@sema-agent/server 7.103.2 → 7.105.0

package/dist/parked-decide.d.ts

@@ -13,6 +13,7 @@ import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, Ques
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
+import { type SessionFaceReader } from "./session-incarnation.js";
 export interface ParkedAgentMatch {
     handle: string;
     row: BackgroundAgentRecord;
@@ -118,9 +119,13 @@ export interface ParkedDecideDeps {
      *  checkpointStore 同实例,[ref] 设计稿 §4),以及与它同出一张列表的继承座 `mountsCallerTool`(一层行才有;属主与全部判据
      *  在 `parked-revive-surface.ts`)。修前是 boot 期的一只裸 Agent 工具、从不交座 ⇒ 7.32.0 起停在继承工具上的 allow 恒 422。 */
     reviveSurface: ParkedReviveSurfaceFactory;
-    /** #1110 codex r1 [high]:会话属主面(`sessionStorage.ownerOf`)—— 赎回腿在 claim 前读**根会话现在**的属主交给赎回面(属主换人 / 会话
-     *  已不在 ⇒ 不交座)。缺席 = 本部署无属主面 ⇒ 读数缺席 ⇒ 不交座(fail-closed)。读抛 ⇒ 原样上抛(claim 之前,没有东西要回滚)。 */
-    sessionOwnerOf?: (sessionId: string) => Promise<string | null | undefined>;
+    /**
+     * S-790([ref] §4)—— 会话面读口(`sessionStorage.sessionFaceOf`:属主 + 化身一次读)。**必填**:本腿对根会话读两次 ——
+     * claim 之前一次、claim 成功之后一次 —— 会话不在或两次不是同一位住客 ⇒ 回滚 claim、答既有的 `409 decide.not_parked`;赎回面只在
+     * 属主相等且两次是同一位住客时交继承座。读抛 ⇒ claim 前原样上抛(没有东西要回滚),claim 后先回滚再上抛。
+     * (#1110 那只可选的 `sessionOwnerOf` 退役:可选 ⇒ 缺席时静默不复核,正是 S-790 那个窗的形。)
+     */
+    sessionFaceOf: SessionFaceReader;
     /** revive args 的 `subagent_type` 成员性判定集([ref] Q1 修正:非 roster 成员必须省略,否则
      *  unknown subagent_type 拒;字面比对 general-purpose 在 roster 撞名时会错省)。缺省空集=恒省略。 */
     knownAgentTypes?: ReadonlySet<string>;

package/dist/parked-decide.js

@@ -2,6 +2,7 @@ import { readRunParks } from "./orchestration/workflow-agent-session-index.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
+import { sameSessionOccupant } from "./session-incarnation.js";
 export async function findParkOrigin(sources, cp) {
     if (sources.agentStore !== undefined) {
         let match;
@@ -135,6 +136,16 @@ export function planWorkflowParkedDecide(origin, req) {
             `agent; completed steps replay from the journal. Do not re-issue the original call.`,
     };
 }
+function sessionGone(taskId) {
+    return {
+        status: 409,
+        body: {
+            error: "the session this agent belongs to was deleted (or deleted and started again under the same id) while its approval waited, so the approval no longer applies — nothing was resumed",
+            errorCode: "decide.not_parked",
+            taskId,
+        },
+    };
+}
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? (row.rootSessionId ?? row.parentSessionId) : undefined;
@@ -148,9 +159,14 @@ export async function decideParkedAgent(deps, req, match) {
     if (row.name === undefined) {
         return { status: 409, body: { error: "parked row carries no agent name — the revive path requires a named agent (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
     }
+    const root = row.rootSessionId;
+    if (root === undefined) {
+        return { status: 409, body: { error: "this agent's row carries no root session anchor — the revive path cannot tell which session this approval belongs to (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
+    }
+    const faceBefore = await deps.sessionFaceOf(root);
+    if (faceBefore === undefined)
+        return sessionGone(match.handle);
     const inheritedGate = deps.rebuildInheritedGate ? await deps.rebuildInheritedGate(row, { principal: decodeCheckpointScope(req.scope) }) : undefined;
-    const rootOwner = row.rootSessionId !== undefined && deps.sessionOwnerOf ? await deps.sessionOwnerOf(row.rootSessionId) : undefined;
-    const surface = deps.reviveSurface(row, { principal: decodeCheckpointScope(req.scope), ...(rootOwner !== undefined ? { rootOwner } : {}) });
     const stores = { agentStore: deps.agentStore, checkpointStore: deps.checkpointStore };
     const claim = await deps.registry.claimParkedAgent(stores, match.handle, { scope: row.scope, owner: row.owner });
     if (!claim.ok) {
@@ -167,6 +183,44 @@ export async function decideParkedAgent(deps, req, match) {
         }
     }
     const ticket = claim.ticket;
+    const quietWarn = (event, fields) => {
+        try {
+            deps.warn?.(event, fields);
+        }
+        catch {
+        }
+    };
+    const rollback = async (why) => {
+        try {
+            const disp = await deps.registry.rollbackParkedClaim(stores, ticket);
+            quietWarn("parked_decide_rolled_back", { taskId: match.handle, why, disposition: disp });
+            return disp;
+        }
+        catch (e) {
+            quietWarn("parked_decide_rollback_failed", { taskId: match.handle, why, error: e instanceof Error ? e.message : String(e) });
+            return "retry";
+        }
+    };
+    let faceAfter;
+    try {
+        faceAfter = await deps.sessionFaceOf(root);
+    }
+    catch (e) {
+        await rollback("session_face_unreadable");
+        throw e;
+    }
+    if (!sameSessionOccupant(faceBefore, faceAfter)) {
+        await rollback("session_occupant_changed");
+        return sessionGone(match.handle);
+    }
+    let surface;
+    try {
+        surface = deps.reviveSurface(row, { principal: decodeCheckpointScope(req.scope), root: { before: faceBefore, after: faceAfter } });
+    }
+    catch (e) {
+        await rollback("revive_surface_threw");
+        throw e;
+    }
     try {
         await req.onDecideCommitted?.();
     }
@@ -193,24 +247,6 @@ export async function decideParkedAgent(deps, req, match) {
             },
         },
     };
-    const quietWarn = (event, fields) => {
-        try {
-            deps.warn?.(event, fields);
-        }
-        catch {
-        }
-    };
-    const rollback = async (why) => {
-        try {
-            const disp = await deps.registry.rollbackParkedClaim(stores, ticket);
-            quietWarn("parked_decide_rolled_back", { taskId: match.handle, why, disposition: disp });
-            return disp;
-        }
-        catch (e) {
-            quietWarn("parked_decide_rollback_failed", { taskId: match.handle, why, error: e instanceof Error ? e.message : String(e) });
-            return "retry";
-        }
-    };
     defaultSubagentTailBus.forgetHandle(match.handle);
     let receipt;
     try {

package/dist/parked-revive-surface.d.ts

@@ -11,10 +11,13 @@
  *    给那个会话的 run 组 `spec.tools` 的同一只工厂、同一个会话分区(任务清单店 `taskListStoreFor(root)` 与领队那一张是同一张;
  *    多租户的 WebFetch 过滤同样生效 ⇒ 子代同样拿不到)。座 = `(t) => tools.includes(t)`(身份判:同名副本不算)。
  *  · **禁**用 boot 期单例填座:那只 bundle 没有会话,它的任务清单是一张私有表 —— 填了座,每个会话 / 租户的复活队友都会共用它。
- *  · **根会话现在还属于这张卡的租户**才填座(codex r1 [high]):任务清单店只按会话 id 分区,而会话 id 由调用方自选、删后可被别人重领 ——
- *    根会话删了(或换了主人)之后赎回一张旧卡,按 id 重解出来的是**新主人**的清单。属主读数由赎回腿在 claim 前读(`identity.rootOwner`,
- *    读自会话属主面;缺席 = 会话已不在 / 读不出),与卡的权威 principal 逐字相等才填;否则不交座(fail-closed:子代不继承,继承工具上的
- *    allow 回 422、审批待决,deny 照结)。根删除时把子孙的 parked 卡一并围栏 / 过期 = 另车(会话化身轴,[ref] 同族)。
+ *  · **根会话现在还是这张卡的那一位住客**才填座(codex r1 [high] + S-790 加严):任务清单店只按会话 id 分区,而会话 id 由调用方自选、
+ *    删后可被别人(或同一个人)重领 —— 根会话删了(或删了重建)之后赎回一张旧卡,按 id 重解出来的是**下一位住客**的清单。判据两条都要:
+ *    ① 根会话的属主与卡的权威 principal 逐字相等;② 赎回腿 claim 前 / 后两次读到的是**同一位住客**(化身逐字相等,
+ *    `session-incarnation.ts` 的 `sameSessionOccupant`)—— 只比属主比不出「同一个人删了重建」。任一条不成立 / 读数缺席 ⇒ 不交座
+ *    (fail-closed:子代不继承,继承工具上的 allow 回 422、审批待决,deny 照结)。赎回腿自己在两次读不一致时整条拒(`409 decide.not_parked`),
+ *    这里的第 ② 条是同一条事实在交座这一处的判据(规则只写在这里,腿只负责读两次)。根删除时把子孙的 parked 卡一并作废 = S-790 件 B
+ *    (`boot/session-faces.ts` 的删除协调器)。
  *  · 只对**一层**行填座(`rootSessionId` 在场且 = `parentSessionId`:派它的 run 就是根会话的 run,列表正是那个 run 的挂载)。更深的行
  *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 用 boot 期那只裸 Agent、无座 = core 的 fail-closed 臂;
  *    行上带继承组成是 core #1112(7.32.x)的半场,到货再改读行。
@@ -23,6 +26,7 @@
  */
 import { type BackgroundAgentRecord, type ToolSpec } from "@sema-agent/core";
 import type { Scenario } from "./capabilities/scenarios.js";
+import { type SessionFace } from "./session-incarnation.js";
 /** 一次赎回用的面:驱动的 Agent 工具 + (一层行时)与它同出一张列表的继承座。 */
 export interface ParkedReviveSurface {
     readonly reviveTool: ToolSpec;
@@ -30,12 +34,15 @@ export interface ParkedReviveSurface {
     readonly mountsCallerTool?: (tool: ToolSpec) => boolean;
 }
 /**
- * 按行解析赎回面的入参身份:`principal` = 权威 principal(取 checkpoint 的 scope 列,不取行上有损的 `row.scope`);`rootOwner` = 行的根会话
- * **现在**的属主(赎回腿在 claim 前读会话属主面;`null` = 匿名会话,缺席 = 会话已不在 / 读不出 / 本部署无属主面)。
+ * 按行解析赎回面的入参身份:`principal` = 权威 principal(取 checkpoint 的 scope 列,不取行上有损的 `row.scope`);`root` = 赎回腿对行的
+ * 根会话读到的两次会话面(claim 之前 / 之后;属主 `null` = 匿名会话)。缺席 = 没有读数 ⇒ 不交座。
  */
 export interface ParkedReviveSurfaceIdentity {
     readonly principal: string | undefined;
-    readonly rootOwner?: string | null;
+    readonly root?: {
+        readonly before: SessionFace;
+        readonly after: SessionFace;
+    };
 }
 /** 按行解析赎回面。 */
 export type ParkedReviveSurfaceFactory = (row: BackgroundAgentRecord, identity: ParkedReviveSurfaceIdentity) => ParkedReviveSurface;

package/dist/parked-revive-surface.js

@@ -1,4 +1,5 @@
 import { DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
+import { sameSessionOccupant } from "./session-incarnation.js";
 const agentOf = (tools) => tools.find((t) => t.name === DEFAULT_SUBAGENT_TOOL_NAME);
 export function createParkedReviveSurface(defaultScenario) {
     const bootTool = agentOf(defaultScenario({}).tools);
@@ -8,7 +9,10 @@ export function createParkedReviveSurface(defaultScenario) {
         const root = row.rootSessionId;
         if (root === undefined || row.parentSessionId !== root)
             return { reviveTool: bootTool };
-        if (identity.rootOwner === undefined || (identity.rootOwner ?? undefined) !== identity.principal)
+        const face = identity.root;
+        if (face === undefined || !sameSessionOccupant(face.before, face.after))
+            return { reviveTool: bootTool };
+        if ((face.before.owner ?? undefined) !== identity.principal || (face.after.owner ?? undefined) !== identity.principal)
             return { reviveTool: bootTool };
         const tools = defaultScenario({}, identity.principal, { sessionId: root }).tools;
         const reviveTool = agentOf(tools);

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,3 +1,4 @@
+import type { Logger } from "../observability/logger.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { AskRow, AskTerminalClaimIntent, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /** 数据根下的目录名。**按店命名**,与兄弟 File 店同规(`approval-nonces` / `approval-ask-audit` /
@@ -120,7 +121,9 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
      *
      * @param root local 数据根(= `LocalBackend` 的 `FileStorageBackend.root`,零新 env)。
      */
-    constructor(root: string);
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
     /**
      * 内核的钟。窗口外读 ⇒ **抛**(不静默回落 `Date.now()`):窗口外的读数按定义不在账本上,重放会得出
      * 另一个时间戳 —— 那是一条**静默**的重放分岔,而本店的全部价值就是重放等价。今天内核的五个读钟点

package/dist/plugins/approval-ask-store-file.js

@@ -1,7 +1,7 @@
 import { closeSync, copyFileSync, openSync, readSync, statSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { AppendLog, atomicWriteFile, ensureDir, readJsonlRecords } from "@sema-agent/core";
-import { createSkippedRecordSink } from "../observability/corrupt-read-seat.js";
+import { AppendLog, atomicWriteFile, ensureDir } from "@sema-agent/core";
+import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { InMemoryApprovalAskStore, encodeDecideUpdatedInput, encodeStoreJsonPayload } from "./approval-ask-store-memory.js";
@@ -26,6 +26,10 @@ const JOURNAL_OP_WORDS = new Set(JOURNAL_OPS);
 export const JOURNAL_OP_TABLE_GATE = true;
 const JOURNAL_V1_CLAIM_INTENTS = ["expire", "cancel"];
 const JOURNAL_V1_CLAIM_INTENT_WORDS = new Set(JOURNAL_V1_CLAIM_INTENTS);
+const ASK_JOURNAL_SHAPE = {
+    what: "approval-ask journal record",
+    read: (record) => record,
+};
 function endsAtRecordBoundary(path) {
     const size = statSync(path).size;
     if (size === 0)
@@ -50,7 +54,7 @@ export class FileApprovalAskStore {
     replayRejectedCount = 0;
     corruptLineCount = 0;
     corruptQuarantinePath;
-    constructor(root) {
+    constructor(root, opts) {
         const dir = join(root, APPROVAL_ASK_DIR);
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
@@ -58,10 +62,8 @@ export class FileApprovalAskStore {
         this.path = join(dir, APPROVAL_ASK_JOURNAL_FILE);
         this.core = new InMemoryApprovalAskStore({ now: () => this.clockRead() });
         const tornTail = existsSync(this.path) && !endsAtRecordBoundary(this.path);
-        const records = readJsonlRecords(this.path, createSkippedRecordSink((info) => {
-            this.corruptLineCount += 1;
-            recordFailOpen("server.approval-ask-journal.corrupt-record-skipped", `path=${info.path} reason=${info.reason}`);
-        }));
+        const { records, skipped } = replayJsonlSkipping(this.path, "approval-ask-journal", ASK_JOURNAL_SHAPE, opts?.warn);
+        this.corruptLineCount = skipped;
         for (const rec of records)
             this.replayRecord(rec);
         this.records = records.length;
@@ -127,11 +129,6 @@ export class FileApprovalAskStore {
         this.records = lines.length;
     }
     replayRecord(raw) {
-        if (raw === null || typeof raw !== "object") {
-            this.corruptLineCount += 1;
-            recordFailOpen("server.approval-ask-journal.corrupt-record-skipped", `path=${this.path} reason=record is not an object`);
-            return;
-        }
         const probe = raw;
         const refuse = (why) => {
             throw new StoreBootRefusalError(`FileApprovalAskStore: approval ask journal ${this.path} carries a record this build cannot replay — ${why} ` +

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -270,6 +270,10 @@ export declare function assertIntegralEpochMs(field: string, value: number): voi
 export declare function assertIdempotencyKeyShape(key: string): void;
 /** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
 export declare const MAX_SETTLED_BY_CHARS = 16;
+/** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 形门 ① 的**谓词本身**,店门口
+ *  ({@link assertDecideSettledBy})与耐久 ask 回决口的 CAS 前体门(S-843:确定的体形错误拒成 400,不落进提交歧义臂)
+ *  读同一只,尺不抄第二份。 */
+export declare function settledByFitsColumn(v: string): boolean;
 /**
  * S-558 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
  * 判的是**形**,不是**词** —— 词表属主恒是 core(`resolveAsk` 对自报词表外的值是响亮 fail-closed deny),

package/dist/plugins/approval-ask-store-sql.js

@@ -14,11 +14,14 @@ export function assertIdempotencyKeyShape(key) {
     }
 }
 export const MAX_SETTLED_BY_CHARS = 16;
+export function settledByFitsColumn(v) {
+    return v.length > 0 && v.length <= MAX_SETTLED_BY_CHARS;
+}
 export function assertDecideSettledBy(decision) {
     const v = decision.settledBy;
     if (v === undefined)
         return;
-    if (v.length === 0 || v.length > MAX_SETTLED_BY_CHARS) {
+    if (!settledByFitsColumn(v)) {
         throw new Error(`invalid settledBy: the settlement source is one word from the engine's closed set and lands in a VARCHAR(${MAX_SETTLED_BY_CHARS}) column — must be 1-${MAX_SETTLED_BY_CHARS} chars (got ${JSON.stringify(v.slice(0, 32))}${v.length > 32 ? "…" : ""}, length ${v.length})`);
     }
     if (decision.decision !== "deny") {

package/dist/plugins/approval-exemption-store.d.ts

@@ -1,5 +1,6 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
+import type { Logger } from "../observability/logger.js";
 export interface ApprovalExemptionRow {
     toolName: string;
     grantedBy: string | null;
@@ -43,11 +44,30 @@ export declare class MemoryApprovalExemptionStore implements ApprovalExemptionSt
     revoke(sessionId: string, toolName: string): Promise<boolean>;
     deleteBySession(sessionId: string): Promise<number>;
 }
+/**
+ * 🔴 S-582 —— **fail-closed per session file.** A record in the MIDDLE of a session's log that cannot be read (bit rot,
+ * a hand edit, a line `42`, an object missing `toolName`) used to be skipped silently. When that line was a REVOKE
+ * tombstone, the grant before it survived the replay: a "don't ask again" the operator had revoked came back and the
+ * tool ran WITHOUT asking — the fail-open direction on the approval axis. We cannot tell which fact the line held, so
+ * the replay owner (`observability/corrupt-read-seat.ts`, seat `approval-exemption`) discloses it and closes that
+ * file's gate: `has` / `list` / `grant` / `revoke` for THAT session reject with `JsonlStoreCorruptError`, and every
+ * consumer already treats a rejected `has` as "not exempt" (ask anyway). Other sessions are untouched (one file = one
+ * session's facts). `deleteBySession` is NOT gated: right-to-delete must not be blocked by a bad byte, and deleting
+ * the file is exactly the remedy — it clears the gate with the file.
+ */
 export declare class FileApprovalExemptionStore implements ApprovalExemptionStore {
     private readonly dir;
     private readonly bySession;
     private readonly logs;
-    constructor(root: string);
+    /** S-582: sanitized session key → that session log's gate (only files that replayed a bad record are listed). */
+    private readonly corruptGates;
+    private readonly warn;
+    /** @param opts.warn corrupt-read disclosure seat (`LocalBackend` wires `discloseWarn`; absent ⇒ the owner falls back to `console.warn`, never to silence). */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
+    /** S-582: first line of every judging / appending method (see the class note). */
+    private assertUsable;
     private pathFor;
     /** Replay every session log (torn-tail-safe; last-wins with revoke tombstones). Index keyed by the SANITIZED id. */
     private hydrate;

package/dist/plugins/approval-exemption-store.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { existsSync, readdirSync, rmSync } from "node:fs";
-import { AppendLog, ensureDir, readJsonlRecords, sanitizePathComponent } from "@sema-agent/core";
+import { AppendLog, ensureDir, sanitizePathComponent } from "@sema-agent/core";
+import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 export class TiDBApprovalExemptionStore {
     pool;
     constructor(pool) {
@@ -98,15 +99,36 @@ export class MemoryApprovalExemptionStore {
         return n;
     }
 }
+const EXEMPTION_RECORD_SHAPE = {
+    what: "approval-exemption record without a string toolName (or with a mistyped revoked / grantedBy / ts)",
+    read(record) {
+        const { toolName, revoked, grantedBy, ts } = record;
+        if (typeof toolName !== "string")
+            return undefined;
+        if (!(revoked === undefined || typeof revoked === "boolean"))
+            return undefined;
+        if (!(grantedBy === undefined || grantedBy === null || typeof grantedBy === "string"))
+            return undefined;
+        if (!(ts === undefined || typeof ts === "string"))
+            return undefined;
+        return { toolName, grantedBy: grantedBy ?? null, ts: ts ?? "", ...(revoked !== undefined ? { revoked } : {}) };
+    },
+};
 export class FileApprovalExemptionStore {
     dir;
     bySession = new Map();
     logs = new Map();
-    constructor(root) {
+    corruptGates = new Map();
+    warn;
+    constructor(root, opts) {
         this.dir = join(root, "approval-exemptions");
+        this.warn = opts?.warn;
         ensureDir(this.dir);
         this.hydrate();
     }
+    assertUsable(key) {
+        this.corruptGates.get(key)?.assertUsable();
+    }
     pathFor(sessionId) {
         return join(this.dir, `${sanitizePathComponent(sessionId)}.jsonl`);
     }
@@ -122,13 +144,13 @@ export class FileApprovalExemptionStore {
             if (!name.endsWith(".jsonl"))
                 continue;
             const key = name.slice(0, -".jsonl".length);
-            const records = readJsonlRecords(join(this.dir, name));
+            const { records, gate } = replayJsonlGuarded(join(this.dir, name), "approval-exemption", EXEMPTION_RECORD_SHAPE, this.warn);
+            if (gate.tripped)
+                this.corruptGates.set(key, gate);
             if (!records.length)
                 continue;
             const m = this.bySession.get(key) ?? new Map();
             for (const r of records) {
-                if (!r || typeof r.toolName !== "string")
-                    continue;
                 if (r.revoked) {
                     m.delete(r.toolName);
                 }
@@ -154,6 +176,7 @@ export class FileApprovalExemptionStore {
     }
     async grant(sessionId, toolName, grantedBy) {
         const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
         this.logFor(sessionId).append({ toolName, grantedBy: grantedBy ?? null, ts: new Date().toISOString() }, true);
         let m = this.bySession.get(key);
         if (!m) {
@@ -164,10 +187,14 @@ export class FileApprovalExemptionStore {
         m.set(toolName, { grantedBy, createdAt: prior?.createdAt ?? Date.now() });
     }
     async has(sessionId, toolName) {
-        return this.bySession.get(sanitizePathComponent(sessionId))?.has(toolName) ?? false;
+        const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
+        return this.bySession.get(key)?.has(toolName) ?? false;
     }
     async list(sessionId) {
-        const m = this.bySession.get(sanitizePathComponent(sessionId));
+        const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
+        const m = this.bySession.get(key);
         if (!m)
             return [];
         return [...m.entries()]
@@ -176,6 +203,7 @@ export class FileApprovalExemptionStore {
     }
     async revoke(sessionId, toolName) {
         const key = sanitizePathComponent(sessionId);
+        this.assertUsable(key);
         const m = this.bySession.get(key);
         if (!m?.has(toolName))
             return false;
@@ -200,6 +228,7 @@ export class FileApprovalExemptionStore {
                 throw new Error(`approval-exemption purge failed for ${sessionId}: ${e instanceof Error ? e.message : String(e)}`);
         }
         this.bySession.delete(key);
+        this.corruptGates.delete(key);
         return removed;
     }
     dispose() {

package/dist/plugins/approval-nonce-store.d.ts

@@ -1,6 +1,7 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
+import type { Logger } from "../observability/logger.js";
 /** 表名(单数形;`test/schema-naming-invariants.test.ts` 的闭集词表钉着)。 */
 export declare const APPROVAL_NONCE_TABLE = "approval_nonce";
 /**
@@ -71,7 +72,15 @@ export declare class MemoryApprovalNonceStore implements ApprovalNonceStore {
  *
  * 崩溃语义:`append` 走 fsync。丢一条记录 = 那个 nonce 在它剩下的 TTL 里可被重放一次(与「整台副本重启」
  * 的既有暴露同级,且 SQL 车道不受此影响);**绝不**能出现的是反向 —— 记录还在却被读成不在,那要靠
- * `readJsonlRecords` 的断尾安全(半行丢弃)兜住。
+ * core JSONL 读法的断尾安全(半行丢弃)兜住。
+ *
+ * 🔴 **S-582:中间一行读不出 ⇒ 整本拒用(fail-closed)**。撕尾是崩溃的正常形(core 丢弃且不报);而**中间**
+ * 那一行读不出(位腐 / 手改 / 一行 `42` / 缺键的对象)时,我们不知道它是哪一只 nonce —— 修前静默跳过它,等于
+ * 让那只已消费的证明再被受理一次(S-280 要关的重放洞换了个入口)。现在由属主披露(`approval_nonce_corrupt_read`)
+ * 并合上 {@link gate}:`consume` / `reapExpired` 第一行即带码拒(`JsonlStoreCorruptError`,外层答 500);`nowMs` 不读账、
+ * 不经闸。清扫同样要拒:压实会把幸存者原样写回、把坏行连同证据一起抹掉,下一次重启读到的就是一本「干净」的账 ——
+ * 闸自己打开,而那只 nonce 仍然没被记住。出路在拒绝句里(移开文件的代价与安全时机)。
+ * 代价如实:这台 local 机器上直连门的 plan_review 在有人处置之前全部 500(`/decide` 不经本店,不受影响)。
  */
 export declare class FileApprovalNonceStore implements ApprovalNonceStore {
     private readonly path;
@@ -80,7 +89,12 @@ export declare class FileApprovalNonceStore implements ApprovalNonceStore {
      *  从复合键里**解析**出来是一条没必要的反向铸形 —— 记录留着就不必解析。 */
     private readonly rows;
     private log;
-    constructor(root: string);
+    /** S-582:本账的损坏闸(见类注)。 */
+    private readonly gate;
+    /** @param opts.warn 腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 属主退回 `console.warn`,不退回沉默)。 */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
     private logFor;
     /** local 车道:店 = 这台机器上的这个数据根,所以店钟就是本进程的墙钟(理由同 Memory 腿)。 */
     nowMs(): Promise<number>;

package/dist/plugins/approval-nonce-store.js

@@ -1,7 +1,8 @@
 import { join } from "node:path";
-import { atomicWriteFile, ensureDir, readJsonlRecords, AppendLog } from "@sema-agent/core";
+import { atomicWriteFile, ensureDir, AppendLog } from "@sema-agent/core";
 import { mysqlDriver, pgDriver, sqlDbNowMs, SQL_DB_NOW_MS } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
+import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 export const APPROVAL_NONCE_TABLE = "approval_nonce";
 export const MAX_APPROVAL_NONCE_CHARS = 190;
 export class SqlApprovalNonceStore {
@@ -66,22 +67,29 @@ export class MemoryApprovalNonceStore {
         return n;
     }
 }
+const NONCE_RECORD_SHAPE = {
+    what: "approval-nonce record without a string s / string n / numeric e",
+    read(record) {
+        const { s, n, e } = record;
+        return typeof s === "string" && typeof n === "string" && typeof e === "number" ? { s, n, e } : undefined;
+    },
+};
 export class FileApprovalNonceStore {
     path;
     tmpDir;
     rows = new Map();
     log;
-    constructor(root) {
+    gate;
+    constructor(root, opts) {
         const dir = join(root, "approval-nonces");
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
         ensureDir(this.tmpDir);
         this.path = join(dir, "consumed.jsonl");
-        for (const r of readJsonlRecords(this.path)) {
-            if (!r || typeof r.s !== "string" || typeof r.n !== "string" || typeof r.e !== "number")
-                continue;
-            this.rows.set(keyOf(r.s, r.n), { s: r.s, n: r.n, e: r.e });
-        }
+        const { records, gate } = replayJsonlGuarded(this.path, "approval-nonce", NONCE_RECORD_SHAPE, opts?.warn);
+        this.gate = gate;
+        for (const r of records)
+            this.rows.set(keyOf(r.s, r.n), r);
     }
     logFor() {
         return (this.log ??= new AppendLog(this.path));
@@ -90,6 +98,7 @@ export class FileApprovalNonceStore {
         return Date.now();
     }
     async consume(sessionId, nonce, expiresAtMs) {
+        this.gate.assertUsable();
         const k = keyOf(sessionId, nonce);
         if (this.rows.has(k))
             return false;
@@ -99,6 +108,7 @@ export class FileApprovalNonceStore {
         return true;
     }
     async reapExpired() {
+        this.gate.assertUsable();
         const nowMs = await this.nowMs();
         const survivors = [];
         let removed = 0;

package/dist/plugins/caching-session-store.d.ts

@@ -3,6 +3,7 @@ import type { SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import type { InstructionSourceStore } from "../instruction-source-notice.js";
+import type { SessionFaceReader } from "../session-incarnation.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
@@ -37,6 +38,10 @@ export declare class CachingSessionStore implements SessionStore {
     private readonly timer?;
     /** Delegated tenant-ownership ops, present only if the inner store exposes them (the TiDB store does). */
     readonly ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
+    /** S-790:属主 + 化身一次读,纯转发(不经暖缓存 —— 化身判的就是「此刻坐在座位上的是谁」,缓存的旧答案正是要消灭的那一形)。
+     *  🔴 必须转发(与 retention / placements / instruction-source 同一条教训):生产默认把真店包进本类,不转发 = parked 决定腿
+     *  与记忆座在默认部署上读不到化身。 */
+    readonly sessionFaceOf?: SessionFaceReader;
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */

package/dist/plugins/caching-session-store.js

@@ -6,6 +6,7 @@ export class CachingSessionStore {
     ttlMs;
     timer;
     ownerOf;
+    sessionFaceOf;
     register;
     listSessions;
     fork;
@@ -45,6 +46,8 @@ export class CachingSessionStore {
         const ownerAware = inner;
         if (ownerAware.ownerOf)
             this.ownerOf = ownerAware.ownerOf.bind(inner);
+        if (ownerAware.sessionFaceOf)
+            this.sessionFaceOf = ownerAware.sessionFaceOf.bind(inner);
         if (ownerAware.register)
             this.register = ownerAware.register.bind(inner);
         if (ownerAware.listSessions)

package/dist/plugins/file-resume-anchor-store.d.ts

@@ -1,13 +1,18 @@
+import type { Logger } from "../observability/logger.js";
 export declare class FileResumeAnchorStore {
     private readonly dir;
     /** sessionId → (eventId → {entryId, owner}) — the same in-memory shape MemoryResumeAnchorStore holds, hydrated on ctor. */
     private readonly bySession;
     /** sessionId → the open append log (one O_APPEND fd per session, lazily opened on first put, held for lifetime). */
     private readonly logs;
-    constructor(root: string);
+    private readonly warn;
+    /** @param opts.warn corrupt-read disclosure seat (S-582; absent ⇒ the replay owner falls back to `console.warn`). */
+    constructor(root: string, opts?: {
+        warn?: Logger["warn"];
+    });
     /** `<dir>/<sanitizePathComponent(sessionId)>.jsonl` — the per-session log path (sessionId is uuidv7, already safe). */
     private pathFor;
-    /** Replay every session log into the in-memory index on boot (torn-tail-safe via readJsonlRecords; last-wins upsert
+    /** Replay every session log into the in-memory index on boot (torn-tail-safe via the replay owner; last-wins upsert
      *  so a re-stamped eventId reflects the latest appended record). The in-memory index is keyed by the SANITIZED
      *  sessionId throughout (put/resolve/list/delete all sanitize), and each on-disk file's base name IS
      *  `sanitizePathComponent(sessionId)` — so the index key is just the file base, with no de-sanitize needed. */