@sema-agent/server 7.142.0 → 7.143.0

package/dist/trace/core-keyset-guard.d.ts

@@ -17,7 +17,7 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, CheckpointGate, CheckpointToken, VerificationResult, CascadeRunResult, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, PendingAction, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, SideQueryResult, WiringManifest, PermissionModeReceipt, GateOutcome, GateDisposition, Settlement, PausedCause, TerminalCause, CheckpointGate, CheckpointToken, VerificationResult, CascadeRunResult, WorkflowRun, ReadRootGrantCandidate, McpReconnectResult, McpServerStatus, NodeLspManagerOptions, RunnerDeps, SessionMemoryStatus, DeploymentSessionMemoryStatus, PromptManifestIdentity, PromptIdentityLayers, PromptManifestSelectors, PromptManifestSection, PromptChainLink, SupersededOverlay, ToolDisclosureManifest } from "@sema-agent/core";
 import type { ToolApprovalFrame } from "../tool-approval.js";
 import type { TableCoreKeys } from "./projection-table.js";
 import type { PauseSeat } from "../terminal.js";
@@ -45,7 +45,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence" | "requestedBy";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceSessionId" | "agentId" | "askReasons" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence" | "requestedBy";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy" | "editRewritten";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -218,7 +218,7 @@ type _GuardPromptManifestKeysNonEmpty = AssertAllKeysHandled<{
     [L in keyof ManifestCore]: [ManifestDeclared<ManifestFaces, L>] extends [never] ? L : never;
 }[keyof ManifestCore]>;
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence" | "checkpointId";
-type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
+type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceSessionId" | "agentId" | "approvalCard" | "restoreMode" | "previewWithheld" | "authoredBy" | "runOrigin" | "requestedByCallId";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type ParkArmKeys = keyof Extract<PendingAction, {
@@ -234,7 +234,7 @@ type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requi
 export type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "modelRole" | "enableBlockedReport" | "promptForm" | "advisorModel" | "runOrigin" | "planFile" | "classifyAllShell";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
-type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds";
+type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction" | "resultEntryIds" | "placementRoot";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;
@@ -245,7 +245,7 @@ type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarde
 type NonPausedTerminalKeys = Exclude<TerminalCause, {
     kind: "paused";
 }> extends infer C ? (C extends object ? keyof C : never) : never;
-type TerminalArmForwarded = "kind" | "code" | "message" | "nestedPause" | "detail" | "reason";
+type TerminalArmForwarded = "kind" | "code" | "message" | "nestedPause" | "detail" | "reason" | "unstartedRow";
 type TerminalArmStripped = never;
 type _GuardTerminalArm = AssertAllKeysHandled<Exclude<NonPausedTerminalKeys, TerminalArmForwarded | TerminalArmStripped>>;
 type _GuardTerminalArmReverse = AssertAllKeysHandled<Exclude<TerminalArmForwarded | TerminalArmStripped, NonPausedTerminalKeys>>;
@@ -433,10 +433,12 @@ type _CoverWordsCheck = AssertAllKeysHandled<Exclude<CoveringWords<{
 }, _CoverProbeWords>> | Exclude<"text[]" | "tree", CoveringWords<readonly string[] | undefined, _CoverProbeWords>> | Extract<"verbatim" | "text[]", CoveringWords<{
     note: string;
 }[], _CoverProbeWords>>>;
+type SessionMemoryStatusSourceKey = keyof SessionMemoryStatus | keyof DeploymentSessionMemoryStatus;
 type SessionMemoryStatusProjected = "captureOptedOut" | "committedCount" | "foldedCount" | "optOutSource" | "lastCaptureAt";
-type SessionMemoryStatusExcluded = "writeHome";
-type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<keyof SessionMemoryStatus, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
-type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, keyof SessionMemoryStatus>>;
+type SessionMemoryStatusExcluded = "writeHome" | "planes";
+type _GuardSessionMemoryStatus = AssertAllKeysHandled<Exclude<SessionMemoryStatusSourceKey, SessionMemoryStatusProjected | SessionMemoryStatusExcluded>>;
+type _GuardSessionMemoryStatusReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected | SessionMemoryStatusExcluded, SessionMemoryStatusSourceKey>>;
+type _GuardSessionMemoryStatusDeploymentReverse = AssertAllKeysHandled<Exclude<SessionMemoryStatusProjected, keyof DeploymentSessionMemoryStatus>>;
 type SideQueryResultForwarded = "text" | "toolCalls" | "model" | "servedModel" | "degraded" | "responseModel" | "usage" | "usageMissing" | "stopReason" | "errorMessage" | "errorCode" | "errorKind" | "inputTooLongRuledOut" | "account";
 type SideQueryResultStripped = never;
 type _GuardSideQueryResult = AssertAllKeysHandled<Exclude<keyof SideQueryResult, SideQueryResultForwarded | SideQueryResultStripped>>;
@@ -525,6 +527,7 @@ export type CoreKeysetGuards = [
     _GuardTerminalArmReverse,
     _GuardSessionMemoryStatus,
     _GuardSessionMemoryStatusReverse,
+    _GuardSessionMemoryStatusDeploymentReverse,
     _GuardNotificationReverse,
     _GuardProvenance,
     _GuardProvenanceReverse,

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.image_removed", "mcp.authorization_required"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored", "route.credential_origin_mismatch", "mods.registration_refused", "config.session_rules_earlier_grammar", "advisor.not_attached", "inherit_env.names_withheld", "model.capability_downgraded", "context.media_removed", "mcp.authorization_required", "classifier.seat_rate_limited", "context.tool_schema_removed"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -47,8 +47,10 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "advisor.not_attached",
     "inherit_env.names_withheld",
     "model.capability_downgraded",
-    "context.image_removed",
+    "context.media_removed",
     "mcp.authorization_required",
+    "classifier.seat_rate_limited",
+    "context.tool_schema_removed",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/exit-seat.d.ts

@@ -19,12 +19,15 @@ export type SafeText = string & {
  *    的 `reason` / `status.error` / `listingIncomplete.error`;引擎铸点已抹过请求回显与同主体词表(记号 `[redacted]`),这一行读同一个脱敏器(引擎记号 = 已抹的值,
  *    引擎放过的形照抹);界 200 码元,原样出门(JSON 串值,消费方自己渲染)。
  *  · `peer-declaration-sentence`:引擎判官对一份 MCP / A2A 对端声明说的句子(`toolAxes` / `toolFaces` / `sessionMetaKey` / 启动界的原因句,逐字带着声明方写的工具名、键名),
- *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
+ *    进请求面 400 拒句、续跑重放的丢弃行与重读行、名册的跳过行,以及能力读面 `GET /v1/capabilities/mcp` 上引擎整集拒(两台撞同一工具命名空间前缀)的拒句 —— 读者是调用方与运维,句子已是一行;不设界(拒句要说全判官的话),原样出门。
  *  · `inbox-diagnostics-text`:`workflow_complete` 补投帧上的诊断教学文本(`diagnostics`)—— 引擎在 workflow 完成通知上铸的「读哪里 / 怎么续跑」文本,入会话收件时洗一次,
  *    店里(`payload` 列)只放出门安全的字节,drain 逐字带出。洗法与 live `task_notification.diagnostics` 同一个 scope(`free-text`);
  *    这一行比 `trace-frame-text` 多一条界(4000 码元,与同族条目的文本位同额),原样出门:`payload` 列是 TEXT,无界的文本一旦超过列宽,入箱写整条失败、补投连摘要一起丢(完成已被记作送达),所以先有界。
  *  · `boot-refusal-line`:起服拒启的一行拒句 —— 部署座装配的拒句(`mods-declaration.ts`:声明的席名、包名、读包者 / 引擎准入交回的话);它经进程级 fatal 出口原样多行进 stderr,
  *    所以必须在这里先压成一行(一句拒因里的换行会在运维的终端里伪造出第二条日志行);界 512 码元(含截断记号)。
+ *  · `peer-inbound-card-text`:运维审批队列 `peer_inbound` 行(`GET /v1/approvals` 的 `pending[]` 与 `/v1/approvals/stream` 的 `pending` 帧)上被扣跨会话来信的
+ *    存储正文(`content`,core 的规范存储形 `[summary] message`)与发信方显示名(`fromName`)—— 别的会话写的自由文本,读者是收信方本人;不设界(core 存的那一份就是
+ *    收信方要审的全文,截了就审不全),原样出门(JSON 串值,消费方自己渲染)。
  */
 declare const EXIT_SEATS: {
     readonly "trace-frame-text": {
@@ -75,6 +78,9 @@ declare const EXIT_SEATS: {
         readonly maxChars: 512;
         readonly emit: "log-line";
     };
+    readonly "peer-inbound-card-text": {
+        readonly scope: "free-text";
+    };
 };
 export type ExitSeat = keyof typeof EXIT_SEATS;
 /** 设了界的座名。 */

package/dist/trace/exit-seat.js

@@ -16,6 +16,7 @@ const EXIT_SEATS = {
     "peer-declaration-sentence": { scope: "free-text" },
     "inbox-diagnostics-text": { scope: "free-text", maxChars: 4000 },
     "boot-refusal-line": { scope: "free-text", maxChars: 512, emit: "log-line" },
+    "peer-inbound-card-text": { scope: "free-text" },
 };
 export function seatMaxChars(seat) {
     return EXIT_SEATS[seat].maxChars;

package/dist/trace/ledger-sink.d.ts

@@ -152,8 +152,8 @@ export declare function createLedgerSink(opts: {
      *  各传自己看得见的那个词(位①=流事件 `ev.type`,位②=账本行 `type`);拿不到类型的打点方
      *  (core 的 onActivity 第五席、resume 腿手动打点)省参,`kind` 诚实缺席(见 turn-activity.ts)。 */
     onActivity?: (kind?: string, statusData?: Record<string, unknown>) => void;
-    /** 这条腿的 `wiring_manifest` **本仓自铸段**(`LegWiringSections`:[ref] `instructions` 读腿的 `InstructionSelectionLeg.segment`、run 级 `skills` 读 spec 字段
-     *  `runSkillsOf`)。**必填**:账本行与 live 帧是同一条腿的两个载体,段必须来自同一只腿;在投帧那一刻读(core 推帧之前已 await 过 loader)。 */
+    /** 这条腿的 `wiring_manifest` **本仓自铸段**(`LegWiringSections`:[ref] `instructions` 读腿的 `InstructionSelectionLeg.segment`、run 级 `skills` 读这条腿的部署事实
+     *  `LegFacts.skills`,`leg-facts.ts`)。**必填**:账本行与 live 帧是同一条腿的两个载体,段必须来自同一只腿;在投帧那一刻读(core 推帧之前已 await 过 loader)。 */
     legSections: () => LegWiringSections;
     /** 这条腿的计量席(E8 累加器 + 归因键)。在场 ⇒ {@link LedgerSink.appendParked} 在停驻行之前先把未结清的用量差落成 `model_usage` 行(状态帧最后,见 `appendParkRow`);
      *  缺席 ⇒ 这条腿没接累加器,停驻行之前无账可结(夹具、不经 `appendParked` 停驻的腿)。 */

package/dist/trace/model-segment.d.ts

@@ -1,4 +1,4 @@
-import { type SegmentEndFields } from "./project.js";
+import { type LiveEventIdentity, type SegmentEndFields } from "./project.js";
 /**
  * 本帧是不是模型文本的段界。**四条消费腿共用这一只**:账本投影 switch(`trace/ledger-sink.ts`)、
  * 顶层 live 流与转发子代腿(`http/routes/tasks.ts`)、子代 tail 面(`fleet/subagent-tail-bus.ts`)。
@@ -13,43 +13,73 @@ export type ReasoningEndFrame = SegmentEndFields & {
     type: "reasoning_end";
 };
 /** 登记册**读到的全部字段**,逐个写出来(不是 `Record<string, unknown>`):`TaskEvent` 与转发腿的原始帧
- *  都结构性满足它,于是调用点一个宽断言都不必写;将来有人想读第七个键,得先在这里加一行。 */
-export interface ReasoningStreamEvent {
+ *  都结构性满足它,于是调用点一个宽断言都不必写;将来有人想读第八个键,得先在这里加一行。
+ *  `type` 而不是 `interface`(与 `LiveEventIdentity` 同一条理由):`text_end` 的铸点收 `Record<string, unknown>`,别名才进得去。 */
+export type ModelStreamEvent = {
     type?: string;
     delta?: unknown;
+    content?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
     sourceTaskId?: unknown;
     bgAgentId?: unknown;
-}
+};
 /** 一条**流**的身份(不含 `eventId`:core 给每个内容事件铸各自的 eventId,拿它当流身份会把每块 delta
  *  切成一段)。三键都缺席 = 宿主自己的流。 */
-export interface ReasoningStreamIdent {
+export interface ModelStreamIdent {
     parentToolCallId?: string;
     sourceTaskId?: string;
     bgAgentId?: string;
 }
+/** live 面模型文本的帧(本登记册铸的全部四种):两族的逐块帧与各自的段末帧。 */
+export type LiveModelTextFrame = (LiveEventIdentity & {
+    type: "text_delta" | "reasoning_delta";
+    delta: string;
+}) | (SegmentEndFields & {
+    type: "text_end";
+}) | ReasoningEndFrame;
 /**
- * 一条 live 腿上**按流身份分账**的 `reasoning` 段登记册。
+ * 🔴 **live 面模型文本的唯一铸点** —— 一条 live 腿上按**族 × 流身份**分账的段登记册(三条 live 腿共用:顶层流 / 转发子代腿 / 子代 tail 面)。
+ *
+ * ## 律(一条):凡出 wire 的模型文本经同一只脱敏器,不分帧
+ * 段末帧(`text_end.content` / `reasoning_end.content`)、`done.result`、账本 `text` / `reasoning` 行早就整段过 `redactModelText`;
+ * 逐块帧(`text_delta` / `reasoning_delta`)此前一个逐字、一个逐块脱敏 —— 跨块的凭据在两者上都留明文。现在逐块帧也只放**同一只脱敏器**判定过的字节:
+ * 每条流一只脱敏器的**流式口**(`trace/redact.ts` 的 `createRedactionStream`:喂入 / 取已判定前缀 / 收尾冲刷三口,同一只扫描器、同一张表):每块到达时喂入、
+ * 取出已判定的那一截放出(脱敏器自己的未决尾不出门,横跨切点的跨度整条不出);段末冲刷,余下的按整段读法放出,再发段末帧。
+ * ⇒ 一段的逐块帧依次拼接 = 该段段末帧的正文 —— 逐字节(凭据形换记号,不含凭据形的文本逐字节不变)。推理段 = 账本 `reasoning` 行(同一只段界谓词);
+ *   文字段的单位是引擎的文字块(`text_end` 收段),账本 `text` 行按 turn 拼接 —— 单文字块的 turn 上相等;锚与值分落在同一 turn 的两个文字块里时账本遮、段末帧与逐块帧不遮
+ *   (单位之差随 `text_end` 既有,本登记册不另立单位;对抗复审 r1 medium)。
+ *
+ * ## 帧数与身份(消费端看得见的三件事)
+ *  · 引擎的每一块 delta 仍恰好一帧、同一枚 `eventId`、原序(`delta` 可以是 `""`:那一块的字节还在窗里)—— 续流游标与 E18 的首块句柄不动;
+ *  · 段末还在窗里的字节在段末帧**之前**一帧放出(同一族的逐块帧,带流身份三键、**不带** `eventId` ⇒ 不发 `id:` 行:它不是引擎的内容帧);
+ *  · 延迟:一个字节在同一条流又到了脱敏器的未决尾上界(`PENDING_TAIL_UNITS` 个读法单元,由脱敏器的臂表算出)之后的下一次重扫时出门(重扫节律在流式口里);
+ *    盖住它的跨度还在判定(未收尾的栅栏 / 引号 / JSON 串值 …)⇒ 判定或段末。
+ *
+ * ## 段界(与账本腿同一只谓词)
+ * 两族都在本流的段界词({@link isModelSegmentBoundary})与腿终局 / 子代终态({@link LiveModelText.cut})收段;`text` 族另在引擎的 `text_end` 收段(它关的是散文段,
+ * 不是 turn 的结构边界 —— 推理段不因它收)。收段顺序:同一批里先散文、后推理(`text_end` 先于 `reasoning_end`,与契约的典型帧序同向)。
+ *
+ * 🔴 **为什么分账**(codex 对抗复审 R1 两根 [high],亲跑复现后按类修):一条腿上并发子代的逐块帧是**交错**到达的。一只累积器只有两种活法,两条都错:
+ *  · 「换身份就收段」⇒ A 说一半、B 插一句、A 说另一半 ⇒ A 被切成两段,**跨块的凭据正好落在切口上**;
+ *  · 「不换就不收」⇒ 两个子代的文字拼成一段,再盖上其中一个的身份键(串味 + 冤枉归属)。
+ * 一条流的段,只被**它自己**的段界或**它自己**的终态收走;别人说什么都与它无关。
  *
- * 🔴 **为什么是登记册而不是一只累积器**(codex 对抗复审 R1 两根 [high],亲跑复现后按类修):一条腿上
- * 并发子代的 `reasoning_delta` 是**交错**到达的。一只累积器只有两种活法,两条都错:
- *  · 「换身份就收段」⇒ A 说一半、B 插一句、A 说另一半 ⇒ A 被切成两枚权威段,**跨块的凭据正好落在切口上**
- *    ——本帧存在的唯一理由当场失效(实测:两枚 `reasoning_end` 拼起来仍是明文密钥);
- *  · 「不换就不收」⇒ 两个子代的思考拼成一段,再盖上其中一个的身份键(串味 + 冤枉归属)。
- * 分账之后规则反而**更少**:一条流的段,只被**它自己**的段界或**它自己**的终态收走;别人说什么都与它无关。
+ * ## 投递态(tail 面:有没有人在听)
+ * `onEvent(ev, deliver)`:`deliver = false` 时只攒原文、照常按段界收段,不扫描、不出帧(tail 面的免投影快门);一条流从不投递转为投递时,放行位跳到**此刻**的段尾
+ * —— 之前的字节没人收,之后的字节仍按**整段**的上下文判定(晚到的订阅者在 `password=` 之后才开始听,值照样认得出)。段末帧的正文恒是整段。
  *
- * 状态的界:每条流的条目在它的首块 delta 上建、在收段时删;腿终局 {@link ReasoningSegments.cut} 不带
- * 匹配器 = 全收全删。子代终态那一次带匹配器的收段(转发腿的 `onTaskNotification`)是让**活着的子代数**
- * 而不是「这条 run 一共派过多少子代」成为上界的那一手。
+ * 状态的界:每条流的条目在它的首块非空 delta 上建、在收段时删;腿终局 {@link LiveModelText.cut} 不带匹配器 = 全收全删。
+ * 子代终态那一次带匹配器的收段(转发腿的 `onTaskNotification`)让**活着的子代数**成为上界。
  */
-export interface ReasoningSegments {
-    /** 喂一帧 → 本帧收走的段末帧(0 或 1 枚,且**只可能是本帧自己那条流**的段)。返回数组只为让调用点
-     *  与 {@link cut} 同形(`for (const f of …) send(f)`),不是「一帧可能收多段」。 */
-    onEvent(ev: ReasoningStreamEvent): ReasoningEndFrame[];
-    /** 收段:`match` 缺省 = 本腿**全部**流(腿终局 / 句柄终态);给了就只收匹配的那几条(某个子代终态)。
+export interface LiveModelText {
+    /** 喂一帧 → 本帧要写的帧(按序):逐块帧 / 本流收段放出的余下字节 + 段末帧。`deliver` 缺省 = 投递。 */
+    onEvent(ev: ModelStreamEvent, deliver?: boolean): LiveModelTextFrame[];
+    /** 收段:`match` 缺省 = 本腿**全部**流(腿终局 / 句柄终态);给了就只收匹配的那几条(某个子代终态)。`deliver` 同 {@link onEvent}(缺省 = 投递)。
      *  与账本腿 `LedgerSink.onDone → flush()` 同位同义 —— 段界表里没有终局词,终局走这扇门。 */
-    cut(match?: (ident: ReasoningStreamIdent) => boolean): ReasoningEndFrame[];
+    cut(match?: (ident: ModelStreamIdent) => boolean, deliver?: boolean): LiveModelTextFrame[];
+    /** 没有开着的段(状态只有开着的段:空着的登记册与新建的一只等价,持有方可以删掉它、下一帧再建)。 */
+    isIdle(): boolean;
 }
 /**
  * 一段推理的**段末事件 id** —— 唯一铸点,live 段末帧与账本 `reasoning` 行共用这一只。
@@ -78,8 +108,8 @@ export declare function reasoningSegmentEventId(anchor: unknown): string | undef
 export declare function reasoningDeltaBytes(ev: {
     delta?: unknown;
 }): string | undefined;
-/** 「这条流属于这些子代 id 之一」—— 子代终态收段的匹配器(`task_id` 与 `sessionId` 是同一个子代的两个
- *  id 域,取并集;`undefined` 成员自动忽略)。腿上共用这一只,免得各写一遍 id 域的并集。 */
-export declare function reasoningStreamOfTask(...ids: ReadonlyArray<string | undefined>): (ident: ReasoningStreamIdent) => boolean;
-export declare function createReasoningSegments(): ReasoningSegments;
+/** 「这条流属于这只后台子代」—— 子代终态收段的匹配器。一只后台子代一个 id(引擎 7.61.0:它的帧的 `sourceTaskId`、
+ *  转发帧的 `bgAgentId`、完成通知的 `task_id` 都是它的注册表行 id),按那一个 id 认流。 */
+export declare function modelStreamOfTask(taskId: string): (ident: ModelStreamIdent) => boolean;
+export declare function createLiveModelText(): LiveModelText;
 //# sourceMappingURL=model-segment.d.ts.map

package/dist/trace/model-segment.js

@@ -1,4 +1,9 @@
-import { reasoningEndEventData } from "./project.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { errorKindOf } from "../observability/err-text.js";
+import { OVERSIZED_REDACTION_PLACEHOLDER } from "../observability/run-terminal.js";
+import { liveIdentityFields, reasoningEndEventData, textEndEventData } from "./project.js";
+import { dropProjectedFace } from "./projection-drop.js";
+import { createRedactionStream } from "./redact.js";
 const BOUNDARY = new Set([
     "tool_start", "tool_end", "status", "context_usage", "compacted", "diagnostics",
     "steering_injected", "compaction_outcome", "workspace_changed", "wiring_manifest",
@@ -14,9 +19,8 @@ export function reasoningSegmentEventId(anchor) {
 export function reasoningDeltaBytes(ev) {
     return typeof ev.delta === "string" && ev.delta !== "" ? ev.delta : undefined;
 }
-export function reasoningStreamOfTask(...ids) {
-    const set = new Set(ids.filter((v) => typeof v === "string" && v !== ""));
-    return (ident) => (ident.sourceTaskId !== undefined && set.has(ident.sourceTaskId)) || (ident.bgAgentId !== undefined && set.has(ident.bgAgentId));
+export function modelStreamOfTask(taskId) {
+    return (ident) => ident.sourceTaskId === taskId || ident.bgAgentId === taskId;
 }
 function streamKeyOf(ident) {
     return `${ident.parentToolCallId ?? ""}\u0000${ident.sourceTaskId ?? ""}\u0000${ident.bgAgentId ?? ""}`;
@@ -25,44 +29,108 @@ function identOf(ev) {
     const s = (v) => (typeof v === "string" ? v : undefined);
     return { parentToolCallId: s(ev.parentToolCallId), sourceTaskId: s(ev.sourceTaskId), bgAgentId: s(ev.bgAgentId) };
 }
-export function createReasoningSegments() {
-    const open = new Map();
-    const cutKey = (key) => {
-        const seg = open.get(key);
-        if (seg === undefined)
+function release(s) {
+    try {
+        return s.text.takeSettled();
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `live-hold len=${s.text.fed.length} err=${errorKindOf(err)}`);
+        return "";
+    }
+}
+function remainderOf(family, s) {
+    try {
+        const r = s.text.flush();
+        if (r.diverged)
+            recordFailOpen("server.live-text.hold-diverged", `family=${family} len=${s.text.fed.length}`);
+        return r.rest;
+    }
+    catch (err) {
+        recordFailOpen("server.run-terminal.redact-threw", `live-hold len=${s.text.fed.length} err=${errorKindOf(err)}`);
+        return OVERSIZED_REDACTION_PLACEHOLDER;
+    }
+}
+export function createLiveModelText() {
+    const open = { text: new Map(), reasoning: new Map() };
+    const deltaType = (family) => (family === "text" ? "text_delta" : "reasoning_delta");
+    const close = (family, key, deliver) => {
+        const s = open[family].get(key);
+        if (s === undefined)
+            return [];
+        open[family].delete(key);
+        if (!deliver)
             return [];
-        open.delete(key);
-        const data = reasoningEndEventData({ ...seg.ident, eventId: seg.segmentEventId, content: seg.buf });
-        return data === null ? [] : [{ type: "reasoning_end", ...data }];
+        if (!s.delivering)
+            s.text.skip();
+        const out = [];
+        const rest = remainderOf(family, s);
+        if (rest !== "")
+            out.push({ type: deltaType(family), delta: rest, ...liveIdentityFields(s.ident) });
+        if (family === "reasoning") {
+            const data = reasoningEndEventData({ ...s.ident, eventId: s.segmentEventId, content: s.text.fed });
+            if (data !== null)
+                out.push({ type: "reasoning_end", ...data });
+        }
+        return out;
+    };
+    const feed = (family, ev, deliver) => {
+        if (typeof ev.delta !== "string") {
+            if (family === "text")
+                dropProjectedFace("text_delta.delta is not a string");
+            else
+                dropProjectedFace("reasoning_delta.delta is not a string");
+            return [];
+        }
+        const ident = identOf(ev);
+        const key = streamKeyOf(ident);
+        let s = open[family].get(key);
+        if (s === undefined && ev.delta !== "") {
+            s = { ident, text: createRedactionStream(), delivering: deliver };
+            open[family].set(key, s);
+        }
+        if (s !== undefined) {
+            if (deliver && !s.delivering) {
+                s.delivering = true;
+                s.text.skip();
+            }
+            else if (!deliver)
+                s.delivering = false;
+            s.text.feed(ev.delta);
+            if (family === "reasoning" && reasoningDeltaBytes(ev) !== undefined)
+                s.segmentEventId ??= reasoningSegmentEventId(ev.eventId);
+        }
+        if (!deliver)
+            return [];
+        return [{ type: deltaType(family), delta: s === undefined ? "" : release(s), ...liveIdentityFields(ev) }];
     };
     return {
-        onEvent: (ev) => {
-            if (ev.type === "reasoning_delta") {
-                const bytes = reasoningDeltaBytes(ev);
-                if (bytes === undefined)
-                    return [];
-                const ident = identOf(ev);
-                const key = streamKeyOf(ident);
-                const seg = open.get(key);
-                if (seg === undefined)
-                    open.set(key, { ident, segmentEventId: reasoningSegmentEventId(ev.eventId), buf: bytes });
-                else {
-                    seg.buf += bytes;
-                    seg.segmentEventId ??= reasoningSegmentEventId(ev.eventId);
-                }
-                return [];
+        onEvent: (ev, deliver = true) => {
+            if (ev.type === "text_delta")
+                return feed("text", ev, deliver);
+            if (ev.type === "reasoning_delta")
+                return feed("reasoning", ev, deliver);
+            const key = streamKeyOf(identOf(ev));
+            if (ev.type === "text_end") {
+                const out = close("text", key, deliver);
+                const end = deliver ? textEndEventData(ev) : null;
+                if (end !== null)
+                    out.push({ type: "text_end", ...end });
+                return out;
             }
-            return isModelSegmentBoundary(ev.type ?? "") ? cutKey(streamKeyOf(identOf(ev))) : [];
+            return isModelSegmentBoundary(ev.type ?? "") ? [...close("text", key, deliver), ...close("reasoning", key, deliver)] : [];
         },
-        cut: (match) => {
+        cut: (match, deliver = true) => {
             const out = [];
-            for (const [key, seg] of [...open]) {
-                if (match !== undefined && !match(seg.ident))
-                    continue;
-                out.push(...cutKey(key));
+            for (const family of ["text", "reasoning"]) {
+                for (const [key, s] of [...open[family]]) {
+                    if (match !== undefined && !match(s.ident))
+                        continue;
+                    out.push(...close(family, key, deliver));
+                }
             }
             return out;
         },
+        isIdle: () => open.text.size === 0 && open.reasoning.size === 0,
     };
 }
 //# sourceMappingURL=model-segment.js.map

package/dist/trace/project.d.ts

@@ -222,8 +222,8 @@ export declare function screenedStoredEventData(type: string, data: unknown): un
 /** `text_end` 段末帧的**唯一**铸点(三腿共用:top stream / 转发子代腿 / 子代 tail 面)。content = 段权威全文 ⇒ 与
  *  durable 面(`result` / 账本 `text` 行)同一只 {@link redactModelText}(认出才改写、抛则占位、不设上限)。
  *  此前三处各自逐字透传 —— 同一份文本毫秒后在 `done.result.result` 上已脱,live 面却在凭据生成瞬间明文([ref])。
- *  `text_delta` 仍逐字:跨 chunk 的凭据无法就地判;clay [ref] ②(2026-09-18)裁定**维持逐字成文**([ref] U-3 关票),
- *  权威段 `text_end.content` 已脱敏、消费端段末整段替换即得脱敏读法。
+ *  逐块的 `text_delta` 由 `trace/model-segment.ts` 的登记册铸(7.143.0 起经同一只脱敏器的放行窗,一段的逐块拼接 = 本帧 content);
+ *  本函数由登记册在段末调,三腿不再各自调。
  *  坏形(content 非串/空串)⇒ null(丢帧,不铸「权威空段」:core 契约明言空段不发本帧,消费端收到空段会清掉已攒 delta)。
  *  身份**四键**随行(live 现状带全四键,消费端可能已依赖);值经 {@link identityKey} —— 非空 string 才上 wire
  *  ([ref] 起不再逐字透传:坏形身份键会在 live 写口上铸出假游标)。 */
@@ -637,6 +637,7 @@ export declare function compactionOutcomeEventData(ev: {
     trigger?: unknown;
     reason?: unknown;
     pass?: unknown;
+    requestedBy?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): FrameData<{
@@ -887,8 +888,8 @@ export declare function toolRosterDeltaEventData(ev: {
  * (值可以是 `undefined`)—— 漏递的腿当场 tsc 红,而不是静默投出一个「缺席」(缺席在 wire 上是一句话:「这条腿对这件事没有陈述」)。
  *  · `instructions`([ref],7.111.0)—— 这条腿的 project-memory loader 选中的指令文件链成员 `{ selected: string[] }`;值来自腿的
  *    `InstructionSelectionLeg.segment()`。`undefined` ⇒ 段缺席;`{ selected: [] }` ⇒ 显式空(走了链、没选中)。
- *  · `skills`(7.137.0)—— 这条 run 交给引擎的技能名册(`{ name, description, source }[]`,与场景卡技能清单同一张形);值来自 spec 字段 `runSkillsOf(spec)`
- *    (唯一铸点 = resolveSpec 出口的 `buildRunSkills`)。**run 级** ⇒ 只投根腿 / 续跑腿的帧,委派子代的帧(`parentToolCallId` 在场)不投(子代的技能由它自己的定义决定);
+ *  · `skills`(7.137.0)—— 这条 run 交给引擎的技能名册(`{ name, description, source }[]`,与场景卡技能清单同一张形);值来自这条腿的部署事实 `LegFacts.skills`
+ *    (`leg-facts.ts`;名册由 `buildRunSkills` 合并、resolveSpec 出口登记,漏斗在复制之前读出)。**run 级** ⇒ 只投根腿 / 续跑腿的帧,委派子代的帧(`parentToolCallId` 在场)不投(子代的技能由它自己的定义决定);
  *    `[]` = 零技能(含 `disableSkills`);`undefined` ⇒ 段缺席(这条腿的 spec 不是本仓装配的)。`description` 过上 wire 的自由文本出口 {@link sanitizeWireText}。
  */
 export interface LegWiringSections {
@@ -1076,6 +1077,8 @@ export declare function compactedEventData(ev: {
     };
     /** [ref](core 7.53.0 [ref]):这次落地的压缩 pass 的 id —— 与它的 `compaction_started` 帧同一个值(引擎在每次落地上都设;型上可选)。逐字。 */
     pass?: string;
+    /** core 7.61.0:扩展经 `$.session.compact` 提的手动请求落地的那一 pass —— 谁要的(同 {@link compactionOutcomeEventData} 那一位)。 */
+    requestedBy?: unknown;
 }): FrameData<{
     attachedFiles?: Array<{
         path: SafeText;

package/dist/trace/project.js

@@ -434,9 +434,14 @@ export function compactionOutcomeEventData(ev) {
         ...(s(ev.trigger) !== undefined ? { trigger: s(ev.trigger) } : {}),
         ...(ev.reason !== undefined ? { reason: seatText("trace-frame-text", String(ev.reason)) } : {}),
         ...(s(ev.pass) !== undefined ? { pass: s(ev.pass) } : {}),
+        ...requestedByField(ev.requestedBy, "compaction_outcome"),
         ...identityFields(ev),
     };
 }
+function requestedByField(v, where) {
+    const requester = extensionRequesterOf(v, where);
+    return requester !== undefined ? { requestedBy: requester } : {};
+}
 export function compactionStartedEventData(ev) {
     const s = (v) => (typeof v === "string" ? v : undefined);
     return {
@@ -893,6 +898,7 @@ export function compactedEventData(ev) {
         ...(num(ev.durationMs) !== undefined ? { durationMs: num(ev.durationMs) } : {}),
         ...(phaseDurations !== undefined ? { phaseDurations } : {}),
         ...(typeof ev.pass === "string" ? { pass: ev.pass } : {}),
+        ...requestedByField(ev.requestedBy, "compacted"),
     };
 }
 export function contextUsageEventData(ev) {

package/dist/trace/redact.d.ts

@@ -36,6 +36,8 @@ export declare function armPoolBudgetForTest(): {
     ssh2ScanBytes: number;
     mappedUnits: number;
     readings: number;
+    coverageVisits: number;
+    rowVisits: number;
 };
 export declare function resetArmPoolBudgetForTest(): void;
 /**
@@ -54,11 +56,9 @@ export declare function resetArmPoolBudgetForTest(): void;
  * 闭集:加一个档而不在 {@link armPool} 的档表里处置 ⇒ **编译**红。
  */
 type RedactionScope = "free-text" | "bounded-unit";
-/** 测试座:{@link unitCountWithin} 的数组形(`table` 须是合法的已并表:升序、两两不交不相接)。 */
-export declare function unitCountWithinForTest(table: ReadonlyArray<readonly [number, number]>, from: number, to: number, max: number): boolean;
 /** 本模块会写进文本的全部替换 token(`«…»` 字面),从三张表现算 —— 表改这里自动跟,不另抄一份。
  *  🔴 **[ref] v2 修复轮起它只剩一个语义:闭形闭集的加载期校验**。运行期「这一段是不是一枚记号」已经由
- *  {@link credentialSpans} 的闭**形**那一支一处答完({@link opaqueUnitEnd}),按闭**集**再认一遍的
+ *  记号行的闭**形**一处答完({@link tokenUnits} / {@link tokenEnd}),按闭**集**再认一遍的
  *  `redactionTokenEndAt` 与它同义而更窄,已删 —— 两只「什么算记号」的判别器就是两个定义。 */
 /** {@link buildDisplaySafeUrl} 解析不动一个配置型 URL 时的**占位**([ref] 件B)——fail-closed:输出**不含原串的
  *  任何字节**(连 host 都不留),不许回落成原值。它不是任何一条臂的产物,所以要在这里**显式**进闭集
@@ -70,17 +70,22 @@ export { DISPLAY_SAFE_URL_TOKEN };
 /**
  * 🔴 **取证相的重扫模式(测试座,[ref])** —— 生产恒 `"incremental"`;`"full"` 是**参照语义** = 「没有可复用的上一次执行」:
  * 每级全部取证臂整段重跑、URL 臂每段重扫,既不读足迹也不回放(池把每一级的脏区间当作「未知」交下去,与级 0 同一个读法)。
- * 证据表的建法(级 0 记号档 + 逐级折入)与收敛判据(脏区间为空)两种模式是同一条,所以两种模式只差「复用与否」这一位 ——
- * 增量重扫的全部正确性主张只有一句:**任何输入上两种模式输出逐字相同**(`test/forensic-incremental-rescan.test.ts` 并跑比对;
- * 折入本身与整表重建的对拍是那个测试文件里的一份测试本地参照)。
+ * 证据表的建法(级 0 记号 + 逐级折入)与收敛判据(脏区间为空)两种模式是同一条,所以两种模式只差「复用与否」这一位 ——
+ * 增量重扫的全部正确性主张只有一句:**任何输入上两种模式输出逐字相同**(`test/forensic-incremental-rescan.test.ts` 并跑比对)。
  */
 export type ForensicRescanMode = "incremental" | "full";
 export declare function setForensicRescanModeForTest(mode: ForensicRescanMode): void;
-/** 测试座:折入函数的数组形(`prev` 须是合法的已并表:升序、两两不交不相接)。 */
-export declare function credentialSpansFoldForTest(prev: ReadonlyArray<readonly [number, number]>, add: ReadonlyArray<readonly [number, number]>): {
-    next: Array<[number, number]>;
+/** 测试座:折入函数的数组形(行 = `[起点, 终点, 族码, 锚位, 收尾位]`)。 */
+export declare function evidenceRowsFoldForTest(prev: ReadonlyArray<readonly [number, number, number, number, number]>, add: ReadonlyArray<readonly [number, number, number, number, number]>): {
+    next: Array<[number, number, number, number, number]>;
     dirty: Array<[number, number]>;
 };
+/** 测试座:{@link measureWithin} 的数组形(`table` 的每一项是一行 `[起点, 终点]` 或 `[起点, 终点, 键]`:不给键 ⇒ 键 = 起点;同一 (起点, 键) 至多一行;
+ *  `self` 给出 ⇒ 读者 = 键为它的那些行,否则不排除任何读数)。 */
+export declare function unitCountWithinForTest(table: ReadonlyArray<readonly [number, number] | readonly [number, number, number]>, from: number, to: number, max: number, self?: number): boolean;
+/** 测试座:同一张表上依次问一串量问(`[from, to, max, self?]`;读法同 {@link unitCountWithinForTest})—— 终点有界的闭包链缓存在问与问之间共用,
+ *  生产里同一级、同一张表上各臂各读者的量问就是这样串起来的。 */
+export declare function unitCountsWithinForTest(table: ReadonlyArray<readonly [number, number] | readonly [number, number, number]>, queries: ReadonlyArray<readonly [number, number, number, number | undefined]>): boolean[];
 /** 🧪 结构读数(与 {@link ppkScanBytesForTest} 同一条技法):本扫描器读过的单元数,线性钉用。 */
 export declare function anchoredScanUnitsForTest(): number;
 export declare function resetAnchoredScanUnitsForTest(): void;
@@ -226,6 +231,53 @@ export type RedactionSpan = {
 };
 export type { RedactionScope };
 export declare function proposeRedactionSpans(text: string, scope: RedactionScope, layout: RedactionLayout, extent: RedactionExtent): readonly RedactionSpan[];
+/**
+ * 🔴 **未决尾的长度上界**(读法单元):一段还在长的文本,末尾这么多个读法单元里起头的候选,本脱敏器**还判不了**(判定要读到文本之外)。
+ * 它不是另立的常数,是候选池成员表的同一份读数 —— 每条臂的**判定距离**取最大({@link MemberIdentity.reach} 的意义见那里):正则臂从正则源读出
+ * (前缀 + 前瞻判据 + 值 run 的最少重复;熵谓词 {@link ENTROPY_SCAN_MAX} 两窗由此进来),手写扫描器陈述它起头要读全的字面锚。
+ * 判定在**无界**远处的结构(没收尾的 JSON 串值 / URL userinfo / 栅栏 / 带引号的值、起头不设长度上界的栅栏行 / 版本头 / 关键字分隔段)不靠它:
+ * head 读法把它们读成未决尾、从起点遮到文本末尾({@link RedactionExtent}),流式口在它的起点前停下,直到它判定或冲刷。
+ * 加一条判定距离更远的臂,这个数随之变大(钉 `test/live-model-text-hold-law.test.ts` 读每条成员的读数与最大值)。
+ */
+export declare const PENDING_TAIL_UNITS: number;
+/** 测试可见:正则臂判定距离的读法本身(读得出的几形与加载期抛的几形)。 */
+export declare function regexDecisionReachForTest(re: RegExp, lexical: boolean): number;
+/** 测试可见:候选池每条成员的判定距离(成员的替换串、池序、读数)。 */
+export declare function pendingTailReachForTest(): ReadonlyArray<{
+    readonly token: string;
+    readonly order: number;
+    readonly reach: number;
+}>;
+/**
+ * 🔴 **流式口 —— 同一只脱敏器的三口**(live 面逐块到达的模型文本 `text_delta` / `reasoning_delta` 的唯一放行器;登记册在 `trace/model-segment.ts`)。
+ * 同一只 {@link runRedaction}、同一张表,只多一件事:知道文本还在长。
+ *  · **喂入**({@link RedactionStream.feed}):原文追加进本段;
+ *  · **取已判定前缀**({@link RedactionStream.takeSettled}):从上次取到的位置起,已判定的那一截的脱敏读法 —— head 读法,出门区终点 = 末尾 {@link PENDING_TAIL_UNITS}
+ *    个读法单元之前;切点再退到横跨它的那一条跨度的起点(一枚可能还在长、或判定在更远处的凭据整条不出)与码点边界。按重扫节律({@link streamRescanStep})才真扫;
+ *  · **收尾冲刷**({@link RedactionStream.flush}):整段读法交出其余字节,并核对已取出的字节在整段读法下是不是同一份。
+ * 律:各次取出依次拼接 + 冲刷 = 整段读法(`redactSecrets(全段)`)逐字节 —— 只喂一次再冲刷就是整段口本身。前提是 {@link PENDING_TAIL_UNITS} 读对了每条臂的判定距离;
+ * 读错的那一形在冲刷时现形(`diverged`),调用方响亮留痕。
+ * 延迟上界:一个字节在它之后又到 {@link PENDING_TAIL_UNITS} 个读法单元之后的下一次重扫时交出;盖住它的跨度判定之前(或冲刷之前)不交出。
+ * 不喂观察者(`observe:false`,与影子重扫同口):命中只在段末那一次整段脱敏里计(段末帧的铸点),逐块重扫不重复计数。扫描器抛 ⇒ 原样抛(放行位不动)。
+ */
+export interface RedactionStream {
+    /** 喂入下一块原文。 */
+    feed(chunk: string): void;
+    /** 取已判定前缀(可为 `""`)。 */
+    takeSettled(): string;
+    /** 收尾冲刷:其余字节的整段读法 + 已取出的字节与整段读法对不对得上。冲刷之后本流不再用。 */
+    flush(): {
+        readonly rest: string;
+        readonly diverged: boolean;
+    };
+    /** 跳过:已喂入的字节不再交出(没有收件人;tail 面没人在听时),之后的判定仍按整段上下文。 */
+    skip(): void;
+    /** 已喂入的整段原文。 */
+    readonly fed: string;
+}
+export declare function createRedactionStream(): RedactionStream;
+/** 测试可见:同一只流式口,未决尾按调用方给的数(比 {@link PENDING_TAIL_UNITS} 小 ⇒ 律被打破的那一形,冲刷时 `diverged` 现形 —— 响亮臂的触发器;生产调用方只有上面那一只)。 */
+export declare function createRedactionStreamWithTailForTest(units: number): RedactionStream;
 /**
  * 🔴 环 + 深度预算(2026-07-25 补)。原实现是纯递归、**既不记已访问节点也不限深度**,而它的调用位置是
  * **最不可信的边界**:`toolStart`/`toolEnd` 把工具的 `args`/`output`/`structured` 直接喂进来。后果两条: