@sema-agent/server 7.103.1 → 7.104.0

package/dist/observability/corrupt-read-seat.d.ts

@@ -31,12 +31,15 @@
  * · **不接 `recordFailOpen`**:那条通道是给 F 类(装饰/缓存)fail-open 的计数与探针用的;这里的 fail-open
  *   是 core 的裁定、本仓不改它,server 的职责只有一条 —— **不许无声**([ref] 安全轴纪律)。响亮 warn 就是
  *   那条职责的兑现;要不要再进 fail-open 台账是另一件事、另一台车的设计。
+ *   (⚠️ 这一条只说 core 自带 File 店的座。**本仓自有**的 JSONL 店是另一回事 —— 失败方向归本仓裁,见文件
+ *   后半的 S-582 重放属主:fail-open 的座**必须**进 F 类台账,fail-closed 的座不进台账而是拒用。)
  *
  * ⚠️ core 那只 guard 的纪律同样适用:sink 是**无绑定**调用的(`this` 是 undefined)。本属主返回的是箭头
  * 闭包,天然满足;但**不要**把某个对象的裸方法引用直接塞进座 —— 读 `this` 会抛,而那个抛会被 core 的
  * guard 吞掉,于是披露**静默丢失**(比没接座更难查)。
  */
-import type { FileStorageCorruptReadInfo, readJsonlRecords } from "@sema-agent/core";
+import { type FileStorageCorruptReadInfo } from "@sema-agent/core";
+import { type FailOpenTag } from "./fail-open.js";
 import type { Logger } from "./logger.js";
 /**
  * 铸一只腐读披露座。
@@ -46,28 +49,160 @@ import type { Logger } from "./logger.js";
  * @param event warn 事件名。**留在调用点**:它是那只店的身份,接线锚(test/roster-corrupt-read.test.ts)
  *   正是靠「构造实参里能读到这个名字」来证明座不是个空回调。
  * @param note 这张脸的后果句(可选)。缺席 ⇒ 不写这个键。
+ * @param leg  与披露**同拍**的一条附加腿(可选;S-612 加):座拿到一次披露时先交给它、再写日志。唯一的用户是
+ *   `LocalSessionStore` 那只 `FileSessionRepo` 的座 —— 会话打开作用域的计数腿(`noteReplayInSessionOpenScope`:
+ *   作用域在场时把 `replay` 计数记到那次打开上,由打开方铸 `session.records_skipped`)。腿**必须不抛**(那一只是纯内存
+ *   赋值);先腿后日志,是因为日志座可能坏(core 的 guard 会吞掉它的抛),而一次日志故障不许吃掉这一记。
+ *   座本身不变:载荷投影、事件名、后果句仍由本属主铸,腿只多拿一份同一个 `info`。
  */
-export declare function createCorruptReadSeat(warn: Logger["warn"], event: string, note?: string): (info: FileStorageCorruptReadInfo) => void;
+export declare function createCorruptReadSeat(warn: Logger["warn"], event: string, note?: string, leg?: (info: FileStorageCorruptReadInfo) => void): (info: FileStorageCorruptReadInfo) => void;
 /**
  * `FileStorageBackend` 那两只座共用的后果句 —— 一个座覆盖 core 转发的三张脸,所以共同事实只有一句,
  * 差别只在第三张脸叫什么(`run-local` 腿看到的是 file-snapshot,HTTP 服务腿看到的是 file-history)。
  * 这一句从前在两处各抄一份、只差一个词;现在词从参数来,句子只有一份。
  */
 export declare function buildDurableAbsenceNote(thirdFace: string): string;
-/** core `readJsonlRecords` 的坏行回调入参(core 不从包根导出这两级的型名 ⇒ 从那只函数的签名派生,不手抄)。 */
-export type JsonlCorruptInfo = Parameters<NonNullable<Parameters<typeof readJsonlRecords>[1]>>[0];
-/** 其中「一条被跳过的记录」那一级。 */
-export type JsonlSkippedRecord = Extract<JsonlCorruptInfo, {
-    kind: "record";
-}>;
 /**
- * S-616(core 7.30.0 #1041 提货)—— 本仓直接调 `readJsonlRecords` 的店(approval-ask 日志、permission-rule 两本日志)
- * 的坏行回调**唯一**形。core 自这一版起对一次坏读报两级:每条被跳过的记录一发 `record`,这次重放的计数一发
- * `replay`(`dropped` = 同一批 `record` 的条数)。这些店按**记录**计数、按记录告警 / 跳闸 —— 手写回调不分级就把同一条
- * 坏行记两次(k3s8 实测:approval-ask 的「1 条解析不出」读成 2 条,permission-rule 的 onError 一行变两行)。
- * 规则一句:**只按记录计,计数级是同一事实的汇总,不再计一次**;穷举 switch,core 加第三级 ⇒ 编译红。
- * 与 {@link createCorruptReadSeat} 的分工:那只是 core 自带 File 店的**披露座**(两级都转发,日志按 `kind` 分桶);
- * 本函数是本仓自有店**消费**坏行事实的口子(计数 / 跳闸只要记录级)。
+ * 一只店对自己记录的**形判据 + 投影**。`read` 认得 ⇒ 返回店的记录;认不得 ⇒ `undefined`。
+ *
+ * 判据写**最小必填键**:本店重放真读的那几格必须在、且形对(一格读错形会被重放读成另一件事 —— 例如豁免店的
+ * `revoked` 若是字符串 `"false"`,真值判断会把它当成撤销)。不写「是对象就行」:那一层 core 已经判过了。
+ * 🔴 `read` 必须是记录的**纯函数** —— 属主对 core 留下的每条记录会再读一次取投影(core 的判据座只回布尔)。
+ */
+export interface JsonlRecordShape<T> {
+    /** 被拒那一行在披露句里的名字(core `JsonlRecordJudge.what`)。 */
+    readonly what: string;
+    read(record: object): T | undefined;
+}
+type JsonlReplaySeatEntry = {
+    readonly direction: "fail-closed";
+    /** 腐读座的 warn 事件名。 */
+    readonly event: string;
+    /** 这只面在拒绝句里的名字。 */
+    readonly face: string;
+    /** 进每一条披露的后果句。 */
+    readonly note: string;
+    /** 拒绝句的出路段:人该做什么、移开文件会丢什么。 */
+    readonly remedy: string;
+} | {
+    readonly direction: "fail-open";
+    readonly event: string;
+    /** 逐条计数的 F 类 tag(`fail-open.ts` 闭集词表;普查表 §1 有登记行)。 */
+    readonly tag: FailOpenTag;
+    readonly note: string;
+};
+/**
+ * JSONL 座的**登记表**(闭集:未登记的座名传不进属主 ⇒ 编译红)。每一座在 `docs/FAIL-OPEN-CENSUS.md` §1 有登记行。
+ *  · `fail-closed` —— 权限 / 安全轴:一行读不出 = 一次授权事实缺了一块,拿残缺的账判决会**放行**不该放行的
+ *    (nonce 重放 / 已撤销的豁免复活 / 已认领的票复活 / 审批记录连同 rev 回滚)。
+ *  · `fail-open` —— 可用性轴:丢一行 = 丢一段进度 / 一条列表项 / 一个事件,放行合法但**必留痕**(F 类)。
+ */
+export declare const JSONL_REPLAY_SEATS: {
+    readonly "approval-nonce": {
+        readonly direction: "fail-closed";
+        readonly event: "approval_nonce_corrupt_read";
+        readonly face: "approval-nonce ledger";
+        readonly note: string;
+        readonly remedy: string;
+    };
+    readonly "approval-exemption": {
+        readonly direction: "fail-closed";
+        readonly event: "approval_exemption_corrupt_read";
+        readonly face: "approval-exemption log";
+        readonly note: string;
+        readonly remedy: string;
+    };
+    readonly "permission-rule-approvals": {
+        readonly direction: "fail-closed";
+        readonly event: "permission_rule_approvals_corrupt_read";
+        readonly face: "permission-rule approval log";
+        readonly note: "S-582 fail-closed: an unreadable snapshot would roll a rule-approval record (and its rev) back to an earlier state. The face refuses every read and write until a person inspects the file.";
+        readonly remedy: "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)";
+    };
+    readonly "permission-rule-tickets": {
+        readonly direction: "fail-closed";
+        readonly event: "permission_rule_tickets_corrupt_read";
+        readonly face: "permission-rule import-ticket log";
+        readonly note: "S-582 fail-closed: an unreadable consume/release line would resurrect a claimed import ticket as unclaimed (one human consent redeemed twice). The face refuses every read and write until a person inspects the file.";
+        readonly remedy: "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)";
+    };
+    readonly "approval-ask-journal": {
+        readonly direction: "fail-open";
+        readonly event: "approval_ask_journal_corrupt_read";
+        readonly tag: "server.approval-ask-journal.corrupt-record-skipped";
+        readonly note: "F: a skipped ask-journal record loses an ask transition's PROGRESS, never a gate (every write is CAS-guarded); the original is quarantined next to the journal.";
+    };
+    readonly "run-store": {
+        readonly direction: "fail-open";
+        readonly event: "run_store_corrupt_read";
+        readonly tag: "server.run-store.corrupt-record-skipped";
+        readonly note: string;
+    };
+    readonly "resume-anchor": {
+        readonly direction: "fail-open";
+        readonly event: "resume_anchor_corrupt_read";
+        readonly tag: "server.resume-anchor.corrupt-record-skipped";
+        readonly note: "F: a skipped anchor means that eventId no longer resolves (resumeAt / rewindFilesTo answer 404 unknown_event for it; the next put re-records it).";
+    };
+    readonly "send-file-ledger": {
+        readonly direction: "fail-open";
+        readonly event: "send_file_ledger_corrupt_read";
+        readonly tag: "server.send-file-ledger.corrupt-record-skipped";
+        readonly note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).";
+    };
+};
+/** 登记名(闭集)。 */
+export type JsonlReplaySeat = keyof typeof JSONL_REPLAY_SEATS;
+type SeatsWhere<D extends JsonlReplaySeatEntry["direction"]> = {
+    [K in JsonlReplaySeat]: (typeof JSONL_REPLAY_SEATS)[K]["direction"] extends D ? K : never;
+}[JsonlReplaySeat];
+/** 登记为 fail-closed 的座(只能交给 {@link replayJsonlGuarded})。 */
+export type FailClosedJsonlSeat = SeatsWhere<"fail-closed">;
+/** 登记为 fail-open 的座(只能交给 {@link replayJsonlSkipping})。 */
+export type FailOpenJsonlSeat = SeatsWhere<"fail-open">;
+/**
+ * fail-closed 座的**带码拒绝**。`kind` 与店层拒绝契约同字(`StoreCorruptError.kind`),`seat` 说是哪一只面。
+ * 调用方各按自己的既有纪律接:豁免探针被拒 ⇒ 当未豁免(照问人);nonce 消费被拒 ⇒ 外层 500(证明不受理)。
+ */
+export declare class JsonlStoreCorruptError extends Error {
+    readonly kind: "corrupt";
+    readonly seat: FailClosedJsonlSeat;
+    readonly path: string;
+    readonly reason: string;
+    constructor(seat: FailClosedJsonlSeat, path: string, reason: string);
+}
+/**
+ * 一个 fail-closed 文件的**损坏闸**(原 `permission-rule-store-file.ts` 的 `CorruptionGate`,S-582 收进属主)。
+ * 置位之后,店的每一个判决 / 追加方法第一行 {@link assertUsable} 即响亮拒 —— 一份不完整的授权账既不能用来
+ * 判决,也不能在它上面继续追加(追加只会让下一次重启读到同样残缺的历史)。
+ * 只是一只闩:披露由属主在跳闸那一刻经腐读座发出(逐条记录 + 计数),闸本身不再说第二遍。
+ */
+export declare class JsonlStoreGate {
+    private readonly seat;
+    private readonly path;
+    private reason;
+    constructor(seat: FailClosedJsonlSeat, path: string);
+    /** 记一次损坏(幂等:第一条原因就是拒绝句里报的那条)。 */
+    trip(reason: string): void;
+    get tripped(): boolean;
+    assertUsable(): void;
+}
+/**
+ * **fail-closed** 座的重放:坏行 ⇒ 逐条披露 + 这只文件的闸合上(交回的 {@link JsonlStoreGate});好行照常交回
+ * (闸合上时店不再用它们判决,但删除类动作 —— 例如 E21 删会话 —— 仍可按店的规矩收掉它们)。
+ * 读错(非 ENOENT)照 core 原样抛。
+ */
+export declare function replayJsonlGuarded<T>(path: string, seat: FailClosedJsonlSeat, shape: JsonlRecordShape<T>, warn?: Logger["warn"]): {
+    records: T[];
+    gate: JsonlStoreGate;
+};
+/**
+ * **fail-open** 座的重放:坏行 ⇒ 跳过 + 逐条披露 + 逐条 `recordFailOpen(<登记的 F tag>)`;`skipped` = 跳过的条数
+ * (撕尾不计 —— core 按设计不报它)。读错(非 ENOENT)照 core 原样抛。
  */
-export declare function createSkippedRecordSink(onRecord: (info: JsonlSkippedRecord) => void): (info: JsonlCorruptInfo) => void;
+export declare function replayJsonlSkipping<T>(path: string, seat: FailOpenJsonlSeat, shape: JsonlRecordShape<T>, warn?: Logger["warn"]): {
+    records: T[];
+    skipped: number;
+};
+export {};
 //# sourceMappingURL=corrupt-read-seat.d.ts.map

package/dist/observability/corrupt-read-seat.js

@@ -1,13 +1,18 @@
-export function createCorruptReadSeat(warn, event, note) {
-    return (info) => warn(event, {
-        kind: info.kind,
-        path: info.path,
-        reason: info.reason,
-        ...corruptReadLevelFields(info),
-        ...(info.sessionId !== undefined ? { sessionId: info.sessionId } : {}),
-        ...(info.principal !== undefined ? { principal: info.principal } : {}),
-        ...(note !== undefined ? { note } : {}),
-    });
+import { readJsonlRecords } from "@sema-agent/core";
+import { recordFailOpen } from "./fail-open.js";
+export function createCorruptReadSeat(warn, event, note, leg) {
+    return (info) => {
+        leg?.(info);
+        return warn(event, {
+            kind: info.kind,
+            path: info.path,
+            reason: info.reason,
+            ...corruptReadLevelFields(info),
+            ...(info.sessionId !== undefined ? { sessionId: info.sessionId } : {}),
+            ...(info.principal !== undefined ? { principal: info.principal } : {}),
+            ...(note !== undefined ? { note } : {}),
+        });
+    };
 }
 function corruptReadLevelFields(info) {
     switch (info.kind) {
@@ -29,19 +34,157 @@ export function buildDurableAbsenceNote(thirdFace) {
         "layer (deployment policy / hooks / shell gate still applied); session repo = a listing silently omitted " +
         `rows; ${thirdFace}. Inspect the named path before deciding.`);
 }
-export function createSkippedRecordSink(onRecord) {
+const RULE_LANE_REMEDY = "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)";
+export const JSONL_REPLAY_SEATS = {
+    "approval-nonce": {
+        direction: "fail-closed",
+        event: "approval_nonce_corrupt_read",
+        face: "approval-nonce ledger",
+        note: "S-582 fail-closed: an unreadable consumption record may be a SPENT plan_review nonce — replaying the rest would accept that proof again. " +
+            "The ledger refuses every consume/reap until a person inspects the file (direct-door plan_review answers 5xx meanwhile; /decide is unaffected).",
+        remedy: "direct-door plan_review is refused until a person inspects the file. Moving it aside forgets every consumption in it — each of those proofs " +
+            "could be replayed until it expires (PRINCIPAL_JWT_MAX_TTL_SEC plus skew after it was recorded) — so move it aside only once that window has passed, then restart",
+    },
+    "approval-exemption": {
+        direction: "fail-closed",
+        event: "approval_exemption_corrupt_read",
+        face: "approval-exemption log",
+        note: "S-582 fail-closed: an unreadable record may be a REVOKE tombstone — replaying the rest would resurrect a revoked \"don't ask again\". " +
+            "That session's exemptions are refused (every tool asks) until a person inspects the file; other sessions are unaffected.",
+        remedy: "this session's exemptions are refused (the tool asks every time) until a person inspects the file; deleting the session, or moving the file " +
+            "aside and restarting, drops this session's exemptions (they will be asked for again)",
+    },
+    "permission-rule-approvals": {
+        direction: "fail-closed",
+        event: "permission_rule_approvals_corrupt_read",
+        face: "permission-rule approval log",
+        note: "S-582 fail-closed: an unreadable snapshot would roll a rule-approval record (and its rev) back to an earlier state. The face refuses every read and write until a person inspects the file.",
+        remedy: RULE_LANE_REMEDY,
+    },
+    "permission-rule-tickets": {
+        direction: "fail-closed",
+        event: "permission_rule_tickets_corrupt_read",
+        face: "permission-rule import-ticket log",
+        note: "S-582 fail-closed: an unreadable consume/release line would resurrect a claimed import ticket as unclaimed (one human consent redeemed twice). The face refuses every read and write until a person inspects the file.",
+        remedy: RULE_LANE_REMEDY,
+    },
+    "approval-ask-journal": {
+        direction: "fail-open",
+        event: "approval_ask_journal_corrupt_read",
+        tag: "server.approval-ask-journal.corrupt-record-skipped",
+        note: "F: a skipped ask-journal record loses an ask transition's PROGRESS, never a gate (every write is CAS-guarded); the original is quarantined next to the journal.",
+    },
+    "run-store": {
+        direction: "fail-open",
+        event: "run_store_corrupt_read",
+        tag: "server.run-store.corrupt-record-skipped",
+        note: "F: a skipped run.json reads that run as ABSENT ('no such run'); a skipped events.jsonl line is one trace event missing from replay; " +
+            "a skipped claim record sends that claim down the torn-claim path (adopted by its live row, else quarantined).",
+    },
+    "resume-anchor": {
+        direction: "fail-open",
+        event: "resume_anchor_corrupt_read",
+        tag: "server.resume-anchor.corrupt-record-skipped",
+        note: "F: a skipped anchor means that eventId no longer resolves (resumeAt / rewindFilesTo answer 404 unknown_event for it; the next put re-records it).",
+    },
+    "send-file-ledger": {
+        direction: "fail-open",
+        event: "send_file_ledger_corrupt_read",
+        tag: "server.send-file-ledger.corrupt-record-skipped",
+        note: "F: a skipped ledger row means that issued link is missing from its tenant's listing (the stored object itself is untouched).",
+    },
+};
+function corruptRefusalSentence(seat, path, reason) {
+    const entry = JSONL_REPLAY_SEATS[seat];
+    return `refusing to use a corrupt ${entry.face} (${path}): ${reason} — ${entry.remedy}`;
+}
+export class JsonlStoreCorruptError extends Error {
+    kind = "corrupt";
+    seat;
+    path;
+    reason;
+    constructor(seat, path, reason) {
+        super(corruptRefusalSentence(seat, path, reason));
+        this.name = "JsonlStoreCorruptError";
+        this.seat = seat;
+        this.path = path;
+        this.reason = reason;
+    }
+}
+export class JsonlStoreGate {
+    seat;
+    path;
+    reason;
+    constructor(seat, path) {
+        this.seat = seat;
+        this.path = path;
+    }
+    trip(reason) {
+        this.reason ??= reason;
+    }
+    get tripped() {
+        return this.reason !== undefined;
+    }
+    assertUsable() {
+        if (this.reason !== undefined)
+            throw new JsonlStoreCorruptError(this.seat, this.path, this.reason);
+    }
+}
+const warnToConsole = (event, fields) => console.warn(event, fields);
+const isThenable = (v) => typeof v === "object" && v !== null && typeof v.then === "function";
+function guardDisclosure(disclose, event) {
+    const reportSinkFailure = (info, err) => warnToConsole(`${event}_sink_failed`, { kind: info.kind, path: info.path, reason: info.reason, sinkError: err instanceof Error ? err.name : typeof err });
     return (info) => {
+        let out;
+        try {
+            out = disclose(info);
+        }
+        catch (err) {
+            reportSinkFailure(info, err);
+            return;
+        }
+        if (isThenable(out))
+            out.then(undefined, (err) => reportSinkFailure(info, err));
+    };
+}
+function replayJsonl(path, seat, shape, warn, onSkipped) {
+    const entry = JSONL_REPLAY_SEATS[seat];
+    const disclose = guardDisclosure(createCorruptReadSeat(warn ?? warnToConsole, entry.event, entry.note), entry.event);
+    const judge = { what: shape.what, accepts: (record) => shape.read(record) !== undefined };
+    const kept = readJsonlRecords(path, (info) => {
         switch (info.kind) {
             case "record":
-                onRecord(info);
-                return;
+                onSkipped(info);
+                break;
             case "replay":
-                return;
+                break;
             default: {
                 const unreachable = info;
                 return unreachable;
             }
         }
-    };
+        disclose(info);
+    }, judge);
+    return kept.map((record) => {
+        const value = shape.read(record);
+        if (value === undefined) {
+            throw new Error(`JSONL replay seat ${seat}: the shape reader accepted a record of ${path} and then refused it — a shape reader must be a pure function of the record`);
+        }
+        return value;
+    });
+}
+export function replayJsonlGuarded(path, seat, shape, warn) {
+    const gate = new JsonlStoreGate(seat, path);
+    const records = replayJsonl(path, seat, shape, warn, (info) => gate.trip(info.reason));
+    return { records, gate };
+}
+export function replayJsonlSkipping(path, seat, shape, warn) {
+    const { tag } = JSONL_REPLAY_SEATS[seat];
+    let skipped = 0;
+    const records = replayJsonl(path, seat, shape, warn, (info) => {
+        skipped += 1;
+        recordFailOpen(tag, `path=${info.path} reason=${info.reason}`);
+    });
+    return { records, skipped };
 }
 //# sourceMappingURL=corrupt-read-seat.js.map

package/dist/observability/fail-open.d.ts

@@ -301,6 +301,18 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "F";
         readonly note: "S-609(`routes/approvals-assistant.ts` 的 `GET /v1/assistant/inbox`):某一行的续跑上下文(checkpoint_ctx)读出来是**坏体**(店的拒绝契约 `StoreCorruptError`;local = 档不是 JSON / 信封不合形,SQL = 列是合法 JSON 但不是一只对象)⇒ **这一行**的 `objective` 落 `null`,列表其余照常。放行的最坏后果 = inbox 上这一张卡不显示它属于哪个任务(纯展示位;这一格不参与任何决裁、续跑或门判 —— 续跑腿与 plan_review 门对同一行各自走读口、坏体一律响亮 500)。不放行的代价是整只 `summaries.map` 抛出 ⇒ 一行坏体打掉整个用户的 inbox。故 F 类;必须留痕,因为修前那句 `.catch(() => null)` 让「坏体」与「本来就没有」同形无痕(detail = 读口转述的 `where`,人拿它去修那一行)。缺席(行不在 / 店抖动)**不**记本 tag:那是读口的刻意保守,不是失败开放。";
     };
+    readonly "server.run-store.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-582(`plugins/file-run-store.ts`,local 车道的 File 形 run 店;三个盘面同一只座):盘上一条记录读不出形 —— 一行 `42` / 缺本店必填键的对象 / 中间的半截 JSON(撕尾不走本 tag,那是崩溃的正常落盘形)⇒ 跳过它继续。三个盘面各自的最坏后果:`run.json` 坏 ⇒ 那条 run 读成**缺席**(`GET /v1/runs/:id` 404,listRuns 少一行;它若占着 claim,EEXIST 路按「行不在」判残骸接管);`events.jsonl` 一行坏 ⇒ 回放少一个事件(其余照读、按 seq 去重不变);claim 记录坏 ⇒ 走既有的撕裂 claim 路(有非终局行就收编,否则隔离出 activeDir)。都是**可用性**损失,不开任何门 ⇒ F。修前三面全零披露(店自己的 `typeof … continue` 与 core 的静默跳过);计数让「这台机器的 run 账在腐」在遥测里显形。⚠️ `RUN_STORE_STRICT_HYDRATE=on` 的射程是「文件读不出」,不含「文件里有坏行」—— strict 档下坏行照走本 tag(未改 strict 语义,见普查表第 96 行)。";
+    };
+    readonly "server.resume-anchor.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-582(`plugins/file-resume-anchor-store.ts`,local 车道的 E18 续跑锚日志):一条锚记录读不出形(`42` / 缺 eventId·entryId / 中间半截 JSON)⇒ 跳过它继续重放。最坏后果 = 那个 eventId 不再解析得出(`resumeAt` / `rewindFilesTo` 对它答 404 `resume_at.unknown_event` / `rewind_files_to.unknown_event` —— `boot/resolve-spec.ts` 的解析腿;下一次 put 会把它重记)。锚是**定位**事实,不是授权事实(属主守卫在行上另有 `owner` 列)⇒ F。修前零披露。";
+    };
+    readonly "server.send-file-ledger.corrupt-record-skipped": {
+        readonly cls: "F";
+        readonly note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -274,6 +274,18 @@ export const FAIL_OPEN_TAGS = {
         cls: "F",
         note: "S-609(`routes/approvals-assistant.ts` 的 `GET /v1/assistant/inbox`):某一行的续跑上下文(checkpoint_ctx)读出来是**坏体**(店的拒绝契约 `StoreCorruptError`;local = 档不是 JSON / 信封不合形,SQL = 列是合法 JSON 但不是一只对象)⇒ **这一行**的 `objective` 落 `null`,列表其余照常。放行的最坏后果 = inbox 上这一张卡不显示它属于哪个任务(纯展示位;这一格不参与任何决裁、续跑或门判 —— 续跑腿与 plan_review 门对同一行各自走读口、坏体一律响亮 500)。不放行的代价是整只 `summaries.map` 抛出 ⇒ 一行坏体打掉整个用户的 inbox。故 F 类;必须留痕,因为修前那句 `.catch(() => null)` 让「坏体」与「本来就没有」同形无痕(detail = 读口转述的 `where`,人拿它去修那一行)。缺席(行不在 / 店抖动)**不**记本 tag:那是读口的刻意保守,不是失败开放。",
     },
+    "server.run-store.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-582(`plugins/file-run-store.ts`,local 车道的 File 形 run 店;三个盘面同一只座):盘上一条记录读不出形 —— 一行 `42` / 缺本店必填键的对象 / 中间的半截 JSON(撕尾不走本 tag,那是崩溃的正常落盘形)⇒ 跳过它继续。三个盘面各自的最坏后果:`run.json` 坏 ⇒ 那条 run 读成**缺席**(`GET /v1/runs/:id` 404,listRuns 少一行;它若占着 claim,EEXIST 路按「行不在」判残骸接管);`events.jsonl` 一行坏 ⇒ 回放少一个事件(其余照读、按 seq 去重不变);claim 记录坏 ⇒ 走既有的撕裂 claim 路(有非终局行就收编,否则隔离出 activeDir)。都是**可用性**损失,不开任何门 ⇒ F。修前三面全零披露(店自己的 `typeof … continue` 与 core 的静默跳过);计数让「这台机器的 run 账在腐」在遥测里显形。⚠️ `RUN_STORE_STRICT_HYDRATE=on` 的射程是「文件读不出」,不含「文件里有坏行」—— strict 档下坏行照走本 tag(未改 strict 语义,见普查表第 96 行)。",
+    },
+    "server.resume-anchor.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-582(`plugins/file-resume-anchor-store.ts`,local 车道的 E18 续跑锚日志):一条锚记录读不出形(`42` / 缺 eventId·entryId / 中间半截 JSON)⇒ 跳过它继续重放。最坏后果 = 那个 eventId 不再解析得出(`resumeAt` / `rewindFilesTo` 对它答 404 `resume_at.unknown_event` / `rewind_files_to.unknown_event` —— `boot/resolve-spec.ts` 的解析腿;下一次 put 会把它重记)。锚是**定位**事实,不是授权事实(属主守卫在行上另有 `owner` 列)⇒ F。修前零披露。",
+    },
+    "server.send-file-ledger.corrupt-record-skipped": {
+        cls: "F",
+        note: "S-582(`plugins/send-file-ledger.ts`,local 车道的发文件账本):一条账行读不出形(`42` / 缺 id·scope·objectKey 三元组 / 中间半截 JSON)⇒ 跳过它继续。最坏后果 = 那条已签发的链接在它租户的列表里**看不见**(对象本身没动;账本本来就不存 URL)。治理面少一行是可见性损失,不是放行 ⇒ F;但它恰是治理面要看的那一类事实,所以必须留痕 —— 修前零披露。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/observability/run-terminal.d.ts

@@ -1,4 +1,4 @@
-import { type RunRecord } from "../plugins/store-contracts.js";
+import { type PersistedTaskResult, type RunRecord } from "../plugins/store-contracts.js";
 /** 一次终局写口交给观测面的原料(store 侧装配,**未脱敏** —— 脱敏在本模块内做,见 {@link notifyRunTerminal})。 */
 export interface RunTerminalRecord {
     /** 这条 run 的账本 id = `GET /v1/runs/:id` 的 id(本仓 run 行主键名为 taskId,同一个值)。 */
@@ -145,6 +145,20 @@ export declare function redactTerminalResult<T extends {
     /** S-394:形上同样 `unknown` —— 本函数是读盘面,`stats` 的树形逐层现判(见 {@link redactStats})。 */
     stats?: unknown;
 } | null | undefined>(result: T): T;
+/**
+ * 🔴 **S-173 —— run 行 `result` 列的唯一入口**:先过出口封口({@link sealResultForExit}:摘恢复凭据 + 折域外码),
+ * 再过 {@link redactTerminalResult}。三家 run 店(SQL 两方言 / file / memory)的**三个**写口 —— `setTerminal` 与
+ * park 两口 `setSuspended` / `setNeedsReview` —— 入口各调一次,列上的字节因此只有一条来路。
+ *
+ * 为什么封口也挪到店的入口(而不只靠调用方):S-173 之前这一列只收终局结果,而终局结果上凭据只可能藏在
+ * `failed.nestedPause` 一处、且每个调用点都已先封口。park 两口收的是 **`paused` 因由** —— 那一臂按 core 的
+ * 类型**必带** `token`(引擎内契约)。凭据挂在「每个调用点都记得先封口」上 = 漏一处就是一次凭据落盘、且
+ * 不会红([ref] 安全轴:fail-closed,不是约定)。两件事都**幂等**(封过口的再封是同形、脱过的再脱是同一引用),
+ * 所以调用点已封过口的腿零行为变化。
+ *
+ * `null` 原样(= 这条腿没有结果可落:引擎没给终局就收流 / 断连竞态 park / 重开 re-park)。
+ */
+export declare function sealRunRowResult(result: PersistedTaskResult | null): PersistedTaskResult | null;
 /** S-107(第五轮合并重扫 wf_f00c00bc 两根 [high]):同一个 `TaskResult` 除 run 行外还被逐字追加进 run_events 的 `done` 行
  *  (bg/verify/cascade/stream/resume 五腿),`failed` 行带原文 `errorMessage`,`GET /v1/runs/:id/events` 原样回放。
  *  三孪生 `appendEvent` 入口 + 事件读面(旧行纵深)同调本函数:只认 `done.result`(整块走 `redactTerminalResult`)与

package/dist/observability/run-terminal.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { redactSecrets, normalizeForRedaction } from "../trace/redact.js";
 import { isModelTextLedgerEventType, isParkLedgerEventType } from "../trace/ledger-events.js";
 import { isUnsuccessfulRunStatus } from "../plugins/store-contracts.js";
+import { sealResultForExit } from "../terminal.js";
 import { errorText } from "./err-text.js";
 import { recordFailOpen } from "./fail-open.js";
 const MESSAGE_CAP = 1024;
@@ -236,6 +237,9 @@ export function redactTerminalResult(result) {
     }
     return changed ? out : result;
 }
+export function sealRunRowResult(result) {
+    return result === null ? null : redactTerminalResult(sealResultForExit(result));
+}
 export function redactLedgerEventData(type, data) {
     if (data === null || typeof data !== "object" || Array.isArray(data))
         return data;

package/dist/parked-decide.d.ts

@@ -13,6 +13,7 @@ import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, Ques
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
+import { type SessionFaceReader } from "./session-incarnation.js";
 export interface ParkedAgentMatch {
     handle: string;
     row: BackgroundAgentRecord;
@@ -118,9 +119,13 @@ export interface ParkedDecideDeps {
      *  checkpointStore 同实例,[ref] 设计稿 §4),以及与它同出一张列表的继承座 `mountsCallerTool`(一层行才有;属主与全部判据
      *  在 `parked-revive-surface.ts`)。修前是 boot 期的一只裸 Agent 工具、从不交座 ⇒ 7.32.0 起停在继承工具上的 allow 恒 422。 */
     reviveSurface: ParkedReviveSurfaceFactory;
-    /** #1110 codex r1 [high]:会话属主面(`sessionStorage.ownerOf`)—— 赎回腿在 claim 前读**根会话现在**的属主交给赎回面(属主换人 / 会话
-     *  已不在 ⇒ 不交座)。缺席 = 本部署无属主面 ⇒ 读数缺席 ⇒ 不交座(fail-closed)。读抛 ⇒ 原样上抛(claim 之前,没有东西要回滚)。 */
-    sessionOwnerOf?: (sessionId: string) => Promise<string | null | undefined>;
+    /**
+     * S-790([ref] §4)—— 会话面读口(`sessionStorage.sessionFaceOf`:属主 + 化身一次读)。**必填**:本腿对根会话读两次 ——
+     * claim 之前一次、claim 成功之后一次 —— 会话不在或两次不是同一位住客 ⇒ 回滚 claim、答既有的 `409 decide.not_parked`;赎回面只在
+     * 属主相等且两次是同一位住客时交继承座。读抛 ⇒ claim 前原样上抛(没有东西要回滚),claim 后先回滚再上抛。
+     * (#1110 那只可选的 `sessionOwnerOf` 退役:可选 ⇒ 缺席时静默不复核,正是 S-790 那个窗的形。)
+     */
+    sessionFaceOf: SessionFaceReader;
     /** revive args 的 `subagent_type` 成员性判定集([ref] Q1 修正:非 roster 成员必须省略,否则
      *  unknown subagent_type 拒;字面比对 general-purpose 在 roster 撞名时会错省)。缺省空集=恒省略。 */
     knownAgentTypes?: ReadonlySet<string>;

package/dist/parked-decide.js

@@ -2,6 +2,7 @@ import { readRunParks } from "./orchestration/workflow-agent-session-index.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
+import { sameSessionOccupant } from "./session-incarnation.js";
 export async function findParkOrigin(sources, cp) {
     if (sources.agentStore !== undefined) {
         let match;
@@ -135,6 +136,16 @@ export function planWorkflowParkedDecide(origin, req) {
             `agent; completed steps replay from the journal. Do not re-issue the original call.`,
     };
 }
+function sessionGone(taskId) {
+    return {
+        status: 409,
+        body: {
+            error: "the session this agent belongs to was deleted (or deleted and started again under the same id) while its approval waited, so the approval no longer applies — nothing was resumed",
+            errorCode: "decide.not_parked",
+            taskId,
+        },
+    };
+}
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
@@ -148,9 +159,14 @@ export async function decideParkedAgent(deps, req, match) {
     if (row.name === undefined) {
         return { status: 409, body: { error: "parked row carries no agent name — the revive path requires a named agent (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
     }
+    const root = row.rootSessionId;
+    if (root === undefined) {
+        return { status: 409, body: { error: "this agent's row carries no root session anchor — the revive path cannot tell which session this approval belongs to (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
+    }
+    const faceBefore = await deps.sessionFaceOf(root);
+    if (faceBefore === undefined)
+        return sessionGone(match.handle);
     const inheritedGate = deps.rebuildInheritedGate ? await deps.rebuildInheritedGate(row, { principal: decodeCheckpointScope(req.scope) }) : undefined;
-    const rootOwner = row.rootSessionId !== undefined && deps.sessionOwnerOf ? await deps.sessionOwnerOf(row.rootSessionId) : undefined;
-    const surface = deps.reviveSurface(row, { principal: decodeCheckpointScope(req.scope), ...(rootOwner !== undefined ? { rootOwner } : {}) });
     const stores = { agentStore: deps.agentStore, checkpointStore: deps.checkpointStore };
     const claim = await deps.registry.claimParkedAgent(stores, match.handle, { scope: row.scope, owner: row.owner });
     if (!claim.ok) {
@@ -167,6 +183,44 @@ export async function decideParkedAgent(deps, req, match) {
         }
     }
     const ticket = claim.ticket;
+    const quietWarn = (event, fields) => {
+        try {
+            deps.warn?.(event, fields);
+        }
+        catch {
+        }
+    };
+    const rollback = async (why) => {
+        try {
+            const disp = await deps.registry.rollbackParkedClaim(stores, ticket);
+            quietWarn("parked_decide_rolled_back", { taskId: match.handle, why, disposition: disp });
+            return disp;
+        }
+        catch (e) {
+            quietWarn("parked_decide_rollback_failed", { taskId: match.handle, why, error: e instanceof Error ? e.message : String(e) });
+            return "retry";
+        }
+    };
+    let faceAfter;
+    try {
+        faceAfter = await deps.sessionFaceOf(root);
+    }
+    catch (e) {
+        await rollback("session_face_unreadable");
+        throw e;
+    }
+    if (!sameSessionOccupant(faceBefore, faceAfter)) {
+        await rollback("session_occupant_changed");
+        return sessionGone(match.handle);
+    }
+    let surface;
+    try {
+        surface = deps.reviveSurface(row, { principal: decodeCheckpointScope(req.scope), root: { before: faceBefore, after: faceAfter } });
+    }
+    catch (e) {
+        await rollback("revive_surface_threw");
+        throw e;
+    }
     try {
         await req.onDecideCommitted?.();
     }
@@ -193,24 +247,6 @@ export async function decideParkedAgent(deps, req, match) {
             },
         },
     };
-    const quietWarn = (event, fields) => {
-        try {
-            deps.warn?.(event, fields);
-        }
-        catch {
-        }
-    };
-    const rollback = async (why) => {
-        try {
-            const disp = await deps.registry.rollbackParkedClaim(stores, ticket);
-            quietWarn("parked_decide_rolled_back", { taskId: match.handle, why, disposition: disp });
-            return disp;
-        }
-        catch (e) {
-            quietWarn("parked_decide_rollback_failed", { taskId: match.handle, why, error: e instanceof Error ? e.message : String(e) });
-            return "retry";
-        }
-    };
     defaultSubagentTailBus.forgetHandle(match.handle);
     let receipt;
     try {