@sema-agent/server 7.122.0 → 7.124.0

package/dist/plugins/local-session-store.d.ts

@@ -1,5 +1,5 @@
 import { FileSessionRepo, type AcquiredSession, type SessionStore, type SessionRepo, type SessionTreeEntry } from "@sema-agent/core";
-import type { SessionSummary } from "./store-contracts.js";
+import type { SessionRunRollupSource, SessionSummary } from "./store-contracts.js";
 import { type Logger } from "../observability/logger.js";
 import { type SessionFace } from "../session-incarnation.js";
 import { type InstructionSourceBaseline } from "../instruction-source-notice.js";
@@ -14,6 +14,7 @@ import { type StagingHandle } from "../session-sync-kernel.js";
 export declare function createLocalSessionRepo(root: string): FileSessionRepo;
 export declare class LocalSessionStore implements SessionStore {
     private readonly repo;
+    private readonly runs;
     /** [ref] 车1:托管留存声明 —— **诚实的 none**。本店的行没有任何按期删除的腿(留存 lane 的三方法只实现在
      *  SQL 聚合店上),所以 locked policy + 本店 ⇒ core 的 `assertRetentionCapability` 拒启,这是契约的
      *  **正确行为**不是缺口(要留存治理先上 DB 后端;设计稿 §1「不做清单」逐字)。缺席也会被读成 none,
@@ -27,17 +28,6 @@ export declare class LocalSessionStore implements SessionStore {
      *  shows the wrong "most recent" — TOC-review #10). In-memory only (no sidecar) when `dataDir` is absent (the
      *  process-local `InMemorySessionRepo` case, where the sessions themselves are lost on restart anyway). */
     private readonly lastActivity;
-    /** K-5c (core 1.155 SessionStore.noteTaskRun seam): the latest task run per session, recorded by core's Runner at
-     *  runTask START (so a running/suspended run surfaces too) → projected as `lastRunId` on listSessions. The cloud
-     *  TiDB/PG twins derive it from `task_run`; the local backend has no runs ledger, so this is an in-memory map.
-     *  ⚠️ IN-MEMORY BEST-EFFORT (honest degrade, NOT sidecar-persisted — review Q6): it covers the PRIMARY /resume use
-     *  case (re-attach to a RUNNING run — recorded at the run's start, the process can't have restarted while that run
-     *  is still live), and is LOST on a process restart. That's acceptable: a session whose last run predates a restart
-     *  has only TERMINAL runs (no live tail to re-attach), so `lastRunId` falls back to null and the shell uses its
-     *  no-anchor path — same posture as the other local degrades here (runCount:0, lastStatus:""). Persisting it would
-     *  need a sidecar-format change (the #10 clobber area); deferred until a real local-file-backed need. */
-    /** K-5c/[ref]/[ref]:per-session 最近一次 run 的 {taskId, runId?}(noteTaskRun 席;runId omit ⇒ 清座)。 */
-    private readonly lastTaskRun;
     /** 2c P1d-β — live staged-import handles keyed by stagingId, so a local staging's in-memory buffer is readable via
      *  readStagedEntries (the durable twins re-read the staged session_event rows; local has no such rows). */
     private readonly stagings;
@@ -81,12 +71,14 @@ export declare class LocalSessionStore implements SessionStore {
     /** 认领行(`session_owner_claimed`)的出口 —— 一次性迁移 M10 的认领臂专用(窗口见 `plugins/one-time-migrations.ts` 登记表)。 */
     private readonly log;
     /** @param repo     the core SessionRepo this store projects into the §0.5 SessionStore shape.
+     *  @param runs     the run store whose per-session projection is the ONLY source of a row's `runCount` / `lastStatus` / `lastRunId` /
+     *                  `lastTaskRunId` (LocalBackend passes its `FileRunStore`). Required — a run-less local session store does not exist.
      *  @param dataDir  the SAME data dir the file-backed repo persists under (LocalBackend passes `fileBackend.root`).
      *                  When given, lastActivity is persisted to `<dataDir>/session-last-activity.json` so it survives a
      *                  restart (the file-backed deployment); omit it for the in-memory deployment (nothing survives).
      *  @param opts.log the `session_owner_claimed` line's sink (LocalBackend passes a logger at the deployment's LOG_LEVEL;
      *                  absent ⇒ an info-level JSON-line logger — a claim is never silent). */
-    constructor(repo: SessionRepo, dataDir?: string, opts?: {
+    constructor(repo: SessionRepo, runs: SessionRunRollupSource, dataDir?: string, opts?: {
         log?: Pick<Logger, "info">;
     });
     /**
@@ -211,9 +203,11 @@ export declare class LocalSessionStore implements SessionStore {
      *   - `firstActivityAt` — the session's `createdAt` (repo metadata).
      *   - `lastActivityAt`  — the touch marker (falls back to `createdAt`); the keyset sort key.
      *   - `objectivePreview`— the last USER-text entry, synthesized from the session tree (no run ledger).
-     *   - `runCount`/`lastStatus` — DEGRADED (0 / ""): the session abstraction has no runs ledger; the TiDB twin
-     *                          LEFT-JOINs `task_run` for these, which the local backend (MemoryRunStore, separate
-     *                          ledger) intentionally does NOT correlate here (variant-2 is session-abstraction-only).
+     *   - `runCount`/`lastStatus`/`lastRunId`/`lastTaskRunId` — S-1371:read from the run store handed in (`runs`; the TiDB
+     *                          twin LEFT-JOINs `task_run` for the same values, the run store's own `listSessions` is that
+     *                          join's same-semantics projection — latest run by `created_at DESC, task_id DESC`, count of all,
+     *                          `lastTaskRunId` = that run's `result.runId`). One call per list (not per row); a session with no
+     *                          run row ⇒ `0 / "" / null` (TiDB's null→"" mapping); a run-store read failure throws (never `0 / ""`).
      *
      * Keyset matches the contract: STRICTLY older than the cursor, ties broken by id DESC; `limit` is honored after
      * the in-memory sort. Cheap (a local single-user store holds few sessions). Errors reading one session's entries
@@ -230,17 +224,16 @@ export declare class LocalSessionStore implements SessionStore {
         limit: number;
         q?: string;
     }): Promise<SessionSummary[]>;
-    /** K-5c (core 1.155 SessionStore seam): core's Runner calls this at runTask START with the run's taskId, so the
-     *  latest run surfaces as `lastRunId` on listSessions even while it is still running/suspended (the local backend
-     *  has no runs ledger to derive it from, unlike the TiDB/PG twins). In-memory, last-write-wins per session.
-     *  [ref] → [ref]([ref] 兑现;上一版「有意缓议」注即本批债锚,兑现随批撤):第三参 engine runId
-     *  自本批起**消费** —— map 值 {taskId, runId?} + 行投影 `lastTaskRunId` + **两座同动清座**(omit ⇒
-     *  清 runId 座,对齐 core TtlSessionStore.noteTaskRun 的 omit⇒clear 契约,core session.d.ts
-     *  亲读:旧 run 的 runId 挂在新 task 旁 = 把上一条 run 的身份错标给新 run)。存储与行投影同批落
-     *  (codex 5.65 R1-[medium]「存储先行、投影另批」之驳仍成立:本店 runId 唯一读点即行投影)。
-     *  wire 半场:HTTP 面零投影透传(sessions-list.ts,additive 键随行上 wire);sema-sdk spec
-     *  `SessionSummary` 闭集候 SDK 开键([ref]/.82 班车)——SDK 落键即端到端闭合。 */
-    noteTaskRun(sessionId: string, taskId: string, runId?: string): void;
+    /** S-1371:run 店里每个会话的 run 投影(按 sessionId 索引)。
+     *  **一次读**:run 店的 `listSessions` 本来就按会话聚合全账(无会话过滤口),这里取全量再按会话仓的 id 查表 —— 比逐会话 N 次读便宜,
+     *  也不在会话店里另存一份 run 账。读失败 ⇒ 抛(不吞成 `0 / ""`:那会把「读不到」说成「没跑过」)。 */
+    private runRollups;
+    /**
+     * 一行里 run 身份与计数的**唯一出处**(S-1371,会话行四位一源):四位全读 {@link runRollups} 的投影(与 SQL 双生的 `task_run` rn=1 JOIN 同口径);
+     * 该会话没有 run 行 ⇒ `0` / `""` / `null`、`lastTaskRunId` 缺席(TiDB 的 `COALESCE(…,0)` / null→"" 映射)。在途的最新一条:`lastRunId` 在场(run 行建出来就有)、
+     * `lastTaskRunId` 缺席(`result` 在终局与 park 时才写)。
+     */
+    private runProjectionOf;
     /** Synthesize a session's objective preview = the most-recent USER text message (the objective the run last saw).
      *  Reads the session's entries through the repo; any read error degrades to null (never fails the list). */
     private previewOf;

package/dist/plugins/local-session-store.js

@@ -12,9 +12,11 @@ import { carriedIncarnation, mintSessionIncarnation, sessionFaceFromRow } from "
 import { decodeInstructionSource, encodeInstructionSource, sameInstructionSourceBaseline } from "../instruction-source-notice.js";
 import { noteReplayInSessionOpenScope, openSessionForItself } from "../session-records-skipped-notice.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
+import { buildObjectivePreview } from "../user-authored-text.js";
 import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, } from "../session-sync-kernel.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const isNotFound = (e) => e instanceof SessionError && e.code === "not_found";
+const SESSION_OBJECTIVE_PREVIEW_CHARS = 200;
 function userText(entry) {
     if (entry.type !== "message")
         return null;
@@ -23,14 +25,12 @@ function userText(entry) {
         return null;
     const c = msg.content;
     if (typeof c === "string")
-        return c.trim() || null;
+        return c;
     if (Array.isArray(c)) {
-        const text = c
+        return c
             .filter((p) => !!p && typeof p === "object" && p.type === "text")
             .map((p) => p.text)
-            .join(" ")
-            .trim();
-        return text || null;
+            .join(" ");
     }
     return null;
 }
@@ -143,10 +143,10 @@ export function createLocalSessionRepo(root) {
 }
 export class LocalSessionStore {
     repo;
+    runs;
     retention = UNMANAGED_RETENTION;
     pending = new Map();
     lastActivity = new Map();
-    lastTaskRun = new Map();
     stagings = new Map();
     loaded;
     flushTimer;
@@ -159,8 +159,9 @@ export class LocalSessionStore {
     instructionSources;
     meta;
     log;
-    constructor(repo, dataDir, opts) {
+    constructor(repo, runs, dataDir, opts) {
         this.repo = repo;
+        this.runs = runs;
         this.sidecarPath = dataDir ? join(dataDir, "session-last-activity.json") : undefined;
         this.log = opts?.log ?? createLogger();
         const sidecar = (file, which, read, strict = false) => new SidecarMap(dataDir ? resolve(join(dataDir, file)) : undefined, `${file} (the local ${which} sidecar)`, read, (path, e) => this.refuseSidecar(path, `LocalSessionStore ${which} sidecar`, e, which), (e) => this.warnSidecar("write", e, which), strict);
@@ -403,6 +404,7 @@ export class LocalSessionStore {
         await this.titles.ensureLoaded();
         await this.meta.ensureLoaded();
         const metas = await this.repo.list();
+        const rollups = await this.runRollups();
         const all = [];
         for (const meta of metas) {
             const cell = this.meta.state.entries.get(meta.id);
@@ -411,17 +413,13 @@ export class LocalSessionStore {
                 continue;
             const firstActivityAt = meta.createdAt || new Date(0).toISOString();
             const lastActivityAt = this.lastActivity.get(meta.id) ?? firstActivityAt;
-            const lastRun = this.lastTaskRun.get(meta.id);
             all.push({
                 sessionId: meta.id,
                 owner,
                 lastActivityAt,
                 firstActivityAt,
-                runCount: 0,
                 objectivePreview: await this.previewOf(meta),
-                lastStatus: "",
-                lastRunId: lastRun?.taskId ?? null,
-                ...(lastRun?.runId !== undefined ? { lastTaskRunId: lastRun.runId } : {}),
+                ...this.runProjectionOf(meta.id, rollups),
                 title: this.titles.state.entries.get(meta.id) ?? null,
             });
         }
@@ -436,8 +434,12 @@ export class LocalSessionStore {
             : filtered;
         return after.slice(0, opts.limit);
     }
-    noteTaskRun(sessionId, taskId, runId) {
-        this.lastTaskRun.set(sessionId, { taskId, ...(runId !== undefined ? { runId } : {}) });
+    async runRollups() {
+        const rows = await this.runs.listSessions({ limit: Number.MAX_SAFE_INTEGER });
+        return new Map(rows.map((r) => [r.sessionId, { runCount: r.runCount, lastStatus: r.lastStatus, lastRunId: r.lastRunId, ...(r.lastTaskRunId !== undefined ? { lastTaskRunId: r.lastTaskRunId } : {}) }]));
+    }
+    runProjectionOf(sessionId, rollups) {
+        return rollups.get(sessionId) ?? { runCount: 0, lastStatus: "", lastRunId: null };
     }
     async previewOf(meta) {
         try {
@@ -445,8 +447,9 @@ export class LocalSessionStore {
             const entries = await session.getEntries();
             for (let i = entries.length - 1; i >= 0; i--) {
                 const text = userText(entries[i]);
-                if (text)
-                    return text.slice(0, 200);
+                const preview = text === null ? "" : buildObjectivePreview(text, SESSION_OBJECTIVE_PREVIEW_CHARS);
+                if (preview !== "")
+                    return preview;
             }
             return null;
         }
@@ -541,7 +544,6 @@ export class LocalSessionStore {
         }
         await this.dropMeta(sessionId);
         this.lastActivity.delete(sessionId);
-        this.lastTaskRun.delete(sessionId);
         for (const map of [this.titles, this.instructionSources]) {
             await map.ensureLoaded();
             if (map.state.entries.delete(sessionId))

package/dist/plugins/memory-run-store.js

@@ -224,9 +224,15 @@ export class MemoryRunStore {
             const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
             const latest = sorted[0];
             const latestRunId = latest.result?.runId;
-            const times = arr.map((r) => r.createdAt.getTime());
-            const last = Math.max(...times);
-            const first = Math.min(...times);
+            let last = -Infinity;
+            let first = Infinity;
+            for (const r of arr) {
+                const t = r.createdAt.getTime();
+                if (t > last)
+                    last = t;
+                if (t < first)
+                    first = t;
+            }
             summaries.push({
                 sessionId,
                 owner: latest.owner,

package/dist/plugins/one-time-migrations.js

@@ -162,6 +162,57 @@ export const ONE_TIME_MIGRATIONS = [
             "`AUTONOMY=plan` 的部署上按体里的原词重放(运维的 plan 不再被按段重钳)—— 升级前把这些停驻的 run 决掉 / 取消,或升级窗内设 `AUTONOMY=read-only`",
         reportKeys: [],
     },
+    {
+        id: "M13",
+        introducedIn: "7.123.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        removal: "删 `config-lkg.ts` 的 formatVersion 2 读回迁移:`migrateV2Lkg` / `migrateDroppedIdentityRow` / `RETIRED_CATALOG_COORDINATE` 与其上的窗注;`loadLkg` 的 2 臂" +
+            "(版本判据里的 `2` 与 `formatVersion === 2 ? migrateV2Lkg(…)` 那一支 —— 2 回到「unknown formatVersion」拒)、返回型的 `migrated` 位与 JSDoc 里说它的那一行、" +
+            "文件头注「2 读回时一次性迁移」那一句;`boot/web-admin.ts` 读 `read.migrated` 打 `config_lkg_migrated` 的那一行(formatVersion 1 迁移的同名事件那一行留);" +
+            "`migrateV1Lkg` 里不带 v1 的 etag 那一句旁注对 `migrateV2Lkg` 的引用(不带 etag 的规则本身留 —— v1 载荷同样没有完整的被丢条目记录);契约 §A.1d " +
+            "`droppedEntries` 一节「升级窗(如实)」那一条与 §A.1d `[config.model_refused_name_minted]` 那一条里「LKG 载体 `droppedIdentities` 读回时一次性迁移」那半句;手写 formatVersion 2 信封的测试夹具" +
+            "(`test/config-lkg.test.ts`、`test/config-hot/batch1-version-ordinal.test.ts` 改写成 3;`test/models-dropped-entries-s1295.test.ts` 的旧 LKG 迁移格改钉 2 读回不可用)",
+        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 2 答「unknown formatVersion 2」):2 读回 ⇒ 不可用,中心可达照拉(整拉,读腿铸出完整载体,新 LKG 按 3 覆盖)、" +
+            "断着则 env 兜底,下一份干净候选重写 —— 与回滚到 7.122.0 读 3 同一种处置",
+        reportKeys: [],
+    },
+    {
+        id: "M14",
+        introducedIn: "7.99.0",
+        releasedOn: "2026-09-24",
+        removableAfter: "2026-10-24",
+        removal: "删 `config-lkg.ts` 的 formatVersion 1 迁移:`legacyV1LkgPath` / `migrateV1Lkg` 与其上的窗注(`loadLkg` 的 1 臂今天已是拒句,不动);" +
+            "`boot/web-admin.ts` `bootFromLkg` 里调用 `migrateV1Lkg` 的那一段(含它打 `config_lkg_migrated` / 推不出身份时响亮拒的那两行);" +
+            "`migrateV1Lkg` 的测试格(`test/config-lkg.test.ts` v1 迁移组)",
+        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 1 答「pre-identity LKG (formatVersion 1) — not read back …」):旧默认路径上的 v1 文件不再被迁进箱、" +
+            "原样留在盘上;中心可达照拉(整拉,新 LKG 按现行箱名落盘)、断着则 env 兜底",
+        reportKeys: [],
+    },
+    {
+        id: "M15",
+        introducedIn: "7.124.0",
+        releasedOn: "2026-10-11",
+        removableAfter: "2026-11-10",
+        removal: "删 `config-lkg.ts` 的载荷迁移:`migrateLkgPayload` 与其上的窗注、`loadLkg` 里调它的那一段(载荷照旧过 `lkgPayloadProblem`)、`LkgReadMigration.receipts`" +
+            "(信封 2 → 3 的 M13 若已先删,`LkgReadMigration` 与 `migrated` 位一并删)、对 `@sema-agent/settings-schema/one-time-migrations` 的 import;`loadLkg` 的版本判据收成" +
+            "只认 4(3 回到「unknown formatVersion」拒);`boot/web-admin.ts` 读回后按 4 写回的那一段;文件头注 formatVersion 4 一段里「每次读回都过迁移」那一句;" +
+            "`test/ss11-stored-migrations.test.ts` 的 M15 组(4 原样读回那一格留)",
+        afterRemoval: "既有响亮臂 `config_lkg_unusable`(`loadLkg` 对 3 答「unknown formatVersion 3」):旧载荷的 LKG 读回 ⇒ 不可用,中心可达照拉(整拉,新 LKG 按 4 覆盖)、" +
+            "断着则 env 兜底 —— 与回滚到 7.123.0 读 4 同一种处置",
+        reportKeys: [],
+    },
+    {
+        id: "M16",
+        introducedIn: "7.124.0",
+        releasedOn: "2026-10-11",
+        removableAfter: "2026-11-10",
+        removal: "删 `config-d-migration.ts` 整只文件与两个入口的调用(`boot/web-admin.ts` 建本地配置源之后、`run-local.ts` 建配置源之后各一行 + import);" +
+            "`test/ss11-stored-migrations.test.ts` 的 M16 组;部署文档里「起服自动迁 config.d」那一句(运维仍可手跑契约命令行,直到契约删族)",
+        afterRemoval: "契约读腿的墓碑(永久):config.d 里还带旧形的域文档 —— `runtime.json` 带事实 ⇒ `RetiredDomainError` 整份读不出;`atModelAllowlist` / `models.default` ⇒ " +
+            "models 域降级、rosters 整份读不出 —— 拒句点名迁移 id;出路是运维手跑契约命令行(契约删族之后只剩手改)",
+        reportKeys: [],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;

package/dist/plugins/scheduler-support.d.ts

@@ -1,6 +1,6 @@
 import { SchedulerError } from "@sema-agent/core";
 import type { SchedulerCapability, ScheduledIntent, SchedulerContext, ScheduledTaskId, ScheduledTaskSummary } from "@sema-agent/core";
-import type { SchedulerRecord } from "@sema-agent/settings-schema/scheduler-store";
+import type { SchedulerParseWarning, SchedulerRecord } from "@sema-agent/settings-schema/scheduler-store";
 export type { SchedulerRecord };
 /** core `Result<T,E>` shape (harness/types) — `{ok:true,value} | {ok:false,error}`. */
 type Result<T, E> = {
@@ -31,23 +31,42 @@ export declare function validateIntent(intent: ScheduledIntent, caps: Caps, nowM
 export declare function defaultSchedulerStorePath(config: {
     readonly agentConfigDir?: string;
 }): string;
+/** 调度店读写的日志口(logger 的子集)。 */
+export interface SchedulerStoreLog {
+    warn(msg: string, meta?: Record<string, unknown>): void;
+    info(msg: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * 一次读的告警 → 日志(settings-schema 11 的调度店读口恒交回告警,没有静默模式)。告警是闭集,穷举;**不带记录原文**(`malformed-record`
+ * 的 `record` 可能是任意内容 —— 只报下标):
+ *  · `unreadable-file` ⇒ warn(整份文件不是 JSON 数组:读成零条,写者一律不写 —— 见 `mutateSchedulerStore`);
+ *  · `malformed-record` ⇒ warn(这一条读不懂、被跳过;下一个写者落盘时它就没了);
+ *  · `stale-session-record` ⇒ info(会话链上过期 ≥ 7 天的记录,读时丢、下一个写者落盘);
+ *  · `one-time-migration` ⇒ info(SS-M3 的读时改写收据:durable 记录换上新键,下一个写者落盘)。
+ */
+export declare function logSchedulerWarnings(log: SchedulerStoreLog, path: string, warnings: readonly SchedulerParseWarning[]): void;
 /**
- * File-backed SchedulerCapability (durable across daemon restarts). Store = a single JSON file (atomic write via
- * the registry-core /node binding). The resident shell daemon reads the same store to fire intents. `now`
- * injectable for tests.
+ * File-backed SchedulerCapability (durable across daemon restarts). Store = a single JSON file shared with the resident shell
+ * daemon. Every WRITE goes through the contract's ONE mutation primitive `mutateSchedulerStore` (optimistic witness + atomic
+ * write; a naked load → save is the lost-update race against the daemon's fire / reap writers). A store file that is not a JSON
+ * array is `unreadable_file`: nothing is written over it (the caller gets an `io` error). Reads (`list`) use the contract's read
+ * port; every read's warnings go to the log ({@link logSchedulerWarnings}). `now` injectable for tests.
  */
 export declare class FileSchedulerBackend implements SchedulerCapability {
     readonly schedulerCapabilities: Caps;
     private readonly storePath;
     private readonly now;
-    /** `storePath` 必填:路径是装配层从配置定的事实(`SCHEDULER_STORE_PATH` ?? {@link defaultSchedulerStorePath}),本类不自己找缺省。 */
+    private readonly log;
+    /** `storePath` 必填:路径是装配层从配置定的事实(`SCHEDULER_STORE_PATH` ?? {@link defaultSchedulerStorePath}),本类不自己找缺省。
+     *  `log` 必填:店的每次读都交回告警(读不懂的文件 / 被跳过的记录 / 读时改写),没有不出声的读法。 */
     constructor(opts: {
         storePath: string;
+        log: SchedulerStoreLog;
         caps?: Partial<Caps>;
         now?: () => number;
     });
-    private load;
-    private save;
+    /** 一次读改写(契约的唯一写原语)。`fn` 必须纯、可重放(并发写者落地时整段重放);返回 `null` = 不写。拿不到结果的三形各成一个 `io` 错。 */
+    private mutate;
     schedule(intent: ScheduledIntent, ctx: SchedulerContext): Promise<Result<{
         id: ScheduledTaskId;
     }, SchedulerError>>;

package/dist/plugins/scheduler-support.js

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { randomBytes, createHash } from "node:crypto";
 import { SchedulerError, isValidCronExpr } from "@sema-agent/core";
-import { loadSchedulerStore, saveSchedulerStore } from "@sema-agent/settings-schema/node";
+import { loadSchedulerStore, mutateSchedulerStore } from "@sema-agent/settings-schema/node";
 import { configRootOf } from "../sema-config-dir.js";
 const ok = (value) => ({ ok: true, value });
 const err = (error) => ({ ok: false, error });
@@ -62,20 +62,67 @@ function computeNextRunMs(when, nowMs) {
 export function defaultSchedulerStorePath(config) {
     return join(configRootOf(config), "scheduled_tasks.json");
 }
+export function logSchedulerWarnings(log, path, warnings) {
+    for (const w of warnings) {
+        switch (w.kind) {
+            case "unreadable-file":
+                log.warn("scheduler_store_unreadable", { path, why: w.why, note: "the scheduled-task store is not a JSON array — it reads as zero records and no writer overwrites it; fix or remove the file" });
+                break;
+            case "malformed-record":
+                log.warn("scheduler_store_record_malformed", { path, index: w.index, note: "this record does not read and is skipped (the next write drops it)" });
+                break;
+            case "stale-session-record":
+                log.info("scheduler_store_record_stale", { path, index: w.index, id: w.id, note: "a session-chained record whose next run is ≥ 7 days past — dropped on read (the next write persists the drop)" });
+                break;
+            case "one-time-migration":
+                log.info("scheduler_store_record_migrated", { path, index: w.index, migration: w.receipt.migration, appliedAs: w.receipt.appliedAs, note: "settings-schema one-time migration rewrote this record on read (the next write persists it)" });
+                break;
+            default: {
+                const unhandled = w;
+                throw new Error(`scheduler store: unknown read warning ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
+}
 export class FileSchedulerBackend {
     schedulerCapabilities;
     storePath;
     now;
+    log;
     constructor(opts) {
         this.schedulerCapabilities = { ...DEFAULT_SCHEDULER_CAPS, ...(opts.caps ?? {}) };
         this.storePath = opts.storePath;
+        this.log = opts.log;
         this.now = opts.now ?? (() => Date.now());
     }
-    load() {
-        return loadSchedulerStore(this.storePath);
-    }
-    save(records) {
-        saveSchedulerStore(this.storePath, records);
+    mutate(fn, what) {
+        let result;
+        let produced = false;
+        let mutation;
+        try {
+            mutation = mutateSchedulerStore(this.storePath, (records) => {
+                const r = fn(records);
+                result = r.result;
+                produced = true;
+                return r.next;
+            }, { nowMs: this.now() });
+        }
+        catch (e) {
+            return err(new SchedulerError("io", `failed to ${what}`, e));
+        }
+        logSchedulerWarnings(this.log, this.storePath, mutation.warnings);
+        if (mutation.ok || mutation.reason === "aborted")
+            return produced ? ok(result) : err(new SchedulerError("io", `failed to ${what}`));
+        switch (mutation.reason) {
+            case "unreadable_file":
+                return err(new SchedulerError("io", `failed to ${what}: the scheduled-task store file is not a JSON array — nothing was written over it`));
+            case "conflict_exhausted":
+                return err(new SchedulerError("io", `failed to ${what}: concurrent writers kept changing the store — nothing was written`));
+            default: {
+                const unhandled = mutation;
+                throw new Error(`scheduler store: unknown mutation outcome ${JSON.stringify(unhandled)}`);
+            }
+        }
     }
     async schedule(intent, ctx) {
         const nowMs = this.now();
@@ -88,60 +135,56 @@ export class FileSchedulerBackend {
         if (intent.lifetime === "session" && this.schedulerCapabilities.supportsSessionLifetime === false) {
             return err(new SchedulerError("invalid_schedule", 'lifetime:"session" is not supported on this deployment (no resident daemon reaps session-lifetime records — the row would be an orphan)'));
         }
-        const records = this.load();
         const key = dedupKey(ctx.scope, intent, ctx.sessionId);
-        const existingIdx = records.findIndex((r) => {
-            const rr = r;
-            return r.scope === ctx.scope && dedupKey(r.scope, { when: r.when, label: r.label, lifetime: rr.lifetime }, r.sessionId) === key;
-        });
-        const scopeCount = records.filter((r) => r.scope === ctx.scope).length;
-        if (existingIdx < 0 && scopeCount >= this.schedulerCapabilities.maxScheduledPerScope) {
-            return err(new SchedulerError("limit_exceeded", `scope at cap (${this.schedulerCapabilities.maxScheduledPerScope})`));
-        }
-        const id = (existingIdx >= 0 ? records[existingIdx].id : randomBytes(12).toString("base64url"));
-        const rec = {
-            id,
-            scope: ctx.scope,
-            ...(ctx.principal ? { principal: ctx.principal } : {}),
-            ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
-            prompt: intent.prompt,
-            when: intent.when,
-            ...(intent.label ? { label: intent.label } : {}),
-            ...(intent.mode ? { mode: intent.mode } : {}),
-            ...(intent.lifetime ? { lifetime: intent.lifetime } : {}),
-            ...(intent.recurring !== undefined ? { recurring: intent.recurring } : {}),
-            createdMs: nowMs,
-            ...(computeNextRunMs(intent.when, nowMs) !== undefined ? { nextRunMs: computeNextRunMs(intent.when, nowMs) } : {}),
-        };
-        if (existingIdx >= 0)
-            records[existingIdx] = rec;
-        else
-            records.push(rec);
-        try {
-            this.save(records);
-        }
-        catch (e) {
-            return err(new SchedulerError("io", "failed to persist scheduled task", e));
-        }
-        return ok({ id });
+        const decided = this.mutate((records) => {
+            const existingIdx = records.findIndex((r) => {
+                const rr = r;
+                return r.scope === ctx.scope && dedupKey(r.scope, { when: r.when, label: r.label, lifetime: rr.lifetime }, r.sessionId) === key;
+            });
+            const scopeCount = records.filter((r) => r.scope === ctx.scope).length;
+            if (existingIdx < 0 && scopeCount >= this.schedulerCapabilities.maxScheduledPerScope) {
+                return { next: null, result: err(new SchedulerError("limit_exceeded", `scope at cap (${this.schedulerCapabilities.maxScheduledPerScope})`)) };
+            }
+            const id = (existingIdx >= 0 ? records[existingIdx].id : randomBytes(12).toString("base64url"));
+            const rec = {
+                id,
+                scope: ctx.scope,
+                ...(ctx.principal ? { principal: ctx.principal } : {}),
+                ...(ctx.sessionId ? { sessionId: ctx.sessionId } : {}),
+                prompt: intent.prompt,
+                when: intent.when,
+                ...(intent.label ? { label: intent.label } : {}),
+                ...(intent.mode ? { mode: intent.mode } : {}),
+                ...(intent.lifetime ? { lifetime: intent.lifetime } : {}),
+                ...(intent.recurring !== undefined ? { recurring: intent.recurring } : {}),
+                createdMs: nowMs,
+                ...(computeNextRunMs(intent.when, nowMs) !== undefined ? { nextRunMs: computeNextRunMs(intent.when, nowMs) } : {}),
+            };
+            const next = existingIdx >= 0 ? records.map((r, i) => (i === existingIdx ? rec : r)) : [...records, rec];
+            return { next, result: ok({ id }) };
+        }, "persist scheduled task");
+        return decided.ok ? decided.value : decided;
     }
     async cancel(id, ctx) {
-        const records = this.load();
-        const idx = records.findIndex((r) => r.id === id);
-        if (idx < 0 || records[idx].scope !== ctx.scope) {
-            return err(new SchedulerError("not_found", `no scheduled task ${id} in your scope (wrong id, already cancelled, or not yours)`));
-        }
-        records.splice(idx, 1);
+        const decided = this.mutate((records) => {
+            const idx = records.findIndex((r) => r.id === id);
+            if (idx < 0 || records[idx].scope !== ctx.scope) {
+                return { next: null, result: err(new SchedulerError("not_found", `no scheduled task ${id} in your scope (wrong id, already cancelled, or not yours)`)) };
+            }
+            return { next: records.filter((_, i) => i !== idx), result: ok(undefined) };
+        }, "persist cancellation");
+        return decided.ok ? decided.value : decided;
+    }
+    async list(ctx) {
+        let read;
         try {
-            this.save(records);
+            read = loadSchedulerStore(this.storePath, { nowMs: this.now() });
         }
         catch (e) {
-            return err(new SchedulerError("io", "failed to persist cancellation", e));
+            return err(new SchedulerError("io", "failed to read the scheduled-task store", e));
         }
-        return ok(undefined);
-    }
-    async list(ctx) {
-        const summaries = this.load()
+        logSchedulerWarnings(this.log, this.storePath, read.warnings);
+        const summaries = read.records
             .filter((r) => r.scope === ctx.scope)
             .map((r) => ({
             id: r.id,

package/dist/plugins/session-policy-store-sql.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { assertSessionRuleNamesCurrent, loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
-import { assertSessionRuleNamesReachable, readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
+import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
 import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText } from "./sql-json-column.js";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
@@ -105,7 +105,6 @@ export class SqlSessionPolicyStore {
             }
             const clean = normalizeRules(stripRev(rules));
             assertSessionRuleNamesCurrent(clean);
-            assertSessionRuleNamesReachable(clean);
             if (prior && opts?.operator !== true) {
                 const loosens = loosenReasons(prior, clean);
                 if (loosens.length > 0) {

package/dist/plugins/store-backend.js

@@ -242,12 +242,12 @@ class LocalBackend {
             throw new Error(`DB_BACKEND=local cannot open data dir ${root}: ${e instanceof Error ? e.message : String(e)}` +
                 (tail === undefined ? "" : ` ${tail}`));
         }
-        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.fileBackend.root, { log: createLogger(config.logLevel) });
         const corruptReadWarn = (msg, fields) => this.discloseWarn(msg, fields);
         this.runStore = new FileRunStore(this.fileBackend.root, {
             error: (msg, fields) => void (this.onError ?? this.onWarn)?.(msg, fields),
             strictHydrate: config.runStoreStrictHydrate,
         });
+        this.sessionStore = new LocalSessionStore(createLocalSessionRepo(this.fileBackend.root), this.runStore, this.fileBackend.root, { log: createLogger(config.logLevel) });
         this.resumeAnchorStore = new FileResumeAnchorStore(this.fileBackend.root);
         this.approvalExemptionStore = new FileApprovalExemptionStore(this.fileBackend.root, { warn: corruptReadWarn });
         this.approvalNonceStore = new FileApprovalNonceStore(this.fileBackend.root, { warn: corruptReadWarn });

package/dist/plugins/store-contracts.d.ts

@@ -216,7 +216,7 @@ export interface RunRecord {
      *  被取消了没有」看终局码;判「一条还在跑的 run 上有没有人按过取消」才看这一位。 */
     cancelRequested: boolean;
     /** First ~120 chars of the objective (secret-redacted at write) — the list's "what is this task" glance.
-     *  null for rows predating the column. */
+     *  一个事实位:`""` = 建过预览、剥完没有用户正文(只有注入块 / 空 objective);null = 没记录(更早版本建的行 / 列前的行)。 */
     objectivePreview: string | null;
     createdAt: string;
     updatedAt: string;
@@ -337,9 +337,8 @@ export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
  * 两个不同的忙闲。
  *
  * 🔴 **未知词 / 无读数 ⇒ 词缺席(`undefined`),不是 `idle`**(诚实缺席,不是静默兜底):
- *  · `lastStatus === ""` 有两个真来源 ——(a)SQL 双生:这条会话**还没有任何 run**;(b)local 文件车道:
- *    该 lister **结构上说不出** run 状态(`local-session-store.ts:465` 自陈的诚实降级 `lastStatus: ""`)。
- *    两者都不是「我知道它闲着」,所以都不许铸出 `idle` 这个断言;
+ *  · `lastStatus === ""` 的真来源:这条会话**还没有任何 run**(SQL 双生与 local 会话店同;local 会话店的 run 店是必填位,没有「说不出 run 状态」的装配形)。
+ *    它不是「我知道它闲着」,所以不许铸出 `idle` 这个断言;
  *  · 读不懂的词(滚动升级里新副本写入的新状态词经裸 cast 读到本进程)同判 —— 与
  *    {@link isTerminalRunStatus} 族的保守方向一致。
  *  · **缺席怎么渲染是 core 的辖域,本仓一个字都不复述**(S-514-JU:此处原写着「core 对缺席渲染成 `idle`」
@@ -407,6 +406,23 @@ export interface SessionSummary {
      *  titled OR the lister face has no session_meta (the legacy task_run aggregate / memory twins — honest degrade). */
     title: string | null;
 }
+/**
+ * S-1371 —— 会话**枚举面**读 run 账里「每会话的 run 投影」的窄读面:`runCount` / `lastStatus` / `lastRunId` / `lastTaskRunId` 四位,
+ * 同一次读、同一条「最新一条」的口径。
+ *
+ * 为什么是 run 店自己的 `listSessions`、不另造一只读口:这四位在 SQL 双生里就是 `task_run` 的 `rn=1` JOIN(计数、最新一条的状态与 task_id、
+ * 最新一条 `result.runId`),在文件 / 内存 run 店里就是 `listSessions` 的同口径聚合(`created_at DESC, task_id DESC` 取最新一条、数全部)——
+ * 它们本来就是**同一个问题的同一份答案**。local 会话店(会话身份来自会话仓、不是 run 账)读这一只,一行里就不会出现两个来源各答一遍
+ * 「最新一条是谁」(此前 `runCount` / `lastStatus` 读 run 店、`lastRunId` / `lastTaskRunId` 读进程内座:重启后同一行「有终态词、`lastRunId` 为 null」);
+ * 不另造的另一半理由:再造一只 `listBySession` 就要在三个孪生里各落一遍并重新证一遍同口径。
+ *
+ * 只收四位:`Pick` 把读面钉死在它真用的键上(其余键 —— 预览 / 属主 / 时刻 —— 在会话仓那边另有来源,不许从这里混读)。
+ */
+export interface SessionRunRollupSource {
+    listSessions(opts: {
+        limit: number;
+    }): Promise<ReadonlyArray<Pick<SessionSummary, "sessionId" | "runCount" | "lastStatus" | "lastRunId" | "lastTaskRunId">>>;
+}
 /**
  * S-297 —— 「这个会话**最近一条腿**是哪一条 run」的窄读面(`latestRunForSession` 的回值)。
  *

package/dist/plugins/web-search.d.ts

@@ -40,7 +40,7 @@
  *    换的时候要核对的等价点:本文件的 `normalize()` 统一形状 + `max` 截断 +
  *    `setWebSearchBadPayloadObserver` 观测器,core 的 adapter 都没有,得在外层补回来。
  *
- * ③ **四级优先级语义未定**(env / config-center / per-scenario / per-request 谁压谁)。
+ * ③ **四级优先级语义未定**(env / web-admin / per-scenario / per-request 谁压谁)。
  *    🔴 三问里「谁被伤」这条决定了默认值:一个**只配了模型 key** 的既有部署,若新语义让某一级
  *    能自行打开搜索,它就在升级后**凭空长出一条出网工具** —— 那是安全姿态变更,不是特性。
  *    ⇒ 语义定稿前,任何新的开启通道**默认 OFF**;开启必须是部署方的显式动作。