@sema-agent/server 7.110.0 → 7.111.0

package/dist/http/routes/tasks.js

@@ -28,6 +28,7 @@ import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
+import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -114,6 +115,7 @@ export async function handleTasks(req, res, match, ctx) {
         const principal = prepared.auth?.principal;
         const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
         let wiringReceipt;
+        const instructionLeg = createInstructionSelectionLeg();
         const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
         if (liveStream) {
             if (prepared.verify || prepared.cascade) {
@@ -261,7 +263,7 @@ export async function handleTasks(req, res, match, ctx) {
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), instructionsSegment: instructionLeg.segment });
                     usageKey = tid;
                     deps.modelUsage?.register(tid);
                     const owner = principal ?? null;
@@ -504,7 +506,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
                                 }
                                 else if (ev.type === "wiring_manifest") {
-                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace);
+                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
                                     wiringReceipt ??= wiringFace;
                                     sseData(res, { type: "wiring_manifest", ...wiringFace });
                                 }
@@ -647,7 +649,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
+                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {
@@ -658,7 +660,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 }
                             },
                         }, withApproval)
-                        : withApproval());
+                        : withApproval()));
                     if (durableTaskId && deps.runStore) {
                         const finalPlane = finalResult ? outwardPlane(finalResult.terminal) : undefined;
                         if (finalResult && finalPlane?.status === "suspended" && deps.checkpointStore)
@@ -836,7 +838,7 @@ export async function handleTasks(req, res, match, ctx) {
                 const observeSyncLegEvent = (ev) => {
                     if (ev.type !== "wiring_manifest" || wiringReceipt !== undefined)
                         return;
-                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace);
+                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
                 };
                 let result;
                 let cancelVerbLabel = false;
@@ -850,7 +852,7 @@ export async function handleTasks(req, res, match, ctx) {
                             observeSyncLegEvent(ev);
                         return stream.result();
                     };
-                    result = await withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg());
+                    result = await instructionLeg.run(prepared.spec.sessionId, () => withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg()));
                 }
                 finally {
                     counters.uncountedBillableInflight--;

package/dist/http/server.d.ts

@@ -218,7 +218,7 @@ export interface ServiceStoreDeps {
      *  已配 AND 有 store backend(main.ts 建;写点在两条 send lane 的 withLedgerRecording)。 */
     sendFileLedger?: import("../plugins/send-file-ledger.js").SendFileLedger;
     /** S-928 用户输入受理账本(「200 applied」受理的影子;单写者 = `src/user-input-ledger.ts` 的活对象,boot 装配在 stage-07 并跑一次收敛)。
-     *  在场 ⇔ 有 store backend(生产恒与 `runStore` 同源于 backend)。消费点:steer 的 live 腿受理前写 `accepted`(写不进 ⇒ 503
+     *  在场 ⇔ 有 store backend(生产恒与 `runStore` 同源于 backend)。消费点:steer 的 live 腿 / interrupt{text} / 同步子代的 steer(S-966)受理前写 `accepted`(写不进 ⇒ 503
      *  `steering.ledger_unavailable`)、三条 run 腿开通告口那一拍铸 `crashed` 通告并在收场时 settle、`GET /v1/sessions/:id` 的
      *  `userInputUndrained` 读面。缺席只出现在不接 backend 的 stub-harness 上(那时没有这一面,行为与修前逐字相同)。 */
     userInputLedger?: import("../user-input-ledger.js").UserInputLedger;

package/dist/index.d.ts

@@ -29,5 +29,5 @@ export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-r
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
-export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
+export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/instruction-selection.d.ts

@@ -0,0 +1,34 @@
+import type { InstructionChainMember } from "./project-memory.js";
+/** wire 段 `wiring_manifest.instructions` 的形。`selected` 的成员拼写 = `INSTRUCTION_FILE_CHAIN` 的成员(相对 cwd)。 */
+export interface InstructionsSegment {
+    readonly selected: readonly InstructionChainMember[];
+}
+/**
+ * 一次 loader 调用对**腿**说了什么:
+ *  · `stated: false` —— 没有陈述(走链之前的门拦下了:无手 / cwd 不是本机绝对目录;或这是委派子代的 prepare);
+ *  · `stated: true`  —— 走了链,`file` = 选中的链成员,`null` = 一个都没有。
+ * 判别式显式写出来(不拿 `undefined` / `null` 两个空值各代表一件事 —— O6 那条教训:「不适用」不是「来源 = 无」)。
+ */
+export type LegInstructionStatement = {
+    readonly stated: false;
+} | {
+    readonly stated: true;
+    readonly file: InstructionChainMember | null;
+};
+/** 一条腿的指令文件选择:开作用域 + 读段。每条投 `wiring_manifest` 的腿(流式 / 非流式 / bg / 续跑)各建一只。 */
+export interface InstructionSelectionLeg {
+    /** 在这条腿的作用域里跑它的模型驱动(引擎的 prepare 在里面调 loader)。`sessionId` = 这条腿的会话 —— 作用域里只有**同会话**的 loader 调用
+     *  才算这条腿自己的 prepare([ref] opus 腿 F1:wake 续跑在腿自己的 prepare 之前同步跑部署 `userPromptSubmit` 的 agent 型 hook,hook agent 是另一只
+     *  会话、却与本进程共用同一只 loader ⇒ 只按「第一次调用」会被它抢先封槽)。嵌套时内层覆盖外层 —— 每条腿说自己的。 */
+    run<T>(sessionId: string | undefined, fn: () => T): T;
+    /** 这条腿的 `instructions` 段;`undefined` ⇒ 段缺席。在投帧那一刻读:core 在推帧之前已经 await 过 loader。 */
+    segment(): InstructionsSegment | undefined;
+}
+export declare function createInstructionSelectionLeg(): InstructionSelectionLeg;
+/**
+ * loader 侧唯一写口:当前作用域里、**同会话的**第一次调用封槽(`sessionId` = loader ctx 带的会话;不等于腿的会话 —— hook agent / 子代 /
+ * 别的嵌套 run 的 prepare —— 一律不算,也不封槽,等这条腿自己的那一次);作用域外(run-local、leader、council 子任务 …)无效。
+ * 「身份 = 作用域 ∧ 同会话」两条都要:只靠作用域会被同进程共用 loader 的别的 Runner 抢先(F1);只靠会话会让同会话的并发腿 / 快速续跑串值。
+ */
+export declare function settleLegInstructionStatement(statement: LegInstructionStatement, sessionId: string | undefined): void;
+//# sourceMappingURL=instruction-selection.d.ts.map

package/dist/instruction-selection.js

@@ -0,0 +1,23 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const legScope = new AsyncLocalStorage();
+export function createInstructionSelectionLeg() {
+    let slot;
+    return {
+        run: (sessionId, fn) => {
+            slot = { sessionId, settled: false };
+            return legScope.run(slot, fn);
+        },
+        segment: () => slot?.segment,
+    };
+}
+export function settleLegInstructionStatement(statement, sessionId) {
+    const slot = legScope.getStore();
+    if (slot === undefined || slot.settled)
+        return;
+    if (slot.sessionId !== undefined && sessionId !== slot.sessionId)
+        return;
+    slot.settled = true;
+    if (statement.stated)
+        slot.segment = { selected: statement.file === null ? [] : [statement.file] };
+}
+//# sourceMappingURL=instruction-selection.js.map

package/dist/observability/corrupt-read-seat.d.ts

@@ -150,6 +150,24 @@ export declare const JSONL_REPLAY_SEATS: {
         readonly tag: "server.send-file-ledger.corrupt-record-skipped";
         readonly note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).";
     };
+    readonly "approval-ask-audit": {
+        readonly direction: "fail-open";
+        readonly event: "approval_ask_audit_corrupt_read";
+        readonly tag: "server.approval-ask-audit.corrupt-record-skipped";
+        readonly note: "F: a skipped ask-audit record is one audit row missing from the boot crash-convergence read (an ask / settle / leg-close fact gone ⇒ that orphan is listed on a thinner basis or not at all, never a gate — the audit store gates nothing and the approval path never reads it back).";
+    };
+    readonly "workflow-notify-journal": {
+        readonly direction: "fail-open";
+        readonly event: "workflow_notify_journal_corrupt_read";
+        readonly tag: "server.workflow-notify-journal.corrupt-record-skipped";
+        readonly note: "F: a skipped notify-journal record is one run's pending entry (or its ack) missing from the boot replay. The recovery sweep walks the journal, so a lost pending line means that run's completion notify is not re-derived after a crash (the live in-process notify and the WorkflowStatus poll floor are untouched); a lost ack line means one extra idempotent re-delivery (the receiver dedups on runId). It gates no permission and changes no run.";
+    };
+    readonly "workflow-agent-session-index": {
+        readonly direction: "fail-open";
+        readonly event: "workflow_agent_session_ledger_line_rejected";
+        readonly tag: "server.workflow-agent-session-index.corrupt-record-skipped";
+        readonly note: "F: a skipped index line leaves that run on its previous known-good snapshot; a /decide for a park the line should have indexed finds no row and falls back to the legacy lane (an honest miss, never a mis-route — the redeem key is compared verbatim on the run record, not read from this index).";
+    };
     readonly "user-input-ledger": {
         readonly direction: "fail-open";
         readonly event: "user_input_ledger_corrupt_read";

package/dist/observability/corrupt-read-seat.js

@@ -93,6 +93,24 @@ export const JSONL_REPLAY_SEATS = {
         tag: "server.send-file-ledger.corrupt-record-skipped",
         note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).",
     },
+    "approval-ask-audit": {
+        direction: "fail-open",
+        event: "approval_ask_audit_corrupt_read",
+        tag: "server.approval-ask-audit.corrupt-record-skipped",
+        note: "F: a skipped ask-audit record is one audit row missing from the boot crash-convergence read (an ask / settle / leg-close fact gone ⇒ that orphan is listed on a thinner basis or not at all, never a gate — the audit store gates nothing and the approval path never reads it back).",
+    },
+    "workflow-notify-journal": {
+        direction: "fail-open",
+        event: "workflow_notify_journal_corrupt_read",
+        tag: "server.workflow-notify-journal.corrupt-record-skipped",
+        note: "F: a skipped notify-journal record is one run's pending entry (or its ack) missing from the boot replay. The recovery sweep walks the journal, so a lost pending line means that run's completion notify is not re-derived after a crash (the live in-process notify and the WorkflowStatus poll floor are untouched); a lost ack line means one extra idempotent re-delivery (the receiver dedups on runId). It gates no permission and changes no run.",
+    },
+    "workflow-agent-session-index": {
+        direction: "fail-open",
+        event: "workflow_agent_session_ledger_line_rejected",
+        tag: "server.workflow-agent-session-index.corrupt-record-skipped",
+        note: "F: a skipped index line leaves that run on its previous known-good snapshot; a /decide for a park the line should have indexed finds no row and falls back to the legacy lane (an honest miss, never a mis-route — the redeem key is compared verbatim on the run record, not read from this index).",
+    },
     "user-input-ledger": {
         direction: "fail-open",
         event: "user_input_ledger_corrupt_read",

package/dist/observability/fail-open.d.ts

@@ -317,17 +317,29 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
     };
+    readonly "server.approval-ask-audit.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-967(`approval-ask-audit-store.ts`,local 车道 File ask 审计店的 boot 重放;登记名 `approval-ask-audit`):账本**中间**一行读不出形(`42` / 数组 / 缺键 / 词表外 `kind`·`outcome`·`orphanState` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `ask` ⇒ 那只孤儿在崩溃收敛读面缺席(无身份可列);丢 `settle` ⇒ 该组按 pending 臂收(审批门在执行之前 ⇒ 若这条 settle 其实是 `allowed` 且工具已执行,`resumeSafe:true` 是错的 —— 与头注「双故障窗」同族);丢 `leg_closed` ⇒ decided 臂多收一行(保守方向);丢 `crash_converged` ⇒ 下一次 boot 重收(幂等);丢 `interrupted_by_shutdown` / `late_settle` ⇒ 成因注退回 `crashed_before_park` / 少一行取证。审计店不开门、不改任何审批结算 ⇒ F。修前:重放坏行只计入 `convergeCrashedAsks().corruptLines`(boot 日志一个数),**无逐条披露、无 tag**。";
+    };
+    readonly "server.workflow-notify-journal.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-977(`orchestration/workflow-notify-journal.ts`,local 车道 File notify journal 的 boot 重放;登记名 `workflow-notify-journal`):账本**中间**一行读不出形(`42` / 数组 / 缺 runId·scope / `acked` 非布尔 / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `pending` 行(`record` 写下的那条)⇒ 那条 run 不在恢复积压里,崩溃丢掉的终态通告 boot 恢复扫描不再重导(live 进程内通告与 `WorkflowStatus` 轮询地板不受影响);丢 `acked` 行 ⇒ 该 run 读回 pending(或前一份已知良好的条目),多一次幂等重投(接收方按 runId 去重)。账本不开门、不改任何 run 的执行或授权 ⇒ F。修前:坏行 / 缺键行**静默**(解析失败 `continue`、只判 `typeof runId === \"string\"`)。";
+    };
+    readonly "server.workflow-agent-session-index.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-977(`orchestration/workflow-agent-session-index.ts`,local 车道 workflow 出身 park 的 join 索引账本的 boot 重放;登记名 `workflow-agent-session-index`):账本**中间**一行读不出形(`42` / 数组 / 缺 `runId`·`rows` / 任一行成员缺身份位 / 半截 JSON;撕尾不走本 tag)⇒ **整行**跳过,那条 run 保留上一份已知良好的快照(不做「丢坏成员、留好成员」—— 那会铸出比真相少几条 park 的行集)。最坏后果 = 该 run 的 park 在索引里缺行 ⇒ `/decide` 找不到它、退回 legacy 腿(409 `conflict.resume_context_unavailable`):诚实 miss,不是错配 —— 赎回键由记录上的 `parks[]` 逐字比对,不读本索引。索引不开门 ⇒ F。修前:形不对的整行响亮(`workflow_agent_session_ledger_line_rejected`,同事件名保留)但**无 tag**,带换行的半截 JSON 静默 `continue`。";
+    };
     readonly "server.user-input-ledger.append-failed": {
         readonly cls: "F";
-        readonly note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。";
+        readonly note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 本进程下一次收敛扫描补结清(本进程写的、已不在活腿上 ⇒ leg_over);进程在那之前就崩了 ⇒ 下一次 boot 的收敛读 run 店判(S-969 L8 起两车道同一只判词:承载它的 run 正常翻面 / 已 park ⇒ leg_over 补结清、不告知;落款死亡判决或写者已死仍 running ⇒ crashed)—— 仍会多说一句的只剩两形:withdraw 漏写后那条腿崩了(一次没变成 200 的受理被告知一次);settle 漏写后本进程续跑了同一条 run、续跑腿崩了(run 行说的是同一 taskId 上**最新**那条腿)。方向都是多说,不漏;converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。";
     };
     readonly "server.user-input-ledger.read-failed": {
         readonly cls: "F";
-        readonly note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。";
+        readonly note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(判词要读 run 店 —— S-969 L8 起两车道都读;一趟内同一 taskId 只读一次,读失败 ⇒ 同 run 的每一行各记一笔、留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。";
     };
     readonly "server.user-input-ledger.corrupt-record-skipped": {
         readonly cls: "F";
-        readonly note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。";
+        readonly note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。S-969 L6 起 SQL 孪生(`plugins/user-input-ledger-sql.ts` `readRows`)同一只 tag:三只读口取到的行上读不出的列(`input_kind` 词表外 —— 新版本写的输入族 / 手改;收敛行缺 `state_at_ms`)⇒ 逐行跳过、其余照交,`listOpen` 的续翻游标按原始行推进(修前整页抛:收敛断点不前进、同会话通告与读面一并失效);坏行留在表里 ⇒ 每读一次计一次,非零 = 表里有本版本读不懂的行。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 该受理在账上仍 open,下一趟收敛按 run 行判(S-969 L8,两车道同一只判词):本进程写的 / run 行已正常收场、已 park、易手 ⇒ 补结清、不告知;只有 run 行仍 `running` 且持有者是写者(local)、带死亡落款且持有者是写者、或行不在(local:File 店藏了读不出的行)⇒ 当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次;丢 `erased`(S-965,7.111.0 起的会话级墓碑;缺 `sessionId` 的那一行**不**读成「擦全部」)⇒ 被删会话的受理行在本进程的折叠里复现 —— 只有身份 + 时刻(无用户文本),读面 / 通告按 sessionId 取,同一个 id 被重新登记时新住客可见上一位的 `crashed` 告知(= 7.110.x 无级联时的状态);撕尾的 `erased` 不在此列:墓碑写在会话本体删除**之前**,撕掉 ⇒ DELETE 没有成功、会话还在,幂等重试重写。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。";
     };
     readonly "server.outbound.connect-observer-threw": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -290,17 +290,29 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
     },
+    "server.approval-ask-audit.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-967(`approval-ask-audit-store.ts`,local 车道 File ask 审计店的 boot 重放;登记名 `approval-ask-audit`):账本**中间**一行读不出形(`42` / 数组 / 缺键 / 词表外 `kind`·`outcome`·`orphanState` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `ask` ⇒ 那只孤儿在崩溃收敛读面缺席(无身份可列);丢 `settle` ⇒ 该组按 pending 臂收(审批门在执行之前 ⇒ 若这条 settle 其实是 `allowed` 且工具已执行,`resumeSafe:true` 是错的 —— 与头注「双故障窗」同族);丢 `leg_closed` ⇒ decided 臂多收一行(保守方向);丢 `crash_converged` ⇒ 下一次 boot 重收(幂等);丢 `interrupted_by_shutdown` / `late_settle` ⇒ 成因注退回 `crashed_before_park` / 少一行取证。审计店不开门、不改任何审批结算 ⇒ F。修前:重放坏行只计入 `convergeCrashedAsks().corruptLines`(boot 日志一个数),**无逐条披露、无 tag**。",
+    },
+    "server.workflow-notify-journal.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-977(`orchestration/workflow-notify-journal.ts`,local 车道 File notify journal 的 boot 重放;登记名 `workflow-notify-journal`):账本**中间**一行读不出形(`42` / 数组 / 缺 runId·scope / `acked` 非布尔 / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `pending` 行(`record` 写下的那条)⇒ 那条 run 不在恢复积压里,崩溃丢掉的终态通告 boot 恢复扫描不再重导(live 进程内通告与 `WorkflowStatus` 轮询地板不受影响);丢 `acked` 行 ⇒ 该 run 读回 pending(或前一份已知良好的条目),多一次幂等重投(接收方按 runId 去重)。账本不开门、不改任何 run 的执行或授权 ⇒ F。修前:坏行 / 缺键行**静默**(解析失败 `continue`、只判 `typeof runId === \"string\"`)。",
+    },
+    "server.workflow-agent-session-index.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-977(`orchestration/workflow-agent-session-index.ts`,local 车道 workflow 出身 park 的 join 索引账本的 boot 重放;登记名 `workflow-agent-session-index`):账本**中间**一行读不出形(`42` / 数组 / 缺 `runId`·`rows` / 任一行成员缺身份位 / 半截 JSON;撕尾不走本 tag)⇒ **整行**跳过,那条 run 保留上一份已知良好的快照(不做「丢坏成员、留好成员」—— 那会铸出比真相少几条 park 的行集)。最坏后果 = 该 run 的 park 在索引里缺行 ⇒ `/decide` 找不到它、退回 legacy 腿(409 `conflict.resume_context_unavailable`):诚实 miss,不是错配 —— 赎回键由记录上的 `parks[]` 逐字比对,不读本索引。索引不开门 ⇒ F。修前:形不对的整行响亮(`workflow_agent_session_ledger_line_rejected`,同事件名保留)但**无 tag**,带换行的半截 JSON 静默 `continue`。",
+    },
     "server.user-input-ledger.append-failed": {
         cls: "F",
-        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
+        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 本进程下一次收敛扫描补结清(本进程写的、已不在活腿上 ⇒ leg_over);进程在那之前就崩了 ⇒ 下一次 boot 的收敛读 run 店判(S-969 L8 起两车道同一只判词:承载它的 run 正常翻面 / 已 park ⇒ leg_over 补结清、不告知;落款死亡判决或写者已死仍 running ⇒ crashed)—— 仍会多说一句的只剩两形:withdraw 漏写后那条腿崩了(一次没变成 200 的受理被告知一次);settle 漏写后本进程续跑了同一条 run、续跑腿崩了(run 行说的是同一 taskId 上**最新**那条腿)。方向都是多说,不漏;converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
     },
     "server.user-input-ledger.read-failed": {
         cls: "F",
-        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
+        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(判词要读 run 店 —— S-969 L8 起两车道都读;一趟内同一 taskId 只读一次,读失败 ⇒ 同 run 的每一行各记一笔、留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
     },
     "server.user-input-ledger.corrupt-record-skipped": {
         cls: "F",
-        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
+        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。S-969 L6 起 SQL 孪生(`plugins/user-input-ledger-sql.ts` `readRows`)同一只 tag:三只读口取到的行上读不出的列(`input_kind` 词表外 —— 新版本写的输入族 / 手改;收敛行缺 `state_at_ms`)⇒ 逐行跳过、其余照交,`listOpen` 的续翻游标按原始行推进(修前整页抛:收敛断点不前进、同会话通告与读面一并失效);坏行留在表里 ⇒ 每读一次计一次,非零 = 表里有本版本读不懂的行。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 该受理在账上仍 open,下一趟收敛按 run 行判(S-969 L8,两车道同一只判词):本进程写的 / run 行已正常收场、已 park、易手 ⇒ 补结清、不告知;只有 run 行仍 `running` 且持有者是写者(local)、带死亡落款且持有者是写者、或行不在(local:File 店藏了读不出的行)⇒ 当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次;丢 `erased`(S-965,7.111.0 起的会话级墓碑;缺 `sessionId` 的那一行**不**读成「擦全部」)⇒ 被删会话的受理行在本进程的折叠里复现 —— 只有身份 + 时刻(无用户文本),读面 / 通告按 sessionId 取,同一个 id 被重新登记时新住客可见上一位的 `crashed` 告知(= 7.110.x 无级联时的状态);撕尾的 `erased` 不在此列:墓碑写在会话本体删除**之前**,撕掉 ⇒ DELETE 没有成功、会话还在,幂等重试重写。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
     },
     "server.outbound.connect-observer-threw": {
         cls: "F",

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -1,4 +1,5 @@
-import type { WorkflowRun } from "@sema-agent/core";
+import { type WorkflowRun } from "@sema-agent/core";
+import type { Logger } from "../observability/logger.js";
 /** 一条索引行:**子会话 id 是主键**(会话 id 全局唯一 ⇒ 读口天然是单行精确查,无分页假阴性)。 */
 export interface WorkflowAgentSessionRow {
     /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = 那条 checkpoint 行的 `sessionId`;
@@ -101,38 +102,26 @@ export declare function readAgentSessionLedgerLine(v: unknown): WorkflowAgentSes
  * 单机车道的索引(`FileWorkflowRunStore` / `InMemoryWorkflowRunStore` 的同室孪生)。
  *
  * `root` 在场 ⇒ 追加式 JSONL 账本(与姊妹 {@link import("./workflow-notify-journal.js").FileWorkflowNotifyJournalStore}
- * 逐字同形:0o700 目录 + 0o600 账本、按行重放、末行撕裂即丢),重启后 park 仍可 join;缺席 ⇒ 纯内存
+ * 逐字同形:0o700 目录 + 0o600 账本、按行重放),重启后 park 仍可 join;缺席 ⇒ 纯内存
  * (`WORKFLOW_RUN_STORE=memory` 的显式易失车道,与它的 run 店同寿命)。
  *
  * 账本的一行 = **一次 `syncRun` 的整份行集**(按 runId 后写覆盖),所以重放即收敛,不需要压缩腿。
+ *
+ * 追加 / 重放走本仓 JSONL 店的**共用口**(S-977;此前 ctor 里自写 `truncateTornTail` + 手写 `split("\n") + JSON.parse` 重放):
+ * 追加 = core `AppendLog`(惰性打开、撕尾在**打开与每次追加前**修 —— 修前只在 boot 修,运行期半写后的下一次成功写仍会被粘进残尾),
+ * 重放 = `replayJsonlSkipping`(登记座 `workflow-agent-session-index`:中间坏行 —— 含半截 JSON 与形不对的整行 —— 跳过 + 逐条披露 + F tag;
+ * 撕尾不计、不披露)。盘上字节 / 0o600 账本 / 0o700 目录与修前逐字同,升级零迁移。
  */
 export declare class LocalWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
     private readonly fsyncEnabled;
-    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
-     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
-    private readonly onWarn?;
     private readonly ledgerPath;
     private readonly byRun;
     private readonly bySession;
-    private fd;
+    private log;
     constructor(root?: string, fsyncEnabled?: boolean, 
-    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
-     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
-    onWarn?: ((msg: string, meta: Record<string, unknown>) => void) | undefined);
-    /**
-     * 打开账本时把**撕裂尾**(崩在 append 中途、末尾没有换行的那截字节)截回最后一个完整行边界。
-     *
-     * 🔴 为什么必须在**任何 append 之前**做(codex 修复验证轮 [medium],故障注入复现):残尾留在盘上时,
-     * 下一次 `syncRun` 会紧贴着它落字节 ⇒ `<残尾><新记录>` 在 replay 里是**一行**,JSON 解析失败被整行丢掉。
-     * 丢的**不是**那截未提交的残尾(丢它是对的),而是紧随其后那次**成功重试**写下的行 —— 于是「写失败了
-     * 下一次写会重试救回来」这条本模块与 `syncAgentSessionIndex` 都在依赖的性质当场失效,park 索引静默消失。
-     * 截尾之后 append 永远从一个干净的行边界开始,重试才真的救得回来。
-     *
-     * 截掉的只可能是**未提交**的字节(一条记录的耐久性以它那个换行为界,与 notify journal 同一条崩溃序),
-     * 所以这里不是丢数据;但它是一次真实的崩溃留痕,**响亮**一次([ref]:安全轴不许静默)。
-     */
-    private truncateTornTail;
-    private replay;
+    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。形与日志座 `Logger["warn"]` 逐字同源,
+     *  不另立第二种披露通道。 */
+    onWarn?: Logger["warn"]);
     /** 内存两张表的收敛(重放与写路径共用一份逻辑)。 */
     private apply;
     syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;

package/dist/orchestration/workflow-agent-session-index.js

@@ -1,5 +1,6 @@
-import { existsSync, fsyncSync, mkdirSync, openSync, readFileSync, truncateSync, writeSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const nonEmptyString = (v) => typeof v === "string" && v !== "";
 export function readRunParks(run) {
     if (typeof run !== "object" || run === null)
@@ -72,64 +73,27 @@ function readAgentSessionRow(v) {
         return undefined;
     return { sessionId, runId, agentKey, scope };
 }
+const LEDGER_LINE_SHAPE = {
+    what: "a workflow agent-session index line {runId, rows[]}",
+    read: readAgentSessionLedgerLine,
+};
 export class LocalWorkflowAgentSessionIndex {
     fsyncEnabled;
-    onWarn;
     ledgerPath;
     byRun = new Map();
     bySession = new Map();
-    fd;
+    log;
     constructor(root, fsyncEnabled = true, onWarn) {
         this.fsyncEnabled = fsyncEnabled;
-        this.onWarn = onWarn;
         if (root === undefined) {
             this.ledgerPath = undefined;
             return;
         }
         const dir = join(root, "workflow-agent-sessions");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.ledgerPath = join(dir, "index.jsonl");
-        this.truncateTornTail();
-        this.replay();
-    }
-    truncateTornTail() {
-        const path = this.ledgerPath;
-        if (path === undefined || !existsSync(path))
-            return;
-        const bytes = readFileSync(path);
-        if (bytes.length === 0 || bytes[bytes.length - 1] === 0x0a)
-            return;
-        const keep = bytes.lastIndexOf(0x0a) + 1;
-        truncateSync(path, keep);
-        this.onWarn?.("workflow_agent_session_ledger_torn_tail_truncated", {
-            path,
-            droppedBytes: bytes.length - keep,
-            note: "the last append never finished (no trailing newline) — those uncommitted bytes were cut back to the last complete line so the NEXT append starts on a clean boundary. Without the cut, the retry that follows would be glued onto the broken suffix and dropped as one unparsable line, i.e. the retry — not the torn write — is what would be lost.",
-        });
-    }
-    replay() {
-        if (this.ledgerPath === undefined || !existsSync(this.ledgerPath))
-            return;
-        for (const line of readFileSync(this.ledgerPath, "utf8").split("\n")) {
-            if (!line.trim())
-                continue;
-            let rec;
-            try {
-                rec = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const entry = readAgentSessionLedgerLine(rec);
-            if (entry === undefined) {
-                this.onWarn?.("workflow_agent_session_ledger_line_rejected", {
-                    path: this.ledgerPath,
-                    note: "a committed ledger line did not read back as {runId, rows[]} — that run keeps its previous snapshot; a /decide for a park it should have indexed falls back to the legacy lane (honest miss, never a mis-route)",
-                });
-                continue;
-            }
+        for (const entry of replayJsonlSkipping(this.ledgerPath, "workflow-agent-session-index", LEDGER_LINE_SHAPE, onWarn).records)
             this.apply(entry.runId, entry.rows);
-        }
     }
     apply(runId, rows) {
         for (const old of this.byRun.get(runId) ?? []) {
@@ -145,11 +109,8 @@ export class LocalWorkflowAgentSessionIndex {
     }
     async syncRun(runId, rows) {
         if (this.ledgerPath !== undefined) {
-            if (this.fd === undefined)
-                this.fd = openSync(this.ledgerPath, "a", 0o600);
-            writeSync(this.fd, `${JSON.stringify({ runId, rows })}\n`);
-            if (this.fsyncEnabled)
-                fsyncSync(this.fd);
+            this.log ??= new AppendLog(this.ledgerPath);
+            this.log.append({ runId, rows }, this.fsyncEnabled);
         }
         this.apply(runId, rows);
     }

package/dist/orchestration/workflow-notify-journal.d.ts

@@ -1,6 +1,7 @@
-import type { WorkflowRun, WorkflowRunStore, WorkflowRunStatus, WorkflowRunSummary } from "@sema-agent/core";
+import { type WorkflowRun, type WorkflowRunStore, type WorkflowRunStatus, type WorkflowRunSummary } from "@sema-agent/core";
 import { type FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "./workflow-agent-session-index.js";
+import type { Logger } from "../observability/logger.js";
 /** A workflow completion notification's terminal payload — the bounded, redacted shape core's notifier seam
  *  carries, re-derivable from a durable {@link import("@sema-agent/core").WorkflowRun} on the recovery path. */
 export interface WorkflowCompletionPayload {
@@ -201,6 +202,11 @@ export declare class WorkflowNotifyGate {
  * appends, atomic single-line records. Single-instance / TOC-local: a cross-replica TiDB/PG port is a follow-on
  * (the recovery sweep + gate are backend-agnostic).
  *
+ * 追加 / 重放走本仓 JSONL 店的**共用口**(S-977;此前是第二 / 第三份私有实现):追加 = core `AppendLog`(惰性打开;单条 `writeSync`
+ * 循环写满、失败的写截回开写处;**撕尾在打开与每次追加前修**,所以崩在一次 append 中途之后的下一条成功写不会被粘进残尾),
+ * 重放 = `replayJsonlSkipping`(登记座 `workflow-notify-journal`:中间坏行跳过 + 逐条披露 + F tag;撕尾不计 —— 它是崩溃的正常落盘形;
+ * 末行 JSON 完整但缺换行的认下、下一次追加补换行)。盘上字节 / 0o600 账本 / 0o700 目录与修前逐字同,升级零迁移。
+ *
  * The ledger only ever grows by one line per `record`/`ack`; an acked entry's line is not deleted (the replay
  * folds it), so retention is a future compaction concern — the backlog `listPending` walks is bounded by
  * IN-FLIGHT + un-swept runs, not history.
@@ -209,12 +215,9 @@ export declare class FileWorkflowNotifyJournalStore implements WorkflowNotifyJou
     private readonly fsyncEnabled;
     private readonly ledgerPath;
     private readonly entries;
-    private fd;
-    constructor(root: string, fsyncEnabled?: boolean);
-    /** Replay the ledger into the authoritative map (last-writer-wins by line order). Tolerates a torn final line
-     *  (a crash mid-append) by dropping an unparsable trailing record — the same crash-safety FileWorkflowRunStore
-     *  relies on (a partial append is simply not yet committed state). */
-    private replay;
+    private log;
+    /** @param warn 坏账本行的披露座(缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。 */
+    constructor(root: string, fsyncEnabled?: boolean, warn?: Logger["warn"]);
     /** Commit one entry: append the JSON line (fsync) THEN flip the in-memory map (crash-safe ordering — the
      *  durable record lands before the in-memory state the caller observes). */
     private commit;
@@ -228,7 +231,7 @@ export declare class FileWorkflowNotifyJournalStore implements WorkflowNotifyJou
     ack(runId: string, ackedAt: number): Promise<void>;
     listPending(): Promise<WorkflowNotifyJournalEntry[]>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
-    /** Release the append handle (best-effort) — called on shutdown. */
+    /** Release the append handle — called on shutdown. core `AppendLog.close()` swallows its own `closeSync` error (never throws). */
     close(): void;
     /** Test/inspection: total entries (acked + pending). */
     get size(): number;

package/dist/orchestration/workflow-notify-journal.js

@@ -1,9 +1,10 @@
-import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, closeSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
 import { buildFleetWorkflowRow } from "../fleet/fleet-bus.js";
 import { isTerminalWorkflowRowStatus, seedTerminalWorkflowRow } from "../fleet/fleet-terminal-window.js";
 import { buildParkedAgentSessionRows, sameAgentSessionRows } from "./workflow-agent-session-index.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const SUMMARY_MAX = 500;
 export function recoverySummary(status, error) {
     if (status === "completed")
@@ -162,42 +163,31 @@ export class WorkflowNotifyGate {
         return { scanned: pending.length, redelivered, stillRunning, abandoned };
     }
 }
+const JOURNAL_ENTRY_SHAPE = {
+    what: "a notify-journal entry {runId: string, scope: string, acked: boolean}",
+    read(record) {
+        const { runId, scope, acked } = record;
+        if (typeof runId !== "string" || typeof scope !== "string" || typeof acked !== "boolean")
+            return undefined;
+        return record;
+    },
+};
 export class FileWorkflowNotifyJournalStore {
     fsyncEnabled;
     ledgerPath;
     entries = new Map();
-    fd;
-    constructor(root, fsyncEnabled = true) {
+    log;
+    constructor(root, fsyncEnabled = true, warn) {
         this.fsyncEnabled = fsyncEnabled;
         const dir = join(root, "workflow-notify");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.ledgerPath = join(dir, "journal.jsonl");
-        this.replay();
-    }
-    replay() {
-        if (!existsSync(this.ledgerPath))
-            return;
-        const text = readFileSync(this.ledgerPath, "utf8");
-        for (const line of text.split("\n")) {
-            if (!line.trim())
-                continue;
-            let ev;
-            try {
-                ev = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            if (ev && typeof ev.runId === "string")
-                this.entries.set(ev.runId, ev);
-        }
+        for (const ev of replayJsonlSkipping(this.ledgerPath, "workflow-notify-journal", JOURNAL_ENTRY_SHAPE, warn).records)
+            this.entries.set(ev.runId, ev);
     }
     commit(entry) {
-        if (this.fd === undefined)
-            this.fd = openSync(this.ledgerPath, "a", 0o600);
-        writeSync(this.fd, `${JSON.stringify(entry)}\n`);
-        if (this.fsyncEnabled)
-            fsyncSync(this.fd);
+        this.log ??= new AppendLog(this.ledgerPath);
+        this.log.append(entry, this.fsyncEnabled);
         this.entries.set(entry.runId, entry);
     }
     async record(input) {
@@ -226,14 +216,8 @@ export class FileWorkflowNotifyJournalStore {
         return this.entries.get(runId) ?? null;
     }
     close() {
-        if (this.fd !== undefined) {
-            try {
-                closeSync(this.fd);
-            }
-            catch {
-            }
-            this.fd = undefined;
-        }
+        this.log?.close();
+        this.log = undefined;
     }
     get size() {
         return this.entries.size;

package/dist/plugins/file-outcome-sink.d.ts

@@ -1,4 +1,4 @@
-import type { TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
+import { type TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
 /** The one write verb every outcome sink (TiDB/Pg ledger adapters + this File twin) exposes to main.ts,
  *  plus the OPTIONAL read aggregate backing `GET /v1/outcomes` (P2) — present on the SQL ledgers (their
  *  existing per-(signature, model) summary); absent here (the JSONL file IS the local dataset — a dashboard
@@ -18,7 +18,10 @@ export interface OutcomeSink {
 }
 export declare class FileOutcomeSink implements OutcomeSink {
     private readonly path;
+    private log;
     constructor(root: string);
     recordCore(o: CoreTaskOutcome): Promise<void>;
+    /** 收追加口(`StoreBackend.close` 的优雅关闭腿;之后再写会重开)。core `AppendLog.close()` 自己吞 `closeSync` 的错,不抛。 */
+    dispose(): void;
 }
 //# sourceMappingURL=file-outcome-sink.d.ts.map