@sema-agent/server 7.125.1 → 7.127.0

package/dist/plugins/caching-session-store.d.ts

@@ -8,24 +8,36 @@ export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
     sweepIntervalMs?: number;
-    /** S25 (SILENT-FALLBACK P1): called when a cross-instance write (import/replace) evicts a WARM entry —
-     *  the affinity-contract violation signal that previously had zero fingerprint. */
-    onConflictEvict?: (sessionId: string) => void;
+    /** Called once per warm hit that turned out stale (the store's head no longer names the cached leaf, or the session is
+     *  gone): the entry was dropped and the session woken from the store again. Not an error — the operator signal for
+     *  "requests for one session alternate between replicas within the TTL" (the hit rate affinity would buy back). */
+    onStaleHit?: (sessionId: string) => void;
 }
+/** The store's current head for one session — the one read every warm hit is checked against (`undefined` = no such
+ *  session). The same single-row read `OwnerAwareSessionStore.getHead` names; this cache requires its inner store to have it. */
+export type SessionHeadReader = Required<Pick<OwnerAwareSessionStore, "getHead">>;
 /**
- * Warm/sticky cache in front of a durable {@link SessionStore} (Option A).
+ * Warm cache in front of a durable {@link SessionStore}.
  *
- * Keeps a woken session in memory and **reuses the same storage instance across turns**, so a hot
- * session is not re-read from TiDB every short turn (treats the cattle like a warm pet while it's
- * active). Idle sessions expire after `ttlSec`; `release` evicts immediately.
+ * Keeps a woken session in memory and **reuses the same storage instance across turns**, so an active session is not
+ * woken from the store (meta row + event log) on every short turn. Idle sessions expire after `ttlSec`; `release` evicts.
  *
- * ⚠️ **Session affinity is REQUIRED** when this cache is enabled (`SESSION_CACHE_TTL_SEC>0`): route a
- * given sessionId to the same instance. Under affinity the cached storage is the sole writer, so its
- * in-memory leaf is always current and consistent with TiDB (write-through; F2 CAS still applies).
- * Without affinity a concurrent write from another instance makes this cache stale; that surfaces as
- * a `SessionError("conflict")` on the next append — the async run driver calls `evict()` on conflict
- * (defense-in-depth) and the entry also expires after `ttlSec`, but those are backstops, not the
- * guarantee. If you cannot guarantee affinity, set `SESSION_CACHE_TTL_SEC=0` to disable the cache.
+ * **One rule: a warm entry is served only while the store's head for that session still names the leaf the entry
+ * holds.** Every hit reads the head first (`getHead` — one primary-key row read on the SQL twins); head gone or leaf
+ * moved ⇒ the entry is dropped and the session is woken from the store again ({@link CachingOptions.onStaleHit}). The
+ * leaf is the token because it is exactly what the stores' conditional writes compare (`expectedLeafId`): a handle this
+ * cache hands out is never behind the store's leaf, so those writes fail only on a genuinely concurrent write — two runs
+ * writing one session at the same time. Any number of replicas may share one store under any routing; session affinity
+ * only raises the hit rate.
+ *
+ * Open item (the same before this rule): a write that rewrites history while leaving the final leaf id where it was —
+ * a session-sync replace / `overwrite-dst` staged commit on ANOTHER replica that changes entry payloads under the same
+ * ids — moves no leaf, so a warm entry elsewhere keeps its old payloads until it expires or is evicted. Its conditional
+ * writes still succeed (the leaf matches); what is stale is the content of the entries under it. Closing it needs a
+ * store revision bumped by every write path (append, leaf move, replace, staged commit) and carried by the woken handle.
+ *
+ * Writes that go around the cached handle through THIS wrapper (import / replace / staged commit / delete) also drop
+ * the entry at the write site, so the next acquire wakes from the written state.
  *
  * Orthogonal to the F3 branch-floor change: floor bounds the *cold wake* size; this cache removes
  * *repeated* re-reads of an active session.
@@ -36,12 +48,16 @@ export declare class CachingSessionStore implements SessionStore {
     private readonly pending;
     private readonly ttlMs;
     private readonly timer?;
+    private readonly onStaleHit?;
     /** Delegated tenant-ownership ops, present only if the inner store exposes them (the TiDB store does). */
     readonly ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
     /** S-790:属主 + 化身一次读,纯转发(不经暖缓存 —— 化身判的就是「此刻坐在座位上的是谁」,缓存的旧答案正是要消灭的那一形)。
      *  🔴 必须转发(与 retention / placements / instruction-source 同一条教训):生产默认把真店包进本类,不转发 = parked 决定腿
      *  与记忆座在默认部署上读不到化身。 */
     readonly sessionFaceOf?: SessionFaceReader;
+    /** core `SessionStore.incarnationOf`(按 id 读住客)—— 同一条纯转发、同一条理由:答的是行上那一格,绝不从暖缓存里那只会话的元数据答
+     *  (缓存的会话活得比「另一只店删掉又重建了这一行」长)。🔴 必须转发:k8s 工作区空间的每 run 读与起服门读的就是本类。 */
+    readonly incarnationOf?: SessionStore["incarnationOf"];
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */
@@ -73,11 +89,8 @@ export declare class CachingSessionStore implements SessionStore {
     /** E18 — delegate the leaf read straight to inner (a cache-bypassing single SELECT; the resume-at turn-capture
      *  reads the DURABLE leaf, not a possibly-stale cached view — same discipline as the §0.5 repo ops above). */
     readonly getLeafId?: (sessionId: string) => Promise<string | null>;
-    /** [ref] 六轮复审:owner+leafId 原子快照透传(cache-bypassing,getLeafId 同姿势)。 */
-    readonly getHead?: (sessionId: string) => Promise<{
-        owner: string | null;
-        leafId: string | null;
-    } | undefined>;
+    /** [ref] 六轮复审:owner+leafId 原子快照透传(cache-bypassing,getLeafId 同姿势)。内层店必有(本类的暖命中按它核新鲜)。 */
+    readonly getHead: SessionHeadReader["getHead"];
     /** 2c session-sync — delegated export/import seam, DURABLE (bypasses the warm cache exactly like
      *  list/fork: an export reads the full durable log, an import writes durable state). */
     readonly exportEntries?: (sessionId: string) => Promise<SessionTreeEntry[] | null>;
@@ -96,7 +109,7 @@ export declare class CachingSessionStore implements SessionStore {
      *  转发白名单里 ⇒ 默认部署(SESSION_CACHE_TTL_SEC=300 把真店包进本类)PUSH Phase A 恒 501
      *  `capability.session_store_required`,而 capabilities().sessionSync 谓词三项(backend/exportEntries/
      *  fileHistoryStore)都被转发了 ⇒ 照报 true(能力面谎)。转发形:handle 的 `commit` 是唯一写真 id 的
-     *  时刻,成功后逐出该 id 的暖 handle + S25 指纹(importEntries/replaceEntries 同纪律);`abort` 只丢
+     *  时刻,成功后逐出该 id 的暖 handle(importEntries/replaceEntries 同纪律);`abort` 只丢
      *  staging 行、不碰真 id ⇒ 不逐出。 */
     readonly beginImportStaging?: (realSessionId: string, token: string) => StagingHandle;
     /** Staging 清扫面(kernel `ImportStagingStore.sweepStagingSessions`)。当下 reaper 走 `backend.session()`
@@ -133,11 +146,18 @@ export declare class CachingSessionStore implements SessionStore {
         scope?: string;
     }) => Promise<PlacedSessionRow[]>;
     readonly placementOf?: (sessionId: string) => Promise<SessionPlacementRecord | undefined>;
-    constructor(inner: SessionStore, opts: CachingOptions);
+    constructor(inner: SessionStore & SessionHeadReader, opts: CachingOptions);
     acquire(sessionId?: string, opts?: PlacementAcquireOpts): Promise<AcquiredSession>;
     touch(sessionId: string): Promise<void>;
     release(sessionId: string): Promise<void>;
-    /** Drop a session from the warm cache (e.g. after a cross-instance write conflict). */
+    /**
+     * The cache's one rule: the warm entry for `sessionId`, if the store's head still names the leaf it holds; otherwise
+     * the entry is dropped (counted once via `onStaleHit`) and `undefined` sends the caller to the store. The head is read
+     * first, the cached leaf second: a write this replica commits in between can only turn a fresh verdict into a stale
+     * one (an extra wake), never the reverse.
+     */
+    private freshHit;
+    /** Drop a session from the warm cache. */
     evict(sessionId: string): void;
     get size(): number;
     dispose(): void;

package/dist/plugins/caching-session-store.js

@@ -5,8 +5,10 @@ export class CachingSessionStore {
     pending = new Map();
     ttlMs;
     timer;
+    onStaleHit;
     ownerOf;
     sessionFaceOf;
+    incarnationOf;
     register;
     listSessions;
     fork;
@@ -34,6 +36,8 @@ export class CachingSessionStore {
     constructor(inner, opts) {
         this.inner = inner;
         this.ttlMs = Math.max(0, opts.ttlSec) * 1000;
+        this.onStaleHit = opts.onStaleHit;
+        this.getHead = inner.getHead.bind(inner);
         const declared = inner.retention;
         if (declared !== undefined)
             this.retention = declared;
@@ -49,6 +53,8 @@ export class CachingSessionStore {
             this.ownerOf = ownerAware.ownerOf.bind(inner);
         if (ownerAware.sessionFaceOf)
             this.sessionFaceOf = ownerAware.sessionFaceOf.bind(inner);
+        if (typeof inner.incarnationOf === "function")
+            this.incarnationOf = inner.incarnationOf.bind(inner);
         if (ownerAware.register)
             this.register = ownerAware.register.bind(inner);
         if (ownerAware.listSessions)
@@ -69,8 +75,6 @@ export class CachingSessionStore {
             this.fork = ownerAware.fork.bind(inner);
         if (ownerAware.getLeafId)
             this.getLeafId = ownerAware.getLeafId.bind(inner);
-        if (ownerAware.getHead)
-            this.getHead = ownerAware.getHead.bind(inner);
         if (ownerAware.exportEntries)
             this.exportEntries = ownerAware.exportEntries.bind(inner);
         if (ownerAware.listEntryIds)
@@ -85,8 +89,6 @@ export class CachingSessionStore {
             const imp = ownerAware.importEntries.bind(inner);
             this.importEntries = async (sessionId, owner, entries) => {
                 await imp(sessionId, owner, entries);
-                if (this.cache.has(sessionId))
-                    opts.onConflictEvict?.(sessionId);
                 this.evict(sessionId);
             };
         }
@@ -94,8 +96,6 @@ export class CachingSessionStore {
             const rep = ownerAware.replaceEntries.bind(inner);
             this.replaceEntries = async (sessionId, owner, entries) => {
                 await rep(sessionId, owner, entries);
-                if (this.cache.has(sessionId))
-                    opts.onConflictEvict?.(sessionId);
                 this.evict(sessionId);
             };
         }
@@ -109,8 +109,6 @@ export class CachingSessionStore {
                     appendBatch: (entries) => h.appendBatch(entries),
                     commit: async (owner, o) => {
                         const r = await h.commit(owner, o);
-                        if (this.cache.has(realSessionId))
-                            opts.onConflictEvict?.(realSessionId);
                         this.evict(realSessionId);
                         return r;
                     },
@@ -141,7 +139,7 @@ export class CachingSessionStore {
             this.store(fresh);
             return fresh;
         }
-        const hit = this.cache.get(sessionId);
+        const hit = await this.freshHit(sessionId);
         if (hit && opts?.requireExisting !== true && this.placements !== undefined && this.placementOf !== undefined) {
             assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
         }
@@ -182,6 +180,18 @@ export class CachingSessionStore {
         this.cache.delete(sessionId);
         await this.inner.release(sessionId);
     }
+    async freshHit(sessionId) {
+        const hit = this.cache.get(sessionId);
+        if (hit === undefined)
+            return undefined;
+        const head = await this.inner.getHead(sessionId);
+        if (head !== undefined && head.leafId === (await hit.acquired.session.getLeafId()))
+            return hit;
+        if (this.cache.get(sessionId) === hit)
+            this.cache.delete(sessionId);
+        this.onStaleHit?.(sessionId);
+        return undefined;
+    }
     evict(sessionId) {
         this.cache.delete(sessionId);
     }

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity, type ToolApprovalCard } from "@sema-agent/core";
 import { type ParkRowFacts, type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDialect, type SqlDriver } from "./sql-driver.js";
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
@@ -127,17 +127,14 @@ export interface PendingCheckpoint extends ParkRowFacts {
      */
     hasBidiControls?: true;
     /**
-     * [ref]([ref]② core 点名 / [ref] 认领):**内容问句分型键** —— `"content_ask"` 当这条 tool_approval
-     * park 门住的是保留工具 AskUserQuestion(问用户的问题,不是副作用工具),消费端(cli/壳审批面)据它
-     * 渲问句 UI 而不用嗅探 `toolName`。词与判据 = core `summarizeCheckpoint` 的同一行规则(行上 core 铸的
-     * `toolName` 的**全函数**派生;词属主 `approval-content-kind.ts`,parity 钉看漂移)——**不是**
-     * `hasBidiControls` 那类「server 不重算」的扫描位:派生 ≠ 重扫。
-     * 🔴 `"content_ask"` 或**缺席**([ref]② OMIT 纪律,恒不铸 `null`/`false`):缺席 = 非内容问句门
-     * (普通工具门 / 非工具 park / toolName 缺席的存量行)。展示/分诊用,永不参与 resume / gate / CAS。
-     * 两条 durable 读面(`GET /v1/approvals` 行 + `/stream` `pending` 帧)经同一投影同时携带;live 腿的
-     * 同名键在 `LivePendingRow.contentKind`(同一词属主)。
+     * core 7.49.0 #1414:**这一行渲在哪张卡上** —— 门上引擎铸的 `gate.approvalCard`(闭集 core `TOOL_APPROVAL_CARDS`;`question` = 问用户的
+     * 问题,不是副作用工具),即 core `summarizeCheckpoint` 投给 `CheckpointSummary.approvalCard` 的同一个词。读法单点 = `approval-content-kind.ts`
+     * 的 `parkedApprovalCard`(只在审批门型上读、闭集窄读;两只店同调它:SQL 孪生读 `checkpoint` 列的 `gate` 子树,LOCAL 孪生读 blob 上的门)。
+     * 🔴 缺席即缺席([ref]② OMIT 纪律):非审批门、7.49.0 之前停驻的存量行(门上无卡 —— core 的读法「无卡 = 不是一问」,本仓**不**从
+     * 工具名回推)。两条 durable 读面(`GET /v1/approvals` 行 + `/stream` `pending` 帧)经同一投影同时携带;live 腿的同名键在
+     * `LivePendingRow.approvalCard`。展示/分诊用,永不参与 resume / gate / CAS。(此前此处是按 `tool_name` 列派生的 `contentKind`,随 #1414 删。)
      */
-    contentKind?: "content_ask";
+    approvalCard?: ToolApprovalCard;
 }
 /**
  * [ref]([ref] / DEBTS [ref]):session 键读口(`findPendingTokenBySession` / `peekPendingScope`)的**行绑定**。
@@ -416,8 +413,8 @@ interface SteerColumnRead {
  * **一列一形**:`pending_steer_queue` 存 `PendingSteerEntry[]`。
  *
  * 🔴 7.74.0 起只剩这**一**列。队列化之前的裸单座列 `pending_steer` 随它的席位一起退役了(core 7.17.0
- * [ref] d:引擎对带席的行 PRE-CAS 拒 `seat_retired`),存量列由启动期的一次性迁移删掉
- * (`plugins/one-time-migrations.ts`:列上还有非空值 ⇒ **响亮拒启**,清空后 `DROP COLUMN`)。
+ * [ref] d:引擎对带席的行 PRE-CAS 拒 `seat_retired`),存量列 7.74.0 起由启动期的一次性迁移删掉;迁移窗关后删码,
+ * 仍带着这一列的跳版升级库起服**响亮拒**(`plugins/one-time-migrations.ts` 的退役 schema 拒启臂)。
  * ⇒ 这里刻意**没有**第二条读腿:双读臂的寿命就是那一次迁移,不是永远。
  *
  * 列有内容却读不出 ⇒ `lossy`(两个调用点对它的处置见 {@link SteerColumnRead})。
@@ -623,29 +620,46 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      *
      * [ref] D-D: the deadline-branch EXPIRES (≈ abort) every kind EXCEPT a tool-approval human/irreversible_ask
      * gate — those are resolve-DENIED gracefully by the SLA deny-sweep (listExpiredApprovalGates →
-     * resumeCheckpoint(deny)), so expiring them here too would race + lose the graceful denial. 🔴 A durable
-     * AskUserQuestion ALSO mints gate.kind='human' (no question-specific kind in core) — but DENYING a question is
-     * incoherent (the model gets a "denied" tool-result, not an answer), so it is carved BACK INTO the expire path
-     * (COALESCE(tool_name,'')='AskUserQuestion') to abort-expire on timeout instead. Legacy rows (gate_kind NULL)
-     * stay on the expire path. The terminal_at_ms-branch is the crash-safe backstop for ANY kind (incl. a human gate
-     * whose deny-resume keeps failing) — it always abort-expires past the absolute cap (which is now STRICTLY after
-     * the deadline, so it never races the deny-sweep at the deadline instant).
+     * resumeCheckpoint(deny)), so expiring them here too would race + lose the graceful denial. Legacy rows (gate_kind
+     * NULL) stay on the expire path. The terminal_at_ms-branch is the crash-safe backstop for ANY kind (incl. a human
+     * gate whose deny-resume keeps failing) — it always abort-expires past the absolute cap (which is now STRICTLY
+     * after the deadline, so it never races the deny-sweep at the deadline instant).
+     *
+     * core 7.49.0 #1414 / #1468 A-S4: among the approval kinds, which rows the deny-sweep owns has ONE judge — core
+     * `facetOf(gate)`. A gate carrying the `question` card is facet `B` (a question's deadline voids it; denying a question
+     * is incoherent), so step ② expires it here row by row (token CAS, `status='pending'` guarded — a concurrent decide or
+     * another replica wins cleanly). The card lives only in the `checkpoint` blob's `gate` subtree, so the split cannot be
+     * one SQL predicate without writing core's judgment a second time in SQL; the old `tool_name` literal arm is gone. A
+     * gate with no card (parked before 7.49.0) is no question — core's reading — and stays with the deny-sweep.
      */
     reapExpired(cutoff: number): Promise<number>;
+    /** reapExpired ②'s position in the overdue approval rows, per store instance (see there). Absent = start from the earliest deadline. */
+    private reapCursor;
     /**
-     * [ref] D-D (SLA-timer): the sessions of pending human/irreversible_ask checkpoints past their `deadline`
-     * (the per-approval SLA). The reaper resolve-DENIES each (re-resume with decision=deny → the model continues
-     * with the denial) — graceful, vs the abort that expire() gives resource_limit/needs_review. Excludes legacy
-     * rows (gate_kind NULL — they predate the split and fall through to reapExpired's expire path). LIMIT bounds
-     * the per-tick deny-resume work (each is a model run). Scope is read off the COMMITTED row (invariant #4).
-     * 🔴 EXCLUDES AskUserQuestion gates (which also mint gate.kind='human'): denying a question is incoherent —
-     * the model would get a "denied" tool-result instead of an answer — so a timed-out durable question falls to
-     * reapExpired's abort-expire path instead of this graceful-deny path.
+     * [ref] D-D (SLA-timer): the sessions of pending approval-kind checkpoints past their `deadline` (the per-approval
+     * SLA) that the deny-sweep owns ({@link denySweepOwns} — core `facetOf` reads them as facet `A`) — the reaper resolve-DENIES
+     * each (re-resume with decision=deny → the model continues with the denial) — graceful, vs the abort that expire() gives
+     * resource_limit/needs_review. Excludes legacy rows (gate_kind NULL — they predate the split and fall through to
+     * reapExpired's expire path). `limit` bounds the per-tick deny-resume work (each is a model run).
+     * 🔴 core 7.49.0 #1414 / #1468 A-S4: a gate carrying the `question` card (facet `B`) is NOT deny-swept — core refuses
+     * `sla_timeout` on it pre-CAS — reapExpired voids it instead. The card lives only in the blob's `gate` subtree and the
+     * judge is core's (the split is not one SQL predicate — see {@link reapExpired}), so the filter runs on the rows read;
+     * the read is therefore PAGED, filter first and `limit` after: pages of {@link REAP_CLASSIFY_BATCH} rows in the stable
+     * (deadline, token) order, the cursor advancing, until `limit` rows are collected or the overdue rows run out — the same
+     * "filter, then take `limit`" the LOCAL twin does. A backlog of question rows ahead of the deny-sweep's rows costs extra
+     * bounded pages, never a hidden deny-sweep row (they used to hold slots of a `LIMIT limit` window until voided).
      */
     listExpiredApprovalGates(cutoff: number, limit?: number): Promise<Array<{
         sessionId: string;
         scope: string;
     }>>;
+    /**
+     * core 7.49.0 #1414 / #1468 A-S4 —— 审批门型里过了 deadline 的 pending 行(deadline 升序),每行带 core 对它的到期读法
+     * (`denySweepOwns` = 审批门型 ∧ core `facetOf` 读作 `A`,门型取列、卡取 `gate` 子树)。到期两条腿(reapExpired 的 ②、拒扫腿的选行)读同一只:
+     * 对审批门型「谁拒扫、谁作废」本仓不写第二份判据。读恒有界(每次一页 `limit` 行),序 = (deadline, token) 稳定序;`after` = 从这一位置之后读
+     * (reapExpired 的跨拍游标;拒扫腿选行一次之内的翻页游标)。
+     */
+    private overdueApprovalRows;
     /** Pending checkpoints for the operator queue — NON-secret fields only (never the token). `taskId` is
      *  joined from task_active (the JOIN KEY to the run/trace — a suspended run KEEPS its
      *  session claim, so the join is live for every pending row; null only in pathological windows). */

package/dist/plugins/checkpoint-store-sql.js

@@ -1,6 +1,6 @@
-import { ASK_USER_QUESTION_SQL_LITERAL, contentKindOf } from "../approval-content-kind.js";
+import { parkedApprovalCard, parkedFacetOf } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
-import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
+import { APPROVAL_GATE_KINDS_SQL_IN, denySweepOwns } from "../tool-approval.js";
 import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, parkRowFacts, screenUncoveredDetailSeat } from "../approval-card.js";
@@ -10,6 +10,7 @@ import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.
 import { isDupKeyError, isMissingColumnError } from "./sql-errors.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
+const REAP_CLASSIFY_BATCH = 200;
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 const MAX_TOOL_INPUT_CHARS = 8192;
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, (Number.isFinite(Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS)) ? Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) : 0) || 30 * 86_400_000);
@@ -182,6 +183,22 @@ function readParkRowFactsCell(cell) {
     return parkRowFacts(pendingAction);
 }
 const PARK_ROW_PENDING_ACTION = { key: "pendingAction", as: "pending_action" };
+const PARK_ROW_GATE = { key: "gate", as: "park_gate" };
+function readParkGateCell(cell) {
+    try {
+        return decodeNullableJsonColumn(cell, readParkGateMemberBody, "checkpoint.checkpoint $.gate (approval card / expiry facet)");
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        recordFailOpen("server.approvals.park-row-blob-unreadable", "member=gate");
+        return undefined;
+    }
+}
+const readParkGateMemberBody = createObjectColumnReader();
+function parkedGateOfRow(r) {
+    return { kind: r.gate_kind ?? undefined, approvalCard: readParkGateCell(r[PARK_ROW_GATE.as])?.approvalCard };
+}
 const readPendingActionMemberBody = createObjectColumnReader();
 export function boundedToolInput(args) {
     if (args === undefined)
@@ -518,21 +535,49 @@ export class SqlCheckpointStore {
     }
     async reapExpired(cutoff) {
         const res = await this.db.query(this.q("UPDATE checkpoint SET status = 'expired', decided_at_ms = ? " +
-            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= ? AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN} OR COALESCE(tool_name,'') = ${ASK_USER_QUESTION_SQL_LITERAL})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= ?))`, "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 " +
-            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN} OR COALESCE(tool_name,'') = ${ASK_USER_QUESTION_SQL_LITERAL})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= $3))`), [Date.now(), cutoff, cutoff]);
-        return res.affected;
+            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= ? AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= ?))`, "UPDATE checkpoint SET status = 'expired', decided_at_ms = $1 " +
+            `WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ${APPROVAL_GATE_KINDS_SQL_IN})) OR (terminal_at_ms IS NOT NULL AND terminal_at_ms <= $3))`), [Date.now(), cutoff, cutoff]);
+        let n = res.affected;
+        const batch = await this.overdueApprovalRows(cutoff, REAP_CLASSIFY_BATCH, this.reapCursor);
+        for (const row of batch) {
+            if (!row.denySweeps && (await this.expire(row.token, row.scope)))
+                n++;
+        }
+        const last = batch.at(-1);
+        this.reapCursor = batch.length < REAP_CLASSIFY_BATCH || last === undefined ? undefined : { deadline: last.deadline, token: last.token };
+        return n;
     }
+    reapCursor;
     async listExpiredApprovalGates(cutoff, limit = 100) {
-        const { rows } = await this.db.query(this.q(`SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} ` +
-            `AND COALESCE(tool_name,'') <> ${ASK_USER_QUESTION_SQL_LITERAL} AND deadline IS NOT NULL AND deadline <= ? ORDER BY deadline ASC LIMIT ?`, `SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} ` +
-            `AND COALESCE(tool_name,'') <> ${ASK_USER_QUESTION_SQL_LITERAL} AND deadline IS NOT NULL AND deadline <= $1 ORDER BY deadline ASC LIMIT $2`), [cutoff, limit]);
-        return rows.map((r) => ({ sessionId: String(r.session_id), scope: String(r.scope) }));
+        const hits = [];
+        let after;
+        while (hits.length < limit) {
+            const page = await this.overdueApprovalRows(cutoff, REAP_CLASSIFY_BATCH, after);
+            for (const r of page) {
+                if (hits.length < limit && r.denySweeps)
+                    hits.push({ sessionId: r.sessionId, scope: r.scope });
+            }
+            const last = page.at(-1);
+            if (page.length < REAP_CLASSIFY_BATCH || last === undefined)
+                break;
+            after = { deadline: last.deadline, token: last.token };
+        }
+        return hits;
+    }
+    async overdueApprovalRows(cutoff, limit, after) {
+        const head = `SELECT c.token, c.session_id, c.scope, c.gate_kind, c.deadline, ${jsonColumnText(this.db.dialect, "checkpoint", PARK_ROW_GATE)} FROM checkpoint c ` +
+            `WHERE c.status = 'pending' AND c.gate_kind IN ${APPROVAL_GATE_KINDS_SQL_IN} AND c.deadline IS NOT NULL AND `;
+        const { rows } = await this.db.query(after === undefined
+            ? head + this.q("c.deadline <= ? ORDER BY c.deadline ASC, c.token ASC LIMIT ?", "c.deadline <= $1 ORDER BY c.deadline ASC, c.token ASC LIMIT $2")
+            : head +
+                this.q("c.deadline <= ? AND (c.deadline > ? OR (c.deadline = ? AND c.token > ?)) ORDER BY c.deadline ASC, c.token ASC LIMIT ?", "c.deadline <= $1 AND (c.deadline > $2 OR (c.deadline = $3 AND c.token > $4)) ORDER BY c.deadline ASC, c.token ASC LIMIT $5"), after === undefined ? [cutoff, limit] : [cutoff, after.deadline, after.deadline, after.token, limit]);
+        return rows.map((r) => ({ token: String(r.token), sessionId: String(r.session_id), scope: String(r.scope), deadline: Number(r.deadline), denySweeps: denySweepOwns(parkedGateOfRow(r)) }));
     }
     async listPending(scope) {
         const d = this.db.dialect;
         const base = `SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, ${jsonColumnText(d, "tool_input")}, c.bound_input_hash, ` +
             `${jsonColumnText(d, "risk_descriptor")}, ${jsonColumnText(d, "rule_suggestions")}, c.has_bidi_controls, c.created_at_ms, c.deadline, c.gate_kind, ta.task_id, ` +
-            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)} ` +
+            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_GATE)} ` +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
@@ -543,6 +588,7 @@ export class SqlCheckpointStore {
             const boundInputHash = r.bound_input_hash ?? null;
             const gateKind = r.gate_kind ?? null;
             const ruleOffers = readRuleOffersCell(r.rule_suggestions);
+            const approvalCard = parkedApprovalCard(parkedGateOfRow(r));
             return {
                 sessionId: String(r.session_id),
                 scope: String(r.scope),
@@ -558,7 +604,7 @@ export class SqlCheckpointStore {
                 riskDescriptor: readRiskDescriptorCell(r.risk_descriptor),
                 ...(ruleOffers !== undefined ? { ruleOffers } : {}),
                 ...(Number(r.has_bidi_controls) === 1 ? { hasBidiControls: true } : {}),
-                ...(contentKindOf(toolName) !== undefined ? { contentKind: "content_ask" } : {}),
+                ...(approvalCard !== undefined ? { approvalCard } : {}),
                 ...readParkRowFactsCell(r[PARK_ROW_PENDING_ACTION.as]),
             };
         });

package/dist/plugins/file-run-store.d.ts

@@ -1,8 +1,9 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { StoreBootRefusalError, type CreateRunOutcome, type NewRunMeta, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { StoreBootRefusalError, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
+import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
  * `RUN_STORE_STRICT_HYDRATE=on` 下 hydrate 列不出 `runs/` 时的**拒启**类型([ref] 件B;codex 对抗复审
  * R1-[high] 验真后从裸 `Error` 升成具名类型)。
@@ -25,6 +26,11 @@ export declare class FileRunStore {
     private readonly runsDir;
     private readonly activeDir;
     private readonly tmpDir;
+    /** `<root>/space-commits/` — the twin of `workspace_space_commit`: one record per space key (file name = the key,
+     *  checked by `sanitizePathComponent`; written by `atomicWriteFile`). */
+    private readonly spaceCommitsDir;
+    /** The k8s workspace space's commit fence (the rule: `workspace-space-commit.ts`) over the record files. */
+    private readonly spaceCommits;
     /** taskId → RunRow (the run registry index). */
     private readonly runs;
     /** sessionId → taskId — the single-active-run claim (the task_active table; index of active/*). */
@@ -55,6 +61,15 @@ export declare class FileRunStore {
     private runJsonPath;
     private eventsPath;
     private activePath;
+    private spaceCommitPath;
+    /** One space's commit record, or `undefined` (no file). A record that is not this store's shape is a loud read failure
+     *  (the reader — the next run's connect — refuses; it never guesses that no commit is in flight). */
+    private loadSpaceCommit;
+    /** The k8s workspace space's commit fence rows (SQL twin: `workspace_space_commit`; the rule: `workspace-space-commit.ts`). */
+    readSpaceCommit(spaceKey: string): Promise<SpaceCommitReading | undefined>;
+    claimSpaceCommit(spaceKey: string, taskId: string, state: SpaceCommitState, claim: SpaceCommitClaim): Promise<boolean>;
+    endSpaceCommit(spaceKey: string, taskId: string): Promise<void>;
+    abandonSpaceCommit(spaceKey: string, taskId: string): Promise<boolean>;
     private toRow;
     private toDisk;
     private toRecord;
@@ -120,6 +135,9 @@ export declare class FileRunStore {
     /** [ref] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
      *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     setTerminal(taskId: string, status: TaskStatus, result: PersistedTaskResult | null, error: string | null): Promise<void>;
+    /** The terminal write's one synchronous section (SQL twin: one transaction): the k8s space's pending commit record (when
+     *  offered) → the terminal row → the active-run claim release. Returns whether the pending record is now this run's. */
+    private writeTerminal;
     /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard).
      *  S-173:同时落 `result` —— 封口脱敏后的投影(`sealRunRowResult`,凭据不落;`null` = 没观察到 park 结果),SQL 孪生同注。 */
     setSuspended(taskId: string, result: PersistedTaskResult | null): Promise<void>;
@@ -131,11 +149,15 @@ export declare class FileRunStore {
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
     getRun(taskId: string): Promise<RunRecord | undefined>;
-    /** Undo THIS submission's key binding (`idem_key` → NULL) — called only where the submit surface refuses the submission
+    /** Undo THIS submission's binding (key + body fingerprint → null) — called only where the submit surface refuses the submission
      *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, a device-placement reject):
      *  the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
-     *  is the refusal's record); only the key is freed. */
+     *  is the refusal's record); only the binding is freed. */
     releaseIdemKey(taskId: string): Promise<void>;
+    /** The body fingerprint this row's binding of `idem.key` holds — binding `idem.bodyFingerprint` first when it holds none (first
+     *  arrival binds and is persisted, everyone after reads; the file twin of the SQL conditional UPDATE — one writer per data root,
+     *  single-threaded between the check and the write). `null` = no such row, or the row is not bound to this key (never written). */
+    bindIdemBodyFingerprint(taskId: string, idem: RunIdemBinding): Promise<string | null>;
     /** The run a submission's scoped `Idempotency-Key` names (the file twin of `uq_task_run_idem`), if any. */
     getRunByIdem(idemKey: string): Promise<RunRecord | undefined>;
     /** Runs newest-first, keyset on (createdAt, taskId) DESC; optional exact-match filters (owner is exact, like the SQL). */
@@ -312,24 +334,6 @@ export declare class FileRunStore {
     private releaseClaim;
     /** Drop a run entirely (registry + event log + open fd + on-disk dir) — used by deleteBySession. */
     private dropRun;
-    /**
-     * 🔴 **一次性迁移 M3 的 local 腿(窗口见 `one-time-migrations.ts` 登记表,随 M3 一起删)** —— 退役词旧拼法的账本改写,
-     * SQL 两孪生那条整表 UPDATE 的 local 形。逐条走**同一只**纯改写函数,所以三条车道改出来的字节一致。
-     *
-     * 为什么是 store 上的一只动词、而不是外面一个文件走查:本店的账本有**两份**在场 —— 盘上的 jsonl
-     * 与 hydrate 进来的内存索引。外部走查只改得到前者,读腿读的却是后者(`getEvents` 从 Map 取),
-     * 于是迁移在本次进程里完全不生效、下次重启才"忽然"生效。两份一起改的唯一正确位置就是这里。
-     *
-     * 写盘用整文件原子替换(不是追加):改的是**已有行**,而 `AppendLog` 只会往后写。替换之前把**全部**
-     * append fd 撤掉(rename 之后旧 fd 指向的是被 unlink 的 inode,继续往那儿追加 = 之后的事件全部写进一个
-     * 没人看得见的文件),下一次 `appendEvent` 会按惰性规则重新开。撤 fd 复用**既有的那一只** {@link dispose}
-     * —— 刻意不在这里另写一段 close+catch:那会是本文件第二处同形的兜底臂,而规则要变少不要变多。
-     * 常态下这一撤是空操作:本动词跑在 boot 期,那时一个 append fd 都还没惰性开出来。
-     *
-     * 幂等:零命中 ⇒ 一个字节都不写、一只 fd 都不撤(第二跑零 I/O)。
-     * @returns 被改写的账本**行**数(不是 run 数)。
-     */
-    migrateRetiredAskOriginRows(): Promise<number>;
     /**
      * 一次性迁移 **M6 的 local 腿**(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):把 ≤7.115.x 写下的死亡判决行
      * (`failed` ∧ 码列空 ∧ 句子是那两句,判据 = `readLegacyHolderDeathCode`)补上机读码,盘上(`run.json` 整份原子替换,同 `persist`)与内存同改。