@sema-agent/server 7.110.0 → 7.112.0

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -1,4 +1,5 @@
-import type { WorkflowRun } from "@sema-agent/core";
+import { type WorkflowRun } from "@sema-agent/core";
+import type { Logger } from "../observability/logger.js";
 /** 一条索引行:**子会话 id 是主键**(会话 id 全局唯一 ⇒ 读口天然是单行精确查,无分页假阴性)。 */
 export interface WorkflowAgentSessionRow {
     /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = 那条 checkpoint 行的 `sessionId`;
@@ -101,38 +102,26 @@ export declare function readAgentSessionLedgerLine(v: unknown): WorkflowAgentSes
  * 单机车道的索引(`FileWorkflowRunStore` / `InMemoryWorkflowRunStore` 的同室孪生)。
  *
  * `root` 在场 ⇒ 追加式 JSONL 账本(与姊妹 {@link import("./workflow-notify-journal.js").FileWorkflowNotifyJournalStore}
- * 逐字同形:0o700 目录 + 0o600 账本、按行重放、末行撕裂即丢),重启后 park 仍可 join;缺席 ⇒ 纯内存
+ * 逐字同形:0o700 目录 + 0o600 账本、按行重放),重启后 park 仍可 join;缺席 ⇒ 纯内存
  * (`WORKFLOW_RUN_STORE=memory` 的显式易失车道,与它的 run 店同寿命)。
  *
  * 账本的一行 = **一次 `syncRun` 的整份行集**(按 runId 后写覆盖),所以重放即收敛,不需要压缩腿。
+ *
+ * 追加 / 重放走本仓 JSONL 店的**共用口**(S-977;此前 ctor 里自写 `truncateTornTail` + 手写 `split("\n") + JSON.parse` 重放):
+ * 追加 = core `AppendLog`(惰性打开、撕尾在**打开与每次追加前**修 —— 修前只在 boot 修,运行期半写后的下一次成功写仍会被粘进残尾),
+ * 重放 = `replayJsonlSkipping`(登记座 `workflow-agent-session-index`:中间坏行 —— 含半截 JSON 与形不对的整行 —— 跳过 + 逐条披露 + F tag;
+ * 撕尾不计、不披露)。盘上字节 / 0o600 账本 / 0o700 目录与修前逐字同,升级零迁移。
  */
 export declare class LocalWorkflowAgentSessionIndex implements WorkflowAgentSessionIndex {
     private readonly fsyncEnabled;
-    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
-     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
-    private readonly onWarn?;
     private readonly ledgerPath;
     private readonly byRun;
     private readonly bySession;
-    private fd;
+    private log;
     constructor(root?: string, fsyncEnabled?: boolean, 
-    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 那一行照样不入索引,只是没人听见)。形与 workflow 店族的
-     *  `onWarn` 逐字同源(`workflow-completion-inbox.ts` 的那一只),不另立第二种披露通道。 */
-    onWarn?: ((msg: string, meta: Record<string, unknown>) => void) | undefined);
-    /**
-     * 打开账本时把**撕裂尾**(崩在 append 中途、末尾没有换行的那截字节)截回最后一个完整行边界。
-     *
-     * 🔴 为什么必须在**任何 append 之前**做(codex 修复验证轮 [medium],故障注入复现):残尾留在盘上时,
-     * 下一次 `syncRun` 会紧贴着它落字节 ⇒ `<残尾><新记录>` 在 replay 里是**一行**,JSON 解析失败被整行丢掉。
-     * 丢的**不是**那截未提交的残尾(丢它是对的),而是紧随其后那次**成功重试**写下的行 —— 于是「写失败了
-     * 下一次写会重试救回来」这条本模块与 `syncAgentSessionIndex` 都在依赖的性质当场失效,park 索引静默消失。
-     * 截尾之后 append 永远从一个干净的行边界开始,重试才真的救得回来。
-     *
-     * 截掉的只可能是**未提交**的字节(一条记录的耐久性以它那个换行为界,与 notify journal 同一条崩溃序),
-     * 所以这里不是丢数据;但它是一次真实的崩溃留痕,**响亮**一次([ref]:安全轴不许静默)。
-     */
-    private truncateTornTail;
-    private replay;
+    /** 坏账本行的**响亮**出口(可选;缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。形与日志座 `Logger["warn"]` 逐字同源,
+     *  不另立第二种披露通道。 */
+    onWarn?: Logger["warn"]);
     /** 内存两张表的收敛(重放与写路径共用一份逻辑)。 */
     private apply;
     syncRun(runId: string, rows: readonly WorkflowAgentSessionRow[]): Promise<void>;

package/dist/orchestration/workflow-agent-session-index.js

@@ -1,5 +1,6 @@
-import { existsSync, fsyncSync, mkdirSync, openSync, readFileSync, truncateSync, writeSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const nonEmptyString = (v) => typeof v === "string" && v !== "";
 export function readRunParks(run) {
     if (typeof run !== "object" || run === null)
@@ -72,64 +73,27 @@ function readAgentSessionRow(v) {
         return undefined;
     return { sessionId, runId, agentKey, scope };
 }
+const LEDGER_LINE_SHAPE = {
+    what: "a workflow agent-session index line {runId, rows[]}",
+    read: readAgentSessionLedgerLine,
+};
 export class LocalWorkflowAgentSessionIndex {
     fsyncEnabled;
-    onWarn;
     ledgerPath;
     byRun = new Map();
     bySession = new Map();
-    fd;
+    log;
     constructor(root, fsyncEnabled = true, onWarn) {
         this.fsyncEnabled = fsyncEnabled;
-        this.onWarn = onWarn;
         if (root === undefined) {
             this.ledgerPath = undefined;
             return;
         }
         const dir = join(root, "workflow-agent-sessions");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.ledgerPath = join(dir, "index.jsonl");
-        this.truncateTornTail();
-        this.replay();
-    }
-    truncateTornTail() {
-        const path = this.ledgerPath;
-        if (path === undefined || !existsSync(path))
-            return;
-        const bytes = readFileSync(path);
-        if (bytes.length === 0 || bytes[bytes.length - 1] === 0x0a)
-            return;
-        const keep = bytes.lastIndexOf(0x0a) + 1;
-        truncateSync(path, keep);
-        this.onWarn?.("workflow_agent_session_ledger_torn_tail_truncated", {
-            path,
-            droppedBytes: bytes.length - keep,
-            note: "the last append never finished (no trailing newline) — those uncommitted bytes were cut back to the last complete line so the NEXT append starts on a clean boundary. Without the cut, the retry that follows would be glued onto the broken suffix and dropped as one unparsable line, i.e. the retry — not the torn write — is what would be lost.",
-        });
-    }
-    replay() {
-        if (this.ledgerPath === undefined || !existsSync(this.ledgerPath))
-            return;
-        for (const line of readFileSync(this.ledgerPath, "utf8").split("\n")) {
-            if (!line.trim())
-                continue;
-            let rec;
-            try {
-                rec = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const entry = readAgentSessionLedgerLine(rec);
-            if (entry === undefined) {
-                this.onWarn?.("workflow_agent_session_ledger_line_rejected", {
-                    path: this.ledgerPath,
-                    note: "a committed ledger line did not read back as {runId, rows[]} — that run keeps its previous snapshot; a /decide for a park it should have indexed falls back to the legacy lane (honest miss, never a mis-route)",
-                });
-                continue;
-            }
+        for (const entry of replayJsonlSkipping(this.ledgerPath, "workflow-agent-session-index", LEDGER_LINE_SHAPE, onWarn).records)
             this.apply(entry.runId, entry.rows);
-        }
     }
     apply(runId, rows) {
         for (const old of this.byRun.get(runId) ?? []) {
@@ -145,11 +109,8 @@ export class LocalWorkflowAgentSessionIndex {
     }
     async syncRun(runId, rows) {
         if (this.ledgerPath !== undefined) {
-            if (this.fd === undefined)
-                this.fd = openSync(this.ledgerPath, "a", 0o600);
-            writeSync(this.fd, `${JSON.stringify({ runId, rows })}\n`);
-            if (this.fsyncEnabled)
-                fsyncSync(this.fd);
+            this.log ??= new AppendLog(this.ledgerPath);
+            this.log.append({ runId, rows }, this.fsyncEnabled);
         }
         this.apply(runId, rows);
     }

package/dist/orchestration/workflow-notify-journal.d.ts

@@ -1,6 +1,7 @@
-import type { WorkflowRun, WorkflowRunStore, WorkflowRunStatus, WorkflowRunSummary } from "@sema-agent/core";
+import { type WorkflowRun, type WorkflowRunStore, type WorkflowRunStatus, type WorkflowRunSummary } from "@sema-agent/core";
 import { type FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "./workflow-agent-session-index.js";
+import type { Logger } from "../observability/logger.js";
 /** A workflow completion notification's terminal payload — the bounded, redacted shape core's notifier seam
  *  carries, re-derivable from a durable {@link import("@sema-agent/core").WorkflowRun} on the recovery path. */
 export interface WorkflowCompletionPayload {
@@ -201,6 +202,11 @@ export declare class WorkflowNotifyGate {
  * appends, atomic single-line records. Single-instance / TOC-local: a cross-replica TiDB/PG port is a follow-on
  * (the recovery sweep + gate are backend-agnostic).
  *
+ * 追加 / 重放走本仓 JSONL 店的**共用口**(S-977;此前是第二 / 第三份私有实现):追加 = core `AppendLog`(惰性打开;单条 `writeSync`
+ * 循环写满、失败的写截回开写处;**撕尾在打开与每次追加前修**,所以崩在一次 append 中途之后的下一条成功写不会被粘进残尾),
+ * 重放 = `replayJsonlSkipping`(登记座 `workflow-notify-journal`:中间坏行跳过 + 逐条披露 + F tag;撕尾不计 —— 它是崩溃的正常落盘形;
+ * 末行 JSON 完整但缺换行的认下、下一次追加补换行)。盘上字节 / 0o600 账本 / 0o700 目录与修前逐字同,升级零迁移。
+ *
  * The ledger only ever grows by one line per `record`/`ack`; an acked entry's line is not deleted (the replay
  * folds it), so retention is a future compaction concern — the backlog `listPending` walks is bounded by
  * IN-FLIGHT + un-swept runs, not history.
@@ -209,12 +215,9 @@ export declare class FileWorkflowNotifyJournalStore implements WorkflowNotifyJou
     private readonly fsyncEnabled;
     private readonly ledgerPath;
     private readonly entries;
-    private fd;
-    constructor(root: string, fsyncEnabled?: boolean);
-    /** Replay the ledger into the authoritative map (last-writer-wins by line order). Tolerates a torn final line
-     *  (a crash mid-append) by dropping an unparsable trailing record — the same crash-safety FileWorkflowRunStore
-     *  relies on (a partial append is simply not yet committed state). */
-    private replay;
+    private log;
+    /** @param warn 坏账本行的披露座(缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。 */
+    constructor(root: string, fsyncEnabled?: boolean, warn?: Logger["warn"]);
     /** Commit one entry: append the JSON line (fsync) THEN flip the in-memory map (crash-safe ordering — the
      *  durable record lands before the in-memory state the caller observes). */
     private commit;
@@ -228,7 +231,7 @@ export declare class FileWorkflowNotifyJournalStore implements WorkflowNotifyJou
     ack(runId: string, ackedAt: number): Promise<void>;
     listPending(): Promise<WorkflowNotifyJournalEntry[]>;
     get(runId: string): Promise<WorkflowNotifyJournalEntry | null>;
-    /** Release the append handle (best-effort) — called on shutdown. */
+    /** Release the append handle — called on shutdown. core `AppendLog.close()` swallows its own `closeSync` error (never throws). */
     close(): void;
     /** Test/inspection: total entries (acked + pending). */
     get size(): number;

package/dist/orchestration/workflow-notify-journal.js

@@ -1,9 +1,10 @@
-import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, closeSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
 import { buildFleetWorkflowRow } from "../fleet/fleet-bus.js";
 import { isTerminalWorkflowRowStatus, seedTerminalWorkflowRow } from "../fleet/fleet-terminal-window.js";
 import { buildParkedAgentSessionRows, sameAgentSessionRows } from "./workflow-agent-session-index.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const SUMMARY_MAX = 500;
 export function recoverySummary(status, error) {
     if (status === "completed")
@@ -162,42 +163,31 @@ export class WorkflowNotifyGate {
         return { scanned: pending.length, redelivered, stillRunning, abandoned };
     }
 }
+const JOURNAL_ENTRY_SHAPE = {
+    what: "a notify-journal entry {runId: string, scope: string, acked: boolean}",
+    read(record) {
+        const { runId, scope, acked } = record;
+        if (typeof runId !== "string" || typeof scope !== "string" || typeof acked !== "boolean")
+            return undefined;
+        return record;
+    },
+};
 export class FileWorkflowNotifyJournalStore {
     fsyncEnabled;
     ledgerPath;
     entries = new Map();
-    fd;
-    constructor(root, fsyncEnabled = true) {
+    log;
+    constructor(root, fsyncEnabled = true, warn) {
         this.fsyncEnabled = fsyncEnabled;
         const dir = join(root, "workflow-notify");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.ledgerPath = join(dir, "journal.jsonl");
-        this.replay();
-    }
-    replay() {
-        if (!existsSync(this.ledgerPath))
-            return;
-        const text = readFileSync(this.ledgerPath, "utf8");
-        for (const line of text.split("\n")) {
-            if (!line.trim())
-                continue;
-            let ev;
-            try {
-                ev = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            if (ev && typeof ev.runId === "string")
-                this.entries.set(ev.runId, ev);
-        }
+        for (const ev of replayJsonlSkipping(this.ledgerPath, "workflow-notify-journal", JOURNAL_ENTRY_SHAPE, warn).records)
+            this.entries.set(ev.runId, ev);
     }
     commit(entry) {
-        if (this.fd === undefined)
-            this.fd = openSync(this.ledgerPath, "a", 0o600);
-        writeSync(this.fd, `${JSON.stringify(entry)}\n`);
-        if (this.fsyncEnabled)
-            fsyncSync(this.fd);
+        this.log ??= new AppendLog(this.ledgerPath);
+        this.log.append(entry, this.fsyncEnabled);
         this.entries.set(entry.runId, entry);
     }
     async record(input) {
@@ -226,14 +216,8 @@ export class FileWorkflowNotifyJournalStore {
         return this.entries.get(runId) ?? null;
     }
     close() {
-        if (this.fd !== undefined) {
-            try {
-                closeSync(this.fd);
-            }
-            catch {
-            }
-            this.fd = undefined;
-        }
+        this.log?.close();
+        this.log = undefined;
     }
     get size() {
         return this.entries.size;

package/dist/plugins/file-outcome-sink.d.ts

@@ -1,4 +1,4 @@
-import type { TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
+import { type TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
 /** The one write verb every outcome sink (TiDB/Pg ledger adapters + this File twin) exposes to main.ts,
  *  plus the OPTIONAL read aggregate backing `GET /v1/outcomes` (P2) — present on the SQL ledgers (their
  *  existing per-(signature, model) summary); absent here (the JSONL file IS the local dataset — a dashboard
@@ -18,7 +18,10 @@ export interface OutcomeSink {
 }
 export declare class FileOutcomeSink implements OutcomeSink {
     private readonly path;
+    private log;
     constructor(root: string);
     recordCore(o: CoreTaskOutcome): Promise<void>;
+    /** 收追加口(`StoreBackend.close` 的优雅关闭腿;之后再写会重开)。core `AppendLog.close()` 自己吞 `closeSync` 的错,不抛。 */
+    dispose(): void;
 }
 //# sourceMappingURL=file-outcome-sink.d.ts.map

package/dist/plugins/file-outcome-sink.js

@@ -1,14 +1,20 @@
-import { mkdirSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
+import { AppendLog, ensureDir } from "@sema-agent/core";
 export class FileOutcomeSink {
     path;
+    log;
     constructor(root) {
         const dir = join(root, "outcomes");
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        ensureDir(dir);
         this.path = join(dir, "outcomes.jsonl");
     }
     async recordCore(o) {
-        appendFileSync(this.path, `${JSON.stringify({ at: Date.now(), ...o })}\n`, { mode: 0o600 });
+        this.log ??= new AppendLog(this.path);
+        this.log.append({ at: Date.now(), ...o }, false);
+    }
+    dispose() {
+        this.log?.close();
+        this.log = undefined;
     }
 }
 //# sourceMappingURL=file-outcome-sink.js.map

package/dist/plugins/file-run-store.js

@@ -7,7 +7,7 @@ import { randomBytes } from "node:crypto";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
-import { RUN_STALLED_ERROR, StoreBootRefusalError } from "./store-contracts.js";
+import { RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { migrateRetiredAskOrigin } from "./one-time-migrations.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
@@ -603,7 +603,7 @@ export class FileRunStore {
         for (const r of orphans) {
             r.status = "failed";
             r.result = null;
-            r.error = "run orphaned by engine restart";
+            r.error = RUN_ORPHANED_ERROR;
             r.updatedAt = new Date();
             this.persist(r);
         }
@@ -808,7 +808,7 @@ export class FileRunStore {
             pidStillRunning: owner !== undefined && isProcessLive({ pid: owner.pid }),
             note: "the claim's owner process is provably not the one that wrote it (fingerprint falsified, or the pid is gone) and the row has nothing left to resume — taking the claim over",
         });
-        return { kind: "stale", reason: `run orphaned by engine restart (claim held by ${who}, which is gone)`, snapshot };
+        return { kind: "stale", reason: buildRunOrphanedError(who), snapshot };
     }
     takeOverClaim(sessionId, reason, snapshot) {
         const nowClaim = readClaimRecord(singleRecordOf(this.readRecords(this.activePath(sessionId), CLAIM_RECORD_SHAPE)), sessionId);

package/dist/plugins/retention-store-sql.d.ts

@@ -8,7 +8,7 @@
  * core 把破坏性级联整个下沉成 store 方法(`expireCheckpoints` / `deleteExpiredSessions` /
  * `deleteOrphanToolResults`),并点名 server 的 session-purge 顺序契约(E21,`boot/session-faces.ts` 的
  * `purgeSession` 协调器)为参考实现。那条顺序契约横跨**十余张表**(run 账本 / checkpoint / tool_result /
- * anchor / exemption / policy / attachment / snapshot / workflow inbox / session_meta+event),而设计稿
+ * anchor / exemption / policy / attachment / 用户输入受理账本 / snapshot / workflow inbox / session_meta+event),而设计稿
  * §6 的 F5 又要求「审计行与删除同一个 DB 事务」—— 一个事务 ⇒ 一条连接 ⇒ **一个属主**。
  *
  * ⇒ 布局裁定:本能力**不能**挂在 session / checkpoint / tool-result 任何一只店上(每只店只拥有自己的表,

package/dist/plugins/retention-store-sql.js

@@ -1,5 +1,6 @@
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { TASK_LIST_ITEM_TABLE, TASK_LIST_META_TABLE, taskListKeyFor } from "./task-list-store-sql.js";
+import { USER_INPUT_ACCEPTANCE_TABLE } from "./user-input-ledger-sql.js";
 import { ensureIndexes } from "./ensure-index.js";
 export const MANAGED_RETENTION = "managed";
 export const UNMANAGED_RETENTION = "none";
@@ -382,6 +383,7 @@ export class SqlRetentionStore {
             ["session_policy", "session_id"],
             ["session_policy_rev_mark", "session_id"],
             ...(this.opts.taskAttachmentTable ? [["task_attachment", "session_id"]] : []),
+            [USER_INPUT_ACCEPTANCE_TABLE, "session_id"],
             ["file_history_tracked", "scope"],
             ["file_history_version", "scope"],
             ["file_history_boundary", "scope"],

package/dist/plugins/store-backend.js

@@ -277,6 +277,7 @@ class LocalBackend {
         this.approvalAskStore.dispose();
         this.sendFileLedgerStore.dispose();
         this.userInputLedgerStore.dispose();
+        this.outcomeSinkInst.dispose();
         this.workflowJournalStore.dispose();
         this.checkpointStoreInst?.close();
         this.permissionRuleStoresInst?.dispose();

package/dist/plugins/store-contracts.d.ts

@@ -94,23 +94,73 @@ export interface RunCancelContext {
     elapsedMs?: number;
 }
 /**
- * 落库/上 wire 的终局结果 = core 的 `TaskResult` **加上** server 自铸的可缺席侧记键。
+ * 🔴 S-947(cli [ref] 第 3 件 / L-212)—— **server 为什么中止了这条 run**:取消终局的机读成因,闭集。
  *
- * 今天只有一个成员({@link RunCancelContext});additive 且可缺席,所以旧行、旧消费端逐字不受影响
- * (`TaskResult` 仍可原样赋给本型)。⚠️ 这不是给「往 core 结果里塞私货」开的口子:每加一个键都要能
- * 回答「为什么它属于 run 账本而不属于 core 的任务结果」——`cancelContext` 的答案是它描述的是
- * **server 侧的取消现场**,core 那一侧根本不知道有人按了取消。
+ * 病:非 detach 流断连、`POST /v1/runs/:id/cancel`、断连时有 ask 但 park 宽限用尽 —— 三件事在终局上**逐字同形**
+ * (`failed` + `terminal.code:"cancelled"`),壳只能按 `errorMessage` 文案猜。
+ *
+ * 每个词都必须有一个**真站点**(没有站点的词不许进表;普查与站点坐标见契约 §5.0d):
+ *  · `client_disconnected`      —— 非 detach 的 `POST /v1/tasks/stream` 客户端断连,断连那一刻本 run 没有流内未决 ask
+ *                                  (`http/routes/tasks.ts` 的断连臂,立即中止);
+ *  · `ask_park_grace_exhausted` —— 同一断连臂,但断连那一刻有流内未决 ask、已按窗到期同路转 park,宽限计时器用尽时 park 仍没落成;
+ *  · `cancel_verb`              —— `POST /v1/runs/:id/cancel`:同副本快路、跨副本耐久取消旗的轮询(四条腿的心跳 / 登记追平),
+ *                                  以及 park 中的 run 被它直接终局化(那一形不经 abort,成因照样是这条动词)。
+ * **刻意不在表里**(普查过、没有真站点):抢占(`preempt` 是优雅让出,终局是 `paused`,不是取消)、有序关停
+ * (S-929 只把未决卡转 park,从不中止活 run;进程退出后的行由收割器落「持有者死亡」判决,那不是本仓铸的取消终局)、
+ * `interrupt`(引擎的 turn 动词,终局 `completed` + `haltedByUser`)、detach 断连(不中止)。
+ *
+ * 词表属主 = 本文件(与它所在的 {@link PersistedTaskResult} 同住);**单写者** = `run-cancel-context.ts` 的 `createRunAbort`
+ * (中止那一刻登记)与 `mintCancelledResult`(终局铸点读它),自铸 wire 值登记 = `trace/self-minted-wire.ts` 的 `abortCause`
+ * (`satisfies Record<AbortCause, …>`:加 / 删一个词而登记没跟 ⇒ tsc 红)。
+ */
+export declare const ABORT_CAUSES: readonly ["client_disconnected", "ask_park_grace_exhausted", "cancel_verb"];
+export type AbortCause = (typeof ABORT_CAUSES)[number];
+/**
+ * server 自铸、挂在终局结果上的**侧记键**全集(都描述「server 这一侧发生了什么」,core 那一侧无从知道)。
+ * 本型是这一族键的**唯一登记处**(`trace/core-keyset-guard.ts` 的辖域线指向这里;那边另有一道编译期钉:
+ * core 的 `TaskResult` 哪天长出同名键 ⇒ 当场红 —— 同一个键两个铸者是本型存在要防的那件事)。
+ *  · `cancelContext`([ref])—— 取消现场快照(分诊材料:多久没动静、起跑多久);
+ *  · `abortCause`(S-947)—— 这次取消是谁 / 什么发起的({@link AbortCause})。
+ * 两键**同一只铸点**(`mintCancelledResult`)、**同一条在场闸**(「只补空座」:终局就是被那次中止打断的那一条,
+ * 才挂;与中止赛跑跑完的终局、引擎自带码的失败一律原样立住、两键都不挂)。差别只在缺席纪律:快照一键都证不出 ⇒ 整只缺席;
+ * 成因在铸点那一刻恒已知 ⇒ 取消终局上恒在场。
  */
-export type PersistedTaskResult = TaskResult & {
+export interface PersistedResultSideKeys {
     cancelContext?: RunCancelContext;
-};
+    abortCause?: AbortCause;
+}
+/**
+ * 落库/上 wire 的终局结果 = core 的 `TaskResult` **加上** server 自铸的可缺席侧记键({@link PersistedResultSideKeys})。
+ *
+ * additive 且可缺席,所以旧行、旧消费端逐字不受影响(`TaskResult` 仍可原样赋给本型)。⚠️ 这不是给「往 core 结果里塞私货」
+ * 开的口子:每加一个键都要能回答「为什么它属于 run 账本而不属于 core 的任务结果」—— 两键的答案都是它们描述的是
+ * **server 侧的取消现场**,core 那一侧根本不知道有人按了取消、谁按的。落点 = `result` JSON 列(三孪生整只存),**零新列**。
+ */
+export type PersistedTaskResult = TaskResult & PersistedResultSideKeys;
 /**
  * 🔴 run 店「持有它的实例丢了」那一判的**行上落款**(S-928 codex r1-F1 提为常量):三只 run 店的 `reapStale` 把心跳过期的 running 行翻成
- * `failed` 并写下这一句。它是 run 店死亡判决留在行上的唯一证据 —— 用户输入受理账本的 SQL 收敛臂据它在 reap **之后**仍能判出「写者死了」
- * (`user-input-ledger.ts` 的判词)。改这一句 = 改那条判据;所以三个写者与那一个读者都只引用本常量。读时折叠成同一句话的 wire 展示站点
+ * `failed` 并写下这一句。它是 run 店死亡判决留在行上的证据之一(另一只 = {@link RUN_ORPHANED_ERROR})—— 用户输入受理账本的收敛判词
+ * (S-969 L8 起两车道同一只)据 {@link isHolderDeathVerdict} 在 reap **之后**仍能判出「写者死了」。改这一句 = 改那条判据;所以三个写者与那一个读者都只引用本常量。读时折叠成同一句话的 wire 展示站点
  * (`routes/runs.ts` 的 stale 折叠、`routes/trace-usage.ts` 的 WORKER_DOWN 帧)刻意留字面量:它们由文案冻结门逐字钉着,且不参与任何判据。
  */
 export declare const RUN_STALLED_ERROR = "run stalled (instance lost?)";
+/**
+ * 🔴 File 车道「持有它的进程随重启没了」那一判的行上落款(S-969 L8 提为常量):boot 孤儿回收(`FileRunStore.reclaimOrphanedAtBoot`,
+ * 数据根 LOCK 作证前世进程已死 ⇒ 仍 running 的行无条件判孤儿)与运行期 claim 接管的 running 臂(`judgeClaim`,外来 + owner 已死 + 无可续)
+ * 都写这一句;接管臂在括号里附上前任持有者的进程指纹(取证用,形 = {@link buildRunOrphanedError})。与 {@link RUN_STALLED_ERROR} 同一种身份:
+ * run 店写在行上的**死亡判决**,读者 = {@link isHolderDeathVerdict}。
+ */
+export declare const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
+/** File 车道两个孤儿落款写口共用的那一句(`heldBy` = 接管臂的前任持有者描述;boot 回收臂不带)。 */
+export declare function buildRunOrphanedError(heldBy?: string): string;
+/**
+ * run 行上是不是一份**持有者死亡判决**:`failed`,且 `error` 是 run 店的两只死亡落款之一 —— {@link RUN_STALLED_ERROR}(三只 run 店的
+ * `reapStale`:心跳过期 ⇒ 实例丢了)或 {@link RUN_ORPHANED_ERROR}(File 车道:前世进程随重启没了;接管臂带括注)。判决只说「持有它的那个进程
+ * 死在这条腿收场之前」,不说是谁 —— 持有者是谁读行上的 `instanceId`(两只落款都不改它)。唯一读者 = 用户输入受理账本的收敛判词
+ * (`src/user-input-ledger.ts` `judgeOpen`);改任一句落款 = 改那条判据,所以写者与读者都只引用本模块的常量。
+ * 正常失败(别的 error)/ park 过期收割(`approval expired before decision`:腿 park 过)都**不是**死亡判决。
+ */
+export declare function isHolderDeathVerdict(run: Pick<RunRecord, "status" | "error">): boolean;
 export interface RunRecord {
     taskId: string;
     sessionId: string;

package/dist/plugins/store-contracts.js

@@ -1,6 +1,16 @@
 export class StoreBootRefusalError extends Error {
 }
+export const ABORT_CAUSES = ["client_disconnected", "ask_park_grace_exhausted", "cancel_verb"];
 export const RUN_STALLED_ERROR = "run stalled (instance lost?)";
+export const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
+export function buildRunOrphanedError(heldBy) {
+    return heldBy === undefined ? RUN_ORPHANED_ERROR : `${RUN_ORPHANED_ERROR} (claim held by ${heldBy}, which is gone)`;
+}
+export function isHolderDeathVerdict(run) {
+    if (run.status !== "failed" || run.error === null)
+        return false;
+    return run.error === RUN_STALLED_ERROR || run.error === RUN_ORPHANED_ERROR || run.error.startsWith(`${RUN_ORPHANED_ERROR} (`);
+}
 export const RUN_STATUS_CLASS = {
     running: "live",
     completed: "succeeded",

package/dist/plugins/user-input-ledger-file.d.ts

@@ -1,5 +1,5 @@
 import type { Logger } from "../observability/logger.js";
-import { UserInputLedgerFold, type NewUserInputAcceptance, type OpenScanCursor, type SettleHow, type UserInputAcceptance, type UserInputLedgerRecord, type UserInputLedgerStore } from "../user-input-ledger.js";
+import { UserInputLedgerFold, type NewUserInputAcceptance, type OpenScanCursor, type OpenScanPage, type SettleHow, type UserInputAcceptance, type UserInputLedgerRecord, type UserInputLedgerStore } from "../user-input-ledger.js";
 /** 账本文件名(取证按文件字节对账 —— 崩溃语义的真源是文件)。 */
 export declare const USER_INPUT_LEDGER_FILE = "ledger.jsonl";
 /** 纯内存孪生(测试 / 夹具)。 */
@@ -13,9 +13,11 @@ export declare class MemoryUserInputLedgerStore implements UserInputLedgerStore
     settle(acceptId: string, how: SettleHow, atMs: number): Promise<boolean>;
     converge(acceptId: string, atMs: number): Promise<boolean>;
     announce(acceptId: string, taskId: string, atMs: number): Promise<boolean>;
-    listOpen(after?: OpenScanCursor, limit?: number): Promise<UserInputAcceptance[]>;
+    listOpen(after?: OpenScanCursor, limit?: number): Promise<OpenScanPage>;
     listCrashed(sessionId: string): Promise<UserInputAcceptance[]>;
     listUnannounced(sessionId: string, limit: number): Promise<UserInputAcceptance[]>;
+    /** S-965:会话树删除 = 一行会话级墓碑(守卫:该会话此刻有行 ⇒ 落;否则零写、回 0)。写抛 ⇒ 原样抛(协调器据此不删会话本体)。 */
+    deleteBySession(sessionId: string): Promise<number>;
 }
 /** local 车道(File)孪生。 */
 export declare class FileUserInputLedgerStore extends MemoryUserInputLedgerStore {

package/dist/plugins/user-input-ledger-file.js

@@ -39,6 +39,10 @@ export class MemoryUserInputLedgerStore {
     async listUnannounced(sessionId, limit) {
         return this.fold.listUnannounced(sessionId, limit);
     }
+    async deleteBySession(sessionId) {
+        const n = this.fold.sessionSize(sessionId);
+        return (await this.write({ kind: "erased", sessionId, at: Date.now() })) ? n : 0;
+    }
 }
 const RECORD_SHAPE = {
     what: "user-input ledger record of an unknown kind or with a missing / out-of-vocabulary member",
@@ -46,8 +50,14 @@ const RECORD_SHAPE = {
         const o = record;
         const str = (k) => (typeof o[k] === "string" && o[k].length > 0 ? o[k] : undefined);
         const at = typeof o.at === "number" && Number.isFinite(o.at) ? o.at : undefined;
+        if (at === undefined)
+            return undefined;
+        if (o.kind === "erased") {
+            const sessionId = str("sessionId");
+            return sessionId === undefined ? undefined : { kind: "erased", sessionId, at };
+        }
         const acceptId = str("acceptId");
-        if (acceptId === undefined || at === undefined)
+        if (acceptId === undefined)
             return undefined;
         switch (o.kind) {
             case "accepted": {

package/dist/plugins/user-input-ledger-sql.d.ts

@@ -13,13 +13,22 @@
  * 无 owner / principal / scope 列(行随它挂靠的会话走 —— 收编形Ⅲ);`writer` 是受理进程的 `instanceId`(随进程消亡,不是租户轴)。
  * 行里不存输入正文(只有身份与时刻)。
  *
- * ## 不在本表上的东西
- * 会话删除 / 托管留存的级联**未接**(行至多是几条身份 + 时刻;S-928 收车档登记的欠账)。
+ * ## 会话树删除(S-965)
+ * `deleteBySession` = `DELETE … WHERE session_id = ?`(真删行;File 孪生是一行会话级墓碑,同义)。两条删会话树的级联各有一臂:在线删除协调器
+ * 经本动词;托管留存的事务化孪生(`retention-store-sql.ts` `purgeSessionTrees` ④)在**自己的事务**里对本表发同一只谓词(`session_id` 单键,
+ * 多值集合按方言)—— 它不调店,理由见该文件顶注的布局裁定(一个事务 ⇒ 一条连接 ⇒ 一个属主)。谓词走 `(session_id, state, accepted_at_ms)` 索引的前缀。
+ *
+ * ## 读不出的行(S-969 L6):逐行跳过,游标按原始行推进
+ * 三只读口都按 `state` 列取行(`= 'open'` / `= 'converged'`),所以 `state` 词表外的行任何读口都取不到;被取到的行上读不出的列 —— `input_kind`
+ * 词表外(新版本写的输入族:滚动发布 / 回滚的混版窗)、收敛行缺 `state_at_ms` —— 由 {@link readRows} 逐行跳过 + 计 F 类 tag
+ * `server.user-input-ledger.corrupt-record-skipped`(File 孪生重放坏行的同一只登记座),其余行照交。修前一行读不出 ⇒ 整页抛:收敛断点不前进
+ * (其后的 open 行永不收敛)、同会话的通告与读面一并失效。`listOpen` 的续翻游标取**原始**末行的键(`accept_id` / `accepted_at_ms` 是 NOT NULL
+ * 键列,坏行也读得出),跳过的行照样推进;页里少了几行不等于扫到底(那由原始行数判)。SQL 文本 / DDL 不变。
  */
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
-import { type NewUserInputAcceptance, type OpenScanCursor, type SettleHow, type UserInputAcceptance, type UserInputLedgerStore } from "../user-input-ledger.js";
+import { type NewUserInputAcceptance, type OpenScanCursor, type OpenScanPage, type SettleHow, type UserInputAcceptance, type UserInputLedgerStore } from "../user-input-ledger.js";
 export declare const USER_INPUT_ACCEPTANCE_TABLE = "user_input_acceptance";
 export declare class SqlUserInputLedgerStore implements UserInputLedgerStore {
     private readonly db;
@@ -29,9 +38,10 @@ export declare class SqlUserInputLedgerStore implements UserInputLedgerStore {
     settle(acceptId: string, how: SettleHow, atMs: number): Promise<boolean>;
     converge(acceptId: string, atMs: number): Promise<boolean>;
     announce(acceptId: string, taskId: string, atMs: number): Promise<boolean>;
-    listOpen(after?: OpenScanCursor, limit?: number): Promise<UserInputAcceptance[]>;
+    listOpen(after?: OpenScanCursor, limit?: number): Promise<OpenScanPage>;
     listCrashed(sessionId: string): Promise<UserInputAcceptance[]>;
     listUnannounced(sessionId: string, limit: number): Promise<UserInputAcceptance[]>;
+    deleteBySession(sessionId: string): Promise<number>;
 }
 /** MySQL 协议腿的构造绑定。 */
 export declare class TiDBUserInputLedgerStore extends SqlUserInputLedgerStore {