@sema-agent/server 7.110.0 → 7.112.0

package/dist/http/routes/tasks.js

@@ -10,7 +10,7 @@ import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotific
 import { createLedgerSink } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
-import { mintCancelledResult } from "../../run-cancel-context.js";
+import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData, liveIdentityFields } from "../../trace/project.js";
@@ -28,6 +28,7 @@ import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
+import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -56,7 +57,7 @@ function sendSubmitResult(res, resp) {
 const MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE = "verify / cascade ran with their normal multi-attempt semantics, but the synchronous /v1/tasks endpoint has no event channel — no status/progress frames exist to replay on this shape. For status / progress / delegated-child frames and the terminal done, submit via POST /v1/runs and read GET /v1/runs/:id/events; note that verify / cascade legs carry no per-turn stream there either (no wiring_manifest / text / turn_end frames — the engine runs those legs as result-returning attempts).";
 export async function handleTasks(req, res, match, ctx) {
     const { deps } = ctx;
-    const { idemCache, inflightRuns, cancelledViaVerb, steerableRuns, counters } = ctx.registry;
+    const { idemCache, inflightRuns, steerableRuns, counters } = ctx.registry;
     const { rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
     const { prepareSpec, finalizeTaskResult } = ctx.legs;
     const reqState = ctx.req;
@@ -114,6 +115,7 @@ export async function handleTasks(req, res, match, ctx) {
         const principal = prepared.auth?.principal;
         const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
         let wiringReceipt;
+        const instructionLeg = createInstructionSelectionLeg();
         const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
         if (liveStream) {
             if (prepared.verify || prepared.cascade) {
@@ -134,7 +136,7 @@ export async function handleTasks(req, res, match, ctx) {
             if (earlyDurableTid) {
                 res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", taskId: earlyDurableTid, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })}\n\n`);
             }
-            const ac = new AbortController();
+            const ac = createRunAbort();
             let closed = false;
             let detachLogged = false;
             let disconnectParkGrace;
@@ -156,14 +158,14 @@ export async function handleTasks(req, res, match, ctx) {
                         deps.logger?.info("stream_disconnect_ask_parked", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, asks: parked, graceMs: DISCONNECT_PARK_GRACE_MS });
                         disconnectParkGrace = setTimeout(() => {
                             closed = true;
-                            ac.abort();
+                            ac.abort("ask_park_grace_exhausted");
                         }, DISCONNECT_PARK_GRACE_MS);
                         disconnectParkGrace.unref?.();
                         return;
                     }
                 }
                 closed = true;
-                ac.abort();
+                ac.abort("client_disconnected");
             };
             req.on("close", onDisconnect);
             res.on("close", () => {
@@ -211,13 +213,7 @@ export async function handleTasks(req, res, match, ctx) {
                 let runRowSettled = false;
                 let durableTaskId;
                 let durableHeartbeat;
-                const cancelledResult = (errorMessage, engineResult) => mintCancelledResult({
-                    taskId: durableTaskId ?? "",
-                    sessionId: prepared.spec.sessionId ?? "",
-                    startedAtMs: streamLegStartedAt,
-                    message: errorMessage,
-                    ...(engineResult !== undefined ? { engineResult } : {}),
-                });
+                const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: errorMessage, cause });
                 let userMsgEntryId;
                 let anchorPut = false;
                 const putRewindAnchor = () => {
@@ -261,14 +257,11 @@ export async function handleTasks(req, res, match, ctx) {
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData) });
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), instructionsSegment: instructionLeg.segment });
                     usageKey = tid;
                     deps.modelUsage?.register(tid);
                     const owner = principal ?? null;
-                    const abortFromVerb = () => {
-                        cancelledViaVerb.add(tid);
-                        ac.abort();
-                    };
+                    const abortFromVerb = () => ac.abort("cancel_verb");
                     durableHeartbeat = setInterval(() => {
                         void rs.heartbeat(tid, owner).catch(() => undefined);
                         if (!ac.signal.aborted) {
@@ -290,10 +283,8 @@ export async function handleTasks(req, res, match, ctx) {
                 catch (e) {
                     if (durableHeartbeat)
                         clearInterval(durableHeartbeat);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
+                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
                         inflightRuns.delete(durableTaskId);
-                        cancelledViaVerb.delete(durableTaskId);
-                    }
                     throw e;
                 }
                 let fleetSettled = false;
@@ -313,10 +304,8 @@ export async function handleTasks(req, res, match, ctx) {
                 catch (e) {
                     if (durableHeartbeat)
                         clearInterval(durableHeartbeat);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
+                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
                         inflightRuns.delete(durableTaskId);
-                        cancelledViaVerb.delete(durableTaskId);
-                    }
                     settleFleet("failed");
                     throw e;
                 }
@@ -428,13 +417,13 @@ export async function handleTasks(req, res, match, ctx) {
                                     sseData(res, end);
                                 if (ev.type === "message_committed" && ev.role === "user")
                                     userMsgEntryId = ev.entryId;
-                                const cancelVerbAtDone = ev.type === "done" && durableTaskId !== undefined && cancelledViaVerb.has(durableTaskId);
+                                const causeAtDone = ev.type === "done" ? ac.cause() : undefined;
                                 if (ev.type === "done") {
                                     finalResult = await mintSubmitExitResult(ev.result, deps.checkpointStore);
                                     if (durableTaskId && finalResult)
                                         finalResult = { ...finalResult, taskId: durableTaskId };
-                                    if (cancelVerbAtDone && finalResult !== undefined) {
-                                        finalResult = cancelledResult("cancelled by user", finalResult);
+                                    if (causeAtDone !== undefined && finalResult !== undefined) {
+                                        finalResult = mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: "cancelled by user", cause: causeAtDone, engineResult: finalResult });
                                     }
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
@@ -504,7 +493,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
                                 }
                                 else if (ev.type === "wiring_manifest") {
-                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace);
+                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
                                     wiringReceipt ??= wiringFace;
                                     sseData(res, { type: "wiring_manifest", ...wiringFace });
                                 }
@@ -647,7 +636,7 @@ export async function handleTasks(req, res, match, ctx) {
                             });
                     }
                     const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
+                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope(prepared.spec.sessionId, () => deps.sendUserFile
                         ? deps.sendUserFile.runWithContext({
                             taskId: askTaskId,
                             emit: async (f) => {
@@ -658,7 +647,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 }
                             },
                         }, withApproval)
-                        : withApproval());
+                        : withApproval()));
                     if (durableTaskId && deps.runStore) {
                         const finalPlane = finalResult ? outwardPlane(finalResult.terminal) : undefined;
                         if (finalResult && finalPlane?.status === "suspended" && deps.checkpointStore)
@@ -670,6 +659,7 @@ export async function handleTasks(req, res, match, ctx) {
                         else {
                             putRewindAnchor();
                             const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
+                            const dcCause = ac.cause();
                             if (pending) {
                                 if (ledgerSink && !ledgerTerminal) {
                                     ledgerTerminal = true;
@@ -679,18 +669,28 @@ export async function handleTasks(req, res, match, ctx) {
                                 await deps.runStore.setSuspended(durableTaskId, null);
                                 settleFleet("suspended");
                             }
-                            else {
+                            else if (dcCause !== undefined) {
                                 const dcErr = "stream client disconnected before completion (run aborted)";
-                                const dc = cancelledResult(dcErr);
+                                const dc = cancelledResult(dcErr, dcCause);
                                 if (ledgerSink && !ledgerTerminal) {
                                     ledgerTerminal = true;
                                     await ledgerSink.flush().catch(() => undefined);
-                                    await ledgerSink.append("failed", { errorMessage: dcErr, errorCode: "cancelled" }).catch(() => undefined);
+                                    await ledgerSink.append("failed", buildCancelledLedgerRow(dc)).catch(() => undefined);
                                 }
                                 await deps.runStore.setTerminal(durableTaskId, "failed", dc, dcErr);
                                 noteRunOutcome(dc);
                                 settleFleet("failed");
                             }
+                            else {
+                                const err = "stream ended before a terminal event";
+                                if (ledgerSink && !ledgerTerminal) {
+                                    ledgerTerminal = true;
+                                    await ledgerSink.flush().catch(() => undefined);
+                                    await ledgerSink.append("failed", { errorMessage: err }).catch(() => undefined);
+                                }
+                                await deps.runStore.setTerminal(durableTaskId, "failed", null, err);
+                                settleFleet("failed");
+                            }
                         }
                         runRowSettled = true;
                     }
@@ -704,10 +704,8 @@ export async function handleTasks(req, res, match, ctx) {
                         steerableRuns.delete(durableTaskId);
                     if (liveStreamRef !== undefined)
                         await deps.userInputLedger?.settleLeg(liveStreamRef);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac) {
+                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
                         inflightRuns.delete(durableTaskId);
-                        cancelledViaVerb.delete(durableTaskId);
-                    }
                     for (const evict of subagentHandleEvictions)
                         evict();
                     if (!runRowSettled && durableTaskId && deps.runStore) {
@@ -715,6 +713,7 @@ export async function handleTasks(req, res, match, ctx) {
                             const row = await deps.runStore.getRun(durableTaskId);
                             if (row?.status === "running") {
                                 const pending = prepared.spec.sessionId ? await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId) : undefined;
+                                const backstopCause = ac.cause();
                                 if (pending) {
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
@@ -733,13 +732,13 @@ export async function handleTasks(req, res, match, ctx) {
                                     await deps.runStore.setTerminal(durableTaskId, retryPlane.status, finalResult, retryPlane.errorMessage ?? null);
                                     settleFleet(retryPlane.status, fleetRunResiduals(finalResult));
                                 }
-                                else if (ac.signal.aborted) {
+                                else if (backstopCause !== undefined) {
                                     const err = "stream aborted before completion (run cancelled)";
-                                    const c = cancelledResult(err);
+                                    const c = cancelledResult(err, backstopCause);
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
                                         await ledgerSink.flush().catch(() => undefined);
-                                        await ledgerSink.append("failed", { errorMessage: err, errorCode: "cancelled" }).catch(() => undefined);
+                                        await ledgerSink.append("failed", buildCancelledLedgerRow(c)).catch(() => undefined);
                                     }
                                     await deps.runStore.setTerminal(durableTaskId, "failed", c, err);
                                 }
@@ -806,17 +805,14 @@ export async function handleTasks(req, res, match, ctx) {
                 if (deps.checkpointStore && prepared.spec.sessionId) {
                     await deps.checkpointStore.putCtx(prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope });
                 }
-                const syncCancelCtrl = new AbortController();
+                const syncCancelCtrl = createRunAbort();
                 if (prepared.spec.sessionId)
                     markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
                     const owner = principal ?? null;
-                    const abortFromVerb = () => {
-                        cancelledViaVerb.add(tid);
-                        syncCancelCtrl.abort();
-                    };
+                    const abortFromVerb = () => syncCancelCtrl.abort("cancel_verb");
                     durableHeartbeat = setInterval(() => {
                         void rs.heartbeat(tid, owner).catch(() => undefined);
                         if (!syncCancelCtrl.signal.aborted) {
@@ -836,10 +832,9 @@ export async function handleTasks(req, res, match, ctx) {
                 const observeSyncLegEvent = (ev) => {
                     if (ev.type !== "wiring_manifest" || wiringReceipt !== undefined)
                         return;
-                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace);
+                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
                 };
                 let result;
-                let cancelVerbLabel = false;
                 counters.uncountedBillableInflight++;
                 try {
                     const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v);
@@ -850,24 +845,23 @@ export async function handleTasks(req, res, match, ctx) {
                             observeSyncLegEvent(ev);
                         return stream.result();
                     };
-                    result = await withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg());
+                    result = await instructionLeg.run(prepared.spec.sessionId, () => withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg()));
                 }
                 finally {
                     counters.uncountedBillableInflight--;
                     if (durableHeartbeat)
                         clearInterval(durableHeartbeat);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === syncCancelCtrl) {
+                    if (durableTaskId && inflightRuns.get(durableTaskId) === syncCancelCtrl)
                         inflightRuns.delete(durableTaskId);
-                        cancelVerbLabel = cancelledViaVerb.has(durableTaskId);
-                        cancelledViaVerb.delete(durableTaskId);
-                    }
                 }
-                if (cancelVerbLabel) {
+                const syncAbortCause = syncCancelCtrl.cause();
+                if (syncAbortCause !== undefined) {
                     result = mintCancelledResult({
                         taskId: durableTaskId ?? "",
                         sessionId: prepared.spec.sessionId ?? "",
                         startedAtMs: syncLegStartedAt,
                         message: "cancelled by user",
+                        cause: syncAbortCause,
                         engineResult: result,
                     });
                 }

package/dist/http/server.d.ts

@@ -218,7 +218,7 @@ export interface ServiceStoreDeps {
      *  已配 AND 有 store backend(main.ts 建;写点在两条 send lane 的 withLedgerRecording)。 */
     sendFileLedger?: import("../plugins/send-file-ledger.js").SendFileLedger;
     /** S-928 用户输入受理账本(「200 applied」受理的影子;单写者 = `src/user-input-ledger.ts` 的活对象,boot 装配在 stage-07 并跑一次收敛)。
-     *  在场 ⇔ 有 store backend(生产恒与 `runStore` 同源于 backend)。消费点:steer 的 live 腿受理前写 `accepted`(写不进 ⇒ 503
+     *  在场 ⇔ 有 store backend(生产恒与 `runStore` 同源于 backend)。消费点:steer 的 live 腿 / interrupt{text} / 同步子代的 steer(S-966)受理前写 `accepted`(写不进 ⇒ 503
      *  `steering.ledger_unavailable`)、三条 run 腿开通告口那一拍铸 `crashed` 通告并在收场时 settle、`GET /v1/sessions/:id` 的
      *  `userInputUndrained` 读面。缺席只出现在不接 backend 的 stub-harness 上(那时没有这一面,行为与修前逐字相同)。 */
     userInputLedger?: import("../user-input-ledger.js").UserInputLedger;

package/dist/http/server.js

@@ -43,7 +43,6 @@ export function createHttpServer(rawDeps) {
     }
     const idemCache = new IdempotencyCache();
     const inflightRuns = new Map();
-    const cancelledViaVerb = new Set();
     const preemptableRuns = new Map();
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
@@ -97,7 +96,7 @@ export function createHttpServer(rawDeps) {
     }
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, isFleetWide, sessionOwnerScope, sessionOwnerScopeForWrite, runOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {

package/dist/index.d.ts

@@ -29,5 +29,5 @@ export { createKeyResolver, resolveModelApiKey, type ModelKeyRef } from "./key-r
 export { isModelKeyPoison, ModelKeyPoisonedError, type ModelKeyPoison, type ModelKeyPoisonReason } from "./key-resolver.js";
 export { RETIRED_ENVS, type RetiredEnv, type RetiredEnvKind, type RetiredEnvWire } from "./config.js";
 export { CATALOG_ENTRY_HEADER_LANES, CATALOG_ENTRY_HEADER_NAMES, type CatalogEntryHeaderName } from "./model-entry-headers.js";
-export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
+export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/instruction-selection.d.ts

@@ -0,0 +1,34 @@
+import type { InstructionChainMember } from "./project-memory.js";
+/** wire 段 `wiring_manifest.instructions` 的形。`selected` 的成员拼写 = `INSTRUCTION_FILE_CHAIN` 的成员(相对 cwd)。 */
+export interface InstructionsSegment {
+    readonly selected: readonly InstructionChainMember[];
+}
+/**
+ * 一次 loader 调用对**腿**说了什么:
+ *  · `stated: false` —— 没有陈述(走链之前的门拦下了:无手 / cwd 不是本机绝对目录;或这是委派子代的 prepare);
+ *  · `stated: true`  —— 走了链,`file` = 选中的链成员,`null` = 一个都没有。
+ * 判别式显式写出来(不拿 `undefined` / `null` 两个空值各代表一件事 —— O6 那条教训:「不适用」不是「来源 = 无」)。
+ */
+export type LegInstructionStatement = {
+    readonly stated: false;
+} | {
+    readonly stated: true;
+    readonly file: InstructionChainMember | null;
+};
+/** 一条腿的指令文件选择:开作用域 + 读段。每条投 `wiring_manifest` 的腿(流式 / 非流式 / bg / 续跑)各建一只。 */
+export interface InstructionSelectionLeg {
+    /** 在这条腿的作用域里跑它的模型驱动(引擎的 prepare 在里面调 loader)。`sessionId` = 这条腿的会话 —— 作用域里只有**同会话**的 loader 调用
+     *  才算这条腿自己的 prepare([ref] opus 腿 F1:wake 续跑在腿自己的 prepare 之前同步跑部署 `userPromptSubmit` 的 agent 型 hook,hook agent 是另一只
+     *  会话、却与本进程共用同一只 loader ⇒ 只按「第一次调用」会被它抢先封槽)。嵌套时内层覆盖外层 —— 每条腿说自己的。 */
+    run<T>(sessionId: string | undefined, fn: () => T): T;
+    /** 这条腿的 `instructions` 段;`undefined` ⇒ 段缺席。在投帧那一刻读:core 在推帧之前已经 await 过 loader。 */
+    segment(): InstructionsSegment | undefined;
+}
+export declare function createInstructionSelectionLeg(): InstructionSelectionLeg;
+/**
+ * loader 侧唯一写口:当前作用域里、**同会话的**第一次调用封槽(`sessionId` = loader ctx 带的会话;不等于腿的会话 —— hook agent / 子代 /
+ * 别的嵌套 run 的 prepare —— 一律不算,也不封槽,等这条腿自己的那一次);作用域外(run-local、leader、council 子任务 …)无效。
+ * 「身份 = 作用域 ∧ 同会话」两条都要:只靠作用域会被同进程共用 loader 的别的 Runner 抢先(F1);只靠会话会让同会话的并发腿 / 快速续跑串值。
+ */
+export declare function settleLegInstructionStatement(statement: LegInstructionStatement, sessionId: string | undefined): void;
+//# sourceMappingURL=instruction-selection.d.ts.map

package/dist/instruction-selection.js

@@ -0,0 +1,23 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const legScope = new AsyncLocalStorage();
+export function createInstructionSelectionLeg() {
+    let slot;
+    return {
+        run: (sessionId, fn) => {
+            slot = { sessionId, settled: false };
+            return legScope.run(slot, fn);
+        },
+        segment: () => slot?.segment,
+    };
+}
+export function settleLegInstructionStatement(statement, sessionId) {
+    const slot = legScope.getStore();
+    if (slot === undefined || slot.settled)
+        return;
+    if (slot.sessionId !== undefined && sessionId !== slot.sessionId)
+        return;
+    slot.settled = true;
+    if (statement.stated)
+        slot.segment = { selected: statement.file === null ? [] : [statement.file] };
+}
+//# sourceMappingURL=instruction-selection.js.map

package/dist/observability/corrupt-read-seat.d.ts

@@ -150,6 +150,24 @@ export declare const JSONL_REPLAY_SEATS: {
         readonly tag: "server.send-file-ledger.corrupt-record-skipped";
         readonly note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).";
     };
+    readonly "approval-ask-audit": {
+        readonly direction: "fail-open";
+        readonly event: "approval_ask_audit_corrupt_read";
+        readonly tag: "server.approval-ask-audit.corrupt-record-skipped";
+        readonly note: "F: a skipped ask-audit record is one audit row missing from the boot crash-convergence read (an ask / settle / leg-close fact gone ⇒ that orphan is listed on a thinner basis or not at all, never a gate — the audit store gates nothing and the approval path never reads it back).";
+    };
+    readonly "workflow-notify-journal": {
+        readonly direction: "fail-open";
+        readonly event: "workflow_notify_journal_corrupt_read";
+        readonly tag: "server.workflow-notify-journal.corrupt-record-skipped";
+        readonly note: "F: a skipped notify-journal record is one run's pending entry (or its ack) missing from the boot replay. The recovery sweep walks the journal, so a lost pending line means that run's completion notify is not re-derived after a crash (the live in-process notify and the WorkflowStatus poll floor are untouched); a lost ack line means one extra idempotent re-delivery (the receiver dedups on runId). It gates no permission and changes no run.";
+    };
+    readonly "workflow-agent-session-index": {
+        readonly direction: "fail-open";
+        readonly event: "workflow_agent_session_ledger_line_rejected";
+        readonly tag: "server.workflow-agent-session-index.corrupt-record-skipped";
+        readonly note: "F: a skipped index line leaves that run on its previous known-good snapshot; a /decide for a park the line should have indexed finds no row and falls back to the legacy lane (an honest miss, never a mis-route — the redeem key is compared verbatim on the run record, not read from this index).";
+    };
     readonly "user-input-ledger": {
         readonly direction: "fail-open";
         readonly event: "user_input_ledger_corrupt_read";

package/dist/observability/corrupt-read-seat.js

@@ -93,6 +93,24 @@ export const JSONL_REPLAY_SEATS = {
         tag: "server.send-file-ledger.corrupt-record-skipped",
         note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).",
     },
+    "approval-ask-audit": {
+        direction: "fail-open",
+        event: "approval_ask_audit_corrupt_read",
+        tag: "server.approval-ask-audit.corrupt-record-skipped",
+        note: "F: a skipped ask-audit record is one audit row missing from the boot crash-convergence read (an ask / settle / leg-close fact gone ⇒ that orphan is listed on a thinner basis or not at all, never a gate — the audit store gates nothing and the approval path never reads it back).",
+    },
+    "workflow-notify-journal": {
+        direction: "fail-open",
+        event: "workflow_notify_journal_corrupt_read",
+        tag: "server.workflow-notify-journal.corrupt-record-skipped",
+        note: "F: a skipped notify-journal record is one run's pending entry (or its ack) missing from the boot replay. The recovery sweep walks the journal, so a lost pending line means that run's completion notify is not re-derived after a crash (the live in-process notify and the WorkflowStatus poll floor are untouched); a lost ack line means one extra idempotent re-delivery (the receiver dedups on runId). It gates no permission and changes no run.",
+    },
+    "workflow-agent-session-index": {
+        direction: "fail-open",
+        event: "workflow_agent_session_ledger_line_rejected",
+        tag: "server.workflow-agent-session-index.corrupt-record-skipped",
+        note: "F: a skipped index line leaves that run on its previous known-good snapshot; a /decide for a park the line should have indexed finds no row and falls back to the legacy lane (an honest miss, never a mis-route — the redeem key is compared verbatim on the run record, not read from this index).",
+    },
     "user-input-ledger": {
         direction: "fail-open",
         event: "user_input_ledger_corrupt_read",

package/dist/observability/fail-open.d.ts

@@ -281,9 +281,13 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-107:持久 error 脱后 UTF-8 字节 > 65,000(TiDB TEXT 65,535 字节)⇒ 脱后切并带标记(切在占位里不是泄漏);计数=多少条终态文案被字节封顶截断";
     };
+    readonly "server.runs.abort-cause-missing": {
+        readonly cls: "F";
+        readonly note: "S-947 候裁 ⑤(主会话裁:默认值保留,miss 臂必须响):续跑腿 `http/resume-legs.ts` 的 `checkpoint.resume_aborted` 臂 —— core 只在本腿递进去的信号**已中止**时铸该码,而那只信号唯一的写者是取消动词(快路 / 耐久旗轮询,句柄登记 `cancel_verb`),所以**只有 core 契约外的形**(桩 / 非 core Runner 直接抛该码,本腿句柄从未中止)才到得了「句柄上读不到成因」这一臂。取消终局照铸,成因取本腿唯一的中止词 `cancel_verb`(取消终局恒带成因由铸点签名保证,不让它缺);detail `task=<taskId>`;计数 = 多少次取消成因是默认值而不是句柄登记的。生产上恒零是证据,不归零 = 有一条不走 core 契约的 Runner 在跑续跑腿。";
+    };
     readonly "server.runs.terminal-ledger-write-failed": {
         readonly cls: "F";
-        readonly note: "S-107(全量门 silent-degradation 棘轮抓出的五处静默 `catch {}`):run 终局链里**账本腿**(flush 缓冲 text/reasoning、append `failed` 行)与终态翻转(setTerminal)已不共命运——账本 INSERT 抛不再让 run 卡 running 到 reaper;但那条抛掉的账本行之前是**静默**吞的。detail `arm=` 四臂(flush-clean-cancel / append-clean-cancel / flush-catch / append-thrown-cancel / append-failed):缺的是 run_events 尾巴(缓冲文本或 failed 事件),run 行本身仍是 durable truth,读面/reaper 容忍缺失,故 F 类;计数=多少次终局账本写失败。";
+        readonly note: "S-107(全量门 silent-degradation 棘轮抓出的五处静默 `catch {}`):run 终局链里**账本腿**(flush 缓冲 text/reasoning、append `failed` 行)与终态翻转(setTerminal)已不共命运——账本 INSERT 抛不再让 run 卡 running 到 reaper;但那条抛掉的账本行之前是**静默**吞的。detail `arm=` 四臂(flush-clean-cancel / append-clean-cancel / flush-catch / append-thrown-cancel / append-failed);S-947 起续跑腿(`http/resume-legs.ts`)两座同 tag:resume-append-resume-aborted / resume-append-thrown-cancel(取消抛出两臂的 `failed` 行,修前那两臂根本不落账本终局行):缺的是 run_events 尾巴(缓冲文本或 failed 事件),run 行本身仍是 durable truth,读面/reaper 容忍缺失,故 F 类;计数=多少次终局账本写失败。";
     };
     readonly "server.redact.ppk-eat-to-end": {
         readonly cls: "F";
@@ -317,17 +321,29 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
     };
+    readonly "server.approval-ask-audit.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-967(`approval-ask-audit-store.ts`,local 车道 File ask 审计店的 boot 重放;登记名 `approval-ask-audit`):账本**中间**一行读不出形(`42` / 数组 / 缺键 / 词表外 `kind`·`outcome`·`orphanState` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `ask` ⇒ 那只孤儿在崩溃收敛读面缺席(无身份可列);丢 `settle` ⇒ 该组按 pending 臂收(审批门在执行之前 ⇒ 若这条 settle 其实是 `allowed` 且工具已执行,`resumeSafe:true` 是错的 —— 与头注「双故障窗」同族);丢 `leg_closed` ⇒ decided 臂多收一行(保守方向);丢 `crash_converged` ⇒ 下一次 boot 重收(幂等);丢 `interrupted_by_shutdown` / `late_settle` ⇒ 成因注退回 `crashed_before_park` / 少一行取证。审计店不开门、不改任何审批结算 ⇒ F。修前:重放坏行只计入 `convergeCrashedAsks().corruptLines`(boot 日志一个数),**无逐条披露、无 tag**。";
+    };
+    readonly "server.workflow-notify-journal.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-977(`orchestration/workflow-notify-journal.ts`,local 车道 File notify journal 的 boot 重放;登记名 `workflow-notify-journal`):账本**中间**一行读不出形(`42` / 数组 / 缺 runId·scope / `acked` 非布尔 / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `pending` 行(`record` 写下的那条)⇒ 那条 run 不在恢复积压里,崩溃丢掉的终态通告 boot 恢复扫描不再重导(live 进程内通告与 `WorkflowStatus` 轮询地板不受影响);丢 `acked` 行 ⇒ 该 run 读回 pending(或前一份已知良好的条目),多一次幂等重投(接收方按 runId 去重)。账本不开门、不改任何 run 的执行或授权 ⇒ F。修前:坏行 / 缺键行**静默**(解析失败 `continue`、只判 `typeof runId === \"string\"`)。";
+    };
+    readonly "server.workflow-agent-session-index.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-977(`orchestration/workflow-agent-session-index.ts`,local 车道 workflow 出身 park 的 join 索引账本的 boot 重放;登记名 `workflow-agent-session-index`):账本**中间**一行读不出形(`42` / 数组 / 缺 `runId`·`rows` / 任一行成员缺身份位 / 半截 JSON;撕尾不走本 tag)⇒ **整行**跳过,那条 run 保留上一份已知良好的快照(不做「丢坏成员、留好成员」—— 那会铸出比真相少几条 park 的行集)。最坏后果 = 该 run 的 park 在索引里缺行 ⇒ `/decide` 找不到它、退回 legacy 腿(409 `conflict.resume_context_unavailable`):诚实 miss,不是错配 —— 赎回键由记录上的 `parks[]` 逐字比对,不读本索引。索引不开门 ⇒ F。修前:形不对的整行响亮(`workflow_agent_session_ledger_line_rejected`,同事件名保留)但**无 tag**,带换行的半截 JSON 静默 `continue`。";
+    };
     readonly "server.user-input-ledger.append-failed": {
         readonly cls: "F";
-        readonly note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。";
+        readonly note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 本进程下一次收敛扫描补结清(本进程写的、已不在活腿上 ⇒ leg_over);进程在那之前就崩了 ⇒ 下一次 boot 的收敛读 run 店判(S-969 L8 起两车道同一只判词:承载它的 run 正常翻面 / 已 park ⇒ leg_over 补结清、不告知;落款死亡判决或写者已死仍 running ⇒ crashed)—— 仍会多说一句的只剩两形:withdraw 漏写后那条腿崩了(一次没变成 200 的受理被告知一次);settle 漏写后本进程续跑了同一条 run、续跑腿崩了(run 行说的是同一 taskId 上**最新**那条腿)。方向都是多说,不漏;converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。";
     };
     readonly "server.user-input-ledger.read-failed": {
         readonly cls: "F";
-        readonly note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。";
+        readonly note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(判词要读 run 店 —— S-969 L8 起两车道都读;一趟内同一 taskId 只读一次,读失败 ⇒ 同 run 的每一行各记一笔、留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。";
     };
     readonly "server.user-input-ledger.corrupt-record-skipped": {
         readonly cls: "F";
-        readonly note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。";
+        readonly note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。S-969 L6 起 SQL 孪生(`plugins/user-input-ledger-sql.ts` `readRows`)同一只 tag:三只读口取到的行上读不出的列(`input_kind` 词表外 —— 新版本写的输入族 / 手改;收敛行缺 `state_at_ms`)⇒ 逐行跳过、其余照交,`listOpen` 的续翻游标按原始行推进(修前整页抛:收敛断点不前进、同会话通告与读面一并失效);坏行留在表里 ⇒ 每读一次计一次,非零 = 表里有本版本读不懂的行。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 该受理在账上仍 open,下一趟收敛按 run 行判(S-969 L8,两车道同一只判词):本进程写的 / run 行已正常收场、已 park、易手 ⇒ 补结清、不告知;只有 run 行仍 `running` 且持有者是写者(local)、带死亡落款且持有者是写者、或行不在(local:File 店藏了读不出的行)⇒ 当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次;丢 `erased`(S-965,7.111.0 起的会话级墓碑;缺 `sessionId` 的那一行**不**读成「擦全部」)⇒ 被删会话的受理行在本进程的折叠里复现 —— 只有身份 + 时刻(无用户文本),读面 / 通告按 sessionId 取,同一个 id 被重新登记时新住客可见上一位的 `crashed` 告知(= 7.110.x 无级联时的状态);撕尾的 `erased` 不在此列:墓碑写在会话本体删除**之前**,撕掉 ⇒ DELETE 没有成功、会话还在,幂等重试重写。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。";
     };
     readonly "server.outbound.connect-observer-threw": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -260,7 +260,8 @@ export const FAIL_OPEN_TAGS = {
     "server.run-terminal.artifact-capped": { cls: "F", note: "S-107:leader_run 行上的工件字节(salvaged[].patch / candidatePatch.patch / merge.candidatePatch / merge.rej)长度 > ARTIFACT_INPUT_CAP(256KB)⇒ 整份换 «redacted:oversized-artifact»(fail-closed 取证丢弃;原字节仍在 worker 分支/merge 咽喉);计数=多少份工件被整份丢弃" },
     "server.run-terminal.diag-capped": { cls: "F", note: "S-107:诊断文本座(merge details/measure/grader trace、leader 日志座、planner 样本、journal 预览、workflow_run error cut)长度 > DIAG_INPUT_CAP(256KB)⇒ 整段换 «redacted:oversized-diagnostic» [len=N](fail-closed 取证丢弃;固定窗不 fail-closed 故不开窗);计数=多少段诊断文本被整段丢弃" },
     "server.run-terminal.output-truncated": { cls: "F", note: "S-107:持久 error 脱后 UTF-8 字节 > 65,000(TiDB TEXT 65,535 字节)⇒ 脱后切并带标记(切在占位里不是泄漏);计数=多少条终态文案被字节封顶截断" },
-    "server.runs.terminal-ledger-write-failed": { cls: "F", note: "S-107(全量门 silent-degradation 棘轮抓出的五处静默 `catch {}`):run 终局链里**账本腿**(flush 缓冲 text/reasoning、append `failed` 行)与终态翻转(setTerminal)已不共命运——账本 INSERT 抛不再让 run 卡 running 到 reaper;但那条抛掉的账本行之前是**静默**吞的。detail `arm=` 四臂(flush-clean-cancel / append-clean-cancel / flush-catch / append-thrown-cancel / append-failed):缺的是 run_events 尾巴(缓冲文本或 failed 事件),run 行本身仍是 durable truth,读面/reaper 容忍缺失,故 F 类;计数=多少次终局账本写失败。" },
+    "server.runs.abort-cause-missing": { cls: "F", note: "S-947 候裁 ⑤(主会话裁:默认值保留,miss 臂必须响):续跑腿 `http/resume-legs.ts` 的 `checkpoint.resume_aborted` 臂 —— core 只在本腿递进去的信号**已中止**时铸该码,而那只信号唯一的写者是取消动词(快路 / 耐久旗轮询,句柄登记 `cancel_verb`),所以**只有 core 契约外的形**(桩 / 非 core Runner 直接抛该码,本腿句柄从未中止)才到得了「句柄上读不到成因」这一臂。取消终局照铸,成因取本腿唯一的中止词 `cancel_verb`(取消终局恒带成因由铸点签名保证,不让它缺);detail `task=<taskId>`;计数 = 多少次取消成因是默认值而不是句柄登记的。生产上恒零是证据,不归零 = 有一条不走 core 契约的 Runner 在跑续跑腿。" },
+    "server.runs.terminal-ledger-write-failed": { cls: "F", note: "S-107(全量门 silent-degradation 棘轮抓出的五处静默 `catch {}`):run 终局链里**账本腿**(flush 缓冲 text/reasoning、append `failed` 行)与终态翻转(setTerminal)已不共命运——账本 INSERT 抛不再让 run 卡 running 到 reaper;但那条抛掉的账本行之前是**静默**吞的。detail `arm=` 四臂(flush-clean-cancel / append-clean-cancel / flush-catch / append-thrown-cancel / append-failed);S-947 起续跑腿(`http/resume-legs.ts`)两座同 tag:resume-append-resume-aborted / resume-append-thrown-cancel(取消抛出两臂的 `failed` 行,修前那两臂根本不落账本终局行):缺的是 run_events 尾巴(缓冲文本或 failed 事件),run 行本身仍是 durable truth,读面/reaper 容忍缺失,故 F 类;计数=多少次终局账本写失败。" },
     "server.redact.ppk-eat-to-end": { cls: "F", note: "S-107 第三十二轮重扫:PuTTY .ppk 容器扫描器(redact.ts redactPpkContainers)在「无合格终止 / 收口后同容器范围再见私钥字段 / 收口后到下一版本头之间夹非空白」三形下从头**吃到输入末尾**(fail-closed 取证丢弃)——终态 errorMessage 座上=整条错误文案变成 «redacted:private-key»,与 redactions_applied_total{private-key} 的诚实替换同形不可分,故要有自己的计数/探针;影子扫不计;计数=多少次整段吃尾。" },
     "server.approval-card.closed-word-out-of-set": {
         cls: "F",
@@ -290,17 +291,29 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
     },
+    "server.approval-ask-audit.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-967(`approval-ask-audit-store.ts`,local 车道 File ask 审计店的 boot 重放;登记名 `approval-ask-audit`):账本**中间**一行读不出形(`42` / 数组 / 缺键 / 词表外 `kind`·`outcome`·`orphanState` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `ask` ⇒ 那只孤儿在崩溃收敛读面缺席(无身份可列);丢 `settle` ⇒ 该组按 pending 臂收(审批门在执行之前 ⇒ 若这条 settle 其实是 `allowed` 且工具已执行,`resumeSafe:true` 是错的 —— 与头注「双故障窗」同族);丢 `leg_closed` ⇒ decided 臂多收一行(保守方向);丢 `crash_converged` ⇒ 下一次 boot 重收(幂等);丢 `interrupted_by_shutdown` / `late_settle` ⇒ 成因注退回 `crashed_before_park` / 少一行取证。审计店不开门、不改任何审批结算 ⇒ F。修前:重放坏行只计入 `convergeCrashedAsks().corruptLines`(boot 日志一个数),**无逐条披露、无 tag**。",
+    },
+    "server.workflow-notify-journal.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-977(`orchestration/workflow-notify-journal.ts`,local 车道 File notify journal 的 boot 重放;登记名 `workflow-notify-journal`):账本**中间**一行读不出形(`42` / 数组 / 缺 runId·scope / `acked` 非布尔 / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `pending` 行(`record` 写下的那条)⇒ 那条 run 不在恢复积压里,崩溃丢掉的终态通告 boot 恢复扫描不再重导(live 进程内通告与 `WorkflowStatus` 轮询地板不受影响);丢 `acked` 行 ⇒ 该 run 读回 pending(或前一份已知良好的条目),多一次幂等重投(接收方按 runId 去重)。账本不开门、不改任何 run 的执行或授权 ⇒ F。修前:坏行 / 缺键行**静默**(解析失败 `continue`、只判 `typeof runId === \"string\"`)。",
+    },
+    "server.workflow-agent-session-index.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-977(`orchestration/workflow-agent-session-index.ts`,local 车道 workflow 出身 park 的 join 索引账本的 boot 重放;登记名 `workflow-agent-session-index`):账本**中间**一行读不出形(`42` / 数组 / 缺 `runId`·`rows` / 任一行成员缺身份位 / 半截 JSON;撕尾不走本 tag)⇒ **整行**跳过,那条 run 保留上一份已知良好的快照(不做「丢坏成员、留好成员」—— 那会铸出比真相少几条 park 的行集)。最坏后果 = 该 run 的 park 在索引里缺行 ⇒ `/decide` 找不到它、退回 legacy 腿(409 `conflict.resume_context_unavailable`):诚实 miss,不是错配 —— 赎回键由记录上的 `parks[]` 逐字比对,不读本索引。索引不开门 ⇒ F。修前:形不对的整行响亮(`workflow_agent_session_ledger_line_rejected`,同事件名保留)但**无 tag**,带换行的半截 JSON 静默 `continue`。",
+    },
     "server.user-input-ledger.append-failed": {
         cls: "F",
-        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 进程之后**若再崩**(local 车道下一次 boot),它会被当成崩溃丢失告知一次(一句多余的「你的 steer 丢了」,而它其实被正常收场了;SQL 车道的收敛判据只认 run 店已落盘的 reap 判决 —— `failed` + `RUN_STALLED_ERROR` ⇒ crashed、仍 `running` ⇒ live、正常翻面 ⇒ leg_over 补结清 —— 正常收场的 run 不会被误收);converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
+        note: "S-928(`src/user-input-ledger.ts`):200 承诺**之后**的一次账本写失败 —— detail 的 `op=` 点名是哪一种:`settle`(腿在本进程收场)/ `withdraw`(引擎没收下这次 steer)/ `converge`(收敛器判孤儿)/ `announce`(通告已投出,记「告知过」)。放行的最坏后果逐个说清:settle / withdraw 漏写 ⇒ 这次受理在账上仍是 open —— 本进程下一次收敛扫描补结清(本进程写的、已不在活腿上 ⇒ leg_over);进程在那之前就崩了 ⇒ 下一次 boot 的收敛读 run 店判(S-969 L8 起两车道同一只判词:承载它的 run 正常翻面 / 已 park ⇒ leg_over 补结清、不告知;落款死亡判决或写者已死仍 running ⇒ crashed)—— 仍会多说一句的只剩两形:withdraw 漏写后那条腿崩了(一次没变成 200 的受理被告知一次);settle 漏写后本进程续跑了同一条 run、续跑腿崩了(run 行说的是同一 taskId 上**最新**那条腿)。方向都是多说,不漏;converge 漏写 ⇒ 留在 open,下一次扫描再判(延迟,不丢);announce 漏写 ⇒ 下一条 run 再说一遍(至多一次退化成至少一次)。都是**告知面**的偏差,不开任何门、不改任何 run 的执行 ⇒ F。计数非零 = 这台机器的账本写不动了(local:数据根盘满 / 只读;SQL:库不可达),steer 此刻多半也在回 503。",
     },
     "server.user-input-ledger.read-failed": {
         cls: "F",
-        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(SQL 臂判词要读 run 店,run 店读失败 ⇒ 该行留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
+        note: "S-928(`src/user-input-ledger.ts` / `http/routes/sessions.ts`):一次账本**读**失败 —— `op=converge`(收敛扫描读不出 open 受理 ⇒ 本轮不收敛,下一个 tick 再来)/ `op=judge`(判词要读 run 店 —— S-969 L8 起两车道都读;一趟内同一 taskId 只读一次,读失败 ⇒ 同 run 的每一行各记一笔、留在 open、下一次扫描再判)/ `op=announce`(新 run 首拍读不出本会话的待告知受理 ⇒ 这一拍不告知,run 照跑,下一条 run 再试)/ `op=session-view`(`GET /v1/sessions/:id` 的 additive 键 `userInputUndrained` 读不出 ⇒ 键缺席、会话视图照常 200)。放行的最坏后果 = 一次「你的输入因崩溃丢了」的告知被推迟,或会话视图上这一格读作零条;不阻断任何 run、不改任何回执。反方向(读失败就拒跑 run / 整只会话视图 500)是拿一个告知面的抖动去打掉主路径,方向更坏。",
     },
     "server.user-input-ledger.corrupt-record-skipped": {
         cls: "F",
-        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 一次正常收场的受理被当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
+        note: "S-928(`plugins/user-input-ledger-file.ts`,local 车道 File 孪生的 boot 重放;登记名 `user-input-ledger`):账本中间一行读不出形(`42` / 缺键 / 词表外的 `kind`·`input`·`how`·`cause` / 半截 JSON;撕尾不走本 tag)⇒ 跳过它继续。S-969 L6 起 SQL 孪生(`plugins/user-input-ledger-sql.ts` `readRows`)同一只 tag:三只读口取到的行上读不出的列(`input_kind` 词表外 —— 新版本写的输入族 / 手改;收敛行缺 `state_at_ms`)⇒ 逐行跳过、其余照交,`listOpen` 的续翻游标按原始行推进(修前整页抛:收敛断点不前进、同会话通告与读面一并失效);坏行留在表里 ⇒ 每读一次计一次,非零 = 表里有本版本读不懂的行。最坏后果按行种:丢 `accepted` ⇒ 那次受理若真随崩溃丢了,不会被告知(= 本账之前的状态);丢 `settled` ⇒ 该受理在账上仍 open,下一趟收敛按 run 行判(S-969 L8,两车道同一只判词):本进程写的 / run 行已正常收场、已 park、易手 ⇒ 补结清、不告知;只有 run 行仍 `running` 且持有者是写者(local)、带死亡落款且持有者是写者、或行不在(local:File 店藏了读不出的行)⇒ 当成崩溃丢失告知一次;丢 `converged` ⇒ 下一次 boot 重收一次(幂等);丢 `announced` ⇒ 再告知一次;丢 `erased`(S-965,7.111.0 起的会话级墓碑;缺 `sessionId` 的那一行**不**读成「擦全部」)⇒ 被删会话的受理行在本进程的折叠里复现 —— 只有身份 + 时刻(无用户文本),读面 / 通告按 sessionId 取,同一个 id 被重新登记时新住客可见上一位的 `crashed` 告知(= 7.110.x 无级联时的状态);撕尾的 `erased` 不在此列:墓碑写在会话本体删除**之前**,撕掉 ⇒ DELETE 没有成功、会话还在,幂等重试重写。全在告知面,不开门 ⇒ F。修前不存在(本账本 S-928 新立)。",
     },
     "server.outbound.connect-observer-threw": {
         cls: "F",