@sema-agent/server 7.103.1 → 7.104.0

package/dist/parked-revive-surface.d.ts

@@ -11,10 +11,13 @@
  *    给那个会话的 run 组 `spec.tools` 的同一只工厂、同一个会话分区(任务清单店 `taskListStoreFor(root)` 与领队那一张是同一张;
  *    多租户的 WebFetch 过滤同样生效 ⇒ 子代同样拿不到)。座 = `(t) => tools.includes(t)`(身份判:同名副本不算)。
  *  · **禁**用 boot 期单例填座:那只 bundle 没有会话,它的任务清单是一张私有表 —— 填了座,每个会话 / 租户的复活队友都会共用它。
- *  · **根会话现在还属于这张卡的租户**才填座(codex r1 [high]):任务清单店只按会话 id 分区,而会话 id 由调用方自选、删后可被别人重领 ——
- *    根会话删了(或换了主人)之后赎回一张旧卡,按 id 重解出来的是**新主人**的清单。属主读数由赎回腿在 claim 前读(`identity.rootOwner`,
- *    读自会话属主面;缺席 = 会话已不在 / 读不出),与卡的权威 principal 逐字相等才填;否则不交座(fail-closed:子代不继承,继承工具上的
- *    allow 回 422、审批待决,deny 照结)。根删除时把子孙的 parked 卡一并围栏 / 过期 = 另车(会话化身轴,[ref] 同族)。
+ *  · **根会话现在还是这张卡的那一位住客**才填座(codex r1 [high] + S-790 加严):任务清单店只按会话 id 分区,而会话 id 由调用方自选、
+ *    删后可被别人(或同一个人)重领 —— 根会话删了(或删了重建)之后赎回一张旧卡,按 id 重解出来的是**下一位住客**的清单。判据两条都要:
+ *    ① 根会话的属主与卡的权威 principal 逐字相等;② 赎回腿 claim 前 / 后两次读到的是**同一位住客**(化身逐字相等,
+ *    `session-incarnation.ts` 的 `sameSessionOccupant`)—— 只比属主比不出「同一个人删了重建」。任一条不成立 / 读数缺席 ⇒ 不交座
+ *    (fail-closed:子代不继承,继承工具上的 allow 回 422、审批待决,deny 照结)。赎回腿自己在两次读不一致时整条拒(`409 decide.not_parked`),
+ *    这里的第 ② 条是同一条事实在交座这一处的判据(规则只写在这里,腿只负责读两次)。根删除时把子孙的 parked 卡一并作废 = S-790 件 B
+ *    (`boot/session-faces.ts` 的删除协调器)。
  *  · 只对**一层**行填座(`rootSessionId` 在场且 = `parentSessionId`:派它的 run 就是根会话的 run,列表正是那个 run 的挂载)。更深的行
  *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 用 boot 期那只裸 Agent、无座 = core 的 fail-closed 臂;
  *    行上带继承组成是 core #1112(7.32.x)的半场,到货再改读行。
@@ -23,6 +26,7 @@
  */
 import { type BackgroundAgentRecord, type ToolSpec } from "@sema-agent/core";
 import type { Scenario } from "./capabilities/scenarios.js";
+import { type SessionFace } from "./session-incarnation.js";
 /** 一次赎回用的面:驱动的 Agent 工具 + (一层行时)与它同出一张列表的继承座。 */
 export interface ParkedReviveSurface {
     readonly reviveTool: ToolSpec;
@@ -30,12 +34,15 @@ export interface ParkedReviveSurface {
     readonly mountsCallerTool?: (tool: ToolSpec) => boolean;
 }
 /**
- * 按行解析赎回面的入参身份:`principal` = 权威 principal(取 checkpoint 的 scope 列,不取行上有损的 `row.scope`);`rootOwner` = 行的根会话
- * **现在**的属主(赎回腿在 claim 前读会话属主面;`null` = 匿名会话,缺席 = 会话已不在 / 读不出 / 本部署无属主面)。
+ * 按行解析赎回面的入参身份:`principal` = 权威 principal(取 checkpoint 的 scope 列,不取行上有损的 `row.scope`);`root` = 赎回腿对行的
+ * 根会话读到的两次会话面(claim 之前 / 之后;属主 `null` = 匿名会话)。缺席 = 没有读数 ⇒ 不交座。
  */
 export interface ParkedReviveSurfaceIdentity {
     readonly principal: string | undefined;
-    readonly rootOwner?: string | null;
+    readonly root?: {
+        readonly before: SessionFace;
+        readonly after: SessionFace;
+    };
 }
 /** 按行解析赎回面。 */
 export type ParkedReviveSurfaceFactory = (row: BackgroundAgentRecord, identity: ParkedReviveSurfaceIdentity) => ParkedReviveSurface;

package/dist/parked-revive-surface.js

@@ -1,4 +1,5 @@
 import { DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
+import { sameSessionOccupant } from "./session-incarnation.js";
 const agentOf = (tools) => tools.find((t) => t.name === DEFAULT_SUBAGENT_TOOL_NAME);
 export function createParkedReviveSurface(defaultScenario) {
     const bootTool = agentOf(defaultScenario({}).tools);
@@ -8,7 +9,10 @@ export function createParkedReviveSurface(defaultScenario) {
         const root = row.rootSessionId;
         if (root === undefined || row.parentSessionId !== root)
             return { reviveTool: bootTool };
-        if (identity.rootOwner === undefined || (identity.rootOwner ?? undefined) !== identity.principal)
+        const face = identity.root;
+        if (face === undefined || !sameSessionOccupant(face.before, face.after))
+            return { reviveTool: bootTool };
+        if ((face.before.owner ?? undefined) !== identity.principal || (face.after.owner ?? undefined) !== identity.principal)
             return { reviveTool: bootTool };
         const tools = defaultScenario({}, identity.principal, { sessionId: root }).tools;
         const reviveTool = agentOf(tools);

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,3 +1,4 @@
+import type { Logger } from "../observability/logger.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /** 数据根下的目录名。**按店命名**,与兄弟 File 店同规(`approval-nonces` / `approval-ask-audit` /
@@ -120,7 +121,9 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
      *
      * @param root local 数据根(= `LocalBackend` 的 `FileStorageBackend.root`,零新 env)。
      */
-    constructor(root: string);
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
     /**
      * 内核的钟。窗口外读 ⇒ **抛**(不静默回落 `Date.now()`):窗口外的读数按定义不在账本上,重放会得出
      * 另一个时间戳 —— 那是一条**静默**的重放分岔,而本店的全部价值就是重放等价。今天内核的五个读钟点

package/dist/plugins/approval-ask-store-file.js

@@ -1,7 +1,7 @@
 import { closeSync, copyFileSync, openSync, readSync, statSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { AppendLog, atomicWriteFile, ensureDir, readJsonlRecords } from "@sema-agent/core";
-import { createSkippedRecordSink } from "../observability/corrupt-read-seat.js";
+import { AppendLog, atomicWriteFile, ensureDir } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { InMemoryApprovalAskStore, encodeDecideUpdatedInput, encodeStoreJsonPayload } from "./approval-ask-store-memory.js";
@@ -26,6 +26,10 @@ const JOURNAL_OP_WORDS = new Set(JOURNAL_OPS);
 export const JOURNAL_OP_TABLE_GATE = true;
 const JOURNAL_V1_CLAIM_INTENTS = ["expire", "cancel"];
 const JOURNAL_V1_CLAIM_INTENT_WORDS = new Set(JOURNAL_V1_CLAIM_INTENTS);
+const ASK_JOURNAL_SHAPE = {
+    what: "approval-ask journal record",
+    read: (record) => record,
+};
 function endsAtRecordBoundary(path) {
     const size = statSync(path).size;
     if (size === 0)
@@ -50,7 +54,7 @@ export class FileApprovalAskStore {
     replayRejectedCount = 0;
     corruptLineCount = 0;
     corruptQuarantinePath;
-    constructor(root) {
+    constructor(root, opts) {
         const dir = join(root, APPROVAL_ASK_DIR);
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
@@ -58,10 +62,8 @@ export class FileApprovalAskStore {
         this.path = join(dir, APPROVAL_ASK_JOURNAL_FILE);
         this.core = new InMemoryApprovalAskStore({ now: () => this.clockRead() });
         const tornTail = existsSync(this.path) && !endsAtRecordBoundary(this.path);
-        const records = readJsonlRecords(this.path, createSkippedRecordSink((info) => {
-            this.corruptLineCount += 1;
-            recordFailOpen("server.approval-ask-journal.corrupt-record-skipped", `path=${info.path} reason=${info.reason}`);
-        }));
+        const { records, skipped } = replayJsonlSkipping(this.path, "approval-ask-journal", ASK_JOURNAL_SHAPE, opts?.warn);
+        this.corruptLineCount = skipped;
         for (const rec of records)
             this.replayRecord(rec);
         this.records = records.length;
@@ -127,11 +129,6 @@ export class FileApprovalAskStore {
         this.records = lines.length;
     }
     replayRecord(raw) {
-        if (raw === null || typeof raw !== "object") {
-            this.corruptLineCount += 1;
-            recordFailOpen("server.approval-ask-journal.corrupt-record-skipped", `path=${this.path} reason=record is not an object`);
-            return;
-        }
         const probe = raw;
         const refuse = (why) => {
             throw new StoreBootRefusalError(`FileApprovalAskStore: approval ask journal ${this.path} carries a record this build cannot replay — ${why} ` +

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -270,6 +270,10 @@ export declare function assertIntegralEpochMs(field: string, value: number): voi
 export declare function assertIdempotencyKeyShape(key: string): void;
 /** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
 export declare const MAX_SETTLED_BY_CHARS = 16;
+/** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 形门 ① 的**谓词本身**,店门口
+ *  ({@link assertDecideSettledBy})与耐久 ask 回决口的 CAS 前体门(S-843:确定的体形错误拒成 400,不落进提交歧义臂)
+ *  读同一只,尺不抄第二份。 */
+export declare function settledByFitsColumn(v: string): boolean;
 /**
  * S-558 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
  * 判的是**形**,不是**词** —— 词表属主恒是 core(`resolveAsk` 对自报词表外的值是响亮 fail-closed deny),

package/dist/plugins/approval-ask-store-sql.js

@@ -14,11 +14,14 @@ export function assertIdempotencyKeyShape(key) {
     }
 }
 export const MAX_SETTLED_BY_CHARS = 16;
+export function settledByFitsColumn(v) {
+    return v.length > 0 && v.length <= MAX_SETTLED_BY_CHARS;
+}
 export function assertDecideSettledBy(decision) {
     const v = decision.settledBy;
     if (v === undefined)
         return;
-    if (v.length === 0 || v.length > MAX_SETTLED_BY_CHARS) {
+    if (!settledByFitsColumn(v)) {
         throw new Error(`invalid settledBy: the settlement source is one word from the engine's closed set and lands in a VARCHAR(${MAX_SETTLED_BY_CHARS}) column — must be 1-${MAX_SETTLED_BY_CHARS} chars (got ${JSON.stringify(v.slice(0, 32))}${v.length > 32 ? "…" : ""}, length ${v.length})`);
     }
     if (decision.decision !== "deny") {

package/dist/plugins/approval-exemption-store.d.ts

@@ -1,5 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
+import type { Logger } from "../observability/logger.js";
 export interface ApprovalExemptionRow {
     toolName: string;
     grantedBy: string | null;
@@ -43,11 +44,30 @@ export declare class MemoryApprovalExemptionStore implements ApprovalExemptionSt
     revoke(sessionId: string, toolName: string): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<number>;
 }
+/**
+ * 🔴 S-582 —— **fail-closed per session file.** A record in the MIDDLE of a session's log that cannot be read (bit rot,
+ * a hand edit, a line `42`, an object missing `toolName`) used to be skipped silently. When that line was a REVOKE
+ * tombstone, the grant before it survived the replay: a "don't ask again" the operator had revoked came back and the
+ * tool ran WITHOUT asking — the fail-open direction on the approval axis. We cannot tell which fact the line held, so
+ * the replay owner (`observability/corrupt-read-seat.ts`, seat `approval-exemption`) discloses it and closes that
+ * file's gate: `has` / `list` / `grant` / `revoke` for THAT session reject with `JsonlStoreCorruptError`, and every
+ * consumer already treats a rejected `has` as "not exempt" (ask anyway). Other sessions are untouched (one file = one
+ * session's facts). `deleteBySession` is NOT gated: right-to-delete must not be blocked by a bad byte, and deleting
+ * the file is exactly the remedy — it clears the gate with the file.
+ */
 export declare class FileApprovalExemptionStore implements ApprovalExemptionStore {
     private readonly dir;
     private readonly bySession;
     private readonly logs;
-    constructor(root: string);
+    /** S-582: sanitized session key → that session log's gate (only files that replayed a bad record are listed). */
+    private readonly corruptGates;
+    private readonly warn;
+    /** @param opts.warn corrupt-read disclosure seat (`LocalBackend` wires `discloseWarn`; absent ⇒ the owner falls back to `console.warn`, never to silence). */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
+    /** S-582: first line of every judging / appending method (see the class note). */
+    private assertUsable;
     private pathFor;
     /** Replay every session log (torn-tail-safe; last-wins with revoke tombstones). Index keyed by the SANITIZED id. */
     private hydrate;

package/dist/plugins/approval-exemption-store.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { existsSync, readdirSync, rmSync } from "node:fs";
-import { AppendLog, ensureDir, readJsonlRecords, sanitizePathComponent } from "@sema-agent/core";
+import { AppendLog, ensureDir, sanitizePathComponent } from "@sema-agent/core";
+import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 export class TiDBApprovalExemptionStore {
     pool;
     constructor(pool) {
@@ -98,15 +99,36 @@ export class MemoryApprovalExemptionStore {
         return n;
     }
 }
+const EXEMPTION_RECORD_SHAPE = {
+    what: "approval-exemption record without a string toolName (or with a mistyped revoked / grantedBy / ts)",
+    read(record) {
+        const { toolName, revoked, grantedBy, ts } = record;
+        if (typeof toolName !== "string")
+            return undefined;
+        if (!(revoked === undefined || typeof revoked === "boolean"))
+            return undefined;
+        if (!(grantedBy === undefined || grantedBy === null || typeof grantedBy === "string"))
+            return undefined;
+        if (!(ts === undefined || typeof ts === "string"))
+            return undefined;
+        return { toolName, grantedBy: grantedBy ?? null, ts: ts ?? "", ...(revoked !== undefined ? { revoked } : {}) };
+    },
+};
 export class FileApprovalExemptionStore {
     dir;
     bySession = new Map();
     logs = new Map();
-    constructor(root) {
+    corruptGates = new Map();
+    warn;
+    constructor(root, opts) {
         this.dir = join(root, "approval-exemptions");
+        this.warn = opts?.warn;
         ensureDir(this.dir);
         this.hydrate();
     }
+    assertUsable(key) {
+        this.corruptGates.get(key)?.assertUsable();
+    }
     pathFor(sessionId) {
         return join(this.dir, `${sanitizePathComponent(sessionId)}.jsonl`);
     }
@@ -122,13 +144,13 @@ export class FileApprovalExemptionStore {
             if (!name.endsWith(".jsonl"))
                 continue;
             const key = name.slice(0, -".jsonl".length);
-            const records = readJsonlRecords(join(this.dir, name));
+            const { records, gate } = replayJsonlGuarded(join(this.dir, name), "approval-exemption", EXEMPTION_RECORD_SHAPE, this.warn);
+            if (gate.tripped)
+                this.corruptGates.set(key, gate);
             if (!records.length)
                 continue;
             const m = this.bySession.get(key) ?? new Map();
             for (const r of records) {
-                if (!r || typeof r.toolName !== "string")
-                    continue;
                 if (r.revoked) {
                     m.delete(r.toolName);
                 }
@@ -154,6 +176,7 @@ export class FileApprovalExemptionStore {
     }
     async grant(sessionId, toolName, grantedBy) {
         const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
         this.logFor(sessionId).append({ toolName, grantedBy: grantedBy ?? null, ts: new Date().toISOString() }, true);
         let m = this.bySession.get(key);
         if (!m) {
@@ -164,10 +187,14 @@ export class FileApprovalExemptionStore {
         m.set(toolName, { grantedBy, createdAt: prior?.createdAt ?? Date.now() });
     }
     async has(sessionId, toolName) {
-        return this.bySession.get(sanitizePathComponent(sessionId))?.has(toolName) ?? false;
+        const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
+        return this.bySession.get(key)?.has(toolName) ?? false;
     }
     async list(sessionId) {
-        const m = this.bySession.get(sanitizePathComponent(sessionId));
+        const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
+        const m = this.bySession.get(key);
         if (!m)
             return [];
         return [...m.entries()]
@@ -176,6 +203,7 @@ export class FileApprovalExemptionStore {
     }
     async revoke(sessionId, toolName) {
         const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
         const m = this.bySession.get(key);
         if (!m?.has(toolName))
             return false;
@@ -200,6 +228,7 @@ export class FileApprovalExemptionStore {
                 throw new Error(`approval-exemption purge failed for ${sessionId}: ${e instanceof Error ? e.message : String(e)}`);
         }
         this.bySession.delete(key);
+        this.corruptGates.delete(key);
         return removed;
     }
     dispose() {

package/dist/plugins/approval-nonce-store.d.ts

@@ -1,6 +1,7 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
+import type { Logger } from "../observability/logger.js";
 /** 表名(单数形;`test/schema-naming-invariants.test.ts` 的闭集词表钉着)。 */
 export declare const APPROVAL_NONCE_TABLE = "approval_nonce";
 /**
@@ -71,7 +72,15 @@ export declare class MemoryApprovalNonceStore implements ApprovalNonceStore {
  *
  * 崩溃语义:`append` 走 fsync。丢一条记录 = 那个 nonce 在它剩下的 TTL 里可被重放一次(与「整台副本重启」
  * 的既有暴露同级,且 SQL 车道不受此影响);**绝不**能出现的是反向 —— 记录还在却被读成不在,那要靠
- * `readJsonlRecords` 的断尾安全(半行丢弃)兜住。
+ * core JSONL 读法的断尾安全(半行丢弃)兜住。
+ *
+ * 🔴 **S-582:中间一行读不出 ⇒ 整本拒用(fail-closed)**。撕尾是崩溃的正常形(core 丢弃且不报);而**中间**
+ * 那一行读不出(位腐 / 手改 / 一行 `42` / 缺键的对象)时,我们不知道它是哪一只 nonce —— 修前静默跳过它,等于
+ * 让那只已消费的证明再被受理一次(S-280 要关的重放洞换了个入口)。现在由属主披露(`approval_nonce_corrupt_read`)
+ * 并合上 {@link gate}:`consume` / `reapExpired` 第一行即带码拒(`JsonlStoreCorruptError`,外层答 500);`nowMs` 不读账、
+ * 不经闸。清扫同样要拒:压实会把幸存者原样写回、把坏行连同证据一起抹掉,下一次重启读到的就是一本「干净」的账 ——
+ * 闸自己打开,而那只 nonce 仍然没被记住。出路在拒绝句里(移开文件的代价与安全时机)。
+ * 代价如实:这台 local 机器上直连门的 plan_review 在有人处置之前全部 500(`/decide` 不经本店,不受影响)。
  */
 export declare class FileApprovalNonceStore implements ApprovalNonceStore {
     private readonly path;
@@ -80,7 +89,12 @@ export declare class FileApprovalNonceStore implements ApprovalNonceStore {
      *  从复合键里**解析**出来是一条没必要的反向铸形 —— 记录留着就不必解析。 */
     private readonly rows;
     private log;
-    constructor(root: string);
+    /** S-582:本账的损坏闸(见类注)。 */
+    private readonly gate;
+    /** @param opts.warn 腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 属主退回 `console.warn`,不退回沉默)。 */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
     private logFor;
     /** local 车道:店 = 这台机器上的这个数据根,所以店钟就是本进程的墙钟(理由同 Memory 腿)。 */
     nowMs(): Promise<number>;

package/dist/plugins/approval-nonce-store.js

@@ -1,7 +1,8 @@
 import { join } from "node:path";
-import { atomicWriteFile, ensureDir, readJsonlRecords, AppendLog } from "@sema-agent/core";
+import { atomicWriteFile, ensureDir, AppendLog } from "@sema-agent/core";
 import { mysqlDriver, pgDriver, sqlDbNowMs, SQL_DB_NOW_MS } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
+import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 export const APPROVAL_NONCE_TABLE = "approval_nonce";
 export const MAX_APPROVAL_NONCE_CHARS = 190;
 export class SqlApprovalNonceStore {
@@ -66,22 +67,29 @@ export class MemoryApprovalNonceStore {
         return n;
     }
 }
+const NONCE_RECORD_SHAPE = {
+    what: "approval-nonce record without a string s / string n / numeric e",
+    read(record) {
+        const { s, n, e } = record;
+        return typeof s === "string" && typeof n === "string" && typeof e === "number" ? { s, n, e } : undefined;
+    },
+};
 export class FileApprovalNonceStore {
     path;
     tmpDir;
     rows = new Map();
     log;
-    constructor(root) {
+    gate;
+    constructor(root, opts) {
         const dir = join(root, "approval-nonces");
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
         ensureDir(this.tmpDir);
         this.path = join(dir, "consumed.jsonl");
-        for (const r of readJsonlRecords(this.path)) {
-            if (!r || typeof r.s !== "string" || typeof r.n !== "string" || typeof r.e !== "number")
-                continue;
-            this.rows.set(keyOf(r.s, r.n), { s: r.s, n: r.n, e: r.e });
-        }
+        const { records, gate } = replayJsonlGuarded(this.path, "approval-nonce", NONCE_RECORD_SHAPE, opts?.warn);
+        this.gate = gate;
+        for (const r of records)
+            this.rows.set(keyOf(r.s, r.n), r);
     }
     logFor() {
         return (this.log ??= new AppendLog(this.path));
@@ -90,6 +98,7 @@ export class FileApprovalNonceStore {
         return Date.now();
     }
     async consume(sessionId, nonce, expiresAtMs) {
+        this.gate.assertUsable();
         const k = keyOf(sessionId, nonce);
         if (this.rows.has(k))
             return false;
@@ -99,6 +108,7 @@ export class FileApprovalNonceStore {
         return true;
     }
     async reapExpired() {
+        this.gate.assertUsable();
         const nowMs = await this.nowMs();
         const survivors = [];
         let removed = 0;

package/dist/plugins/caching-session-store.d.ts

@@ -3,6 +3,7 @@ import type { SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import type { InstructionSourceStore } from "../instruction-source-notice.js";
+import type { SessionFaceReader } from "../session-incarnation.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
@@ -37,6 +38,10 @@ export declare class CachingSessionStore implements SessionStore {
     private readonly timer?;
     /** Delegated tenant-ownership ops, present only if the inner store exposes them (the TiDB store does). */
     readonly ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
+    /** S-790:属主 + 化身一次读,纯转发(不经暖缓存 —— 化身判的就是「此刻坐在座位上的是谁」,缓存的旧答案正是要消灭的那一形)。
+     *  🔴 必须转发(与 retention / placements / instruction-source 同一条教训):生产默认把真店包进本类,不转发 = parked 决定腿
+     *  与记忆座在默认部署上读不到化身。 */
+    readonly sessionFaceOf?: SessionFaceReader;
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */

package/dist/plugins/caching-session-store.js

@@ -6,6 +6,7 @@ export class CachingSessionStore {
     ttlMs;
     timer;
     ownerOf;
+    sessionFaceOf;
     register;
     listSessions;
     fork;
@@ -45,6 +46,8 @@ export class CachingSessionStore {
         const ownerAware = inner;
         if (ownerAware.ownerOf)
             this.ownerOf = ownerAware.ownerOf.bind(inner);
+        if (ownerAware.sessionFaceOf)
+            this.sessionFaceOf = ownerAware.sessionFaceOf.bind(inner);
         if (ownerAware.register)
             this.register = ownerAware.register.bind(inner);
         if (ownerAware.listSessions)

package/dist/plugins/file-resume-anchor-store.d.ts

@@ -1,13 +1,18 @@
+import type { Logger } from "../observability/logger.js";
 export declare class FileResumeAnchorStore {
     private readonly dir;
     /** sessionId → (eventId → {entryId, owner}) — the same in-memory shape MemoryResumeAnchorStore holds, hydrated on ctor. */
     private readonly bySession;
     /** sessionId → the open append log (one O_APPEND fd per session, lazily opened on first put, held for lifetime). */
     private readonly logs;
-    constructor(root: string);
+    private readonly warn;
+    /** @param opts.warn corrupt-read disclosure seat (S-582; absent ⇒ the replay owner falls back to `console.warn`). */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
     /** `<dir>/<sanitizePathComponent(sessionId)>.jsonl` — the per-session log path (sessionId is uuidv7, already safe). */
     private pathFor;
-    /** Replay every session log into the in-memory index on boot (torn-tail-safe via readJsonlRecords; last-wins upsert
+    /** Replay every session log into the in-memory index on boot (torn-tail-safe via the replay owner; last-wins upsert
      *  so a re-stamped eventId reflects the latest appended record). The in-memory index is keyed by the SANITIZED
      *  sessionId throughout (put/resolve/list/delete all sanitize), and each on-disk file's base name IS
      *  `sanitizePathComponent(sessionId)` — so the index key is just the file base, with no de-sanitize needed. */

package/dist/plugins/file-resume-anchor-store.js

@@ -1,13 +1,25 @@
 import { join } from "node:path";
 import { existsSync, readdirSync, rmSync } from "node:fs";
-import { AppendLog, ensureDir, readJsonlRecords, sanitizePathComponent } from "@sema-agent/core";
+import { AppendLog, ensureDir, sanitizePathComponent } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
+const ANCHOR_RECORD_SHAPE = {
+    what: "resume-anchor record without a string eventId / entryId",
+    read(record) {
+        const { eventId, entryId, owner } = record;
+        if (typeof eventId !== "string" || typeof entryId !== "string")
+            return undefined;
+        return { eventId, entryId, owner: typeof owner === "string" ? owner : null, ownerReadable: owner === undefined || owner === null || typeof owner === "string" };
+    },
+};
 export class FileResumeAnchorStore {
     dir;
     bySession = new Map();
     logs = new Map();
-    constructor(root) {
+    warn;
+    constructor(root, opts) {
         this.dir = join(root, "resume-anchors");
+        this.warn = opts?.warn;
         ensureDir(this.dir);
         this.hydrate();
     }
@@ -26,14 +38,16 @@ export class FileResumeAnchorStore {
             if (!name.endsWith(".jsonl"))
                 continue;
             const key = name.slice(0, -".jsonl".length);
-            const records = readJsonlRecords(join(this.dir, name));
+            const { records } = replayJsonlSkipping(join(this.dir, name), "resume-anchor", ANCHOR_RECORD_SHAPE, this.warn);
             if (!records.length)
                 continue;
             const m = this.bySession.get(key) ?? new Map();
             for (const r of records) {
-                if (!r || typeof r.eventId !== "string" || typeof r.entryId !== "string")
+                if (!r.ownerReadable) {
+                    m.delete(r.eventId);
                     continue;
-                m.set(r.eventId, { entryId: r.entryId, owner: r.owner ?? null });
+                }
+                m.set(r.eventId, { entryId: r.entryId, owner: r.owner });
             }
             this.bySession.set(key, m);
         }

package/dist/plugins/file-run-store.d.ts

@@ -1,5 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
+import type { Logger } from "../observability/logger.js";
 import { StoreBootRefusalError, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
@@ -45,9 +46,12 @@ export declare class FileRunStore {
     /** [ref] 件B(census 第 29 行终局):`RUN_STORE_STRICT_HYDRATE` 的**部署级**表态。
      *  `true` ⇒ hydrate 的 readdir 失败拒启;缺席/`false` ⇒ 件6 的记债腿,行为字节不变。 */
     private readonly strictHydrate;
+    /** S-582:三个盘面坏行的腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 重放属主退回 `console.warn`)。 */
+    private readonly corruptReadWarn;
     constructor(root: string, opts?: {
         error?(msg: string, fields?: Record<string, unknown>): void;
         strictHydrate?: boolean;
+        warn?: Logger["warn"];
     });
     private runDir;
     private runJsonPath;
@@ -58,8 +62,9 @@ export declare class FileRunStore {
     private toRecord;
     /** Replay the on-disk registry/claims/event-logs into the in-memory index on boot. Each plane is torn-tail-/
      *  partial-write-safe (run.json via atomicWriteFile can never be half-written; the active file via writeThenLink is
-     *  all-or-nothing; events.jsonl via readJsonlRecords drops a crash tail). A corrupt run.json (failed parse) is
-     *  skipped — that run is lost, not a poison that fails the boot. */
+     *  all-or-nothing; events.jsonl via the JSONL replay drops a crash tail). A corrupt run.json (failed parse) is
+     *  skipped — that run is lost, not a poison that fails the boot — and since S-582 the skip is disclosed and counted
+     *  (`server.run-store.corrupt-record-skipped`), never silent. */
     /**
      * hydrate 期**逐文件**读盘的统一口([ref] 件B / codex 对抗复审 R4-[high])。
      *
@@ -73,6 +78,12 @@ export declare class FileRunStore {
      * 吞、也不改形),既有的「坏行跳过、不毒 boot」宽容契约与既有的抛法一起原封保留。
      */
     private replay;
+    /**
+     * S-582 —— 本店**唯一**的盘上记录读口(hydrate 经 {@link replay} 包一层 strict 档,运行期读点直调它):
+     * 交形判据给重放属主,坏行按登记名 `run-store` 跳过 + 披露 + 计数。strict 档的射程是「文件读不出」,
+     * 不含「文件里有坏行」—— 后者在两档下都走这里的 F 臂(普查表第 96 行)。
+     */
+    private readRecords;
     /**
      * strict 档下的**存在性判别**(codex R4-[high] 的前半):`existsSync` 对 ENOENT 与 EACCES 同答 false,
      * 而这两句话在本门下必须分开 —— 前者是常态(`runs/` 下的非目录杂物、还没落盘的目录),后者是「我读
@@ -110,10 +121,12 @@ export declare class FileRunStore {
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
-    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
-    setSuspended(taskId: string): Promise<void>;
-    /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */
-    setNeedsReview(taskId: string): Promise<void>;
+    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard).
+     *  S-173:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。 */
+    setSuspended(taskId: string, result: PersistedTaskResult | null): Promise<void>;
+    /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review.
+     *  S-173:同 {@link setSuspended} 落封口脱敏后的 `result`。 */
+    setNeedsReview(taskId: string, result: PersistedTaskResult | null): Promise<void>;
     /** Durable F4 resume: flip suspended/needs_review → running (CAS) + reset cancel/preempt flags.
      *  [ref](codex R1 [medium]):认领 = 接管 `instanceId`(= 当前持有副本;SQL 孪生同注)。CAS 输不改。 */
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
@@ -192,7 +205,7 @@ export declare class FileRunStore {
     /** [ref] wire the checkpoint probe (LocalBackend.checkpoint(), where checkpoint + run store share one root). */
     setCheckpointProbe(probe: RunStoreCheckpointProbe): void;
     /** [ref] shared tail of both suspended-run reapers: flip one parked row → failed('approval.expired') and
-     *  PERSIST it — the file twin of the SQL UPDATE (`error`/`error_code` set directly, no result blob). */
+     *  PERSIST it — the file twin of the SQL UPDATE (`error`/`error_code` set directly, no result blob; S-173: the park-time `result` is cleared, same as the SQL `result = NULL`). */
     private failExpiredPark;
     /**
      * [ref] Durable F4 expiry — the file twin of TiDBRunStore.reapSuspended, driven by the injected checkpoint
@@ -294,7 +307,7 @@ export declare class FileRunStore {
     /** Drop a run entirely (registry + event log + open fd + on-disk dir) — used by deleteBySession. */
     private dropRun;
     /**
-     * 🔴 **一次性迁移(随 7.75.0 连同 `one-time-migrations.ts` 整删)** —— 退役词旧拼法的账本改写,
+     * 🔴 **一次性迁移 M3 的 local 腿(窗口见 `one-time-migrations.ts` 登记表,随 M3 一起删)** —— 退役词旧拼法的账本改写,
      * SQL 两孪生那条整表 UPDATE 的 local 形。逐条走**同一只**纯改写函数,所以三条车道改出来的字节一致。
      *
      * 为什么是 store 上的一只动词、而不是外面一个文件走查:本店的账本有**两份**在场 —— 盘上的 jsonl