@sema-agent/server 7.111.0 → 7.113.0

package/dist/plugins/approval-ask-store-file.js

@@ -54,7 +54,7 @@ export class FileApprovalAskStore {
     replayRejectedCount = 0;
     corruptLineCount = 0;
     corruptQuarantinePath;
-    constructor(root, opts) {
+    constructor(root) {
         const dir = join(root, APPROVAL_ASK_DIR);
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
@@ -62,7 +62,7 @@ export class FileApprovalAskStore {
         this.path = join(dir, APPROVAL_ASK_JOURNAL_FILE);
         this.core = new InMemoryApprovalAskStore({ now: () => this.clockRead() });
         const tornTail = existsSync(this.path) && !endsAtRecordBoundary(this.path);
-        const { records, skipped } = replayJsonlSkipping(this.path, "approval-ask-journal", ASK_JOURNAL_SHAPE, opts?.warn);
+        const { records, skipped } = replayJsonlSkipping(this.path, "approval-ask-journal", ASK_JOURNAL_SHAPE);
         this.corruptLineCount = skipped;
         for (const rec of records)
             this.replayRecord(rec);

package/dist/plugins/file-resume-anchor-store.d.ts

@@ -1,15 +1,10 @@
-import type { Logger } from "../observability/logger.js";
 export declare class FileResumeAnchorStore {
     private readonly dir;
     /** sessionId → (eventId → {entryId, owner}) — the same in-memory shape MemoryResumeAnchorStore holds, hydrated on ctor. */
     private readonly bySession;
     /** sessionId → the open append log (one O_APPEND fd per session, lazily opened on first put, held for lifetime). */
     private readonly logs;
-    private readonly warn;
-    /** @param opts.warn corrupt-read disclosure seat (S-582; absent ⇒ the replay owner falls back to `console.warn`). */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     /** `<dir>/<sanitizePathComponent(sessionId)>.jsonl` — the per-session log path (sessionId is uuidv7, already safe). */
     private pathFor;
     /** Replay every session log into the in-memory index on boot (torn-tail-safe via the replay owner; last-wins upsert

package/dist/plugins/file-resume-anchor-store.js

@@ -16,10 +16,8 @@ export class FileResumeAnchorStore {
     dir;
     bySession = new Map();
     logs = new Map();
-    warn;
-    constructor(root, opts) {
+    constructor(root) {
         this.dir = join(root, "resume-anchors");
-        this.warn = opts?.warn;
         ensureDir(this.dir);
         this.hydrate();
     }
@@ -38,7 +36,7 @@ export class FileResumeAnchorStore {
             if (!name.endsWith(".jsonl"))
                 continue;
             const key = name.slice(0, -".jsonl".length);
-            const { records } = replayJsonlSkipping(join(this.dir, name), "resume-anchor", ANCHOR_RECORD_SHAPE, this.warn);
+            const { records } = replayJsonlSkipping(join(this.dir, name), "resume-anchor", ANCHOR_RECORD_SHAPE);
             if (!records.length)
                 continue;
             const m = this.bySession.get(key) ?? new Map();

package/dist/plugins/file-run-store.d.ts

@@ -1,6 +1,5 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import type { Logger } from "../observability/logger.js";
 import { StoreBootRefusalError, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
@@ -46,12 +45,9 @@ export declare class FileRunStore {
     /** [ref] 件B(census 第 29 行终局):`RUN_STORE_STRICT_HYDRATE` 的**部署级**表态。
      *  `true` ⇒ hydrate 的 readdir 失败拒启;缺席/`false` ⇒ 件6 的记债腿,行为字节不变。 */
     private readonly strictHydrate;
-    /** S-582:三个盘面坏行的腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 重放属主退回 `console.warn`)。 */
-    private readonly corruptReadWarn;
     constructor(root: string, opts?: {
         error?(msg: string, fields?: Record<string, unknown>): void;
         strictHydrate?: boolean;
-        warn?: Logger["warn"];
     });
     private runDir;
     private runJsonPath;

package/dist/plugins/file-run-store.js

@@ -62,11 +62,9 @@ export class FileRunStore {
     claimLocks = new Map();
     logger;
     strictHydrate;
-    corruptReadWarn;
     constructor(root, opts) {
         this.logger = opts;
         this.strictHydrate = opts?.strictHydrate === true;
-        this.corruptReadWarn = opts?.warn;
         this.runsDir = join(root, "runs");
         this.activeDir = join(root, "runs", "active");
         this.tmpDir = join(root, "tmp");
@@ -137,7 +135,7 @@ export class FileRunStore {
         }
     }
     readRecords(path, shape) {
-        return replayJsonlSkipping(path, "run-store", shape, this.corruptReadWarn);
+        return replayJsonlSkipping(path, "run-store", shape);
     }
     refuseIfUnreadable(jsonPath, dir) {
         try {

package/dist/plugins/send-file-ledger.d.ts

@@ -1,7 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import type { IssuedFileLink } from "./send-user-file.js";
-import type { Logger } from "../observability/logger.js";
 /** Ledger scope sentinel for single-user issuance (no principal) — mirrors scopeSegment's "_" key segment. */
 export declare const SENDFILE_SINGLE_USER_SCOPE = "_";
 export interface SendFileLedgerEntry {
@@ -48,10 +47,7 @@ export declare class FileSendFileLedger implements SendFileLedger {
     private readonly path;
     private readonly mem;
     private log;
-    /** @param opts.warn corrupt-read disclosure seat (S-582; absent ⇒ the replay owner falls back to `console.warn`). */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     record(entry: SendFileLedgerEntry): Promise<void>;
     listByScope(scope: string, limit: number, beforeId?: string): Promise<SendFileLedgerEntry[]>;
     /** Release the append-log fd (LocalBackend.close → graceful-restart re-open). */

package/dist/plugins/send-file-ledger.js

@@ -80,11 +80,11 @@ export class FileSendFileLedger {
     path;
     mem = new MemorySendFileLedger();
     log;
-    constructor(root, opts) {
+    constructor(root) {
         const dir = join(root, "sendfile-ledger");
         ensureDir(dir);
         this.path = join(dir, "links.jsonl");
-        for (const r of replayJsonlSkipping(this.path, "send-file-ledger", LEDGER_ROW_SHAPE, opts?.warn).records)
+        for (const r of replayJsonlSkipping(this.path, "send-file-ledger", LEDGER_ROW_SHAPE).records)
             void this.mem.record(r);
     }
     async record(entry) {

package/dist/plugins/store-backend.js

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { buildDurableAbsenceNote, createCorruptReadSeat } from "../observability/corrupt-read-seat.js";
+import { createCorruptReadFailOpenSeat, createDurableAbsenceSeat } from "../observability/corrupt-read-seat.js";
 import { join } from "node:path";
 import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
@@ -230,7 +230,7 @@ class LocalBackend {
             this.fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
                 root,
                 ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
-                onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "file_store_corrupt_read", buildDurableAbsenceNote("file-history = a rewind boundary or scope read as missing")),
+                onCorruptRead: createDurableAbsenceSeat((msg, fields) => this.discloseWarn(msg, fields), root, "file-history = a rewind boundary or scope read as missing"),
             }), config.storeLockWaitMs, (fields) => this.onWarn?.("store_dir_lock_wait", { ...fields }));
         }
         catch (e) {
@@ -241,22 +241,21 @@ class LocalBackend {
                 (tail === undefined ? "" : ` ${tail}`));
         }
         this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root, {
-            onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "session_repo_corrupt_read", undefined, noteReplayInSessionOpenScope),
+            onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInSessionOpenScope),
         }), this.fileBackend.root);
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
             strictHydrate: config.runStoreStrictHydrate,
-            warn: corruptReadWarn,
         });
-        this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root, { warn: corruptReadWarn });
+        this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
         this.approvalExemptionStore = new FileApprovalExemptionStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.approvalNonceStore = new FileApprovalNonceStore(this.fileBackend.root, { warn: corruptReadWarn });
-        this.approvalAskStore = new FileApprovalAskStore(this.fileBackend.root, { warn: corruptReadWarn });
-        this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root, { warn: corruptReadWarn });
-        this.userInputLedgerStore = new FileUserInputLedgerStore(this.fileBackend.root, { warn: corruptReadWarn });
+        this.approvalAskStore = new FileApprovalAskStore(this.fileBackend.root);
+        this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root);
+        this.userInputLedgerStore = new FileUserInputLedgerStore(this.fileBackend.root);
         this.workflowJournalStore = new FileWorkflowJournalStore(this.fileBackend.root, undefined, {
-            onCorruptRead: createCorruptReadSeat((msg, fields) => this.discloseWarn(msg, fields), "workflow_journal_corrupt_read"),
+            onCorruptRead: createCorruptReadFailOpenSeat("server.workflow-journal.corrupt-record-skipped"),
         });
         this.outcomeSinkInst = new FileOutcomeSink(this.fileBackend.root);
         const ownControlDir = fileMemoryControlDirFor(config);

package/dist/plugins/store-contracts.d.ts

@@ -94,16 +94,49 @@ export interface RunCancelContext {
     elapsedMs?: number;
 }
 /**
- * 落库/上 wire 的终局结果 = core 的 `TaskResult` **加上** server 自铸的可缺席侧记键。
+ * 🔴 S-947(cli [ref] 第 3 件 / L-212)—— **server 为什么中止了这条 run**:取消终局的机读成因,闭集。
  *
- * 今天只有一个成员({@link RunCancelContext});additive 且可缺席,所以旧行、旧消费端逐字不受影响
- * (`TaskResult` 仍可原样赋给本型)。⚠️ 这不是给「往 core 结果里塞私货」开的口子:每加一个键都要能
- * 回答「为什么它属于 run 账本而不属于 core 的任务结果」——`cancelContext` 的答案是它描述的是
- * **server 侧的取消现场**,core 那一侧根本不知道有人按了取消。
+ * 病:非 detach 流断连、`POST /v1/runs/:id/cancel`、断连时有 ask 但 park 宽限用尽 —— 三件事在终局上**逐字同形**
+ * (`failed` + `terminal.code:"cancelled"`),壳只能按 `errorMessage` 文案猜。
+ *
+ * 每个词都必须有一个**真站点**(没有站点的词不许进表;普查与站点坐标见契约 §5.0d):
+ *  · `client_disconnected`      —— 非 detach 的 `POST /v1/tasks/stream` 客户端断连,断连那一刻本 run 没有流内未决 ask
+ *                                  (`http/routes/tasks.ts` 的断连臂,立即中止);
+ *  · `ask_park_grace_exhausted` —— 同一断连臂,但断连那一刻有流内未决 ask、已按窗到期同路转 park,宽限计时器用尽时 park 仍没落成;
+ *  · `cancel_verb`              —— `POST /v1/runs/:id/cancel`:同副本快路、跨副本耐久取消旗的轮询(四条腿的心跳 / 登记追平),
+ *                                  以及 park 中的 run 被它直接终局化(那一形不经 abort,成因照样是这条动词)。
+ * **刻意不在表里**(普查过、没有真站点):抢占(`preempt` 是优雅让出,终局是 `paused`,不是取消)、有序关停
+ * (S-929 只把未决卡转 park,从不中止活 run;进程退出后的行由收割器落「持有者死亡」判决,那不是本仓铸的取消终局)、
+ * `interrupt`(引擎的 turn 动词,终局 `completed` + `haltedByUser`)、detach 断连(不中止)。
+ *
+ * 词表属主 = 本文件(与它所在的 {@link PersistedTaskResult} 同住);**单写者** = `run-cancel-context.ts` 的 `createRunAbort`
+ * (中止那一刻登记)与 `mintCancelledResult`(终局铸点读它),自铸 wire 值登记 = `trace/self-minted-wire.ts` 的 `abortCause`
+ * (`satisfies Record<AbortCause, …>`:加 / 删一个词而登记没跟 ⇒ tsc 红)。
  */
-export type PersistedTaskResult = TaskResult & {
+export declare const ABORT_CAUSES: readonly ["client_disconnected", "ask_park_grace_exhausted", "cancel_verb"];
+export type AbortCause = (typeof ABORT_CAUSES)[number];
+/**
+ * server 自铸、挂在终局结果上的**侧记键**全集(都描述「server 这一侧发生了什么」,core 那一侧无从知道)。
+ * 本型是这一族键的**唯一登记处**(`trace/core-keyset-guard.ts` 的辖域线指向这里;那边另有一道编译期钉:
+ * core 的 `TaskResult` 哪天长出同名键 ⇒ 当场红 —— 同一个键两个铸者是本型存在要防的那件事)。
+ *  · `cancelContext`([ref])—— 取消现场快照(分诊材料:多久没动静、起跑多久);
+ *  · `abortCause`(S-947)—— 这次取消是谁 / 什么发起的({@link AbortCause})。
+ * 两键**同一只铸点**(`mintCancelledResult`)、**同一条在场闸**(「只补空座」:终局就是被那次中止打断的那一条,
+ * 才挂;与中止赛跑跑完的终局、引擎自带码的失败一律原样立住、两键都不挂)。差别只在缺席纪律:快照一键都证不出 ⇒ 整只缺席;
+ * 成因在铸点那一刻恒已知 ⇒ 取消终局上恒在场。
+ */
+export interface PersistedResultSideKeys {
     cancelContext?: RunCancelContext;
-};
+    abortCause?: AbortCause;
+}
+/**
+ * 落库/上 wire 的终局结果 = core 的 `TaskResult` **加上** server 自铸的可缺席侧记键({@link PersistedResultSideKeys})。
+ *
+ * additive 且可缺席,所以旧行、旧消费端逐字不受影响(`TaskResult` 仍可原样赋给本型)。⚠️ 这不是给「往 core 结果里塞私货」
+ * 开的口子:每加一个键都要能回答「为什么它属于 run 账本而不属于 core 的任务结果」—— 两键的答案都是它们描述的是
+ * **server 侧的取消现场**,core 那一侧根本不知道有人按了取消、谁按的。落点 = `result` JSON 列(三孪生整只存),**零新列**。
+ */
+export type PersistedTaskResult = TaskResult & PersistedResultSideKeys;
 /**
  * 🔴 run 店「持有它的实例丢了」那一判的**行上落款**(S-928 codex r1-F1 提为常量):三只 run 店的 `reapStale` 把心跳过期的 running 行翻成
  * `failed` 并写下这一句。它是 run 店死亡判决留在行上的证据之一(另一只 = {@link RUN_ORPHANED_ERROR})—— 用户输入受理账本的收敛判词

package/dist/plugins/store-contracts.js

@@ -1,5 +1,6 @@
 export class StoreBootRefusalError extends Error {
 }
+export const ABORT_CAUSES = ["client_disconnected", "ask_park_grace_exhausted", "cancel_verb"];
 export const RUN_STALLED_ERROR = "run stalled (instance lost?)";
 export const RUN_ORPHANED_ERROR = "run orphaned by engine restart";
 export function buildRunOrphanedError(heldBy) {

package/dist/plugins/user-input-ledger-file.d.ts

@@ -1,4 +1,3 @@
-import type { Logger } from "../observability/logger.js";
 import { UserInputLedgerFold, type NewUserInputAcceptance, type OpenScanCursor, type OpenScanPage, type SettleHow, type UserInputAcceptance, type UserInputLedgerRecord, type UserInputLedgerStore } from "../user-input-ledger.js";
 /** 账本文件名(取证按文件字节对账 —— 崩溃语义的真源是文件)。 */
 export declare const USER_INPUT_LEDGER_FILE = "ledger.jsonl";
@@ -24,10 +23,7 @@ export declare class FileUserInputLedgerStore extends MemoryUserInputLedgerStore
     /** 账本绝对路径。 */
     readonly path: string;
     private log;
-    /** @param opts.warn 腐读披露座(缺席 ⇒ 重放属主退回 `console.warn`)。 */
-    constructor(root: string, opts?: {
-        warn?: Logger["warn"];
-    });
+    constructor(root: string);
     protected persist(rec: UserInputLedgerRecord): void;
     /** 收追加口(LocalBackend.close → 优雅重启重开)。core `AppendLog.close()` 自己吞 `closeSync` 的错,不抛。 */
     dispose(): void;

package/dist/plugins/user-input-ledger-file.js

@@ -88,12 +88,12 @@ const RECORD_SHAPE = {
 export class FileUserInputLedgerStore extends MemoryUserInputLedgerStore {
     path;
     log;
-    constructor(root, opts) {
+    constructor(root) {
         super();
         const dir = join(root, USER_INPUT_LEDGER_DIR);
         ensureDir(dir);
         this.path = join(dir, USER_INPUT_LEDGER_FILE);
-        for (const rec of replayJsonlSkipping(this.path, "user-input-ledger", RECORD_SHAPE, opts?.warn).records)
+        for (const rec of replayJsonlSkipping(this.path, "user-input-ledger", RECORD_SHAPE).records)
             this.fold.apply(rec);
     }
     persist(rec) {

package/dist/run-cancel-context.d.ts

@@ -1,4 +1,4 @@
-import type { PersistedTaskResult, RunCancelContext } from "./plugins/store-contracts.js";
+import type { AbortCause, PersistedTaskResult, RunCancelContext } from "./plugins/store-contracts.js";
 /**
  * @param taskId  这条 run 的账本 id(turn 活性登记的键)。
  * @param startedAtMs 这条 run 起跑的墙钟时刻(epoch ms):取消腿手上有行就用行的 `createdAt`,
@@ -43,11 +43,23 @@ export declare const CANCELLED_CODE = "cancelled";
  *  · `cancelContext`:已经有快照就不重铸(重铸会把「上一条引擎事件多久以前」重新计时)。
  *
  * ## 为什么不判「这条 failed 是不是 abort 形」
- * 判据在**调用点**:调用点问的是「本腿这次是不是被取消动词打中了」(`cancelCtrl.signal.aborted` /
- * `cancelledViaVerb`),那是 server 自己的事实。让本函数去嗅 `terminal.message` 的字面就是再造事实
+ * 判据在**调用点**:调用点问的是「本腿这次是不是被 server 中止了」—— 本腿 {@link RunAbort} 句柄上登记的成因
+ * (`cause()` 在场),那是 server 自己的事实。让本函数去嗅 `terminal.message` 的字面就是再造事实
  * —— [ref] 二那次事故的同一个形。
+ *
+ * ## S-947:成因(`abortCause`)与码、快照**同进同退**
+ * `cause` 是**必填**:本函数是 server 铸取消终局的唯一出口,而每一次取消都有一个发起者 ⇒ 「本仓铸的取消终局上恒有
+ * `abortCause`」由签名保证,不靠调用方记得。它走与补码、补快照**同一条**空座闸 —— 引擎给的终局不是无码的 failed
+ * (与中止赛跑跑完了 / 引擎自带码)⇒ 整只原样返回,成因也不挂(那条终局不是这次中止的结果,挂上就是「完成了却带着取消便签」)。
  */
-export declare function mintCancelledResult(args: {
+export declare function mintCancelledResult<R extends PersistedTaskResult>(args: CancelMintArgs & {
+    engineResult: R;
+}): R;
+export declare function mintCancelledResult(args: CancelMintArgs & {
+    engineResult?: undefined;
+}): PersistedTaskResult;
+/** {@link mintCancelledResult} 的公共实参(`engineResult` 另列:在场与否决定返回型)。 */
+interface CancelMintArgs {
     /** 这条 run 的账本 id(活性登记的键;账本不在场时给空串,快照按「证不出」处理)。 */
     taskId: string;
     /** 会话 id(合成形要写进结果;引擎给了结果时不用)。 */
@@ -56,7 +68,47 @@ export declare function mintCancelledResult(args: {
     startedAtMs: number;
     /** 合成形的失败文案(引擎给了终局时不用)。 */
     message: string;
-    /** 引擎给出的终局(在场 ⇒ 在它之上补标)。 */
-    engineResult?: PersistedTaskResult;
-}): PersistedTaskResult;
+    /** S-947:这次取消的发起者(本腿 {@link RunAbort} 句柄上登记的那一个;park 中直接终局化的取消动词给 `"cancel_verb"`)。 */
+    cause: AbortCause;
+}
+/**
+ * S-947 —— 没有 `done` 可落的取消形在账本上的那一行(`failed`):**从铸好的取消终局投影**,不手抄。
+ *
+ * 账本 `failed` 行是平面形(`errorMessage` / `errorCode` 顶层),所以成因也在顶层、与 `errorCode` 并列;有 `done` 可落的
+ * 那几形,成因随 `done.result` 走(结果本身带它)。两形同一个来源 = 同一只取消终局,不是两处各写一份。
+ * 返回纯数据 ⇒ `build*`。
+ */
+export declare function buildCancelledLedgerRow(c: PersistedTaskResult): {
+    errorMessage?: string;
+    errorCode?: string;
+    abortCause?: AbortCause;
+};
+/**
+ * S-947 —— 一条 run 腿的**中止句柄**:server 中止这条腿的唯一入口,也是「为什么中止」的唯一登记处。
+ *
+ * ## 为什么是句柄、不是一张按 taskId 键控的表
+ * 修前这件事由 `cancelledViaVerb: Set<taskId>`(「这次是取消动词」一个词)+ 各腿手写的生命周期(登记 / finally 里按身份守卫删 /
+ * 同步腿「删之前先取」)承担:一个键控在 **taskId** 上的旁表,要防的病都来自键与腿不同寿 —— 快速续跑在旧腿 finally 之前
+ * 用同一 taskId 登记新腿、旧腿收尾删掉新腿的条目;同步腿必须在删之前取值。成因挂在**腿自己的中止控制器**上之后,
+ * 这些规则一条都不需要:句柄与腿同寿,换腿就是换句柄,没有可删、可串、可漏的旁表。
+ *
+ * ## 先到先得(first-writer-wins)
+ * 第一次 `abort(cause)` 生效并登记成因;之后的调用全是 no-op(信号早已中止,成因不改写)—— 断连之后又到了取消动词、
+ * 取消之后又断连,终局说的都是**真正让这条腿停下来**的那一个。`AbortController.abort()` 自身就是幂等的,本句柄只是在
+ * 「第一次」那一刻把词记下。
+ *
+ * ## 引擎看到的东西不变
+ * 中止走 `AbortController.abort()` 的默认原因(引擎、provider 的 fetch、子进程看到的仍是标准 `AbortError`)—— 成因**不**塞进
+ * `signal.reason`:那会改掉引擎与 provider 层收到的拒绝值,是在下游改上游接缝的输入(立宪禁区)。
+ */
+export interface RunAbort {
+    /** 交给引擎的那只信号(`spec.signal` / 审批 / 提问 ALS 的 `abortSignal` / 子代 stoppedBy 归因都用它)。 */
+    readonly signal: AbortSignal;
+    /** 以 `cause` 中止本腿。已中止 ⇒ no-op(成因不改写)。 */
+    abort(cause: AbortCause): void;
+    /** 让本腿停下来的那次中止的成因;未中止 ⇒ `undefined`。 */
+    cause(): AbortCause | undefined;
+}
+export declare function createRunAbort(): RunAbort;
+export {};
 //# sourceMappingURL=run-cancel-context.d.ts.map

package/dist/run-cancel-context.js

@@ -23,6 +23,7 @@ export function mintCancelledResult(args) {
             ...engine,
             terminal: { ...engine.terminal, code: CANCELLED_CODE },
             ...(engine.cancelContext === undefined && ctx !== undefined ? { cancelContext: ctx } : {}),
+            abortCause: args.cause,
         };
     }
     return {
@@ -32,6 +33,31 @@ export function mintCancelledResult(args) {
         result: "",
         stats: { turns: 0, tokens: 0, usageMissing: true },
         ...(ctx ? { cancelContext: ctx } : {}),
+        abortCause: args.cause,
+    };
+}
+export function buildCancelledLedgerRow(c) {
+    const t = c.terminal;
+    return {
+        ...(t.kind === "failed" && t.message !== undefined ? { errorMessage: t.message } : {}),
+        ...(t.kind === "failed" && t.code !== undefined ? { errorCode: t.code } : {}),
+        ...(c.abortCause !== undefined ? { abortCause: c.abortCause } : {}),
+    };
+}
+export function createRunAbort() {
+    const ctrl = new AbortController();
+    let landed;
+    return {
+        signal: ctrl.signal,
+        abort(cause) {
+            if (ctrl.signal.aborted)
+                return;
+            landed = cause;
+            ctrl.abort();
+        },
+        cause() {
+            return landed;
+        },
     };
 }
 //# sourceMappingURL=run-cancel-context.js.map

package/dist/run-local.d.ts

@@ -142,7 +142,7 @@ export interface LocalApproverIo {
  *  · **人答 N**(TTY 臂)⇒ 裸 `false` —— core 契约里这就是「一个人拒了」(`human_refused` / `who.party:"person"`,模型读「用户不想继续,
  *    停下来等他」,run 以 `haltedOnUserRejection` 停批);
  *  · **没有人被问**(无 TTY 臂 / 参数展示不出臂)⇒ 部署政策拒对象 {@link UnattendedPolicyRefusal}(经与协调器 deny 政策臂**同一只**构造
- *    `buildUnattendedPolicyRefusal`;core 7.37.1 `readApproverOutcomeObject` ⇒ `policy_refused` / `who.party:"none"`,模型读 core 的
+ *    `buildUnattendedPolicyRefusal`;core `readApproverOutcomeObject` ⇒ `policy_refused` / `who.party:"policy"`(core 7.39.0 #1265 起;此前 `"none"`),模型读 core 的
  *    策略句 + 本席的拒因,不停批)。修前两臂交裸 `false` ⇒ 机器的拒被记成人拒、模型被告知去等一个不存在的人。
  *  两臂的拒都经 `io.noteRefusedWithoutPerson` 报一次 —— 「活没干完」(退 1)此前搭的是 core 人拒标记的便车,S-956 之后由本席的事实给。
  */

package/dist/run-local.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { DEFAULT_MODEL_REF, resolveTaskModel } from "./model-select.js";
 import { defaultModelRefusal, modelUnavailableMessage } from "./model-entry-refusal.js";
-import { buildDurableAbsenceNote, createCorruptReadSeat } from "./observability/corrupt-read-seat.js";
+import { createDurableAbsenceSeat } from "./observability/corrupt-read-seat.js";
 import { outwardPlane } from "./terminal.js";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
@@ -351,7 +351,7 @@ export async function runLocal(argv, deps = {}) {
         fileBackend = acquireLocalBackendWithWait(() => new FileStorageBackend({
             root,
             ...(config.fileHistory !== undefined ? { fileHistory: config.fileHistory } : {}),
-            onCorruptRead: createCorruptReadSeat(logger.warn.bind(logger), "file_store_corrupt_read", buildDurableAbsenceNote("file-snapshot = a snapshot or scope read as missing")),
+            onCorruptRead: createDurableAbsenceSeat(logger.warn.bind(logger), root, "file-snapshot = a snapshot or scope read as missing"),
         }), config.storeLockWaitMs, (fields) => logger.warn("store_dir_lock_wait", { ...fields }));
     }
     catch (e) {

package/dist/runs.d.ts

@@ -2,6 +2,7 @@ import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type Run
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
 import type { Metrics } from "./observability/metrics.js";
+import { type RunAbort } from "./run-cancel-context.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import type { ElicitationCoordinator } from "./elicitation.js";
 import type { QuestionCoordinator } from "./question.js";
@@ -259,10 +260,11 @@ export declare function evictIfConflict(runner: Runner, sessionId: string | unde
  * text); tool/lifecycle events are recorded individually. Per-token live streaming stays on the
  * synchronous `/v1/tasks/stream` endpoint. Never throws — failures are recorded on the run.
  *
- * Cancellation (POST /v1/runs/:id/cancel): the run registers an AbortController in `inflight` (same-replica
- * fast path — the cancel handler aborts it directly) and its heartbeat tick polls the durable
- * `cancel_requested` flag (cross-replica, ≤HEARTBEAT_MS lag). Either way the run settles to
- * status "failed" + errorCode "cancelled" (metric label "cancelled"); the entry is removed in `finally`.
+ * Cancellation (POST /v1/runs/:id/cancel): the run registers its abort handle (S-947 `RunAbort`) in `inflight`
+ * (same-replica fast path — the cancel handler aborts it directly) and its heartbeat tick polls the durable
+ * `cancel_requested` flag (cross-replica, ≤HEARTBEAT_MS lag); both abort with `cancel_verb`. Either way the run settles
+ * to status "failed" + errorCode "cancelled" + `result.abortCause` (metric label "cancelled"); the entry is removed in
+ * `finally`.
  *
  * Preemption (POST /v1/assistant/tasks/:id/preempt, [ref] seam #2): a SECOND, INDEPENDENT controller
  * (`preemptCtrl`, registered in `preemptable`) carries the scheduler's graceful "yield this task" — when raised,
@@ -281,7 +283,7 @@ export declare function evictIfConflict(runner: Runner, sessionId: string | unde
 export declare function runInBackground(runner: Runner, spec: TaskSpec, runStore: RunStore, taskId: string, metrics?: Metrics, principal?: string, verify?: VerifyRoundsSpec, // 快审 F1:number 参升整对象——cost 顶随传
 cascade?: CascadeConfig, instrumentDegenerate?: (result: TaskResult) => void, planCacheProbe?: {
     record: (scope: string | undefined, objective: string, completed: boolean) => void;
-}, persistThinking?: boolean, inflight?: Map<string, AbortController>, preemptable?: Map<string, AbortController>, steerable?: Map<string, TaskStream>, modelUsage?: ModelUsageTracker, elicitation?: ElicitationCoordinator, 
+}, persistThinking?: boolean, inflight?: Map<string, RunAbort>, preemptable?: Map<string, AbortController>, steerable?: Map<string, TaskStream>, modelUsage?: ModelUsageTracker, elicitation?: ElicitationCoordinator, 
 /** E23: the VERIFIED principal (gatedPrincipal) that may answer this run's elicitations — matches the respond
  *  owner-gate's identity source (NOT the cost-attribution `principal`, which on a direct door is the self-asserted
  *  header → can be null while a JWT principal exists). Falls back to the run owner when not supplied. */

package/dist/runs.js

@@ -12,7 +12,7 @@ import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest,
 import { createLedgerSink } from "./trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "./trace/engine-notice-wire.js";
 import { recordTurnActivity } from "./turn-activity.js";
-import { CANCELLED_CODE, mintCancelledResult } from "./run-cancel-context.js";
+import { buildCancelledLedgerRow, CANCELLED_CODE, createRunAbort, mintCancelledResult } from "./run-cancel-context.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
@@ -178,14 +178,16 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
-    const cancelCtrl = new AbortController();
+    const cancelCtrl = createRunAbort();
     inflight?.set(taskId, cancelCtrl);
     markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
     const preemptEligible = verify === undefined && cascade === undefined;
     const preemptCtrl = new AbortController();
     if (preemptEligible)
         preemptable?.set(taskId, preemptCtrl);
-    const cancelledResult = (engineResult) => mintCancelledResult({ taskId, sessionId: spec.sessionId ?? "", startedAtMs: startedAt, message: "cancelled by user", ...(engineResult !== undefined ? { engineResult } : {}) });
+    const cancelledResult = (cause, engineResult) => engineResult !== undefined
+        ? mintCancelledResult({ taskId, sessionId: spec.sessionId ?? "", startedAtMs: startedAt, message: "cancelled by user", cause, engineResult })
+        : mintCancelledResult({ taskId, sessionId: spec.sessionId ?? "", startedAtMs: startedAt, message: "cancelled by user", cause });
     const recordDone = (result, status) => {
         metrics?.addGauge("runs_active", -1);
         metrics?.inc("tasks_total", { status });
@@ -222,7 +224,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         void runStore.heartbeat(taskId, owner).catch(() => { metrics?.inc("run_signal_poll_errors_total", { kind: "heartbeat" }); });
         if (!cancelCtrl.signal.aborted) {
             void runStore.isCancelRequested(taskId, owner).then((c) => { if (c)
-                cancelCtrl.abort(); }).catch(() => { metrics?.inc("run_signal_poll_errors_total", { kind: "cancel" }); });
+                cancelCtrl.abort("cancel_verb"); }).catch(() => { metrics?.inc("run_signal_poll_errors_total", { kind: "cancel" }); });
         }
         if (preemptEligible && !preemptCtrl.signal.aborted) {
             void runStore.isPreemptRequested(taskId, owner).then((p) => { if (p)
@@ -233,7 +235,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const anchor = new TurnAnchorCapture(captureTurnAnchor, () => metrics?.inc("resume_anchor_capture_failed"), captureUserMessageAnchor);
     let reached;
     let observedDone;
-    let cancelledAtDone = false;
+    let causeAtDone;
     let settledAsCancel = false;
     let steerableStreamRef;
     let legLive = true;
@@ -364,9 +366,10 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             for await (const ev of stream) {
                 if (ev.type === "done") {
                     observedDone = ev.result;
-                    cancelledAtDone = cancelCtrl.signal.aborted;
+                    causeAtDone = cancelCtrl.cause();
                 }
                 fleetPublisher?.onEvent(ev);
+                await userInputLedger?.observeLegEvent(stream, ev);
                 await flushPromptManifest();
                 switch (ev.type) {
                     case "text_delta":
@@ -402,7 +405,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     }
                     evictIfConflict(runner, spec.sessionId, ev.result);
                     {
-                        const settled = cancelledAtDone ? cancelledResult(ev.result) : ev.result;
+                        const settled = causeAtDone !== undefined ? cancelledResult(causeAtDone, ev.result) : ev.result;
                         settledAsCancel = failureCodeOf(settled.terminal) === CANCELLED_CODE;
                         const safe = await withModelUsage(sealResultForExit(settled));
                         await sink.appendDone(safe);
@@ -448,17 +451,18 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 ? sendUserFile.runWithContext({ taskId, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); } }, withApproval)
                 : withApproval();
         })));
-        if (!reached && cancelCtrl.signal.aborted) {
+        const cleanCancelCause = cancelCtrl.cause();
+        if (!reached && cleanCancelCause !== undefined) {
             try {
                 await flush();
             }
             catch (e) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=flush-clean-cancel ${errText(e)}`);
             }
-            const c = cancelledResult();
+            const c = cancelledResult(cleanCancelCause);
             settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
             try {
-                await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
+                await append("failed", buildCancelledLedgerRow(c));
             }
             catch (e) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-clean-cancel ${errText(e)}`);
@@ -469,6 +473,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
         }
     }
     catch (err) {
+        const thrownCancelCause = cancelCtrl.cause();
         const message = errText(err);
         try {
             try {
@@ -488,11 +493,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             else if (reached?.kind === "needs_review") {
                 await runStore.setNeedsReview(taskId, reached.result);
             }
-            else if (cancelCtrl.signal.aborted && observedDone === undefined) {
-                const c = cancelledResult();
+            else if (thrownCancelCause !== undefined && observedDone === undefined) {
+                const c = cancelledResult(thrownCancelCause);
                 settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;
                 try {
-                    await append("failed", { errorMessage: "cancelled by user", errorCode: CANCELLED_CODE });
+                    await append("failed", buildCancelledLedgerRow(c));
                 }
                 catch (e) {
                     recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=append-thrown-cancel ${errText(e)}`);

package/dist/spec-fields.js

@@ -37,7 +37,6 @@ export function normalizeAttachments(v) {
     const out = {
         ...(o.todoReminder === true ? { todoReminder: true } : {}),
         ...(changedFiles !== undefined ? { changedFiles } : {}),
-        ...(o.planModeReminder === true ? { planModeReminder: true } : {}),
         ...(typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {}),
         ...(o.toolsDelta === true ? { toolsDelta: true } : {}),
         ...(o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {}),

package/dist/tool-approval.d.ts

@@ -821,7 +821,7 @@ export type RespondSettledBy = Extract<HostSettledBy, HostDecidedBy>;
 export type UnattendedApprovalPolicy = "park" | "deny";
 /**
  * S-689 —— `deny` 政策下「无人可答」交给 core 的形:core `AskOutcome` 对象臂的**部署政策拒**
- * (`settledBy:"policy"` ⇒ core 结算 `policy_refused`、`who.party:"none"`,模型读的是策略句)。
+ * (`settledBy:"policy"` ⇒ core 结算 `policy_refused`、`who.party:"policy"`(core 7.39.0 #1265 起;此前 `"none"`),模型读的是策略句)。
  *
  * 修前这里交**裸 `false`** —— 而在 core 的 onAsk 契约里裸 `false` 就是「一个人拒了」:结算记
  * `human_refused` / `who.party:"person"`,模型被告知「用户不想继续,停下来等他」,run 以

package/dist/trace/core-keyset-guard.d.ts

@@ -146,7 +146,7 @@ type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueue
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
 type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";