@sema-agent/server 7.69.0 → 7.70.0

package/dist/observability/run-terminal-log.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { redactSecrets } from "../trace/redact.js";
+import { isParkLedgerEventType } from "../trace/ledger-events.js";
 import { errorText } from "./err-text.js";
 import { recordFailOpen } from "./fail-open.js";
 const MESSAGE_CAP = 1024;
@@ -75,6 +76,37 @@ export function redactErrorMessage(raw) {
     }
 }
 const MAX_EDITED_FILES = 1000;
+const RESULT_KEY_TREATMENT = {
+    terminal: "redacted",
+    remoteEnvFailures: "redacted",
+    editedFiles: "redacted",
+    taskId: "verbatim",
+    runId: "verbatim",
+    sessionId: "verbatim",
+    model: "verbatim",
+    effectiveReasoning: "verbatim",
+    result: "verbatim",
+    salvagedOutput: "verbatim",
+    apiFailure: "verbatim",
+    retryAfterMs: "verbatim",
+    degraded: "verbatim",
+    structuredOutput: "verbatim",
+    rewindNotes: "verbatim",
+    haltedOnUserRejection: "verbatim",
+    haltedByUser: "verbatim",
+    strandedHumanAnswers: "verbatim",
+    pendingApproval: "verbatim",
+    approvalWaitedMs: "verbatim",
+    effectiveReadFace: "verbatim",
+    effectiveReadDenyPatterns: "verbatim",
+    effectiveMemoryScopes: "verbatim",
+    stats: "verbatim",
+};
+const LEGACY_RESULT_LEAVES = ["errorMessage", "blockedReason", "checkpointGate"];
+export const REDACTABLE_RESULT_LEAVES = [
+    ...Object.entries(RESULT_KEY_TREATMENT).filter(([, t]) => t === "redacted").map(([k]) => k),
+    ...LEGACY_RESULT_LEAVES,
+];
 export function redactTerminalResult(result) {
     if (result === undefined || result === null)
         return result;
@@ -89,14 +121,41 @@ export function redactTerminalResult(result) {
         out.blockedReason = redactErrorMessage(r.blockedReason);
         changed = true;
     }
+    if (r.checkpointGate !== undefined) {
+        const legacyGate = redactCheckpointGate(r.checkpointGate);
+        if (legacyGate !== r.checkpointGate) {
+            out.checkpointGate = legacyGate;
+            changed = true;
+        }
+    }
     if (r.terminal !== null && typeof r.terminal === "object") {
         const t = r.terminal;
-        if (t.kind === "failed" && typeof t.message === "string") {
-            out.terminal = { ...t, message: redactErrorMessage(t.message) };
-            changed = true;
+        let nt;
+        if (t.kind === "failed" && typeof t.message === "string")
+            nt = { ...t, message: redactErrorMessage(t.message) };
+        else if (t.kind === "blocked" && typeof t.reason === "string")
+            nt = { ...t, reason: redactErrorMessage(t.reason) };
+        const gateOf = (cause) => {
+            if (cause === null || typeof cause !== "object" || !("gate" in cause))
+                return undefined;
+            const g = cause.gate;
+            const ng = redactCheckpointGate(g);
+            return { gate: ng, changed: ng !== g };
+        };
+        const base = nt ?? t;
+        if (t.kind === "paused") {
+            const g = gateOf(base);
+            if (g?.changed === true)
+                nt = { ...base, gate: g.gate };
+        }
+        else if (t.kind === "failed") {
+            const np = base.nestedPause;
+            const g = gateOf(np);
+            if (g?.changed === true)
+                nt = { ...base, nestedPause: { ...np, gate: g.gate } };
         }
-        else if (t.kind === "blocked" && typeof t.reason === "string") {
-            out.terminal = { ...t, reason: redactErrorMessage(t.reason) };
+        if (nt !== undefined) {
+            out.terminal = nt;
             changed = true;
         }
     }
@@ -136,6 +195,11 @@ export function redactLedgerEventData(type, data) {
             return data;
         return { ...data, errorMessage: redactErrorMessage(msg) };
     }
+    if (isParkLedgerEventType(type)) {
+        const gate = data.gate;
+        const next = redactCheckpointGate(gate);
+        return next === gate ? data : { ...data, gate: next };
+    }
     return data;
 }
 export function redactWorkerReportError(report) {
@@ -145,38 +209,123 @@ export function redactWorkerReportError(report) {
         return report;
     return { ...report, ...(error !== report.error ? { error } : {}), ...(gate !== report.checkpointGate ? { checkpointGate: gate } : {}) };
 }
+const RISK_DESCRIPTOR_TREATMENT = {
+    severity: "verbatim",
+    axes: "verbatim",
+    toolName: "verbatim",
+    shellGateDoctrine: "verbatim",
+    summary: "text",
+    touchedPaths: "text[]",
+    shadowedRule: "text",
+    probeReason: "text",
+    probeCause: "probe-cause",
+};
+const PROBE_CAUSE_TREATMENT = {
+    code: "verbatim",
+    roots: "operands",
+    further: "operands",
+};
+const PROBE_CAUSE_OPERANDS_TREATMENT = {
+    shown: "text[]",
+    total: "verbatim",
+};
+export function redactRiskDescriptor(rd) {
+    if (rd === null || typeof rd !== "object" || Array.isArray(rd))
+        return rd;
+    const r = rd;
+    let changed = false;
+    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
+        changed = true; return o; };
+    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
+    const out = { ...r };
+    for (const [key, treatment] of Object.entries(RISK_DESCRIPTOR_TREATMENT)) {
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "text":
+                if (typeof r[key] === "string")
+                    out[key] = str(r[key]);
+                break;
+            case "text[]":
+                if (Array.isArray(r[key]))
+                    out[key] = strs(r[key]);
+                break;
+            case "probe-cause": {
+                const pc = r[key];
+                if (pc === null || typeof pc !== "object" || Array.isArray(pc))
+                    break;
+                const p = pc;
+                const np = { ...p };
+                for (const [ck, ct] of Object.entries(PROBE_CAUSE_TREATMENT)) {
+                    if (ct === "verbatim")
+                        continue;
+                    const ops = p[ck];
+                    if (ops === null || typeof ops !== "object" || Array.isArray(ops))
+                        continue;
+                    const o = ops;
+                    const no = { ...o };
+                    for (const [ok, ot] of Object.entries(PROBE_CAUSE_OPERANDS_TREATMENT)) {
+                        if (ot === "text[]" && Array.isArray(o[ok]))
+                            no[ok] = strs(o[ok]);
+                    }
+                    np[ck] = no;
+                }
+                out[key] = np;
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled leaf treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return changed ? out : rd;
+}
+const CHECKPOINT_GATE_TREATMENT = {
+    kind: "verbatim",
+    reason: "text",
+    toolName: "verbatim",
+    riskDescriptor: "risk-descriptor",
+    safetyAxis: "verbatim",
+    realApproval: "verbatim",
+    resumeAfterMs: "verbatim",
+};
 export function redactCheckpointGate(gate) {
     if (gate === null || typeof gate !== "object" || Array.isArray(gate))
         return gate;
     const g = gate;
-    let changed = false;
     const out = { ...g };
-    const str = (v) => { const o = redactErrorMessage(v) ?? ""; if (o !== v)
-        changed = true; return o; };
-    const strs = (v) => (Array.isArray(v) ? v.map((x) => (typeof x === "string" ? str(x) : x)) : v);
-    if (typeof g.reason === "string")
-        out.reason = str(g.reason);
-    const rd = g.riskDescriptor;
-    if (rd && typeof rd === "object" && !Array.isArray(rd)) {
-        const r = rd;
-        const nr = { ...r };
-        for (const k of ["summary", "shadowedRule", "probeReason"])
-            if (typeof r[k] === "string")
-                nr[k] = str(r[k]);
-        if (Array.isArray(r.touchedPaths))
-            nr.touchedPaths = strs(r.touchedPaths);
-        const pc = r.probeCause;
-        if (pc && typeof pc === "object" && !Array.isArray(pc)) {
-            const p = pc;
-            const np = { ...p };
-            for (const k of ["roots", "further"]) {
-                const ops = p[k];
-                if (ops && typeof ops === "object" && !Array.isArray(ops) && Array.isArray(ops.shown))
-                    np[k] = { ...ops, shown: strs(ops.shown) };
+    let changed = false;
+    for (const [key, treatment] of Object.entries(CHECKPOINT_GATE_TREATMENT)) {
+        switch (treatment) {
+            case "verbatim":
+                break;
+            case "text": {
+                const v = g[key];
+                if (typeof v !== "string")
+                    break;
+                const next = redactErrorMessage(v) ?? "";
+                if (next !== v) {
+                    out[key] = next;
+                    changed = true;
+                }
+                break;
+            }
+            case "risk-descriptor": {
+                if (!(key in g))
+                    break;
+                const next = redactRiskDescriptor(g[key]);
+                if (next !== g[key]) {
+                    out[key] = next;
+                    changed = true;
+                }
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled gate field treatment: ${String(unhandled)}`);
             }
-            nr.probeCause = np;
         }
-        out.riskDescriptor = nr;
     }
     return changed ? out : gate;
 }
@@ -366,9 +515,11 @@ export function memoRedactTerminalResult(seat, result) {
     if (result === undefined || result === null)
         return result;
     const r = result;
-    if (r.terminal === undefined && r.errorMessage === undefined && r.blockedReason === undefined && r.remoteEnvFailures === undefined)
+    if (REDACTABLE_RESULT_LEAVES.every((k) => r[k] === undefined))
         return result;
-    const leaves = { terminal: r.terminal, errorMessage: r.errorMessage, blockedReason: r.blockedReason, remoteEnvFailures: r.remoteEnvFailures };
+    const leaves = {};
+    for (const k of REDACTABLE_RESULT_LEAVES)
+        leaves[k] = r[k];
     const redacted = memoRedactedRead(seat, leaves, (l) => redactTerminalResult(l));
     if (redacted === leaves)
         return result;

package/dist/observability/tool-trace.d.ts

@@ -14,6 +14,18 @@ import type { Metrics } from "./metrics.js";
  * 🔴 BREAKING(server 7.64.0,core 7.6.0 提货):标签名 `source` → `deniedBy`,词表从七词
  * (`policy/hook/safety/shellGate/planMode/classifier/org`)换成八词
  * (`policy/hook/org/classifier/plan_mode/compliance/write_protection/ask_resolution`)。仪表盘/告警规则要改。
+ *
+ * 🔴 **第二个计数器 `auto_mode_classifier_unavailable_total{cause}`(server 7.70.0,core 7.12.0 [ref])**
+ * —— 分类器**停摆**的常开信号。7.12.0 之前这件事有两条可观测路:熔断跳闸时的
+ * `auto_mode_breaker_open_total`,以及「`unavailable` 的 ask 会走到人面前」(审批 inbox 里看得见)。
+ * 该版把熔断族整族退役、又把 `unavailable` 改成**当场 deny** ⇒ 两条路同时没了,而
+ * `permission_denied_total{deniedBy}` 对它是**瞎的**:分类器停摆与分类器正常拦下一次危险调用,
+ * 两者都记 `deniedBy:"classifier"`。一次持续停摆于是在默认监控上与「今天安全拦截多了点」不可区分
+ * (`TOOL_TRACE` 默认关,拿不到那半边)。core 同批把事实加在了 deny 上
+ * (`PermissionDeniedPayload.classifierUnavailable`),本仓就在**这同一只常开观察者**上消费它。
+ * 两个计数刻意**不合并成一个标签**:它们答两个问题(「谁拒的」vs「这次拒是不是因为分类器停摆、哪一类」),
+ * 而运维对停摆要立刻动手(改配置 / 等重试 / 看后端),对安全拦截不要。
+ * ⛔ 纯计量:不改任何裁决、不新开观察面、事实缺席时**不铸**(缺席 ≠ 「分类器好着呢」,只是这次拒不是它)。
  */
 export declare function createPermissionDeniedMeter(metrics: Pick<Metrics, "inc">): Hooks;
 /**

package/dist/observability/tool-trace.js

@@ -1,4 +1,4 @@
-import { isDeniedBy } from "@sema-agent/core";
+import { isAutoModeUnavailableCause, isDeniedBy } from "@sema-agent/core";
 import { redactSecrets } from "../trace/redact.js";
 function deniedByLabel(gate) {
     const d = gate.disposition;
@@ -8,6 +8,10 @@ export function createPermissionDeniedMeter(metrics) {
     return {
         permissionDenied(payload) {
             metrics.inc("permission_denied_total", { deniedBy: deniedByLabel(payload.gate) });
+            const cause = payload.classifierUnavailable?.cause;
+            if (cause !== undefined) {
+                metrics.inc("auto_mode_classifier_unavailable_total", { cause: isAutoModeUnavailableCause(cause) ? cause : "other" });
+            }
         },
     };
 }

package/dist/plugins/store-backend.d.ts

@@ -71,7 +71,8 @@ export type ServiceFileHistoryStore = FileHistoryStore & {
 /** SVC-2 (core CORE-7) WorkflowJournalStore — core's interface PLUS the service `deleteByRun` (GC extra). tidb/pg =
  *  durable SQL twins (cross-replica resume journal); local = the service {@link FileWorkflowJournalStore}
  *  (single-box but RESTART-durable crash-safe JSONL, replacing core's InMemory). The shared equivalence suite keeps
- *  all three byte-matched (scope guard / idempotent-per-ordinal / oversize skip-journal). */
+ *  all three byte-matched (scope guard / idempotent-per-ordinal / oversize **refusal** —— S-194 / core 7.12.0
+ *  [ref] 起两臂一律抛 `workflow.journal_oversize`,判长口径归 core `assertJournalEntryFits` 单一属主). */
 export type ServiceWorkflowJournalStore = WorkflowJournalStore & {
     /** codex R1-H2(journal 读面界):分页+单行字节门的投影读——SQL 端 LIMIT/OFFSET 定行数、LENGTH 门
      *  定单行(超 maxResultBytes 的行 resultJson=null 只回 resultBytes,读面标 truncated)。HTTP 读面

package/dist/plugins/workflow-journal-store-sql.d.ts

@@ -57,7 +57,7 @@ export declare class SqlWorkflowJournalStore implements WorkflowJournalStore {
     /** Record one agent's result. Idempotent per (run_id, ordinal): the PK upsert OVERWRITES (last-write-wins), so a
      *  resumed run re-appending its replayed prefix verbatim leaves no duplicate. callKeyOrdinal is the SOLE ordinal
      *  source (core's parser — a malformed key collapses to 0, matching InMemory). Throws on a REAL failure
-     *  (LOAD-BEARING), EXCEPT an oversize result is skip-journaled (see below) rather than throwing the workflow dead. */
+     *  (LOAD-BEARING) — an oversize entry included, on BOTH arms (S-194 / core 7.12.0 [ref]; see below). */
     append(runId: string, scope: string, entry: WorkflowJournalEntry): Promise<void>;
     /** Entries for `runId` IF its recorded scope === `scope`, ASCENDING by ordinal; otherwise EMPTY. CORE-9 audit
      *  BLOCKER: scope in the WHERE (twin of WorkflowRunStore) — the LLM controls `resumeFromRunId`, so a cross-scope

package/dist/plugins/workflow-journal-store-sql.js

@@ -1,6 +1,6 @@
 import { callKeyOrdinal } from "@sema-agent/core";
-import { oversizeJournalResult } from "@sema-agent/core";
-import { journalEntryOfRow, journalEntryPayload, journalRowPayloadOf } from "../orchestration/workflow-journal-entry.js";
+import { assertJournalEntryFits } from "@sema-agent/core";
+import { journalEntryOfRow, journalRowPayloadOf } from "../orchestration/workflow-journal-entry.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 const DEFAULT_RESUME_CLAIM_TTL_MS = 60 * 60 * 1000;
 export class SqlWorkflowJournalStore {
@@ -14,15 +14,8 @@ export class SqlWorkflowJournalStore {
         return this.db.dialect === "tidb" ? tidb : pg;
     }
     async append(runId, scope, entry) {
+        assertJournalEntryFits(entry);
         const serialized = journalRowPayloadOf(entry);
-        if (oversizeJournalResult(serialized)) {
-            if (journalEntryPayload(entry).parked) {
-                throw new Error(`workflow journal: PARKED entry ${entry.callKey} is ${serialized.length} bytes, over the journal result cap — refusing to skip it. ` +
-                    "Skipping a parked entry would make a resume start a SECOND live agent beside the session already pinned by the pending checkpoint (duplicating pre-approval side effects); " +
-                    "a completed result may be skipped (resume just re-runs that agent), a park may not.");
-            }
-            return;
-        }
         await this.db.query(this.q("INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES (?,?,?,?,?,?) " +
             "ON DUPLICATE KEY UPDATE call_key = VALUES(call_key), result = VALUES(result)", "INSERT INTO workflow_journal (run_id, ordinal, scope, call_key, result, created_at_ms) VALUES ($1,$2,$3,$4,$5,$6) " +
             "ON CONFLICT (run_id, ordinal) DO UPDATE SET call_key = EXCLUDED.call_key, result = EXCLUDED.result"), [runId, callKeyOrdinal(entry.callKey), scope, entry.callKey, serialized, Date.now()]);

package/dist/posture-source.d.ts

@@ -13,8 +13,16 @@
  * `env 显式` > `center 发布` > `posture 派生` > `引擎/服务端默认`。
  *
  * ## 定界
- * 本模块只说**来源**。值本身、以及「这台机器凭什么派生出这个值」那句话,由每个键自己给
- * ({@link PostureKnobFacts.postureMeaning})——那句话是键专属的事实,共享它只会得到一句谁都不认的空话。
+ * 本模块只说**来源**。值本身、以及**两条键专属臂**的句子——「这台机器凭什么派生出这个值」
+ * ({@link PostureKnobFacts.postureMeaning})与「组织发布的值在这台机器上怎么生效」
+ * ({@link PostureKnobFacts.centerMeaning})——由每个键自己给。那两句话是键专属的事实,共享它们只会
+ * 得到一句谁都不认的空话,或者更坏:一句**对某些键是假的**话。
+ *
+ * 🔴 `centerMeaning` 是 G-7(test [ref])的修复面,成因是一次真的过期断言:这一臂原本硬编码
+ * 「applied from the config-center (**restart-to-apply**)」,而 S-174(core 7.10.0 [ref])之后
+ * `readFace.face` 是**热换席**(`Runner.swapDeps({readFace})`,下一拍 refresh 当场换进全部 Runner,
+ * `read-face` 重启片也不再为它签理由)——运维照那句话去滚动重启一片 fleet,重启的是一个已经生效的变更。
+ * 生效时机是**键**的事实,不是四词表的属性,所以它跟 `postureMeaning` 一样归键。
  */
 /** 旋钮取值来源的闭集词表(顺序 = 优先序)。 */
 export declare const POSTURE_SOURCE_WORDS: readonly ["env", "center", "posture", "engine-default"];
@@ -25,13 +33,25 @@ export interface PostureKnobFacts {
     /** 这台机器上占住这个键的 env 变量名(指路句要逐字点它,运维才知道去改哪个)。 */
     readonly knob: string;
     readonly source: PostureSource;
+    /**
+     * `center` 那一臂**专属**的一句话:组织发布的这个值在这台机器上**怎么生效**(热换席?等重启?
+     * 还是这个键根本没有 center 腿?),以及怎么把这个键取回来。只在 `source === "center"` 时被读到。
+     *
+     * 🔴 为什么归键而不是共享(G-7 的成因):生效时机是键的事实。同一句「restart-to-apply」对
+     * `readFace.face` 是假的(S-174 热换席),对三个 S-178 旋钮则连触发条件都没有(`config.ts` 的
+     * `postureSourceOfKnob` / `postureSourceOfNumEnv` 只产 env/posture/engine-default,center 写不到
+     * 它们)—— 一句共享的硬编码必然对其中一类说谎。
+     */
+    readonly centerMeaning: string;
     /**
      * `posture` 那一臂**专属**的一句话:这台机器为什么派生出了这个值,以及怎么把它钉回去。
      * 只在 `source === "posture"` 时被读到 —— 别的臂的句子是通用的(见 {@link postureSourceNote})。
      */
     readonly postureMeaning: string;
 }
-/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。 */
+/** 运维指路句 —— **穷举 switch,无缺省臂**:四词闭集加一个成员这里就编译红。
+ *  两条**通用**臂(`env` / `engine-default`)的句子在这里写死并点名旋钮;两条**键专属**臂
+ *  (`center` / `posture`)原样取键给的那句话(理由见 {@link PostureKnobFacts} 的两个字段注)。 */
 export declare function postureSourceNote(facts: PostureKnobFacts): string;
 /**
  * 这个值是**运维显式表态**的吗?

package/dist/posture-source.js

@@ -4,7 +4,7 @@ export function postureSourceNote(facts) {
         case "env":
             return `pinned by this machine's ${facts.knob} env var (deployment sovereignty — it wins over any published value for this key)`;
         case "center":
-            return `applied from the config-center (restart-to-apply); set ${facts.knob} on this machine to take the key back`;
+            return facts.centerMeaning;
         case "posture":
             return facts.postureMeaning;
         case "engine-default":

package/dist/read-face-posture.d.ts

@@ -46,7 +46,14 @@ export interface ReadFacePostureFacts {
  */
 export declare function readFaceForPosture(singleUserTurnkey: boolean): ReadFacePostureFacts;
 /** 本档的运维指路句 —— 骨架由共享件 {@link postureSourceNote} 给(四词穷举在那里,加词即编译红);
- *  本函数只提供 `posture` 那一臂的**键专属**事实句。 */
+ *  本函数提供两条**键专属**臂(`center` / `posture`)的事实句。
+ *
+ *  🔴 `center` 那句话的事实来源是 S-174(core 7.10.0 [ref]):`RunnerDeps.readFace` 进了 core 的可换席
+ *  闭集 `SWAPPABLE_DEP_SEATS` ⇒ 组织发布/撤回一个档位,**下一拍 refresh 当场换进全部 Runner**,
+ *  `config-center/restart-signal.ts` 的 `read-face` 片也不再为它签重启理由(判据同源 =
+ *  `CENTER_READ_FACE_LIVE_KEYS`,由 core 的 `isSwappableDepSeat` 派生)。本句此前逐字写着
+ *  「(restart-to-apply)」—— G-7 抓获的那条过期断言,方向恰好是「让运维为一个已生效的变更重启 fleet」。
+ *  ⚠️ 只说 `face` 这一席:三个 deny 键仍是 boot-baked,那半场的话不在这条读面上(它们没有来源位)。 */
 export declare function readFaceSourceNote(source: ReadFaceSource): string;
 /** operator 诊断面的投影(`GET /v1/diagnostics/wiring`)。`face:null` = 本部署没钉档,引擎默认接管。 */
 export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {

package/dist/read-face-posture.js

@@ -7,6 +7,7 @@ export function readFaceSourceNote(source) {
     return postureSourceNote({
         knob: "READ_FACE",
         source,
+        centerMeaning: "published by the config-center and applied HOT — the containment FACE is a swappable engine seat (core 7.10.0), so the next refresh (or POST /v1/admin/config/refresh) swaps it into every Runner with NO restart; set READ_FACE on this machine to take the key back",
         postureMeaning: "derived from the single-user turnkey posture (REQUIRE_PRINCIPAL is not set): reads outside the workspace roots are allowed by default — set READ_FACE=roots to pin the containing posture back",
     });
 }

package/dist/run-cancel-context.d.ts

@@ -1,4 +1,4 @@
-import type { RunCancelContext } from "./plugins/store-contracts.js";
+import type { PersistedTaskResult, RunCancelContext } from "./plugins/store-contracts.js";
 /**
  * @param taskId  这条 run 的账本 id(turn 活性登记的键)。
  * @param startedAtMs 这条 run 起跑的墙钟时刻(epoch ms):取消腿手上有行就用行的 `createdAt`,
@@ -10,4 +10,53 @@ import type { RunCancelContext } from "./plugins/store-contracts.js";
  *          断言「我看过现场,什么都没有」,而事实是「我什么都没看见」)。
  */
 export declare function buildCancelContext(taskId: string, startedAtMs: number, nowMs?: number): RunCancelContext | undefined;
+/**
+ * 🔴 **用户取消的机器码 —— 全仓单源**(合并重扫 [5])。
+ *
+ * run 行的 `errorCode` 列、因由臂上的 `terminal.code`、`tasks_total{status}` 的 metrics 标签、fleet 行的
+ * 终态词,是**同一个词**;同一个词就该同一个来源。此前仓里是「一个词两只常量 + 十余处字面量」
+ * (`approval-reconciler.ts` 另有一份 `CANCELLED_ERROR_CODE`),改它的值会让 recordDone / fleet 标签 /
+ * reconciler 的 VOID 判据 / cancel 端点的幂等判据静默分叉。
+ *
+ * 机器门(新写者当场红):`test/cancel-terminal-single-owner.test.ts` 的 G2/G3。
+ */
+export declare const CANCELLED_CODE = "cancelled";
+/**
+ * S-104 —— **取消终局的唯一铸点**。三条用户取消腿(sync stream 的断连支与 cancel-verb 支、durable bg 腿)
+ * 都从这里出结果,于是「一次取消在账本/wire 上长什么样」只有一份口径。
+ *
+ * ## 两种到达形,一条规则
+ * `engineResult` 在场与否 = 「引擎有没有给出终局」,不是两条规则:
+ *  · **在场**(现行常态):**跑起来之后**的 `signal.aborted` 被 core 当成流内事件优雅收尾 —— 流照常
+ *    发 `done`,`terminal` 是一条**不带码**的 `failed`。这里在**它**之上补标,不另造一份结果(另造会把
+ *    引擎已经算出的 `stats` / `result` / `editedFiles` 全丢掉)。
+ *  · **缺席**:根本没读到 done —— 客户端断连后迭代器早收,或**开跑之前**就已经立起的旗
+ *    (亲核 core 7.11.2 `dist/core/runner/runtask.js:623-626`:`runLocked` 入口对已 aborted 的 signal
+ *    抛 `AbortError`)⇒ 合成一条诚实的取消终局。
+ *
+ * ## 「只补空座」纪律(与 core 的 `amendTerminal` 同规),而且**补码与补快照同进同退**
+ *  · 引擎给的终局**不是无码的 failed**(它完成了 / 阻塞了 / 自己带了码)⇒ **整只原样返回**。
+ *    这一条是本车自查轮逮住的自造缺陷:首版只让**补码**受这条纪律管、快照却无条件挂,于是「取消动词
+ *    到了、但活其实已经干完了」会产出一条 `completed` 却带着取消便签的终局 —— 契约 §5.3 逐字写着
+ *    「只在用户取消形上铸」,两个方向的读者都会读错。一次与 abort 赛跑的真失败(`brain.network`)同理:
+ *    贴成 `cancelled` 会把故障统计洗白。
+ *  · `cancelContext`:已经有快照就不重铸(重铸会把「上一条引擎事件多久以前」重新计时)。
+ *
+ * ## 为什么不判「这条 failed 是不是 abort 形」
+ * 判据在**调用点**:调用点问的是「本腿这次是不是被取消动词打中了」(`cancelCtrl.signal.aborted` /
+ * `cancelledViaVerb`),那是 server 自己的事实。让本函数去嗅 `terminal.message` 的字面就是再造事实
+ * —— [ref] 二那次事故的同一个形。
+ */
+export declare function mintCancelledResult(args: {
+    /** 这条 run 的账本 id(活性登记的键;账本不在场时给空串,快照按「证不出」处理)。 */
+    taskId: string;
+    /** 会话 id(合成形要写进结果;引擎给了结果时不用)。 */
+    sessionId: string;
+    /** 本腿起跑的墙钟时刻(epoch ms)。语义与缺席纪律见 {@link buildCancelContext}。 */
+    startedAtMs: number;
+    /** 合成形的失败文案(引擎给了终局时不用)。 */
+    message: string;
+    /** 引擎给出的终局(在场 ⇒ 在它之上补标)。 */
+    engineResult?: PersistedTaskResult;
+}): PersistedTaskResult;
 //# sourceMappingURL=run-cancel-context.d.ts.map

package/dist/run-cancel-context.js

@@ -12,4 +12,26 @@ export function buildCancelContext(taskId, startedAtMs, nowMs = Date.now()) {
         ...(elapsedMs !== undefined ? { elapsedMs } : {}),
     };
 }
+export const CANCELLED_CODE = "cancelled";
+export function mintCancelledResult(args) {
+    const ctx = args.taskId === "" ? undefined : buildCancelContext(args.taskId, args.startedAtMs);
+    const engine = args.engineResult;
+    if (engine !== undefined) {
+        if (engine.terminal.kind !== "failed" || engine.terminal.code !== undefined)
+            return engine;
+        return {
+            ...engine,
+            terminal: { ...engine.terminal, code: CANCELLED_CODE },
+            ...(engine.cancelContext === undefined && ctx !== undefined ? { cancelContext: ctx } : {}),
+        };
+    }
+    return {
+        taskId: args.taskId,
+        sessionId: args.sessionId,
+        terminal: { kind: "failed", code: CANCELLED_CODE, message: args.message },
+        result: "",
+        stats: { turns: 0, tokens: 0 },
+        ...(ctx ? { cancelContext: ctx } : {}),
+    };
+}
 //# sourceMappingURL=run-cancel-context.js.map

package/dist/run-local.d.ts

@@ -96,17 +96,25 @@ export interface LocalApproverIo {
 /**
  * [ref] 件三:**onAsk 座**(§0 潜雷 / §5 锁 6)。
  *
- * 🔴 为什么这个座位是接治理链的**同窗必做项**:run-local 有 checkpointStore(file backend),所以
- * `AUTONOMY=ask` ⇒ `shellGate:"always"` ⇒ Bash 进 `irreversibleTools` ⇒ park lane effective ⇒ **每一次
- * shell 调用都 durable park 成一张永远没人 resume 的 checkpoint**,任务挂起、CLI 退 1。一次性 CLI 里
- * 没有任何赎回腿,那不是「等人来批」,是卡死。core 的 `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk`
- * 早退(prepare-task dist 亲读),ask 于是落回本回调 —— 把 park 换成「问人 / 当场拒」的唯一正当接法。
+ * 🔴 为什么这个座位是接治理链的**同窗必做项**(成因,留档):彼时 run-local 的主 runner 带着
+ * checkpointStore(file backend),于是 `AUTONOMY=ask` ⇒ `shellGate:"always"` ⇒ Bash 进
+ * `irreversibleTools` ⇒ park lane effective ⇒ **每一次 shell 调用都 durable park 成一张永远没人 resume
+ * 的 checkpoint**,任务挂起、CLI 退 1。一次性 CLI 里没有任何赎回腿,那不是「等人来批」,是卡死。
+ * core 的 `isLiveApproverSeat(onAsk)` 为真时 `suspendAsk` 早退(prepare-task dist 亲读),ask 于是落回
+ * 本回调 —— 把 park 换成「问人 / 当场拒」的正当接法。
+ *
+ * 🔴 **本席不是那颗雷的唯一防线,也从来不该是**(B-060 批 codex 交叉复审 [medium] 的教训):它只挡
+ * **审批**那条车道;core 的**平台/资源停驻**(`suspendForPlatformLimit`)由「店在不在」一位武装,
+ * 压根不经过 onAsk。所以自 B-060 起本腿的结构性防线是**整条腿不接 checkpointStore**(装配点在
+ * `createSharedRunnerDeps` 调用处,理由全文在那里),本席退回它本来的职责:**给 TTY 前的人一次真的
+ * 问答**。两道并存不是冗余 —— 一道管「谁来答」,一道管「答不了时会不会留下无人兑付的行」。
  *
  * ⛔ **不在 toolPolicy 层做 ask→deny 映射**:core 自己就有 headless auto-deny 的语义与文案,在策略层
  * 复刻一份 = 同源谎(两处判据日后各改各的)。裁决归 core,座位归这里。
  *
  * 🔴 非 TTY 臂答 `false`(真 deny),**绝不答 `"unavailable"`**:后者被 core 读成「席位够不到」并**改道
- * `suspendAsk`**(dist `core/hooks.js:296` 的 `approverUnavailable` 重投),上面那颗雷会原样回来。
+ * `suspendAsk`**(dist `core/hooks.js:296` 的 `approverUnavailable` 重投)。今天本腿无店 ⇒ 那条改道无处
+ * 可去(fail-closed 拒),但这一条仍是本席的契约:答案是「不批」,不是「找不到人」。
  */
 export declare function createLocalApprover(io: LocalApproverIo): OnAsk;
 /** 默认的 TTY 问人器:一问一答,回答写 **stderr**(stdout 是任务结果的专用管道,别污染它)。

package/dist/run-local.js

@@ -387,6 +387,7 @@ export async function runLocal(argv, deps = {}) {
             ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
         },
         toolResultStore: fileBackend.toolResultStore,
+        checkpointStore: undefined,
         sessionPolicyStore: fileBackend.sessionPolicyStore,
         usageWindowStore: config.usageWindows ? fileBackend.usageWindowStore : undefined,
         orgMemoryAdmission,
@@ -397,7 +398,6 @@ export async function runLocal(argv, deps = {}) {
         ...sharedRunnerDeps,
         sessionStore,
         ...(memoryEngine ? { memoryBackend: memoryEngine.backend, memoryEngineDir: memoryEngine.root } : {}),
-        checkpointStore: fileBackend.checkpointStore,
         onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled

package/dist/runs.d.ts

@@ -97,57 +97,6 @@ export declare function markChildrenStoppedByUserOnAbort(signal: AbortSignal, ta
 export declare function isSessionConflictResult(result: {
     terminal: TerminalCause;
 }): boolean;
-/**
- * E18 resume-at CALLER error → an HTTP 4xx. A bad/stale resume-at target (the resolved entryId is gone or is not a
- * settled message boundary) surfaces as a FAILED TaskResult carrying a `resume_at.*` errorCode (core swallows the
- * prepare-throw into the result, exactly like a session conflict — runtask catch → status:"failed"+errorCode). The
- * sync path otherwise 200s a failed result; map these to 4xx so a caller mistake reads as one. `not_found` (the
- * entry is genuinely absent) → 404; everything else (not_a_message / conflicts_resume / no_session) → 422.
- *
- * [ref] Phase3: `requireExistingSession` on a genuinely-missing/purged session ALSO surfaces as a failed result
- * (core prepare-task maps the store's `not_found` → `resume.session_not_found`); map it to 404 (the session is gone),
- * the same "caller mistake reads as a 4xx, not a silent 200 fresh run" discipline.
- *
- * [ref] rewind exclusive mode (core 1.292 resumeAtMode:"before"): its two edge rejections ride the same `resume_at.*`
- * prefix (before_target_not_user / before_root_unsupported → 422 via the existing branch, errorCode passed through
- * UNCHANGED for the shell). `rewind_snapshot.unresolvable` (rewindFiles + "before": no snapshot at/above the branch
- * point) is core's third rejection with a DIFFERENT prefix — same caller-mistake shape (prepare-throw, nothing
- * billed), map it to 422 explicitly so it doesn't fall through to a 200-with-failed body.
- *
- * [ref] 件A([ref] 件4): core 5.13.0's org-memory admission rides the SAME prepare-throw pipe
- * (GOVERNANCE_CODES). `memory.admission_denied` is TERMINAL — the principal has no grant on that tenant
- * plane → 403 (a retry cannot change the verdict). `memory.admission_required` is TRANSIENT fail-closed —
- * the directory is unreachable / no resolver is wired → 503 (retry later; the sync leg forwards the
- * result's `retryAfterMs` as body `retryAfterSec`, same family shape as usage.window_exhausted). Exact
- * codes only, no memory.* family grab — an unknown sibling stays a 200-with-failed-body until cataloged.
- *
- * [ref] (core 7.0.0 片2/3, [ref] S-3): the session capture opt-out's four prepare-throw refusals ride the
- * same pipe. `memory.capture_optout_denied` is TERMINAL (the principal's `allowMemoryOptOut` verdict is an
- * explicit `false`, or the posture is `capture-required` / `governed`-with-absent-verdict — a retry cannot
- * change it) → 403, the `memory.admission_denied` twin. `memory.capture_optout_unpersisted` is the
- * declaration arm's "control-plane record could not be written" refusal — a store outage, retry may succeed
- * → 503 (transient fail-closed, the `memory.admission_required` twin; no retryAfterMs on this one — core
- * mints none, so the sync leg forwards no hint rather than inventing one). `config.memory_capture_spelling`
- * is a TaskSpec authoring mistake (the only legal spelling is the string "off") → 400, the
- * `config.memory_erasure_request` family shape. `config.memory_capture_unsupported` is the DEPLOYMENT SHAPE
- * refusing the declaration (remote/per-run execution with no durable capture-record carrier: the record
- * would not survive to a resume replica) → 409 — the request is well-formed, the deployment's state
- * conflicts with it, the `config.refresh_unavailable` family shape ("change the deployment, not the request").
- * Status choices are pinned by the `config.`/`memory.` family status sets in error-code-catalog-live.test.ts.
- *
- * S-125 件⑥(core 7.4.0 [ref]):`rewind.child_scope_unsupported` —— 这条腿是一个**委派子代**,它的文件编辑
- * 记在**根 session** 的文件历史里,所以「把文件还原到某个 entry」是根 session 的动作、不是子代的;core 在
- * prepare 期响亮拒(零计费,文件一个字节没动)。映射 **422**:请求形式合法、语义上找错了执行者 —— 与
- * `resume_at.*` 的「调用方指错了锚」同一族同一档,而不是 404(目标在,只是不归你)也不是 409(部署状态没冲突)。
- * ⚠️ **前缀不吞**:本码前缀是 `rewind.`,与下面那条 `resume_at.` **开集前缀臂**不同族 —— 它不会被那一臂顺手
- * 兜走(兜走会把一条「找错执行者」的拒答成「锚解析不了」),也不是 `rewind_snapshot.`(那是「快照找不到」)。
- * 三个前缀各自成族,逐码对表见 `test/resume-anchor.test.ts` 的 S-125 `rewind.` 族格。
- * 🔴 **可达性如实**:本仓的 HTTP 面**今天铸不出**这条腿 —— 子代由 core 内部的 Agent 工具派生,
- * `fileHistoryLineage` 是 core prepare 的 internals(不在 `TaskSpec` 上),server 从不直接 prepare 一条带
- * lineage 的子代腿。本臂是**分诊面的完备性**(core 说 X ⇒ wire 形是 Y),不是一条今天在跑的路;将来的
- * 委派入口接线那天零改动即生效。同族其余五码今天**仍落 200-with-failed-body**,那是本批**之前**就存在的
- * 缺口(不是本批回归),已在上述对表格里逐码显式登记为债务,并由那道门看住不许陈腐。
- */
 export declare function resumeAtHttpStatus(result: {
     terminal: TerminalCause;
 }): number | undefined;