@sema-agent/server 7.125.1 → 7.126.0

package/dist/observability/fail-open.js

@@ -118,7 +118,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.approvals.park-row-blob-unreadable": {
         cls: "F",
-        note: "S-700(`plugins/checkpoint-store-sql.ts` 的 `readParkRowFactsCell`):运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint` 列里寄存行的 **`pendingAction` 子树**(NP-3 / 7.100.0 起引擎内只取这一棵、整只快照不出库;只为 park 行事实 `requiresRealApproval` / `ruleOffersAbsence` / `mandated`(S-663 二段,core #1079)/ `mandate`(S-721)/ `origin`(S-755)而读 —— 事实位的真源是 `approval-card.ts` 的 `ParkRowFacts`)**在场却不是一只对象**(JSON `null` 字面 / 串 / 数 —— 手改 / 迁移脚本改过)。子树**缺席**(SQL NULL:成员不在,或整只文档不是对象 —— 后者 `get()` 照旧拒;MariaDB 文本承载上的非 JSON 字节同样答 SQL NULL)⇒ 事实缺席、不计数。放行的最坏后果 = **这一行**的 park 行事实(`ParkRowFacts` 各位)缺席(展示/分诊材料;core 定性 display metadata,resume 的带子读 gate 自己的位),队列其余部分照常 —— 而这一行本来就 resume 不了(`get()` 对同一格拒)。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 blob 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),与同一 `rows.map` 里 `rule_suggestions` / `risk_descriptor` 两格同族同判。故 F 类;tag 与那两格**分开计**(哪一格在坏要读得出来)。计数非零 = 这一行的 decide 同样读不动(`get()` 对同一格拒),去按 session 查那一行。",
+        note: "S-700(`plugins/checkpoint-store-sql.ts` 的 `readParkRowFactsCell`):运维待批队列(`GET /v1/approvals` / `/stream`)的某一行,`checkpoint` 列里寄存行的 **`pendingAction` 子树**(NP-3 / 7.100.0 起引擎内只取这一棵、整只快照不出库;只为 park 行事实 `requiresRealApproval` / `ruleOffersAbsence` / `mandated`(S-663 二段,core #1079)/ `mandate`(S-721)/ `origin`(S-755)而读 —— 事实位的真源是 `approval-card.ts` 的 `ParkRowFacts`)**在场却不是一只对象**(JSON `null` 字面 / 串 / 数 —— 手改 / 迁移脚本改过)。子树**缺席**(SQL NULL:成员不在,或整只文档不是对象 —— 后者 `get()` 照旧拒;MariaDB 文本承载上的非 JSON 字节同样答 SQL NULL)⇒ 事实缺席、不计数。放行的最坏后果 = **这一行**的 park 行事实(`ParkRowFacts` 各位)缺席(展示/分诊材料;core 定性 display metadata,resume 的带子读 gate 自己的位),队列其余部分照常 —— 而这一行本来就 resume 不了(`get()` 对同一格拒)。不放行的代价是整只 `rows.map` 抛出 ⇒ 一行坏 blob 打掉整个租户的队列(列表 500、SSE 心跳照常而队列永远空),与同一 `rows.map` 里 `rule_suggestions` / `risk_descriptor` 两格同族同判。故 F 类;tag 与那两格**分开计**(哪一格在坏要读得出来)。计数非零 = 这一行的 decide 同样读不动(`get()` 对同一格拒),去按 session 查那一行。 **第二座 `member=gate`**(`readParkGateCell`:同一列的 **`gate` 子树**在场却不是一只对象 —— 队列行的卡词与到期两条腿的分法都读它):读不出 = 门上无卡,队列行不带卡词,**到期改道** —— core `facetOf` 读「无卡 = 不是一问」为 `A`,所以一张本该到期**作废**的问答行改走 SLA **拒扫腿**(模型拿到一次「拒」而不是整条 run 作废);改道后的续跑 `get()` 对同一份坏 blob 响亮拒(拒扫腿每拍一条失败),行留停驻、由 `terminal_at_ms` 兜底收割 —— 所以最坏后果**不是**「只少展示」,是一张问答行的到期去向变了、最长挂到绝对上限。放行仍对:不放行的代价与 pendingAction 座同(一行坏 blob 打掉整个租户的队列与到期读腿)。计数 detail = `member=gate` 时,去按 session 查那一行的 `checkpoint.gate`。",
     },
     "server.sql-json.checkpoint.pending-steer-queue-lossy": {
         cls: "F",
@@ -206,7 +206,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.hooks.matcher-unjudged": {
         cls: "F",
-        note: "S-995(`hooks/hook-runner.ts` 的 `deadToolMatcherIssue`,fresh 受理面「工具事件 matcher 选中别名而选不中正名 ⇒ 400」判据的**未判**臂;detail = `event=… reason=… matcherChars=…`,不带 matcher 原字节):一只 matcher 没能被判 ⇒ 照旧受理。判据一条顺序、两档共用(7.114.0 修复轮):长度上限 → 形只问契约包的 `hookMatcherForm`(literal 形〔名字表 / 空 / `*`〕两档都直接问 `hookMatcherSelects`、不占预算;regex 形 regex 档把同一只契约函数交进 vm 带预算、literal 档不适用;invalid 形 regex 档直接记 `invalid_regex`、literal 档不适用)。三种 reason 同一个 tag —— `oversize`(两档:超 8 192 字符不读;多租户车道上 hooks 不装配,这一笔只为让超长输入显形)/ `over_budget`(regex 档正则形:一次受理共享的 100 ms 墙钟预算用尽,`node:vm` 的 timeout 打断正则回溯)/ `invalid_regex`(regex 档正则形编不过;确定性的坏配置,运行期另记 `hook_matcher_invalid`,拒它是新检测臂、不在本规则)。**不记**的:literal 档(多租户车道)遇正则形 = 不适用 —— 该车道 hooks 整只不装配,没有被守的对象,不是未判。放行的最坏后果 = **那一只 matcher 没被这条判据守住**:它若真写了别名,照旧永不命中(7.112.0 对正则形一律不判,同一后果);**不是安全闸**(受理面的有效性判 = S-924 的「响亮」,决定不了任何放行 / 拒绝 / 权限;hook 的 deny 语义在运行期 hook-runner)。反方向(越界即拒)会把负载抖动 / 病态但合法的 matcher 变成对合法请求的 400。拒放集合相对 7.113.0 的一处放宽:超过上限的字面别名 matcher 7.113.0 拒、7.114.0 两档未判受理(已披露)。计数让「受理面一直判不了」(攻击者喂灾难正则 / 超长 matcher)显形。",
+        note: "S-995(`hooks/hook-runner.ts` 的 `toolMatcherIssue`,fresh 受理面「工具事件 matcher 选中别名而选不中正名 ⇒ 400」判据的**未判**臂;detail = `event=… reason=… matcherChars=…`,不带 matcher 原字节):一只 matcher 没能被判 ⇒ 照旧受理。判据一条顺序、两档共用(7.114.0 修复轮):长度上限 → 形只问契约包的 `hookMatcherForm`(literal 形〔名字表 / 空 / `*`〕两档都直接问 `hookMatcherSelects`、不占预算;regex 形 regex 档把同一只契约函数交进 vm 带每次求值各一份的固定预算〔超时 = 灾难回溯 ⇒ 确定的 400 拒,不是未判、不登记〕、literal 档不适用;invalid 形 regex 档 = 确定的 400 拒〔S-1455 收尾:不是未判、不登记;运行期另记 `hook_matcher_invalid`〕、literal 档不适用)。现在只有一种 reason —— `oversize`(两档:超 8 192 字符不读;多租户车道上 hooks 不装配,这一笔只为让超长输入显形)。`invalid_regex` 臂自 S-1455 收尾(7.126.0)起退役:它是确定性的坏配置、不是「判不了」,与超预算同类 ⇒ 受理当场 400。**不记**的:literal 档(多租户车道)遇正则形 = 不适用 —— 该车道 hooks 整只不装配,没有被守的对象,不是未判。放行的最坏后果 = **那一只 matcher 没被这条判据守住**:它若真写了别名,照旧永不命中(7.112.0 对正则形一律不判,同一后果);**不是安全闸**(受理面的有效性判 = S-924 的「响亮」,决定不了任何放行 / 拒绝 / 权限;hook 的 deny 语义在运行期 hook-runner)。拒放集合相对 7.113.0 的一处放宽:超过上限的字面别名 matcher 7.113.0 拒、7.114.0 两档未判受理(已披露)。计数让「受理面一直判不了」(超长 matcher)显形。",
     },
     "server.hooks.notice-sink-threw": {
         cls: "F",
@@ -273,7 +273,7 @@ export const FAIL_OPEN_TAGS = {
     "server.redact.ppk-eat-to-end": { cls: "F", note: "S-107 第三十二轮重扫:PuTTY .ppk 容器扫描器(redact.ts redactPpkContainers)在「无合格终止 / 收口后同容器范围再见私钥字段 / 收口后到下一版本头之间夹非空白」三形下从头**吃到输入末尾**(fail-closed 取证丢弃)——终态 errorMessage 座上=整条错误文案变成 «redacted:private-key»,与 redactions_applied_total{private-key} 的诚实替换同形不可分,故要有自己的计数/探针;影子扫不计;计数=多少次整段吃尾。" },
     "server.approval-card.closed-word-out-of-set": {
         cls: "F",
-        note: "S-249(`approval-card.ts` 的边界窄读族;今天三个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛)、S-1170 起的 `classifierNoRuling`(core 7.43.0 #1353 的成因词,活卡帧读 `AskRequest.classifierNoRuling`,闭集筛 = core `isAutoModeFallbackCause`)与 `differs`(core 7.44.0 #1374,载体是 `runs.ts` 的 409 `steering.duplicate_input_id` 体读的引擎拒错 `detail.differs`,闭集筛 = core `STEER_REPLAY_FACETS` 的非空子集;集外成员 / 空 / 非数组 ⇒ 不铸 `detail`,码仍是契约);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` / `classifierNoRuling=` / `differs=` 判别是哪一座):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
+        note: "S-249(`approval-card.ts` 的边界窄读族;今天四个成员:`readRuleOffersAbsence`、S-934 ② 起的 `readAskClassPair`(core 7.37.0 #1214 的类对 `askClass` / `classes`,活卡帧 / 呈卡帧的卡 / 运维队列行同一只,判法 = core 屏 `screenAskClassMembers`(S-955 ⑥ / core 7.38.0 #1249,本仓零自写对判),两键同在同缺,半对 / 集外 / 首员不符 / 重复员 = 屏拒 = 读不出;detail 前缀 `askClass=` / `classes=`),与 S-721 起的 `readClosedWordSeat` —— 一座一只 core 成员筛,座是参数:`mandate`(core 7.32.0 #1092,活卡帧 / 活挂起行 / 运维队列行同一只,闭集筛 = core `isPersistedRuleMandate`)与 S-755 起的 `origin`(运维队列行读 park 行孪生座,闭集筛 = core `isAskOrigin`,与 inbox 行 core 投影处同一只筛)、S-1170 起的 `classifierNoRuling`(core 7.43.0 #1353 的成因词,活卡帧读 `AskRequest.classifierNoRuling`,闭集筛 = core `isAutoModeFallbackCause`)与 `differs`(core 7.44.0 #1374,载体是 `runs.ts` 的 409 `steering.duplicate_input_id` 体读的引擎拒错 `detail.differs`,闭集筛 = core `STEER_REPLAY_FACETS` 的非空子集;集外成员 / 空 / 非数组 ⇒ 不铸 `detail`,码仍是契约);detail 前缀 `ruleOffersAbsence=` / `mandate=` / `origin=` / `classifierNoRuling=` / `differs=` 判别是哪一座;第四个成员是 `approval-content-kind.ts` 的 `readApprovalCard` —— 卡词 `approvalCard` 自己的闭集窄读,活 ask / LOCAL 店停驻门 / SQL 店读出的门子树三个载体共用一只,闭集 = core `TOOL_APPROVAL_CARDS`,detail 前缀 `approvalCard=`):活卡帧 / `card_json` / (S-700 起)运维队列行(`parkRowFacts` 读寄存行上的 park 孪生座;队列是热读面 ⇒ 同一行每读一次计一次)的一个**闭集词**座上,键在场而词不在本仓认得的那张表里(世代差,或第三方 producer)⇒ 该座**按缺席**处置。放行的最坏后果=卡上少一行「为什么这次没有规则候选」的解释(壳退回不显示该行),它**不改变任何裁决**——门在引擎里早已判完,本座是展示/观测面;反方向(把一个消费端词表外的值原样上卡)更坏:下游按闭集写的分支会落进 default 臂或渲染出生词。本臂存在的全部理由是**判别**:修前「上游发了个生词」与「上游根本没发这个键」在遥测上同形,而前者意味着本仓的词表该跟着 core 加词了(型面另有两向编译围栏,但那只在**重新编译**时说话,跑在线上的那一版不会自己红)。detail 带座名与那个词(经 redactSecrets 截 40);数 / 布尔等原始值原样,对象 / 数组 / 函数 / null 只报形名(`<object>` / `<array>` / `<function>` / `<null>`,S-700 codex r1:格式化从不调用值自己的转换方法 —— 持久层里一格 `{\"toString\":null}` 曾让诊断本身抛出、打掉整只队列)。",
     },
     "server.pg-pool.idle-client-error": {
         cls: "F",
@@ -379,6 +379,18 @@ export const FAIL_OPEN_TAGS = {
         bound: "FLEET_LEASE_OUTAGE_MAX_MS",
         note: "`fleet/serving-lease.ts` 的 `noteCenterCapabilities`(fleet 成员每一次中心能力读数;detail = `worker=<w> generation=<g> was=<enabled|none>`):中心答复体读得出、却**没有宣告** `servingLease`(老中心 `{ ok: true }` / 降级中心 / 位撤掉)⇒ 规则 1:租约不生效,`leaseState: none`,零续租、零 503 —— 这只 fleet 成员此刻**不受围栏**。答复体读不出不进这一臂(那是「没有读数」,上一次的位与钟原样,`fleet-client.ts` `capabilityReadingOf`);已被拒的实例不进(拒是黏的,位消失不复活)。归 R:能力门控是契约规则(中心不宣告 = 中心不执行围栏),裁定写定替换只来自中心权威终止或运维覆盖;位只开关围栏、不碰钟 —— 位缺席期间 `T_max` 的钟照走(最后一次授予的到期 / 本进程第一次见到位的时刻),位一回来即按它判,所以位的抖动绕不过 `FLEET_LEASE_OUTAGE_MAX_MS`。放行的最坏后果 = 中心不执行围栏期间,一只被取代的实例照常服务(这一段由中心的选择定界,不由引擎)。计数长期保留:非零 = 这台中心没宣告租约能力。",
     },
+    "server.workspace-cache.unavailable": {
+        cls: "F",
+        note: "k8s 车道按工作区空间的构建缓存卷(`WORKSPACE_CACHE=volume`,`plugins/remote-env-k8s.ts` 连沙箱那一步):这条 run 拿不到它空间的缓存卷 —— 卷建不成(RBAC 少动词 / API 拒 / 网络错,`reason=claim_failed`)、卷在快照时限内没绑定(集群没有缺省 StorageClass / 供给器不在,`reason=claim_unbound`)、卷绑上了而挂着它的 pod 起不来(挂载失败 / 卷所在节点没了,`reason=claim_unmountable`)—— 后两种把等它的那只 pod 删掉,换一只不挂卷的 —— 、或本副本读不出会话住客没有空间键(`reason=incarnation_unknown`)⇒ run **照常起**:不挂卷、不注入工具缓存 env,工具按镜像自己的缓存目录工作(每轮重下依赖)。放行的最坏后果 = 这一轮构建慢(缓存定义上可再生),不是门、不是凭据、不碰工作区与快照;反方向(卷拿不到就拒这一轮)会让一个缓存把整条 run 打掉。同拍一行运维日志 `workspace_cache_unavailable`(`space` 前缀 / `reason` / `error`)。计数非零 = 这台部署开了缓存卷却拿不到,运维去看 StorageClass / Role / 配额。",
+    },
+    "server.workspace-cache.reclaim-failed": {
+        cls: "F",
+        note: "k8s 车道按工作区空间的构建缓存卷的**回收**(`plugins/remote-env-k8s.ts` `createSpaceReclaimer`;两条腿同一只回收座:会话删除协调器 `boot/session-faces.ts` `purgeSession` 与托管留存 sweep `boot/retention-lane.ts` 删掉会话树之后):按标签 `sema.space=<空间摘要>` 删卷的请求失败(Role 少 `deletecollection` / API 拒 / 网络,`reason=delete_failed`)、回收座这次调用的绝对截止(= 快照时限)先到(请求没发或在途被切,`reason=budget`),或在线腿删除前读不出被删会话的住客(`reason=occupant_unreadable`;化身缺席的存量行 = 没有空间,不计)⇒ 卷留着(住客读不出时该空间的快照对象也没回收,归桶的生命周期规则),会话照删(不挡删除)。放行的最坏后果 = 节点盘上多留一只没人再用的卷(存储泄漏,不碰任何别的空间、不是门不是凭据);反方向(删卷失败就拒删会话)会让一个缓存挡住删除权。同拍一行 `workspace_cache_reclaim_failed`(回收座的两形:`space` 前缀 / `label` / `reason` / `error`;住客读不出那一形:`sessionId` / `reason` / `error`)。计数非零 = 有卷没回收掉,运维按行里的标签手清,并核 Role。",
+    },
+    "server.workspace-space.reclaim-failed": {
+        cls: "F",
+        note: "k8s 车道工作区空间结束时对**快照对象**的回收(`plugins/remote-env-k8s.ts` `createSpaceReclaimer` 的对象部分;与上一条同一只回收座、两条腿:会话删除协调器与托管留存 sweep):按空间的 `<前缀>/<化身>/space/` 分区(快照 + `latest`)和该会话停驻车道里名字带被结束住客归属记号的 `<前缀>/<会话 id>/*.tar.gz` 分别 LIST、逐个预签 DELETE;LIST 失败、DELETE 失败(HTTP 非 2xx / 非 404、网络)LIST 超过 1000 个对象被截断,或回收座一次调用的绝对截止(= 快照时限;卷回收也在内)到点〔切断在途请求、停掉余下的;这次调用里还没轮到的空间零请求、各记一次;没删的归生命周期规则〕,各记一次(detail `lane=space|park stage=list|delete|budget`;会话删除口把回收座脱离应答路径,座若抛了——契约禁止——记 `stage=seat_threw`)⇒ 这些对象留在桶里,会话照删(不挡删除)。放行的最坏后果 = 一份已无人能读的工作区快照留在桶里(会话已删,经 API 不可达;内容是用户工作区,所以不是「只占盘」—— 留到桶的生命周期规则把它过期掉为止);不碰任何别的空间、不是门不是凭据;反方向(清不掉对象就拒删会话)会让一个对象存储抖动挡住用户的删除权。故 F 类,但必须留痕:静默吞掉之后「这个会话删了、它的工作区内容还在不在桶里」在遥测里没有任何痕迹。同拍一行 `workspace_space_reclaim_failed`(`space` 前缀 / `sessionId` / `lane` / `stage` / `error`)。计数非零 = 有对象没回收掉,运维按行里的空间前缀 / 会话 id 去桶里手清,并核对象存储的可达性与 DELETE 权限。回收与同一空间的尚在途的 run 末提交不是互斥的:会话删除时没有活 run(409 挡),但上一条 run 的提交若恰在删除之后才落对象,这批对象不在本次回收射程内(同样归桶的生命周期规则)。停驻分区按会话 id 分区,所以只删名字带被结束住客归属记号的对象(不读任何钟)—— 会话 id 删后被别人重新登记,新住客停驻出的快照带它自己的记号、不碰;不带记号的旧形与 `none` 留给桶的生命周期规则。",
+    },
     "server.fleet.announce-reply-unreadable": {
         cls: "P-DEBT",
         note: "7.121.0 修复验证轮(`fleet-client.ts` 的公告环,fleet 成员每一拍心跳 2xx 答复;detail = `why=<body|not-an-object|invalid-capabilities> leaseState=<此刻的租约态>`):答复不是能力读数(体读不出 / 不是对象 / `capabilities` 键在场而形坏 —— settings-schema 9.0.0 `readCapabilityReading` 的 `unreadable`,外加本仓的 `body`)⇒ 当作没有这一拍答复,租约的状态与钟原样。**一律**计数(不论租约生效与否):租约还没生效(`leaseState=none`)时这只成员**一直不受围栏**,而修前这一形零计数(中心每拍答 `<html>` ⇒ 成员恒 none、零痕迹);租约已生效时计数说明中心的答复在坏、围栏靠的是上一次读数。归 P 类:围栏轴;归 DEBT:本进程判不出中心为什么答坏体,收口条件 = 中心契约 / 监控(中心侧对心跳答复形的执法)落地。每段连拍另有一行 warn `fleet_announce_reply_unreadable`(带 `why`)。",

package/dist/observability/metrics.d.ts

@@ -62,7 +62,6 @@ export interface MetricsSummary {
     };
     cascade: Record<string, number>;
     verifications: Record<string, number>;
-    councilRuns: Record<string, number>;
     toolErrors: Record<string, number>;
     /** S-451(additive,7.87.0):窗内 HTTP **失败**请求数,按状态码**类**聚合 —— 键只有 `"4xx"` / `"5xx"`
      *  两种,2xx/3xx 一格不进。⚠️ `"4xx"` 里**含 `499`**(本仓给「客户端在响应结束前断连」铸的标签,

package/dist/observability/metrics.js

@@ -186,7 +186,6 @@ export class Metrics {
             })(cby("plan_cache_recurrence_total", "hit")),
             cascade: cby("cascade_total", "outcome"),
             verifications: cby("verifications_total", "verdict"),
-            councilRuns: cby("council_runs_total", "mode"),
             toolErrors: Object.fromEntries([...(this.counters.get("tool_calls_total")?.series.values() ?? [])]
                 .filter((s) => s.labels.ok === "false")
                 .map((s) => [s.labels.name ?? "?", s.value])),
@@ -221,8 +220,6 @@ export function createMetrics() {
     m.counter("task_tokens_total", "Total model tokens consumed by tasks");
     m.histogram("task_duration_seconds", "Async run wall-clock duration");
     m.gauge("runs_active", "Async runs currently executing");
-    m.counter("council_runs_total", "Code-review council runs (L1+L3)");
-    m.histogram("council_tokens", "Total model tokens per council review (lenses + arbiter)");
     m.histogram("task_cache_hit_rate", "Prefix-cache hit rate per task (core-computed stats.cacheHitRate, 0..1)", [
         0.05, 0.1, 0.25, 0.5, 0.75, 0.9, 0.95, 1,
     ]);

package/dist/observability/run-terminal.js

@@ -172,10 +172,74 @@ const STRANDED_ANSWER_TREATMENT = {
     toolCallId: "provider-join-key",
 };
 const TERMINAL_FAILURE_DETAIL_TREATMENT = {
-    kind: "verbatim",
-    status: "verbatim",
-    code: "provider-echo",
+    provider_rejected: {
+        kind: "verbatim",
+        status: "verbatim",
+        code: "provider-echo",
+        providerCondition: "verbatim",
+        providerConditionSource: "verbatim",
+        providerResetAtMs: "verbatim",
+        route: "verbatim",
+    },
+    coded: { kind: "verbatim", detail: "free-text-tree" },
+    model_output_invalid: { kind: "verbatim", cause: "verbatim", outputLimit: "verbatim" },
 };
+const TERMINAL_DETAIL_WALK_DEPTH = 32;
+const TERMINAL_DETAIL_TOO_DEEP = "[omitted: nested deeper than 32 levels]";
+function redactStringLeaves(node, depth = 0) {
+    if (typeof node === "string")
+        return redactErrorMessage(node) ?? node;
+    if (node === null || typeof node !== "object")
+        return node;
+    if (depth > TERMINAL_DETAIL_WALK_DEPTH)
+        return TERMINAL_DETAIL_TOO_DEEP;
+    if (Array.isArray(node)) {
+        const next = node.map((x) => redactStringLeaves(x, depth + 1));
+        return next.every((x, i) => x === node[i]) ? node : next;
+    }
+    let out;
+    for (const [k, v] of Object.entries(node)) {
+        const nv = redactStringLeaves(v, depth + 1);
+        if (nv !== v)
+            (out ??= { ...node })[k] = nv;
+    }
+    return out ?? node;
+}
+function shapeTerminalFailureDetail(detail) {
+    if (detail === null || typeof detail !== "object" || Array.isArray(detail))
+        return detail;
+    const d = detail;
+    const kind = d.kind;
+    const table = typeof kind === "string" && Object.hasOwn(TERMINAL_FAILURE_DETAIL_TREATMENT, kind) ? TERMINAL_FAILURE_DETAIL_TREATMENT[kind] : undefined;
+    if (table === undefined)
+        return redactStringLeaves(d);
+    let out;
+    for (const [key, treatment] of Object.entries(table)) {
+        const v = d[key];
+        if (v === undefined)
+            continue;
+        switch (treatment) {
+            case "verbatim":
+            case "provider-join-key":
+                break;
+            case "provider-echo":
+                if (!admitProviderEcho(v, `terminal.detail.${key}`))
+                    delete (out ??= { ...d })[key];
+                break;
+            case "free-text-tree": {
+                const nv = redactStringLeaves(v);
+                if (nv !== v)
+                    (out ??= { ...d })[key] = nv;
+                break;
+            }
+            default: {
+                const unhandled = treatment;
+                throw new Error(`unhandled failure-detail treatment: ${String(unhandled)}`);
+            }
+        }
+    }
+    return out ?? detail;
+}
 const TERMINAL_BLOCKED_DETAIL_TREATMENT = {
     kind: "verbatim",
     cause: "verbatim",
@@ -279,7 +343,7 @@ export function redactTerminalResult(result) {
                 nt = { ...base, nestedPause: { ...np, gate: g.gate } };
             const cur = nt ?? base;
             const detail = cur.detail;
-            const shaped = shapeEchoMembers(detail, TERMINAL_FAILURE_DETAIL_TREATMENT, "terminal.detail");
+            const shaped = shapeTerminalFailureDetail(detail);
             if (shaped !== detail)
                 nt = { ...cur, detail: shaped };
         }
@@ -609,6 +673,7 @@ const CHECKPOINT_GATE_TREATMENT = {
     safetyAxis: "verbatim",
     realApproval: "verbatim",
     resumeAfterMs: "verbatim",
+    approvalCard: "verbatim",
 };
 export function redactCheckpointGate(gate) {
     if (gate === null || typeof gate !== "object" || Array.isArray(gate))

package/dist/permission-rule-vocab.d.ts

@@ -14,9 +14,10 @@ export declare function isPersistedRuleTool(name: string): boolean;
  * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
  * `subpath`(Read 目录形,永不容纳任何命令)/ `path`(core 7.9.0 [ref]:路径族 deny/ask/allow 的模式文法
  * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)/ `name` / `name_prefix`(core 7.43.0 #1318:`Skill` 的名字文法 ——
- * `Skill(<名>)` 精确、`Skill(<前缀>:*)` 名字前缀、无词界;技能卡的建议行 `match: "name"`)。
+ * `Skill(<名>)` 精确、`Skill(<前缀>:*)` 名字前缀、无词界;技能卡的建议行 `match: "name"`)/ `host` / `subdomain`(core 7.49.0 #1365:
+ * `WebFetch(domain:<host>)` 精确主机、`WebFetch(domain:*.<域>)` 域下每个主机 —— 只有 allow 形)。
  */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix"];
+export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
 /**
  * S-511 —— `RuleBehavior` 每一员在**无同意仪式的直接写口**(`POST /v1/rules`)上的逐员表态。
  *

package/dist/permission-rule-vocab.js

@@ -2,7 +2,7 @@ import { ruleToolGrammarOf } from "@sema-agent/core";
 export function isPersistedRuleTool(name) {
     return ruleToolGrammarOf(name) !== undefined;
 }
-export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix"];
+export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
 const MATCHES_PIN = true;
 void MATCHES_PIN;
 export const DIRECT_RULE_WRITE_ADMITS = {

package/dist/plan-cache-probe.d.ts

@@ -8,8 +8,9 @@
  * does an agent's traffic actually re-pose near-duplicate objectives per tenant? (arXiv 2602.18922:
  * heterogeneous queries can hit 0–12%.) We hold the real multi-tenant traffic, so this is ours to count.
  *
- * **The token criterion is copied verbatim from core `strategy-store` (`compileStrategyQuery`)** —
- * otherwise we'd measure something other than what plan-cache retrieval would actually use. Note the
+ * **The token criterion is core `strategy-store`'s (`compileStrategyQuery`) as last shipped in core 7.48.0** — core 7.49.0
+ * retired the strategy store with no replacement, so there is no core counterpart left to stay in lockstep with: from
+ * that release on this criterion is the probe's own definition, frozen at that form. Note the
  * **asymmetry**: a stored problem is matched on its full `tokens()` set, the query on its
  * `significant()` set. A hit = `significant(new) ⊆ tokens(historical)` OR (5.49 legacy acceptance
  * arm) the non-CJK subset `qAlnum` is non-empty and fully contained (`qAlnum ⊆ tokens(historical)`).

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -538,7 +538,7 @@ export declare const APPROVAL_BATCH_TABLE = "approval_batch";
  *     64 字符(`approval-ask-machine.ts` deterministicId),按构造不可能更长。
  *   · `task_id` → 64:入口 `UUIDV7_RE`(`security.ts:134`)只放行 36 字符的规范 uuidv7;与兄弟列
  *     `task_run.task_id VARCHAR(64)` 同宽(此前 255 是本家族独有的偏离,无依据)。
- *   · `session_id` → 64:提交入口硬拒 >64(`http/server.ts` "sessionId must be at most 64 characters"),
+ *   · `session_id` → 64:提交入口只收 canonical uuid(36 字符;7.125.x 及更早硬拒 >64),列宽仍容存量,
  *     与 `session_meta`/`task_run` 同宽。
  *   · `owner` → 190:`assertPrincipalShape` 的 `PRINCIPAL_MAX_LENGTH = 190`(`security.ts` 的同名导出常量,
  *     刻意不钉行号 —— 旧注写的 `security.ts:350` 已随该文件编辑漂走)硬拒更长者;

package/dist/plugins/caching-session-store.d.ts

@@ -42,6 +42,9 @@ export declare class CachingSessionStore implements SessionStore {
      *  🔴 必须转发(与 retention / placements / instruction-source 同一条教训):生产默认把真店包进本类,不转发 = parked 决定腿
      *  与记忆座在默认部署上读不到化身。 */
     readonly sessionFaceOf?: SessionFaceReader;
+    /** core `SessionStore.incarnationOf`(按 id 读住客)—— 同一条纯转发、同一条理由:答的是行上那一格,绝不从暖缓存里那只会话的元数据答
+     *  (缓存的会话活得比「另一只店删掉又重建了这一行」长)。🔴 必须转发:k8s 工作区空间的每 run 读与起服门读的就是本类。 */
+    readonly incarnationOf?: SessionStore["incarnationOf"];
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */

package/dist/plugins/caching-session-store.js

@@ -7,6 +7,7 @@ export class CachingSessionStore {
     timer;
     ownerOf;
     sessionFaceOf;
+    incarnationOf;
     register;
     listSessions;
     fork;
@@ -49,6 +50,8 @@ export class CachingSessionStore {
             this.ownerOf = ownerAware.ownerOf.bind(inner);
         if (ownerAware.sessionFaceOf)
             this.sessionFaceOf = ownerAware.sessionFaceOf.bind(inner);
+        if (typeof inner.incarnationOf === "function")
+            this.incarnationOf = inner.incarnationOf.bind(inner);
         if (ownerAware.register)
             this.register = ownerAware.register.bind(inner);
         if (ownerAware.listSessions)

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity, type ToolApprovalCard } from "@sema-agent/core";
 import { type ParkRowFacts, type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDialect, type SqlDriver } from "./sql-driver.js";
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
@@ -127,17 +127,14 @@ export interface PendingCheckpoint extends ParkRowFacts {
      */
     hasBidiControls?: true;
     /**
-     * [ref]([ref]② core 点名 / [ref] 认领):**内容问句分型键** —— `"content_ask"` 当这条 tool_approval
-     * park 门住的是保留工具 AskUserQuestion(问用户的问题,不是副作用工具),消费端(cli/壳审批面)据它
-     * 渲问句 UI 而不用嗅探 `toolName`。词与判据 = core `summarizeCheckpoint` 的同一行规则(行上 core 铸的
-     * `toolName` 的**全函数**派生;词属主 `approval-content-kind.ts`,parity 钉看漂移)——**不是**
-     * `hasBidiControls` 那类「server 不重算」的扫描位:派生 ≠ 重扫。
-     * 🔴 `"content_ask"` 或**缺席**([ref]② OMIT 纪律,恒不铸 `null`/`false`):缺席 = 非内容问句门
-     * (普通工具门 / 非工具 park / toolName 缺席的存量行)。展示/分诊用,永不参与 resume / gate / CAS。
-     * 两条 durable 读面(`GET /v1/approvals` 行 + `/stream` `pending` 帧)经同一投影同时携带;live 腿的
-     * 同名键在 `LivePendingRow.contentKind`(同一词属主)。
+     * core 7.49.0 #1414:**这一行渲在哪张卡上** —— 门上引擎铸的 `gate.approvalCard`(闭集 core `TOOL_APPROVAL_CARDS`;`question` = 问用户的
+     * 问题,不是副作用工具),即 core `summarizeCheckpoint` 投给 `CheckpointSummary.approvalCard` 的同一个词。读法单点 = `approval-content-kind.ts`
+     * 的 `parkedApprovalCard`(只在审批门型上读、闭集窄读;两只店同调它:SQL 孪生读 `checkpoint` 列的 `gate` 子树,LOCAL 孪生读 blob 上的门)。
+     * 🔴 缺席即缺席([ref]② OMIT 纪律):非审批门、7.49.0 之前停驻的存量行(门上无卡 —— core 的读法「无卡 = 不是一问」,本仓**不**从
+     * 工具名回推)。两条 durable 读面(`GET /v1/approvals` 行 + `/stream` `pending` 帧)经同一投影同时携带;live 腿的同名键在
+     * `LivePendingRow.approvalCard`。展示/分诊用,永不参与 resume / gate / CAS。(此前此处是按 `tool_name` 列派生的 `contentKind`,随 #1414 删。)
      */
-    contentKind?: "content_ask";
+    approvalCard?: ToolApprovalCard;
 }
 /**
  * [ref]([ref] / DEBTS [ref]):session 键读口(`findPendingTokenBySession` / `peekPendingScope`)的**行绑定**。
@@ -416,8 +413,8 @@ interface SteerColumnRead {
  * **一列一形**:`pending_steer_queue` 存 `PendingSteerEntry[]`。
  *
  * 🔴 7.74.0 起只剩这**一**列。队列化之前的裸单座列 `pending_steer` 随它的席位一起退役了(core 7.17.0
- * [ref] d:引擎对带席的行 PRE-CAS 拒 `seat_retired`),存量列由启动期的一次性迁移删掉
- * (`plugins/one-time-migrations.ts`:列上还有非空值 ⇒ **响亮拒启**,清空后 `DROP COLUMN`)。
+ * [ref] d:引擎对带席的行 PRE-CAS 拒 `seat_retired`),存量列 7.74.0 起由启动期的一次性迁移删掉;迁移窗关后删码,
+ * 仍带着这一列的跳版升级库起服**响亮拒**(`plugins/one-time-migrations.ts` 的退役 schema 拒启臂)。
  * ⇒ 这里刻意**没有**第二条读腿:双读臂的寿命就是那一次迁移,不是永远。
  *
  * 列有内容却读不出 ⇒ `lossy`(两个调用点对它的处置见 {@link SteerColumnRead})。
@@ -623,29 +620,46 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      *
      * [ref] D-D: the deadline-branch EXPIRES (≈ abort) every kind EXCEPT a tool-approval human/irreversible_ask
      * gate — those are resolve-DENIED gracefully by the SLA deny-sweep (listExpiredApprovalGates →
-     * resumeCheckpoint(deny)), so expiring them here too would race + lose the graceful denial. 🔴 A durable
-     * AskUserQuestion ALSO mints gate.kind='human' (no question-specific kind in core) — but DENYING a question is
-     * incoherent (the model gets a "denied" tool-result, not an answer), so it is carved BACK INTO the expire path
-     * (COALESCE(tool_name,'')='AskUserQuestion') to abort-expire on timeout instead. Legacy rows (gate_kind NULL)
-     * stay on the expire path. The terminal_at_ms-branch is the crash-safe backstop for ANY kind (incl. a human gate
-     * whose deny-resume keeps failing) — it always abort-expires past the absolute cap (which is now STRICTLY after
-     * the deadline, so it never races the deny-sweep at the deadline instant).
+     * resumeCheckpoint(deny)), so expiring them here too would race + lose the graceful denial. Legacy rows (gate_kind
+     * NULL) stay on the expire path. The terminal_at_ms-branch is the crash-safe backstop for ANY kind (incl. a human
+     * gate whose deny-resume keeps failing) — it always abort-expires past the absolute cap (which is now STRICTLY
+     * after the deadline, so it never races the deny-sweep at the deadline instant).
+     *
+     * core 7.49.0 #1414 / #1468 A-S4: among the approval kinds, which rows the deny-sweep owns has ONE judge — core
+     * `facetOf(gate)`. A gate carrying the `question` card is facet `B` (a question's deadline voids it; denying a question
+     * is incoherent), so step ② expires it here row by row (token CAS, `status='pending'` guarded — a concurrent decide or
+     * another replica wins cleanly). The card lives only in the `checkpoint` blob's `gate` subtree, so the split cannot be
+     * one SQL predicate without writing core's judgment a second time in SQL; the old `tool_name` literal arm is gone. A
+     * gate with no card (parked before 7.49.0) is no question — core's reading — and stays with the deny-sweep.
      */
     reapExpired(cutoff: number): Promise<number>;
+    /** reapExpired ②'s position in the overdue approval rows, per store instance (see there). Absent = start from the earliest deadline. */
+    private reapCursor;
     /**
-     * [ref] D-D (SLA-timer): the sessions of pending human/irreversible_ask checkpoints past their `deadline`
-     * (the per-approval SLA). The reaper resolve-DENIES each (re-resume with decision=deny → the model continues
-     * with the denial) — graceful, vs the abort that expire() gives resource_limit/needs_review. Excludes legacy
-     * rows (gate_kind NULL — they predate the split and fall through to reapExpired's expire path). LIMIT bounds
-     * the per-tick deny-resume work (each is a model run). Scope is read off the COMMITTED row (invariant #4).
-     * 🔴 EXCLUDES AskUserQuestion gates (which also mint gate.kind='human'): denying a question is incoherent —
-     * the model would get a "denied" tool-result instead of an answer — so a timed-out durable question falls to
-     * reapExpired's abort-expire path instead of this graceful-deny path.
+     * [ref] D-D (SLA-timer): the sessions of pending approval-kind checkpoints past their `deadline` (the per-approval
+     * SLA) that the deny-sweep owns ({@link denySweepOwns} — core `facetOf` reads them as facet `A`) — the reaper resolve-DENIES
+     * each (re-resume with decision=deny → the model continues with the denial) — graceful, vs the abort that expire() gives
+     * resource_limit/needs_review. Excludes legacy rows (gate_kind NULL — they predate the split and fall through to
+     * reapExpired's expire path). `limit` bounds the per-tick deny-resume work (each is a model run).
+     * 🔴 core 7.49.0 #1414 / #1468 A-S4: a gate carrying the `question` card (facet `B`) is NOT deny-swept — core refuses
+     * `sla_timeout` on it pre-CAS — reapExpired voids it instead. The card lives only in the blob's `gate` subtree and the
+     * judge is core's (the split is not one SQL predicate — see {@link reapExpired}), so the filter runs on the rows read;
+     * the read is therefore PAGED, filter first and `limit` after: pages of {@link REAP_CLASSIFY_BATCH} rows in the stable
+     * (deadline, token) order, the cursor advancing, until `limit` rows are collected or the overdue rows run out — the same
+     * "filter, then take `limit`" the LOCAL twin does. A backlog of question rows ahead of the deny-sweep's rows costs extra
+     * bounded pages, never a hidden deny-sweep row (they used to hold slots of a `LIMIT limit` window until voided).
      */
     listExpiredApprovalGates(cutoff: number, limit?: number): Promise<Array<{
         sessionId: string;
         scope: string;
     }>>;
+    /**
+     * core 7.49.0 #1414 / #1468 A-S4 —— 审批门型里过了 deadline 的 pending 行(deadline 升序),每行带 core 对它的到期读法
+     * (`denySweepOwns` = 审批门型 ∧ core `facetOf` 读作 `A`,门型取列、卡取 `gate` 子树)。到期两条腿(reapExpired 的 ②、拒扫腿的选行)读同一只:
+     * 对审批门型「谁拒扫、谁作废」本仓不写第二份判据。读恒有界(每次一页 `limit` 行),序 = (deadline, token) 稳定序;`after` = 从这一位置之后读
+     * (reapExpired 的跨拍游标;拒扫腿选行一次之内的翻页游标)。
+     */
+    private overdueApprovalRows;
     /** Pending checkpoints for the operator queue — NON-secret fields only (never the token). `taskId` is
      *  joined from task_active (the JOIN KEY to the run/trace — a suspended run KEEPS its
      *  session claim, so the join is live for every pending row; null only in pathological windows). */

package/dist/plugins/checkpoint-store-sql.js

@@ -1,6 +1,6 @@
-import { ASK_USER_QUESTION_SQL_LITERAL, contentKindOf } from "../approval-content-kind.js";
+import { parkedApprovalCard, parkedFacetOf } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
-import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS_SQL_IN, denySweepOwns } from "../tool-approval.js";
 import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, parkRowFacts, screenUncoveredDetailSeat } from "../approval-card.js";
@@ -10,6 +10,7 @@ import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.
 import { isDupKeyError, isMissingColumnError } from "./sql-errors.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
+const REAP_CLASSIFY_BATCH = 200;
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 const MAX_TOOL_INPUT_CHARS = 8192;
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, (Number.isFinite(Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS)) ? Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) : 0) || 30 * 86_400_000);
@@ -182,6 +183,22 @@ function readParkRowFactsCell(cell) {
     return parkRowFacts(pendingAction);
 }
 const PARK_ROW_PENDING_ACTION = { key: "pendingAction", as: "pending_action" };
+const PARK_ROW_GATE = { key: "gate", as: "park_gate" };
+function readParkGateCell(cell) {
+    try {
+        return decodeNullableJsonColumn(cell, readParkGateMemberBody, "checkpoint.checkpoint $.gate (approval card / expiry facet)");
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        recordFailOpen("server.approvals.park-row-blob-unreadable", "member=gate");
+        return undefined;
+    }
+}
+const readParkGateMemberBody = createObjectColumnReader();
+function parkedGateOfRow(r) {
+    return { kind: r.gate_kind ?? undefined, approvalCard: readParkGateCell(r[PARK_ROW_GATE.as])?.approvalCard };
+}
 const readPendingActionMemberBody = createObjectColumnReader();
 export function boundedToolInput(args) {
     if (args === undefined)
@@ -518,21 +535,49 @@ export class SqlCheckpointStore {
     }
     async reapExpired(cutoff) {
         const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at_ms = ? " +
-            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= ? AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN} OR COALESCE(tool_name,'') = ${ASK_USER_QUESTION_SQL_LITERAL})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= ?))`, "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 " +
-            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN} OR COALESCE(tool_name,'') = ${ASK_USER_QUESTION_SQL_LITERAL})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= $3))`), [Date.now(), cutoff, cutoff]);
-        return res.affected;
+            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= ? AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= ?))`, "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 " +
+            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= $3))`), [Date.now(), cutoff, cutoff]);
+        let n = res.affected;
+        const batch = await this.overdueApprovalRows(cutoff, REAP_CLASSIFY_BATCH, this.reapCursor);
+        for (const row of batch) {
+            if (!row.denySweeps && (await this.expire(row.token, row.scope)))
+                n++;
+        }
+        const last = batch.at(-1);
+        this.reapCursor = batch.length < REAP_CLASSIFY_BATCH || last === undefined ? undefined : { deadline: last.deadline, token: last.token };
+        return n;
     }
+    reapCursor;
     async listExpiredApprovalGates(cutoff, limit = 100) {
-        const { rows } = await this.db.query(this.q(`SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} ` +
-            `AND COALESCE(tool_name,'') <> ${ASK_USER_QUESTION_SQL_LITERAL} AND deadline IS NOT NULL AND deadline <= ? ORDER BY deadline ASC LIMIT ?`, `SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} ` +
-            `AND COALESCE(tool_name,'') <> ${ASK_USER_QUESTION_SQL_LITERAL} AND deadline IS NOT NULL AND deadline <= $1 ORDER BY deadline ASC LIMIT $2`), [cutoff, limit]);
-        return rows.map((r) => ({ sessionId: String(r.session_id), scope: String(r.scope) }));
+        const hits = [];
+        let after;
+        while (hits.length < limit) {
+            const page = await this.overdueApprovalRows(cutoff, REAP_CLASSIFY_BATCH, after);
+            for (const r of page) {
+                if (hits.length < limit && r.denySweeps)
+                    hits.push({ sessionId: r.sessionId, scope: r.scope });
+            }
+            const last = page.at(-1);
+            if (page.length < REAP_CLASSIFY_BATCH || last === undefined)
+                break;
+            after = { deadline: last.deadline, token: last.token };
+        }
+        return hits;
+    }
+    async overdueApprovalRows(cutoff, limit, after) {
+        const head = `SELECT c.token, c.session_id, c.scope, c.gate_kind, c.deadline, ${jsonColumnText(this.db.dialect, "checkpoint", PARK_ROW_GATE)} FROM checkpoint c ` +
+            `WHERE c.status = 'pending' AND c.gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} AND c.deadline IS NOT NULL AND `;
+        const { rows } = await this.db.query(after === undefined
+            ? head + this.q("c.deadline <= ? ORDER BY c.deadline ASC, c.token ASC LIMIT ?", "c.deadline <= $1 ORDER BY c.deadline ASC, c.token ASC LIMIT $2")
+            : head +
+                this.q("c.deadline <= ? AND (c.deadline > ? OR (c.deadline = ? AND c.token > ?)) ORDER BY c.deadline ASC, c.token ASC LIMIT ?", "c.deadline <= $1 AND (c.deadline > $2 OR (c.deadline = $3 AND c.token > $4)) ORDER BY c.deadline ASC, c.token ASC LIMIT $5"), after === undefined ? [cutoff, limit] : [cutoff, after.deadline, after.deadline, after.token, limit]);
+        return rows.map((r) => ({ token: String(r.token), sessionId: String(r.session_id), scope: String(r.scope), deadline: Number(r.deadline), denySweeps: denySweepOwns(parkedGateOfRow(r)) }));
     }
     async listPending(scope) {
         const d = this.db.dialect;
         const base = `SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, ${jsonColumnText(d, "tool_input")}, c.bound_input_hash, ` +
             `${jsonColumnText(d, "risk_descriptor")}, ${jsonColumnText(d, "rule_suggestions")}, c.has_bidi_controls, c.created_at_ms, c.deadline, c.gate_kind, ta.task_id, ` +
-            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)} ` +
+            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_GATE)} ` +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
@@ -543,6 +588,7 @@ export class SqlCheckpointStore {
             const boundInputHash = r.bound_input_hash ?? null;
             const gateKind = r.gate_kind ?? null;
             const ruleOffers = readRuleOffersCell(r.rule_suggestions);
+            const approvalCard = parkedApprovalCard(parkedGateOfRow(r));
             return {
                 sessionId: String(r.session_id),
                 scope: String(r.scope),
@@ -558,7 +604,7 @@ export class SqlCheckpointStore {
                 riskDescriptor: readRiskDescriptorCell(r.risk_descriptor),
                 ...(ruleOffers !== undefined ? { ruleOffers } : {}),
                 ...(Number(r.has_bidi_controls) === 1 ? { hasBidiControls: true } : {}),
-                ...(contentKindOf(toolName) !== undefined ? { contentKind: "content_ask" } : {}),
+                ...(approvalCard !== undefined ? { approvalCard } : {}),
                 ...readParkRowFactsCell(r[PARK_ROW_PENDING_ACTION.as]),
             };
         });

package/dist/plugins/file-run-store.d.ts

@@ -1,8 +1,9 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { StoreBootRefusalError, type CreateRunOutcome, type NewRunMeta, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { StoreBootRefusalError, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
+import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
  * `RUN_STORE_STRICT_HYDRATE=on` 下 hydrate 列不出 `runs/` 时的**拒启**类型([ref] 件B;codex 对抗复审
  * R1-[high] 验真后从裸 `Error` 升成具名类型)。
@@ -25,6 +26,11 @@ export declare class FileRunStore {
     private readonly runsDir;
     private readonly activeDir;
     private readonly tmpDir;
+    /** `<root>/space-commits/` — the twin of `workspace_space_commit`: one record per space key (file name = the key,
+     *  checked by `sanitizePathComponent`; written by `atomicWriteFile`). */
+    private readonly spaceCommitsDir;
+    /** The k8s workspace space's commit fence (the rule: `workspace-space-commit.ts`) over the record files. */
+    private readonly spaceCommits;
     /** taskId → RunRow (the run registry index). */
     private readonly runs;
     /** sessionId → taskId — the single-active-run claim (the task_active table; index of active/*). */
@@ -55,6 +61,15 @@ export declare class FileRunStore {
     private runJsonPath;
     private eventsPath;
     private activePath;
+    private spaceCommitPath;
+    /** One space's commit record, or `undefined` (no file). A record that is not this store's shape is a loud read failure
+     *  (the reader — the next run's connect — refuses; it never guesses that no commit is in flight). */
+    private loadSpaceCommit;
+    /** The k8s workspace space's commit fence rows (SQL twin: `workspace_space_commit`; the rule: `workspace-space-commit.ts`). */
+    readSpaceCommit(spaceKey: string): Promise<SpaceCommitReading | undefined>;
+    claimSpaceCommit(spaceKey: string, taskId: string, state: SpaceCommitState, claim: SpaceCommitClaim): Promise<boolean>;
+    endSpaceCommit(spaceKey: string, taskId: string): Promise<void>;
+    abandonSpaceCommit(spaceKey: string, taskId: string): Promise<boolean>;
     private toRow;
     private toDisk;
     private toRecord;
@@ -120,6 +135,9 @@ export declare class FileRunStore {
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
+    /** The terminal write's one synchronous section (SQL twin: one transaction): the k8s space's pending commit record (when
+     *  offered) → the terminal row → the active-run claim release. Returns whether the pending record is now this run's. */
+    private writeTerminal;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard).
      *  S-173:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。 */
     setSuspended(taskId: string, result: PersistedTaskResult | null): Promise<void>;
@@ -131,11 +149,15 @@ export declare class FileRunStore {
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
     getRun(taskId: string): Promise<RunRecord | undefined>;
-    /** Undo THIS submission's key binding (`idem_key` → NULL) — called only where the submit surface refuses the submission
+    /** Undo THIS submission's binding (key + body fingerprint → null) — called only where the submit surface refuses the submission
      *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, a device-placement reject):
      *  the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
-     *  is the refusal's record); only the key is freed. */
+     *  is the refusal's record); only the binding is freed. */
     releaseIdemKey(taskId: string): Promise<void>;
+    /** The body fingerprint this row's binding of `idem.key` holds — binding `idem.bodyFingerprint` first when it holds none (first
+     *  arrival binds and is persisted, everyone after reads; the file twin of the SQL conditional UPDATE — one writer per data root,
+     *  single-threaded between the check and the write). `null` = no such row, or the row is not bound to this key (never written). */
+    bindIdemBodyFingerprint(taskId: string, idem: RunIdemBinding): Promise<string | null>;
     /** The run a submission's scoped `Idempotency-Key` names (the file twin of `uq_task_run_idem`), if any. */
     getRunByIdem(idemKey: string): Promise<RunRecord | undefined>;
     /** Runs newest-first, keyset on (createdAt, taskId) DESC; optional exact-match filters (owner is exact, like the SQL). */
@@ -312,24 +334,6 @@ export declare class FileRunStore {
     private releaseClaim;
     /** Drop a run entirely (registry + event log + open fd + on-disk dir) — used by deleteBySession. */
     private dropRun;
-    /**
-     * 🔴 **一次性迁移 M3 的 local 腿(窗口见 `one-time-migrations.ts` 登记表,随 M3 一起删)** —— 退役词旧拼法的账本改写,
-     * SQL 两孪生那条整表 UPDATE 的 local 形。逐条走**同一只**纯改写函数,所以三条车道改出来的字节一致。
-     *
-     * 为什么是 store 上的一只动词、而不是外面一个文件走查:本店的账本有**两份**在场 —— 盘上的 jsonl
-     * 与 hydrate 进来的内存索引。外部走查只改得到前者,读腿读的却是后者(`getEvents` 从 Map 取),
-     * 于是迁移在本次进程里完全不生效、下次重启才"忽然"生效。两份一起改的唯一正确位置就是这里。
-     *
-     * 写盘用整文件原子替换(不是追加):改的是**已有行**,而 `AppendLog` 只会往后写。替换之前把**全部**
-     * append fd 撤掉(rename 之后旧 fd 指向的是被 unlink 的 inode,继续往那儿追加 = 之后的事件全部写进一个
-     * 没人看得见的文件),下一次 `appendEvent` 会按惰性规则重新开。撤 fd 复用**既有的那一只** {@link dispose}
-     * —— 刻意不在这里另写一段 close+catch:那会是本文件第二处同形的兜底臂,而规则要变少不要变多。
-     * 常态下这一撤是空操作:本动词跑在 boot 期,那时一个 append fd 都还没惰性开出来。
-     *
-     * 幂等:零命中 ⇒ 一个字节都不写、一只 fd 都不撤(第二跑零 I/O)。
-     * @returns 被改写的账本**行**数(不是 run 数)。
-     */
-    migrateRetiredAskOriginRows(): Promise<number>;
     /**
      * 一次性迁移 **M6 的 local 腿**(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):把 ≤7.115.x 写下的死亡判决行
      * (`failed` ∧ 码列空 ∧ 句子是那两句,判据 = `readLegacyHolderDeathCode`)补上机读码,盘上(`run.json` 整份原子替换,同 `persist`)与内存同改。