@sema-agent/server 7.86.0 → 7.87.0

package/dist/http/routes/approvals-assistant.js

@@ -6,11 +6,11 @@ import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
-import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
+import { MAX_APPROVAL_REASON_CHARS, projectQuestionAnswer, questionAnswerFromProjection } from "../../approval-hmac.js";
 import { PLAN_APPROVE_PERMISSION_MODES_AFTER, isPlanApprovePermissionModeAfter, storedBodyPermissionMode } from "../../task-settings.js";
 import { MAX_APPROVAL_NONCE_CHARS } from "../../plugins/approval-nonce-store.js";
 import { redactedPreview, redactSecrets } from "../../trace/redact.js";
-import { redactRiskDescriptor } from "../../observability/run-terminal-log.js";
+import { redactRiskDescriptor } from "../../observability/run-terminal.js";
 import { fleetRunLabels } from "../../fleet/fleet-bus.js";
 import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
@@ -23,6 +23,8 @@ import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-ke
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "updatedInput",
 ];
+const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "updatedInput"];
 const ACCEPTED_DECIDE_BODY = new Set(DECIDE_BODY_DECLARED_KEYS);
 const UNSUPPORTED_DECIDE_BODY = new Set(["editedPlan", "sessionId", "taskId"]);
 export function decideBodyKeyIssue(raw) {
@@ -50,6 +52,23 @@ export function decideBodyKeyIssue(raw) {
 const PLAN_REVIEW_BODY_DECLARED_KEYS = [
     "boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason",
 ];
+const PLAN_REVIEW_PROOF_COVERED_KEYS = ["boundCallId", "decision", "editedPlan", "permissionModeAfter", "reason"];
+const PLAN_REVIEW_NOT_IN_PROOF_KEYS = [];
+const PROOF_SLOT_OF = {
+    answer: "answer",
+    boundCallId: "boundCallId",
+    boundInputHash: "boundInputHash",
+    decision: "decision",
+    editedPlan: "boundInputHash",
+    permissionModeAfter: "permissionModeAfter",
+    reason: "reason",
+};
+function buildApprovalEnvelope(sessionId, covered, reading) {
+    const envelope = { sessionId, decision: reading.decision };
+    for (const key of covered)
+        Object.assign(envelope, { [PROOF_SLOT_OF[key]]: reading[key] });
+    return envelope;
+}
 const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
 const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
     "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
@@ -79,13 +98,27 @@ export function planReviewBodyKeyIssue(raw) {
 export function decisionReasonOf(body) {
     return typeof body.reason === "string" && body.reason !== "" ? body.reason : undefined;
 }
-export function isQuestionAnswer(v) {
+const QUESTION_ANSWER_TOP_KEYS = ["answers"];
+const QUESTION_ANSWER_ITEM_KEYS = ["header", "selected", "note"];
+const ACCEPTED_QUESTION_ANSWER_TOP = new Set(QUESTION_ANSWER_TOP_KEYS);
+const ACCEPTED_QUESTION_ANSWER_ITEM = new Set(QUESTION_ANSWER_ITEM_KEYS);
+const NO_TOLERATED_KEYS = new Set();
+export function checkQuestionAnswer(v) {
     if (!v || typeof v !== "object" || Array.isArray(v))
-        return false;
+        return { ok: false, kind: "shape" };
     const a = v.answers;
     if (!Array.isArray(a) || a.length === 0)
-        return false;
-    return a.every((it) => {
+        return { ok: false, kind: "shape" };
+    const buckets = { unknown: [], unsupported: [] };
+    scanKeyClosure(v, "answer.", ACCEPTED_QUESTION_ANSWER_TOP, NO_TOLERATED_KEYS, buckets);
+    a.forEach((it, i) => {
+        if (!it || typeof it !== "object" || Array.isArray(it))
+            return;
+        scanKeyClosure(it, `answer.answers[${i}].`, ACCEPTED_QUESTION_ANSWER_ITEM, NO_TOLERATED_KEYS, buckets);
+    });
+    if (buckets.unknown.length > 0)
+        return { ok: false, kind: "unknown_key", keyPaths: buckets.unknown.sort().slice(0, MAX_KEY_ECHO) };
+    const shapeOk = a.every((it) => {
         if (!it || typeof it !== "object" || Array.isArray(it))
             return false;
         const { header, selected, note } = it;
@@ -95,6 +128,7 @@ export function isQuestionAnswer(v) {
             selected.every((s) => typeof s === "string") &&
             (note === undefined || typeof note === "string"));
     });
+    return shapeOk ? { ok: true, value: v } : { ok: false, kind: "shape" };
 }
 async function decideIdempotentReplay(cs, args) {
     const { sessionId, out, binding, decision, payload, deciderPrincipal, explicitOperator, warn } = args;
@@ -173,7 +207,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const scope = operator
                 ? (new URLSearchParams(match.search).get("owner") ?? undefined)
                 : (principal ?? "__none__");
-            await streamApprovals(req, res, cs, scope, deps.config);
+            await streamApprovals(req, res, cs, deps.toolApproval, scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
@@ -464,7 +498,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 const storeNowMs = await store.nowMs();
                 const hdr = (n) => { const h = req.headers[n]; return Array.isArray(h) ? h[0] : h; };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId: run.sessionId, boundCallId: planNonce ?? null, boundInputHash: decision === "edit" ? editedPlanBinding(body.editedPlan) : null, decision, reason: typeof body.reason === "string" ? body.reason : null, ...(isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? { permissionModeAfter: body.permissionModeAfter } : {}) }, deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(run.sessionId, PLAN_REVIEW_PROOF_COVERED_KEYS, {
+                    boundCallId: planNonce ?? null,
+                    decision,
+                    editedPlan: decision === "edit" ? editedPlanBinding(body.editedPlan) : null,
+                    permissionModeAfter: isPlanApprovePermissionModeAfter(body.permissionModeAfter) ? body.permissionModeAfter : undefined,
+                    reason: typeof body.reason === "string" ? body.reason : null,
+                }), deps.config, { actionBinding: false, nowSec: Math.floor(storeNowMs / 1000) });
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -556,12 +596,19 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 remember = true;
             }
             let answer;
+            let answerProjection;
             if (body.answer !== undefined) {
-                if (!isQuestionAnswer(body.answer)) {
-                    sendError(res, 400, "request.body_shape", "malformed answer — expected { answers: [{ header, selected: string[], note? }] }");
+                const checked = checkQuestionAnswer(body.answer);
+                if (!checked.ok) {
+                    if (checked.kind === "shape") {
+                        sendError(res, 400, "request.body_shape", "malformed answer — expected { answers: [{ header, selected: string[], note? }] }");
+                        return;
+                    }
+                    sendError(res, 400, "request.field_invalid", `answer: unrecognized key(s) — refused rather than dropped, because a dropped key reads as "in effect" to the caller (a misspelled selected key silently drops part of the operator's answer). ${keyClosureClause([...checked.keyPaths], "unknown (not a question-answer key — check the spelling)")}. Accepted: answers, answers[].header, answers[].selected, answers[].note`, { unknownKeys: [...checked.keyPaths] });
                     return;
                 }
-                answer = body.answer;
+                answerProjection = projectQuestionAnswer(checked.value);
+                answer = questionAnswerFromProjection(answerProjection);
             }
             for (const f of ["checkpointToken", "boundCallId", "boundInputHash"]) {
                 if (body[f] !== undefined && typeof body[f] !== "string") {
@@ -573,6 +620,10 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "updated_input_not_in_proof", "updatedInput is not supported on a direct-door worker (not covered by the decision proof)");
                 return;
             }
+            if (deps.config.directDoorActive && body.checkpointToken !== undefined) {
+                sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -585,7 +636,13 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     const h = req.headers[n];
                     return Array.isArray(h) ? h[0] : h;
                 };
-                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, { sessionId, boundCallId: binding.boundCallId, boundInputHash: binding.boundInputHash, decision, reason: typeof body.reason === "string" ? body.reason : null }, deps.config);
+                const proof = verifyDirectDoorProof({ jwt: hdr(PRINCIPAL_TOKEN_HEADER), mac: hdr(APPROVAL_MAC_HEADER), kid: hdr(APPROVAL_MAC_KID_HEADER) }, buildApprovalEnvelope(sessionId, DECIDE_PROOF_COVERED_KEYS, {
+                    answer: answerProjection,
+                    boundCallId: binding.boundCallId,
+                    boundInputHash: binding.boundInputHash,
+                    decision,
+                    reason: typeof body.reason === "string" ? body.reason : null,
+                }), deps.config);
                 if (!proof.ok) {
                     sendError(res, proof.status, proof.errorCode, proof.error);
                     return;
@@ -664,7 +721,24 @@ function projectPendingForWire(row, governance) {
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
     return governanceForced ? { ...redacted, governanceForced } : redacted;
 }
-export async function streamApprovals(req, res, cs, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
+function createSseDeltaLane(res, spec) {
+    let prev = new Map();
+    return {
+        tick(rows) {
+            const cur = new Map(rows.map((r) => [spec.keyOf(r), { row: r, bytes: spec.bytesOf(r) }]));
+            for (const [k, v] of cur) {
+                if (prev.get(k)?.bytes !== v.bytes)
+                    res.write(`event: ${spec.upsertEvent}\ndata: ${JSON.stringify(spec.upsertData(v.row, Date.now()))}\n\n`);
+            }
+            for (const [k, v] of prev) {
+                if (!cur.has(k))
+                    res.write(`event: ${spec.exitEvent}\ndata: ${JSON.stringify(spec.exitData(v.row, Date.now()))}\n\n`);
+            }
+            prev = cur;
+        },
+    };
+}
+export async function streamApprovals(req, res, cs, live, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     const keyOf = (p) => JSON.stringify([p.sessionId, p.toolCallId ?? null]);
     sseHeaders(res);
     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, mode: "approvals-delta", pollMs: APPROVALS_STREAM_POLL_MS })}\n\n`);
@@ -672,13 +746,29 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
     bindSseLifecycle(req, res, () => { closed = true; });
     const start = Date.now();
     let lastBeat = Date.now();
-    let prev = new Map();
-    let prevFrames = new Map();
+    const durableLane = createSseDeltaLane(res, {
+        upsertEvent: "pending",
+        exitEvent: "resolved",
+        keyOf,
+        bytesOf: (p) => JSON.stringify({ type: "pending", ...p }),
+        upsertData: (p, nowMs) => ({ type: "pending", ...p, serverNowMs: nowMs }),
+        exitData: (p, nowMs) => ({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: nowMs }),
+    });
+    const liveLane = createSseDeltaLane(res, {
+        upsertEvent: "live_pending",
+        exitEvent: "live_resolved",
+        keyOf: (r) => r.approvalId,
+        bytesOf: (r) => JSON.stringify({ type: "live_pending", ...r }),
+        upsertData: (r, nowMs) => ({ type: "live_pending", ...r, serverNowMs: nowMs }),
+        exitData: (r, nowMs) => ({ type: "live_resolved", approvalId: r.approvalId, serverNowMs: nowMs }),
+    });
     let first = true;
     while (!closed) {
         let pending;
+        let livePending;
         try {
             pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
+            livePending = live ? live.listLivePending(scope) : [];
         }
         catch {
             if (!res.writableEnded)
@@ -686,25 +776,12 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
             await sleep(pollMs);
             continue;
         }
-        const cur = new Map(pending.map((p) => [keyOf(p), p]));
-        const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
-        const pendingFrame = (k) => JSON.stringify({ type: "pending", ...cur.get(k), serverNowMs: Date.now() });
+        durableLane.tick(pending);
+        liveLane.tick(livePending);
         if (first) {
-            for (const k of curFrames.keys())
-                res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
-        else {
-            for (const [k, frame] of curFrames)
-                if (prevFrames.get(k) !== frame)
-                    res.write(`event: pending\ndata: ${pendingFrame(k)}\n\n`);
-            for (const [k, p] of prev)
-                if (!cur.has(k))
-                    res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId, serverNowMs: Date.now() })}\n\n`);
-        }
-        prev = cur;
-        prevFrames = curFrames;
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
             break;

package/dist/http/routes/runs.js

@@ -1,5 +1,5 @@
 import { persistedPlaneOf } from "../../terminal.js";
-import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
+import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal.js";
 import { isModelTextLedgerEventType } from "../../trace/ledger-events.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
@@ -89,7 +89,7 @@ async function subagentReadGate(req, res, ctx, runId, search) {
 }
 function sendHandleMiss(res, run, thisInstanceId) {
     if (isTerminalRunStatus(run.status)) {
-        sendError(res, 404, "not_found.task_owner_settled", "no such background task handle here. Routing hint about its OWNER (not about this handle): the run has already settled, and background handles live in the replica-local registry for the parent's lifetime, so none of its handles are readable any more. Read the run's own outcome via GET /v1/runs/:id");
+        sendError(res, 404, "not_found.task_owner_settled", "no such background task handle here. Routing hint about its OWNER (not about this handle): the run has already settled. Read the run's own outcome via GET /v1/runs/:id");
         return true;
     }
     if (run.status === "running" && runProvenElsewhere(run, thisInstanceId)) {

package/dist/http/routes/tasks.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, uuidv7, terminalProjection } from "@sema-agent/core";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
 import { stripResumeToken } from "../../terminal.js";
@@ -414,7 +414,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
                                     putRewindAnchor();
-                                    settleFleet(finalResult ? terminalProjection(finalResult.terminal).status : "completed", fleetRunResiduals(finalResult));
+                                    settleFleet(terminalProjection(finalResult.terminal).status, fleetRunResiduals(finalResult));
                                     if (ledgerSink && finalResult) {
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;

package/dist/http/routes/workflows.js

@@ -5,7 +5,7 @@ import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from ".
 import { journalEntryOfRow, journalEntryPayload, journalRowPayloadOf } from "../../orchestration/workflow-journal-entry.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { createHash } from "node:crypto";
-import { redactErrorMessage, redactHead } from "../../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead } from "../../observability/run-terminal.js";
 const JOURNAL_PROJECTION_MEMO_CAP = 1024;
 const journalProjectionMemo = new Map();
 import { sendJson, sendError, sseHeaders } from "../send.js";

package/dist/http/server.d.ts

@@ -28,8 +28,8 @@ import type { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
 import { scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
 import type { ConsolidationSeatLabel } from "../boot/memory-consolidation.js";
-import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
-export { streamApprovals, isQuestionAnswer };
+import { streamApprovals, checkQuestionAnswer } from "./routes/approvals-assistant.js";
+export { streamApprovals, checkQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";

package/dist/http/server.js

@@ -1,5 +1,5 @@
 import http from "node:http";
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 import { validatePendingSteer, terminalProjection } from "@sema-agent/core";
 import {} from "../config-center/facade.js";
 import { HttpError } from "../security.js";
@@ -12,8 +12,8 @@ import {} from "../tool-approval.js";
 import {} from "../observability/rate-limit.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
-import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
-export { streamApprovals, isQuestionAnswer };
+import { streamApprovals, checkQuestionAnswer } from "./routes/approvals-assistant.js";
+export { streamApprovals, checkQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
 export { cascadeConfig };
 import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";

package/dist/leader/diffout.js

@@ -1,4 +1,4 @@
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 export const DEFAULT_MAX_DIFF_BYTES = 5 * 1024 * 1024;
 const DEFAULT_READ_TIMEOUT_MS = 30_000;
 const SAFE_REV = /^[A-Za-z0-9._/-]{1,200}$/;

package/dist/leader/endpoint.js

@@ -1,5 +1,5 @@
 import { uuidv7 } from "@sema-agent/core";
-import { redactErrorMessage, redactHead, redactLeaderResult, redactLeaderResultWithFlag } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead, redactLeaderResult, redactLeaderResultWithFlag } from "../observability/run-terminal.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { leaderIdemKey } from "../plugins/leader-run-store-sql.js";
 function statusForLeaderResult(result) {

package/dist/leader/fanout.js

@@ -1,5 +1,5 @@
 import { terminalProjection } from "@sema-agent/core";
-import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactWorkerReportError } from "../observability/run-terminal.js";
 import { pausedCauseOf } from "../terminal.js";
 class Semaphore {
     max;

package/dist/leader/leader.js

@@ -1,5 +1,5 @@
 import { fanOut } from "./fanout.js";
-import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { pullDiff } from "./diffout.js";
 import { mergeBranches } from "./merge.js";
 import { Runner, runWithVerification, resumeWithVerification, terminalProjection } from "@sema-agent/core";

package/dist/leader/merge.js

@@ -1,5 +1,5 @@
 import { delimitUntrusted } from "@sema-agent/core";
-import { OVERSIZED_DIAG_PLACEHOLDER, redactArtifactText, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { OVERSIZED_DIAG_PLACEHOLDER, redactArtifactText, redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal.js";
 import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.js";
 import { shellQuote as Q } from "../plugins/remote-shell.js";
 const CONFLICT_FILES_MAX = 200;

package/dist/leader/planner.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { redactErrorMessage, redactHead, redactTail } from "../observability/run-terminal.js";
 export function economicGuard(objective, opts = {}) {
     if (opts.fanoutEnabled === false)
         return { single: true, reason: "fan-out disabled by deployment (A6)" };

package/dist/leader/repair-oracle.js

@@ -1,7 +1,7 @@
 import { runExecGate, } from "@sema-agent/core";
 import { createHash } from "node:crypto";
 import { shellQuote as sq } from "../plugins/remote-shell.js";
-import { redactHead, redactTail } from "../observability/run-terminal-log.js";
+import { redactHead, redactTail } from "../observability/run-terminal.js";
 const sha = (s) => createHash("sha256").update(s).digest("hex").slice(0, 16);
 function changedFilesOf(patch) {
     const out = new Set();

package/dist/leader/repair-wire.js

@@ -1,7 +1,7 @@
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
 import { terminalProjection } from "@sema-agent/core";
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }

package/dist/leader/wire.js

@@ -16,7 +16,7 @@ import { attachRepairLoopDeps } from "./repair-wire.js";
 import { routePlanWithFallback, validateSubtasks } from "./planner.js";
 import { createEngineNoticeSeat } from "../boot/runner-deps.js";
 import { currentPrincipal } from "../observability/principal-context.js";
-import { redactHead } from "../observability/run-terminal-log.js";
+import { redactHead } from "../observability/run-terminal.js";
 const REPAIR_LOOP_WIRED = true;
 const sh = (env) => async (cmd) => {
     const r = await env.exec(`bash -lc ${JSON.stringify(cmd)}`);

package/dist/observability/fail-open.d.ts

@@ -141,6 +141,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "#261 fleet 存活对账腿的一次 durable 读失败/超预算(2s)⇒ **本周期整轮跳过**并开熔断,不做任何投影。放行的最坏后果 = 幽灵行(发布方已死、行僵在内存 Map 里)在面板上多活几个周期,与本腿存在之前的行为等同(那时它永远活着),不是新损失;真源不受影响(`GET /v1/runs/:id` 照常)。方向刻意 fail-open 且**只向留行一侧**:读不出来 ≠ 该退休——库抖一下就把一屏在跑的任务从面板上抹掉,比多留一条幽灵行伤得多。必须留痕:静默吞掉之后「对账腿为什么一直没生效」在遥测里没有任何痕迹,而本腿的全部价值就是「幽灵行会自己走」。";
     };
+    readonly "server.fleet.terminal-notify": {
+        readonly cls: "F";
+        readonly note: "S-450:**两条臂共用**(detail 里 `read-failed` 分得开)—— ① `observability/run-terminal.ts` 的**行为订阅者**扇出(唯一铸点 `notifyRunTerminal`,三只 store 的 CAS 赢分支各调一次):某个订阅者(今天只有 fleet 对账腿的候补窗升级腿)在 `setTerminal` 的调用栈上抛错 ⇒ 吞掉并计数,终局写照常成功;② `fleet/fleet-reconciler.ts` 的事件腿在收到事件后那一次 durable 点读失败 ⇒ 这条行留在候补窗里等周期臂。⚠️ 同一只铸点上的**日志腿**(`setRunTerminalLogObserver`)走的是**相反**契约(刻意不 try、抛出让 `setTerminal` reject),**不计本 tag** —— 读遥测别把两席混成一件。方向承重:这条腿的全部价值是「把候补窗行的成对终帧从『下一个对账周期(≤60s)』提前到『durable 写落地的同一 tick』」,它是一格**投影提速**;把它的 bug 外溢成终局写 reject 会让 run 卡 running 到 reaper、claim 悬挂([868] 指纹),代价高出几个量级。放行的最坏后果 = 这条行的成对终帧退回到周期臂补发,**与本件存在之前的行为逐字等同**,不是新损失;故 F 类。必须留痕:静默吞掉之后「事件腿为什么一直没生效」在遥测里没有任何痕迹,而面板上看到的只是『偶尔慢一分钟』这种没人会立案的症状。";
+    };
     readonly "server.fleet.run-status-unmapped": {
         readonly cls: "F";
         readonly note: "A-032 P1-④:`runStatusToFleet` 收到**词表外**的 run 状态词(闭集签名之外的唯一来路 = `rowToRun` 把无约束的 status 文本列裸 cast,滚动升级里更新的副本写的新词被旧副本读到)⇒ 折成 `idle`。放行的最坏后果 = 该行在 fleet 面板上**永久滞留**(removal 集 {completed,failed,killed} 收不到 idle),纯展示面、不影响 run 本身与任何执法判据,故 F 类。方向刻意不改(把 miss 折成终局会把一条还在跑的任务从面板上摘掉,误摘比多一行更伤)。留痕是承重的:2026-06-28 on-box e2e 逮到的 `blocked` 泄漏当年只能靠人眼在面板上发现——计数让下一次词表漂移在遥测里当场显形。编译期一侧已由闭集入参 + `never` 臂执法。";
@@ -189,6 +193,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-02 codex R1-[medium](验真后修):decide 的 409 `approval_stale` 臂对**调用方回显的旧 token** 做归属判定(`cs.get(binding.checkpointToken)`),那次读**抛了**(store 抖动 / 版本守卫 / 行恰被清理)。修前这里是静默 `catch(()=>null)`,「读不出」被折成「确认不在库」——叠上 S-02 的 404 收口后,一次 store 抖动就会把合法旧 token 的 409+terminal 谎报成 404「没有这条审批」。修后:unreadable ⇒ **保持 409**(`terminal` 不披露——证不出归属就不说,与 2026-07-26 纪律同向;404 折叠只在读成功且未命中时走,探测方无法自控 store 故障 ⇒ 谕示封闭不破)。放行的最坏后果 = 该次拒体 `terminal` 诚实缺席(`currentPending` 由它自己的读口与属主复核另判,不受本臂牵连),壳退回重拉列表,judgment 面 fail-safe,故 F 类。留痕理由:这次读是 terminal 披露与 404 折叠两个判定的输入,长期抖动必须在遥测显形。";
     };
+    readonly "server.resume.reopen-confirm-unreadable": {
+        readonly cls: "F";
+        readonly note: "S-447(#60 M2 自查项,`http/resume-legs.ts` 的 `confirmCheckpointReopened`):续跑腿在 core 给出 reopen 族失败后按 **token** 复核「这张 checkpoint 是不是又 pending 了」,这一读抛(库拖/版本太新/店不可达)。**方向本来就是 fail-closed**:读不出 ⇒ `return true` ⇒ 「不写任何终局、重新 park」(`:1206-1212` 头注已把取舍与有界代价写死:错 park 由 `reapSuspended` 兑,错终局会孤儿化一张活 park 到 TTL)—— 所以这条腿不是 P 类,缺的只是**留痕**。放行的最坏后果 = 多一次多余的 re-park(一张已经被决掉的卡重新挂到 reaper 窗里),人面上是「这条续跑没动」而不是谁被放行了。必须登记的理由是 **uniformity**:同文件三只同形读(`:249` `server.approvals.stale-echoed-token-unreadable` · `:288` `server.approvals.stale-current-pending-unreadable` · 本腿)中只有它是黑的,于是「店一直读不出所以每条续跑都在白白 re-park」与「一切正常」在遥测上同形。计数非零 = 这台机器的 checkpoint 店在拖,运维要去看库。";
+    };
     readonly "server.approvals.stale-current-pending-unreadable": {
         readonly cls: "F";
         readonly note: "S-02 件2([5522]④→[5525]):409 `approval_stale` 拒体铸 additive 指路键 `currentPending`(本会话当前 pending 的 D-1 坐标,壳一跳重定位)时,当前 pending 行的 `cs.get(token)` 读**抛了**(store 抖动 / 滚动升级期 checkpoint 格式 version guard / 行恰被并发消费)⇒ 本次拒体**缺 `currentPending` 键**,409 本体与 `terminal` 判定照旧。放行的最坏后果 = 壳退回该键到货前的行为(重拉 GET /v1/approvals 自行重定位),纯指路/便利面,不参与任何门/CAS/resume 判定,故 F 类(同族先例:`server.park.toolcallid-read-failed`,同为 cs.get 投影读失败臂)。必须留痕:键缺席与「此刻确实没有 pending」在 wire 上同形,不计数则「指路为什么总缺」在遥测里永不显形。";

package/dist/observability/fail-open.js

@@ -132,6 +132,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "#261 fleet 存活对账腿的一次 durable 读失败/超预算(2s)⇒ **本周期整轮跳过**并开熔断,不做任何投影。放行的最坏后果 = 幽灵行(发布方已死、行僵在内存 Map 里)在面板上多活几个周期,与本腿存在之前的行为等同(那时它永远活着),不是新损失;真源不受影响(`GET /v1/runs/:id` 照常)。方向刻意 fail-open 且**只向留行一侧**:读不出来 ≠ 该退休——库抖一下就把一屏在跑的任务从面板上抹掉,比多留一条幽灵行伤得多。必须留痕:静默吞掉之后「对账腿为什么一直没生效」在遥测里没有任何痕迹,而本腿的全部价值就是「幽灵行会自己走」。",
     },
+    "server.fleet.terminal-notify": {
+        cls: "F",
+        note: "S-450:**两条臂共用**(detail 里 `read-failed` 分得开)—— ① `observability/run-terminal.ts` 的**行为订阅者**扇出(唯一铸点 `notifyRunTerminal`,三只 store 的 CAS 赢分支各调一次):某个订阅者(今天只有 fleet 对账腿的候补窗升级腿)在 `setTerminal` 的调用栈上抛错 ⇒ 吞掉并计数,终局写照常成功;② `fleet/fleet-reconciler.ts` 的事件腿在收到事件后那一次 durable 点读失败 ⇒ 这条行留在候补窗里等周期臂。⚠️ 同一只铸点上的**日志腿**(`setRunTerminalLogObserver`)走的是**相反**契约(刻意不 try、抛出让 `setTerminal` reject),**不计本 tag** —— 读遥测别把两席混成一件。方向承重:这条腿的全部价值是「把候补窗行的成对终帧从『下一个对账周期(≤60s)』提前到『durable 写落地的同一 tick』」,它是一格**投影提速**;把它的 bug 外溢成终局写 reject 会让 run 卡 running 到 reaper、claim 悬挂([868] 指纹),代价高出几个量级。放行的最坏后果 = 这条行的成对终帧退回到周期臂补发,**与本件存在之前的行为逐字等同**,不是新损失;故 F 类。必须留痕:静默吞掉之后「事件腿为什么一直没生效」在遥测里没有任何痕迹,而面板上看到的只是『偶尔慢一分钟』这种没人会立案的症状。",
+    },
     "server.fleet.run-status-unmapped": {
         cls: "F",
         note: "A-032 P1-④:`runStatusToFleet` 收到**词表外**的 run 状态词(闭集签名之外的唯一来路 = `rowToRun` 把无约束的 status 文本列裸 cast,滚动升级里更新的副本写的新词被旧副本读到)⇒ 折成 `idle`。放行的最坏后果 = 该行在 fleet 面板上**永久滞留**(removal 集 {completed,failed,killed} 收不到 idle),纯展示面、不影响 run 本身与任何执法判据,故 F 类。方向刻意不改(把 miss 折成终局会把一条还在跑的任务从面板上摘掉,误摘比多一行更伤)。留痕是承重的:2026-06-28 on-box e2e 逮到的 `blocked` 泄漏当年只能靠人眼在面板上发现——计数让下一次词表漂移在遥测里当场显形。编译期一侧已由闭集入参 + `never` 臂执法。",
@@ -180,6 +184,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-02 codex R1-[medium](验真后修):decide 的 409 `approval_stale` 臂对**调用方回显的旧 token** 做归属判定(`cs.get(binding.checkpointToken)`),那次读**抛了**(store 抖动 / 版本守卫 / 行恰被清理)。修前这里是静默 `catch(()=>null)`,「读不出」被折成「确认不在库」——叠上 S-02 的 404 收口后,一次 store 抖动就会把合法旧 token 的 409+terminal 谎报成 404「没有这条审批」。修后:unreadable ⇒ **保持 409**(`terminal` 不披露——证不出归属就不说,与 2026-07-26 纪律同向;404 折叠只在读成功且未命中时走,探测方无法自控 store 故障 ⇒ 谕示封闭不破)。放行的最坏后果 = 该次拒体 `terminal` 诚实缺席(`currentPending` 由它自己的读口与属主复核另判,不受本臂牵连),壳退回重拉列表,judgment 面 fail-safe,故 F 类。留痕理由:这次读是 terminal 披露与 404 折叠两个判定的输入,长期抖动必须在遥测显形。",
     },
+    "server.resume.reopen-confirm-unreadable": {
+        cls: "F",
+        note: "S-447(#60 M2 自查项,`http/resume-legs.ts` 的 `confirmCheckpointReopened`):续跑腿在 core 给出 reopen 族失败后按 **token** 复核「这张 checkpoint 是不是又 pending 了」,这一读抛(库拖/版本太新/店不可达)。**方向本来就是 fail-closed**:读不出 ⇒ `return true` ⇒ 「不写任何终局、重新 park」(`:1206-1212` 头注已把取舍与有界代价写死:错 park 由 `reapSuspended` 兑,错终局会孤儿化一张活 park 到 TTL)—— 所以这条腿不是 P 类,缺的只是**留痕**。放行的最坏后果 = 多一次多余的 re-park(一张已经被决掉的卡重新挂到 reaper 窗里),人面上是「这条续跑没动」而不是谁被放行了。必须登记的理由是 **uniformity**:同文件三只同形读(`:249` `server.approvals.stale-echoed-token-unreadable` · `:288` `server.approvals.stale-current-pending-unreadable` · 本腿)中只有它是黑的,于是「店一直读不出所以每条续跑都在白白 re-park」与「一切正常」在遥测上同形。计数非零 = 这台机器的 checkpoint 店在拖,运维要去看库。",
+    },
     "server.approvals.stale-current-pending-unreadable": {
         cls: "F",
         note: "S-02 件2([5522]④→[5525]):409 `approval_stale` 拒体铸 additive 指路键 `currentPending`(本会话当前 pending 的 D-1 坐标,壳一跳重定位)时,当前 pending 行的 `cs.get(token)` 读**抛了**(store 抖动 / 滚动升级期 checkpoint 格式 version guard / 行恰被并发消费)⇒ 本次拒体**缺 `currentPending` 键**,409 本体与 `terminal` 判定照旧。放行的最坏后果 = 壳退回该键到货前的行为(重拉 GET /v1/approvals 自行重定位),纯指路/便利面,不参与任何门/CAS/resume 判定,故 F 类(同族先例:`server.park.toolcallid-read-failed`,同为 cs.get 投影读失败臂)。必须留痕:键缺席与「此刻确实没有 pending」在 wire 上同形,不计数则「指路为什么总缺」在遥测里永不显形。",

package/dist/observability/metrics.d.ts

@@ -28,6 +28,9 @@ export declare class Metrics {
      *  needed). Counters are cumulative totals; histograms are reported as averages (sum/count). */
     summarize(): MetricsSummary;
 }
+/** S-451:`/metrics/summary` 上「失败最多的路由」保留几条。看板要的是**头部**,不是全表;
+ *  `routeLabel` 的值域本来就有界(路由声明表 + `"other"`),这个上限只是让这张脸的大小与路由表长解耦。 */
+export declare const HTTP_ERROR_ROUTE_TOP_N = 10;
 export interface MetricsSummary {
     runsActive: number;
     tasks: Record<string, number>;
@@ -61,6 +64,15 @@ export interface MetricsSummary {
     verifications: Record<string, number>;
     councilRuns: Record<string, number>;
     toolErrors: Record<string, number>;
+    /** S-451(additive,7.87.0):窗内 HTTP **失败**请求数,按状态码**类**聚合 —— 键只有 `"4xx"` / `"5xx"`
+     *  两种,2xx/3xx 一格不进。⚠️ `"4xx"` 里**含 `499`**(本仓给「客户端在响应结束前断连」铸的标签,
+     *  SSE 长连接上是常态)—— 看一场真风暴时按 {@link httpErrorsByRoute} 分辨是哪条腿。
+     *  空对象 = 窗内零失败(与 `tasks`/`toolErrors` 同律:键恒在场,不用缺席表示零)。 */
+    httpErrorsByClass: Record<string, number>;
+    /** S-451(additive,7.87.0):失败(4xx+5xx 合计)最多的前 {@link HTTP_ERROR_ROUTE_TOP_N} 条 **route 标签**
+     *  (`routeLabel` 的低基数形,id 已折成 `:id`;未命中路由表的落 `"other"`)。按计数降序。
+     *  这是「180 次 404 到底打在哪」的那一格。 */
+    httpErrorsByRoute: Record<string, number>;
 }
 export interface MetricSnapshot {
     counters: Array<{

package/dist/observability/metrics.js

@@ -188,9 +188,25 @@ export class Metrics {
             toolErrors: Object.fromEntries([...(this.counters.get("tool_calls_total")?.series.values() ?? [])]
                 .filter((s) => s.labels.ok === "false")
                 .map((s) => [s.labels.name ?? "?", s.value])),
+            ...(() => {
+                const failures = [...(this.counters.get("http_requests_total")?.series.values() ?? [])]
+                    .map((s) => ({ cls: /^([45])\d\d$/.exec(s.labels.status ?? "")?.[1], route: s.labels.route ?? "?", value: s.value }))
+                    .filter((x) => x.cls !== undefined);
+                const byClass = {};
+                const byRoute = {};
+                for (const f of failures) {
+                    byClass[`${f.cls}xx`] = (byClass[`${f.cls}xx`] ?? 0) + f.value;
+                    byRoute[f.route] = (byRoute[f.route] ?? 0) + f.value;
+                }
+                return {
+                    httpErrorsByClass: byClass,
+                    httpErrorsByRoute: Object.fromEntries(Object.entries(byRoute).sort((a, b) => b[1] - a[1]).slice(0, HTTP_ERROR_ROUTE_TOP_N)),
+                };
+            })(),
         };
     }
 }
+export const HTTP_ERROR_ROUTE_TOP_N = 10;
 export function createMetrics() {
     const m = new Metrics();
     m.counter("metric_gauge_eval_errors_total", "Dynamic gauge eval errors by gauge name (an erroring gauge emits NO sample that scrape — absence means unknown, not 0)");
@@ -270,6 +286,7 @@ export function createMetrics() {
     m.counter("compaction_events_total", "Compaction lifecycle events by outcome (started/completed/failed/skipped) and trigger");
     m.counter("hook_llm_calls_total", "prompt/agent hook entries that completed a model call (hooks 3b), by type");
     m.counter("auth_bridge_verify_total", "Registry SSO JWT verifications (auth-bridge), by outcome");
+    m.counter("fleet_rows_reconciled_total", "Fleet rows the #261 liveness-reconcile leg acted on, by `disposition`: 'retired' = durable was terminal, the leg projected the settled pair (terminal task frame → task_remove); 'retired_deferred' = a row that had already left declaratively (removeReason:\"orphaned\") got its settled pair BACKFILLED once durable turned terminal; 'orphaned' / 'orphaned_child' = declarative exit, NO terminal was minted (the reaper owns the death ruling); 'workflow_retired' = same projection for a workflow row. `trigger` rides ONLY the retired_deferred series (S-450): 'event' = the backfill fired on the same tick a terminal write landed through the run-store write口 (single replica), 'cycle' = it fired on the 60s reconcile cycle (cross-replica writes, and terminals flipped by the BATCH reapers, which never pass through the write口). A retired_deferred series that is 100% trigger=cycle means the event leg is not wired or this deployment\'s terminals all come from those two families");
     m.counter("fleet_lease_issued_total", "Fleet trace-lease tokens issued");
     m.counter("fleet_lease_rejected_total", "Fleet trace-lease requests rejected");
     m.counter("fleet_lease_exhausted_total", "Fleet trace-lease requests rejected because the pool was exhausted");

package/dist/observability/{run-terminal-log.d.ts → run-terminal.d.ts}

@@ -3,8 +3,14 @@ import { type RunRecord } from "../plugins/store-contracts.js";
 export interface RunTerminalRecord {
     /** 这条 run 的账本 id = `GET /v1/runs/:id` 的 id(本仓 run 行主键名为 taskId,同一个值)。 */
     runId: string;
-    sessionId: string;
-    owner: string | null;
+    /**
+     * 🔴 **只在「这条终局要出声」时在场**(S-450):三只 store 只在 `runTerminalLogLevel(...) !== undefined`
+     * 时才多付那一次 PK 读去装它(成功终局零额外查询 —— 那条注在 `run-store-sql.ts` 的 `setTerminal` 里)。
+     * 日志腿恰好只在同一形下运行,所以**它读到的恒是在场的**;行为订阅者不得依赖它。
+     */
+    sessionId?: string;
+    /** 同 {@link RunTerminalRecord.sessionId}:只在要出声的那一形在场。`null` = 行上没有 owner。 */
+    owner?: string | null;
     status: RunRecord["status"];
     /** 终局结果里的引擎侧 taskId —— 只在与 {@link RunTerminalRecord.runId} **不同**时进日志(sync 腿上 core 会把它
      *  铸成 sessionId,两者同值时重复一遍只是噪音)。 */
@@ -15,8 +21,16 @@ export interface RunTerminalRecord {
     /** 行创建到终局的墙钟毫秒(store 侧用行的 createdAt 算;算不出=不传,键缺席)。 */
     elapsedMs?: number | undefined;
 }
-/** 观测者收到的是**已判级 + 已脱敏 + 已截断**的成品——装配层只负责把它送进 logger。 */
-export type RunTerminalObserver = (level: "error" | "info", fields: Record<string, unknown>) => void;
+/** **日志腿**收到的是**已判级 + 已脱敏 + 已截断**的成品——装配层只负责把它送进 logger。 */
+export type RunTerminalLogObserver = (level: "error" | "info", fields: Record<string, unknown>) => void;
+/**
+ * **行为订阅者**(S-450):CAS 赢的那一刻收到整只 {@link RunTerminalRecord}。
+ *
+ * 🔴 载荷是**这次写自己的视角**,不是回读的 durable 行 —— 只有 `runId` / `status` 两位在**任何**形下
+ * 都为真(CAS 赢 ⇒ 行就是这个词)。日志腿专用的那几位在成功终局上**刻意缺席**(store 不为它们多付一次
+ * PK 往返,见 {@link RunTerminalRecord.sessionId})。要更多事实的订阅者请自己按 `runId` 读 durable。
+ */
+export type RunTerminalSubscriber = (rec: RunTerminalRecord) => void;
 /**
  * 终局行的级别判据。`undefined` = 不打行。
  *
@@ -25,13 +39,39 @@ export type RunTerminalObserver = (level: "error" | "info", fields: Record<strin
  * 穷举 switch,并在 `blocked` 那一格给出与 fleet 读面互斥的答案)。表的编译期双向钉在属主处。
  */
 export declare function runTerminalLogLevel(status: RunRecord["status"], errorCode: string | undefined): "error" | "info" | undefined;
-/** 装配点(`main.ts` 唯一)。传 `undefined` 卸载(测试隔离)。 */
-export declare function setRunTerminalObserver(fn: RunTerminalObserver | undefined): void;
+/** **日志腿**的装配点(`boot/stage-01-config.ts` 唯一)。传 `undefined` 卸载(测试隔离)。 */
+export declare function setRunTerminalLogObserver(fn: RunTerminalLogObserver | undefined): void;
+/**
+ * **行为订阅者**的登记口(S-450)。返回解除登记的句柄。
+ *
+ * 与 {@link setRunTerminalLogObserver} 是**两个语义不同的席**,不是一个带旗的列表:
+ *  · 日志腿**恰一只**、装配层亲接、**不隔离**(抛出会让 `setTerminal` reject —— 见 {@link notifyRunTerminal});
+ *  · 行为订阅者**可多只**、运行期来去、**逐只隔离**(抛出吞掉 + `recordFailOpen`)。
+ * 两条失败契约相反,所以它们必须是两个名字;混进一个列表再加一个 `isolate` 位,就是把「这条腿出事
+ * 该不该把 run 拖下水」这个**语义**降级成一个**配置**。
+ */
+export declare function subscribeRunTerminal(fn: RunTerminalSubscriber): () => void;
+/** test-only:清空行为订阅者(用例之间不串台;日志腿用 `setRunTerminalLogObserver(undefined)`)。 */
+export declare function resetRunTerminalSubscribersForTest(): void;
 /**
- * store 的终局写口在 **CAS 赢了之后**调用它。未装配观测者 ⇒ 无操作(纯内存/无 boot 的单测车道)。
+ * 🔴 **run 行翻终局的唯一铸点** —— 三个 run store 的 `setTerminal` 在 **CAS 赢了之后**各调它一次
+ * (SQL 腿 `w.affected > 0`,file / memory 腿在同判据的 CAS 分支内)。「CAS 赢了才发」是**恰一次**的来源:
+ * 调用侧的兜底腿有意会对同一行重复写(cancel × leg-throw × reaper 三向),打空的那几次一个字都不发。
+ *
+ * 两条出口,**失败契约相反**,顺序承重:
+ *  ① **行为订阅者先**({@link subscribeRunTerminal},逐只 try)—— 它们要在日志腿万一违约抛出之前跑完;
+ *  ② **日志腿后**({@link setRunTerminalLogObserver},级别筛 + 脱敏 + 不 try)。
+ *
+ * 为什么日志腿**刻意不 try**(原文保留,[ref] 的成文理由):静默吞掉观测者异常 = 又造一条「走了兜底与
+ * 一切正常同形」的路,方向与本模块的存在理由相反;生产装配的那一只只调 `Logger`(`createLogger` 的 emit
+ * 内部已把 JSON.stringify 与 write 全部 try 住,结构上不抛)。
+ * 为什么行为订阅者**必须 try**(S-450 新加的那一半):它们是**行为腿**,不是一只结构上不抛的 logger;
+ * 而本函数跑在 `setTerminal` 的调用栈上、**CAS 已经赢了、行已经落盘**,此时把订阅者的 bug 放大成
+ * 「终局写 reject」= run 卡 `running` 到 reaper + claim 悬挂([ref] 指纹)。吞但**不静默**:
+ * `recordFailOpen("server.fleet.terminal-notify")`(F 类,普查登记在案)。
  *
- * 脱敏:`errorMessage` 过 `redactSecrets` 再截断到 {@link MESSAGE_CAP} —— provider 的错误体
- * 会原样回显请求片段(取证里的 403 体带订阅链接;别的 provider 会回显 Authorization 头前缀),
+ * 脱敏(只在日志腿那一格):`errorMessage` 过 `redactSecrets` 再截断到 {@link MESSAGE_CAP} —— provider 的
+ * 错误体会原样回显请求片段(取证里的 403 体带订阅链接;别的 provider 会回显 Authorization 头前缀),
  * 而引擎日志是运维面、常被整条采集走。`errorCode` / `model` 是闭集式短标量,verbatim。
  */
 export declare function notifyRunTerminal(rec: RunTerminalRecord): void;
@@ -164,4 +204,4 @@ export declare function memoRedactTerminalResult<T extends Parameters<typeof red
 export declare function diffScanShadowCountForTest(): number;
 export declare function resetDiffScanShadowCountForTest(): void;
 export declare function resetReadRedactionMemoForTest(): void;
-//# sourceMappingURL=run-terminal-log.d.ts.map
+//# sourceMappingURL=run-terminal.d.ts.map