@sema-agent/server 7.125.1 → 7.127.0

package/dist/boot/runner-deps.d.ts

@@ -23,6 +23,7 @@ import { type WorkflowCompletionInbox } from "../orchestration/workflow-completi
 import { type EngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate, type WorkflowCompletionPayload } from "../orchestration/workflow-notify-journal.js";
 import type { ServiceWorkflowJournalStore, SessionCaptureRecordSource, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { createSessionStore } from "../plugins/session-store.js";
 import type { QuestionCoordinator } from "../question.js";
 import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { MemoryBackend } from "@sema-agent/core";
@@ -87,9 +88,6 @@ export interface RunnerDepsCtx {
     promptSource: RunnerDeps["promptSource"];
     rosterStore: RunnerDeps["rosterStore"];
     backgroundAgentStore: RunnerDeps["backgroundAgentStore"];
-    /** S-506([ref] §5):本副本 per-session 登记簿的**同步**化身读腿(装配期由 resolve-spec 写入)。在场 ⇒ 铸
-     *  `RunnerDeps.memorySessionIncarnation` 座;缺席 ⇒ 座不铸(core 口径:按 id 绑定 = 修前行为)。 */
-    sessionIncarnationOf: ((sessionId: string) => string | undefined) | undefined;
     mailboxStore: RunnerDeps["mailboxStore"];
     /**
      * [ref]:mailbox 的**收件人生命周期面**(预删除态)。与 `mailboxStore` **成对**(`boot/stores.ts` 同段铸,
@@ -105,7 +103,7 @@ export interface RunnerDepsCtx {
     elicitation: ElicitationCoordinator | undefined;
     question: QuestionCoordinator | undefined;
     toolApproval: ToolApprovalCoordinator | undefined;
-    sessionStore: ReturnType<StoreBackend["session"]>;
+    sessionStore: ReturnType<typeof createSessionStore>;
     /**
      * B-060(test [ref] 核心发现①)—— **一条部署腿上的每一只 Runner 看同一只检查点店**。
      *
@@ -159,6 +157,9 @@ export interface RunnerDepsCtx {
         backend: MemoryBackend;
         root: string;
     } | undefined;
+    /** core 7.49.0 [ref]:引擎数据根(boot 事实,`boot/stores.ts` 恒铸 —— 记忆引擎开不开都在)。共享基座把它交成每只 Runner 的
+     *  `memoryEngineDir`:引擎从它解出每条腿的唯一豁免根(守卫集不再收 `dataRoot`)。开引擎时与 `memoryEngine.root` 同一只。 */
+    engineDataRoot: string;
     /**
      * S-399(core 7.21.1)—— 记忆整理的**已解析座**(`boot/memory-consolidation.ts` 的
      * `resolveConsolidationDriverSeat` 产物),在场 **iff** 整理阀门开着(`resolveConsolidationValve` 的判决:
@@ -236,7 +237,7 @@ export interface RunnerDepsCtx {
 }
 /** [ref] A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "crossSessionInbound" | "crossSessionDialogExpiry" | "writeProtectedPaths" | "memoryEngineDir" | "allowedTools" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "checkpointStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * [ref] A10 留档发现②(review 2026-07-29,[ref]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -263,7 +264,7 @@ export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDeny
  *    属性,比再抽一层共享基座更强的同源保证),不重复收纳进这里。
  */
 /** 基座真实消费的窄面(Pick)——subRunner 调用点(main.ts)只需凑这 13 个字段,不必造全量 ctx。 */
-export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics">;
+export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "deploymentHooks" | "toolResultStore" | "checkpointStore" | "sessionPolicyStore" | "hands" | "usageWindowStore" | "orgMemoryAdmission" | "sharedMemoryStores" | "logger" | "governanceSeams" | "mcpRevocations" | "metrics" | "engineDataRoot">;
 /** 转发席只需要 `inc` —— 刻意窄到这一个动词,免得把整只 Metrics 拖进这条纯转发腿。 */
 export interface EngineNoticeMetricsSeat {
     inc: (name: string, labels?: Record<string, string>) => void;

package/dist/boot/runner-deps.js

@@ -1,16 +1,14 @@
 import { createFileWorkflowScriptStore } from "@sema-agent/core";
 import { join } from "node:path";
-import { listCollabWorkflows, resolveCollabWorkflow } from "../capabilities/collab-workflows.js";
 import { lkgReadDenyRows } from "../config-lkg.js";
 import { fleetBackgroundChildPublisher, FleetEventBus } from "../fleet/fleet-bus.js";
 import { createMemoryEngineIncidentSink } from "../memory-incident-sink.js";
-import { createMemorySessionIncarnationSeat, sessionFaceReaderOf } from "./session-incarnation-seat.js";
 import { assertAutoConsolidationWirable } from "./memory-consolidation.js";
 import { createHardenedVmRunner } from "../orchestration/hardened-vm-runner.js";
 import { createWorkerHardenedVmRunner } from "../orchestration/hardened-vm-worker-runner.js";
 import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js";
 import { resolveServedSession } from "../orchestration/workflow-completion-inbox.js";
-import { defaultEngineNoticeRouter, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
+import { defaultEngineNoticeRouter, redactNoticeMessage, redactNoticeRuleText } from "../trace/engine-notice-wire.js";
 import { WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "../project-memory.js";
 import { createInstructionSourceSeat } from "../instruction-source-notice.js";
@@ -43,7 +41,8 @@ const CEILING_ORIGINS = new Set(["walltime", "turns"]);
 export function createEngineNoticeForwarder(logger, router = defaultEngineNoticeRouter, metrics) {
     return (notice) => {
         const detail = redactNoticeRuleText(notice.code, notice.detail);
-        logger.warn("engine_notice", { code: notice.code, message: notice.message, ...(detail !== undefined ? { detail } : {}) });
+        const message = redactNoticeMessage(notice.message);
+        logger.warn("engine_notice", { code: notice.code, message, ...(detail !== undefined ? { detail } : {}) });
         if (metrics !== undefined && notice.code === "task.interrupt_unconsumed") {
             const origin = notice.detail?.origin;
             if (typeof origin === "string" && CEILING_ORIGINS.has(origin))
@@ -103,6 +102,7 @@ export function createSharedRunnerDeps(ctx) {
         usageWindows: ctx.config.usageWindows ? ctx.config.usageWindows : undefined,
         usageWindowStore: ctx.usageWindowStore ? ctx.usageWindowStore : undefined,
         sharedMemoryStores: ctx.sharedMemoryStores ? ctx.sharedMemoryStores : undefined,
+        memoryEngineDir: ctx.engineDataRoot,
         compliancePostureResolver: ctx.governanceSeams.compliancePostureResolver,
         lockedConfig: ctx.governanceSeams.lockedConfig,
         retentionPolicy: ctx.governanceSeams.retentionPolicy,
@@ -123,16 +123,7 @@ export function createRunnerDeps(ctx) {
                 : createHardenedVmRunner(),
             workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
             workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
-            workflowScriptStore: (() => {
-                const fileStore = createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts"));
-                return {
-                    scopePartitioned: true,
-                    persist: fileStore.persist.bind(fileStore),
-                    load: fileStore.load.bind(fileStore),
-                    resolveName: (name) => resolveCollabWorkflow(name) ?? fileStore.resolveName?.(name),
-                    list: () => listCollabWorkflows(),
-                };
-            })(),
+            workflowScriptStore: createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts")),
             onWorkflowAgentSpawn: workflowAgentRegistry
                 ? (handle) => {
                     const unregister = workflowAgentRegistry.register(handle);
@@ -192,9 +183,7 @@ export function createRunnerDeps(ctx) {
         },
         sessionStore,
         memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
-        memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,
         memoryCaptureRecordStore: sessionCaptureRecords !== undefined ? (plane) => sessionCaptureRecords(plane) : undefined,
-        memorySessionIncarnation: ctx.sessionIncarnationOf !== undefined && sessionFaceReaderOf(sessionStore) !== undefined ? createMemorySessionIncarnationSeat(ctx.sessionIncarnationOf, (e, f) => logger.warn(e, f)) : undefined,
         onMemoryHarvestReport: memoryEngine
             ? (report, info) => {
                 metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });

package/dist/boot/session-faces.d.ts

@@ -6,7 +6,7 @@
  *
  * ⚠️ **位置即契约**:
  *  1. `sessionWatchRegistry` 必须在 `purgeSession` **之前**构造 —— purge 尾部的 `dropSession` 是
- *     同副本租户轮转围栏(delete 即终结旧 owner 的 SSE 订阅),两者是一对。
+ *     同副本租户轮转围栏(delete 即终结旧 owner 的 SSE 订阅),两者是一对;空间回收座在它**之后**起、且不在应答路径里。
  *  2. `setLeafAdvanceListener(...)` 是**进程级单点**装载(leaf-bus 只有一个监听位),必须与
  *     registry 的构造同段发生,晚于它、早于任何会 append 的路由。
  */
@@ -17,6 +17,7 @@ import type { Metrics } from "../observability/metrics.js";
 import type { WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
 import { PlanCacheProbe } from "../plan-cache-probe.js";
 import type { CheckpointStoreFull, StoreBackend, ToolResultStoreFull } from "../plugins/store-backend.js";
+import type { createSessionStore } from "../plugins/session-store.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { FileHistoryErasureFace } from "../file-history-capture.js";
 import type { OwnerAwareSessionStore } from "../security.js";
@@ -26,13 +27,14 @@ import type { TaskListLane } from "./task-list-lane.js";
 import { type RunnerDeps } from "@sema-agent/core";
 import type { MailboxRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
 import type { UserInputLedgerStore } from "../user-input-ledger.js";
+import type { SpaceReclaimer } from "../workspace-space.js";
 export interface SessionFacesCtx {
     config: ServiceConfig;
     logger: Logger;
     metrics: Metrics;
     localRoot: string;
     backend: StoreBackend | undefined;
-    sessionStore: ReturnType<StoreBackend["session"]>;
+    sessionStore: ReturnType<typeof createSessionStore>;
     runStore: ReturnType<StoreBackend["run"]> | undefined;
     checkpointStore: CheckpointStoreFull | undefined;
     toolResultStore: ToolResultStoreFull | undefined;
@@ -60,6 +62,9 @@ export interface SessionFacesCtx {
     /** S-965:用户输入受理账本的**店**(E21 级联的一条腿:该会话的受理行随会话删)。与受理 / 收敛 / 告知读的是同一只(stage-07 取一次)。
      *  缺席 = 本部署没装账本(env-only:没有 backend / run 店)⇒ 无行可删。 */
     userInputLedgerStore: UserInputLedgerStore | undefined;
+    /** k8s 车道工作区空间的回收座(配了构建缓存卷或快照存储时在场;与托管留存 sweep 同一只)—— E21 级联的一条腿:会话删了 =
+     *  这位住客的空间结束了,它的缓存卷、`space/` 快照、该会话停驻车道的快照随之回收。缺席 = 本部署没有可回收的东西。 */
+    spaceReclaimer?: SpaceReclaimer;
 }
 export declare function createSessionFaces(ctx: SessionFacesCtx): {
     ownerAware: OwnerAwareSessionStore;

package/dist/boot/session-faces.js

@@ -7,8 +7,10 @@ import { SessionWatchRegistry, posIntEnv } from "../session-watch.js";
 import { defaultTaskRegistry, peerSessionBoxHandle } from "@sema-agent/core";
 import { reapSessionBackgroundHard } from "../background-session-reap.js";
 import { probeSessionChildren, retireSessionChildren, SessionChildrenStopIncompleteError } from "../session-children-retire.js";
+import { SessionIncarnationMissingError, redactIncarnations, sessionFaceReadOf } from "../session-incarnation.js";
+import { recordFailOpen } from "../observability/fail-open.js";
 export function createSessionFaces(ctx) {
-    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, mailboxStore, mailboxRecipientLifecycle, backgroundAgentStore, userInputLedgerStore, } = ctx;
+    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, mailboxStore, mailboxRecipientLifecycle, backgroundAgentStore, userInputLedgerStore, spaceReclaimer, } = ctx;
     const mysqlPool = backend?.mysqlPool();
     const auditPgPool = backend?.pgPool();
     const auditLocalRoot = backend?.kind === "local" ? (config.localDataRoot ?? localRoot) : undefined;
@@ -34,6 +36,28 @@ export function createSessionFaces(ctx) {
         })
         : undefined;
     setLeafAdvanceListener(sessionWatchRegistry ? (sid, leaf, owner, seq) => sessionWatchRegistry.notifyLocal(sid, leaf, owner, seq) : undefined);
+    const readSessionFace = sessionFaceReadOf(sessionStore);
+    const occupantSpaceKeyOf = async (sessionId, owner) => {
+        if (readSessionFace === undefined)
+            return undefined;
+        try {
+            const face = await readSessionFace(sessionId);
+            return face !== undefined && face.owner === owner ? face.incarnation : undefined;
+        }
+        catch (err) {
+            if (err instanceof SessionIncarnationMissingError)
+                return undefined;
+            const reason = "occupant_unreadable";
+            recordFailOpen("server.workspace-cache.reclaim-failed", `reason=${reason}`);
+            logger.warn("workspace_cache_reclaim_failed", {
+                sessionId,
+                reason,
+                error: redactIncarnations(String(err)),
+                effect: "the deleted session's space could not be read, so its build-cache volume and snapshot objects are not reclaimed (the session delete went ahead) — delete the volume by label sema.space; the objects fall to the bucket's lifecycle rule",
+            });
+            return undefined;
+        }
+    };
     const purgeSession = ownerAware.deleteSession
         ? async (sessionId, owner) => {
             if (ownerAware.ownerOf) {
@@ -41,6 +65,7 @@ export function createSessionFaces(ctx) {
                 if (stillOwner !== owner)
                     return { deleted: false };
             }
+            const spaceKey = spaceReclaimer !== undefined ? await occupantSpaceKeyOf(sessionId, owner) : undefined;
             const childScope = owner ?? "default";
             const reach = await probeSessionChildren({ agentStore: backgroundAgentStore, checkpointStore, registry: defaultTaskRegistry }, sessionId, childScope);
             if (!reach.reachable) {
@@ -116,6 +141,17 @@ export function createSessionFaces(ctx) {
                 await peerBox.store.drop(peerBox.scope, peerBox.handle);
             const historyDeleted = await ownerAware.deleteSession(sessionId, owner);
             sessionWatchRegistry?.dropSession(sessionId);
+            if (historyDeleted && spaceReclaimer !== undefined && spaceKey !== undefined) {
+                void spaceReclaimer.reclaim([{ sessionId, spaceKey }]).catch((err) => {
+                    recordFailOpen("server.workspace-space.reclaim-failed", "stage=seat_threw");
+                    logger.warn("workspace_space_reclaim_failed", {
+                        sessionId,
+                        stage: "seat_threw",
+                        error: redactIncarnations(String(err)),
+                        effect: "the ended space's cache volume and snapshot objects may stay (the reclaim seat threw, which its contract forbids; the session delete went ahead) — the bucket's lifecycle rule is the fallback for objects, the volume is deleted by label sema.space",
+                    });
+                });
+            }
             return { deleted: historyDeleted || runs.removed > 0 };
         }
         : undefined;

package/dist/boot/stage-03-store-backend.d.ts

@@ -3,6 +3,7 @@ export declare function runStage03(ctx: Awaited<ReturnType<typeof runStage02>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-03-store-backend.js

@@ -2,10 +2,10 @@ import { uuidv7 } from "@sema-agent/core";
 import { openStores } from "./stores.js";
 export async function runStage03(ctx) {
     const { config, localRoot, logger, metrics } = ctx;
-    const { backend, storePosture, memoryEngine, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
+    const { backend, storePosture, memoryEngine, engineDataRoot, memorySyncCursors, rosterStore, backgroundAgentStore, taskAttachmentStore, mailboxStore, mailboxRecipientLifecycle, memoryExportBackend, memorySyncRunner, sessionStore, breakerState, usageWindowStore, memoryPosture, taskListLane, sqlEngineFacts, } = await openStores({ config, logger, metrics, localRoot });
     const instanceId = uuidv7();
     const sessionCaptureRecords = backend?.sessionCaptureRecords();
     const sessionCaptureRecordStore = sessionCaptureRecords?.();
-    return { ...ctx, backend, backgroundAgentStore, breakerState, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngineFacts, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
+    return { ...ctx, backend, backgroundAgentStore, breakerState, engineDataRoot, instanceId, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memoryExportBackend, memoryPosture, memorySyncCursors, memorySyncRunner, rosterStore, sessionCaptureRecordStore, sessionCaptureRecords, sessionStore, sqlEngineFacts, storePosture, taskAttachmentStore, taskListLane, usageWindowStore };
 }
 //# sourceMappingURL=stage-03-store-backend.js.map

package/dist/boot/stage-04-stores.d.ts

@@ -44,6 +44,7 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-05-execution-env.d.ts

@@ -6,12 +6,11 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -60,6 +59,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-05-execution-env.js

@@ -2,15 +2,18 @@ import { createToolTracer, createPermissionDeniedMeter } from "../observability/
 import { composeHooks } from "../hooks/hook-runner.js";
 import { assertDeviceLaneWired, createDeviceLane } from "./device-lane.js";
 import { assertWorkspaceSpaceReadable, createExecutionEnv } from "./execution-env.js";
-import { sessionFaceReaderOf } from "./session-incarnation-seat.js";
+import { incarnationReadOf } from "../session-incarnation.js";
 import * as facts from "../capability-facts.js";
 import { sessionStoreLabelOf } from "../store-posture.js";
+import { runStore } from "./late-binds.js";
 export function runStage05(ctx) {
     const { backend, config, instanceId, logger, metrics, sessionStore, taskAttachmentStore } = ctx;
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, replicaId: instanceId }) : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, noteSessionIncarnation, sessionIncarnationOf, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}) });
+    const incarnationOf = incarnationReadOf(sessionStore);
+    const spaceCommits = backend !== undefined ? () => runStore : undefined;
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(incarnationOf !== undefined ? { incarnationOf } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
-    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), sessionFaceReaderOf(sessionStore), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
+    assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { incarnationOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     const toolTracer = config.toolTrace ? createToolTracer(logger) : undefined;
     if (toolTracer)
         logger.info("tool_trace_enabled", {});
@@ -18,6 +21,6 @@ export function runStage05(ctx) {
         ...(toolTracer ? composeHooks(createPermissionDeniedMeter(metrics), toolTracer) : createPermissionDeniedMeter(metrics)),
         ...(config.hooksTimeoutMs !== undefined ? { timeoutMs: config.hooksTimeoutMs } : {}),
     };
-    return { ...ctx, deploymentHooks, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, noteSessionIncarnation, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, sessionIncarnationOf, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
+    return { ...ctx, deploymentHooks, deviceLane, dropSessionScoped, executionEnvFactory, fenceSessionOwner, lspManager, spaceReclaimer, perSessionCwd, perTaskImage, sendUserFileTaskEnvs, sessionEnvSelection, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, worktreeReap };
 }
 //# sourceMappingURL=stage-05-execution-env.js.map

package/dist/boot/stage-06-runners.d.ts

@@ -20,7 +20,6 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: Runner;
-    handslessSubRunner: Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -67,12 +66,11 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -121,6 +119,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-06-runners.js

@@ -3,25 +3,27 @@ import { outwardPlane } from "../terminal.js";
 import { createSessionTitler } from "../session-titler.js";
 import { cardRuleScopeRoot } from "../task-cwd.js";
 import { ForkRoutingSessionStore } from "../plugins/fork-routing-session-store.js";
-import { withoutExecutionEnv } from "../capabilities/hands-lane.js";
+import { withoutHands } from "../capabilities/hands-lane.js";
 import { redactSecrets } from "../trace/redact.js";
 import { hasServiceAuth } from "../http/server.js";
 import { workflowModelAllowlistFor } from "../task-workflow.js";
 import { createHookLlm, buildHookFailureText } from "../hooks/hook-llm.js";
 import { assertRetentionLaneWirable } from "./retention-lane.js";
-import { buildConsolidationValveAudit, createMemoryConsolidationFaces, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
+import { buildConsolidationValveAudit, createMemoryConsolidationFaces, createOperatorValveWriteJudge, resolveConsolidationDriverSeat } from "./memory-consolidation.js";
 import { createPerModelAuthSeat } from "./side-query-lane.js";
 import { createWorkflowOrchestration } from "./workflow-orchestration.js";
 import { createLiveCoordinators } from "./coordinators.js";
 import { createParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { createRuntimeCaps } from "./runtime-caps.js";
-import { createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
+import { createEngineNoticeForwarder, createRunnerDeps, createSharedRunnerDeps } from "./runner-deps.js";
+import { defaultEngineNoticeRouter } from "../trace/engine-notice-wire.js";
 import { createOrgMemoryAdmissionWiring } from "./org-memory.js";
 import { createGovernanceSeams } from "./governance-seams.js";
 import { createSharedMemoryScopeAuthorizer } from "../shared-memory-scope-authorizer.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
+import { withInternalRunEnvs } from "../internal-run-env.js";
 export function runStage06(ctx) {
-    const { backend, backgroundAgentStore, brain, sessionIncarnationOf, config, webAdmin, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
+    const { backend, backgroundAgentStore, brain, engineDataRoot, config, webAdmin, consolidationValve, deploymentHooks, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecordStore, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
     const parkCommitted = backend?.checkpoint && config.durableApproval ? createParkCommitWatch(backend.checkpoint(logger)) : undefined;
     const checkpointStore = parkCommitted?.store;
@@ -74,6 +76,8 @@ export function runStage06(ctx) {
             onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
             ...(sessionCaptureRecordStore !== undefined ? { captureRecordStore: sessionCaptureRecordStore } : {}),
+            writeJudge: createOperatorValveWriteJudge(),
+            onNotice: createEngineNoticeForwarder(logger, defaultEngineNoticeRouter, metrics),
         })
         : undefined;
     for (const w of buildConsolidationValveAudit({
@@ -110,9 +114,9 @@ export function runStage06(ctx) {
         consolidationSeat,
         hands: commitHands,
         mcpRevocations,
-        sessionIncarnationOf,
         config, logger, metrics, localRoot, promptSource: webAdmin.promptSource, rosterStore, backgroundAgentStore, mailboxStore, mailboxRecipientLifecycle, usageWindowStore, brain,
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
+        engineDataRoot,
         sessionCaptureRecords,
         memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
         permissionRuleStore: permissionRuleProvider,
@@ -123,9 +127,9 @@ export function runStage06(ctx) {
         getRunStore: () => runStore,
     });
     const runner = new Runner(runnerDeps);
-    const handslessRunner = new Runner(withoutExecutionEnv(runnerDeps));
+    const handslessRunner = new Runner(withoutHands(runnerDeps));
     const { hookModelFor, hookLlm } = createHookLlm({ config, getKeyResolver: () => webAdmin.getKeyResolver(), metrics });
-    const hookAgentRunner = new Runner({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) });
+    const hookAgentRunner = new Runner(withInternalRunEnvs({ ...runnerDeps, sessionStore: new TtlSessionStore({ defaultTtlDays: 1 / 24 }) }));
     const agentHookCall = async ({ prompt, model, timeoutMs, system }) => {
         const pick = hookModelFor(model);
         if (!pick.ok)
@@ -196,6 +200,7 @@ export function runStage06(ctx) {
             orgMemoryAdmission,
             governanceSeams,
             sharedMemoryStores: sharedMemoryStore ? sharedMemoryStore : undefined,
+            engineDataRoot,
         }),
         sessionStore: subRunnerSessions,
         onBackgroundChildEvent: runnerDeps.onBackgroundChildEvent ? runnerDeps.onBackgroundChildEvent : undefined,
@@ -204,7 +209,6 @@ export function runStage06(ctx) {
         onError: runnerDeps.onError ? runnerDeps.onError : undefined,
     };
     const subRunner = new Runner(subRunnerDeps);
-    const handslessSubRunner = new Runner(withoutExecutionEnv(subRunnerDeps));
-    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, handslessSubRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
+    return { ...ctx, approvalAskAudit, approvalExemptionStore, centerRuntimeCapsResolver, checkpointStore, parkCommits, durableEnabled, elicitation, fleetBus, governanceSeams, handslessRunner, hookAgent, hookAgentRunner, hookLlm, mcpRevocations, memoryConsolidationFaces, memoryOptOutGrantStore, orgMemoryAdmission, outcomeSink, principalCaps, question, retentionExecutor, retentionLaneStore, runner, runnerDeps, runtimeCapsPeekResolver, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionTitler, sharedMemoryStore, sqlWorkflowRunStore, streamApprovalGate, subRunner, subRunnerSessions, subagentSteerRegistry, toolApproval, workflowAgentRegistry, workflowAgentSessionIndex, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable };
 }
 //# sourceMappingURL=stage-06-runners.js.map

package/dist/boot/stage-07-capability-layer.d.ts

@@ -35,7 +35,6 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: import("@sema-agent/core").Runner;
-    handslessSubRunner: import("@sema-agent/core").Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: import("@sema-agent/core").Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -82,12 +81,11 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -136,6 +134,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -27,7 +27,7 @@ import { buildDisplaySafeUrl } from "../trace/redact.js";
 import * as facts from "../capability-facts.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 export async function runStage07(ctx) {
-    const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, durableEnabled, handslessSubRunner, instanceId, localRoot, logger, memoryEngine, metrics, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
+    const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, durableEnabled, instanceId, localRoot, logger, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, subRunnerSessions, taskListLane, toolApproval } = ctx;
     const authorize = createAuthorizer(config, sessionStore);
     const runStore = backend ? backend.run() : undefined;
     bindRunStore(runStore);
@@ -153,8 +153,8 @@ export async function runStage07(ctx) {
     const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => webAdmin.getKeyResolver(), logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
-        webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
+        runner, subRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
+        webSearch: webSearch ? webSearch : undefined, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,
         ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
@@ -168,7 +168,6 @@ export async function runStage07(ctx) {
     const parkedReviveInheritedGate = parkedReviveSurface && config.durableApproval
         ? createParkedReviveInheritedGate({
             config, question, logger, localRoot,
-            memoryEngineRoot: memoryEngine?.root,
             approverSeat: createRunnerDepsOnAsk(toolApproval),
             approvalExemptionStore,
             ...(runnerDeps.runtimeCapsResolver ? { resolveRuntimeCaps: runnerDeps.runtimeCapsResolver } : {}),

package/dist/boot/stage-08-reapers.d.ts

@@ -48,7 +48,6 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: Runner;
-    handslessSubRunner: Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -95,12 +94,11 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -149,6 +147,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-08-reapers.js

@@ -5,7 +5,7 @@ import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
 export function runStage08(ctx) {
-    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits,
         rateLimiter, costQuota, toolResultStore, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap,
@@ -30,6 +30,7 @@ export function runStage08(ctx) {
             },
             audit: { append: (row) => retentionLaneStore.appendAudit(row, Date.now()) },
             holdInForce: (domain) => retentionLaneStore.holdInForce(domain),
+            ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
             logger,
             metrics,
             now: () => Date.now(),
@@ -56,7 +57,6 @@ export function runStage08(ctx) {
         ["handsless", handslessRunner],
         ["hookAgent", hookAgentRunner],
         ["sub", subRunner],
-        ["handslessSub", handslessSubRunner],
     ];
     const swapRunnerDeps = (next) => {
         for (let i = 0; i < bootRunners.length; i++) {

package/dist/boot/stage-09-leader.d.ts

@@ -77,7 +77,6 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     handslessRunner: import("@sema-agent/core").Runner;
-    handslessSubRunner: import("@sema-agent/core").Runner;
     hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
     hookAgentRunner: import("@sema-agent/core").Runner;
     hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
@@ -124,12 +123,11 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     fenceSessionOwner: (sid: string, owner: string | null) => void;
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
-    noteSessionIncarnation: (sid: string, incarnation: string | undefined) => void;
+    spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
     sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
-    sessionIncarnationOf: (sid: string) => string | undefined;
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionInheritEnv: (sid: string, policy: import("../request-value-closure.js").TaskInheritEnv | undefined) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
@@ -178,6 +176,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     backend: import("../index.js").StoreBackend | undefined;
     backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
     breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    engineDataRoot: string;
     instanceId: string;
     mailboxRecipientLifecycle: import("../plugins/mailbox-recipient-lifecycle.js").MailboxRecipientLifecycle | undefined;
     mailboxStore: import("@sema-agent/core").MailboxStore | undefined;

package/dist/boot/stage-09-leader.js

@@ -6,7 +6,7 @@ import { createLeaderFace } from "./leader.js";
 import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 export function runStage09(ctx) {
-    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
+    const { approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryErasure, governanceSeams, localRoot, logger, mailboxRecipientLifecycle, mailboxStore, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, spaceReclaimer, taskListLane, toolResultStore, tracer, usageWindowStore, userInputLedgerStore, workflowCompletionInbox } = ctx;
     const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
         deviceStore: deviceLane?.store,
         dropSessionScoped,
@@ -15,6 +15,7 @@ export function runStage09(ctx) {
         workflowCompletionInbox, taskListLane, mailboxStore, mailboxRecipientLifecycle,
         backgroundAgentStore,
         userInputLedgerStore,
+        ...(spaceReclaimer !== undefined ? { spaceReclaimer } : {}),
     });
     const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend, tracer, usageWindowStore, promptSource: webAdmin.promptSource, onError: runnerDeps.onError });
     const drainState = { draining: false };