@sema-agent/server 7.116.1 → 7.118.0

package/dist/tool-approval.js

@@ -1,6 +1,7 @@
 import { contentKindOf } from "./approval-content-kind.js";
+import { liveSettledBy, policyCannotAllow, readDecidedBy, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK, SETTLED_BY_RETIRED } from "./host-decision.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { uuidv7, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
+import { uuidv7, classifyAsk, foldArbitrationRow, screenAskClassMembers, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, parseRuleText, pathConfinableWriteToolNames } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
 import { redactDeep, redactSecrets, redactSecretsWithArms } from "./trace/redact.js";
 import { hasBidiControls } from "./text-bidi.js";
@@ -8,12 +9,12 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { MAX_SETTLED_BY_CHARS, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, settledByFitsColumn } from "./plugins/approval-ask-store-sql.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { answerGrantsBeyondCall } from "./standing-answer-grant.js";
+import { answerGrantsBeyondCall, grantBindingOf } from "./standing-answer-grant.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -81,11 +82,37 @@ const FS_WRITE_TOOLS = pathConfinableWriteToolNames();
 function sessionAllowCategory(toolName) {
     return FS_WRITE_TOOLS.has(toolName) ? "fs-write" : `tool:${toolName}`;
 }
-function sessionAllowKey(owner, sessionId, category) {
-    return JSON.stringify([owner, sessionId, category]);
+function sessionAllowKey(owner, sessionId, category, binding) {
+    return JSON.stringify([owner, sessionId, category, binding.kind === "bound" ? binding.digest : null]);
+}
+function askStandingAnswerFacts(req, governanceForced) {
+    return {
+        governanceForced,
+        requiresRealApproval: req.requiresRealApproval === true,
+        mandated: req.mandated === true,
+        grantBinding: grantBindingOf(req),
+        classes: screenAskClassMembers(req.askClass, req.classes)?.classes,
+    };
+}
+export function policyAskStandingAnswerFacts(req, ask) {
+    return {
+        governanceForced: false,
+        requiresRealApproval: ask.requiresRealApproval === true,
+        mandated: ask.mandated === true,
+        grantBinding: grantBindingOf(req),
+        classes: [...classifyAsk(ask, { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} }).classes],
+    };
 }
 export function standingAnswerMayRetire(facts) {
-    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated && !facts.grantsBeyondCall;
+    return (!facts.governanceForced &&
+        !facts.requiresRealApproval &&
+        !facts.mandated &&
+        facts.grantBinding.kind !== "unreadable" &&
+        facts.classes !== undefined &&
+        foldArbitrationRow(new Set(facts.classes)).ruleMayClear);
+}
+export function standingAnswerDurablyRecordable(facts) {
+    return standingAnswerMayRetire(facts) && facts.grantBinding.kind === "none";
 }
 export function parkRowStandingAnswerFacts(pending, gate, governance) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
@@ -93,7 +120,8 @@ export function parkRowStandingAnswerFacts(pending, gate, governance) {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantsBeyondCall: answerGrantsBeyondCall(pending),
+        grantBinding: grantBindingOf(pending),
+        classes: screenAskClassMembers(pending.askClass, pending.classes)?.classes,
     };
 }
 function pendingEntryStandingAnswerFacts(entry) {
@@ -101,7 +129,8 @@ function pendingEntryStandingAnswerFacts(entry) {
         governanceForced: entry.governanceForced === true,
         requiresRealApproval: entry.requiresRealApproval === true,
         mandated: entry.mandated === true,
-        grantsBeyondCall: answerGrantsBeyondCall(entry),
+        grantBinding: entry.grantBinding,
+        classes: entry.classes,
     };
 }
 function mandatedFromSeat(seat) {
@@ -118,25 +147,6 @@ export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty str
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
-export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
-export function respondSettledBy(parsed) {
-    return parsed.settledBy;
-}
-export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
-export const SETTLED_BY_TOO_WIDE = `settledBy must be 1-${MAX_SETTLED_BY_CHARS} characters — the settlement source is one word from the engine's closed set and lands in a fixed-width column on the decision row`;
-export function judgeSettledByBody(settledBy, decision, directDoorActive) {
-    if (settledBy === undefined)
-        return { kind: "absent" };
-    if (directDoorActive)
-        return { kind: "not_in_proof" };
-    if (decision !== "deny")
-        return { kind: "deny_only" };
-    if (typeof settledBy !== "string")
-        return { kind: "not_string" };
-    if (!settledByFitsColumn(settledBy))
-        return { kind: "too_wide" };
-    return { kind: "accepted", settledBy };
-}
 export const READ_ROOT_GRANT_ALLOW_ONLY = 'readRootGrant is only meaningful with decision "allow" — it is the card\'s "Yes, and add directory" answer (allow this call and add the card\'s readRootCandidate.dir to this run\'s read directories)';
 export const READ_ROOT_GRANT_SHAPE = `readRootGrant must be the card's readRootCandidate.dir sent back byte for byte — a non-empty string of at most ${READ_ROOT_CANDIDATE_DIR_MAX} characters`;
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
@@ -183,23 +193,19 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
-        const settledByVerdict = judgeSettledByBody(body.settledBy, d, false);
-        let settledBy;
-        switch (settledByVerdict.kind) {
-            case "deny_only":
-                return { ok: false, error: SETTLED_BY_DENY_ONLY };
-            case "not_string":
-                return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
-            case "too_wide":
-                return { ok: false, error: SETTLED_BY_TOO_WIDE };
-            case "absent":
-                break;
+        if (body.settledBy !== undefined)
+            return { ok: false, error: SETTLED_BY_RETIRED };
+        const decidedByReading = readDecidedBy(body.decidedBy, false);
+        let decidedBy;
+        switch (decidedByReading.kind) {
+            case "outside_closed_set":
+                return { ok: false, error: DECIDED_BY_OUTSIDE_CLOSED_SET };
             case "accepted":
-                settledBy = settledByVerdict.settledBy;
+                decidedBy = decidedByReading.decidedBy;
                 break;
             default: {
-                const unreachable = settledByVerdict;
-                throw new Error(`unhandled settledBy verdict: ${JSON.stringify(unreachable)}`);
+                const unreachable = decidedByReading;
+                throw new Error(`unhandled decidedBy reading: ${JSON.stringify(unreachable)}`);
             }
         }
         const rawGrant = body.readRootGrant;
@@ -214,7 +220,7 @@ export function parseToolApprovalResponse(body) {
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
-            ...(settledBy !== undefined ? { settledBy } : {}),
+            decidedBy,
             ...(readRootGrant !== undefined ? { readRootGrant } : {}),
         };
     }
@@ -310,9 +316,10 @@ function replayTerminalAskRow(row) {
     return false;
 }
 export function outcomeOfDecidedRow(row) {
-    if (row.decision !== "approve")
-        return row.settledBy !== null ? { allow: false, settledBy: row.settledBy } : false;
-    return row.updatedInput !== undefined ? { allow: true, updatedInput: row.updatedInput } : true;
+    const allow = row.decision === "approve";
+    const source = row.settledBy !== null ? { settledBy: row.settledBy } : {};
+    const edit = allow && row.updatedInput !== undefined ? { updatedInput: row.updatedInput } : {};
+    return row.settledBy === null && !("updatedInput" in edit) ? allow : { allow, ...edit, ...source };
 }
 function settleArgsOfDecided(outcome) {
     if (typeof outcome === "boolean")
@@ -751,13 +758,14 @@ export class ToolApprovalCoordinator {
         return (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
     }
     async standingGrantSettles(origin, req, governanceForced) {
-        if (!standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }))
+        const facts = askStandingAnswerFacts(req, governanceForced);
+        if (!standingAnswerMayRetire(facts))
             return false;
         const sessionId = origin.sessionId;
         if (!sessionId)
             return false;
-        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName)));
-        const durable = !live && (await this.durableGrantHas(sessionId, req.toolName));
+        const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName), facts.grantBinding));
+        const durable = !live && !answerGrantsBeyondCall(req) && (await this.durableGrantHas(sessionId, req.toolName));
         if (!live && !durable)
             return false;
         if (!(await this.sessionGrantUncontestedByRow(origin, req)))
@@ -1071,6 +1079,7 @@ export class ToolApprovalCoordinator {
         let effectiveGovernanceForced = governanceForced;
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
+        const noRulingCause = readClosedWordSeat(req, "classifierNoRuling");
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
         const frame = {
@@ -1098,13 +1107,13 @@ export class ToolApprovalCoordinator {
             ...(governanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            ...(standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true, grantsBeyondCall: answerGrantsBeyondCall(req) }) ? {} : { rememberRefused: true }),
+            ...(standingAnswerMayRetire(askStandingAnswerFacts(req, governanceForced)) ? {} : { rememberRefused: true }),
+            ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
+            ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
             ...(askClassPair ?? {}),
-            ...(typeof req.persistedRuleShadowed === "string" && req.persistedRuleShadowed !== ""
-                ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
-                : {}),
+            ...((d) => (d !== undefined ? { allowRuleShadowed: d } : {}))(readAllowRuleShadowed(req)),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
             ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((f) => (f !== undefined ? { denialLimitFallback: f } : {}))(readDenialLimitFallback(req)),
@@ -1206,10 +1215,10 @@ export class ToolApprovalCoordinator {
                     frame.governanceForced = true;
                 else
                     delete frame.governanceForced;
-                if (typeof cardForFrame.persistedRuleShadowed === "string")
-                    frame.persistedRuleShadowed = cardForFrame.persistedRuleShadowed;
+                if (cardForFrame.allowRuleShadowed !== undefined)
+                    frame.allowRuleShadowed = cardForFrame.allowRuleShadowed;
                 else
-                    delete frame.persistedRuleShadowed;
+                    delete frame.allowRuleShadowed;
                 if (cardForFrame.inputHasBidi === true)
                     frame.inputHasBidi = true;
                 else
@@ -1308,11 +1317,12 @@ export class ToolApprovalCoordinator {
                 return unattended === "unavailable" ? unattended : shapeDeny(unattended);
             }
             if (settled.allowed) {
-                if (settled.updatedInput === undefined && settled.readRootGrant === undefined)
+                if (hostSettled === undefined && settled.updatedInput === undefined && settled.readRootGrant === undefined)
                     return true;
                 return {
                     allow: true,
                     ...(settled.updatedInput !== undefined ? { updatedInput: settled.updatedInput } : {}),
+                    ...(hostSettled !== undefined ? { settledBy: hostSettled } : {}),
                     ...(settled.readRootGrant !== undefined ? { readRootGrant: settled.readRootGrant } : {}),
                 };
             }
@@ -1625,11 +1635,14 @@ export class ToolApprovalCoordinator {
                 return shapeOutcome(await allowedP);
             }
         }
+        const entryGrantBinding = grantBindingOf(req);
+        const entryClasses = askClassPair?.classes;
         const rememberRefused = !standingAnswerMayRetire(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
             ...(req.mandated === true ? { mandated: true } : {}),
-            toolName: req.toolName,
+            grantBinding: entryGrantBinding,
+            classes: entryClasses,
         }));
         if (rememberRefused)
             frame.rememberRefused = true;
@@ -1650,6 +1663,8 @@ export class ToolApprovalCoordinator {
             ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             frame,
             toolName: req.toolName,
+            grantBinding: entryGrantBinding,
+            ...(entryClasses !== undefined ? { classes: entryClasses } : {}),
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
@@ -1787,6 +1802,9 @@ export class ToolApprovalCoordinator {
         const preRule = this.precheckEditedRuleBeforeDecision(entry, parsed);
         if (preRule !== undefined)
             return preRule;
+        if (policyCannotAllow(parsed.decidedBy, parsed.value !== "deny", entry.requiresRealApproval === true)) {
+            return { status: 400, body: { error: POLICY_CANNOT_ALLOW_PERSON_ASK, errorCode: "request.body_shape" } };
+        }
         const ruleEligibility = { eligible: true };
         const settled = this.askStore && entry.askId !== undefined && entry.batchId !== undefined
             ? this.respondWithCas(this.askStore, entry.askId, entry.batchId, id, entry, parsed, ruleEligibility)
@@ -1947,7 +1965,7 @@ export class ToolApprovalCoordinator {
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
-                    ...(parsed.settledBy !== undefined ? { settledBy: parsed.settledBy } : {}),
+                    decidedBy: parsed.decidedBy,
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
@@ -2185,7 +2203,7 @@ export class ToolApprovalCoordinator {
                 decision: parsed.value === "deny" ? "deny" : "approve",
                 ...(parsed.note !== undefined ? { decisionNote: parsed.note } : {}),
                 ...(parsed.value !== "deny" && parsed.updatedInput !== undefined ? { updatedInput: parsed.updatedInput } : {}),
-                ...(parsed.settledBy !== undefined ? { settledBy: respondSettledBy(parsed) } : {}),
+                ...((sb) => (sb !== undefined ? { settledBy: sb } : {}))(liveSettledBy(parsed.decidedBy)),
             }), "decideAsk", DURABLE_CALL_TIMEOUT_MS, (late) => {
                 if (late.ok)
                     this.notifyExternalDecision(askId, outcomeOfDecidedRow(late.row));
@@ -2246,10 +2264,10 @@ export class ToolApprovalCoordinator {
                 if (oldest !== undefined)
                     this.allowAllSessions.delete(oldest);
             }
-            this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName)));
+            this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName), entry.grantBinding));
         }
         const allowed = parsed.value !== "deny";
-        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: respondSettledBy(parsed) };
+        const settleArgs = opts?.settleOutcome !== undefined ? settleArgsOfDecided(opts.settleOutcome) : { allowed, updatedInput: parsed.updatedInput, settledBy: liveSettledBy(parsed.decidedBy) };
         const readRootGrant = opts?.settleOutcome === undefined || opts.settleOutcomeIsThisRequest === true ? parsed.readRootGrant : undefined;
         entry.settle(settleArgs.allowed, settleArgs.allowed ? "allowed" : "denied", settleArgs.updatedInput, settleArgs.settledBy, settleArgs.allowed ? undefined : parsed.note, readRootGrant);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;

package/dist/trace/core-keyset-guard.d.ts

@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -129,14 +129,14 @@ type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "mem
 type _GuardWiringGovernance = AssertAllKeysHandled<Exclude<keyof WiringSection<"governance">, WiringGovernanceHandled>>;
 type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernanceHandled, keyof WiringSection<"governance">>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed" | "permission.skill_allowed" | "permission.allowed_tools_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
@@ -144,11 +144,11 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
@@ -199,7 +199,7 @@ type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveA
 type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
 type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
 type ParkRowKeys = keyof NonNullable<WorkflowRun["parks"]>[number];
-type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed";
+type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed" | "parkedBy" | "generation";
 type ParkRowWithheld = "token";
 type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
 type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "task.tool_turn_incomplete"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -63,12 +63,10 @@ export interface EngineNoticeWireRow {
  */
 export declare function sanitizeNoticeDetail(detail: Record<string, unknown> | undefined): Record<string, unknown>;
 /**
- * `engine_notice` 载荷构造器(三条终点腿同源:live SSE / durable 账本 / 未来的任何第四条腿)。
- *
- * 与 `trace/project.ts` 的 `*EventData` 族同纪律(白名单挑键、禁 `{...notice}`),但**不住在那个文件里**:
- * 那一族的入参全是 core `TaskEvent` 的臂(有 `wire-whitelist-exhaustiveness` 的臂集编译门看着),
- * 而 `EngineNotice` 不是 `TaskEvent` —— 混进去会让那道门的语义变成"两个不同来源的联合",判别力反而降。
+ * 通告 `detail` 里的**规则条目原串**过呈现口(`presentRuleEntry`:剥 C0 / 双向控制符、超长截断)—— 会话流行(经 {@link engineNoticeEventData})
+ * 与运维日志行(`boot/runner-deps.ts` 的转发席)同调这一只。其余字段、其余码原样(多行文本不受影响)。
  */
+export declare function presentNoticeDetail(code: string, detail: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
 export declare function engineNoticeEventData(notice: {
     code: string;
     message: string;

package/dist/trace/engine-notice-wire.js

@@ -1,4 +1,5 @@
 import { redactSecrets } from "./redact.js";
+import { presentRuleEntry } from "../rule-entry-list.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.session_polluted",
@@ -33,6 +34,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "permission.ask_released_by_mode",
     "permission.read_deny_unapplied",
     "permission.rule_store_unavailable",
+    "permission.allowed_tool_not_granted",
     "task.tool_turn_incomplete",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
@@ -90,11 +92,22 @@ function sanitizeValue(v, depth) {
     }
     return undefined;
 }
+const RULE_ENTRY_DETAIL_ARRAYS = { "permission.allowed_tool_not_granted": "entries" };
+export function presentNoticeDetail(code, detail) {
+    const key = Object.hasOwn(RULE_ENTRY_DETAIL_ARRAYS, code) ? RULE_ENTRY_DETAIL_ARRAYS[code] : undefined;
+    if (key === undefined || detail === undefined)
+        return detail;
+    const list = detail[key];
+    if (!Array.isArray(list))
+        return detail;
+    const presented = list.map((item) => item !== null && typeof item === "object" && typeof item.entry === "string" ? { ...item, entry: presentRuleEntry(item.entry) } : item);
+    return { ...detail, [key]: presented };
+}
 export function engineNoticeEventData(notice, sessionId, nowMs) {
     return {
         code: notice.code,
         message: redactSecrets(String(notice.message)).slice(0, NOTICE_TEXT_MAX),
-        detail: sanitizeNoticeDetail(notice.detail),
+        detail: sanitizeNoticeDetail(presentNoticeDetail(notice.code, notice.detail)),
         sessionId,
         ts: nowMs,
     };

package/dist/trace/self-minted-wire.d.ts

@@ -19,9 +19,9 @@ export declare const SELF_MINTED_WIRE: {
         };
     };
     /**
-     * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_STEER_UNDRAINED_CAUSES`,
+     * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_INPUT_UNDRAINED_CAUSES`,两族共用;
      * `leg_end` 由引擎铸、逐字过境,不在本表);本表登记的是「这个值自哪一版起由本服务出现在 wire 上」。`satisfies Record<CrashedCause, …>`:
-     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。
+     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。码按受理时的车道选(`user-input-ledger.ts` `userInputLaneOf`):本行 = steer 车道。
      */
     readonly userSteerUndrainedServerCause: {
         readonly at: "engine_notice task.user_steer_undrained detail.cause(本服务铸的臂;下一条同会话 run 开通告口那一拍)";
@@ -32,6 +32,16 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /** S-1122(7.118.0,core 7.44.0 #1362):同一臂在 follow-up 车道(`later` 档)上的那一族。7.110.0–7.117.x 的这类丢失报在 steer 一族里。 */
+    readonly userFollowupUndrainedServerCause: {
+        readonly at: "engine_notice task.user_followup_undrained detail.cause(本服务铸的臂;`later` 档受理的崩溃丢失,下一条同会话 run 开通告口那一拍)";
+        readonly members: {
+            crashed: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /**
      * S-961(7.111.0):`wiring_manifest.instructions.selected[]` 的成员值 = 指令文件链的成员(相对 cwd 的拼写)。属主是 `project-memory.ts`
      * 的 `INSTRUCTION_FILE_CHAIN`([ref] 序:CLAUDE 族先、AGENTS 族后,首中即选)—— 链加 / 删一员 ⇒ 本行 `satisfies` 编译红,登记跟着动。
@@ -95,6 +105,10 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 409;
                 readonly since: "7.101.0";
             };
+            readonly "memory.scope_home_not_directory": {
+                readonly attr: 409;
+                readonly since: "7.118.0";
+            };
             readonly "memory.erasure_evidence_unavailable": {
                 readonly attr: 409;
                 readonly since: "7.108.0";

package/dist/trace/self-minted-wire.js

@@ -12,6 +12,12 @@ export const SELF_MINTED_WIRE = {
             crashed: { attr: "-", since: "7.110.0" },
         },
     },
+    userFollowupUndrainedServerCause: {
+        at: "engine_notice task.user_followup_undrained detail.cause(本服务铸的臂;`later` 档受理的崩溃丢失,下一条同会话 run 开通告口那一拍)",
+        members: {
+            crashed: { attr: "-", since: "7.118.0" },
+        },
+    },
     wiringInstructionsSelected: {
         at: "wiring_manifest instructions.selected[](本腿 loader 选中的链成员;段缺席 = 本腿无陈述)",
         members: {
@@ -34,6 +40,7 @@ export const SELF_MINTED_WIRE = {
         members: {
             "config.memory_erasure_request": { attr: 400, since: "7.52.0" },
             "memory.target_outside_store": { attr: 409, since: "7.101.0" },
+            "memory.scope_home_not_directory": { attr: 409, since: "7.118.0" },
             "memory.erasure_evidence_unavailable": { attr: 409, since: "7.108.0" },
             "memory.erasure_selector_mismatch": { attr: 409, since: "7.108.0" },
             "memory.erasure_census_incomplete": { attr: 409, since: "7.108.0" },

package/dist/user-input-ledger.d.ts

@@ -6,7 +6,7 @@
  * `POST /v1/runs/:id/steer` 对本副本的活 run 回 **200 `delivery:"applied"`**:输入只进了 core `TaskStream` 的**进程内**队列,
  * 本服务此前不落任何字节。「你的输入丢了」今天唯一的告知是 core 在**腿终局**铸的 `task.user_steer_undrained`(`cause:"leg_end"`)——
  * 进程被 SIGKILL / 崩溃时那个终局席跑不到 ⇒ **零告知**:壳手里只有一张 200 回执,重启后主请求与转录里都没有它。
- * core 7.38.0 #1233 给了词:`detail.cause` 闭集 {@link USER_STEER_UNDRAINED_CAUSES} = `leg_end` / `crashed`,`crashed` 由**服务层**在
+ * core 给了词:`detail.cause` 闭集 {@link USER_INPUT_UNDRAINED_CAUSES} = `leg_end` / `crashed`,`crashed` 由**服务层**在
  * 该会话下一条 run 之前铸。本文件 = 那个服务层。
  *
  * ## 对象(一只账本,一类输入,一句规则)
@@ -22,9 +22,9 @@
  * (core `WorkflowTaskHandle.sessionScoped`),活得比发起它的 run 腿长,没有一条 run 行约束它,而 workflow run 行上没有持有者列 ⇒ 判不出写者死没死(另票);
  * 子代 resume(`…/subagents/:target/resume`)不往在飞的队列里投,起的是一条新的子代腿;follow-up 在本仓**没有**独立的受理口(`src/http/routes` 零
  * follow-up 入口)。steer 的 `later` 档在引擎里走 follow-up 车道(引擎在腿收场时按车道分账:没投出去的 `later` 记进 `task.user_followup_undrained`),
- * 但它仍是一次 `TaskStream.steer` 受理、消费帧同为 `human_input{delivery:"applied"}`(两车道同一只消费口)⇒ 同进本账,消费即结清;崩溃告知走 core 唯一的
- * 服务层臂 `task.user_steer_undrained{cause:"crashed"}`(core 对该臂的定义按动词:服务层受理过的 steer)。follow-up 一族在 core 里没有 `cause` 键、没有
- * 服务层臂 ⇒ 本账无处按车道归档,要按车道归档须 core 先给那一臂(上游待答)⇒ 闭集一词,不预留第二词。
+ * 但它仍是一次 `TaskStream.steer` 受理、消费帧同为 `human_input{delivery:"applied"}`(两车道同一只消费口)⇒ 同进本账,消费即结清。
+ * **族 = 受理时它排进的引擎车道**({@link UserInputKind}:`steer` / `follow_up`,由档位经 {@link userInputLaneOf} 一只函数得出),崩溃告知的码按族选
+ * (core 7.44.0 #1362:两族同一只成因词表 `USER_INPUT_UNDRAINED_CAUSES`,服务层的 `crashed` 臂按车道选码,与引擎自己的 `leg_end` 臂同一种分账)。
  *
  * ## 五形行(append-only;行序 = 语义序;File 孪生的盘上形 = 下面的 {@link UserInputLedgerRecord},SQL 孪生 = 一行一受理 + CAS 列 + 删行,同义)
  *  · `accepted`  —— 受理点(`routes/runs.ts` 的 live 腿,**调 `TaskStream.steer` 之前**、回 200 之前)写;写不进 ⇒ 503
@@ -85,17 +85,28 @@
  * 不开旋钮(没有「关掉告知」的正当需求)· 不改 steer 的 200 体(回执仍是「已交付」,账本是它的影子)· 不重放丢失的输入(core 明写
  * NOT redelivered;本账只告知,不替人决定重发)· 不存输入正文(行里只有身份与时刻)。
  */
-import { type EngineNoticeCode, type TaskEvent, type UserSteerUndrainedCause } from "@sema-agent/core";
+import { type EngineNoticeCode, type SystemInjectionPriority, type TaskEvent, type UserInputUndrainedCause } from "@sema-agent/core";
 import { type RunRecord } from "./plugins/store-contracts.js";
 import { type EngineNoticeRouter } from "./trace/engine-notice-wire.js";
 /** local 数据根下的子目录(File 孪生;与 `approval-ask-audit/` 同层同形)。 */
 export declare const USER_INPUT_LEDGER_DIR = "user-input-ledger";
-/** 账本收的输入族(闭集)。follow-up 结论见顶注「对象」段。 */
-export type UserInputKind = "steer";
-/** 读盘词表(`satisfies Record<…, true>` ⇒ 闭集加词而本表没跟 = 编译红;判定走 `Object.hasOwn`)。 */
+/**
+ * 账本收的输入族(闭集)= 受理时它排进的**引擎车道**:`steer`(`now` / `next` 档)/ `follow_up`(`later` 档)。崩溃告知的码按族选
+ * ({@link UNDRAINED_NOTICE_OF}),读面行的 `kind` 就是它。`follow_up` 自 7.118.0 起写(之前的版本受理口一律写 `steer`,`later` 档的旧行照它当时的族读)。
+ */
+export type UserInputKind = "steer" | "follow_up";
+/** 读盘词表(`satisfies Record<…, true>` ⇒ 闭集加词而本表没跟 = 编译红;判定走 `Object.hasOwn`)。≤7.117.x 的读腿不认 `follow_up`(回滚须知在 MIGRATION)。 */
 export declare const USER_INPUT_KIND_WORDS: {
     readonly steer: true;
+    readonly follow_up: true;
 };
+/**
+ * 一次受理排进哪条引擎车道 —— 三个受理口(run steer 的 live 腿 / interrupt 带 text 形 / 子代 steer)同调这一只。core 原句(`TaskStream.steer` 注):
+ * 「a `"later"` steer rides the followUp lane, so its stranded account is `task.user_followup_undrained`」;`now` / `next` 走 steer 车道。
+ * 档位型取 core 包根的 `SystemInjectionPriority`(`TaskStream.steer` 的 `priority`;缺席 = 引擎缺省 `next`),本仓不复述:core 加一档 ⇒ 下面的
+ * 穷举 `never` 臂编译红,由人裁新档排进哪条车道。
+ */
+export declare function userInputLaneOf(tier: SystemInjectionPriority | undefined): UserInputKind;
 /** `settled` 的两种收场(闭集,见顶注)。 */
 export type SettleHow = "leg_end" | "not_applied" | "consumed";
 /** 读盘词表(File 孪生的折叠守卫 / SQL 孪生的 `settle_how` 列读腿同读这一张;`consumed` 自 7.113.0 起,≤7.112.x 的读腿不认它 —— 回滚须知在 MIGRATION)。 */
@@ -105,7 +116,7 @@ export declare const SETTLE_HOW_WORDS: {
     readonly consumed: true;
 };
 /** 本服务铸的那一臂(core 删掉这个词 ⇒ `Extract` 得 `never` ⇒ 下面的常量编译红)。 */
-export type CrashedCause = Extract<UserSteerUndrainedCause, "crashed">;
+export type CrashedCause = Extract<UserInputUndrainedCause, "crashed">;
 export declare const CRASHED_CAUSE: CrashedCause;
 /** 盘上 / 行上的 cause 词判:必须是 core 闭集的成员,**且**铸者是服务层(词表外 / 引擎臂 ⇒ 不是本账能写的行)。 */
 export declare function isServingLayerUndrainedCause(v: unknown): v is CrashedCause;
@@ -328,11 +339,12 @@ export interface UserInputLedger {
     readSession(sessionId: string): Promise<UndrainedUserInputRow[] | undefined>;
 }
 /**
- * 一条旧 run 的 `crashed` 通告(纯数据)。`detail` 键集 = core 契约 `{ steer, cause, taskId?, sessionId?, runId? }` 的子集(`runId` 缺席,理由见顶注)。
+ * 一条旧 run 一族的 `crashed` 通告(纯数据)。`detail` 键集 = core 契约 `{ steer | followUp, cause, taskId?, sessionId?, runId? }` 的子集(`runId` 缺席,理由见顶注)。
  * `message` 只是 fallback 展示(core 同族句的形,只换成因);消费端按 `code` + `detail.cause` 分支。
  */
-export declare function buildCrashedSteerNotice(input: {
-    steer: number;
+export declare function buildCrashedUndrainedNotice(input: {
+    family: UserInputKind;
+    count: number;
     taskId: string;
     sessionId: string;
 }): {