@sema-agent/server 7.131.0 → 7.133.0

package/dist/plugins/breaker-state-sql.d.ts

@@ -6,7 +6,7 @@
  *
  * core's `createCircuitBreakerBrain` defaults to a per-PROCESS Map → on a multi-replica deployment
  * every replica re-discovers a provider outage independently (slow fleet-wide reaction). This backs
- * the breaker with the shared `circuit_breaker` table so a trip on one replica is learned by the others.
+ * the breaker with the shared `breaker_state` table so a trip on one replica is learned by the others.
  *
  * IMPORTANT — `BreakerState.get/set` are **synchronous** (core calls them on the hot path of every
  * brain invocation; a DB round-trip per call is untenable). So this is a **write-through cache**:
@@ -40,7 +40,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool, PoolClient } from "pg";
 import type { BreakerSnapshot, BreakerState } from "@sema-agent/core";
 import { type SqlDriver } from "./sql-driver.js";
-/** PG translation of the tidb-pool.ts `circuit_breaker` DDL (DATETIME(3)→TIMESTAMPTZ(3)). Disjoint from other
+/** PG translation of the tidb-pool.ts `breaker_state` DDL (DATETIME(3)→TIMESTAMPTZ(3)). Disjoint from other
  *  stores' tables, so a self-contained ensureSchema is safe (no central-schema shadowing). TiDB's DDL lives
  *  centrally in tidb-pool.ts (no PG-side twin needed there — production wires ONE ensureTidbSchema). */
 export declare const PG_BREAKER_STATE_SCHEMA: string[];

package/dist/plugins/breaker-state-sql.js

@@ -1,6 +1,6 @@
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 export const PG_BREAKER_STATE_SCHEMA = [
-    `CREATE TABLE IF NOT EXISTS circuit_breaker (
+    `CREATE TABLE IF NOT EXISTS breaker_state (
      breaker_key VARCHAR(190) COLLATE "C"   NOT NULL,
      phase       VARCHAR(16) COLLATE "C"    NOT NULL,
      failures    INTEGER        NOT NULL DEFAULT 0,
@@ -37,8 +37,8 @@ export class SqlBreakerState {
     }
     async writeThrough(key, snap) {
         try {
-            await this.db.query(this.q("INSERT INTO circuit_breaker (breaker_key, phase, failures, opened_at, updated_at) VALUES (?,?,?,?,?) " +
-                "ON DUPLICATE KEY UPDATE phase=VALUES(phase), failures=VALUES(failures), opened_at=VALUES(opened_at), updated_at=VALUES(updated_at)", "INSERT INTO circuit_breaker (breaker_key, phase, failures, opened_at, updated_at) VALUES ($1,$2,$3,$4,$5) " +
+            await this.db.query(this.q("INSERT INTO breaker_state (breaker_key, phase, failures, opened_at, updated_at) VALUES (?,?,?,?,?) " +
+                "ON DUPLICATE KEY UPDATE phase=VALUES(phase), failures=VALUES(failures), opened_at=VALUES(opened_at), updated_at=VALUES(updated_at)", "INSERT INTO breaker_state (breaker_key, phase, failures, opened_at, updated_at) VALUES ($1,$2,$3,$4,$5) " +
                 "ON CONFLICT (breaker_key) DO UPDATE SET phase=EXCLUDED.phase, failures=EXCLUDED.failures, opened_at=EXCLUDED.opened_at, updated_at=EXCLUDED.updated_at"), [key, snap.phase, snap.failures, snap.openedAt != null ? new Date(snap.openedAt) : null, new Date()]);
             this.pending.delete(key);
             if (this.writeFailStreak > 0) {
@@ -60,7 +60,7 @@ export class SqlBreakerState {
         try {
             const pendingAtStart = new Set(this.pending);
             const guarded = (key) => this.pending.has(key) || pendingAtStart.has(key);
-            const { rows } = await this.db.query("SELECT breaker_key, phase, failures, opened_at FROM circuit_breaker");
+            const { rows } = await this.db.query("SELECT breaker_key, phase, failures, opened_at FROM breaker_state");
             const seen = new Set();
             for (const r of rows) {
                 const key = String(r.breaker_key);

package/dist/plugins/caching-session-store.d.ts

@@ -4,6 +4,7 @@ import type { StagingHandle } from "../session-sync-kernel.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import type { InstructionSourceStore } from "../instruction-source-notice.js";
 import type { SessionFaceReader } from "../session-incarnation.js";
+import type { OwnerlessClaim } from "../delegated-session-owner.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
@@ -59,6 +60,8 @@ export declare class CachingSessionStore implements SessionStore {
      *  (缓存的会话活得比「另一只店删掉又重建了这一行」长)。🔴 必须转发:k8s 工作区空间的每 run 读与起服门读的就是本类。 */
     readonly incarnationOf?: SessionStore["incarnationOf"];
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
+    /** S-1770 委派继承律的认领口,纯转发(写的是行上的属主那一格 —— 只 CAS 子行自己,不碰暖缓存里的会话;停驻挂点在默认部署上读的就是本类 —— 与 `placementOf` 同转发同缺:内店记录委派树 ⇒ 两只都在)。 */
+    readonly claimOwnerless?: OwnerlessClaim;
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */
     readonly listSessions?: (opts: {

package/dist/plugins/caching-session-store.js

@@ -10,6 +10,7 @@ export class CachingSessionStore {
     sessionFaceOf;
     incarnationOf;
     register;
+    claimOwnerless;
     listSessions;
     fork;
     deleteSession;
@@ -57,6 +58,8 @@ export class CachingSessionStore {
             this.incarnationOf = inner.incarnationOf.bind(inner);
         if (ownerAware.register)
             this.register = ownerAware.register.bind(inner);
+        if (ownerAware.claimOwnerless)
+            this.claimOwnerless = ownerAware.claimOwnerless.bind(inner);
         if (ownerAware.listSessions)
             this.listSessions = ownerAware.listSessions.bind(inner);
         if (ownerAware.sessionSummaryOf)

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -37,6 +37,14 @@ export declare function tokenFingerprint(token: string): string;
  *  交给它、原样展开)。继承而不是在这里逐键再写一遍:core 给这一臂再加一位同类事实时,改的只有那张 Pick 表。 */
 export interface PendingCheckpoint extends ParkRowFacts {
     sessionId: string;
+    /**
+     * 这道停驻门的**非秘密稳定身份**(core `Checkpoint.checkpointId`,引擎每次停驻铸)—— 三处 durable 读面(本行 = `GET /v1/approvals` 的 `pending[]`
+     * 与 `/v1/approvals/stream` 的 `pending` 帧;停驻收件 `GET /v1/assistant/inbox` 的 `inbox[]`)共用的 **join 键**,也是 409 载体 A
+     * `pendingGate.checkpointId` / `terminal.paused.checkpointId` 的同一个值。**在场就是可信的那一个值,缺席就是缺席**:读法唯一 = `checkpoint-identity.ts` 的
+     * `durableRowIdentity`(过信任边界 —— 不含 token、有界),没有它的行(core 5.42.0 之前停驻的老行 / 没过边界的值)**照列**、键缺席(这一行没有可 join 的身份)、
+     * 每行计一次 `server.approvals.durable-row-checkpoint-id-missing`。两只店各读自己手里的那一份(SQL 孪生读 `checkpoint` 列的成员,LOCAL 孪生读 blob)。
+     */
+    checkpointId?: string;
     scope: string;
     toolName: string | null;
     toolCallId: string | null;
@@ -51,11 +59,12 @@ export interface PendingCheckpoint extends ParkRowFacts {
      *  consumer to treat the key's PRESENCE as "there is a binding" and echo `null` back into /decide. */
     boundCallId?: string;
     boundInputHash?: string;
-    /** 🔴 [ref]③ (additive): the checkpoint's gate kind — the operator queue mixes tool approvals with
+    /** 🔴 [ref]③: the checkpoint's gate kind — the operator queue mixes tool approvals with
      *  plan_review / resource_limit / task_done parks (all of which carry `toolName: null`), so a durable-recovery
-     *  consumer needs this to ROUTE a row to the right wire (`/decide` vs `/plan_review` vs `/resume`). Absent
-     *  only for a legacy SQL row suspended before the `gate_kind` column existed. */
-    gateKind?: CheckpointGate["kind"];
+     *  consumer needs this to ROUTE a row to the right wire (`/decide` vs `/plan_review` vs `/resume`). ALWAYS present
+     *  (S-1681, 7.132.0): every park stamps it, the one-time migration M21 filled any row without it from the row's gate,
+     *  and a SQL row that still carries none is not listed by `listPending` (counted: `server.approvals.queue-row-gate-kind-missing`; no decide route binds it either). */
+    gateKind: CheckpointGate["kind"];
     /** The suspended run's taskId (task_active join) — the key to the run/trace ("view task context"). */
     taskId: string | null;
     /** The pending tool call's args (post-hook), redacted + bounded — for tool_approval the write payload, for a
@@ -278,6 +287,15 @@ export declare function assertCheckpointColumnSchema(query: (sql: string) => Pro
 export declare function boundedRuleOffers(raw: unknown, opts?: {
     countRedactions?: boolean;
 }): RuleOfferProjection[] | undefined;
+/**
+ * S-1681 —— 运维队列行的门型:**两只孪生同一只判官**(SQL 孪生读 `gate_kind` 列 —— put 时从同一只门反范式下来的那一格,每次停驻都盖,一次性迁移 M21 把没有它的
+ * 存量行从门子树补齐;local 孪生读快照上的门 `cp.gate.kind`)。
+ * 读到的值是 NULL / 缺席 / 不是 core 登记的门型 ⇒ `undefined`:这一行**不列**(响亮:计一次 `server.approvals.queue-row-gate-kind-missing`)—— 与每一条决断口同一个读法:
+ * 按门型绑定取行的读口对这种行本来就不命中(`pendingRowQuery` 的 `gate_kind IN (…)`,证不出门型就不当它是这道门),队列不再把一行谁也决不了的行投出去,
+ * 也不按缺键投(消费方按 `gateKind` 路由、缺键即 fail-closed)。不整只拒:一行坏行不许让整个租户的队列(列表 500、SSE 心跳照常而队列永远停在旧帧)消失。
+ * 按构造不可达(写口恒盖、M21 补齐);计数非零 = 写腿或手改出了错,按 `SELECT … WHERE status = 'pending' AND gate_kind IS NULL` 查那一行。
+ */
+export declare function queueRowGateKind(kind: unknown): CheckpointGate["kind"] | undefined;
 /** Redact + size-bound a pending tool call's args for persistence/serving. JSON-roundtrips so the stored shape
  *  matches what the operator queue serves; oversized payloads collapse to a marker rather than bloating the row.
  *  Exported for the LOCAL twin (local-checkpoint-store.ts) so the operator-queue projection can't drift. */
@@ -695,6 +713,12 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      * {@link SqlCheckpointStore.pendingRowQuery};语义与三态全文见 {@link PendingRowBinding} 顶注。
      * `scope` 传 `""`(空串)历史上与缺席同义(旧形 `scope ?` 真值判),这里逐字保留。
      */
+    /**
+     * 每一只**待决** checkpoint 的会话(去重)—— 审批账本留存律的挂靠源(`approval-ask-retention.ts`:待决 checkpoint = 一个还能动的停驻,
+     * 它的会话就是停驻那条腿上问行的 `source_task_id`)。**不按门型过滤**:运维队列 {@link listPending} 不列 `gate_kind` 读不出的行,
+     * 而决断口的令牌回落仍认它 —— 留存若跟着队列漏掉它,就会删掉一只还能被决的停驻的问。只读 `session_id`,不读 blob。
+     */
+    listPendingSessionIds(): Promise<string[]>;
     findPendingTokenBySession(sessionId: string, scope?: string, binding?: PendingRowBinding): Promise<CheckpointToken | null>;
     /**
      * 🔴 [ref] 车5 §9 C4 —— 流内审批对账收敛器判据 1 的**窄读口**(店面承载;收敛器本体不在本车)。

package/dist/plugins/checkpoint-store-sql.js

@@ -1,13 +1,14 @@
 import { parkedApprovalCard, parkedFacetOf } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { APPROVAL_GATE_KINDS_SQL_IN, denySweepOwns } from "../tool-approval.js";
-import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
+import { CheckpointError, isGateKind, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, parkRowFacts, screenUncoveredDetailSeat } from "../approval-card.js";
 import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readJsonArrayColumn, readJsonObjectColumn, readNonNullJsonValueColumn, } from "./sql-json-column.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { durableRowIdentity } from "../checkpoint-identity.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
-import { isDupKeyError, isMissingColumnError } from "./sql-errors.js";
+import { isDupKeyError, isMissingColumnError, rowTooLargeOrSelf } from "./sql-errors.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 const REAP_CLASSIFY_BATCH = 200;
@@ -183,6 +184,18 @@ function readParkRowFactsCell(cell) {
     return parkRowFacts(pendingAction);
 }
 const PARK_ROW_PENDING_ACTION = { key: "pendingAction", as: "pending_action" };
+const PARK_ROW_CHECKPOINT_ID = { key: "checkpointId", as: "checkpoint_id" };
+const readCheckpointIdMemberBody = (body) => (typeof body === "string" ? { value: body } : { problem: "checkpointId is not a JSON string" });
+function readCheckpointIdCell(cell) {
+    try {
+        return decodeNullableJsonColumn(cell, readCheckpointIdMemberBody, "checkpoint.checkpoint $.checkpointId (operator queue row)");
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        return null;
+    }
+}
 const PARK_ROW_GATE = { key: "gate", as: "park_gate" };
 function readParkGateCell(cell) {
     try {
@@ -196,6 +209,12 @@ function readParkGateCell(cell) {
     }
 }
 const readParkGateMemberBody = createObjectColumnReader();
+export function queueRowGateKind(kind) {
+    if (isGateKind(kind))
+        return kind;
+    recordFailOpen("server.approvals.queue-row-gate-kind-missing", `gate_kind=${kind === null || kind === undefined ? "NULL" : redactSecrets(String(kind)).slice(0, 40)}`);
+    return undefined;
+}
 function parkedGateOfRow(r) {
     return { kind: r.gate_kind ?? undefined, approvalCard: readParkGateCell(r[PARK_ROW_GATE.as])?.approvalCard };
 }
@@ -418,7 +437,7 @@ export class SqlCheckpointStore {
             if (this.isDupKey(e)) {
                 throw new CheckpointError("checkpoint.already_exists", `checkpoint token already exists`);
             }
-            throw e;
+            throw rowTooLargeOrSelf(this.db.dialect, e, `the checkpoint row for session ${JSON.stringify(cp.sessionId)}`);
         }
     }
     async get(token) {
@@ -575,38 +594,41 @@ export class SqlCheckpointStore {
     }
     async listPending(scope) {
         const d = this.db.dialect;
-        const base = `SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, ${jsonColumnText(d, "tool_input")}, c.bound_input_hash, ` +
+        const base = `SELECT c.session_id, c.token, c.scope, c.tool_name, c.tool_call_id, ${jsonColumnText(d, "tool_input")}, c.bound_input_hash, ` +
             `${jsonColumnText(d, "risk_descriptor")}, ${jsonColumnText(d, "rule_suggestions")}, c.has_bidi_controls, c.created_at_ms, c.deadline, c.gate_kind, ta.task_id, ` +
-            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_GATE)} ` +
+            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_GATE)}, ${jsonColumnText(d, "checkpoint", PARK_ROW_CHECKPOINT_ID)} ` +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
             : await this.db.query(`${base} ORDER BY c.created_at_ms ASC`);
-        const out = rows.map((r) => {
+        const out = rows.flatMap((r) => {
+            const gateKind = queueRowGateKind(r.gate_kind);
+            if (gateKind === undefined)
+                return [];
             const toolName = r.tool_name ?? null;
             const toolCallId = r.tool_call_id ?? null;
             const boundInputHash = r.bound_input_hash ?? null;
-            const gateKind = r.gate_kind ?? null;
             const ruleOffers = readRuleOffersCell(r.rule_suggestions);
             const approvalCard = parkedApprovalCard(parkedGateOfRow(r));
-            return {
-                sessionId: String(r.session_id),
-                scope: String(r.scope),
-                toolName,
-                toolCallId,
-                ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
-                ...(boundInputHash !== null ? { boundInputHash } : {}),
-                ...(gateKind !== null ? { gateKind } : {}),
-                taskId: r.task_id ?? null,
-                input: refusing("a tool input the operator would be approving unseen", () => decodeToolInputColumn(r.tool_input)) ?? null,
-                createdAt: Number(r.created_at_ms),
-                deadline: r.deadline == null ? null : Number(r.deadline),
-                riskDescriptor: readRiskDescriptorCell(r.risk_descriptor),
-                ...(ruleOffers !== undefined ? { ruleOffers } : {}),
-                ...(Number(r.has_bidi_controls) === 1 ? { hasBidiControls: true } : {}),
-                ...(approvalCard !== undefined ? { approvalCard } : {}),
-                ...readParkRowFactsCell(r[PARK_ROW_PENDING_ACTION.as]),
-            };
+            return [{
+                    sessionId: String(r.session_id),
+                    ...durableRowIdentity("approvals-queue", readCheckpointIdCell(r[PARK_ROW_CHECKPOINT_ID.as]), r.token),
+                    scope: String(r.scope),
+                    toolName,
+                    toolCallId,
+                    ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
+                    ...(boundInputHash !== null ? { boundInputHash } : {}),
+                    gateKind,
+                    taskId: r.task_id ?? null,
+                    input: refusing("a tool input the operator would be approving unseen", () => decodeToolInputColumn(r.tool_input)) ?? null,
+                    createdAt: Number(r.created_at_ms),
+                    deadline: r.deadline == null ? null : Number(r.deadline),
+                    riskDescriptor: readRiskDescriptorCell(r.risk_descriptor),
+                    ...(ruleOffers !== undefined ? { ruleOffers } : {}),
+                    ...(Number(r.has_bidi_controls) === 1 ? { hasBidiControls: true } : {}),
+                    ...(approvalCard !== undefined ? { approvalCard } : {}),
+                    ...readParkRowFactsCell(r[PARK_ROW_PENDING_ACTION.as]),
+                }];
         });
         return out.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
     }
@@ -620,6 +642,10 @@ export class SqlCheckpointStore {
         }
         return out;
     }
+    async listPendingSessionIds() {
+        const { rows } = await this.db.query("SELECT DISTINCT session_id FROM checkpoint WHERE status='pending'", []);
+        return rows.map((r) => String(r.session_id));
+    }
     async findPendingTokenBySession(sessionId, scope, binding) {
         const { sql, params } = this.pendingRowQuery("token", sessionId, scope || undefined, binding);
         const { rows } = await this.db.query(sql, params);
@@ -716,9 +742,14 @@ export class SqlCheckpointStore {
     async putCtx(sessionId, ctx) {
         const text = this.json(ctx, "checkpoint ctx");
         assertJsonColumnWritable(text, createObjectColumnReader(), `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (write leg)`);
-        await this.db.query(this.q("INSERT INTO checkpoint_ctx (session_id, ctx, updated_at_ms) VALUES (?,?,?) " +
-            "ON DUPLICATE KEY UPDATE ctx = VALUES(ctx), updated_at_ms = VALUES(updated_at_ms)", "INSERT INTO checkpoint_ctx (session_id, ctx, updated_at_ms) VALUES ($1,$2::jsonb,$3) " +
-            "ON CONFLICT (session_id) DO UPDATE SET ctx = EXCLUDED.ctx, updated_at_ms = EXCLUDED.updated_at_ms"), [sessionId, text, Date.now()]);
+        try {
+            await this.db.query(this.q("INSERT INTO checkpoint_ctx (session_id, ctx, updated_at_ms) VALUES (?,?,?) " +
+                "ON DUPLICATE KEY UPDATE ctx = VALUES(ctx), updated_at_ms = VALUES(updated_at_ms)", "INSERT INTO checkpoint_ctx (session_id, ctx, updated_at_ms) VALUES ($1,$2::jsonb,$3) " +
+                "ON CONFLICT (session_id) DO UPDATE SET ctx = EXCLUDED.ctx, updated_at_ms = EXCLUDED.updated_at_ms"), [sessionId, text, Date.now()]);
+        }
+        catch (e) {
+            throw rowTooLargeOrSelf(this.db.dialect, e, `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)}`);
+        }
     }
     async getCtx(sessionId) {
         const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "ctx")} FROM checkpoint_ctx WHERE session_id=?`, `SELECT ${jsonColumnText("pg", "ctx")} FROM checkpoint_ctx WHERE session_id=$1`), [sessionId]);

package/dist/plugins/file-history-store-sql.d.ts

@@ -2,6 +2,7 @@ import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type FileHistoryRetentionPolicy, type ExecutionEnv, type FileHistoryStore, type FileHistoryResult, type FileHistoryTrackResult, type FileHistoryRestoreResult, type FileHistoryExport } from "@sema-agent/core";
 import { type BlobBackend } from "./blob-backend.js";
+import type { SyncBlobPutResult } from "./store-backend.js";
 import { type SqlDriver } from "./sql-driver.js";
 /** The file-history blob domain's SQL table (BlobBackend `table`/MinIO index binding + the A7 assert). */
 export declare const FILE_HISTORY_BLOB_TABLE = "file_history_blob";
@@ -147,8 +148,10 @@ export declare class SqlFileHistoryStore implements FileHistoryStore {
      *  Domain-isolated by construction (this store's blob table only — [ref] D1). Reaper-driven. */
     sweepOrphanBlobs(): Promise<number>;
     /** Upload ONE content-addressed blob ahead of an importHistory (§5 streamed negotiation). Store-level
-     *  integrity re-check (the route pre-verifies too — the internal caller might not). Never-throw. */
-    putBlob(hash: string, bytes: Uint8Array): Promise<FileHistoryResult>;
+     *  integrity re-check (the route pre-verifies too — the internal caller might not). Never-throw.
+     *  The SQL blob judge's refusal ({@link BlobTooLargeError}, judged on the connection that would have written the blob)
+     *  keeps its own code — the route answers it 413 (the sentence names that connection's walls), every other write failure 502 ("retry"). */
+    putBlob(hash: string, bytes: Uint8Array): Promise<SyncBlobPutResult>;
     getBlob(hash: string): Promise<Uint8Array | undefined>;
     /** The subset of `hashes` already present — one SQL INDEX probe (the import presence pre-check). */
     hasBlobs(hashes: string[]): Promise<Set<string>>;

package/dist/plugins/file-history-store-sql.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { captureFileBackupViaEnv, applyFileRestoreViaEnv, fileHistoryModeProvenDifferent, worldStillMatchesMint, boundaryPublishVerdict, fileHistoryDescribeTrackKey, fileHistoryTrackKeyOf, fileHistoryResolveTrackKey, fileHistoryExportDigest, validateFileHistoryExport, resolveFileHistoryRetention, fileHistoryBoundariesToKeep, } from "@sema-agent/core";
-import { SqlBlobBackend } from "./blob-backend.js";
+import { BlobTooLargeError, SqlBlobBackend } from "./blob-backend.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -594,6 +594,8 @@ export class SqlFileHistoryStore {
             return { ok: true };
         }
         catch (err) {
+            if (err instanceof BlobTooLargeError)
+                return { ok: false, error: { code: err.code, message: err.message, wallSource: err.cap.source } };
             return { ok: false, error: { code: "snapshot_failed", message: `putBlob ${hash} write/upload failed: ${discloseCaughtFailure(err)}` } };
         }
     }

package/dist/plugins/file-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { StoreBootRefusalError, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { StoreBootRefusalError, type FenceLanded, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
@@ -22,7 +22,7 @@ import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState }
 export declare class RunStoreStrictHydrateError extends StoreBootRefusalError {
     readonly name = "RunStoreStrictHydrateError";
 }
-export declare class FileRunStore {
+export declare class FileRunStore implements InProcessClaimFence {
     private readonly runsDir;
     private readonly activeDir;
     private readonly tmpDir;
@@ -148,6 +148,8 @@ export declare class FileRunStore {
      *  [ref](codex R1 [medium]):认领 = 接管 `instanceId`(= 当前持有副本;SQL 孪生同注)。CAS 输不改。 */
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
+    /** 认领当写栅栏用(契约 = `store-contracts.ts` 的 `InProcessClaimFence`):判、刷新活性(同步落盘)与 `write` 是同一个同步段。 */
+    whileHoldingClaim(sessionId: string, taskId: string, write: () => FenceLanded): boolean;
     getRun(taskId: string): Promise<RunRecord | undefined>;
     /** Undo THIS submission's binding (key + body fingerprint → null) — called only where the submit surface refuses the submission
      *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, a device-placement reject):
@@ -161,17 +163,7 @@ export declare class FileRunStore {
     /** The run a submission's scoped `Idempotency-Key` names (the file twin of `uq_task_run_idem`), if any. */
     getRunByIdem(idemKey: string): Promise<RunRecord | undefined>;
     /** Runs newest-first, keyset on (createdAt, taskId) DESC; optional exact-match filters (owner is exact, like the SQL). */
-    listRuns(opts: {
-        status?: string;
-        jobId?: string;
-        source?: string;
-        owner?: string;
-        cursor?: {
-            createdAt: string;
-            taskId: string;
-        };
-        limit: number;
-    }): Promise<RunRecord[]>;
+    listRuns(opts: RunListQuery): Promise<RunRecord[]>;
     /**
      * S-297 —— 这个会话**最近一条腿**的窄指针({@link SqlRunStore.latestRunForSession} 的孪生:同一个排序口径
      *  `createdAt DESC, taskId DESC`,与本店 {@link FileRunStore.listSessions} 挑 `rn=1` 那一行的比较器逐字同一份)。

package/dist/plugins/file-run-store.js

@@ -525,6 +525,15 @@ export class FileRunStore {
     async getActiveTaskId(sessionId) {
         return this.active.get(sessionId);
     }
+    whileHoldingClaim(sessionId, taskId, write) {
+        const r = this.runs.get(taskId);
+        if (this.active.get(sessionId) !== taskId || r === undefined || r.status !== "running")
+            return false;
+        r.updatedAt = new Date();
+        this.persist(r);
+        write();
+        return true;
+    }
     async getRun(taskId) {
         const r = this.runs.get(taskId);
         return r ? this.toRecord(r) : undefined;

package/dist/plugins/fork-routing-session-store.d.ts

@@ -24,6 +24,7 @@
  * (requireExisting 的 host-first 重试仍落对店),中途 touch/noteTaskRun 缺路由=落 transient(no-op 级)。
  */
 import { type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
+import { type DelegationTree } from "../delegated-session-owner.js";
 /** acquire 选项形(core 5.48 SessionStore 契约):[ref] placement=受信 spawner 的分区建会话声明。 */
 type AcquireOpts = {
     requireExisting?: boolean;
@@ -85,8 +86,15 @@ export declare class ForkRoutingSessionStore implements SessionStore {
      *     unpin 不落错店)。
      *
      * 已在 host(路由或真行)⇒ 幂等直返。两店都无此会话 ⇒ 抛(调用方=park veto,诚实 fail-closed)。
+     *
+     * S-1770:宿主行**在建行那一笔里**带属主 `owner` —— 调用方按委派继承律算好(`delegated-session-owner.ts`:委派树根的属主,
+     * 推不出 ⇒ 孤行哨兵;`tree` = 判据读到的委派树,判断用:宿主行记着别的树 ⇒ 拒),这里经宿主店的首写登记写下、再按律定夺(core `register` 契约:登记不判授权,判在复读)。
+     * 宿主店里同 id 已有一行:记着这一棵委派树且无主 ⇒ 按同一条律认领(只有记录委派树的店);别的树的 / 属主不是它(别人先认领的空壳,或 local 店的无主空壳)⇒ 抛(停驻否决),
+     * 转录不拷进别人的行;宿主店记不了 / 读不回属主 ⇒ 同样抛 —— 晋升出一只无主的转录行就是把它交给任何拿到 id 的人。
      */
-    promoteToHost(sessionId: string): Promise<void>;
+    promoteToHost(sessionId: string, owner: string | null, tree: DelegationTree): Promise<void>;
+    /** 晋升的建行那一笔(S-1770,规则见 {@link promoteToHost} 头注):宿主店首写登记 `owner`,然后按律定下宿主行的属主(与停驻快路同一只 `settleDelegatedOwner`)。 */
+    private registerPromotedOwner;
     fork(sourceId: string, owner?: string | null): Promise<string | null>;
     get size(): number;
     dispose(): void | Promise<void>;

package/dist/plugins/fork-routing-session-store.js

@@ -1,5 +1,6 @@
 import { SessionError } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { delegatedOwnerHostOf, settleDelegatedOwner } from "../delegated-session-owner.js";
 const ROUTE_MAX = 8192;
 export class ForkRoutingSessionStore {
     host;
@@ -170,7 +171,7 @@ export class ForkRoutingSessionStore {
     list() {
         return this.transient.list?.() ?? Promise.resolve([]);
     }
-    async promoteToHost(sessionId) {
+    async promoteToHost(sessionId, owner, tree) {
         if (this.promoted.has(sessionId))
             return;
         if (this.route.get(sessionId) === "host") {
@@ -190,6 +191,7 @@ export class ForkRoutingSessionStore {
         }
         const entries = await src.session.getEntries();
         const leaf = await src.session.getLeafId();
+        await this.registerPromotedOwner(sessionId, owner, tree);
         const dst = await this.host.acquire(sessionId);
         try {
             const storage = dst.session.getStorage();
@@ -217,6 +219,15 @@ export class ForkRoutingSessionStore {
         this.promoted.add(sessionId);
         this.remember(sessionId, "host");
     }
+    async registerPromotedOwner(sessionId, owner, tree) {
+        const register = this.host.register;
+        const host = delegatedOwnerHostOf(this.host);
+        if (register === undefined || host === undefined) {
+            throw new Error(`session "${sessionId}" cannot be promoted: the host session store cannot record or read back a session owner (register / ownerOf / sessionFaceOf; placementOf and claimOwnerless together or neither), so the promoted transcript would land ownerless`);
+        }
+        await register.call(this.host, sessionId, owner);
+        await settleDelegatedOwner(host, sessionId, owner, tree);
+    }
     async fork(sourceId, owner) {
         const routed = this.route.get(sourceId);
         const tryFork = async (store, where) => {

package/dist/plugins/host-platform.d.ts

@@ -34,6 +34,8 @@
 import type { ChildProcess } from "node:child_process";
 import { killProcessTree, type BackgroundHardKillOutcome } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
+/** 平台读点全仓一处(`test/host-shell-settle-order.test.ts` 源码钉);别处要平台串从这里取,不直读 Node 的平台字段。 */
+export declare const HOST_PLATFORM: NodeJS.Platform;
 export declare const IS_WIN32: boolean;
 export interface HostShell {
     shell: string;

package/dist/plugins/host-platform.js

@@ -1,7 +1,8 @@
 import os from "node:os";
 import { getShellConfig, killProcessTree, signalProcessTree } from "@sema-agent/core";
 import { redactSecrets } from "../trace/redact.js";
-export const IS_WIN32 = process.platform === "win32";
+export const HOST_PLATFORM = process.platform;
+export const IS_WIN32 = HOST_PLATFORM === "win32";
 const POSIX_SH_FALLBACK = { shell: "/bin/sh", args: ["-c"] };
 let cachedPosixShell;
 let winShellState = { kind: "unsettled" };

package/dist/plugins/k8s-bg-scripts.d.ts

@@ -1,3 +1,14 @@
+/** The longest the kill script itself may take beyond one control-plane wall: its re-check rounds (4 pauses of one second, plus slack). */
+export declare const KILL_ALL_RECHECK_MS = 5000;
+/**
+ * The pod-side "end all work" script: SIGKILL every LIVE process of the pod except pid 1, the container's keeper (`sleep infinity` — as pid 1, or as the child
+ * of the `sh` that is pid 1 when the pod's start command runs a hook first: killing it would end the container and with it the exec the snapshot needs) and this
+ * script's own shell — what a run-end snapshot needs of a command still running when its run is over (the pod is deleted right after; killing the exec socket would
+ * not stop the process, see the adapter's header). Exits 0 only when nothing it should have killed is alive any more: a killed process is re-checked (up to 5 rounds,
+ * one second apart, only while something is still alive) by its `State:` line — a zombie (`Z`, which a pid-1 `sleep` never reaps) is dead; a process that outlives the
+ * rounds makes the script exit 1, so the caller never reads a silent kill failure as a still tree. `procDir` is `/proc` (a test points it at a fake tree).
+ */
+export declare function buildKillAllScript(procDir?: string): string;
 /** The detached runner (base64'd into the pod, run under `setsid`). Self-reports pgid; streams output to out/err. */
 export declare function buildBgRunnerScript(dir: string): string;
 /** Short foreground launcher: writes cmd.sh + runner.sh, then `setsid`s the runner detached and returns immediately. */

package/dist/plugins/k8s-bg-scripts.js

@@ -1,4 +1,26 @@
 import { shellQuote } from "./remote-shell.js";
+export const KILL_ALL_RECHECK_MS = 5_000;
+export function buildKillAllScript(procDir = "/proc") {
+    return [
+        'alive() { st=; while read -r k v; do [ "$k" = "State:" ] && st=${v%% *}; done 2>/dev/null < "$1/status"; [ -n "$st" ] && [ "$st" != Z ] && [ "$st" != X ]; }',
+        `keeper() { [ "$(tr '\\0' ' ' 2>/dev/null < "$1/cmdline")" = "sleep infinity " ]; }`,
+        'spare() { pid=${1##*/}; [ "$pid" = 1 ] || [ "$pid" = "$$" ] || keeper "$1"; }',
+        "round=0",
+        "while :; do",
+        "left=0",
+        `for p in ${shellQuote(procDir)}/[0-9]*; do`,
+        'spare "$p" && continue',
+        'alive "$p" || continue',
+        "left=1",
+        'kill -9 "${p##*/}" 2>/dev/null',
+        "done",
+        '[ "$left" = 0 ] && exit 0',
+        "round=$((round + 1))",
+        '[ "$round" -ge 5 ] && exit 1',
+        "sleep 1",
+        "done",
+    ].join("\n");
+}
 export function buildBgRunnerScript(dir) {
     const q = (name) => shellQuote(`${dir}/${name}`);
     return [

package/dist/plugins/local-checkpoint-store.d.ts

@@ -98,6 +98,8 @@ export declare class LocalCheckpointStore {
     /** All still-pending checkpoints across the registered scopes (summary + full row via get). */
     private pendings;
     /** Operator approval queue — the same NON-secret card as the SQL twins (never the token). */
+    /** 每一只待决 checkpoint 的会话(去重;不按门型过滤 —— 理由与 SQL 孪生 `listPendingSessionIds` 逐字同,见那里)。 */
+    listPendingSessionIds(): Promise<string[]>;
     listPending(scope?: string): Promise<PendingCheckpoint[]>;
     /**
      * [ref]:与 SQL 孪生**同判**的 session 键读口 —— `binding.gateKinds` 过滤门型、序恒「最新优先,token 兜平局」

package/dist/plugins/local-checkpoint-store.js

@@ -1,12 +1,13 @@
 import { z } from "zod";
 import { parkedApprovalCard } from "../approval-content-kind.js";
 import { parkRowFacts } from "../approval-card.js";
+import { durableRowIdentity } from "../checkpoint-identity.js";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { denySweepOwns } from "../tool-approval.js";
 import { FileCheckpointStore, atomicWriteFile, executionVerdict, sanitizePathComponent, } from "@sema-agent/core";
-import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingActionToolCallId, pendingRowPrecedes, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
+import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingActionToolCallId, pendingRowPrecedes, queueRowGateKind, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
 import { createZodColumnReader, decodeJsonColumn, foldJsonColumn, readStringArrayColumn } from "./sql-json-column.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
@@ -160,20 +161,27 @@ export class LocalCheckpointStore {
         }
         return out;
     }
+    async listPendingSessionIds() {
+        return [...new Set((await this.pendings()).map(({ cp }) => cp.sessionId))];
+    }
     async listPending(scope) {
         const rows = [];
-        for (const { cp } of await this.pendings(scope)) {
+        for (const { token, cp } of await this.pendings(scope)) {
             const pa = cp.pendingAction;
             const gate = cp.gate;
+            const gateKind = queueRowGateKind(gate?.kind);
+            if (gateKind === undefined)
+                continue;
             const toolCallId = pa?.toolCallId ?? null;
             rows.push({
                 sessionId: cp.sessionId,
+                ...durableRowIdentity("approvals-queue", cp.checkpointId, token),
                 scope: cp.scope,
                 toolName: pa?.toolName ?? null,
                 toolCallId,
                 ...(toolCallId !== null ? { boundCallId: toolCallId } : {}),
                 ...(pa?.boundInputHash !== undefined ? { boundInputHash: pa.boundInputHash } : {}),
-                ...(gate?.kind !== undefined ? { gateKind: gate.kind } : {}),
+                gateKind,
                 taskId: (await this.opts.getActiveTaskId?.(cp.sessionId)) ?? null,
                 input: boundedToolInput(pa?.args),
                 createdAt: cp.createdAt,

package/dist/plugins/local-session-store.d.ts

@@ -7,7 +7,7 @@ import { type InstructionSourceBaseline } from "../instruction-source-notice.js"
 import { type StagingHandle, type SyncRelation } from "../session-sync-kernel.js";
 /**
  * local 车道会话存档的**唯一 repo 出口**:本仓里每一只读 `<root>/sessions/*.jsonl` 的 `FileSessionRepo` 都从这里取(`LocalSessionStore` 的底座与会话视图口
- * `audit.ts#buildSessionAuditLocal` 的读旁路),所以坏记录的披露座只有这一份接线 —— 修前视图口自建一只不带座的 repo,同一份坏档在这里读到有计数 / 探针,
+ * 窗口 `local-session-window.ts#LocalSessionWindow.wake` 的读旁路),所以坏记录的披露座只有这一份接线 —— 修前视图口自建一只不带座的 repo,同一份坏档在这里读到有计数 / 探针,
  * 在视图口读到一个字都没有。座 = F 类 `server.session-repo.corrupt-record-skipped`(会话存档里读不出的记录丢的是可用性:历史少一截 / 列表少一行,不开任何门;
  * 计数单位 = 一条被跳过的记录,逐命中探针行,warn 每进程一次),外加会话打开作用域的计数腿(`noteReplayInSessionOpenScope`:只在 `openSessionForItself`
  * 的作用域里才记,作用域外 —— 列表 / 导出 / 视图口 —— 是空操作,那些读只进运维面)。

package/dist/plugins/local-session-store.js

@@ -642,7 +642,7 @@ export class LocalSessionStore {
         const current = await this.metaOf(sessionId);
         const prior = current === undefined ? undefined : { owner: current.owner ?? null, incarnation: current.incarnation };
         await this.deleteSessionHeld(sessionId, owner);
-        await this.importEntriesAs(sessionId, owner, entries, carriedIncarnation(prior, owner));
+        await this.importEntriesAs(sessionId, owner, entries, carriedIncarnation(sessionId, prior, owner));
     }
     beginImportStaging(realSessionId, token) {
         const h = new LocalStagingHandle(this, realSessionId, stagingIdFor(realSessionId, token));