@sema-agent/server 7.50.0 → 7.52.0

package/dist/tool-approval.js

@@ -6,7 +6,7 @@ import { hasBidiControls } from "./text-bidi.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, } from "./approval-card.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, } from "./approval-card.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
@@ -16,6 +16,12 @@ export function isApprovalGateKind(k) {
 export const APPROVAL_GATE_KINDS_SQL_IN = `(${APPROVAL_GATE_KINDS.map((k) => `'${k}'`).join(",")})`;
 const MAX_APPROVAL_ARGS_BYTES = 16384;
 const DEFAULT_APPROVAL_TTL_MS = 5 * 60_000;
+const DEFAULT_UNREACHED_ASK_TTL_MS = 60 * 60_000;
+const SUSPENDED_POLL_MAX_PER_TICK = 64;
+const SUSPENDED_POLL_BUDGET_MS = 5_000;
+const EDITED_DECISION_MARK_CAP_MS = 10_000;
+const ABANDONED_EDIT_TOMBSTONE_TTL_MS = 10 * 60_000;
+const ABANDONED_EDIT_TOMBSTONE_MAX = 256;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
 const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
@@ -35,6 +41,7 @@ function durableRuleMaterial(material) {
     }
     return { ruleCommand: material.command, ruleScopeRoot: material.scopeRoot ?? null };
 }
+export const ASK_DECISION_CONSUMER_ABSENT = "absent";
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
 const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
 const DURABLE_CALL_TIMEOUT_MS = 5_000;
@@ -203,12 +210,16 @@ export class ToolApprovalCoordinator {
     allowAllSessions = new Set();
     streams = new Map();
     ttlMs;
+    unreachedTtlMs;
     askStore;
     windowMarginMs;
     admitMaxPerTask;
     admitMaxPerOwner;
     admitByTask = new Map();
     admitByOwner = new Map();
+    suspendedPollOffset = 0;
+    editedDecisionsInFlight = new Map();
+    abandonedEditedDecisions = new Map();
     storeErrorWarned = false;
     storeErrorTally = 0;
     governanceAskMarks;
@@ -225,6 +236,7 @@ export class ToolApprovalCoordinator {
         this.ruleScopeRootFor = opts?.ruleScopeRootFor;
         this.governanceAskMarks = opts?.governanceAskMarks;
         this.ttlMs = opts?.ttlMs ?? DEFAULT_APPROVAL_TTL_MS;
+        this.unreachedTtlMs = opts?.unreachedTtlMs ?? DEFAULT_UNREACHED_ASK_TTL_MS;
         this.askStore = opts?.askStore;
         this.windowMarginMs = opts?.windowMarginMs ?? DEFAULT_WINDOW_MARGIN_MS;
         this.admitMaxPerTask = opts?.admitMaxPerTask ?? DEFAULT_ADMIT_MAX_PER_TASK;
@@ -427,6 +439,12 @@ export class ToolApprovalCoordinator {
             const row = await this.withStoreDeadline(this.askStore.getAsk(askId), "getAsk(expire-error-recovery)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
             if (row === null || row.state !== "DECIDED")
                 return undefined;
+            if (replayTerminalAskRow(row) === true && this.abandonedEditedDecisionPending(askId)) {
+                this.guardRowDerivedApprove(askId, true, "expire-error-recovery");
+                return undefined;
+            }
+            if (this.editedDecisionInFlight(askId))
+                return undefined;
             const replayed = replayTerminalAskRow(row);
             return typeof replayed === "boolean" ? replayed : undefined;
         }
@@ -435,6 +453,15 @@ export class ToolApprovalCoordinator {
             return undefined;
         }
     }
+    hasOtherSuspendedOwner(askId, self) {
+        if (askId === undefined)
+            return false;
+        for (const e of this.pendingByAskId.get(askId) ?? []) {
+            if (e !== self && e.suspended === true && e.settledOutcome === undefined)
+                return true;
+        }
+        return false;
+    }
     settleSameAskIdParkRoute(askId) {
         const entries = this.pendingByAskId.get(askId);
         if (!entries)
@@ -506,6 +533,10 @@ export class ToolApprovalCoordinator {
         const entries = this.pendingByAskId.get(askId);
         if (!entries)
             return { settled: 0 };
+        if (allowed && updatedInput === undefined) {
+            if (this.guardRowDerivedApprove(askId, true, "notify-external-decision") === "unavailable")
+                return { settled: 0 };
+        }
         let settled = 0;
         for (const entry of [...entries]) {
             entry.settle(allowed, allowed ? "allowed" : "denied", updatedInput);
@@ -572,33 +603,49 @@ export class ToolApprovalCoordinator {
         const ctx = this.als.getStore();
         if (!ctx)
             return this.unattendedOutcome();
-        return this.askBroadcast({ taskId: ctx.taskId, legKey: ctx.legKey ?? "", ...(ctx.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: ctx.legDeadlineMonotonic } : {}) }, [ctx], req, signal);
+        return this.askBroadcast({
+            taskId: ctx.taskId,
+            owner: ctx.owner,
+            ...(ctx.sessionId !== undefined ? { sessionId: ctx.sessionId } : {}),
+            legKey: ctx.legKey ?? "",
+            ...(ctx.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: ctx.legDeadlineMonotonic } : {}),
+        }, [ctx], req, signal);
     };
     boundAsk = (identity) => {
         return (req, signal) => {
             const set = this.streams.get(this.streamKey(identity.owner, identity.sessionId, identity.taskId));
             const live = set && set.size > 0 ? [...set] : [];
-            if (live.length === 0)
-                return Promise.resolve(this.unattendedOutcome());
-            return this.askBroadcast({ taskId: identity.taskId, legKey: identity.legKey ?? "", ...(identity.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: identity.legDeadlineMonotonic } : {}) }, live, req, signal);
+            return this.askBroadcast({
+                taskId: identity.taskId,
+                owner: identity.owner,
+                ...(identity.sessionId !== undefined ? { sessionId: identity.sessionId } : {}),
+                legKey: identity.legKey ?? "",
+                ...(identity.legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic: identity.legDeadlineMonotonic } : {}),
+            }, live, req, signal);
         };
     };
     async askBroadcast(origin, ctxs, req, signal) {
         if (signal?.aborted)
             return false;
         const aliveCtxs = ctxs.filter((c) => !c.abortSignal?.aborted);
-        if (aliveCtxs.length === 0)
-            return this.unattendedOutcome();
+        const reachability = aliveCtxs.length === 0 ? "unreached" : "reachable";
+        if (reachability === "unreached") {
+            const unattended = this.unattendedOutcome();
+            if (unattended === false)
+                return unattended;
+            if (!this.askStore)
+                return unattended;
+        }
         const primary = aliveCtxs[0];
-        const governanceForced = (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(primary.owner, primary.sessionId, origin.taskId))).isMarked(req.toolCallId);
+        const governanceForced = (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
         if (!governanceForced &&
             req.requiresRealApproval !== true &&
-            primary.sessionId &&
-            this.allowAllSessions.has(sessionAllowKey(primary.owner, primary.sessionId, sessionAllowCategory(req.toolName))) &&
+            origin.sessionId &&
+            this.allowAllSessions.has(sessionAllowKey(origin.owner, origin.sessionId, sessionAllowCategory(req.toolName))) &&
             (await this.sessionGrantUncontestedByRow(origin, req))) {
             return true;
         }
-        const releaseAdmission = this.admit(origin.taskId, primary.owner);
+        const releaseAdmission = this.admit(origin.taskId, origin.owner);
         if (!releaseAdmission) {
             defaultLogger.warn("approval admission gate: too many pending asks — routing to park", {
                 taskId: origin.taskId,
@@ -612,7 +659,7 @@ export class ToolApprovalCoordinator {
         const child = isChildAsk(req);
         const bounded = boundArgs(req.args);
         let effectiveGovernanceForced = governanceForced;
-        let ruleLaneMaterial = this.buildRuleLaneMaterial(req, primary.owner, governanceForced, primary.sessionId);
+        let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const frame = {
             type: "tool_approval",
             approvalId: id,
@@ -641,12 +688,14 @@ export class ToolApprovalCoordinator {
                 ? { persistedRuleShadowed: redactSecrets(req.persistedRuleShadowed).slice(0, MAX_RULE_TEXT_CHARS) }
                 : {}),
             ...(ruleLaneMaterial !== undefined ? { ruleOffers: ruleLaneMaterial.offers } : {}),
+            ...((a) => (a !== undefined ? { ruleOffersAbsence: a } : {}))(readRuleOffersAbsence(req)),
             ...((c) => (c !== undefined ? { probeCause: c } : {}))(readProbeCause(req)),
             ...((c) => (c !== undefined ? { ruleEvidence: c } : {}))(readRuleEvidence(req)),
             ...(bounded.omitted ? { argsOmitted: true } : { args: bounded.args }),
             ...(bounded.hasBidi || req.hasBidiControls === true ? { inputHasBidi: true } : {}),
         };
-        const effectiveWindowMs = effectiveAskWindowMs(this.ttlMs, this.windowMarginMs, origin.legDeadlineMonotonic, performance.now());
+        const windowBudgetMs = reachability === "unreached" ? this.unreachedTtlMs : this.ttlMs;
+        const effectiveWindowMs = effectiveAskWindowMs(windowBudgetMs, this.windowMarginMs, origin.legDeadlineMonotonic, performance.now());
         const expiresAtMs = Date.now() + effectiveWindowMs;
         let askId;
         let batchId;
@@ -676,8 +725,8 @@ export class ToolApprovalCoordinator {
                     askId,
                     taskId: origin.taskId,
                     sourceTaskId,
-                    sessionId: primary.sessionId ?? origin.taskId,
-                    owner: primary.owner,
+                    sessionId: origin.sessionId ?? origin.taskId,
+                    owner: origin.owner,
                     batchId,
                     toolCallId: req.toolCallId,
                     legKey,
@@ -695,13 +744,14 @@ export class ToolApprovalCoordinator {
                 });
                 if (existingOrCreated.row.state !== "STREAM_PENDING") {
                     releaseAdmission();
-                    const replayed = replayTerminalAskRow(existingOrCreated.row);
+                    const replayed = this.guardRowDerivedApprove(askId, replayTerminalAskRow(existingOrCreated.row), "ensure-ask-idempotent-replay");
                     if (replayed === true)
                         recordRowDerivedApproveReplay("ensure-ask-idempotent-replay");
                     return replayed === "unavailable" ? this.unattendedOutcome() : replayed;
                 }
                 const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.row.cardJson);
-                const sanePersistedDeadline = Number.isFinite(existingOrCreated.row.expiresAtMs) && existingOrCreated.row.expiresAtMs <= Date.now() + effectiveWindowMs + DURABLE_CALL_TIMEOUT_MS;
+                const maxMintableWindowMs = Math.max(effectiveWindowMs, this.unreachedTtlMs);
+                const sanePersistedDeadline = Number.isFinite(existingOrCreated.row.expiresAtMs) && existingOrCreated.row.expiresAtMs <= Date.now() + maxMintableWindowMs + DURABLE_CALL_TIMEOUT_MS;
                 if (!persistedEnvelope.success || !sanePersistedDeadline) {
                     this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope.success}, deadlineOk=${sanePersistedDeadline}, ` +
                         `origin=${existingOrCreated.inserted ? "row-this-call-just-inserted" : "row-hit-idempotently"})`), "ensureAsk(persisted-row-unusable)");
@@ -772,6 +822,10 @@ export class ToolApprovalCoordinator {
                     abandonedEnsure = true;
                     if (lateEnsuredAskId !== undefined)
                         voidAbandonedRow(lateEnsuredAskId);
+                    if (reachability === "unreached") {
+                        releaseAdmission();
+                        return this.unattendedOutcome();
+                    }
                 }
             }
         }
@@ -818,7 +872,7 @@ export class ToolApprovalCoordinator {
                 sig.removeEventListener("abort", fn);
             this.pending.delete(id);
             if (windowRouteUnavailable && askId !== undefined && batchId !== undefined && this.unattendedOutcome() !== false) {
-                this.recordParkTombstone(wireApprovalId, { askId, batchId, owner: primary.owner, parkedAtMs: Date.now() });
+                this.recordParkTombstone(wireApprovalId, { askId, batchId, owner: origin.owner, parkedAtMs: Date.now() });
                 parkRouted = true;
             }
             if (askId !== undefined) {
@@ -851,11 +905,11 @@ export class ToolApprovalCoordinator {
                         settle(false, "expired");
                         return;
                     }
-                    if (row.state === "STREAM_PENDING") {
+                    if (row.state === "STREAM_PENDING" || this.editedDecisionInFlight(pinnedAskId)) {
                         await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
                         continue;
                     }
-                    const outcome = replayTerminalAskRow(row);
+                    const outcome = this.guardRowDerivedApprove(pinnedAskId, replayTerminalAskRow(row), `converge:${where}`);
                     if (outcome === "unavailable") {
                         windowRouteUnavailable = true;
                         settle(false, "expired");
@@ -874,8 +928,15 @@ export class ToolApprovalCoordinator {
                     await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
                 }
             }
-            if (!done)
-                settle(false, "expired");
+            if (!done) {
+                if (this.editedDecisionInFlight(pinnedAskId)) {
+                    windowRouteUnavailable = true;
+                    settle(false, "expired");
+                }
+                else {
+                    settle(false, "expired");
+                }
+            }
         };
         const settleParkRouteIfUnsettled = (hostSettledBy) => {
             if (done)
@@ -937,6 +998,10 @@ export class ToolApprovalCoordinator {
                 settle(false, "expired");
                 return;
             }
+            if (this.hasOtherSuspendedOwner(askId, selfEntry)) {
+                settle(false, "expired");
+                return;
+            }
             try {
                 const won = await this.withStoreDeadline(this.askStore.transitionAsk(askId, "STREAM_PENDING", "VOID", { updatedAtMs: Date.now() }), "transitionAsk(cancel)", DURABLE_CALL_TIMEOUT_MS, (lateWon) => {
                     if (!lateWon)
@@ -991,11 +1056,11 @@ export class ToolApprovalCoordinator {
             settle,
             forceParkNow,
             settleParkRoute: () => settleParkRouteIfUnsettled(),
-            owner: primary.owner,
-            ctxTaskId: primary.taskId,
-            originCtx: primary,
-            ...(child ? { originTaskId: req.sourceTaskId } : { targetCtxs: new Set(aliveCtxs), onTargetGone }),
-            ...(primary.sessionId ? { sessionId: primary.sessionId } : {}),
+            owner: origin.owner,
+            ...(primary ? { ctxTaskId: primary.taskId, originCtx: primary } : {}),
+            ...(reachability === "unreached" ? { suspended: true } : {}),
+            ...(child ? { originTaskId: req.sourceTaskId } : primary ? { targetCtxs: new Set(aliveCtxs), onTargetGone } : {}),
+            ...(origin.sessionId ? { sessionId: origin.sessionId } : {}),
             toolName: req.toolName,
             registeredAtMs: Date.now(),
             expiresAtMs: persistedExpiresAtMs,
@@ -1045,7 +1110,7 @@ export class ToolApprovalCoordinator {
         const openByCtx = new Map(aliveCtxs.map((c) => [c, emitOne(c)]));
         const emitAllP = (async () => {
             const results = await Promise.all(openByCtx.values());
-            const anySucceeded = results.some((r) => r.legacy || r.card);
+            const anySucceeded = reachability === "unreached" || this.hasOtherSuspendedOwner(askId, selfEntry) || results.some((r) => r.legacy || r.card);
             if (!anySucceeded && !done) {
                 if (this.askStore && askId !== undefined && batchId !== undefined) {
                     try {
@@ -1580,14 +1645,168 @@ export class ToolApprovalCoordinator {
                 ...(e.sessionId !== undefined ? { sessionId: e.sessionId } : {}),
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
-                ...(e.originTaskId !== undefined ? { fromSubagent: true } : {}),
+                ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
             });
         }
         return rows;
     }
+    async pollSuspendedDecisions() {
+        const store = this.askStore;
+        if (!store)
+            return { polled: 0, settled: 0, backlog: 0, truncated: false };
+        const candidates = [];
+        const seen = new Set();
+        for (const entry of this.pending.values()) {
+            if (entry.suspended === true && entry.askId !== undefined && entry.settledOutcome === undefined && !seen.has(entry.askId)) {
+                seen.add(entry.askId);
+                candidates.push(entry.askId);
+            }
+        }
+        const start = candidates.length > 0 ? this.suspendedPollOffset % candidates.length : 0;
+        const ordered = [...candidates.slice(start), ...candidates.slice(0, start)];
+        const deadlineMs = Date.now() + SUSPENDED_POLL_BUDGET_MS;
+        let settled = 0;
+        let polled = 0;
+        let truncated = false;
+        for (const askId of ordered) {
+            if (polled >= SUSPENDED_POLL_MAX_PER_TICK || Date.now() >= deadlineMs) {
+                truncated = true;
+                break;
+            }
+            polled++;
+            this.suspendedPollOffset = start + polled;
+            let row;
+            try {
+                row = await this.withStoreDeadline(store.getAsk(askId), "getAsk(poll-suspended)", DURABLE_CONVERGE_READ_TIMEOUT_MS);
+            }
+            catch (err) {
+                this.noteStoreError(err, "getAsk(poll-suspended)");
+                continue;
+            }
+            if (row === null || row.state === "STREAM_PENDING")
+                continue;
+            if (this.editedDecisionInFlight(askId))
+                continue;
+            const outcome = replayTerminalAskRow(row);
+            if (outcome === "unavailable") {
+                const before = this.pendingByAskId.get(askId)?.size ?? 0;
+                this.settleSameAskIdParkRoute(askId);
+                settled += before;
+                continue;
+            }
+            if (typeof outcome !== "boolean")
+                continue;
+            const delivered = this.notifyExternalDecision(askId, outcome).settled;
+            if (outcome && delivered > 0)
+                recordRowDerivedApproveReplay("poll-suspended");
+            settled += delivered;
+        }
+        const backlog = Math.max(0, candidates.length - polled);
+        if (truncated) {
+            defaultLogger.warn("approval_suspended_poll_truncated", {
+                polled,
+                settled,
+                backlog,
+                maxPerTick: SUSPENDED_POLL_MAX_PER_TICK,
+                budgetMs: SUSPENDED_POLL_BUDGET_MS,
+                resumeFromOffset: this.suspendedPollOffset,
+            });
+        }
+        return { polled, settled, backlog, truncated };
+    }
+    liveConsumerCount(askId) {
+        let n = 0;
+        for (const e of this.pendingByAskId.get(askId) ?? [])
+            if (e.settledOutcome === undefined)
+                n++;
+        return n;
+    }
+    markEditedDecisionInFlight(askId) {
+        this.editedDecisionsInFlight.set(askId, (this.editedDecisionsInFlight.get(askId) ?? 0) + 1);
+        let released = false;
+        const drop = () => {
+            if (released)
+                return;
+            released = true;
+            clearTimeout(watchdog);
+            const n = (this.editedDecisionsInFlight.get(askId) ?? 1) - 1;
+            if (n <= 0)
+                this.editedDecisionsInFlight.delete(askId);
+            else
+                this.editedDecisionsInFlight.set(askId, n);
+        };
+        const watchdog = setTimeout(() => {
+            if (released)
+                return;
+            defaultLogger.warn("approval_edited_decision_mark_expired", { askId, capMs: EDITED_DECISION_MARK_CAP_MS });
+            this.abandonedEditedDecisions.set(askId, Date.now() + ABANDONED_EDIT_TOMBSTONE_TTL_MS);
+            if (this.abandonedEditedDecisions.size > ABANDONED_EDIT_TOMBSTONE_MAX) {
+                const oldest = this.abandonedEditedDecisions.keys().next();
+                if (!oldest.done)
+                    this.dropAbandonedEditTombstone(oldest.value, "capacity");
+            }
+            drop();
+        }, EDITED_DECISION_MARK_CAP_MS);
+        watchdog.unref?.();
+        return drop;
+    }
+    editedDecisionInFlightCount(askId) {
+        return this.editedDecisionsInFlight.get(askId) ?? 0;
+    }
+    editedDecisionInFlight(askId) {
+        return (this.editedDecisionsInFlight.get(askId) ?? 0) > 0;
+    }
+    abandonedEditedDecisionPending(askId) {
+        const until = this.abandonedEditedDecisions.get(askId);
+        if (until === undefined)
+            return false;
+        if (Date.now() > until) {
+            this.dropAbandonedEditTombstone(askId, "ttl");
+            return true;
+        }
+        return true;
+    }
+    guardRowDerivedApprove(askId, outcome, where) {
+        if (outcome !== true || askId === undefined)
+            return outcome;
+        if (!this.abandonedEditedDecisionPending(askId))
+            return outcome;
+        defaultLogger.warn("approval_row_derived_approve_parked_after_abandoned_edit", { askId, where });
+        this.settleSameAskIdParkRoute(askId);
+        return "unavailable";
+    }
+    dropAbandonedEditTombstone(askId, why) {
+        const stillWaiting = this.liveConsumerCount(askId);
+        if (stillWaiting > 0) {
+            defaultLogger.warn("approval_abandoned_edit_tombstone_dropped_parking_consumers", { askId, why, parked: stillWaiting });
+            this.settleSameAskIdParkRoute(askId);
+        }
+        this.abandonedEditedDecisions.delete(askId);
+    }
+    expireEditedDecisionMarkForTest(askId) {
+        this.abandonedEditedDecisions.set(askId, Date.now() + ABANDONED_EDIT_TOMBSTONE_TTL_MS);
+        this.editedDecisionsInFlight.delete(askId);
+    }
+    forceAbandonedEditTombstoneExpiryForTest(askId) {
+        if (!this.abandonedEditedDecisions.has(askId))
+            return;
+        this.abandonedEditedDecisions.set(askId, Date.now() - 1);
+        this.abandonedEditedDecisionPending(askId);
+    }
+    setAbandonedEditTombstoneDeadlineForTest(askId, atMs) {
+        if (this.abandonedEditedDecisions.has(askId))
+            this.abandonedEditedDecisions.set(askId, atMs);
+    }
     pendingCount() {
         return this.pending.size;
     }
+    suspendedCount() {
+        let n = 0;
+        for (const e of this.pending.values())
+            if (e.suspended === true)
+                n++;
+        return n;
+    }
     sessionAllowedCount() {
         return this.allowAllSessions.size;
     }

package/dist/trace/core-keyset-guard.d.ts

@@ -26,7 +26,7 @@ type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "descripti
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end";

package/dist/trace/engine-notice-wire.d.ts

@@ -1,5 +1,7 @@
 /**
- * 上 wire 的通告码 —— **显式闭集常量表**(设计稿 ①,起步三码;今天九码)。
+ * 上 wire 的通告码 —— **显式闭集常量表**(设计稿 ①,起步三码;今天的码数以本常量自身为准——
+ * 在散文里抄数字必陈腐,codex 5.65 增量批 R1-[low] 实逮:上一句曾写「今天九码」而表里是十条。
+ * 码数的**受门**真源=契约文档附录 D.3 的小节标题,⑥b 双向门盯着)。
  *
  * 起步的那六码同族:都是「这条 session 的记忆姿态」的披露,resume 之后仍然相关 ⇒ 也进 durable 账本
  * (cli 断连补看走既有 events 重放腿,[4634](ii))。
@@ -14,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;
@@ -80,13 +82,13 @@ export type EngineNoticeWireSink = (row: EngineNoticeWireRow) => void;
  *
  * 🔴 跨 session 隔离靠的是 **Map 键的精确串相等**,不是任何「最近活跃」回落 —— 缺席就是缺席(G5)。
  *
- * 🔴 **同 session 的跨代隔离靠 legId「最新代独占」**(#310 codex 对抗复审 R1-[high],验真后修)。
+ * 🔴 **同 session 的跨代隔离靠 legId「最新代独占」**(#310 codex 交叉复审 R1-[high],验真后修)。
  * 病(真窗,本仓每一处 in-flight 登记都为它写过 identity-guard):run 行在**流体内**就已 setTerminal /
  * setSuspended,而本腿的注销在 `finally` —— 中间那一窗里,同一条 session 上的**下一条腿**(快速续跑 /
  * 紧接着的新提交)已经注册好了自己的口。若按「会话内全量扇出」投,新腿的一条通告会**同时**落进:
  *  · 旧腿那条已 end 的 SSE(顶多记一次 fail-open,无害),以及
  *  · **旧 taskId 的账本** —— 一条不属于那条 run 的、终态之后的行;resume 复用同 taskId 时还会与新腿
- *    抢同一个 `(task_id, seq)` 域。这不是跨租户泄露,是**同租户跨 run 的账本污染**,同样必须关死。
+ *    抢同一个 `(task_id, seq)` 域。这不是跨租户外泄,是**同租户跨 run 的账本污染**,同样必须关死。
  * 药:每次 `registerLeg` 铸一个单调 legId,`route` **只投最新代**;旧代的口留在表里(它自己的注销仍
  * 按身份精确删,不会误删新代),但一帧都收不到。方向 = fail-closed(宁可旧腿少一帧,不可新腿的事实
  * 写进旧腿的账)。

package/dist/trace/engine-notice-wire.js

@@ -11,6 +11,8 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "steering.parked_input_blocked",
     "task.user_steer_undrained",
     "task.user_followup_undrained",
+    "memory.capture_opted_out",
+    "memory.capture_optout_unpersisted",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/ledger-events.d.ts

@@ -1,5 +1,5 @@
 /**
- * runs 账本(`task_run_event`)的**事件型闭集**——A-032 P1-③ / codex 对抗复审 F2。
+ * runs 账本(`task_run_event`)的**事件型闭集**——A-032 P1-③ / codex 交叉复审 F2。
  *
  * ## 为什么需要这个联合
  * 账本行的 `type` 是消费端分流的键:`GET /v1/runs/:id/events` 裸回放照发,而 `trace/project.ts` 的

package/dist/trace/ledger-sink.d.ts

@@ -40,7 +40,7 @@ export interface LedgerSink {
      * 与 {@link onEvent} 的 `case "status"` 共用**同一个**白名单 builder(`brainStatusEventData`),差别只有
      * 一处:本门**同步入链** —— 在回调进入的那一刻就占住序号槽,而不是先 `await flush()` 再入链。
      *
-     * 🔴 **为什么必须同步入链**(codex 对抗复审 R2 [medium],红先复现后修):`onForwardEvent` 是同步入链的,
+     * 🔴 **为什么必须同步入链**(codex 交叉复审 R2 [medium],红先复现后修):`onForwardEvent` 是同步入链的,
      * 而 core 的第五席与 forward sink 都是**同步回调**、可能同一拍相邻到达。走 `onEvent` 的话那一次
      * `await flush()` 会让**后到**的 forward 帧抢到**更小**的序号 ⇒ durable 时间线倒挂(消费端读到「子代
      * 进度」排在触发它的那次重连之前)。钉在 `test/issue190-status-wire-disclosure.test.ts` §4⑤b。
@@ -71,7 +71,7 @@ export interface LedgerSink {
     }): Promise<void>;
 }
 /**
- * **单写串行链**的可复用形(#310 codex 对抗复审 R1-[high],验真后修)—— `seq` 的**分配发生在链步内**,
+ * **单写串行链**的可复用形(#310 codex 交叉复审 R1-[high],验真后修)—— `seq` 的**分配发生在链步内**,
  * 于是「分配序 == 发起序 == 提交序」。
  *
  * 病(实测形,`LedgerSink` 内部早有这条纪律的内联版、其顶注 [1.211 codex H2] 逐字记着它):裸写口

package/dist/trace/project.d.ts

@@ -4,7 +4,7 @@
  * The event log (src/runs.ts) is a flat per-task seq stream: reasoning / text / tool_start / tool_end /
  * turn_end / compacted / done / suspended / failed. sema-registry renders an ORDERED `blocks[]` transcript
  * (CC-style thinking↔tool interleave), grouped into turns. This is pure presentation/projection = the
- * SERVICE layer (core [R57] adversarial: do NOT push this shape into core — different consumer, different shape).
+ * SERVICE layer (core [R57] cross-review: do NOT push this shape into core — different consumer, different shape).
  *
  * Per core [R57] corrections: there is no `suspended` event (suspend = the run row's status); per-turn tokens ride
  * on `turn_end.usage` (core additive). As of core 1.121.0 (design/99 §E1) `tool_end` ALSO carries the model-facing
@@ -18,7 +18,7 @@ import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
 import type { LedgerEventType } from "./ledger-events.js";
 /** 账本写口的统一签名 —— `type` 是**闭集**(`ledger-events.ts`):新型必须先登记,否则调用点编译红
- *  (codex 对抗复审 F2:别名门 `ap("x")` 与动态首参让纯词法门结构性抓不全)。 */
+ *  (codex 交叉复审 F2:别名门 `ap("x")` 与动态首参让纯词法门结构性抓不全)。 */
 type AppendFn = (type: LedgerEventType, data: unknown) => Promise<void>;
 type GetEventsFn = (taskId: string, afterSeq: number) => Promise<RunEvent[]>;
 /** E8 (shell-host): drain the per-task model-usage accumulator into an append-only `model_usage` DELTA event.
@@ -402,6 +402,7 @@ export declare function brainStatusEventData(ev: {
     maxRetries?: number;
     retryInMs?: number;
     errClass?: string;
+    retryAtMs?: number;
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -295,6 +295,7 @@ export function brainStatusEventData(ev) {
         ...(num(ev.attempt) ? { attempt: ev.attempt } : {}),
         ...(num(ev.maxRetries) ? { maxRetries: ev.maxRetries } : {}),
         ...(num(ev.retryInMs) ? { retryInMs: ev.retryInMs } : {}),
+        ...(num(ev.retryAtMs) ? { retryAtMs: ev.retryAtMs } : {}),
         ...(typeof ev.errClass === "string" && ev.errClass.length > 0 ? { errClass: ev.errClass } : {}),
         ...identityFields(ev),
     };

package/dist/turn-activity.d.ts

@@ -3,7 +3,7 @@
  * GET /v1/runs/:id 读面的判别材料 `msSinceLastActivity` 的唯一数据源。
  *
  * 【为什么需要它】run 行的 `updatedAt` 由 liveness heartbeat(独立 `setInterval`,runs.ts)推进——
- * 它只证明 **server 进程**活着;turn 卡死在某个 await 上时心跳照走([3771] 推理漏洞的公开更正)。
+ * 它只证明 **server 进程**活着;turn 卡死在某个 await 上时心跳照走([3771] 推理缺陷的公开更正)。
  * 「turn 真在推进」的证据 = ledger sink 的 durable append(text/tool/status/park/done 全族都过那一条
  * 单写串行链)。cli 的 running 形保守臂([3779] C3)缺的就是这一维:没有它,「真忙的后台 run」与
  * 「断连僵局」在 wire 上不可分辨,只能猜。

package/dist/wall-clock-jump-guard.d.ts

@@ -17,7 +17,7 @@
  *
  * 本模块改判**宽限**:检出一次前跳后,按**单调钟**静默 `grace = slaMs` 毫秒不做判定。
  *
- * 🔴 **宽限量是一个完整 SLA,不是 `min(J, S)`**(codex 对抗复审 R1 [high] 三,验真后修 —— 第一版正是
+ * 🔴 **宽限量是一个完整 SLA,不是 `min(J, S)`**(codex 交叉复审 R1 [high] 三,验真后修 —— 第一版正是
  * `min(J, S)`,而那条「J < S 时宽限恰好补平损失」的证明**是错的**)。错在哪:宽限只是**推迟**判定,
  * 它消不掉墙钟从此**永久领先** J 毫秒这件事。反例(逐字复算):S=45s,gate 在真实 t=0 铸出(deadline =
  * W0+45s),真实 t=1s 时前跳 J=10s。`min(J,S)`=10s ⇒ 宽限到真实 t=11s;此后墙钟恒为 `W0+t+10`,
@@ -29,7 +29,7 @@
  *     t_x + S(墙钟与单调钟从跳变后起同速),宽限只可能把它再往后推,绝不会提前 ✔
  * 即**任一审批席都拿得到不少于一个完整 SLA 的真实时间**;单次阶跃下判定最多被推迟一个 S。
  *
- * 🔴 **「有界且一次性自清」只对单次阶跃成立**(codex 对抗复审 R2 [high] 五,验真后修 —— 第一版把这句话
+ * 🔴 **「有界且一次性自清」只对单次阶跃成立**(codex 交叉复审 R2 [high] 五,验真后修 —— 第一版把这句话
  * 写成了无条件的,那是错的):每次前跳都把窗延到「此刻 + 一个 S」,所以**只要每个 S 内再跳一次**,窗就
  * 永远续下去,deny 腿被静默关停 —— 而它是一条 **fail-closed** 腿,永久不跑比跑早了更坏。
  * 收口 = 一串连续跳变的**累计宽限总上限**(缺省 `2 × S`:一个 S 覆盖有证明的单次阶跃,第二个 S 容一串
@@ -40,7 +40,7 @@
  * ## 方向与响亮度(#157 安全轴)
  * 宽限只会**推迟**一个 fail-closed 动作(deny),绝不会放行任何东西 —— 方向安全。但它必须**响亮**:
  * 检出即 warn(带跳变量与宽限量),宽限期内每拍 info。绝对兜底仍在:`checkpoint.terminal_at_ms`
- * (put 时钉死的绝对上限)由另一条 reap 腿执行,不经本守卫 ⇒ 悬挂不可能无限。
+ * (put 时写死的绝对上限)由另一条 reap 腿执行,不经本守卫 ⇒ 悬挂不可能无限。
  *
  * 后拨(墙钟相对单调钟**倒退**)不触发宽限:它只会让 deadline 显得更远 ⇒ 判定被推迟,已经是安全方向。
  * 仍然 warn —— 一次没人知道的钟倒退是运维事实,不是可以吞掉的噪声。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.50.0",
+  "version": "7.52.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "5.63.0",
+    "@sema-agent/core": "7.0.0",
     "@sema-agent/settings-schema": "1.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",