@sema-agent/server 7.103.2 → 7.105.0

package/dist/plugins/memory-run-store.d.ts

@@ -55,10 +55,12 @@ export declare class MemoryRunStore {
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
-    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
-    setSuspended(taskId: string): Promise<void>;
-    /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */
-    setNeedsReview(taskId: string): Promise<void>;
+    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard).
+     *  S-173:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。 */
+    setSuspended(taskId: string, result: PersistedTaskResult | null): Promise<void>;
+    /** [ref] D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review.
+     *  S-173:同 {@link setSuspended} 落封口脱敏后的 `result`。 */
+    setNeedsReview(taskId: string, result: PersistedTaskResult | null): Promise<void>;
     /** Durable F4 resume: flip suspended/needs_review → running (CAS) + reset cancel/preempt flags.
      *  [ref](codex R1 [medium]):认领 = 接管 `instanceId`(= 当前持有副本;SQL 孪生同注)。CAS 输不改。 */
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
@@ -124,7 +126,7 @@ export declare class MemoryRunStore {
     /** Fail stale `running` rows (crashed-run backstop) + release task_active for any now-terminal row. */
     reapStale(olderThanMs: number): Promise<number>;
     /** [ref] shared tail of both suspended-run reapers: flip one parked row → failed('approval.expired'), the
-     *  in-memory twin of the SQL UPDATE (`error`/`error_code` set directly — no result blob to derive from). */
+     *  in-memory twin of the SQL UPDATE (`error`/`error_code` set directly — no result blob to derive from; S-173: the park-time `result` is cleared, same as the SQL `result = NULL`). */
     private failExpiredPark;
     /** Release the claim for TERMINAL rows only — suspended/needs_review keep it (the `DELETE ta … WHERE tr.status
      *  NOT IN ('running','suspended','needs_review')` twin, shared by reapStale + the [ref] suspended reapers). */

package/dist/plugins/memory-run-store.js

@@ -1,4 +1,4 @@
-import { redactErrorMessage, redactLedgerEventData, redactTerminalResult } from "../observability/run-terminal.js";
+import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
 import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
@@ -105,7 +105,7 @@ export class MemoryRunStore {
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
     async setTerminal(taskId, status, result, error) {
-        result = redactTerminalResult(result);
+        result = sealRunRowResult(result);
         error = error === null ? null : (redactErrorMessage(error) ?? null);
         const r = this.runs.get(taskId);
         if (!r) {
@@ -140,17 +140,21 @@ export class MemoryRunStore {
         if (pending)
             notifyRunTerminal(pending);
     }
-    async setSuspended(taskId) {
+    async setSuspended(taskId, result) {
+        const sealed = sealRunRowResult(result);
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "suspended")) {
             r.status = "suspended";
+            r.result = sealed;
             r.updatedAt = new Date();
         }
     }
-    async setNeedsReview(taskId) {
+    async setNeedsReview(taskId, result) {
+        const sealed = sealRunRowResult(result);
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "needs_review")) {
             r.status = "needs_review";
+            r.result = sealed;
             r.updatedAt = new Date();
         }
     }
@@ -159,6 +163,7 @@ export class MemoryRunStore {
         if (!r || (r.status !== "suspended" && r.status !== "needs_review"))
             return false;
         r.status = "running";
+        r.result = null;
         r.instanceId = instanceId;
         r.cancelRequested = false;
         r.preemptRequested = false;
@@ -292,6 +297,7 @@ export class MemoryRunStore {
         for (const r of this.runs.values()) {
             if (r.status === "running" && r.updatedAt.getTime() < cutoff) {
                 r.status = "failed";
+                r.result = null;
                 r.error = "run stalled (instance lost?)";
                 r.updatedAt = new Date();
                 reaped += 1;
@@ -302,6 +308,7 @@ export class MemoryRunStore {
     }
     failExpiredPark(r) {
         r.status = "failed";
+        r.result = null;
         r.error = "approval expired before decision";
         r.errorCode = "approval.expired";
         r.updatedAt = new Date();

package/dist/plugins/one-time-migrations.d.ts

@@ -16,8 +16,45 @@ export interface OneTimeMigrationReport {
     /** M4:`device_audit.detail` 里 JSON 文本 `null` 被改成列 NULL 的行数(表不在 ⇒ 恒 0)。
      *  非零 = 这次迁移真改写了存量字节,必须让运维看见(与 M1 的 `retiredSnapshotRows` 同一条纪律)。 */
     readonly auditDetailJsonNullRows: number;
+    /** M5:`session_meta.incarnation` 列 —— `added` = 本次 `ADD COLUMN`;`present` = 早已在(新库 / 第二跑);
+     *  `no-table` = 这只库上没有 `session_meta`(中央 DDL 之后不可达,只为不编一个读数);`lazy-on-read` = local 文件车道
+     *  (没有这张表,存量会话首读补铸)。 */
+    readonly sessionIncarnationColumn: "added" | "present" | "no-table" | "lazy-on-read";
+    /** M5:本次给空化身铸了令牌的行数。非零 = 这次迁移真写了存量行,必须让运维看见(与 M4 同一条纪律)。 */
+    readonly sessionIncarnationsBackfilled: number;
 }
-/** 三条迁移都不适用的载体(local 车道没有 SQL 表)。 */
+/**
+ * S-590 —— 一条一次性迁移的窗(登记表的一行;纯数据)。字段注写着每个值的取证方式,改一行之前照着重核。
+ * 规则(窗长 30 天、窗关后的第一个 minor 删码、门怎么判)在本文件头注「窗」一节,只写那一次。
+ */
+export interface OneTimeMigrationWindow {
+    /** 本文件里的条目名(头注「四条迁移」的 M1…M4)。 */
+    readonly id: string;
+    /** 引入这条迁移的版本 = 第一只含其代码的发布 tag(取证:`git log -S '<该条的常量名>' -- src/plugins/one-time-migrations.ts`
+     *  找引入提交 → `git tag --contains <提交> --sort=creatordate` 取最早)。 */
+    readonly introducedIn: string;
+    /** 该版本在 npm 上的发布日,UTC 日历日 YYYY-MM-DD(取证:`npm view @sema-agent/server time`)。`null` = **未发布形**:引入它的
+     *  那一版还没发布,由抬 `package.json` 到那一版的发布准备提交回填(规则见文件头「窗」一节;键必须显式写,缺席 ⇒ 到期门红)。 */
+    readonly releasedOn: string | null;
+    /** = `releasedOn` + 30 天(UTC 日历日;到期门逐条核这条等式)。今天晚于它 ⇒ 到期门红,删码排进其后第一个 minor。
+     *  与 `releasedOn` 同为 `null`(未发布形,不计到期)或同为日期。 */
+    readonly removableAfter: string | null;
+    /** 删码时删什么(到期门的红句逐字引用)。 */
+    readonly removal: string;
+    /** 删码之后,存量库若还带着迁移前的形,由哪一条**既有**响亮臂接住;没有就如实写没有(不为它新造兼容读)。 */
+    readonly afterRemoval: string;
+    /** 本条在 {@link OneTimeMigrationReport} 里的读数键 —— 报告的每个键恰属一条(到期门核:新迁移不登记 ⇒ 红)。 */
+    readonly reportKeys: readonly (keyof OneTimeMigrationReport)[];
+}
+/**
+ * 🔴 S-590 —— 一次性迁移登记表,本文件各条的窗的**唯一属主**。别处(接口 JSDoc、调用点、DDL 注、部署文档)只写「窗口见
+ * `plugins/one-time-migrations.ts` 登记表」;起动日志行 `one_time_migrations_applied` 的 `removableAfter` 读数由本表派生。
+ *
+ * M1–M3 同一次删:M3 的「本版在这只库上跑过了」标记就是 M1 / M2 的退役 schema 在不在(头注「幂等」一节),先删 M1 / M2
+ * 而留着 M3 会让 M3 永远判「跑过了」。三条同版引入、同一天到期,本来就同一次删。
+ */
+export declare const ONE_TIME_MIGRATIONS: readonly OneTimeMigrationWindow[];
+/** local 车道上 SQL 独有的四条(M1 / M2 / M4 / M5)的读数:那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
 export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "askOriginRowsMigrated">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {

package/dist/plugins/one-time-migrations.js

@@ -1,12 +1,76 @@
 import { acquireEnsureSchemaLock, releaseEnsureSchemaLock } from "./tidb-pool.js";
 import { acquirePgEnsureSchemaLock, releasePgEnsureSchemaLock } from "./pg-pool.js";
 import { jsonColumnTextExpr } from "./sql-json-column.js";
+import { SESSION_META_INCARNATION_COLUMN, mintSessionIncarnation } from "../session-incarnation.js";
+export const ONE_TIME_MIGRATIONS = [
+    {
+        id: "M1",
+        introducedIn: "7.74.0",
+        releasedOn: "2026-09-13",
+        removableAfter: "2026-10-13",
+        removal: "删 migrateOn 的 M1 步(`snapshot_manifest` 在场探针、删前计数、`DROP TABLE`)与 `RETIRED_SNAPSHOT_TABLE`;报告、日志行与 " +
+            "`NO_SQL_MIGRATIONS` 的 `retiredSnapshotTable` / `retiredSnapshotRows`;与 M2 / M3 同一次删(见本表头注)",
+        afterRemoval: "没有响亮臂:存量库里的 `snapshot_manifest` 成一张无人读写的孤儿表 —— 它的读腿(边界探针)已随 core 7.17.0 的 seam 退役删掉," +
+            "起服列册探针 `schema-consistency.ts` 只对账代码认识的表。只有从 7.73.x 及更早直接跳到删码版的库会遇到;不影响任何读腿," +
+            "运维可手工 `DROP TABLE snapshot_manifest`",
+        reportKeys: ["retiredSnapshotTable", "retiredSnapshotRows"],
+    },
+    {
+        id: "M2",
+        introducedIn: "7.74.0",
+        releasedOn: "2026-09-13",
+        removableAfter: "2026-10-13",
+        removal: "删 migrateOn 的 M2 拒启臂与 `DROP COLUMN` 步、`RETIRED_STEER_SEAT_COLUMN`、`DELIVERABLE_STEER_SEAT_WHERE`、`RetiredSteerSeatError`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `retiredSteerSeatColumn` / `retiredSteerSeatStaleRows`;与 M1 / M3 同一次删",
+        afterRemoval: "起服列册探针 `schema-consistency.ts`(S-547)的多列臂:存量库的 `checkpoint.pending_steer` 是代码不认识的列 ⇒ 拒启 " +
+            "`config.schema_mismatch`(响亮;⚠️ 那一臂的句子说「库比代码新」,对这一形方向说反了)。运维照拒句手工删列时,列上还送得出去的 " +
+            "steering 指令随之丢失 —— 删码之后没有任何东西再替它数一遍送得出去的格",
+        reportKeys: ["retiredSteerSeatColumn", "retiredSteerSeatStaleRows"],
+    },
+    {
+        id: "M3",
+        introducedIn: "7.74.0",
+        releasedOn: "2026-09-13",
+        removableAfter: "2026-10-13",
+        removal: "删 migrateOn 的 M3 两条整表 `UPDATE` 与它的「退役 schema 还在」跳过标记、`RETIRED_ASK_ORIGIN`、`GATE_BEARING_LEDGER_EVENT_TYPE`、" +
+            "`migrateRetiredAskOrigin`,以及 local 腿(`FileRunStore.migrateRetiredAskOriginRows` 与 `LocalBackend.runOneTimeMigrations` 里那一格);" +
+            "报告与日志行的 `askOriginRowsMigrated`;与 M1 / M2 同一次删",
+        afterRemoval: "读腿既有的 `server.trace.gate-outcome-defective`(`trace/project.ts` 的 `screenedGate`):残留旧拼法的 gate 与任何集外词同判 —— " +
+            "整条 withhold + 计数 + 一次 warn(与头注「M3 够不到的一格」同一条臂)",
+        reportKeys: ["askOriginRowsMigrated"],
+    },
+    {
+        id: "M4",
+        introducedIn: "7.93.5",
+        releasedOn: "2026-09-21",
+        removableAfter: "2026-10-21",
+        removal: "删 migrateOn 的 M4 步(`device_audit` 在场探针 + `UPDATE … SET detail = NULL`)与 `AUDIT_TABLE` / `AUDIT_DETAIL_COLUMN`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `auditDetailJsonNullRows`;它若是表里最后一条,按头注「窗」一节整个文件一起删",
+        afterRemoval: "`device-store-sql.ts` `listAudit` 的读形拒(S-550:一行读不出形 ⇒ 整页拒,刻意不逐行隔离):含一行 JSON 文本 `null` 的那一页" +
+            "读不出来,拒句点名行 id —— 响亮,但那一页会一直读不出来,直到运维手工把那些行的 `detail` 置成 SQL NULL",
+        reportKeys: ["auditDetailJsonNullRows"],
+    },
+    {
+        id: "M5",
+        introducedIn: "7.104.0",
+        releasedOn: "2026-09-28",
+        removableAfter: "2026-10-28",
+        removal: "删 migrateOn 的 M5 步(`session_meta` 在场探针、`incarnation` 列在场探针 + `ADD COLUMN`、空化身回填循环)与 `backfillSessionIncarnations`;" +
+            "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `sessionIncarnationColumn` / `sessionIncarnationsBackfilled`;**列本身留在中央 DDL 里**(它不是迁移的一部分)",
+        afterRemoval: "① 列不在的存量库:起服列册探针 `schema-consistency.ts`(S-547)的缺列臂拒启 `config.schema_mismatch`,拒句里的 `ALTER TABLE … ADD COLUMN` " +
+            "由同一份 DDL 生成(响亮);② 列在但行上仍是空化身(跳过了带 M5 的版本直接升):会话店读口 `sessionFaceOf` 对那一行响亮拒 " +
+            "`session.incarnation_missing`(parked 决定腿因此拒、记忆座退回按 id 绑定并 warn)—— 运维手工给那些行填一只随机令牌即可",
+        reportKeys: ["sessionIncarnationColumn", "sessionIncarnationsBackfilled"],
+    },
+];
 export const NO_SQL_MIGRATIONS = {
     retiredSnapshotTable: "absent",
     retiredSnapshotRows: 0,
     retiredSteerSeatStaleRows: 0,
     retiredSteerSeatColumn: "absent",
     auditDetailJsonNullRows: 0,
+    sessionIncarnationColumn: "lazy-on-read",
+    sessionIncarnationsBackfilled: 0,
 };
 const RETIRED_SNAPSHOT_TABLE = "snapshot_manifest";
 const RETIRED_STEER_SEAT_COLUMN = "pending_steer";
@@ -37,24 +101,24 @@ export class RetiredSteerSeatError extends Error {
 }
 function mysqlDb(conn) {
     return {
-        async rows(sql) {
-            const [rows] = await conn.query(sql);
+        async rows(sql, params) {
+            const [rows] = params === undefined ? await conn.query(sql) : await conn.query(sql, [...params]);
             return rows;
         },
-        async exec(sql) {
-            const [r] = await conn.query(sql);
+        async exec(sql, params) {
+            const [r] = params === undefined ? await conn.query(sql) : await conn.query(sql, [...params]);
             return Number(r.affectedRows ?? 0);
         },
     };
 }
 function pgDb(client) {
     return {
-        async rows(sql) {
-            const r = await client.query(sql);
+        async rows(sql, params) {
+            const r = params === undefined ? await client.query(sql) : await client.query(sql, [...params]);
             return r.rows;
         },
-        async exec(sql) {
-            const r = await client.query(sql);
+        async exec(sql, params) {
+            const r = params === undefined ? await client.query(sql) : await client.query(sql, [...params]);
             return r.rowCount ?? 0;
         },
     };
@@ -139,6 +203,7 @@ async function migrateOn(db, dialect) {
         ? 0
         : await db.exec(`UPDATE ${AUDIT_TABLE} SET ${AUDIT_DETAIL_COLUMN} = NULL ` +
             `WHERE ${AUDIT_DETAIL_COLUMN} IS NOT NULL AND ${jsonColumnTextExpr(dialect, AUDIT_DETAIL_COLUMN)} = 'null'`);
+    const { sessionIncarnationColumn, sessionIncarnationsBackfilled } = await migrateSessionIncarnations(db, dialect);
     let retiredSnapshotTable = "absent";
     let retiredSnapshotRows = 0;
     let retiredSteerSeatColumn = "absent";
@@ -169,7 +234,64 @@ async function migrateOn(db, dialect) {
         throw new Error(`one-time migration failed AFTER completing destructive steps — record these before retrying, a retry cannot ` +
             `report them again: ${destroyed.join("; ")}. Underlying failure: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
     }
-    return { retiredSnapshotTable, retiredSnapshotRows, retiredSteerSeatColumn, retiredSteerSeatStaleRows, askOriginRowsMigrated, auditDetailJsonNullRows };
+    return {
+        retiredSnapshotTable, retiredSnapshotRows, retiredSteerSeatColumn, retiredSteerSeatStaleRows, askOriginRowsMigrated, auditDetailJsonNullRows,
+        sessionIncarnationColumn, sessionIncarnationsBackfilled,
+    };
+}
+const INCARNATION_BACKFILL_BATCH = 500;
+async function migrateSessionIncarnations(db, dialect) {
+    if (!(await tableExists(db, dialect, "session_meta")))
+        return { sessionIncarnationColumn: "no-table", sessionIncarnationsBackfilled: 0 };
+    const col = SESSION_META_INCARNATION_COLUMN;
+    let sessionIncarnationColumn = "present";
+    if (!(await columnExists(db, dialect, "session_meta", col.name))) {
+        try {
+            await db.exec(`ALTER TABLE session_meta ADD COLUMN ${dialect === "tidb" ? col.tidb : col.pg}`);
+            sessionIncarnationColumn = "added";
+        }
+        catch (e) {
+            if (!(await columnExists(db, dialect, "session_meta", col.name)))
+                throw e;
+        }
+    }
+    return { sessionIncarnationColumn, sessionIncarnationsBackfilled: await backfillSessionIncarnations(db, dialect) };
+}
+async function backfillSessionIncarnations(db, dialect) {
+    const remaining = async () => Number((await db.rows("SELECT COUNT(*) AS n FROM session_meta WHERE incarnation = ''"))[0]?.n ?? 0);
+    const initial = await remaining();
+    if (initial === 0)
+        return 0;
+    const ceiling = Math.ceil(initial / INCARNATION_BACKFILL_BATCH) * 2 + 2;
+    let written = 0;
+    let after;
+    for (let round = 0; round < ceiling; round++) {
+        const ids = (after === undefined
+            ? await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`)
+            : await db.rows(`SELECT session_id FROM session_meta WHERE incarnation = '' AND session_id > ${dialect === "pg" ? "$1" : "?"} ORDER BY session_id LIMIT ${INCARNATION_BACKFILL_BATCH}`, [after])).map((r) => String(r.session_id));
+        if (ids.length === 0) {
+            if (after === undefined)
+                return written;
+            after = undefined;
+            continue;
+        }
+        const params = [];
+        const bind = (v) => {
+            params.push(v);
+            return dialect === "pg" ? `$${params.length}` : "?";
+        };
+        const cases = ids.map((id) => `WHEN ${bind(id)} THEN ${bind(mintSessionIncarnation())}`).join(" ");
+        const inList = ids.map((id) => bind(id)).join(", ");
+        written += await db.exec(`UPDATE session_meta SET incarnation = CASE session_id ${cases} END WHERE incarnation = '' AND session_id IN (${inList})`, params);
+        after = ids.length < INCARNATION_BACKFILL_BATCH ? undefined : ids[ids.length - 1];
+    }
+    const left = await remaining();
+    if (left > 0) {
+        throw new Error(`one-time migration M5: ${left} session_meta row(s) still carry an empty incarnation after ${ceiling} backfill round(s) ` +
+            `(${written} written) — refusing to start rather than serve sessions whose occupant cannot be told apart. Retry the boot; ` +
+            `if it repeats, something keeps writing rows without an incarnation (an older replica still inserting?).`);
+    }
+    return written;
 }
 export function migrateRetiredAskOrigin(type, data) {
     if (type !== GATE_BEARING_LEDGER_EVENT_TYPE)
@@ -186,7 +308,8 @@ export function migrateRetiredAskOrigin(type, data) {
     return { ...d, gate: { ...g, origin: RETIRED_ASK_ORIGIN.to } };
 }
 export function logOneTimeMigrations(log, backend, report) {
-    const changed = report.retiredSnapshotTable === "dropped" || report.retiredSteerSeatColumn === "dropped" || report.askOriginRowsMigrated > 0 || report.auditDetailJsonNullRows > 0;
+    const changed = report.retiredSnapshotTable === "dropped" || report.retiredSteerSeatColumn === "dropped" || report.askOriginRowsMigrated > 0 || report.auditDetailJsonNullRows > 0 ||
+        report.sessionIncarnationColumn === "added" || report.sessionIncarnationsBackfilled > 0;
     (changed ? log.warn : log.info).call(log, "one_time_migrations_applied", {
         backend,
         retiredSnapshotTable: report.retiredSnapshotTable,
@@ -195,11 +318,16 @@ export function logOneTimeMigrations(log, backend, report) {
         retiredSteerSeatStaleRows: report.retiredSteerSeatStaleRows,
         askOriginRowsMigrated: report.askOriginRowsMigrated,
         auditDetailJsonNullRows: report.auditDetailJsonNullRows,
-        note: "one-time persisted-data migrations for this version's retirements (retired whole-tree snapshot index table " +
-            "dropped; retired single-seat steering column dropped; retired ask-origin spelling rewritten in place; audit " +
-            "details written as the JSON text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly " +
-            "one on-disk spelling). This " +
-            "whole migration step is removed in the next minor — start this version at least once before upgrading past it.",
+        sessionIncarnationColumn: report.sessionIncarnationColumn,
+        sessionIncarnationsBackfilled: report.sessionIncarnationsBackfilled,
+        removableAfter: Object.fromEntries(ONE_TIME_MIGRATIONS.map((w) => [w.id, w.removableAfter])),
+        note: "one-time persisted-data migrations (M1: retired whole-tree snapshot index table dropped; M2: retired single-seat " +
+            "steering column dropped; M3: retired ask-origin spelling rewritten in place; M4: audit details written as the JSON " +
+            "text `null` by an earlier version folded to a SQL NULL, so \"no detail\" has exactly one on-disk spelling; M5: the " +
+            "session incarnation column added and every session row without one minted its own token). Each step " +
+            "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
+            "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
+            "version that still carries a step at least once before upgrading past its deletion.",
     });
 }
 //# sourceMappingURL=one-time-migrations.js.map

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,6 +1,7 @@
 import { FileDurableRulePartitionProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type StaleRuleApprovalRecord } from "@sema-agent/core";
 import { type RuleImportTicket, type RuleTicketPurpose, type RuleTicketReclaimResult, type RuleTicketRedeemResult, type RuleTicketSnapshot } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
+import type { Logger } from "../observability/logger.js";
 import { type RuleCandidate } from "@sema-agent/core";
 /**
  * `RuleApprovalRecordStore` 的 File 形。
@@ -11,8 +12,10 @@ import { type RuleCandidate } from "@sema-agent/core";
 export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordStore {
     private readonly rows;
     private readonly log;
+    /** 本面的损坏闸(S-582 起由重放属主交回;置位后每个方法第一行响亮拒)。 */
     private readonly gate;
-    constructor(dir: string, onError?: (message: string) => void);
+    /** @param warn 腐读披露座(S-582;缺席 ⇒ 属主退回 `console.warn`)。 */
+    constructor(dir: string, warn?: Logger["warn"]);
     /** 取证/自证用:本面是否因内部损坏而 fail-closed。 */
     get corrupt(): boolean;
     /** 归还本面 eager 持有的日志描述符(束的 `dispose()` 唯一调用点)。`AppendLog` 上没有 finalizer,
@@ -39,10 +42,12 @@ export declare class FileRuleApprovalRecordStore implements RuleApprovalRecordSt
 export declare class FileRuleImportTicketStore {
     private readonly rows;
     private readonly log;
+    /** 本面的损坏闸(S-582 起由重放属主交回)。 */
     private readonly gate;
     /** 单调钟(判定用)。与 {@link now}(墙钟,记账用)是两只不同的钟,别混。 */
     private readonly monotonic;
-    constructor(dir: string, now?: () => number, onError?: (message: string) => void, monotonic?: () => number);
+    /** @param warn 腐读披露座(S-582;缺席 ⇒ 属主退回 `console.warn`)。 */
+    constructor(dir: string, now?: () => number, warn?: Logger["warn"], monotonic?: () => number);
     private readonly now;
     /** 取证/自证用:本面是否因内部损坏而 fail-closed。 */
     get corrupt(): boolean;
@@ -100,9 +105,11 @@ export interface FilePermissionRuleStores extends PermissionRuleStoreBundle {
  * `onError` 接的是 core 规则文件的**披露面**(读不出来 / 校验和不符 / 撞上符号链接时它答零规则并
  * 说出来)。接住它打一条 warn 是**必须**的:那条路径上「零规则」与「真的没有规则」在读面上同形,
  * 不留痕就变成一次静默的 fail-closed(用户会突然被反复询问,却没有任何线索)。
+ * `warn`(S-582)接的是本仓审批记录 / 导入票两份日志的**腐读座**(逐行披露 + 计数;缺席 ⇒ `console.warn`)。
  */
 export declare function createFilePermissionRuleStores(root: string, opts?: {
     onError?: (message: string) => void;
+    warn?: Logger["warn"];
     now?: () => number;
     monotonic?: () => number;
 }): FilePermissionRuleStores;

package/dist/plugins/permission-rule-store-file.js

@@ -2,10 +2,10 @@ import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { readdirSync } from "node:fs";
 import { performance } from "node:perf_hooks";
-import { FileDurableRulePartitionProvider, AppendLog, ensureDir, readJsonlRecords, } from "@sema-agent/core";
+import { FileDurableRulePartitionProvider, AppendLog, ensureDir, } from "@sema-agent/core";
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
-import { createSkippedRecordSink } from "../observability/corrupt-read-seat.js";
+import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 import { RULE_BEHAVIORS } from "@sema-agent/core";
 const RuleScopeSchema = z.union([
@@ -109,53 +109,44 @@ const TicketLineSchema = z.union([
     z.object({ op: z.literal("settle"), ticketId: z.string().min(1), outcome: z.unknown() }).strict(),
 ]);
 const LEGACY_TICKET_PURPOSE = "cc-import";
-class CorruptionGate {
-    face;
-    path;
-    onError;
-    reason;
-    constructor(face, path, onError) {
-        this.face = face;
-        this.path = path;
-        this.onError = onError;
-    }
-    trip(reason) {
-        this.reason ??= reason;
-        this.onError?.(`${this.face} at ${this.path} is corrupt: ${reason}`);
-    }
-    get tripped() {
-        return this.reason !== undefined;
-    }
-    assertUsable() {
-        if (this.reason === undefined)
-            return;
-        throw new Error(`refusing to use a corrupt ${this.face} (${this.path}): ${this.reason} — ` +
-            "the permission-rule lane is fail-closed until a person inspects the file (moving it aside restarts the lane with an empty log)");
-    }
-}
+const APPROVAL_LOG_SHAPE = {
+    what: "permission-rule approval line that is neither a current-form put/discard nor a pre-form put",
+    read(record) {
+        const parsed = ApprovalLineSchema.safeParse(record);
+        if (parsed.success)
+            return { kind: "line", line: parsed.data };
+        const stale = StaleApprovalLineSchema.safeParse(record);
+        if (stale.success && stale.data.record.schema !== RULE_APPROVAL_RECORD_SCHEMA)
+            return { kind: "stale", envelope: toStaleEnvelope(stale.data.record) };
+        return undefined;
+    },
+};
+const TICKET_LOG_SHAPE = {
+    what: "permission-rule import-ticket line outside the mint/consume/release/settle shapes",
+    read(record) {
+        const parsed = TicketLineSchema.safeParse(record);
+        return parsed.success ? parsed.data : undefined;
+    },
+};
 export class FileRuleApprovalRecordStore {
     rows = new Map();
     log;
     gate;
-    constructor(dir, onError) {
+    constructor(dir, warn) {
         ensureDir(dir);
         const path = join(dir, "approvals.jsonl");
-        this.gate = new CorruptionGate("permission-rule approval log", path, onError);
-        for (const raw of readJsonlRecords(path, createSkippedRecordSink((info) => this.gate.trip(info.reason)))) {
-            const parsed = ApprovalLineSchema.safeParse(raw);
-            if (!parsed.success) {
-                const stale = StaleApprovalLineSchema.safeParse(raw);
-                if (stale.success && stale.data.record.schema !== RULE_APPROVAL_RECORD_SCHEMA) {
-                    this.rows.set(stale.data.record.id, toStaleEnvelope(stale.data.record));
-                    continue;
-                }
-                this.gate.trip(`a replayed record does not carry a readable shape: ${parsed.error.message}`);
+        const { records, gate } = replayJsonlGuarded(path, "permission-rule-approvals", APPROVAL_LOG_SHAPE, warn);
+        this.gate = gate;
+        for (const entry of records) {
+            if (entry.kind === "stale") {
+                this.rows.set(entry.envelope.id, entry.envelope);
                 continue;
             }
-            if (parsed.data.op === "discard")
-                this.rows.delete(parsed.data.id);
+            const line = entry.line;
+            if (line.op === "discard")
+                this.rows.delete(line.id);
             else
-                this.rows.set(parsed.data.record.id, toApprovalRecord(parsed.data.record));
+                this.rows.set(line.record.id, toApprovalRecord(line.record));
         }
         this.log = new AppendLog(path);
     }
@@ -204,19 +195,14 @@ export class FileRuleImportTicketStore {
     log;
     gate;
     monotonic;
-    constructor(dir, now, onError, monotonic) {
+    constructor(dir, now, warn, monotonic) {
         this.now = now ?? Date.now;
         this.monotonic = monotonic ?? (() => performance.now());
         ensureDir(dir);
         const path = join(dir, "import-tickets.jsonl");
-        this.gate = new CorruptionGate("permission-rule import-ticket log", path, onError);
-        for (const raw of readJsonlRecords(path, createSkippedRecordSink((info) => this.gate.trip(info.reason)))) {
-            const parsed = TicketLineSchema.safeParse(raw);
-            if (!parsed.success) {
-                this.gate.trip(`a replayed record does not carry a readable shape: ${parsed.error.message}`);
-                continue;
-            }
-            const line = parsed.data;
+        const { records, gate } = replayJsonlGuarded(path, "permission-rule-tickets", TICKET_LOG_SHAPE, warn);
+        this.gate = gate;
+        for (const line of records) {
             if (line.op === "mint") {
                 this.rows.set(line.ticketId, {
                     ownerKey: line.ownerKey,
@@ -344,8 +330,8 @@ export function createFilePermissionRuleStores(root, opts) {
     const dir = join(root, "permission-rules");
     ensureDir(dir);
     const durable = opts?.onError ? new FileDurableRulePartitionProvider(dir, opts.onError) : new FileDurableRulePartitionProvider(dir);
-    const approvals = new FileRuleApprovalRecordStore(dir, opts?.onError);
-    const tickets = new FileRuleImportTicketStore(dir, opts?.now, opts?.onError, opts?.monotonic);
+    const approvals = new FileRuleApprovalRecordStore(dir, opts?.warn);
+    const tickets = new FileRuleImportTicketStore(dir, opts?.now, opts?.warn, opts?.monotonic);
     return {
         durable,
         approvals,

package/dist/plugins/pg-session-storage.d.ts

@@ -4,6 +4,7 @@ import type { SessionSummary } from "./store-contracts.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import { type StagingHandle } from "../session-sync-kernel.js";
 import { type InstructionSourceBaseline } from "../instruction-source-notice.js";
+import { type SessionFace } from "../session-incarnation.js";
 import { type IndexSpec } from "./ensure-index.js";
 /**
  * PG-dialect DDL for the L1 session log, translated from tidb-pool.ts SCHEMA_STATEMENTS:
@@ -80,6 +81,8 @@ export declare class PgSessionStore implements SessionStore {
     }): Promise<PlacedSessionRow[]>;
     /** Owner principal of a session, `null` if registered ownerless, `undefined` if no such session. */
     ownerOf(sessionId: string): Promise<string | null | undefined>;
+    /** S-790:属主 + 化身一次读(TiDB 孪生 {@link TiDBSessionStore.sessionFaceOf} 同义;空化身 ⇒ 响亮拒)。 */
+    sessionFaceOf(sessionId: string): Promise<SessionFace | undefined>;
     touch(sessionId: string): Promise<void>;
     /** E18 — the session's current leaf SessionTreeEntry.id (session_meta.leaf_id). @see TiDBSessionStore.getLeafId
      *  (single SELECT, no acquire/lock, cache-bypassing — safe to read mid-run for the resume-at turn-capture). */