@sema-agent/server 7.111.0 → 7.113.0

package/dist/http/resume-legs.js

@@ -8,7 +8,7 @@ const sessionFaceUnavailable = async (sessionId) => {
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
-import { mintCancelledResult } from "../run-cancel-context.js";
+import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../run-cancel-context.js";
 import {} from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
@@ -30,7 +30,7 @@ import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { storedBodyPermissionMode } from "../task-settings.js";
-import { acceptedResumingReceipt } from "./route-ctx.js";
+import { acceptedResumingReceipt, buildHostLegOutcome } from "./route-ctx.js";
 import { mintAndDriveDurableRun } from "./durable-run-leg.js";
 import { createSessionsLocal } from "./routes/sessions.js";
 import { createSessionSyncLocal } from "./routes/session-sync.js";
@@ -70,12 +70,68 @@ const WORKER_SWAP_REDEEMABLE = {
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
 }
-const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(["hostDecision", "approver"]);
+const CHECKPOINT_ERROR_DISPOSITION = {
+    "checkpoint.resume_aborted": "cancelled",
+    "checkpoint.invalid_outcome": "retriable",
+    "checkpoint.reopen_revote": "retriable",
+    "checkpoint.reopened_concurrently": "retriable",
+    "resume.parent_constraint_missing": "retriable",
+    "resume.parent_constraint_mismatch": "retriable",
+    "resume.constraint_rejected": "retriable",
+    "resume.constraint_unprojectable": "retriable",
+    "resume.usage_window_exhausted": "retriable",
+    "resume.principal_mismatch": "retriable",
+    "resume.placement_mismatch": "retriable",
+    "resume.preflight_rejected": "retriable",
+    "wake.gate_pending": "retriable",
+    "wake.nothing_to_deliver": "retriable",
+    "checkpoint.config_refused": "retriable",
+    "checkpoint.walltime_axis_retired": "retriable",
+    "steering.blocked_by_hook": "retriable",
+    "checkpoint.unsupported_version": "by_reason",
+    "checkpoint.already_resolved": "terminal",
+    "checkpoint.not_found": "terminal",
+    "checkpoint.gate_mismatch": "terminal",
+    "checkpoint.reopen_failed": "terminal",
+    "checkpoint.cwd_conflicts_restore": "terminal",
+    "checkpoint.already_exists": "terminal",
+    "checkpoint.execution_outcome_conflict": "terminal",
+    "steering.duplicate_input_id": "terminal",
+    "steering.invalid_content": "terminal",
+    "steering.queue_full": "terminal",
+};
+export function checkpointErrorDisposition(e) {
+    const word = Object.hasOwn(CHECKPOINT_ERROR_DISPOSITION, e.code) ? CHECKPOINT_ERROR_DISPOSITION[e.code] : undefined;
+    switch (word) {
+        case "cancelled":
+        case "retriable":
+        case "terminal":
+            return word;
+        case "by_reason":
+            return checkpointRowRedeemableElsewhere(e.detail?.reason) ? "retriable" : "terminal";
+        case undefined:
+            return "terminal";
+        default: {
+            const unhandled = word;
+            throw new Error(`unhandled checkpoint-error disposition: ${String(unhandled)}`);
+        }
+    }
+}
+const CHECKPOINT_ERROR_FIELD_ROLE = {
+    boundCallId: "binding",
+    boundInputHash: "binding",
+    answer: "answer",
+    hostDecision: "outcome_cell",
+    approver: "outcome_cell",
+    taskConfig: "config",
+    inheritedGate: "config",
+};
+const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(Object.keys(CHECKPOINT_ERROR_FIELD_ROLE).filter((f) => CHECKPOINT_ERROR_FIELD_ROLE[f] === "outcome_cell"));
 function notResumableAnswer() {
     return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
 }
 export function createResumeLegs(ctx) {
-    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
+    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
     async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
@@ -225,7 +281,7 @@ export function createResumeLegs(ctx) {
         const noteLateSettleIfAccepted = (out) => {
             if (lateSettleSink === undefined || lateSettleAnchor === undefined || out.status !== 200)
                 return;
-            if (out.body?.errorCode === "cancelled")
+            if (out.body?.errorCode === "cancelled" && out.decisionCommitted !== true)
                 return;
             try {
                 lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
@@ -472,7 +528,8 @@ export function createResumeLegs(ctx) {
         let resumeLegLive = false;
         const subagentHandleEvictions = [];
         let claimedRow = false;
-        const cancelCtrl = new AbortController();
+        const cancelCtrl = createRunAbort();
+        let cancelLedgerAppend;
         const preemptCtrl = new AbortController();
         if (taskId && deps.runStore) {
             claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
@@ -488,7 +545,7 @@ export function createResumeLegs(ctx) {
                 void rs.heartbeat(taskId, owner).catch(() => undefined);
                 if (!cancelCtrl.signal.aborted) {
                     void rs.isCancelRequested(taskId, owner).then((c) => { if (c)
-                        cancelCtrl.abort(); }).catch(() => undefined);
+                        cancelCtrl.abort("cancel_verb"); }).catch(() => undefined);
                 }
                 if (!preemptCtrl.signal.aborted) {
                     void rs.isPreemptRequested(taskId, owner).then((p) => { if (p)
@@ -531,6 +588,7 @@ export function createResumeLegs(ctx) {
                         instructionsSegment: instructionLeg.segment,
                     });
                     const vAppend = (type, data) => verifySink.append(type, data);
+                    cancelLedgerAppend = vAppend;
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
@@ -579,7 +637,9 @@ export function createResumeLegs(ctx) {
                             : {}),
                     };
                     resumeLegLive = true;
-                    const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
+                    const vrEngine = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
+                    const vrCause = cancelCtrl.cause();
+                    const vr = vrCause !== undefined && taskId !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: vrEngine, cause: vrCause }) : vrEngine;
                     await commitResumeCtx();
                     let safe = sealResultForExit(vr);
                     const vrNested = nestedPauseOf(vr.terminal);
@@ -622,6 +682,7 @@ export function createResumeLegs(ctx) {
                 const persistThinking = deps.config.traceThinking;
                 const serialAppend = createSerialLedgerAppend((s, type, data) => rs.appendEvent(taskId, s, type, data), startSeq);
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
+                cancelLedgerAppend = append;
                 unregisterEngineNotice = registerEngineNoticeLeg({
                     sessionId,
                     ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
@@ -715,9 +776,13 @@ export function createResumeLegs(ctx) {
                     if (!taskId || !rs)
                         return sealResultForExit(await stream.result());
                     onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
+                    let causeAtDone;
                     for await (const ev of stream) {
+                        if (ev.type === "done")
+                            causeAtDone = cancelCtrl.cause();
                         recordTurnActivity(taskId);
                         fleetPub?.onEvent(ev);
+                        await deps.userInputLedger?.observeLegEvent(stream, ev);
                         await appendPromptManifest(append, deps.promptManifests, taskId);
                         switch (ev.type) {
                             case "text_delta":
@@ -823,7 +888,8 @@ export function createResumeLegs(ctx) {
                         }
                     }
                     await flush();
-                    const r = await stream.result();
+                    const rEngine = await stream.result();
+                    const r = causeAtDone !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: rEngine, cause: causeAtDone }) : rEngine;
                     const rPark = r.terminal.kind === "paused" ? outwardPlane(r.terminal).status : undefined;
                     if (rPark === "suspended") {
                         const parkCallId = await parkToolCallId(r, deps.checkpointStore);
@@ -882,7 +948,8 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             if (e instanceof CheckpointError) {
-                if (e.code === "checkpoint.resume_aborted") {
+                const disposition = checkpointErrorDisposition(e);
+                if (disposition === "cancelled") {
                     const cs2 = deps.checkpointStore;
                     if (cs2) {
                         try {
@@ -898,25 +965,17 @@ export function createResumeLegs(ctx) {
                         }
                     }
                     if (claimedRow && taskId && deps.runStore) {
-                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: e.message });
+                        const handleCause = cancelCtrl.cause();
+                        if (handleCause === undefined)
+                            recordFailOpen("server.runs.abort-cause-missing", `task=${taskId} arm=resume-aborted`);
+                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: e.message, cause: handleCause ?? "cancel_verb" });
+                        await cancelLedgerAppend?.("failed", buildCancelledLedgerRow(c)).catch((err) => recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-append-resume-aborted ${errorText(err)}`));
                         await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch(() => undefined);
                     }
                     settleFleet("failed");
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
                 }
-                const retriable = e.code === "checkpoint.invalid_outcome" ||
-                    e.code === "checkpoint.reopen_revote" ||
-                    e.code === "checkpoint.reopened_concurrently" ||
-                    e.code === "resume.parent_constraint_missing" ||
-                    e.code === "resume.parent_constraint_mismatch" ||
-                    e.code === "resume.constraint_rejected" ||
-                    e.code === "resume.constraint_unprojectable" ||
-                    e.code === "resume.usage_window_exhausted" ||
-                    e.code === "resume.principal_mismatch" ||
-                    e.code === "resume.placement_mismatch" ||
-                    e.code === "resume.preflight_rejected" ||
-                    e.code.startsWith("wake.") ||
-                    (e.code === "checkpoint.unsupported_version" && checkpointRowRedeemableElsewhere(e.detail?.reason));
+                const retriable = disposition === "retriable";
                 if (claimedRow && taskId && deps.runStore) {
                     if (retriable && freshRunClaimed) {
                         const c = { taskId, sessionId, terminal: { kind: "failed", code: e.code, message: e.message }, stats: { turns: 0, tokens: 0, usageMissing: true } };
@@ -953,9 +1012,11 @@ export function createResumeLegs(ctx) {
                     },
                 };
             }
-            if (cancelCtrl.signal.aborted) {
+            const thrownCause = cancelCtrl.cause();
+            if (thrownCause !== undefined) {
                 if (taskId && deps.runStore) {
-                    const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user" });
+                    const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", cause: thrownCause });
+                    await cancelLedgerAppend?.("failed", buildCancelledLedgerRow(c)).catch((err) => recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-append-thrown-cancel ${errorText(err)}`));
                     await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
                 }
                 settleFleet("failed");
@@ -1002,6 +1063,7 @@ export function createResumeLegs(ctx) {
         settleFleet(checkpointReopened ? "suspended" : resumePlane.status, fleetRunResiduals(sealed));
         return {
             status: 200,
+            decisionCommitted: true,
             body: {
                 taskId, sessionId, status: resumePlane.status,
                 bindingEnforced: true,
@@ -1188,7 +1250,7 @@ export function createResumeLegs(ctx) {
             return resolved.answer;
         const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        return driveResumeIntoRunLog({
+        return buildHostLegOutcome(await driveResumeIntoRunLog({
             runner: runnerFor(spec),
             token,
             sessionId: cp.sessionId,
@@ -1205,7 +1267,7 @@ export function createResumeLegs(ctx) {
             ...(req !== undefined ? { callerInitiated: true } : {}),
             ...(workflowParkedResume !== undefined ? { workflowParkedResume } : {}),
             ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
-        });
+        }));
     }
     async function preparePlanReview(sessionId, log, decider) {
         const cs = deps.checkpointStore;
@@ -1301,7 +1363,7 @@ export function createResumeLegs(ctx) {
     }
     const routeCtxBase = {
         deps,
-        registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
+        registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview },

package/dist/http/route-ctx.d.ts

@@ -26,12 +26,15 @@ import type { SessionsLocal } from "./routes/sessions.js";
 import type { SessionSyncLocal } from "./routes/session-sync.js";
 import type { PlanApprovePermissionModeAfter } from "../task-settings.js";
 import type { VerifyRoundsSpec } from "./verify-rounds.js";
-/** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。 */
+import type { RunAbort } from "../run-cancel-context.js";
+/** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
+ *  S-947:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
+ *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
 export interface RunRegistry {
     idemCache: IdempotencyCache<SubmitOutcome>;
-    inflightRuns: Map<string, AbortController>;
+    /** 本副本在飞的 durable 腿 → 它的中止句柄(取消动词的同副本快路在这里按 `cancel_verb` 中止它)。 */
+    inflightRuns: Map<string, RunAbort>;
     preemptableRuns: Map<string, AbortController>;
-    cancelledViaVerb: Set<string>;
     steerableRuns: Map<string, TaskStream>;
     wakeParkMints: Map<string, Promise<void>>;
     /** 裸 number 的登记簿(`let` 拆不出闭包)—— 装进盒子才能跨模块自增/自减。 */
@@ -69,8 +72,10 @@ export interface RouteHelpers {
     usageWindowDenied(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
     safeDecode(seg: string): string | null;
     isFleetWide(req: IncomingMessage): boolean;
-    /** 属主门。`notFoundForm` 选 not-yours 臂的 404 拼法:缺省 `"run"`(not_found.run 长文,[ref]);session
-     *  资源面传 `"session"`(not_found.session + "session not found")与其 unknown 臂同码同串(G52 [ref])。 */
+    /** 属主门。`notFoundForm` 选 not-yours 臂的 404 拼法:缺省 `"run"`(not_found.run 长文,[ref]);**每一个 session
+     *  资源面都必须传 `"session"`**(not_found.session + {@link SESSION_NOT_FOUND_MESSAGE})与其 unknown 臂同码同串
+     *  (G52 [ref];S-989 补上了 detail / head / events 三个读口 —— 它们此前吃缺省 "run",单端点内 unknown / not-yours
+     *  两臂码与串都不同)。缺省 `"run"` 的语义不变:run 面不传。 */
     runOwnerOk(req: IncomingMessage, res: ServerResponse, owner: string | null, notFoundForm?: "run" | "session"): boolean;
     sessionOwnerScope(req: IncomingMessage): {
         fleetWide: boolean;
@@ -380,15 +385,9 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<{
-        status: number;
-        body: object;
-    }>;
+    }): Promise<ResumeLegOutcome>;
     /** 全 resume 家族的共同下半场(lease admission + 写 run log + fleet 发布)。 */
-    driveResumeIntoRunLog(args: DriveResumeArgs): Promise<{
-        status: number;
-        body: object;
-    }>;
+    driveResumeIntoRunLog(args: DriveResumeArgs): Promise<ResumeLegOutcome>;
     /** assistant 抢占腿的复位(gate-kind 守卫 + 行级属主复核 + 驱动)。 */
     resumePreempted(sessionId: string, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/resume` 腿传 `true`。 */
@@ -411,10 +410,7 @@ export interface RouteLegs {
      *  顶注)。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道的专用席,而两条腿共用这一条驱动
      *  路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿、不自建第二条驱动
      *  路径」的成文纪律。 */
-    workflowParkedResume?: DriveResumeArgs["workflowParkedResume"]): Promise<{
-        status: number;
-        body: object;
-    }>;
+    workflowParkedResume?: DriveResumeArgs["workflowParkedResume"]): Promise<HostLegOutcome>;
     /**
      * assistant plan_review 三态腿的**纯读段**(S-609,7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
      * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
@@ -628,6 +624,49 @@ export type RouteDecl = RouteDispatchDecl | RouteGateDecl;
  * 两臂逐字节同形,指路价值不丢。钉=audit-fixes-http「[ref]」格(两臂全文比对);文案变更走
  * api-error-text-freeze 基线流程。
  */
+/**
+ * resume 家族**引擎腿**的结局:HTTP 应答(`status` / `body`)+ 一位**进程内**事实(不上 wire)。workflow 宿主腿的结局另型({@link HostLegOutcome}),并集 = {@link ResumeLegOutcome}。
+ *
+ * `decisionCommitted` —— **这条腿的终局是在引擎受理了这次决定之后才结出来的**([ref] X5,7.112.0):本腿走到了「引擎交回结果」那一步
+ * (`resumeStream` / `resumeWithVerification` 解析 = core 的全部 pre-CAS 门 + checkpoint resolve CAS 都过了 —— 受理点的判据属主
+ * = {@link DriveResumeArgs.acceptEarly} 顶注),之后才收场。只由 `driveResumeLeg` 走完引擎那一步的终局出口铸;`CheckpointError` 臂、
+ * 「中止抛穿」臂、一切 4xx / 拒绝出口一律**不铸**(缺席 ⇒ 证不出提交,读者按「没提交」读 —— fail-closed)。
+ *
+ * 读者:`/decide` 的两道「这次决定提交了没有」门 —— [ref] 迟到结算留痕(`noteLateSettleIfAccepted`)与 remember 豁免落店
+ * (`routes/approvals-assistant.ts`)。它们原先只读 wire 体的 `errorCode !== "cancelled"`(「取消 = 决定没提交」),S-947 给续跑腿补了
+ * 「引擎受理之后才被取消」的取消终局之后,`cancelled` 不再等价「没提交」⇒ 两门改读本位:`200 ∧ (errorCode≠cancelled ∨ decisionCommitted)`。
+ * 🔴 为什么不放进 `result.cancelContext`(主会话初稿的落点):那只快照的契约是「分诊材料,不是状态机输入:任何门 / CAS / resume 判定都不许
+ * 读它」(`plugins/store-contracts.ts` `RunCancelContext` 顶注)—— 这两道门正是判定;而且门读的是 `/decide` 的平面体、看不到结果对象。
+ * 受理与否是腿自己的控制流事实,在腿上说,零 wire 变更。
+ */
+export interface EngineLegOutcome {
+    status: number;
+    body: object;
+    decisionCommitted?: true;
+}
+/**
+ * **workflow 宿主腿的结局(wake / fresh)—— 型上就没有 `decisionCommitted`**(S-992 ②,7.113.0;`never` 让「这条路径不铸」成为**编译事实**,不是靠人记)。
+ *
+ * 为什么这条路径不该有该位:`/decide` 的 workflow 第三条车道(`resumeCheckpoint` 的 parked 分流,`planWorkflowParkedDecide` 之后)与 `POST /v1/sessions/:id/wake`
+ * 把决定 / 消息交给**宿主会话的下一跑**(`resumeWake` / `startFreshHostTurn`)。它们的 200 只到「已交给宿主的下一跑」—— 子代 checkpoint 的 resolve CAS 发生在
+ * workflow 引擎自己驱动那一步,server 观察不到(`resume-legs.ts` 该分流处「刻意不落 `late_settle`」同源)。「这次决定被引擎受理了」这句话在这里**没有可说的对象**,
+ * 于是 `decisionCommitted` 在这条路径上语义含混(修前:`resumeWake` 的收尾是 `driveResumeIntoRunLog` 的 `ResumeLegOutcome`,非受理点早返形(无 `acceptEarly`)下它会把
+ * 引擎腿的 `decisionCommitted:true` 原样带出去 —— 型被声明返回型 `{status, body}` 擦掉了,运行期仍在)。读者核实:两道提交门(`noteLateSettleIfAccepted` 迟到结算留痕、
+ * `/decide` 的 remember 豁免落店)在这条路径上今天**零读取**(前者该分流直接 `return`、不调;后者的 `pendingGrant` 只由引擎腿的 `onResumeCommitted` 回调置位,宿主腿不调它,且 `planWorkflowParkedDecide` 对 workflow 车道的 `remember` 本就 fail-closed 拒 —— `decide.workflow_remember_unsupported`,`parked-decide.ts`)——
+ * 无读者 ⇒ 剥掉该位,而不是留一个「铸了也没人读、读了不知道什么意思」的位。出口经 {@link buildHostLegOutcome} 只带 `status` / `body`。
+ */
+export interface HostLegOutcome {
+    status: number;
+    body: object;
+    decisionCommitted?: never;
+}
+/** resume 家族一条腿的结局:引擎腿(可带 `decisionCommitted`)∪ workflow 宿主腿(型上没有)。`out.decisionCommitted === true` 同时收窄到引擎腿。 */
+export type ResumeLegOutcome = EngineLegOutcome | HostLegOutcome;
+/** 把任意腿的结局折成宿主腿结局:**只带 `status` / `body`**(丢掉引擎腿的 `decisionCommitted` —— 见 {@link HostLegOutcome})。纯数据。 */
+export declare function buildHostLegOutcome(out: {
+    status: number;
+    body: object;
+}): HostLegOutcome;
 /**
  * **「决定/续跑已受理」那一枚 200 收据的单一铸点**(S-218)。
  *
@@ -643,6 +682,14 @@ export declare function acceptedResumingReceipt(taskId: string, sessionId: strin
     body: object;
 };
 export declare const RUN_NOT_FOUND_MESSAGE = "run not found \u2014 the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
+/**
+ * 会话资源面 404 的**唯一一句**(与 {@link RUN_NOT_FOUND_MESSAGE} 同一冻结纪律,常量锚在 `test/api-error-text-freeze.test.ts`)。
+ *
+ * 为什么是常量不是各点字面量:这句话要在**每一个**会话面的「不存在」臂与「非属主」臂上逐字节同串(G52 [ref] /
+ * S-989 —— 两臂差一个码或一个字就是单端点内的存在性 oracle)。十余个出站点各抄一份,漂开的那天没有任何东西会说话;
+ * 走一只常量 + `runOwnerOk(..., "session")` 的会话拼法,「改一处」就是改全域。
+ */
+export declare const SESSION_NOT_FOUND_MESSAGE = "session not found";
 /** [ref] 前缀=域判别子既成契约:a\* 与 wa\* 形 id 给 TaskOutput/journal 指路;其余给 {@link RUN_NOT_FOUND_MESSAGE}。 */
 export declare function runNotFoundMessage(id: string): string;
 export {};

package/dist/http/route-ctx.js

@@ -21,10 +21,14 @@ export function assertNever(x) {
     throw new Error(`unreachable route id: ${String(x)}`);
 }
 export const ROUTE_METHOD_ORDER = ["GET", "POST", "PUT", "DELETE"];
+export function buildHostLegOutcome(out) {
+    return { status: out.status, body: out.body };
+}
 export function acceptedResumingReceipt(taskId, sessionId) {
     return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
 }
 export const RUN_NOT_FOUND_MESSAGE = "run not found — the id belongs to no run in this deployment's run store (a run from another server process, or an in-memory store that did not survive a restart, is not visible here)";
+export const SESSION_NOT_FOUND_MESSAGE = "session not found";
 export function runNotFoundMessage(id) {
     const aStar = /^(?:a|wa)[0-9a-f]{4,}$/i.test(id);
     return aStar

package/dist/http/routes/approvals-assistant.js

@@ -764,7 +764,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 : undefined;
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
-            if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
+            if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
                 try {
                     await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
                     rememberApplied = true;

package/dist/http/routes/background.js

@@ -5,7 +5,7 @@ import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
-import { assertNever } from "../route-ctx.js";
+import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 const LIST_LIMIT = 500;
 export const DESCRIPTION_MAX = 500;
 const ROW_KEY_DISPOSITION = {
@@ -65,7 +65,7 @@ export async function handleBackground(req, res, match, ctx) {
     }
     const owner = await deps.sessionStorage.ownerOf(sessionId);
     if (owner === undefined) {
-        sendError(res, 404, "not_found.session", "session not found");
+        sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
         return;
     }
     const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);

package/dist/http/routes/mcp-reconnect.js

@@ -4,7 +4,7 @@ import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import {} from "../route-ctx.js";
-import { assertNever } from "../route-ctx.js";
+import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 const NEUTRALIZED_TEXT_MAX = 200;
 const humanText = (s) => redactSecrets(s).slice(0, NEUTRALIZED_TEXT_MAX);
@@ -82,7 +82,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
             }
             const owner = await deps.sessionStorage.ownerOf(sessionId);
             if (owner === undefined) {
-                sendError(res, 404, "not_found.session", "session not found");
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
             const isOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);

package/dist/http/routes/notify-wake.js

@@ -2,7 +2,7 @@ import { taskNotificationInboxEntry } from "../../orchestration/workflow-complet
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
 import { sendResumeOutcome } from "../route-ctx.js";
-import { assertNever } from "../route-ctx.js";
+import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 export async function handleNotifyWake(req, res, match, ctx) {
     const { deps } = ctx;
     const { steerableRuns } = ctx.registry;
@@ -63,12 +63,12 @@ export async function handleNotifyWake(req, res, match, ctx) {
             }
             const notifyOwner = await deps.sessionStorage.ownerOf(notifySession);
             if (notifyOwner === undefined) {
-                sendError(res, 404, "not_found.session", "session not found");
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
             const notifyOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
             if (!notifyOperator && notifyOwner !== null && notifyOwner !== principal) {
-                sendError(res, 404, "not_found.session", "session not found");
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
             const payload = {

package/dist/http/routes/runs.js

@@ -146,9 +146,23 @@ async function acceptLiveUserInput(deps, res, at) {
         return "refused";
     }
 }
+async function relayAcceptedInput(deps, acceptance, call) {
+    let out;
+    try {
+        out = await call();
+    }
+    catch (e) {
+        if (acceptance !== undefined)
+            await deps.userInputLedger.withdraw(acceptance);
+        throw e;
+    }
+    if (acceptance !== undefined)
+        await deps.userInputLedger.confirm(acceptance);
+    return out;
+}
 export async function handleRuns(req, res, match, ctx) {
     const { deps } = ctx;
-    const { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints } = ctx.registry;
+    const { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints } = ctx.registry;
     const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
     const { prepareSpec } = ctx.legs;
     const source = ctx.req.source;
@@ -319,7 +333,7 @@ export async function handleRuns(req, res, match, ctx) {
             }
             const err = note;
             try {
-                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err });
+                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb" });
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {
@@ -368,10 +382,7 @@ export async function handleRuns(req, res, match, ctx) {
                 sendJson(res, 202, { taskId, status: now?.status ?? "failed", cancelRequested: now?.cancelRequested ?? false, note: "run already terminal — cancel is a no-op" });
                 return;
             }
-            if (inflightRuns.has(taskId)) {
-                cancelledViaVerb.add(taskId);
-                inflightRuns.get(taskId).abort();
-            }
+            inflightRuns.get(taskId)?.abort("cancel_verb");
             sendJson(res, 202, { taskId, status: "cancelling", cancelRequested: true });
         }
         else if (isParkedRunStatus(run.status)) {
@@ -484,13 +495,11 @@ export async function handleRuns(req, res, match, ctx) {
             if (acceptance === "refused")
                 return;
             try {
-                await live.steer(text, { trusted, ...(steerInputId !== undefined ? { inputId: steerInputId } : {}) });
+                await relayAcceptedInput(deps, acceptance, () => live.steer(text, { trusted, inputId: messageId }));
                 sendJson(res, 200, { taskId, status: "running", delivery: "applied", messageId, ...(priority ? { priority } : {}) });
                 return;
             }
             catch (e) {
-                if (acceptance !== undefined)
-                    await deps.userInputLedger.withdraw(acceptance);
                 const code = e.code;
                 if (code === "steering.invalid_content") {
                     sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
@@ -797,11 +806,9 @@ export async function handleRuns(req, res, match, ctx) {
         if (acceptance === "refused")
             return;
         try {
-            await liveStream.steer(text, { trusted, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) });
+            await relayAcceptedInput(deps, acceptance, () => liveStream.steer(text, { trusted, priority: "now", ...(interruptInputId !== undefined ? { inputId: interruptInputId } : {}) }));
         }
         catch (e) {
-            if (acceptance !== undefined)
-                await deps.userInputLedger.withdraw(acceptance);
             const code = e.code;
             if (code === "steering.invalid_content") {
                 sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : "invalid steering content");
@@ -1155,7 +1162,6 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const handle = resolution?.handle;
         if (handle) {
-            let acceptance;
             try {
                 if (verb === "resume") {
                     if (!handle.resume) {
@@ -1172,11 +1178,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     return;
                 }
                 const messageId = uuidv7();
-                const accepted = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle });
-                if (accepted === "refused")
+                const acceptance = await acceptLiveUserInput(deps, res, { messageId, sessionId: run.sessionId, taskId: runId, leg: handle });
+                if (acceptance === "refused")
                     return;
-                acceptance = accepted;
-                const marker = await handle.steer(redacted);
+                const marker = await relayAcceptedInput(deps, acceptance, () => handle.steer(redacted));
                 if (acceptance !== undefined) {
                     const ledger = deps.userInputLedger;
                     const settle = () => ledger.settleLeg(handle);
@@ -1186,8 +1191,6 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 return;
             }
             catch (e) {
-                if (acceptance !== undefined)
-                    await deps.userInputLedger.withdraw(acceptance);
                 const code = e.code;
                 if (code === "steering.not_running") {
                     send409(code, "sub-agent just finished — no longer accepting steers");

package/dist/http/routes/session-sync.js

@@ -12,7 +12,7 @@ const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
 const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
-import { assertNever } from "../route-ctx.js";
+import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import { readSessionRulesRecords, describeSessionRulesRecordProblem, legacyToolNameProblemOf } from "../../session-policy-wire.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
@@ -60,18 +60,18 @@ export async function handleSessionSync(req, res, match, ctx) {
             const ownsOrFleet = (o) => scope.fleetWide || o === scope.gateOwner;
             const pullGateOk = () => {
                 if (owner === undefined) {
-                    sendError(res, 404, "not_found.session", "session not found");
+                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return false;
                 }
                 if (!ownsOrFleet(owner)) {
-                    sendError(res, 404, "not_found.session", "session not found");
+                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return false;
                 }
                 return true;
             };
             const pushGateOk = () => {
                 if (owner !== undefined && !ownsOrFleet(owner)) {
-                    sendError(res, 404, "not_found.session", "session not found");
+                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return false;
                 }
                 return true;
@@ -89,7 +89,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     throw e;
                 }
                 if (out === null) {
-                    sendError(res, 404, "not_found.session", "session not found");
+                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
                 sendJson(res, 200, { manifest: out.manifest });
@@ -115,7 +115,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 const it = await stream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
                 if (it === null) {
-                    sendError(res, 404, "not_found.session", "session not found");
+                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
                 res.writeHead(200, { "content-type": "application/x-ndjson", "transfer-encoding": "chunked" });