@sema-agent/server 7.16.0 → 7.18.0

package/USAGE.md

@@ -333,11 +333,39 @@ STREAM_APPROVAL_ORPHAN_TTL_MS=604800000
   `STREAM_APPROVAL_ORPHAN_TTL_MS`,否则**拒启**并点名。理由是归因诚实:adhoc 判据在
   `(创建 + 窗 + 宽限)` 触发、遗孤兜底在 `(创建 + TTL)` 触发,兜底若先到,每条 adhoc 腿都会被记成
   `orphan_ttl_exceeded`(「遗孤」)而不是 `adhoc_leg_no_durable_domain`(「结构上无对账域」),审计面从此读不出真成因。
+- **断连时活卡怎么办(#245/[3777] 成文)**:客户端**优雅断开**(server 收到 socket close)时,流内未决 ask
+  立即强转 durable park(7.16.0 #241),恢复后 attach 重放会重呈卡。客户端**网络中断**(TCP half-open,
+  server 侧 close 事件不触发)是已知盲窗:SSE heartbeat 帧只会堆进 TCP 重传队列,server 要等 OS 级重传
+  耗尽(十几分钟量级)才感知——这段时间内真正的兜底是**活卡窗到期转 park**(`STREAM_ASK_WINDOW_MS`,
+  默认 5min),所以把窗改大等于把断连场景的最坏无人区拉长,改小前先看上面的跨旋钮不变量。half-open 的
+  主动探测(写水位判死)在攻关排期([3777] S2)。
+- **无 durable 前置的部署(五合取不满足:local backend / 无 checkpoint 能力)**:流内协议整个不上场
+  (启动一行 `stream_approval_disabled` 点名缺哪项),ask 走旧活卡腿——断连场景的最坏结局是活卡 TTL
+  窗满**自动 deny(fail-closed)后 run 继续**,不会死锁在等一张没人能回的卡上;代价是断连期间用户的
+  批准机会直接过期。要「断连也不丢决策」的语义,配齐 durable 前置(持久 store + `DURABLE_APPROVAL=true`)。
   默认值(300s + 60s vs 7d)自然满足,只有显式改坏才会撞上。
 - **调参方向**:想让人有更长时间点审批卡 → 调大 `STREAM_ASK_WINDOW_MS`;卡太多刷屏 → 调小两个 `ADMIT_MAX_*`
   (代价是超限的 ask 走 park,要有人去审批队列捞);库压大 → 调小 `STREAM_APPROVAL_RECONCILE_BATCH`
   (代价是收敛变慢,靠队列轮转保证下轮接着扫)。
 
+**可选 — READ 面姿态(readFace,7.18.0 起;缺席=引擎当家)**
+
+```bash
+READ_FACE=open                       # 词表 open|roots;坏词启动期响亮拒。不设=不传给引擎(引擎默认 roots)
+READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitive":true}]'
+```
+- **`READ_FACE`**:READ 工具面(读文件/遍历/搜索)的部署级姿态。引擎默认 **`roots`** = 读被夹在任务的
+  workspace roots 里;`open` = 部署显式放开(单用户自托管、要读全盘配置那种形)。任务层只能**收紧**
+  (spec 的 `readFace:"roots"`),放开只有这一个部署座席——层级方向与写门一致(部署默认压不过承重墙)。
+- **`READ_DENY_PATTERNS`**:JSON 数组,元素 `"pattern"` 或 `{pattern, caseSensitive?}`。语义是
+  **路径段窗**匹配:pattern 按 `/` 分段,`*` 是唯一元字符(段内通配,不跨段),整段序列可命中路径**任意
+  位置**(`.ssh` 同时盖住 `~/.ssh/…` 和别处的 `.ssh`);默认 ASCII 大小写**不敏感**,单条 `caseSensitive:true`
+  退出。这些条目**叠在** core 内建 deny 集之上(内建先、追加后,重复折叠),不是替换。
+- **坏形拒启,不静默折默认**:坏 JSON / 非数组 / 缺 `pattern` / 编不过 core 的 `compileReadDeny`
+  一律启动期点名拒——一个手滑的 deny 集比没有 deny 集更糟(以为挡了其实没挡)。
+- **缺席不铸**:两个键不设就**不传给引擎**——引擎抬默认/扩内建集那天,存量部署自动跟上(与重试上限
+  同款「引擎当家」纪律)。
+
 **可选 — MCP 入站表单(elicitation,E23):默认关**
 
 ```bash

package/dist/boot/reapers.js

@@ -17,6 +17,7 @@ import { sweepStaleScratchpads } from "../env-facts.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
 import { createApprovalReconciler } from "../approval-reconciler.js";
+import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
 /** #157 / [2762]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -97,6 +98,17 @@ export function startReapers(ctx) {
             logger.info("reaper_swept", { metric, ...labels, count: n });
         }
     };
+    // #242:E2B 孤儿回收腿的三件座——provider(仅 e2b 部署形 + 旋钮 ON 时铸,一次)、时间节流锚
+    // (初始 -GRACE ⇒ 首 tick 即跑,承担 boot 半场)、重入守卫(list+逐杀可能跨多个 tick;provider RPC
+    // 带 SDK 级 requestTimeoutMs,旗不会因一次挂起永挂)。节流锚刻意用墙钟(codex R3 登记不改):判据
+    // 侧的 GRACE 比对是 E2B startedAt(墙钟)vs Date.now(墙钟)同钟系,节流锚换单调钟只护住「回拨多跑
+    // 一轮 list」这种无害面,却让本文件唯一一处异质钟——不值。锚在**发起时**推进(非成功时):失败轮也
+    // 压满 GRACE 间隔=对 provider 的天然退避;错误可见性由 e2bOrphanGuard 的连败阈值 warn 承担。
+    const e2bOrphanProvider = config.remoteExec?.provider === "e2b" && config.remoteExec.orphanReclaim !== false
+        ? createE2bOrphanSandboxProvider({ apiKey: config.remoteExec.apiKey })
+        : undefined;
+    let e2bOrphanLastRunMs = Date.now() - E2B_ORPHAN_GRACE_MS;
+    let e2bOrphanInFlight = false;
     let wfRunReapInFlight = false; // 1.108 review (lens③): serialize the all-scopes retention sweep across ticks
     let attachmentSweepInFlight = false; // 复审 F1:附件孤儿 sweep 的重入守卫(同上)
     let bgAgentReapInFlight = false; // core 1.364: same serialization for the durable bg-agent joint reap (per-scope serial loop)
@@ -105,6 +117,7 @@ export function startReapers(ctx) {
     // per-tick, so each leg's consecutive-failure streak survives across ticks — see createThrottledReaperCatch).
     const probeClockSkewGuard = createThrottledReaperCatch("probe_clock_skew", logger);
     const runsReapStaleGuard = createThrottledReaperCatch("runs_reap_stale", logger);
+    const e2bOrphanGuard = createThrottledReaperCatch("e2b_orphan_reclaim", logger); // #242
     const checkpointsReapExpiredGuard = createThrottledReaperCatch("checkpoints_reap_expired", logger);
     const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
@@ -483,6 +496,22 @@ export function startReapers(ctx) {
             })
                 .then(() => scratchpadSweepStaleGuard.onSuccess(), scratchpadSweepStaleGuard.onError));
         }
+        // #242(design/242 v1):E2B 孤儿沙盒回收。tick 内**时间节流**到 GRACE 周期(每 tick 打一次
+        // provider list API 是浪费——孤儿的时间尺度是分钟级);首轮在进程起后第一个 tick 就跑(boot 半场,
+        // 不单开 boot 调用点)。判据/边界全在 e2b-orphan-reclaim.ts;这里只管节流+重入+throttled catch。
+        if (e2bOrphanProvider && runStore && Date.now() - e2bOrphanLastRunMs >= E2B_ORPHAN_GRACE_MS && !e2bOrphanInFlight) {
+            e2bOrphanInFlight = true;
+            e2bOrphanLastRunMs = Date.now();
+            leg(reclaimOrphanE2bSandboxes({ provider: e2bOrphanProvider, runs: runStore, logger })
+                .then((s) => {
+                if (s.reclaimed > 0)
+                    metrics.inc("e2b_orphans_reclaimed_total", {}, s.reclaimed);
+            })
+                .then(() => e2bOrphanGuard.onSuccess(), e2bOrphanGuard.onError)
+                .finally(() => {
+                e2bOrphanInFlight = false;
+            }));
+        }
     }, config.reapIntervalSec * 1000);
     reaper.unref?.();
     return reaper;

package/dist/boot/runner-deps.d.ts

@@ -116,7 +116,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "onNotice">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "onNotice">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`

package/dist/boot/runner-deps.js

@@ -84,6 +84,10 @@ export function createSharedRunnerDeps(ctx) {
         // e/b([985]):center catalog 轴的 core 消费面——candidate/pinned-digest 解析走这里(prepare-task
         // dist:session_start 优先 candidate、resume 按 digest 解析、miss=fail-loud prompt_snapshot_unavailable)。
         promptSource: ctx.promptSource,
+        // #246(core 5.30.0):readFace/readDenyPatterns 部署座席——READ 容纳姿态是部署级承重面,主/子
+        // Runner 必须同源同席([1543] 纪律,与 onNotice 同理);缺席=undefined=core 引擎默认(roots+内建表)。
+        readFace: ctx.config.readFace ? ctx.config.readFace : undefined,
+        readDenyPatterns: ctx.config.readDenyPatterns ? ctx.config.readDenyPatterns : undefined,
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
         // core 1.364 durable bg agents 读半场(写半场=scenarioDeps.backgroundAgentStore 同实例,组装区注释)。

package/dist/config-types.d.ts

@@ -359,6 +359,9 @@ export interface ServiceConfigFlat {
         allowInternetAccess?: boolean;
         sandboxEnv?: Record<string, string>;
         mountPath?: string;
+        /** #242:崩溃遗留沙盒回收腿(E2B_ORPHAN_RECLAIM,默认 true;判据与 v1 边界见
+         *  plugins/e2b-orphan-reclaim.ts 头注)。 */
+        orphanReclaim?: boolean;
     } | {
         provider: "k8s";
         image: string;
@@ -1042,6 +1045,15 @@ export interface ServiceConfigFlat {
     /** Task Trace API (S1): persist the agent's reasoning/thinking into the durable run event log (for the CC-style
      *  trace UI). Default ON; `TRACE_THINKING=false` disables capture for sensitive deployments. Redacted on persist. */
     traceThinking: boolean;
+    /** #246(core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不钉死
+     *  上游默认);显式坏词启动期响亮拒。只影响读面,写面永不受它管(core 契约)。 */
+    readFace?: "open" | "roots";
+    /** #246:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
+     *  [{pattern, caseSensitive?}],boot 时用 core `compileReadDeny` 预验——坏形拒启。缺席=不铸。 */
+    readDenyPatterns?: {
+        pattern: string;
+        caseSensitive: boolean;
+    }[];
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
     /** Per-principal request cap per minute on task/run endpoints. 0 disables. */
@@ -1154,7 +1166,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES } from "@sema-agent/core";
+import { compileReadDeny, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -477,6 +477,34 @@ export const hostBackgroundShellEnabled = () => boolEnvWithLegacyNegated("HOST_B
 export const hostExecSpoolEnabled = () => boolEnvWithLegacyNegated("HOST_EXEC_SPOOL_ENABLED", "HOST_EXEC_SPOOL_DISABLED", true);
 /** Enum env with validation: a typo (e.g. SESSION_BACKEND=Tidb) FAILS at startup instead of being silently
  *  cast to the union type and degrading to the default backend (dropping the persistence the operator asked for). */
+/** #246:READ_DENY_PATTERNS 的 env 形=JSON 数组,元素为 `"pattern"` 裸字符串简写或 {pattern, caseSensitive?}
+ *  (与 core `ReadDenyEntry = string | {…}` 词表同宽——合并码扫 C6:USAGE 承诺了简写而 parser 只收对象形,
+ *  批内自相矛盾)。boot 即用 core 的 `compileReadDeny` 预验(引擎同一套规则,宿主不自造第二份校验语义)
+ *  ——JSON 坏形/编不过一律拒启(响亮:安全面追加表静默折默认=静默丢保护,#157 禁令方向)。 */
+function parseReadDenyPatternsEnv(raw) {
+    let arr;
+    try {
+        arr = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new Error(`READ_DENY_PATTERNS is not valid JSON: ${e.message}`);
+    }
+    if (!Array.isArray(arr))
+        throw new Error('READ_DENY_PATTERNS must be a JSON array of "pattern" strings or {pattern, caseSensitive?} objects');
+    const entries = arr.map((it, i) => {
+        if (typeof it === "string")
+            return { pattern: it, caseSensitive: false }; // 裸串简写 ≡ {pattern}(大小写默认不敏感,与对象形缺席 caseSensitive 一致)
+        if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
+            throw new Error(`READ_DENY_PATTERNS[${i}] must be a string or an object with a string 'pattern'`);
+        }
+        const cs = it.caseSensitive;
+        if (cs !== undefined && typeof cs !== "boolean")
+            throw new Error(`READ_DENY_PATTERNS[${i}].caseSensitive must be boolean when present`);
+        return { pattern: it.pattern, caseSensitive: cs === true };
+    });
+    compileReadDeny(entries); // 引擎规则预验;抛错原样上抛=拒启
+    return entries;
+}
 function enumEnv(name, fallback, allowed) {
     const v = (process.env[name] ?? fallback);
     if (!allowed.includes(v))
@@ -765,14 +793,14 @@ function parseModelDomain() {
         // A non-empty value here would override every brain to one URL — breaking failover AND the Anthropic
         // route (it would POST to the vLLM gateway). See design/15.
         baseUrl: "",
-        reasoning: env("MODEL_REASONING", "true") === "true",
+        reasoning: boolEnv("MODEL_REASONING", true), // #245:直读族收编词表(rc.2 登记的 7.17 件)
         // vision precheck: the modality list drives BOTH the `model_no_vision` 422 (main.ts resolveSpec,
         // when body.images hits a text-only model) AND the vision flag on GET /v1/models. The env-lane default model
         // declares vision via MODEL_VISION — DEFAULT "true" keeps the historical image-capable behavior, so set
         // MODEL_VISION=false for a text-only model (e.g. deepseek) to make the precheck actually fire instead of letting
         // images透传 to an opaque downstream-gateway 400. (The centralized config-center lane derives input from its own
         // per-model vision flag — see config-center/facade.ts.)
-        input: env("MODEL_VISION", "true") === "true" ? ["text", "image"] : ["text"],
+        input: boolEnv("MODEL_VISION", true) ? ["text", "image"] : ["text"], // #245
         // Per-1M-token USD pricing (core `modelCostToPricing`: input→inputPer1M, …). Default 0 keeps the
         // historical behavior (spend reads $0) — set MODEL_COST_* on a deploy to make `model_cost_micro_usd`
         // + the Fleet card's costUsd real. Numbers are the gateway's contract price (e.g. the review gateway's
@@ -831,11 +859,8 @@ function parseModelDomain() {
             // AND defeat the precheck (config.models[cheapId] is user-pickable via body.model) — the SAME dead-code-on-a-lane
             // class clay caught on the env main model. MODEL_CHEAP_VISION declares it (strict "true"); UNSET → inherit the
             // main model's input (prior behavior, no change — the documented "same gateway, just a different id" case).
-            input: process.env.MODEL_CHEAP_VISION === undefined
-                ? model.input
-                : process.env.MODEL_CHEAP_VISION === "true"
-                    ? ["text", "image"]
-                    : ["text"],
+            // #245:三态语义不变(缺席/空串 ⇒ 继承主模型),词面收编 parseBoolWord(未知词 boot 拒)。
+            input: ((v) => (v === undefined ? model.input : v ? ["text", "image"] : ["text"]))(parseBoolWord("MODEL_CHEAP_VISION", process.env.MODEL_CHEAP_VISION)),
             // Own pricing: pricing is keyed by model id (budget.buildPricing), so without this the cheap model
             // inherits the MAIN model's `cost` and subagent/summarize spend (council lenses, compaction) is
             // metered at the PRO per-token price → cost metric + per-principal quota over-count. Set
@@ -857,7 +882,7 @@ function parseModelDomain() {
             // wrong when the cheap slot is a different tokenizer family (e.g. CJK-dense deepseek cheap under an
             // anthropic main). MODEL_CHEAP_CHARS_PER_TOKEN overrides; UNSET → inherit main (same knob family).
             ...(optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") !== undefined ? { charsPerToken: optFinitePositiveEnv("MODEL_CHEAP_CHARS_PER_TOKEN") } : {}),
-            reasoning: process.env.MODEL_CHEAP_REASONING === undefined ? model.reasoning : process.env.MODEL_CHEAP_REASONING === "true",
+            reasoning: parseBoolWord("MODEL_CHEAP_REASONING", process.env.MODEL_CHEAP_REASONING) ?? model.reasoning, // #245:三态同上
         }
         : undefined;
     // [818]① 1M dual-window (core 1.289 `Model.autoCompactTokens`, additive): a 1M-window model gets
@@ -932,7 +957,7 @@ function parseModelDomain() {
                 authToken: firstSetEnv("ANTHROPIC_AUTH_TOKEN"),
                 baseUrl: firstSetEnv("ANTHROPIC_BASE_URL"),
                 version: process.env.ANTHROPIC_VERSION,
-                cacheBreakpoints: (process.env.ANTHROPIC_CACHE_BREAKPOINTS ?? "true") === "true",
+                cacheBreakpoints: boolEnv("ANTHROPIC_CACHE_BREAKPOINTS", true), // #245
                 ...(process.env.ANTHROPIC_MAX_RETRIES ? { maxRetries: numEnv("ANTHROPIC_MAX_RETRIES", "2") } : {}), // A1 同族:NaN 会把 SDK 重试面折没
             }
             : undefined,
@@ -1221,7 +1246,9 @@ function parseApprovalDomain(ctx) {
         // boot 期的休眠行审计(`boot/permission-rules-audit.ts`)——对显式开过的部署说「N 条规则随默认 ON
         // 激活」是假话,那些行本来就是活的。判据与 `boolEnv` 认的字面量集**同源**(只有 "true"/"false"
         // 算表态;空串按未设,拼错的值走 boolEnv 的告警臂并落回默认 ⇒ 也不算表态)。
-        permissionRulesEnabledExplicit: ((raw) => raw === "true" || raw === "false")(process.env["PERMISSION_RULES_ENABLED"]),
+        // #245:显式表态判别随词表放宽——八词任一在场即「显式」(旧形只认 true/false 两词,=1 的显式关/开
+        // 会被当「未表态」滑进派生腿,恰是 operator-knob 病的判别位变体);未知词由本体 boolEnv 先拒启。
+        permissionRulesEnabledExplicit: parseBoolWord("PERMISSION_RULES_ENABLED", process.env["PERMISSION_RULES_ENABLED"]) !== undefined,
         // #151 车2(design/172 §3.3 D3):ToolApprovalCoordinator 窗长三元的安全余量。numEnv fail-loud 形,
         // 照邻居旋钮(approvalTimeoutSec 等)抄——坏形（非数字)在启动期炸,不静默折成 NaN。
         streamAskWindowMarginMs: numEnv("STREAM_ASK_WINDOW_MARGIN_MS", "10000"),
@@ -1640,6 +1667,12 @@ function parseOrchestrationDomain(ctx) {
         }
     }
     return {
+        // #246(core 5.30.0):readFace 部署座席。显式设置才铸(缺席让 core 自默认 roots——server 不复制
+        // 上游默认,上游改默认时不产生第二份真源);坏词响亮拒(#210 旋钮坏值纪律)。铸造在本域=组登记
+        // (ORCHESTRATION_GROUP_KEYS)同域——合并码扫 C7:此前误写在 observability 域函数里,条件展开会
+        // 逃过该函数返回型的多余属性检查,分组闭集校验从此看不见这两键。
+        ...(process.env.READ_FACE !== undefined ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]) } : {}),
+        ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
@@ -1664,6 +1697,10 @@ function parseOrchestrationDomain(ctx) {
                 // cwd——改此值前先 drain 挂起中的 e2b 任务,否则 resumed 任务的 exec 落新根而产物在旧根
                 // (根修=core resumeVM 契约带回 WorkspaceHandle.mountPath,已转 core)。
                 ...(process.env.E2B_MOUNT_PATH ? { mountPath: process.env.E2B_MOUNT_PATH } : {}),
+                // #242(design/242 v1):崩溃遗留沙盒回收腿(boot 一次+reaper 周期)。默认 ON——泄漏=真金
+                // 白银,判据已保守化(活行跳过/无行 10min GRACE/拿不准恒不杀);v1 前置=每部署独立 E2B key
+                // (跨部署异库共用一把 key 的形不支持,发车说明成文)。
+                orphanReclaim: boolEnv("E2B_ORPHAN_RECLAIM", true),
             }
             : // Kata pod sandbox on our k3s: image required; auth explicit (K8S_API_URL/K8S_TOKEN) or in-cluster SA.
                 process.env.REMOTE_EXEC === "k8s" && process.env.K8S_SANDBOX_IMAGE
@@ -1974,7 +2011,7 @@ function parseIntegrationsDomain() {
             ? {
                 baseUrl: env("SEMA_REGISTRY_URL"),
                 token: process.env.SEMA_REGISTRY_TOKEN || "",
-                dryRun: process.env.SEMA_REGISTRY_DRY_RUN === "true",
+                dryRun: boolEnv("SEMA_REGISTRY_DRY_RUN", false), // #245
                 worker: process.env.SEMA_REGISTRY_WORKER || undefined,
             }
             : undefined,
@@ -2014,7 +2051,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "rosterRetentionMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
-    "imageBakes",
+    "imageBakes", "readFace", "readDenyPatterns",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",

package/dist/http/active-run-conflict.d.ts

@@ -44,6 +44,11 @@ export interface ActiveRunConflictBody {
     errorCode: "conflict.session_active_run";
     activeTaskId: string | null;
     activeTaskStatus?: string;
+    /** #245 S1([3777]):running 形专属的**活性证据**——本副本 ledger sink 最后一次 durable append 距今
+     *  的毫秒数(「turn 真在推进」的判别材料;与行 updatedAt 的进程心跳语义刻意分离)。**同副本
+     *  best-effort**:缺席 = 无法证明(跨副本/重启后),不是「不活」——诚实缺席,绝不铸 0。消费端
+     *  (cli running 臂,[3779] C3)凭它区分「真忙的后台 run」与「久无进展的疑似僵局」,替代猜测文案。 */
+    msSinceLastActivity?: number;
     pendingGate?: PendingGateMaterial;
 }
 /** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
@@ -100,6 +105,8 @@ export interface ActiveRunConflictDoneResult {
     errorMessage: string;
     activeTaskId: string | null;
     activeTaskStatus?: string;
+    /** #245 S1:与 409 body 同键同语义(见 {@link ActiveRunConflictBody.msSinceLastActivity})。 */
+    msSinceLastActivity?: number;
     pendingGate?: PendingGateMaterial;
 }
 export declare function toDoneFrameResult(body: ActiveRunConflictBody): ActiveRunConflictDoneResult;
@@ -129,6 +136,9 @@ interface ConflictProbeDeps<TToken> {
     } | undefined;
     /** #220:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席 —— 与 best-effort 同方向)。 */
     governance?: GovernancePosture | undefined;
+    /** #245 S1:turn 活性读口(生产装配 = `readTurnActivityMs`,turn-activity.ts)。返回最后活性时刻
+     *  (epoch ms)或 undefined。可选:未装配/读不到 ⇒ `msSinceLastActivity` 键缺席,best-effort 同方向。 */
+    turnActivity?: ((taskId: string) => number | undefined) | undefined;
 }
 export declare function buildActiveRunConflict<TToken>(deps: ConflictProbeDeps<TToken>, sessionId: string, activeTaskId: string | null | undefined): Promise<ActiveRunConflictBody>;
 export {};

package/dist/http/active-run-conflict.js

@@ -89,6 +89,7 @@ export function toDoneFrameResult(body) {
         errorMessage: body.error,
         activeTaskId: body.activeTaskId,
         ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),
+        ...(body.msSinceLastActivity !== undefined ? { msSinceLastActivity: body.msSinceLastActivity } : {}),
         ...(body.pendingGate !== undefined ? { pendingGate: body.pendingGate } : {}),
     };
 }
@@ -109,10 +110,13 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
         if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
             return base;
         if (status === "running") {
+            // #245 S1:活性证据只在 running 形铸(parked 行的状态本身就是证据);读口失败与缺席同路(best-effort)。
+            const lastAt = deps.turnActivity?.(activeTaskId);
             return {
                 ...base,
                 error: "session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)",
                 activeTaskStatus: status,
+                ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
             };
         }
         // parked:找 pending checkpoint 的门型,指到它的那一个 resume 入口

package/dist/http/routes/approvals-assistant.js

@@ -5,6 +5,7 @@ import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
 import { sleep } from "../sse-log.js";
+import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator } from "../principal-gate.js";
 import { governanceOriginOf } from "../active-run-conflict.js";
@@ -777,7 +778,10 @@ governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     // named events). The SSE event name stays for native EventSource addEventListener.
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
     let closed = false;
-    req.on("close", () => { closed = true; });
+    // design/245 件1:req+res 双挂 + 一次性闸(理由全文在 `sse-lifecycle.ts` 顶注)。本腿每连接自跑一条
+    // 打共享 checkpoint 表的轮询(见上方 A-002.19 的定性),旗翻不过来的代价就是这条 DB 轮询对着死
+    // socket 跑满 15 分钟 —— 断连清理在本腿是**负载**问题,不只是收摊问题。
+    bindSseLifecycle(req, res, () => { closed = true; });
     const start = Date.now();
     let lastBeat = Date.now();
     let prev = new Map();

package/dist/http/routes/runs.js

@@ -12,12 +12,14 @@ import { cascadeConfig, runMeta } from "../run-meta.js";
 import { createHash } from "node:crypto";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
+import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { buildActiveRunConflict } from "../active-run-conflict.js";
+import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 // server.ts 侧的 routeLabel / isBillableSubmitPath 仍要用下面这些正则,故本模块导出(方向恒为 server.ts → routes/*)。
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
@@ -294,6 +296,10 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const sessionId = prepared.spec.sessionId ?? uuidv7();
             const taskId = clientTaskId ?? uuidv7();
             const created = await runStore.createRun(taskId, sessionId, prepared.auth?.principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
+            // #245 S1(codex S1-F2):新 run 行落库即清同 taskId 的旧世代活性残留——session purge 后客户端合法
+            // 复用自带 taskId 重提交时,旧记录会被读成「刚有活性」的假证据(map 无 generation 轴,清是唯一诚实解)。
+            if (created.ok)
+                clearTurnActivity(taskId);
             if (created.ok)
                 deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
             if (!created.ok) {
@@ -303,7 +309,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                     return { status: 202, body: { taskId: clientTaskId, sessionId, status: "running" } };
                 }
                 // [2255]① 真出路材料:activeTaskStatus + parked 时 pendingGate{kind,decidePath}(best-effort,失败退旧形)
-                return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config }, sessionId, created.activeTaskId) };
+                return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
             }
             // Durable F4: persist the resume rebuild inputs (sessionId-keyed) so an operator can resume from any
             // replica even after this worker is gone — core's checkpoint blob can't carry service scenario context.
@@ -444,10 +450,14 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 if (Array.isArray(arr))
                     suggestions = arr.map((s) => String(s));
             }
+            // #245 S1:poll 面的活性证据——语义/缺席纪律与 409 body 同键同源(active-run-conflict.ts 顶注)。
+            // 只在**真 running**(非 stale 折叠)时铸:stale 已被折成 failed,再带活性读数是自相矛盾的材料。
+            const lastActivityAt = run.status === "running" && !stale ? readTurnActivityMs(run.taskId) : undefined;
             sendJson(res, 200, {
                 taskId: run.taskId,
                 sessionId: run.sessionId,
                 status: stale ? "failed" : run.status,
+                ...(lastActivityAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastActivityAt) } : {}),
                 result: run.result ?? undefined,
                 supervisorCost,
                 suggestions, // E12: present once the post-completion pass settled (undefined while pending / if none / off)
@@ -1302,8 +1312,11 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         }, 15_000);
         if (typeof hb.unref === "function")
             hb.unref();
-        req.on("close", () => {
+        // design/245 件1:req+res 双挂 + 一次性闸(理由全文在 `sse-lifecycle.ts` 顶注)。本腿的代价最重——
+        // 旗翻不过来时,parked 的 `next()` 会把**总线订阅**一直挂在那里,发布方继续为死对端缓冲。
+        bindSseLifecycle(req, res, () => {
             closed = true;
+            clearInterval(hb); // 与 finally 同一手:`it.return()` 若没能当场解开 parked next(订阅方不配合),定时器不该比连接活得久
             void it.return?.(); // parked next() 不观察 closed 旗——显式 return 解除 park + 清订阅(subscribeWorkflow 同案)
         });
         try {

package/dist/http/routes/tasks.js

@@ -5,6 +5,7 @@ import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTermi
 import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
+import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
@@ -221,6 +222,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (!res.writableEnded)
                     onDisconnect();
             });
+            // 注册后回看(合并码扫 C2,2026-08-13;判据与 src/http/sse-lifecycle.ts:76 同源,理由见其顶注
+            // 「为什么注册完还要回看一眼状态」):本腿的注册点排在 prepareSpec/门族若干 await 之后,Node 的
+            // 'close' 只发一次、后装监听器不补发——那段窗内断掉的连接若不回看,ac 永不 abort,整条 run 对着
+            // 死连接烧完(dropped-relay token burn 正是这套接线存在的原始理由,被自己的注册时序绕过)。
+            // writableEnded 卫兵同上一行:正常收流的 close 不是断连。
+            if ((res.destroyed || res.closed) && !res.writableEnded)
+                onDisconnect();
             // #154 件一:本连接的 `wiring_manifest` 帧投哪一形。判据 = `explicitOperatorOk`(**不是** `isOperator`:
             // 空 `OPERATOR_PRINCIPALS` 必须是「没有人是 operator」;把它读成「所有人都是」会让未配名单的部署把
             // 治理面发给每一个订阅者)。**每连接求一次**、不逐帧求:身份在一条连接内不会变,而逐帧调用会让
@@ -344,10 +352,12 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = earlyDurableTid ?? uuidv7(); // reuse the id already emitted as the X-Task-Id header (defensive mint if absent)
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
+                    if (created.ok)
+                        clearTurnActivity(tid); // #245 S1(codex S1-F2):清同 taskId 旧世代活性残留(runs.ts 同款注)
                     if (created.ok)
                         deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget; in-titler dedupe;model 跟 turn([1992]②)
                     if (!created.ok) {
-                        const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config }, prepared.spec.sessionId, created.activeTaskId); // [2255]① 真出路材料
+                        const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId); // [2255]① 真出路材料
                         // Headers are already SSE — encode the rejection as the stream's terminal event; the 409 in
                         // the returned resp is for a deduplicated concurrent caller (and is never idem-cached).
                         // done 帧 additive 携带同一份材料 —— 形状铸在 toDoneFrameResult(有名字有类型),不在这行内联挑键。
@@ -361,9 +371,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // shell drops the SSE and this abort kills the run, but the mark was only wired on the
                 // cancel-verb/resume legs, so background children reaped by THIS abort read "parent"/"system"
                 // instead of "user". Same registration discipline as runs.ts (FIRST on the signal, before core's
-                // teardown listeners). Owner = sessionId (the sync leg's core-canonical taskId — resolveSpec sets no
-                // spec.taskId, same key as the resume leg); skipSessionScoped inside the helper keeps CC Backgrounded
-                // children unmarked.
+                // teardown listeners). Owner = the leg's core-canonical taskId(`spec.taskId ?? sessionId`——[3806] 起
+                // 本腿设 spec.taskId=durableTaskId,canonical 随之;无 durable 行的部署仍回落 sessionId,codex F4 连带);
+                // skipSessionScoped inside the helper keeps CC Backgrounded children unmarked.
                 //
                 // 🔴 **位置即正确性**(#168 件3,3c codex R3 定性的先存病):这条规则说的是「本请求断连 ⇒ 把
                 // owner=sessionId 的 task-scoped 子代记成人为停止」,而**只有抢到了这条 session 的请求**才有资格
@@ -372,7 +382,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // 一次 DB 往返。认领失败那条路在上面就 return 了 ⇒ 一次都不注册。
                 // 无 durable 账本(无 runStore / 无 sessionId)的部署没有认领这回事,注册点与从前等价。
                 if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(ac.signal, prepared.spec.sessionId, prepared.auth?.principal);
+                    markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 // [900]①/[906]③ detach 车道逐事件落账:sync 腿历史上只 createRun+setTerminal(events 账本恒空,
                 // detach 后壳只能轮询终局)。opt-in 车道把 for-await 的每个事件喂给与 bg 腿(runs.ts)共享的
                 // LedgerSink(src/trace/ledger-sink.ts —— 单一 switch,落账 type/data 形状与 GET /v1/runs/:id/events
@@ -388,17 +398,18 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // never write `failed` over it (bg 腿 `reached` 同款纪律).
                 let ledgerTerminal = false;
                 // model_usage 双腿对齐([1840]§五,W9 同根):detach 账本腿补上 bg 腿的 E8 三件(register /
-                // turn_end delta 落账 / 终局 SUM 进 stats.modelUsage)。归因键=**sessionId**,不是 durableTaskId:
-                // core 的 taskId mint = `spec.taskId ?? sessionId`(dist 亲读 runtask.js:773),本腿 resolveSpec
-                // 不设 spec.taskId ⇒ tracer 的 brain.call e.taskId = sessionId。账本键仍是 durableTaskId(两域
-                // 分家——attach 时 getEvents 按账本键包一层)。非 detach 车道照旧不登记(下方 E8 INTENTIONAL
-                // 排除注释仍准确——那腿无账本消费者);2107 行的「账面差异」清单相应少了 model_usage 一项。
+                // turn_end delta 落账 / 终局 SUM 进 stats.modelUsage)。归因键=**durableTaskId**(codex F4,
+                // 2026-08-13):core 的 taskId mint = `spec.taskId ?? sessionId`,而 [3806] 起本腿把 durableTaskId
+                // 塞进了 spec.taskId ⇒ tracer 的 brain.call e.taskId = durableTaskId——usageKey 若还钉 sessionId,
+                // tracker 的 register-gate 会把整条腿的用量当未注册 no-op(detach 腿 model_usage 帧全丢)。归因键
+                // 与账本键自此同源(此前「两域分家」的分家理由正是 spec.taskId 缺席,随 [3806] 一并消失)。
+                // 非 detach 车道照旧不登记(下方 E8 INTENTIONAL 排除注释仍准确——那腿无账本消费者)。
                 // (usageKey 声明在外层——leak-fence clear 在外层 finally,须覆盖 throw 路径。)
                 if (detachOnDisconnect && durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking });
-                    usageKey = prepared.spec.sessionId;
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: () => recordTurnActivity(tid) });
+                    usageKey = durableTaskId;
                     if (usageKey)
                         deps.modelUsage?.register(usageKey);
                 }
@@ -447,14 +458,14 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 try {
                     fleetPub = durableTaskId
                         // core 1.154 nested-subagent tree: rootTaskId = the run's CANONICAL core taskId (`spec.taskId ?? sessionId`).
-                        // The sync leg does NOT set spec.taskId, so canonical == sessionId — a forwarded subagent whose parentTaskId
-                        // equals it nests under the run; deeper subagents nest under their parent subagent's row.
+                        // [3806] 起本腿设 spec.taskId = durableTaskId ⇒ canonical == durableTaskId(codex F4 连带):rootTaskId
+                        // 若还钉 sessionId,core forward 的子代 parentTaskId(=canonical)嵌不进这棵树——fleet 树上成孤儿行。
                         // 🔒 Scope the fleet row with the SAME identity GET /v1/fleet/stream FILTERS by — `gatedPrincipal`
                         // (crypto-verified on a direct door), NOT the cost-attribution `principal` (= the spoofable header).
                         // On a direct door the two diverge: a spoofed header would tag the row under a victim's scope (cross-
                         // tenant leak) or under "default" while the verified owner's stream filters it OUT (the row vanishes
                         // from its real owner's view). Tenant-isolation parity with the stream filter (TOC review #6).
-                        ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) }) // BC-1: name = short objective preview (description = live-activity, set by the publisher onEvent tool_start)
+                        ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, ...fleetRunLabels(prepared.spec.objective) }) // BC-1: name = short objective preview (description = live-activity, set by the publisher onEvent tool_start)
                         : undefined;
                 }
                 catch (e) {
@@ -641,7 +652,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             // (mid-flight ctrl+b) and, as a natural consequence, steer/compact — now reach a mid-turn
                             // INTERACTIVE run too (previously only the bg + resume legs registered). Deregistered in the
                             // outer finally (with the fleet settle), so an early throw can't leak a stale handle.
-                            const liveStream = prepared.runner.runTaskStream({ ...prepared.spec, signal: ac.signal }, undefined, fwdInternals); // #196:场景 hands 判别位选出的 Runner
+                            const liveStream = prepared.runner.runTaskStream({ ...prepared.spec, signal: ac.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) }, undefined, fwdInternals); // [3806]:tid 必须进 spec.taskId——缺席时 core 按 sessionId fallback 喂 noteTaskRun,lastRunId 投影被污染(bg 腿一直有传,两腿对称) // #196:场景 hands 判别位选出的 Runner
                             liveStreamRef = liveStream;
                             if (durableTaskId)
                                 steerableRuns.set(durableTaskId, liveStream);
@@ -684,8 +695,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     // finalize/settleFleet/res.write/setTerminal 顺序不动(落账是旁路)。
                                     if (ledgerSink && finalResult) {
                                         // E8 双腿对齐:终局 flush 最后一拍 delta + SUM 全账本 model_usage 进 stats.modelUsage
-                                        // (bg 腿 withModelUsage 同形)。⚠️ 键两域分家:drain 键=usageKey(sessionId,core 归因),
-                                        // 账本读键=durableTaskId——attachModelUsage 的 taskId 双用途在此不成立,getEvents 包一层。
+                                        // (bg 腿 withModelUsage 同形)。键自 codex F4 修后同源:usageKey=durableTaskId=账本键
+                                        // (getEvents 包一层保留——按变量各取所需,同值不同职,防未来再分家时又要拆)。
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;
                                             const tid2 = durableTaskId;
@@ -1264,8 +1275,10 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = uuidv7();
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
+                    if (created.ok)
+                        clearTurnActivity(tid); // #245 S1(codex S1-F2):清同 taskId 旧世代活性残留(runs.ts 同款注)
                     if (!created.ok)
-                        return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config }, prepared.spec.sessionId, created.activeTaskId) }; // [2255]① 真出路材料
+                        return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) }; // [2255]① 真出路材料
                     deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
                     durableTaskId = tid;
                 }
@@ -1280,7 +1293,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // with the stream leg's disconnect marker).
                 const syncCancelCtrl = new AbortController();
                 if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, prepared.spec.sessionId, prepared.auth?.principal);
+                    markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal); // owner=canonical taskId([3806] 后=durableTaskId;codex F4 连带,流式腿同修
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
@@ -1307,7 +1320,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 else if (durableTaskId) {
                     inflightRuns.set(durableTaskId, syncCancelCtrl);
                 }
-                const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal };
+                const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) }; // [3806]:同流式腿——tid 进 spec.taskId,否则 core fallback sessionId 污染 lastRunId
                 // Developer mode (1.44): verify = adversarial verify→fix gate. Cascade (1.45): cheap→strong ladder,
                 // escalate on a failed gate (default = didn't complete). Both opt-in, mutually exclusive, multi-attempt.
                 let result;