@sema-agent/server 7.17.0 → 7.18.1

package/USAGE.md

@@ -333,11 +333,39 @@ STREAM_APPROVAL_ORPHAN_TTL_MS=604800000
   `STREAM_APPROVAL_ORPHAN_TTL_MS`,否则**拒启**并点名。理由是归因诚实:adhoc 判据在
   `(创建 + 窗 + 宽限)` 触发、遗孤兜底在 `(创建 + TTL)` 触发,兜底若先到,每条 adhoc 腿都会被记成
   `orphan_ttl_exceeded`(「遗孤」)而不是 `adhoc_leg_no_durable_domain`(「结构上无对账域」),审计面从此读不出真成因。
+- **断连时活卡怎么办(#245/[3777] 成文)**:客户端**优雅断开**(server 收到 socket close)时,流内未决 ask
+  立即强转 durable park(7.16.0 #241),恢复后 attach 重放会重呈卡。客户端**网络中断**(TCP half-open,
+  server 侧 close 事件不触发)是已知盲窗:SSE heartbeat 帧只会堆进 TCP 重传队列,server 要等 OS 级重传
+  耗尽(十几分钟量级)才感知——这段时间内真正的兜底是**活卡窗到期转 park**(`STREAM_ASK_WINDOW_MS`,
+  默认 5min),所以把窗改大等于把断连场景的最坏无人区拉长,改小前先看上面的跨旋钮不变量。half-open 的
+  主动探测(写水位判死)在攻关排期([3777] S2)。
+- **无 durable 前置的部署(五合取不满足:local backend / 无 checkpoint 能力)**:流内协议整个不上场
+  (启动一行 `stream_approval_disabled` 点名缺哪项),ask 走旧活卡腿——断连场景的最坏结局是活卡 TTL
+  窗满**自动 deny(fail-closed)后 run 继续**,不会死锁在等一张没人能回的卡上;代价是断连期间用户的
+  批准机会直接过期。要「断连也不丢决策」的语义,配齐 durable 前置(持久 store + `DURABLE_APPROVAL=true`)。
   默认值(300s + 60s vs 7d)自然满足,只有显式改坏才会撞上。
 - **调参方向**:想让人有更长时间点审批卡 → 调大 `STREAM_ASK_WINDOW_MS`;卡太多刷屏 → 调小两个 `ADMIT_MAX_*`
   (代价是超限的 ask 走 park,要有人去审批队列捞);库压大 → 调小 `STREAM_APPROVAL_RECONCILE_BATCH`
   (代价是收敛变慢,靠队列轮转保证下轮接着扫)。
 
+**可选 — READ 面姿态(readFace,7.18.0 起;缺席=引擎当家)**
+
+```bash
+READ_FACE=open                       # 词表 open|roots;坏词启动期响亮拒。不设=不传给引擎(引擎默认 roots)
+READ_DENY_PATTERNS='[{"pattern":"**/secrets/**"},{"pattern":".ssh","caseSensitive":true}]'
+```
+- **`READ_FACE`**:READ 工具面(读文件/遍历/搜索)的部署级姿态。引擎默认 **`roots`** = 读被夹在任务的
+  workspace roots 里;`open` = 部署显式放开(单用户自托管、要读全盘配置那种形)。任务层只能**收紧**
+  (spec 的 `readFace:"roots"`),放开只有这一个部署座席——层级方向与写门一致(部署默认压不过承重墙)。
+- **`READ_DENY_PATTERNS`**:JSON 数组,元素 `"pattern"` 或 `{pattern, caseSensitive?}`。语义是
+  **路径段窗**匹配:pattern 按 `/` 分段,`*` 是唯一元字符(段内通配,不跨段),整段序列可命中路径**任意
+  位置**(`.ssh` 同时盖住 `~/.ssh/…` 和别处的 `.ssh`);默认 ASCII 大小写**不敏感**,单条 `caseSensitive:true`
+  退出。这些条目**叠在** core 内建 deny 集之上(内建先、追加后,重复折叠),不是替换。
+- **坏形拒启,不静默折默认**:坏 JSON / 非数组 / 缺 `pattern` / 编不过 core 的 `compileReadDeny`
+  一律启动期点名拒——一个手滑的 deny 集比没有 deny 集更糟(以为挡了其实没挡)。
+- **缺席不铸**:两个键不设就**不传给引擎**——引擎抬默认/扩内建集那天,存量部署自动跟上(与重试上限
+  同款「引擎当家」纪律)。
+
 **可选 — MCP 入站表单(elicitation,E23):默认关**
 
 ```bash

package/dist/boot/runner-deps.d.ts

@@ -116,7 +116,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "onNotice">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "onNotice">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`

package/dist/boot/runner-deps.js

@@ -84,6 +84,10 @@ export function createSharedRunnerDeps(ctx) {
         // e/b([985]):center catalog 轴的 core 消费面——candidate/pinned-digest 解析走这里(prepare-task
         // dist:session_start 优先 candidate、resume 按 digest 解析、miss=fail-loud prompt_snapshot_unavailable)。
         promptSource: ctx.promptSource,
+        // #246(core 5.30.0):readFace/readDenyPatterns 部署座席——READ 容纳姿态是部署级承重面,主/子
+        // Runner 必须同源同席([1543] 纪律,与 onNotice 同理);缺席=undefined=core 引擎默认(roots+内建表)。
+        readFace: ctx.config.readFace ? ctx.config.readFace : undefined,
+        readDenyPatterns: ctx.config.readDenyPatterns ? ctx.config.readDenyPatterns : undefined,
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
         // core 1.364 durable bg agents 读半场(写半场=scenarioDeps.backgroundAgentStore 同实例,组装区注释)。

package/dist/config-types.d.ts

@@ -1045,6 +1045,15 @@ export interface ServiceConfigFlat {
     /** Task Trace API (S1): persist the agent's reasoning/thinking into the durable run event log (for the CC-style
      *  trace UI). Default ON; `TRACE_THINKING=false` disables capture for sensitive deployments. Redacted on persist. */
     traceThinking: boolean;
+    /** #246(core 5.30.0 readFace 部署座席):READ 容纳面。缺席=不铸(core 引擎默认 roots,server 不钉死
+     *  上游默认);显式坏词启动期响亮拒。只影响读面,写面永不受它管(core 契约)。 */
+    readFace?: "open" | "roots";
+    /** #246:部署级 READ deny 追加表(additive-only,core 内建表永不可缩)。env=JSON 数组
+     *  [{pattern, caseSensitive?}],boot 时用 core `compileReadDeny` 预验——坏形拒启。缺席=不铸。 */
+    readDenyPatterns?: {
+        pattern: string;
+        caseSensitive: boolean;
+    }[];
     /** Structured log level. */
     logLevel: "debug" | "info" | "warn" | "error";
     /** Per-principal request cap per minute on task/run endpoints. 0 disables. */
@@ -1157,7 +1166,7 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  函数不产出它,但它与 `autonomy` 是同一根治理棒的两半,归本组。 */
 export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "operatorPrincipals" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
-export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes">;
+export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "remoteExec" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "rosterRetentionMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sessionAutoTitle" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "imageBakes" | "readFace" | "readDenyPatterns">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
 export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "sighupIdleGraceMs" | "parentPid" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */

package/dist/config.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES } from "@sema-agent/core";
+import { compileReadDeny, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js"; // design/158 A4: the parser leaf — NOT security.js (base config layer must not value-import the 55KiB auth module)
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -477,6 +477,34 @@ export const hostBackgroundShellEnabled = () => boolEnvWithLegacyNegated("HOST_B
 export const hostExecSpoolEnabled = () => boolEnvWithLegacyNegated("HOST_EXEC_SPOOL_ENABLED", "HOST_EXEC_SPOOL_DISABLED", true);
 /** Enum env with validation: a typo (e.g. SESSION_BACKEND=Tidb) FAILS at startup instead of being silently
  *  cast to the union type and degrading to the default backend (dropping the persistence the operator asked for). */
+/** #246:READ_DENY_PATTERNS 的 env 形=JSON 数组,元素为 `"pattern"` 裸字符串简写或 {pattern, caseSensitive?}
+ *  (与 core `ReadDenyEntry = string | {…}` 词表同宽——合并码扫 C6:USAGE 承诺了简写而 parser 只收对象形,
+ *  批内自相矛盾)。boot 即用 core 的 `compileReadDeny` 预验(引擎同一套规则,宿主不自造第二份校验语义)
+ *  ——JSON 坏形/编不过一律拒启(响亮:安全面追加表静默折默认=静默丢保护,#157 禁令方向)。 */
+function parseReadDenyPatternsEnv(raw) {
+    let arr;
+    try {
+        arr = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new Error(`READ_DENY_PATTERNS is not valid JSON: ${e.message}`);
+    }
+    if (!Array.isArray(arr))
+        throw new Error('READ_DENY_PATTERNS must be a JSON array of "pattern" strings or {pattern, caseSensitive?} objects');
+    const entries = arr.map((it, i) => {
+        if (typeof it === "string")
+            return { pattern: it, caseSensitive: false }; // 裸串简写 ≡ {pattern}(大小写默认不敏感,与对象形缺席 caseSensitive 一致)
+        if (typeof it !== "object" || it === null || typeof it.pattern !== "string") {
+            throw new Error(`READ_DENY_PATTERNS[${i}] must be a string or an object with a string 'pattern'`);
+        }
+        const cs = it.caseSensitive;
+        if (cs !== undefined && typeof cs !== "boolean")
+            throw new Error(`READ_DENY_PATTERNS[${i}].caseSensitive must be boolean when present`);
+        return { pattern: it.pattern, caseSensitive: cs === true };
+    });
+    compileReadDeny(entries); // 引擎规则预验;抛错原样上抛=拒启
+    return entries;
+}
 function enumEnv(name, fallback, allowed) {
     const v = (process.env[name] ?? fallback);
     if (!allowed.includes(v))
@@ -1639,6 +1667,12 @@ function parseOrchestrationDomain(ctx) {
         }
     }
     return {
+        // #246(core 5.30.0):readFace 部署座席。显式设置才铸(缺席让 core 自默认 roots——server 不复制
+        // 上游默认,上游改默认时不产生第二份真源);坏词响亮拒(#210 旋钮坏值纪律)。铸造在本域=组登记
+        // (ORCHESTRATION_GROUP_KEYS)同域——合并码扫 C7:此前误写在 observability 域函数里,条件展开会
+        // 逃过该函数返回型的多余属性检查,分组闭集校验从此看不见这两键。
+        ...(process.env.READ_FACE !== undefined ? { readFace: enumEnv("READ_FACE", "roots", ["open", "roots"]) } : {}),
+        ...(process.env.READ_DENY_PATTERNS !== undefined ? { readDenyPatterns: parseReadDenyPatternsEnv(process.env.READ_DENY_PATTERNS) } : {}),
         remoteExec: process.env.REMOTE_EXEC === "e2b" && process.env.E2B_API_KEY
             ? {
                 provider: "e2b",
@@ -2017,7 +2051,7 @@ const ORCHESTRATION_GROUP_KEYS = [
     "workflowSizeGuideline", "backgroundAgentRetentionMs", "backgroundAgentStaleRunningMs",
     "backgroundAgentParkClaimStaleMs", "rosterRetentionMs", "scratchpadSweepTtlMs", "sandboxPkgSource",
     "sessionAutoTitle", "selectEnvironmentTool", "envFactsEnabled", "toolDeferLongtail", "lspEnabled", "lspHostEnabled",
-    "imageBakes",
+    "imageBakes", "readFace", "readDenyPatterns",
 ];
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",

package/dist/http/active-run-conflict.d.ts

@@ -44,6 +44,11 @@ export interface ActiveRunConflictBody {
     errorCode: "conflict.session_active_run";
     activeTaskId: string | null;
     activeTaskStatus?: string;
+    /** #245 S1([3777]):running 形专属的**活性证据**——本副本 ledger sink 最后一次 durable append 距今
+     *  的毫秒数(「turn 真在推进」的判别材料;与行 updatedAt 的进程心跳语义刻意分离)。**同副本
+     *  best-effort**:缺席 = 无法证明(跨副本/重启后),不是「不活」——诚实缺席,绝不铸 0。消费端
+     *  (cli running 臂,[3779] C3)凭它区分「真忙的后台 run」与「久无进展的疑似僵局」,替代猜测文案。 */
+    msSinceLastActivity?: number;
     pendingGate?: PendingGateMaterial;
 }
 /** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
@@ -100,6 +105,8 @@ export interface ActiveRunConflictDoneResult {
     errorMessage: string;
     activeTaskId: string | null;
     activeTaskStatus?: string;
+    /** #245 S1:与 409 body 同键同语义(见 {@link ActiveRunConflictBody.msSinceLastActivity})。 */
+    msSinceLastActivity?: number;
     pendingGate?: PendingGateMaterial;
 }
 export declare function toDoneFrameResult(body: ActiveRunConflictBody): ActiveRunConflictDoneResult;
@@ -129,6 +136,9 @@ interface ConflictProbeDeps<TToken> {
     } | undefined;
     /** #220:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席 —— 与 best-effort 同方向)。 */
     governance?: GovernancePosture | undefined;
+    /** #245 S1:turn 活性读口(生产装配 = `readTurnActivityMs`,turn-activity.ts)。返回最后活性时刻
+     *  (epoch ms)或 undefined。可选:未装配/读不到 ⇒ `msSinceLastActivity` 键缺席,best-effort 同方向。 */
+    turnActivity?: ((taskId: string) => number | undefined) | undefined;
 }
 export declare function buildActiveRunConflict<TToken>(deps: ConflictProbeDeps<TToken>, sessionId: string, activeTaskId: string | null | undefined): Promise<ActiveRunConflictBody>;
 export {};

package/dist/http/active-run-conflict.js

@@ -89,6 +89,7 @@ export function toDoneFrameResult(body) {
         errorMessage: body.error,
         activeTaskId: body.activeTaskId,
         ...(body.activeTaskStatus !== undefined ? { activeTaskStatus: body.activeTaskStatus } : {}),
+        ...(body.msSinceLastActivity !== undefined ? { msSinceLastActivity: body.msSinceLastActivity } : {}),
         ...(body.pendingGate !== undefined ? { pendingGate: body.pendingGate } : {}),
     };
 }
@@ -109,10 +110,13 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
         if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
             return base;
         if (status === "running") {
+            // #245 S1:活性证据只在 running 形铸(parked 行的状态本身就是证据);读口失败与缺席同路(best-effort)。
+            const lastAt = deps.turnActivity?.(activeTaskId);
             return {
                 ...base,
                 error: "session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)",
                 activeTaskStatus: status,
+                ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
             };
         }
         // parked:找 pending checkpoint 的门型,指到它的那一个 resume 入口

package/dist/http/route-ctx.d.ts

@@ -109,6 +109,15 @@ export interface DriveResumeArgs {
      *  ask sees them — the decide leg's exemption grant). Contract: must not throw (callers swallow internally);
      *  awaited so the ordering guarantee is real, and a store write here is ms-scale vs the model leg. */
     onResumeCommitted?: () => Promise<void>;
+    /** [3829]/[3830]:调用方声明「本腿的 park 是终局后纯 park,session claim 已随终局 finalize 删除」——
+     *  getActiveTaskId 缺席时**铸新 canonical taskId + createRun 全生命周期行**(wake 续跑=同 session 新一轮
+     *  turn),而不是无行裸跑(不可取消/无计费归因/无 durable append/fleet 不可见,且 core `spec.taskId ??
+     *  sessionId` fallback 会把 lastRunId 铸成 sessionId)。`source` 进 run 行元数据(runMeta 同列)。
+     *  decide/answer/plan_review 腿**不设**此位:它们的 claim 在 park 期间特意保留,缺席=行被 reap 的竞态,
+     *  维持既有兜底(checkpoint token 同拍过期 ⇒ resumeStream 拒),不铸新行。 */
+    mintFreshRun?: {
+        source: string;
+    };
 }
 /** 提交/续跑「腿」= 跨域共享的**有状态**长流程(不像 {@link RouteHelpers} 那样只依赖 deps/config:它们要写
  *  run log、发 fleet 帧、走 markResuming CAS、驱动模型)。A9 上批的停点就在这里——tasks/runs 两域共用

package/dist/http/routes/approvals-assistant.js

@@ -5,6 +5,7 @@ import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行展示名与 fleet 行同源(见用处的注)
 import { sleep } from "../sse-log.js";
+import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator } from "../principal-gate.js";
 import { governanceOriginOf } from "../active-run-conflict.js";
@@ -777,7 +778,10 @@ governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     // named events). The SSE event name stays for native EventSource addEventListener.
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
     let closed = false;
-    req.on("close", () => { closed = true; });
+    // design/245 件1:req+res 双挂 + 一次性闸(理由全文在 `sse-lifecycle.ts` 顶注)。本腿每连接自跑一条
+    // 打共享 checkpoint 表的轮询(见上方 A-002.19 的定性),旗翻不过来的代价就是这条 DB 轮询对着死
+    // socket 跑满 15 分钟 —— 断连清理在本腿是**负载**问题,不只是收摊问题。
+    bindSseLifecycle(req, res, () => { closed = true; });
     const start = Date.now();
     let lastBeat = Date.now();
     let prev = new Map();

package/dist/http/routes/runs.js

@@ -12,12 +12,14 @@ import { cascadeConfig, runMeta } from "../run-meta.js";
 import { createHash } from "node:crypto";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { streamSseLog } from "../sse-log.js";
+import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
 import { resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS } from "../../approval-ask-machine.js";
 import { normalizeRunEventType } from "../../trace/project.js";
 import { sendJson, sendError, httpErrorCode, sseHeaders } from "../send.js";
 import { buildActiveRunConflict } from "../active-run-conflict.js";
+import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
 // server.ts 侧的 routeLabel / isBillableSubmitPath 仍要用下面这些正则,故本模块导出(方向恒为 server.ts → routes/*)。
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
@@ -294,6 +296,10 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const sessionId = prepared.spec.sessionId ?? uuidv7();
             const taskId = clientTaskId ?? uuidv7();
             const created = await runStore.createRun(taskId, sessionId, prepared.auth?.principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
+            // #245 S1(codex S1-F2):新 run 行落库即清同 taskId 的旧世代活性残留——session purge 后客户端合法
+            // 复用自带 taskId 重提交时,旧记录会被读成「刚有活性」的假证据(map 无 generation 轴,清是唯一诚实解)。
+            if (created.ok)
+                clearTurnActivity(taskId);
             if (created.ok)
                 deps.sessionTitler?.maybeTitle(sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
             if (!created.ok) {
@@ -303,7 +309,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                     return { status: 202, body: { taskId: clientTaskId, sessionId, status: "running" } };
                 }
                 // [2255]① 真出路材料:activeTaskStatus + parked 时 pendingGate{kind,decidePath}(best-effort,失败退旧形)
-                return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config }, sessionId, created.activeTaskId) };
+                return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
             }
             // Durable F4: persist the resume rebuild inputs (sessionId-keyed) so an operator can resume from any
             // replica even after this worker is gone — core's checkpoint blob can't carry service scenario context.
@@ -444,10 +450,14 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 if (Array.isArray(arr))
                     suggestions = arr.map((s) => String(s));
             }
+            // #245 S1:poll 面的活性证据——语义/缺席纪律与 409 body 同键同源(active-run-conflict.ts 顶注)。
+            // 只在**真 running**(非 stale 折叠)时铸:stale 已被折成 failed,再带活性读数是自相矛盾的材料。
+            const lastActivityAt = run.status === "running" && !stale ? readTurnActivityMs(run.taskId) : undefined;
             sendJson(res, 200, {
                 taskId: run.taskId,
                 sessionId: run.sessionId,
                 status: stale ? "failed" : run.status,
+                ...(lastActivityAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastActivityAt) } : {}),
                 result: run.result ?? undefined,
                 supervisorCost,
                 suggestions, // E12: present once the post-completion pass settled (undefined while pending / if none / off)
@@ -1302,8 +1312,11 @@ async function handleRunVerbsBody(req, res, url, ctx, miss) {
         }, 15_000);
         if (typeof hb.unref === "function")
             hb.unref();
-        req.on("close", () => {
+        // design/245 件1:req+res 双挂 + 一次性闸(理由全文在 `sse-lifecycle.ts` 顶注)。本腿的代价最重——
+        // 旗翻不过来时,parked 的 `next()` 会把**总线订阅**一直挂在那里,发布方继续为死对端缓冲。
+        bindSseLifecycle(req, res, () => {
             closed = true;
+            clearInterval(hb); // 与 finally 同一手:`it.return()` 若没能当场解开 parked next(订阅方不配合),定时器不该比连接活得久
             void it.return?.(); // parked next() 不观察 closed 旗——显式 return 解除 park + 清订阅(subscribeWorkflow 同案)
         });
         try {

package/dist/http/routes/tasks.js

@@ -5,6 +5,7 @@ import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTermi
 import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
 import { createLedgerSink } from "../../trace/ledger-sink.js";
+import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../../turn-activity.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
@@ -221,6 +222,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (!res.writableEnded)
                     onDisconnect();
             });
+            // 注册后回看(合并码扫 C2,2026-08-13;判据与 src/http/sse-lifecycle.ts:76 同源,理由见其顶注
+            // 「为什么注册完还要回看一眼状态」):本腿的注册点排在 prepareSpec/门族若干 await 之后,Node 的
+            // 'close' 只发一次、后装监听器不补发——那段窗内断掉的连接若不回看,ac 永不 abort,整条 run 对着
+            // 死连接烧完(dropped-relay token burn 正是这套接线存在的原始理由,被自己的注册时序绕过)。
+            // writableEnded 卫兵同上一行:正常收流的 close 不是断连。
+            if ((res.destroyed || res.closed) && !res.writableEnded)
+                onDisconnect();
             // #154 件一:本连接的 `wiring_manifest` 帧投哪一形。判据 = `explicitOperatorOk`(**不是** `isOperator`:
             // 空 `OPERATOR_PRINCIPALS` 必须是「没有人是 operator」;把它读成「所有人都是」会让未配名单的部署把
             // 治理面发给每一个订阅者)。**每连接求一次**、不逐帧求:身份在一条连接内不会变,而逐帧调用会让
@@ -344,10 +352,12 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = earlyDurableTid ?? uuidv7(); // reuse the id already emitted as the X-Task-Id header (defensive mint if absent)
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
+                    if (created.ok)
+                        clearTurnActivity(tid); // #245 S1(codex S1-F2):清同 taskId 旧世代活性残留(runs.ts 同款注)
                     if (created.ok)
                         deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget; in-titler dedupe;model 跟 turn([1992]②)
                     if (!created.ok) {
-                        const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config }, prepared.spec.sessionId, created.activeTaskId); // [2255]① 真出路材料
+                        const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId); // [2255]① 真出路材料
                         // Headers are already SSE — encode the rejection as the stream's terminal event; the 409 in
                         // the returned resp is for a deduplicated concurrent caller (and is never idem-cached).
                         // done 帧 additive 携带同一份材料 —— 形状铸在 toDoneFrameResult(有名字有类型),不在这行内联挑键。
@@ -361,9 +371,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // shell drops the SSE and this abort kills the run, but the mark was only wired on the
                 // cancel-verb/resume legs, so background children reaped by THIS abort read "parent"/"system"
                 // instead of "user". Same registration discipline as runs.ts (FIRST on the signal, before core's
-                // teardown listeners). Owner = sessionId (the sync leg's core-canonical taskId — resolveSpec sets no
-                // spec.taskId, same key as the resume leg); skipSessionScoped inside the helper keeps CC Backgrounded
-                // children unmarked.
+                // teardown listeners). Owner = the leg's core-canonical taskId(`spec.taskId ?? sessionId`——[3806] 起
+                // 本腿设 spec.taskId=durableTaskId,canonical 随之;无 durable 行的部署仍回落 sessionId,codex F4 连带);
+                // skipSessionScoped inside the helper keeps CC Backgrounded children unmarked.
                 //
                 // 🔴 **位置即正确性**(#168 件3,3c codex R3 定性的先存病):这条规则说的是「本请求断连 ⇒ 把
                 // owner=sessionId 的 task-scoped 子代记成人为停止」,而**只有抢到了这条 session 的请求**才有资格
@@ -372,7 +382,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // 一次 DB 往返。认领失败那条路在上面就 return 了 ⇒ 一次都不注册。
                 // 无 durable 账本(无 runStore / 无 sessionId)的部署没有认领这回事,注册点与从前等价。
                 if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(ac.signal, prepared.spec.sessionId, prepared.auth?.principal);
+                    markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                 // [900]①/[906]③ detach 车道逐事件落账:sync 腿历史上只 createRun+setTerminal(events 账本恒空,
                 // detach 后壳只能轮询终局)。opt-in 车道把 for-await 的每个事件喂给与 bg 腿(runs.ts)共享的
                 // LedgerSink(src/trace/ledger-sink.ts —— 单一 switch,落账 type/data 形状与 GET /v1/runs/:id/events
@@ -388,17 +398,18 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // never write `failed` over it (bg 腿 `reached` 同款纪律).
                 let ledgerTerminal = false;
                 // model_usage 双腿对齐([1840]§五,W9 同根):detach 账本腿补上 bg 腿的 E8 三件(register /
-                // turn_end delta 落账 / 终局 SUM 进 stats.modelUsage)。归因键=**sessionId**,不是 durableTaskId:
-                // core 的 taskId mint = `spec.taskId ?? sessionId`(dist 亲读 runtask.js:773),本腿 resolveSpec
-                // 不设 spec.taskId ⇒ tracer 的 brain.call e.taskId = sessionId。账本键仍是 durableTaskId(两域
-                // 分家——attach 时 getEvents 按账本键包一层)。非 detach 车道照旧不登记(下方 E8 INTENTIONAL
-                // 排除注释仍准确——那腿无账本消费者);2107 行的「账面差异」清单相应少了 model_usage 一项。
+                // turn_end delta 落账 / 终局 SUM 进 stats.modelUsage)。归因键=**durableTaskId**(codex F4,
+                // 2026-08-13):core 的 taskId mint = `spec.taskId ?? sessionId`,而 [3806] 起本腿把 durableTaskId
+                // 塞进了 spec.taskId ⇒ tracer 的 brain.call e.taskId = durableTaskId——usageKey 若还钉 sessionId,
+                // tracker 的 register-gate 会把整条腿的用量当未注册 no-op(detach 腿 model_usage 帧全丢)。归因键
+                // 与账本键自此同源(此前「两域分家」的分家理由正是 spec.taskId 缺席,随 [3806] 一并消失)。
+                // 非 detach 车道照旧不登记(下方 E8 INTENTIONAL 排除注释仍准确——那腿无账本消费者)。
                 // (usageKey 声明在外层——leak-fence clear 在外层 finally,须覆盖 throw 路径。)
                 if (detachOnDisconnect && durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking });
-                    usageKey = prepared.spec.sessionId;
+                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: () => recordTurnActivity(tid) });
+                    usageKey = durableTaskId;
                     if (usageKey)
                         deps.modelUsage?.register(usageKey);
                 }
@@ -447,14 +458,14 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 try {
                     fleetPub = durableTaskId
                         // core 1.154 nested-subagent tree: rootTaskId = the run's CANONICAL core taskId (`spec.taskId ?? sessionId`).
-                        // The sync leg does NOT set spec.taskId, so canonical == sessionId — a forwarded subagent whose parentTaskId
-                        // equals it nests under the run; deeper subagents nest under their parent subagent's row.
+                        // [3806] 起本腿设 spec.taskId = durableTaskId ⇒ canonical == durableTaskId(codex F4 连带):rootTaskId
+                        // 若还钉 sessionId,core forward 的子代 parentTaskId(=canonical)嵌不进这棵树——fleet 树上成孤儿行。
                         // 🔒 Scope the fleet row with the SAME identity GET /v1/fleet/stream FILTERS by — `gatedPrincipal`
                         // (crypto-verified on a direct door), NOT the cost-attribution `principal` (= the spoofable header).
                         // On a direct door the two diverge: a spoofed header would tag the row under a victim's scope (cross-
                         // tenant leak) or under "default" while the verified owner's stream filters it OUT (the row vanishes
                         // from its real owner's view). Tenant-isolation parity with the stream filter (TOC review #6).
-                        ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) }) // BC-1: name = short objective preview (description = live-activity, set by the publisher onEvent tool_start)
+                        ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, ...fleetRunLabels(prepared.spec.objective) }) // BC-1: name = short objective preview (description = live-activity, set by the publisher onEvent tool_start)
                         : undefined;
                 }
                 catch (e) {
@@ -641,7 +652,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                             // (mid-flight ctrl+b) and, as a natural consequence, steer/compact — now reach a mid-turn
                             // INTERACTIVE run too (previously only the bg + resume legs registered). Deregistered in the
                             // outer finally (with the fleet settle), so an early throw can't leak a stale handle.
-                            const liveStream = prepared.runner.runTaskStream({ ...prepared.spec, signal: ac.signal }, undefined, fwdInternals); // #196:场景 hands 判别位选出的 Runner
+                            const liveStream = prepared.runner.runTaskStream({ ...prepared.spec, signal: ac.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) }, undefined, fwdInternals); // [3806]:tid 必须进 spec.taskId——缺席时 core 按 sessionId fallback 喂 noteTaskRun,lastRunId 投影被污染(bg 腿一直有传,两腿对称) // #196:场景 hands 判别位选出的 Runner
                             liveStreamRef = liveStream;
                             if (durableTaskId)
                                 steerableRuns.set(durableTaskId, liveStream);
@@ -684,8 +695,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     // finalize/settleFleet/res.write/setTerminal 顺序不动(落账是旁路)。
                                     if (ledgerSink && finalResult) {
                                         // E8 双腿对齐:终局 flush 最后一拍 delta + SUM 全账本 model_usage 进 stats.modelUsage
-                                        // (bg 腿 withModelUsage 同形)。⚠️ 键两域分家:drain 键=usageKey(sessionId,core 归因),
-                                        // 账本读键=durableTaskId——attachModelUsage 的 taskId 双用途在此不成立,getEvents 包一层。
+                                        // (bg 腿 withModelUsage 同形)。键自 codex F4 修后同源:usageKey=durableTaskId=账本键
+                                        // (getEvents 包一层保留——按变量各取所需,同值不同职,防未来再分家时又要拆)。
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;
                                             const tid2 = durableTaskId;
@@ -1264,8 +1275,10 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 if (deps.runStore && prepared.spec.sessionId) {
                     const tid = uuidv7();
                     const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", runMeta(prepared, source));
+                    if (created.ok)
+                        clearTurnActivity(tid); // #245 S1(codex S1-F2):清同 taskId 旧世代活性残留(runs.ts 同款注)
                     if (!created.ok)
-                        return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config }, prepared.spec.sessionId, created.activeTaskId) }; // [2255]① 真出路材料
+                        return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) }; // [2255]① 真出路材料
                     deps.sessionTitler?.maybeTitle(prepared.spec.sessionId, prepared.spec.objective, typeof prepared.spec.model === "string" ? prepared.spec.model : prepared.spec.model?.id); // fire-and-forget;model 跟 turn([1992]②)
                     durableTaskId = tid;
                 }
@@ -1280,7 +1293,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 // with the stream leg's disconnect marker).
                 const syncCancelCtrl = new AbortController();
                 if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, prepared.spec.sessionId, prepared.auth?.principal);
+                    markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal); // owner=canonical taskId([3806] 后=durableTaskId;codex F4 连带,流式腿同修
                 if (durableTaskId && deps.runStore) {
                     const rs = deps.runStore;
                     const tid = durableTaskId;
@@ -1307,7 +1320,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                 else if (durableTaskId) {
                     inflightRuns.set(durableTaskId, syncCancelCtrl);
                 }
-                const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal };
+                const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) }; // [3806]:同流式腿——tid 进 spec.taskId,否则 core fallback sessionId 污染 lastRunId
                 // Developer mode (1.44): verify = adversarial verify→fix gate. Cascade (1.45): cheap→strong ladder,
                 // escalate on a failed gate (default = didn't complete). Both opt-in, mutually exclusive, multi-attempt.
                 let result;

package/dist/http/routes/trace-usage.js

@@ -2,6 +2,7 @@ import { projectEvents, taskSummary, mapTraceEvent } from "../../trace/project.j
 import { projectArtifacts } from "../../trace/artifacts.js";
 import { usageSummary, usageSeries, usageBreakdown } from "../../usage-analytics.js";
 import { sleep } from "../sse-log.js";
+import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal } from "../principal-gate.js";
 // [3321] tool-results 读面**共用这一段守卫**([3318] 的字面承诺):新 sub 进的是同一个 `sub` 捕获组,
@@ -410,7 +411,9 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
     // SSE shape changed, e.g. when P1 adds token-delta granularity). resumeFrom echoes the honored Last-Event-ID.
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "delta", resumeFrom: from })}\n\n`); // [2373]C-12:data.type 双发与内容帧一致
     let closed = false;
-    req.on("close", () => {
+    // design/245 件1:断连清理走共享助手(req+res 双挂 + 一次性闸)。只挂 `req` 时,请求流被读干的
+    // 形下这条旗永远翻不过来,泵会对着死 socket 一路轮询到 15 分钟帽 —— 理由全文在 `sse-lifecycle.ts` 顶注。
+    bindSseLifecycle(req, res, () => {
         closed = true;
     });
     const start = Date.now();

package/dist/http/server.js

@@ -13,6 +13,7 @@ import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { normalizeApproachNotice, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -60,7 +61,7 @@ export { coarseStatusForState, errorCodeForExit };
 // (routes/* 绝不可值 import server.ts:那条边会闭合运行时环,见 test/module-cycle-gate.test.ts)。
 import { sendJson, sendError, httpErrorCode, msg } from "./send.js";
 import { authorized, systemFor, gatedPrincipal, explicitOperatorOk, isOperator } from "./principal-gate.js";
-import { resumeEntryForGate } from "./active-run-conflict.js";
+import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 export { explicitOperatorOk, isOperator };
 /** 分组入参 → 平铺视图(createHttpServer 的第一件事)。一组都没给 ⇒ 原样返回(存量调用零开销、零形变)。 */
 export function flattenServiceDeps(deps) {
@@ -1686,15 +1687,45 @@ export function createHttpServer(rawDeps) {
                 return { status: 429, body: { error: "budget exhausted (quota lease)", errorCode: "quota_exhausted", retryAfterSec: adm.retryAfterSec } };
             }
         }
-        const taskId = await deps.runStore?.getActiveTaskId(sessionId);
+        let taskId = await deps.runStore?.getActiveTaskId(sessionId);
+        // [3829]/[3830] wake 腿(mintFreshRun 声明位):task_done 纯 park 的终局 finalize 已删 task_active
+        // claim——本腿在此恒拿不到 taskId,曾经整腿无行裸跑(不可取消/无计费归因/无 durable append/fleet
+        // 不可见),而 core `spec.taskId ?? sessionId` fallback 还会把 lastRunId 铸成 sessionId(续听恒 404,
+        // cli 7.18 提货围栏首撞)。wake 续跑=同 session 新一轮 turn(原任务已终局),正确形=铸新 canonical
+        // taskId + createRun 全生命周期行;createRun 的 task_active 唯一键 claim 同时补上 double-text 互斥
+        // (getActiveTaskId 读后另一提交抢建行的竞态窗 ⇒ 与 sync 腿同形 409 真出路)。未声明该位的腿
+        // (decide/answer/plan_review)语义不变:claim 缺席=行被 reap 的竞态,checkpoint token 同拍过期兜底。
+        let freshRunClaimed = false;
+        // 🔴 codex R1-F1(2026-08-14):mintFreshRun 腿对「claim 有值」**只有 409 一条出路**,绝不落入下方的
+        // markResuming 复用臂。本腿的 park 是终局后纯 park——它自己的行早已终局并释放 claim,此刻 claim 里
+        // 的必是**别的 run**(典型:task_done park 之后同 session 又提交了新任务且其已 park 成 suspended,
+        // claim 保留)。旧路径会用**本 park 的旧 token**对**对方的行**赢下 markResuming CAS 并驱动续跑——
+        // 错误终局化对方的行、孤儿化对方仍 pending 的卡(checkpoint 表无 per-session pending 唯一约束,
+        // findPendingTokenBySession 又是无序 LIMIT 1,两条 pending 并存时旧 task_done park 完全可能被选中)。
+        if (args.mintFreshRun && taskId && deps.runStore) {
+            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, taskId) };
+        }
+        if (!taskId && args.mintFreshRun && deps.runStore) {
+            const freshId = uuidv7();
+            const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
+                source: args.mintFreshRun.source,
+                objectivePreview: resumeObjective ? redactSecrets(resumeObjective).slice(0, 120) : null,
+            });
+            if (!created.ok) {
+                return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
+            }
+            taskId = freshId;
+            freshRunClaimed = true;
+        }
         // MF-Fleet (TOC review #7): a HITL resume (/decide, /answer, /plan_review, /preempt-resume, /wake) drives the
         // SAME durable run row that suspended — so it must re-publish to the fleet bus under the SAME runId, or the run
         // VANISHES from GET /v1/fleet/stream the moment it resumes (the original publisher's row was last touched at
         // suspend; nothing keeps it live or settles it after). Reuse `taskId` (the existing suspended run id) so the row
         // RE-APPEARS as the same fleet row; scope = `principal` (the checkpoint/run-owner scope persisted at suspend —
-        // the original submitter, NOT spoofable; matches the run row's owner). rootTaskId = sessionId: the resume's
-        // rebuilt taskConfig carries NO spec.taskId (resolveSpec omits it), so core's canonical taskId == sessionId,
-        // exactly like the sync leg. No-op when no fleetBus / no taskId.
+        // the original submitter, NOT spoofable; matches the run row's owner). rootTaskId = taskId(codex F3,2026-08-13):
+        // resume 的 taskConfig 自此携带 spec.taskId=run 行 id(下方注入点),core canonical 随之——[3806] 修完 sync
+        // 两腿后本腿曾是最后一条 sessionId fallback 腿(resume 后 noteTaskRun 再铸 lastRunId 污染)。No-op when no
+        // fleetBus / no taskId.
         // 🔒 scope = `fleetScope` (the VERIFIED `gatedPrincipal(req)` the calling route computed) — the SAME identity
         // GET /v1/fleet/stream filters by, mirroring the create-path #6 fix. NOT `principal` (= the spoofable
         // checkpoint/auth header from `principalFrom`): a spoofed header would re-publish the resumed row under a
@@ -1704,8 +1735,13 @@ export function createHttpServer(rawDeps) {
         // resume leg now feeds the forward sink like the sync/bg legs (fleet child rows at any depth + the durable
         // task_progress append; see the resumeStream call in driveResume).
         const fleetPub = taskId && deps.fleetBus
-            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: sessionId, ...fleetRunLabels(resumeObjective) })
+            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, ...fleetRunLabels(resumeObjective) })
             : undefined;
+        // codex F3(2026-08-13):resume 重建的 taskConfig 必须携带 run 行 tid——缺席时 core `spec.taskId ??
+        // sessionId` fallback 喂 noteTaskRun,resume 一次 lastRunId 就再被污染成 sessionId([3806] sync 两腿
+        // 修复的 resume 腿孪生)。canonical taskId 迁移的三个同源消费点(fleet rootTaskId / stoppedBy owner /
+        // model-usage 归因键)本批同改,勿单点回退。
+        const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
         // C (TOC adversarial review): settle the resumed fleet row EXACTLY once. A plain Error thrown out of the
         // resume (not CheckpointError/cancel) hits the catch's `throw e` BEFORE the final onTerminal below → the
         // re-published row leaks as a stale "running". Route every onTerminal through this guard so the finally can
@@ -1766,22 +1802,23 @@ export function createHttpServer(rawDeps) {
             // approval (and released the session lock), the run is terminal, or a concurrent resume already claimed
             // it. Bail rather than run a resume whose run row is gone / a sibling owns; the checkpoint reaper expires
             // the token in the same tick so resumeStream would reject anyway. Closes the window the heartbeat can't.
-            claimedRow = await deps.runStore.markResuming(taskId);
+            // [3829]:fresh 行由上面的 createRun 事务铸出即 `running` + claim 在手——markResuming 的 CAS 只认
+            // suspended/needs_review,对它恒败;跳过=行本来就是本腿自己的,资格等价于 CAS 赢。
+            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId);
             if (!claimedRow)
                 return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
-            // stoppedBy — resume leg NOW marked (core 1.256 delivered the mark-by-owner seam): on this
-            // leg core's canonical taskId == sessionId (the rebuilt taskConfig carries no spec.taskId), so a
-            // task-scoped child's owner KEY VALUE coincides with a session-scoped child's — the old `list()` path
-            // couldn't tell them apart (no sessionScoped flag exposed) and took an honest degrade. The seam filters
-            // by the EXPLICIT flag (`skipSessionScoped:true` inside the helper), so only task-scoped children take
-            // the "user" marker; session-scoped ones a cancelled parent deliberately does NOT stop stay unmarked
-            // (CC Backgrounded semantics). Owner = sessionId (this leg's canonical key), NOT the run-row taskId.
+            // stoppedBy — resume leg NOW marked (core 1.256 delivered the mark-by-owner seam): codex F3(2026-08-13)
+            // 起本腿 canonical taskId == run 行 taskId(resumeTaskConfig 注入 spec.taskId),task-scoped 子代的 owner
+            // 键值随之与 session-scoped 的分开——但 seam 仍按 EXPLICIT flag 过滤(`skipSessionScoped:true` inside
+            // the helper),only task-scoped children take the "user" marker; session-scoped ones a cancelled parent
+            // deliberately does NOT stop stay unmarked (CC Backgrounded semantics). Owner = taskId(this leg's
+            // canonical key since the F3 injection), NOT sessionId.
             //
             // 🔴 位置(#168 件3,与 /v1/tasks/stream 同族):归因规则只有**抢到这条 run 的腿**才有资格挂 ——
             // `markResuming` 输掉的那一支(别的副本已经在 resume,或行已被 reap)在上面就 409 走人,从此一次
             // 都不注册。本腿此前把它挂在 CAS 之前,只是因为 `cancelCtrl` 的唯一 abort 源(inflightRuns / 心跳
             // 轮询)也都在 CAS 之后注册才没出事 —— 那是巧合不是保证。
-            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, sessionId, principal);
+            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal); // owner=canonical taskId(codex F3:resumeTaskConfig 带 spec.taskId=run 行 id,core 子代 owner 键随之;此臂在 if(taskId) 块内恒真)
             // MF-Fleet (#7): the row is now `running` again → re-publish it LIVE to the fleet (re-appears as the same row
             // that was sitting "waiting" while parked). After onStart only — never if markResuming lost the CAS (a sibling
             // owns the row). onTerminal at every settle below keeps the row's lifecycle in lock-step with the run-store row.
@@ -1855,7 +1892,7 @@ export function createHttpServer(rawDeps) {
                 if (verifyRounds !== undefined) {
                     // resumeWithVerification runs the SAME pre-CAS guard + atomic CAS as resume() internally, so a lost
                     // CAS rejects with CheckpointError before any work — handled by the catch below, same as the stream path.
-                    const vr = await resumeWithVerification(legRunner, token, outcome, { ...taskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds); // 快审 F1:整对象直传
+                    const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds); // 快审 F1:整对象直传;codex F3:带 taskId 的形
                     let safe = stripCheckpointToken(vr);
                     // 🔴 A re-suspend on a LATER gate is NOT terminal: core maps it to status:"failed" +
                     // verification.unverifiedReason with the checkpoint token still live. Treat it exactly like
@@ -1961,7 +1998,7 @@ export function createHttpServer(rawDeps) {
                     // (`++seq` is a sync increment — sink-vs-loop appends get unique seqs); only when a durable log exists.
                     // false once this leg settles — notifications after that take the durable-inbox path.
                     resumeLegLive = true;
-                    const stream = await legRunner.resumeStream(token, outcome, { ...taskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
+                    const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
                             // S2 live tail(复审 #1:forward sink 有三条腿——resume 腿上 spawn 的 bg 子代同样带
@@ -2042,6 +2079,7 @@ export function createHttpServer(rawDeps) {
                     if (!taskId || !rs)
                         return await stream.result(); // no durable log to persist into → just drain
                     for await (const ev of stream) {
+                        recordTurnActivity(taskId); // codex F5:S1 活性打点网的 resume 腿(sync/bg 双腿在 ledger-sink onActivity,本腿 append 不走那条链)——漏打则 resume 后 msSinceLastActivity 冻在 suspend 前,活跑的 run 被读成僵死
                         fleetPub?.onEvent(ev); // MF-Fleet (#7): turn_end → tokens, tool_start → live activity, in-stream task_progress → child row (parity with the sync leg's onEvent)
                         await appendPromptManifest(append, deps.promptManifests, taskId); // [998]②: the resumed prepare's manifest lands ahead of its first event (runs.ts twin)
                         switch (ev.type) {
@@ -2370,6 +2408,13 @@ export function createHttpServer(rawDeps) {
             // C: a plain Error (not CheckpointError, not a cancel) is about to propagate before the post-catch
             // `settleFleet(result.status)` can run → settle the re-published row to "failed" first so it doesn't leak
             // as a stale "running" (no-op if a CheckpointError/cancel branch above already settled it).
+            // 🔴 codex R1-F2(2026-08-14):行也要落终局,不只 fleet 帧——本腿在 markResuming/createRun 赢下行后
+            // 普通异常一路 throw 出去,行曾一直留 running+claim 在手直到 reapStale(期间 session 被锁死,最终被
+            // 误记 instance-lost)。cancel 分支(上方)早为同一理由落行,本臂是漏掉的孪生。claimedRow 守卫=只有
+            // 抢到行的腿才有资格驱终局(与 CheckpointError 臂同一条纪律)。
+            if (claimedRow && taskId && deps.runStore) {
+                await deps.runStore.setTerminal(taskId, "failed", null, e instanceof Error ? e.message : String(e)).catch(() => undefined);
+            }
             settleFleet("failed");
             throw e;
         }
@@ -2548,6 +2593,7 @@ export function createHttpServer(rawDeps) {
             resumeObjective,
             outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
             verifyRounds: undefined, // wake 续跑不重开 verify 门(原任务已终局;新工作要 verify 走新 run)
+            mintFreshRun: { source: "wake" }, // [3829]:终局纯 park 的 claim 已删,声明铸新行(注释见 DriveResumeArgs)
         });
     }
     /**
@@ -2917,6 +2963,10 @@ const WORKER_SWAP_REDEEMABLE = {
     governed_unwired: true,
     real_approval_damaged: false,
     real_approval_forged: false,
+    // core 5.30.0(#246 提货):v9 read-face 段的行完整性两词——d.ts 逐字与 real_approval 两词同列
+    // 「terminal for the row's current bytes」,换 worker 不可兑,归属同前(invalid_outcome 臂,行留 pending)。
+    read_face_damaged: false,
+    read_face_forged: false,
     constraint_chain_missing: false,
 };
 /** 判别符缺席(旧引擎裸抛)或词表不认得 ⇒ **false**,即维持修前的 TERMINAL 归属。fail-closed 的方向在

package/dist/http/sse-lifecycle.d.ts

@@ -0,0 +1,65 @@
+/**
+ * design/245 件1 —— 一条 SSE 连接的**关闭清理链**接线口。
+ *
+ * ## 为什么必须双监听(而不是只挂 `req`)
+ *
+ * `routes/tasks.ts:232` 早已成文并在生产上验过一次:**请求体一旦被读完,客户端再断开就不会有
+ * `req` 的 `'close'` 了** —— Node 的 readable 在 EOF 被消费掉那一刻就 autoDestroy 并把 `'close'`
+ * 发掉了,之后的断连在 `req` 这一侧无事发生。tasks.ts 的 POST 腿当年正因此让「断连即杀 run」的
+ * 契约整条失效(dropped relay 照烧 token),补的就是 `res` 那一半。
+ *
+ * 四个断连形(客户端 abort / 服务端 `res.destroy()` / 裸 socket RST / 半关 FIN)**实测**
+ * (开发机 node v24.2.0;CI 跑 node 22,未在其上重测 —— 引用这些结论时按此打折),归纳出两条判据:
+ *  1. **`res` 的 `'close'` 恒先于 `req` 的**。socket 一死先落到响应侧;`req` 那一份是 http server
+ *     的 `abortIncoming` 补发的,晚一拍。⇒ 只挂 `req` 等于自愿多跑一拍才收摊。
+ *  2. **请求流被读干后,`req` 的 `'close'` 不再补发**。「读干」不限于 POST 读 body:GET 上任何人
+ *     调 `resume()`/for-await 同样把它烧掉(实测同形)。⇒ 只挂 `req` 的腿,其清理是否发生取决于
+ *     「这条路径上有没有人碰过请求流」这种**远处的、易漂的**前提,而不是自己的接线。
+ *
+ * 所以正解是**两侧都挂**:`res` 那一份是真正管用的那条(恒发、且更早),`req` 那一份保留既有语义
+ * (某些形下它也发,且历史行为依赖它)。`routes/fleet.ts` 与 `routes/workflows.ts` 早就是这个形,
+ * 本模块只是把那对逐字重复的接线收成一个属主,让第三条腿不必再各写一遍、也不会再漏写一半。
+ *
+ * ## 为什么闸是必须的
+ *
+ * 上面第 1 条的另一面:**一次断连通常两个事件都来**。清理动作(`clearInterval` / 迭代器
+ * `return()` / 置 `closed` 旗)本身多数幂等,但「多数」不是「全部」——一旦某个端点的 onClose 里
+ * 掺进不幂等的一手(计数、记一条日志、发一帧、abort 一个已被复用的控制器),重复执行就是真缺陷,
+ * 而且是那种「本地跑不出来、线上偶发」的形。闸放在这里 = 各端点写 onClose 时不必再自证幂等。
+ *
+ * 闸在**调用之前**落下(不是之后):onClose 抛出时,第二个事件不得把一个已经跑了一半的清理再跑
+ * 一遍 —— 半跑过的清理重入,比不跑更难诊断。
+ *
+ * ## 为什么注册完还要回看一眼状态
+ *
+ * 光「订阅未来事件」不够:`'close'` **只发一次**,而四条腿的接线全都排在若干次 await 之后
+ * (trace 是 `getRun`/`retainedFrom`,runs 是 subagent probe,sse-log 是 `retainedFrom`)。客户端
+ * 在那段慢查询里断开 ⇒ 两个 close 都在监听器注册**之前**烧完(实测:后装的监听器不会被补发)⇒
+ * 清理整条不发生,泵对着死连接轮询到 15 分钟帽。这不是假想:`sse-log.ts` 的 preamble 注里记着的
+ * 同一个坑,当时只把 preamble 挪到了接线之后,而接线本身前面还有别的 await。
+ *
+ * 所以注册之后补一次**状态回看**:两条腿(事件订阅 + 当前状态)合起来才覆盖完整时间轴。
+ *
+ * 🔴 判据只能取 `res` 侧。实测三态:窗口内断连 ⇒ `res.destroyed`/`res.closed` 皆 true;连接健在 ⇒
+ * 皆 false;**请求流被读干但连接健在** ⇒ `req.destroyed` 为 true 而 `res` 两位仍为 false。
+ * ⇒ 用 `req.destroyed` 当判据会把「读干形的活连接」当场判死 —— 误杀一条正在服务的流,比漏清理更糟。
+ *
+ * ## 本模块**不**做的事(留给调用方,别在这里加)
+ *
+ * 不区分「正常收流的 close」与「断连的 close」:`res.end()` 之后同样会发 `'close'`。四个调用方的
+ * onClose 在收流后执行都是无害的(旗已无人读、interval 已清、迭代器已 return)。onClose 带**副作用**
+ * 的腿(tasks.ts 的 park/abort 那条)必须自己按 `res.writableEnded` 判别,那条判据是**该腿的语义**,
+ * 不是本助手的 —— 塞进这里会让「正常结束」在别的腿上被误当断连。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+/**
+ * 把 `onClose` 接到这条连接的两个关闭信号上,并保证**至多执行一次**。
+ *
+ * 连接在调用本函数**之前**就已经断了(接线排在慢查询之后的那种形),`onClose` 会在本函数内
+ * **同步**跑一次 —— 调用方据此可以假定:本函数返回后,「已断连」这件事一定已经被通知过了。
+ * 于是 `closed` 旗在泵进入循环前就已翻好,不需要每条腿再自己判一次 `res.destroyed`。
+ *
+ * @param onClose 本连接的全部清理动作(置 `closed` 旗、`clearInterval`、迭代器 `return()` 等)。
+ */
+export declare function bindSseLifecycle(req: IncomingMessage, res: ServerResponse, onClose: () => void): void;
+//# sourceMappingURL=sse-lifecycle.d.ts.map

package/dist/http/sse-lifecycle.js

@@ -0,0 +1,25 @@
+/**
+ * 把 `onClose` 接到这条连接的两个关闭信号上,并保证**至多执行一次**。
+ *
+ * 连接在调用本函数**之前**就已经断了(接线排在慢查询之后的那种形),`onClose` 会在本函数内
+ * **同步**跑一次 —— 调用方据此可以假定:本函数返回后,「已断连」这件事一定已经被通知过了。
+ * 于是 `closed` 旗在泵进入循环前就已翻好,不需要每条腿再自己判一次 `res.destroyed`。
+ *
+ * @param onClose 本连接的全部清理动作(置 `closed` 旗、`clearInterval`、迭代器 `return()` 等)。
+ */
+export function bindSseLifecycle(req, res, onClose) {
+    let fired = false;
+    const once = () => {
+        if (fired)
+            return;
+        fired = true; // 先落闸再调用:onClose 抛出时不得从第二个事件重入(见顶注)
+        onClose();
+    };
+    res.on("close", once); // 实测恒先到的那一个,也是读干形下唯一到的那一个
+    req.on("close", once);
+    // 回看:接线之前就断掉的连接,两个事件都已烧完,只有状态位还留着证据(理由与判据选取见顶注)。
+    // 先注册再回看,不是反过来 —— 反过来会在「回看与注册之间」新开一个同样的窗。
+    if (res.destroyed || res.closed)
+        once();
+}
+//# sourceMappingURL=sse-lifecycle.js.map

package/dist/http/sse-log.js

@@ -1,3 +1,4 @@
+import { bindSseLifecycle } from "./sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "./send.js";
 /** #151 车3 §5.3:preamble 的**有界**等待上限。挂起的 store 不许拖住开流——开流是壳的主路径,
  *  而 preamble 只是一个锦上添花的对账基准。超时即按「无卡集基准」继续(与今天等同)。 */
@@ -65,8 +66,12 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
     // 只发一次,在等待窗里断连的客户端其 close 事件会在监听器注册之前烧掉 ⇒ `closed` 恒 false ⇒ 泵照常
     // 进轮询循环,对着已死的 res 反复 getEvents/statusOf 直到终态/stale/15 分钟帽。本行原本紧跟
     // sseHeaders,是 preamble 插进来才多出这个窗 —— 所以搬接线、不搬 preamble。
+    //
+    // design/245 件1:接线本身收到共享助手(req+res 双挂 + 一次性闸)。此前只挂 `req`,而请求流被读干
+    // 之后 `req` 的 close 不再补发 —— 本泵是 `task_run` 与 `image_bake` 两条日志共用的 seam,调用方
+    // 是谁、在它之前有没有人碰过请求流,不该由本泵去赌。理由全文在 `sse-lifecycle.ts` 顶注。
     let closed = false;
-    req.on("close", () => {
+    bindSseLifecycle(req, res, () => {
         closed = true;
     });
     // #151 车3 §5.1:preamble 排在 416 判定与 sseHeaders **之后**、日志 tail 之前。有界 + fail-open,
@@ -75,8 +80,8 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
     if (preamble) {
         const frames = await collectSsePreamble(preamble, (reason, err) => provider.onPreambleFailure?.(reason, err));
         // 等待窗里断连了就别再写(`closed` 由上面的 close 监听器置;`writableEnded`/`destroyed` 是
-        // 第二道 —— codex 复审第二轮 medium 指出 res 侧的 close 面本 helper 没听,那半条见终报的存疑单,
-        // 这里先把「往已死的 res 写」这半堵掉,判据与 routes/tasks.ts 心跳处逐字同源)。
+        // 第二道 —— codex 复审第二轮 medium 当时指出 res 侧的 close 面本 helper 没听,那半条已由
+        // design/245 件1 的 `bindSseLifecycle` 补上;这道判据保留为第二重,与 routes/tasks.ts 心跳处逐字同源)。
         if (!closed && !res.writableEnded && !res.destroyed) {
             for (const f of frames)
                 res.write(`event: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);

package/dist/runs.js

@@ -3,6 +3,7 @@ import { withPrincipal } from "./observability/principal-context.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
 import { createLedgerSink } from "./trace/ledger-sink.js";
+import { recordTurnActivity } from "./turn-activity.js";
 import { createApprovalCardEmitter, resolveApprovalLeg } from "./tool-approval.js";
 import { fleetRunResiduals, isFleetAgentTerminalNotification } from "./fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "./fleet/subagent-tail-bus.js";
@@ -481,7 +482,7 @@ approval) {
     // model-usage/park-terminal/fleet) in place and drives the sink; `append`/`flush` below stay the leg-local
     // names for every out-of-band row (elicit/question frames, model_usage deltas, suggestions, failed) so they
     // share the run's single seq counter. `notifiedKeys` is the same per-leg instance the observer/drain arms use.
-    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys });
+    const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: () => recordTurnActivity(taskId) });
     const append = (type, data) => sink.append(type, data);
     const flush = () => sink.flush();
     // E8 (shell-host contract): drain the per-task model-usage accumulator into an append-only `model_usage` DELTA event, so

package/dist/trace/ledger-sink.d.ts

@@ -61,5 +61,11 @@ export declare function createLedgerSink(opts: {
      *  (shared with its observer/drain arms so no arm double-appends a key another arm delivered); a leg with no
      *  other durable arms (sync detach lane) omits it and gets a private instance. */
     notifiedKeys?: NotifiedKeys;
+    /** #245 S1:turn 活性打点(`recordTurnActivity(taskId)`)。打点位有两处且都必须:①`onEvent` 入口
+     *  ——**text_delta/reasoning_delta 只进内存缓冲、到 flush 边界才 append**(codex S1-F1,2026-08-13:
+     *  只打 append 会让长时间流式输出被误读成「无进展」,方向与本键的设计目的正好相反);②`append`
+     *  入口——兜住不经 onEvent 的直写路径(appendParked/appendDone/onForwardEvent)。分诊提示性回调:
+     *  抛错不得断链(打点失败丢的只是判别材料,账本不能陪葬)。 */
+    onActivity?: () => void;
 }): LedgerSink;
 //# sourceMappingURL=ledger-sink.d.ts.map

package/dist/trace/ledger-sink.js

@@ -18,7 +18,17 @@ export function createLedgerSink(opts) {
     // anchor tracks the same value for its own anchor-put; both latches see the same events in the same order,
     // so the stamps agree byte-for-byte — the anchor's extra `turnHadTool` state never feeds the stamp.)
     let textEventId;
+    // #245 S1:活性打点(顶注契约:两打点位之一;抛错吞掉,绝不拖账本/事件循环下水)。
+    const beat = () => {
+        try {
+            opts.onActivity?.();
+        }
+        catch {
+            /* 分诊打点失败只丢判别材料 */
+        }
+    };
     const append = (type, data) => {
+        beat(); // 打点位②:不经 onEvent 的直写路径(parked/done/forward)在这里被兜住
         const step = chain.then(() => opts.appendEvent(++seq, type, data));
         chain = step.then(() => undefined, () => undefined);
         return step;
@@ -36,6 +46,7 @@ export function createLedgerSink(opts) {
         }
     };
     const onEvent = async (ev) => {
+        beat(); // 打点位①:所有流事件(含只进缓冲的 text/reasoning delta)——「事件到达 sink」= turn 在推进
         switch (ev.type) {
             case "text_delta": {
                 const td = ev;

package/dist/turn-activity.d.ts

@@ -0,0 +1,30 @@
+/**
+ * #245 S1([3777] 决策卡死墙攻关):进程内 per-task「turn 最后活性时刻」——running 形 409 与
+ * GET /v1/runs/:id 读面的判别材料 `msSinceLastActivity` 的唯一数据源。
+ *
+ * 【为什么需要它】run 行的 `updatedAt` 由 liveness heartbeat(独立 `setInterval`,runs.ts)推进——
+ * 它只证明 **server 进程**活着;turn 卡死在某个 await 上时心跳照走([3771] 推理漏洞的公开更正)。
+ * 「turn 真在推进」的证据 = ledger sink 的 durable append(text/tool/status/park/done 全族都过那一条
+ * 单写串行链)。cli 的 running 形保守臂([3779] C3)缺的就是这一维:没有它,「真忙的后台 run」与
+ * 「断连僵局」在 wire 上不可分辨,只能猜。
+ *
+ * 【语义边界(与消费端约定,勿漂)】
+ * - **同副本 best-effort**:记录只活在本进程。跨副本命中(claim 持有者在别的副本)或本副本重启后
+ *   ⇒ 读不到 ⇒ wire 键**诚实缺席**——缺席 = 「无法证明」,不是「不活」。绝不铸 0(0 会被读成
+ *   「刚刚还活着」,错误方向与 [2255] 「宁缺毋假」纪律同族)。
+ * - 不落库、不进 SQL 面:这是分诊提示,不是状态机输入;任何门/CAS/resume 判定都不许读它。
+ *
+ * 【生命周期】终局**不主动清**——409 只在 `running` 行上消费本记录,终局行不进那个分支,残留无害;
+ * 主动清反而制造「done append 已打点、行还没翻终态」窗口里的缺席假象。有界性由插入序近似 LRU 兜底
+ * (CAP 条,超限逐最老;每条 ≈ 60B,上限 ≈ 0.5MB,常驻可接受)。
+ * 🔴 但**新世代必须清**(codex S1-F2,2026-08-13):session purge 删行后客户端合法复用自带 taskId 重
+ * 提交——不清的话新 run 首次打点前会读到旧 run 的时刻 = 假「刚有活性」证据。清点 = 三个 createRun
+ * 成功分支(routes/runs.ts + routes/tasks.ts×2,接线锚在 session-active-conflict-materials 测试)。
+ */
+/** ledger sink 每次 durable append 时打点(装配点:runs.ts / routes/tasks.ts 的 createLedgerSink)。 */
+export declare function recordTurnActivity(taskId: string): void;
+/** 最后活性时刻(epoch ms);无记录 ⇒ undefined(缺席语义见顶注)。 */
+export declare function readTurnActivityMs(taskId: string): number | undefined;
+/** 测试隔离用(生产路径不调:终局不清的理由见顶注)。 */
+export declare function clearTurnActivity(taskId: string): void;
+//# sourceMappingURL=turn-activity.d.ts.map

package/dist/turn-activity.js

@@ -0,0 +1,46 @@
+/**
+ * #245 S1([3777] 决策卡死墙攻关):进程内 per-task「turn 最后活性时刻」——running 形 409 与
+ * GET /v1/runs/:id 读面的判别材料 `msSinceLastActivity` 的唯一数据源。
+ *
+ * 【为什么需要它】run 行的 `updatedAt` 由 liveness heartbeat(独立 `setInterval`,runs.ts)推进——
+ * 它只证明 **server 进程**活着;turn 卡死在某个 await 上时心跳照走([3771] 推理漏洞的公开更正)。
+ * 「turn 真在推进」的证据 = ledger sink 的 durable append(text/tool/status/park/done 全族都过那一条
+ * 单写串行链)。cli 的 running 形保守臂([3779] C3)缺的就是这一维:没有它,「真忙的后台 run」与
+ * 「断连僵局」在 wire 上不可分辨,只能猜。
+ *
+ * 【语义边界(与消费端约定,勿漂)】
+ * - **同副本 best-effort**:记录只活在本进程。跨副本命中(claim 持有者在别的副本)或本副本重启后
+ *   ⇒ 读不到 ⇒ wire 键**诚实缺席**——缺席 = 「无法证明」,不是「不活」。绝不铸 0(0 会被读成
+ *   「刚刚还活着」,错误方向与 [2255] 「宁缺毋假」纪律同族)。
+ * - 不落库、不进 SQL 面:这是分诊提示,不是状态机输入;任何门/CAS/resume 判定都不许读它。
+ *
+ * 【生命周期】终局**不主动清**——409 只在 `running` 行上消费本记录,终局行不进那个分支,残留无害;
+ * 主动清反而制造「done append 已打点、行还没翻终态」窗口里的缺席假象。有界性由插入序近似 LRU 兜底
+ * (CAP 条,超限逐最老;每条 ≈ 60B,上限 ≈ 0.5MB,常驻可接受)。
+ * 🔴 但**新世代必须清**(codex S1-F2,2026-08-13):session purge 删行后客户端合法复用自带 taskId 重
+ * 提交——不清的话新 run 首次打点前会读到旧 run 的时刻 = 假「刚有活性」证据。清点 = 三个 createRun
+ * 成功分支(routes/runs.ts + routes/tasks.ts×2,接线锚在 session-active-conflict-materials 测试)。
+ */
+const CAP = 8192;
+const lastActivityByTask = new Map();
+/** ledger sink 每次 durable append 时打点(装配点:runs.ts / routes/tasks.ts 的 createLedgerSink)。 */
+export function recordTurnActivity(taskId) {
+    if (lastActivityByTask.has(taskId)) {
+        lastActivityByTask.delete(taskId); // 重插保持插入序 = 近似 LRU
+    }
+    else if (lastActivityByTask.size >= CAP) {
+        const oldest = lastActivityByTask.keys().next().value;
+        if (oldest !== undefined)
+            lastActivityByTask.delete(oldest);
+    }
+    lastActivityByTask.set(taskId, Date.now());
+}
+/** 最后活性时刻(epoch ms);无记录 ⇒ undefined(缺席语义见顶注)。 */
+export function readTurnActivityMs(taskId) {
+    return lastActivityByTask.get(taskId);
+}
+/** 测试隔离用(生产路径不调:终局不清的理由见顶注)。 */
+export function clearTurnActivity(taskId) {
+    lastActivityByTask.delete(taskId);
+}
+//# sourceMappingURL=turn-activity.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.17.0",
+  "version": "7.18.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.29.0",
+    "@sema-agent/core": "^5.30.0",
     "@sema-agent/registry-core": "^0.16.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",