@sema-agent/server 7.69.0 → 7.71.0

package/dist/trace/core-keyset-guard.d.ts

@@ -17,28 +17,100 @@
  * ⑨⑩([ref],2026-08-31)把两个最大的 wire 面也纳入:TaskSpec 按「server 有无写点」记 Wired/Unwired,
  * TaskResult 按「转发/摘除」记 Forwarded/Stripped —— 谁改 resolve-spec.ts / runs.ts 的发射点谁同步本文件。
  */
-import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, GateOutcome, Settlement, PausedCause } from "@sema-agent/core";
-/** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。 */
-type AssertAllKeysHandled<T extends never> = T;
+import type { TaskNotificationPayload, SemaProvenance, BackgroundChildEvent, RosterEntry, AskRequest, CheckpointSummary, TaskEvent, TraceEvent, MailboxMessage, MailboxAppendMessage, TaskSpec, TaskResult, WiringManifest, GateOutcome, Settlement, PausedCause } from "@sema-agent/core";
+import type { ToolApprovalFrame } from "../tool-approval.js";
+/** 编译期断言:T 必须收敛到 never(有残余键 = tsc 红)。
+ *  🔴 **导出**([ref] U1/U2):本仓「词表闭集,未处置成员=编译红」的钉法只许有**一个**形 ——
+ *  `observability/run-terminal-log.ts` 的三张叶表 + 结果顶层键表用同一只断言,而不是各自再抄一份
+ *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
+ *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
+export type AssertAllKeysHandled<T extends never> = T;
 type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
 type NotificationExcluded = "peer" | "crossSessionMessage" | "crossSessionNotice";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
+type _GuardNotificationReverse = AssertAllKeysHandled<Exclude<NotificationProjected | NotificationExcluded, keyof TaskNotificationPayload>>;
+type ProvenanceProjected = "kind" | "from" | "taskId" | "seq" | "agentType";
+type ProvenanceExcluded = "peerMeta";
+type _GuardProvenance = AssertAllKeysHandled<Exclude<keyof SemaProvenance, ProvenanceProjected | ProvenanceExcluded>>;
+type _GuardProvenanceReverse = AssertAllKeysHandled<Exclude<ProvenanceProjected | ProvenanceExcluded, keyof SemaProvenance>>;
+type AgentMessageProjected = "from" | "body";
+type _GuardAgentMessage = AssertAllKeysHandled<Exclude<keyof NonNullable<TaskNotificationPayload["agentMessage"]>, AgentMessageProjected>>;
+type _GuardAgentMessageReverse = AssertAllKeysHandled<Exclude<AgentMessageProjected, keyof NonNullable<TaskNotificationPayload["agentMessage"]>>>;
 type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
+type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNotifExcluded, keyof BackgroundChildEvent>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
+type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
 type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "persistedRuleShadowed" | "probeCause" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "probeReason" | "hasBidiControls" | "previewWithheld" | "execCwd";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
+type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
+type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
+type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
+type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
 type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
+type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailbox = AssertAllKeysHandled<Exclude<keyof MailboxMessage, MailboxProjected>>;
+type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof MailboxMessage>>;
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
+type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools";
+type WiringSectionExcluded = "governance" | "configFingerprint";
+type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
+type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
+type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
+type WiringLegHandled = "kind";
+type _GuardWiringLeg = AssertAllKeysHandled<Exclude<keyof WiringSection<"leg">, WiringLegHandled>>;
+type _GuardWiringLegReverse = AssertAllKeysHandled<Exclude<WiringLegHandled, keyof WiringSection<"leg">>>;
+type WiringAskHandled = "form" | "provenance" | "effective";
+type _GuardWiringAsk = AssertAllKeysHandled<Exclude<keyof WiringSection<"ask">, WiringAskHandled>>;
+type _GuardWiringAskReverse = AssertAllKeysHandled<Exclude<WiringAskHandled, keyof WiringSection<"ask">>>;
+type WiringQuestionHandled = "wired" | "provenance" | "interactiveToolsWithoutDeliveryFace";
+type _GuardWiringQuestion = AssertAllKeysHandled<Exclude<keyof WiringSection<"question">, WiringQuestionHandled>>;
+type _GuardWiringQuestionReverse = AssertAllKeysHandled<Exclude<WiringQuestionHandled, keyof WiringSection<"question">>>;
+type WiringInteractionHandled = "posture";
+type _GuardWiringInteraction = AssertAllKeysHandled<Exclude<keyof WiringSection<"interaction">, WiringInteractionHandled>>;
+type _GuardWiringInteractionReverse = AssertAllKeysHandled<Exclude<WiringInteractionHandled, keyof WiringSection<"interaction">>>;
+type WiringElicitHandled = "seamWired" | "serversOptedIn";
+type _GuardWiringElicit = AssertAllKeysHandled<Exclude<keyof WiringSection<"elicit">, WiringElicitHandled>>;
+type _GuardWiringElicitReverse = AssertAllKeysHandled<Exclude<WiringElicitHandled, keyof WiringSection<"elicit">>>;
+type WiringParkLaneHandled = "capable" | "effective" | "reasons" | "checkpointDurability";
+type _GuardWiringParkLane = AssertAllKeysHandled<Exclude<keyof WiringSection<"parkLane">, WiringParkLaneHandled>>;
+type _GuardWiringParkLaneReverse = AssertAllKeysHandled<Exclude<WiringParkLaneHandled, keyof WiringSection<"parkLane">>>;
+type WiringSessionHandled = "store";
+type _GuardWiringSession = AssertAllKeysHandled<Exclude<keyof WiringSection<"session">, WiringSessionHandled>>;
+type _GuardWiringSessionReverse = AssertAllKeysHandled<Exclude<WiringSessionHandled, keyof WiringSection<"session">>>;
+type WiringToolsHandled = "schemaVersion" | "count" | "entries" | "digest";
+type _GuardWiringTools = AssertAllKeysHandled<Exclude<keyof WiringSection<"tools">, WiringToolsHandled>>;
+type _GuardWiringToolsReverse = AssertAllKeysHandled<Exclude<WiringToolsHandled, keyof WiringSection<"tools">>>;
+type FleetExcluded = "subagentTranscripts";
+type WiringFleetHandled = "backgroundAgentStore" | "hostChildEventSink" | FleetExcluded;
+type _GuardWiringFleet = AssertAllKeysHandled<Exclude<keyof WiringSection<"fleet">, WiringFleetHandled>>;
+type _GuardWiringFleetReverse = AssertAllKeysHandled<Exclude<WiringFleetHandled, keyof WiringSection<"fleet">>>;
+type WiringMcpEntry = WiringSection<"mcp">[number];
+type WiringMcpExcluded = "error";
+type WiringMcpHandled = "name" | "source" | "status" | "errorCode" | "delivered" | "httpStatus" | "toolCount" | WiringMcpExcluded;
+type _GuardWiringMcp = AssertAllKeysHandled<Exclude<keyof WiringMcpEntry, WiringMcpHandled>>;
+type _GuardWiringMcpReverse = AssertAllKeysHandled<Exclude<WiringMcpHandled, keyof WiringMcpEntry>>;
+type WiringRulesHandled = "storeWired" | "syncWired" | "orgGoverned";
+type _GuardWiringRules = AssertAllKeysHandled<Exclude<keyof WiringSection<"permissionRules">, WiringRulesHandled>>;
+type _GuardWiringRulesReverse = AssertAllKeysHandled<Exclude<WiringRulesHandled, keyof WiringSection<"permissionRules">>>;
+type WiringModelGateHandled = "class" | "removed" | "restore";
+type _GuardWiringModelGate = AssertAllKeysHandled<Exclude<keyof WiringSection<"modelGate">, WiringModelGateHandled>>;
+type _GuardWiringModelGateReverse = AssertAllKeysHandled<Exclude<WiringModelGateHandled, keyof WiringSection<"modelGate">>>;
+type WiringAutoModeHandled = "armed" | "reason";
+type _GuardWiringAutoMode = AssertAllKeysHandled<Exclude<keyof WiringSection<"autoMode">, WiringAutoModeHandled>>;
+type _GuardWiringAutoModeReverse = AssertAllKeysHandled<Exclude<WiringAutoModeHandled, keyof WiringSection<"autoMode">>>;
+type WiringGovernanceHandled = "audience" | "lockedConfig" | "compliance" | "memoryAdmission" | "retention";
+type _GuardWiringGovernance = AssertAllKeysHandled<Exclude<keyof WiringSection<"governance">, WiringGovernanceHandled>>;
+type _GuardWiringGovernanceReverse = AssertAllKeysHandled<Exclude<WiringGovernanceHandled, keyof WiringSection<"governance">>>;
 type PermissionTraceKind = Extract<TraceEvent["kind"], `permission.${string}`>;
-type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
+export type PermissionTraceProjected = "permission.persisted_rule_allowed" | "permission.rule_store_unreadable" | "permission.read_only_allowed";
 type PermissionTraceDropped = "permission.sandbox_admitted" | "permission.rule_sync_resurrected" | "permission.rule_sync_dropped" | "permission.org_snapshot_unavailable";
 type _GuardPermissionTrace = AssertAllKeysHandled<Exclude<PermissionTraceKind, PermissionTraceProjected | PermissionTraceDropped>>;
 type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTraceProjected | PermissionTraceDropped, PermissionTraceKind>>;
@@ -48,6 +120,7 @@ type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<Permiss
 type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "classifierUnavailable";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
+type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
 type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
@@ -59,35 +132,86 @@ type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded
 type PausedCauseForwarded = "kind" | "gate" | "checkpointId" | "restoreMode";
 type PausedCauseStripped = "token";
 type _GuardPausedCause = AssertAllKeysHandled<Exclude<keyof PausedCause, PausedCauseForwarded | PausedCauseStripped>>;
-type _NoDoubleBookPausedCause = AssertAllKeysHandled<Extract<PausedCauseForwarded, PausedCauseStripped>>;
 type _GuardPausedCauseReverse = AssertAllKeysHandled<Exclude<PausedCauseForwarded | PausedCauseStripped, keyof PausedCause>>;
 type SettlementKeys = Settlement extends infer S ? (S extends object ? keyof S : never) : never;
 type SettlementWhoKeys = Settlement["who"] extends infer W ? (W extends object ? keyof W : never) : never;
-type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, "disposition" | "settlement" | "origin">>;
-type _GuardSettlement = AssertAllKeysHandled<Exclude<SettlementKeys, "kind" | "who" | "when" | "note">>;
-type _GuardSettlementWho = AssertAllKeysHandled<Exclude<SettlementWhoKeys, "party" | "approver" | "window">>;
+type GateOutcomeProjected = "disposition" | "settlement" | "origin";
+type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
+type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
+type SettlementProjected = "kind" | "who" | "when" | "note";
+type _GuardSettlement = AssertAllKeysHandled<Exclude<SettlementKeys, SettlementProjected>>;
+type _GuardSettlementReverse = AssertAllKeysHandled<Exclude<SettlementProjected, SettlementKeys>>;
+type SettlementWhoProjected = "party" | "approver" | "window";
+type _GuardSettlementWho = AssertAllKeysHandled<Exclude<SettlementWhoKeys, SettlementWhoProjected>>;
+type _GuardSettlementWhoReverse = AssertAllKeysHandled<Exclude<SettlementWhoProjected, SettlementWhoKeys>>;
 export type CoreKeysetGuards = [
     _GuardNotification,
+    _GuardNotificationReverse,
+    _GuardProvenance,
+    _GuardProvenanceReverse,
+    _GuardAgentMessage,
+    _GuardAgentMessageReverse,
     _GuardBgNotif,
+    _GuardBgNotifReverse,
     _GuardRoster,
+    _GuardRosterReverse,
     _GuardAsk,
+    _GuardAskReverse,
+    _GuardAskFrame,
+    _GuardAskFrameReverse,
     _GuardTaskEvent,
+    _GuardTaskEventReverse,
     _GuardMailbox,
+    _GuardMailboxReverse,
     _GuardMailboxAppend,
+    _GuardMailboxAppendReverse,
+    _GuardWiringSections,
+    _GuardWiringSectionsReverse,
+    _GuardWiringLeg,
+    _GuardWiringLegReverse,
+    _GuardWiringAsk,
+    _GuardWiringAskReverse,
+    _GuardWiringQuestion,
+    _GuardWiringQuestionReverse,
+    _GuardWiringInteraction,
+    _GuardWiringInteractionReverse,
+    _GuardWiringElicit,
+    _GuardWiringElicitReverse,
+    _GuardWiringParkLane,
+    _GuardWiringParkLaneReverse,
+    _GuardWiringSession,
+    _GuardWiringSessionReverse,
+    _GuardWiringTools,
+    _GuardWiringToolsReverse,
+    _GuardWiringFleet,
+    _GuardWiringFleetReverse,
+    _GuardWiringMcp,
+    _GuardWiringMcpReverse,
+    _GuardWiringRules,
+    _GuardWiringRulesReverse,
+    _GuardWiringModelGate,
+    _GuardWiringModelGateReverse,
+    _GuardWiringAutoMode,
+    _GuardWiringAutoModeReverse,
+    _GuardWiringGovernance,
+    _GuardWiringGovernanceReverse,
     _GuardPermissionTrace,
     _GuardPermissionTraceReverse,
     _GuardPermissionTraceNonEmpty,
     _GuardInboxSummary,
+    _GuardInboxSummaryReverse,
     _GuardTaskSpec,
     _GuardTaskSpecReverse,
     _GuardTaskResult,
     _GuardTaskResultReverse,
+    _GuardPausedCause,
+    _GuardPausedCauseReverse,
     _GuardGateOutcome,
+    _GuardGateOutcomeReverse,
     _GuardSettlement,
+    _GuardSettlementReverse,
     _GuardSettlementWho,
-    _GuardPausedCause,
-    _NoDoubleBookPausedCause,
-    _GuardPausedCauseReverse
+    _GuardSettlementWhoReverse
 ];
 export {};
 //# sourceMappingURL=core-keyset-guard.d.ts.map

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -22,6 +22,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "classifier.denial_limit",
     "mcp.injection_dropped",
     "delegation.ask_unresolvable",
+    "task.interrupt_unconsumed",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/ledger-events.d.ts

@@ -31,8 +31,13 @@
  *    的 `switch (ev.type)` 白名单臂(差集门 `test/durable-append-arm-parity.test.ts` 看守两腿一致);
  *  · **腿自己的带外行**:park/终局/失败/建议/用量/装配自证(不来自流事件)。
  */
-export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" | "status" | "context_usage" | "compacted" | "diagnostics" | "steering_injected" | "compaction_outcome" | "workspace_changed" | "wiring_manifest" | "human_input" | "task_progress" | "task_notification" | "turn_end"
-/** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)。 */
+export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" | "status" | "context_usage" | "compacted" | "diagnostics" | "steering_injected" | "compaction_outcome" | "workspace_changed" | "wiring_manifest"
+/** S-212(7.71.0):运行期名册变更(core 7.8.0 [ref] ⑪)。**快照语义**——`delta.roster` 是整只
+ *  变更后名册,消费端收到即整只替换,所以回放不需要任何合并;它的耐久面因此不是 `wiring_manifest.tools`
+ *  的重复,而是那份开腿快照**之后**的每一次改动(修前两条 durable 腿零 case ⇒ 回放只见开头一版)。 */
+ | "tool_roster_delta" | "human_input" | "task_progress" | "task_notification" | "turn_end"
+/** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
+ *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"
 /** 人在环三族的 open/close 帧对(投递面 = 本腿的 durable events tail)。 */
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
@@ -59,4 +64,19 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  * 由 `test/engine-notice-wire.test.ts` 的腿覆盖门看守,那才是它的对位门。
  */
  | "engine_notice";
+/**
+ * 🔴 **park 行名的运行时闭集**(合并重扫 [4])。
+ *
+ * 此前这两个词在仓里有**三处**并列的字面量:`ledger-sink.ts` 的 `appendParked` 形参与 `onDone` 的分诊、
+ * 以及 `observability/run-terminal-log.ts` 的脱敏臂。`LedgerEventType` 只是类型联合、运行期取不到,
+ * 所以脱敏臂只能自己再抄一份 —— 而抄的那一份**加词不红**:仓里/引擎加第三个 park 词并登记进
+ * `LedgerEventType` 之后,`appendParked` 与 resume 腿的动态首参照写照落,回放时那一行的
+ * `gate.riskDescriptor.summary` 明文,脱敏臂一声不吭。
+ *
+ * ⇒ 词表落成**运行时常量**由消费点派生;下方两条断言把它与类型联合双向锁死(多一词 / 少一词都 tsc 红)。
+ */
+export declare const PARK_LEDGER_EVENT_TYPES: readonly ["suspended", "needs_review"];
+export type ParkLedgerEventType = (typeof PARK_LEDGER_EVENT_TYPES)[number];
+/** park 行名的**收窄谓词**(消费点要的是「这个词是不是 park 词」+ 类型收窄,不是一次裸 includes)。 */
+export declare function isParkLedgerEventType(v: string): v is ParkLedgerEventType;
 //# sourceMappingURL=ledger-events.d.ts.map

package/dist/trace/ledger-events.js

@@ -1,2 +1,7 @@
-export {};
+export const PARK_LEDGER_EVENT_TYPES = ["suspended", "needs_review"];
+const _parkWordsAreLedgerTypes = true;
+void _parkWordsAreLedgerTypes;
+export function isParkLedgerEventType(v) {
+    return PARK_LEDGER_EVENT_TYPES.includes(v);
+}
 //# sourceMappingURL=ledger-events.js.map

package/dist/trace/ledger-sink.d.ts

@@ -1,7 +1,7 @@
 import { type TerminalCause } from "@sema-agent/core";
 import { brainStatusEventData } from "./project.js";
 import { NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
-import type { LedgerEventType } from "./ledger-events.js";
+import { type LedgerEventType, type ParkLedgerEventType } from "./ledger-events.js";
 /**
  * LedgerSink — the SINGLE "stream event → durable runs-ledger" projection, shared by the background leg
  * (runs.ts `runInBackground`) and the sync `/v1/tasks/stream` detach lane (server.ts, `x-detach-on-disconnect`).
@@ -61,13 +61,15 @@ export interface LedgerSink {
     }): void;
     /** Park event (durable F4 suspend / [ref] D-B review pause): ONLY the `checkpointGate` is persisted —
      *  never the capability `checkpointToken` (search [18] Q1b).
-     *  ⚠️ **"non-secret" was the old wording and it is not true** ([ref] R3, 2026-09-03 — wording only, behaviour
-     *  unchanged; [ref] decides the arm): the gate carries NO capability token, but its `riskDescriptor.summary` /
-     *  `shadowedRule` are model-/human-controlled display text that [ref] measured carrying a PEM private-key
-     *  body verbatim. This durable row replays on every `GET /v1/runs/:id/events` reconnect and is NOT backfilled
-     *  by core [ref]'s mint-point fix — it is the third face of the `checkpointGate` sister item recorded in
-     *  `http/routes/approvals-assistant.ts` (`redactPendingDisclosures` header). */
-    appendParked(kind: "suspended" | "needs_review", result: unknown): Promise<void>;
+     *  🔴 **The gate is redacted, not "non-secret"** ([ref], 2026-09-10 — the arm [ref] R3 left open): it carries no
+     *  capability token, but its `reason` and the `riskDescriptor` leaf family are model-/human-controlled display
+     *  text that [ref] measured carrying a PEM private-key body verbatim, and this durable row replays on EVERY
+     *  `GET /v1/runs/:id/events` reconnect (core [ref]'s mint-point fix does not backfill rows already written).
+     *  The redaction owner is NOT this writer: it is `redactLedgerEventData` — the one confluence every ledger row
+     *  crosses at the three store twins' `appendEvent` AND again on the read face (idempotent). Redacting here too
+     *  would put two writers on one semantic surface; the other park writers (`http/server.ts`'s two resume legs)
+     *  would still need it, and a per-writer arm is exactly the shape that drifts. */
+    appendParked(kind: ParkLedgerEventType, result: unknown): Promise<void>;
     /** Terminal `done` event. `result` must already be checkpoint-token-stripped (and, on the bg leg,
      *  model-usage-attached) by the caller. */
     appendDone(result: unknown): Promise<void>;

package/dist/trace/ledger-sink.js

@@ -1,7 +1,8 @@
 import { terminalProjection } from "@sema-agent/core";
 import { redactSecrets } from "./redact.js";
-import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
+import { toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
+import { isParkLedgerEventType } from "./ledger-events.js";
 export function createSerialLedgerAppend(appendEvent, startSeq) {
     let seq = startSeq;
     let chain = Promise.resolve();
@@ -98,6 +99,13 @@ export function createLedgerSink(opts) {
                 await flush();
                 await append("wiring_manifest", wiringManifestEventData(ev));
                 break;
+            case "tool_roster_delta": {
+                await flush();
+                const rosterDelta = toolRosterDeltaEventData(ev);
+                if (rosterDelta !== undefined)
+                    await append("tool_roster_delta", rosterDelta);
+                break;
+            }
             case "human_input":
                 await flush();
                 await append("human_input", humanInputEventData(ev));
@@ -156,7 +164,7 @@ export function createLedgerSink(opts) {
         await flush();
         if (result.terminal.kind === "paused") {
             const parkKind = terminalProjection(result.terminal).status;
-            if (parkKind === "suspended" || parkKind === "needs_review") {
+            if (isParkLedgerEventType(parkKind)) {
                 await appendParked(parkKind, result);
                 return;
             }

package/dist/trace/project.d.ts

@@ -357,11 +357,12 @@ export declare function workspaceChangedEventData(ev: {
  *       ([ref],7.57.0 已发)答的是「**若此刻提交**会不会武装」,本段答的是「**这条真跑起来的腿**武装了吗」;
  *       同一个主体(调用方自己的 run)、同一条轴,只差事前/事后。剥掉它,壳就只能拿事前预测冒充事后事实;
  *    ② **两个值都是引擎派生的闭形**:`armed` 布尔,`reason` 是 core 的闭集词(`AUTO_MODE_ARM_REASONS`:
- *       armed / no_intent / no_face / denied / resolver_fault / latch_open)—— 非用户内容,不脱敏、逐字;
+ *       armed / no_intent / no_face / denied / resolver_fault;core 7.12.0 起 `latch_open` 随熔断/单向闩
+ *       整族退役)—— 非用户内容,不脱敏、逐字;
  *    ③ **不是 governance 侧信道**:它描述的是**本腿**的武装结论,与 lockedConfig/compliance/memoryAdmission/
  *       retention 四位无函数关系;而 `denied` 这一词所披露的「组织把这一位关了」在 [ref] 读面上**本就已经**
  *       对同一租户可见(`org_denied`),本段没有扩大任何受众。
- *    🔴 **逐字透传,不映射**:core 的六词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
+ *    🔴 **逐字透传,不映射**:core 的五词与本仓 [ref] 读面的六词(`AUTO_MODE_UNARMED_REASONS`)**刻意不归一**
  *       —— 两张表回答的是两个问题、粒度也不同(core 的 `denied` 一词对应本仓的 `org_denied` / `local_denied`
  *       两词:core 只看合成后的 caps deny 位,本仓分得出这个 false 是 center 下发的还是本地 env 写的)。
  *       ⚠️ **`settings_denied` 不折进 `denied`,它折进 `no_intent`**(codex 车BO r1 [medium] 验真后纠):
@@ -423,6 +424,11 @@ export declare function workspaceChangedEventData(ev: {
  * 的那一点订阅腿的名册增量座,一次改变名册的 refresh ⇒ **恰一帧**(序在 manifest 之后、那次 refresh 自己的
  * `tool_end` 之前),`delta.fromDigest` = 消费端手上那份名册的 digest。7.66.0 写下的「前瞻接线」披露随本版
  * 退役:本臂现在会真的触发,消费端可以依赖它了。
+ *
+ * 🔴 **三腿共用本构造器(S-212,7.71.0)**:live 腿(`routes/tasks.ts`)+ 两条 durable 腿
+ * (`trace/ledger-sink.ts` 的 `onEvent` / `http/server.ts` 的 resume switch)。返回 `undefined` 的那一格在
+ * 三腿上是同一件事 ——**整帧不发 / 整帧不落账**,绝不半张名册上 wire 或落库。落账的正当性(旧裁定
+ * 「不落账」为何在 7.71.0 撤销)逐字记在 `core-keyset-guard.ts` ⑪ 段。
  */
 export declare function toolRosterDeltaEventData(ev: {
     delta?: unknown;
@@ -548,10 +554,17 @@ export interface TraceTurn {
      *  verbatim 转发——`in` 刻意保持它历史上的「总量」语义不变(旧帧/新帧读端零伤),不随 core 的
      *  `promptTokens`/`turn_end.usage.inputTokens` 翻转为 cache-MISS。新增 `uncachedIn` 承接 core 3.0.0 才有的
      *  cache-MISS 分量(命名取自 core `uncachedInputTokensOf`),只在能确认自己踩在新契约帧上时才发
-     *  (见 {@link toContractTokens})。 */
+     *  (见 {@link toContractTokens})。
+     *
+     *  🔴 **S-213⑥:五个子键**全部按同族 OMIT 契约走 —— 引擎那一侧报了才铸,没报就**缺席**,恒不折 `0`。
+     *  `in`/`out` 此前是必填座、缺一键时写 `?? 0`:读端拿到的 `in:0` 与「这一轮真的零输入」逐字节同形,
+     *  于是一次 usage 半缺(某些 provider 只回 output 侧)在面板上显示成一个可核对的真数字。
+     *  0 是一个数,未知不是 —— 两者同形正是本仓 `boundCallId`/`gateKind`/`contentKind` 一族一直在防的事。
+     *  ⚠️ wire 面(`GET /v1/tasks/:id/turns` 与 trace SSE 的 `turn` 事件)因此可能给出**只有一侧**的
+     *  `tokens`;做算术的消费端要按「键可能缺席」读(`tokens` 整只可缺席早就是契约的一部分)。 */
     tokens?: {
-        in: number;
-        out: number;
+        in?: number;
+        out?: number;
         uncachedIn?: number;
         cacheRead?: number;
         cacheWrite?: number;
@@ -600,7 +613,12 @@ export declare function turnEndEventData(ev: {
  *  的投影契约,不是 wire verbatim——`in` 保持它一直以来的**总量**语义,3.0.0 起改取 `totalInputTokens`
  *  (归一化总输入含 cache)优先,`inputTokens` 回落(旧帧/尚未升级的 core 下 `totalInputTokens` 缺席时,
  *  `in` 落回旧值,读端零伤)。`uncachedIn` 只在**能确认自己踩在新契约帧上**(`totalInputTokens` 在场)时
- *  才发——旧帧的 `inputTokens` 是族依赖的旧语义,标成「uncachedIn(cache-MISS)」会是谎言。 */
+ *  才发——旧帧的 `inputTokens` 是族依赖的旧语义,标成「uncachedIn(cache-MISS)」会是谎言。
+ *
+ *  🔴 S-213⑥:**一条规则管五个子键** —— 源侧在场就铸、缺席就不铸,没有 `?? 0`。此前 `in`/`out` 两座
+ *  各带一个默认 0,于是 usage 半缺(provider 只回 output 侧)被投影成 `in:0` = 一个看起来可核对的真
+ *  数字;`uncachedIn`/`cacheRead`/`cacheWrite` 三键从第一天起就是缺席制,`in`/`out` 只是漏进了默认值。
+ *  早退分支语义不变:输入两键(择一)与 `outputTokens` 全缺 ⇒ 整只 `tokens` 缺席(不铸空对象)。 */
 export declare function toContractTokens(usage: unknown): TraceTurn["tokens"] | undefined;
 /** [ref]C-13:tool_start/tool_end 的**共享挑键**——`projectEvents`(turns 面)与 `mapTraceEvent`
  *  (trace SSE 面)对同一账本行的字段选择逐字同构,此前两处独立手写,structured/totalChars/label

package/dist/trace/project.js

@@ -493,11 +493,12 @@ export function toContractTokens(usage) {
     if (!usage || typeof usage !== "object")
         return undefined;
     const u = usage;
-    if (u.inputTokens == null && u.totalInputTokens == null && u.outputTokens == null)
+    const inTokens = u.totalInputTokens ?? u.inputTokens;
+    if (inTokens == null && u.outputTokens == null)
         return undefined;
     return {
-        in: u.totalInputTokens ?? u.inputTokens ?? 0,
-        out: u.outputTokens ?? 0,
+        ...(inTokens != null ? { in: inTokens } : {}),
+        ...(u.outputTokens != null ? { out: u.outputTokens } : {}),
         ...(u.totalInputTokens != null && u.inputTokens != null ? { uncachedIn: u.inputTokens } : {}),
         ...(u.cacheReadTokens != null ? { cacheRead: u.cacheReadTokens } : {}),
         ...(u.cacheWriteTokens != null ? { cacheWrite: u.cacheWriteTokens } : {}),
@@ -650,6 +651,7 @@ function mapTraceEventInner(type, seq, data) {
         case "compaction_outcome":
         case "wiring_manifest":
         case "human_input":
+        case "tool_roster_delta":
             return null;
         default:
             return null;

package/dist/trace/redact.d.ts

@@ -1,3 +1,31 @@
+/**
+ * Trace thinking-block redaction (service-side). Per core [R57]: the agent's reasoning/CoT is emitted on the
+ * live TaskEvent stream but DELIBERATELY kept out of the metadata Tracer because CoT may contain reasoned-about
+ * secrets (and is large / ToS-sensitive for some providers). Persisting it for the trace UI is the deployment's
+ * call — so when we DO persist it, redact unambiguous secret formats first. Conservative on purpose: only clear
+ * key/token shapes are redacted. ⚠️ It is NOT exhaustive: unrecognised secret formats (a free-text password,
+ * a JWT) pass through, and the broad `Bearer <20+ chars>` rule can over-match legitimate CoT (false positives
+ * tolerated — over-redacting trace text is safe). For sensitive deployments, disable thinking capture entirely
+ * via TRACE_THINKING=false. This is a seam — deployments can extend the patterns.
+ *
+ * 两组臂,顺序即优先序:{@link FULL_SECRET_PATTERNS}(完整形)在前,{@link FRAGMENT_SECRET_PATTERNS}
+ * ([ref] 前缀残片,上游先截后脱的产物 ⇒ 带 `:partial` 后缀的 token)在后。
+ */
+/** 本模块替换 token 的**闭形**正则源(`«redacted»` / `«redacted:aws-key»` / `«redacted:gh-token:partial»` …):
+ *  URL-userinfo 臂用它把「用户名位上已经是本模块 token」整个当一个用户名单元吃掉。模块加载时对
+ *  {@link REDACTION_TOKENS} 逐个校验闭形(表加了新 token 形而这里没跟 ⇒ 加载即抛,fail-closed)。 */
+import { stripFormatCharacters } from "@sema-agent/core";
+/**
+ * `redactSecrets` 的**归一化前置**(S-103 ①):把全部 `\p{Cf}`(零宽空格 / 词连接符 / BOM / 软连字符 / ZWJ / ZWNJ …)
+ * 剥掉。实现单一属主是 core 的 `stripFormatCharacters`(`@sema-agent/core`,7.3.1 起导出,正是为「先扫描后渲染」这一序
+ * 开的口),本模块只**转出**它,不抄第二份 —— 两份实现漂了就等于两个「什么是格式字符」的定义。
+ *
+ * 🔴 **需要判断「这次脱敏到底有没有认出凭据形」的调用方,比较基准是它、不是原文**:
+ * `redactSecrets(x) !== x` 在本版里对**任何**含 Cf 的文本都为真(输出是剥后文本),拿它当谓词会把一条带 emoji ZWJ
+ * 的普通 `git commit` 判成「含凭据形」;正确的谓词是 `redactSecrets(x) !== normalizeForRedaction(x)`。
+ * 现役消费方:`src/tool-approval.ts` 的 `durableRuleMaterial`(规则车道素材闸)与语料的 FP=0 格。
+ */
+export declare const normalizeForRedaction: typeof stripFormatCharacters;
 /** 测试可见:扫描器 indexOf 实际扫过的字节数(摊还线性 ⇒ ≤ 常数 × 输入长)。 */
 export declare function ppkScanBytesForTest(): number;
 export declare function resetPpkScanBytesForTest(): void;