@sema-agent/server 7.141.0 → 7.143.0

package/dist/boot/runner-deps.d.ts

@@ -7,7 +7,7 @@
  * ⚠️ **位置即契约**:必须晚于 stores/exec-env/coordinators/workflow 段(所有键都是它们的产物),
  * 且早于 `new Runner(runnerDeps)` —— Runner 构造时展开 tier 表成私有目录副本(之后的换代经
  * `Runner.swapDeps` 换进,见 boot/stage-08-reapers.ts)。
- * `getRunStore()` 是唯一的晚绑取值(runStore 在本段之后才构造),原文靠同作用域前向引用。
+ * runStore 在本段之后才构造 ⇒ 本段不读它(本段没有晚绑取值)。
  */
 import { type CacheBreakFinding, type CrossBoundaryPosture, type RunnerDeps, type WorkflowRunStore, type AskOutcome } from "@sema-agent/core";
 import type { createBrain } from "../brain.js";
@@ -19,13 +19,13 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type ConsolidationDriverSeat } from "./memory-consolidation.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
-import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
 import { type EngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
 import type { ServiceWorkflowJournalStore, SessionCaptureRecordSource, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
 import type { createSessionStore } from "../plugins/session-store.js";
 import type { QuestionCoordinator } from "../question.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
+import { type PeerInboundFace } from "../peer-inbound-face.js";
 import type { MemoryBackend } from "@sema-agent/core";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
 import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -68,7 +68,10 @@ export declare function createRunnerDepsOnAsk(toolApproval: ToolApprovalCoordina
  *  `classificationKnown:false`(指标标签折 `unknown`),不吞不编;与安装包的锁步由 test/boot-runner-deps-shared-base.test.ts
  *  的 dist 扫描格钉住(两种发射写法都读;读不出词的经变量发射点本身红;core 加词/收进 d.ts 那天先红)。
  *  第七词 `peer-seat-hold`(runtask 的 `holdDeclarations`,字面量):对端座的三员对象里 `hold` / `release` 抛了 ⇒ 引擎报一次、该引用
- *  不被持有;座是本仓的 desk,所以这是部署自己的故障,与其余六词同走 warn + 计数。 */
+ *  不被持有;座是本仓的 desk,所以这是部署自己的故障,与其余六词同走 warn + 计数。
+ *  第八词 `input-author-unreadable`(core 7.61.0 `run-leg.js` 的 `objectiveAuthorOf` 回调,字面量):宿主经 `RunInternals.objectiveAuthor`
+ *  递了一个不在 `INPUT_AUTHORS` 里的词 ⇒ 引擎报一次、该目标按操作者的输入筛。本服务不递这个字段(src 零读写),只有嵌入方手铸时才发射,
+ *  仍是部署侧的故障,同走 warn + 计数。 */
 export declare const CONFIG_ADVISORY_CLASSIFICATIONS: ReadonlySet<string>;
 /** [ref]:core 的 [ref] 前缀缓存**断裂**探测器交给宿主的根因**闭集**,以及每个词的日志级别。
  *  闭集**不抄词**:词源直接取 core 公开导出的 `CacheBreakFinding["cause"]`(`@sema-agent/core` 根导出,
@@ -240,10 +243,7 @@ export interface RunnerDepsCtx {
     workflowJournalStore: ServiceWorkflowJournalStore | undefined;
     workflowAgentRegistry: WorkflowAgentRegistry | undefined;
     workflowNotifyGate: WorkflowNotifyGate | undefined;
-    workflowCompletionInbox: WorkflowCompletionInbox | undefined;
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
-    /** 晚绑(runStore 在本段之后构造)——见文件头「位置即契约」。 */
-    getRunStore: () => ReturnType<StoreBackend["run"]> | undefined;
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
@@ -281,7 +281,10 @@ export interface EngineNoticeMetricsSeat {
 }
 export declare function createEngineNoticeForwarder(logger: {
     warn: (msg: string, fields?: Record<string, unknown>) => void;
-}, router?: EngineNoticeRouter, metrics?: EngineNoticeMetricsSeat): NonNullable<RunnerDeps["onNotice"]>;
+}, router?: EngineNoticeRouter, metrics?: EngineNoticeMetricsSeat, 
+/** [ref]:收信方决断面的坐标表(进程单例,与 core 的 held 队列注册表同寿命;它只读两条 peer 通告的坐标,见 `peer-inbound-face.ts`)。
+ *  默认值与 `router` 同一条理由:装配点多,必填会让「新车道忘了传」变成被扣的信静默不列。 */
+peerInbound?: Pick<PeerInboundFace, "observe">): NonNullable<RunnerDeps["onNotice"]>;
 /**
  * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
  * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。

package/dist/boot/runner-deps.js

@@ -8,20 +8,22 @@ import { assertAutoConsolidationWirable } from "./memory-consolidation.js";
 import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
-import { resolveServedSession } from "../orchestration/workflow-completion-inbox.js";
 import { defaultEngineNoticeRouter, redactNoticeMessage, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { buildCrossSessionInboundLayers, crossSessionDialogExpiryOf } from "../cross-session-settings.js";
+import { defaultPeerInboundFace } from "../peer-inbound-face.js";
 import { createPeerDirectory } from "../peer-directory.js";
 import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
 import { errorKindOf } from "../observability/err-text.js";
+import { codeFieldOf } from "../terminal.js";
 import { buildShownUrlsInText } from "../url-refusal.js";
+import { seatText } from "../trace/exit-seat.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
         return undefined;
@@ -30,6 +32,7 @@ export function createRunnerDepsOnAsk(toolApproval) {
 export const CONFIG_ADVISORY_CLASSIFICATIONS = new Set([
     "file-history-no-env",
     "file-history-no-store",
+    "input-author-unreadable",
     "interaction-posture-refused",
     "memory-tools-not-mounted",
     "peer-seat-hold",
@@ -45,7 +48,7 @@ export const PROMPT_CACHE_BREAK_CAUSE_LEVEL = {
 };
 const PROMPT_CACHE_BREAK_LEVELS = new Map(Object.entries(PROMPT_CACHE_BREAK_CAUSE_LEVEL));
 const CEILING_ORIGINS = new Set(["walltime", "turns"]);
-export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
+export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics, peerInbound = defaultPeerInboundFace) {
     return (notice) => {
         const detail = redactNoticeRuleText(notice.code, notice.detail);
         const message = redactNoticeMessage(notice.message);
@@ -55,6 +58,7 @@ export function createEngineNoticeForwarder(logger, router = defaultEngineNotice
             if (typeof origin === "string" && CEILING_ORIGINS.has(origin))
                 metrics.inc("limit_ceiling_after_answer_total", { origin });
         }
+        peerInbound.observe(notice);
         router.route(notice);
     };
 }
@@ -138,7 +142,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, } = ctx;
     const peerSessionLister = sessionStore.listSessions?.bind(sessionStore);
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
@@ -167,20 +171,6 @@ export function createRunnerDeps(ctx) {
                 ...(workflowNotifyGate
                     ? workflowNotifyGate.buildNotifier()
                     : { notify: (input) => deliverWorkflowCompletion(input) }),
-                ackServed: async (input) => {
-                    if (!workflowCompletionInbox)
-                        return;
-                    try {
-                        const sid = await resolveServedSession(input, getRunStore() ? (id) => getRunStore().getRun(id) : undefined);
-                        if (sid) {
-                            await workflowCompletionInbox.markTerminalServed(sid, input.runId);
-                            logger.info("workflow_complete_ack_served", { route: "poll-served", sessionId: sid, runId: input.runId });
-                        }
-                    }
-                    catch (err) {
-                        logger.warn("workflow_ack_served_failed", { runId: input.runId, err: String(err) });
-                    }
-                },
             },
         }
         : {};
@@ -199,7 +189,7 @@ export function createRunnerDeps(ctx) {
         onTaskOutcome: outcomeSink
             ? (o) => {
                 metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
-                void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
+                void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: seatText("operator-log-text", String(err)) }));
             }
             : undefined,
         onElicit: elicitation ? elicitation.elicit : undefined,
@@ -249,17 +239,18 @@ export function createRunnerDeps(ctx) {
             : undefined,
         ...selfOrchestrationDeps,
         onError: (err, ctx) => {
+            const codeField = codeFieldOf(err);
             if (ctx.phase === "degraded") {
-                logger.warn("task_degraded", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("task_degraded", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
                 return;
             }
             if (ctx.phase === "prompt-constitution") {
-                logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
                 return;
             }
             if (ctx.phase === "rewind") {
                 const code = rewindFailureCode(err);
-                logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: String(err) });
+                logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: seatText("operator-log-text", String(err)) });
                 metrics.inc("rewind_snapshot_failed_total", { code });
                 return;
             }
@@ -268,12 +259,12 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "mcp") {
-                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
+                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
                 metrics.inc("mcp_server_unavailable_total");
                 return;
             }
             if (ctx.phase === "a2a") {
-                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
+                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
                 metrics.inc("a2a_peer_unavailable_total");
                 return;
             }
@@ -285,7 +276,8 @@ export function createRunnerDeps(ctx) {
                     sessionId: ctx.sessionId,
                     confirmed: classification !== undefined,
                     ...(classification !== undefined ? { classification, classificationKnown: causeLevel !== undefined } : {}),
-                    err: String(err),
+                    ...codeField,
+                    err: seatText("operator-log-text", String(err)),
                 };
                 metrics.inc("prompt_cache_low_hit_total", {
                     ...(classification !== undefined ? { classification: causeLevel !== undefined ? classification : "unknown" } : {}),
@@ -298,25 +290,24 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "config") {
-                const code = typeof err?.code === "string" ? err.code : undefined;
                 const classification = ctx.classification;
                 const classificationKnown = classification === undefined ? undefined : CONFIG_ADVISORY_CLASSIFICATIONS.has(classification);
                 const fields = {
                     sessionId: ctx.sessionId,
-                    ...(code !== undefined ? { code } : {}),
+                    ...codeField,
                     ...(classification !== undefined ? { classification, classificationKnown } : {}),
-                    info: String(err),
+                    info: seatText("operator-log-text", String(err)),
                 };
                 logger.warn("runner_config_advisory", fields);
                 metrics.inc("runner_config_advisory_total", {
-                    ...(code !== undefined ? { code } : {}),
+                    ...codeField,
                     ...(classification !== undefined ? { classification: classificationKnown ? classification : "unknown" } : {}),
                     level: "warn",
                 });
                 return;
             }
             metrics.inc("runner_error_total", { phase: ctx.phase });
-            logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, err: String(err) });
+            logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, ...codeField, err: seatText("operator-log-text", String(err)) });
         },
         ...(ctx.consolidationSeat !== undefined
             ? {

package/dist/boot/runtime-caps.js

@@ -1,6 +1,7 @@
 import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, } from "../runtime-caps-resolver.js";
 import { scopedTokenNeedsWorker } from "../center-credential.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
+import { seatText } from "../trace/exit-seat.js";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
@@ -47,7 +48,7 @@ export function createRuntimeCaps(ctx) {
         ? createPrincipalEntitlementsClient({
             center: config.webAdmin,
             ...(config.webAdmin.worker ? { worker: config.webAdmin.worker } : {}),
-            onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }),
+            onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: seatText("operator-log-text", String(err)) }),
         })
         : undefined;
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
@@ -60,7 +61,7 @@ export function createRuntimeCaps(ctx) {
         const withMemoryGrant = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
             onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
                 principal,
-                err: String(err),
+                err: seatText("operator-log-text", String(err)),
                 ...(observability ? {} : { face: "capabilities-read" }),
                 effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
             }),

package/dist/boot/session-faces.js

@@ -11,6 +11,7 @@ import { probeSessionChildren, retireSessionChildren, sessionChildrenScope, Sess
 import { SessionActiveRunError } from "../execution-placement.js";
 import { headReadOf, redactIncarnations } from "../session-incarnation.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { seatText } from "../trace/exit-seat.js";
 export function createSessionFaces(ctx) {
     const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure, workflowCompletionInbox, taskListLane, dropSessionScoped, mailboxStore, mailboxRecipientLifecycle, backgroundAgentStore, userInputLedgerStore, spaceReclaimer, } = ctx;
     const mysqlPool = backend?.mysqlPool();
@@ -106,7 +107,7 @@ export function createSessionFaces(ctx) {
                 }
             }
             if (workflowCompletionInbox)
-                await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: String(err) }));
+                await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: seatText("operator-log-text", String(err)) }));
             const peerBox = mailboxStore !== undefined && mailboxRecipientLifecycle !== undefined
                 ? { store: mailboxStore, lifecycle: mailboxRecipientLifecycle, scope: owner ?? "default", handle: peerSessionBoxHandle(sessionId) }
                 : undefined;
@@ -118,7 +119,7 @@ export function createSessionFaces(ctx) {
                 await reapSessionBackgroundHard(sessionId, owner ?? "default", { includeRetained: false, reason: "session_deleted" }, logger);
             }
             catch (err) {
-                logger.warn("session_background_reap_failed", { sessionId, err: String(err) });
+                logger.warn("session_background_reap_failed", { sessionId, err: seatText("operator-log-text", String(err)) });
             }
             if (peerBox !== undefined)
                 await peerBox.store.drop(peerBox.scope, peerBox.handle);
@@ -138,7 +139,7 @@ export function createSessionFaces(ctx) {
                     logger.warn("workspace_space_reclaim_failed", {
                         sessionId,
                         stage: "seat_threw",
-                        error: redactIncarnations(String(err)),
+                        error: seatText("operator-log-text", redactIncarnations(String(err))),
                         effect: "the ended space's cache volume and snapshot objects may stay (the reclaim seat threw, which its contract forbids; the session delete went ahead) — the bucket's lifecycle rule is the fallback for objects, the volume is deleted by label sema.space",
                     });
                 });

package/dist/boot/shutdown.d.ts

@@ -31,6 +31,7 @@ import type { BreakerStateStore, CostQuotaStore, RateLimiterStore, StoreBackend
 import type { WorkflowNotifyJournalStore } from "../orchestration/workflow-notify-journal.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
+import type { PeerInboundShutdownReading } from "../peer-inbound-face.js";
 import { type DrainState } from "../fleet/drain-entry.js";
 export interface ShutdownCtx {
     config: ServiceConfig;
@@ -94,6 +95,14 @@ export interface ShutdownCtx {
     servingLease?: {
         stop(): void;
     } | undefined;
+    /**
+     * [ref]:被扣跨会话来信的收信方决断面(`peer-inbound-face.ts`,进程单例)的关停口 —— CC `HBe` 的宿主半场(core 不调 `PeerHeldQueue.shutdown()`)。
+     * hardShutdown 起点与审批面收尾**并行**调它、`backend.close()` 之前等它(结清要走信箱店的 CAS 与回执投递):本进程仍被扣的信按 core 的规则
+     * 带 `expired` 回执结清(reason `shutdown`)。缺席 = 本装配不接(测试装配)。
+     */
+    peerInbound?: {
+        shutdown(): Promise<PeerInboundShutdownReading>;
+    } | undefined;
 }
 /**
  * 受控退的**后台宽限**还要等多久(ms)—— hardShutdown 软停后台 shell 之后、`process.exit` 之前,给软停过的行**一次**

package/dist/boot/shutdown.js

@@ -9,6 +9,7 @@ import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
 import { DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL, HARD_STOP_ACTION_ID, drainDeadlineBeyondBound } from "../fleet/drain-entry.js";
+import { seatText } from "../trace/exit-seat.js";
 const HARD_STOP_GRACE_MS = 10_000;
 const FINAL_EXIT_MS = 15_000;
 export function backgroundGraceRemainingMs(a) {
@@ -17,7 +18,7 @@ export function backgroundGraceRemainingMs(a) {
     return Math.max(0, Math.min(a.softStoppedAt + a.graceMs, a.deadlineMs) - a.now);
 }
 export function installShutdownHandlers(ctx) {
-    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, webAdmin, version, deviceHub, toolApproval, parkCommits, servingLease, } = ctx;
+    const { config, logger, server, reaper, fleetReconcile, retentionLane, releaseRetentionLease, otelExporter, breakerState, costQuota, rateLimiter, runner, subRunner, lspManager, workflowNotifyJournal, fleetClient, backend, drainState, storeLiveProbe, webAdmin, version, deviceHub, toolApproval, parkCommits, servingLease, peerInbound, } = ctx;
     const dataRoot = config.localDataRoot;
     if (dataRoot) {
         const prior = readCrashLast(dataRoot);
@@ -91,7 +92,21 @@ export function installShutdownHandlers(ctx) {
                 for (const p of uncommittedParks)
                     logger.warn("approval_park_uncommitted_at_shutdown", { approvalId: p.approvalId, taskId: p.taskId });
             })
-                .catch((err) => logger.warn("approval_drain_for_shutdown_failed", { err: String(err) }));
+                .catch((err) => logger.warn("approval_drain_for_shutdown_failed", { err: seatText("operator-log-text", String(err)) }));
+        const peerInboundDrain = peerInbound === undefined
+            ? Promise.resolve()
+            : (async () => {
+                const deadline = new AbortController();
+                const settled = peerInbound.shutdown().then((reading) => {
+                    if (reading.queues > 0 || reading.scopeUnresolved > 0)
+                        logger.info("peer_inbound_settled_at_shutdown", { queues: reading.queues, scopeUnresolved: reading.scopeUnresolved });
+                }, (err) => logger.warn("peer_inbound_shutdown_failed", { err: seatText("operator-log-text", String(err)) }));
+                const timedOut = delay(Math.max(0, graceDeadlineMs - Date.now()), undefined, { signal: deadline.signal }).then(() => "deadline", () => "done");
+                const winner = await Promise.race([settled.then(() => "done"), timedOut]);
+                deadline.abort();
+                if (winner === "deadline")
+                    logger.warn("peer_inbound_shutdown_unfinished_at_deadline", {});
+            })();
         clearInterval(reaper);
         clearInterval(fleetReconcile.timer);
         const retentionTeardown = retentionLane === undefined
@@ -107,7 +122,7 @@ export function installShutdownHandlers(ctx) {
         engineLease?.stop();
         storeLiveProbe?.stop();
         servingLease?.stop();
-        void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: String(err) }));
+        void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: seatText("operator-log-text", String(err)) }));
         webAdmin?.stopRefreshLoop();
         otelExporter?.stop();
         breakerState?.stop();
@@ -119,7 +134,7 @@ export function installShutdownHandlers(ctx) {
         const softStoppedAt = Date.now();
         const backgroundGraceMs = backgroundGraceRemainingMs({ softStopped: backgroundSoftStopped, softStoppedAt, now: softStoppedAt, graceMs: HOST_BG_KILL_GRACE_MS, deadlineMs: graceDeadlineMs });
         const backgroundGrace = backgroundGraceMs > 0 ? delay(backgroundGraceMs) : Promise.resolve();
-        const drained = approvalDrain
+        const drained = Promise.all([approvalDrain, peerInboundDrain])
             .then(() => parkCommits?.quiesce(graceDeadlineMs))
             .then((q) => {
             if (q !== undefined && q.inFlight > 0)

package/dist/boot/stage-02-web-admin-pull.js

@@ -3,6 +3,7 @@ import { createWebAdminRuntime } from "./web-admin.js";
 import { composeExecutionLane, FILE_SOURCED_LANES } from "./execution-lane.js";
 import { configSourceKind } from "../config-provider.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "../config-d-migration.js";
+import { logEnvModelsMigration, runEnvModelsMigration } from "../config-root-migration.js";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { defaultModelRefusal, refusedNameMintedRefusal } from "../model-entry-refusal.js";
 import { isRosterGateArmed } from "../config.js";
@@ -13,6 +14,8 @@ export async function runStage02(ctx) {
     const configSource = configSourceKind(config);
     if (configSource === "local") {
         await assertLocalConfigDirTrusted({ root: localRoot, declaredOwnerUid: config.configLocalOwnerUid });
+        const envModelsMigration = { root: localRoot, env: process.env, envTableIsPlaceholder: isRosterGateArmed(config.webAdmin) };
+        logEnvModelsMigration(logger, envModelsMigration, await runEnvModelsMigration(envModelsMigration));
         logConfigDirMigration(logger, await migrateLocalConfigDirectory(localRoot));
     }
     await composeExecutionLane(config, { configSource, localRoot, logger, drivesFromFile: FILE_SOURCED_LANES });

package/dist/boot/stage-03-store-backend.d.ts

@@ -5,7 +5,10 @@ export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>):
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
     engineDataRoot: string;
     instanceId: string;
-    mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
+    mailboxRecipientLifecycle: Readonly<{
+        retireRecipient: NonNullable<import("@sema-agent/core").MailboxStore["retireRecipient"]>;
+        listRetiredRecipients: NonNullable<import("@sema-agent/core").MailboxStore["listRetiredRecipients"]>;
+    }> | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
     memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
     memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;

package/dist/boot/stage-03-store-backend.js

@@ -2,9 +2,8 @@ import { uuidv7 } from "@sema-agent/core";
 import { openStores } from "./stores.js";
 export async function runStage03(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
-    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportStores, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngine, } = await openStores({ config, logger, metrics, localRoot });
+    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, sessionCaptureRecords, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportStores, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngine, } = await openStores({ config, logger, metrics, localRoot });
     const instanceId = uuidv7();
-    const sessionCaptureRecords = backend?.sessionCaptureRecords();
     return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportStores, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecords, sessionStore, sqlEngine, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
 }
 //# sourceMappingURL=stage-03-store-backend.js.map

package/dist/boot/stage-04-stores.d.ts

@@ -28,14 +28,17 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
-    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
     engineDataRoot: string;
     instanceId: string;
-    mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
+    mailboxRecipientLifecycle: Readonly<{
+        retireRecipient: NonNullable<import("@sema-agent/core").MailboxStore["retireRecipient"]>;
+        listRetiredRecipients: NonNullable<import("@sema-agent/core").MailboxStore["listRetiredRecipients"]>;
+    }> | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
     memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
     memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;

package/dist/boot/stage-04-stores.js

@@ -6,23 +6,22 @@ import { auditDormantPermissionRules } from "./permission-rules-audit.js";
 import { createBudgetAndTracing } from "./budget-tracing.js";
 import { createRuleConsentLane } from "../rules-consent.js";
 import { createConsolidationValve } from "./memory-consolidation.js";
+import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage04(ctx) {
-    const { backend, breakerState, config, logger, memoryEngine, metrics, sessionCaptureRecords } = ctx;
-    const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}) }) : undefined;
+    const { backend, breakerState, config, logger, memoryEngine, metrics } = ctx;
+    const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine) : undefined;
     const memoryComplianceFaces = memoryEngine
         ? createMemoryComplianceFaces(memoryEngine, {
-            onIncident: (err) => logger.warn("memory_compliance_incident", { code: err.code ?? null, detail: err.message }),
-            ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
+            onIncident: createOperatorFaceIncidentSink({ logger }, "memory_compliance_incident"),
         })
         : undefined;
     const memoryOriginFaces = memoryEngine
         ? createMemoryOriginFaces(memoryEngine, {
-            onIncident: (err) => logger.warn("memory_origin_incident", { code: err.code ?? null, detail: err.message }),
-            ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
+            onIncident: createOperatorFaceIncidentSink({ logger }, "memory_origin_incident"),
         })
         : undefined;
     const sessionMemoryStatusFace = memoryEngine
-        ? createSessionMemoryStatusFace(memoryEngine, { ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}) })
+        ? createSessionMemoryStatusFace(memoryEngine)
         : undefined;
     const { valve: consolidationValve, watch: consolidationSeatWatch } = createConsolidationValve({ config, memoryEngine, logger });
     const adoptionBoot = await runAdoptionBootScan({ backend, logger });

package/dist/boot/stage-05-execution-env.d.ts

@@ -10,7 +10,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -47,14 +47,17 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
-    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
     engineDataRoot: string;
     instanceId: string;
-    mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
+    mailboxRecipientLifecycle: Readonly<{
+        retireRecipient: NonNullable<import("@sema-agent/core").MailboxStore["retireRecipient"]>;
+        listRetiredRecipients: NonNullable<import("@sema-agent/core").MailboxStore["listRetiredRecipients"]>;
+    }> | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
     memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
     memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;

package/dist/boot/stage-05-execution-env.js

@@ -13,18 +13,20 @@ export async function runStage05(ctx) {
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, seat: sessionStore.executionPlacement, replicaId: instanceId }) : undefined;
     const headOf = headReadOf(sessionStore);
     const spaceCommits = backend !== undefined ? () => runStore : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, readSandboxGitPlane, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane: sandboxGitPlaneSeat, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
     if (deviceLane !== undefined && config.remoteExec?.provider === "device")
         await noteDeviceRelayBindings(config.remoteExec.relay, deviceLane.store, logger);
     assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { headOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     if (sandboxSecretSeatGate !== undefined)
         await sandboxSecretSeatGate();
-    const sandboxGitPlane = await readSandboxGitPlane();
-    if (sandboxGitPlane.state === "on")
-        logger.info("credential_plane_sandbox_git", { state: "on", origins: sandboxGitPlane.origins });
-    else if (sandboxGitPlane.reason !== "single_user" && sandboxGitPlane.reason !== "lane_without_boundary") {
-        logger.info("credential_plane_sandbox_git", { state: "off", reason: sandboxGitPlane.reason, why: SANDBOX_GIT_PLANE_OFF_TEXT[sandboxGitPlane.reason] });
+    await sandboxGitPlaneSeat.settle();
+    const sandboxGitPlane = sandboxGitPlaneSeat.now;
+    const bootPlane = sandboxGitPlane();
+    if (bootPlane.state === "on")
+        logger.info("credential_plane_sandbox_git", { state: "on", origins: bootPlane.origins });
+    else if (bootPlane.reason !== "single_user" && bootPlane.reason !== "lane_without_boundary") {
+        logger.info("credential_plane_sandbox_git", { state: "off", reason: bootPlane.reason, why: SANDBOX_GIT_PLANE_OFF_TEXT[bootPlane.reason] });
     }
     if (config.toolTrace)
         logger.info("tool_trace_enabled", {});

package/dist/boot/stage-06-runners.d.ts

@@ -71,7 +71,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
@@ -108,14 +108,17 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
-    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
     engineDataRoot: string;
     instanceId: string;
-    mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
+    mailboxRecipientLifecycle: Readonly<{
+        retireRecipient: NonNullable<import("@sema-agent/core").MailboxStore["retireRecipient"]>;
+        listRetiredRecipients: NonNullable<import("@sema-agent/core").MailboxStore["listRetiredRecipients"]>;
+    }> | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
     memoryEngine: import("../memory-scope-stores.js").MemoryScopeStores | undefined;
     memoryExportStores: import("../memory-scope-stores.js").MemoryScopeStores | undefined;

package/dist/boot/stage-06-runners.js

@@ -29,6 +29,7 @@ import { mountOrgDeliveryGate } from "./org-delivery.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
 import { retentionSweepRuns } from "../plugins/retention-store-sql.js";
+import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
@@ -92,9 +93,8 @@ export async function runStage06(ctx) {
             seat: consolidationSeat,
             scopes: config.memoryConsolidationDriver.scopes,
             ...(config.memoryProvenance !== undefined ? { provenance: config.memoryProvenance } : {}),
-            onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
+            onIncident: createOperatorFaceIncidentSink({ logger }, "memory_consolidation_incident"),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
-            ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
             writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),
             onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
         })
@@ -141,10 +141,9 @@ export async function runStage06(ctx) {
         memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
         permissionRuleStore: permissionRuleProvider,
         executionEnvFactory, lspManager, fleetBus, deploymentMods, workflowRunStore, workflowJournalStore,
-        workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,
+        workflowAgentRegistry, workflowNotifyGate, deliverWorkflowCompletion, orgMemoryAdmission,
         governanceSeams,
         sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
-        getRunStore: () => runStore,
     });
     const orgDeliveryGate = mountOrgDeliveryGate({ runnerDeps, directory: orgMemoryAdmission.directory, mailboxStore, backend, logger });
     const runner = new Runner(runnerDeps);