@sema-agent/server 7.85.0 → 7.87.0

package/dist/http/routes/runs.js

@@ -1,9 +1,9 @@
 import { persistedPlaneOf } from "../../terminal.js";
-import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
+import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal.js";
 import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
-import { isTerminalRunStatus, isParkedRunStatus } from "../../plugins/store-contracts.js";
+import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { HttpError, verifiedPrincipal, isUuidV7, encodeCheckpointScope } from "../../security.js";
@@ -27,7 +27,7 @@ import { headerStr, gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } f
 import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import { assertNever } from "../route-ctx.js";
 import { mintAndDriveDurableRun } from "../durable-run-leg.js";
-import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage, runProvenElsewhere } from "../route-ctx.js";
+import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 const ASK_PARKING_RETRY_AFTER_SEC = 2;
 const ASK_ACTOR_LABEL_MAX = 256;
@@ -64,7 +64,8 @@ export function projectDecisionActor(raw) {
     const parsed = AskDecisionActorSchema.safeParse(raw);
     return parsed.success ? parsed.data : undefined;
 }
-async function subagentReadGate(req, res, deps, runId, search) {
+async function subagentReadGate(req, res, ctx, runId, search) {
+    const { deps } = ctx;
     const principal = gatedPrincipal(req, deps.config);
     if (deps.config.requirePrincipal && principal === undefined) {
         sendPrincipalRefusal(res, req, deps.config);
@@ -72,10 +73,13 @@ async function subagentReadGate(req, res, deps, runId, search) {
     }
     const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
     const run = await deps.runStore.getRun(runId);
-    if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+    if (!run) {
         sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
         return null;
     }
+    if (!trusted && !ctx.helpers.runOwnerOk(req, res, run.owner)) {
+        return null;
+    }
     const callerSession = new URLSearchParams(search).get("session");
     if (!trusted && run.sessionId && callerSession !== run.sessionId) {
         sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
@@ -85,7 +89,7 @@ async function subagentReadGate(req, res, deps, runId, search) {
 }
 function sendHandleMiss(res, run, thisInstanceId) {
     if (isTerminalRunStatus(run.status)) {
-        sendError(res, 404, "not_found.task_owner_settled", "no such background task handle here. Routing hint about its OWNER (not about this handle): the run has already settled, and background handles live in the replica-local registry for the parent's lifetime, so none of its handles are readable any more. Read the run's own outcome via GET /v1/runs/:id");
+        sendError(res, 404, "not_found.task_owner_settled", "no such background task handle here. Routing hint about its OWNER (not about this handle): the run has already settled. Read the run's own outcome via GET /v1/runs/:id");
         return true;
     }
     if (run.status === "running" && runProvenElsewhere(run, thisInstanceId)) {
@@ -429,10 +433,8 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!trusted && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.steer"))
             return;
         let parkQueueFull;
@@ -714,10 +716,8 @@ export async function handleRuns(req, res, match, ctx) {
             sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
             return;
         }
-        if (!trusted && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!trusted && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.interrupt"))
             return;
         const sendInterruptNotRunning = (error) => sendError(res, 409, "steering.not_running", error);
@@ -812,10 +812,8 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        if (!operator && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.compact"))
             return;
         let compactBody;
@@ -894,10 +892,8 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         }
         const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-        if (!operator && run.owner !== null && run.owner !== principal) {
-            sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
+        if (!operator && !runOwnerOk(req, res, run.owner))
             return;
-        }
         if (!runSessionAcceptOk(req, res, run, "run.detach"))
             return;
         const live = steerableRuns.get(taskId);
@@ -913,7 +909,7 @@ export async function handleRuns(req, res, match, ctx) {
 }
 export async function handleRunVerbs(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runSessionAcceptOk } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, safeDecode, runOwnerOk, runSessionAcceptOk } = ctx.helpers;
     if (match.decl.id === "run-subagent-output") {
         if (!deps.runStore || !deps.subagentTaskOutput) {
             sendError(res, 501, "capability.run_store_required", "subagent output reads require the run store");
@@ -925,7 +921,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gated = await subagentReadGate(req, res, deps, runId, match.search);
+        const gated = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gated)
             return;
         const { run } = gated;
@@ -950,7 +946,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed subagent path (invalid percent-encoding)");
             return;
         }
-        const gatedTail = await subagentReadGate(req, res, deps, runId, match.search);
+        const gatedTail = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gatedTail)
             return;
         const { run } = gatedTail;
@@ -1015,7 +1011,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             sendError(res, 400, "request.path_malformed", "malformed task path (invalid percent-encoding)");
             return;
         }
-        const gatedB = await subagentReadGate(req, res, deps, runId, match.search);
+        const gatedB = await subagentReadGate(req, res, ctx, runId, match.search);
         if (!gatedB)
             return;
         const { run } = gatedB;
@@ -1113,10 +1109,12 @@ export async function handleRunVerbs(req, res, match, ctx) {
         }
         const trusted = explicitOperatorOk(principal, deps.config.operatorPrincipals);
         const run = await deps.runStore.getRun(runId);
-        if (!run || (!trusted && run.owner !== null && run.owner !== principal)) {
+        if (!run) {
             sendError(res, 404, "not_found.run", RUN_NOT_FOUND_MESSAGE);
             return;
         }
+        if (!trusted && !runOwnerOk(req, res, run.owner))
+            return;
         if (!runSessionAcceptOk(req, res, run, `subagent.${verb}`))
             return;
         const send409 = (errorCode, error) => sendError(res, 409, errorCode, error);

package/dist/http/routes/sessions.js

@@ -219,7 +219,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const headSession = decodeURIComponent(match.params.sessionId);
+            const headSession = safeDecode(match.params.sessionId);
+            if (headSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             const getHead = deps.sessionStorage?.getHead?.bind(deps.sessionStorage);
             let owner;
             let leafId;
@@ -262,7 +266,11 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const evSession = decodeURIComponent(match.params.sessionId);
+            const evSession = safeDecode(match.params.sessionId);
+            if (evSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
             if (sse.sseConnections >= (deps.sessionEventsMaxConnections ?? 256)) {
                 res.setHeader("retry-after", "5");
                 sendError(res, 503, "state.sse_connection_cap", "session-events connection cap reached — fall back to /head polling");

package/dist/http/routes/shared-memory.js

@@ -90,7 +90,11 @@ export async function handleSharedMemory(req, res, match, ctx) {
         }
         case "shared-memory-store-documents":
         case "shared-memory-store-document": {
-            const storeId = decodeURIComponent(match.params.store);
+            const storeId = ctx.helpers.safeDecode(match.params.store);
+            if (storeId === null) {
+                sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
+                return;
+            }
             const query = new URLSearchParams(match.search);
             const snapshot = await bindSnapshot(req, res, ctx);
             if (!snapshot)

package/dist/http/routes/tasks.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, uuidv7, terminalProjection } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
 import { stripResumeToken } from "../../terminal.js";
@@ -414,7 +414,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
                                     putRewindAnchor();
-                                    settleFleet(finalResult ? terminalProjection(finalResult.terminal).status : "completed", fleetRunResiduals(finalResult));
+                                    settleFleet(terminalProjection(finalResult.terminal).status, fleetRunResiduals(finalResult));
                                     if (ledgerSink && finalResult) {
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;

package/dist/http/routes/workflows.js

@@ -5,7 +5,7 @@ import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from ".
 import { journalEntryOfRow, journalEntryPayload, journalRowPayloadOf } from "../../orchestration/workflow-journal-entry.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { createHash } from "node:crypto";
-import { redactErrorMessage, redactHead } from "../../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead } from "../../observability/run-terminal.js";
 const JOURNAL_PROJECTION_MEMO_CAP = 1024;
 const journalProjectionMemo = new Map();
 import { sendJson, sendError, sseHeaders } from "../send.js";

package/dist/http/server.d.ts

@@ -28,8 +28,8 @@ import type { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
 import { scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
 import type { ConsolidationSeatLabel } from "../boot/memory-consolidation.js";
-import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
-export { streamApprovals, isQuestionAnswer };
+import { streamApprovals, checkQuestionAnswer } from "./routes/approvals-assistant.js";
+export { streamApprovals, checkQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";

package/dist/http/server.js

@@ -1,5 +1,5 @@
 import http from "node:http";
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 import { validatePendingSteer, terminalProjection } from "@sema-agent/core";
 import {} from "../config-center/facade.js";
 import { HttpError } from "../security.js";
@@ -12,8 +12,8 @@ import {} from "../tool-approval.js";
 import {} from "../observability/rate-limit.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
-import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
-export { streamApprovals, isQuestionAnswer };
+import { streamApprovals, checkQuestionAnswer } from "./routes/approvals-assistant.js";
+export { streamApprovals, checkQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";

package/dist/leader/diffout.js

@@ -1,4 +1,4 @@
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 export const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 const DEFAULT_READ_TIMEOUT_MS = 30_000;
 const SAFE_REV = /^[A-Za-z0-9._/-]{1,200}$/;

package/dist/leader/endpoint.js

@@ -1,5 +1,5 @@
 import { uuidv7 } from "@sema-agent/core";
-import { redactErrorMessage, redactHead, redactLeaderResult, redactLeaderResultWithFlag } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead, redactLeaderResult, redactLeaderResultWithFlag } from "../observability/run-terminal.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { leaderIdemKey } from "../plugins/leader-run-store-sql.js";
 function statusForLeaderResult(result) {

package/dist/leader/fanout.js

@@ -1,5 +1,5 @@
 import { terminalProjection } from "@sema-agent/core";
-import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal.js";
 import { pausedCauseOf } from "../terminal.js";
 class Semaphore {
     max;

package/dist/leader/leader.js

@@ -1,5 +1,5 @@
 import { fanOut } from "./fanout.js";
-import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
 import { Runner, runWithVerification, resumeWithVerification, terminalProjection } from "@sema-agent/core";

package/dist/leader/merge.js

@@ -1,5 +1,5 @@
 import { delimitUntrusted } from "@sema-agent/core";
-import { OVERSIZED_DIAG_PLACEHOLDER, redactArtifactText, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { OVERSIZED_DIAG_PLACEHOLDER, redactArtifactText, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal.js";
 import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.js";
 import { shellQuote as Q } from "../plugins/remote-shell.js";
 const CONFLICT_FILES_MAX = 200;

package/dist/leader/planner.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal.js";
 export function economicGuard(objective, opts = {}) {
     if (opts.fanoutEnabled === false)
         return { single: true, reason: "fan-out disabled by deployment (A6)" };

package/dist/leader/repair-oracle.js

@@ -1,7 +1,7 @@
 import { runExecGate, } from "@sema-agent/core";
 import { createHash } from "node:crypto";
 import { shellQuote as sq } from "../plugins/remote-shell.js";
-import { redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { redactHead, redactTail } from "../observability/run-terminal.js";
 const sha = (s) => createHash("sha256").update(s).digest("hex").slice(0, 16);
 function changedFilesOf(patch) {
     const out = new Set();

package/dist/leader/repair-wire.js

@@ -1,7 +1,7 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
 import { terminalProjection } from "@sema-agent/core";
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }

package/dist/leader/wire.js

@@ -16,7 +16,7 @@ import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
 import { currentPrincipal } from "../observability/principal-context.js";
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 const REPAIR_LOOP_WIRED = true;
 const sh = (env) => async (cmd) => {
     const r = await env.exec(`bash -lc ${JSON.stringify(cmd)}`);

package/dist/memory-scope.d.ts

@@ -221,6 +221,22 @@ declarations?: {
  * `normalizeMemorySpec(spec)?.enabled === true`。S-405 之后 `memory:"off"` 铸的是「键在场 + `enabled:false`」(保留事实),
  * 任何按「键在不在场」判挂没挂的读者从那一天起都读错(改前 `memory-notice` 正是那样,把无记忆面的披露一起吞掉)。
  * 消费方拿本函数的布尔,不拿 `spec.memory` 自己判。
+ *
+ * ⚠️ **本函数会抛,而「抛」本身就是一条判据**(S-424 补注)。`normalizeMemorySpec` 对两形直接 throw
+ * (亲核安装态 core 7.22.0 `dist/core/memory.js:367-372` 与 `:373-385`):
+ *  · 单数 `scope` 键在场 ⇒ `code:"config.memory_scope_spelling"`(core 已删的旧拼写;它的报错原话
+ *    是「Refusing to start with memory silently off」—— 静默关闭正是那次 HIGH 的伤害面);
+ *  · `capture` 在场且不是字面 `"off"` ⇒ `code:"config.memory_capture_spelling"`。
+ *
+ * 这两形在本仓的 wire 面上**都到不了这里**,各有属主:
+ *  · 请求体侧 = 值闭包门 `singleMemberOffFieldIssue`(`src/request-value-closure.ts`;fresh 400 与 resume
+ *    重放共用的同一只)—— 到得了下游的 `memory`/`memoryCapture` 只可能是字面 `"off"` 或缺席;
+ *  · spec 侧 = 唯一铸点 {@link memorySpecForRequest}(本文件)—— 它恒产 `scopes: [scope, ...extras]`,
+ *    从不产单数 `scope`,`capture` 也只在声明为 `"off"` 时才铸。
+ *
+ * 所以这里抛 = **调用方没先过值闭包门**(手搓 spec、或绕过铸点直接喂一份 `TaskSpec.memory`),不是这一腿
+ * 的运行期异常,**不要在本函数里加吞异常的臂**:吞掉就退回「memory 静默整体关闭」,即上面那条报错原话
+ * 拒绝的那件事。要放宽/收紧值域,改上面两个属主。
  */
 export declare function memoryFaceMounted(memory: TaskSpec["memory"]): boolean;
 //# sourceMappingURL=memory-scope.d.ts.map

package/dist/observability/fail-open.d.ts

@@ -141,6 +141,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "#261 fleet 存活对账腿的一次 durable 读失败/超预算(2s)⇒ **本周期整轮跳过**并开熔断,不做任何投影。放行的最坏后果 = 幽灵行(发布方已死、行僵在内存 Map 里)在面板上多活几个周期,与本腿存在之前的行为等同(那时它永远活着),不是新损失;真源不受影响(`GET /v1/runs/:id` 照常)。方向刻意 fail-open 且**只向留行一侧**:读不出来 ≠ 该退休——库抖一下就把一屏在跑的任务从面板上抹掉,比多留一条幽灵行伤得多。必须留痕:静默吞掉之后「对账腿为什么一直没生效」在遥测里没有任何痕迹,而本腿的全部价值就是「幽灵行会自己走」。";
     };
+    readonly "server.fleet.terminal-notify": {
+        readonly cls: "F";
+        readonly note: "S-450:**两条臂共用**(detail 里 `read-failed` 分得开)—— ① `observability/run-terminal.ts` 的**行为订阅者**扇出(唯一铸点 `notifyRunTerminal`,三只 store 的 CAS 赢分支各调一次):某个订阅者(今天只有 fleet 对账腿的候补窗升级腿)在 `setTerminal` 的调用栈上抛错 ⇒ 吞掉并计数,终局写照常成功;② `fleet/fleet-reconciler.ts` 的事件腿在收到事件后那一次 durable 点读失败 ⇒ 这条行留在候补窗里等周期臂。⚠️ 同一只铸点上的**日志腿**(`setRunTerminalLogObserver`)走的是**相反**契约(刻意不 try、抛出让 `setTerminal` reject),**不计本 tag** —— 读遥测别把两席混成一件。方向承重:这条腿的全部价值是「把候补窗行的成对终帧从『下一个对账周期(≤60s)』提前到『durable 写落地的同一 tick』」,它是一格**投影提速**;把它的 bug 外溢成终局写 reject 会让 run 卡 running 到 reaper、claim 悬挂([868] 指纹),代价高出几个量级。放行的最坏后果 = 这条行的成对终帧退回到周期臂补发,**与本件存在之前的行为逐字等同**,不是新损失;故 F 类。必须留痕:静默吞掉之后「事件腿为什么一直没生效」在遥测里没有任何痕迹,而面板上看到的只是『偶尔慢一分钟』这种没人会立案的症状。";
+    };
     readonly "server.fleet.run-status-unmapped": {
         readonly cls: "F";
         readonly note: "A-032 P1-④:`runStatusToFleet` 收到**词表外**的 run 状态词(闭集签名之外的唯一来路 = `rowToRun` 把无约束的 status 文本列裸 cast,滚动升级里更新的副本写的新词被旧副本读到)⇒ 折成 `idle`。放行的最坏后果 = 该行在 fleet 面板上**永久滞留**(removal 集 {completed,failed,killed} 收不到 idle),纯展示面、不影响 run 本身与任何执法判据,故 F 类。方向刻意不改(把 miss 折成终局会把一条还在跑的任务从面板上摘掉,误摘比多一行更伤)。留痕是承重的:2026-06-28 on-box e2e 逮到的 `blocked` 泄漏当年只能靠人眼在面板上发现——计数让下一次词表漂移在遥测里当场显形。编译期一侧已由闭集入参 + `never` 臂执法。";
@@ -189,6 +193,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-02 codex R1-[medium](验真后修):decide 的 409 `approval_stale` 臂对**调用方回显的旧 token** 做归属判定(`cs.get(binding.checkpointToken)`),那次读**抛了**(store 抖动 / 版本守卫 / 行恰被清理)。修前这里是静默 `catch(()=>null)`,「读不出」被折成「确认不在库」——叠上 S-02 的 404 收口后,一次 store 抖动就会把合法旧 token 的 409+terminal 谎报成 404「没有这条审批」。修后:unreadable ⇒ **保持 409**(`terminal` 不披露——证不出归属就不说,与 2026-07-26 纪律同向;404 折叠只在读成功且未命中时走,探测方无法自控 store 故障 ⇒ 谕示封闭不破)。放行的最坏后果 = 该次拒体 `terminal` 诚实缺席(`currentPending` 由它自己的读口与属主复核另判,不受本臂牵连),壳退回重拉列表,judgment 面 fail-safe,故 F 类。留痕理由:这次读是 terminal 披露与 404 折叠两个判定的输入,长期抖动必须在遥测显形。";
     };
+    readonly "server.resume.reopen-confirm-unreadable": {
+        readonly cls: "F";
+        readonly note: "S-447(#60 M2 自查项,`http/resume-legs.ts` 的 `confirmCheckpointReopened`):续跑腿在 core 给出 reopen 族失败后按 **token** 复核「这张 checkpoint 是不是又 pending 了」,这一读抛(库拖/版本太新/店不可达)。**方向本来就是 fail-closed**:读不出 ⇒ `return true` ⇒ 「不写任何终局、重新 park」(`:1206-1212` 头注已把取舍与有界代价写死:错 park 由 `reapSuspended` 兑,错终局会孤儿化一张活 park 到 TTL)—— 所以这条腿不是 P 类,缺的只是**留痕**。放行的最坏后果 = 多一次多余的 re-park(一张已经被决掉的卡重新挂到 reaper 窗里),人面上是「这条续跑没动」而不是谁被放行了。必须登记的理由是 **uniformity**:同文件三只同形读(`:249` `server.approvals.stale-echoed-token-unreadable` · `:288` `server.approvals.stale-current-pending-unreadable` · 本腿)中只有它是黑的,于是「店一直读不出所以每条续跑都在白白 re-park」与「一切正常」在遥测上同形。计数非零 = 这台机器的 checkpoint 店在拖,运维要去看库。";
+    };
     readonly "server.approvals.stale-current-pending-unreadable": {
         readonly cls: "F";
         readonly note: "S-02 件2([5522]④→[5525]):409 `approval_stale` 拒体铸 additive 指路键 `currentPending`(本会话当前 pending 的 D-1 坐标,壳一跳重定位)时,当前 pending 行的 `cs.get(token)` 读**抛了**(store 抖动 / 滚动升级期 checkpoint 格式 version guard / 行恰被并发消费)⇒ 本次拒体**缺 `currentPending` 键**,409 本体与 `terminal` 判定照旧。放行的最坏后果 = 壳退回该键到货前的行为(重拉 GET /v1/approvals 自行重定位),纯指路/便利面,不参与任何门/CAS/resume 判定,故 F 类(同族先例:`server.park.toolcallid-read-failed`,同为 cs.get 投影读失败臂)。必须留痕:键缺席与「此刻确实没有 pending」在 wire 上同形,不计数则「指路为什么总缺」在遥测里永不显形。";

package/dist/observability/fail-open.js

@@ -132,6 +132,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "#261 fleet 存活对账腿的一次 durable 读失败/超预算(2s)⇒ **本周期整轮跳过**并开熔断,不做任何投影。放行的最坏后果 = 幽灵行(发布方已死、行僵在内存 Map 里)在面板上多活几个周期,与本腿存在之前的行为等同(那时它永远活着),不是新损失;真源不受影响(`GET /v1/runs/:id` 照常)。方向刻意 fail-open 且**只向留行一侧**:读不出来 ≠ 该退休——库抖一下就把一屏在跑的任务从面板上抹掉,比多留一条幽灵行伤得多。必须留痕:静默吞掉之后「对账腿为什么一直没生效」在遥测里没有任何痕迹,而本腿的全部价值就是「幽灵行会自己走」。",
     },
+    "server.fleet.terminal-notify": {
+        cls: "F",
+        note: "S-450:**两条臂共用**(detail 里 `read-failed` 分得开)—— ① `observability/run-terminal.ts` 的**行为订阅者**扇出(唯一铸点 `notifyRunTerminal`,三只 store 的 CAS 赢分支各调一次):某个订阅者(今天只有 fleet 对账腿的候补窗升级腿)在 `setTerminal` 的调用栈上抛错 ⇒ 吞掉并计数,终局写照常成功;② `fleet/fleet-reconciler.ts` 的事件腿在收到事件后那一次 durable 点读失败 ⇒ 这条行留在候补窗里等周期臂。⚠️ 同一只铸点上的**日志腿**(`setRunTerminalLogObserver`)走的是**相反**契约(刻意不 try、抛出让 `setTerminal` reject),**不计本 tag** —— 读遥测别把两席混成一件。方向承重:这条腿的全部价值是「把候补窗行的成对终帧从『下一个对账周期(≤60s)』提前到『durable 写落地的同一 tick』」,它是一格**投影提速**;把它的 bug 外溢成终局写 reject 会让 run 卡 running 到 reaper、claim 悬挂([868] 指纹),代价高出几个量级。放行的最坏后果 = 这条行的成对终帧退回到周期臂补发,**与本件存在之前的行为逐字等同**,不是新损失;故 F 类。必须留痕:静默吞掉之后「事件腿为什么一直没生效」在遥测里没有任何痕迹,而面板上看到的只是『偶尔慢一分钟』这种没人会立案的症状。",
+    },
     "server.fleet.run-status-unmapped": {
         cls: "F",
         note: "A-032 P1-④:`runStatusToFleet` 收到**词表外**的 run 状态词(闭集签名之外的唯一来路 = `rowToRun` 把无约束的 status 文本列裸 cast,滚动升级里更新的副本写的新词被旧副本读到)⇒ 折成 `idle`。放行的最坏后果 = 该行在 fleet 面板上**永久滞留**(removal 集 {completed,failed,killed} 收不到 idle),纯展示面、不影响 run 本身与任何执法判据,故 F 类。方向刻意不改(把 miss 折成终局会把一条还在跑的任务从面板上摘掉,误摘比多一行更伤)。留痕是承重的:2026-06-28 on-box e2e 逮到的 `blocked` 泄漏当年只能靠人眼在面板上发现——计数让下一次词表漂移在遥测里当场显形。编译期一侧已由闭集入参 + `never` 臂执法。",
@@ -180,6 +184,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-02 codex R1-[medium](验真后修):decide 的 409 `approval_stale` 臂对**调用方回显的旧 token** 做归属判定(`cs.get(binding.checkpointToken)`),那次读**抛了**(store 抖动 / 版本守卫 / 行恰被清理)。修前这里是静默 `catch(()=>null)`,「读不出」被折成「确认不在库」——叠上 S-02 的 404 收口后,一次 store 抖动就会把合法旧 token 的 409+terminal 谎报成 404「没有这条审批」。修后:unreadable ⇒ **保持 409**(`terminal` 不披露——证不出归属就不说,与 2026-07-26 纪律同向;404 折叠只在读成功且未命中时走,探测方无法自控 store 故障 ⇒ 谕示封闭不破)。放行的最坏后果 = 该次拒体 `terminal` 诚实缺席(`currentPending` 由它自己的读口与属主复核另判,不受本臂牵连),壳退回重拉列表,judgment 面 fail-safe,故 F 类。留痕理由:这次读是 terminal 披露与 404 折叠两个判定的输入,长期抖动必须在遥测显形。",
     },
+    "server.resume.reopen-confirm-unreadable": {
+        cls: "F",
+        note: "S-447(#60 M2 自查项,`http/resume-legs.ts` 的 `confirmCheckpointReopened`):续跑腿在 core 给出 reopen 族失败后按 **token** 复核「这张 checkpoint 是不是又 pending 了」,这一读抛(库拖/版本太新/店不可达)。**方向本来就是 fail-closed**:读不出 ⇒ `return true` ⇒ 「不写任何终局、重新 park」(`:1206-1212` 头注已把取舍与有界代价写死:错 park 由 `reapSuspended` 兑,错终局会孤儿化一张活 park 到 TTL)—— 所以这条腿不是 P 类,缺的只是**留痕**。放行的最坏后果 = 多一次多余的 re-park(一张已经被决掉的卡重新挂到 reaper 窗里),人面上是「这条续跑没动」而不是谁被放行了。必须登记的理由是 **uniformity**:同文件三只同形读(`:249` `server.approvals.stale-echoed-token-unreadable` · `:288` `server.approvals.stale-current-pending-unreadable` · 本腿)中只有它是黑的,于是「店一直读不出所以每条续跑都在白白 re-park」与「一切正常」在遥测上同形。计数非零 = 这台机器的 checkpoint 店在拖,运维要去看库。",
+    },
     "server.approvals.stale-current-pending-unreadable": {
         cls: "F",
         note: "S-02 件2([5522]④→[5525]):409 `approval_stale` 拒体铸 additive 指路键 `currentPending`(本会话当前 pending 的 D-1 坐标,壳一跳重定位)时,当前 pending 行的 `cs.get(token)` 读**抛了**(store 抖动 / 滚动升级期 checkpoint 格式 version guard / 行恰被并发消费)⇒ 本次拒体**缺 `currentPending` 键**,409 本体与 `terminal` 判定照旧。放行的最坏后果 = 壳退回该键到货前的行为(重拉 GET /v1/approvals 自行重定位),纯指路/便利面,不参与任何门/CAS/resume 判定,故 F 类(同族先例:`server.park.toolcallid-read-failed`,同为 cs.get 投影读失败臂)。必须留痕:键缺席与「此刻确实没有 pending」在 wire 上同形,不计数则「指路为什么总缺」在遥测里永不显形。",

package/dist/observability/metrics.d.ts

@@ -28,6 +28,9 @@ export declare class Metrics {
      *  needed). Counters are cumulative totals; histograms are reported as averages (sum/count). */
     summarize(): MetricsSummary;
 }
+/** S-451:`/metrics/summary` 上「失败最多的路由」保留几条。看板要的是**头部**,不是全表;
+ *  `routeLabel` 的值域本来就有界(路由声明表 + `"other"`),这个上限只是让这张脸的大小与路由表长解耦。 */
+export declare const HTTP_ERROR_ROUTE_TOP_N = 10;
 export interface MetricsSummary {
     runsActive: number;
     tasks: Record<string, number>;
@@ -61,6 +64,15 @@ export interface MetricsSummary {
     verifications: Record<string, number>;
     councilRuns: Record<string, number>;
     toolErrors: Record<string, number>;
+    /** S-451(additive,7.87.0):窗内 HTTP **失败**请求数,按状态码**类**聚合 —— 键只有 `"4xx"` / `"5xx"`
+     *  两种,2xx/3xx 一格不进。⚠️ `"4xx"` 里**含 `499`**(本仓给「客户端在响应结束前断连」铸的标签,
+     *  SSE 长连接上是常态)—— 看一场真风暴时按 {@link httpErrorsByRoute} 分辨是哪条腿。
+     *  空对象 = 窗内零失败(与 `tasks`/`toolErrors` 同律:键恒在场,不用缺席表示零)。 */
+    httpErrorsByClass: Record<string, number>;
+    /** S-451(additive,7.87.0):失败(4xx+5xx 合计)最多的前 {@link HTTP_ERROR_ROUTE_TOP_N} 条 **route 标签**
+     *  (`routeLabel` 的低基数形,id 已折成 `:id`;未命中路由表的落 `"other"`)。按计数降序。
+     *  这是「180 次 404 到底打在哪」的那一格。 */
+    httpErrorsByRoute: Record<string, number>;
 }
 export interface MetricSnapshot {
     counters: Array<{

package/dist/observability/metrics.js

@@ -188,9 +188,25 @@ export class Metrics {
             toolErrors: Object.fromEntries([...(this.counters.get("tool_calls_total")?.series.values() ?? [])]
                 .filter((s) => s.labels.ok === "false")
                 .map((s) => [s.labels.name ?? "?", s.value])),
+            ...(() => {
+                const failures = [...(this.counters.get("http_requests_total")?.series.values() ?? [])]
+                    .map((s) => ({ cls: /^([45])\d\d$/.exec(s.labels.status ?? "")?.[1], route: s.labels.route ?? "?", value: s.value }))
+                    .filter((x) => x.cls !== undefined);
+                const byClass = {};
+                const byRoute = {};
+                for (const f of failures) {
+                    byClass[`${f.cls}xx`] = (byClass[`${f.cls}xx`] ?? 0) + f.value;
+                    byRoute[f.route] = (byRoute[f.route] ?? 0) + f.value;
+                }
+                return {
+                    httpErrorsByClass: byClass,
+                    httpErrorsByRoute: Object.fromEntries(Object.entries(byRoute).sort((a, b) => b[1] - a[1]).slice(0, HTTP_ERROR_ROUTE_TOP_N)),
+                };
+            })(),
         };
     }
 }
+export const HTTP_ERROR_ROUTE_TOP_N = 10;
 export function createMetrics() {
     const m = new Metrics();
     m.counter("metric_gauge_eval_errors_total", "Dynamic gauge eval errors by gauge name (an erroring gauge emits NO sample that scrape — absence means unknown, not 0)");
@@ -270,6 +286,7 @@ export function createMetrics() {
     m.counter("compaction_events_total", "Compaction lifecycle events by outcome (started/completed/failed/skipped) and trigger");
     m.counter("hook_llm_calls_total", "prompt/agent hook entries that completed a model call (hooks 3b), by type");
     m.counter("auth_bridge_verify_total", "Registry SSO JWT verifications (auth-bridge), by outcome");
+    m.counter("fleet_rows_reconciled_total", "Fleet rows the #261 liveness-reconcile leg acted on, by `disposition`: 'retired' = durable was terminal, the leg projected the settled pair (terminal task frame → task_remove); 'retired_deferred' = a row that had already left declaratively (removeReason:\"orphaned\") got its settled pair BACKFILLED once durable turned terminal; 'orphaned' / 'orphaned_child' = declarative exit, NO terminal was minted (the reaper owns the death ruling); 'workflow_retired' = same projection for a workflow row. `trigger` rides ONLY the retired_deferred series (S-450): 'event' = the backfill fired on the same tick a terminal write landed through the run-store write口 (single replica), 'cycle' = it fired on the 60s reconcile cycle (cross-replica writes, and terminals flipped by the BATCH reapers, which never pass through the write口). A retired_deferred series that is 100% trigger=cycle means the event leg is not wired or this deployment\'s terminals all come from those two families");
     m.counter("fleet_lease_issued_total", "Fleet trace-lease tokens issued");
     m.counter("fleet_lease_rejected_total", "Fleet trace-lease requests rejected");
     m.counter("fleet_lease_exhausted_total", "Fleet trace-lease requests rejected because the pool was exhausted");

package/dist/observability/{run-terminal-log.d.ts → run-terminal.d.ts}

@@ -3,8 +3,14 @@ import { type RunRecord } from "../plugins/store-contracts.js";
 export interface RunTerminalRecord {
     /** 这条 run 的账本 id = `GET /v1/runs/:id` 的 id(本仓 run 行主键名为 taskId,同一个值)。 */
     runId: string;
-    sessionId: string;
-    owner: string | null;
+    /**
+     * 🔴 **只在「这条终局要出声」时在场**(S-450):三只 store 只在 `runTerminalLogLevel(...) !== undefined`
+     * 时才多付那一次 PK 读去装它(成功终局零额外查询 —— 那条注在 `run-store-sql.ts` 的 `setTerminal` 里)。
+     * 日志腿恰好只在同一形下运行,所以**它读到的恒是在场的**;行为订阅者不得依赖它。
+     */
+    sessionId?: string;
+    /** 同 {@link RunTerminalRecord.sessionId}:只在要出声的那一形在场。`null` = 行上没有 owner。 */
+    owner?: string | null;
     status: RunRecord["status"];
     /** 终局结果里的引擎侧 taskId —— 只在与 {@link RunTerminalRecord.runId} **不同**时进日志(sync 腿上 core 会把它
      *  铸成 sessionId,两者同值时重复一遍只是噪音)。 */
@@ -15,8 +21,16 @@ export interface RunTerminalRecord {
     /** 行创建到终局的墙钟毫秒(store 侧用行的 createdAt 算;算不出=不传,键缺席)。 */
     elapsedMs?: number | undefined;
 }
-/** 观测者收到的是**已判级 + 已脱敏 + 已截断**的成品——装配层只负责把它送进 logger。 */
-export type RunTerminalObserver = (level: "error" | "info", fields: Record<string, unknown>) => void;
+/** **日志腿**收到的是**已判级 + 已脱敏 + 已截断**的成品——装配层只负责把它送进 logger。 */
+export type RunTerminalLogObserver = (level: "error" | "info", fields: Record<string, unknown>) => void;
+/**
+ * **行为订阅者**(S-450):CAS 赢的那一刻收到整只 {@link RunTerminalRecord}。
+ *
+ * 🔴 载荷是**这次写自己的视角**,不是回读的 durable 行 —— 只有 `runId` / `status` 两位在**任何**形下
+ * 都为真(CAS 赢 ⇒ 行就是这个词)。日志腿专用的那几位在成功终局上**刻意缺席**(store 不为它们多付一次
+ * PK 往返,见 {@link RunTerminalRecord.sessionId})。要更多事实的订阅者请自己按 `runId` 读 durable。
+ */
+export type RunTerminalSubscriber = (rec: RunTerminalRecord) => void;
 /**
  * 终局行的级别判据。`undefined` = 不打行。
  *
@@ -25,13 +39,39 @@ export type RunTerminalObserver = (level: "error" | "info", fields: Record<strin
  * 穷举 switch,并在 `blocked` 那一格给出与 fleet 读面互斥的答案)。表的编译期双向钉在属主处。
  */
 export declare function runTerminalLogLevel(status: RunRecord["status"], errorCode: string | undefined): "error" | "info" | undefined;
-/** 装配点(`main.ts` 唯一)。传 `undefined` 卸载(测试隔离)。 */
-export declare function setRunTerminalObserver(fn: RunTerminalObserver | undefined): void;
+/** **日志腿**的装配点(`boot/stage-01-config.ts` 唯一)。传 `undefined` 卸载(测试隔离)。 */
+export declare function setRunTerminalLogObserver(fn: RunTerminalLogObserver | undefined): void;
+/**
+ * **行为订阅者**的登记口(S-450)。返回解除登记的句柄。
+ *
+ * 与 {@link setRunTerminalLogObserver} 是**两个语义不同的席**,不是一个带旗的列表:
+ *  · 日志腿**恰一只**、装配层亲接、**不隔离**(抛出会让 `setTerminal` reject —— 见 {@link notifyRunTerminal});
+ *  · 行为订阅者**可多只**、运行期来去、**逐只隔离**(抛出吞掉 + `recordFailOpen`)。
+ * 两条失败契约相反,所以它们必须是两个名字;混进一个列表再加一个 `isolate` 位,就是把「这条腿出事
+ * 该不该把 run 拖下水」这个**语义**降级成一个**配置**。
+ */
+export declare function subscribeRunTerminal(fn: RunTerminalSubscriber): () => void;
+/** test-only:清空行为订阅者(用例之间不串台;日志腿用 `setRunTerminalLogObserver(undefined)`)。 */
+export declare function resetRunTerminalSubscribersForTest(): void;
 /**
- * store 的终局写口在 **CAS 赢了之后**调用它。未装配观测者 ⇒ 无操作(纯内存/无 boot 的单测车道)。
+ * 🔴 **run 行翻终局的唯一铸点** —— 三个 run store 的 `setTerminal` 在 **CAS 赢了之后**各调它一次
+ * (SQL 腿 `w.affected > 0`,file / memory 腿在同判据的 CAS 分支内)。「CAS 赢了才发」是**恰一次**的来源:
+ * 调用侧的兜底腿有意会对同一行重复写(cancel × leg-throw × reaper 三向),打空的那几次一个字都不发。
+ *
+ * 两条出口,**失败契约相反**,顺序承重:
+ *  ① **行为订阅者先**({@link subscribeRunTerminal},逐只 try)—— 它们要在日志腿万一违约抛出之前跑完;
+ *  ② **日志腿后**({@link setRunTerminalLogObserver},级别筛 + 脱敏 + 不 try)。
+ *
+ * 为什么日志腿**刻意不 try**(原文保留,[ref] 的成文理由):静默吞掉观测者异常 = 又造一条「走了兜底与
+ * 一切正常同形」的路,方向与本模块的存在理由相反;生产装配的那一只只调 `Logger`(`createLogger` 的 emit
+ * 内部已把 JSON.stringify 与 write 全部 try 住,结构上不抛)。
+ * 为什么行为订阅者**必须 try**(S-450 新加的那一半):它们是**行为腿**,不是一只结构上不抛的 logger;
+ * 而本函数跑在 `setTerminal` 的调用栈上、**CAS 已经赢了、行已经落盘**,此时把订阅者的 bug 放大成
+ * 「终局写 reject」= run 卡 `running` 到 reaper + claim 悬挂([ref] 指纹)。吞但**不静默**:
+ * `recordFailOpen("server.fleet.terminal-notify")`(F 类,普查登记在案)。
  *
- * 脱敏:`errorMessage` 过 `redactSecrets` 再截断到 {@link MESSAGE_CAP} —— provider 的错误体
- * 会原样回显请求片段(取证里的 403 体带订阅链接;别的 provider 会回显 Authorization 头前缀),
+ * 脱敏(只在日志腿那一格):`errorMessage` 过 `redactSecrets` 再截断到 {@link MESSAGE_CAP} —— provider 的
+ * 错误体会原样回显请求片段(取证里的 403 体带订阅链接;别的 provider 会回显 Authorization 头前缀),
  * 而引擎日志是运维面、常被整条采集走。`errorCode` / `model` 是闭集式短标量,verbatim。
  */
 export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
@@ -164,4 +204,4 @@ export declare function memoRedactTerminalResult<T extends Parameters<typeof red
 export declare function diffScanShadowCountForTest(): number;
 export declare function resetDiffScanShadowCountForTest(): void;
 export declare function resetReadRedactionMemoForTest(): void;
-//# sourceMappingURL=run-terminal-log.d.ts.map
+//# sourceMappingURL=run-terminal.d.ts.map