@sema-agent/server 7.141.0 → 7.143.0

package/dist/http/routes/session-memory-sync.js

@@ -0,0 +1,174 @@
+import { memorySyncReportOf } from "@sema-agent/core";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import {} from "../route-ctx.js";
+import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { sessionOwnerCellOf } from "../../security.js";
+import { leafOfAdmittedHead } from "../../session-incarnation.js";
+import { declaredMemorySyncIdentityFlaw, memorySyncIdentityRule } from "../../memory-sync-identity.js";
+import { MEMORY_OBSERVATION_ABSENT_REASONS } from "../../plugins/store-contracts.js";
+export const SESSION_ACTIVE_SYNC_MESSAGE = "a run in this session is in flight, or the session moved on after the memory it reads was observed (a run was admitted or its transcript advanced) — wait for it to finish on its own, then sync again (do not cancel it to sync sooner)";
+export const SESSION_MEMORY_UNOBSERVED_REASONS = ["no_settled_run", ...MEMORY_OBSERVATION_ABSENT_REASONS, "memory_not_mounted", "no_leaf"];
+const LATEST_RUN_UNOBSERVED_MESSAGE = "the latest settled run in this session has no memory observation on record, and an earlier run is never read in its place — run another task in this session (if that run was refused, fix what refused it first), then sync";
+export const SESSION_MEMORY_UNOBSERVED_MESSAGES = {
+    no_settled_run: "this session has no settled run with a memory observation yet, so there is nothing to say about which memory it reads — run a task in it (or let the run in flight finish), then sync",
+    run_result_missing: LATEST_RUN_UNOBSERVED_MESSAGE,
+    run_result_unobserved: LATEST_RUN_UNOBSERVED_MESSAGE,
+    memory_not_mounted: "memory was configured for the latest settled run in this session but did not mount, so which memory this session reads is unknown, and an earlier run is never read in its place — run another task in this session (if its memory fails to mount again, fix that first), then sync",
+    no_leaf: "this session has no transcript yet, so there is no revision to sync from — run a task in it (or let the run in flight finish), then sync",
+};
+export function sessionReadSetOf(observed) {
+    if (observed === undefined)
+        return { kind: "unobserved", reason: "no_settled_run" };
+    const { taskId, observation } = observed;
+    switch (observation.state) {
+        case "mounted":
+            return { kind: "read", taskId, scopes: observation.scopes.map((s) => s.scope) };
+        case "none":
+            return { kind: "read", taskId, scopes: [] };
+        case "memoryless":
+            return { kind: "unobserved", reason: "memory_not_mounted" };
+        case "absent":
+            return { kind: "unobserved", reason: observation.reason };
+        default:
+            return assertNever(observation);
+    }
+}
+class ReportMintRefused extends Error {
+}
+function reportOf(round) {
+    try {
+        return memorySyncReportOf(round);
+    }
+    catch (err) {
+        if (err instanceof TypeError)
+            throw new ReportMintRefused(err.message);
+        throw err;
+    }
+}
+const inflightByLeg = new WeakMap();
+function mergedRound(leg, key, run) {
+    let table = inflightByLeg.get(leg);
+    if (table === undefined) {
+        table = new Map();
+        inflightByLeg.set(leg, table);
+    }
+    const inflight = table.get(key);
+    if (inflight !== undefined)
+        return inflight;
+    const owner = table;
+    const round = run().finally(() => {
+        if (owner.get(key) === round)
+            owner.delete(key);
+    });
+    table.set(key, round);
+    return round;
+}
+export async function handleSessionMemorySync(req, res, match, ctx) {
+    const { deps } = ctx;
+    switch (match.decl.id) {
+        case "session-memory-sync": {
+            const fact = facts.sessionMemorySync(deps);
+            if (!fact.available) {
+                switch (fact.why) {
+                    case "memory_sync_leg_absent":
+                        sendError(res, 501, "feature.memory_sync_disabled", "session memory sync is not available on this deployment — it runs only where a file memory engine syncs to a center (MEMORY_SYNC_URL)");
+                        return;
+                    case "run_store_absent":
+                        sendError(res, 501, "capability.run_store_required", "session memory sync requires a durable run store (DB_BACKEND=mysql|pg|local) — the session's read set is the memory its latest settled run observed");
+                        return;
+                    case "session_head_face_absent":
+                        sendError(res, 501, "capability.session_ownership_required", "session memory sync requires the session-ownership face (sessionStorage.headOf)");
+                        return;
+                    default:
+                        return assertNever(fact.why);
+                }
+            }
+            const { leg, runStore, sessionStorage } = fact;
+            if (deps.config.requirePrincipal && gatedPrincipal(req, deps.config) === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            if (ctx.helpers.rateLimited(req, res))
+                return;
+            const sessionId = ctx.helpers.safeDecode(match.params.sessionId);
+            if (sessionId === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
+            const readHead = () => sessionStorage.headOf(sessionId);
+            const head = await readHead();
+            if (head === undefined) {
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                return;
+            }
+            if (!ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(sessionStorage, sessionId, head.owner)))
+                return;
+            const sourceRevision = leafOfAdmittedHead(head);
+            const body = await ctx.helpers.readJson(req);
+            if (body === null || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((k) => k !== "target") || typeof body.target !== "string") {
+                sendError(res, 400, "request.body_shape", "body must be { target: string } — the sync identity the target engine publishes (GET /v1/capabilities → memorySyncServe.identity), verbatim; no other key");
+                return;
+            }
+            const target = body.target;
+            const flaw = declaredMemorySyncIdentityFlaw(target);
+            if (flaw !== undefined) {
+                sendError(res, 400, "request.field_invalid", `target ${memorySyncIdentityRule(flaw)} — send the target engine's memorySyncServe.identity exactly as GET /v1/capabilities publishes it`, { field: "target", reason: flaw });
+                return;
+            }
+            const readSet = sessionReadSetOf(await runStore.latestMemoryObservationForSession(sessionId));
+            if (readSet.kind === "unobserved" || sourceRevision === null) {
+                const reason = readSet.kind === "unobserved" ? readSet.reason : "no_leaf";
+                const activeTaskId = await runStore.getActiveTaskId(sessionId);
+                sendError(res, 409, "conflict.session_memory_unobserved", SESSION_MEMORY_UNOBSERVED_MESSAGES[reason], { reason, ...(activeTaskId !== undefined ? { activeTaskId } : {}) });
+                return;
+            }
+            const { taskId: observedTaskId, scopes } = readSet;
+            const quiet = async () => {
+                if ((await runStore.getActiveTaskId(sessionId)) !== undefined)
+                    return false;
+                if ((await runStore.latestRunForSession(sessionId))?.taskId !== observedTaskId)
+                    return false;
+                const now = await readHead();
+                return now !== undefined && leafOfAdmittedHead(now) === sourceRevision;
+            };
+            const fenced = () => reportOf({ target, sourceRevision, scopes, refused: { code: "session_active", message: SESSION_ACTIVE_SYNC_MESSAGE } });
+            let report;
+            try {
+                if (target !== leg.peer) {
+                    report = reportOf({ target, sourceRevision, scopes, refused: { code: "config.memory_sync_target_mismatch", reaches: leg.peer } });
+                }
+                else if (!(await quiet())) {
+                    report = fenced();
+                }
+                else if (scopes.length === 0) {
+                    report = reportOf({ target, sourceRevision, scopes, layers: [] });
+                }
+                else {
+                    report = await mergedRound(leg, JSON.stringify([sessionId, sourceRevision, observedTaskId, target]), async () => {
+                        const round = await leg.syncOnce("session-trigger", { reading: scopes });
+                        if (!(await quiet()))
+                            return fenced();
+                        return reportOf({ target, sourceRevision, scopes, layers: round.calls.filter((c) => scopes.includes(c.scope)) });
+                    });
+                }
+            }
+            catch (err) {
+                if (!(err instanceof ReportMintRefused))
+                    throw err;
+                deps.logger?.warn?.("session_memory_sync_report_refused", { sessionId, err: err.message });
+                sendError(res, 500, "internal.error", "memory sync failed");
+                return;
+            }
+            sendJson(res, 200, report);
+            return;
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const SESSION_MEMORY_SYNC_ROUTES = [
+    { id: "session-memory-sync", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/memory\/sync$/, label: "/v1/sessions/:id/memory/sync", methods: ["POST"] },
+];
+//# sourceMappingURL=session-memory-sync.js.map

package/dist/http/routes/session-sync.js

@@ -1,5 +1,5 @@
 import { once } from "node:events";
-import { randomBytes, createHash } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, validateFileHistoryExport } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
 import { FileHistoryUnreadableError, blobGetterOf, exportSessionManifest, exportedFileHistory, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
@@ -222,6 +222,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     return;
                 }
                 const fs = blobs.historyStore;
+                const exchange = blobs.blobExchange;
                 let envelope;
                 try {
                     envelope = await exportedFileHistory(fs, sessionId);
@@ -238,7 +239,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 let bytes;
                 try {
-                    bytes = await fs.getBlob(hash);
+                    bytes = await exchange.get(hash);
                 }
                 catch (e) {
                     if (sendPullUnreadable(req, res, deps.logger, e))
@@ -268,16 +269,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 400, "request.id_invalid", "blob hash must be 64 lowercase-hex chars");
                     return;
                 }
-                const fs = blobs.historyStore;
                 const body = await readRawBody(req, SYNC_BLOB_MAX_BYTES);
-                if (createHash("sha256").update(body).digest("hex") !== hash) {
-                    sendError(res, 400, "request.hash_mismatch", "blob hash mismatch");
-                    return;
-                }
-                const put = await fs.putBlob(hash, new Uint8Array(body));
+                const put = await blobs.blobExchange.put(hash, new Uint8Array(body));
                 if (!put.ok) {
-                    if (put.error.code === "blob_too_large_for_sql") {
-                        sendError(res, 413, "blob_too_large_for_sql", put.error.message, { wallSource: put.error.wallSource });
+                    if (put.error.blobCap !== undefined) {
+                        sendError(res, 413, "blob_too_large_for_sql", put.error.message, { wallSource: put.error.blobCap.wallSource });
+                        return;
+                    }
+                    if (put.error.code === "adopt_failed") {
+                        sendError(res, 400, "request.hash_mismatch", "blob hash mismatch");
                         return;
                     }
                     sendError(res, 502, put.error.code, "blob store write failed");
@@ -751,15 +751,8 @@ async function firstMissingBlob(blobFaces, referenced) {
         return undefined;
     if (!blobFaces.available)
         return referenced[0];
-    const store = blobFaces.historyStore;
-    if (typeof store.hasBlobs === "function") {
-        const present = await store.hasBlobs([...referenced]);
-        return referenced.find((h) => !present.has(h));
-    }
-    for (const hash of referenced)
-        if (!(await store.getBlob(hash)))
-            return hash;
-    return undefined;
+    const present = await blobFaces.blobExchange.has(referenced);
+    return referenced.find((h) => !present.has(h));
 }
 function sendSessionSyncUnavailable(res, why) {
     switch (why) {
@@ -779,7 +772,7 @@ function sendSessionSyncUnavailable(res, why) {
         case "policy_purge_absent":
             sendError(res, 501, "capability.policy_purge_required", "session sync is not available on this deployment: the session-policy store has no deleteBySession purge verb, so an overwrite-dst import could not wipe the destination's stale policy rows. Every in-tree policy store carries it since core 1.423 — upgrade the policy store");
             return;
-        case "sync_blob_faces_absent":
+        case "blob_exchange_absent":
             sendError(res, 501, "capability.snapshot_store_required", "file-history blob transfer is not available on this deployment: its file-history store has no blob faces (SQL backends only; capabilities.sessionSyncFileHistory is false here). Sync the conversation without fileHistory");
             return;
         default:

package/dist/http/routes/sessions-list.d.ts

@@ -16,7 +16,8 @@ export declare function handleSessionsList(req: IncomingMessage, res: ServerResp
  * 会话列表行的 **wire 投影** —— `GET /v1/sessions` 的每一行与 `PATCH /v1/sessions/:id` 的 200 回执是**同一只**(店行 → wire 行只有这一处)。
  *  · 预览:店行读的是 run 行预览列的事实位(`""` = 有记录、剥完没有用户正文;NULL = 没记录);本面只说「有没有可显示的预览」⇒ 两者都是 `null`。
  *  · `tempo`:见上方 [ref] 注(由 `lastStatus` 经唯一一张表派生;omit-when-absent)。
- *  · 其余键(含 `title` / `pinned`)零投影透传 —— 店行是唯一铸点。
+ *  · 其余键(含 `title` / `pinned` / `rowTag` / `unreadable`)零投影透传 —— 店行是唯一铸点(`unreadable` 的码出自 `session-error-wire.ts` 的那一张表,
+ *    与全局兜底对同一只会话答的码同读;SQL 孪生的叶子是行上一列 ⇒ 恒缺席)。
  */
 export declare function projectSessionListRow(r: SessionListItem): SessionListItem & {
     tempo?: ReturnType<typeof sessionTempoOfRunStatus>;

package/dist/http/routes/sessions.d.ts

@@ -12,7 +12,7 @@
  * `sse.sseConnections` / `sse.sseOwnerLookups`——`let` 无法跨模块共享自增。判据/时机/配对释放逐字未动。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { type SessionMemoryStatus } from "@sema-agent/core";
+import type { SessionMemoryView } from "../../memory-operator-faces.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 单域独占状态。每个 server 实例一份——模块级会把连接坑/缓存跨实例串味。 */
 export interface SessionsLocal {
@@ -42,7 +42,7 @@ export interface SessionsLocal {
      *  mcp/a2a 按 (scenario, principal) 分键是因为它们的面按人裁,这张面不按人裁,分键只会白扩表)。 */
     memoryStatusCache: Map<string, {
         at: number;
-        status: Promise<SessionMemoryStatus>;
+        status: Promise<SessionMemoryView>;
     }>;
 }
 export declare function createSessionsLocal(): SessionsLocal;

package/dist/http/routes/sessions.js

@@ -8,13 +8,12 @@ import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
-import { foldPlaneStatuses } from "../../memory-operator-faces.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
 import { headReadOf, leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
-import { runRowReadableOnSessionFace } from "../owner-access.js";
+import { foldOwnerUnreadable, runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
@@ -84,7 +83,7 @@ export async function handleSessions(req, res, match, ctx) {
     const readOwnedSessionView = async (sessionAudit, sessionId, readOpts) => {
         const headOf = headReadOf(deps.sessionStorage);
         if (headOf !== undefined) {
-            const owner = (await headOf(sessionId))?.owner;
+            const owner = (await foldOwnerUnreadable(deps.logger, match.decl.id, sessionId, () => headOf(sessionId)))?.owner;
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return undefined;
@@ -274,7 +273,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const head = await headOf(headSession);
+            const head = await foldOwnerUnreadable(deps.logger, match.decl.id, headSession, () => headOf(headSession));
             if (head === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -304,7 +303,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const reading = await placementFact.seat.read(placementSession);
+            const reading = await foldOwnerUnreadable(deps.logger, match.decl.id, placementSession, () => placementFact.seat.read(placementSession));
             if (reading === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
@@ -322,7 +321,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const readHead = (id) => evFact.sessionStorage.headOf(id);
+            const readHead = (id) => foldOwnerUnreadable(deps.logger, match.decl.id, id, () => evFact.sessionStorage.headOf(id));
             const readOwner = async (id) => (await readHead(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
@@ -541,6 +540,10 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.body_shape", "invalid session memory erase body — expected { requestId: string, allowUnevidenced?: boolean } (no `select`: this face erases exactly this session's own contributions)");
                 return;
             }
+            if ("scope" in raw) {
+                sendError(res, 400, "request.body_shape", "invalid session memory erase body — `scope` is not accepted: this face erases this session's own contributions in every memory store of the deployment, so there is no layer to name; resend without `scope`");
+                return;
+            }
             if ("select" in raw) {
                 sendError(res, 400, "request.body_shape", "invalid session memory erase body — `select` is not accepted on the self-service face: the selector is fixed to { sessionId: <this session> } by the path; the operator face POST /v1/memory/erase takes explicit selectors");
                 return;
@@ -553,17 +556,12 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "allowUnevidenced must be a boolean when present");
                 return;
             }
-            const at = readLayerSeat(res, Object.prototype.hasOwnProperty.call(raw, "scope"), raw.scope);
-            if (at === null)
-                return;
             const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
             try {
                 const input = { requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) };
-                sendJson(res, 200, await (at !== undefined ? faces.erase(input, at) : faces.erase(input)));
+                sendJson(res, 200, await faces.erase(input));
             }
             catch (err) {
-                if (sentMemoryLayerRefusal(res, err, { kind: "session_owner", withheld }))
-                    return;
                 if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }, deps.logger))
                     return;
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
@@ -601,21 +599,22 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             try {
                 const { memoryStatusCache } = ctx.local.sessions;
-                const statusOf = (store) => {
-                    const cacheKey = JSON.stringify([sessionId, store.controlPlane]);
-                    const cached = memoryStatusCache.get(cacheKey);
-                    if (cached && Date.now() - cached.at <= MEMORY_STATUS_TTL_MS)
-                        return cached.status;
+                const reading = face.readingAt(at);
+                const cacheKey = JSON.stringify([sessionId, reading.key]);
+                const cached = memoryStatusCache.get(cacheKey);
+                let pending;
+                if (cached && Date.now() - cached.at <= MEMORY_STATUS_TTL_MS)
+                    pending = cached.status;
+                else {
                     if (memoryStatusCache.size > 1024)
                         memoryStatusCache.clear();
-                    const status = store.status(sessionId);
-                    const fresh = { at: Date.now(), status };
+                    pending = reading.status(sessionId);
+                    const fresh = { at: Date.now(), status: pending };
                     memoryStatusCache.set(cacheKey, fresh);
-                    status.catch(() => { if (memoryStatusCache.get(cacheKey) === fresh)
+                    pending.catch(() => { if (memoryStatusCache.get(cacheKey) === fresh)
                         memoryStatusCache.delete(cacheKey); });
-                    return status;
-                };
-                const s = foldPlaneStatuses(await Promise.all(face.storesAt(at).map(statusOf)));
+                }
+                const s = await pending;
                 sendJson(res, 200, {
                     sessionId,
                     autoConsolidationArmed: deps.memoryAutoConsolidationArmed,

package/dist/http/routes/tasks.js

@@ -5,18 +5,18 @@ import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpS
 import { atHostBoundary, sealResultForExit, outwardPlane } from "../../terminal.js";
 import { voidVerifierPauseCard } from "../../verifier-pause-card.js";
 import { withPrincipal } from "../../observability/principal-context.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
-import { createReasoningSegments, reasoningStreamOfTask } from "../../trace/model-segment.js";
+import { createLiveModelText, modelStreamOfTask } from "../../trace/model-segment.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
-import { createLedgerSink, createLedgerTwinEmit } from "../../trace/ledger-sink.js";
+import { createForwardAppendFailedNote, createLedgerSink, createLedgerTwinEmit } from "../../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../../trace/engine-notice-wire.js";
 import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { writeLiveFrame, writeLiveHeartbeat } from "../live-frame.js";
-import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData, liveIdentityFields } from "../../trace/project.js";
+import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, liveIdentityFields } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { replayOfExistingRun } from "../submit-replay.js";
@@ -36,12 +36,11 @@ import * as facts from "../../capability-facts.js";
 import { persistSubmitCtx } from "../submit-ctx.js";
 import { serviceVersion } from "../../service-version.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
-import { runSkillsOf } from "../../capabilities/skills.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 import { refusalBody } from "../refusal-body.js";
 import { heldWorkflowParkDecisions } from "../../parked-decide.js";
-import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../../session-workspace.js";
+import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../../session-workspace.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 async function mintSubmitExitResult(result, checkpoints) {
     return redactTerminalResult(sealResultForExit(await graftParkToolCallId(result, checkpoints)));
@@ -166,7 +165,7 @@ export async function handleTasks(req, res, match, ctx) {
             const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
             let wiringReceipt;
             const instructionLeg = createInstructionSelectionLeg();
-            const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(prepared.spec) });
+            const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: prepared.legFacts?.skills });
             const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
             if (liveStream) {
                 if (prepared.verify || prepared.cascade) {
@@ -342,7 +341,7 @@ export async function handleTasks(req, res, match, ctx) {
                     if (durableTaskId && deps.runStore) {
                         const rs = deps.runStore;
                         const tid = durableTaskId;
-                        ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), legSections: legWiringSections });
+                        ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), legSections: legWiringSections, usage: { modelUsage: deps.modelUsage, taskId: tid } });
                         usageKey = tid;
                         deps.modelUsage?.register(tid);
                         const owner = principal ?? null;
@@ -400,7 +399,8 @@ export async function handleTasks(req, res, match, ctx) {
                         ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
                         live: (row) => {
                             if (res.writableEnded || res.destroyed) {
-                                recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");
+                                if (noticeLedger === undefined)
+                                    recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");
                                 return;
                             }
                             writeLiveFrame(res, { type: "engine_notice", ...row });
@@ -417,8 +417,8 @@ export async function handleTasks(req, res, match, ctx) {
                         const streamBody = async () => {
                             await withPrincipal(principal, async () => {
                                 const tailContentMode = prepared.spec.forwardSubagentEvents === true ? "on" : "progress_only";
-                                const childReasoning = createReasoningSegments();
-                                const topReasoning = createReasoningSegments();
+                                const childText = createLiveModelText();
+                                const topText = createLiveModelText();
                                 const heldDecisions = await heldWorkflowParkDecisions(deps, prepared.spec.sessionId);
                                 const fwdInternals = {
                                     ...heldDecisions,
@@ -432,8 +432,8 @@ export async function handleTasks(req, res, match, ctx) {
                                         }
                                         if (res.writableEnded)
                                             return;
-                                        for (const end of childReasoning.onEvent(e))
-                                            writeLiveFrame(res, end);
+                                        for (const f of childText.onEvent(e))
+                                            writeLiveFrame(res, f);
                                         const t = e.type;
                                         if (t === "task_progress") {
                                             writeLiveFrame(res, { type: "task_progress", ...taskProgressEventData(e) });
@@ -449,34 +449,20 @@ export async function handleTasks(req, res, match, ctx) {
                                             const te = e;
                                             writeLiveFrame(res, { type: "tool_end", ...toolEndEventData(te) });
                                         }
-                                        else if (t === "text_delta") {
-                                            const td = e;
-                                            writeLiveFrame(res, { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) });
-                                        }
-                                        else if (t === "text_end") {
-                                            const tend = textEndEventData(e);
-                                            if (tend !== null)
-                                                writeLiveFrame(res, { type: "text_end", ...tend });
-                                        }
-                                        else if (t === "reasoning_delta") {
-                                            const rd = e;
-                                            writeLiveFrame(res, { type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) });
-                                        }
                                     },
                                     onTaskNotification: (n, opts) => {
                                         if (n.task_type === "workflow")
                                             return;
                                         if (!res.writableEnded)
-                                            for (const end of childReasoning.cut(reasoningStreamOfTask(n.task_id, n.sessionId)))
-                                                writeLiveFrame(res, end);
+                                            for (const f of childText.cut(modelStreamOfTask(n.task_id)))
+                                                writeLiveFrame(res, f);
                                         defaultSubagentTailBus.forgetHandle(n.task_id);
                                         if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
                                             defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
                                         }
-                                        const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                                         const deliverable = syncLegLive && !res.writableEnded && !res.destroyed;
                                         const parked = !deliverable && deps.workflowCompletionInbox !== undefined;
-                                        deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
+                                        deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, legLive: syncLegLive, parkedDurable: parked });
                                         if (parked) {
                                             void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                                         }
@@ -502,12 +488,12 @@ export async function handleTasks(req, res, match, ctx) {
                                 if (durableTaskId)
                                     steerableRuns.set(durableTaskId, liveStream);
                                 prepared.acceptance.attachStream({ reachable: () => !closed && !res.writableEnded && !res.destroyed, write: (frame) => writeLiveFrame(res, { ...frame }) });
-                                const liveWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(prepared.spec));
+                                const liveWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), prepared.legFacts?.sessionWitness);
                                 for await (const ev of liveStream) {
                                     if (closed)
                                         break;
-                                    for (const end of ev.type === "done" ? [...childReasoning.cut(), ...topReasoning.cut()] : topReasoning.onEvent(ev))
-                                        writeLiveFrame(res, end);
+                                    for (const f of ev.type === "done" ? [...childText.cut(), ...topText.cut()] : topText.onEvent(ev))
+                                        writeLiveFrame(res, f);
                                     const promptEntryId = promptCommit(ev);
                                     if (promptEntryId !== undefined)
                                         userMsgEntryId = promptEntryId;
@@ -568,8 +554,7 @@ export async function handleTasks(req, res, match, ctx) {
                                             writeLiveFrame(res, { type: "task_notification", ...taskNotificationEventData(ev) });
                                         }
                                     }
-                                    else if (ev.type === "reasoning_delta" && typeof ev.delta === "string") {
-                                        writeLiveFrame(res, { type: "reasoning_delta", delta: redactSecrets(ev.delta), ...(ev.eventId ? { eventId: ev.eventId } : {}), ...(ev.parentToolCallId ? { parentToolCallId: ev.parentToolCallId } : {}) });
+                                    else if (ev.type === "text_delta" || ev.type === "text_end" || ev.type === "reasoning_delta") {
                                     }
                                     else if (ev.type === "task_progress") {
                                         writeLiveFrame(res, { type: "task_progress", ...taskProgressEventData(ev) });
@@ -618,25 +603,19 @@ export async function handleTasks(req, res, match, ctx) {
                                     else if (ev.type === "human_input") {
                                         writeLiveFrame(res, { type: "human_input", ...humanInputEventData(ev) });
                                     }
-                                    else if (ev.type === "text_delta" || ev.type === "text_end" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
+                                    else if (ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
                                         const e = ev;
                                         const ident = liveIdentityFields(e);
-                                        const textEnd = ev.type === "text_end" ? textEndEventData(e) : undefined;
-                                        const arm = ev.type === "text_delta"
-                                            ? { type: "text_delta", delta: e.delta, ...ident }
-                                            : ev.type === "text_end"
-                                                ?
-                                                    textEnd === null || textEnd === undefined ? null : { type: "text_end", ...textEnd }
-                                                : ev.type === "turn_end"
-                                                    ? { type: "turn_end", ...turnEndEventData(ev), ...ident }
-                                                    : ev.type === "message_committed"
-                                                        ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
-                                                        : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
-                                        if (arm !== null)
-                                            writeLiveFrame(res, arm);
+                                        const arm = ev.type === "turn_end"
+                                            ? { type: "turn_end", ...turnEndEventData(ev), ...ident }
+                                            : ev.type === "message_committed"
+                                                ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
+                                                : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
+                                        writeLiveFrame(res, arm);
                                     }
                                     else {
-                                        writeLiveFrame(res, { ...ev });
+                                        const unknownArm = ev;
+                                        writeLiveFrame(res, { ...unknownArm });
                                     }
                                 }
                             });
@@ -742,10 +721,11 @@ export async function handleTasks(req, res, match, ctx) {
                             ? deps.sendUserFile.runWithContext({
                                 taskId: askTaskId,
                                 emit: async (f) => {
-                                    void (await emitAsk(f));
+                                    if (ledgerSink === undefined || faceAlive())
+                                        void (await emitAsk(f));
                                     if (ledgerSink) {
                                         const { type, ...rest } = f;
-                                        await ledgerSink.append(type, rest).catch(() => undefined);
+                                        await ledgerSink.append(type, rest).catch(createForwardAppendFailedNote(type));
                                     }
                                 },
                             }, withApproval)
@@ -957,7 +937,7 @@ export async function handleTasks(req, res, match, ctx) {
                         const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), heldDecisions);
                         const plainLeg = async () => {
                             const stream = prepared.runner.runTaskStream(specWithSignal, undefined, heldDecisions);
-                            const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(prepared.spec));
+                            const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), prepared.legFacts?.sessionWitness);
                             for await (const ev of stream) {
                                 observeSyncLegEvent(ev);
                                 prepared.acceptance.observe(ev);
@@ -975,7 +955,7 @@ export async function handleTasks(req, res, match, ctx) {
                             inflightRuns.delete(durableTaskId);
                     }
                     const syncAbortCause = syncCancelCtrl.cause();
-                    await voidVerifierPauseCard(result, deps.checkpointStore);
+                    await voidVerifierPauseCard(result, prepared.runner);
                     if (syncAbortCause !== undefined) {
                         result = mintCancelledResult({
                             taskId: durableTaskId ?? "",

package/dist/http/run-read-face.d.ts

@@ -5,6 +5,13 @@ import type { ServiceConfig } from "../config-types.js";
 export interface RunFaceDeps {
     config: Pick<ServiceConfig, "runStaleSec" | "infraCostRates">;
 }
+/** 一条行是不是「看起来失联」:盘上 `running`、而最后一次心跳早于 `runStaleSec` —— 读面把它折成 `failed`(`run.stalled`)。读它的人只此一只判据(读面与同步重放回执同读)。 */
+export declare function runRowStale(deps: RunFaceDeps, run: RunRecord): boolean;
+/**
+ * 一条行上的结果**当作出口结果读**(封口 + 脱敏的读入口)—— 读面的 `result` 与同步提交的重放体读的是同一只:
+ * 终局行按 taskId+updatedAt 记忆的读入口,非终局行(停驻 / 在跑)走店入口那一套封口的读入口;行上没有结果 ⇒ `undefined`。
+ */
+export declare function runRowExitResult(run: RunRecord): import("../plugins/store-contracts.js").PersistedTaskResult | undefined;
 export declare function readRunFace(deps: RunFaceDeps, runStore: RunStore, run: RunRecord): Promise<{
     result: import("../plugins/store-contracts.js").PersistedTaskResult | undefined;
     supervisorCost: import("../observability/cost-taxonomy.js").SupervisorCostBreakdown | undefined;