@sema-agent/server 7.4.0 → 7.6.0

package/dist/http/routes/fleet.js

@@ -1,3 +1,4 @@
+import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTerminalWorkflowRows } from "../../fleet/fleet-terminal-window.js";
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedPrincipal } from "../principal-gate.js";
@@ -44,7 +45,12 @@ async function handleFleetBody(req, res, url, ctx, miss) {
         // (a non-shell observer following one session). Default (absent) keeps the frame-即-投递 semantics —
         // today's only session-bound consumer IS the model-injecting shell.
         const observeOnly = fleetParams.get("observe") === "1";
-        await streamFleet(req, res, deps.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox);
+        // #189:终态行窗的 durable 读交给 streamFleet 在**订阅注册之后**做(见那里的缓冲段)——放在这里
+        // (开流之前)会让"帧已扇出而本连接尚未订阅"的窗口凭空多出一个读的时长,codex R1-H1 红先复现过。
+        // [3156] 轮2 真红修:终态窗的查询键必须与可见性判据**同源**——fleetWide 连接(callerScope=null,
+        // visW 放行全 scope)此前窗却按 caller principal("default")查,而行的 scope 是引擎铸的
+        // ("anon:shell-live")⇒ durable pull 恒 miss。fleetWide ⇒ null(窗走进程内 seed 缓存,全 scope)。
+        await streamFleet(req, res, deps.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: fleetWide ? null : (principal ?? "default"), pullScope: principal ?? "default", ready: deps.fleetRecoveryDone });
         return;
     }
     miss.fell = true;
@@ -54,7 +60,7 @@ async function handleFleetBody(req, res, url, ctx, miss) {
  *  else owner-scoped (only rows whose `scope` matches). The tenant-internal `scope` field is STRIPPED from every
  *  emitted row (it's a gate input, never rendered). A removal is forwarded ONLY for a row this connection actually
  *  saw (no id-existence oracle for an unseen tenant's run). Heartbeat + dual-close cleanup unsubscribe the bus. */
-function streamFleet(req, res, bus, callerScope, callerSession = null, completionInbox) {
+function streamFleet(req, res, bus, callerScope, callerSession = null, completionInbox, terminal) {
     return new Promise((resolve) => {
         sseHeaders(res);
         // [1508] 1.247 `bgNotifyFailClosed` — the GENERATION marker cli asked for ([1500]📌/[1502] F2): declares
@@ -81,19 +87,68 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
         // subscriber gets a content-scrubbed projection (ids/status/progress/timing kept); a fleet-wide observer
         // (trace/dashboard, callerSession === null) keeps the full row. Rows tagged with the caller's own session
         // pass sessionOk and are never scrubbed (r.sessionId present ⇒ it equals callerSession here).
+        // codex R6:FleetTaskRow 逐键处置表——`satisfies Record<keyof FleetTaskRow,…>` 使**任何**行新键先在
+        // 编译期红(TS2741),强迫对跨会话可见性表态;"keep" 键必须同步进下方白名单构造,配套钉在
+        // test/fleet-bg-child.test.ts(R6 格:kept 键集 ⊆ 表内 keep∪rewrite 集)。
+        const SCOPED_TASK_KEY_DISPOSITION = {
+            id: "keep", parentId: "keep", parentToolCallId: "keep", workflowRunId: "keep", status: "keep",
+            startedAt: "keep", elapsedMs: "keep", tokens: "keep", queuedCount: "keep",
+            awaitingPlanApproval: "keep", toolUses: "keep", usage: "keep", resumable: "keep", sourceLane: "keep",
+            name: "rewrite", scope: "strip", sessionId: "strip",
+            description: "scrub", agentType: "scrub", agentName: "scrub", currentAction: "scrub",
+            currentTool: "scrub", transcriptId: "scrub", stoppedBy: "scrub", editedFiles: "scrub",
+        };
+        void SCOPED_TASK_KEY_DISPOSITION;
         const stripT = (r) => {
             const { scope: _s, sessionId: _sid, ...rest } = r;
             if (callerSession !== null && r.sessionId === undefined) {
-                const { description: _d, agentType: _at, agentName: _an, currentAction: _ca, ...keep } = rest;
-                return { ...keep, name: "(unattributed)" };
+                // [3136]②→codex R6(确认轮):黑名单形被两次击穿(currentTool、editedFiles)——同一信任边界的键
+                // 靠逐个想起来列,漏一个就是跨会话内容泄漏。改**白名单构造**:kept 对象逐键显式拼,未列键默认
+                // 不过;新键先过上方处置表的编译期门。
+                return {
+                    id: rest.id,
+                    status: rest.status,
+                    name: "(unattributed)",
+                    ...(rest.parentId !== undefined ? { parentId: rest.parentId } : {}),
+                    ...(rest.parentToolCallId !== undefined ? { parentToolCallId: rest.parentToolCallId } : {}),
+                    ...(rest.workflowRunId !== undefined ? { workflowRunId: rest.workflowRunId } : {}),
+                    ...(rest.startedAt !== undefined ? { startedAt: rest.startedAt } : {}),
+                    ...(rest.elapsedMs !== undefined ? { elapsedMs: rest.elapsedMs } : {}),
+                    ...(rest.tokens !== undefined ? { tokens: rest.tokens } : {}),
+                    ...(rest.queuedCount !== undefined ? { queuedCount: rest.queuedCount } : {}),
+                    ...(rest.awaitingPlanApproval !== undefined ? { awaitingPlanApproval: rest.awaitingPlanApproval } : {}),
+                    ...(rest.toolUses !== undefined ? { toolUses: rest.toolUses } : {}),
+                    ...(rest.usage !== undefined ? { usage: rest.usage } : {}),
+                    ...(rest.resumable !== undefined ? { resumable: rest.resumable } : {}),
+                    ...(rest.sourceLane !== undefined ? { sourceLane: rest.sourceLane } : {}),
+                };
             }
             return rest;
         };
+        // A-002.5(#194 病族 F2):workflow 行与 task 行同一条降权跨会话边界——stripT 的黑名单三次被
+        // 击穿后改了白名单,stripW 当时漏改(同函数体孪生)。处置表同姿势:行加新键先编译红强迫表态。
+        const SCOPED_WORKFLOW_KEY_DISPOSITION = {
+            id: "keep", status: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
+            startedCount: "keep", elapsedMs: "keep", tokens: "keep",
+            name: "rewrite", scope: "strip", sessionId: "strip",
+            description: "scrub",
+        };
+        void SCOPED_WORKFLOW_KEY_DISPOSITION;
         const stripW = (r) => {
             const { scope: _s, sessionId: _sid, ...rest } = r;
             if (callerSession !== null && r.sessionId === undefined) {
-                const { description: _d, ...keep } = rest;
-                return { ...keep, name: "(unattributed)" };
+                // 白名单构造:kept 逐键显式拼,未列键默认不过(与 stripT 同形;"keep" 键必须同步进处置表)。
+                return {
+                    id: rest.id,
+                    status: rest.status,
+                    name: "(unattributed)",
+                    ...(rest.doneCount !== undefined ? { doneCount: rest.doneCount } : {}),
+                    ...(rest.totalCount !== undefined ? { totalCount: rest.totalCount } : {}),
+                    ...(rest.failedCount !== undefined ? { failedCount: rest.failedCount } : {}),
+                    ...(rest.startedCount !== undefined ? { startedCount: rest.startedCount } : {}),
+                    ...(rest.elapsedMs !== undefined ? { elapsedMs: rest.elapsedMs } : {}),
+                    ...(rest.tokens !== undefined ? { tokens: rest.tokens } : {}),
+                };
             }
             return rest;
         };
@@ -102,14 +157,18 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
         // 单点注入:调用方已带 type 的帧(hook_notice/bg_notification)保持原值。
         const send = (event, data) => { if (!res.writableEnded)
             res.write(`event: ${event}\ndata: ${JSON.stringify({ type: event, ...data })}\n\n`); };
-        // connect-time snapshot (filtered + scope-stripped) — the visible rows become this connection's "seen" set.
-        const snap = bus.snapshot();
-        const tasks = snap.tasks.filter(visT);
-        const workflows = snap.workflows.filter(visW);
-        tasks.forEach((r) => seenTasks.add(r.id));
-        workflows.forEach((r) => seenWf.add(r.id));
-        send("snapshot", { tasks: tasks.map(stripT), workflows: workflows.map(stripW), ts: snap.ts });
-        const unsubscribe = bus.subscribe((frame) => {
+        /** #189:快照里那些**按窗保留**的 workflow 行 id(来自 durable 终态窗,或握手期间才翻终态的行)
+         *  —— 见 workflow / workflow_remove 两臂。 */
+        const retainedTerminalWf = new Set();
+        /** 现在是否正在重放握手期缓冲(只在这段里,终态行帧才升级为"保留行")。 */
+        let replayingBuffer = false;
+        /** [3193] codex R4:首见即终态的历史行保留**预算**(每连接)。retainedTerminalWf 本身不积累
+         *  (每个 id 的撤行帧即刻消费),真正会无界的是「被豁免撤行、留在面板与 seenWf 里的历史行数」。
+         *  预算=终态窗容量同阶(×2);耗尽后退回旧「终帧→撤行」契约(行瞬态可见)——有界降级,不吞帧。
+         *  快照径的保留行不占预算(已由窗的行数+窗龄双界)。 */
+        let retainedHistoryBudget = FLEET_SNAPSHOT_TERMINAL_MAX_ROWS * 2;
+        /** 一条增量帧的处理(**先注册订阅、后组装快照**,故与快照解耦成具名函数——见下方缓冲段)。 */
+        const handleFrame = (frame) => {
             switch (frame.type) {
                 case "task":
                     if (visT(frame.row)) {
@@ -119,6 +178,19 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                     break;
                 case "workflow":
                     if (visW(frame.row)) {
+                        // #189 / codex R4-M3 → [3193] ①a 泛化:**本连接首见即终态**的行(重放期或活径皆然)与终态窗
+                        // 里的行是同一件事——它对这条连接从来不是"活跃集成员",是历史;它的撤行帧描述的活跃集离场
+                        // 对本连接无意义,照发只会让"看不看得见刚结束的 workflow"取决于 recover 落在握手窗哪一侧
+                        // (cli [3193] 插桩实证:落在重放窗内=保留可见,落在重放窗后=终帧+撤行背靠背、行瞬现即消)。
+                        // ⇒ 判据=「重放期 ∪ 首见即终态」并集(#189 原判据的严格超集):重放期臂保住"快照见过
+                        // running、缓冲里才翻终态"的行(R4-M3);首见臂保住活径上 recover 晚到的行(①a)。见过
+                        // running 的行在活径仍按既有契约走(终帧→撤行),在线消费端语义不变。豁免仍一次性,集合有界如旧。
+                        // [3193] codex R5:已在保留集里的 id(快照径收的)不重复扣预算——否则握手重放把同一批行
+                        // 按"快照+重放"记两次账,40 预算被快照行白耗光,其后真正的首见历史行立刻失去豁免。
+                        if ((replayingBuffer || !seenWf.has(frame.row.id)) && isTerminalWorkflowRowStatus(frame.row.status) && !retainedTerminalWf.has(frame.row.id) && retainedHistoryBudget > 0) {
+                            retainedTerminalWf.add(frame.row.id);
+                            retainedHistoryBudget--;
+                        }
                         seenWf.add(frame.row.id);
                         send("workflow", { row: stripW(frame.row), ts: frame.ts });
                     }
@@ -128,6 +200,17 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                         send("task_remove", { id: frame.id, ts: frame.ts });
                     break;
                 case "workflow_remove":
+                    // 🔴 #189 / codex R2-M1:按窗**刻意保留**的历史行不受本连接的撤行帧影响。行在 durable 读
+                    // 期间翻终态时,活写路径的「终帧 + 撤行」会落进缓冲,重放到这里就会把快照刚保住的那一行
+                    // 又撤掉 —— 于是「看不看得见刚结束的 workflow」重新取决于连接时机(晚 1ms 连上的人看得见,
+                    // 撞上这一拍的人看不见),正是本 issue 要消灭的竞态。撤行帧描述的是**活跃集**离场,而这些
+                    // 行进快照时就已经是终态历史,不在活跃集语义里。id 不复用(runId 每次新铸,终态不回滚),
+                    // 故这层豁免既有界又不会误伤后来的真活行。
+                    // 豁免**一次性**:配对的那一帧撤行到达即消费(codex R5-M3)。否则这个 id 被永久噤声——
+                    // 同 id 若之后又出现活行(帧乱序/未来的行复用),它的撤行帧也会被吞,面板留一条撤不掉的死行;
+                    // 顺带,每条长连接的保留集不再随握手期完成数无界增长。
+                    if (retainedTerminalWf.delete(frame.id))
+                        break;
                     if (seenWf.delete(frame.id))
                         send("workflow_remove", { id: frame.id, ts: frame.ts });
                     break;
@@ -217,6 +300,21 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                 default:
                     break; // snapshot frames are connect-time only, never fanned out
             }
+        };
+        // 🔴 #189 / codex R1-H1:订阅**先于**快照注册,快照组装期间到达的帧先进缓冲、发完快照再按序重放。
+        // 快照第一次有了一段 await(durable 终态窗读),而 fleet bus 只扇给**当前**订阅者、不重放 —— 先读后
+        // 订阅就等于开了一个"这段时间的帧对本连接不存在"的窗口(bg_notification 是模型注入面,丢一帧=这次
+        // 完成回执要等到下次开流才由 durable inbox 补;task_remove/hook_notice 同理)。
+        // 顺序安全:`bus.snapshot()` 取在**读之后**,缓冲里的行帧描述的都是快照那一刻或更早的状态,重放
+        // 只会把同一状态再叠一次(upsert 幂等);撤行帧仍按 seen 集判(没见过的行不发撤除)。
+        // 缓冲无显式上限:窗口被读预算硬界在 2s,且缓冲存的是**帧对象引用**(不复制行);设一个会丢帧的
+        // 上限反而正好丢掉这段代码要保住的东西。
+        let buffered = [];
+        const unsubscribe = bus.subscribe((frame) => {
+            if (buffered !== null)
+                buffered.push(frame);
+            else
+                handleFrame(frame);
         });
         // Real frame (not an SSE comment) — a per-frame-parsing BFF drops comments (zero-frame window downstream)
         const hb = setInterval(() => { if (!res.writableEnded)
@@ -234,8 +332,56 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                 res.end();
             resolve();
         };
+        // 关闭钩子在 await **之前**挂上:快照还在组装时对端就断了,也照常收摊(不然那段时间的断连没人处理)。
         req.on("close", shutdown);
         res.on("close", shutdown);
+        void (async () => {
+            // [3193] 病理1:boot recover(判死前世 running 行)与快照组装赛跑——SIGKILL 后壳重连常抢在
+            // recover 之前,此刻 seed/durable 两径皆空,快照永远缺那一行。屏障=recovery 完成 promise
+            // (main.ts 铸,memory 后端/无 gate 部署=已 resolve),**有界**等待(帧订阅已挂上,等待期帧全
+            // 进缓冲不丢):超时=recover 真挂了,按旧行为出快照(可用性路径,行还有 first-sight-terminal
+            // 豁免与下次重连兜底),不无限拖住连接。
+            if (terminal?.ready !== undefined) {
+                await Promise.race([terminal.ready, new Promise((r) => { const t = setTimeout(r, 3000); if (typeof t.unref === "function")
+                        t.unref(); })]);
+                if (done || res.writableEnded)
+                    return;
+            }
+            // #189:durable 近期终态行窗(有界 + 永不抛;详见 fleet-terminal-window.ts)。
+            const terminalWindow = terminal === undefined ? [] : await recentTerminalWorkflowRows(terminal.store, terminal.scope, terminal.pullScope);
+            if (done || res.writableEnded)
+                return; // 组装期间断连:shutdown 已 unsubscribe,不再发任何东西
+            // connect-time snapshot (filtered + scope-stripped) — the visible rows become this connection's "seen" set.
+            const snap = bus.snapshot();
+            const tasks = snap.tasks.filter(visT);
+            const live = snap.workflows.filter(visW);
+            // #189:活行(bus 的活跃集)+ durable 终态窗。
+            //  · 一行一 id:同 id 两侧都有(行刚翻转的那一拍)时 **活行优先** —— 活行是唯一写者写的当前态,
+            //    终态窗是读时快照,后者覆盖前者会让面板倒退。
+            //  · 并入行同样过 `visW`(scope + `?session=`),与活行**同一套判据**:终态行泄跨租户是事故。
+            //  · bus 的 Map **不被触碰** —— 单写者不变量原样:活跃集里永远没有终态行,增量帧语义逐字不变。
+            const liveIds = new Set(live.map((r) => r.id));
+            const retained = terminalWindow.filter((r) => !liveIds.has(r.id) && visW(r));
+            retained.forEach((r) => retainedTerminalWf.add(r.id));
+            const workflows = [...live, ...retained];
+            tasks.forEach((r) => seenTasks.add(r.id));
+            workflows.forEach((r) => seenWf.add(r.id));
+            send("snapshot", { tasks: tasks.map(stripT), workflows: workflows.map(stripW), ts: snap.ts });
+            const pending = buffered ?? [];
+            buffered = null; // 自此直投(先置空再重放:重放期间新到的帧走直投,不会插到旧帧前面)
+            replayingBuffer = true;
+            try {
+                for (const frame of pending)
+                    handleFrame(frame);
+            }
+            finally {
+                replayingBuffer = false; // 重放一结束立刻恢复常态语义(哪怕上面抛了)
+            }
+        })().catch(() => shutdown());
+        // ⚠️ 上面这个 catch 不是"静默降级":快照组装本身抛错(写向已销毁的 socket 那一族)时**没有**可以继续
+        // 的语义——这条连接已经没救了,干净收摊即正解。它真正防的是把原先同步执行器里的抛错(会直接 reject
+        // 出去)变成一条 **unhandled rejection**(Node 默认带走整个进程)。订阅回调自身的抛错另有隔离层
+        // (fleet bus 的 subscribe,记 fail-open),不经这里。
     });
 }
 //# sourceMappingURL=fleet.js.map

package/dist/http/routes/memory-policy.d.ts

@@ -2,7 +2,8 @@
  * design/158 A9 域模块 —— memory 导出/同步 + 只读策略面。
  *
  * 路由:`GET /v1/memory/export`、`POST /v1/memory/sync/:scope`、`GET /v1/policy`。
- * owner 门 = 「本人 user scope 或显式 operator」,越界一律 404(零存在性 oracle)。本域零可变状态。
+ * owner 门 = 「本人 user scope / 显式 operator / `org:` 键的目录成员」(见 {@link gateMemoryScope}),
+ * 越界一律 404(零存在性 oracle)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx } from "../route-ctx.js";

package/dist/http/routes/memory-policy.js

@@ -2,6 +2,70 @@ import { formatUserScope } from "@sema-agent/core";
 import { parseMemorySyncRequest } from "../../memory-sync.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+const ORG_PREFIX = "org:";
+/** 本面是否让目录参与判决。闭集穷举 switch:新增第三个模式是**编译**错误,不会静默落进某个默认臂
+ *  ——这条门在授权轴上,静默默认值正是它不许有的东西。 */
+function directoryDecidesThisFace(mode) {
+    switch (mode) {
+        case "enforce":
+            return true;
+        case "audit":
+            return false; // 见 gateMemoryScope 顶注的 codex R1 段
+    }
+}
+/**
+ * memory-policy 两面(export 读 / sync 写)共用的属主门 —— design/170 件A §7「第二消费者收编」。
+ *
+ * 收编前本门把 `org:*` 写死 operator-only(注逐字「membership waits for the S3 登记簿」),于是同一进程里
+ * 「谁属于 org:acme」有两个答案:core 准入门问授权目录、本面问 operatorPrincipals。收编后 `org:` 成员性
+ * 只由 `deps.orgMemoryDirectory` 回答(与准入 seam 同一个实例、同一份缓存)。
+ *
+ * 判决序(前两级刻意在目录之前 —— 它们不需要目录也成立,顺带让常路零额外 I/O):
+ *  ① 本人 user 盘逐字匹配 ⇒ 通过;② 显式 operator ⇒ 通过(ops/迁移面不依赖目录在场);
+ *  ③ `org:` 键 + 目录在场 + **enforce 模式** ⇒ 查目录:瞬时不可用照原样上抛;取数成功但无该键 ⇒
+ *     `not_found`;`need==="write"` 另要条目 `write === true`(读授予不隐含写授予,与准入面 writeScope
+ *     收窄同源);④ 其余(`userproj:` 等目录没有答案的键、无目录源的部署、audit 模式)⇒ `not_found`。
+ *
+ * **audit 模式为什么在本面等于「不接目录」**(codex 对抗审 R1,2026-08-07):`audit` 是 operator 表态
+ * 「这份目录还没被验证过,先别拿它做判决」。拿未验证的目录去开真数据面(读)甚至写面,是这条表态能
+ * 造成的最严重后果——方向恰好反了;`audit=零行为变化` 的公开契约在本面因此读作「逐字保持收编前的
+ * operator-only」,连额外那一跳目录 I/O 和 enforce 才有的 503 响应形都不引入。org 面的诊断信号属于
+ * 准入侧的 `memory_admission_total{outcome,mode}`,不在本面另开一路。
+ *
+ * 拒绝一律 `not_found` 而非 403:本面的零存在性 oracle 纪律不变(与 run/trace 属主门同口径),
+ * 「不是成员」和「没这个 scope」对调用方必须不可区分。
+ */
+async function gateMemoryScope(deps, principal, scope, need) {
+    if (scope === formatUserScope(principal))
+        return { kind: "allow" };
+    if (explicitOperatorOk(principal, deps.config.operatorPrincipals))
+        return { kind: "allow" };
+    const directory = deps.orgMemoryDirectory;
+    if (!scope.startsWith(ORG_PREFIX) || directory === undefined || !directoryDecidesThisFace(deps.config.memoryOrgAdmissionMode)) {
+        return { kind: "not_found" };
+    }
+    const lookup = await directory.lookup(principal);
+    if (lookup.kind === "unavailable")
+        return { kind: "unavailable", retryAfterMs: lookup.retryAfterMs };
+    const grant = lookup.scopes[scope];
+    if (grant === undefined)
+        return { kind: "not_found" };
+    return need === "write" && grant.write !== true ? { kind: "not_found" } : { kind: "allow" };
+}
+/** 门的拒绝臂下发:瞬时 ⇒ 503 `memory.admission_required` + `retryAfterSec`(秒上取整,永不 0 —— C6;
+ *  族形与 sync 提交腿的同码响应逐字一致);终局 ⇒ 404 零 oracle。返回 true = 已应答,调用方须 return。 */
+function sendScopeGateRefusal(res, gate) {
+    if (gate.kind === "allow")
+        return false;
+    if (gate.kind === "unavailable") {
+        const retryAfterSec = Math.max(1, Math.ceil(gate.retryAfterMs / 1000));
+        res.setHeader("retry-after", String(retryAfterSec)); // 体里有等待提示 ⇒ 标准头同值(与同步提交腿的同码应答逐字一致)
+        sendError(res, 503, "memory.admission_required", "org memory directory unavailable — authorization could not be established", { retryAfterSec });
+        return true;
+    }
+    sendError(res, 404, "not_found.memory_scope", "not found"); // owner gate: no existence oracle
+    return true;
+}
 export async function handleMemoryPolicy(req, res, url, ctx) {
     const miss = { fell: false };
     await handleMemoryPolicyBody(req, res, url, ctx, miss);
@@ -17,11 +81,13 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
     // C-additive 落点). After the global service-credential gate (a credential/SSO-JWT is already
     // verified); the OWNER gate here is the tenant boundary: the verified principal may export exactly its OWN
     // user disk (`scope === formatUserScope(principal)` — core's mint, byte-identical to memoryScopeFor's) or be
-    // an explicit operator (explicitOperatorOk, ops/migration face). Anything else = 404, NEVER 403 (zero
-    // existence oracle, run/trace owner-gate parity). org:*/userproj:* membership waits for the S3 登记簿
-    // (design §1.4) — until then those keys are operator-only by construction. proj:* keys of repo-backed
-    // projects never live in this DB (铁律: git is their authority) — an owner asking for one just gets
-    // an empty set, honestly.
+    // an explicit operator (explicitOperatorOk, ops/migration face), or — design/170 件A §7 收编 — a
+    // DIRECTORY MEMBER of an `org:` key (the same org-memory directory instance core's admission seam reads,
+    // so one process holds ONE answer to "who belongs to org:acme"). Anything else = 404, NEVER 403 (zero
+    // existence oracle, run/trace owner-gate parity); a directory that cannot answer = 503, never 404.
+    // `userproj:*` stays operator-only by construction (the directory has no answer for that key shape).
+    // proj:* keys of repo-backed projects never live in this DB (铁律: git is their authority) — an owner
+    // asking for one just gets an empty set, honestly.
     if (url === "/v1/memory/export" && req.method === "GET") {
         // Auth BEFORE availability (501-before-auth precedent): the backend posture must not oracle
         // to a caller who couldn't read anything anyway.
@@ -39,10 +105,8 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
             sendError(res, 400, "request.query_invalid", "missing ?scope=<key>");
             return;
         }
-        if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-            sendError(res, 404, "not_found.memory_scope", "not found"); // owner gate: no existence oracle
+        if (sendScopeGateRefusal(res, await gateMemoryScope(deps, principal, scope, "read")))
             return;
-        }
         try {
             const entries = await deps.memoryExport(scope);
             sendJson(res, 200, { scope, exportedAt: new Date().toISOString(), entries });
@@ -57,8 +121,8 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
     // plan 随数据走——reconcile/nextSyncBaseline 是 core 纯函数,由持数据的本 server 在 performMemorySync
     // (memory-sync.ts) 里直接调用;此处只持 HTTP 半场). Gate ORDER mirrors the export face verbatim:
     // auth (401) → backend posture (501, file 形态诚实拒绝——单用户 file 面自己就是 TOC 侧,没有中心
-    // 权威半场可服务) → owner gate (404 zero-oracle: verified principal 的 user 盘逐字匹配,或 explicit
-    // operator;org:/userproj: 键在 S3 登记簿前 = operator-only by construction) → 验型 (422 typed)。
+    // 权威半场可服务) → owner gate (404 zero-oracle: verified principal 的 user 盘逐字匹配 / explicit
+    // operator / `org:` 键的目录成员且条目 write:true;userproj: 仍 operator-only) → 验型 (422 typed)。
     if (req.method === "POST" && url.startsWith("/v1/memory/sync/")) {
         const principal = gatedPrincipal(req, deps.config); // direct-door safe: verified identity, never the spoofable header
         if (!principal) {
@@ -83,10 +147,10 @@ async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
             sendError(res, 400, "memory_sync_invalid_scope", "missing :scope");
             return;
         }
-        if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-            sendError(res, 404, "not_found.memory_scope", "not found"); // owner gate: no existence oracle (export-face parity)
+        // 写面:门与 export 面同一个 `gateMemoryScope`,只在 `need` 上分家 —— org 条目须 `write === true`
+        // 才放行(读授予不隐含写授予)。属主/operator 两级与读面逐字同判。
+        if (sendScopeGateRefusal(res, await gateMemoryScope(deps, principal, scope, "write")))
             return;
-        }
         const body = await readJson(req); // 413/400 (oversize / bad JSON) via the typed top-level catch — auth already done
         const parsed = parseMemorySyncRequest(body, scope);
         if (!parsed.ok) {

package/dist/http/routes/runs.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
+import { isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, verifiedPrincipal, isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { runInBackground } from "../../runs.js";
@@ -157,7 +158,7 @@ async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
         // 🔴 开关谓词是**必须**的(codex 复审第二轮 high,2026-08-06):原按「关的时候表里本就没行 ⇒
         // 无需分支」落地,但这个前提在**回滚**下不成立 —— 开着协议的副本(或更新版本)已经落下的
         // `STREAM_PENDING` 行在关掉开关后**仍在表里**,无谓词的重放腿会把它们照常投上 wire,
-        // 「默认关 = 逐字零变化」(§6.5/§7.2)当场破。谓词同时省掉了关闭态每次开流的一次 store 往返
+        // 「开关关 = 逐字零变化」(§6.5/§7.2)当场破。谓词同时省掉了关闭态每次开流的一次 store 往返
         // 与那份 store 故障暴露面。钉:场景9(零帧 **且** 零 store 读 —— 只钉零帧会放过「读了但没投」)。
         preamble: async (signal) => {
             if (!deps.config.streamApproval.enabled)
@@ -575,7 +576,10 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             // 并发腿可能先终态化(如 approval.expired),我方写打空却仍答 "cancelled" 就是响应与账本不一致。
             // 写后复读,照实际行应答(锁一样释放了;谁先写赢谁的 errorCode)。
             const finalRow = await rs.getRun(taskId).catch(() => undefined);
-            if (finalRow && finalRow.errorCode !== "cancelled" && (finalRow.status === "failed" || finalRow.status === "completed" || finalRow.status === "blocked")) {
+            // 终局判据取自词表属主 `store-contracts.ts` 的穷举 `isTerminalRunStatus`(原地手抄的三连 `===`
+            // 对 core **增**一个终局态是静默的:新态会被判成「还没终局」⇒ 这里改答 "cancelled",与账本不一致,
+            // 正是本段注释要防的那件事)。
+            if (finalRow && finalRow.errorCode !== "cancelled" && isTerminalRunStatus(finalRow.status)) {
                 sendJson(res, 202, { taskId, status: finalRow.status, errorCode: finalRow.errorCode ?? null, note: `session unlocked; the run was terminalized concurrently (${finalRow.errorCode ?? finalRow.status}) before this cancel's write — reporting the actual ledger state` });
                 return;
             }

package/dist/http/routes/tasks.js

@@ -158,14 +158,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             // relay keeps burning billable tokens to completion (council). Mirrors the closed-flag pattern of the
             // poll-based SSE endpoints, and additionally cancels the generator via spec.signal.
             const ac = new AbortController();
-            // probe-stoppedby: a client DISCONNECT on the sync stream lane is a USER stop too —
-            // Ctrl+C on the shell drops the SSE and this abort kills the run, but the mark was only wired on the
-            // cancel-verb/resume legs, so background children reaped by THIS abort read "parent"/"system" instead
-            // of "user". Same registration discipline as runs.ts (FIRST on the signal, before core's teardown
-            // listeners). Owner = sessionId (the sync leg's core-canonical taskId — resolveSpec sets no spec.taskId,
-            // same key as the resume leg); skipSessionScoped inside the helper keeps CC Backgrounded children unmarked.
-            if (prepared.spec.sessionId)
-                markChildrenStoppedByUserOnAbort(ac.signal, prepared.spec.sessionId, prepared.auth?.principal);
+            // 🔴 stoppedBy 归因的注册点在**下面**(createRun 认领成功之后),不在这里 —— #168 件3,见那里的注。
             let closed = false;
             let detachLogged = false; // [854]①b:detach 断连 info 只打一条(req/res 两个 close listener 都可能进来)
             const onDisconnect = () => {
@@ -225,7 +218,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             // 跨腿投递,租户门必须带上,不能让 A 租户的开流看到 B 租户的卡。
             // 有界(2s)+ fail-open:store 抛或挂起都只记一次 warn、零卡继续开流(§5.3)。
             // 🔴 开关谓词与 runs.ts 同源同理由(codex 复审第二轮 high:回滚下表里可能有残留 STREAM_PENDING
-            // 行,无谓词会破「默认关 = 逐字零变化」;顺带省掉关闭态每次开流的一次 store 往返)。钉:场景9。
+            // 行,无谓词会破「开关关 = 逐字零变化」;顺带省掉关闭态每次开流的一次 store 往返)。钉:场景9。
             const replaySessionId = deps.config.streamApproval.enabled ? prepared.spec.sessionId : undefined;
             if (replaySessionId) {
                 const replayOwner = gatedPrincipal(req, deps.config) ?? null;
@@ -323,6 +316,23 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     }
                     durableTaskId = tid;
                 }
+                // ── stoppedBy 归因(#168 件3:注册点必须晚于 run 认领)────────────────────────────────────
+                // probe-stoppedby: a client DISCONNECT on the sync stream lane is a USER stop too — Ctrl+C on the
+                // shell drops the SSE and this abort kills the run, but the mark was only wired on the
+                // cancel-verb/resume legs, so background children reaped by THIS abort read "parent"/"system"
+                // instead of "user". Same registration discipline as runs.ts (FIRST on the signal, before core's
+                // teardown listeners). Owner = sessionId (the sync leg's core-canonical taskId — resolveSpec sets no
+                // spec.taskId, same key as the resume leg); skipSessionScoped inside the helper keeps CC Backgrounded
+                // children unmarked.
+                //
+                // 🔴 **位置即正确性**(#168 件3,3c codex R3 定性的先存病):这条规则说的是「本请求断连 ⇒ 把
+                // owner=sessionId 的 task-scoped 子代记成人为停止」,而**只有抢到了这条 session 的请求**才有资格
+                // 那么说。注册早于 `createRun` 时,一次 pre-start 断连会把**另一条活 run** 的子代标成 user-stopped
+                // (认领随后 409,本请求根本没代表过这条 session)。窗 = SSE 头/首帧 + 开流 preamble(有界 2s)+
+                // 一次 DB 往返。认领失败那条路在上面就 return 了 ⇒ 一次都不注册。
+                // 无 durable 账本(无 runStore / 无 sessionId)的部署没有认领这回事,注册点与从前等价。
+                if (prepared.spec.sessionId)
+                    markChildrenStoppedByUserOnAbort(ac.signal, prepared.spec.sessionId, prepared.auth?.principal);
                 // [900]①/[906]③ detach 车道逐事件落账:sync 腿历史上只 createRun+setTerminal(events 账本恒空,
                 // detach 后壳只能轮询终局)。opt-in 车道把 for-await 的每个事件喂给与 bg 腿(runs.ts)共享的
                 // LedgerSink(src/trace/ledger-sink.ts —— 单一 switch,落账 type/data 形状与 GET /v1/runs/:id/events
@@ -815,9 +825,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     const askOwner = gatedPrincipal(req, deps.config) ?? null;
                     const emitAsk = (frame) => {
                         // #157(codex R2 复审 HIGH):流已断时这里是**静默 no-op** —— 上游 coordinator 的 try/catch
-                        // 因此拿不到任何信号,一次断连就被记成"投递成功",问题挂到 TTL 才按无人应答结算。方向本批
-                        // 不动(改成 throw 是既有的刻意决定,见下面 drain 包装处的注释),但**必须留痕**:否则
-                        // `open-frame-undelivered` 只覆盖"持久化抛错",覆盖不到真正常见的那条路。
+                        // 因此拿不到任何信号,一次断连就被记成"投递成功",该 ask 挂到 TTL 才按无人应答结算。当时
+                        // 方向不动,但**必须留痕**:否则 `open-frame-undelivered` 只覆盖"持久化抛错",覆盖不到真正
+                        // 常见的那条路。
+                        // ⚠️ **question 半场已在 #173 换了方向**(a318fa1):question / question_complete 两型帧改走
+                        // 下方 `emitQuestion` 的断流 THROW,于是它们**到不了**本 no-op 臂(两道守卫同步相邻、其间无
+                        // await);实测 park 墙钟 8002ms → <160ms。今天真正还落在这条静默臂上的只有 elicitation 族
+                        // 与其它运行流帧。别再据本段把 question 的 TTL 悬挂当作现行行为。
                         // `destroyed` 与 `writableEnded` 一起判——emitApproval 用的就是这对谓词。
                         // 分类按帧型走(`failOpenTagForDroppedFrame`):这条闭包同时驮着 open 帧、完成面包屑与
                         // 其它运行流帧,一刀切会让**一次**断连把保护型计数记两次,真 open 失败率被面包屑盖住。
@@ -832,13 +846,18 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     // runId). `askOwner` = the VERIFIED principal → only this caller's own completions are emitted.
                     // 🔒 THROW on a dead/ended stream instead of emitAsk's silent no-op (1.80 review: a disconnect
                     // between request-send and this drain made the two-phase ack a FALSE success — the entry was
-                    // removed with no frame ever written; throwing keeps it pending for the next leg). Only THIS
-                    // drain wrapper throws — the shared emitAsk (question/elicit frames) keeps its no-op semantics.
+                    // removed with no frame ever written; throwing keeps it pending for the next leg). This wrapper was
+                    // once the ONLY one that threw; since #173 (a318fa1) emitQuestion, emitApproval and writeLive all
+                    // throw on a dead stream too. Of the HITL family only ELICIT still rides emitAsk's no-op — but emitAsk
+                    // is NOT elicit-only: SendUserFile's `file_link` (below) and other runtime frames also write straight
+                    // through it, so its dead-stream drop surface is wider than the HITL lanes (file_link is covered by its
+                    // own durable twin, not by a throw).
                     // 🔴 drain 案: write these as ANONYMOUS `data:` frames, NOT emitAsk's NAMED
                     // `event: <type>` form — the run's own live-leg task_notification frames on this SAME connection
                     // are anonymous (L1392/L1474), so a shell parsing the default message channel silently never saw
-                    // a drained frame (the Monitor "park✓ drain✗" fingerprint). question/elicit stay on emitAsk
-                    // (their own established named-event contract).
+                    // a drained frame (the Monitor "park✓ drain✗" fingerprint). The HITL frames keep their own
+                    // established NAMED-event contract — elicit still writes straight through emitAsk, question rides
+                    // emitQuestion (same named-event write, one extra dead-stream guard in front, #173).
                     await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, prepared.spec.sessionId, askOwner, (frame) => {
                         if (closed || res.writableEnded || res.destroyed)
                             throw new Error("stream ended before the completion frame was written");
@@ -860,11 +879,26 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         : streamBody;
                     // #152 复审 A1:`deliverable` 是 durable 部署上 park-vs-live 判决的投递面谓词(见 question.ts 该键注)。
                     // 本腿的投递面就是这条 SSE 连接,而 ①b detach 车道下客户端断连**不 abort、不结束这条腿**——run 继续在
-                    // 本 runWithContext 作用域里跑,emitAsk 往已死 socket 写被静默丢弃(question 帧无 ledgerSink 双写)。
-                    // 谓词让判决面此时如实读作「无活流」⇒ durable park(运维可经 /decide 补答),而不是 allow 后挂满 ttl
-                    // 以空答喂模型。断连发生在判决之后的窗口仍落 ttl 空答(与 elicit/approval 同栏,各自 TTL 语义)。
+                    // 本 runWithContext 作用域里跑。谓词让判决面此时如实读作「无活流」⇒ durable park(运维可经 /decide
+                    // 补答),而不是 allow 后挂满 ttl。
+                    // #173([2937] test 墙钟反证定谳):question 开帧的 emit 不再共享 emitAsk 的静默 no-op——死流上
+                    // no-op = 开帧「假投递成功」,coordinator 等满 TTL 才以 unavailable 结算(实测 park 墙钟 ≈TTL,
+                    // 断连→ask 间隔拉到 15s 也一样:判决在 gate 时刻,而 gate 早已判过的窗口里 ask 只剩 emit 一道门)。
+                    // 收紧与 emitApproval 同形:断流 THROW ⇒ #166 的 delivery==="failed" 臂**立即** settle
+                    // unavailable,不再等满 TTL。
+                    // ⚠️ 收紧买到的是**结算速度**,不是可恢复性(2026-08-07 亲读 core 5.16 定):本闭包只在工具已
+                    // 执行时被调用,即 `createDurableQuestionGate` 已判 allow、core 已过 `suspendAsk` 挂起点 ⇒ 这一
+                    // 形落 `declined_unavailable` 自答续跑卡(赎回既有审批的腿返 isError),**不铸 checkpoint**。
+                    // 真正 park 的是判决时投递面就不可达的腿(`deliverable`/`hasLiveContext` 读 false ⇒ 门判 ask),
+                    // 它们根本走不到这里。别把两形写成一句。
+                    // elicitation 保持 no-op(其 decline 语义 fail-closed,#166 车登记另议)。
+                    const emitQuestion = (frame) => {
+                        if (res.writableEnded || res.destroyed)
+                            throw new Error("live stream ended — question frame undeliverable");
+                        emitAsk(frame);
+                    };
                     const withQuestion = () => deps.question
-                        ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitAsk, abortSignal: ac.signal, deliverable: () => !res.writableEnded && !res.destroyed }, withElicit)
+                        ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitQuestion, abortSignal: ac.signal, deliverable: () => !res.writableEnded && !res.destroyed }, withElicit)
                         : withElicit();
                     // [816]/[820]②: the live tool-approval context — SAME id/owner/emit/signal as question/elicit
                     // (nested ALS, each its own store). sessionId keys the "allow all edits this session" state.
@@ -874,8 +908,11 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     // 🔒 approval 帧不用共享 emitAsk 的静默 no-op 语义:res 已结束时 no-op = 卡「假投递成功」,
                     // coordinator 等满 TTL 落 deny —— G1 "unavailable"→park 腿在真 wiring 里就不可达(cross-review
                     // 抓获)。这里 THROW,coordinator 的 emit-catch 按「无活人可达」返 "unavailable"(durable 部署
-                    // park;非 durable 由 core fail-closed deny,行为不劣于旧 no-op)。仅 approval 帧收紧;question/
-                    // elicit 的共享 emitAsk 保持 no-op(它们各有 TTL/abort 语义,另议)。
+                    // park;非 durable 由 core fail-closed deny,行为不劣于旧 no-op)。
+                    // 当年本注写的「仅 approval 帧收紧」已被 #173 推进一格:question 帧此后与本臂**同形**收紧(见上面
+                    // `emitQuestion`)。**HITL 三族里**仍留在共享 emitAsk 静默 no-op 上的只有 elicitation(其 decline
+                    // 结算本身就是 fail-closed,收紧收益小,另议);emitAsk 本身还驮着 SendUserFile 的 `file_link` 等
+                    // 非 HITL 帧,那些不在本条收紧的辖域内(file_link 的补偿是它自己的 durable 双写,不是 throw)。
                     const emitApproval = (frame) => {
                         if (res.writableEnded || res.destroyed)
                             throw new Error("live stream ended — approval card undeliverable");

package/dist/http/routes/trace-usage.js

@@ -2,7 +2,7 @@ import { projectEvents, taskSummary, mapTraceEvent } from "../../trace/project.j
 import { projectArtifacts } from "../../trace/artifacts.js";
 import { usageSummary, usageSeries, usageBreakdown } from "../../usage-analytics.js";
 import { sleep } from "../sse-log.js";
-import { sendJson, sendError, sseHeaders } from "../send.js";
+import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal } from "../principal-gate.js";
 const TRACE_RE = /^\/v1\/tasks(?:\/([^/]+)(\/turns|\/stream|\/artifacts))?$/;
 export async function handleTraceUsage(req, res, url, ctx) {
@@ -248,7 +248,6 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
         closed = true;
     });
     const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
     let lastBeat = Date.now();
     const write = (events) => {
         for (const ev of events) {
@@ -272,14 +271,14 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
             break;
         }
-        if (Date.now() - start > MAX_MS) {
+        if (Date.now() - start > SSE_MAX_STREAM_MS) {
             // BL-16: the stream hit its 15-min cap but the RUN is still going — emit a terminal event so the client
             // can tell "reconnect to continue" from "task completed" (a silent close looked like completion).
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {
-            if (Date.now() - lastBeat > 15_000) {
+            if (Date.now() - lastBeat > SSE_HEARTBEAT_IDLE_MS) {
                 res.write(`event: heartbeat\ndata: {}\n\n`);
                 lastBeat = Date.now();
             }