@sema-agent/server 7.111.0 → 7.113.0

package/MIGRATION.md

@@ -7,6 +7,74 @@
 > ⚠️ 完整清单在仓库根 `CHANGELOG.md`——它**不随 npm tarball 出包**(本文件随包)。看完整迁移窗的
 > 权威姿势是源码 tag diff:`git diff v<旧>..v<新>`(每版都推 `v<版本>` tag);npm 包页也镜像 CHANGELOG。
 
+## 7.113.0(车UP)—— `@sema-agent/core` 7.38.3 → 7.39.1(core 7.39.0 硬破坏六条 + 7.39.1 清单披露补全):`attachments.planModeReminder` 退役 · 停放行排空前提 · 策略结算记在策略名下 · 受理账本收消费证据
+
+- **🔴 请求面硬破坏:`attachments.planModeReminder` 退役(响亮拒,无兼容形)**。① *谁受影响*:提交体 `attachments` 里带 `planModeReminder`(任何值,含 `false`)的调用方
+  (SDK 的 `TaskRequest.attachments.planModeReminder`、自建客户端)。② *怎么改*:删掉这个键 —— 引擎(core 7.39.0)在 `permissionMode:"plan"` 的腿上自己陈述
+  plan 姿态(首请求 / 周期提醒 / 退出帧);要 plan 姿态就发 `permissionMode:"plan"`。③ *不改会怎样*:该提交 `400 request.field_invalid`(错误句点名退役与出路)——
+  不再是「受理、引擎在 prepare 拒」。升级前就停放、存量体里带这个键的任务续跑时**丢键照跑**(它要的提醒今天由引擎在 plan 模式下自己铸,不丢意图)。
+- **🔴 升级前排空 ≤ core 7.33.x 时期停放的 checkpoint 行**(core 7.39.0 删掉一次性迁移):`inheritedGate` 仍带退役模式种子(`autoModeRequested` / `approverPosture` /
+  非 `"always"` 的 `shellGate`)的 pending 行 —— 只可能是 server ≤7.105.0 时期停放、至今仍 pending 的行 —— 升级后续跑被拒 `409 checkpoint.unsupported_version`
+  (行字节不动、仍 pending)。**在还跑 ≤7.112.0 的部署上**用 `docs/DEPLOY-PREREQS.md` 同名节的只读 SQL 数行(期望 0),非 0 就答完或取消那些 run 再换钉;
+  漏排的行升级后可 `POST /v1/runs/:id/cancel` 放弃,或一次性回滚到 7.112.x 续跑完再升回来。
+- **`DB_BACKEND=local`(File 店)车道的排空**:没有 SQL 可跑 —— 用随包的只读脚本 `scripts/retired-mode-seed-drain-local.mjs`(7.113.0 起在 npm 包里)。
+  **升级前你装的还是 ≤7.112.0,脚本不在已装的包里,但不必先升级服务**:`d=$(mktemp -d) && (cd "$d" && npm pack @sema-agent/server@7.113.0 && tar xzf sema-agent-server-7.113.0.tgz) && node "$d/package/scripts/retired-mode-seed-drain-local.mjs"`
+  (已升级的,直接 `node <安装目录>/node_modules/@sema-agent/server/scripts/retired-mode-seed-drain-local.mjs`)。
+  **读哪个数据根**:不带参时 = 服务自己的那条解析 —— `LOCAL_DATA_ROOT` → `CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`(脚本取的是服务 `loadConfig` 调的同一只函数,不是它自抄的一份),
+  所以请在**与服务同一份 env** 下跑;也可以把数据根当唯一参数递进去。末行 `RETIRED-MODE-SEED rows=… root=<实际读的数据根>` 回显读了哪个目录。
+  只读、不取锁;它把 `checkpoints/checkpoints.snapshot.jsonl`(压实后的行)与 `checkpoints/checkpoints.jsonl`(之后的事件)折成当前状态再判 pending 行(不要用 grep 代替:压实后老行只在快照里)。
+  行形与事件词的判据与 core 的 File 店逐条同(判据坐标写在脚本头注里)。**服务运行中也能跑**:脚本自己判读到的是不是一致的快照 + 账本 ——
+  读前读后各取两只文件的身份(压实会原子换新快照再清空账本,追加会改大小),变了就重读(至多 3 次);仍读不稳就报 rc 2「服务在写,停写或重跑」,不会在半态下报一个假的「干净」。
+  **rc 0** = 零命中,可换钉;**rc 1** = 有命中(逐行 `RETIRED-ROW token=… sessionId=… member=…`,按 sessionId 答完或取消再跑);
+  **rc 2** = 不给结论 —— 账本里有它不认的事件词、不合形的记录(含坏行、`put` 的行体不合形、缺 `scope` 的快照行;命中的旧卡照列),
+  或**数据根目录不存在、根下没有 `checkpoints/`**(路径打错、env 没对上服务,读到的是一个什么都没有的目录:缺席不等于干净),或读期间文件一直在变、读文件出错。
+- **新镜像码 `checkpoint.config_refused`(409,`retriable:true`)**:resume 的配置门在 claim 前拒,卡仍 pending、run 行停回 `suspended`;体带 `field` ——
+  `taskConfig` = 改配置后同一张卡再决,`inheritedGate` = 行记下的模式种子坏了、只能取消这条 run。本服务自己的配置面产不出它(来路只剩嵌入方自写 `resolveSpec`)。
+- **两个 409 码的体多一个 `retriable:true`(additive;落点改判)**:`checkpoint.walltime_axis_retired` 与 `/wake` 口上的 `steering.blocked_by_hook`。键此前缺席;码、状态、`error` 报文不变。
+  读法与本节 `checkpoint.config_refused` / `seat_retired` 同:这一族里 `retriable:true` = 「卡仍 pending(core 在 claim 之前拒)」,**不是**「原样重试会成功」。
+  - **`checkpoint.walltime_axis_retired`(`POST /v1/approvals/:session/decide`;账本带已退役的跨片限时配额 `resourceLedger.totalWalltimeSec` 的存量 pending 行)**。
+    **Before(7.112.0)**:这个码落终局 —— run 行被驱成 `failed`、会话锁释放,卡仍 pending 却再也没有可续跑的行(孤儿)。
+    **After(7.113.0)**:run 行**留 `suspended`、会话锁保持**,卡仍 pending。这条行在 ≥7.39 的引擎上**永远续不了**(同一份字节每次都被同码拒)。
+    core 报文建议的「另开新任务」在**同一会话**上会 `409 conflict.session_active_run`(会话锁还在这条行手里),所以出路是:**先 `POST /v1/runs/:id/cancel` 放弃这条 run**(卡 expire、会话释放),再在该会话上另开新任务;
+    或在 core 报文所说的「previous release」的 worker 上续完它 —— 注意 7.112.x 带的 core 7.38.3 已经同样拒这个码,**回滚到 7.112.x 救不了**,要续只能用限时轴退役之前的 core 版本。
+  - **`steering.blocked_by_hook` 的 `/wake` 口(带 `message` 的 wake 撞上部署的 `userPromptSubmit` hook 崩 / 超时 / 拒;core 在 claim 之前拒,卡仍 pending)**。
+    **Before(7.112.0)**:409 体不带 `retriable`,`/wake` 为这次尝试铸的合成 run 行以无码的终局(`result:null`)落终局 —— 一次零执行的拒绝被记成普通失败。
+    **After(7.113.0)**:409 体带 `retriable:true`;合成行以带 `steering.blocked_by_hook` 码的结构化终局落终局,**不占会话**;hook 恢复后**同一张卡**可再 wake。live `steer` / `interrupt` 口上的同名码(422)不变。
+- **审计面(门记录 `tool_end.gate.settlement`,值变更)**:① 无人值守腿(leader worker / 修复腿 / `sema` CLI / 它们的续跑)上机器按类放行的那一问,结算从
+  `human_allowed` / `who.party:"person"` 改为 **`policy_allowed` / `who.party:"policy"` / `who.approver:"unattended_class_answer"`**(7.109.0 起登记的「读作机器放行」
+  这条读法退役);② 一切**策略拒**(`UNATTENDED_APPROVAL_POLICY=deny` 的无人可答、run-local 无 TTY 的拒、`settledBy:"policy"` 的决裁)的 `policy_refused`
+  `who.party` 从 `"none"` 改为 **`"policy"`**。按 party 词分桶的审计读者改读新词。**混版 / 回滚**:7.112.x 的读面不认 party `policy`,读到 7.113.0 写下的这两种记录会把整条 `gate` 扣下(读面没有 `gate`、计一次投影缺陷)。
+- **结果面(additive)**:`blocked` 终局多一个可选 `terminal.detail { kind:"prompt_blocked_by_hook", cause, hookReason? }`(主提交被部署 `userPromptSubmit` hook 拦下时;
+  同步 200 体 / 流 `done.result` / `GET /v1/runs/:id` / 账本 `done` 行四面同形),`hookReason` 与 `reason` 同一只脱敏。按封闭 schema 校验结果的消费方加这一可选键。
+- **hook 作者 / 嵌入方**:本服务的 hooks 复合体对每一槽的 PreToolUse 结果先过引擎自己的 hook 席收据 —— 契约成员放在原型上 / 不可枚举 / 访问器上的结果、Proxy 载体,
+  经复合体与直接交给引擎**同答**:引擎拒(工具不跑、`permissionDenied` 响)。此前复合体会把原型上的 `deny` 读丢、把 Proxy 的 `allow` 折成普通 allow。本服务自己的
+  `createTaskHooks` 只铸普通对象,不受影响;自写裸 `Hooks` 的嵌入方按引擎契约自查。
+- **用户输入受理账本(零 DDL、零动作)**:引擎确认消费一条 live steer(core 7.39.0 起的 `human_input{delivery:"applied"}`)⇒ 受理结清成新词 `consumed`
+  (local:`ledger.jsonl` 的 `settled` 行 `how:"consumed"`;SQL:`user_input_acceptance.settle_how = 'consumed'`,列宽够、无 ALTER);确认消费过的输入崩溃时**不再**告知。
+  `task.user_steer_undrained{cause:"crashed"}` 的 `message` 事实句改为「…ended before the engine confirmed consuming them」(`detail` 不变;按文本匹配的脚本改读 `detail.cause`)。
+  **wire 值变更**:不带 `Idempotency-Key` 的 live steer,其 `human_input.inputId` 自本版等于 steer 回执上的 `messageId`(此前引擎自铸)。
+  **回滚到 ≤7.112.x**:local 车道 —— 旧二进制不认 `consumed` 行,启动重放计一条坏行并跳过 ⇒ 那几条受理在它眼里回到「未结清」,若其写者已不在会被按崩溃告知一次
+  (宁多说一遍);要干净回滚:停服后删 `<数据根>/user-input-ledger/ledger.jsonl`(代价 = 丢掉尚未告知的崩溃丢失提醒)。SQL 车道 —— 结清行的 `state` 列仍是 `settled`,
+  旧二进制的收敛只扫 `state = 'open'`,不受影响。
+- **嵌入方(类型面)**:包根导出的 `SettleHow` 多一个词 `consumed`(对它穷举的 switch tsc 红即通知);`TaskSpec.outputStyle`(core 7.39.0 新席)本服务不接、请求面不收。
+
+### 运维日志事件名退役一族(车 UQ S-990 / 车 UR S-1000 / S-569)—— 按事件名配告警 / 数行的运维要改配
+- **退役(不再逐记录发 warn)**:`session_repo_corrupt_read` · `workflow_journal_corrupt_read` · `workflow_run_corrupt_read` · `roster_corrupt_read` · `background_agent_corrupt_read`(该座已删,披露归 backend 的 `file_store_corrupt_read`)· `mailbox_corrupt_read`(S-990 六座);`approval_ask_journal_corrupt_read` · `run_store_corrupt_read` · `resume_anchor_corrupt_read` · `send_file_ledger_corrupt_read` · `approval_ask_audit_corrupt_read` · `workflow_notify_journal_corrupt_read` · `workflow_agent_session_ledger_line_rejected` · `user_input_ledger_corrupt_read`(S-1000 八座)。
+- **替代读法(F 类座纪律,同一只记录器)**:每座一个 tag —— 进程内**一次** `fail_open` warn(首条明细 + 指路)、`fail_open_total{tag}` 计数每命中 +1、`SEMA_FAILOPEN_PROBE=1` 时每命中一行探针(`kind=record path= line= form= reason=`);tag 名见 `docs/FAIL-OPEN-CENSUS.md`(第 110–113 / 115 / 117 行与 S-582 / S-928 / S-967 / S-977 既有行)。
+- **保持逐命中响亮(安全轴混座,不退役)**:`file_store_corrupt_read`;其 session-policy 脸的坏读今天仍 fail-open(core #1299 修后改拒),server 7.113.0 起同时计 `server.session-policy.corrupt-read-fail-open`(P-DEBT)。
+- **run-local 车道**(前台 CLI 进程)的会话 repo 仍走混座逐命中 warn,不降。
+
+### 会话读三口的非属主 404(车 UQ S-989;wire 值变更)
+- `GET /v1/sessions/:id`(detail / head / events)对**非属主**调用方的反枚举 404,码 / 句子从 run 拼法(`not_found.run` + run 长文)改为会话拼法(`not_found.session` + `session not found`),与「不存在」臂同串。读 `not_found.run` 判「会话读被拒」的旧端要改读 `not_found.session`;属主 200 不变;run 面(`/v1/runs/:id`)不变。
+
+## 7.112.0(车UG,S-924)—— `settings.hooks` 里按工具别名写的 matcher 提交当场 400(此前静默不命中)
+
+- **🔴 settings 面硬破坏(响亮拒,无迁移代码、无兼容形)**。① *谁受影响*:提交体 `settings.hooks` 里 PreToolUse / PostToolUse / PostToolUseFailure 的 `matcher`
+  是**引擎工具别名**的(今天只有 `ListPeers` → `ListAgents`;别名表读 core 静态工具目录)—— 它们**早就不命中**(post 两事件自 7.107.0 / core 7.36.0,PreToolUse 一直),只是没人告诉写的人。
+  ② *怎么改*:把 matcher 改成**正名**(错误句直接给出);`正名|别名` 的滚动期写法不受影响(命中正名)。③ *不改会怎样*:该**新提交** `400 request.field_invalid`(错误句点名别名与正名)——
+  不再是「接受、hook 永不跑」。耐久 resume 重放**不判**(会砖 parked 任务):升级前就 parked 的任务,其存量 body 里的别名 matcher 在续跑腿照旧永不命中、同一份 hooks 里其余钩子照常生效(与 7.111.0 逐字同)。
+  嵌入方经 `resolveSpec` 席挂的工具别名在受理面看不见,不在本门射程。
+
 ## 7.111.0(车TA,S-961 / S-972)—— `wiring_manifest` 帧 +`instructions` 段(additive,零动作)
 
 - **wire(additive,零动作)**:`wiring_manifest` 帧(四条腿:流式 SSE / 账本行 / 非流式 `wiringManifest` 回执 / 续跑腿)多一段本服务自铸的 `instructions: { selected: string[] }` = 这条腿选中的项目指令文件(相对 cwd 的链成员);`[]` = 没有,缺席 = 无陈述(契约附录 G.21)。按封闭 schema 校验该帧的消费方加这一可选键;不要它的部署 `PROJECT_MEMORY_ENABLED=false`(连同项目记忆注入一起关)。`task.user_steer_undrained{cause:"crashed"}` 的 `message` 改句序(行动句在前、< 400 字符),`detail` 不变 —— 按文本匹配的脚本改读 `detail.cause`(S-972)。

package/USAGE.md

@@ -690,7 +690,7 @@ FLEET_ADVERTISE_ADDRESS=http://<本机可达IP>:8090  # 可选:设了才启公
   | 记忆整理阀门判决 + 驱动席(`MEMORY_CONSOLIDATION_DRIVER=on`,或未设而出厂缺省按目录派生 —— 7.104.0 起) | 重启生效 | 阀门开关与整理跑用的模型都在启动期定一次;中心改了 roles / 档位 / 目录条目后,**判决会翻**(派生开 ↔ 关,含只把主模型挪到整理座那一条上)或开着而座漂了 ⇒ `/health` 报 `restartRequired`,`restart.reasons` 含 `memory-consolidation`(7.100.0 新理由;7.104.0 起派生关的那台同样报) |
 
   生效与否的观测口=`/health` 世代账键(`configTargetVersion`/`configAppliedVersion`+两 ordinal+`configApplyStaleMs`,见 API 表 `/health` 行)——target≠applied 持续=「改了没生效」的机读信号。
-- **`run-local`(一次性本机 CLI)上三张审批名单同样执法**(7.101.0 起,TTY 问 / 无 TTY 拒):`APPROVAL_DENY` 当场拒;`APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ stdin 是 TTY 就 `y/N` 问人,否则当场拒并在 stderr 点名三张名单键;`APPROVAL_AUTO_BUDGET` 照常生效(never-auto 不吃预算);TTY 问句带上这次调用的参数,人答 N 而停下的 run 退 1(停因 `haltedOnUserRejection`)。**无 TTY 的拒记在部署政策名下**(7.110.0 起,S-956;此前记成人拒):该次调用 `tool_end.gate.settlement` = `{kind:"policy_refused", who:{party:"none"}}`,模型读到的是引擎的策略句(「部署政策拒了、此处没有交互审批,别重试,先做不需要审批的部分」)加一句拒因,而不是「用户不想继续,停下来等他」—— 不停批,模型接着做别的部分;那只要人批的动作没执行 ⇒ run 照样退 1,非 `--json` 形 stderr 停因行是 `task incomplete (approval unanswered): …`。参数展示不出而不问就拒的那一形(TTY 在场也一样)同此。这条腿没有 checkpoint 店也**不**拒启 —— 它有一只当场作答的席,名单的 ask 不需要 park(上表「无 checkpoint 店 ⇒ 整组拒」只说服务腿)。此前三张名单在这条腿上无声不生效。
+- **`run-local`(一次性本机 CLI)上三张审批名单同样执法**(7.101.0 起,TTY 问 / 无 TTY 拒):`APPROVAL_DENY` 当场拒;`APPROVAL_REQUIRE` / `APPROVAL_NEVER_AUTO` 命中 ⇒ stdin 是 TTY 就 `y/N` 问人,否则当场拒并在 stderr 点名三张名单键;`APPROVAL_AUTO_BUDGET` 照常生效(never-auto 不吃预算);TTY 问句带上这次调用的参数,人答 N 而停下的 run 退 1(停因 `haltedOnUserRejection`)。**无 TTY 的拒记在部署政策名下**(7.110.0 起,S-956;此前记成人拒):该次调用 `tool_end.gate.settlement` = `{kind:"policy_refused", who:{party:"policy"}}`(7.113.0 起;7.110.x–7.112.x 为 `party:"none"`),模型读到的是引擎的策略句(「部署政策拒了、此处没有交互审批,别重试,先做不需要审批的部分」)加一句拒因,而不是「用户不想继续,停下来等他」—— 不停批,模型接着做别的部分;那只要人批的动作没执行 ⇒ run 照样退 1,非 `--json` 形 stderr 停因行是 `task incomplete (approval unanswered): …`。参数展示不出而不问就拒的那一形(TTY 在场也一样)同此。这条腿没有 checkpoint 店也**不**拒启 —— 它有一只当场作答的席,名单的 ask 不需要 park(上表「无 checkpoint 店 ⇒ 整组拒」只说服务腿)。此前三张名单在这条腿上无声不生效。
 - **仅 `/v1/tasks`(同步)+ `/v1/runs`(异步)**——`/v1/tasks/stream` 不支持(多次尝试非单流,400)。与 `verify` **互斥**(同时给 → 400)。
 - 成本上界 = 任务的 `maxCostUsd`(防冷重跑税)。**三条 core 警示**:① 每档**冷重跑**重付输入成本(便宜档常过才划算);② 门收到**未脱敏**输出(自定义门转发外部 verifier 要脱敏);③ **写工具会跑 N 次**——**只用于只读/幂等任务**(每次升级整任务重跑)。开放式任务(找全 bug/文笔)没有可判定 oracle、级联会空转,那种用 `discuss`(广度交叉)而非级联(深度阶梯)。
 
@@ -836,7 +836,7 @@ UNATTENDED_APPROVAL_POLICY=park
   - `deny` ⇒ **真无人值守/headless 部署的显式声明**:这类 ask 当场拒绝,让模型自己改道,不积压一堆
     等不到人的挂起 run。它是**收紧**方向(不放行任何东西)。
     这一拒记在**部署政策**名下,不记在人名下(7.100.0 起):那次调用的 `tool_end.gate.settlement` 是
-    `{kind:"policy_refused", who:{party:"none"}}`;模型读到的是「部署政策拒了、此处没有交互审批,别重试,
+    `{kind:"policy_refused", who:{party:"policy"}}`(7.113.0 起;此前 `party:"none"`);模型读到的是「部署政策拒了、此处没有交互审批,别重试,
     先做不需要审批的部分」,run 接着跑(auto 模式下分类器连拒后回落的那一问被拒时,引擎按「无人可判」停下
     run:终局 `failed` / `classifier.denial_limit`)。此前记成 `human_refused` / `who.party:"person"`,模型被告知
     「用户不想继续,停下来等他」,run 以 `haltedOnUserRejection` 收束 —— 而这台部署自己声明了没人会来。
@@ -873,7 +873,7 @@ UNATTENDED_APPROVAL_POLICY=park
   `ordinary` 的问 —— 模式写门对普通写的问、形状层对非只读 shell 的问(写与命令照常落地,与 7.105.0 同)。其余每一类都不答:
   写保护表目标(`write_protection`)、shell 读会话目录外(`probe`)、MCP / A2A 工具标记、transcript 写、规则店读不出、共享制品读、
   plan 的写问(`mode`),以及运维 / hook / 规则 / 组织为人提的问(审批名单、治理层、`APPROVAL_NEVER_AUTO` …)。不答的问:
-  - **有席的腿交给席**:run-local 在终端里跑 ⇒ 问你 y/N;没有 TTY ⇒ 当场拒(stderr 一句;门记录记在部署政策名下 `policy_refused` / `who.party:"none"`,7.110.0 起,S-956)。
+  - **有席的腿交给席**:run-local 在终端里跑 ⇒ 问你 y/N;没有 TTY ⇒ 当场拒(stderr 一句;门记录记在部署政策名下 `policy_refused` / `who.party:"policy"`(7.113.0 起;7.110.x–7.112.x 为 `"none"`),7.110.0 起,S-956)。
   - **无席的腿**(leader 各腿):配了 durable 审批块的部署 ⇒ park,等人经 `/decide` 答(与 7.105.0 同形);没配 ⇒ 当场拒(fail-closed)。
 - 答集是常量(只 `ordinary`,core 推荐形),**不是旋钮**。7.106.0–7.108.0 的 `UNATTENDED_PERMISSION_MODE` 已退役:**设了即拒启**
   (`config.env_key_retired`,任何值都拒);从 `.env` 里删掉它。要让机器多答某一类问,先立案,不开旋钮。

package/dist/approval-ask-audit-store.d.ts

@@ -165,7 +165,6 @@
  */
 import type { HostDecision } from "./host-decision.js";
 import { AppendLog } from "@sema-agent/core";
-import type { Logger } from "./observability/logger.js";
 /** 数据子目录名(挂在 local 数据根下,与 `workflow-notify/` 同层同形)。 */
 export declare const APPROVAL_ASK_AUDIT_DIR = "approval-ask-audit";
 /** 崩溃收敛行的读面上限(新前旧后截断;有界 wire —— 读面不许随月份线性长)。 */
@@ -358,15 +357,15 @@ export declare class FileApprovalAskAuditStore implements ApprovalAskAuditSink,
      * (撕尾不进重放、完整末行进重放,修前修后读数同);
      * 目录已在而盘后来满 / 变只读 ⇒ boot 照常,append 走 `recordFailOpen`。
      * @param internals.appendLog 测试注入席(见 {@link AuditAppendPort})。
-     * @param internals.warn 腐读披露座(缺席 ⇒ 重放属主退回 `console.warn`,不退回沉默)。
+     *
+     * 坏行披露 = F 类座纪律(S-1000:无 warn 出口)—— 每条跳过的行 `recordFailOpen` 计数 + 探针行,warn 每进程每 tag 一次。
      */
     constructor(root: string, internals?: {
         appendLog?: (path: string) => AuditAppendPort;
-        warn?: Logger["warn"];
     });
     /** 重放的坏值计数(`convergeCrashedAsks().corruptLines`):重放属主跳过的坏行(撕尾不计)+ 成因词表外的行(行在、结清照认,坏值照样计数)。 */
     private corruptLines;
-    /** 重放前世账本(共用口 `replayJsonlSkipping`):撕尾 = 未落完的写,静默跳过;坏行跳过 + 逐条披露;坏行数另暴露给收敛日志。 */
+    /** 重放前世账本(共用口 `replayJsonlSkipping`):撕尾 = 未落完的写,静默跳过;坏行跳过 + 逐条计数 / 探针;坏行数另暴露给收敛日志。 */
     private replay;
     private group;
     /** append + fsync(逐行落盘:进程猝死不丢已记的行 —— 本店的全部价值就在崩溃时刻;写口 = 共用的 `AppendLog`:单次 `writeSync` 一行、末段在打开与每次追加前修(撕尾截、完整末行补换行)、失败的写截回开写处)。

package/dist/approval-ask-audit-store.js

@@ -191,11 +191,11 @@ export class FileApprovalAskAuditStore {
         const dir = join(root, APPROVAL_ASK_AUDIT_DIR);
         ensureDir(dir);
         this.ledgerPath = join(dir, "ledger.jsonl");
-        this.replay(internals?.warn);
+        this.replay();
     }
     corruptLines = 0;
-    replay(warn) {
-        const { records, skipped } = replayJsonlSkipping(this.ledgerPath, "approval-ask-audit", LEDGER_SHAPE, warn);
+    replay() {
+        const { records, skipped } = replayJsonlSkipping(this.ledgerPath, "approval-ask-audit", LEDGER_SHAPE);
         this.corruptLines = skipped;
         let line = 0;
         for (const { rec, outOfSetCause } of records) {

package/dist/approval-card.d.ts

@@ -651,8 +651,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -766,8 +766,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;

package/dist/boot/coordinators.js

@@ -41,7 +41,7 @@ export function createLiveCoordinators(ctx) {
         });
     }
     const approvalAskAudit = config.toolApprovalEnabled && backend?.kind === "local" && config.localDataRoot !== undefined
-        ? new FileApprovalAskAuditStore(config.localDataRoot, { warn: (event, fields) => logger.warn(event, fields) })
+        ? new FileApprovalAskAuditStore(config.localDataRoot)
         : undefined;
     if (approvalAskAudit) {
         const converged = approvalAskAudit.convergeCrashedAsks();

package/dist/boot/stores.js

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 import { FileBackgroundAgentStore, FileMailboxStore, FileRosterStore, FileUsageWindowStore, InMemoryUsageWindowStore, mailboxCrossProcessMountVerdict } from "@sema-agent/core";
-import { createCorruptReadSeat } from "../observability/corrupt-read-seat.js";
+import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "../memory-sync-client.js";
 import { memoryEmbedderFor } from "../plugins/memory-embedder.js";
 import { ensurePgMemoryEmbedderMetaSchema, reconcileEmbedderFingerprint } from "../plugins/memory-embedder-fingerprint.js";
@@ -232,7 +232,7 @@ export async function openStores(ctx) {
         }
         else if (backend?.kind === "local") {
             rosterStore = new FileRosterStore(join(config.localDataRoot ?? localRoot, "roster.json"), {
-                onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "roster_corrupt_read"),
+                onCorruptRead: createCorruptReadFailOpenSeat("server.roster.corrupt-record-skipped"),
             });
         }
         if (rosterStore)
@@ -252,9 +252,7 @@ export async function openStores(ctx) {
             backgroundAgentStore = new TiDBBackgroundAgentStore(mysqlPool);
         }
         else if (backend?.kind === "local") {
-            backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot, {
-                onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "background_agent_corrupt_read"),
-            });
+            backgroundAgentStore = new FileBackgroundAgentStore(config.localDataRoot ?? localRoot);
         }
         if (backgroundAgentStore)
             logger.info("background_agent_store_enabled", { backend: pgPool ? "pg" : mysqlPool ? "tidb" : "file" });
@@ -308,7 +306,7 @@ export async function openStores(ctx) {
         }
         else if (backend?.kind === "local") {
             mailboxStore = new FileMailboxStore(config.localDataRoot ?? localRoot, {
-                onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "mailbox_corrupt_read"),
+                onCorruptRead: createCorruptReadFailOpenSeat("server.mailbox.corrupt-record-skipped"),
             });
             mailboxRecipientLifecycle = createDropOnlyRecipientLifecycle(mailboxStore);
         }

package/dist/boot/workflow-orchestration.js

@@ -2,7 +2,7 @@ import { FileWorkflowRunStore, InMemoryWorkflowRunStore } from "@sema-agent/core
 import { join } from "node:path";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { LocalWorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
-import { createCorruptReadSeat } from "../observability/corrupt-read-seat.js";
+import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, resolveCompletionRoute } from "../orchestration/workflow-completion-inbox.js";
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { SubagentSteerRegistry } from "../orchestration/subagent-steer.js";
@@ -16,11 +16,11 @@ export function createWorkflowOrchestration(ctx) {
             ? new InMemoryWorkflowRunStore()
             : (sqlWorkflowRunStore ??
                 new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows"), {
-                    onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "workflow_run_corrupt_read"),
+                    onCorruptRead: createCorruptReadFailOpenSeat("server.workflow-run.corrupt-record-skipped"),
                 }))
         : undefined;
     const workflowNotifyJournal = config.selfOrchestrationEnabled && config.workflowRunStoreBackend !== "memory"
-        ? (sqlWorkflowRunStore ? backend.notifyJournal() : new FileWorkflowNotifyJournalStore(join(config.localDataRoot ?? localRoot, "workflows"), undefined, (msg, meta) => logger.warn(msg, meta)))
+        ? (sqlWorkflowRunStore ? backend.notifyJournal() : new FileWorkflowNotifyJournalStore(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
         : undefined;
     const workflowCompletionInbox = config.selfOrchestrationEnabled
         ? config.workflowRunStoreBackend === "memory"
@@ -64,7 +64,7 @@ export function createWorkflowOrchestration(ctx) {
             ? new LocalWorkflowAgentSessionIndex()
             : (sqlWorkflowRunStore
                 ? backend.workflowAgentSessionIndex()
-                : new LocalWorkflowAgentSessionIndex(join(config.localDataRoot ?? localRoot, "workflows"), undefined, (msg, meta) => logger.warn(msg, meta)))
+                : new LocalWorkflowAgentSessionIndex(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
         : undefined;
     const workflowRunStore = baseWorkflowRunStore
         ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex)

package/dist/config-types.d.ts

@@ -1884,7 +1884,7 @@ export interface ServiceConfigFlat {
      * 结束等待的确实是本仓的窗;其余三臂结束等待的是容量/连接/装配,自报恒缺席。
      *
      * 🔴 **`deny` 交给引擎的形(S-689)**:部署政策拒对象臂 `{allow:false, settledBy:"policy", reason}` ⇒ 引擎结算
-     * `policy_refused`(`who.party:"none"`)、模型读策略句(「部署政策拒了、此处没有交互审批,别重试、做不需审批的
+     * `policy_refused`(`who.party:"policy"` —— core 7.39.0 #1265 起;此前 `"none"`)、模型读策略句(「部署政策拒了、此处没有交互审批,别重试、做不需审批的
      * 部分」)、run 不以「用户拒绝」收束而是继续。修前是裸 `false` —— 引擎契约里那就是「一个人拒了」
      * (`human_refused` / `haltedOnUserRejection`),与本键「没有人会来」的自声明正好相反。(b)(c) 两臂照旧带
      * `"timeout"` 自报(`approval_window_expired`)。

package/dist/config.js

@@ -11,6 +11,7 @@ import { isV2ScopeKey, memoryReplicationCoverage, replicationCovers } from "./me
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { CONFIG_PROVIDER_WORDS, DB_BACKEND_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS } from "./config-types.js";
+import { resolveLocalDataRoot } from "./local-data-root.js";
 import { buildWriteProtectionPosture } from "./write-protection.js";
 import { normalizeSshFingerprint } from "./ssh-host-key.js";
 import { buildReadFacePostureNotice, readFaceForPosture } from "./read-face-posture.js";
@@ -874,7 +875,7 @@ function parseStoreDomain(ctx) {
     const sqlEngineExplicit = !!process.env.DB_BACKEND && dbBackend !== "local" && dbBackend !== "memory";
     const sessionBackendRaw = enumEnv("SESSION_BACKEND", sqlEngineExplicit ? "mysql" : "memory", ["memory", "mysql", "auto"]);
     const sessionBackend = sessionBackendRaw === "mysql" ? "tidb" : sessionBackendRaw;
-    const localDataRoot = process.env.LOCAL_DATA_ROOT || process.env.CONFIG_LOCAL_DIR || process.env.AGENT_DATA_DIR || join(homedir(), ".ai-agent");
+    const localDataRoot = resolveLocalDataRoot(process.env, homedir());
     const dbHostSet = dbBackend === "pg" ? !!process.env.PG_HOST : !!process.env.MYSQL_HOST;
     const needsTidb = sessionBackend === "tidb" || (sessionBackend === "auto" && dbHostSet);
     const needsDb = needsTidb;

package/dist/hooks/hook-runner.d.ts

@@ -35,6 +35,11 @@ export interface ParseHooksConfigResult {
     /** 人可读的第一条校验错误(HTTP 层用它 400 fail-loud;resume 防御路径用它 warn)。 */
     error?: string;
 }
+/**
+ * fresh 提交面专用判据(S-924):配置里第一条「永远打不中」的工具事件 matcher 的拒句;没有 ⇒ undefined。
+ * 入参是 {@link parseHooksConfig} 已校验过的配置。**只有 `admission.ts` 的 fresh 提交门调它** —— resume 重放不调(理由见上面的头注)。
+ */
+export declare function deadToolMatcherIssue(config: HooksConfig): string | undefined;
 /**
  * 把 wire 上的 untrusted `settings.hooks` 校验成契约 {@link HooksConfig} + 服务侧上限。
  * 错误返回 error 字符串而不 throw——submit 路径 400 fail-loud、resume 防御路径 warn-drop,由调用方选。
@@ -174,8 +179,8 @@ export declare function createTaskHooks(config: HooksConfig, ctx: HookRunnerCont
  * 把部署级 hooks 基线(deps.hooks,如 TOOL_TRACE 观测)折进 task 级 hooks——core 是整槽覆盖
  * (`spec.hooks ?? deps.hooks`),不折叠就静默 shadow 部署观测(runtask gateBaseline 注释点名的坑)。
  * 语义:部署槽先跑(观测看到原始输入/输出),task 槽后跑;结果合并:
- *  - preToolUse:deny > ask > allow 折叠;updatedInput 串行线程(部署重写喂给 task 槽);context 拼接。读不出词的结果
- *    (非对象、集外 `action`)原样交回、由引擎的接手屏判(S-959,短路同 deny)。
+ *  - preToolUse:每一槽的结果**先过 core 的 hook 席收据** `receiveHookResult`(S-971,core 7.39.0 #1274)—— 引擎拒的载体 ⇒ 交回引擎的拒绝体
+ *    (短路,引擎按自己的 fail-closed 拒处置);收下的 ⇒ 折它的冻结副本:deny > ask > allow 折叠;updatedInput 串行线程(部署重写喂给 task 槽);context 拼接。
  *  - postToolUse/postToolUseFailure/postToolBatch:双跑,additionalContext 拼接,updatedOutput 取
  *    后者(task 槽)优先。
  *  - userPromptSubmit/stop:部署 block 优先短路(不再跑 task 槽),否则双跑、context 拼接、task block 生效。

package/dist/hooks/hook-runner.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { hostShell, resolveHostShell, adoptHostForegroundChild } from "../plugins/host-platform.js";
-import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, } from "@sema-agent/settings-schema/hooks";
+import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, HOOK_EVENT_MATCHER_FIELD, } from "@sema-agent/settings-schema/hooks";
+import { describeToolCatalog, isEngineRefusal, receiveHookResult } from "@sema-agent/core";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, buildDisplaySafeUrl } from "../trace/redact.js";
@@ -56,6 +57,49 @@ function toAssistantTurnError(errorKind) {
         return "unknown";
     return Object.prototype.hasOwnProperty.call(BRAIN_TO_TURN_ERROR, errorKind) ? (BRAIN_TO_TURN_ERROR[errorKind] ?? "unknown") : "unknown";
 }
+const NAME_ALTERNATION = /^[A-Za-z0-9_-]+(?:\|[A-Za-z0-9_-]+)*$/;
+function matcherReadsWireToolName(event) {
+    return HOOK_EVENT_OWNER[event] === "engine" && HOOK_EVENT_MATCHER_FIELD[event] === "tool_name";
+}
+let engineToolAliasTable;
+function engineToolAliases() {
+    if (engineToolAliasTable !== undefined)
+        return engineToolAliasTable;
+    const entries = describeToolCatalog();
+    const wireNames = new Set(entries.map((e) => e.name));
+    const table = new Map();
+    for (const e of entries) {
+        for (const alias of e.face.aliases ?? []) {
+            if (!wireNames.has(alias) && !table.has(alias))
+                table.set(alias, e.name);
+        }
+    }
+    engineToolAliasTable = table;
+    return table;
+}
+function deadAliasInMatcher(event, matcher) {
+    if (matcher === undefined || !matcherReadsWireToolName(event) || !NAME_ALTERNATION.test(matcher))
+        return undefined;
+    const branches = matcher.split("|");
+    const aliases = engineToolAliases();
+    for (const branch of branches) {
+        const canonical = aliases.get(branch);
+        if (canonical !== undefined && !branches.includes(canonical))
+            return { alias: branch, canonical };
+    }
+    return undefined;
+}
+export function deadToolMatcherIssue(config) {
+    for (const [event, groups] of Object.entries(config)) {
+        for (const group of groups ?? []) {
+            const dead = deadAliasInMatcher(event, group.matcher);
+            if (dead) {
+                return `settings.hooks.${event}: matcher "${dead.alias}" is an alias; tool-event matchers match the tool's wire name (PostToolUse / PostToolUseFailure since 7.107.0) — use "${dead.canonical}"`;
+            }
+        }
+    }
+    return undefined;
+}
 export function parseHooksConfig(raw) {
     const parsed = HooksConfig.safeParse(raw);
     if (!parsed.success) {
@@ -1190,10 +1234,10 @@ export function composeHooks(deployment, task) {
             for (const slot of [d.preToolUse?.bind(d), t.preToolUse?.bind(t)]) {
                 if (!slot)
                     continue;
-                const r = await slot(toolName, current, ctx);
-                if (r === undefined || Object.is(r, null) || Object.is(r, false))
+                const r = receiveHookResult(await slot(toolName, current, ctx));
+                if (r === undefined || r === null || r === false)
                     continue;
-                if (typeof r !== "object")
+                if (isEngineRefusal(r))
                     return r;
                 if (r.additionalContext)
                     contexts.push(r.additionalContext);

package/dist/host-decision.d.ts

@@ -22,7 +22,9 @@ import { type AskOutcome, type ResumeOutcome } from "@sema-agent/core";
  *    而 sweep 结构上不能 `allow`)。
  *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
  *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
- *    并把结算记成 `policy_refused`(`who.party:"none"`)。`allow` 侧结构上不可(core pre-CAS 拒:只有人批准)。
+ *    并把结算记成 `policy_refused`(`who.party:"policy"`,core 7.39.0 #1265 起;此前 `"none"`)。`allow` 侧:core 7.39.0 起引擎收策略的
+ *    放行(`policy_allowed`),但本仓的两条 decide 口**不开**这一形(`tool-approval.ts` 的 `SETTLED_BY_ONLY_ON_DENY` 与店列的同一条拒仍在 ——
+ *    耐久车道上的机器放行是一件没裁过的新能力,不在 7.113.0 提货批内,候登)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
 /**
@@ -74,8 +76,8 @@ export type HostDecidedBy = HostDecision["decidedBy"];
  * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
  * 「通道没报」,两头都不真。
  *
- * 🔴 归属**不按词分岔**:core 的 `policy_refused` 结算记录上确实没有归属席(`who.party:"none"`),但那是
- * **core 的记录**怎么写,不是**本服务观察到的事实**是什么 —— 送出这次请求的那把已验证身份是真的,本仓的
+ * 🔴 归属**不按词分岔**:core 7.38.x 的 `policy_refused` 结算记录上没有归属席(`who.party:"none"`),7.39.0 #1265 起有了
+ * (`who.party:"policy"`,`approver?`)—— 无论 core 的记录怎么写,**本服务观察到的事实**不变:送出这次请求的那把已验证身份是真的,本仓的
  * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
  *
  * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条

package/dist/http/admission.js

@@ -7,7 +7,7 @@ import { taskBodyKeyIssue } from "../request-key-closure.js";
 import { FILE_HISTORY_DISABLED_NO_RESTORE, fileHistoryRestoreConflict, inheritEnvFieldIssue, singleMemberOffFieldIssue } from "../request-value-closure.js";
 import { selfOrchestrationDenial } from "../task-workflow.js";
 import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
-import { parseHooksConfig } from "../hooks/hook-runner.js";
+import { deadToolMatcherIssue, parseHooksConfig } from "../hooks/hook-runner.js";
 import { judgeRequestWebSearch } from "../plugins/web-search.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS, MAX_CWD_CHARS } from "../task-cwd.js";
@@ -200,6 +200,11 @@ export function createAdmission(ctx) {
                     sendError(res, 400, "request.field_invalid", hooksParsed.error ?? "settings.hooks: invalid shape");
                     return null;
                 }
+                const deadMatcher = deadToolMatcherIssue(hooksParsed.config);
+                if (deadMatcher !== undefined) {
+                    sendError(res, 400, "request.field_invalid", deadMatcher);
+                    return null;
+                }
             }
             {
                 const webSearchVerdict = judgeRequestWebSearch(st.webSearch);
@@ -545,11 +550,15 @@ export function createAdmission(ctx) {
         if (body.attachments !== undefined) {
             const a = body.attachments;
             if (typeof a !== "object" || a === null || Array.isArray(a)) {
-                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, planModeReminder?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
+                sendError(res, 400, "request.field_invalid", "attachments must be an object { todoReminder?, todoReminderMode?, changedFiles?, budgetUsd?, backgroundTasks?, toolsDelta?, agentListing?, skillsListing?, mcpInstructions? }");
                 return null;
             }
             const rec = a;
-            for (const k of ["todoReminder", "planModeReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
+            if (rec.planModeReminder !== undefined) {
+                sendError(res, 400, "request.field_invalid", 'attachments.planModeReminder was retired in core 7.39.0 — the engine now states plan posture itself whenever the permission mode is "plan" (first request, periodic reminders, exit frame); remove the key (send permissionMode "plan" for plan posture)');
+                return null;
+            }
+            for (const k of ["todoReminder", "budgetUsd", "backgroundTasks", "toolsDelta", "agentListing", "skillsListing", "mcpInstructions"]) {
                 if (rec[k] !== undefined && typeof rec[k] !== "boolean") {
                     sendError(res, 400, "request.field_invalid", `attachments.${k} must be a boolean`);
                     return null;

package/dist/http/request-guards.js

@@ -1,6 +1,6 @@
 import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "@sema-agent/core";
 import { HttpError, principalFrom } from "../security.js";
-import { RUN_NOT_FOUND_MESSAGE } from "./route-ctx.js";
+import { RUN_NOT_FOUND_MESSAGE, SESSION_NOT_FOUND_MESSAGE } from "./route-ctx.js";
 import { sendError } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, runOwnerReadable, sendPrincipalRefusal } from "./principal-gate.js";
 const MAX_BODY = 8 * 1024 * 1024;
@@ -165,7 +165,7 @@ export function createRequestGuards(ctx) {
         }
         if (!runOwnerReadable(principal, owner, deps.config)) {
             if (notFoundForm === "session")
-                sendError(res, 404, "not_found.session", "session not found");
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             else
                 sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
             return false;

package/dist/http/resume-legs.d.ts

@@ -7,21 +7,26 @@
  * 字节不变)。同居是第三条,也是唯一一条既保住静态序又保住 move-only 的。序由 `const` 的 TDZ 亲自执法:
  * 腿是提升的函数声明、ctx 是文件尾的 `const`,谁也不会在工厂执行期读到对方。
  *
- * ctx 字段 28 只(registry 7 + helpers 14 + deps/runnerFor/prepareSpec/finalizeTaskResult + 三只配额/租约/用量窗
- * 判据)—— 这是**如实披露**的耦合读数(设计稿 §9:把它变小是波 3 的事,本刀不承诺)。型一律从既有型派生
+ * ctx 字段 27 只(registry 6 + helpers 14 + deps/runnerFor/prepareSpec/finalizeTaskResult + 三只配额/租约/用量窗
+ * 判据;S-947 删 `cancelledViaVerb` 旁表后 28 → 27,与 `test/split-ctx-parity.test.ts` 的读数同)—— 这是**如实披露**的耦合读数(设计稿 §9:把它变小是波 3 的事,本刀不承诺)。型一律从既有型派生
  * (`RunRegistry` / `RouteHelpers` / `RouteLegs` / `ReturnType<typeof createRequestGuards>`),不手抄签名 ⇒ 不会漂。
  */
 import type { IncomingMessage } from "node:http";
-import { type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
+import { CheckpointError, type QuestionAnswer, type CheckpointToken } from "@sema-agent/core";
 import type { DecideBinding } from "./wire-types.js";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import { type HostDecision } from "../host-decision.js";
 import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
-import type { RouteCtxBase, DriveResumeArgs, PreparedPlanReview } from "./route-ctx.js";
+import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome } from "./route-ctx.js";
 import { type TrustedRunInternals } from "./durable-run-leg.js";
 import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
+/**
+ * {@link CHECKPOINT_ERROR_DISPOSITION} 的读口(纯函数,resume 腿的 catch 臂与钉共用)。运行期遇到表外的码(装树 core 比本二进制多一个码的版本偏斜 ——
+ * 型面上拼不出来)⇒ `"terminal"`:与 `by_reason` 认不得的词同一条 fail-closed 方向(不宽容默认成可重试),也与修前手列串的缺省逐字相同。
+ */
+export declare function checkpointErrorDisposition(e: CheckpointError): "cancelled" | "retriable" | "terminal";
 export declare function createResumeLegs(ctx: {
     deps: FlatServiceDeps;
     runnerFor: FlatServiceDeps["runnerFor"];
@@ -33,21 +38,12 @@ export declare function createResumeLegs(ctx: {
     }) => Promise<void>, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }) => Promise<{
-        status: number;
-        body: object;
-    }>;
-    driveResumeIntoRunLog: (args: DriveResumeArgs) => Promise<{
-        status: number;
-        body: object;
-    }>;
+    }) => Promise<ResumeLegOutcome>;
+    driveResumeIntoRunLog: (args: DriveResumeArgs) => Promise<ResumeLegOutcome>;
     driveResumeLeg: (args: DriveResumeArgs, onAccepted?: (receipt: {
         status: number;
         body: object;
-    }) => void) => Promise<{
-        status: number;
-        body: object;
-    }>;
+    }) => void) => Promise<ResumeLegOutcome>;
     mayDiscloseRowError: (cs: CheckpointStoreFull, token: CheckpointToken, decider: {
         principal?: string;
         explicitOperator: boolean;
@@ -59,14 +55,8 @@ export declare function createResumeLegs(ctx: {
         status: number;
         body: object;
     }>;
-    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, trustedInternals: TrustedRunInternals, runId: string) => Promise<{
-        status: number;
-        body: object;
-    }>;
-    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowParkedResume?: DriveResumeArgs["workflowParkedResume"], ownerLeaseAdmittedFor?: string) => Promise<{
-        status: number;
-        body: object;
-    }>;
+    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, trustedInternals: TrustedRunInternals, runId: string) => Promise<HostLegOutcome>;
+    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowParkedResume?: DriveResumeArgs["workflowParkedResume"], ownerLeaseAdmittedFor?: string) => Promise<HostLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
         principalPresent?: boolean;