@sema-agent/server 7.114.0 → 7.116.0

package/dist/approval-ask-audit-store.d.ts

@@ -9,8 +9,12 @@
  * 当时:local 车道 ask 账进程内易失(`InMemoryApprovalAskStore`),活卡窗内崩溃 = **零痕迹**:重启后
  * `/v1/approvals` 两数组空,那次审批连一条审计行都没有。**S-384 起 local 的 ask 账已是持久的**
  * (`FileApprovalAskStore`),所以「零痕迹」那句不再成立;本店今天还在的理由收窄成它**独有**的那一格:
- * `crashConverged` 这个 local-only 的 additive 读面(孤儿行的 `orphanState` / `resumeSafe` 两位),
- * ask 账本身没有「boot 收敛孤儿」这条动词。两本同根账并存是已登记的抽象欠账。本店把 ask **铸造 / 决议 / 腿闭**三类事件
+ * `crashConverged` 这个 local-only 的 additive 读面(孤儿行的 `orphanState` / `resumeSafe` 两位)—— **腿证据只在这里**
+ * (`legTracked` / `leg_closed` / 关停记号),ask 账没有。🔴 **「这一问还能不能决」不归本店答**:答案源是 ask 账的行状态
+ * (决断口只读它)。启动收敛是**一只**函数(`approval-crash-convergence.ts`):先跑本店的收敛(下面「boot 收敛判据」),再把 ask 账里
+ * 前世留下的 `STREAM_PENDING` 行收成 `VOID`,成因词取本店对同一 `approvalId` 的 {@link FileApprovalAskAuditStore.causeFor} —— 成因
+ * 判一次、写两处(ask 行 `deniedReason` 与本店收敛行 `cause` 同词)。并账(把腿证据搬上 ask 行、本店退役)不是本形:本店在
+ * 协议不上场的 local 部署上也在,那里没有 ask 行可并。本店把 ask **铸造 / 决议 / 腿闭**三类事件
  * append 进磁盘账本(挂线点 = `ToolApprovalCoordinator`,见 `askAudit` ctor opt),boot 时收敛器把
  * 孤儿行标 `crashed_before_park` 终态成因注,`GET /v1/approvals` 的 additive 键 `crashConverged` 供
  * 操作员追溯。
@@ -165,8 +169,11 @@
  */
 import type { HostDecision } from "./host-decision.js";
 import { AppendLog } from "@sema-agent/core";
+import type { HolderGoneReason, VOID_REASONS } from "./approval-deny-reasons.js";
 /** 数据子目录名(挂在 local 数据根下,与 `workflow-notify/` 同层同形)。 */
 export declare const APPROVAL_ASK_AUDIT_DIR = "approval-ask-audit";
+/** 账本文件名(目录内唯一一只;启动收敛据它判「盘上有没有前世审计证据」,见 `approval-crash-convergence.ts` 的 `openAuditEvidenceForConvergence`)。 */
+export declare const APPROVAL_ASK_AUDIT_LEDGER = "ledger.jsonl";
 /** 崩溃收敛行的读面上限(新前旧后截断;有界 wire —— 读面不许随月份线性长)。 */
 export declare const CRASH_CONVERGED_LIST_MAX = 200;
 /** 追加口的窄形(core `AppendLog` 的 `append` / `close`)—— 店的测试注入席({@link FileApprovalAskAuditStore} 构造器 `internals.appendLog`)按它造替身。 */
@@ -193,7 +200,7 @@ export interface AuditAskInput {
  * **计坏行**(`corruptLines`,坏值响亮律 —— 不静默读成「没写成因」),但**不丢该 settle 行的结清**(F4:outcome / parkRouted 照认 ——
  * 因为一个成因词把整条结清行丢掉,会把一张已结清的卡收成 pending 孤儿,方向比「少认一个成因」更坏)。
  */
-export type AuditShutdownCause = "shutdown_before_park";
+export type AuditShutdownCause = typeof VOID_REASONS.HOLDER_SHUTDOWN;
 /**
  * 成因词的读盘词表(F4:`satisfies Record<AuditShutdownCause, true>` ⇒ 闭集加一个词而本表没跟 = **编译红**;判定走 `Object.hasOwn`,
  * 原型链上的名字不算词 —— CLAUDE.md 词表律)。唯一读者 = {@link readShutdownCause}。
@@ -202,9 +209,11 @@ export declare const AUDIT_SHUTDOWN_CAUSE_WORDS: {
     readonly shutdown_before_park: true;
 };
 /** 收敛行 `cause` 的闭集(`GET /v1/approvals` `crashConverged[].cause`):崩溃孤儿 / 有序关停截断的腿(S-929 +1;与 `crashed_before_park` 同形)。
+ *  🔴 **词表属主 = `approval-deny-reasons.ts` 的 `VOID_REASONS`**(`HOLDER_CRASHED` / `HOLDER_SHUTDOWN`):启动收敛把同一问的问账行收成 VOID 时
+ *  `deniedReason` 写的就是这两个词 —— 同一问在 `crashConverged` 与决断口 410 体上只有一个成因词(本型不再自带一份字面量)。
  *  wire 值闭集登记在 `trace/self-minted-wire.ts` 的 `crashConvergedCause`(`satisfies Record<CrashConvergedCause, …>` 双向绑定 ⇒ 加词不登记 = tsc 红,
  *  wire 变更清单从那张表 diff —— F3)。 */
-export type CrashConvergedCause = "crashed_before_park" | AuditShutdownCause;
+export type CrashConvergedCause = HolderGoneReason;
 /** 决议点入参(`settle()` 公共咽喉挂线;五臂全过,不漏窗到期/断连/取消)。 */
 export interface AuditSettleInput {
     approvalId: string;
@@ -287,7 +296,11 @@ export interface CrashConvergedRow {
     /** 铸造时刻(键名照 `livePending[].ts`)。 */
     ts: number;
     expiresAtMs: number;
-    /** 终态 DENIED 同码(稿 §2 (c) 施工形;SQL 车道收敛器的 fail-closed DENIED 同向)。 */
+    /**
+     * 收敛行的判别常量:这张卡**已不可再决**(wire 形不变)。⚠️ 协议上场的部署上,同一问在 ask 账里是 `VOID` + `deniedReason` = 本行 `cause`
+     * (决断口 410 `gone.ask` 读的是那一行)—— 「能不能决」两面一致,但终态的**名字**这里是 `denied`、ask 行是 `VOID`:这是登记在案的残留,
+     * 不是语义(改这个值会让把它当闭集判别式读的消费端整行丢弃,须与消费端同窗改)。
+     */
     decision: "denied";
     /** 成因注(闭集 {@link CrashConvergedCause}):`crashed_before_park` = 进程崩了;`shutdown_before_park`(S-929)= 腿被**有序关停**截断
      *  (判据见头注「收敛行的 `cause`」)。两者的 `orphanState` / `resumeSafe` 判据相同。 */
@@ -420,7 +433,7 @@ export declare class FileApprovalAskAuditStore implements ApprovalAskAuditSink,
      */
     recordLateSettle(input: AuditLateSettleInput): void;
     /**
-     * boot 崩溃收敛器(装配层在构造后、协调器开始服务前调一次;幂等跨 boot)。
+     * boot 崩溃收敛器的**本店半场**(由 `approval-crash-convergence.ts` 的启动收敛在任何卡开始之前调一次;幂等跨 boot)。
      * 判据 = 头注「boot 收敛判据」段(一处成文,不复述)。返回两分臂计数 + 坏行数供 boot 日志。
      */
     convergeCrashedAsks(): {
@@ -429,6 +442,12 @@ export declare class FileApprovalAskAuditStore implements ApprovalAskAuditSink,
         inconsistent: number;
         corruptLines: number;
     };
+    /**
+     * 一问的**成因词**(启动收敛的唯一判点,`approval-crash-convergence.ts` 读它写 ask 行的 `deniedReason`;本店收敛行的 `cause` 走同一只
+     * {@link causeOf})。前世账本里没有这只 `approvalId` 的铸造行(崩在 ask 账落行之后、本店铸造行之前,或本店那时不在)⇒ `crashed_before_park`:
+     * 没有有序关停的证据,就不说它是有序关停。判据读的是构造时冻结的前世账本 ⇒ 同一份账本跨几次启动恒得同一个词。
+     */
+    causeFor(approvalId: string): CrashConvergedCause;
     /** S-929 收敛行的成因注(判据见头注「收敛行的 `cause`」):组的最后一个事件行之后、收敛行(若已收敛)之前,有本 taskId 的
      *  有序关停记号 ⇒ `shutdown_before_park`;否则 `crashed_before_park`。 */
     private causeOf;

package/dist/approval-ask-audit-store.js

@@ -4,6 +4,7 @@ import { AppendLog, ensureDir } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { replayJsonlSkipping } from "./observability/corrupt-read-seat.js";
 export const APPROVAL_ASK_AUDIT_DIR = "approval-ask-audit";
+export const APPROVAL_ASK_AUDIT_LEDGER = "ledger.jsonl";
 export const CRASH_CONVERGED_LIST_MAX = 200;
 export const AUDIT_SHUTDOWN_CAUSE_WORDS = { shutdown_before_park: true };
 export function buildCheckpointAnchorHash(token) {
@@ -190,7 +191,7 @@ export class FileApprovalAskAuditStore {
         this.openLog = internals?.appendLog ?? ((p) => new AppendLog(p));
         const dir = join(root, APPROVAL_ASK_AUDIT_DIR);
         ensureDir(dir);
-        this.ledgerPath = join(dir, "ledger.jsonl");
+        this.ledgerPath = join(dir, APPROVAL_ASK_AUDIT_LEDGER);
         this.replay();
     }
     corruptLines = 0;
@@ -375,6 +376,10 @@ export class FileApprovalAskAuditStore {
         this.convergedRows.length = Math.min(this.convergedRows.length, CRASH_CONVERGED_LIST_MAX);
         return { pending, decided, inconsistent, corruptLines: this.corruptLines };
     }
+    causeFor(approvalId) {
+        const g = this.replayed.get(approvalId);
+        return g?.ask === undefined ? "crashed_before_park" : this.causeOf(g);
+    }
     causeOf(g) {
         const after = g.settleLine ?? g.askLine ?? 0;
         const before = g.convergedLine ?? Number.POSITIVE_INFINITY;

package/dist/approval-card.d.ts

@@ -269,6 +269,23 @@ export type ProbeCauseProjection = z.infer<typeof ProbeCauseSchema>;
  * (截出来的是另一个机器码);`shown` 超限 ⇒ **截条目**,`total` 逐字保真。
  */
 export declare function readProbeCause(req: unknown): ProbeCauseProjection | undefined;
+/**
+ * `AskRequest.probeReason`(core 5.33.0 [ref]:`probeCause` 的**散文**兄弟 —— 探针对「为什么没清掉这一问」的一句话)的
+ * **边界窄读**,活卡帧(`ToolApprovalFrame.probeReason`)的**唯一**铸造点。
+ *
+ * 🔴 **只有活卡帧**:`card_json` / 呈卡帧不携本键(`ApprovalCardSchema` 是 `.strict()` 的耐久信封,加键 = 回滚窗内旧二进制读不动新行,
+ * 要另行裁定)。耐久面的对偶 = `gate.riskDescriptor.probeReason`(park 行整体透传,出门前过 `redactRiskDescriptor` 的 `text` 叶,
+ * 与本函数同一只脱敏规则 ⇒ 对同一句话两面同值)。
+ *
+ * 姿势逐条(与 {@link readProbeCause} / {@link readRuleEvidence} 同款分工):
+ *  · `safeParse`,非串 ⇒ 按缺席处置(宪法 [ref]);空串 / 纯空白 ⇒ 缺席(core 自己也只在 `trim() !== ""` 时铸)。
+ *  · 长度:超过 {@link MAX_PROBE_REASON_CODEPOINTS} ⇒ **整只丢,不截**(判据与 `probeCause.code` 超限同形);
+ *    先判长度再脱敏 ⇒ 喂给脱敏器的永远是个短串(脱敏器的 RangeError 面是超大输入)。
+ *  · 内容族(部署自写的探针散文,人眼信任边界上的文本)⇒ `redactSecrets`。脱敏后**不再截**:耐久面同样不截,
+ *    两面逐字节同值比「帧上短一截」重要(`persistedRuleShadowed` R2-[medium] 的反面:那里有卡面要对齐,这里没有)。
+ *  · 缺席 ≠「没有原因」:只有 maybe 档收紧且探针真给了 reason 的 ask 才有它。
+ */
+export declare function readProbeReason(req: unknown): string | undefined;
 /**
  * [ref](core 7.19.0)—— `readRootCandidate.dir` 的**上限**。
  *
@@ -512,26 +529,6 @@ declare const DenialLimitFallbackSchema: z.ZodObject<{
     autoDenyAfterMs: z.ZodNumber;
 }, z.core.$strict>;
 export type DenialLimitFallback = z.infer<typeof DenialLimitFallbackSchema>;
-/**
- * ⚰️ **退役成员的形(server 7.69.0–7.71.0 铸过,7.72.0 起永不再铸)** —— core 7.14.0 [ref] 把
- * `classifierUnavailable` 从 ask 侧**整族**删掉(事实改骑 `GateDisposition.denied.cause`),所以本仓
- * 的**铸造**腿(`buildApprovalCard` / 活卡帧 / inbox 行)本批全部摘掉;窄读函数
- * `readClassifierUnavailable` 与对 core 型面的合规钉连同它们的素材一起删(素材没了,钉的两端只剩一端)。
- *
- * 🔴 **这只 schema 本身留着,而且是承重的,不是没删干净**:`ApprovalCardSchema` 是 `.strict()`,
- * 而它同时是 `approval_ask.card_json` 这张**耐久列**的读契约(读侧三个 `safeParse`:重放腿、幂等重入、
- * 对账扫描)。把成员从 strict schema 上删掉 ⇒ 7.69.0–7.71.0 铸下、升级时**仍然 pending** 的那些行
- * 当场判假 ⇒ 「跳过 + 一次 warn」:人手上那张卡在重连后变不回来、幂等重入退成 park。
- * ⇒ 一条耐久投影的 schema **必须读得懂它自己写过的每一版**;写侧只写当前引擎供得出的键,读侧接受
- * 全部历史成员。这不是给退役键开特例,这是 strict + durable 这一组合的内生义务(同样的处置将适用于
- * 未来任何一次键退役)。
- *
- * 形保持原样(单成员 `cause` 必填、`.strict()`):它描述的是**已经写在库里的字节**,不许再动。
- */
-declare const ClassifierUnavailableSchema: z.ZodObject<{
-    cause: z.ZodString;
-}, z.core.$strict>;
-export type ClassifierUnavailable = z.infer<typeof ClassifierUnavailableSchema>;
 /**
  * `AskRequest.denialLimitFallback`(core 7.4.0 [ref])的**边界窄读** —— 活卡帧与 `card_json` 的唯一铸造点
  * (与 {@link readRuleOffersAbsence} / {@link readProbeCause} 同款分工),两面结构性同值。
@@ -569,6 +566,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         requiresRealApproval: z.ZodBoolean;
     }, z.core.$strict>;
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+    rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     persistedRuleShadowed: z.ZodOptional<z.ZodString>;
     ruleOffers: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -651,8 +649,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -684,6 +682,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             requiresRealApproval: z.ZodBoolean;
         }, z.core.$strict>;
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
+        rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         persistedRuleShadowed: z.ZodOptional<z.ZodString>;
         ruleOffers: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -766,8 +765,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "write_protection_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "unverifiable_delete" | "transcript_write" | "governance_unavailable" | "rule_unreadable" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -803,6 +802,8 @@ export interface ApprovalCardSource {
     /** [ref]/[ref]:治理来源标 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口),
      *  于是 live 帧 / `card_json` / 重放帧三面同源,不是三处各判一遍。 */
     governanceForced?: true;
+    /** 7.116.0 S4:「本会话放行」不会被记住(帧上同名键,见 `ApprovalCardSchema.rememberRefused`)。 */
+    rememberRefused?: true;
     /** E-14:bidi 在场位 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口)⇒ live 帧 /
      *  `approval_request` / `card_json` / 重放帧四面同源,不是四处各扫一遍。 */
     inputHasBidi?: true;

package/dist/approval-card.js

@@ -160,6 +160,18 @@ export function readProbeCause(req) {
         ...(raw.further !== undefined ? { further: family(raw.further) } : {}),
     };
 }
+const MAX_PROBE_REASON_CODEPOINTS = 201;
+const ProbeReasonEnvelopeSchema = z.object({ probeReason: z.string().optional() });
+export function readProbeReason(req) {
+    const parsed = ProbeReasonEnvelopeSchema.safeParse(req);
+    const raw = parsed.success ? parsed.data.probeReason : undefined;
+    if (raw === undefined || raw.trim() === "")
+        return undefined;
+    if ([...raw].length > MAX_PROBE_REASON_CODEPOINTS)
+        return undefined;
+    const redacted = redactSecrets(raw);
+    return redacted === "" ? undefined : redacted;
+}
 export { READ_ROOT_CANDIDATE_DIR_MAX };
 const ReadRootCandidateEnvelopeSchema = z.object({
     readRootCandidate: z.object({ dir: z.string().min(1), clearsThisAsk: z.literal(true), covers: z.literal("exact").optional() }).optional(),
@@ -342,6 +354,7 @@ export const ApprovalCardSchema = z
     })
         .strict(),
     governanceForced: z.literal(true).optional(),
+    rememberRefused: z.literal(true).optional(),
     inputHasBidi: z.literal(true).optional(),
     persistedRuleShadowed: z.string().max(MAX_RULE_TEXT_CHARS).optional(),
     ruleOffers: z.array(RuleOfferSchema).max(MAX_RULE_OFFERS).optional(),
@@ -415,6 +428,7 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
             requiresRealApproval,
         },
         ...(source.governanceForced === true ? { governanceForced: true } : {}),
+        ...(source.rememberRefused === true ? { rememberRefused: true } : {}),
         ...(source.inputHasBidi === true ? { inputHasBidi: true } : {}),
         ...(shadowedRule !== undefined && shadowedRule !== "" ? { persistedRuleShadowed: shadowedRule } : {}),
         ...(probeCause !== undefined ? { probeCause } : {}),

package/dist/approval-crash-convergence.d.ts

@@ -0,0 +1,60 @@
+import type { ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
+import { FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
+import { type HolderGoneReason } from "./approval-deny-reasons.js";
+import { type RunStoreReader } from "./user-input-ledger.js";
+import type { Logger } from "./observability/logger.js";
+/** 启动收敛的读数(进启动日志)。 */
+export interface CrashConvergenceReport {
+    /** 审计半场:pending 臂(崩时人还没答)/ decided 臂(批了、执行窗内崩)/ 审计断档组 / 坏行 —— 语义见审计店头注。 */
+    readonly pending: number;
+    readonly decided: number;
+    readonly inconsistent: number;
+    readonly corruptLines: number;
+    /** ask 账半场:按成因词计的、本次收成 VOID 的前世 `STREAM_PENDING` 行数。 */
+    readonly asksVoided: Readonly<Record<HolderGoneReason, number>>;
+    /** 其中卡信封读不出、成因词是回落(`crashed_before_park`)的行数(同时记 fail-open tag)。 */
+    readonly causeUnreadable: number;
+}
+/** 本次收成 VOID 的行数合计 —— 由成因闭集派生(对 `asksVoided` 的每个词求和;闭集加词不需要改这里)。 */
+export declare function totalAsksVoided(report: Pick<CrashConvergenceReport, "asksVoided">): number;
+/** 本函数读写的那几口(窄形:测试可以直给一只内存店)。 */
+export type CrashConvergenceAskPort = Pick<ApprovalAskStore, "listByState" | "transitionAsk">;
+/** 审计店的两口(收敛半场 + 成因判点)。 */
+export type CrashConvergenceAuditPort = Pick<FileApprovalAskAuditStore, "convergeCrashedAsks" | "causeFor">;
+/**
+ * 启动收敛读哪一份**审计证据**:活的审计店在场就用它;不在场(这一世 `TOOL_APPROVAL_ENABLED` 关着 ⇒ 装配三合取不成立)而盘上有前世的审计账本
+ * ⇒ 开一只读它 —— 成因是盘上证据的函数,不随这一世的开关变(否则前世有序关停截断的问在这一世被写成 `crashed_before_park`,审批重新打开那天审计读面
+ * 对同一问列 `shutdown_before_park`,两本账永久分家)。盘上没有账本(审批从没开过)⇒ 不铸店、不建目录,证据缺席。
+ * 开出来的这一只只供收敛:不进协调器、不进 `crashConverged` 读面(那一面在审批关着时本就缺席)。
+ */
+export declare function openAuditEvidenceForConvergence(live: CrashConvergenceAuditPort | undefined, localDataRoot: string | undefined): {
+    audit: CrashConvergenceAuditPort | undefined;
+    release: () => void;
+};
+/**
+ * 启动收敛(见文件头)。只在数据根独占的车道上调,且必须在本进程铸出第一问之前。幂等跨启动:收过的行已不是 `STREAM_PENDING`,
+ * 审计半场有自己的收敛锚;成因读冻结的前世审计账 ⇒ 半途崩溃再启,剩下的行得到与第一次相同的词。
+ */
+export declare function convergeCrashedAsksAtBoot(input: {
+    askStore: CrashConvergenceAskPort | undefined;
+    audit: CrashConvergenceAuditPort | undefined;
+    now?: () => number;
+}): Promise<CrashConvergenceReport>;
+/**
+ * **启动装配的这一步**(stage-07 调一次,孤儿 run 回收之后):车道判据 → 审计证据 → 收敛 → 启动日志。
+ *  · 只在数据根独占的车道上跑 —— 车道事实与用户输入受理账本同一只 `writerGoneEvidenceFor`(local ⇒ `exclusive_data_root`);SQL 车道整步不做。
+ *  · ask 店取 `backend.approvalAsk()`,**不看协议开关**:前世开着协议留下的行,今世关着也照收(否则重新打开协议那天它们又变得可决)。
+ *  · 审计证据经 {@link openAuditEvidenceForConvergence}(这一世的审批开关不改变成因)。
+ *  · 有任何收敛 / 坏行 ⇒ 一行 warn `approval_ask_audit_crash_converged`(零动作不打)。收敛写入抛错 ⇒ 抛出 ⇒ 拒启。
+ */
+export declare function runBootCrashConvergence(ctx: {
+    backend: {
+        readonly kind: "mysql" | "pg" | "local";
+        approvalAsk(): CrashConvergenceAskPort;
+    } | undefined;
+    runStore: RunStoreReader | undefined;
+    liveAudit: CrashConvergenceAuditPort | undefined;
+    localDataRoot: string | undefined;
+    logger: Pick<Logger, "warn">;
+}): Promise<CrashConvergenceReport | undefined>;
+//# sourceMappingURL=approval-crash-convergence.d.ts.map

package/dist/approval-crash-convergence.js

@@ -0,0 +1,75 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER, FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
+import { ApprovalCardEnvelopeSchema } from "./approval-card.js";
+import { VOID_REASONS } from "./approval-deny-reasons.js";
+import { writerGoneEvidenceFor } from "./user-input-ledger.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+const CONVERGE_PAGE = 500;
+export function totalAsksVoided(report) {
+    return Object.values(report.asksVoided).reduce((sum, n) => sum + n, 0);
+}
+export function openAuditEvidenceForConvergence(live, localDataRoot) {
+    if (live !== undefined)
+        return { audit: live, release: () => { } };
+    if (localDataRoot === undefined || !existsSync(join(localDataRoot, APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER)))
+        return { audit: undefined, release: () => { } };
+    const opened = new FileApprovalAskAuditStore(localDataRoot);
+    return { audit: opened, release: () => opened.close() };
+}
+export async function convergeCrashedAsksAtBoot(input) {
+    const now = input.now ?? Date.now;
+    const audited = input.audit?.convergeCrashedAsks() ?? { pending: 0, decided: 0, inconsistent: 0, corruptLines: 0 };
+    const asksVoided = { [VOID_REASONS.HOLDER_CRASHED]: 0, [VOID_REASONS.HOLDER_SHUTDOWN]: 0 };
+    let causeUnreadable = 0;
+    const store = input.askStore;
+    if (store !== undefined) {
+        const seen = new Set();
+        for (;;) {
+            const page = (await store.listByState("STREAM_PENDING", CONVERGE_PAGE)).filter((r) => !seen.has(r.askId));
+            if (page.length === 0)
+                break;
+            for (const row of page) {
+                seen.add(row.askId);
+                const envelope = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
+                if (!envelope.success) {
+                    causeUnreadable += 1;
+                    recordFailOpen("server.approval-crash-convergence.cause-unreadable", `ask ${row.askId} (task ${row.taskId}): card envelope unreadable — cause defaulted to ${VOID_REASONS.HOLDER_CRASHED}`);
+                }
+                const reason = envelope.success && input.audit !== undefined ? input.audit.causeFor(envelope.data.approvalId) : VOID_REASONS.HOLDER_CRASHED;
+                let won;
+                try {
+                    won = await store.transitionAsk(row.askId, "STREAM_PENDING", "VOID", { deniedReason: reason, updatedAtMs: now() });
+                }
+                catch (err) {
+                    throw new Error(`approval crash convergence: could not close the previous process's pending approval ask ${row.askId} (task ${row.taskId}): ` +
+                        `${err instanceof Error ? err.message : String(err)} — refusing to start, because serving now would leave a card that nothing waits for ` +
+                        "decidable with a 200. Fix the data root (disk full / read-only?) and start again.");
+                }
+                if (won)
+                    asksVoided[reason] += 1;
+            }
+        }
+    }
+    return { ...audited, asksVoided, causeUnreadable };
+}
+export async function runBootCrashConvergence(ctx) {
+    const { backend, runStore, logger } = ctx;
+    if (backend === undefined || runStore === undefined || writerGoneEvidenceFor(backend.kind, runStore).kind !== "exclusive_data_root")
+        return undefined;
+    const evidence = openAuditEvidenceForConvergence(ctx.liveAudit, ctx.localDataRoot);
+    const converged = await convergeCrashedAsksAtBoot({ askStore: backend.approvalAsk(), audit: evidence.audit }).finally(evidence.release);
+    if (converged.pending > 0 || converged.decided > 0 || converged.inconsistent > 0 || converged.corruptLines > 0 || totalAsksVoided(converged) > 0) {
+        logger.warn("approval_ask_audit_crash_converged", {
+            pending: converged.pending,
+            decided: converged.decided,
+            inconsistent: converged.inconsistent,
+            corruptLines: converged.corruptLines,
+            asksVoided: converged.asksVoided,
+            causeUnreadable: converged.causeUnreadable,
+            note: "approval asks left pending by the previous process were converged: each such ask is now VOID in the ask ledger (the decision endpoint answers 410 gone.ask with this cause as deniedReason) and is listed under GET /v1/approvals crashConverged when the audit ledger saw it (cause crashed_before_park = the process crashed; cause shutdown_before_park = an orderly shutdown cut the leg off before it closed or before its park committed)",
+        });
+    }
+    return converged;
+}
+//# sourceMappingURL=approval-crash-convergence.js.map

package/dist/approval-deny-reasons.d.ts

@@ -16,6 +16,8 @@
  * 值域不相交这条纪律的用处(`ALL_TERMINAL_REASONS` 的机器判据钉住不相交性)。
  *
  * 写点纪律(grep 钉):全仓 `DENIED` 只有**一个**写点 = 收敛器判据 2 的非取消臂(`approval-reconciler.ts`)。
+ * 启动收敛(进程没了)落的是 VOID 不是 DENIED:状态机上 `STREAM_PENDING` 没有到 DENIED 的边(DENIED 只在「已路由去 park」之后),
+ * 而承载它的进程没了 = 这条腿死了 = abort 语义。
  */
 /** `DENIED` 终态的归因闭集(v1 单员)。 */
 export declare const DENY_REASONS: {
@@ -49,8 +51,19 @@ export declare const VOID_REASONS: {
     /** 判据 5:任何在 `STREAM_APPROVAL_ORPHAN_TTL_MS` 内仍未收敛的 `PARKING` 行(量 immutable 的
      *  `createdAtMs`,§9 C5)—— 约束①(遗孤最终可判)的最后兜底,带一条 warn。 */
     readonly ORPHAN_TTL_EXCEEDED: "orphan_ttl_exceeded";
+    /**
+     * 启动收敛(`approval-crash-convergence.ts`,local 车道):**承载这一问的进程没了** —— 前世进程崩溃 / 被杀,留下的
+     * `STREAM_PENDING` 行在下一次启动、任何卡能开始之前收成 VOID。证据是数据根 `LOCK`(前世写者全死),不是「等够久了」。
+     * 🔴 值与 `GET /v1/approvals` `crashConverged[].cause` 是**同一个词**(审计店的 `CrashConvergedCause` 从本表取型):
+     * 同一问在两个读面上只有一个成因词。
+     */
+    readonly HOLDER_CRASHED: "crashed_before_park";
+    /** 同上,但承载它的腿是被**有序关停**截断的(审计账本上有本腿的关停记号;关停收尾没能在宽限窗内把这张卡结清)。 */
+    readonly HOLDER_SHUTDOWN: "shutdown_before_park";
 };
 export type VoidReason = (typeof VOID_REASONS)[keyof typeof VOID_REASONS];
+/** 「承载这一问的进程没了」的两个成因词(启动收敛写进问账行 `deniedReason`,审计收敛行 `cause` 读同一型)。 */
+export type HolderGoneReason = typeof VOID_REASONS.HOLDER_CRASHED | typeof VOID_REASONS.HOLDER_SHUTDOWN;
 /** 两组的并集(机器判据用:值域不相交 + 列宽 ≤ 64 的钉子在 test/approval-reconciler.test.ts)。 */
 export declare const ALL_TERMINAL_REASONS: readonly string[];
 //# sourceMappingURL=approval-deny-reasons.d.ts.map

package/dist/approval-deny-reasons.js

@@ -7,6 +7,8 @@ export const VOID_REASONS = {
     BATCH_BOUND_ELSEWHERE: "batch_bound_elsewhere",
     ADHOC_LEG_NO_DURABLE_DOMAIN: "adhoc_leg_no_durable_domain",
     ORPHAN_TTL_EXCEEDED: "orphan_ttl_exceeded",
+    HOLDER_CRASHED: "crashed_before_park",
+    HOLDER_SHUTDOWN: "shutdown_before_park",
 };
 export const ALL_TERMINAL_REASONS = [...Object.values(DENY_REASONS), ...Object.values(VOID_REASONS)];
 //# sourceMappingURL=approval-deny-reasons.js.map

package/dist/approval.js

@@ -4,6 +4,7 @@ import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { isExplicitPosture } from "./posture-source.js";
 import { handsOnWorkerFilePlane } from "./execution-lane-caps.js";
 import { heldRuleName } from "./tool-rule-names.js";
+import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
 export function hasApprovalListIntent(config) {
     return (config.approvalRequire.length > 0 ||
         config.approvalDeny.length > 0 ||
@@ -74,6 +75,9 @@ function createNameSetMatcher(names) {
         return (toolName) => exact.has(toolName);
     return (toolName) => exact.has(toolName) || covering.some((rule) => namespacedRuleNameCovers(rule, toolName));
 }
+function grantedByRule() {
+    return { action: "allow", decisionReason: "rule" };
+}
 export function createDurableAskPolicy(opts) {
     const require = createNameSetMatcher(opts.requireApproval);
     const deny = createNameSetMatcher(opts.deny ?? []);
@@ -94,7 +98,7 @@ export function createDurableAskPolicy(opts) {
                 if (remEarly !== undefined && remEarly <= 0) {
                     return operatorAlwaysHumanAsk("RESOURCE_SUSPEND budget exhausted", `durable resource budget exhausted — human approval required to run "${req.toolName}"`);
                 }
-                if (opts.exempt && heldRuleName(req, isQuestionTool) === undefined) {
+                if (opts.exempt && heldRuleName(req, isQuestionTool) === undefined && !answerGrantsBeyondCall(req)) {
                     return (async () => {
                         let exempted = false;
                         try {
@@ -105,7 +109,7 @@ export function createDurableAskPolicy(opts) {
                         }
                         if (exempted) {
                             opts.onExempted?.(req.toolName, req.toolName);
-                            return { action: "allow" };
+                            return grantedByRule();
                         }
                         return decideRequired(req, requireHit);
                     })();
@@ -122,7 +126,7 @@ export function createDurableAskPolicy(opts) {
         }
         if (heldRuleName(req, isQuestionTool) === undefined && budget > 0 && autoApproved < budget) {
             autoApproved++;
-            return { action: "allow" };
+            return grantedByRule();
         }
         return operatorAsk(`APPROVAL_REQUIRE(${requireHit})`, `approval required to run "${req.toolName}"`);
     }

package/dist/boot/coordinators.js

@@ -43,18 +43,6 @@ export function createLiveCoordinators(ctx) {
     const approvalAskAudit = config.toolApprovalEnabled && backend?.kind === "local" && config.localDataRoot !== undefined
         ? new FileApprovalAskAuditStore(config.localDataRoot)
         : undefined;
-    if (approvalAskAudit) {
-        const converged = approvalAskAudit.convergeCrashedAsks();
-        if (converged.pending > 0 || converged.decided > 0 || converged.inconsistent > 0 || converged.corruptLines > 0) {
-            logger.warn("approval_ask_audit_crash_converged", {
-                pending: converged.pending,
-                decided: converged.decided,
-                inconsistent: converged.inconsistent,
-                corruptLines: converged.corruptLines,
-                note: "orphan approval asks from the previous process were converged (cause crashed_before_park = it crashed; cause shutdown_before_park = an orderly shutdown cut the leg off before it closed or before its park committed); see GET /v1/approvals crashConverged",
-            });
-        }
-    }
     const approvalExemptionStore = backend ? backend.approvalExemption() : undefined;
     const toolApproval = config.toolApprovalEnabled
         ? new ToolApprovalCoordinator({

package/dist/boot/execution-env.js

@@ -15,6 +15,7 @@ import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-dock
 import { sshExecutionEnvFactory } from "../plugins/remote-env-ssh.js";
 import { isRemoteScratchpadLane, withRemoteScratchpad } from "../plugins/remote-scratchpad.js";
 import { FileSchedulerBackend, defaultSchedulerStorePath } from "../plugins/scheduler-support.js";
+import * as facts from "../capability-facts.js";
 import { materializeAttachmentsInto } from "../plugins/task-attachment-store.js";
 import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-isolation.js";
 import { customPkgSourceFromEnv, derivePkgSourceEnv } from "../sandbox-pkg-source.js";
@@ -204,7 +205,7 @@ export function createExecutionEnv(ctx) {
     }
     else if (config.remoteExec?.provider === "host") {
         {
-            const hostScheduler = config.schedulerEnabled && config.requirePrincipal !== true
+            const hostScheduler = facts.hostScheduler(config).available
                 ? new FileSchedulerBackend({
                     ...(config.schedulerStorePath ? { storePath: config.schedulerStorePath } : {}),
                     ...(config.schedulerSessionWakeup === false || config.schedulerSessionLifetime === false

package/dist/boot/exit-boundary.d.ts

@@ -3,10 +3,11 @@ import type { Logger } from "../observability/logger.js";
 export interface ProcessExitBoundary {
     /**
      * **优化点**,不承担不变量:受控退的收尾链在它自己的终点早按一次子进程腿(理由逐字写在
-     * `boot/shutdown.ts` 的调用点上 —— 那之后进程还活十秒量级,后台腿的软→硬梯子跑得完)。
+     * `boot/shutdown.ts` 的调用点上 —— 调用方随后在退出前等一次后台宽限,后台腿的软→硬梯子跑得完)。
      * 工作区腿**刻意不给**这条早按:停机中段 `rm -rf` 会把在飞 turn 正在写的目录从它脚下抽掉。
+     * 返回本次软停的后台行数(core `reapAllSessionBackground` 的返回;腿抛错 ⇒ 0,warn 已记)—— 调用方据此决定欠不欠宽限。
      */
-    reapChildProcessesEarly(): void;
+    reapChildProcessesEarly(): number;
     /** 摘掉本次装配的 `exit` 钩。幂等(同进程内反复装配的调用方=测试必须用它收尾)。 */
     dispose(): void;
 }

package/dist/boot/exit-boundary.js

@@ -5,8 +5,10 @@ import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "..
 const PROCESS_EXIT_INCLUDES_RETAINED = false;
 export function installProcessExitBoundary({ logger }) {
     const reapOwnChildProcesses = () => {
+        let backgroundSoftStopped = 0;
         try {
             const reaped = defaultTaskRegistry.reapAllSessionBackground();
+            backgroundSoftStopped = reaped;
             if (reaped > 0)
                 logger.info("shutdown_background_reaped", { reaped });
         }
@@ -23,6 +25,7 @@ export function installProcessExitBoundary({ logger }) {
         catch (err) {
             logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
         }
+        return backgroundSoftStopped;
     };
     const reapBackgroundHard = () => {
         try {

package/dist/boot/resolve-spec.js

@@ -9,7 +9,7 @@ import { gateScenarioRequest, mergeUserSkills, selectScenario } from "../capabil
 import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.js";
 import { buildNoticeLaneFacts, shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
-import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
+import { assertGuardPatternsUsable, buildApprovalGrantNotice, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
 import { singleUserAutoAcceptBaselineApplies } from "../approval.js";
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
@@ -59,6 +59,9 @@ export function createResolveSpec(ctx) {
     };
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
+    const approvalGrantNotice = buildApprovalGrantNotice(config);
+    if (approvalGrantNotice)
+        logger.info(approvalGrantNotice.event, approvalGrantNotice.fields);
     const resolveSpec = async (body, req, auth, opts) => {
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
@@ -439,6 +442,7 @@ export function createResolveSpec(ctx) {
                 return merged && config.toolDeferLongtail ? applyLongtailDefer(merged, true) : merged;
             })(cap.tools),
             skills: body.disableSkills === true ? [] : mergeUserSkills(cap.skills, body.skills, logger),
+            ...(() => { const v = toolNameListFromBody(body.userInvokedSkills); return v ? { userInvokedSkills: v } : {}; })(),
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined),

package/dist/boot/shutdown.d.ts

@@ -96,6 +96,25 @@ export interface ShutdownCtx {
      *  `backend.close()` 之前等它 quiesce —— 在飞的 `put`(审批 park / 资源挂起…,与审批协调器在不在场无关)不许被抽掉连接池。 */
     parkCommits: ParkCommitWatch | undefined;
 }
+/**
+ * 受控退的**后台宽限**还要等多久(ms)—— hardShutdown 软停后台 shell 之后、`process.exit` 之前,给软停过的行**一次**
+ * `HOST_BG_KILL_GRACE_MS` 收完合作清理(host 梯子:SIGTERM → 宽限 → 组 SIGKILL)。
+ *
+ * 没有这一步时,**无活连接**的干净停机里 `server.close` 回调立刻落地、链上其余步骤都是毫秒级,`exit` 几乎紧跟软停,退出边界钩同拍一枪
+ * 组 SIGKILL ⇒ 收到 SIGTERM 后要一点时间停容器 / 刷盘的后台 shell 被腰斩。**只缩不延**的两条:
+ *  · 起点是软停时刻(不是「别的步骤做完之后」)—— 慢 close / 审批面收尾已经耗掉的时间算进宽限里,链上别的等待不与它相加,取较晚者;
+ *  · 封顶在 hardShutdown 起点算的**同一个到期点**(`deadlineMs`,与审批面收尾 / 店 quiesce 共读)—— 运维把宽限调得再长,
+ *    退出也不晚于到期点,一定早于 15 s 的 `finalExit`,不延长停机总上限。
+ * `softStopped` = 本次软停的后台行数(core `reapAllSessionBackground` 的返回;0 ⇒ 没有梯子在跑、不欠宽限,空闲引擎的退出不变慢)。
+ * 该数里含后台 agent / workflow 行(core 不拆开数),它们没有 shell 梯子 ⇒ 只有这一形会**多**等(≤ 一个宽限),不会少等。
+ */
+export declare function backgroundGraceRemainingMs(a: {
+    softStopped: number;
+    softStoppedAt: number;
+    now: number;
+    graceMs: number;
+    deadlineMs: number;
+}): number;
 /**
  * `installShutdownHandlers` 的**摘除把手**([ref] 二轮重扫件4)。
  *