@sema-agent/server 7.4.0 → 7.6.0

package/dist/http/send.d.ts

@@ -9,6 +9,29 @@
  */
 import type { ServerResponse } from "node:http";
 export declare function sseHeaders(res: ServerResponse, extra?: Record<string, string>): void;
+/**
+ * 一条 SSE 连接的墙钟上限。到点发一帧 `error`/`STREAM_MAX_DURATION`(**不是**静默关闭 —— 客户端分不出
+ * 「到帽了请重连」和「跑完了」)然后收流。
+ *
+ * 🔴 为什么共享(2026-08-08,#176 二轮扫描 finding):这个数与下面的心跳间隔此前在**三处**各手抄一份
+ * —— `http/sse-log.ts`(task_run + image_bake 共用的那台泵)、`http/routes/trace-usage.ts`、
+ * `http/routes/approvals-assistant.ts`(它的顶注还自称「parity with streamTaskTrace」)。三处各自有测试
+ * 钉着**自己那一份**,没有任何跨副本的一致性钉 ⇒ 单边调帽后「parity」只剩注释里那句话。
+ *
+ * ⚠️ 改这个数请连**文案**一起改:三处的 `STREAM_MAX_DURATION` 消息里把「15-minute」写死在散文里
+ * (文案面另有 freeze 门,故此处不做插值——散文与常量的同步靠这行告诫,不靠机器)。
+ */
+export declare const SSE_MAX_STREAM_MS: number;
+/**
+ * 长时间无事件时的心跳间隔(防中继的 idle timeout 掐流)。与 {@link SSE_MAX_STREAM_MS} 同批收口。
+ *
+ * ⚠️ 收口的只有**间隔**,**不含帧形**:`sse-log` / `trace-usage` 发 `data: {}`,`approvals-assistant`
+ * 发 `data: {"type":"heartbeat"}`。这是真分歧不是笔误 —— trace-usage 自己的 meta 帧还引着 [2373]C-12
+ * 「每个 data payload 都带 type」的约定,而它的心跳帧没有 type(probe-sse-1 的注释把这条记成「按
+ * data.type 分派的客户端会拿到 undefined」)。统一帧形是**行为面**改动(要么给两处加 type=多发一个键,
+ * 要么给 approvals 减 type=消费端破坏),属候裁,不在本批的零行为码范围内。
+ */
+export declare const SSE_HEARTBEAT_IDLE_MS = 15000;
 export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
 /** A6(design/158 lens1 §C3/lens3 §C3a): canonical error-response sender for sites that already carry a
  *  machine `errorCode` — `errorCode` is a required positional arg (not optional-bag) so a call site

package/dist/http/send.js

@@ -6,6 +6,29 @@ export function sseHeaders(res, extra) {
         ...extra,
     });
 }
+/**
+ * 一条 SSE 连接的墙钟上限。到点发一帧 `error`/`STREAM_MAX_DURATION`(**不是**静默关闭 —— 客户端分不出
+ * 「到帽了请重连」和「跑完了」)然后收流。
+ *
+ * 🔴 为什么共享(2026-08-08,#176 二轮扫描 finding):这个数与下面的心跳间隔此前在**三处**各手抄一份
+ * —— `http/sse-log.ts`(task_run + image_bake 共用的那台泵)、`http/routes/trace-usage.ts`、
+ * `http/routes/approvals-assistant.ts`(它的顶注还自称「parity with streamTaskTrace」)。三处各自有测试
+ * 钉着**自己那一份**,没有任何跨副本的一致性钉 ⇒ 单边调帽后「parity」只剩注释里那句话。
+ *
+ * ⚠️ 改这个数请连**文案**一起改:三处的 `STREAM_MAX_DURATION` 消息里把「15-minute」写死在散文里
+ * (文案面另有 freeze 门,故此处不做插值——散文与常量的同步靠这行告诫,不靠机器)。
+ */
+export const SSE_MAX_STREAM_MS = 15 * 60 * 1000;
+/**
+ * 长时间无事件时的心跳间隔(防中继的 idle timeout 掐流)。与 {@link SSE_MAX_STREAM_MS} 同批收口。
+ *
+ * ⚠️ 收口的只有**间隔**,**不含帧形**:`sse-log` / `trace-usage` 发 `data: {}`,`approvals-assistant`
+ * 发 `data: {"type":"heartbeat"}`。这是真分歧不是笔误 —— trace-usage 自己的 meta 帧还引着 [2373]C-12
+ * 「每个 data payload 都带 type」的约定,而它的心跳帧没有 type(probe-sse-1 的注释把这条记成「按
+ * data.type 分派的客户端会拿到 undefined」)。统一帧形是**行为面**改动(要么给两处加 type=多发一个键,
+ * 要么给 approvals 减 type=消费端破坏),属候裁,不在本批的零行为码范围内。
+ */
+export const SSE_HEARTBEAT_IDLE_MS = 15_000;
 export function sendJson(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));

package/dist/http/server.d.ts

@@ -187,6 +187,10 @@ export interface ServiceCoordinatorDeps {
      *  (the live multi-row task/workflow fleet view: status/elapsed/tokens/doneCount transitions pushed over time).
      *  Present when wired in main.ts; the run + workflow lifecycle publish their per-row deltas to it. */
     fleetBus?: FleetEventBus;
+    /** [3193] 病理1:boot recover(判死前世 running 行并回灌 fleet)完成屏障——`/v1/fleet/stream` 快照组装
+     *  对它做**有界**等待(3s cap,routes/fleet.ts),SIGKILL 后壳重连不再与 recover 赛跑。缺席或已
+     *  resolve=立即组装(memory 后端、无 notify gate 的部署);main.ts 铸(recover 收官即落,失败也落)。 */
+    fleetRecoveryDone?: Promise<void>;
     /** [1196] session-watch registry(SSE 订阅共享探针面)。present ⇔ sessionStorage 有 getLeafId/ownerOf
      *  (main.ts 建);absent ⇒ /v1/sessions/:id/events 501(capabilities.sessionEvents 同谓词,永不漂)。 */
     sessionWatch?: import("../session-watch.js").SessionWatchRegistry;
@@ -266,6 +270,11 @@ export interface ServiceSeamDeps {
      *  (MEMORY_ENGINE_BACKEND=pg|tidb); absent / file posture ⇒ 501 honestly (a single-user file plane
      *  IS the TOC side of a sync — it has no central-authority half to serve). */
     memorySync?: (scope: string, syncReq: MemorySyncRequest) => Promise<MemorySyncResponse>;
+    /** design/170 件A §7 —— org 记忆授权目录,`boot/org-memory.ts` 装配的**同一个实例**(准入 seam 与
+     *  本面共享它的 TTL 缓存/退避窗/gen 高水位)。memory-policy 面的 `org:` 属主门用它回答成员性:
+     *  读面要该 scope 在授权表里、写面另要条目 `write === true`。缺席=本部署没有目录源 ⇒ `org:` 键
+     *  逐字保持 operator-only(收编前行为),绝不因目录不接线而放宽。 */
+    orgMemoryDirectory?: import("../org-memory-admission.js").OrgMemoryDirectory;
     /** WEB-SETUP-RECON 附B — org sessionMirror 治理态的 SERVICE 半场 = **观测面(audit),非执法面**。
      *  裁定 (c):「该镜像而未镜像」发生在数据产生端(壳)——本 server 是镜像**目标**,只看得见到达的 push;
      *  没到达的会话对 server 不存在(无客户端会话清单、无心跳契约),required 锁的真执法只能在壳(CC

package/dist/http/server.js

@@ -5,7 +5,7 @@ import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, Checkpoin
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
+import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
@@ -1456,9 +1456,14 @@ export function createHttpServer(rawDeps) {
         //    "approve a content-ask with no answer" (runtask.js: `taskConfig.onQuestion ?? deps.onQuestion` is
         //    `undefined` or QUESTION_AWAITS_RESUME), but on an ASK_QUESTION_ENABLED deployment the spec no longer
         //    stamps the sentinel and `deps.onQuestion` is the coordinator, so core's condition is never met and it
-        //    does NOT refuse. Without the guard below the resume would execute the question on a leg with no live
-        //    context, take the coordinator's empty "no human" default, and consume the checkpoint. Do not delete it
-        //    on the belief that core still catches this (parked twin: src/parked-decide.ts).
+        //    does NOT refuse.
+        //    ⚠️ The ORIGINAL rationale — "the redeemed leg would take the coordinator's empty 'no human' default" —
+        //    is DISPROVED and must not be repeated: since #166 QuestionCoordinator never synthesizes an empty answer
+        //    set (every no-human arm returns `{kind:"unavailable"}`), and core 5.16 answers a redeemed AskUserQuestion
+        //    with an isError ("will not silently self-answer") rather than a fabricated verdict. The guard STAYS on a
+        //    cheaper rationale: the checkpoint is consumed by the CAS BEFORE that revive can report unavailable, so
+        //    the operator loses the parked question for a revive that could only fail — refusing pre-CAS costs nothing
+        //    and gives a precise error. Do not delete it (parked twin: src/parked-decide.ts, same rationale).
         //  - an answer is only meaningful on an approve of a question gate; on a deny or a non-question gate it
         //    signals the operator is deciding a different pending action than the one parked — reject, don't guess.
         if (decision === "approve" && pendingTool === "AskUserQuestion" && !answer) {
@@ -1627,14 +1632,7 @@ export function createHttpServer(rawDeps) {
         // un-cancellable (cancel 202'd + flagged the row, but nothing honored it). markResuming reset the flag,
         // so only a cancel issued DURING this leg aborts it.
         const cancelCtrl = new AbortController();
-        // stoppedBy — resume leg NOW marked (core 1.256 delivered the mark-by-owner seam): on this
-        // leg core's canonical taskId == sessionId (the rebuilt taskConfig carries no spec.taskId), so a
-        // task-scoped child's owner KEY VALUE coincides with a session-scoped child's — the old `list()` path
-        // couldn't tell them apart (no sessionScoped flag exposed) and took an honest degrade. The seam filters
-        // by the EXPLICIT flag (`skipSessionScoped:true` inside the helper), so only task-scoped children take
-        // the "user" marker; session-scoped ones a cancelled parent deliberately does NOT stop stay unmarked
-        // (CC Backgrounded semantics). Owner = sessionId (this leg's canonical key), NOT the run-row taskId.
-        markChildrenStoppedByUserOnAbort(cancelCtrl.signal, sessionId, principal);
+        // 🔴 stoppedBy 归因的注册点在**下面**(markResuming 认领成功之后),不在这里 —— #168 件3,见那里的注。
         // design/80 seam #2: a resumed leg is itself preempt-able. Register a FRESH preempt controller (markResuming
         // also reset preempt_requested), thread a LIVE preemptSignal into the resume taskConfig below, and poll the
         // durable preempt flag in the heartbeat — so the scheduler can preempt the RESUMED work once it makes
@@ -1648,6 +1646,19 @@ export function createHttpServer(rawDeps) {
             claimedRow = await deps.runStore.markResuming(taskId);
             if (!claimedRow)
                 return { status: 409, body: { error: "run is not in a resumable (suspended) state (already resumed, decided, or expired)", errorCode: "conflict.not_resumable" } };
+            // stoppedBy — resume leg NOW marked (core 1.256 delivered the mark-by-owner seam): on this
+            // leg core's canonical taskId == sessionId (the rebuilt taskConfig carries no spec.taskId), so a
+            // task-scoped child's owner KEY VALUE coincides with a session-scoped child's — the old `list()` path
+            // couldn't tell them apart (no sessionScoped flag exposed) and took an honest degrade. The seam filters
+            // by the EXPLICIT flag (`skipSessionScoped:true` inside the helper), so only task-scoped children take
+            // the "user" marker; session-scoped ones a cancelled parent deliberately does NOT stop stay unmarked
+            // (CC Backgrounded semantics). Owner = sessionId (this leg's canonical key), NOT the run-row taskId.
+            //
+            // 🔴 位置(#168 件3,与 /v1/tasks/stream 同族):归因规则只有**抢到这条 run 的腿**才有资格挂 ——
+            // `markResuming` 输掉的那一支(别的副本已经在 resume,或行已被 reap)在上面就 409 走人,从此一次
+            // 都不注册。本腿此前把它挂在 CAS 之前,只是因为 `cancelCtrl` 的唯一 abort 源(inflightRuns / 心跳
+            // 轮询)也都在 CAS 之后注册才没出事 —— 那是巧合不是保证。
+            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, sessionId, principal);
             // MF-Fleet (#7): the row is now `running` again → re-publish it LIVE to the fleet (re-appears as the same row
             // that was sitting "waiting" while parked). After onStart only — never if markResuming lost the CAS (a sibling
             // owns the row). onTerminal at every settle below keeps the row's lifecycle in lock-step with the run-store row.
@@ -1952,7 +1963,7 @@ export function createHttpServer(rawDeps) {
                             case "wiring_manifest":
                                 await flush();
                                 await append("wiring_manifest", wiringManifestEventData(ev));
-                                break; // 🔴 core 5.14.0 design/173:resume 腿自证清单(每条腿发自己那份)。**同一个**构造器剥 `governance` 段(audience:"operator",no projection ⇒ do not disclose)——三腿同源,分头挑键即下一次泄露
+                                break; // 🔴 core 5.14.0 design/173:resume 腿自证清单(每条腿发自己那份)。本腿与 durable 账本腿共用**同一个**租户面构造器,剥 `governance` 段(audience:"operator",no projection ⇒ do not disclose)——账本写时不知道未来读者是谁,存全量 = 把 operator-only 面写进租户可读介质。⚠️ 「三腿同源」自 #154 件一起不再成立:live sync 腿(routes/tasks.ts)按连接身份分叉,operator 连接走 `wiringManifestOperatorEventData`。所以判据是「**durable 两腿恒剥、live 腿按身份分叉**」,不是「分头挑键即泄露」——别照旧注把已落地的 operator 面当泄露删掉,也别给第四条腿抄错构造器:先问这条腿知不知道读者是谁
                             case "human_input":
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
@@ -2802,7 +2813,10 @@ function cors(res, req, origins, principalHeader) {
     // 后五项都是**真被 handler 读**的自定义头:`idempotency-key`(tasks/runs/images)、
     // `x-detach-on-disconnect`(tasks 断连不中止)、direct-door 决策证明三件套(approvals /decide 的
     // crypto 绑定腿 —— 缺了它,direct-door worker 上的 web 审批面在浏览器里根本用不了)。
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid, if-none-match`);
+    res.setHeader("access-control-allow-headers", 
+    // direct-door 三件套用 security.ts 的具名导出插值(与同句的 `${principalHeader}` 同姿势)——手抄的
+    // 头名漏改在这一行是**静默**的:预检挡下 ⇒ 请求到不了 handler,任何一处都不会报错。
+    `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
     // 🔴 expose-headers 此前**整个缺席** ⇒ fetch 类客户端读不到 `X-Task-Id`(routes/tasks.ts 经 sseHeaders
     // 下发的 durable rewind handle)。tasks.ts 的 G15 meta 帧注释把这归因为「EventSource 与部分代理读不到
     // 响应头」—— 对 EventSource 成立,但对 fetch 客户端真因是这里缺 expose,meta 帧只是绕过。

package/dist/http/sse-log.js

@@ -1,4 +1,4 @@
-import { sendJson, sendError, sseHeaders } from "./send.js";
+import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "./send.js";
 /** #151 车3 §5.3:preamble 的**有界**等待上限。挂起的 store 不许拖住开流——开流是壳的主路径,
  *  而 preamble 只是一个锦上添花的对账基准。超时即按「无卡集基准」继续(与今天等同)。 */
 export const SSE_PREAMBLE_TIMEOUT_MS = 2_000;
@@ -83,7 +83,6 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         }
     }
     const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
     let lastBeat = Date.now();
     const write = (events) => {
         for (const ev of events) {
@@ -116,7 +115,7 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
             res.write(`event: ${sf.event}\ndata: ${JSON.stringify(sf.data)}\n\n`);
             break;
         }
-        if (Date.now() - start > MAX_MS) {
+        if (Date.now() - start > SSE_MAX_STREAM_MS) {
             // BL-16: cap reached but the run continues — emit a terminal reconnect signal (not a silent close, which
             // a client couldn't distinguish from a completed run). Distinct from the `failed`/`done` run events.
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
@@ -124,7 +123,7 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         }
         if (events.length === 0) {
             // Heartbeat during a long idle tail (e.g. a debate phase) so the relay's idle timeout doesn't fire.
-            if (Date.now() - lastBeat > 15_000) {
+            if (Date.now() - lastBeat > SSE_HEARTBEAT_IDLE_MS) {
                 res.write(`event: heartbeat\ndata: {}\n\n`);
                 lastBeat = Date.now();
             }

package/dist/http/wire-types.d.ts

@@ -235,8 +235,13 @@ export interface TaskRequestBody {
      *  后下一轮把占位符换成真 schema。
      *  为什么要上 wire:cli 的 #181 取证表明,忠实跟随广告 schema 解码的 provider(openai-completions 车道)
      *  在 `static` 下会**无界循环** —— 每轮发 `{}` → invalidArgumentsRejection → 下一轮广告仍空,纠错回路
-     *  结构上无效。core 的缺省是 `spec.toolMaterializeStrategy ?? env ?? "static"`,进程级 env 说不了
-     *  「每个模型」的话(模型目录车道 per-model api 可混),所以必须有一个**按任务**的位子。
+     *  结构上无效。core 的缺省链是 `spec.toolMaterializeStrategy ?? env ?? <core 缺省>`,而**进程级 env 说不了
+     *  「每个模型」的话**(模型目录车道 per-model api 可混),所以必须有一个**按任务**的位子——这条理由与
+     *  core 缺省是哪个词无关,故不随其变。
+     *  ⚠️ core 缺省本身已翻:5.15.0 BREAKING 起 `<core 缺省>` = **`"swap"`**(5.14 世代是 `"static"`;
+     *  core 把 `"static"` 重新定性为「a strict explicit opt-in」)。本注上一版还写着 `?? "static"`,照它推
+     *  「不挂键 ⇒ 落 static」会反。缺省词的属主是 core,本仓不复述第二份——要确认取值去读 core 的
+     *  `prepare-task` 与其 CHANGELOG。
      *  缺省不挂键(交给 core 的 env/缺省链);未知词 400 fail-loud(与 promptProfile/permissionMode 同姿势 ——
      *  静默折缺省会让调用方以为切了策略却没切)。 */
     toolMaterializeStrategy?: "static" | "swap";

package/dist/leader/diffout.d.ts

@@ -38,6 +38,16 @@ export type PullDiffResult = {
     truncated?: boolean;
     exitCode?: number;
 };
+/**
+ * 一次 diff 的字节帽(pull 腿与 push/上行腿**共用同一个数**)。
+ *
+ * 🔴 exported 是判据的一部分(2026-08-08,#176 二轮扫描 finding):`diffup.ts` 原先另抄了一份同值常量,
+ * 而它**本就已经** `import { safeRev } from "./diffout.js"` —— 依赖边在,共享零成本。两份手抄的后果不是
+ * 「多写一行」,是**单边改值后上行/pull 两腿对同一个 diff 的过/拒判定分家**:同一份补丁在一条腿上过、
+ * 另一条腿上被截断,而两处都「按自己的常量」正确工作,没有任何一处会报错。
+ * (同族先例:`checkpoint-store-sql.ts` 的 `export const TERMINAL_GRACE_MS`。)
+ */
+export declare const DEFAULT_MAX_DIFF_BYTES: number;
 export declare function safeRev(rev: string): boolean;
 /**
  * Pull `<baseSha>..<ref>` from a worker container as a `git format-patch` series. Never throws — failures

package/dist/leader/diffout.js

@@ -1,6 +1,18 @@
-const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
+/**
+ * 一次 diff 的字节帽(pull 腿与 push/上行腿**共用同一个数**)。
+ *
+ * 🔴 exported 是判据的一部分(2026-08-08,#176 二轮扫描 finding):`diffup.ts` 原先另抄了一份同值常量,
+ * 而它**本就已经** `import { safeRev } from "./diffout.js"` —— 依赖边在,共享零成本。两份手抄的后果不是
+ * 「多写一行」,是**单边改值后上行/pull 两腿对同一个 diff 的过/拒判定分家**:同一份补丁在一条腿上过、
+ * 另一条腿上被截断,而两处都「按自己的常量」正确工作,没有任何一处会报错。
+ * (同族先例:`checkpoint-store-sql.ts` 的 `export const TERMINAL_GRACE_MS`。)
+ */
+export const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 const DEFAULT_READ_TIMEOUT_MS = 30_000;
-/** A safe git rev token: sha, branch/tag name, or `A..B`. No shell metacharacters, no leading dash. */
+/** A safe git rev token: sha, branch/tag name, or `A..B`. No shell metacharacters, no leading dash.
+ *  🔗 近亲判据:`leader/planner.ts` 的 branch 校验用同一套字符类 + 同一个 200 上限 + 同样拒前导 `-`,
+ *  只在 `..` 上有意分家(这里要放行 `A..B` 区间形,那边全拒)。差异与候裁说明写在 planner 那处
+ *  (#176 二轮扫描 finding)——单边加字符类成员时,请两处一起看。 */
 const SAFE_REV = /^[A-Za-z0-9._/-]{1,200}$/;
 export function safeRev(rev) {
     return SAFE_REV.test(rev) && !rev.startsWith("-") && !rev.includes("..--");

package/dist/leader/diffup.js

@@ -14,9 +14,10 @@
  * A worker that skips the upload surfaces as `{ok:false}` → merge quarantines it (honest failure, no hang).
  * pullDiff stays as the compat path for static (leader-owned) envs — M2 降兼容.
  */
-import { safeRev } from "./diffout.js";
+// 字节帽与 `safeRev` 同源取自 pull 腿(理由见 diffout.ts 的 DEFAULT_MAX_DIFF_BYTES 顶注:同值双抄一旦
+// 单边改值,上行/pull 两腿对同一个 diff 的过/拒判定就分家,且两边都「按自己的常量」静默正确)。
+import { safeRev, DEFAULT_MAX_DIFF_BYTES } from "./diffout.js";
 import { OBJECT_STORE_IO_TIMEOUT_MS } from "../plugins/blob-backend.js";
-const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 /** The staged upload script. `repoDir`/`workDir` are deployment config; `baseSha` is interpolated into a
  *  shell line, so it is re-validated HERE (fail-closed) — callers should already have applied diffout's
  *  safeRev rules, but this function is the last line before the shell. The patch is written OUTSIDE the repo

package/dist/leader/planner.js

@@ -91,6 +91,13 @@ export function validateSubtasks(arr, opts = {}) {
         const branch = typeof e.branch === "string" && e.branch.trim() ? e.branch.trim() : `worker/${workerId}`;
         // Reject a leading "-" (would be parsed as an option by `git checkout -b <branch>`), ".." (ref escape), and
         // an over-long ref (git rejects it anyway; cap keeps the value tidy). The char set is shell-safe.
+        //
+        // 🔗 近亲判据(2026-08-08,#176 二轮扫描 finding):`leader/diffout.ts` 的 `safeRev` 用**同一套**字符
+        // 类 `[A-Za-z0-9._/-]`、**同一个** 200 长度上限、**同样**拒前导 `-`。唯一的真差异在 `..`:safeRev 只拒
+        // `..--`(rev 要支持 `A..B` 区间形),这里全拒 `..`(branch **名**里 `..` 无合法用途,git 自己也拒)
+        // —— 是**有意收紧**,不是抄漏。两处此前零互指、无共享基元、无跨处钉;单边加一个字符类成员时另一边
+        // 不会有任何提示。是否抽一个共享基元(比如 `refToken(s, { allowRange })`)属结构面决定,候裁;本批
+        // 只把「近亲关系 + 差异所在」两侧成文。
         if (branch.length > 200 || !/^[A-Za-z0-9._/-]+$/.test(branch) || branch.startsWith("-") || branch.includes("..")) {
             throw new Error(`sub-task ${workerId}: invalid branch`);
         }

package/dist/main.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, combinePolicies, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
+import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
 import { createSessionTitler } from "./session-titler.js";
 import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
@@ -14,7 +14,7 @@ import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { webSearchConfigFromEnv, createWebSearchBackend, setWebSearchBadPayloadObserver, shouldProbeWebSearchOnBoot } from "./plugins/web-search.js";
 import { createAuthorizer, encodeCheckpointScope } from "./security.js";
-import { assertGateIntentServiceable, createDurableAskPolicy, hasOperatorGateIntent } from "./approval.js";
+import { assertGateIntentServiceable, hasOperatorGateIntent } from "./approval.js";
 import { loadSkills } from "./capabilities/skills.js";
 import { GiteaClient } from "./capabilities/repo-tools.js";
 import { buildScenarios, builtinScenarioDetails } from "./capabilities/scenarios.js";
@@ -38,7 +38,8 @@ import { createHookLlm } from "./hooks/hook-llm.js";
 import { startFleetClientFromEnv } from "./fleet-client.js";
 import { reclaimOrphansAtBoot } from "./boot-reclaim.js";
 import { createConfigCenterRuntime } from "./boot/config-center.js";
-import { createDurableQuestionGate, createResolveSpec } from "./boot/resolve-spec.js";
+import { createResolveSpec } from "./boot/resolve-spec.js";
+import { createParkedReviveInheritedGate } from "./boot/parked-revive-gate.js";
 import { startReapers } from "./boot/reapers.js";
 import { openStores } from "./boot/stores.js";
 import { createBudgetAndTracing } from "./boot/budget-tracing.js";
@@ -184,7 +185,7 @@ async function main() {
     // baseline, so a task-hooks fold (resolveSpec) shadows neither.
     const deploymentHooks = toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics);
     // design/158 A10:workflow 编排面搬到 src/boot/workflow-orchestration.ts(逐字;构造次序契约见该文件头注)。
-    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
+    const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     // design/158 A10:活体协调器 + SendUserFile 工具面搬到 src/boot/coordinators.ts(逐字;durableEnabled 的
     // 「必须早于 runnerDeps 求值」次序契约见该文件头注)。
     const { elicitation, question, toolApproval, durableEnabled, streamApprovalGate, sendUserFileEmitter, sendFileLedger, sendUserFileToolSpec } = createLiveCoordinators({ config, logger, backend, sendUserFileTaskEnvs });
@@ -406,8 +407,15 @@ async function main() {
     // Finding #2 (edge case): the single-user auto-accept tool-policy BASELINE applies ONLY when the operator
     // expressed NO gate intent. If they SET approval flags (APPROVAL_REQUIRE/APPROVAL_DENY/DURABLE_APPROVAL) but no
     // backing store is wired (e.g. DB_BACKEND=local → no checkpointStore ⇒ durableEnabled
-    // false), that is a MISCONFIG — do NOT mask it with allow-all; leave toolPolicy undefined so core's UNGATED warning
-    // still surfaces it. So the baseline needs single-user turnkey ∧ zero expressed gate intent.
+    // false), that is a MISCONFIG — do NOT mask it with allow-all; leave toolPolicy undefined. So the baseline needs
+    // single-user turnkey ∧ zero expressed gate intent.
+    // 🔴 #177 后本段的**信号面**已换人(原文「so core's UNGATED warning still surfaces it」已过期):守卫集
+    // (SENSITIVE_WRITE_PATTERNS,缺省非空)现在从 governance 拍无条件铸一条 DENY 基线 ⇒ 缺省部署的
+    // `spec.toolPolicy` 恒在场 ⇒ core 的 `hasEffectAwareGate`(prepare-task,判据是 policyLayers.length>0)
+    // 恒为真,那条 UNGATED onError 不再触发。补偿件在 boot/resolve-spec.ts:同一形(durable 门关 ∧ 单用户
+    // 基线不适用 ∧ 守卫集开)在 boot 期发一次 `tool_policy_only_sensitive_baseline` warn,把「守卫段之外
+    // 无裁决」这件事按我们自己的话说出来。本行留 `undefined` 仍是对的(不拿 allow-all 掩盖 misconfig),
+    // 只是它不再是那条信号的产地。
     // 单源在 approval.ts(与 inv#2 同文件)—— 这里原是内联的三格枚举,漏了 approvalNeverAuto,详见该函数顶注。
     const operatorGateIntent = hasOperatorGateIntent(config);
     // D3-F1(全窗复审,HIGH):门意图已表达但唯一门形(durable)不可服务 ⇒ boot 拒启带双出路指引。
@@ -622,29 +630,12 @@ async function main() {
     // checkpointStore 同实例天然成立;per-request 项如 webSearch 对 revive 无关——objective 在 core
     // driveParkedResume 里被丢弃)。checkpointStore/agentStore 任一缺席 = park 本就不可达,分支不接线。
     const parkedReviveTool = checkpointStore && backgroundAgentStore ? scenarios.default?.({})?.tools.find((t) => t.name === "Agent") : undefined;
-    // [1596]/[1597] 跨进程父约束重供席工厂:host 任务的 toolPolicy 解析槽按部署配置**同参重建**
-    // (resolveSpec durableEnabled 分支的同款折叠:durableQuestion + durableAsk 四旋钮),单层链
-    // count=1,durableMandate=true(host 有 durableApproval 且 durable 车道无 live onAsk 的恒形)。
-    // exempt 探针锚 = row.rootSessionId——与 parked decide 的 remember grant 锚同键([1591] 候裁②),
-    // 重建链上的豁免语义与原链一致。重建不出(无 root 锚)= 不供席 = core pre-CAS 门诚实拒(现状)。
-    // #152 复审 A2:「同参重建」是本工厂自述的不变式,所以 question 门必须调 resolve-spec 的**同一个**
-    // 工厂并传同一个活体面,不能自折 core 原形——分腿改动只落一侧就是两份拷贝开始漂移的那一刻。
-    // 赎回腿今天无 question ALS ctx(/decide 路由触发,core driveParkedResume 内驱动)⇒ 判 ask,与原形同判。
+    // [1596]/[1597] 跨副本父约束重供席工厂:host 任务的 toolPolicy 解析槽按**当前**部署配置重建
+    // 「部署 ⊇ 操作员」两层完整链(design/181 件二收编;实现与全部理由在 boot/parked-revive-gate.ts,
+    // 提出去的唯一理由是 main.ts 顶层 `void main()` 让那条腿的运行期语义在原地一格都钉不住)。
+    // 构造条件逐字保持:裸 Agent 工具在场 ∧ 部署真开了 durable 审批。
     const parkedReviveInheritedGate = parkedReviveTool && config.durableApproval
-        ? (row) => ({
-            parentConstraints: [{
-                    policy: combinePolicies(createDurableQuestionGate(question), createDurableAskPolicy({
-                        requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
-                        ...(approvalExemptionStore && row.rootSessionId
-                            ? {
-                                exempt: (toolName) => approvalExemptionStore.has(row.rootSessionId, toolName),
-                                onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: row.rootSessionId, toolName, rawToolName, leg: "parked_revive" }),
-                            }
-                            : {}),
-                    })),
-                    durableMandate: true,
-                }],
-        })
+        ? createParkedReviveInheritedGate({ config, question, approvalExemptionStore, logger, localRoot })
         : undefined;
     // 场景详情:内建 details 必须在 overlay 合并【前】构建(探针要打纯内建工厂,不是被 center 顶掉的);
     // center details 随 overlay 同判定源盖同名——source 语义与 selectScenario 实际取用永一致(约定①)。
@@ -663,7 +654,7 @@ async function main() {
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
         rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap,
-        workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
+        workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
         backgroundAgentStore, mailboxStore, toolApproval,
         getRunDenySweep: () => runDenySweep,
     });
@@ -772,6 +763,10 @@ async function main() {
         // Undefined-safe: the env-only/no-backend worker 501s the routes.
         backend: backend ? backend : undefined,
     };
+    // [3193] 病理1:fleet 快照的 recovery 屏障(deferred 形,声明先于 deps 装配、落定在下方 recover 块——
+    // 对装配顺序鲁棒;无 notify gate 的部署在 recover 块 else 臂立即落)。
+    let resolveFleetRecovery;
+    const fleetRecoveryDone = new Promise((r) => { resolveFleetRecovery = r; });
     /** 进程内活体协调面(本副本 only,重启即空:HITL 协调器/可 steer 句柄注册表/总线/收件箱) */
     const coordinators = {
         elicitation: elicitation ? elicitation : undefined, // E23: live-only inbound-elicitation coordinator (respond route + ALS wraps)
@@ -781,6 +776,7 @@ async function main() {
         subagentSteerRegistry, // C2 (core 1.219): steerable Task-subagent handle registry (POST /v1/runs/:id/subagents/:target/steer)
         workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined, // P1 ①②: drain → workflow_complete frame on stream-open
         fleetBus,
+        fleetRecoveryDone, // [3193] 病理1:快照组装的有界等待信号(recover 块落定)
         // [1196] session 级 SSE 订阅:watch registry(N 订阅共享一条探针,自适应拍距,无订阅即停)。谓词与
         // /head 探针同门(getLeafId+ownerOf);缺 store 面不建=路由 501+capabilities.sessionEvents=false。
         sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined, // [1196] 建于 purgeSession 之前(delete 即 dropSession 的同副本围栏)
@@ -810,6 +806,10 @@ async function main() {
         memorySync: memoryExportBackend && memorySyncCursors
             ? (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq)
             : undefined,
+        // design/170 件A §7 收编:memory-policy 面的 `org:` 属主门与 core 准入 seam 读**同一个**目录实例
+        // (`createOrgMemoryAdmissionWiring` 的产物),两面因此共享 TTL 缓存/退避窗/gen 高水位 —— 一个进程
+        // 对「谁属于 org:acme」只有一个答案。缺席(无 center 且无 env 表)⇒ 策略面 `org:` 键仍 operator-only。
+        orgMemoryDirectory: orgMemoryAdmission.directory,
         // sessionMirror 观测面(server 非执法端,论证在 ServiceDeps.sessionMirrorRuling):
         // 与 executionRuling 同车同缓存(零额外 center RTT);无 center/dry-run ⇒ 不接线,观测面暗、零行为差。
         sessionMirrorRuling: principalCaps
@@ -1028,10 +1028,18 @@ async function main() {
     // blocked on it (recovery only re-fires completion notifications — independent of serving new requests). A
     // sweep throw is logged, never fatal.
     if (workflowNotifyGate) {
+        // [2995]/[2999] opts 单点合成在 workflow-orchestration(可见性回灌 + replica-local 形 boot 孤儿判死)。
+        // [3193] 病理1:recover 收官(成败皆算)即落 fleet 快照屏障——「serving 不等 recovery」对**提交请求**
+        // 仍成立,但 fleet 快照组装现在对它做有界等待(routes/fleet.ts,3s cap):SIGKILL 后壳重连不再
+        // 与 boot 判死赛跑(cli [3193] 插桩实证的竞态)。
         void workflowNotifyGate
-            .recover({ orphanGraceMs: config.workflowOrphanGraceMs })
+            .recover(workflowRecoverOpts)
             .then((tally) => logger.info("workflow_notify_recovered", tally))
-            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: String(err) }));
+            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: String(err) }))
+            .finally(() => resolveFleetRecovery());
+    }
+    else {
+        resolveFleetRecovery();
     }
     // design/158 A10:收尾段搬到 src/boot/shutdown.ts(逐字)。⚠️ 调用点必须留在 listen 之后 —— 位置即契约,
     // 理由(信号注册时点/三信号相对次序/clearInterval 先于 server.close)见该文件头注。

package/dist/observability/fail-open.d.ts

@@ -11,7 +11,7 @@ export interface FailOpenTagEntry {
 export declare const FAIL_OPEN_TAGS: {
     readonly "server.hitl.frame-undelivered-stream-closed": {
         readonly cls: "P-DEBT";
-        readonly note: "HITL 的 **open** 帧(question / elicitation)写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,问到 TTL 才按无人应答结算。方向(no-op 而非 throw)是既有的刻意决定,本条只保证它不再无声。";
+        readonly note: "HITL 的 **open** 帧写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,该 ask 挂到 TTL 才按无人应答结算。⚠️ #173 后 question 开帧改走断流 THROW(立即结算 unavailable),因此本 tag 在产的只剩 **elicitation** 一族——读计数时勿把它当作 question 的人在环缺口。no-op 而非 throw 对 elicitation 仍是既有的刻意决定,本条只保证它不再无声。";
     };
     readonly "server.stream.frame-dropped-stream-closed": {
         readonly cls: "F";
@@ -19,7 +19,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.question.open-frame-undelivered": {
         readonly cls: "P-DEBT";
-        readonly note: "AskUserQuestion 的 open 帧投递失败 ⇒ 按 headless 默认结算,模型不问人自己往下判。方向是刻意的产品姿态(绝不把 run 挂死),但一次投递故障确实让人在环这道门被跳过——记债,不当合法兜底。";
+        readonly note: "AskUserQuestion 的 open 帧投递失败 ⇒ 该问按 unavailable 结算(#166 前是合成空答)。⚠️ 本臂**恒在门判 allow 之后**(工具已在执行),core 已过挂起点 ⇒ 落点**不是 park**:普通腿发 declined_unavailable 自答续跑卡,赎回既有审批的腿返 isError(engine 拒绝自答)。也就是说这一形**不铸 checkpoint、不可恢复**,人在环这道门被一次投递故障真的跳过了(门判 allow 之前就不可达的那些腿走的是 durable park,不经本臂)。「绝不把 run 挂死」是刻意的产品姿态,但债要在遥测里显形——记债,不当合法兜底。";
     };
     readonly "server.elicitation.open-frame-undelivered": {
         readonly cls: "F";
@@ -37,6 +37,14 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。";
     };
+    readonly "server.fleet.snapshot-terminal-window-unavailable": {
+        readonly cls: "F";
+        readonly note: "`/v1/fleet/stream` 连接时快照的**近期终态行窗**(#189:引擎重启后 boot 判死的 workflow 行,pull 自 durable store)读失败或超预算(2s)⇒ 本次快照少这几行历史。放行的最坏后果=面板首屏看不到刚结束的 workflow(与本修之前的行为等同,不是新损失);真源不受影响(`GET /v1/workflows` 照常)。方向刻意 fail-open:一次慢查询不该把整条 SSE 的握手拖住——少几行是难看,连不上流是坏掉。";
+    };
+    readonly "server.fleet.subscriber-callback-threw": {
+        readonly cls: "F";
+        readonly note: "fleet bus 某订阅回调抛错 ⇒ 该回调本帧作废,其余订阅方与发布方不受影响。隔离是承重的:扇出同步,修前异常会传回发布方 put/update 投影点,core 持久化 catch{} 且不推进 storeRev ⇒ durable 行冻在 running 而 notify 已 ack(#183 复审 R3 HIGH)。丢的只是一个消费方的一帧渲染,故 F 类;但必须留痕——静默吞掉等于订阅方病灶永不显形。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;
@@ -46,6 +54,13 @@ export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;
  * 一刀切记同一个 tag 是错的:承载 HITL 帧的那条闭包同时驮着完成面包屑与其它运行流帧,于是**一次**
  * 断连会让保护型计数涨两次(open 一次、complete 又一次),真正的 open 失败率被面包屑的假阳性盖住。
  * 只有 open 帧是"人在环这道门被跳过"的证据,其余都是体验损失。
+ *
+ * ⚠️ **两条 question 臂在生产上已不可达**(#173 之后,2026-08-07):本函数唯一的生产调用点是
+ * `routes/tasks.ts` 的 `emitAsk` 断流臂,而 question 与 question_complete 两型帧都先过同文件
+ * `emitQuestion` 的断流守卫(两道守卫同步相邻、其间无 await)并在断流时 throw,永不抵达这里;另一条
+ * question 路(`runs.ts` 的 durable append)根本不经 emitAsk。在产的只剩 elicitation 族与 default。
+ * 两臂**保留不删**:它们是本映射的语义定义(单测直打的纯函数),elicit 侧若哪天照 question 收紧、或
+ * 新增第四条 emit 腿忘了守卫,留着的臂是正确落点而不是死码。读遥测时按上面这段判在产分布。
  */
 export declare function failOpenTagForDroppedFrame(frameType: string): FailOpenTag;
 /** {@link createFailOpenRecorder} 返回的活对象(有行为、有状态 ⇒ `create*` 而非 `build*`)。 */

package/dist/observability/fail-open.js

@@ -34,7 +34,7 @@ import { appendFileSync } from "node:fs";
 export const FAIL_OPEN_TAGS = {
     "server.hitl.frame-undelivered-stream-closed": {
         cls: "P-DEBT",
-        note: "HITL 的 **open** 帧(question / elicitation)写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,问到 TTL 才按无人应答结算。方向(no-op 而非 throw)是既有的刻意决定,本条只保证它不再无声。",
+        note: "HITL 的 **open** 帧写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,该 ask 挂到 TTL 才按无人应答结算。⚠️ #173 后 question 开帧改走断流 THROW(立即结算 unavailable),因此本 tag 在产的只剩 **elicitation** 一族——读计数时勿把它当作 question 的人在环缺口。no-op 而非 throw 对 elicitation 仍是既有的刻意决定,本条只保证它不再无声。",
     },
     "server.stream.frame-dropped-stream-closed": {
         cls: "F",
@@ -42,7 +42,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.question.open-frame-undelivered": {
         cls: "P-DEBT",
-        note: "AskUserQuestion 的 open 帧投递失败 ⇒ 按 headless 默认结算,模型不问人自己往下判。方向是刻意的产品姿态(绝不把 run 挂死),但一次投递故障确实让人在环这道门被跳过——记债,不当合法兜底。",
+        note: "AskUserQuestion 的 open 帧投递失败 ⇒ 该问按 unavailable 结算(#166 前是合成空答)。⚠️ 本臂**恒在门判 allow 之后**(工具已在执行),core 已过挂起点 ⇒ 落点**不是 park**:普通腿发 declined_unavailable 自答续跑卡,赎回既有审批的腿返 isError(engine 拒绝自答)。也就是说这一形**不铸 checkpoint、不可恢复**,人在环这道门被一次投递故障真的跳过了(门判 allow 之前就不可达的那些腿走的是 durable park,不经本臂)。「绝不把 run 挂死」是刻意的产品姿态,但债要在遥测里显形——记债,不当合法兜底。",
     },
     "server.elicitation.open-frame-undelivered": {
         cls: "F",
@@ -60,6 +60,14 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。",
     },
+    "server.fleet.snapshot-terminal-window-unavailable": {
+        cls: "F",
+        note: "`/v1/fleet/stream` 连接时快照的**近期终态行窗**(#189:引擎重启后 boot 判死的 workflow 行,pull 自 durable store)读失败或超预算(2s)⇒ 本次快照少这几行历史。放行的最坏后果=面板首屏看不到刚结束的 workflow(与本修之前的行为等同,不是新损失);真源不受影响(`GET /v1/workflows` 照常)。方向刻意 fail-open:一次慢查询不该把整条 SSE 的握手拖住——少几行是难看,连不上流是坏掉。",
+    },
+    "server.fleet.subscriber-callback-threw": {
+        cls: "F",
+        note: "fleet bus 某订阅回调抛错 ⇒ 该回调本帧作废,其余订阅方与发布方不受影响。隔离是承重的:扇出同步,修前异常会传回发布方 put/update 投影点,core 持久化 catch{} 且不推进 storeRev ⇒ durable 行冻在 running 而 notify 已 ack(#183 复审 R3 HIGH)。丢的只是一个消费方的一帧渲染,故 F 类;但必须留痕——静默吞掉等于订阅方病灶永不显形。",
+    },
 };
 /**
  * 断流丢帧该记哪个 tag —— **按帧型分类**,纯函数(与写流的那条闭包解耦,才单测得动)。
@@ -67,13 +75,20 @@ export const FAIL_OPEN_TAGS = {
  * 一刀切记同一个 tag 是错的:承载 HITL 帧的那条闭包同时驮着完成面包屑与其它运行流帧,于是**一次**
  * 断连会让保护型计数涨两次(open 一次、complete 又一次),真正的 open 失败率被面包屑的假阳性盖住。
  * 只有 open 帧是"人在环这道门被跳过"的证据,其余都是体验损失。
+ *
+ * ⚠️ **两条 question 臂在生产上已不可达**(#173 之后,2026-08-07):本函数唯一的生产调用点是
+ * `routes/tasks.ts` 的 `emitAsk` 断流臂,而 question 与 question_complete 两型帧都先过同文件
+ * `emitQuestion` 的断流守卫(两道守卫同步相邻、其间无 await)并在断流时 throw,永不抵达这里;另一条
+ * question 路(`runs.ts` 的 durable append)根本不经 emitAsk。在产的只剩 elicitation 族与 default。
+ * 两臂**保留不删**:它们是本映射的语义定义(单测直打的纯函数),elicit 侧若哪天照 question 收紧、或
+ * 新增第四条 emit 腿忘了守卫,留着的臂是正确落点而不是死码。读遥测时按上面这段判在产分布。
  */
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {
-        case "question":
+        case "question": // 见头注:#173 后生产不可达(emitQuestion 先 throw),保留为映射定义
         case "elicitation":
             return "server.hitl.frame-undelivered-stream-closed";
-        case "question_complete":
+        case "question_complete": // 同上,生产不可达
             return "server.question.complete-breadcrumb-dropped";
         case "elicitation_complete":
             return "server.elicitation.complete-breadcrumb-dropped";

package/dist/observability/prompt-manifest.d.ts

@@ -68,7 +68,11 @@ export declare function promptManifestRecordOf(e: {
         wireSchemaDigest: string;
     }>;
     /** core 5.15.0(#181,[2872] 提货②):deferred 工具的披露策略自证——{deferredTools(数), strategy
-     *  ("static"|"swap"), source(四值:spec/env/api-default/default)}。诊断三键(数+两闭集词,零内容)。 */
+     *  ("static"|"swap"), source(四值:`spec` / `env` / `default` / `degraded_no_direct_lane`)}。
+     *  诊断三键(数 + 两闭集词,零内容)。词表属主是 core(`core/trace.d.ts` 的 `source` 联合),本仓宽收
+     *  ⇒ 词错不会红,所以照抄时务必对表:`degraded_no_direct_lane` = 直呼车道联锁把 `static` 请求收窄成
+     *  `swap` 的那一格,正是运维最需要认出来的一格(本注上一版把它写成了不存在的 `api-default`,下游看板
+     *  照抄就会把真实的 degraded 读成未知词)。 */
     toolDisclosure?: {
         deferredTools: number;
         strategy: string;