, leg: liveStream });
+        if (acceptance === "refused")
+            return;
         try {
             await liveStream.steer(text, { trusted, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) });
         }
         catch (e) {
+            if (acceptance !== undefined)
+                await deps.userInputLedger.withdraw(acceptance);
             const code = e.code;
             if (code === "steering.invalid_content") {
                 sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");

package/dist/http/routes/sessions.js

@@ -618,8 +618,18 @@ export async function handleSessions(req, res, match, ctx) {
             const tail = qi("tail");
             const before = qi("before");
             const blobCap = qi("blobCap");
+            let undrained;
+            if (deps.userInputLedger) {
+                try {
+                    undrained = await deps.userInputLedger.readSession(match.params.sessionId);
+                }
+                catch (e) {
+                    recordFailOpen("server.user-input-ledger.read-failed", `op=session-view ${e instanceof Error ? e.message : String(e)}`);
+                }
+            }
+            const undrainedKey = undrained !== undefined ? { userInputUndrained: undrained } : {};
             if (tail === undefined && before === undefined && blobCap === undefined) {
-                sendJson(res, 200, audit);
+                sendJson(res, 200, { ...audit, ...undrainedKey });
                 return;
             }
             let messages = audit.messages;
@@ -631,7 +641,7 @@ export async function handleSessions(req, res, match, ctx) {
             }
             if (blobCap !== undefined && blobCap > 0)
                 messages = truncateMessageBlobs(messages, blobCap);
-            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}) });
+            sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}), ...undrainedKey });
             return;
         }
     }

package/dist/http/routes/tasks.js

@@ -333,10 +333,12 @@ export async function handleTasks(req, res, match, ctx) {
                     },
                     ...(noticeLedger
                         ? {
-                            durable: (row) => void noticeLedger.append("engine_notice", row).catch(() => recordFailOpen("server.engine-notice.durable-append-failed", `leg=sync code=${row.code} task=${durableTaskId ?? ""}`)),
+                            durable: (row) => noticeLedger.append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=sync code=${row.code} task=${durableTaskId ?? ""}`), false)),
                         }
                         : {}),
                 });
+                if (deps.userInputLedger && durableTaskId && prepared.spec.sessionId)
+                    await deps.userInputLedger.announceUndrained({ sessionId: prepared.spec.sessionId, taskId: durableTaskId });
                 try {
                     const streamBody = async () => {
                         await withPrincipal(principal, async () => {
@@ -700,6 +702,8 @@ export async function handleTasks(req, res, match, ctx) {
                         clearInterval(durableHeartbeat);
                     if (durableTaskId && steerableRuns.get(durableTaskId) === liveStreamRef)
                         steerableRuns.delete(durableTaskId);
+                    if (liveStreamRef !== undefined)
+                        await deps.userInputLedger?.settleLeg(liveStreamRef);
                     if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
                         inflightRuns.delete(durableTaskId);
                         cancelledViaVerb.delete(durableTaskId);

package/dist/http/server.d.ts

@@ -217,6 +217,11 @@ export interface ServiceStoreDeps {
     /** SendUserFile 账本(多租户治理面):scope↔object 映射的读面 GET /v1/sendfile-links。present ⇔ 签发面
      *  已配 AND 有 store backend(main.ts 建;写点在两条 send lane 的 withLedgerRecording)。 */
     sendFileLedger?: import("../plugins/send-file-ledger.js").SendFileLedger;
+    /** S-928 用户输入受理账本(「200 applied」受理的影子;单写者 = `src/user-input-ledger.ts` 的活对象,boot 装配在 stage-07 并跑一次收敛)。
+     *  在场 ⇔ 有 store backend(生产恒与 `runStore` 同源于 backend)。消费点:steer 的 live 腿受理前写 `accepted`(写不进 ⇒ 503
+     *  `steering.ledger_unavailable`)、三条 run 腿开通告口那一拍铸 `crashed` 通告并在收场时 settle、`GET /v1/sessions/:id` 的
+     *  `userInputUndrained` 读面。缺席只出现在不接 backend 的 stub-harness 上(那时没有这一面,行为与修前逐字相同)。 */
+    userInputLedger?: import("../user-input-ledger.js").UserInputLedger;
     /** 2c session-sync (P1d) — the WHOLE durable backend, so the `/v1/sessions/:id/sync/*` routes can fan out across
      *  ALL four session subsystems (session entries + fileSnapshot blobs/manifests + sessionPolicy + resumeAnchor)
      *  in the §8 fail-closed atomic order.

package/dist/index.d.ts

@@ -28,4 +28,6 @@ export { createSideQueryLane, createPerModelKeyBrain, type KeyResolver, type Sid
 export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
+export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
+export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -25,4 +25,5 @@ export { createSideQueryLane, createPerModelKeyBrain } from "./boot/side-query-l
 export { createKeyResolver, resolveModelApiKey } from "./key-resolver.js";
 export { isModelKeyPoison, ModelKeyPoisonedError } from "./key-resolver.js";
 export { RETIRED_ENVS } from "./config.js";
+export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES } from "./model-entry-headers.js";
 //# sourceMappingURL=index.js.map

package/dist/instruction-source-notice.d.ts

@@ -28,9 +28,9 @@
  * sessionId / phase)—— 与 `mcp.injection_dropped`「装配期铸、无 runId」同形,run 归属由投递腿承载(这条 run 的 SSE /
  * 这条 run 的账本)。向 core 要 ctx 加 runId 已登记为未闭环项。
  */
-import type { EngineNotice } from "@sema-agent/core";
-import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
-export declare const INSTRUCTION_SOURCE_CHANGED: ServerNoticeCode;
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+/** 码常量型 = core 码册(#1240 入册:受众 user、铸者 `NOTICE_MINTER` = `"server"`)。 */
+export declare const INSTRUCTION_SOURCE_CHANGED: EngineNoticeCode;
 /** 基线读数。`recorded: false` = 这个会话还没有任何 run 记过基线(首 run ⇒ 只写不发);`source: null` = 记过,且那一次
  *  没有项目指令文件被选中。两态必须可判别:把「没记过」读成「记过没有」会让新会话首 run 发一帧 `null → CLAUDE.md`。 */
 export type InstructionSourceBaseline = {

package/dist/memory-layer-legacy-lock.d.ts

@@ -1,6 +1,6 @@
-import type { EngineNotice } from "@sema-agent/core";
-import type { ServerNoticeCode } from "./trace/engine-notice-wire.js";
-export declare const MEMORY_LAYER_LOCKED_LEGACY: ServerNoticeCode;
+import type { EngineNotice, EngineNoticeCode } from "@sema-agent/core";
+/** 码常量型 = core 码册(#1240 入册:受众 operator、铸者 `NOTICE_MINTER` = `"server"`;不上会话流,只落转发体的运维日志)。 */
+export declare const MEMORY_LAYER_LOCKED_LEGACY: EngineNoticeCode;
 /** 探测读数:锁住的层名(排序)+ 看不全的目录条数。挂载面不存在(新数据根)⇒ 两者皆空。 */
 export interface LockedLegacyLayerProbe {
     readonly layers: readonly string[];

package/dist/model-entry-headers.d.ts

@@ -1,10 +1,13 @@
 /**
  * 白名单 = 名字 → 读它的线路(闭集;**加一个名字 = 加一行并写明哪条线路读它、为什么是部署的事**)。
  * `anthropic-beta`:Anthropic Messages 的 beta 开关(逗号分隔的 beta 名;core anthropic 腿会把自己的 beta 并进同一个头)。
+ *
+ * S-963:本表与 {@link CATALOG_ENTRY_HEADER_NAMES} / {@link CatalogEntryHeaderName} 从包根 `src/index.ts` 原对象导出(web-admin 目录编辑页构建期取白名单,
+ * 不手抄;`RETIRED_ENVS` 同族)—— 它是**本进程准入判据的活表**,所以三只(表 / 每行线路数组 / 名字数组)在这里一次冻结:导出面上的嵌入方改不了它。
  */
-export declare const CATALOG_ENTRY_HEADER_LANES: {
+export declare const CATALOG_ENTRY_HEADER_LANES: Readonly<{
     readonly "anthropic-beta": readonly ["anthropic-messages"];
-};
+}>;
 export type CatalogEntryHeaderName = keyof typeof CATALOG_ENTRY_HEADER_LANES;
 export declare const CATALOG_ENTRY_HEADER_NAMES: readonly CatalogEntryHeaderName[];
 /** 判过的袋(只含白名单里的名字,值逐字)。 */

package/dist/model-entry-headers.js

@@ -1,8 +1,8 @@
 import { redactSecrets } from "./trace/redact.js";
-export const CATALOG_ENTRY_HEADER_LANES = {
-    "anthropic-beta": ["anthropic-messages"],
-};
-export const CATALOG_ENTRY_HEADER_NAMES = Object.keys(CATALOG_ENTRY_HEADER_LANES);
+export const CATALOG_ENTRY_HEADER_LANES = Object.freeze({
+    "anthropic-beta": Object.freeze(["anthropic-messages"]),
+});
+export const CATALOG_ENTRY_HEADER_NAMES = Object.freeze(Object.keys(CATALOG_ENTRY_HEADER_LANES));
 export const MAX_HEADER_VALUE_CHARS = 1024;
 const HEADER_VALUE_SHAPE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
 const HEADER_NAME_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;

package/dist/model-unreachable-notice.d.ts

@@ -5,8 +5,8 @@
  * ## 病
  * 运营用户看不到日志 / 诊断面:VPN 中途切换之后模型网关建连超时,用户只拿到一句 undici 原句(`fetch failed (connect …)`),
  * 分不清是网络断了还是起服时读进的代理已经失效,也没有「查 VPN / 代理、代理变过就重启」这条出路。只落运维日志不算闭环
- * (test 立案原话)。core 没有现成的「模型不可达」用户通告码(`ENGINE_NOTICE_CODES` 亲查零命中)⇒ 本仓自铸,走既有的
- * `SERVER_NOTICE_AUDIENCE` 族(S-690 形:白名单 / 归属 / 消毒 / 隔离四件判据一个不绕),不开第二条通道。
+ * (test 立案原话)。core 没有现成的「模型不可达」用户通告码 ⇒ 本仓铸,走既有的本仓铸码族(S-690 形:白名单 / 归属 / 消毒 / 隔离四件判据
+ * 一个不绕),不开第二条通道。core 7.38.0(#1240)起本码在 core 码册里:受众 `NOTICE_AUDIENCE` = user、铸者 `NOTICE_MINTER` = `"server"`。
  *
  * ## 判据(一句):**这一次模型调用的终局是 `stopReason: "error"`,且它发出的最后一条请求在建连时就失败了**
  * 「最后一条请求落在哪」由出网观察者记在调用作用域上(`model-reach-scope.ts`,undici 诊断通道,见 `outbound-dispatcher.ts`)——

package/dist/observability/corrupt-read-seat.d.ts

@@ -150,6 +150,12 @@ export declare const JSONL_REPLAY_SEATS: {
         readonly tag: "server.send-file-ledger.corrupt-record-skipped";
         readonly note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).";
     };
+    readonly "user-input-ledger": {
+        readonly direction: "fail-open";
+        readonly event: "user_input_ledger_corrupt_read";
+        readonly tag: "server.user-input-ledger.corrupt-record-skipped";
+        readonly note: "F: a skipped user-input ledger record can only bend the crash-loss ANNOUNCEMENT (a lost settle announces one steer that was handled; a lost accept leaves a real loss unannounced; a lost announce repeats it once) — it gates nothing and changes no run.";
+    };
 };
 /** 登记名(闭集)。 */
 export type JsonlReplaySeat = keyof typeof JSONL_REPLAY_SEATS;

package/dist/observability/corrupt-read-seat.js

@@ -93,6 +93,12 @@ export const JSONL_REPLAY_SEATS = {
         tag: "server.send-file-ledger.corrupt-record-skipped",
         note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).",
     },
+    "user-input-ledger": {
+        direction: "fail-open",
+        event: "user_input_ledger_corrupt_read",
+        tag: "server.user-input-ledger.corrupt-record-skipped",
+        note: "F: a skipped user-input ledger record can only bend the crash-loss ANNOUNCEMENT (a lost settle announces one steer that was handled; a lost accept leaves a real loss unannounced; a lost announce repeats it once) — it gates nothing and changes no run.",
+    },
 };
 function corruptRefusalSentence(seat, path, reason) {
     const entry = JSONL_REPLAY_SEATS[seat];

package/dist/observability/fail-open.d.ts

@@ -291,7 +291,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.approval-card.closed-word-out-of-set": {
         readonly cls: "F";
-        readonly note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,成员筛 = core `isAskClass`,两键同在同缺,半对 / 首员不符同样算读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。";
+        readonly note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。";
     };
     readonly "server.pg-pool.idle-client-error": {
         readonly cls: "F";
@@ -317,6 +317,18 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
     };
+    readonly "server.user-input-ledger.append-failed": {
+        readonly cls: "F";
+        readonly note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。";
+    };
+    readonly "server.user-input-ledger.read-failed": {
+        readonly cls: "F";
+        readonly note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。";
+    };
+    readonly "server.user-input-ledger.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。";
+    };
     readonly "server.outbound.connect-observer-threw": {
         readonly cls: "F";
         readonly note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。";

package/dist/observability/fail-open.js

@@ -264,7 +264,7 @@ export const FAIL_OPEN_TAGS = {
     "server.redact.ppk-eat-to-end": { cls: "F", note: "S-107 第三十二轮重扫:PuTTY .ppk 容器扫描器(redact.ts redactPpkContainers)在「无合格终止 / 收口后同容器范围再见私钥字段 / 收口后到下一版本头之间夹非空白」三形下从头**吃到输入末尾**(fail-closed 取证丢弃)——终态 errorMessage 座上=整条错误文案变成 «redacted:private-key»,与 redactions_applied_total{private-key} 的诚实替换同形不可分,故要有自己的计数/探针;影子扫不计;计数=多少次整段吃尾。" },
     "server.approval-card.closed-word-out-of-set": {
         cls: "F",
-        note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,成员筛 = core `isAskClass`,两键同在同缺,半对 / 首员不符同样算读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
+        note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
     },
     "server.pg-pool.idle-client-error": {
         cls: "F",
@@ -290,6 +290,18 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
     },
+    "server.user-input-ledger.append-failed": {
+        cls: "F",
+        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
+    },
+    "server.user-input-ledger.read-failed": {
+        cls: "F",
+        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
+    },
+    "server.user-input-ledger.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
+    },
     "server.outbound.connect-observer-threw": {
         cls: "F",
         note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。",

package/dist/observability/metrics.js

@@ -215,7 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
-    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
+    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel|apiErrorCode — the last is the provider's own refusal word on a 4xx, core 7.38.0); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
     m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
@@ -265,6 +265,7 @@ export function createMetrics() {
     m.counter("images_omitted_total", "Tasks whose images will be degraded to text placeholders (no-vision model), by model (S6)");
     m.counter("runs_reaped_total", "Run rows flipped by the background reapers (S7), by kind (stale/suspended/expired_checkpoint)");
     m.counter("checkpoints_reaped_total", "Durable checkpoints expired by the backstop reaper (S7)");
+    m.counter("user_input_converged_total", "User-input acceptances (S-928 ledger) converged to crashed by the maintenance tick (the boot pass reports its count on the user_input_ledger_crash_converged warn line instead): steers accepted whose writer process ended before the run settled");
     m.counter("bakes_reaped_total", "Image bakes failed by the stale-lease reaper (S7)");
     m.counter("counter_flush_failed_total", "Write-behind counter flush/refresh failures (S9), by table and kind");
     m.gauge("counter_flush_fail_streak", "Current consecutive write-behind flush/refresh failures (S9), by table and kind");

package/dist/observability/run-terminal.js

@@ -176,6 +176,11 @@ const STRANDED_ANSWER_TREATMENT = {
     deliveryId: "verbatim",
     toolCallId: "provider-join-key",
 };
+const TERMINAL_FAILURE_DETAIL_TREATMENT = {
+    kind: "verbatim",
+    status: "verbatim",
+    code: "provider-echo",
+};
 const PROVIDER_ECHO_SHAPERS = {
     responseModel: (v) => (admitProviderEcho(v, "responseModel") ? v : undefined),
     apiFailure: (v) => shapeEchoMembers(v, API_FAILURE_TREATMENT, "apiFailure"),
@@ -238,6 +243,11 @@ export function redactTerminalResult(result) {
             const g = gateOf(np);
             if (g?.changed === true)
                 nt = { ...base, nestedPause: { ...np, gate: g.gate } };
+            const cur = nt ?? base;
+            const detail = cur.detail;
+            const shaped = shapeEchoMembers(detail, TERMINAL_FAILURE_DETAIL_TREATMENT, "terminal.detail");
+            if (shaped !== detail)
+                nt = { ...cur, detail: shaped };
         }
         if (nt !== undefined) {
             out.terminal = nt;

package/dist/operator-ask.d.ts

@@ -33,7 +33,7 @@
  *    (`dist/core/gate-fold.js`),那是 `allowLayerMayClear` 的另一条独立豁免;本仓再盖一次是第二个写者。
  *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
  */
-import type { PermissionResult } from "@sema-agent/core";
+import { type PermissionResult, type ToolPolicy } from "@sema-agent/core";
 /** 本文件两只铸点的返回形 = core `PermissionResult` 的 ask 臂(窄型:`authoredBy` 只长在这一臂上)。 */
 export type OperatorAskResult = Extract<PermissionResult, {
     action: "ask";
@@ -63,12 +63,13 @@ export declare function operatorAsk(rule: string, message: string): OperatorAskR
  */
 export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
 /**
- * core 部署出身位 `authoredBy:"deployment"` 的**唯一**盖位函数(S-897 起收成一处):给一只**部署自己的声明**产的 ask 盖上出身 ⇒
- * core 类读 `operator_forced`、`mandated`、不铸 `mandate` 词(表外的门;缺词 = 另有门在)⇒ bypassPermissions 放不掉、站着的答案
- * 退不掉、壳也不会按单个强制词替人答。三个调用者:{@link operatorAlwaysHumanAsk}(`APPROVAL_NEVER_AUTO` / 预算耗尽)、
- * 治理层包装(`runtime-governance.ts` 的 `createGovernanceAskMarkingPolicy`)、SUP 路由姿态(`router/route-orchestration.ts`,
- * 经 {@link operatorAlwaysHumanAsk})。修前前两处各写一份 `{ ...d, authoredBy: "deployment" }`(两个写者),S-897 若再抄就是第三份。
- * 只作用于 ask 臂(类型上就只收 ask);其余键逐字透传。
+ * 🔴 **S-958 —— 治理层的叶策略包装**:`leaf` 产的每一只 ask 盖部署出身(经 {@link withDeploymentAuthorship}),allow / deny 原物交回;
+ * 成员(`projection` / `pathDenyRules` / `writeTargetGuard` / `nameSets`)经 core `wrapToolPolicy` 随行(契约「包装至少拒内层所拒」:
+ * 只加一位、从不放宽)。同步叶保持同步返回;叶抛照抛(fail-closed 的属主仍是叶)。
+ *
+ * **只收叶**:治理层(`runtime-governance.ts` `applyRuntimeGovernance`)对每一片叶各盖一次,再交 core `combinePolicies` 折**一次**
+ * (折叠是最外层,其输出原样交回 —— core 把落选 ask 的类(含本位带出的 `operator_forced`)写进 `foldedAskClasses` 并担保那只对象)。
+ * 把一只折叠交给本函数 = 在折叠的输出上展开 —— 那正是 S-958 修掉的病(7.39.0 起按名拒,响亮、fail-closed,不是静默)。
  */
-export declare function withDeploymentAuthorship<A extends OperatorAskResult>(ask: A): A;
+export declare function createDeploymentAuthoredPolicy(leaf: ToolPolicy): ToolPolicy;
 //# sourceMappingURL=operator-ask.d.ts.map