@sema-agent/server 7.117.0 → 7.118.0

package/dist/trace/core-keyset-guard.d.ts

@@ -43,7 +43,7 @@ type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNo
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -136,7 +136,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "contentKind" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
@@ -144,11 +144,11 @@ type ParkArmKeys = keyof Extract<PendingAction, {
     kind: "tool_approval";
 }>;
 type ParkArmQueueProjected = "toolName" | "toolCallId" | "boundInputHash" | "ruleOffers" | "hasBidiControls" | keyof import("../approval-card.js").ParkRowFacts;
-type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest";
+type ParkArmQueueExcluded = "kind" | "args" | "batchToolCallIds" | "completedCallIds" | "capabilityId" | "contractId" | "shapeDigest" | "implementationRevision" | "rosterDigest" | "family" | "pathTarget" | "names" | "preview" | "previewWithheld" | "execCwd" | "denialLimitFallback" | "authoredBy" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
 type _GuardParkArmQueue = AssertAllKeysHandled<Exclude<ParkArmKeys, ParkArmQueueProjected | ParkArmQueueExcluded>>;
 type _GuardParkArmQueueReverse = AssertAllKeysHandled<Exclude<ParkArmQueueProjected | ParkArmQueueExcluded, ParkArmKeys>>;
 type _NoDoubleBookParkArmQueue = AssertAllKeysHandled<Extract<ParkArmQueueProjected, ParkArmQueueExcluded>>;
-type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
+type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "approvalReach" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "permissionMode" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools" | "fileHistory" | "userInvokedSkills" | "allowedTools";
 type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence" | "outputStyle";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
@@ -199,7 +199,7 @@ type WorkflowRunStripped = "sourceTaskId" | "originatingSessionId" | "effectiveA
 type _GuardWorkflowRun = AssertAllKeysHandled<Exclude<keyof WorkflowRun, WorkflowRunForwarded | WorkflowRunStripped>>;
 type _GuardWorkflowRunReverse = AssertAllKeysHandled<Exclude<WorkflowRunForwarded | WorkflowRunStripped, keyof WorkflowRun>>;
 type ParkRowKeys = keyof NonNullable<WorkflowRun["parks"]>[number];
-type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed";
+type ParkRowProjected = "callKey" | "sessionId" | "originRunId" | "originUnconfirmed" | "parkedBy" | "generation";
 type ParkRowWithheld = "token";
 type _GuardParkRow = AssertAllKeysHandled<Exclude<ParkRowKeys, ParkRowProjected | ParkRowWithheld>>;
 type _NoDoubleBookParkRow = AssertAllKeysHandled<Extract<ParkRowProjected, ParkRowWithheld>>;

package/dist/trace/self-minted-wire.d.ts

@@ -19,9 +19,9 @@ export declare const SELF_MINTED_WIRE: {
         };
     };
     /**
-     * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_STEER_UNDRAINED_CAUSES`,
+     * S-928(7.110.0):`engine_notice` `task.user_steer_undrained` 上**本仓铸**的那一臂。词表属主是 core(`USER_INPUT_UNDRAINED_CAUSES`,两族共用;
      * `leg_end` 由引擎铸、逐字过境,不在本表);本表登记的是「这个值自哪一版起由本服务出现在 wire 上」。`satisfies Record<CrashedCause, …>`:
-     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。
+     * core 删掉 `crashed` ⇒ `CrashedCause` 成 never ⇒ 本行编译红。码按受理时的车道选(`user-input-ledger.ts` `userInputLaneOf`):本行 = steer 车道。
      */
     readonly userSteerUndrainedServerCause: {
         readonly at: "engine_notice task.user_steer_undrained detail.cause(本服务铸的臂;下一条同会话 run 开通告口那一拍)";
@@ -32,6 +32,16 @@ export declare const SELF_MINTED_WIRE: {
             };
         };
     };
+    /** S-1122(7.118.0,core 7.44.0 #1362):同一臂在 follow-up 车道(`later` 档)上的那一族。7.110.0–7.117.x 的这类丢失报在 steer 一族里。 */
+    readonly userFollowupUndrainedServerCause: {
+        readonly at: "engine_notice task.user_followup_undrained detail.cause(本服务铸的臂;`later` 档受理的崩溃丢失,下一条同会话 run 开通告口那一拍)";
+        readonly members: {
+            crashed: {
+                attr: string;
+                since: string;
+            };
+        };
+    };
     /**
      * S-961(7.111.0):`wiring_manifest.instructions.selected[]` 的成员值 = 指令文件链的成员(相对 cwd 的拼写)。属主是 `project-memory.ts`
      * 的 `INSTRUCTION_FILE_CHAIN`([ref] 序:CLAUDE 族先、AGENTS 族后,首中即选)—— 链加 / 删一员 ⇒ 本行 `satisfies` 编译红,登记跟着动。
@@ -95,6 +105,10 @@ export declare const SELF_MINTED_WIRE: {
                 readonly attr: 409;
                 readonly since: "7.101.0";
             };
+            readonly "memory.scope_home_not_directory": {
+                readonly attr: 409;
+                readonly since: "7.118.0";
+            };
             readonly "memory.erasure_evidence_unavailable": {
                 readonly attr: 409;
                 readonly since: "7.108.0";

package/dist/trace/self-minted-wire.js

@@ -12,6 +12,12 @@ export const SELF_MINTED_WIRE = {
             crashed: { attr: "-", since: "7.110.0" },
         },
     },
+    userFollowupUndrainedServerCause: {
+        at: "engine_notice task.user_followup_undrained detail.cause(本服务铸的臂;`later` 档受理的崩溃丢失,下一条同会话 run 开通告口那一拍)",
+        members: {
+            crashed: { attr: "-", since: "7.118.0" },
+        },
+    },
     wiringInstructionsSelected: {
         at: "wiring_manifest instructions.selected[](本腿 loader 选中的链成员;段缺席 = 本腿无陈述)",
         members: {
@@ -34,6 +40,7 @@ export const SELF_MINTED_WIRE = {
         members: {
             "config.memory_erasure_request": { attr: 400, since: "7.52.0" },
             "memory.target_outside_store": { attr: 409, since: "7.101.0" },
+            "memory.scope_home_not_directory": { attr: 409, since: "7.118.0" },
             "memory.erasure_evidence_unavailable": { attr: 409, since: "7.108.0" },
             "memory.erasure_selector_mismatch": { attr: 409, since: "7.108.0" },
             "memory.erasure_census_incomplete": { attr: 409, since: "7.108.0" },

package/dist/user-input-ledger.d.ts

@@ -6,7 +6,7 @@
  * `POST /v1/runs/:id/steer` 对本副本的活 run 回 **200 `delivery:"applied"`**:输入只进了 core `TaskStream` 的**进程内**队列,
  * 本服务此前不落任何字节。「你的输入丢了」今天唯一的告知是 core 在**腿终局**铸的 `task.user_steer_undrained`(`cause:"leg_end"`)——
  * 进程被 SIGKILL / 崩溃时那个终局席跑不到 ⇒ **零告知**:壳手里只有一张 200 回执,重启后主请求与转录里都没有它。
- * core 7.38.0 #1233 给了词:`detail.cause` 闭集 {@link USER_STEER_UNDRAINED_CAUSES} = `leg_end` / `crashed`,`crashed` 由**服务层**在
+ * core 给了词:`detail.cause` 闭集 {@link USER_INPUT_UNDRAINED_CAUSES} = `leg_end` / `crashed`,`crashed` 由**服务层**在
  * 该会话下一条 run 之前铸。本文件 = 那个服务层。
  *
  * ## 对象(一只账本,一类输入,一句规则)
@@ -22,9 +22,9 @@
  * (core `WorkflowTaskHandle.sessionScoped`),活得比发起它的 run 腿长,没有一条 run 行约束它,而 workflow run 行上没有持有者列 ⇒ 判不出写者死没死(另票);
  * 子代 resume(`…/subagents/:target/resume`)不往在飞的队列里投,起的是一条新的子代腿;follow-up 在本仓**没有**独立的受理口(`src/http/routes` 零
  * follow-up 入口)。steer 的 `later` 档在引擎里走 follow-up 车道(引擎在腿收场时按车道分账:没投出去的 `later` 记进 `task.user_followup_undrained`),
- * 但它仍是一次 `TaskStream.steer` 受理、消费帧同为 `human_input{delivery:"applied"}`(两车道同一只消费口)⇒ 同进本账,消费即结清;崩溃告知走 core 唯一的
- * 服务层臂 `task.user_steer_undrained{cause:"crashed"}`(core 对该臂的定义按动词:服务层受理过的 steer)。follow-up 一族在 core 里没有 `cause` 键、没有
- * 服务层臂 ⇒ 本账无处按车道归档,要按车道归档须 core 先给那一臂(上游待答)⇒ 闭集一词,不预留第二词。
+ * 但它仍是一次 `TaskStream.steer` 受理、消费帧同为 `human_input{delivery:"applied"}`(两车道同一只消费口)⇒ 同进本账,消费即结清。
+ * **族 = 受理时它排进的引擎车道**({@link UserInputKind}:`steer` / `follow_up`,由档位经 {@link userInputLaneOf} 一只函数得出),崩溃告知的码按族选
+ * (core 7.44.0 #1362:两族同一只成因词表 `USER_INPUT_UNDRAINED_CAUSES`,服务层的 `crashed` 臂按车道选码,与引擎自己的 `leg_end` 臂同一种分账)。
  *
  * ## 五形行(append-only;行序 = 语义序;File 孪生的盘上形 = 下面的 {@link UserInputLedgerRecord},SQL 孪生 = 一行一受理 + CAS 列 + 删行,同义)
  *  · `accepted`  —— 受理点(`routes/runs.ts` 的 live 腿,**调 `TaskStream.steer` 之前**、回 200 之前)写;写不进 ⇒ 503
@@ -85,17 +85,28 @@
  * 不开旋钮(没有「关掉告知」的正当需求)· 不改 steer 的 200 体(回执仍是「已交付」,账本是它的影子)· 不重放丢失的输入(core 明写
  * NOT redelivered;本账只告知,不替人决定重发)· 不存输入正文(行里只有身份与时刻)。
  */
-import { type EngineNoticeCode, type TaskEvent, type UserSteerUndrainedCause } from "@sema-agent/core";
+import { type EngineNoticeCode, type SystemInjectionPriority, type TaskEvent, type UserInputUndrainedCause } from "@sema-agent/core";
 import { type RunRecord } from "./plugins/store-contracts.js";
 import { type EngineNoticeRouter } from "./trace/engine-notice-wire.js";
 /** local 数据根下的子目录(File 孪生;与 `approval-ask-audit/` 同层同形)。 */
 export declare const USER_INPUT_LEDGER_DIR = "user-input-ledger";
-/** 账本收的输入族(闭集)。follow-up 结论见顶注「对象」段。 */
-export type UserInputKind = "steer";
-/** 读盘词表(`satisfies Record<…, true>` ⇒ 闭集加词而本表没跟 = 编译红;判定走 `Object.hasOwn`)。 */
+/**
+ * 账本收的输入族(闭集)= 受理时它排进的**引擎车道**:`steer`(`now` / `next` 档)/ `follow_up`(`later` 档)。崩溃告知的码按族选
+ * ({@link UNDRAINED_NOTICE_OF}),读面行的 `kind` 就是它。`follow_up` 自 7.118.0 起写(之前的版本受理口一律写 `steer`,`later` 档的旧行照它当时的族读)。
+ */
+export type UserInputKind = "steer" | "follow_up";
+/** 读盘词表(`satisfies Record<…, true>` ⇒ 闭集加词而本表没跟 = 编译红;判定走 `Object.hasOwn`)。≤7.117.x 的读腿不认 `follow_up`(回滚须知在 MIGRATION)。 */
 export declare const USER_INPUT_KIND_WORDS: {
     readonly steer: true;
+    readonly follow_up: true;
 };
+/**
+ * 一次受理排进哪条引擎车道 —— 三个受理口(run steer 的 live 腿 / interrupt 带 text 形 / 子代 steer)同调这一只。core 原句(`TaskStream.steer` 注):
+ * 「a `"later"` steer rides the followUp lane, so its stranded account is `task.user_followup_undrained`」;`now` / `next` 走 steer 车道。
+ * 档位型取 core 包根的 `SystemInjectionPriority`(`TaskStream.steer` 的 `priority`;缺席 = 引擎缺省 `next`),本仓不复述:core 加一档 ⇒ 下面的
+ * 穷举 `never` 臂编译红,由人裁新档排进哪条车道。
+ */
+export declare function userInputLaneOf(tier: SystemInjectionPriority | undefined): UserInputKind;
 /** `settled` 的两种收场(闭集,见顶注)。 */
 export type SettleHow = "leg_end" | "not_applied" | "consumed";
 /** 读盘词表(File 孪生的折叠守卫 / SQL 孪生的 `settle_how` 列读腿同读这一张;`consumed` 自 7.113.0 起,≤7.112.x 的读腿不认它 —— 回滚须知在 MIGRATION)。 */
@@ -105,7 +116,7 @@ export declare const SETTLE_HOW_WORDS: {
     readonly consumed: true;
 };
 /** 本服务铸的那一臂(core 删掉这个词 ⇒ `Extract` 得 `never` ⇒ 下面的常量编译红)。 */
-export type CrashedCause = Extract<UserSteerUndrainedCause, "crashed">;
+export type CrashedCause = Extract<UserInputUndrainedCause, "crashed">;
 export declare const CRASHED_CAUSE: CrashedCause;
 /** 盘上 / 行上的 cause 词判:必须是 core 闭集的成员,**且**铸者是服务层(词表外 / 引擎臂 ⇒ 不是本账能写的行)。 */
 export declare function isServingLayerUndrainedCause(v: unknown): v is CrashedCause;
@@ -328,11 +339,12 @@ export interface UserInputLedger {
     readSession(sessionId: string): Promise<UndrainedUserInputRow[] | undefined>;
 }
 /**
- * 一条旧 run 的 `crashed` 通告(纯数据)。`detail` 键集 = core 契约 `{ steer, cause, taskId?, sessionId?, runId? }` 的子集(`runId` 缺席,理由见顶注)。
+ * 一条旧 run 一族的 `crashed` 通告(纯数据)。`detail` 键集 = core 契约 `{ steer | followUp, cause, taskId?, sessionId?, runId? }` 的子集(`runId` 缺席,理由见顶注)。
  * `message` 只是 fallback 展示(core 同族句的形,只换成因);消费端按 `code` + `detail.cause` 分支。
  */
-export declare function buildCrashedSteerNotice(input: {
-    steer: number;
+export declare function buildCrashedUndrainedNotice(input: {
+    family: UserInputKind;
+    count: number;
     taskId: string;
     sessionId: string;
 }): {

package/dist/user-input-ledger.js

@@ -1,14 +1,28 @@
-import { USER_STEER_UNDRAINED_CAUSES } from "@sema-agent/core";
+import { USER_INPUT_UNDRAINED_CAUSES } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { isHolderDeathVerdict } from "./plugins/store-contracts.js";
 import { defaultEngineNoticeRouter } from "./trace/engine-notice-wire.js";
 export const USER_INPUT_LEDGER_DIR = "user-input-ledger";
-export const USER_INPUT_KIND_WORDS = { steer: true };
+export const USER_INPUT_KIND_WORDS = { steer: true, follow_up: true };
+export function userInputLaneOf(tier) {
+    switch (tier) {
+        case "later":
+            return "follow_up";
+        case "now":
+        case "next":
+        case undefined:
+            return "steer";
+        default: {
+            const unhandled = tier;
+            throw new Error(`unhandled steer tier: ${String(unhandled)}`);
+        }
+    }
+}
 export const SETTLE_HOW_WORDS = { leg_end: true, not_applied: true, consumed: true };
 const UNDRAINED_CAUSE_MINTER = { leg_end: "engine", crashed: "server" };
 export const CRASHED_CAUSE = "crashed";
 export function isServingLayerUndrainedCause(v) {
-    if (typeof v !== "string" || !USER_STEER_UNDRAINED_CAUSES.includes(v))
+    if (typeof v !== "string" || !USER_INPUT_UNDRAINED_CAUSES.includes(v))
         return false;
     return UNDRAINED_CAUSE_MINTER[v] === "server";
 }
@@ -124,12 +138,16 @@ export function sortAcceptances(list) {
 export const USER_INPUT_OPEN_SCAN_MAX = 1000;
 export const USER_INPUT_OPEN_SCAN_PAGES = 100;
 export const USER_INPUT_SESSION_READ_MAX = 500;
-const USER_STEER_UNDRAINED = "task.user_steer_undrained";
-export function buildCrashedSteerNotice(input) {
+const UNDRAINED_NOTICE_OF = {
+    steer: { code: "task.user_steer_undrained", countKey: "steer", what: "user steer(s)" },
+    follow_up: { code: "task.user_followup_undrained", countKey: "followUp", what: "user steer(s) queued for the run's end (priority later)" },
+};
+export function buildCrashedUndrainedNotice(input) {
+    const face = UNDRAINED_NOTICE_OF[input.family];
     return {
-        code: USER_STEER_UNDRAINED,
-        message: `Check the earlier run's transcript and results before re-sending any of these steers to a live run. The server accepted ${input.steer} user steer(s) for run ${input.taskId} (each answered 200 applied or 202 queued-immediate), but the process running that run ended before the engine confirmed consuming them. They are NOT redelivered.`,
-        detail: { steer: input.steer, cause: CRASHED_CAUSE, taskId: input.taskId, sessionId: input.sessionId },
+        code: face.code,
+        message: `Check the earlier run's transcript and results before re-sending any of these steers to a live run. The server accepted ${input.count} ${face.what} for run ${input.taskId} (each answered 200 applied or 202 queued-immediate), but the process running that run ended before the engine confirmed consuming them. They are NOT redelivered.`,
+        detail: { [face.countKey]: input.count, cause: CRASHED_CAUSE, taskId: input.taskId, sessionId: input.sessionId },
         sessionId: input.sessionId,
     };
 }
@@ -323,15 +341,16 @@ export function createUserInputLedger(opts) {
             }
             const groups = new Map();
             for (const a of rows) {
-                const g = groups.get(a.taskId);
+                const key = `${a.taskId}\u0000${a.input}`;
+                const g = groups.get(key);
                 if (g)
-                    g.push(a);
+                    g.group.push(a);
                 else
-                    groups.set(a.taskId, [a]);
+                    groups.set(key, { taskId: a.taskId, family: a.input, group: [a] });
             }
-            for (const [oldTaskId, group] of groups) {
-                const steer = new Set(group.map((a) => a.messageId)).size;
-                const delivered = await router.routeConfirmed(buildCrashedSteerNotice({ steer, taskId: oldTaskId, sessionId: at.sessionId }));
+            for (const { taskId: oldTaskId, family, group } of groups.values()) {
+                const count = new Set(group.map((a) => a.messageId)).size;
+                const delivered = await router.routeConfirmed(buildCrashedUndrainedNotice({ family, count, taskId: oldTaskId, sessionId: at.sessionId }));
                 if (delivered === 0)
                     continue;
                 for (const a of group) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.117.0",
+  "version": "7.118.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -64,7 +64,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.42.1",
+    "@sema-agent/core": "7.44.0",
     "@sema-agent/settings-schema": "8.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",

package/scripts/drain-check-local.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * 换钉前的**排空检查 —— `DB_BACKEND=local`(File 店)车道**,只读。随 npm 包出(`scripts/drain-check-local.mjs`)。
- * 一次跑**五条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
+ * 一次跑**六条判据**(判据表 {@link DRAIN_CRITERIA},每条一行末行、各自的命中行;SQL 车道的同一判据是同目录随包的 `drain-check.mysql.sql` / `drain-check.pg.sql`,
  * 每条判据一段、段首标记 `-- drain-check:<判据名>:<后端>`,判据名与本表的 `name` 同一个词):
  *  · `skill-grants-rollback`(**回滚**到 7.115.x 前,即引擎从 7.41 退回 7.40):四样任一 ——
  *    ① pending 行带 `state.skillGrants`(本次 run 冻结在行上的技能授予行:模型激活 / 子代捕获写下的放行与禁止);
@@ -21,6 +21,14 @@
  *    (行字节不动;出路 = 取消、改好条目重提,见随包 `MIGRATION.md` 7.117.0 节)。命中行点名是哪一层(`member=skills` / `member=agents.skills`)。
  *    判据**就是**服务提交与续跑两腿同经的那一只函数(`src/rule-entry-list.ts` 的 `skillDenyInertEntryOf`,它调引擎包根的 `compileAllowList`),经编译产物
  *    `dist/rule-entry-list.js` 取 —— 本脚本不写第二份;
+ *  · `workflow-park-holder`(换钉 7.118.0 前,引擎 7.44.0 起 workflow 子代卡交给哪条 run 只看记录 `parks[]` 条目上的持有者位 `parkedBy` / `generation`):
+ *    pending 行的子会话被 workflow park 索引点名(`<数据根>/workflows/workflow-agent-sessions/index.jsonl`:一行 = 一条 workflow run 的整份指针集
+ *    `{ runId, rows: [{ sessionId, runId, agentKey, scope }] }`,同一条 run 后写的一行整份覆盖先写的,空集 = 它不再点名任何子会话)= 一张待批的 workflow 子代卡。
+ *    在**换钉之前、对旧版本的数据**跑:引擎 7.43 及以前写下的记录没有持有者位 ⇒ 这样的卡升级后在决定口答 409 `decide.workflow_parks_unreadable`
+ *    (更早的引擎写下、记录上根本没有 `parks` 的,答 409 `conflict.resume_context_unavailable`;卡都仍待批,出路相同 = 续跑那条 workflow run 再决,见随包 `MIGRATION.md` 7.118.0 节);换钉之后再跑会把新引擎写下的卡也数进来。命中行点名点它的 run(`runId=`)。
+ *    账本行的读法是服务里那一只(`src/orchestration/workflow-agent-session-index.ts` 的 `readAgentSessionLedgerLine`),经编译产物
+ *    `dist/orchestration/workflow-agent-session-index.js` 取 —— 本脚本只按 runId 折叠;读不出的行计入 `corrupt`(rc 2:读不出的那一行可能正是点名某张待批卡的那一份);
+ *    窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
  *  · `retired-mode-seed`(换钉 7.113.0 前,core 7.39.0 删掉退役 mode-seed 的一次性迁移):pending 行的 `state.inheritedGate` 仍带退役成员;
  *  · `permissions-allow-list`(换钉 7.117.0 前,本服务把 `settings.permissions.allow` 整份交给引擎的 allow 层):pending 行所在会话的续跑上下文
  *    (`checkpoint-ctx/*.json` 的信封 `{ sessionId, updatedAt, ctx }`)里,`ctx.body.settings.permissions.allow` 是非空数组,且 `ctx.permissionsAllowReading` 不是 `"allow_layer"`
@@ -62,14 +70,17 @@
  * ## 读数(机读末行 + 退出码)
  *  · 每条命中一行:`SKILL-GRANTS-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skillGrants|boundGrantDigest|userInvokedSkills|disallowedTools>` / `SKILL-MANIFEST-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
  *    `SKILL-DENY-INERT-ROW token=<token> sessionId=<id> createdAt=<ms> member=<skills|agents.skills>` /
+ *    `WORKFLOW-PARK-ROW token=<token> sessionId=<id> createdAt=<ms> runId=<点名它的 run,逗号连接>` /
  *    `ALLOW-LIST-ROW token=<token> sessionId=<id> createdAt=<ms>` / `RETIRED-ROW token=<token> sessionId=<id> createdAt=<ms> member=<成员>`;
  *  · 每条判据一行末行(表序;`RETIRED-MODE-SEED` 那一行恒在最后,7.113.0 起读「最后一行」的下游不受影响;`PERMISSIONS-ALLOW-LIST` 仍是倒数第二行):
  *    `SKILL-GRANTS rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-SKILL-MANIFEST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `SKILL-DENY-INERT rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
+ *    `WORKFLOW-PARK-HOLDER rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `PERMISSIONS-ALLOW-LIST rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`,
  *    `RETIRED-MODE-SEED rows=<命中数> pending=<pending 行数> total=<行数> unknownEvents=<n> corrupt=<n> root=<实际读的数据根>`;
- *    `corrupt` = 共用扫描的坏记录 + 这条判据自己读不懂的旁路输入(`permissions-allow-list`:读不懂的 ctx 档,文件名进 stderr —— 一份读不懂的 ctx 可能正是某条 pending 行带 `allow` 的那一份);
+ *    `corrupt` = 共用扫描的坏记录 + 这条判据自己读不懂的旁路输入(`permissions-allow-list`:读不懂的 ctx 档,文件名进 stderr —— 一份读不懂的 ctx 可能正是某条 pending 行带 `allow` 的那一份;
+ *    `workflow-park-holder`:索引账本里读不出的行,行号进 stderr);
  *    没读成 / 不能下结论(rc 2 的几种缺席与不稳形)时前五个计数是 `-`、多一个 `reason=<词>`,**不会出现 `rows=0`**(下游读 `rows=0` 即「干净」);
  *  · rc 0 = 每条判据都零命中(可换钉 / 可回滚)· rc 1 = 有命中(逐行列出;答完或取消再跑)· rc 2 = 读不懂 / 没读成 / 不能下结论(账本里有本脚本不认的事件词 / 不合形的记录 / 读不懂的 ctx 档 /
  *    数据根缺席 / 缺省根解析不可用 / 判据模块不可用(脚本隔壁没有 `dist/`:源码树没 build)/ 读期间文件一直在变 / 读文件出错 / 用法错)—— 不给结论(缺席 ≠ 干净:一条读不懂的记录可能正是让某行回到 pending 的那一条)。
@@ -81,7 +92,7 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 /** 从脚本隔壁的编译产物取来的服务判据(脚本不持第二份实现)。
- * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined }} ServiceCriteria */
+ * @typedef {{ allowListReadingUnstated: (ctx: Record<string, unknown>) => boolean, retiredSkillManifestLayerOf: (body: unknown) => "skills" | "agents.skills" | undefined, skillDenyInertEntryOf: (body: unknown) => { layer: "skills" | "agents.skills", message: string } | undefined, readAgentSessionLedgerLine: (v: unknown) => { runId: string, rows: Array<{ sessionId: string }> } | undefined }} ServiceCriteria */
 
 /** 读期间文件在变时的有界重读次数(含第一次)。 */
 const STABLE_READ_ATTEMPTS = 3;
@@ -292,6 +303,49 @@ function readCtxIndex(root) {
   return { bySession, corrupt: unreadable.length, unreadable };
 }
 
+/**
+ * `<数据根>/workflows/workflow-agent-sessions/index.jsonl` —— workflow park 索引的 local 账本(服务里 `LocalWorkflowAgentSessionIndex` 的盘上形)。
+ * 一行 = 一条 workflow run 的整份指针集;行的读法是服务里那一只(`readLine`,经编译产物取),本函数只按 runId 折叠(后写整份覆盖先写,空集 = 不再点名)。
+ * 文件不存在 = 没有指针(没跑过 workflow);读不出的行计入 `corrupt`、行号回给调用方(不猜它属于哪条 run)。
+ * @param {string} root
+ * @param {ServiceCriteria["readAgentSessionLedgerLine"]} readLine
+ * @returns {{ bySession: Map<string, string[]>, corrupt: number, unreadable: string[] }} 子会话 → 点名它的 run(排序)。 */
+function readParkIndex(root, readLine) {
+  const rel = join("workflows", "workflow-agent-sessions", "index.jsonl");
+  /** @type {Map<string, string[]>} runId → 它此刻点名的子会话 */
+  const byRun = new Map();
+  /** @type {string[]} */
+  const unreadable = [];
+  const text = textOf(join(root, rel));
+  text.split("\n").forEach((line, i) => {
+    if (line.trim().length === 0) return;
+    let v;
+    try {
+      v = JSON.parse(line);
+    } catch {
+      v = undefined;
+    }
+    const entry = v === undefined ? undefined : readLine(v);
+    if (entry === undefined) {
+      unreadable.push(`${rel}:${i + 1}`);
+      return;
+    }
+    if (entry.rows.length === 0) byRun.delete(entry.runId);
+    else byRun.set(entry.runId, entry.rows.map((r) => r.sessionId));
+  });
+  /** @type {Map<string, string[]>} */
+  const bySession = new Map();
+  for (const [runId, sessions] of byRun) {
+    for (const sessionId of sessions) {
+      const runs = bySession.get(sessionId) ?? [];
+      if (!runs.includes(runId)) runs.push(runId);
+      bySession.set(sessionId, runs);
+    }
+  }
+  for (const runs of bySession.values()) runs.sort();
+  return { bySession, corrupt: unreadable.length, unreadable };
+}
+
 /**
  * 判据表 —— 「哪些 pending 行算命中」。扫描骨架(快照 + 账本折成当前行、一致性重读、数据根判定)各条共用,判据只管这一问:
  *  · `tail` / `hit`:末行前缀 / 命中行前缀;
@@ -356,6 +410,22 @@ export const DRAIN_CRITERIA = [
       return hit === undefined ? undefined : ` member=${hit.layer}`;
     },
   },
+  {
+    // 换钉 7.118.0 之前:待批、且子会话被 workflow park 索引点名的卡(头注里那一条)。账本行的读法是服务里那一只(`readAgentSessionLedgerLine`,经编译产物取);
+    // 命中行点名点它的 run。表序在 `permissions-allow-list` 之前 —— 那一条仍倒数第二、`RETIRED-MODE-SEED` 仍最后。
+    name: "workflow-park-holder",
+    tail: "WORKFLOW-PARK-HOLDER",
+    hit: "WORKFLOW-PARK-ROW",
+    load: (root, service) => {
+      const idx = readParkIndex(root, service.readAgentSessionLedgerLine);
+      return { input: idx.bySession, corrupt: idx.corrupt, unreadable: idx.unreadable };
+    },
+    judge: (row, input) => {
+      const bySession = /** @type {Map<string, string[]>} */ (input);
+      const runs = typeof row.sessionId === "string" ? bySession.get(row.sessionId) : undefined;
+      return runs === undefined ? undefined : ` runId=${runs.join(",")}`;
+    },
+  },
   {
     name: "permissions-allow-list",
     tail: "PERMISSIONS-ALLOW-LIST",
@@ -401,6 +471,7 @@ async function loadServiceCriteria(rootEcho) {
     ["dist/http/checkpoint-ctx.js", () => import("../dist/http/checkpoint-ctx.js"), "allowListReadingUnstated"],
     ["dist/http/retired-skill-manifest.js", () => import("../dist/http/retired-skill-manifest.js"), "retiredSkillManifestLayerOf"],
     ["dist/rule-entry-list.js", () => import("../dist/rule-entry-list.js"), "skillDenyInertEntryOf"],
+    ["dist/orchestration/workflow-agent-session-index.js", () => import("../dist/orchestration/workflow-agent-session-index.js"), "readAgentSessionLedgerLine"],
   ];
   /** @type {Record<string, unknown>} */
   const fns = {};

package/scripts/drain-check.mysql.sql

@@ -8,12 +8,13 @@
 --   sessions   命中行所在的会话 id,逗号连接,新的在前。以 hit_rows 为准:这一列被会话变量 group_concat_max_len(缺省 1024 字节)截断时,列出的会话数会少于 hit_rows ——
 --              先处理列出的再跑一次,或先在同一个会话里 SET SESSION group_concat_max_len = 1048576; 再跑本文件(本文件自己只含 SELECT)。
 -- 每段只数 pending 行(已决 / 已过期的行不数);判据只看**键在不在 / 值形**,不读行的其余内容。
--- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,五条判据同名。
+-- DB_BACKEND=local(File 店)没有 SQL:用同目录的 drain-check-local.mjs,六条判据同名。
 --
--- 五条判据(顺序同 drain-check-local.mjs 的判据表):
+-- 六条判据(顺序同 drain-check-local.mjs 的判据表):
 --   skill-grants-rollback   回滚到 7.115.x(引擎 7.40)之前:7.116.0 停驻的行带 7.40 不读的技能授予节 / 卡绑定 / 会话上下文里的人点名技能 / 还没被激活的技能声明的禁止清单。
 --   retired-skill-manifest  升级到 7.116.0 之前:停驻、持久化提交体里技能(顶层 skills[] 或子代 agents[].skills[])还带已退役的 manifest 键。
 --   skill-deny-inert        换钉 7.117.0 之前:停驻、提交体里技能(顶层 skills[] 或子代 agents[].skills[])的 disallowedTools 有引擎会读成空的条目的**候选**(见该段注)。
+--   workflow-park-holder    换钉 7.118.0 之前 / 从 7.118.0 回滚到 7.117.x 之前:此刻待批、且子会话被 workflow park 索引点名的卡(workflow 子代卡;见该段注)。
 --   permissions-allow-list  换钉 7.117.0 之前:停驻、提交体 settings.permissions.allow 是非空数组且读法记号不是当前的 "allow_layer"(无记号 = 名单时代;"statement" = 表态时代)。
 --   retired-mode-seed       换钉 7.113.0 之前:检查点的 inheritedGate 里仍带退役 mode-seed 成员。
 
@@ -48,7 +49,9 @@ WHERE k.status = 'pending'
 
 -- drain-check:skill-deny-inert:mysql —— 期望 hit_rows = 0;每一行 = 一条**候选**:升级后续跑可能被拒的停驻行(拒的是提交体里技能的一条 disallowedTools 条目 ——
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
--- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。
+-- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是
+-- (session_id, run_id)),续跑腿读的是其中**持有者**那条记录的发起会话,持有者通常是链上最新的、不是最老的,SQL 判不出是哪一条 ⇒ 数的是真超集:
+-- 任一条指针记录的发起会话命中即数(指针没有记录 / 记录没有发起会话 ⇒ 读这张卡自己会话的);整条连接链包在对这张卡的 EXISTS 里(kk = 这张卡本身,按主键取回),一张卡只数一次。
 -- 引擎 7.42 逐字读规则条目,读成空的拒什么也不拒,服务对这种体在提交与续跑上同拒;7.41 去首尾空白,所以 7.116.x 上它可能还是一条有效的拒)。
 -- SQL 不能逐条照引擎判读(引擎的文法 —— 非 ASCII 空白、内容形不受支持的工具、括号不配对 —— 在 SQL 里复刻不全,逐形枚举的表必漏),所以这里数的是**真超集**:
 --   顶层 skills[*] 或子代 agents[*].skills[*] 的 disallowedTools **非空**的停驻行(与回滚判据 skill-grants-rollback 的第四样同一只形)。两方言都 ⊇ 运行期判据;拒侧清单不是数组的形(受理口 400,盘上不该有)两边数法不同 —— pg 只认数组,MySQL 的 [0] 把非数组当一元数组读。
@@ -57,29 +60,52 @@ WHERE k.status = 'pending'
 SELECT 'skill-deny-inert' AS criterion, COUNT(*) AS hit_rows,
        COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
 FROM checkpoint k
-LEFT JOIN workflow_agent_session w ON w.session_id = k.session_id
-LEFT JOIN workflow_run r ON r.id = w.run_id
-JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), k.session_id)
 WHERE k.status = 'pending'
-  AND ((JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.skills')) = 'ARRAY'
-        AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.skills[*].disallowedTools[0]'))
-       OR (JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.agents')) = 'ARRAY'
-           AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.agents[*].skills[*].disallowedTools[0]')));
+  AND EXISTS (SELECT 1
+              FROM checkpoint kk
+              LEFT JOIN workflow_agent_session w ON w.session_id = kk.session_id
+              LEFT JOIN workflow_run r ON r.id = w.run_id
+              JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), kk.session_id)
+              WHERE kk.token = k.token
+                AND ((JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.skills')) = 'ARRAY'
+                      AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.skills[*].disallowedTools[0]'))
+                     OR (JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.agents')) = 'ARRAY'
+                         AND JSON_CONTAINS_PATH(c.ctx, 'one', '$.body.agents[*].skills[*].disallowedTools[0]'))));
+
+-- drain-check:workflow-park-holder:mysql —— 期望 hit_rows = 0;每一行 = 一张待批的 workflow 子代卡(它的子会话被 workflow_agent_session 里的一条指针点名)。
+-- 在**换钉之前**、对旧版本的数据跑:7.118.0 起 workflow 子代卡交给哪条 run 只看记录 parks[] 条目上的持有者位(parkedBy / generation),
+-- 引擎 7.43 及以前写下的记录没有这两位 ⇒ 这样的卡升级后在决定口答 409 decide.workflow_parks_unreadable(更早的引擎写下、记录上根本没有 parks 的,答 409
+-- conflict.resume_context_unavailable;卡都仍待批,出路相同 = 续跑那条 workflow run 再决)。
+-- 换钉前把它们决掉(或取消发起它的任务)就省掉这一步。换钉之后再跑本段会把新引擎写下的卡也数进来(那时它不再是「会被拒的卡」的读数)。
+-- 从 7.118.0 回滚到 7.117.x 之前、对 7.118.0 的数据跑:数出的就是全部待批的 workflow 子代卡 —— 回滚要删掉这张索引表(7.117.x 按旧主键重建,
+-- 旧副本在新主键上写不进 / 读不准,见随包 MIGRATION.md 7.118.0 节),删表之后这些卡没有指针、决不掉;先把它们决掉或取消。
+-- 对索引表用 EXISTS 而不 JOIN:一个子会话可以被好几条记录点名,JOIN 会把一张卡数成几张。
+-- 窗与删码:本判据是一次性迁移 M9 的读侧半场 —— 窗口与删码清单见引擎启动期一次性迁移登记表(one-time-migrations)M9 一行,随 M9 一起删;这里不写第二份窗。
+SELECT 'workflow-park-holder' AS criterion, COUNT(*) AS hit_rows,
+       COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
+FROM checkpoint k
+WHERE k.status = 'pending'
+  AND EXISTS (SELECT 1 FROM workflow_agent_session w WHERE w.session_id = k.session_id);
 
 -- drain-check:permissions-allow-list:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后续跑会被拒的停驻行。
 -- 读哪一份续跑上下文:与续跑腿同 —— workflow 子代的停驻行(在 workflow_agent_session 里登记过)续跑时读的是**发起这条 workflow 的会话**那一份
--- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。
+-- (workflow_run.run 的 originatingSessionId);其余行读自己会话那一份。一个子会话可以被好几条 workflow 记录点名(续跑链 / 分叉;7.118.0 起索引主键是
+-- (session_id, run_id)),续跑腿读的是其中**持有者**那条记录的发起会话,持有者通常是链上最新的、不是最老的,SQL 判不出是哪一条 ⇒ 数的是真超集:
+-- 任一条指针记录的发起会话命中即数(指针没有记录 / 记录没有发起会话 ⇒ 读这张卡自己会话的);整条连接链包在对这张卡的 EXISTS 里(kk = 这张卡本身,按主键取回),一张卡只数一次。
 -- 判据 = 服务续跑腿拒臂的同一句话:提交体 settings.permissions.allow 是非空数组,且上下文的读法记号 permissionsAllowReading 不是当前的 "allow_layer"。
 SELECT 'permissions-allow-list' AS criterion, COUNT(*) AS hit_rows,
        COALESCE(GROUP_CONCAT(k.session_id ORDER BY k.created_at_ms DESC SEPARATOR ','), '') AS sessions
 FROM checkpoint k
-LEFT JOIN workflow_agent_session w ON w.session_id = k.session_id
-LEFT JOIN workflow_run r ON r.id = w.run_id
-JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), k.session_id)
 WHERE k.status = 'pending'
-  AND JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.settings.permissions.allow')) = 'ARRAY'
-  AND JSON_LENGTH(JSON_EXTRACT(c.ctx, '$.body.settings.permissions.allow')) > 0
-  AND COALESCE(JSON_UNQUOTE(JSON_EXTRACT(c.ctx, '$.permissionsAllowReading')), '') <> 'allow_layer';
+  AND EXISTS (SELECT 1
+              FROM checkpoint kk
+              LEFT JOIN workflow_agent_session w ON w.session_id = kk.session_id
+              LEFT JOIN workflow_run r ON r.id = w.run_id
+              JOIN checkpoint_ctx c ON c.session_id = COALESCE(JSON_UNQUOTE(JSON_EXTRACT(r.run, '$.originatingSessionId')), kk.session_id)
+              WHERE kk.token = k.token
+                AND JSON_TYPE(JSON_EXTRACT(c.ctx, '$.body.settings.permissions.allow')) = 'ARRAY'
+                AND JSON_LENGTH(JSON_EXTRACT(c.ctx, '$.body.settings.permissions.allow')) > 0
+                AND COALESCE(JSON_UNQUOTE(JSON_EXTRACT(c.ctx, '$.permissionsAllowReading')), '') <> 'allow_layer');
 
 -- drain-check:retired-mode-seed:mysql —— 期望 hit_rows = 0;每一行 = 一条升级后会被拒的停放行。
 -- 判据逐字照引擎 refuseRetiredModeSeed:inheritedGate 带 autoModeRequested / approverPosture(任何值,含 JSON null),或 shellGate 不是 "always"(含 JSON null)。