@sema-agent/server 7.5.0 → 7.6.0

package/dist/http/routes/trace-usage.js

@@ -2,7 +2,7 @@ import { projectEvents, taskSummary, mapTraceEvent } from "../../trace/project.j
 import { projectArtifacts } from "../../trace/artifacts.js";
 import { usageSummary, usageSeries, usageBreakdown } from "../../usage-analytics.js";
 import { sleep } from "../sse-log.js";
-import { sendJson, sendError, sseHeaders } from "../send.js";
+import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal } from "../principal-gate.js";
 const TRACE_RE = /^\/v1\/tasks(?:\/([^/]+)(\/turns|\/stream|\/artifacts))?$/;
 export async function handleTraceUsage(req, res, url, ctx) {
@@ -248,7 +248,6 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
         closed = true;
     });
     const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
     let lastBeat = Date.now();
     const write = (events) => {
         for (const ev of events) {
@@ -272,14 +271,14 @@ async function streamTaskTrace(req, res, runStore, taskId, staleMs) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "WORKER_DOWN", message: "run stalled (instance lost?)" })}\n\n`);
             break;
         }
-        if (Date.now() - start > MAX_MS) {
+        if (Date.now() - start > SSE_MAX_STREAM_MS) {
             // BL-16: the stream hit its 15-min cap but the RUN is still going — emit a terminal event so the client
             // can tell "reconnect to continue" from "task completed" (a silent close looked like completion).
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "trace stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
             break;
         }
         if (events.length === 0) {
-            if (Date.now() - lastBeat > 15_000) {
+            if (Date.now() - lastBeat > SSE_HEARTBEAT_IDLE_MS) {
                 res.write(`event: heartbeat\ndata: {}\n\n`);
                 lastBeat = Date.now();
             }

package/dist/http/send.d.ts

@@ -9,6 +9,29 @@
  */
 import type { ServerResponse } from "node:http";
 export declare function sseHeaders(res: ServerResponse, extra?: Record<string, string>): void;
+/**
+ * 一条 SSE 连接的墙钟上限。到点发一帧 `error`/`STREAM_MAX_DURATION`(**不是**静默关闭 —— 客户端分不出
+ * 「到帽了请重连」和「跑完了」)然后收流。
+ *
+ * 🔴 为什么共享(2026-08-08,#176 二轮扫描 finding):这个数与下面的心跳间隔此前在**三处**各手抄一份
+ * —— `http/sse-log.ts`(task_run + image_bake 共用的那台泵)、`http/routes/trace-usage.ts`、
+ * `http/routes/approvals-assistant.ts`(它的顶注还自称「parity with streamTaskTrace」)。三处各自有测试
+ * 钉着**自己那一份**,没有任何跨副本的一致性钉 ⇒ 单边调帽后「parity」只剩注释里那句话。
+ *
+ * ⚠️ 改这个数请连**文案**一起改:三处的 `STREAM_MAX_DURATION` 消息里把「15-minute」写死在散文里
+ * (文案面另有 freeze 门,故此处不做插值——散文与常量的同步靠这行告诫,不靠机器)。
+ */
+export declare const SSE_MAX_STREAM_MS: number;
+/**
+ * 长时间无事件时的心跳间隔(防中继的 idle timeout 掐流)。与 {@link SSE_MAX_STREAM_MS} 同批收口。
+ *
+ * ⚠️ 收口的只有**间隔**,**不含帧形**:`sse-log` / `trace-usage` 发 `data: {}`,`approvals-assistant`
+ * 发 `data: {"type":"heartbeat"}`。这是真分歧不是笔误 —— trace-usage 自己的 meta 帧还引着 [2373]C-12
+ * 「每个 data payload 都带 type」的约定,而它的心跳帧没有 type(probe-sse-1 的注释把这条记成「按
+ * data.type 分派的客户端会拿到 undefined」)。统一帧形是**行为面**改动(要么给两处加 type=多发一个键,
+ * 要么给 approvals 减 type=消费端破坏),属候裁,不在本批的零行为码范围内。
+ */
+export declare const SSE_HEARTBEAT_IDLE_MS = 15000;
 export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
 /** A6(design/158 lens1 §C3/lens3 §C3a): canonical error-response sender for sites that already carry a
  *  machine `errorCode` — `errorCode` is a required positional arg (not optional-bag) so a call site

package/dist/http/send.js

@@ -6,6 +6,29 @@ export function sseHeaders(res, extra) {
         ...extra,
     });
 }
+/**
+ * 一条 SSE 连接的墙钟上限。到点发一帧 `error`/`STREAM_MAX_DURATION`(**不是**静默关闭 —— 客户端分不出
+ * 「到帽了请重连」和「跑完了」)然后收流。
+ *
+ * 🔴 为什么共享(2026-08-08,#176 二轮扫描 finding):这个数与下面的心跳间隔此前在**三处**各手抄一份
+ * —— `http/sse-log.ts`(task_run + image_bake 共用的那台泵)、`http/routes/trace-usage.ts`、
+ * `http/routes/approvals-assistant.ts`(它的顶注还自称「parity with streamTaskTrace」)。三处各自有测试
+ * 钉着**自己那一份**,没有任何跨副本的一致性钉 ⇒ 单边调帽后「parity」只剩注释里那句话。
+ *
+ * ⚠️ 改这个数请连**文案**一起改:三处的 `STREAM_MAX_DURATION` 消息里把「15-minute」写死在散文里
+ * (文案面另有 freeze 门,故此处不做插值——散文与常量的同步靠这行告诫,不靠机器)。
+ */
+export const SSE_MAX_STREAM_MS = 15 * 60 * 1000;
+/**
+ * 长时间无事件时的心跳间隔(防中继的 idle timeout 掐流)。与 {@link SSE_MAX_STREAM_MS} 同批收口。
+ *
+ * ⚠️ 收口的只有**间隔**,**不含帧形**:`sse-log` / `trace-usage` 发 `data: {}`,`approvals-assistant`
+ * 发 `data: {"type":"heartbeat"}`。这是真分歧不是笔误 —— trace-usage 自己的 meta 帧还引着 [2373]C-12
+ * 「每个 data payload 都带 type」的约定,而它的心跳帧没有 type(probe-sse-1 的注释把这条记成「按
+ * data.type 分派的客户端会拿到 undefined」)。统一帧形是**行为面**改动(要么给两处加 type=多发一个键,
+ * 要么给 approvals 减 type=消费端破坏),属候裁,不在本批的零行为码范围内。
+ */
+export const SSE_HEARTBEAT_IDLE_MS = 15_000;
 export function sendJson(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));

package/dist/http/server.d.ts

@@ -187,6 +187,10 @@ export interface ServiceCoordinatorDeps {
      *  (the live multi-row task/workflow fleet view: status/elapsed/tokens/doneCount transitions pushed over time).
      *  Present when wired in main.ts; the run + workflow lifecycle publish their per-row deltas to it. */
     fleetBus?: FleetEventBus;
+    /** [3193] 病理1:boot recover(判死前世 running 行并回灌 fleet)完成屏障——`/v1/fleet/stream` 快照组装
+     *  对它做**有界**等待(3s cap,routes/fleet.ts),SIGKILL 后壳重连不再与 recover 赛跑。缺席或已
+     *  resolve=立即组装(memory 后端、无 notify gate 的部署);main.ts 铸(recover 收官即落,失败也落)。 */
+    fleetRecoveryDone?: Promise<void>;
     /** [1196] session-watch registry(SSE 订阅共享探针面)。present ⇔ sessionStorage 有 getLeafId/ownerOf
      *  (main.ts 建);absent ⇒ /v1/sessions/:id/events 501(capabilities.sessionEvents 同谓词,永不漂)。 */
     sessionWatch?: import("../session-watch.js").SessionWatchRegistry;

package/dist/http/server.js

@@ -5,7 +5,7 @@ import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, Checkpoin
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
+import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
 import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
@@ -2813,7 +2813,10 @@ function cors(res, req, origins, principalHeader) {
     // 后五项都是**真被 handler 读**的自定义头:`idempotency-key`(tasks/runs/images)、
     // `x-detach-on-disconnect`(tasks 断连不中止)、direct-door 决策证明三件套(approvals /decide 的
     // crypto 绑定腿 —— 缺了它,direct-door worker 上的 web 审批面在浏览器里根本用不了)。
-    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, x-approval-principal-token, x-approval-mac, x-approval-mac-kid, if-none-match`);
+    res.setHeader("access-control-allow-headers", 
+    // direct-door 三件套用 security.ts 的具名导出插值(与同句的 `${principalHeader}` 同姿势)——手抄的
+    // 头名漏改在这一行是**静默**的:预检挡下 ⇒ 请求到不了 handler,任何一处都不会报错。
+    `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
     // 🔴 expose-headers 此前**整个缺席** ⇒ fetch 类客户端读不到 `X-Task-Id`(routes/tasks.ts 经 sseHeaders
     // 下发的 durable rewind handle)。tasks.ts 的 G15 meta 帧注释把这归因为「EventSource 与部分代理读不到
     // 响应头」—— 对 EventSource 成立,但对 fetch 客户端真因是这里缺 expose,meta 帧只是绕过。

package/dist/http/sse-log.js

@@ -1,4 +1,4 @@
-import { sendJson, sendError, sseHeaders } from "./send.js";
+import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "./send.js";
 /** #151 车3 §5.3:preamble 的**有界**等待上限。挂起的 store 不许拖住开流——开流是壳的主路径,
  *  而 preamble 只是一个锦上添花的对账基准。超时即按「无卡集基准」继续(与今天等同)。 */
 export const SSE_PREAMBLE_TIMEOUT_MS = 2_000;
@@ -83,7 +83,6 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         }
     }
     const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
     let lastBeat = Date.now();
     const write = (events) => {
         for (const ev of events) {
@@ -116,7 +115,7 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
             res.write(`event: ${sf.event}\ndata: ${JSON.stringify(sf.data)}\n\n`);
             break;
         }
-        if (Date.now() - start > MAX_MS) {
+        if (Date.now() - start > SSE_MAX_STREAM_MS) {
             // BL-16: cap reached but the run continues — emit a terminal reconnect signal (not a silent close, which
             // a client couldn't distinguish from a completed run). Distinct from the `failed`/`done` run events.
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
@@ -124,7 +123,7 @@ export async function streamSseLog(req, res, provider, id, staleMs) {
         }
         if (events.length === 0) {
             // Heartbeat during a long idle tail (e.g. a debate phase) so the relay's idle timeout doesn't fire.
-            if (Date.now() - lastBeat > 15_000) {
+            if (Date.now() - lastBeat > SSE_HEARTBEAT_IDLE_MS) {
                 res.write(`event: heartbeat\ndata: {}\n\n`);
                 lastBeat = Date.now();
             }

package/dist/leader/diffout.d.ts

@@ -38,6 +38,16 @@ export type PullDiffResult = {
     truncated?: boolean;
     exitCode?: number;
 };
+/**
+ * 一次 diff 的字节帽(pull 腿与 push/上行腿**共用同一个数**)。
+ *
+ * 🔴 exported 是判据的一部分(2026-08-08,#176 二轮扫描 finding):`diffup.ts` 原先另抄了一份同值常量,
+ * 而它**本就已经** `import { safeRev } from "./diffout.js"` —— 依赖边在,共享零成本。两份手抄的后果不是
+ * 「多写一行」,是**单边改值后上行/pull 两腿对同一个 diff 的过/拒判定分家**:同一份补丁在一条腿上过、
+ * 另一条腿上被截断,而两处都「按自己的常量」正确工作,没有任何一处会报错。
+ * (同族先例:`checkpoint-store-sql.ts` 的 `export const TERMINAL_GRACE_MS`。)
+ */
+export declare const DEFAULT_MAX_DIFF_BYTES: number;
 export declare function safeRev(rev: string): boolean;
 /**
  * Pull `<baseSha>..<ref>` from a worker container as a `git format-patch` series. Never throws — failures

package/dist/leader/diffout.js

@@ -1,6 +1,18 @@
-const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
+/**
+ * 一次 diff 的字节帽(pull 腿与 push/上行腿**共用同一个数**)。
+ *
+ * 🔴 exported 是判据的一部分(2026-08-08,#176 二轮扫描 finding):`diffup.ts` 原先另抄了一份同值常量,
+ * 而它**本就已经** `import { safeRev } from "./diffout.js"` —— 依赖边在,共享零成本。两份手抄的后果不是
+ * 「多写一行」,是**单边改值后上行/pull 两腿对同一个 diff 的过/拒判定分家**:同一份补丁在一条腿上过、
+ * 另一条腿上被截断,而两处都「按自己的常量」正确工作,没有任何一处会报错。
+ * (同族先例:`checkpoint-store-sql.ts` 的 `export const TERMINAL_GRACE_MS`。)
+ */
+export const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 const DEFAULT_READ_TIMEOUT_MS = 30_000;
-/** A safe git rev token: sha, branch/tag name, or `A..B`. No shell metacharacters, no leading dash. */
+/** A safe git rev token: sha, branch/tag name, or `A..B`. No shell metacharacters, no leading dash.
+ *  🔗 近亲判据:`leader/planner.ts` 的 branch 校验用同一套字符类 + 同一个 200 上限 + 同样拒前导 `-`,
+ *  只在 `..` 上有意分家(这里要放行 `A..B` 区间形,那边全拒)。差异与候裁说明写在 planner 那处
+ *  (#176 二轮扫描 finding)——单边加字符类成员时,请两处一起看。 */
 const SAFE_REV = /^[A-Za-z0-9._/-]{1,200}$/;
 export function safeRev(rev) {
     return SAFE_REV.test(rev) && !rev.startsWith("-") && !rev.includes("..--");

package/dist/leader/diffup.js

@@ -14,9 +14,10 @@
  * A worker that skips the upload surfaces as `{ok:false}` → merge quarantines it (honest failure, no hang).
  * pullDiff stays as the compat path for static (leader-owned) envs — M2 降兼容.
  */
-import { safeRev } from "./diffout.js";
+// 字节帽与 `safeRev` 同源取自 pull 腿(理由见 diffout.ts 的 DEFAULT_MAX_DIFF_BYTES 顶注:同值双抄一旦
+// 单边改值,上行/pull 两腿对同一个 diff 的过/拒判定就分家,且两边都「按自己的常量」静默正确)。
+import { safeRev, DEFAULT_MAX_DIFF_BYTES } from "./diffout.js";
 import { OBJECT_STORE_IO_TIMEOUT_MS } from "../plugins/blob-backend.js";
-const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 /** The staged upload script. `repoDir`/`workDir` are deployment config; `baseSha` is interpolated into a
  *  shell line, so it is re-validated HERE (fail-closed) — callers should already have applied diffout's
  *  safeRev rules, but this function is the last line before the shell. The patch is written OUTSIDE the repo

package/dist/leader/planner.js

@@ -91,6 +91,13 @@ export function validateSubtasks(arr, opts = {}) {
         const branch = typeof e.branch === "string" && e.branch.trim() ? e.branch.trim() : `worker/${workerId}`;
         // Reject a leading "-" (would be parsed as an option by `git checkout -b <branch>`), ".." (ref escape), and
         // an over-long ref (git rejects it anyway; cap keeps the value tidy). The char set is shell-safe.
+        //
+        // 🔗 近亲判据(2026-08-08,#176 二轮扫描 finding):`leader/diffout.ts` 的 `safeRev` 用**同一套**字符
+        // 类 `[A-Za-z0-9._/-]`、**同一个** 200 长度上限、**同样**拒前导 `-`。唯一的真差异在 `..`:safeRev 只拒
+        // `..--`(rev 要支持 `A..B` 区间形),这里全拒 `..`(branch **名**里 `..` 无合法用途,git 自己也拒)
+        // —— 是**有意收紧**,不是抄漏。两处此前零互指、无共享基元、无跨处钉;单边加一个字符类成员时另一边
+        // 不会有任何提示。是否抽一个共享基元(比如 `refToken(s, { allowRange })`)属结构面决定,候裁;本批
+        // 只把「近亲关系 + 差异所在」两侧成文。
         if (branch.length > 200 || !/^[A-Za-z0-9._/-]+$/.test(branch) || branch.startsWith("-") || branch.includes("..")) {
             throw new Error(`sub-task ${workerId}: invalid branch`);
         }

package/dist/main.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, combinePolicies, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
+import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend, describeStaticWiring } from "@sema-agent/core";
 import { createSessionTitler } from "./session-titler.js";
 import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
@@ -14,7 +14,7 @@ import { ensureChildSessionDurableWithPromotion } from "./plugins/session-store.
 import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js";
 import { webSearchConfigFromEnv, createWebSearchBackend, setWebSearchBadPayloadObserver, shouldProbeWebSearchOnBoot } from "./plugins/web-search.js";
 import { createAuthorizer, encodeCheckpointScope } from "./security.js";
-import { assertGateIntentServiceable, createDurableAskPolicy, hasOperatorGateIntent } from "./approval.js";
+import { assertGateIntentServiceable, hasOperatorGateIntent } from "./approval.js";
 import { loadSkills } from "./capabilities/skills.js";
 import { GiteaClient } from "./capabilities/repo-tools.js";
 import { buildScenarios, builtinScenarioDetails } from "./capabilities/scenarios.js";
@@ -38,7 +38,8 @@ import { createHookLlm } from "./hooks/hook-llm.js";
 import { startFleetClientFromEnv } from "./fleet-client.js";
 import { reclaimOrphansAtBoot } from "./boot-reclaim.js";
 import { createConfigCenterRuntime } from "./boot/config-center.js";
-import { createDurableQuestionGate, createResolveSpec } from "./boot/resolve-spec.js";
+import { createResolveSpec } from "./boot/resolve-spec.js";
+import { createParkedReviveInheritedGate } from "./boot/parked-revive-gate.js";
 import { startReapers } from "./boot/reapers.js";
 import { openStores } from "./boot/stores.js";
 import { createBudgetAndTracing } from "./boot/budget-tracing.js";
@@ -629,29 +630,12 @@ async function main() {
     // checkpointStore 同实例天然成立;per-request 项如 webSearch 对 revive 无关——objective 在 core
     // driveParkedResume 里被丢弃)。checkpointStore/agentStore 任一缺席 = park 本就不可达,分支不接线。
     const parkedReviveTool = checkpointStore && backgroundAgentStore ? scenarios.default?.({})?.tools.find((t) => t.name === "Agent") : undefined;
-    // [1596]/[1597] 跨进程父约束重供席工厂:host 任务的 toolPolicy 解析槽按部署配置**同参重建**
-    // (resolveSpec durableEnabled 分支的同款折叠:durableQuestion + durableAsk 四旋钮),单层链
-    // count=1,durableMandate=true(host 有 durableApproval 且 durable 车道无 live onAsk 的恒形)。
-    // exempt 探针锚 = row.rootSessionId——与 parked decide 的 remember grant 锚同键([1591] 候裁②),
-    // 重建链上的豁免语义与原链一致。重建不出(无 root 锚)= 不供席 = core pre-CAS 门诚实拒(现状)。
-    // #152 复审 A2:「同参重建」是本工厂自述的不变式,所以 question 门必须调 resolve-spec 的**同一个**
-    // 工厂并传同一个活体面,不能自折 core 原形——分腿改动只落一侧就是两份拷贝开始漂移的那一刻。
-    // 赎回腿今天无 question ALS ctx(/decide 路由触发,core driveParkedResume 内驱动)⇒ 判 ask,与原形同判。
+    // [1596]/[1597] 跨副本父约束重供席工厂:host 任务的 toolPolicy 解析槽按**当前**部署配置重建
+    // 「部署 ⊇ 操作员」两层完整链(design/181 件二收编;实现与全部理由在 boot/parked-revive-gate.ts,
+    // 提出去的唯一理由是 main.ts 顶层 `void main()` 让那条腿的运行期语义在原地一格都钉不住)。
+    // 构造条件逐字保持:裸 Agent 工具在场 ∧ 部署真开了 durable 审批。
     const parkedReviveInheritedGate = parkedReviveTool && config.durableApproval
-        ? (row) => ({
-            parentConstraints: [{
-                    policy: combinePolicies(createDurableQuestionGate(question), createDurableAskPolicy({
-                        requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
-                        ...(approvalExemptionStore && row.rootSessionId
-                            ? {
-                                exempt: (toolName) => approvalExemptionStore.has(row.rootSessionId, toolName),
-                                onExempted: (toolName, rawToolName) => logger.info("approval_exempted", { sessionId: row.rootSessionId, toolName, rawToolName, leg: "parked_revive" }),
-                            }
-                            : {}),
-                    })),
-                    durableMandate: true,
-                }],
-        })
+        ? createParkedReviveInheritedGate({ config, question, approvalExemptionStore, logger, localRoot })
         : undefined;
     // 场景详情:内建 details 必须在 overlay 合并【前】构建(探针要打纯内建工厂,不是被 center 顶掉的);
     // center details 随 overlay 同判定源盖同名——source 语义与 selectScenario 实际取用永一致(约定①)。
@@ -779,6 +763,10 @@ async function main() {
         // Undefined-safe: the env-only/no-backend worker 501s the routes.
         backend: backend ? backend : undefined,
     };
+    // [3193] 病理1:fleet 快照的 recovery 屏障(deferred 形,声明先于 deps 装配、落定在下方 recover 块——
+    // 对装配顺序鲁棒;无 notify gate 的部署在 recover 块 else 臂立即落)。
+    let resolveFleetRecovery;
+    const fleetRecoveryDone = new Promise((r) => { resolveFleetRecovery = r; });
     /** 进程内活体协调面(本副本 only,重启即空:HITL 协调器/可 steer 句柄注册表/总线/收件箱) */
     const coordinators = {
         elicitation: elicitation ? elicitation : undefined, // E23: live-only inbound-elicitation coordinator (respond route + ALS wraps)
@@ -788,6 +776,7 @@ async function main() {
         subagentSteerRegistry, // C2 (core 1.219): steerable Task-subagent handle registry (POST /v1/runs/:id/subagents/:target/steer)
         workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined, // P1 ①②: drain → workflow_complete frame on stream-open
         fleetBus,
+        fleetRecoveryDone, // [3193] 病理1:快照组装的有界等待信号(recover 块落定)
         // [1196] session 级 SSE 订阅:watch registry(N 订阅共享一条探针,自适应拍距,无订阅即停)。谓词与
         // /head 探针同门(getLeafId+ownerOf);缺 store 面不建=路由 501+capabilities.sessionEvents=false。
         sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined, // [1196] 建于 purgeSession 之前(delete 即 dropSession 的同副本围栏)
@@ -1040,10 +1029,17 @@ async function main() {
     // sweep throw is logged, never fatal.
     if (workflowNotifyGate) {
         // [2995]/[2999] opts 单点合成在 workflow-orchestration(可见性回灌 + replica-local 形 boot 孤儿判死)。
+        // [3193] 病理1:recover 收官(成败皆算)即落 fleet 快照屏障——「serving 不等 recovery」对**提交请求**
+        // 仍成立,但 fleet 快照组装现在对它做有界等待(routes/fleet.ts,3s cap):SIGKILL 后壳重连不再
+        // 与 boot 判死赛跑(cli [3193] 插桩实证的竞态)。
         void workflowNotifyGate
             .recover(workflowRecoverOpts)
             .then((tally) => logger.info("workflow_notify_recovered", tally))
-            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: String(err) }));
+            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: String(err) }))
+            .finally(() => resolveFleetRecovery());
+    }
+    else {
+        resolveFleetRecovery();
     }
     // design/158 A10:收尾段搬到 src/boot/shutdown.ts(逐字)。⚠️ 调用点必须留在 listen 之后 —— 位置即契约,
     // 理由(信号注册时点/三信号相对次序/clearInterval 先于 server.close)见该文件头注。

package/dist/observability/fail-open.d.ts

@@ -37,6 +37,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。";
     };
+    readonly "server.fleet.snapshot-terminal-window-unavailable": {
+        readonly cls: "F";
+        readonly note: "`/v1/fleet/stream` 连接时快照的**近期终态行窗**(#189:引擎重启后 boot 判死的 workflow 行,pull 自 durable store)读失败或超预算(2s)⇒ 本次快照少这几行历史。放行的最坏后果=面板首屏看不到刚结束的 workflow(与本修之前的行为等同,不是新损失);真源不受影响(`GET /v1/workflows` 照常)。方向刻意 fail-open:一次慢查询不该把整条 SSE 的握手拖住——少几行是难看,连不上流是坏掉。";
+    };
     readonly "server.fleet.subscriber-callback-threw": {
         readonly cls: "F";
         readonly note: "fleet bus 某订阅回调抛错 ⇒ 该回调本帧作废,其余订阅方与发布方不受影响。隔离是承重的:扇出同步,修前异常会传回发布方 put/update 投影点,core 持久化 catch{} 且不推进 storeRev ⇒ durable 行冻在 running 而 notify 已 ack(#183 复审 R3 HIGH)。丢的只是一个消费方的一帧渲染,故 F 类;但必须留痕——静默吞掉等于订阅方病灶永不显形。";

package/dist/observability/fail-open.js

@@ -60,6 +60,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "已验签的提示词工件回填本地缓存失败。工件本身已返回给调用方;代价是下次同 digest 还要再取一次网络。",
     },
+    "server.fleet.snapshot-terminal-window-unavailable": {
+        cls: "F",
+        note: "`/v1/fleet/stream` 连接时快照的**近期终态行窗**(#189:引擎重启后 boot 判死的 workflow 行,pull 自 durable store)读失败或超预算(2s)⇒ 本次快照少这几行历史。放行的最坏后果=面板首屏看不到刚结束的 workflow(与本修之前的行为等同,不是新损失);真源不受影响(`GET /v1/workflows` 照常)。方向刻意 fail-open:一次慢查询不该把整条 SSE 的握手拖住——少几行是难看,连不上流是坏掉。",
+    },
     "server.fleet.subscriber-callback-threw": {
         cls: "F",
         note: "fleet bus 某订阅回调抛错 ⇒ 该回调本帧作废,其余订阅方与发布方不受影响。隔离是承重的:扇出同步,修前异常会传回发布方 put/update 投影点,core 持久化 catch{} 且不推进 storeRev ⇒ durable 行冻在 running 而 notify 已 ack(#183 复审 R3 HIGH)。丢的只是一个消费方的一帧渲染,故 F 类;但必须留痕——静默吞掉等于订阅方病灶永不显形。",

package/dist/orchestration/workflow-notify-journal.d.ts

@@ -1,5 +1,5 @@
 import type { WorkflowRun, WorkflowRunStore, WorkflowRunStatus, WorkflowRunSummary } from "@sema-agent/core";
-import type { FleetEventBus } from "../fleet/fleet-bus.js";
+import { type FleetEventBus } from "../fleet/fleet-bus.js";
 /** A workflow completion notification's terminal payload — the bounded, redacted shape core's notifier seam
  *  carries, re-derivable from a durable {@link import("@sema-agent/core").WorkflowRun} on the recovery path. */
 export interface WorkflowCompletionPayload {

package/dist/orchestration/workflow-notify-journal.js

@@ -41,8 +41,8 @@
  */
 import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, closeSync } from "node:fs";
 import { join } from "node:path";
-import { deriveAgentDisplayStatus } from "@sema-agent/core";
-import { redactSecrets } from "../trace/redact.js";
+import { buildFleetWorkflowRow } from "../fleet/fleet-bus.js";
+import { isTerminalWorkflowRowStatus, seedTerminalWorkflowRow } from "../fleet/fleet-terminal-window.js";
 /** Build a bounded + redacted completion summary from a durable run's terminal state (the recovery path — the
  *  live path uses core's own `boundedSummary`). We never have the raw result here (the run store keeps the run,
  *  not the originator's payload), so we synthesize a conservative one: status + the run's already-bounded error.
@@ -500,43 +500,23 @@ export class JournalingWorkflowRunStore {
     publishFleet(id, run) {
         if (!this.fleetBus)
             return;
-        const agents = run.agents ?? [];
-        // [2336] doneCount 与 failedCount **不相交**:done 只数 completed。契约以此为前提(fleet-bus.ts
-        // startedCount 注的回退式 done+failed ≤ started);把 failed 也计进 done 会让全失败 workflow 的
-        // 终帧渲成 "N done"(cli 4.1.3 实测 done=2 failed=2 started=2)。
-        const done = agents.filter((a) => a.status === "completed").length;
-        const failed = agents.filter((a) => a.status === "failed").length;
-        // cli [1726] 二①:CC 规模告警的分母是 **started**(已启动),而 `totalCount`(= agents.length)是**计划总数**
-        // (含排队中)。判别口径走 core 导出的 `deriveAgentDisplayStatus` —— 一个 agent 已在 `run.agents` 里但
-        // `startedAt` 未置就是排队中。**不自己写 `startedAt !== undefined`**:那是 core 的显示契约,两端各写一遍
-        // 必然漂移(本仓刚在 coarse 门镜像上吃过同款),用它的函数则 core 一改、两端同时跟随。
-        const started = agents.filter((a) => deriveAgentDisplayStatus(a, run.status) !== "queued").length;
-        const terminal = run.status === "completed" || run.status === "failed";
+        // A-002.3(#194 病族 F1 同源性断裂):终态判据走 fleet-terminal-window 的共享谓词(其穷举表对
+        // core WorkflowRunStatus 编译期闭合)——此前手写两值比较是第二份独立定义,core 加终态词时穷举表
+        // 红、这里恒 false ⇒ 行既不 seed 进终态窗也不 removeWorkflow,面板留幽灵 running 行。
+        const terminal = isTerminalWorkflowRowStatus(run.status);
         // 撤行**不挂在发帧成功上**(复审第 2 轮 MEDIUM):「终态行必须离场」是不变量、发终帧是尽力而为。
         // try/finally ⇒ 发布本体抛错照样撤行(异常仍向上抛,不吞:吞了就是一条未登记的 fail-open 臂)。
         // 订阅方抛错已在 fleet bus 的 subscribe 隔离层被吞并记 fail-open——本 finally 守的是发布机器本身
         // 的抛错(理论缝级,fresh 复审盘点后判近死防御但保留:防未来发布本体改动回退)。两腿一处收口。
+        // 行投影本体 = {@link buildFleetWorkflowRow}(#189:快照的终态行窗与本写路径共用同一份投影,
+        // 单源不漂;本函数的发布/撤行语义逐字不变)。
+        // [3156] 轮2 修:终态行**写路径顺手 seed** 进程内终态窗缓存——重启-重连剧本里(boot recover 判死),
+        // fleetWide 连接的 durable pull 没有正确的查询键可用(caller principal ≠ 引擎铸行 scope),seed 是
+        // 唯一同源可达径。放在 publish 之前:seed 是纯内存 push,不会抛;终态行入窗与发帧同拍。
+        if (terminal)
+            seedTerminalWorkflowRow(buildFleetWorkflowRow(id, run));
         try {
-            this.fleetBus.publishWorkflow({
-                id,
-                // [WF2-A parity] redact the workflow label surfaces for parity with the run + subagent-child names (fleet-bus.ts):
-                // a tool-launched (LLM-authored) workflow's meta.name/description is task-controlled and could carry a secret shape.
-                name: redactSecrets(run.name ?? "Dynamic workflow"),
-                ...(run.description ? { description: redactSecrets(run.description) } : {}),
-                scope: run.scope,
-                // codex-6 F2:sessionId 必须随行——streamFleet 对无 sessionId 的行按「同 principal 全会话可见」
-                // 兜底,漏发=A 会话的 workflow 名/进度/token 泄进 B 会话的 ?session= 过滤流。
-                ...(run.originatingSessionId ? { sessionId: run.originatingSessionId } : {}),
-                status: run.status,
-                doneCount: done,
-                totalCount: agents.length,
-                failedCount: failed,
-                startedCount: started,
-                tokens: (run.stats?.tokens ?? 0) + (run.stats?.nested?.tokens ?? 0),
-                // [1294]:跑动中也带时长(1.232 只在 endedAt 后带——clay 验收轮实锚面板恒显 0s)。终态用
-                // endedAt 定格,活跑用 now-startedAt(每次 put/update 观察点刷新,壳侧读帧即当前时长)。
-                elapsedMs: (run.endedAt ?? Date.now()) - run.startedAt,
-            });
+            this.fleetBus.publishWorkflow(buildFleetWorkflowRow(id, run));
         }
         finally {
             if (terminal)

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -297,6 +297,39 @@ export declare const APPROVAL_BATCHES_TABLE = "approval_batches";
  *
  * SCHEMA POLICY 同 `tidb-pool.ts` 头注:纯 CREATE,禁 ALTER 增量 seam,改列直接改这里 + 重建库
  * (`docs/schema/baseline-mysql.sql` 是由这些文本机器录制出的**产物**,永不手改)。
+ *
+ * ── 列宽的**测量依据**(#192 A10;U2 逐列取证在档)──────────────────────────────────────────────────
+ * 本表家族原先一律 VARCHAR(255),是"先建表后想"的产物。按"每列的值到底由谁铸、有没有入口上限"重新裁:
+ *
+ *  收窄(有硬上限背书,证据即上限本身):
+ *   · `ask_id` / `batch_id` / `bound_ask_id` → 64:`deriveAskId`/`deriveBatchId` 恒是 sha256 hex 取前
+ *     64 字符(`approval-ask-machine.ts` deterministicId),按构造不可能更长。
+ *   · `task_id` → 64:入口 `UUIDV7_RE`(`security.ts:134`)只放行 36 字符的规范 uuidv7;与兄弟列
+ *     `task_run.task_id VARCHAR(64)` 同宽(此前 255 是本家族独有的偏离,无依据)。
+ *   · `session_id` → 64:提交入口硬拒 >64(`http/server.ts` "sessionId must be at most 64 characters"),
+ *     与 `session_meta`/`task_run` 同宽。
+ *   · `owner` → 190:`assertPrincipalShape` 的 `PRINCIPAL_MAX_LENGTH = 190`(`security.ts:350`)硬拒更长者;
+ *     全仓每一根 owner/scope 轴都是 190,此前 255 同样是无依据偏离。
+ *   · `gate_token` → 120:它抄的是 checkpoint 的 token(core `mintCheckpointToken` = 16 字节 hex = 32 字符),
+ *     取与**被抄那一列** `checkpoint.token VARCHAR(120)` 同宽 —— 同一个值在两张表上宽度必须一致,
+ *     否则抄的那一步就是一道静默截断。512 是原先的 16 倍冗余。
+ *
+ *  🔑 上面四条收窄之所以**不引入任何新暴露面**,靠的不是入口断言而是一条更硬的事实:同一个 session_id /
+ *     task_id / owner **早就**同时躺在 `session_meta.session_id VARCHAR(64)` / `task_run.task_id VARCHAR(64)` /
+ *     `task_run.owner VARCHAR(190)` 里。任何长到能撑爆本表新宽度的值,在写到那几张**更中心**的表时就已经
+ *     先炸了 —— 本表此前的 255 从来不是一道额外的安全余量,只是一处与全仓不一致的偏离。
+ *     ⇒ 收窄的风险上界 = 0;真正要担心的是反过来:留着 255 会让人误以为这里可以存更长的 id。
+ *
+ *  🔴 **刻意不收窄**(测量结果不支持,记在这里免得下一个人以为是漏了):
+ *   · `source_task_id` / `tool_call_id` / `parent_tool_call_id` / `gate_bound_call_id` —— 这四列的值是
+ *     **模型/引擎铸的原始 id**,服务端在写行这一步**没有任何长度断言**(`approval-card.ts` 的
+ *     `MAX_IDENT` 只裁了给人看的那份 card 投影,不是本列)。没有入口上限就收窄 = 把"存不下"这件事
+ *     推迟到 INSERT 才炸(MySQL 更糟:静默截断),换来的只是几十字节。要收窄,先补入口断言
+ *     (照 `assertPrincipalShape`/`assertIdempotencyKeyShape` 的姿势),那是另一件事。
+ *   · `bound_input_hash` / `gate_bound_input_hash` —— 按约定是 sha256 hex(64),但 `readBoundInputHash`
+ *     只校验"非空字符串",没校长度/字形 ⇒ 同上,先有断言再谈收窄。
+ *   · `idempotency_key` —— 255 **正是**入口断言的上限本身(zod `.max(255)` + 店内 `assertIdempotencyKeyShape`
+ *     双执法),宽度与上限同源,恰好正确,动它反而制造截断面。
  */
 export declare const TIDB_APPROVAL_ASK_STATEMENTS: readonly string[];
 /** {@link TIDB_APPROVAL_ASK_STATEMENTS} 的遍历壳——生产路径走 `tidb-pool.ts` 的中央 `ensureSchema`