@sema-agent/server 7.149.0 → 7.151.0

package/dist/file-history-capture.js

@@ -3,19 +3,22 @@ const FILE_HISTORY_CAPTURE_WORD_SET = {
     "on-optional": true,
 };
 export const FILE_HISTORY_CAPTURE_WORDS = Object.keys(FILE_HISTORY_CAPTURE_WORD_SET);
+export function fileHistoryWired(backend) {
+    return backend !== undefined;
+}
 export function assembleFileHistory(backend) {
-    if (backend === undefined)
+    if (!fileHistoryWired(backend))
         return { store: undefined, erasure: undefined };
     const physical = backend.fileHistory();
     return { store: physical, erasure: physical };
 }
-export function fileHistoryCaptureOf(store, knob) {
-    return store !== undefined && knob ? "on-optional" : "off";
+export function fileHistoryCaptureOf(wired, knob) {
+    return wired && knob ? "on-optional" : "off";
 }
-export function coreFileHistoryCaptureSeat(store, knob) {
-    if (store === undefined)
+export function coreFileHistoryCaptureSeat(wired, knob) {
+    if (!wired)
         return undefined;
-    const word = fileHistoryCaptureOf(store, knob);
+    const word = fileHistoryCaptureOf(wired, knob);
     switch (word) {
         case "off":
             return "off";

package/dist/file-history-disclosure.d.ts

@@ -50,16 +50,18 @@ export interface CaughtFailure {
     readonly fault: Pick<FileHistoryError, "permanence">;
 }
 /**
- * 把一个 caught error 折成店侧的散文 + 判断,**并**在它是一枚 typed 永久失败时留痕。
+ * 把一个 caught error 折成店侧的散文 + 判断,**并**在它是一枚 typed 永久失败时留痕。**先读店边界**(`storeBoundaryFault`,`site` = 折点所在的店方法):
+ * 文件历史店把失败**返回**成值(不抛),值里的文本取自这里 —— 驱动错(以及词法外的码:工作区 fs 的 `ENOENT` / `EACCES`、对象存储的码)在这里换成边界形
+ * (类别句 + 原码尾注,原句进运维日志 `at=store` 一行),返回值里不再带库的原话。
  *
- * `text` = 散文形:带 typed `code` 的前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
- * 不带的**逐字**是原 message(transient 失败的文案因此与本批之前一字不差)。
+ * `text` = 散文形:带本仓词法内 `code` 的(typed 失败:`blob_too_large_for_sql` 一类)前缀一个括号词(`(blob_too_large_for_sql) blob of … exceeds …`),
+ * 其余逐字是(过了边界的)message —— 边界句自带 `[original code: <码>]` 尾注,不再前缀第二遍码。
  * `fault` = 判断形(core 7.55.0 `FileHistoryError.permanence`):永久码表里的码 ⇒ `{ permanence: "terminal" }`;连接类故障 ⇒ `{ permanence: "transient" }`
  * (什么都不改稍后再试可能成);部署错配类故障 ⇒ `{ permanence: "terminal" }`(修表 / 授权之前重试注定失败);其余 ⇒ `{}`(店不知道 —— 认不出的驱动 / 库错是不是会自己好,不归本店判)。
- * 永久码先于分类判(一只错不会两个都是);分类词只读判官 `storeFaultClassOf`,本文件不写码。
+ * 永久码先于分类判(一只错不会两个都是);分类词只读判官 `storeFaultClassOf`(边界形带着它在原错上判的词),本文件不写码。
  * 副作用 = 机器形:码取自错误对象,逐次计数 + 每进程每码一条 warn。观测绝不抛。
  */
-export declare function foldCaughtFailure(err: unknown): CaughtFailure;
+export declare function foldCaughtFailure(err: unknown, site: string): CaughtFailure;
 /** 装配层把 logger/metrics 接上(main.ts,与 `installFailOpenRecorder` 同一处)。 */
 export declare function installFileHistoryFailureRecorder(deps: Sink): void;
 /** 本进程逐码累计(测试/诊断读面)。 */

package/dist/file-history-disclosure.js

@@ -1,5 +1,6 @@
 import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "@sema-agent/core";
 import { storeFaultClassOf } from "./plugins/store-fault.js";
+import { outwardFailureCode, storeBoundaryFault } from "./terminal.js";
 const PERMANENT_STORE_FAILURE_CODES = {
     blob_too_large_for_sql: {
         note: "a blob is larger than this deployment's SQL snapshot-blob cap — the same file will fail every turn until the deployment changes",
@@ -30,16 +31,17 @@ function drainToMetrics() {
         }
     }
 }
-export function foldCaughtFailure(err) {
-    const message = err instanceof Error ? err.message : String(err);
-    const code = err?.code;
-    const typedCode = typeof code === "string" && code !== "" ? code : undefined;
+export function foldCaughtFailure(err, site) {
+    const seen = storeBoundaryFault(err, site);
+    const message = seen instanceof Error ? seen.message : String(seen);
+    const code = seen?.code;
+    const typedCode = typeof code === "string" && code !== "" && outwardFailureCode(code) === code ? code : undefined;
     const permanentCode = typedCode !== undefined && isPermanentCode(typedCode) ? typedCode : undefined;
     if (permanentCode !== undefined)
         recordPermanent(permanentCode, message);
     return {
         text: typedCode !== undefined ? `(${typedCode}) ${message}` : message,
-        fault: permanentCode !== undefined ? { permanence: "terminal" } : faultOfClass(storeFaultClassOf(err)),
+        fault: permanentCode !== undefined ? { permanence: "terminal" } : faultOfClass(storeFaultClassOf(seen)),
     };
 }
 function faultOfClass(cls) {

package/dist/fleet/drain-entry.d.ts

@@ -87,6 +87,8 @@ export type DrainEntryAnswer = DrainReceipt | DrainDeadlineRefusal;
  * `session-resident-background.ts` 头注)· retain 的后台 shell · 只读订阅流(只进 `attachedStreams`)。
  * 四项在同一次读里求出(`http/server.ts` 的 `inflightBreakdown` 是唯一的分项函数,两个和都读它),`/health` 的 `inflight` 与 `inflightBreakdown` 因此永远自洽,
  * 判停与 `/health` 也不会各有一份算法。只有这两个函数各写一次这两个和,没有第三张计法表。
+ * 第三个读数 `/health.engineLease.attached`(附着流条数,[ref])进的是**同一张**计法表(契约「附着」一列:每一类活进不进它),不是第二套计数:
+ * 它读 {@link DrainState.attachedStreams} —— 自退判据第一合取读的那一只(`http/dispatch.ts` 的开放响应集 × SSE 章,定义只此一处)。
  */
 export interface InflightBreakdown {
     readonly http: number;
@@ -128,6 +130,8 @@ export interface DrainState {
     /** [ref]:首个**非探针**请求的单调时刻(`null` = 还没有过)。与 `lastActivityAt` 同一个写者(`http/server.ts` 的活性打点)、写一次就定;
      *  读者 = 租约腿的候首触态(`boot/engine-lease.ts`)与 `/health.engineLease.firstAttach.attachedAt`。 */
     firstActivityAt?: () => number | null;
+    /** 本副本此刻打开着的 SSE 流条数(`createHttpServer` 自赋;定义只此一处)。读者:附着租约自退判据的第一合取、`/health.engineLease.attached`(经租约腿的读数)—— 同一只读口,
+     *  不另数。语义是**附着流条数,不是活跃调用方**:订阅流与流式提交腿算,后台腿 / 无流同步腿不算(契约计法表「附着」列);纯轮询壳读到 0 合法。 */
     attachedStreams?: () => number;
     lastAttachEndedAt?: () => number;
     /** [ref]:附着租约窗的读口(`/health.engineLease`)。收尾链在**装了租约腿**时才装它,读口现读租约腿的把手 —— 腿还在观察才有读数,未装配的盒子里根本没有这只口。 */

package/dist/fleet/engine-signal.d.ts

@@ -16,6 +16,8 @@
  *     那一形的面只有每拍一行运维 warn + 计数)。「扣着」在两出口上只有这一种读法(7.120.x 的 `/health.modelPlaneDeferred` 本版删除)。
  *     合成只在 {@link buildRestartSignal} 一处,`restartState()` 是它唯一的调用方 —— 两个出口读的是同一只取值口。
  *  4. **代际**:`generation` = env `FLEET_GENERATION` 的回声(规范十进制串;非规范在 boot 拒启,见 `config.ts`);缺席 ⇔ 非 fleet 成员。
+ *     **围栏只有成员身份一个开关**:租约读数只有一只读者 {@link memberLeaseOf}(铸点与准入三处同读)—— 非成员恒 {@link LEASE_NONE},
+ *     注入了读数也不读;所以「`/health` 不报 `leaseState` 而准入照按租约拒」这一形构造不出来。
  *     **身份不是引擎态**:`instanceId`(本进程起步自铸的那一只,`boot/stage-03` 的 uuidv7)是体的身份,只在两出口体的**顶层**说一次,
  *     铸点不读它、契约形里不重复它。
  *  5. **两形一读(展开 / 收缩)**:两出口今天各发两形 —— 嵌套键 {@link ENGINE_SIGNAL_KEY}(契约 `EngineSignal` 整只,{@link buildEngineSignal}),
@@ -52,8 +54,19 @@ export type ServingLeaseView = {
 };
 /** 心跳体上的 fleet 成员三键 —— 类型取自契约心跳形(拼法与值域只有契约一个写者)。 */
 export type FleetMembershipKeys = Pick<InstanceAnnouncement, "generation" | "leaseState" | "leaseUntil">;
-/** 非 fleet 成员 / 没装租约客户端时的读数(唯一拼法)。 */
+/** 非 fleet 成员 / 没装租约客户端时的读数(唯一拼法)。成员的推定围栏只住在租约客户端里,不进这只缺省值。 */
 export declare const LEASE_NONE: ServingLeaseView;
+/**
+ * 租约读数的**唯一读者**(规则 4;铸点 {@link mintEngineSignal} 与准入三处 —— 计费门 / a2a `message/send` / PARKED 赎回席 —— 都经它,不直读
+ * `deps.servingLease`):成员身份 = `config.fleetGeneration` 在场 ⇒ 租约客户端此刻的读数(没装 ⇒ {@link LEASE_NONE});非成员 ⇒ {@link LEASE_NONE}。
+ */
+export declare function memberLeaseOf(deps: Pick<EngineSignalInputs, "config" | "servingLease">): ServingLeaseView;
+/**
+ * 装配判的拒句(`createHttpServer` 构造期,fail-closed):租约读数只属于 fleet 成员,而成员身份只有 `config.fleetGeneration` 一个开关 ——
+ * 注入了 `servingLease` 却没设代际,读数永远不会被 {@link memberLeaseOf} 读到、准入永远不按租约拒。两键都是可选的,所以这是一份能编译的
+ * 自相矛盾的装配:响亮拒,不静默丢掉读数(本服务自己的组合根只给成员装租约客户端,走不到这里)。
+ */
+export declare const SERVING_LEASE_MEMBERSHIP_REQUIRED = "servingLease is wired but config.fleetGeneration is not: a serving-lease reading belongs to a fleet member, and membership is config.fleetGeneration (FLEET_GENERATION) alone \u2014 without it the reading is never read and admission never refuses on the lease; set config.fleetGeneration to this instance's generation, or do not pass servingLease; refusing to start rather than ignore the lease reading";
 /** 扣着的候选(web-admin 的 `planeDeferredNoHandoff` 投影):版本、起扣时刻、被扣的重启片。 */
 export interface RetainedCandidate {
     readonly version: number;

package/dist/fleet/engine-signal.js

@@ -1,6 +1,10 @@
 import { readinessOf } from "../http/readiness.js";
 import { drainingFactOf } from "./drain-entry.js";
 export const LEASE_NONE = Object.freeze({ state: "none" });
+export function memberLeaseOf(deps) {
+    return deps.config?.fleetGeneration === undefined ? LEASE_NONE : (deps.servingLease?.() ?? LEASE_NONE);
+}
+export const SERVING_LEASE_MEMBERSHIP_REQUIRED = "servingLease is wired but config.fleetGeneration is not: a serving-lease reading belongs to a fleet member, and membership is config.fleetGeneration (FLEET_GENERATION) alone — without it the reading is never read and admission never refuses on the lease; set config.fleetGeneration to this instance's generation, or do not pass servingLease; refusing to start rather than ignore the lease reading";
 export function buildRestartSignal(published, retained) {
     if (published !== undefined)
         return published;
@@ -29,7 +33,7 @@ export function mintEngineSignal(deps) {
         ...(draining !== undefined ? { draining } : {}),
         ...(restart !== undefined ? { restart } : {}),
         ...(deps.config?.fleetGeneration !== undefined ? { generation: deps.config.fleetGeneration } : {}),
-        lease: deps.servingLease?.() ?? LEASE_NONE,
+        lease: memberLeaseOf(deps),
         ...(configApply !== undefined ? { configApply } : {}),
     };
 }

package/dist/fleet/fleet-reconciler.d.ts

@@ -1,5 +1,5 @@
 /**
- * [ref](docs/DESIGN-261-fleet-liveness-reconcile.md v1.2,四方零驳定稿)—— fleet 总线**存活对账腿**。
+ * [ref](docs/[ref]-fleet-liveness-reconcile.md v1.2,四方零驳定稿)—— fleet 总线**存活对账腿**。
  *
  * ## 它修什么(§0 病灶机制链)
  * fleet 总线是进程内纯内存聚合(`fleet-bus.ts` 头注自陈 NOT durable / NOT cross-replica),行的**唯一**

package/dist/fleet/serving-lease.d.ts

@@ -32,11 +32,26 @@ export interface ServingLeaseClientOpts {
         readonly epoch: () => number;
     };
 }
+/**
+ * 一拍心跳听到了什么(`fleet-client.ts` 每一次公告尝试恰好交一只;读者在本模块)。
+ *  · `reading` —— 中心的显式能力声明(契约 `declared`;位缺席 = 中心说不执行围栏);
+ *  · `silent` —— 没有读数。`why` 的形是闭集:`HTTP <状态>`(非 2xx,不带中心体片段)/ 请求抛出的那句(不可达 / 超时 / 凭证读不出)/
+ *    `reply-unreadable:<因>`(2xx 而不是声明,因 = `fleet-client.ts` `AnnounceReplyFlaw`)/ `not-sent:<那句>`(这一拍的引擎信号铸不出,没发)。
+ */
+export type HeartbeatHearing = {
+    readonly kind: "reading";
+    readonly capabilities: WebAdminCapabilities;
+} | {
+    readonly kind: "silent";
+    readonly why: string;
+};
 export interface ServingLeaseClient {
-    /** 一次中心能力读数(`undefined` = `undeclared`,中心没宣告 = 不支持)。每一次读数调一次;`unreadable` 不是读数,不调(`fleet-client.ts` `capabilityReadingOf`)。 */
-    noteCenterCapabilities(caps: WebAdminCapabilities | undefined): void;
-    /** 此刻的租约读数(铸点与准入判读它)。 */
+    /** 一拍心跳听到的东西(规则 1;每一次公告尝试恰好一次)。 */
+    noteHeartbeat(hearing: HeartbeatHearing): void;
+    /** 此刻的租约读数(铸点与准入判读它 —— 经 `engine-signal.ts` 的唯一读者 `memberLeaseOf`)。 */
     view(): ServingLeaseView;
+    /** 订阅「租约态由事件翻转」(规则 2′;一只订阅者 = 装配层的 `announceNow`,晚绑:fleet 客户端在本客户端之后造)。 */
+    onViewChange(listener: () => void): void;
     /** 起步读黏性拒(装配层在唯一排空入口装好之后调一次)。 */
     resumeStickyDenial(): void;
     /** 立刻续一次(测试 / 能力位刚出现时用;单飞)。 */

package/dist/fleet/serving-lease.js

@@ -40,8 +40,9 @@ export function createServingLeaseClient(o) {
     const mono = o.clock?.mono ?? (() => performance.now());
     const epoch = o.clock?.epoch ?? Date.now;
     const stickyPath = o.dataRoot === undefined ? undefined : join(o.dataRoot, SERVING_LEASE_DENIED_FILE);
-    let capability;
-    const enabled = () => capability?.announced === true;
+    let fence = { kind: "presumed", since: mono() };
+    const enabled = () => fence.kind === "on";
+    let viewListener;
     let denied = false;
     let stopped = false;
     let lease;
@@ -49,6 +50,37 @@ export function createServingLeaseClient(o) {
     let timer;
     let inFlight;
     let failStreak = 0;
+    const view = () => {
+        if (denied)
+            return { state: "denied" };
+        if (fence.kind === "off")
+            return { state: "none" };
+        const now = mono();
+        if (lease !== undefined && now < lease.expiresAtMono)
+            return { state: "granted", leaseUntil: lease.leaseUntil };
+        return { state: "expired", pastOutageMax: now - (lease?.expiresAtMono ?? fence.since) >= o.outageMaxMs };
+    };
+    const changing = (change) => {
+        const before = view().state;
+        change();
+        if (view().state !== before)
+            viewListener?.();
+    };
+    const unconfirmed = (why) => {
+        recordFailOpen("server.fleet.serving-lease-unconfirmed", `worker=${o.center.worker} generation=${o.generation} why=${why}`);
+        failStreak += 1;
+        if (failStreak === 1) {
+            o.logger?.warn("fleet_serving_lease_unconfirmed", {
+                error: why,
+                note: "the fleet center has not confirmed this instance's serving lease (heartbeat or renewal unanswered, refused or unreadable, or the verdict was unknown) — this instance keeps serving until its last grant, or with no grant yet the moment the fence took effect (this process's start, for a member that has not heard the center), is FLEET_LEASE_OUTAGE_MAX_MS behind, then refuses new work (unconfirmed is never a denial)",
+            });
+        }
+    };
+    const confirmed = (by) => {
+        if (failStreak > 0)
+            o.logger?.info("fleet_serving_lease_recovered", { after: failStreak, by });
+        failStreak = 0;
+    };
     const clear = () => {
         if (timer !== undefined)
             clearTimeout(timer);
@@ -79,6 +111,9 @@ export function createServingLeaseClient(o) {
     const enterDenied = (denial) => {
         if (denied)
             return;
+        changing(() => enterDeniedNow(denial));
+    };
+    const enterDeniedNow = (denial) => {
         denied = true;
         lease = undefined;
         clear();
@@ -118,25 +153,22 @@ export function createServingLeaseClient(o) {
             why = err instanceof Error ? err.message : String(err);
         }
         if (reading === undefined || reading.verdict === "unknown") {
-            const unconfirmed = reading === undefined ? why : "verdict=unknown (the center holds no lifecycle object for this instance right now)";
-            recordFailOpen("server.fleet.serving-lease-unconfirmed", `worker=${o.center.worker} generation=${o.generation} why=${unconfirmed}`);
-            failStreak += 1;
-            if (failStreak === 1)
-                o.logger?.warn("fleet_serving_lease_unconfirmed", { error: unconfirmed, note: "the serving lease could not be renewed (the center is unreachable or did not confirm this instance) — this instance keeps serving until the lease expires and then for FLEET_LEASE_OUTAGE_MAX_MS more before it refuses new work (unconfirmed is never a denial)" });
+            if (fence.kind === "on")
+                unconfirmed(reading === undefined ? why : "verdict=unknown (the center holds no lifecycle object for this instance right now)");
             schedule(nextInMs);
             return;
         }
-        if (failStreak > 0)
-            o.logger?.info("fleet_serving_lease_recovered", { after: failStreak });
-        failStreak = 0;
+        confirmed("verdict");
         switch (reading.verdict) {
-            case "granted":
+            case "granted": {
                 if (denied)
                     return;
-                lease = { expiresAtMono: sendMono + reading.ttlMs, leaseUntil: sendEpoch + reading.ttlMs };
+                const granted = { expiresAtMono: sendMono + reading.ttlMs, leaseUntil: sendEpoch + reading.ttlMs };
+                changing(() => (lease = granted));
                 nextInMs = reading.ttlMs / 3;
                 schedule(nextInMs);
                 return;
+            }
             case "denied":
                 enterDenied({ from: "center", reason: reading.reason });
                 return;
@@ -154,34 +186,48 @@ export function createServingLeaseClient(o) {
         });
         return inFlight;
     };
+    const noteDeclaration = (caps) => {
+        const on = caps.servingLease === true;
+        if (!on)
+            recordFailOpen("server.fleet.serving-lease-capability-absent", `worker=${o.center.worker} generation=${o.generation} was=${fence.kind}`);
+        if (on && fence.kind !== "on") {
+            fence = { kind: "on", since: fence.since ?? mono() };
+            o.logger?.info("fleet_serving_lease_enabled", { generation: o.generation, worker: o.center.worker });
+            void renewNow();
+        }
+        else if (!on && fence.kind !== "off") {
+            const was = fence.kind;
+            fence = { kind: "off", since: was === "on" ? fence.since : undefined };
+            clear();
+            confirmed("not-enforced");
+            if (was === "on")
+                o.logger?.warn("fleet_serving_lease_disabled", { note: "the fleet center no longer announces the servingLease capability — the lease is out of effect (leaseState none) until it does again; its outage clock is not reset (when the capability returns, the last grant and the moment the fence first took effect in this process still count)" });
+        }
+    };
     return {
-        noteCenterCapabilities(caps) {
+        noteHeartbeat(hearing) {
             if (stopped || denied)
                 return;
-            const on = caps?.servingLease === true;
-            if (!on)
-                recordFailOpen("server.fleet.serving-lease-capability-absent", `worker=${o.center.worker} generation=${o.generation} was=${enabled() ? "enabled" : "none"}`);
-            if (on && !enabled()) {
-                capability = { announced: true, firstSeenAtMono: capability?.firstSeenAtMono ?? mono() };
-                o.logger?.info("fleet_serving_lease_enabled", { generation: o.generation, worker: o.center.worker });
-                void renewNow();
-            }
-            else if (!on && capability?.announced === true) {
-                capability = { announced: false, firstSeenAtMono: capability.firstSeenAtMono };
-                clear();
-                o.logger?.warn("fleet_serving_lease_disabled", { note: "the fleet center no longer announces the servingLease capability — the lease is out of effect (leaseState none) until it does again; its outage clock is not reset (when the capability returns, the last grant and this process's first sighting of the capability still count)" });
+            switch (hearing.kind) {
+                case "silent":
+                    if (fence.kind === "presumed")
+                        unconfirmed(`heartbeat:${hearing.why}`);
+                    return;
+                case "reading":
+                    if (fence.kind === "presumed")
+                        changing(() => noteDeclaration(hearing.capabilities));
+                    else
+                        noteDeclaration(hearing.capabilities);
+                    return;
+                default: {
+                    const unhandled = hearing;
+                    throw new Error(`serving lease: unknown heartbeat hearing ${JSON.stringify(unhandled)}`);
+                }
             }
         },
-        view() {
-            if (denied)
-                return { state: "denied" };
-            if (capability === undefined || !capability.announced)
-                return { state: "none" };
-            const now = mono();
-            if (lease !== undefined && now < lease.expiresAtMono)
-                return { state: "granted", leaseUntil: lease.leaseUntil };
-            const expiredAt = lease?.expiresAtMono ?? capability.firstSeenAtMono;
-            return { state: "expired", pastOutageMax: now - expiredAt >= o.outageMaxMs };
+        view,
+        onViewChange(listener) {
+            viewListener = listener;
         },
         resumeStickyDenial() {
             if (stickyPath === undefined || denied)

package/dist/fleet-client.d.ts

@@ -18,9 +18,10 @@
  *  - **`modelRefusals?`([ref])**:在场 ⇔ 本副本对最近一次被判的中心候选目录有可报的拒(逐条名 → 码 / 模型面组拒码)—— 取自
  *    `/health.modelRefusals` **同一只**取值口(装配层接 `deployment.modelRefusalsState`),同一个对象,形 = settings-schema
  *    `ModelRefusalsSignal`;缺席即键缺席(同 `restart`)。
- *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因,比任何观测都快):draining 翻转由收尾链直调
- *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`
- *    (两处 = 两类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
+ *  - **自报状态翻转即刻再 announce**(第一时间自摘流 / 自挂流 / 报重启 / 报拒因 / 报租约态,比任何观测都快):draining 翻转由收尾链直调
+ *    `announceNow`;roster 落地、restart 信号与模型拒因变化由装配层把 web-admin 的 `onSelfReportChange` 接到 `announceNow`;租约态由事件引起的
+ *    翻转(推定的终结 / 续租判决 / 被拒 —— 不自激的那几样,见 `fleet/serving-lease.ts` 规则 2′)由装配层把服务租约客户端的 `onViewChange` 接到
+ *    `announceNow`(三处 = 三类输入各自的唯一写者,触发都是 `announceNow`)。退出前 DELETE(显式注销,幂等)。
  *  - **usage 批报**:tracer 的 `brain.call` 已带 ALS principal —— FleetUsageAccumulator 按 principal×model
  *    累计,每窗口(默认 60s,半开 [windowStartMs, windowEndMs))POST /api/fleet/usage。幂等键
  *    (worker,instanceId,windowStartMs) 重发安全;**发送失败 → merge 回累计器**,并入下一窗(失败窗从未入账,
@@ -30,8 +31,9 @@
  *    不在下一个人的凭证下上报(不记到别人头上);它留在原箱,那个身份回来时照常报出去,收尾时还压着就响亮一行。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport, type CapabilityReading, type WebAdminCapabilities, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
+import { UsageReport, type CapabilityReading, type ModelRefusalsSignal } from "@sema-agent/settings-schema/fleet";
 import { type EngineSignalFacts } from "./fleet/engine-signal.js";
+import type { HeartbeatHearing } from "./fleet/serving-lease.js";
 import { type CenterEndpoint } from "./web-admin-client/center-request.js";
 import { type CenterCredentialSource } from "./center-credential.js";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
@@ -118,10 +120,10 @@ export interface FleetClientOpts {
     /** [ref]:模型拒因信号(装配层接 `/health` 同一只取值口 `deployment.modelRefusalsState`)。每条公告现读一次;`undefined` ⇒ 公告不带
      *  `modelRefusals` 键。必填:与 `restart` 同 —— 心跳面没有「不知道有没有拒」这一形(老引擎不发这个键,中心按 `version` 判「不可知」)。 */
     modelRefusals: () => ModelRefusalsSignal | undefined;
-    /** 编排器片 2:每一次**能力读数**交出去一次(装配层接服务租约客户端的 `noteCenterCapabilities`)。规则见 {@link capabilityReadingOf}:
-     *  只有 `declared`(交出宣告的位)与 `undeclared`(交 `undefined` = 老中心没宣告)是读数;`unreadable`(体读不出 / 不是对象 /
-     *  `capabilities` 键在场而形坏)不是读数 ⇒ 不调,上一次读数与它的钟原样。失败的公告同样不调(没听到 ≠ 没有)。 */
-    onCenterCapabilities?: (caps: WebAdminCapabilities | undefined) => void;
+    /** 编排器片 2:**每一次公告尝试恰好交一只**听到的东西(装配层接服务租约客户端的 `noteHeartbeat`;只有 fleet 成员接)。`reading` = 中心的显式
+     *  声明(规则见 {@link capabilityReadingOf});其余一律 `silent`(`why` 闭集:`HTTP <状态>` / 请求抛出的那句 / `reply-unreadable:<因>` /
+     *  `not-sent:<那句>`)—— 没听到不是「没有」,租约客户端按沉默处置。没接这一只 ⇒ 不读答复体(非成员的心跳答复不进任何租约臂)。 */
+    onHeartbeat?: (hearing: HeartbeatHearing) => void;
     /** [ref]:按凭证身份分箱的用量账(缺席 = 用量环不装)。 */
     usage?: FleetUsageBins;
     heartbeatMs?: number;
@@ -149,13 +151,13 @@ export interface FleetClient {
     flushFinalUsage: () => Promise<void>;
 }
 /**
- * 心跳 2xx 答复读不成能力读数的原因 —— 一张闭集:`body` = 答复体本身读不出(空体 / 截断 / 非 JSON),其余两词 = 契约读器
- * `readCapabilityReading` 的 `unreadable` 两因(`not-an-object` / `invalid-capabilities`)。
+ * 心跳 2xx 答复读不成能力读数的原因 —— 一张闭集:`body` = 答复体本身读不出(空体 / 截断 / 非 JSON),其余三词 = 契约读器
+ * `readCapabilityReading` 的 `unreadable` 三因(`not-an-object` / `capabilities-absent` / `invalid-capabilities`)。
  */
 export type AnnounceReplyFlaw = "body" | Extract<CapabilityReading, {
     kind: "unreadable";
 }>["why"];
-/** 本仓对一次心跳答复的读法:契约三态,`unreadable` 的原因扩成 {@link AnnounceReplyFlaw}(`detail` = 读不出体时的那句错误,当数据交出)。 */
+/** 本仓对一次心跳答复的读法:契约两态,`unreadable` 的原因扩成 {@link AnnounceReplyFlaw}(`detail` = 读不出体时的那句错误,当数据交出)。 */
 export type AnnounceReplyReading = Exclude<CapabilityReading, {
     kind: "unreadable";
 }> | {

package/dist/fleet-client.js

@@ -110,9 +110,40 @@ export function startFleetClient(opts) {
     let failStreak = 0;
     let unreadableStreak = 0;
     const address = opts.advertiseAddress;
+    const announceFailed = (error) => {
+        failStreak += 1;
+        if (failStreak === 1)
+            opts.logger?.warn("fleet_announce_failed", { error });
+    };
+    const hearReply = async (res, leaseState) => {
+        const reading = await capabilityReadingOf(res);
+        switch (reading.kind) {
+            case "declared":
+                unreadableStreak = 0;
+                return { kind: "reading", capabilities: reading.capabilities };
+            case "unreadable":
+                recordFailOpen("server.fleet.announce-reply-unreadable", `why=${reading.why} leaseState=${leaseState}`);
+                unreadableStreak += 1;
+                if (unreadableStreak === 1) {
+                    opts.logger?.warn("fleet_announce_reply_unreadable", {
+                        status: res.status,
+                        why: reading.why,
+                        ...(reading.detail !== undefined ? { error: reading.detail } : {}),
+                        note: "the fleet center's heartbeat reply is not a capability declaration (unreadable body, not an object, no capabilities key, or a malformed capabilities value) — no reading taken; the serving lease keeps its state and outage clock (a member that has heard no declaration stays inside the presumed fence)",
+                    });
+                }
+                return { kind: "silent", why: `reply-unreadable:${reading.why}` };
+            default: {
+                const unhandled = reading;
+                throw new Error(`heartbeat reply: unknown capability reading ${JSON.stringify(unhandled)}`);
+            }
+        }
+    };
     const announceOnce = async () => {
         if (stopped || address === undefined)
             return;
+        let hearing;
+        let sending = false;
         try {
             const signal = opts.signal();
             const engineSignal = buildEngineSignal(signal);
@@ -129,43 +160,32 @@ export function startFleetClient(opts) {
                 ...fleetMembershipKeys(signal),
                 [ENGINE_SIGNAL_KEY]: engineSignal,
             };
+            sending = true;
             const { res } = await send("fleet-instances", "POST", body);
-            if (!res.ok)
-                throw new Error(`announce ${res.status}${await rejectionSnippet(res)}`);
-            if (opts.onCenterCapabilities !== undefined) {
-                const reading = await capabilityReadingOf(res);
-                switch (reading.kind) {
-                    case "declared":
-                    case "undeclared":
-                        unreadableStreak = 0;
-                        opts.onCenterCapabilities(reading.kind === "declared" ? reading.capabilities : undefined);
-                        break;
-                    case "unreadable":
-                        recordFailOpen("server.fleet.announce-reply-unreadable", `why=${reading.why} leaseState=${signal.lease.state}`);
-                        unreadableStreak += 1;
-                        if (unreadableStreak === 1) {
-                            opts.logger?.warn("fleet_announce_reply_unreadable", {
-                                status: res.status,
-                                why: reading.why,
-                                ...(reading.detail !== undefined ? { error: reading.detail } : {}),
-                                note: "the fleet center's heartbeat reply is not a capability reading (unreadable body, not an object, or a malformed capabilities value) — no reading taken; the last one stands (the serving lease keeps its state and outage clock)",
-                            });
-                        }
-                        break;
-                    default: {
-                        const unhandled = reading;
-                        throw new Error(`heartbeat reply: unknown capability reading ${JSON.stringify(unhandled)}`);
-                    }
-                }
+            if (!res.ok) {
+                hearing = { kind: "silent", why: `HTTP ${res.status}` };
+                announceFailed(`announce ${res.status}${await rejectionSnippet(res)}`);
             }
-            if (failStreak > 0)
-                opts.logger?.info("fleet_announce_recovered", { after: failStreak });
-            failStreak = 0;
+            else {
+                if (failStreak > 0)
+                    opts.logger?.info("fleet_announce_recovered", { after: failStreak });
+                failStreak = 0;
+                if (opts.onHeartbeat !== undefined)
+                    hearing = await hearReply(res, signal.lease.state);
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : String(err);
+            hearing = { kind: "silent", why: sending ? error : `not-sent:${error}` };
+            announceFailed(error);
+        }
+        if (hearing === undefined || opts.onHeartbeat === undefined)
+            return;
+        try {
+            opts.onHeartbeat(hearing);
         }
         catch (err) {
-            failStreak += 1;
-            if (failStreak === 1)
-                opts.logger?.warn("fleet_announce_failed", { error: err instanceof Error ? err.message : String(err) });
+            opts.logger?.warn("fleet_heartbeat_listener_failed", { error: err instanceof Error ? err.message : String(err), note: "the serving-lease client threw while taking this heartbeat's hearing — this beat did not reach the fence; the announce loop goes on" });
         }
     };
     let inFlight;

package/dist/history-anchor.js

@@ -10,7 +10,7 @@ async function unknownAnchorCause(readers, reader, sessionId, handle) {
     if (reader === undefined)
         return NO_ANCHOR;
     try {
-        const run = await readVisibleRun(reader, readers.runs, handle);
+        const run = (await readVisibleRun(reader, readers.runs, handle))?.row;
         if (run === undefined || run.sessionId !== sessionId)
             return NO_ANCHOR;
         return (await readers.anchors.resolve(sessionId, handle, run.owner)) === undefined ? PROMPT_WITHOUT_ANCHOR : NO_ANCHOR;

package/dist/hitl-delivery.d.ts

@@ -29,7 +29,7 @@ export interface HitlSinks {
     readonly live?: boolean;
 }
 /**
- * 一条腿的传输(无状态)。`deliver` 与 `reachable` 是**属性**(不是方法签名)—— 帧型参数因此逆变。腿上装出的那一只是全族型(`HitlTransport<HitlFrame>`,
+ * 一条腿的传输(无状态)。`deliver` 是**属性**(不是方法签名)—— 帧型参数因此逆变。腿上装出的那一只是全族型(`HitlTransport<HitlFrame>`,
  * 一腿一只、三族共用);**窄化发生在装进族上下文那一步**:审批上下文的判别联合把传输型钉到本族帧(呈卡族收不进旧族帧),竞速机的目标从族上下文取
  * ⇒ 混族的 (transport, frame) 对编译不过。直接拿全族型传输喂竞速机的代码不受这道型约束(三只协调器都从族上下文取,`P14` 编译期钉)。
  */
@@ -39,8 +39,6 @@ export interface HitlTransport<F extends HitlFrame> {
      * 写抛 / 已死 ⇒ 直写没接下(不碰死连接)。③ 交回每只涉及的 sink 接下与否。**永不 reject。**
      */
     readonly deliver: (frame: F, onto?: HitlSinks) => Promise<HitlSinks>;
-    /** 判决面谓词:有直写 ⇒ 直写此刻活着;只有账本 ⇒ 恒真(账本 tail 随时可被接上)。谓词读不出 ⇒ 假(判决面 fail-closed 到停驻)。 */
-    readonly reachable: () => boolean;
 }
 /** 直写面:一个具名帧写 + 「此刻还活着吗」。 */
 export interface HitlLiveSink<F extends HitlFrame> {

package/dist/hitl-delivery.js

@@ -66,7 +66,7 @@ export function createHitlTransport(sinks) {
         }
         return ledgerAccepted !== undefined ? { ledger: ledgerAccepted, live: liveAccepted } : { live: liveAccepted };
     };
-    return { deliver, reachable: () => live === undefined || liveAlive(live) };
+    return { deliver };
 }
 export function createHitlOpenRace(args) {
     const opens = args.targets.map((t) => t.transport.deliver(t.frame));

package/dist/hooks/hook-runner.js

@@ -60,8 +60,8 @@ export const SETTINGS_HOOK_STATIONS = {
 function chainsBelowTaskOn(patterns, station) {
     return patterns.some((p) => p === station || (p.endsWith(".*") && station.startsWith(p.slice(0, -1))));
 }
-const REQUEST_HOOK_REWRITE_UNSHOWN_REASON = "a request PreToolUse hook rewrote this call's input, but this deployment runs its own handler for this call after the request's hooks and that handler never sees a rewrite made above it, so the rewrite cannot be honored and the call was not executed";
-const REQUEST_HOOK_ALLOW_UNJUDGED_REASON = "a request PreToolUse hook allowed this call, but this deployment runs its own handler for this call after the request's hooks, and a request hook's allow does not stand in for that handler's judgment, so the call was not executed";
+const REQUEST_HOOK_REWRITE_UNSHOWN_REASON = "a request PreToolUse hook rewrote this call's input, but a deployment-seat handler is admitted at the PreToolUse site below the request's hooks (admission is per site; whether its matcher fits this call is not read), and such a handler never sees a rewrite made above it, so request-hook rewrites are refused at this site and the call was not executed";
+const REQUEST_HOOK_ALLOW_UNJUDGED_REASON = "a request PreToolUse hook allowed this call, but a deployment-seat handler is admitted at the PreToolUse site below the request's hooks (admission is per site; whether its matcher fits this call is not read), and a request hook's allow does not stand in for that handler's judgment, so request-hook allows are refused at this site and the call was not executed";
 function hangTranslator(on, event, translators) {
     const translate = translators[event];
     if (translate === undefined)

package/dist/host-lsp-manager.d.ts

@@ -6,8 +6,8 @@
  * `LSP_HOST_ENABLED`。理由:core 的 `NodeLspManager` 在 worker 上起本机子进程、在 worker 盘上找根,问的正是「这块盘是不是调用方的」;
  * 车道能力表不另存一位(同一个答案的第二个写者)。两个入口(服务装配 `boot/execution-env.ts`、纯本地 CLI `run-local.ts`)的 `lspManager`
  * 就是本函数的返回值,不再有任何条件(结构钉 `test/secret-env-scrub-disclosure.test.ts` 的 P1,逐格钉 `test/lsp-host-manager.test.ts` 的 P2)。
- * 「绑得住读」(`openBound`)不是运行期判据:它是「手在本 worker 盘上」的车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts`),
- * 运行期的不可绑拒由引擎答。
+ * 「绑得住读」(`openBound`)不是本铸点的判据:它是每条有手车道的结构前提(对拍钉 `test/host-env-open-bound.test.ts` P3;本版 ssh 缓装),
+ * 运行期的不可绑由那一答答(远端目标给不出那一次观测 ⇒ `not_supported`,引擎读作缺席)。
  *
  * ## 子进程 env:病([ref],core 7.30.1 [ref] 提货;DEBTS [ref] 同轴的第二条,7.99.0 修复验证 opus 腿普查带出)
  * core 的 `NodeLspManager` 默认 spawn(`defaultLspSpawn`)在 7.30.1 之前**不带 env** ⇒ 语言服务器整份继承本进程的

package/dist/http/active-run-conflict.d.ts

@@ -15,7 +15,7 @@
  */
 import { type GovernancePosture } from "../runtime-governance.js";
 import type { ShellGateDoctrine } from "@sema-agent/core";
-import { type RunRecord } from "../plugins/store-contracts.js";
+import type { RunStore } from "../plugins/store-backend.js";
 import { type PendingRowBinding } from "../plugins/checkpoint-store-face.js";
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export declare const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run \u2014 POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
@@ -113,12 +113,8 @@ interface ConflictProbeDeps<TToken> {
     /** 结构形入参,但 `status` 取 run 行的**闭词表**(合并码重扫):判 park 要走词表属主
      *  `isParkedRunStatus`,而它的入参是穷举联合 —— 这一格写成开放 `string` 就只能在调用点裸 cast,
      *  绕开那道编译期执法(core 加一个 park 类成员时本文件不会红)。 */
-    /** 持有者那一行(只读 `status`;409 体只点名**活着**的持有者 —— 心跳过期的持有者在认领冲突处已被判死、认领已放,见 run 店 `createRun`)。 */
-    runStore?: {
-        getRun?: (id: string) => Promise<{
-            status?: RunRecord["status"];
-        } | null | undefined>;
-    } | undefined;
+    /** 持有者那一行的状态(不带属主的一格事实,经属主存取器 `runFactsOf` 读;409 体只点名**活着**的持有者 —— 心跳过期的持有者在认领冲突处已被判死、认领已放,见 run 店 `createRun`)。 */
+    runStore?: Pick<RunStore, "getRun"> | undefined;
     checkpointStore?: {
         peekPendingScope?: (sessionId: string, binding?: PendingRowBinding) => Promise<string | null | undefined>;
         findPendingTokenBySession?: (sessionId: string, scope?: string, binding?: PendingRowBinding) => Promise<TToken | null | undefined>;