@sema-agent/server 7.109.0 → 7.111.0

package/dist/plugins/run-store-sql.js

@@ -6,6 +6,7 @@ import { pgSanitizeText } from "./pg-safe-json.js";
 import { toIso as iso } from "./sql-row-helpers.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readJsonObjectColumn, readNonNullJsonValueColumn } from "./sql-json-column.js";
+import { RUN_STALLED_ERROR } from "./store-contracts.js";
 import { notifyRunTerminal, runTerminalLogLevel } from "../observability/run-terminal.js";
 import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
@@ -423,8 +424,8 @@ export class SqlRunStore {
         const cutoff = new Date(Date.now() - olderThanMs);
         let reaped = 0;
         await this.tx(async (conn) => {
-            const { affected } = await conn.query(this.q("UPDATE task_run SET status = 'failed', result = NULL, error = 'run stalled (instance lost?)', updated_at = ? " +
-                "WHERE status = 'running' AND updated_at < ?", "UPDATE task_run SET status = 'failed', result = NULL, error = 'run stalled (instance lost?)', updated_at = $1 " +
+            const { affected } = await conn.query(this.q(`UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', updated_at = ? ` +
+                "WHERE status = 'running' AND updated_at < ?", `UPDATE task_run SET status = 'failed', result = NULL, error = '${RUN_STALLED_ERROR}', updated_at = $1 ` +
                 "WHERE status = 'running' AND updated_at < $2"), [new Date(), cutoff]);
             reaped = affected;
             await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));

package/dist/plugins/schema-indexes.js

@@ -8,6 +8,8 @@ export const CENTRAL_SCHEMA_INDEXES = [
     { table: "checkpoint", name: "idx_checkpoint_session_status", columns: ["session_id", "status"] },
     { table: "resume_anchor", name: "idx_resume_anchor_session", columns: ["session_id"] },
     { table: "approval_nonce", name: "idx_approval_nonce_expires", columns: ["expires_at_ms"] },
+    { table: "user_input_acceptance", name: "idx_user_input_acceptance_session", columns: ["session_id", "state", "accepted_at_ms"] },
+    { table: "user_input_acceptance", name: "idx_user_input_acceptance_state", columns: ["state", "accepted_at_ms", "accept_id"] },
     { table: "sendfile_link", name: "idx_sendfile_link_scope", columns: ["scope", "id"] },
     { table: "session_policy", name: "idx_session_policy_session", columns: ["session_id"] },
     { table: "session_policy_rev_mark", name: "idx_session_policy_rev_mark_session", columns: ["session_id"] },

package/dist/plugins/store-backend.d.ts

@@ -12,6 +12,7 @@ import { type ApprovalNonceStore } from "./approval-nonce-store.js";
 import { type ApprovalAskStore as ApprovalAskStoreType } from "./approval-ask-store-sql.js";
 import { type MemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
+import type { UserInputLedgerStore } from "../user-input-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { type SessionPolicyStoreLogger } from "./session-policy-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
@@ -195,6 +196,9 @@ export interface StoreBackend {
     /** SendUserFile scope↔object ledger (multi-tenant list/revoke handle; the hashed key segment hides the
      *  mapping from URLs). REQUIRED on all backends (works local — one JSONL, like approvalExemption). */
     sendFileLedger(): SendFileLedger;
+    /** S-928 用户输入受理账本的存储孪生(「200 applied」受理的影子;语义属主 `src/user-input-ledger.ts`)。REQUIRED on all backends ——
+     *  local = File(数据根下 `user-input-ledger/ledger.jsonl`,singleton:追加 fd 与内存折叠都在实例里),SQL = 表 `user_input_acceptance`。 */
+    userInputLedger(): UserInputLedgerStore;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
      *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore.
      *  `logger`:SQL 孪生抹除封键那一臂(S-891)的点名口(缺席 ⇒ 店退回 `console.warn`);local(core 的 File 店)不收。 */

package/dist/plugins/store-backend.js

@@ -23,6 +23,8 @@ import { FileApprovalAskStore } from "./approval-ask-store-file.js";
 import { TiDBMemoryOptOutGrantStore, PgMemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { TiDBSessionCaptureRecordStore, PgSessionCaptureRecordStore } from "./session-capture-record-store-sql.js";
 import { TiDBSendFileLedger, PgSendFileLedger, FileSendFileLedger } from "./send-file-ledger.js";
+import { FileUserInputLedgerStore } from "./user-input-ledger-file.js";
+import { TiDBUserInputLedgerStore, PgUserInputLedgerStore } from "./user-input-ledger-sql.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
 import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-store-sql.js";
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
@@ -123,6 +125,7 @@ class TiDBBackend {
     approvalAsk() { return new TiDBApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
+    userInputLedger() { return new TiDBUserInputLedgerStore(this.pool); }
     sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
@@ -171,6 +174,7 @@ class PgBackend {
     approvalAsk() { return new PgApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
+    userInputLedger() { return new PgUserInputLedgerStore(this.pool); }
     sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
@@ -212,6 +216,7 @@ class LocalBackend {
     approvalNonceStore;
     approvalAskStore;
     sendFileLedgerStore;
+    userInputLedgerStore;
     workflowJournalStore;
     outcomeSinkInst;
     onWarn;
@@ -249,6 +254,7 @@ class LocalBackend {
         this.approvalNonceStore = new FileApprovalNonceStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.approvalAskStore = new FileApprovalAskStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root, { warn: corruptReadWarn });
+        this.userInputLedgerStore = new FileUserInputLedgerStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.workflowJournalStore = new FileWorkflowJournalStore(this.fileBackend.root, undefined, {
             onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "workflow_journal_corrupt_read"),
         });
@@ -270,6 +276,8 @@ class LocalBackend {
         this.approvalNonceStore.dispose();
         this.approvalAskStore.dispose();
         this.sendFileLedgerStore.dispose();
+        this.userInputLedgerStore.dispose();
+        this.outcomeSinkInst.dispose();
         this.workflowJournalStore.dispose();
         this.checkpointStoreInst?.close();
         this.permissionRuleStoresInst?.dispose();
@@ -291,6 +299,7 @@ class LocalBackend {
     }
     permissionRuleStoresInst;
     sendFileLedger() { return this.sendFileLedgerStore; }
+    userInputLedger() { return this.userInputLedgerStore; }
     checkpoint() {
         if (!this.checkpointStoreInst) {
             const cs = new LocalCheckpointStore(this.fileBackend.root, {

package/dist/plugins/store-contracts.d.ts

@@ -104,6 +104,30 @@ export interface RunCancelContext {
 export type PersistedTaskResult = TaskResult & {
     cancelContext?: RunCancelContext;
 };
+/**
+ * 🔴 run 店「持有它的实例丢了」那一判的**行上落款**(S-928 codex r1-F1 提为常量):三只 run 店的 `reapStale` 把心跳过期的 running 行翻成
+ * `failed` 并写下这一句。它是 run 店死亡判决留在行上的证据之一(另一只 = {@link RUN_ORPHANED_ERROR})—— 用户输入受理账本的收敛判词
+ * (S-969 L8 起两车道同一只)据 {@link isHolderDeathVerdict} 在 reap **之后**仍能判出「写者死了」。改这一句 = 改那条判据;所以三个写者与那一个读者都只引用本常量。读时折叠成同一句话的 wire 展示站点
+ * (`routes/runs.ts` 的 stale 折叠、`routes/trace-usage.ts` 的 WORKER_DOWN 帧)刻意留字面量:它们由文案冻结门逐字钉着,且不参与任何判据。
+ */
+export declare const RUN_STALLED_ERROR = "run stalled (instance lost?)";
+/**
+ * 🔴 File 车道「持有它的进程随重启没了」那一判的行上落款(S-969 L8 提为常量):boot 孤儿回收(`FileRunStore.reclaimOrphanedAtBoot`,
+ * 数据根 LOCK 作证前世进程已死 ⇒ 仍 running 的行无条件判孤儿)与运行期 claim 接管的 running 臂(`judgeClaim`,外来 + owner 已死 + 无可续)
+ * 都写这一句;接管臂在括号里附上前任持有者的进程指纹(取证用,形 = {@link buildRunOrphanedError})。与 {@link RUN_STALLED_ERROR} 同一种身份:
+ * run 店写在行上的**死亡判决**,读者 = {@link isHolderDeathVerdict}。
+ */
+export declare const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
+/** File 车道两个孤儿落款写口共用的那一句(`heldBy` = 接管臂的前任持有者描述;boot 回收臂不带)。 */
+export declare function buildRunOrphanedError(heldBy?: string): string;
+/**
+ * run 行上是不是一份**持有者死亡判决**:`failed`,且 `error` 是 run 店的两只死亡落款之一 —— {@link RUN_STALLED_ERROR}(三只 run 店的
+ * `reapStale`:心跳过期 ⇒ 实例丢了)或 {@link RUN_ORPHANED_ERROR}(File 车道:前世进程随重启没了;接管臂带括注)。判决只说「持有它的那个进程
+ * 死在这条腿收场之前」,不说是谁 —— 持有者是谁读行上的 `instanceId`(两只落款都不改它)。唯一读者 = 用户输入受理账本的收敛判词
+ * (`src/user-input-ledger.ts` `judgeOpen`);改任一句落款 = 改那条判据,所以写者与读者都只引用本模块的常量。
+ * 正常失败(别的 error)/ park 过期收割(`approval expired before decision`:腿 park 过)都**不是**死亡判决。
+ */
+export declare function isHolderDeathVerdict(run: Pick<RunRecord, "status" | "error">): boolean;
 export interface RunRecord {
     taskId: string;
     sessionId: string;

package/dist/plugins/store-contracts.js

@@ -1,5 +1,15 @@
 export class StoreBootRefusalError extends Error {
 }
+export const RUN_STALLED_ERROR = "run stalled (instance lost?)";
+export const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
+export function buildRunOrphanedError(heldBy) {
+    return heldBy === undefined ? RUN_ORPHANED_ERROR : `${RUN_ORPHANED_ERROR} (claim held by ${heldBy}, which is gone)`;
+}
+export function isHolderDeathVerdict(run) {
+    if (run.status !== "failed" || run.error === null)
+        return false;
+    return run.error === RUN_STALLED_ERROR || run.error === RUN_ORPHANED_ERROR || run.error.startsWith(`${RUN_ORPHANED_ERROR} (`);
+}
 export const RUN_STATUS_CLASS = {
     running: "live",
     completed: "succeeded",

package/dist/plugins/tidb-pool.js

@@ -349,6 +349,23 @@ export const SCHEMA_STATEMENTS = [
      expires_at_ms  BIGINT       NOT NULL,
      PRIMARY KEY (session_id, nonce),
      KEY idx_approval_nonce_expires (expires_at_ms)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS user_input_acceptance (
+     accept_id         VARCHAR(64)  NOT NULL,
+     input_kind        VARCHAR(16)  NOT NULL,
+     message_id        VARCHAR(128) NOT NULL,
+     session_id        VARCHAR(64)  NOT NULL,
+     task_id           VARCHAR(64)  NOT NULL,
+     writer            VARCHAR(64)  NOT NULL,
+     accepted_at_ms    BIGINT       NOT NULL,
+     state             VARCHAR(16)  NOT NULL,
+     state_at_ms       BIGINT       NULL,
+     settle_how        VARCHAR(16)  NULL,
+     announced_at_ms   BIGINT       NULL,
+     announced_task_id VARCHAR(64)  NULL,
+     PRIMARY KEY (accept_id),
+     KEY idx_user_input_acceptance_session (session_id, state, accepted_at_ms),
+     KEY idx_user_input_acceptance_state (state, accepted_at_ms, accept_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS sendfile_link (
      id         VARCHAR(64)  NOT NULL,

package/dist/plugins/user-input-ledger-file.d.ts

@@ -0,0 +1,35 @@
+import type { Logger } from "../observability/logger.js";
+import { UserInputLedgerFold, type NewUserInputAcceptance, type OpenScanCursor, type OpenScanPage, type SettleHow, type UserInputAcceptance, type UserInputLedgerRecord, type UserInputLedgerStore } from "../user-input-ledger.js";
+/** 账本文件名(取证按文件字节对账 —— 崩溃语义的真源是文件)。 */
+export declare const USER_INPUT_LEDGER_FILE = "ledger.jsonl";
+/** 纯内存孪生(测试 / 夹具)。 */
+export declare class MemoryUserInputLedgerStore implements UserInputLedgerStore {
+    protected readonly fold: UserInputLedgerFold;
+    /** 落一行:守卫不过 ⇒ false、零写;过了 ⇒ 先交给 {@link persist}(File 孪生在这里 fsync),再翻折叠。 */
+    protected write(rec: UserInputLedgerRecord): Promise<boolean>;
+    /** 持久面挂点(Memory = 无)。抛 ⇒ 这一行不存在,折叠不动。 */
+    protected persist(_rec: UserInputLedgerRecord): void;
+    accept(a: NewUserInputAcceptance): Promise<void>;
+    settle(acceptId: string, how: SettleHow, atMs: number): Promise<boolean>;
+    converge(acceptId: string, atMs: number): Promise<boolean>;
+    announce(acceptId: string, taskId: string, atMs: number): Promise<boolean>;
+    listOpen(after?: OpenScanCursor, limit?: number): Promise<OpenScanPage>;
+    listCrashed(sessionId: string): Promise<UserInputAcceptance[]>;
+    listUnannounced(sessionId: string, limit: number): Promise<UserInputAcceptance[]>;
+    /** S-965:会话树删除 = 一行会话级墓碑(守卫:该会话此刻有行 ⇒ 落;否则零写、回 0)。写抛 ⇒ 原样抛(协调器据此不删会话本体)。 */
+    deleteBySession(sessionId: string): Promise<number>;
+}
+/** local 车道(File)孪生。 */
+export declare class FileUserInputLedgerStore extends MemoryUserInputLedgerStore {
+    /** 账本绝对路径。 */
+    readonly path: string;
+    private log;
+    /** @param opts.warn 腐读披露座(缺席 ⇒ 重放属主退回 `console.warn`)。 */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
+    protected persist(rec: UserInputLedgerRecord): void;
+    /** 收追加口(LocalBackend.close → 优雅重启重开)。core `AppendLog.close()` 自己吞 `closeSync` 的错,不抛。 */
+    dispose(): void;
+}
+//# sourceMappingURL=user-input-ledger-file.d.ts.map

package/dist/plugins/user-input-ledger-file.js

@@ -0,0 +1,108 @@
+import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
+import { CRASHED_CAUSE, SETTLE_HOW_WORDS, USER_INPUT_KIND_WORDS, USER_INPUT_LEDGER_DIR, USER_INPUT_OPEN_SCAN_MAX, USER_INPUT_SESSION_READ_MAX, UserInputLedgerFold, isServingLayerUndrainedCause, } from "../user-input-ledger.js";
+export const USER_INPUT_LEDGER_FILE = "ledger.jsonl";
+function duplicateAcceptance(acceptId) {
+    return new Error(`user-input ledger: acceptId ${acceptId} is already recorded — an acceptance id is one acceptance`);
+}
+export class MemoryUserInputLedgerStore {
+    fold = new UserInputLedgerFold();
+    async write(rec) {
+        if (!this.fold.admits(rec))
+            return false;
+        this.persist(rec);
+        this.fold.apply(rec);
+        return true;
+    }
+    persist(_rec) { }
+    async accept(a) {
+        const rec = { kind: "accepted", acceptId: a.acceptId, input: a.input, messageId: a.messageId, sessionId: a.sessionId, taskId: a.taskId, writer: a.writer, at: a.acceptedAtMs };
+        if (!(await this.write(rec)))
+            throw duplicateAcceptance(a.acceptId);
+    }
+    settle(acceptId, how, atMs) {
+        return this.write({ kind: "settled", acceptId, how, at: atMs });
+    }
+    converge(acceptId, atMs) {
+        return this.write({ kind: "converged", acceptId, cause: CRASHED_CAUSE, at: atMs });
+    }
+    announce(acceptId, taskId, atMs) {
+        return this.write({ kind: "announced", acceptId, taskId, at: atMs });
+    }
+    async listOpen(after, limit = USER_INPUT_OPEN_SCAN_MAX) {
+        return this.fold.listOpen(after, limit);
+    }
+    async listCrashed(sessionId) {
+        return this.fold.listCrashed(sessionId, USER_INPUT_SESSION_READ_MAX);
+    }
+    async listUnannounced(sessionId, limit) {
+        return this.fold.listUnannounced(sessionId, limit);
+    }
+    async deleteBySession(sessionId) {
+        const n = this.fold.sessionSize(sessionId);
+        return (await this.write({ kind: "erased", sessionId, at: Date.now() })) ? n : 0;
+    }
+}
+const RECORD_SHAPE = {
+    what: "user-input ledger record of an unknown kind or with a missing / out-of-vocabulary member",
+    read(record) {
+        const o = record;
+        const str = (k) => (typeof o[k] === "string" && o[k].length > 0 ? o[k] : undefined);
+        const at = typeof o.at === "number" && Number.isFinite(o.at) ? o.at : undefined;
+        if (at === undefined)
+            return undefined;
+        if (o.kind === "erased") {
+            const sessionId = str("sessionId");
+            return sessionId === undefined ? undefined : { kind: "erased", sessionId, at };
+        }
+        const acceptId = str("acceptId");
+        if (acceptId === undefined)
+            return undefined;
+        switch (o.kind) {
+            case "accepted": {
+                const input = typeof o.input === "string" && Object.hasOwn(USER_INPUT_KIND_WORDS, o.input) ? o.input : undefined;
+                const messageId = str("messageId");
+                const sessionId = str("sessionId");
+                const taskId = str("taskId");
+                const writer = str("writer");
+                if (input === undefined || messageId === undefined || sessionId === undefined || taskId === undefined || writer === undefined)
+                    return undefined;
+                return { kind: "accepted", acceptId, input, messageId, sessionId, taskId, writer, at };
+            }
+            case "settled": {
+                const how = typeof o.how === "string" && Object.hasOwn(SETTLE_HOW_WORDS, o.how) ? o.how : undefined;
+                return how === undefined ? undefined : { kind: "settled", acceptId, how, at };
+            }
+            case "converged":
+                return isServingLayerUndrainedCause(o.cause) ? { kind: "converged", acceptId, cause: o.cause, at } : undefined;
+            case "announced": {
+                const taskId = str("taskId");
+                return taskId === undefined ? undefined : { kind: "announced", acceptId, taskId, at };
+            }
+            default:
+                return undefined;
+        }
+    },
+};
+export class FileUserInputLedgerStore extends MemoryUserInputLedgerStore {
+    path;
+    log;
+    constructor(root, opts) {
+        super();
+        const dir = join(root, USER_INPUT_LEDGER_DIR);
+        ensureDir(dir);
+        this.path = join(dir, USER_INPUT_LEDGER_FILE);
+        for (const rec of replayJsonlSkipping(this.path, "user-input-ledger", RECORD_SHAPE, opts?.warn).records)
+            this.fold.apply(rec);
+    }
+    persist(rec) {
+        this.log ??= new AppendLog(this.path);
+        this.log.append(rec, true);
+    }
+    dispose() {
+        this.log?.close();
+        this.log = undefined;
+    }
+}
+//# sourceMappingURL=user-input-ledger-file.js.map

package/dist/plugins/user-input-ledger-sql.d.ts

@@ -0,0 +1,54 @@
+/**
+ * S-928 用户输入受理账本的 **SQL** 孪生(单文件双方言,[ref] A12 收拢形;两条语句并排写死,方言差异显式)。
+ * 语义属主 = `src/user-input-ledger.ts`;File / Memory 两只在 `user-input-ledger-file.ts`。四只孪生吃同一组试剂盒断言
+ * (`test/helpers/user-input-ledger-kit.ts`;本孪生的真双库腿在 `test/store-contract-kit-db-integration.test.ts`)。
+ *
+ * ## 一张表,一行一受理(四形行落在列上)
+ * File 孪生把四形行逐行追加;这里把同一组转移落在**一行**的列上:`accepted` = INSERT(`state='open'`),`settled` / `converged` =
+ * `state` 列的 CAS(`WHERE state='open'`,互斥、先到者赢),`announced` = `announced_*` 两列的 CAS(`WHERE state='converged' AND
+ * announced_at_ms IS NULL`,至多一次)。File 的「行序 = 语义序」在这里由 CAS 谓词结构性给出 —— 两者同义的证据是同一组试剂盒格。
+ * 多副本并发:两台副本同时收敛同一行 ⇒ 单赢者;settle 与 converge 互斥(同一行只会从 open 走出去一次)。
+ *
+ * ## 身份列
+ * 无 owner / principal / scope 列(行随它挂靠的会话走 —— 收编形Ⅲ);`writer` 是受理进程的 `instanceId`(随进程消亡,不是租户轴)。
+ * 行里不存输入正文(只有身份与时刻)。
+ *
+ * ## 会话树删除(S-965)
+ * `deleteBySession` = `DELETE … WHERE session_id = ?`(真删行;File 孪生是一行会话级墓碑,同义)。两条删会话树的级联各有一臂:在线删除协调器
+ * 经本动词;托管留存的事务化孪生(`retention-store-sql.ts` `purgeSessionTrees` ④)在**自己的事务**里对本表发同一只谓词(`session_id` 单键,
+ * 多值集合按方言)—— 它不调店,理由见该文件顶注的布局裁定(一个事务 ⇒ 一条连接 ⇒ 一个属主)。谓词走 `(session_id, state, accepted_at_ms)` 索引的前缀。
+ *
+ * ## 读不出的行(S-969 L6):逐行跳过,游标按原始行推进
+ * 三只读口都按 `state` 列取行(`= 'open'` / `= 'converged'`),所以 `state` 词表外的行任何读口都取不到;被取到的行上读不出的列 —— `input_kind`
+ * 词表外(新版本写的输入族:滚动发布 / 回滚的混版窗)、收敛行缺 `state_at_ms` —— 由 {@link readRows} 逐行跳过 + 计 F 类 tag
+ * `server.user-input-ledger.corrupt-record-skipped`(File 孪生重放坏行的同一只登记座),其余行照交。修前一行读不出 ⇒ 整页抛:收敛断点不前进
+ * (其后的 open 行永不收敛)、同会话的通告与读面一并失效。`listOpen` 的续翻游标取**原始**末行的键(`accept_id` / `accepted_at_ms` 是 NOT NULL
+ * 键列,坏行也读得出),跳过的行照样推进;页里少了几行不等于扫到底(那由原始行数判)。SQL 文本 / DDL 不变。
+ */
+import type { Pool as MysqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import { type SqlDriver } from "./sql-driver.js";
+import { type NewUserInputAcceptance, type OpenScanCursor, type OpenScanPage, type SettleHow, type UserInputAcceptance, type UserInputLedgerStore } from "../user-input-ledger.js";
+export declare const USER_INPUT_ACCEPTANCE_TABLE = "user_input_acceptance";
+export declare class SqlUserInputLedgerStore implements UserInputLedgerStore {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    accept(a: NewUserInputAcceptance): Promise<void>;
+    settle(acceptId: string, how: SettleHow, atMs: number): Promise<boolean>;
+    converge(acceptId: string, atMs: number): Promise<boolean>;
+    announce(acceptId: string, taskId: string, atMs: number): Promise<boolean>;
+    listOpen(after?: OpenScanCursor, limit?: number): Promise<OpenScanPage>;
+    listCrashed(sessionId: string): Promise<UserInputAcceptance[]>;
+    listUnannounced(sessionId: string, limit: number): Promise<UserInputAcceptance[]>;
+    deleteBySession(sessionId: string): Promise<number>;
+}
+/** MySQL 协议腿的构造绑定。 */
+export declare class TiDBUserInputLedgerStore extends SqlUserInputLedgerStore {
+    constructor(pool: MysqlPool);
+}
+/** PostgreSQL 腿的构造绑定。 */
+export declare class PgUserInputLedgerStore extends SqlUserInputLedgerStore {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=user-input-ledger-sql.d.ts.map

package/dist/plugins/user-input-ledger-sql.js

@@ -0,0 +1,129 @@
+import { recordFailOpen } from "../observability/fail-open.js";
+import { isDupKeyError } from "./sql-errors.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { assertPageLimit, CRASHED_CAUSE, SETTLE_HOW_WORDS, USER_INPUT_KIND_WORDS, USER_INPUT_OPEN_SCAN_MAX, USER_INPUT_SESSION_READ_MAX, } from "../user-input-ledger.js";
+export const USER_INPUT_ACCEPTANCE_TABLE = "user_input_acceptance";
+const COLUMNS = "accept_id, input_kind, message_id, session_id, task_id, writer, accepted_at_ms, state, state_at_ms, settle_how, announced_at_ms, announced_task_id";
+function rowState(r) {
+    const state = String(r["state"]);
+    const at = r["state_at_ms"] == null ? Number.NaN : Number(r["state_at_ms"]);
+    switch (state) {
+        case "open":
+            return { kind: "open" };
+        case "settled": {
+            const how = String(r["settle_how"]);
+            if (!Object.hasOwn(SETTLE_HOW_WORDS, how) || !Number.isFinite(at))
+                return undefined;
+            return { kind: "settled", how: how, atMs: at };
+        }
+        case "converged":
+            if (!Number.isFinite(at))
+                return undefined;
+            return { kind: "converged", cause: CRASHED_CAUSE, atMs: at };
+        default:
+            return undefined;
+    }
+}
+function readRow(r) {
+    const input = String(r["input_kind"]);
+    if (!Object.hasOwn(USER_INPUT_KIND_WORDS, input))
+        return { ok: false, reason: `input_kind ${input} is not a ledger word` };
+    const state = rowState(r);
+    if (state === undefined)
+        return { ok: false, reason: `unreadable state (${String(r["state"])} / ${String(r["settle_how"])} / ${String(r["state_at_ms"])})` };
+    const announcedAt = r["announced_at_ms"] == null ? undefined : Number(r["announced_at_ms"]);
+    return {
+        ok: true,
+        acceptance: {
+            acceptId: String(r["accept_id"]),
+            input: input,
+            messageId: String(r["message_id"]),
+            sessionId: String(r["session_id"]),
+            taskId: String(r["task_id"]),
+            writer: String(r["writer"]),
+            acceptedAtMs: Number(r["accepted_at_ms"]),
+            state,
+            ...(announcedAt !== undefined ? { announced: { atMs: announcedAt, taskId: String(r["announced_task_id"]) } } : {}),
+        },
+    };
+}
+function readRows(rows, op) {
+    const out = [];
+    for (const r of rows) {
+        const read = readRow(r);
+        if (read.ok)
+            out.push(read.acceptance);
+        else
+            recordFailOpen("server.user-input-ledger.corrupt-record-skipped", `table=${USER_INPUT_ACCEPTANCE_TABLE} op=${op} accept_id=${String(r["accept_id"])} ${read.reason}`);
+    }
+    return out;
+}
+function rawCursor(r) {
+    const acceptedAtMs = Number(r["accepted_at_ms"]);
+    if (!Number.isFinite(acceptedAtMs))
+        throw new Error(`${USER_INPUT_ACCEPTANCE_TABLE} row ${String(r["accept_id"])}: accepted_at_ms ${String(r["accepted_at_ms"])} is not a number — cannot page past it`);
+    return { acceptedAtMs, acceptId: String(r["accept_id"]) };
+}
+export class SqlUserInputLedgerStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async accept(a) {
+        try {
+            await this.db.query(this.q(`INSERT INTO ${USER_INPUT_ACCEPTANCE_TABLE} (accept_id, input_kind, message_id, session_id, task_id, writer, accepted_at_ms, state) VALUES (?,?,?,?,?,?,?,'open')`, `INSERT INTO ${USER_INPUT_ACCEPTANCE_TABLE} (accept_id, input_kind, message_id, session_id, task_id, writer, accepted_at_ms, state) VALUES ($1,$2,$3,$4,$5,$6,$7,'open')`), [a.acceptId, a.input, a.messageId, a.sessionId, a.taskId, a.writer, a.acceptedAtMs]);
+        }
+        catch (err) {
+            if (isDupKeyError(this.db.dialect, err))
+                throw new Error(`user-input ledger: acceptId ${a.acceptId} is already recorded — an acceptance id is one acceptance`);
+            throw err;
+        }
+    }
+    async settle(acceptId, how, atMs) {
+        const res = await this.db.query(this.q(`UPDATE ${USER_INPUT_ACCEPTANCE_TABLE} SET state = 'settled', state_at_ms = ?, settle_how = ? WHERE accept_id = ? AND state = 'open'`, `UPDATE ${USER_INPUT_ACCEPTANCE_TABLE} SET state = 'settled', state_at_ms = $1, settle_how = $2 WHERE accept_id = $3 AND state = 'open'`), [atMs, how, acceptId]);
+        return res.affected > 0;
+    }
+    async converge(acceptId, atMs) {
+        const res = await this.db.query(this.q(`UPDATE ${USER_INPUT_ACCEPTANCE_TABLE} SET state = 'converged', state_at_ms = ? WHERE accept_id = ? AND state = 'open'`, `UPDATE ${USER_INPUT_ACCEPTANCE_TABLE} SET state = 'converged', state_at_ms = $1 WHERE accept_id = $2 AND state = 'open'`), [atMs, acceptId]);
+        return res.affected > 0;
+    }
+    async announce(acceptId, taskId, atMs) {
+        const res = await this.db.query(this.q(`UPDATE ${USER_INPUT_ACCEPTANCE_TABLE} SET announced_at_ms = ?, announced_task_id = ? WHERE accept_id = ? AND state = 'converged' AND announced_at_ms IS NULL`, `UPDATE ${USER_INPUT_ACCEPTANCE_TABLE} SET announced_at_ms = $1, announced_task_id = $2 WHERE accept_id = $3 AND state = 'converged' AND announced_at_ms IS NULL`), [atMs, taskId, acceptId]);
+        return res.affected > 0;
+    }
+    async listOpen(after, limit = USER_INPUT_OPEN_SCAN_MAX) {
+        assertPageLimit("listOpen", limit);
+        const { rows } = after === undefined
+            ? await this.db.query(this.q(`SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE state = 'open' ORDER BY accepted_at_ms, accept_id LIMIT ${limit}`, `SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE state = 'open' ORDER BY accepted_at_ms, accept_id LIMIT ${limit}`), [])
+            : await this.db.query(this.q(`SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE state = 'open' AND (accepted_at_ms > ? OR (accepted_at_ms = ? AND accept_id > ?)) ORDER BY accepted_at_ms, accept_id LIMIT ${limit}`, `SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE state = 'open' AND (accepted_at_ms > $1 OR (accepted_at_ms = $2 AND accept_id > $3)) ORDER BY accepted_at_ms, accept_id LIMIT ${limit}`), [after.acceptedAtMs, after.acceptedAtMs, after.acceptId]);
+        const open = readRows(rows, "listOpen");
+        return rows.length === limit ? { open, next: rawCursor(rows[rows.length - 1]) } : { open };
+    }
+    async listCrashed(sessionId) {
+        const { rows } = await this.db.query(this.q(`SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE session_id = ? AND state = 'converged' ORDER BY accepted_at_ms DESC, accept_id DESC LIMIT ${USER_INPUT_SESSION_READ_MAX}`, `SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE session_id = $1 AND state = 'converged' ORDER BY accepted_at_ms DESC, accept_id DESC LIMIT ${USER_INPUT_SESSION_READ_MAX}`), [sessionId]);
+        return readRows(rows, "listCrashed").reverse();
+    }
+    async listUnannounced(sessionId, limit) {
+        const n = assertPageLimit("listUnannounced", limit);
+        const { rows } = await this.db.query(this.q(`SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE session_id = ? AND state = 'converged' AND announced_at_ms IS NULL ORDER BY accepted_at_ms, accept_id LIMIT ${n}`, `SELECT ${COLUMNS} FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE session_id = $1 AND state = 'converged' AND announced_at_ms IS NULL ORDER BY accepted_at_ms, accept_id LIMIT ${n}`), [sessionId]);
+        return readRows(rows, "listUnannounced");
+    }
+    async deleteBySession(sessionId) {
+        const res = await this.db.query(this.q(`DELETE FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE session_id = ?`, `DELETE FROM ${USER_INPUT_ACCEPTANCE_TABLE} WHERE session_id = $1`), [sessionId]);
+        return res.affected;
+    }
+}
+export class TiDBUserInputLedgerStore extends SqlUserInputLedgerStore {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgUserInputLedgerStore extends SqlUserInputLedgerStore {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=user-input-ledger-sql.js.map

package/dist/project-memory.d.ts

@@ -25,7 +25,8 @@ interface ProjectMemoryCtx {
  *  every CLAUDE file it finds, per directory level up the ancestor chain, whereas this loader reads one root and
  *  takes the single first hit. */
 declare const INSTRUCTION_FILE_CHAIN: readonly ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
-type ChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
+/** 一个链成员(相对项目根的拼写)。导出给 S-961 的 wire 段与它的值闭集登记(`trace/self-minted-wire.ts`)—— 链长一员,两处 tsc 跟着红。 */
+export type InstructionChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
 /** Recover (root, rel) for a path the LOADER declared — every declared path is `root + one chain member`.
  *  The probe needs this to re-run the loader's parent-directory symlink gate each round (self-review: the probe
  *  checked only the final component, so swapping `.claude` for a symlink out of the repo MID-RUN made the probe
@@ -33,7 +34,7 @@ type ChainMember = (typeof INSTRUCTION_FILE_CHAIN)[number];
  *  calls it with the host `node:path`. */
 export declare function instructionChainCoordinates(absPath: string, p?: PlatformPath): {
     root: string;
-    rel: ChainMember;
+    rel: InstructionChainMember;
 } | null;
 /**
  * Build a `loadProjectMemory` for the host lane. Returns null (skip) unless hands are enabled AND cwd is a local
@@ -54,6 +55,13 @@ export declare function instructionChainCoordinates(absPath: string, p?: Platfor
  * an absolute local directory) is "not applicable", not "none" — it never reaches the mint (O6, see `LoadOutcome`). The member is the one the snapshot carries — a cache hit answers the cached pick, so
  * the notice follows what the model actually reads, not the disk (a same-process edit changes nothing until the
  * snapshot is re-read: restart, post-compact, or a new session).
+ *
+ * S-961 — the same statement (same predicate, same member) also settles the calling LEG's `wiring_manifest.instructions`
+ * segment through {@link settleLegInstructionStatement} (`instruction-selection.ts`): the leg scope is the run identity
+ * the ctx does not carry, and the first call inside a leg's scope whose `ctx.sessionId` equals the leg's session is that
+ * leg's own prepare (a session-less adhoc leg falls back to plain first-call; [ref] X1). The segment projects
+ * `instructionFile`, not `instructionSources`: an empty selected file with no git narrative returns no answer and so no
+ * `instructionSources`, yet it IS the pick (it shadows every member below it) — and the notice reads the same value.
  */
 export declare function makeLoadProjectMemory(opts: {
     logger?: {

package/dist/project-memory.js

@@ -3,6 +3,7 @@ import { execFile } from "node:child_process";
 import { createHmac, randomBytes } from "node:crypto";
 import hostPath, { isAbsolute, join } from "node:path";
 import { announceInstructionSource } from "./instruction-source-notice.js";
+import { settleLegInstructionStatement } from "./instruction-selection.js";
 import { gitSubprocessEnv } from "./server-secret-env.js";
 import { redactSecrets } from "./trace/redact.js";
 const INSTRUCTION_FILE_CHAIN = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", ".claude/AGENTS.md"];
@@ -92,8 +93,10 @@ export function makeLoadProjectMemory(opts) {
     const seat = opts.instructionSource;
     return async (ctx) => {
         const outcome = await loadOutcome(ctx);
-        if (seat && ctx.sessionId && !ctx.isSubagent && outcome.walked)
-            await announceInstructionSource(seat, ctx.sessionId, outcome.instructionFile);
+        const statement = outcome.walked && !ctx.isSubagent ? { stated: true, file: outcome.instructionFile } : { stated: false };
+        settleLegInstructionStatement(statement, ctx.sessionId);
+        if (seat && ctx.sessionId && statement.stated)
+            await announceInstructionSource(seat, ctx.sessionId, statement.file);
         return outcome.answer;
     };
     async function loadOutcome(ctx) {

package/dist/run-local.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { type AskRequest, type Brain, type TaskSpec } from "@sema-agent/core";
+import { type UnattendedPolicyRefusal } from "./tool-approval.js";
 import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView } from "./deployment-governance.js";
 import { type ServiceConfig } from "./config.js";
 import { type Logger } from "./observability/logger.js";
@@ -105,6 +106,9 @@ export interface LocalApproverIo {
     readonly askYesNo: (prompt: string, signal?: AbortSignal) => Promise<boolean>;
     /** 非 TTY 臂的告知面(stderr)。 */
     readonly printErr: (line: string) => void;
+    /** S-956:本席**没有人被问**就拒了一只 ask(无 TTY / 参数展示不出)的事实出口 —— 退出码的判据之一(见 {@link unfinishedStopOf}):
+     *  这一拒交给 core 的是部署政策拒(不停批、不记人拒),「活没干完」于是不再经 core 的人拒标记传出来,由本席自己说。 */
+    readonly noteRefusedWithoutPerson: () => void;
 }
 /**
  * [ref] 件三:**onAsk 座**(§0 潜雷 / §5 锁 6)。
@@ -130,12 +134,21 @@ export interface LocalApproverIo {
  * ask(core 把 `matchedAskRule` 刻意留在闸内、不上请求),所以无 TTY 拒句**列出**可能产门的全部旋钮,
  * `APPROVAL_DENY` 也点名(它当场拒、不经本席 —— 运维排查「为什么这只工具不跑」时要在同一句里看到它)。
  *
- * 🔴 非 TTY 臂答 `false`(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
+ * 🔴 非 TTY 臂答**拒**(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
  * `suspendAsk`**(dist `core/hooks.js` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
  * 可去(fail-closed 拒),但这一条仍是本席的契约:答案是「不批」,不是「找不到人」。
+ *
+ * 🔴 S-956:**谁拒的就记谁**。本席的拒分两种,交给 core 的形不同:
+ *  · **人答 N**(TTY 臂)⇒ 裸 `false` —— core 契约里这就是「一个人拒了」(`human_refused` / `who.party:"person"`,模型读「用户不想继续,
+ *    停下来等他」,run 以 `haltedOnUserRejection` 停批);
+ *  · **没有人被问**(无 TTY 臂 / 参数展示不出臂)⇒ 部署政策拒对象 {@link UnattendedPolicyRefusal}(经与协调器 deny 政策臂**同一只**构造
+ *    `buildUnattendedPolicyRefusal`;core 7.37.1 `readApproverOutcomeObject` ⇒ `policy_refused` / `who.party:"none"`,模型读 core 的
+ *    策略句 + 本席的拒因,不停批)。修前两臂交裸 `false` ⇒ 机器的拒被记成人拒、模型被告知去等一个不存在的人。
+ *  两臂的拒都经 `io.noteRefusedWithoutPerson` 报一次 —— 「活没干完」(退 1)此前搭的是 core 人拒标记的便车,S-956 之后由本席的事实给。
  */
-/** 本席的形:core `OnAsk` 的函数臂(`"allow"` / `"deny"` 两个字面臂本席从不用),答案恒是布尔 —— 结构上可赋给 `OnAsk`。 */
-export type LocalApprover = (req: AskRequest, signal?: AbortSignal) => Promise<boolean>;
+/** 本席的形:core `OnAsk` 的函数臂(`"allow"` / `"deny"` 两个字面臂本席从不用)—— 人的答是布尔,没有人被问的拒是部署政策拒对象;
+ *  结构上可赋给 `OnAsk`。 */
+export type LocalApprover = (req: AskRequest, signal?: AbortSignal) => Promise<boolean | UnattendedPolicyRefusal>;
 export declare function createLocalApprover(io: LocalApproverIo): LocalApprover;
 export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, streams?: {
     input: NodeJS.ReadableStream;
@@ -143,8 +156,8 @@ export declare function promptYesNoOnTty(prompt: string, signal?: AbortSignal, s
 }): Promise<boolean>;
 /**
  * Boot the engine in LOCAL mode, run ONE task to completion, print the result. Returns the process exit
- * code (0 = completed its work, 1 = the task did not complete — including a `completed` run that a person stopped,
- * see {@link personStopOf} — / a fatal error, 2 = bad usage / unmet env). Pure of
+ * code (0 = completed its work, 1 = the task did not complete — including a `completed` run that a person stopped
+ * or whose approval no person could answer, see {@link unfinishedStopOf} — / a fatal error, 2 = bad usage / unmet env). Pure of
  * `process.exit` so a test can assert the code; `main()` applies it.
  */
 export declare function runLocal(argv: string[], deps?: RunLocalDeps): Promise<number>;