@sema-agent/server 7.77.0 → 7.78.0

package/dist/boot/runner-deps.js

@@ -156,7 +156,9 @@ export function createRunnerDeps(ctx) {
         onElicit: elicitation ? elicitation.elicit : undefined,
         onQuestion: question ? question.question : undefined,
         onAsk: createRunnerDepsOnAsk(toolApproval),
-        autoMode: {},
+        autoMode: {
+            ...(config.autoModeClassifierFallback !== undefined ? { classifierFallback: config.autoModeClassifierFallback } : {}),
+        },
         sessionStore,
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
         memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,

package/dist/config-catalog.js

@@ -73,6 +73,7 @@ export const CONFIG_CATALOG = [
     r("AUTH_BRIDGE_ISSUER", "auth", "string", "registry SSO-JWT issuer(auth bridge 的开关之一)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 用 configCenter.baseUrl(配了 center 即默认开桥)" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: ["read-only", "ask", "plan", "auto"], configKey: "autonomy", center: cGov("autonomy") }),
+    r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
     r("BAKE_CACHE_BASE", "orchestration", "url", "烤镜像 fetch-once 缓存源 base(注入 --cache-base;绝不受调用方控制)"),
     r("BAKE_IMAGE_REGISTRY", "orchestration", "string", "烤镜像自动登记的 registry host 前缀(repo=registry/profile)"),
     r("BAKE_LEASE_MS", "orchestration", "number", "bake 租约窗(ms;runner 心跳推进,过期被 reaper 抢)", { staticDefault: "90000" }),

package/dist/config-center/read-warnings.d.ts

@@ -9,12 +9,21 @@
  *
  * 截断:schema 的键列表有界(64),超界带 `truncatedFrom`(真实总数)——文案如实带上,消费方永远不把有界列表当穷举。
  * 词表是闭集:`switch` 穷举 `kind`,schema 加新 kind 这里编译红,不会静默漏臂。
+ *
+ * **归族只有一条判据**(下游只有一个消费者——候选门:非空 ⇒ 这棵树整拒、保 LKG):
+ * 运维**写了而没生效**的 ⇒ 候选门错误;值**已被收编接受**(写了、生效了、只是换了个位置或被夹住)⇒ 不入诊断面。
+ * settings-schema 2.0.0 的两员新告警各自入族,没有新开第三档:`entry-dropped`(逐条容错丢掉的那条条目——
+ * 运维写下的模型/服务器没进目录,与 `domain-defaulted` 是同一件事的细/粗两档)归前者;
+ * `legacy-governance-lifted`(0.5 期 runtime 文档里的治理三闸被抬进 governance 域)归后者——那几个键**生效了**
+ * (`buildEffective` 用抬升结果解析 governance),把它折成错误会让一份合法的 0.5 期存量配置每一次 refresh 都被
+ * 候选门整拒,而它在 1.10.0 上零告警零 domainErrors(亲验读数)。兼容臂的关窗观测归属主(settings-schema 的
+ * `onWarning` 流),不借候选门这条带副作用的通道传信息。
  */
 import type { EffectiveReadWarning } from "@sema-agent/settings-schema";
 export type FoldedReadWarning = {
     readonly domain: string;
     readonly error: string;
 };
-/** null = 不入诊断面(`hosts-grandfathered`:值已被收编接受,与本地店同口径)。 */
+/** null = 不入诊断面(`hosts-grandfathered` / `legacy-governance-lifted`:值已被收编接受,与本地店同口径)。 */
 export declare function foldEffectiveReadWarning(w: EffectiveReadWarning): FoldedReadWarning | null;
 //# sourceMappingURL=read-warnings.d.ts.map

package/dist/config-center/read-warnings.js

@@ -1,5 +1,6 @@
 const MAX_ERROR_CHARS = 600;
 const cap = (s) => s.slice(0, MAX_ERROR_CHARS);
+const errorText = (e) => (e instanceof Error ? e.message : String(e));
 const keyList = (prefix, keys, truncatedFrom) => {
     const total = truncatedFrom ?? keys.length;
     const budget = MAX_ERROR_CHARS - prefix.length;
@@ -18,9 +19,12 @@ const keyList = (prefix, keys, truncatedFrom) => {
 export function foldEffectiveReadWarning(w) {
     switch (w.kind) {
         case "hosts-grandfathered":
+        case "legacy-governance-lifted":
             return null;
         case "domain-defaulted":
-            return { domain: w.domain, error: cap(w.error instanceof Error ? w.error.message : String(w.error)) };
+            return { domain: w.domain, error: cap(errorText(w.error)) };
+        case "entry-dropped":
+            return { domain: w.domain, error: cap(`entry dropped by domain schema: ${w.path} (${errorText(w.error)})`) };
         case "unknown-keys-dropped":
             return { domain: w.domain, error: keyList("unknown keys dropped by domain schema: ", w.keys, w.truncatedFrom) };
         case "unknown-keys-carried":

package/dist/config-provider.js

@@ -2,7 +2,7 @@ import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
 import { foldEffectiveReadWarning } from "./config-center/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/settings-schema";
+import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
@@ -74,7 +74,7 @@ export class LocalConfigProvider {
         if (etag !== undefined && etag === tag)
             return null;
         const refErrors = [];
-        const resolve = siblingResolver(store, eff);
+        const resolve = createSiblingResolver(store, eff);
         for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
             if (issues.length > 0)

package/dist/config-types.d.ts

@@ -1440,6 +1440,18 @@ export interface ServiceConfigFlat {
      *  「缺席=不阻」⇒ 壳发 `permissionMode:"auto"` 即武装)。词表外的值 boot 拒启(安全轴旋钮不许静默回默认)。
      *  合成点 = `boot/runtime-caps.ts` 最外层(applyLocalAutoModeDeny);读面 = `/v1/capabilities.permissionModeAuto`。 */
     permissionsDisableAutoMode: boolean;
+    /** 7.78.0(core 7.18.0 [ref])—— **分类器席答不出话时怎么办**(`AUTO_MODE_CLASSIFIER_FALLBACK`,
+     *  部署级旋钮,闭二词 `main` | `none`,词表外的值 boot 拒启)。
+     *
+     *  为什么这一格必须由部署说了算:core 7.18.0 把**缺省**从「分类器跑不出裁决 ⇒ 这一次门控调用整条拒」
+     *  改成「主模型代判」(`main`)。auto 模式里的分类器是一道**筛子**,而 `main` 让**被筛的那只模型**
+     *  兼任筛子 —— 这是权限轴上的一次放宽,愿不愿意接受它是部署的事,不是引擎的事。`none` = 只留分类器
+     *  那一级梯子 = **7.77.0 及以前的行为逐字**。
+     *
+     *  🔴 **缺席 = 不铸键**(与 `readFace` 族同律,不复制上游缺省):上游改缺省之日起本仓不会成为第二份
+     *  真源。所以缺席时这台机器跟随 core 的 `main`,运维面由 DEPLOY-PREREQS 的升级段点名(「默认变了」
+     *  是升级须知,不是一个可以静默过去的实现细节)。 */
+    autoModeClassifierFallback?: "main" | "none";
     /** S-111([ref] §4.4)—— CC `settings.crossSessionInbound` 的**部署/组织层**(引擎层形的 `managed` 层,
      *  CC `policySettings` 对位):本部署对入站跨会话消息的治理三态。`accept` 投递 / `hold` 停在收件会话的待审
      *  队列 / `refuse` 整体退出车道。**未设 = 本层不设**(不是 accept):引擎读作「managed 层未表态」,由其余层
@@ -1814,7 +1826,7 @@ export type ServiceStoreConfig = Pick<ServiceConfigFlat, "sessionBackend" | "ses
 export type ServiceModelPlaneConfig = Pick<ServiceConfigFlat, "gatewayBaseUrl" | "gatewayApiKey" | "gatewayFallbackUrls" | "gatewayMaxRetries" | "anthropic" | "resilience" | "model" | "envModel" | "models" | "modelApiKeyEnv" | "modelApiKeys" | "modelQuotaWeights" | "tiers" | "projects" | "roles" | "atModelAllowlist" | "cascadeLadder" | "degrade">;
 /** 组:approval(审批 / HITL 门)。`directDoorActive` 无 env 解析腿(装配层三域合取的产物),但语义上
  *  就是本组的门状态,故进组;`parseApprovalDomain` 的返回类型相应是 `Omit<…, "directDoorActive">`。 */
-export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "crossSessionInbound" | "crossSessionDialogExpiry">;
+export type ServiceApprovalConfig = Pick<ServiceConfigFlat, "approvalRequire" | "approvalDeny" | "approvalTimeoutSec" | "approvalAutoBudget" | "approvalNeverAuto" | "approvalHmacKeys" | "durableApproval" | "durableApprovalSource" | "streamAskWindowMsSource" | "directApprovalDoor" | "directDoorActive" | "resourceSuspend" | "resourceSuspendTtlSec" | "resourceSuspendTotalTokens" | "resourceSuspendTotalBudgetUsd" | "resourceSuspendMaxSlices" | "askQuestionEnabled" | "questionThrottle" | "toolApprovalEnabled" | "permissionRulesEnabled" | "permissionRulesEnabledExplicit" | "streamAskWindowMarginMs" | "streamApproval" | "unattendedApprovalPolicy" | "mcpElicitation" | "sensitiveWritePatterns" | "writeProtectedPaths" | "manualModeShellGate" | "permissionsDisableAutoMode" | "autoModeClassifierFallback" | "crossSessionInbound" | "crossSessionDialogExpiry">;
 /** 组:memory(记忆面 + TOC 同步腿)。 */
 export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled" | "memoryEngineDir" | "memoryEngineRemoteLaneAllowed" | "memoryEngineBackend" | "memoryScope" | "memoryPersistenceCapable" | "memorySync" | "memoryEmbedder" | "memoryOrgAdmissionMode" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "memoryConsolidationDriver" | "memoryOrgDirectoryJson" | "memoryOrgGrantTtlMs" | "memoryOrgUnavailableBackoffMs" | "projectMemoryEnabled" | "syncImportLeaseStaleSec">;
 /** 组:auth(鉴权 / 身份 / 治理棒)。`commandPolicy` 只有 sema-registry 腿(无 env 标量形),故 env 解析

package/dist/config.js

@@ -1162,6 +1162,7 @@ function parseApprovalDomain(ctx) {
                 `Refusing to boot rather than treating a misspelled value as "unset": that silently ran the deployment with NO shell gate while the operator believed one was configured`);
         })(process.env.MANUAL_MODE_SHELL_GATE),
         permissionsDisableAutoMode: boolEnv("PERMISSIONS_DISABLE_AUTO_MODE", false),
+        ...optionalEnumKey("autoModeClassifierFallback", "AUTO_MODE_CLASSIFIER_FALLBACK", process.env.AUTO_MODE_CLASSIFIER_FALLBACK, ["main", "none"]),
         ...optionalEnumKey("crossSessionInbound", "CROSS_SESSION_INBOUND", process.env.CROSS_SESSION_INBOUND, CROSS_SESSION_INBOUND_SETTINGS),
         ...optionalEnumKey("crossSessionDialogExpiry", "CROSS_SESSION_DIALOG_EXPIRY", process.env.CROSS_SESSION_DIALOG_EXPIRY, CROSS_SESSION_DIALOG_EXPIRY_VALUES),
         mcpElicitation: {
@@ -1993,7 +1994,7 @@ const APPROVAL_GROUP_KEYS = [
     "approvalRequire", "approvalDeny", "approvalTimeoutSec", "approvalAutoBudget", "approvalNeverAuto",
     "approvalHmacKeys", "durableApproval", "durableApprovalSource", "streamAskWindowMsSource", "directApprovalDoor", "directDoorActive", "resourceSuspend",
     "resourceSuspendTtlSec", "resourceSuspendTotalTokens", "resourceSuspendTotalBudgetUsd", "resourceSuspendMaxSlices", "askQuestionEnabled", "questionThrottle", "toolApprovalEnabled", "permissionRulesEnabled", "permissionRulesEnabledExplicit", "streamAskWindowMarginMs", "streamApproval", "unattendedApprovalPolicy", "mcpElicitation",
-    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "crossSessionInbound", "crossSessionDialogExpiry",
+    "sensitiveWritePatterns", "writeProtectedPaths", "manualModeShellGate", "permissionsDisableAutoMode", "autoModeClassifierFallback", "crossSessionInbound", "crossSessionDialogExpiry",
 ];
 const MEMORY_GROUP_KEYS = [
     "memoryEngineEnabled", "memoryEngineDir", "memoryEngineRemoteLaneAllowed", "memoryEngineBackend", "memoryScope",

package/dist/http/routes/tasks.js

@@ -13,7 +13,7 @@ import { clearTurnActivity, readTurnActivityMs, recordTurnActivity } from "../..
 import { mintCancelledResult } from "../../run-cancel-context.js";
 import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
-import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData } from "../../trace/project.js";
+import { contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, wiringManifestOperatorEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, textEndEventData } from "../../trace/project.js";
 import { cascadeConfig, runMeta } from "../run-meta.js";
 import { scopedIdempotencyKey } from "../idempotency.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
@@ -487,6 +487,16 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     if (rosterDelta !== undefined)
                                         sseData(res, { type: "tool_roster_delta", ...rosterDelta });
                                 }
+                                else if (ev.type === "tool_progress") {
+                                    const progress = toolProgressEventData(ev);
+                                    if (progress !== undefined)
+                                        sseData(res, { type: "tool_progress", ...progress });
+                                }
+                                else if (ev.type === "tool_disclosure") {
+                                    const disclosure = toolDisclosureEventData(ev);
+                                    if (disclosure !== undefined)
+                                        sseData(res, { type: "tool_disclosure", ...disclosure });
+                                }
                                 else if (ev.type === "human_input") {
                                     sseData(res, { type: "human_input", ...humanInputEventData(ev) });
                                 }

package/dist/http/routes/workflows.js

@@ -246,7 +246,12 @@ function projectLegApprovalKeys(agent) {
     };
 }
 function projectParkRow(p) {
-    return { callKey: p.callKey, sessionId: p.sessionId, originRunId: p.originRunId };
+    return {
+        callKey: p.callKey,
+        sessionId: p.sessionId,
+        originRunId: p.originRunId,
+        ...(p.originUnconfirmed === true ? { originUnconfirmed: true } : {}),
+    };
 }
 function summarizeWorkflowDetail(run) {
     const isDone = (s) => s === "completed" || s === "failed";
@@ -343,6 +348,7 @@ function summarizeWorkflowDetail(run) {
         ...(run.error !== undefined ? { error: redactErrorMessage(run.error) ?? "" } : {}),
         ...(run.errorCode !== undefined ? { errorCode: run.errorCode } : {}),
         ...(run.parks !== undefined ? { parks: run.parks.map(projectParkRow) } : {}),
+        ...(run.resumeAdmissionIncomplete === true ? { resumeAdmissionIncomplete: true } : {}),
         ...(run.result !== undefined ? { result: redactSecrets(run.result) } : {}),
         phases,
         ...(unphasedView ? { unphased: unphasedView } : {}),

package/dist/http/server.js

@@ -33,7 +33,7 @@ import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
@@ -1687,6 +1687,13 @@ export function createHttpServer(rawDeps) {
                                     await append("tool_roster_delta", rosterDelta);
                                 break;
                             }
+                            case "tool_disclosure": {
+                                await flush();
+                                const disclosure = toolDisclosureEventData(ev);
+                                if (disclosure !== undefined)
+                                    await append("tool_disclosure", disclosure);
+                                break;
+                            }
                             case "human_input":
                                 await flush();
                                 await append("human_input", humanInputEventData(ev));
@@ -2518,6 +2525,7 @@ const WORKER_SWAP_REDEEMABLE = {
     real_approval_forged: false,
     read_face_damaged: false,
     read_face_forged: false,
+    write_face_damaged: false,
     constraint_chain_missing: false,
 };
 function checkpointRowRedeemableElsewhere(reason) {

package/dist/observability/fail-open.d.ts

@@ -29,6 +29,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "⑪(core 7.8.0 design/388,`trace/project.ts` 的 `wiring_manifest.tools` 段与 `tool_roster_delta` 构造器共用):载荷过不了 core 自己的 typebox 判形器(`ToolRoster` / `ToolRosterDelta`)⇒ 那一段缺席 / 那一帧不发,**绝不半张脸上 wire**。放行的最坏后果=消费端这条腿看不到工具名册(壳退回按名字分组、用通用审批卡),不影响任何裁决——名册是观测/渲染面,门在引擎里早已判完。反方向(把一份判不了形的名册照发)更坏:消费端会把读不出的行当成「这只工具没挂」。计数让「某个世代的产生者一直在发坏名册」显形。";
     };
+    readonly "server.trace.projection-input-malformed": {
+        readonly cls: "F";
+        readonly note: "7.78.0(core 7.18.0 #741/#786/#789/#790,`trace/project.ts` 的五张新投影脸共用一条规则):`tool_progress` / `tool_disclosure` 两帧的必需位读不出 ⇒ **整帧不发**;`wiring_manifest.hooks[]` / `wiring_manifest.lsp` / `context_usage.sections[]` 三段的容器形或成员形读不出 ⇒ 那一行/那一段被丢、全丢光即键缺席。规则一句话:**在场但读不出 ⇒ 计一次并丢弃;缺席从不计数**(缺席是这几张脸上的一等状态,契约把它定义成一个正面事实 —— `hooks` 缺席 = 「本条腿没有自己的钩子记录」、`sections` 缺席 = 「这条腿没装配出段 IR」、`lsp` 缺席 = 「本部署没接 LSP」)。放行的最坏后果=这条腿的消费端少一张观测/渲染面(壳退回上一份已知状态或通用卡片),**不影响任何裁决**——门在引擎里早已判完。反方向(半张脸照发)严格更坏:消费端会把读不出的行当成那个正面事实。计数是**唯一**能把「坏世代 / 第三方 producer 一直在发坏载荷」与那个正面事实分开的位。";
+    };
     readonly "server.task-mcp.source-label-dropped": {
         readonly cls: "F";
         readonly note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。";

package/dist/observability/fail-open.js

@@ -20,6 +20,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "⑪(core 7.8.0 design/388,`trace/project.ts` 的 `wiring_manifest.tools` 段与 `tool_roster_delta` 构造器共用):载荷过不了 core 自己的 typebox 判形器(`ToolRoster` / `ToolRosterDelta`)⇒ 那一段缺席 / 那一帧不发,**绝不半张脸上 wire**。放行的最坏后果=消费端这条腿看不到工具名册(壳退回按名字分组、用通用审批卡),不影响任何裁决——名册是观测/渲染面,门在引擎里早已判完。反方向(把一份判不了形的名册照发)更坏:消费端会把读不出的行当成「这只工具没挂」。计数让「某个世代的产生者一直在发坏名册」显形。",
     },
+    "server.trace.projection-input-malformed": {
+        cls: "F",
+        note: "7.78.0(core 7.18.0 #741/#786/#789/#790,`trace/project.ts` 的五张新投影脸共用一条规则):`tool_progress` / `tool_disclosure` 两帧的必需位读不出 ⇒ **整帧不发**;`wiring_manifest.hooks[]` / `wiring_manifest.lsp` / `context_usage.sections[]` 三段的容器形或成员形读不出 ⇒ 那一行/那一段被丢、全丢光即键缺席。规则一句话:**在场但读不出 ⇒ 计一次并丢弃;缺席从不计数**(缺席是这几张脸上的一等状态,契约把它定义成一个正面事实 —— `hooks` 缺席 = 「本条腿没有自己的钩子记录」、`sections` 缺席 = 「这条腿没装配出段 IR」、`lsp` 缺席 = 「本部署没接 LSP」)。放行的最坏后果=这条腿的消费端少一张观测/渲染面(壳退回上一份已知状态或通用卡片),**不影响任何裁决**——门在引擎里早已判完。反方向(半张脸照发)严格更坏:消费端会把读不出的行当成那个正面事实。计数是**唯一**能把「坏世代 / 第三方 producer 一直在发坏载荷」与那个正面事实分开的位。",
+    },
     "server.task-mcp.source-label-dropped": {
         cls: "F",
         note: "B-036 / S-143(`mcp-source-label.ts readMcpSourceLabel`,请求腿 + center 腿共用):`mcpServers[].source`(分组标签,显示用、开集)坏形——空串 / 超 80 字 / 非字符串——**丢键留 server**。放行的最坏后果=这台 server 在 wiring_manifest.mcp[] 里没有分组标签(难看),不是门/权限/凭证;本地 config.d 腿由 settings-schema 1.7.0 在解析处拒,故本臂只在请求腿与远端 /effective 直读 JSON 腿可达。",

package/dist/observability/run-terminal-log.js

@@ -101,6 +101,7 @@ const RESULT_KEY_TREATMENT = {
     pendingApproval: "verbatim",
     approvalWaitedMs: "verbatim",
     effectiveReadFace: "verbatim",
+    effectiveWriteFace: "verbatim",
     effectiveReadDenyPatterns: "verbatim",
     effectiveMemoryScopes: "verbatim",
     stats: "verbatim",

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -32,9 +32,13 @@ export type WorkflowRunParkKey = NonNullable<WorkflowRun["parks"]>[number];
  * 盘上 run blob → `parks[]` 的**唯一读者**(宪法 [ref] §2:进程外字节禁裸 `as` 铸形;与本文件
  * {@link readAgentSessionLedgerLine} 同一条姿态)。
  *
- * 判据与 core 的 resume 准入**同源**(亲读安装树 `dist/orchestration/workflow.js:2217-2226`):
- *  · 这一位**不是数组**(旧引擎写的记录 / 被投影剥掉)⇒ 读不出来。core 对这样的记录整条拒 resume
- *    (`workflow.park_truth_unreadable` / `parks_unreadable`),本仓因此也兑付不了它 —— 答缺席,由调用方响亮拒;
+ * 判据(7.78.0 / core 7.18.0 [ref] 复核后的口径):
+ *  · 这一位**不是数组**(旧引擎写的记录 / 被投影剥掉)⇒ **本读者**读不出来 ⇒ 答缺席,由调用方响亮拒。
+ *    ⚠️ 这已**不再**等于「core 也拒 resume」:core 7.18.0 起对 `parks` 缺席的记录从 journal 的 `parked`
+ *    臂 + 记录自己 `parked` 腿行的 `parkedCheckpointToken` 派生候选并逐个验真,非空即准入(三臂的第二臂)。
+ *    本读者仍答缺席的理由是另一条:那条派生只发生在**准入期**,赎回键从记录上读不出来 —— 服务端要么拒,
+ *    要么在自己这边重算 core 的三臂(被 [ref] 统一掉的双读)。恢复动作因此是「去 resume 这条 run」,
+ *    逐字见 `parked-decide.ts` 的 `denyWorkflowParksUnreadable` 顶注;
  *  · **任一条目形不合 ⇒ 整只读不出来**(整档成败制,与本文件账本行同判)。core 对同一形抛
  *    `park_binding_broken` 整条拒 resume;「丢掉坏的、留下好的」会静默铸出一份**比真相少几条 park** 的行集,
  *    而这只读者的消费面正是 park 的赎回路由。

package/dist/parked-decide.d.ts

@@ -49,16 +49,26 @@ export type ParkOrigin = {
     park: WorkflowRunParkKey;
 }
 /**
- * S-252 —— **这条记录的 park 真源读不出来**(第四种出身,不是第四条车道)。
+ * S-252 —— **这条记录的 park 真源在本车道读不出来**(第四种出身,不是第四条车道)。
  *
  * 索引行还在、run 行也还在,但记录上没有一份读得出来的 `parks[]`:旧引擎(core < 7.17.0)写下的存量行
- * 根本没有这一位,或者某一条条目的形坏了。而这一位是**引擎自己**的 park 责任表 —— core 的 resume 准入
- * 读不到它就整条拒(`workflow.park_truth_unreadable` / `parks_unreadable`,亲读安装树
- * `dist/orchestration/workflow.js:2217-2218`;条目形坏 ⇒ `park_binding_broken`,`:2222-2224`)。
- * ⇒ 这条决定**结构上**送不出去:答 200「已交给宿主的下一跑」就是一张兑付不了的回执。
+ * 根本没有这一位,或者某一条条目的形坏了。而这一位是**引擎自己**的 park 责任表,也是本车道把调用方的
+ * checkpoint join 到某一条 park 的**单一真源** ⇒ 这条决定**结构上**送不出去:答 200「已交给宿主的
+ * 下一跑」就是一张兑付不了的回执。
  * 此前这一格与「索引落后一拍 / 这条 run 已不再负责它」两种**正常** miss 完全同形,于是落 legacy 腿拿
  * 一个错因 409。判别式据真源的**可读性**把这一格分出来,三个消费点各自响亮处置(decide 拒 + 不驱动
  * 宿主续跑;SLA sweep 照旧静默跳过——它同样复核不了)。
+ *
+ * 🔴 **7.78.0 / core 7.18.0([ref]):本臂的「为什么拒」没变,「拒了之后干什么」变了。**
+ * 旧注(与旧拒文)断言 core 的 resume 准入对 `!Array.isArray(prior.parks)` 一律整条拒,并据此告诉运维
+ * 「这条 run 恢复不了,开一条新的」。core 7.18.0 把那条准入拆成**三臂**([ref]「走 a″」),该断言
+ * 自此为假:①记录带 `parks` ⇒ 那张表独自作数(不变);②**`parks` 缺席 ⇒ 候选从 journal 的 `parked` 臂
+ * 与记录自己 `parked` 腿行的 `parkedCheckpointToken` 取并集派生**,非空即准入(每个派生候选仍逐个
+ * `checkpointStore.get(token)` 验真);③缺席且并集为空 ⇒ 仍拒(`parks_unreadable`,条件收窄到这一格)。
+ * ⇒ 存量记录**多数可以被 resume 救回来**,而旧拒文让人去开新 run = 把一条救得回来的 run 劝弃。
+ * 本车道**仍然拒**(core 逐字:那种记录的赎回键是在准入期派生的、**从记录上读不出来**;本腿要么拒、
+ * 要么就得在服务端重算 core 的三臂 —— 后者正是这次统一掉的双读),但恢复动作改成真话:**去 resume
+ * 这条 run**。准入一旦走完,core 会把 `parks` 写上记录([ref]),下一次 `/decide` 就走正常的 workflow 臂。
  */
  | {
     kind: "workflow_parks_unreadable";
@@ -228,13 +238,18 @@ export type WorkflowParkedDecidePlan = {
 /**
  * S-252 —— **park 真源读不出来的那条记录的响亮拒**(与上面那族拒臂同一种返回形)。
  *
- * 为什么是拒而不是「尽力而为地投递一次」(机理按安装树 core 7.17.1 `dist/orchestration/workflow.js` 亲读):
- *  · 记录上的 `parks[]` 是**引擎自己**的 park 责任表,而且是**下一次 resume 的准入输入**:
- *    `!Array.isArray(prior.parks)` ⇒ 整条拒 resume(`workflow.park_truth_unreadable` / `parks_unreadable`,
- *    :2217-2218);某一条条目形坏 ⇒ `park_binding_broken`(:2222-2224)。两者都不是「少一条 park」,
- *    是**这条 run 再也 resume 不了** —— 而本车道的投递腿恰恰是让宿主去 `Workflow({resumeFromRunId})`。
- *  ⇒ 决定结构上送不出去。答 200「已交给宿主的下一跑」就是一张兑付不了的回执:卡还 pending、人以为决完了。
- *  ⇒ 拒,并把真话说出来:这条 run 恢复不了,开一条新的;卡仍 pending,什么都没有被伪造。
+ * 为什么是拒而不是「尽力而为地投递一次」:记录上的 `parks[]` 是本车道把调用方的 checkpoint join 到某一条
+ * park 的**单一真源**。读不出来 ⇒ 这条决定结构上送不出去,答 200「已交给宿主的下一跑」就是一张兑付不了的
+ * 回执:卡还 pending、人以为决完了。⇒ 拒,并把真话说出来;卡仍 pending,什么都没有被伪造。
+ *
+ * 🔴 **7.78.0 / core 7.18.0([ref]):真话变了一句,拒没变。** 亲读安装树 7.18.0 的三臂准入(判别式顶注逐字
+ * 记着):`parks` 缺席时 core **从 journal 的 `parked` 臂 + 记录自己 `parked` 腿行的 `parkedCheckpointToken`
+ * 派生候选**并逐个向 checkpoint 店验真,非空即准入 —— 所以「这条 run 恢复不了」自 7.18.0 起对**多数**存量
+ * 记录是假的,照旧文答就是劝人弃掉一条救得回来的 run。本腿仍拒的理由是另一条(core 逐字):那种记录的赎回键
+ * 是**在准入期派生的、从记录上读不出来**,服务端要么拒、要么重算 core 的三臂(被这次统一掉的双读)。
+ * ⇒ 恢复动作 = **去 resume 这条 run**(`Workflow({resumeFromRunId})`):准入走完 core 会把 `parks` 写上
+ * 记录([ref]),下一次 `/decide` 走正常 workflow 臂。若引擎那一步也拒(journal 与腿行都给不出候选,
+ * core 的第三臂),那才是真的恢复不了。
  *
  * 这条臂的受害集 = **存量持久数据**(core < 7.17.0 的引擎写下、升级后还 parked 着的 run 记录)。硬 breaking
  * 三句里持久数据那一句要的就是这个形:响亮拒,不做静默双读(读 `agents[]` 补一份身份正是被退役的双算)。

package/dist/parked-decide.js

@@ -89,7 +89,7 @@ export function denyWorkflowParksUnreadable(origin) {
     return {
         status: 409,
         body: {
-            error: "this parked workflow agent's run record carries no readable list of the parks the run owns — the engine writes that list when it parks, and it is the only proof that this checkpoint token belongs to that run. A record written by an engine older than the one deployed here (or one whose entries are damaged) is refused by a resume of the run itself for the same reason, so the decision is NOT delivered rather than answered with a receipt nothing can redeem. The approval card stays pending and nothing is forged: this run cannot be resumed — start a new run",
+            error: "this parked workflow agent's run record carries no readable list of the parks the run owns — the engine writes that list when it parks, and it is the only proof that this checkpoint token belongs to that run. This route cannot join your checkpoint to a park without it, so the decision is NOT delivered rather than answered with a receipt nothing can redeem. The approval card stays pending and nothing is forged. Resume the run itself instead: the engine derives the parks such a record owns from its journal and its own parked legs, proves each against the checkpoint store, and writes the list onto the record once that admission completes — after which this route works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
             errorCode: "decide.workflow_parks_unreadable",
             runId: origin.runId,
         },

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -80,9 +80,13 @@ export declare function withRedactedError<T extends {
  *
  *  🔴 **`parks[]` 是这条阶梯唯一不许碰的东西**(core 7.17.0 [ref] 义务②)。
  *  它不是观测位,是**下一次 resume 的准入输入**:core 的 resume 准入在任何 agent 被派发之前读记录上的
- *  这一位,读不到就整条拒(`workflow.park_truth_unreadable` / `parks_unreadable`)——不是「少一条 park」,
- *  是**这条 run 再也 resume 不了**;它同时也是本仓 `/decide` 的 workflow 车道复核「这条 park 属于这条 run」
- *  的**单一真源**(S-252)。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
+ *  这一位。🔴 **7.78.0 / core 7.18.0([ref])口径更新**:读不到**不再**是整条拒 —— core 改成三臂,缺席时
+ *  从 journal 的 `parked` 臂 + 记录自己 `parked` 腿行的 `parkedCheckpointToken` 派生候选逐个验真,非空即
+ *  准入,空才拒(`parks_unreadable` 条件收窄到那一格)。但**本店剥它仍是灾难级**:带 `parks` 的记录走
+ *  第一臂,「那张表独自作数」—— 剥成缺席就把一条走第一臂的记录推去走派生臂,而派生的两个缓存只装这条 run
+ *  **自己做出**的 park,继承来、从未跑到的那一条**只存在于被剥掉的那张表里**,于是它要么被漏掉、要么被
+ *  当成不存在而在 resume 时活着重跑([ref] 正要消灭的形)。它同时也是本仓 `/decide` 的 workflow 车道复核
+ *  「这条 park 属于这条 run」的**单一真源**(S-252)。实现上三级全部走 `{...上一级}` 展开、没有任何一级点名裁它,机器背书 =
  *  `test/slim-oversize-run.test.ts` 里那两格(最狠的一级上 `parks` 仍逐字完整 + 负控:记录本来没有
  *  这一位时不许凭空补 `[]`)。缺席 ⇒ 不补:补 `[]` 会把「这版引擎没写这个位」伪造成「这条 run 没有 park」,
  *  而 core 对两者的处置相反。

package/dist/trace/core-keyset-guard.d.ts

@@ -50,7 +50,7 @@ type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded,
 type AskFrameServerMinted = "type" | "approvalId" | "argsOmitted" | "outcome" | "governanceForced" | "expiresAtMs" | "expiresInMs" | "serverNowMs" | "parked" | "inputHasBidi";
 type _GuardAskFrame = AssertAllKeysHandled<Exclude<keyof ToolApprovalFrame, AskProjected | AskFrameServerMinted>>;
 type _GuardAskFrameReverse = AssertAllKeysHandled<Exclude<AskProjected | AskFrameServerMinted, keyof ToolApprovalFrame>>;
-type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta";
+type TaskEventHandled = "text_delta" | "reasoning_delta" | "tool_start" | "tool_end" | "turn_end" | "compacted" | "diagnostics" | "message_committed" | "status" | "task_notification" | "task_progress" | "steering_injected" | "workspace_changed" | "done" | "context_usage" | "compaction_outcome" | "human_input" | "wiring_manifest" | "text_end" | "tool_roster_delta" | "tool_progress" | "tool_disclosure";
 type _GuardTaskEvent = AssertAllKeysHandled<Exclude<TaskEvent["type"], TaskEventHandled>>;
 type _GuardTaskEventReverse = AssertAllKeysHandled<Exclude<TaskEventHandled, TaskEvent["type"]>>;
 type MailboxProjected = "seq" | "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
@@ -59,7 +59,7 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp";
 type WiringSectionExcluded = "governance" | "configFingerprint";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
@@ -122,10 +122,10 @@ type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "prev
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested";
-type TaskSpecUnwired = "excludeAllTools" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecUnwired = "excludeAllTools" | "writeFace" | "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
-type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveMemoryScopes" | "stats" | "editedFiles";
+type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;
@@ -139,7 +139,7 @@ type GateOutcomeProjected = "disposition" | "settlement" | "origin";
 type _GuardGateOutcome = AssertAllKeysHandled<Exclude<keyof GateOutcome, GateOutcomeProjected>>;
 type _GuardGateOutcomeReverse = AssertAllKeysHandled<Exclude<GateOutcomeProjected, keyof GateOutcome>>;
 type GateDispositionKeys = GateDisposition extends infer D ? (D extends object ? keyof D : never) : never;
-type GateDispositionProjected = "kind" | "deniedBy" | "cause";
+type GateDispositionProjected = "kind" | "deniedBy" | "cause" | "classifier";
 type _GuardGateDisposition = AssertAllKeysHandled<Exclude<GateDispositionKeys, GateDispositionProjected>>;
 type _GuardGateDispositionReverse = AssertAllKeysHandled<Exclude<GateDispositionProjected, GateDispositionKeys>>;
 type SettlementProjected = "kind" | "who" | "when" | "note";
@@ -148,12 +148,12 @@ type _GuardSettlementReverse = AssertAllKeysHandled<Exclude<SettlementProjected,
 type SettlementWhoProjected = "party" | "approver" | "window";
 type _GuardSettlementWho = AssertAllKeysHandled<Exclude<SettlementWhoKeys, SettlementWhoProjected>>;
 type _GuardSettlementWhoReverse = AssertAllKeysHandled<Exclude<SettlementWhoProjected, SettlementWhoKeys>>;
-type WorkflowRunForwarded = "id" | "scope" | "status" | "startedAt" | "endedAt" | "createdAt" | "rev" | "parks" | "name" | "description" | "result" | "error" | "errorCode" | "agentFailures" | "stats" | "phases" | "agents" | "groups";
+type WorkflowRunForwarded = "id" | "scope" | "status" | "startedAt" | "endedAt" | "createdAt" | "rev" | "parks" | "name" | "description" | "result" | "error" | "errorCode" | "agentFailures" | "stats" | "phases" | "agents" | "groups" | "resumeAdmissionIncomplete";
 type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveArgs" | "budgetOvershoot" | "timeoutInterruption" | "resultFull" | "completionId" | "resume" | "journalSkips";
 type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
 type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
 type ParkRowKeys = keyof NonNullable<WorkflowRun["parks"]>[number];
-type ParkRowProjected = "callKey" | "sessionId" | "originRunId";
+type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed";
 type ParkRowWithheld = "token";
 type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
 type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;

package/dist/trace/ledger-events.d.ts

@@ -35,7 +35,13 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
 /** S-212(7.71.0):运行期名册变更(core 7.8.0 [ref] ⑪)。**快照语义**——`delta.roster` 是整只
  *  变更后名册,消费端收到即整只替换,所以回放不需要任何合并;它的耐久面因此不是 `wiring_manifest.tools`
  *  的重复,而是那份开腿快照**之后**的每一次改动(修前两条 durable 腿零 case ⇒ 回放只见开头一版)。 */
- | "tool_roster_delta" | "human_input" | "task_progress" | "task_notification" | "turn_end"
+ | "tool_roster_delta"
+/** [ref](core 7.18.0):本条腿的**延迟工具普查**快照(policy / thresholdPercent? / deferred[] / activated[])。
+ *  与 `tool_roster_delta` 同判、同理由——**快照语义**(整只替换,回放零合并),而开腿那一份住在
+ *  `wiring_manifest` 之后的首帧、**之后每一次激活**只活在本帧上。整帧缺席 = 这条腿什么都没延迟。
+ *  🔴 `tool_progress`([ref])**刻意不在本表**:core 的 `tool_progress.ephemeral` 契约逐字「LIVE ONLY …
+ *  core never persists this frame」,与 `task_progress` / `status` 同一处置(两条 durable 腿零 case)。 */
+ | "tool_disclosure" | "human_input" | "task_progress" | "task_notification" | "turn_end"
 /** park 行名**两个**(`appendParked(kind)` 逐字取自 `result.status`)—— 运行期闭集见
  *  {@link PARK_LEDGER_EVENT_TYPES}(本联合是它的类型面,两者由下方的双向断言锁步)。 */
  | "suspended" | "needs_review" | "done" | "failed" | "suggestions" | "model_usage" | "prompt_assembled" | "config_assembled" | "file_link"

package/dist/trace/ledger-sink.js

@@ -1,5 +1,5 @@
 import { terminalProjection } from "@sema-agent/core";
-import { modelTextEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
+import { modelTextEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
 import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
 import { isParkLedgerEventType } from "./ledger-events.js";
 import { isModelSegmentBoundary } from "./model-segment.js";
@@ -97,6 +97,12 @@ export function createLedgerSink(opts) {
                     await append("tool_roster_delta", rosterDelta);
                 break;
             }
+            case "tool_disclosure": {
+                const disclosure = toolDisclosureEventData(ev);
+                if (disclosure !== undefined)
+                    await append("tool_disclosure", disclosure);
+                break;
+            }
             case "human_input":
                 await append("human_input", humanInputEventData(ev));
                 break;

package/dist/trace/model-segment.js

@@ -2,7 +2,7 @@ import { reasoningEndEventData } from "./project.js";
 const BOUNDARY = new Set([
     "tool_start", "tool_end", "status", "context_usage", "compacted", "diagnostics",
     "steering_injected", "compaction_outcome", "workspace_changed", "wiring_manifest",
-    "tool_roster_delta", "human_input", "task_notification", "turn_end",
+    "tool_roster_delta", "human_input", "task_notification", "turn_end", "tool_disclosure",
 ]);
 export function isModelSegmentBoundary(type) {
     return BOUNDARY.has(type);

package/dist/trace/project.d.ts

@@ -236,6 +236,63 @@ export declare function toolEndEventData(ev: {
     eventId?: string;
     parentToolCallId?: string;
 }): Record<string, unknown>;
+/**
+ * `tool_progress` 的白名单投影(core 7.18.0 [ref])—— 一只**仍在跑**的工具调用的存活 tick。
+ *
+ * ## 这一帧只上 live,不落账(判据是 core 的契约,不是本仓的偏好)
+ * core `@contract tool_progress.ephemeral` 逐字:「LIVE ONLY, like `task_progress`/`status`: core never
+ * persists this frame (no session-tree entry, no checkpoint state, no resume replay)」。本仓对
+ * `task_progress` / `status` 正是同一处置(两条 durable 腿零 case),本帧照抄。
+ * 另一条 core 契约把「不落账」从偏好抬成正确性:`@contract tool_progress.cadence` 逐字「A call that
+ * finishes inside one interval emits NO frame at all」⇒ **帧的缺席从来不是证据**;落账会让回放面凭空
+ * 多出一份「这只调用跑了多久」的账,而那件事的真源是 `tool_end`(core 明写 `elapsedTimeSeconds`
+ * **不等于** `tool_end` 的 duration)。
+ *
+ * ## 信任划线
+ *  · `toolCallId` / `toolName` —— 引擎铸的 id 与名册里的工具名(与 `tool_start` 逐字同源)⇒ verbatim。
+ *  · `elapsedTimeSeconds` —— 引擎铸的整秒,单调、一 call 一个原点 ⇒ 有限数才铸键。
+ *  · `output` —— 🔴 **UNTRUSTED RAW**,core 逐字「exactly as `tool_end.output`: process output that may
+ *    carry secrets, paths or PII; core bounds only its SIZE, and a consumer MUST redact before persisting
+ *    or displaying it」⇒ 与 `tool_end.output` **同一只** `redactDeep`,一个字节的例外都不开。
+ *  · `totalLines` / `totalBytes` —— 引擎计数;core 的缺席律逐字:三者**同进同退**(在场=「观察到了输出」,
+ *    缺席=「一个字节都没观察到」,**从不是**「与上一帧相比没变」)。所以本投影按 `output` 的在场判三者:
+ *    `output` 读不出 ⇒ 三键一起缺席,不单独留下两个计数(那会把「没输出」谎报成「有输出但读不出」)。
+ */
+export declare function toolProgressEventData(ev: {
+    toolCallId?: unknown;
+    toolName?: unknown;
+    elapsedTimeSeconds?: unknown;
+    output?: unknown;
+    totalLines?: unknown;
+    totalBytes?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown> | undefined;
+/**
+ * `tool_disclosure` 的白名单投影(core 7.18.0 [ref])—— 本条腿的**延迟工具普查**:哪些挂载的工具今天只是
+ * 名字占位、模型已经激活了哪些、以及是哪条策略判的。
+ *
+ * ## 三腿对称(与 `tool_roster_delta` 同判、同理由)
+ * 开腿那一刻的快照住在 `wiring_manifest` 之后的**第一帧**,而**之后每一次激活**只活在本帧上。不落账 ⇒
+ * 断线重连 / 后台跑完再回来的耐久面永远停在开腿版本,而壳正是据它判「这只工具现在还是不是占位名」。
+ * 本帧是**整只快照**语义(`deferred` / `activated` 全量,消费端整只替换),所以回放不需要合并。
+ *
+ * ## 缺席语义(core 逐字,别读错)
+ *  · **整帧缺席** = 「这条腿什么都没延迟」,**不是**「这个 build 没有这个面」、也不是「未知」;
+ *  · `thresholdPercent` 缺席 = `always` / `never` 两档下**根本没查过阈值**,不许读成「取了默认百分比」;
+ *  · 一条 resume 腿的**首帧** `activated` 可能非空(引擎重播的),**不许**读成「这条腿激活了它们」。
+ *
+ * 成员全是闭形值(策略闭词 + 数字 + 名册里的工具名)⇒ 零脱敏,与 `tool_roster_delta` 的名册行同待遇。
+ * `policy` **不在本仓枚举**(闭集词表属主在 core;抄一份会把 core 加的新词吞成缺席)。
+ */
+export declare function toolDisclosureEventData(ev: {
+    policy?: unknown;
+    thresholdPercent?: unknown;
+    deferred?: unknown;
+    activated?: unknown;
+    eventId?: unknown;
+    parentToolCallId?: unknown;
+}): Record<string, unknown> | undefined;
 /** The `task_progress` payload (a subagent's live progress tick) — EXPLICIT WHITELIST shared by all
  *  three legs (bg runs.ts + resume append + the sync live SSE frame): taskId/parent linkage/token rollup verbatim,
  *  `name` UNTRUSTED (core sanitizes for rendering, does NOT secret-redact — a taskName can be secret-shaped) →
@@ -679,6 +736,7 @@ export declare function contextUsageEventData(ev: {
     usedTokens?: unknown;
     windowTokens?: unknown;
     compactAtTokens?: unknown;
+    sections?: unknown;
     eventId?: unknown;
     parentToolCallId?: unknown;
 }): Record<string, unknown>;

package/dist/trace/project.js

@@ -110,8 +110,12 @@ function screenedGateOrThrow(v) {
         recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
         return undefined;
     }
+    const classifierFallbackRaw = d.classifier !== null && typeof d.classifier === "object" ? d.classifier.fallback : undefined;
     const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
         (d.kind === "denied" && d.cause !== undefined && typeof d.cause !== "string" && "disposition.cause is not a string") ||
+        (d.classifier !== undefined && (d.classifier === null || typeof d.classifier !== "object") && "disposition.classifier is not an object") ||
+        (classifierFallbackRaw !== undefined && (classifierFallbackRaw === null || typeof classifierFallbackRaw !== "object") && "disposition.classifier.fallback is not an object") ||
+        (classifierFallbackRaw !== undefined && classifierFallbackRaw !== null && typeof classifierFallbackRaw === "object" && typeof classifierFallbackRaw.cause !== "string" && "disposition.classifier.fallback.cause is not a string") ||
         (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
         (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
         (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
@@ -125,6 +129,16 @@ function screenedGateOrThrow(v) {
         recordFailOpen("server.trace.gate-outcome-defective", defects.join("; "));
         return undefined;
     }
+    const attribution = d.classifier;
+    const classifier = attribution === undefined
+        ? undefined
+        : {
+            modelRequested: attribution.modelRequested,
+            modelUsed: attribution.modelUsed,
+            ...(attribution.fallback === undefined
+                ? {}
+                : { fallback: { from: attribution.fallback.from, to: attribution.fallback.to, cause: attribution.fallback.cause } }),
+        };
     const settlement = g.settlement === undefined ? undefined : projectSettlement(g.settlement);
     if (g.settlement !== undefined && settlement === undefined) {
         recordFailOpen("server.trace.gate-outcome-defective", "settlement.who is not an object with a party in the closed set");
@@ -132,8 +146,8 @@ function screenedGateOrThrow(v) {
     }
     return {
         disposition: d.kind === "denied"
-            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }) }
-            : { kind: "allowed" },
+            ? { kind: "denied", deniedBy: d.deniedBy, ...(d.cause === undefined ? {} : { cause: d.cause }), ...(classifier === undefined ? {} : { classifier }) }
+            : { kind: "allowed", ...(classifier === undefined ? {} : { classifier }) },
         ...(settlement === undefined ? {} : { settlement }),
         ...(g.origin === undefined ? {} : { origin: g.origin }),
     };
@@ -210,6 +224,43 @@ export function toolEndEventData(ev) {
         ...identityFields(ev),
     };
 }
+const dropProjectedFace = (what) => {
+    recordFailOpen("server.trace.projection-input-malformed", what);
+    return undefined;
+};
+export function toolProgressEventData(ev) {
+    const id = typeof ev.toolCallId === "string" && ev.toolCallId !== "" ? ev.toolCallId : undefined;
+    const name = typeof ev.toolName === "string" && ev.toolName !== "" ? ev.toolName : undefined;
+    if (id === undefined || name === undefined)
+        return dropProjectedFace("tool_progress is missing toolCallId/toolName");
+    const n = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    const hasOutput = typeof ev.output === "string";
+    return {
+        toolCallId: id,
+        toolName: name,
+        ...(n(ev.elapsedTimeSeconds) !== undefined ? { elapsedTimeSeconds: n(ev.elapsedTimeSeconds) } : {}),
+        ...(hasOutput ? { output: redactDeep(ev.output) } : {}),
+        ...(hasOutput && n(ev.totalLines) !== undefined ? { totalLines: n(ev.totalLines) } : {}),
+        ...(hasOutput && n(ev.totalBytes) !== undefined ? { totalBytes: n(ev.totalBytes) } : {}),
+        ...identityFields(ev),
+    };
+}
+export function toolDisclosureEventData(ev) {
+    const policy = typeof ev.policy === "string" && ev.policy !== "" ? ev.policy : undefined;
+    const names = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : undefined);
+    const deferred = names(ev.deferred);
+    const activated = names(ev.activated);
+    if (policy === undefined || deferred === undefined || activated === undefined)
+        return dropProjectedFace("tool_disclosure is missing policy/deferred/activated");
+    const threshold = typeof ev.thresholdPercent === "number" && Number.isFinite(ev.thresholdPercent) ? ev.thresholdPercent : undefined;
+    return {
+        policy,
+        ...(threshold !== undefined ? { thresholdPercent: threshold } : {}),
+        deferred,
+        activated,
+        ...identityFields(ev),
+    };
+}
 export function taskProgressEventData(ev) {
     return {
         taskId: ev.taskId,
@@ -390,6 +441,41 @@ export function wiringManifestEventData(ev) {
     })();
     const toolsIn = m.tools;
     const tools = toolsIn === undefined ? undefined : Value.Check(ToolRoster, toolsIn) ? toolsIn : (recordFailOpen("server.trace.tool-roster-malformed", "wiring_manifest.tools did not fit core ToolRoster"), undefined);
+    const hooksIn = m.hooks;
+    const hooks = (() => {
+        if (hooksIn === undefined)
+            return undefined;
+        if (!Array.isArray(hooksIn))
+            return dropProjectedFace("wiring_manifest.hooks is not an array");
+        const rows = [];
+        for (const raw of hooksIn) {
+            const e = sec(raw);
+            if (e === undefined) {
+                dropProjectedFace("wiring_manifest.hooks[] row is not an object");
+                continue;
+            }
+            const family = str(e.family);
+            const owner = str(e.owner);
+            if (family === undefined || owner === undefined) {
+                dropProjectedFace("wiring_manifest.hooks[] row is missing family/owner");
+                continue;
+            }
+            rows.push({ family, owner, ...(e.observational === true ? { observational: true } : {}) });
+        }
+        return rows.length > 0 ? rows : undefined;
+    })();
+    const lspIn = sec(m.lsp);
+    const lsp = (() => {
+        if (m.lsp === undefined)
+            return undefined;
+        if (lspIn === undefined)
+            return dropProjectedFace("wiring_manifest.lsp is not an object");
+        const mounted = bool(lspIn.mounted);
+        if (mounted === undefined)
+            return dropProjectedFace("wiring_manifest.lsp.mounted is not a boolean");
+        const lane = str(lspIn.lane);
+        return { mounted, ...(lane === undefined ? {} : { lane }) };
+    })();
     const mcpIn = m.mcp;
     const mcp = (() => {
         if (!Array.isArray(mcpIn))
@@ -430,6 +516,8 @@ export function wiringManifestEventData(ev) {
         ...(autoMode !== undefined ? { autoMode } : {}),
         ...(tools !== undefined ? { tools } : {}),
         ...(mcp !== undefined ? { mcp } : {}),
+        ...(hooks !== undefined ? { hooks } : {}),
+        ...(lsp !== undefined ? { lsp } : {}),
         ...identityFields(ev),
     };
 }
@@ -535,9 +623,32 @@ export function contextUsageEventData(ev) {
         ...(n(ev.usedTokens) !== undefined ? { usedTokens: n(ev.usedTokens) } : {}),
         ...(n(ev.windowTokens) !== undefined ? { windowTokens: n(ev.windowTokens) } : {}),
         ...(n(ev.compactAtTokens) !== undefined ? { compactAtTokens: n(ev.compactAtTokens) } : {}),
+        ...contextUsageSectionsField(ev.sections),
         ...identityFields(ev),
     };
 }
+function contextUsageSectionsField(sections) {
+    if (sections === undefined)
+        return {};
+    if (!Array.isArray(sections)) {
+        dropProjectedFace("context_usage.sections is not an array");
+        return {};
+    }
+    const out = [];
+    for (const raw of sections) {
+        if (typeof raw !== "object" || raw === null) {
+            dropProjectedFace("context_usage.sections[] element is not an object");
+            continue;
+        }
+        const { id, tokens, kind } = raw;
+        if (typeof id !== "string" || id === "" || typeof tokens !== "number" || !Number.isFinite(tokens)) {
+            dropProjectedFace("context_usage.sections[] element is missing id/tokens");
+            continue;
+        }
+        out.push({ id, tokens, ...(typeof kind === "string" && kind !== "" ? { kind } : {}) });
+    }
+    return out.length > 0 ? { sections: out } : {};
+}
 export function turnEndEventData(ev) {
     return {
         ...(ev.usage ? { usage: ev.usage } : {}),
@@ -711,6 +822,7 @@ function mapTraceEventInner(type, seq, data) {
         case "wiring_manifest":
         case "human_input":
         case "tool_roster_delta":
+        case "tool_disclosure":
             return null;
         default:
             return null;

package/dist/trace/redact.js

@@ -233,12 +233,150 @@ let anyValueArm;
 function anyValueArmRe() {
     return (anyValueArm ??= new RegExp(`(?:${VALUE_ARM_BODIES.join("|")})`, "y"));
 }
-function collectRegexSpans(g, repl, order, text, out) {
+const HEAD_CLASS_ESCAPES = new Set(["d", "D", "w", "W", "s", "S"]);
+const HEAD_LITERAL_ESCAPES = new Set(["\\", "/", "-", ".", "+", "*", "?", "(", ")", "[", "]", "{", "}", "|", "^", "$"]);
+function headOfAtoms(atoms, src) {
+    const tail = atoms[atoms.length - 1];
+    if (tail === undefined || !tail.unbounded || tail.cls === undefined) {
+        throw new Error(`redact: arm-pool pattern /${src}/ must end in a greedy unbounded single-class value run`);
+    }
+    let pos = 0;
+    let head = 0;
+    for (let k = 0; k < atoms.length - 1; k++) {
+        const a = atoms[k];
+        if (a.cls !== tail.cls)
+            head = pos + a.len;
+        pos += a.len;
+    }
+    return head;
+}
+const HEAD_GROUP_OPEN = /^\((\?:|\?=|\?!|\?<=|\?<!)/;
+function parseHeadAlternative(src, from) {
+    let seqs = [[]];
+    let i = from;
+    let closed = false;
+    while (i < src.length) {
+        const c = src[i];
+        if (c === "|" || c === ")")
+            break;
+        if (closed)
+            throw new Error(`redact: arm-pool pattern /${src}/ has trailing syntax after its value run`);
+        let base;
+        if (c === "(") {
+            const open = HEAD_GROUP_OPEN.exec(src.slice(i));
+            if (open === null)
+                throw new Error(`redact: head derivation cannot bound group at ${i} in /${src}/`);
+            const mark = open[1];
+            const inner = parseHeadAlternatives(src, i + 1 + mark.length);
+            if (src[inner.next] !== ")")
+                throw new Error(`redact: unbalanced group at ${i} in /${src}/`);
+            i = inner.next + 1;
+            if (mark !== "?:")
+                continue;
+            if (inner.alts.some((alt) => alt.some((a) => a.unbounded))) {
+                seqs = inner.alts.flatMap((alt) => seqs.map((s) => [...s, ...alt]));
+                closed = true;
+                continue;
+            }
+            base = { len: Math.max(...inner.alts.map((alt) => alt.reduce((n, a) => n + a.len, 0))), cls: undefined };
+        }
+        else if (c === "[") {
+            let k = i + 1;
+            while (k < src.length && src[k] !== "]")
+                k += src[k] === "\\" ? 2 : 1;
+            if (k >= src.length)
+                throw new Error(`redact: unterminated character class at ${i} in /${src}/`);
+            base = { len: 1, cls: src.slice(i, k + 1) };
+            i = k + 1;
+        }
+        else if (c === "\\") {
+            const e = src[i + 1];
+            if (e === undefined)
+                throw new Error(`redact: dangling escape at ${i} in /${src}/`);
+            if (HEAD_CLASS_ESCAPES.has(e))
+                base = { len: 1, cls: `\\${e}` };
+            else if (HEAD_LITERAL_ESCAPES.has(e))
+                base = { len: 1, cls: undefined };
+            else
+                throw new Error(`redact: head derivation cannot bound escape \\${e} at ${i} in /${src}/`);
+            i += 2;
+        }
+        else if (c === "." || c === "^" || c === "$" || c === "*" || c === "+" || c === "?" || c === "{") {
+            throw new Error(`redact: head derivation cannot bound ${JSON.stringify(c)} at ${i} in /${src}/`);
+        }
+        else {
+            base = { len: 1, cls: undefined };
+            i += 1;
+        }
+        let atom = { ...base, unbounded: false };
+        const q = src[i];
+        if (q === "*" || q === "+") {
+            atom = { ...base, unbounded: true };
+            i += 1;
+        }
+        else if (q === "?") {
+            i += 1;
+        }
+        else if (q === "{") {
+            const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
+            if (m === null)
+                throw new Error(`redact: head derivation cannot bound quantifier at ${i} in /${src}/`);
+            const lo = Number(m[1]);
+            const hi = m[2] === undefined ? lo : m[3] === "" ? -1 : Number(m[3]);
+            atom = hi < 0 ? { ...base, unbounded: true } : { len: base.len * hi, cls: base.cls, unbounded: false };
+            i += m[0].length;
+        }
+        if (src[i] === "?")
+            throw new Error(`redact: head derivation cannot bound a lazy quantifier at ${i} in /${src}/`);
+        if (atom.unbounded)
+            closed = true;
+        for (const s of seqs)
+            s.push(atom);
+    }
+    return { seqs, next: i };
+}
+function parseHeadAlternatives(src, from) {
+    const alts = [];
+    let i = from;
+    for (;;) {
+        const one = parseHeadAlternative(src, i);
+        alts.push(...one.seqs);
+        i = one.next;
+        if (src[i] !== "|")
+            break;
+        i += 1;
+    }
+    return { alts, next: i };
+}
+function literalHeadLength(re) {
+    if (/[uv]/.test(re.flags))
+        throw new Error(`redact: head derivation does not support the u/v flags on /${re.source}/`);
+    const src = re.source;
+    const parsed = parseHeadAlternatives(src, 0);
+    if (parsed.next !== src.length)
+        throw new Error(`redact: head derivation stopped at ${parsed.next} in /${src}/`);
+    return Math.max(...parsed.alts.map((alt) => headOfAtoms(alt, src)));
+}
+function scanResumeAfterHit(start, end, head) {
+    return Math.max(start + 1, end - Math.max(head - 1, 0));
+}
+function headWindowCandidates(at, maxHead) {
+    const out = [];
+    let last = -1;
+    for (const e of at) {
+        for (let p = Math.max(e - Math.max(maxHead - 1, 0), last + 1, 0); p <= e; p++) {
+            out.push({ p, back: e - p });
+            last = p;
+        }
+    }
+    return out;
+}
+function collectRegexSpans(g, head, repl, order, text, out) {
     g.lastIndex = 0;
     for (let m = g.exec(text); m !== null; m = g.exec(text)) {
         const end = m.index + m[0].length;
         out.push({ start: m.index, end, repl, order });
-        g.lastIndex = end > m.index ? end : m.index + 1;
+        g.lastIndex = scanResumeAfterHit(m.index, end, head);
     }
 }
 function resolveSpanOverlaps(spans) {
@@ -265,10 +403,10 @@ function applySpans(text, spans) {
     parts.push(text.slice(copied));
     return { out: parts.join(""), count: spans.length };
 }
-function collectValueArmSpans(g, y, repl, order, text, out) {
+function collectValueArmSpans(g, y, head, repl, order, text, out) {
     const tails = escapedSeparatorTails(text);
     if (tails === undefined) {
-        collectRegexSpans(g, repl, order, text, out);
+        collectRegexSpans(g, head, repl, order, text, out);
         return;
     }
     let pos = 0;
@@ -314,12 +452,14 @@ function collectValueArmSpans(g, y, repl, order, text, out) {
         else
             break;
         out.push({ start: idx, end, repl, order });
-        pos = end;
+        pos = scanResumeAfterHit(idx, end, head);
     }
 }
-function collectStickySpans(y, repl, order, text, at, out) {
+function collectStickySpans(y, head, repl, order, text, at, out) {
     let pos = 0;
-    for (const p of at) {
+    for (const { p, back } of at) {
+        if (back >= head)
+            continue;
         if (p < pos)
             continue;
         y.lastIndex = p;
@@ -328,7 +468,7 @@ function collectStickySpans(y, repl, order, text, at, out) {
             continue;
         const end = p + m[0].length;
         out.push({ start: p, end, repl, order });
-        pos = end;
+        pos = scanResumeAfterHit(p, end, head);
     }
 }
 const WORD_SEGMENT_CLASS = "[A-Za-z0-9._~+/-]";
@@ -1000,17 +1140,22 @@ const armPoolRule = (() => {
     const arms = [...SHAPE_SECRET_PATTERNS, ...FRAGMENT_SECRET_PATTERNS].map(([re, repl], order) => {
         if (/\$./.test(repl))
             throw new Error(`redact: arm-pool replacement ${JSON.stringify(repl)} must not use $N refs`);
-        return { g: re, y: VALUE_ARM_STICKY.get(re), repl, order };
+        const y = VALUE_ARM_STICKY.get(re);
+        const head = literalHeadLength(re);
+        if (y !== undefined && head === 0)
+            throw new Error(`redact: boundary arm /${re.source}/ has a zero-length structural head — the head-window screen would skip every candidate position`);
+        return { g: re, y, head, repl, order };
     });
-    const boundaryArms = arms.flatMap((a) => (a.y === undefined ? [] : [{ y: a.y, repl: a.repl, order: a.order }]));
+    const boundaryArms = arms.flatMap((a) => (a.y === undefined ? [] : [{ y: a.y, head: a.head, repl: a.repl, order: a.order }]));
+    const maxBoundaryHead = Math.max(1, ...boundaryArms.map((a) => a.head));
     return {
         run: (text, wantCount) => {
             const spans = [];
             for (const a of arms) {
                 if (a.y === undefined)
-                    collectRegexSpans(a.g, a.repl, a.order, text, spans);
+                    collectRegexSpans(a.g, a.head, a.repl, a.order, text, spans);
                 else
-                    collectValueArmSpans(a.g, a.y, a.repl, a.order, text, spans);
+                    collectValueArmSpans(a.g, a.y, a.head, a.repl, a.order, text, spans);
             }
             const tried = new Set();
             const freshEnds = (from) => {
@@ -1026,8 +1171,9 @@ const armPoolRule = (() => {
             };
             for (let at = freshEnds(0); at.length > 0;) {
                 const before = spans.length;
+                const cand = headWindowCandidates(at, maxBoundaryHead);
                 for (const a of boundaryArms)
-                    collectStickySpans(a.y, a.repl, a.order, text, at, spans);
+                    collectStickySpans(a.y, a.head, a.repl, a.order, text, cand, spans);
                 at = freshEnds(before);
             }
             const kept = resolveSpanOverlaps(spans);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.77.0",
+  "version": "7.78.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.17.7",
-    "@sema-agent/settings-schema": "1.10.0",
+    "@sema-agent/core": "7.18.0",
+    "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "9.3.0",
+    "@sema-agent/sdk": "9.4.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",