@sema-agent/server 7.109.0 → 7.111.0

package/dist/observability/fail-open.js

@@ -264,7 +264,7 @@ export const FAIL_OPEN_TAGS = {
     "server.redact.ppk-eat-to-end": { cls: "F", note: "S-107 第三十二轮重扫:PuTTY .ppk 容器扫描器(redact.ts redactPpkContainers)在「无合格终止 / 收口后同容器范围再见私钥字段 / 收口后到下一版本头之间夹非空白」三形下从头**吃到输入末尾**(fail-closed 取证丢弃)——终态 errorMessage 座上=整条错误文案变成 «redacted:private-key»,与 redactions_applied_total{private-key} 的诚实替换同形不可分,故要有自己的计数/探针;影子扫不计;计数=多少次整段吃尾。" },
     "server.approval-card.closed-word-out-of-set": {
         cls: "F",
-        note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,成员筛 = core `isAskClass`,两键同在同缺,半对 / 首员不符同样算读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
+        note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
     },
     "server.pg-pool.idle-client-error": {
         cls: "F",
@@ -290,6 +290,30 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
     },
+    "server.approval-ask-audit.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-967(`approval-ask-audit-store.ts`,local 车道 File ask 审计店的 boot 重放;登记名 `approval-ask-audit`):账本**中间**一行读不出形(`42` / 数组 / 缺键 / 词表外 `kind`·`outcome`·`orphanState` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `ask` ⇒ 那只孤儿在崩溃收敛读面缺席(无身份可列);丢 `settle` ⇒ 该组按 pending 臂收(审批门在执行之前 ⇒ 若这条 settle 其实是 `allowed` 且工具已执行,`resumeSafe:true` 是错的 —— 与头注「双故障窗」同族);丢 `leg_closed` ⇒ decided 臂多收一行(保守方向);丢 `crash_converged` ⇒ 下一次 boot 重收(幂等);丢 `interrupted_by_shutdown` / `late_settle` ⇒ 成因注退回 `crashed_before_park` / 少一行取证。审计店不开门、不改任何审批结算 ⇒ F。修前:重放坏行只计入 `convergeCrashedAsks().corruptLines`(boot 日志一个数),**无逐条披露、无 tag**。",
+    },
+    "server.workflow-notify-journal.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-977(`orchestration/workflow-notify-journal.ts`,local 车道 File notify journal 的 boot 重放;登记名 `workflow-notify-journal`):账本**中间**一行读不出形(`42` / 数组 / 缺 runId·scope / `acked` 非布尔 / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `pending` 行(`record` 写下的那条)⇒ 那条 run 不在恢复积压里,崩溃丢掉的终态通告 boot 恢复扫描不再重导(live 进程内通告与 `WorkflowStatus` 轮询地板不受影响);丢 `acked` 行 ⇒ 该 run 读回 pending(或前一份已知良好的条目),多一次幂等重投(接收方按 runId 去重)。账本不开门、不改任何 run 的执行或授权 ⇒ F。修前:坏行 / 缺键行**静默**(解析失败 `continue`、只判 `typeof runId === \"string\"`)。",
+    },
+    "server.workflow-agent-session-index.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-977(`orchestration/workflow-agent-session-index.ts`,local 车道 workflow 出身 park 的 join 索引账本的 boot 重放;登记名 `workflow-agent-session-index`):账本**中间**一行读不出形(`42` / 数组 / 缺 `runId`·`rows` / 任一行成员缺身份位 / 半截 JSON;撕尾不走本 tag)⇒ **整行**跳过,那条 run 保留上一份已知良好的快照(不做「丢坏成员、留好成员」—— 那会铸出比真相少几条 park 的行集)。最坏后果 = 该 run 的 park 在索引里缺行 ⇒ `/decide` 找不到它、退回 legacy 腿(409 `conflict.resume_context_unavailable`):诚实 miss,不是错配 —— 赎回键由记录上的 `parks[]` 逐字比对,不读本索引。索引不开门 ⇒ F。修前:形不对的整行响亮(`workflow_agent_session_ledger_line_rejected`,同事件名保留)但**无 tag**,带换行的半截 JSON 静默 `continue`。",
+    },
+    "server.user-input-ledger.append-failed": {
+        cls: "F",
+        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 本进程下一次收敛扫描补结清(本进程写的、已不在活腿上 ⇒ leg_over);进程在那之前就崩了 ⇒ 下一次 boot 的收敛读 run 店判(S-969 L8 起两车道同一只判词:承载它的 run 正常翻面 / 已 park ⇒ leg_over 补结清、不告知;落款死亡判决或写者已死仍 running ⇒ crashed)—— 仍会多说一句的只剩两形:withdraw 漏写后那条腿崩了(一次没变成 200 的受理被告知一次);settle 漏写后本进程续跑了同一条 run、续跑腿崩了(run 行说的是同一 taskId 上**最新**那条腿)。方向都是多说,不漏;converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
+    },
+    "server.user-input-ledger.read-failed": {
+        cls: "F",
+        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(判词要读 run 店 —— S-969 L8 起两车道都读;一趟内同一 taskId 只读一次,读失败 ⇒ 同 run 的每一行各记一笔、留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
+    },
+    "server.user-input-ledger.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。S-969 L6 起 SQL 孪生(`plugins/user-input-ledger-sql.ts` `readRows`)同一只 tag:三只读口取到的行上读不出的列(`input_kind` 词表外 —— 新版本写的输入族 / 手改;收敛行缺 `state_at_ms`)⇒ 逐行跳过、其余照交,`listOpen` 的续翻游标按原始行推进(修前整页抛:收敛断点不前进、同会话通告与读面一并失效);坏行留在表里 ⇒ 每读一次计一次,非零 = 表里有本版本读不懂的行。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 该受理在账上仍 open,下一趟收敛按 run 行判(S-969 L8,两车道同一只判词):本进程写的 / run 行已正常收场、已 park、易手 ⇒ 补结清、不告知;只有 run 行仍 `running` 且持有者是写者(local)、带死亡落款且持有者是写者、或行不在(local:File 店藏了读不出的行)⇒ 当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次;丢 `erased`(S-965,7.111.0 起的会话级墓碑;缺 `sessionId` 的那一行**不**读成「擦全部」)⇒ 被删会话的受理行在本进程的折叠里复现 —— 只有身份 + 时刻(无用户文本),读面 / 通告按 sessionId 取,同一个 id 被重新登记时新住客可见上一位的 `crashed` 告知(= 7.110.x 无级联时的状态);撕尾的 `erased` 不在此列:墓碑写在会话本体删除**之前**,撕掉 ⇒ DELETE 没有成功、会话还在,幂等重试重写。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
+    },
     "server.outbound.connect-observer-threw": {
         cls: "F",
         note: "S-925(`outbound-dispatcher.ts` 的 undici 诊断通道订阅者:`undici:request:create` / `:headers` / `:error`):一只订阅回调抛了。通道在发布方的调用栈里同步回调订阅者,抛出去在 Node 上是未捕获异常(整进程倒),所以每只回调整体 try、落本 tag。最坏后果 = 这一条请求的建连失败没被记下:少一行 `outbound_connect_failed`、诊断段 `outbound.lastConnectFailure` 不更新、那次模型调用不铸 `server.model_unreachable` 用户通告 —— 请求本身、它的错误、run 的终态一个字节不受影响(观察只读)。计数恒零是证据;非零 = undici 通道载荷的形变了,去看 detail 的 site。",

package/dist/observability/metrics.js

@@ -215,7 +215,7 @@ export function createMetrics() {
     m.counter("http_requests_total", "HTTP requests by route/method/status");
     m.histogram("http_request_duration_seconds", "HTTP request duration");
     m.counter("rate_limited_total", "Requests rejected by the rate limiter");
-    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
+    m.counter("brain_echo_dropped_total", "Provider echo fields (response request-id header / reported model name) the engine's brain dropped at write time for failing the echo shape (visible ASCII, 1-128 chars), by field (requestId|responseModel|apiErrorCode — the last is the provider's own refusal word on a 4xx, core 7.38.0); non-zero = the endpoint or a gateway in front of it echoes out-of-shape bytes");
     m.counter("mcp_probe_total", `No-run MCP status face outcomes by outcome (${MCP_PROBE_OUTCOMES.join("/")} — see src/capabilities/mcp-probe.ts MCP_PROBE_OUTCOMES; rate_limited has TWO causes: the per-identity fixed window AND the replica-wide in-flight cap, which can refuse caller B because of caller A)`);
     m.counter("tasks_total", "Finished tasks by terminal status");
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
@@ -265,6 +265,7 @@ export function createMetrics() {
     m.counter("images_omitted_total", "Tasks whose images will be degraded to text placeholders (no-vision model), by model (S6)");
     m.counter("runs_reaped_total", "Run rows flipped by the background reapers (S7), by kind (stale/suspended/expired_checkpoint)");
     m.counter("checkpoints_reaped_total", "Durable checkpoints expired by the backstop reaper (S7)");
+    m.counter("user_input_converged_total", "User-input acceptances (S-928 ledger) converged to crashed by the maintenance tick (the boot pass reports its count on the user_input_ledger_crash_converged warn line instead): steers accepted whose writer process ended before the run settled");
     m.counter("bakes_reaped_total", "Image bakes failed by the stale-lease reaper (S7)");
     m.counter("counter_flush_failed_total", "Write-behind counter flush/refresh failures (S9), by table and kind");
     m.gauge("counter_flush_fail_streak", "Current consecutive write-behind flush/refresh failures (S9), by table and kind");

package/dist/observability/run-terminal.js

@@ -176,6 +176,11 @@ const STRANDED_ANSWER_TREATMENT = {
     deliveryId: "verbatim",
     toolCallId: "provider-join-key",
 };
+const TERMINAL_FAILURE_DETAIL_TREATMENT = {
+    kind: "verbatim",
+    status: "verbatim",
+    code: "provider-echo",
+};
 const PROVIDER_ECHO_SHAPERS = {
     responseModel: (v) => (admitProviderEcho(v, "responseModel") ? v : undefined),
     apiFailure: (v) => shapeEchoMembers(v, API_FAILURE_TREATMENT, "apiFailure"),
@@ -238,6 +243,11 @@ export function redactTerminalResult(result) {
             const g = gateOf(np);
             if (g?.changed === true)
                 nt = { ...base, nestedPause: { ...np, gate: g.gate } };
+            const cur = nt ?? base;
+            const detail = cur.detail;
+            const shaped = shapeEchoMembers(detail, TERMINAL_FAILURE_DETAIL_TREATMENT, "terminal.detail");
+            if (shaped !== detail)
+                nt = { ...cur, detail: shaped };
         }
         if (nt !== undefined) {
             out.terminal = nt;

package/dist/operator-ask.d.ts

@@ -33,7 +33,7 @@
  *    (`dist/core/gate-fold.js`),那是 `allowLayerMayClear` 的另一条独立豁免;本仓再盖一次是第二个写者。
  *  · **问答工具**(`deployment-governance.ts` 的 `AskUserQuestion`)—— core 的谓词把保留问答工具单列豁免。
  */
-import type { PermissionResult } from "@sema-agent/core";
+import { type PermissionResult, type ToolPolicy } from "@sema-agent/core";
 /** 本文件两只铸点的返回形 = core `PermissionResult` 的 ask 臂(窄型:`authoredBy` 只长在这一臂上)。 */
 export type OperatorAskResult = Extract<PermissionResult, {
     action: "ask";
@@ -63,12 +63,13 @@ export declare function operatorAsk(rule: string, message: string): OperatorAskR
  */
 export declare function operatorAlwaysHumanAsk(rule: string, message: string): OperatorAskResult;
 /**
- * core 部署出身位 `authoredBy:"deployment"` 的**唯一**盖位函数(S-897 起收成一处):给一只**部署自己的声明**产的 ask 盖上出身 ⇒
- * core 类读 `operator_forced`、`mandated`、不铸 `mandate` 词(表外的门;缺词 = 另有门在)⇒ bypassPermissions 放不掉、站着的答案
- * 退不掉、壳也不会按单个强制词替人答。三个调用者:{@link operatorAlwaysHumanAsk}(`APPROVAL_NEVER_AUTO` / 预算耗尽)、
- * 治理层包装(`runtime-governance.ts` 的 `createGovernanceAskMarkingPolicy`)、SUP 路由姿态(`router/route-orchestration.ts`,
- * 经 {@link operatorAlwaysHumanAsk})。修前前两处各写一份 `{ ...d, authoredBy: "deployment" }`(两个写者),S-897 若再抄就是第三份。
- * 只作用于 ask 臂(类型上就只收 ask);其余键逐字透传。
+ * 🔴 **S-958 —— 治理层的叶策略包装**:`leaf` 产的每一只 ask 盖部署出身(经 {@link withDeploymentAuthorship}),allow / deny 原物交回;
+ * 成员(`projection` / `pathDenyRules` / `writeTargetGuard` / `nameSets`)经 core `wrapToolPolicy` 随行(契约「包装至少拒内层所拒」:
+ * 只加一位、从不放宽)。同步叶保持同步返回;叶抛照抛(fail-closed 的属主仍是叶)。
+ *
+ * **只收叶**:治理层(`runtime-governance.ts` `applyRuntimeGovernance`)对每一片叶各盖一次,再交 core `combinePolicies` 折**一次**
+ * (折叠是最外层,其输出原样交回 —— core 把落选 ask 的类(含本位带出的 `operator_forced`)写进 `foldedAskClasses` 并担保那只对象)。
+ * 把一只折叠交给本函数 = 在折叠的输出上展开 —— 那正是 S-958 修掉的病(7.39.0 起按名拒,响亮、fail-closed,不是静默)。
  */
-export declare function withDeploymentAuthorship<A extends OperatorAskResult>(ask: A): A;
+export declare function createDeploymentAuthoredPolicy(leaf: ToolPolicy): ToolPolicy;
 //# sourceMappingURL=operator-ask.d.ts.map

package/dist/operator-ask.js

@@ -1,10 +1,18 @@
+import { wrapToolPolicy } from "@sema-agent/core";
 export function operatorAsk(rule, message) {
     return { action: "ask", message, decisionReason: "rule", matchedAskRule: rule };
 }
 export function operatorAlwaysHumanAsk(rule, message) {
     return withDeploymentAuthorship(operatorAsk(rule, message));
 }
-export function withDeploymentAuthorship(ask) {
+function withDeploymentAuthorship(ask) {
     return { ...ask, authoredBy: "deployment" };
 }
+export function createDeploymentAuthoredPolicy(leaf) {
+    const authored = (d) => (d.action === "ask" ? withDeploymentAuthorship(d) : d);
+    return wrapToolPolicy(leaf, (req, signal) => {
+        const decision = leaf.check(req, signal);
+        return decision instanceof Promise ? decision.then(authored) : authored(decision);
+    });
+}
 //# sourceMappingURL=operator-ask.js.map

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -1,4 +1,5 @@
-import type { WorkflowRun } from "@sema-agent/core";
+import { type WorkflowRun } from "@sema-agent/core";
+import type { Logger } from "../observability/logger.js";
 /** 一条索引行:**子会话 id 是主键**(会话 id 全局唯一 ⇒ 读口天然是单行精确查,无分页假阴性)。 */
 export interface WorkflowAgentSessionRow {
     /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = 那条 checkpoint 行的 `sessionId`;
@@ -101,38 +102,26 @@ export declare function readAgentSessionLedgerLine(v: unknown): WorkflowAgentSes
  * 单机车道的索引(`FileWorkflowRunStore` / `InMemoryWorkflowRunStore` 的同室孪生)。
  *
  * `root` 在场 ⇒ 追加式 JSONL 账本(与姊妹 {@link import("./workflow-notify-journal.js").FileWorkflowNotifyJournalStore}
- * 逐字同形:0o700 目录 + 0o600 账本、按行重放、末行撕裂即丢),重启后 park 仍可 join;缺席 ⇒ 纯内存
+ * 逐字同形:0o700 目录 + 0o600 账本、按行重放),重启后 park 仍可 join;缺席 ⇒ 纯内存
  * (`WORKFLOW_RUN_STORE=memory` 的显式易失车道,与它的 run 店同寿命)。
  *
  * 账本的一行 = **一次 `syncRun` 的整份行集**(按 runId 后写覆盖),所以重放即收敛,不需要压缩腿。
+ *
+ * 追加 / 重放走本仓 JSONL 店的**共用口**(S-977;此前 ctor 里自写 `truncateTornTail` + 手写 `split("\n") + JSON.parse` 重放):
+ * 追加 = core `AppendLog`(惰性打开、撕尾在**打开与每次追加前**修 —— 修前只在 boot 修,运行期半写后的下一次成功写仍会被粘进残尾),
+ * 重放 = `replayJsonlSkipping`(登记座 `workflow-agent-session-index`:中间坏行 —— 含半截 JSON 与形不对的整行 —— 跳过 + 逐条披露 + F tag;
+ * 撕尾不计、不披露)。盘上字节 / 0o600 账本 / 0o700 目录与修前逐字同,升级零迁移。
  */
 export declare class LocalWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
     private readonly fsyncEnabled;
-    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
-     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
-    private readonly onWarn?;
     private readonly ledgerPath;
     private readonly byRun;
     private readonly bySession;
-    private fd;
+    private log;
     constructor(root?: string, fsyncEnabled?: boolean, 
-    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
-     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
-    onWarn?: ((msg: string, meta: Record<string, unknown>) => void) | undefined);
-    /**
-     * 打开账本时把**撕裂尾**(崩在 append 中途、末尾没有换行的那截字节)截回最后一个完整行边界。
-     *
-     * 🔴 为什么必须在**任何 append 之前**做(codex 修复验证轮 [medium],故障注入复现):残尾留在盘上时,
-     * 下一次 `syncRun` 会紧贴着它落字节 ⇒ `<残尾><新记录>` 在 replay 里是**一行**,JSON 解析失败被整行丢掉。
-     * 丢的**不是**那截未提交的残尾(丢它是对的),而是紧随其后那次**成功重试**写下的行 —— 于是「写失败了
-     * 下一次写会重试救回来」这条本模块与 `syncAgentSessionIndex` 都在依赖的性质当场失效,park 索引静默消失。
-     * 截尾之后 append 永远从一个干净的行边界开始,重试才真的救得回来。
-     *
-     * 截掉的只可能是**未提交**的字节(一条记录的耐久性以它那个换行为界,与 notify journal 同一条崩溃序),
-     * 所以这里不是丢数据;但它是一次真实的崩溃留痕,**响亮**一次([ref]:安全轴不许静默)。
-     */
-    private truncateTornTail;
-    private replay;
+    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。形与日志座 `Logger["warn"]` 逐字同源,
+     *  不另立第二种披露通道。 */
+    onWarn?: Logger["warn"]);
     /** 内存两张表的收敛(重放与写路径共用一份逻辑)。 */
     private apply;
     syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;

package/dist/orchestration/workflow-agent-session-index.js

@@ -1,5 +1,6 @@
-import { existsSync, fsyncSync, mkdirSync, openSync, readFileSync, truncateSync, writeSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const nonEmptyString = (v) => typeof v === "string" && v !== "";
 export function readRunParks(run) {
     if (typeof run !== "object" || run === null)
@@ -72,64 +73,27 @@ function readAgentSessionRow(v) {
         return undefined;
     return { sessionId, runId, agentKey, scope };
 }
+const LEDGER_LINE_SHAPE = {
+    what: "a workflow agent-session index line {runId, rows[]}",
+    read: readAgentSessionLedgerLine,
+};
 export class LocalWorkflowAgentSessionIndex {
     fsyncEnabled;
-    onWarn;
     ledgerPath;
     byRun = new Map();
     bySession = new Map();
-    fd;
+    log;
     constructor(root, fsyncEnabled = true, onWarn) {
         this.fsyncEnabled = fsyncEnabled;
-        this.onWarn = onWarn;
         if (root === undefined) {
             this.ledgerPath = undefined;
             return;
         }
         const dir = join(root, "workflow-agent-sessions");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.ledgerPath = join(dir, "index.jsonl");
-        this.truncateTornTail();
-        this.replay();
-    }
-    truncateTornTail() {
-        const path = this.ledgerPath;
-        if (path === undefined || !existsSync(path))
-            return;
-        const bytes = readFileSync(path);
-        if (bytes.length === 0 || bytes[bytes.length - 1] === 0x0a)
-            return;
-        const keep = bytes.lastIndexOf(0x0a) + 1;
-        truncateSync(path, keep);
-        this.onWarn?.("workflow_agent_session_ledger_torn_tail_truncated", {
-            path,
-            droppedBytes: bytes.length - keep,
-            note: "the last append never finished (no trailing newline) — those uncommitted bytes were cut back to the last complete line so the NEXT append starts on a clean boundary. Without the cut, the retry that follows would be glued onto the broken suffix and dropped as one unparsable line, i.e. the retry — not the torn write — is what would be lost.",
-        });
-    }
-    replay() {
-        if (this.ledgerPath === undefined || !existsSync(this.ledgerPath))
-            return;
-        for (const line of readFileSync(this.ledgerPath, "utf8").split("\n")) {
-            if (!line.trim())
-                continue;
-            let rec;
-            try {
-                rec = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const entry = readAgentSessionLedgerLine(rec);
-            if (entry === undefined) {
-                this.onWarn?.("workflow_agent_session_ledger_line_rejected", {
-                    path: this.ledgerPath,
-                    note: "a committed ledger line did not read back as {runId, rows[]} — that run keeps its previous snapshot; a /decide for a park it should have indexed falls back to the legacy lane (honest miss, never a mis-route)",
-                });
-                continue;
-            }
+        for (const entry of replayJsonlSkipping(this.ledgerPath, "workflow-agent-session-index", LEDGER_LINE_SHAPE, onWarn).records)
             this.apply(entry.runId, entry.rows);
-        }
     }
     apply(runId, rows) {
         for (const old of this.byRun.get(runId) ?? []) {
@@ -145,11 +109,8 @@ export class LocalWorkflowAgentSessionIndex {
     }
     async syncRun(runId, rows) {
         if (this.ledgerPath !== undefined) {
-            if (this.fd === undefined)
-                this.fd = openSync(this.ledgerPath, "a", 0o600);
-            writeSync(this.fd, `${JSON.stringify({ runId, rows })}\n`);
-            if (this.fsyncEnabled)
-                fsyncSync(this.fd);
+            this.log ??= new AppendLog(this.ledgerPath);
+            this.log.append({ runId, rows }, this.fsyncEnabled);
         }
         this.apply(runId, rows);
     }

package/dist/orchestration/workflow-notify-journal.d.ts

@@ -1,6 +1,7 @@
-import type { WorkflowRun, WorkflowRunStore, WorkflowRunStatus, WorkflowRunSummary } from "@sema-agent/core";
+import { type WorkflowRun, type WorkflowRunStore, type WorkflowRunStatus, type WorkflowRunSummary } from "@sema-agent/core";
 import { type FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "./workflow-agent-session-index.js";
+import type { Logger } from "../observability/logger.js";
 /** A workflow completion notification's terminal payload — the bounded, redacted shape core's notifier seam
  *  carries, re-derivable from a durable {@link import("@sema-agent/core").WorkflowRun} on the recovery path. */
 export interface WorkflowCompletionPayload {
@@ -201,6 +202,11 @@ export declare class WorkflowNotifyGate {
  * appends, atomic single-line records. Single-instance / TOC-local: a cross-replica TiDB/PG port is a follow-on
  * (the recovery sweep + gate are backend-agnostic).
  *
+ * 追加 / 重放走本仓 JSONL 店的**共用口**(S-977;此前是第二 / 第三份私有实现):追加 = core `AppendLog`(惰性打开;单条 `writeSync`
+ * 循环写满、失败的写截回开写处;**撕尾在打开与每次追加前修**,所以崩在一次 append 中途之后的下一条成功写不会被粘进残尾),
+ * 重放 = `replayJsonlSkipping`(登记座 `workflow-notify-journal`:中间坏行跳过 + 逐条披露 + F tag;撕尾不计 —— 它是崩溃的正常落盘形;
+ * 末行 JSON 完整但缺换行的认下、下一次追加补换行)。盘上字节 / 0o600 账本 / 0o700 目录与修前逐字同,升级零迁移。
+ *
  * The ledger only ever grows by one line per `record`/`ack`; an acked entry's line is not deleted (the replay
  * folds it), so retention is a future compaction concern — the backlog `listPending` walks is bounded by
  * IN-FLIGHT + un-swept runs, not history.
@@ -209,12 +215,9 @@ export declare class FileWorkflowNotifyJournalStore implements WorkflowNotifyJou
     private readonly fsyncEnabled;
     private readonly ledgerPath;
     private readonly entries;
-    private fd;
-    constructor(root: string, fsyncEnabled?: boolean);
-    /** Replay the ledger into the authoritative map (last-writer-wins by line order). Tolerates a torn final line
-     *  (a crash mid-append) by dropping an unparsable trailing record — the same crash-safety FileWorkflowRunStore
-     *  relies on (a partial append is simply not yet committed state). */
-    private replay;
+    private log;
+    /** @param warn 坏账本行的披露座(缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。 */
+    constructor(root: string, fsyncEnabled?: boolean, warn?: Logger["warn"]);
     /** Commit one entry: append the JSON line (fsync) THEN flip the in-memory map (crash-safe ordering — the
      *  durable record lands before the in-memory state the caller observes). */
     private commit;
@@ -228,7 +231,7 @@ export declare class FileWorkflowNotifyJournalStore implements WorkflowNotifyJou
     ack(runId: string, ackedAt: number): Promise<void>;
     listPending(): Promise<WorkflowNotifyJournalEntry[]>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
-    /** Release the append handle (best-effort) — called on shutdown. */
+    /** Release the append handle — called on shutdown. core `AppendLog.close()` swallows its own `closeSync` error (never throws). */
     close(): void;
     /** Test/inspection: total entries (acked + pending). */
     get size(): number;

package/dist/orchestration/workflow-notify-journal.js

@@ -1,9 +1,10 @@
-import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, closeSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
 import { buildFleetWorkflowRow } from "../fleet/fleet-bus.js";
 import { isTerminalWorkflowRowStatus, seedTerminalWorkflowRow } from "../fleet/fleet-terminal-window.js";
 import { buildParkedAgentSessionRows, sameAgentSessionRows } from "./workflow-agent-session-index.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const SUMMARY_MAX = 500;
 export function recoverySummary(status, error) {
     if (status === "completed")
@@ -162,42 +163,31 @@ export class WorkflowNotifyGate {
         return { scanned: pending.length, redelivered, stillRunning, abandoned };
     }
 }
+const JOURNAL_ENTRY_SHAPE = {
+    what: "a notify-journal entry {runId: string, scope: string, acked: boolean}",
+    read(record) {
+        const { runId, scope, acked } = record;
+        if (typeof runId !== "string" || typeof scope !== "string" || typeof acked !== "boolean")
+            return undefined;
+        return record;
+    },
+};
 export class FileWorkflowNotifyJournalStore {
     fsyncEnabled;
     ledgerPath;
     entries = new Map();
-    fd;
-    constructor(root, fsyncEnabled = true) {
+    log;
+    constructor(root, fsyncEnabled = true, warn) {
         this.fsyncEnabled = fsyncEnabled;
         const dir = join(root, "workflow-notify");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.ledgerPath = join(dir, "journal.jsonl");
-        this.replay();
-    }
-    replay() {
-        if (!existsSync(this.ledgerPath))
-            return;
-        const text = readFileSync(this.ledgerPath, "utf8");
-        for (const line of text.split("\n")) {
-            if (!line.trim())
-                continue;
-            let ev;
-            try {
-                ev = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            if (ev && typeof ev.runId === "string")
-                this.entries.set(ev.runId, ev);
-        }
+        for (const ev of replayJsonlSkipping(this.ledgerPath, "workflow-notify-journal", JOURNAL_ENTRY_SHAPE, warn).records)
+            this.entries.set(ev.runId, ev);
     }
     commit(entry) {
-        if (this.fd === undefined)
-            this.fd = openSync(this.ledgerPath, "a", 0o600);
-        writeSync(this.fd, `${JSON.stringify(entry)}\n`);
-        if (this.fsyncEnabled)
-            fsyncSync(this.fd);
+        this.log ??= new AppendLog(this.ledgerPath);
+        this.log.append(entry, this.fsyncEnabled);
         this.entries.set(entry.runId, entry);
     }
     async record(input) {
@@ -226,14 +216,8 @@ export class FileWorkflowNotifyJournalStore {
         return this.entries.get(runId) ?? null;
     }
     close() {
-        if (this.fd !== undefined) {
-            try {
-                closeSync(this.fd);
-            }
-            catch {
-            }
-            this.fd = undefined;
-        }
+        this.log?.close();
+        this.log = undefined;
     }
     get size() {
         return this.entries.size;

package/dist/plugins/file-outcome-sink.d.ts

@@ -1,4 +1,4 @@
-import type { TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
+import { type TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
 /** The one write verb every outcome sink (TiDB/Pg ledger adapters + this File twin) exposes to main.ts,
  *  plus the OPTIONAL read aggregate backing `GET /v1/outcomes` (P2) — present on the SQL ledgers (their
  *  existing per-(signature, model) summary); absent here (the JSONL file IS the local dataset — a dashboard
@@ -18,7 +18,10 @@ export interface OutcomeSink {
 }
 export declare class FileOutcomeSink implements OutcomeSink {
     private readonly path;
+    private log;
     constructor(root: string);
     recordCore(o: CoreTaskOutcome): Promise<void>;
+    /** 收追加口(`StoreBackend.close` 的优雅关闭腿;之后再写会重开)。core `AppendLog.close()` 自己吞 `closeSync` 的错,不抛。 */
+    dispose(): void;
 }
 //# sourceMappingURL=file-outcome-sink.d.ts.map

package/dist/plugins/file-outcome-sink.js

@@ -1,14 +1,20 @@
-import { mkdirSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
 export class FileOutcomeSink {
     path;
+    log;
     constructor(root) {
         const dir = join(root, "outcomes");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.path = join(dir, "outcomes.jsonl");
     }
     async recordCore(o) {
-        appendFileSync(this.path, `${JSON.stringify({ at: Date.now(), ...o })}\n`, { mode: 0o600 });
+        this.log ??= new AppendLog(this.path);
+        this.log.append({ at: Date.now(), ...o }, false);
+    }
+    dispose() {
+        this.log?.close();
+        this.log = undefined;
     }
 }
 //# sourceMappingURL=file-outcome-sink.js.map

package/dist/plugins/file-run-store.js

@@ -7,7 +7,7 @@ import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
-import { StoreBootRefusalError } from "./store-contracts.js";
+import { RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { migrateRetiredAskOrigin } from "./one-time-migrations.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
@@ -592,7 +592,7 @@ export class FileRunStore {
     }
     async reapStale(olderThanMs) {
         const cutoff = Date.now() - olderThanMs;
-        return this.reapRunning((r) => r.updatedAt.getTime() < cutoff, "run stalled (instance lost?)");
+        return this.reapRunning((r) => r.updatedAt.getTime() < cutoff, RUN_STALLED_ERROR);
     }
     async reclaimOrphanedAtBoot(isResumable) {
         const orphans = [];
@@ -603,7 +603,7 @@ export class FileRunStore {
         for (const r of orphans) {
             r.status = "failed";
             r.result = null;
-            r.error = "run orphaned by engine restart";
+            r.error = RUN_ORPHANED_ERROR;
             r.updatedAt = new Date();
             this.persist(r);
         }
@@ -808,7 +808,7 @@ export class FileRunStore {
             pidStillRunning: owner !== undefined && isProcessLive({ pid: owner.pid }),
             note: "the claim's owner process is provably not the one that wrote it (fingerprint falsified, or the pid is gone) and the row has nothing left to resume — taking the claim over",
         });
-        return { kind: "stale", reason: `run orphaned by engine restart (claim held by ${who}, which is gone)`, snapshot };
+        return { kind: "stale", reason: buildRunOrphanedError(who), snapshot };
     }
     takeOverClaim(sessionId, reason, snapshot) {
         const nowClaim = readClaimRecord(singleRecordOf(this.readRecords(this.activePath(sessionId), CLAIM_RECORD_SHAPE)), sessionId);

package/dist/plugins/memory-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult, LatestRunRef } from "./store-contracts.js";
+import { type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /**
  * [ref] P0 — the local lane's stand-in for the SQL twins' checkpoint-table JOIN. The file/memory run stores

package/dist/plugins/memory-run-store.js

@@ -1,6 +1,7 @@
 import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
 import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
+import { RUN_STALLED_ERROR } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
@@ -298,7 +299,7 @@ export class MemoryRunStore {
             if (r.status === "running" && r.updatedAt.getTime() < cutoff) {
                 r.status = "failed";
                 r.result = null;
-                r.error = "run stalled (instance lost?)";
+                r.error = RUN_STALLED_ERROR;
                 r.updatedAt = new Date();
                 reaped += 1;
             }

package/dist/plugins/pg-pool.js

@@ -126,6 +126,21 @@ export const PG_SCHEMA_STATEMENTS = [
      consumed_at_ms BIGINT         NOT NULL,
      expires_at_ms  BIGINT         NOT NULL,
      PRIMARY KEY (session_id, nonce)
+   )`,
+    `CREATE TABLE IF NOT EXISTS user_input_acceptance (
+     accept_id         VARCHAR(64) COLLATE "C"  NOT NULL,
+     input_kind        VARCHAR(16) COLLATE "C"  NOT NULL,
+     message_id        VARCHAR(128) COLLATE "C" NOT NULL,
+     session_id        VARCHAR(64) COLLATE "C"  NOT NULL,
+     task_id           VARCHAR(64) COLLATE "C"  NOT NULL,
+     writer            VARCHAR(64) COLLATE "C"  NOT NULL,
+     accepted_at_ms    BIGINT        NOT NULL,
+     state             VARCHAR(16) COLLATE "C"  NOT NULL,
+     state_at_ms       BIGINT,
+     settle_how        VARCHAR(16) COLLATE "C",
+     announced_at_ms   BIGINT,
+     announced_task_id VARCHAR(64) COLLATE "C",
+     PRIMARY KEY (accept_id)
    )`,
     `CREATE TABLE IF NOT EXISTS sendfile_link (
      id         VARCHAR(64) COLLATE "C"    NOT NULL,

package/dist/plugins/retention-store-sql.d.ts

@@ -8,7 +8,7 @@
  * core 把破坏性级联整个下沉成 store 方法(`expireCheckpoints` / `deleteExpiredSessions` /
  * `deleteOrphanToolResults`),并点名 server 的 session-purge 顺序契约(E21,`boot/session-faces.ts` 的
  * `purgeSession` 协调器)为参考实现。那条顺序契约横跨**十余张表**(run 账本 / checkpoint / tool_result /
- * anchor / exemption / policy / attachment / snapshot / workflow inbox / session_meta+event),而设计稿
+ * anchor / exemption / policy / attachment / 用户输入受理账本 / snapshot / workflow inbox / session_meta+event),而设计稿
  * §6 的 F5 又要求「审计行与删除同一个 DB 事务」—— 一个事务 ⇒ 一条连接 ⇒ **一个属主**。
  *
  * ⇒ 布局裁定:本能力**不能**挂在 session / checkpoint / tool-result 任何一只店上(每只店只拥有自己的表,

package/dist/plugins/retention-store-sql.js

@@ -1,5 +1,6 @@
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { TASK_LIST_ITEM_TABLE, TASK_LIST_META_TABLE, taskListKeyFor } from "./task-list-store-sql.js";
+import { USER_INPUT_ACCEPTANCE_TABLE } from "./user-input-ledger-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
 export const MANAGED_RETENTION = "managed";
 export const UNMANAGED_RETENTION = "none";
@@ -382,6 +383,7 @@ export class SqlRetentionStore {
             ["session_policy", "session_id"],
             ["session_policy_rev_mark", "session_id"],
             ...(this.opts.taskAttachmentTable ? [["task_attachment", "session_id"]] : []),
+            [USER_INPUT_ACCEPTANCE_TABLE, "session_id"],
             ["file_history_tracked", "scope"],
             ["file_history_version", "scope"],
             ["file_history_boundary", "scope"],

package/dist/plugins/run-store-sql.d.ts

@@ -2,7 +2,7 @@ import type { TaskStatus } from "@sema-agent/core";
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type UsageRow } from "../usage-analytics.js";
-import type { RunRecord, SessionSummary, RunEvent, PersistedTaskResult, LatestRunRef } from "./store-contracts.js";
+import { type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import { type SqlDriver } from "./sql-driver.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 export type { RunRecord, SessionSummary, RunEvent, LatestRunRef } from "./store-contracts.js";