@sema-agent/server 7.93.1 → 7.93.3

package/USAGE.md

@@ -375,12 +375,20 @@ MODEL_CASCADE_LADDER=deepseek-flash,deepseek-pro   # 目录里的模型名,cheap
   core 5.54.0 起拒启错误带**可分派 code**(`FileStoreLockError`,message 点名占用方 pid),运维按码
   三动作:`store.dir_in_use`=另一个活进程持有该目录 → 停掉它(或换数据根/迁 SQL 后端);
   `store.dir_claiming`=另一进程正在接管崩溃者留下的锁 → **瞬态,稍候重试**(接管方要么完成要么
-  自己也被收割);`store.lock_unreadable`=锁文件坏形(无 owner 可解析/嵌套接管残留)→ 人工处置,
-  message 会点名要删的文件,**不要盲删数据根下其它东西**。server 刻意不把这族错**吞掉**(fail-fast:
+  自己也被收割);`store.lock_unreadable`=锁**读不出可解析的 owner**
+  (真坏形:无 owner / 嵌套接管残留;**或者**本进程读不动它 —— core 把一切非 ENOENT 的读失败都折进这一码)
+  → 人工处置,message 会点名要删的东西(⚠️ 三条消息点名的**不是同一个**:`LOCK` / `LOCK.claim.*` / 本进程
+  自己那把删不掉的锁),且 core 的句子**带条件** ——「stale 才删」:读不动的那一形背后可能是个**活**写者
+  (权限/属主不对),盲删 = 拆掉围栏 ⇒ 两个写者共用一个数据根。**不要盲删数据根下其它东西**。
+  server 刻意不把这族错**吞掉**(fail-fast:
   两进程共用 file 数据目录是禁止形,静默容忍比拒启更坏)。
+  ⚠️ **拒启句本身就带这三条里对应的那一条出路**(不必再回来查这张表);拒启原因**不是**锁冲突时
+  (磁盘满 / 权限 / 只读挂载 …)拒启句**不加任何出路猜测** —— 此前它一律拼「另一个实例可能占着,停掉它」,
+  把运维送去找一个不存在的进程。HTTP 服务与 `run-local` 共用同一只派生,只有「换一个空目录」那半句按通道
+  措辞不同(`LOCAL_DATA_ROOT` / `--root`)。
   ⚠️ 自 7.93.1 起 `store.dir_in_use` **这一码**多一道有界等待(见下面 `STORE_LOCK_WAIT_MS` 那条):
-  拒启形与文案一格不变,只是拒之前会先在窗内反复重取;另两码(`dir_claiming` / `lock_unreadable`)
-  与非锁类失败**一秒都不等**,原样抛。
+  **等待腿本身**不改拒启形、也不改上面那句出路(它只在拒之前先在窗内反复重取,并在拒句里多写一句
+  `waited Nms`);另两码(`dir_claiming` / `lock_unreadable`)与非锁类失败**一秒都不等**,原样抛。
   `DB_BACKEND=memory` 并非全无盘:workflow 相关账本仍挂数据根下——多个 memory 形引擎**不要共用**
   数据根/HOME(1.309 起并发 boot 不再拒启,但账本内容级共享仍不受支持)。
 - **`STORE_LOCK_WAIT_MS`(缺省 `60000`,单位 ms)—— 撞上活持锁人时等一会儿再拒**:

package/dist/adoption/wire.d.ts

@@ -28,8 +28,8 @@ export declare const AdoptionSourceSchema: z.ZodObject<{
 export type AdoptionSource = z.infer<typeof AdoptionSourceSchema>;
 /** per-store 腿的动作词(183 §6 闭集;form b 只会产出前两个 + `none`)。 */
 export declare const AdoptionLegActionSchema: z.ZodEnum<{
-    reset: "reset";
     none: "none";
+    reset: "reset";
     "bucket-rebind": "bucket-rebind";
     "row-rewrite": "row-rewrite";
     carried: "carried";
@@ -38,8 +38,8 @@ export type AdoptionLegAction = z.infer<typeof AdoptionLegActionSchema>;
 export declare const AdoptionLegSchema: z.ZodObject<{
     store: z.ZodString;
     action: z.ZodEnum<{
-        reset: "reset";
         none: "none";
+        reset: "reset";
         "bucket-rebind": "bucket-rebind";
         "row-rewrite": "row-rewrite";
         carried: "carried";
@@ -109,8 +109,8 @@ export declare const AdoptionReportSchema: z.ZodObject<{
     legs: z.ZodArray<z.ZodObject<{
         store: z.ZodString;
         action: z.ZodEnum<{
-            reset: "reset";
             none: "none";
+            reset: "reset";
             "bucket-rebind": "bucket-rebind";
             "row-rewrite": "row-rewrite";
             carried: "carried";
@@ -170,8 +170,8 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
         legs: z.ZodArray<z.ZodObject<{
             store: z.ZodString;
             action: z.ZodEnum<{
-                reset: "reset";
                 none: "none";
+                reset: "reset";
                 "bucket-rebind": "bucket-rebind";
                 "row-rewrite": "row-rewrite";
                 carried: "carried";
@@ -214,8 +214,8 @@ export type AdoptionReceipt = z.infer<typeof AdoptionReceiptSchema>;
 export declare const AdoptionLegsSchema: z.ZodArray<z.ZodObject<{
     store: z.ZodString;
     action: z.ZodEnum<{
-        reset: "reset";
         none: "none";
+        reset: "reset";
         "bucket-rebind": "bucket-rebind";
         "row-rewrite": "row-rewrite";
         carried: "carried";

package/dist/approval-ask-audit-store.js

@@ -7,6 +7,11 @@ export const CRASH_CONVERGED_LIST_MAX = 200;
 export function buildCheckpointAnchorHash(token) {
     return createHash("sha256").update(token, "utf8").digest("hex").slice(0, 16);
 }
+const HOST_DECIDED_BY_WORDS = ["person", "sla_timeout", "policy"];
+const HOST_DECIDED_BY = new Set(HOST_DECIDED_BY_WORDS);
+function isHostDecidedBy(v) {
+    return typeof v === "string" && HOST_DECIDED_BY.has(v);
+}
 function readLedgerRecord(u) {
     if (u === null || typeof u !== "object" || Array.isArray(u))
         return undefined;
@@ -87,7 +92,7 @@ function readLedgerRecord(u) {
             const decidedByV = o.decidedBy;
             const legacySettledByV = decidedByV === undefined ? o.settledBy : undefined;
             const legacySettledBy = legacySettledByV === "human" || legacySettledByV === "timeout" || legacySettledByV === "aborted" ? legacySettledByV : undefined;
-            const decidedBy = decidedByV === "person" || decidedByV === "sla_timeout" ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
+            const decidedBy = isHostDecidedBy(decidedByV) ? decidedByV : legacySettledBy !== undefined ? "person" : undefined;
             const approver = s("approver");
             const settledAtMs = num("settledAtMs");
             const sessionId = s("sessionId");

package/dist/bench/s1/live-deps.js

@@ -342,6 +342,8 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
         "--enable=receive-pack",
         remoteDir,
     ], { stdio: "ignore" });
+    let daemonSpawnError;
+    daemon.on("error", (e) => { daemonSpawnError = e.message; });
     const waitForPort = async () => {
         for (let i = 0; i < 30; i++) {
             const up = await new Promise((resolve) => {
@@ -387,6 +389,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     let res;
     try {
         if (!(await waitForPort())) {
+            console.error(`[s1] git daemon did not come up on 127.0.0.1:${port}${daemonSpawnError ? ` — spawn failed: ${daemonSpawnError}` : ""}`);
             return { ok: false, reports: [], infraFailed: true };
         }
         const seedDir = mkdtempSync(join(tmpdir(), "s1-team-seed-"));

package/dist/boot/fatal-exit.d.ts

@@ -1,3 +1,24 @@
 /** `err` 的 fatal 日志文本:`String(err)` 过形状律一次。纯函数,零副作用。 */
 export declare function buildFatalErrorText(err: unknown): string;
+/**
+ * 进程级 fatal 出口的**唯一一只腿**:同一只 {@link buildFatalErrorText} 产物写两个面,然后按崩溃码退。
+ *
+ * ── 病(S-555,test [ref] P2)────────────────────────────────────────────────────────────────────
+ * 出口过去只有那条 JSON 行。而拒启文案是**多行**的 —— S-547 的列集对账会生成
+ * `ALTER TABLE <表> ADD COLUMN <列定义>;`,它存在的全部理由就是「运维直接粘进 psql」;塞进 JSON 字符串后
+ * 整段变成一串 `\n` 转义,**粘不走**。dist 里也没有 pretty / `isTTY` 分支去把它摊开(有也不该有:出口的
+ * 可读性不该取决于终端是谁)。
+ *
+ * ── 修 ─────────────────────────────────────────────────────────────────────────────────────────
+ * **同一只产物**再原样多行写一份到 stderr。刻意不做的三件:不铸第二份文案(两份措辞必然分叉)、不加
+ * pretty 旋钮(一个只有出错时才走的出口不该有配置面)、JSON 行**照旧**(机读面零回退,scraper 不动)。
+ * 两个面都在 stderr,次序=先机器行后人读段。**这个次序还承重**:`createLogger()` 的构造会装上 stdio 的
+ * EPIPE 无害化监听(见 `observability/logger.ts` 那段注 —— 宿主把 stderr 接管道又先退时,下一次写会发一个
+ * 异步 `'error'`,无监听即致命),所以那条裸 `process.stderr.write` **必须**排在它之后;同步抛由下面的
+ * `try/finally` 兜住。
+ *
+ * 全仓两个 fatal 出口(`main.ts` 的 `main().catch` 与 `run-local.ts` 的同名尾巴)都经这里 —— 后者此前
+ * 连形状律都没过(裸 `String(err)`),两处各写一遍正是「同类不同命」的土壤。
+ */
+export declare function fatalExit(err: unknown): never;
 //# sourceMappingURL=fatal-exit.d.ts.map

package/dist/boot/fatal-exit.js

@@ -1,5 +1,16 @@
 import { redactSecrets } from "../trace/redact.js";
+import { createLogger } from "../observability/logger.js";
 export function buildFatalErrorText(err) {
     return redactSecrets(String(err));
 }
+export function fatalExit(err) {
+    const text = buildFatalErrorText(err);
+    try {
+        createLogger().error("fatal", { err: text });
+        process.stderr.write(text + "\n");
+    }
+    finally {
+        process.exit(1);
+    }
+}
 //# sourceMappingURL=fatal-exit.js.map

package/dist/boot/shutdown.d.ts

@@ -12,7 +12,8 @@
  *     "第二个信号"的语义读数。
  *  3. `clearInterval(reaper)` 必须是 hardShutdown 的第一件事(在 `server.close()` 之前),否则
  *     收尾期还会有 reaper tick 打向正在关闭的池。
- *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的五只(三信号 + [ref]① 双钩)只能经返回的
+ *  4. **进程级监听一律成对**([ref] 二轮件4):本函数装的六只(三信号 + [ref]① 双钩 + S-557 退出边界钩)
+ *     只能经返回的
  *     {@link ShutdownHandle} 摘 —— 调用方手写「摘三信号」的收尾会把双钩漏在进程上,而陈旧的那只
  *     rejection 钩仍握着 `process.exit(1)`,会对后续无关的 rejection 把进程打掉。
  */

package/dist/boot/shutdown.js

@@ -2,6 +2,8 @@ import { Runner, defaultTaskRegistry } from "@sema-agent/core";
 import { writeCrashLast, clearCrashLast, readCrashLast } from "./crash-last.js";
 import { createSighupIdleHandler } from "../sighup-idle.js";
 import { createParentWatch } from "../parent-watch.js";
+import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
+import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
 import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
@@ -30,6 +32,63 @@ export function installShutdownHandlers(ctx) {
         if (dataRoot)
             writeCrashLast(dataRoot, { version, inflight: drainState.inflight?.(), err });
     };
+    const reapOwnChildProcesses = () => {
+        try {
+            const reaped = defaultTaskRegistry.reapAllSessionBackground();
+            if (reaped > 0)
+                logger.info("shutdown_background_reaped", { reaped });
+        }
+        catch (err) {
+            logger.warn("shutdown_background_reap_failed", { err: String(err) });
+        }
+        try {
+            const fg = reapHostForegroundChildren();
+            if (fg.signalled > 0 || fg.alreadyDead > 0)
+                logger.info("shutdown_foreground_reaped", { signalled: fg.signalled, alreadyDead: fg.alreadyDead });
+            if (fg.failed.length > 0)
+                logger.warn("shutdown_foreground_reap_incomplete", { groups: fg.failed });
+        }
+        catch (err) {
+            logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
+        }
+    };
+    const reapOwnHostWorkspaces = () => {
+        try {
+            const { removed, failed } = reapEphemeralHostWorkspaces();
+            if (removed.length > 0)
+                logger.info("shutdown_host_workspaces_reaped", { removed: removed.length });
+            if (failed.length > 0)
+                logger.warn("shutdown_host_workspace_reap_incomplete", { dirs: failed.map((f) => f.dir) });
+        }
+        catch (err) {
+            logger.warn("shutdown_host_workspace_reap_failed", { err: String(err) });
+        }
+    };
+    const onProcessExit = () => {
+        const onBooks = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
+        try {
+            reapOwnChildProcesses();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_child_reap_threw", err);
+        }
+        try {
+            reapOwnHostWorkspaces();
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_workspace_reap_threw", err);
+        }
+        const left = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
+        try {
+            logger.info("shutdown_exit_boundary", { ...onBooks, leftForegroundChildren: left.foregroundChildren, leftHostWorkspaces: left.hostWorkspaces });
+            if (left.foregroundChildren > 0 || left.hostWorkspaces > 0)
+                logger.warn("shutdown_exit_boundary_incomplete", left);
+        }
+        catch (err) {
+            console.error("shutdown_exit_boundary_log_threw", err);
+        }
+    };
+    process.once("exit", onProcessExit);
     const onUncaughtException = (err) => {
         try {
             writeLastWords(err);
@@ -92,14 +151,7 @@ export function installShutdownHandlers(ctx) {
         subRunner.sessions.dispose();
         void lspManager?.dispose?.();
         void workflowNotifyJournal?.close?.();
-        try {
-            const reaped = defaultTaskRegistry.reapAllSessionBackground();
-            if (reaped > 0)
-                logger.info("shutdown_background_reaped", { reaped });
-        }
-        catch (err) {
-            logger.warn("shutdown_background_reap_failed", { err: String(err) });
-        }
+        reapOwnChildProcesses();
         void fleetClient?.stop();
         server.close(() => {
             void retentionTeardown.then(() => (backend ? backend.close() : Promise.resolve())).finally(() => process.exit(0));
@@ -196,6 +248,7 @@ export function installShutdownHandlers(ctx) {
             if (disposed)
                 return;
             disposed = true;
+            process.removeListener("exit", onProcessExit);
             process.removeListener("uncaughtException", onUncaughtException);
             process.removeListener("unhandledRejection", onUnhandledRejection);
             process.removeListener("SIGTERM", drainThenShutdown);

package/dist/host-decision.d.ts

@@ -20,20 +20,41 @@ import { type ResumeOutcome } from "@sema-agent/core";
  *  · `decidedBy: "person"` —— 运维经审批通道做的决定(两条 HTTP `/decide` 腿);
  *  · `decidedBy: "sla_timeout"` —— 宿主自己的 SLA 扫在行的 deadline 上判的(FACET A;**只有** sweep 能这么说,
  *    而 sweep 结构上不能 `allow`)。
+ *  · `decidedBy: "policy"`(core 7.26.2 / #1016)—— **这台部署自己的策略**拒的:答话的是机器不是人。调用方
+ *    经决裁体的 `settledBy` 自报;core 据它给模型铸一句**策略句**(而不是「用户不同意,停下来等他」),
+ *    并把结算记成 `policy_refused`(`who.party:"none"`)。`allow` 侧结构上不可(core pre-CAS 拒:只有人批准)。
  *  · `approver` —— 通道自报的结算方标识串。**缺席永不读成**「没人批」或「有人批」,只意味着通道没报名字。
  */
-/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那两个词(第二铸点)。 */
+/** 直接取 core `ResumeOutcome` policy_ask 臂的 `hostDecision` 型 —— 本仓不复述那几个词(第二铸点)。 */
 export type HostDecision = Extract<ResumeOutcome, {
     gate: "policy_ask";
 }>["hostDecision"];
+/** **谁结束了这次等待**的闭集,型从 core 的那一格派生(本仓永不抄词表:core 加/退一个词,读它的每一处
+ *  编译期先红)。今天 = `"person"` | `"sla_timeout"` | `"policy"`。 */
+export type HostDecidedBy = HostDecision["decidedBy"];
 /**
- * 一次**人为** decide 的事实。`principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实
- * 没有名字可报)。
+ * 一次 decide 的事实,**一处成形**(两条 HTTP decide 腿 + 活卡 PARKED 赎回席共用)。
  *
- * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒
- * (`checkpoint.invalid_outcome`),而一个奇形怪状的 principal 把一次合法的人工决策变成 400 是纯回归。
- * 筛不过 ⇒ **不带这一格**(而不是带一个被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的
- * 名字既不是通道报的那个,也不是「通道没报」,两头都不真。
+ * `decidedBy` = 调用方**陈述**的决策者(缺席 ⇒ `"person"`,= 本面自古以来的形:一条不说话的 decide 就是
+ * 一个人按的)。🔴 **本仓零判据**:词表的属主是 core,不认识的词由它 pre-CAS 响亮拒
+ * (`checkpoint.invalid_outcome`,`hostDecision.decidedBy … is outside the closed set`)。在这里再判一次
+ * 就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第四个词就会被
+ * 静默 400 掉 —— 那正是 #1016 的 `"policy"` 加进来时本可以发生的事。
+ *
+ * `principal` = 那条腿已经验过身份的决策者(缺席 = 匿名档的部署,通道确实没有名字可报)。
+ * 归属串走 core 的 `screenApproverAttribution` **先筛后带**:core 对形不合的归属是 pre-CAS 响亮拒,
+ * 而一个奇形怪状的 principal 把一次合法的决策变成 400 是纯回归。筛不过 ⇒ **不带这一格**(而不是带一个
+ * 被改造过的串):归属是转录,不是可以「修一修」的东西 —— 修出来的名字既不是通道报的那个,也不是
+ * 「通道没报」,两头都不真。
+ *
+ * 🔴 归属**不按词分岔**:core 的 `policy_refused` 结算记录上确实没有归属席(`who.party:"none"`),但那是
+ * **core 的记录**怎么写,不是**本服务观察到的事实**是什么 —— 送出这次请求的那把已验证身份是真的,本仓的
+ * 迟到结算账本(`approval-ask-audit-store.ts`)记的就是它。按词删一格 = 给账本挖一个只在某个词上出现的洞。
+ *
+ * 🔴 **入参是 `string`,不是 `HostDecidedBy` —— 这一格刻意让类型说真话**(wire 边界强类型宪法):两条
+ * decide 腿能证得出的只有「调用方给了个串」(形门在各自的口上),**证不出**它是词表成员;把参数声明成
+ * 闭集就是让类型替一件本层从没做过的检查背书。⇒ 收 `string`,在**这一处**(本座的边界)做唯一一次 cast,
+ * 而那次 cast 说的是「我把一个未判词的串放到只收词的座上,判词的是座的属主(core,pre-CAS 响亮拒)」。
  */
-export declare function personDecision(principal: string | undefined): HostDecision;
+export declare function hostDecisionFacts(decidedBy: string | undefined, principal: string | undefined): HostDecision;
 //# sourceMappingURL=host-decision.d.ts.map

package/dist/host-decision.js

@@ -1,6 +1,6 @@
 import { screenApproverAttribution } from "@sema-agent/core";
-export function personDecision(principal) {
+export function hostDecisionFacts(decidedBy, principal) {
     const screened = screenApproverAttribution(principal);
-    return { decidedBy: "person", ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
+    return { decidedBy: (decidedBy ?? "person"), ...(screened.approver !== undefined ? { approver: screened.approver } : {}) };
 }
 //# sourceMappingURL=host-decision.js.map

package/dist/http/approval-sweeps.js

@@ -1,7 +1,7 @@
 import { redactHead } from "../observability/run-terminal.js";
 import { findParkOrigin } from "../parked-decide.js";
 import { decodeCheckpointScope } from "../security.js";
-import { personDecision } from "../host-decision.js";
+import { hostDecisionFacts } from "../host-decision.js";
 import { APPROVAL_GATE_KINDS } from "../tool-approval.js";
 import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import { hasServiceAuth } from "./dispatch.js";
@@ -130,7 +130,7 @@ export function createApprovalSweeps(ctx) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, personDecision(req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.settledBy, req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     return { denyExpiredApprovals, redeemParkedAsk };

package/dist/http/resume-legs.js

@@ -62,6 +62,7 @@ const WORKER_SWAP_REDEEMABLE = {
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
 }
+const NON_BINDING_INVALID_OUTCOME_FIELDS = new Set(["hostDecision", "approver"]);
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
@@ -908,7 +909,9 @@ export function createResumeLegs(ctx) {
                         ...(taskId !== undefined ? { taskId } : {}),
                         error: e.message,
                         errorCode: e.code === "checkpoint.invalid_outcome"
-                            ? (outcome.gate === "policy_ask" ? "approval_binding_mismatch" : "resume_outcome_invalid")
+                            ? (outcome.gate === "policy_ask" && !NON_BINDING_INVALID_OUTCOME_FIELDS.has(String(e.detail?.field ?? ""))
+                                ? "approval_binding_mismatch"
+                                : "resume_outcome_invalid")
                             : e.code,
                         ...(e.detail?.field ? { field: e.detail.field } : {}),
                         ...((e.code === "resume.usage_window_exhausted" || e.code === "resume.preflight_rejected") && typeof e.detail?.retryAfterMs === "number" && Number.isFinite(e.detail.retryAfterMs) && e.detail.retryAfterMs > 0

package/dist/http/routes/approvals-assistant.js

@@ -1,8 +1,8 @@
 import { screenedGate } from "../../trace/project.js";
-import { personDecision } from "../../host-decision.js";
+import { hostDecisionFacts } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
-import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
+import { APPROVAL_GATE_KINDS, SETTLED_BY_DENY_ONLY, SETTLED_BY_MUST_BE_STRING } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { editedPlanBinding, isWellFormedUnicode, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -21,10 +21,10 @@ import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
-    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "updatedInput",
+    "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "settledBy", "updatedInput",
 ];
 const DECIDE_PROOF_COVERED_KEYS = ["answer", "boundCallId", "boundInputHash", "decision", "reason"];
-const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "updatedInput"];
+const DECIDE_NOT_IN_PROOF_KEYS = ["checkpointToken", "remember", "settledBy", "updatedInput"];
 const ACCEPTED_DECIDE_BODY = new Set(DECIDE_BODY_DECLARED_KEYS);
 const UNSUPPORTED_DECIDE_BODY = new Set(["editedPlan", "sessionId", "taskId"]);
 export function decideBodyKeyIssue(raw) {
@@ -71,7 +71,8 @@ function buildApprovalEnvelope(sessionId, covered, reading) {
 }
 const ACCEPTED_PLAN_REVIEW_BODY = new Set(PLAN_REVIEW_BODY_DECLARED_KEYS);
 const UNSUPPORTED_PLAN_REVIEW_BODY = new Set([
-    "answer", "boundInputHash", "checkpointToken", "permissionMode", "remember", "sessionId", "taskId", "updatedInput",
+    ...DECIDE_BODY_DECLARED_KEYS.filter((k) => !PLAN_REVIEW_BODY_DECLARED_KEYS.includes(k)),
+    "permissionMode", "sessionId", "taskId",
 ]);
 export function planReviewBodyKeyIssue(raw) {
     if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
@@ -553,7 +554,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "deny" ? "deny" : undefined;
             if (!decision) {
-                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember? }");
+                sendError(res, 400, "request.body_shape", "body must be { decision: 'approve' | 'deny', reason?, answer?, checkpointToken?, boundCallId?, boundInputHash?, updatedInput?, remember?, settledBy? }");
                 return;
             }
             {
@@ -624,6 +625,18 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendError(res, 400, "checkpoint_token_not_in_proof", "checkpointToken is not supported on a direct-door worker (not covered by the decision proof); bind the decision with boundCallId and boundInputHash instead");
                 return;
             }
+            if (deps.config.directDoorActive && body.settledBy !== undefined) {
+                sendError(res, 400, "settled_by_not_in_proof", "settledBy is not supported on a direct-door worker (not covered by the decision proof)");
+                return;
+            }
+            if (body.settledBy !== undefined && decision !== "deny") {
+                sendError(res, 400, "request.field_conflict", SETTLED_BY_DENY_ONLY);
+                return;
+            }
+            if (body.settledBy !== undefined && typeof body.settledBy !== "string") {
+                sendError(res, 400, "request.field_invalid", SETTLED_BY_MUST_BE_STRING);
+                return;
+            }
             const binding = {
                 checkpointToken: body.checkpointToken,
                 boundCallId: body.boundCallId,
@@ -672,7 +685,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, personDecision(deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(body.settledBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {

package/dist/http/routes/memory-origin.d.ts

@@ -97,7 +97,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
         detail?: string | undefined;
         eventId: string;
         at: number;
-        to: "failed" | "done";
+        to: "done" | "failed";
         requestId: string;
     }[];
     custodyBytes: number;
@@ -105,7 +105,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     requestId: string;
     reason: string;
     at: number;
-    status: "pending" | "failed" | "done";
+    status: "done" | "failed" | "pending";
     originUnknownKeys?: string[] | undefined;
     clearanceId: string;
     entryId: string;

package/dist/main.js

@@ -1,5 +1,4 @@
-import { createLogger } from "./observability/logger.js";
-import { buildFatalErrorText } from "./boot/fatal-exit.js";
+import { fatalExit } from "./boot/fatal-exit.js";
 import { runStage01 } from "./boot/stage-01-config.js";
 import { runStage02 } from "./boot/stage-02-registry-pull.js";
 import { runStage03 } from "./boot/stage-03-store-backend.js";
@@ -23,7 +22,6 @@ async function main() {
     await runStage10(s09);
 }
 void main().catch((err) => {
-    createLogger().error("fatal", { err: buildFatalErrorText(err) });
-    process.exit(1);
+    fatalExit(err);
 });
 //# sourceMappingURL=main.js.map

package/dist/plugins/host-platform.d.ts

@@ -48,6 +48,60 @@ export declare function killTreeSoft(pid: number): void;
 /** Graceful tree kill where the CALLER has no escalation timer of its own (currently unused by the host lane —
  *  exported for parity with core's surface; the bg driver keeps its own HOST_BG_KILL_GRACE_MS ladder). */
 export { killProcessTree };
+/** 登记回执 = 注销的唯一凭据(纯数据;身份即凭据,见簿注)。 */
+export interface ForegroundChildTicket {
+    /** 组领袖 pid = pgid(POSIX `detached:true` 的直接后果)。 */
+    readonly pid: number;
+}
+/** 登记一只自起的前台子进程,返回注销用的回执。 */
+export declare function trackHostForegroundChild(pid: number): ForegroundChildTicket;
+/** 注销(`exit` / settle / 领养移交)。按回执身份删 ⇒ 幂等,且**绝不**碰同号的其它登记。 */
+export declare function untrackHostForegroundChild(ticket: ForegroundChildTicket): void;
+/** 一次前台收割的读数。三格分开是**刻意**的:`alreadyDead` 是想要的结果(不是失败),`failed` 是**真的**
+ *  没收上来 —— 两者混成一个数就等于把后者静默掉([ref]:这条腿上不许有安静的兜底)。
+ *
+ *  🔴 **三格只描述调用的那一拍**(S-557):`failed: []` 读作「这一拍发出去的信号没有被拒」,**不是**
+ *  「机器上一个都没落下」—— 簿在这一拍之后照样可以再登记(受控退的窗里在飞 turn 还在 spawn)。
+ *  「一个都没落下」这句话的承重点是退出边界那只钩,不是任何一次读数。 */
+export interface ForegroundReapReading {
+    /** 真发出了杀伤信号的组数。 */
+    readonly signalled: number;
+    /** `ESRCH` —— 组已经不在了。信号的语义就是「让它死」,它已经死了 ⇒ 记数,不报警。 */
+    readonly alreadyDead: number;
+    /** 其余拒因,逐条 `pid:code`。本模块没有 logger,所以**交回调用方响亮记下**(它有)。 */
+    readonly failed: readonly string[];
+}
+/**
+ * 收割簿上全部前台子进程组。返回**发出**信号的读数,不是确认死亡数 —— 确认要等,而本函数的调用点之一
+ * 是 uncaught 出口。
+ *
+ * **同步形、一次到位、不等宽限**(S-557 起自述与实现同一句):承重的调用点是收尾链的
+ * `process.once("exit")` 钩 —— `exit` 之后**没有续段**,`await` 一个宽限梯就是把收割赌在一个永远等不到的
+ * 时刻上(`hardShutdown` 终点那次早按只是优化,见 `boot/shutdown.ts` 的两处注)。上界 = 簿上条数 ×
+ * 一次 `kill(-pid)` syscall(簿条数被 host lane 的在飞 turn 数界住),没有定时器、没有 promise。
+ *
+ * 🔴 **「没有定时器」只对 POSIX 成立**(codex 对抗复审 [high],亲读 core dist 验真后如实标注,**不在本仓绕**):
+ * win32 的 `killTreeHard` 落到 core 的 `signalProcessTree`,而它在**装了 Git Bash** 的机器上先 spawn 一只
+ * MSYS 组杀脚本(detached ⇒ 本进程退了它照跑),随后把 `taskkill /F /T` 的**兜底**排在一只 1200ms
+ * `setTimeout` 上 —— 那只定时器在退出边界这一拍跑不到。射程:MSYS 组杀抓不到的**原生**后代可能幸存;
+ * 没装 Git Bash 的机器走的是同步 spawn 的 `taskkill /F /T`,不吃这条。**属主在上游**(本仓只是调用方),
+ * 正解 = core 给一条**无定时器的同步硬收**面(与后台腿那条已登记的上游诉求同一族),下游自铸第二把
+ * win32 杀伤 = 同一语义面两个写者,禁。修前对照:崩溃双钩那两次收割紧挨 `exit(1)`,同样跑不到那只
+ * 定时器 ⇒ 这是**既有**暴露面,不是退出边界新开的洞;而受控退的早收割仍有十秒量级的窗,定时器跑得完。
+ *
+ * 🔴 **为什么是 `killTreeHard` 而不是 SIGTERM**(codex 对抗复审 [high],亲跑复现后改):软鞍的语义是
+ * 「给它一个收尾窗,到点我再升级」,而这两个调用点之后**没有任何人在场**去升级 —— 一个
+ * `trap '' TERM` 的组收到 SIGTERM 后 `kill` 不抛(实测 `signalled:1, failed:[]`、随后仍然在跑),于是
+ * 「已收割」的读数是**假的**,孤儿照旧永久存活;win32 的软鞍对普通 console tree 更是明确杀不掉任何东西
+ * (见 {@link killTreeSoft} 注)。且本仓对**前台 exec** 的既有杀伤姿势(abort / timeout / 流被放弃)
+ * 一律就是 `killTreeHard` —— 收割用**同一只**,不新造一种只能兑现一半的姿势(规则集更小,不是更大)。
+ * 代价如实写:一条行为良好的命令在这里拿不到收尾窗;它换来的是「引擎死了,它起的命令一定也死」这句话
+ * 真的成立。后台腿的宽限梯不受影响(那条腿有自己的属主,且不在本簿里)。
+ */
+export declare function reapHostForegroundChildren(): ForegroundReapReading;
+/** 簿上现存条数。S-557 起**产品面也读它**(退出边界钩的「exit 时簿上还剩几条」哨兵),与第二本同形簿的
+ *  {@link liveEphemeralHostWorkspaceCount} 同名同形 —— 所以名字里不再带 `ForTest`(零别名,旧名直接消失)。 */
+export declare function liveHostForegroundChildCount(): number;
 /**
  * win32 env-key case collapse (design D1). Windows env keys are case-insensitive; Node hands the
  * object to CreateProcess as-is, so a case-sensitive merge that produced BOTH `Path` (inherited) and `PATH`

package/dist/plugins/host-platform.js

@@ -54,6 +54,38 @@ export function killTreeSoft(pid) {
     process.kill(-pid, "SIGTERM");
 }
 export { killProcessTree };
+const liveHostForegroundGroups = new Set();
+export function trackHostForegroundChild(pid) {
+    const ticket = { pid };
+    liveHostForegroundGroups.add(ticket);
+    return ticket;
+}
+export function untrackHostForegroundChild(ticket) {
+    liveHostForegroundGroups.delete(ticket);
+}
+export function reapHostForegroundChildren() {
+    let signalled = 0;
+    let alreadyDead = 0;
+    const failed = [];
+    for (const { pid } of liveHostForegroundGroups) {
+        try {
+            killTreeHard(pid);
+            signalled++;
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === "ESRCH")
+                alreadyDead++;
+            else
+                failed.push(`${pid}:${code ?? String(err)}`);
+        }
+    }
+    liveHostForegroundGroups.clear();
+    return { signalled, alreadyDead, failed };
+}
+export function liveHostForegroundChildCount() {
+    return liveHostForegroundGroups.size;
+}
 export function collapseWin32EnvKeys(env) {
     if (!IS_WIN32)
         return env;

package/dist/plugins/remote-env-host.js

@@ -7,7 +7,7 @@ import { openSync, closeSync, readSync, statSync, truncateSync, unlinkSync, mkdi
 import { StringDecoder } from "node:string_decoder";
 import { armPipeDestroyGrace, numEnvOr, SYMLINK_CHAIN_MAX_HOPS } from "./remote-shell.js";
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
-import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeSoft, collapseWin32EnvKeys } from "./host-platform.js";
+import { resolveHostShell, hostShell, spawnGroupOptions, killTreeHard, killTreeSoft, collapseWin32EnvKeys, trackHostForegroundChild, untrackHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
 import { FileError, ExecutionError, RemoteExecutionError, scrubSecretEnv, RollingTailBuffer, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
 import { recordSecretEnvScrub } from "../observability/secret-env-scrub.js";
@@ -241,9 +241,9 @@ export class RemoteHostExecutionEnv {
                         throw new BackgroundShellError("spawn_failed", e instanceof Error ? e.message : String(e), e);
                     }
                     const pid = child.pid;
+                    child.on("error", () => ctx.onTerminal(true));
                     if (pid != null) {
                         child.on("close", (code, signal) => ctx.onTerminal(false, code ?? (signal ? 128 + (signalNumber(signal) ?? 9) : 0)));
-                        child.on("error", () => ctx.onTerminal(true));
                         child.unref();
                     }
                     await outFh.close().catch(() => { });
@@ -403,10 +403,15 @@ export class RemoteHostExecutionEnv {
                 env: this.mergeEnv(options?.env),
                 ...spawnGroupOptions(),
             });
+            const ticket = child.pid != null ? trackHostForegroundChild(child.pid) : undefined;
+            if (ticket)
+                child.once("exit", () => untrackHostForegroundChild(ticket));
             const finish = (r) => {
                 if (settled)
                     return;
                 settled = true;
+                if (ticket)
+                    untrackHostForegroundChild(ticket);
                 clearTimeout(timer);
                 options?.abortSignal?.removeEventListener("abort", onAbort);
                 removeDetachListener?.();
@@ -455,6 +460,8 @@ export class RemoteHostExecutionEnv {
                 if (forceSettleTimer)
                     clearTimeout(forceSettleTimer);
                 options?.abortSignal?.removeEventListener("abort", onAbort);
+                if (ticket)
+                    untrackHostForegroundChild(ticket);
                 settled = true;
                 resolve(ok({ stdout: seedOut, stderr: seedErr, exitCode: 0, detached: { shellId } }));
             };
@@ -521,6 +528,7 @@ export class RemoteHostExecutionEnv {
             const errBuf = new RollingTailBuffer();
             let settled = false;
             let handedOver = false;
+            let ticket;
             let pump;
             let drainTimer;
             const cursor = { out: 0, err: 0 };
@@ -613,6 +621,8 @@ export class RemoteHostExecutionEnv {
                     clearInterval(pump);
                     pump = undefined;
                 }
+                if (ticket)
+                    untrackHostForegroundChild(ticket);
                 if (drainTimer) {
                     clearTimeout(drainTimer);
                     drainTimer = undefined;
@@ -665,6 +675,8 @@ export class RemoteHostExecutionEnv {
                 cleanupSpool();
                 throw e;
             }
+            if (child.pid != null)
+                ticket = trackHostForegroundChild(child.pid);
             closeSpoolFds();
             child.on("error", (e) => {
                 finish({ ok: false, error: new ExecutionError("spawn_error", `host spawn failed: ${e.message}`) });
@@ -753,6 +765,8 @@ export class RemoteHostExecutionEnv {
                 settleFromTermination(code, signal);
             });
             child.on("exit", (code, signal) => {
+                if (ticket)
+                    untrackHostForegroundChild(ticket);
                 exited = true;
                 drainTimer = setTimeout(() => settleFromTermination(code, signal), EXIT_SETTLE_DRAIN_MS);
                 drainTimer.unref?.();
@@ -797,6 +811,9 @@ export class RemoteHostExecutionEnv {
         const signalReady = () => { const w = wake; wake = undefined; w?.(); };
         const sh = hostShell();
         const child = spawn(sh.shell, [...sh.args, command], { cwd, env: this.mergeEnv(options?.env), ...spawnGroupOptions() });
+        const ticket = child.pid != null ? trackHostForegroundChild(child.pid) : undefined;
+        if (ticket)
+            child.once("exit", () => untrackHostForegroundChild(ticket));
         let pipeDestroyTimer;
         const kill = () => {
             try {
@@ -831,6 +848,8 @@ export class RemoteHostExecutionEnv {
         child.on("close", (code, signal) => {
             if (pipeDestroyTimer)
                 clearTimeout(pipeDestroyTimer);
+            if (ticket)
+                untrackHostForegroundChild(ticket);
             if (finished)
                 return;
             exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
@@ -906,6 +925,8 @@ export class RemoteHostExecutionEnv {
             if (wallTimer)
                 clearTimeout(wallTimer);
             options?.signal?.removeEventListener("abort", onAbort);
+            if (ticket)
+                untrackHostForegroundChild(ticket);
         }
     }
     async absolutePath(p) {

package/dist/plugins/store-backend.js

@@ -8,6 +8,7 @@ import { FileOutcomeSink } from "./file-outcome-sink.js";
 import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
 import { FileRunStore } from "./file-run-store.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
+import { buildStoreOpenRefusalTail } from "./store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./store-lock-wait.js";
 import { NO_SQL_MIGRATIONS, runSqlOneTimeMigrations } from "./one-time-migrations.js";
 import { LocalSessionStore } from "./local-session-store.js";
@@ -234,8 +235,9 @@ class LocalBackend {
         catch (e) {
             if (e instanceof AdoptionError)
                 throw e;
-            throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)} ` +
-                "(another HTTP service / run-local instance may own it; stop it first or set LOCAL_DATA_ROOT to a free dir)");
+            const tail = buildStoreOpenRefusalTail(e, "http");
+            throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
+                (tail === undefined ? "" : ` ${tail}`));
         }
         this.sessionStore = new LocalSessionStore(new FileSessionRepo(this.fileBackend.root), this.fileBackend.root);
         this.runStore = new FileRunStore(this.fileBackend.root, {

package/dist/plugins/store-open-refusal.d.ts

@@ -0,0 +1,11 @@
+/** 取数据根的两条路。语义上只是「换根的通道叫什么」,不是两套出路。 */
+export type StoreOpenLane = "http" | "run-local";
+/**
+ * 数据根拒启句的**尾巴**:锁类失败 ⇒ 该码的出路;其余一切 ⇒ `undefined`(不加话)。
+ *
+ * @param err  构造 `FileStorageBackend` 时抛出来的东西(未经重铸 —— `store-lock-wait.ts` 的等待腿到窗
+ *             重抛时刻意保留 `code` 与类型身份,正是为了让这里分派得成)。
+ * @param lane 哪条路在问。只影响「换根」半句的措辞。
+ */
+export declare function buildStoreOpenRefusalTail(err: unknown, lane: StoreOpenLane): string | undefined;
+//# sourceMappingURL=store-open-refusal.d.ts.map

package/dist/plugins/store-open-refusal.js

@@ -0,0 +1,23 @@
+import { FileStoreLockError } from "@sema-agent/core";
+const FREE_ROOT_KNOB = {
+    http: "set LOCAL_DATA_ROOT to a free dir",
+    "run-local": "use a different --root",
+};
+export function buildStoreOpenRefusalTail(err, lane) {
+    if (!(err instanceof FileStoreLockError))
+        return undefined;
+    const code = err.code;
+    switch (code) {
+        case "store.dir_in_use":
+            return `(a LIVE process — possibly this one — owns this data dir; stop that process first, or ${FREE_ROOT_KNOB[lane]})`;
+        case "store.dir_claiming":
+            return "(transient: another process is taking over a crashed owner's lock — it either finishes or is itself reclaimed, so just retry in a moment)";
+        case "store.lock_unreadable":
+            return '(only a human can resolve this: do what the line above says, and nothing more — "unreadable" is NOT proof the owner is gone: a lock this process merely lacks permission to read looks identical, so confirm the holder is really stale (or fix the permission) before removing anything)';
+        default: {
+            const unhandled = code;
+            return `(unrecognized file-store lock code ${String(unhandled)}: this server build has no verified way out for it — treat the line above as the whole story)`;
+        }
+    }
+}
+//# sourceMappingURL=store-open-refusal.js.map

package/dist/run-local.js

@@ -7,7 +7,7 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
-import { Runner, uuidv7, parseModelMention, AdoptionError, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
+import { Runner, uuidv7, parseModelMention, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { hasOperatorGateIntent } from "./approval.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
@@ -17,6 +17,7 @@ import { taskWallClockSec } from "./task-workflow.js";
 import { applyCatalogToSource } from "./capabilities/center-prompts.js";
 import { validatePromptsDomain, CORE_ENGINE_VERSION } from "./prompts-domain-validate.js";
 import { buildUnpricedCeilingNotice, loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./config.js";
+import { buildStoreOpenRefusalTail } from "./plugins/store-open-refusal.js";
 import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
@@ -42,6 +43,7 @@ import { createOrgMemoryAdmissionWiring } from "./boot/org-memory.js";
 import { createPermissionDeniedMeter } from "./observability/tool-trace.js";
 import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
+import { fatalExit } from "./boot/fatal-exit.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
@@ -271,9 +273,9 @@ export async function runLocal(argv, deps = {}) {
     }
     catch (e) {
         printErr(`cannot open local data dir ${root}: ${e instanceof Error ? e.message : String(e)}`);
-        if (!(e instanceof AdoptionError)) {
-            printErr("(another run-local/engine instance may own it; finish it first, or use a different --root)");
-        }
+        const tail = buildStoreOpenRefusalTail(e, "run-local");
+        if (tail !== undefined)
+            printErr(tail);
         return 2;
     }
     const sessionStore = fileBackend.sessionStore;
@@ -575,9 +577,6 @@ function isMainModule() {
     }
 }
 if (isMainModule()) {
-    void main().catch((err) => {
-        createLogger().error("fatal", { err: String(err) });
-        process.exit(1);
-    });
+    void main().catch((err) => fatalExit(err));
 }
 //# sourceMappingURL=run-local.js.map

package/dist/tool-approval.d.ts

@@ -1,3 +1,4 @@
+import type { HostDecidedBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
 import { type AskRequest, type AskOutcome, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
@@ -53,6 +54,13 @@ export interface ParkedAskRedeemRequest {
     decision: "approve" | "deny";
     /** [ref] 同源的人写理由(deny 时 core 把它交给模型;allow 只进审计面)。 */
     note?: string;
+    /** #1016:回决体自报的**结算来源**,原样过境到耐久腿的 `hostDecision.decidedBy`(缺席 ⇒ `"person"`)。
+     *  live 命中臂与本 PARKED 臂读**同一格** —— 同一份体落在哪条臂上只取决于副本与时序。
+     *  型 = `string`(本层证得出的全部);判词的是耐久座的属主 core,cast 在 `hostDecisionFacts` 那一处。
+     *  ⚠️ 两座的**词表并不相同**(live = `human`/`timeout`/`policy`,耐久 = `person`/`sla_timeout`/`policy`,
+     *  只在 `policy` 上相交)—— 这正是这条 wire 键只开 `"policy"` 一个词的原因,也是它不能声明成其中任何
+     *  一只闭集的原因:同一个串要落到两个不同词表的座上。 */
+    settledBy?: string;
     /** [ref] ctrl+g 编辑放行的实参整体替换(approve 才有意义)。 */
     updatedInput?: unknown;
     /** 发起本次 respond 的**已验证**调用方(live 腿 `gatedPrincipal` 的那一把)。席在赎回之前拿它与
@@ -575,6 +583,23 @@ export declare const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOffe
  * 指定 scope = 让一次「在项目 A 里点的同意」写成一条覆盖项目 B(或全局)的常驻放行 —— 那是这条轴上
  * 最贵的一次扩权。静默忽略同样不行:客户端会以为自己设上了。响亮拒,一句话说清谁拥有这一格。
  */
+/**
+ * #1016 —— `settledBy` 与 allow 族**互斥**的那一句(两条回决腿共用一份文本:同一个体在两条口上必须
+ * 拿到同一句话)。判的是**键在不在**,不是它是什么词。
+ */
+/**
+ * #1016 —— `settledBy` 的**形**拒句(两条回决腿共用一份文本,与 {@link SETTLED_BY_DENY_ONLY} 同姿势)。
+ *
+ * 🔴 **判形 ≠ 判词**:本层证得出的只有「它是个串」;「它是不是词表里的那个串」由**引擎**判(两条腿各有
+ * 一处响亮拒,读数在收车档)。加这道形门的理由是**类型必须说真话**(wire 边界强类型宪法):
+ * 一个非串值往下会落进 `AskOutcome.settledBy`(core 的串闭集)与本仓审计账本的 `settledBy?: string` 席 ——
+ * 两处都声明成串,而运行期塞进去一个数字。引擎对它照样响亮拒(实测三形一致:`"bogus"` / `1` / `null`
+ * 都是 `approver_contract` 的 fail-closed deny),所以这不是在补一个 fail-open,而是**不让本层的类型撒谎**;
+ * 顺带把「一个非串永远不可能是闭集成员」这件必然的事拒在最早的地方,与同一只 parser 里 `note` /
+ * `persistRule.rule` / `persistRule.edited` 三道既有形门**同族**(那三道在,只有本格没有 = 本格才是特例)。
+ */
+export declare const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string \u2014 the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+export declare const SETTLED_BY_DENY_ONLY = "settledBy is only meaningful with decision \"deny\" \u2014 only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door's own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision";
 export declare const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope \u2014 the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 /** Validate the respond body — the closed three-choice enum (rationale in the module header). */
 export declare function parseToolApprovalResponse(body: unknown): {
@@ -583,10 +608,42 @@ export declare function parseToolApprovalResponse(body: unknown): {
     updatedInput?: unknown;
     persistRule?: ParsedPersistRule;
     note?: string;
+    settledBy?: string;
 } | {
     ok: false;
     error: string;
 };
+/**
+ * core 5.23.0([ref]/[ref]②)—— **宿主自报**的结算来源,`AskOutcome` 对象臂新开的口。本仓在这一格上有
+ * **两种身份**,合成一只座是刻意的(两只座 = 同一个 wire 位的两个写者):
+ *  · **铸**(本仓自己观察到的事实):只有 `"timeout"` —— 同步 `onAsk` 腿的等待窗归**宿主**所有(引擎不为
+ *    一个它没排程的回调起表),所以「本仓的 TTL 窗走完了、没人答」这件事引擎结构上观察不到,不自报就
+ *    永远被记成「一个人拒绝了」;
+ *  · **转**(调用方在回决体里自报的事实,core 7.26.2 / #1016 起):`settledBy:"policy"` = 答这张卡的是
+ *    **这台部署自己的策略**,不是人。本仓**零判据、原样过境**:词的拒绝逻辑归引擎(`resolveAsk` 对
+ *    自报词表外的值是响亮 fail-closed deny),本仓抄一份词表的那天 core 加词就会被静默 400 掉。
+ * 逐词(词表属主恒是 core):
+ *  · `"human"` —— 与「不铸这个键」逐字同义(core 缺席即按人处理);
+ *  · `"aborted"` —— core **明令拒收**宿主自报(那是引擎自家 fail-closed 端的词,宿主自报等于把自己的
+ *    拒绝改标成引擎故障),所以它**不在** `AskOutcome` 的这一格上,本型也就够不着它。
+ * 类型从 core 的**同步 outcome 面**推导(不手抄):`AskOutcome` 的对象臂上 `settledBy` 是**宿主报的事实**,
+ * core 7.6.0([ref] S6-A)删掉的是那张**结算词表**(`ApprovalSettledBy`),不是这一格 —— 词由 core 从
+ * 这个事实铸(`human_refused` / `approval_window_expired` / `policy_refused`)。core 若改这一格的词表,
+ * 这里编译期先红。
+ */
+type HostSettledBy = NonNullable<Extract<AskOutcome, {
+    allow: boolean;
+}>["settledBy"]>;
+/**
+ * #1016 —— wire 上**开给调用方**的那一个词,从 core 的两只闭集里取**交集**。
+ *
+ * 🔴 它是一条**文档钉**,不是过境值的型(过境值是 `string`,理由在 `parseToolApprovalResponse` 那处注):
+ * `"human"` 与缺席同义、`"timeout"` 是本仓自己观察到的窗(客户端说出来就是替服务端伪证一件只有服务端
+ * 看得见的事),而耐久座那边的 `"person"` / `"sla_timeout"` 同理。两只词表**只在 `"policy"` 上相交** ——
+ * 这条 wire 键因此恰好只开那一个词。core 哪天退役它,这里**编译期先红**,而不是在 wire 上静默留一个
+ * 两个座都已经不收的词;`test/tool-approval.test.ts` 的 #1016 那组按它写判据。
+ */
+export type RespondSettledBy = Extract<HostSettledBy, HostDecidedBy>;
 /**
  * [ref] R-13 C —— `UNATTENDED_APPROVAL_POLICY` 的**闭集**词表([ref]Q1「裁2:A+C」/[ref] 裁②)。
  *
@@ -1436,4 +1493,5 @@ export declare class ToolApprovalCoordinator {
     /** [ref]:当前在场的 park 墓碑数(有界性的可观测面 —— 判据据它证「帽是硬的、过期会被清」)。 */
     parkTombstoneCount(): number;
 }
+export {};
 //# sourceMappingURL=tool-approval.d.ts.map

package/dist/tool-approval.js

@@ -83,6 +83,8 @@ export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty str
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
 export const PERSIST_RULE_BATCH_EXCLUSIVE_ERROR = "persistRule.batchOfferIndex is mutually exclusive with persistRule.rule / persistRule.edited — send exactly one arm";
+export const SETTLED_BY_MUST_BE_STRING = "settledBy must be a string — the settlement source is one word from the engine's closed set, and this layer judges only the SHAPE (which word it is, the engine decides)";
+export const SETTLED_BY_DENY_ONLY = 'settledBy is only meaningful with decision "deny" — only a person approves an action that EXECUTES, so a self-reported settlement source on an allow is a contradiction the engine refuses; the refusal would arrive too late to undo this door\'s own side effects (a session allow-all grant, a persisted rule, a DECIDED row that replays as a plain approval), so it is refused here, before the decision';
 export const PERSIST_RULE_SCOPE_REFUSED = "this endpoint does not accept a rule scope — the server mints it from where the approval happened (send neither `scope` nor `persistRule.scope`)";
 export function parseToolApprovalResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
@@ -127,12 +129,19 @@ export function parseToolApprovalResponse(body) {
             }
             note = rawNote;
         }
+        const rawSettledBy = body.settledBy;
+        if (rawSettledBy !== undefined && d !== "deny")
+            return { ok: false, error: SETTLED_BY_DENY_ONLY };
+        if (rawSettledBy !== undefined && typeof rawSettledBy !== "string")
+            return { ok: false, error: SETTLED_BY_MUST_BE_STRING };
+        const settledBy = rawSettledBy;
         return {
             ok: true,
             value: d,
             ...(d !== "deny" && u !== undefined ? { updatedInput: u } : {}),
             ...(persistRule !== undefined ? { persistRule } : {}),
             ...(note !== undefined ? { note } : {}),
+            ...(rawSettledBy !== undefined ? { settledBy } : {}),
         };
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
@@ -1656,6 +1665,7 @@ export class ToolApprovalCoordinator {
                     gateBoundInputHash: row.gateBoundInputHash,
                     decision,
                     ...(parsed.note !== undefined ? { note: parsed.note } : {}),
+                    ...(parsed.settledBy !== undefined ? { settledBy: parsed.settledBy } : {}),
                     ...(parsed.updatedInput !== undefined && parsed.value !== "deny" ? { updatedInput: parsed.updatedInput } : {}),
                     ...(principal !== undefined ? { principal } : {}),
                     ...(httpReq !== undefined ? { httpReq } : {}),
@@ -1952,7 +1962,7 @@ export class ToolApprovalCoordinator {
             this.allowAllSessions.add(sessionAllowKey(entry.owner, entry.sessionId, sessionAllowCategory(entry.toolName)));
         }
         const allowed = parsed.value !== "deny";
-        entry.settle(allowed, allowed ? "allowed" : "denied", opts?.settlePayload !== undefined ? opts.settlePayload.updatedInput : parsed.updatedInput, undefined, allowed ? undefined : parsed.note);
+        entry.settle(allowed, allowed ? "allowed" : "denied", opts?.settlePayload !== undefined ? opts.settlePayload.updatedInput : parsed.updatedInput, parsed.settledBy, allowed ? undefined : parsed.note);
         const updatedInputDelivered = opts?.updatedInputDelivered ?? true;
         const noteRecorded = opts?.noteRecorded ?? false;
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.93.1",
+  "version": "7.93.3",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -59,7 +59,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.26.0",
+    "@sema-agent/core": "7.26.2",
     "@sema-agent/settings-schema": "3.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",