@sema-agent/server 7.132.0 → 7.134.0

package/dist/panel-tool-names.js

@@ -0,0 +1,8 @@
+export const PANEL_MAX_TOOL_NAMES = 200;
+export function buildBoundedToolNames(names) {
+    return {
+        toolNames: names.slice(0, PANEL_MAX_TOOL_NAMES),
+        ...(names.length > PANEL_MAX_TOOL_NAMES ? { toolNamesTruncated: true } : {}),
+    };
+}
+//# sourceMappingURL=panel-tool-names.js.map

package/dist/parked-decide.d.ts

@@ -9,10 +9,12 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
-import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, QuestionAnswer, ResumeOutcome, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
+import type { DecideBinding } from "./http/wire-types.js";
+import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, CheckpointToken, QuestionAnswer, RunInternals, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
+import type { WorkflowParkDecisionStore, WorkflowParkOutcome } from "./orchestration/workflow-park-decision.js";
 import { type SessionFaceReader } from "./session-incarnation.js";
 export interface ParkedAgentMatch {
     handle: string;
@@ -90,6 +92,36 @@ export declare function findParkOrigin(sources: ParkOriginSources, cp: {
     scope: string;
     sessionId: string;
 }): Promise<ParkOrigin | undefined>;
+/** 起跑读者的源(就是 `ServiceDeps` 上那几只;任一缺席 ⇒ 这台部署没有这条车道,读者只交回调用方自己带的那一份)。 */
+export interface HeldWorkflowParkDecisionSources {
+    readonly workflowParkDecisions?: WorkflowParkDecisionStore;
+    readonly checkpointStore?: {
+        get(token: CheckpointToken): Promise<{
+            readonly status: string;
+            readonly scope: string;
+            readonly sessionId: string;
+        } | null>;
+    };
+    readonly workflowAgentSessionIndex?: WorkflowAgentSessionIndex;
+    readonly workflowRunStore?: Pick<WorkflowRunStore, "get">;
+}
+/** `RunInternals.workflowParkedResume` 的一条(形直接取 core 的那一位)。 */
+type ParkedResumeEntry = NonNullable<RunInternals["workflowParkedResume"]>[number];
+/**
+ * 🔴 **决定进引擎的唯一读者** —— 每一只起跑器(durable run 腿、续跑腿流形与 verify 形、同步流腿、同步 JSON 腿)开跑之前调一次,
+ * 产物原样摊进那一跑的 `RunInternals`(部署方铸的 TRUSTED internals:不是 `TaskSpec` 字段、不是工具参数 —— 模型永远不能自己决定一次审批)。
+ *
+ * 产物 = 调用方自己带的那一份(`carried`:`/decide` 的投递跑带着它刚受理、行还没落的那条决定)∪ 这个会话的决定行(律与寿命的属主 =
+ * `orchestration/workflow-park-decision.ts` 文件头),同一张卡以 `carried` 为准(它是要取代行上旧决定的那一个)。行这一侧逐条:
+ *  · 子代卡此刻**仍 pending** 才供:读回 `null` / 状态不是 `pending` ⇒ 不供(引擎对「记着停驻、卡却已不 pending」的序数,有条目 ⇒ 当确认
+ *    结算、没条目 ⇒ 拒续跑 —— 供一条过期条目会把后者改成前者);读卡抛 ⇒ 不供并计 `server.workflow-park-decision.card-unreadable`
+ *    (这一读失败不代表引擎随后的那一读也失败;不供的方向是这一跑不带它、行留着给下一跑 —— 绝不把它变成一次确认);
+ *  · 投递目标 = 这张卡**当下**的持有者 run(`findParkOrigin`,与 `/decide` 路由同一只判官):持有者判不出唯一一条(分叉 / 证不了 / 卡
+ *    已在新 token 下再停)⇒ 不供(引擎只把条目交给 `resumeFromRunId` 恰是持有者的续跑;没有唯一持有者就没有可交付的那一跑)。
+ * 决定店读抛(local 账本闸合上 / SQL 一行坏体)⇒ 与读卡失败同律:这一店当「没有可供的行」,只交回 `carried`,计 `server.workflow-park-decision.store-unreadable`
+ * (不跳过坏行照供其余:读不出的那一行可能正是取代了旧决定的那一笔;不拒起跑:不供是安全方向,卡仍 pending、可再决)。决定的写口照旧由店闸住。
+ */
+export declare function heldWorkflowParkDecisions(sources: HeldWorkflowParkDecisionSources, hostSessionId: string, carried?: readonly ParkedResumeEntry[]): Promise<Pick<RunInternals, "workflowParkedResume">>;
 /**
  * pending checkpoint → parked bg 行匹配。
  *
@@ -173,11 +205,7 @@ export interface ParkedDecideRequest {
     reason?: string;
     /** D-1 decision-binding echo(操作员在 GET 看到的 boundCallId/boundInputHash 原样透传;server
      *  绝不重算,core resume 侧做 fail-closed 等值校验——与 legacy 腿同姿势)。 */
-    binding?: {
-        boundCallId?: string;
-        boundInputHash?: string;
-        updatedInput?: unknown;
-    };
+    binding?: Omit<DecideBinding, "checkpointToken">;
     /** body 带了 `remember:"session"` 时路由传入的 grant 执行器([ref] 候裁② 的 server 侧修,经两轮
      *  行为探针实证):豁免必须锚在**行的 root/host 会话 id**——部署侧三个豁免探针(policy 层/fs-write
      *  门/workflow 门)的闭包统一捕获 host 会话键且签名不携身份(1.393 seam 亲读:`sourceTaskId` 只在
@@ -216,8 +244,10 @@ export interface ParkedDecideResult {
  * · `hostDecision` = 结算**事实**逐字上 outcome;`gateOutcome` 一格 server **永不**填(core 对宿主
  *   自铸的结算词是 pre-CAS 响亮拒)。
  * · `answer` 原样透传([ref]:header 逐字匹配等语义校验全在 core,server 不预判)。
+ * · `feedback`(core 7.54.0):绑定里有就原样上 outcome —— 决定口只在人的放行上收它(拒决 / 策略的决定上带它是门口 400),本铸点不再按判词剪
+ *   (剪 = 静默丢一段人写的话;门口已拒的形到不了这里,引擎在 claim 前再判一次);什么算写了字(空白读作没写)是引擎的读法,本铸点不 trim。
  */
-export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): ResumeOutcome;
+export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): WorkflowParkOutcome;
 /**
  * S-185 车CM —— **第三条车道的计划**(纯函数;驱动本身归 resume 家族的那条腿,见下方「为什么不自建驱动」)。
  *
@@ -234,12 +264,13 @@ export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): Resu
  *    decided, the deployment resumes this run (resumeFromRunId: …)」。
  * ⇒ 第三条车道 = **把决定挂在宿主会话的下一跑上**,而那一跑必须走 resume 家族**既有**的那条腿
  * (`notify-wake.ts` 的成文纪律:wake 会烧模型,所以复用 `ctx.legs.resumeWake`,「而不是在本域自建第二条
- * 驱动路径」)。本函数因此只出**计划**:宿主会话 + 要注入的消息 + 要随 internals 走的那一条决定。
+ * 驱动路径」)。本函数因此只出**计划**:宿主会话 + 要注入的消息 + 要落成决定行的那一条决定(调用方受理时落行,宿主会话的每一跑
+ * 开跑前经那一只读者把它放进 internals)。
  *
  * ## 诚实边界(登记,不假装没有)
  * · **模型中介**:决定送达宿主之后,真正的赎回发生在宿主再调一次 `Workflow({resumeFromRunId})` 时。
- *   core 的 park 回执逐字告诉模型这件事,但它不是一条确定性的机器腿。宿主没照做 ⇒ 卡仍 pending、
- *   人可再决(**不会**静默吃掉批准)。
+ *   core 的 park 回执逐字告诉模型这件事,但它不是一条确定性的机器腿。宿主没照做 ⇒ 卡仍 pending、决定行还在:
+ *   宿主会话的下一跑(谁起的都算)照带它,同一个决定重投再触发一次投递(**不会**静默吃掉批准)。
  * · **`inheritedGate` 不供**:那是「跨进程重供 checkpoint 的父约束」的席位,而 wa* 行不带父约束链;
  *   同进程时 core 的内存 registry 自动重供,跨进程且该 cp 带 `requiresParentConstraint` 时 core 响亮拒
  *   (`resume.parent_constraint_missing`)⇒ 该 ordinal 再 park 一次,不会 fail-open。
@@ -257,7 +288,7 @@ export type WorkflowParkedDecidePlan = {
     hostSessionId: string;
     runId: string;
     message: string;
-    outcome: ResumeOutcome;
+    outcome: WorkflowParkOutcome;
 } | {
     ok: false;
     deny: ParkedDecideResult;
@@ -311,4 +342,5 @@ export declare function planWorkflowParkedDecide(origin: Extract<ParkOrigin, {
  * re-park 诚实可见,操作员可再决。
  */
 export declare function decideParkedAgent(deps: ParkedDecideDeps, req: ParkedDecideRequest, match: ParkedAgentMatch): Promise<ParkedDecideResult>;
+export {};
 //# sourceMappingURL=parked-decide.d.ts.map

package/dist/parked-decide.js

@@ -1,9 +1,11 @@
 import { readClosedWordSeat } from "./approval-card.js";
 import { routeWorkflowPark } from "./orchestration/workflow-agent-session-index.js";
+import { recordFailOpen } from "./observability/fail-open.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
-import { backgroundScopesForCheckpointScope, decodeCheckpointScope } from "./security.js";
+import { backgroundScopesForCheckpointScope, decodeCheckpointScope, ownerOfCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { sameSessionOccupant } from "./session-incarnation.js";
+import { refusalBody, resumeRefusalFacts } from "./http/refusal-body.js";
 export async function findParkOrigin(sources, cp) {
     if (sources.agentStore !== undefined) {
         let match;
@@ -51,6 +53,33 @@ export async function findParkOrigin(sources, cp) {
         return undefined;
     }
 }
+export async function heldWorkflowParkDecisions(sources, hostSessionId, carried) {
+    const entries = [...(carried ?? [])];
+    const { workflowParkDecisions: decisions, checkpointStore: cs, workflowAgentSessionIndex: workflowIndex, workflowRunStore } = sources;
+    if (decisions !== undefined && cs !== undefined && workflowIndex !== undefined && workflowRunStore !== undefined) {
+        const own = new Set(entries.map((e) => String(e.token)));
+        const held = await decisions.listByHostSession(hostSessionId).then((rows) => ({ rows }), (err) => ({ err }));
+        if ("err" in held) {
+            recordFailOpen("server.workflow-park-decision.store-unreadable", `hostSessionId=${hostSessionId} err=${held.err instanceof Error ? held.err.message : String(held.err)}`);
+            return entries.length > 0 ? { workflowParkedResume: entries } : {};
+        }
+        for (const row of held.rows) {
+            if (own.has(String(row.token)))
+                continue;
+            const card = await cs.get(row.token).then((cp) => ({ cp }), (err) => ({ err }));
+            if ("err" in card) {
+                recordFailOpen("server.workflow-park-decision.card-unreadable", `runId=${row.runId} err=${card.err instanceof Error ? card.err.message : String(card.err)}`);
+                continue;
+            }
+            if (card.cp === null || card.cp.status !== "pending")
+                continue;
+            const origin = await findParkOrigin({ workflowIndex, workflowRunStore }, { token: row.token, scope: card.cp.scope, sessionId: card.cp.sessionId });
+            if (origin?.kind === "workflow")
+                entries.push({ runId: origin.runId, token: row.token, outcome: row.outcome });
+        }
+    }
+    return entries.length > 0 ? { workflowParkedResume: entries } : {};
+}
 function quiet(warn, event, fields) {
     try {
         warn?.(event, fields);
@@ -96,6 +125,7 @@ export function buildParkedResumeOutcome(req) {
         boundInputHash: req.binding?.boundInputHash ?? persistedHash,
         decision: req.decision === "approve" ? "allow" : "deny",
         ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        ...(req.binding?.feedback !== undefined ? { feedback: req.binding.feedback } : {}),
         ...(req.answer !== undefined ? { answer: req.answer } : {}),
         ...(req.reason !== undefined ? { reason: req.reason } : {}),
         hostDecision: req.hostDecision,
@@ -106,21 +136,25 @@ export function denyWorkflowParksUnreadable(origin) {
         case "older_engine":
             return {
                 status: 409,
-                body: {
-                    error: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+                body: refusalBody({
                     errorCode: "decide.workflow_parks_unreadable",
-                    runId: origin.runId,
-                },
+                    message: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
+                    facts: {
+                        runId: origin.runId,
+                    },
+                }),
             };
         case "unreadable":
             return {
                 status: 409,
-                body: {
-                    error: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+                body: refusalBody({
                     errorCode: "decide.workflow_parks_unreadable",
-                    runId: origin.runId,
-                    ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
-                },
+                    message: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+                    facts: {
+                        runId: origin.runId,
+                        ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
+                    },
+                }),
             };
         default: {
             const unhandled = origin.cause;
@@ -131,11 +165,13 @@ export function denyWorkflowParksUnreadable(origin) {
 export function denyWorkflowParkForked(origin) {
     return {
         status: 409,
-        body: {
-            error: "this decision cannot be delivered: the same run was resumed more than once and every resumed copy listed in runIds is waiting on this same step, so there is no single run to hand the decision to. Nothing was delivered and the approval card stays pending. Resume one of the runs listed in runIds; once that run is waiting on this step again, deciding here works normally",
+        body: refusalBody({
             errorCode: "decide.workflow_park_forked",
-            runIds: [...origin.runIds],
-        },
+            message: "this decision cannot be delivered: the same run was resumed more than once and every resumed copy listed in runIds is waiting on this same step, so there is no single run to hand the decision to. Nothing was delivered and the approval card stays pending. Resume one of the runs listed in runIds; once that run is waiting on this step again, deciding here works normally",
+            facts: {
+                runIds: [...origin.runIds],
+            },
+        }),
     };
 }
 export function planWorkflowParkedDecide(origin, req) {
@@ -144,11 +180,13 @@ export function planWorkflowParkedDecide(origin, req) {
             ok: false,
             deny: {
                 status: 400,
-                body: {
-                    error: "remember:\"session\" is not supported for this approval: accepting it here only means the decision was handed on for delivery, not that the engine has applied it — an exemption granted now could outlive a decision the engine later rejects. Re-issue the decide without `remember`; the decision itself is accepted normally that way.",
+                body: refusalBody({
                     errorCode: "decide.workflow_remember_unsupported",
-                    runId: origin.runId,
-                },
+                    message: "remember:\"session\" is not supported for this approval: accepting it here only means the decision was handed on for delivery, not that the engine has applied it — an exemption granted now could outlive a decision the engine later rejects. Re-issue the decide without `remember`; the decision itself is accepted normally that way.",
+                    facts: {
+                        runId: origin.runId,
+                    },
+                }),
             },
         };
     }
@@ -158,11 +196,13 @@ export function planWorkflowParkedDecide(origin, req) {
             ok: false,
             deny: {
                 status: 409,
-                body: {
-                    error: "this run was started on its own rather than from a session, so this deployment has nowhere to deliver the decision. Nothing was decided and the approval is still pending — resume the run yourself with the runId below and decide it there",
+                body: refusalBody({
                     errorCode: "decide.workflow_host_unknown",
-                    runId: origin.runId,
-                },
+                    message: "this run was started on its own rather than from a session, so this deployment has nowhere to deliver the decision. Nothing was decided and the approval is still pending — resume the run yourself with the runId below and decide it there",
+                    facts: {
+                        runId: origin.runId,
+                    },
+                }),
             },
         };
     }
@@ -181,29 +221,31 @@ export function planWorkflowParkedDecide(origin, req) {
 function sessionGone(taskId) {
     return {
         status: 409,
-        body: {
-            error: "the session this agent belongs to was deleted (or deleted and started again under the same id) while its approval waited, so the approval no longer applies — nothing was resumed",
+        body: refusalBody({
             errorCode: "decide.not_parked",
-            taskId,
-        },
+            message: "the session this agent belongs to was deleted (or deleted and started again under the same id) while its approval waited, so the approval no longer applies — nothing was resumed",
+            facts: {
+                taskId,
+            },
+        }),
     };
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
     const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
     if (req.grantRemember !== undefined && rememberRoot === undefined) {
-        return { status: 400, body: { error: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", errorCode: "decide.parked_remember_unsupported", taskId: match.handle } };
+        return { status: 400, body: refusalBody({ errorCode: "decide.parked_remember_unsupported", message: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", facts: { taskId: match.handle } }) };
     }
     const pendingTool = req.pendingAction?.toolName;
     if (pendingTool === ASK_USER_QUESTION_TOOL_NAME && req.decision === "approve" && req.answer === undefined) {
-        return { status: 400, body: { error: "pending action is AskUserQuestion — approve requires body.answer (the operator's answers[]); deny needs none", errorCode: "decide.parked_answer_required", taskId: match.handle } };
+        return { status: 400, body: refusalBody({ errorCode: "decide.parked_answer_required", message: "pending action is AskUserQuestion — approve requires body.answer (the operator's answers[]); deny needs none", facts: { taskId: match.handle } }) };
     }
     if (row.name === undefined) {
-        return { status: 409, body: { error: "parked row carries no agent name — the revive path requires a named agent (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
+        return { status: 409, body: refusalBody({ errorCode: "decide.row_unrevivable", message: "parked row carries no agent name — the revive path requires a named agent (row damaged?)", facts: { taskId: match.handle } }) };
     }
     const root = row.rootSessionId;
     if (root === undefined) {
-        return { status: 409, body: { error: "this agent's row carries no root session anchor — the revive path cannot tell which session this approval belongs to (row damaged?)", errorCode: "decide.row_unrevivable", taskId: match.handle } };
+        return { status: 409, body: refusalBody({ errorCode: "decide.row_unrevivable", message: "this agent's row carries no root session anchor — the revive path cannot tell which session this approval belongs to (row damaged?)", facts: { taskId: match.handle } }) };
     }
     const faceBefore = await deps.sessionFaceOf(root);
     if (faceBefore === undefined)
@@ -214,14 +256,14 @@ export async function decideParkedAgent(deps, req, match) {
     if (!claim.ok) {
         switch (claim.reason) {
             case "store_unreachable":
-                return { status: 503, body: { error: "the durable agent store is unreachable — retry", errorCode: "decide.store_unreachable", taskId: match.handle } };
+                return { status: 503, body: refusalBody({ errorCode: "decide.store_unreachable", message: "the durable agent store is unreachable — retry", facts: { taskId: match.handle } }) };
             case "claim_lost":
-                return { status: 409, body: { error: "the parked agent is already claimed — either a concurrent decide won (re-check the pending list), or a stale claim is pending automatic cleanup (retry after the stale-claim window)", errorCode: "decide.claim_lost", taskId: match.handle } };
+                return { status: 409, body: refusalBody({ errorCode: "decide.claim_lost", message: "the parked agent is already claimed — either a concurrent decide won (re-check the pending list), or a stale claim is pending automatic cleanup (retry after the stale-claim window)", facts: { taskId: match.handle } }) };
             case "binding_broken":
             case "checkpoint_not_pending":
-                return { status: 409, body: { error: "the approval gate moved under this decide (re-parked or already settled) — re-check the pending list", errorCode: "decide.gate_moved", taskId: match.handle } };
+                return { status: 409, body: refusalBody({ errorCode: "decide.gate_moved", message: "the approval gate moved under this decide (re-parked or already settled) — re-check the pending list", facts: { taskId: match.handle } }) };
             default:
-                return { status: 409, body: { error: "the parked agent moved under this decide (stopped or already decided)", errorCode: "decide.not_parked", taskId: match.handle } };
+                return { status: 409, body: refusalBody({ errorCode: "decide.not_parked", message: "the parked agent moved under this decide (stopped or already decided)", facts: { taskId: match.handle } }) };
         }
     }
     const ticket = claim.ticket;
@@ -281,7 +323,7 @@ export async function decideParkedAgent(deps, req, match) {
         toolCallId: `drv-${ticket.claimId}`,
         ...(surface.mountsCallerTool !== undefined ? { mountsCallerTool: surface.mountsCallerTool } : {}),
         ...(deps.approverSeatFor !== undefined && seatRoot !== undefined
-            ? { onAsk: deps.approverSeatFor({ owner: decodeCheckpointScope(req.scope) ?? null, taskId: match.handle, sessionId: seatRoot }) }
+            ? { onAsk: deps.approverSeatFor({ owner: ownerOfCheckpointScope(req.scope), taskId: match.handle, sessionId: seatRoot }) }
             : {}),
         reviveClaim: {
             row: { ...ticket.row, parkClaimId: ticket.claimId },
@@ -302,12 +344,14 @@ export async function decideParkedAgent(deps, req, match) {
         const disp = await rollback("execute_threw");
         return {
             status: 500,
-            body: {
-                error: `revive failed before the resume was driven: ${e instanceof Error ? e.message : String(e)}`,
+            body: refusalBody({
                 errorCode: "decide.revive_failed",
-                taskId: match.handle,
-                rollback: disp,
-            },
+                message: `revive failed before the resume was driven: ${e instanceof Error ? e.message : String(e)}`,
+                facts: {
+                    taskId: match.handle,
+                    rollback: disp,
+                },
+            }),
         };
     }
     const isErr = typeof receipt === "object" && receipt !== null && receipt.isError === true;
@@ -319,23 +363,28 @@ export async function decideParkedAgent(deps, req, match) {
             const cause = readClosedWordSeat(receiptDetails, "cause");
             return {
                 status: 422,
-                body: {
-                    error: typeof content === "string" ? content : "the parked resume failed during startup",
+                body: refusalBody({
                     errorCode: "parked_resume.startup_failed",
-                    taskId: match.handle,
-                    rollback: disp,
-                    ...(cause !== undefined ? { cause } : {}),
-                },
+                    message: typeof content === "string" ? content : "the parked resume failed during startup",
+                    facts: {
+                        taskId: match.handle,
+                        rollback: disp,
+                        ...(cause !== undefined ? { cause } : {}),
+                        ...resumeRefusalFacts(receiptDetails.detail),
+                    },
+                }),
             };
         }
         return {
             status: 409,
-            body: {
-                error: typeof content === "string" ? content : "revive was rejected by the delegation tool",
+            body: refusalBody({
                 errorCode: "decide.revive_rejected",
-                taskId: match.handle,
-                rollback: disp,
-            },
+                message: typeof content === "string" ? content : "revive was rejected by the delegation tool",
+                facts: {
+                    taskId: match.handle,
+                    rollback: disp,
+                },
+            }),
         };
     }
     return { status: 200, body: { taskId: match.handle, status: "resuming", decision: req.decision } };

package/dist/parked-revive-surface.d.ts

@@ -19,15 +19,22 @@
  *    这里的第 ② 条是同一条事实在交座这一处的判据(规则只写在这里,腿只负责读两次)。根删除时把子孙的 parked 卡一并作废 = S-790 件 B
  *    (`boot/session-faces.ts` 的删除协调器)。
  *  · 只对**一层**行填座(`rootSessionId` 在场且 = `parentSessionId`:派它的 run 就是根会话的 run,列表正是那个 run 的挂载)。更深的行
- *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 用 boot 期那只裸 Agent、无座 = core 的 fail-closed 臂;
+ *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 无座 = core 的 fail-closed 臂;
  *    行上带继承组成是 core #1112(7.32.x)的半场,到货再改读行。
  * 近似如实记:重解的列表是**部署缺省**那一份,读不回那一 run 的逐请求差异(`settings.webSearch` 后端、center overlay 场景)——
  * 座只判 bundle 实例的成员性,继承面是 `[...web, ...scaffolds]`,那两项差异不改变谁在面内。
+ *
+ * **属主来源(S-1770 / S-1808)与交座是两个独立判据**:赎回工具的停驻挂点(复活的子代再要审批时停驻,`plugins/session-store.ts`)按委派继承律定宿主行属主,
+ * 律要的是**委派树根的见证**:根 id(行上本来就带 `rootSessionId`)+ 判断那一刻读到的根行住客(赎回腿 claim 前后两读的那一位 —— 两读不是同一位时赎回腿整条拒,
+ * 走不到这里;读数缺席 ⇒ 见证不带住客,挂点那一刻根行在 ⇒ 停驻否决)。所以**每一行**都交出它({@link ScenarioContext} 的 `delegationRoot`):交座的一层行以
+ * `{ sessionId: root, delegationRoot }` 重解,不交座的行(更深的行、根住客已变的一层行、读数缺席)以 `{ delegationRoot }` 重解 —— 只喂停驻挂点,不挂任何会话级设施、
+ * 不带 principal,交座判据(上面三条)一个字不动。行上没有根 ⇒ boot 期那只裸 Agent(没有根可交 ⇒ 律给哨兵)。挂点那一刻根行已不在 ⇒ 律给哨兵;在而不是见证的那一位
+ * (批准之后删了、同 id 被重新登记)⇒ 停驻否决 —— 两件都在挂点那一侧判,与这里无关。
  */
 import { type BackgroundAgentRecord, type ToolSpec } from "@sema-agent/core";
 import type { Scenario } from "./capabilities/scenarios.js";
 import { type SessionFace } from "./session-incarnation.js";
-/** 一次赎回用的面:驱动的 Agent 工具 + (一层行时)与它同出一张列表的继承座。 */
+/** 一次赎回用的面:驱动的 Agent 工具(它的停驻挂点绑着行上的根)+ (交座时)与它同出一张列表的继承座。 */
 export interface ParkedReviveSurface {
     readonly reviveTool: ToolSpec;
     /** 缺席 = 不交座(core fail-closed:复活的子代不继承任何场景层工具)。 */

package/dist/parked-revive-surface.js

@@ -7,18 +7,21 @@ export function createParkedReviveSurface(defaultScenario) {
         return undefined;
     return (row, identity) => {
         const root = row.rootSessionId;
-        if (root === undefined || row.parentSessionId !== root)
+        if (root === undefined)
             return { reviveTool: bootTool };
-        const face = identity.root;
-        if (face === undefined || !sameSessionOccupant(face.before, face.after))
-            return { reviveTool: bootTool };
-        if ((face.before.owner ?? undefined) !== identity.principal || (face.after.owner ?? undefined) !== identity.principal)
-            return { reviveTool: bootTool };
-        const tools = defaultScenario({}, identity.principal, { sessionId: root }).tools;
+        const seated = holdsSeat(row.parentSessionId === root, identity);
+        const delegationRoot = { sessionId: root, incarnation: identity.root?.after.incarnation ?? null };
+        const tools = (seated ? defaultScenario({}, identity.principal, { sessionId: root, delegationRoot }) : defaultScenario({}, undefined, { delegationRoot })).tools;
         const reviveTool = agentOf(tools);
         if (reviveTool === undefined)
             return { reviveTool: bootTool };
-        return { reviveTool, mountsCallerTool: (t) => tools.includes(t) };
+        return seated ? { reviveTool, mountsCallerTool: (t) => tools.includes(t) } : { reviveTool };
     };
 }
+function holdsSeat(oneLevel, identity) {
+    const face = identity.root;
+    if (!oneLevel || face === undefined || !sameSessionOccupant(face.before, face.after))
+        return false;
+    return (face.before.owner ?? undefined) === identity.principal && (face.after.owner ?? undefined) === identity.principal;
+}
 //# sourceMappingURL=parked-revive-surface.js.map

package/dist/permission-rule-list.d.ts

@@ -6,7 +6,7 @@
  * `TaskSpec.allowedTools`(`task-settings.ts` 的 `applyTaskSettings`),运维的 `APPROVAL_GRANT` 投 `RunnerDeps.allowedTools`
  * (`boot/runner-deps.ts` 的部署姿态座席族)。本口的 `behavior` 型直接是 core 的 `PermissionRule["behavior"]`(不手抄:core 收窄,这里跟着收窄)。
  *
- * 为什么住在一只叶模块里(不留在 `task-settings.ts`):本模块只 import core 与 `text-bidi.ts`(纯叶),读者引它不成环。
+ * 为什么住在一只叶模块里(不留在 `task-settings.ts`):本模块只 import core 与契约包 settings-schema(纯叶),读者引它不成环。
  */
 import { type PathRuleBases, type PermissionRule, type ToolPolicy } from "@sema-agent/core";
 /** 一张表里规则条数的上限 —— 请求腿 wire 门(`task-settings.ts` 的 deny / ask 两桶判形)读的也是这一个名字:core 的缺省帽是 256,

package/dist/permission-rule-list.js

@@ -1,5 +1,5 @@
 import { createPermissionRulePolicy } from "@sema-agent/core";
-import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
 export const MAX_PERMISSION_RULES_PER_LIST = 1_000;
 export function createRuleListPolicy(names, behavior, source, pathBases) {
     try {
@@ -10,7 +10,7 @@ export function createRuleListPolicy(names, behavior, source, pathBases) {
         });
     }
     catch (e) {
-        const coreMsg = (e instanceof Error ? e.message : String(e)).replace(CONTROL_AND_BIDI_STRIP_RE, "");
+        const coreMsg = stripControlAndBidi(e instanceof Error ? e.message : String(e));
         throw new Error(`${source.replace("settings.", "")} has rule(s) core cannot compile — ${coreMsg}`, { cause: e });
     }
 }

package/dist/permission-rule-vocab.d.ts

@@ -1,4 +1,4 @@
-import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
+import type { RuleBehavior } from "@sema-agent/core";
 /**
  * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
  * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
@@ -9,15 +9,6 @@ import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
  * (既非命令文法也非路径文法 ⇒ 这条行永远匹配不上任何调用),两只店与票口一律拒。
  */
 export declare function isPersistedRuleTool(name: string): boolean;
-/**
- * `PersistedRuleMatch` 七员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
- * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
- * `subpath`(Read 目录形,永不容纳任何命令)/ `path`(core 7.9.0 [ref]:路径族 deny/ask/allow 的模式文法
- * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)/ `name` / `name_prefix`(core 7.43.0 #1318:`Skill` 的名字文法 ——
- * `Skill(<名>)` 精确、`Skill(<前缀>:*)` 名字前缀、无词界;技能卡的建议行 `match: "name"`)/ `host` / `subdomain`(core 7.49.0 #1365:
- * `WebFetch(domain:<host>)` 精确主机、`WebFetch(domain:*.<域>)` 域下每个主机 —— 只有 allow 形)。
- */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
 /**
  * S-511 —— `RuleBehavior` 每一员在**无同意仪式的直接写口**(`POST /v1/rules`)上的逐员表态。
  *
@@ -44,19 +35,6 @@ export type DirectWritableRuleBehavior = {
 }[RuleBehavior];
 /** 判别式谓词(收窄到 {@link DirectWritableRuleBehavior}):端点判过之后,`allow` 在**类型上**到不了写家。 */
 export declare function isDirectWritableRuleBehavior(behavior: RuleBehavior): behavior is DirectWritableRuleBehavior;
-/** [ref] §2.3 B3:batch offer 成员的判别位(`command` = 历史逐段 Bash 规则;`directoryRead` = cd 段铸的目录只读授权)。 */
-export declare const RULE_OFFER_BATCH_MEMBER_KINDS: readonly ["command", "directoryRead"];
-/** [ref] §3.5:一段「为什么仍未被覆盖」的闭三词集(`redirection` 永久逐次 / `no_rule_form` 无可覆盖形 / `cap_overflow` 去重+帽挤出)。 */
-export declare const UNCOVERED_SEGMENT_REASONS: readonly ["redirection", "no_rule_form", "cap_overflow"];
-/** [ref] §3.3-5:卡编辑面的 breadth 警告码(记录 `edited.warnings` 存的就是这两个字面)。 */
-export declare const EDITED_RULE_BREADTH_WARNING_CODES: readonly ["broad_prefix", "compound_prefix"];
-/**
- * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 3→4;[ref] 三态 behavior 进候选行)。
- * 类型绑 core 的字面型:core 再升号 ⇒ 这里编译红,两只 durable 店(SQL 双方言 + File)的 stale 判别与写侧钉
- * 同批随之;判别是**等式**(`!==`)不是下限 —— 旧号的行按 stale 信封交还(不迁移、不 widen、不丢行),
- * pending 卡短命,重触发即取新卡(B7/B8 既诺)。
- */
-export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
 /**
  * 一次撤销之后「这条规则还活着吗」的**三词闭集**(core 7.25.0 [ref]:`RemovalLiveness`)。
  * `"yes"` = 店说它还在(add-wins:撤销期间又落了一次新批准);`"no"` = 店说它不在了;

package/dist/permission-rule-vocab.js

@@ -2,9 +2,6 @@ import { ruleToolGrammarOf } from "@sema-agent/core";
 export function isPersistedRuleTool(name) {
     return ruleToolGrammarOf(name) !== undefined;
 }
-export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
-const MATCHES_PIN = true;
-void MATCHES_PIN;
 export const DIRECT_RULE_WRITE_ADMITS = {
     allow: false,
     deny: true,
@@ -13,14 +10,4 @@ export const DIRECT_RULE_WRITE_ADMITS = {
 export function isDirectWritableRuleBehavior(behavior) {
     return DIRECT_RULE_WRITE_ADMITS[behavior];
 }
-export const RULE_OFFER_BATCH_MEMBER_KINDS = ["command", "directoryRead"];
-const MEMBER_KINDS_PIN = true;
-void MEMBER_KINDS_PIN;
-export const UNCOVERED_SEGMENT_REASONS = ["redirection", "no_rule_form", "cap_overflow"];
-const REASONS_PIN = true;
-void REASONS_PIN;
-export const EDITED_RULE_BREADTH_WARNING_CODES = ["broad_prefix", "compound_prefix"];
-const WARNING_CODES_PIN = true;
-void WARNING_CODES_PIN;
-export const RULE_APPROVAL_RECORD_SCHEMA = 4;
 //# sourceMappingURL=permission-rule-vocab.js.map

package/dist/plugins/approval-ask-store-file.d.ts

@@ -22,7 +22,7 @@ export declare const ASK_JOURNAL_COMPACT_GROWTH = 2;
  * 账本的**动词闭集**([ref] 形)。运行期的词表判定与编译期的穷尽 `switch` 读同一份:
  * 往这里加一个词,{@link FileApprovalAskStore.replayOp} 的 switch 立刻编译红(漏一口不可能发布)。
  */
-declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteByTask"];
+declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteByTask", "reapSettledAsks", "reapEmptyBatches"];
 type JournalOpWord = (typeof JOURNAL_OPS)[number];
 /** 运行期词表(上面的数组)与类型面动词维({@link JournalCall})的**双向**对表 —— 任一边加词而另一边
  *  没跟上,这个别名解析成 `never`,{@link JOURNAL_OP_TABLE_GATE} 的赋值当场编译红。 */
@@ -96,6 +96,17 @@ type JournalCall = {
 } | {
     op: "deleteByTask";
     taskId: string;
+}
+/** 留存律的问账两半(挂靠集落成数组;Set 不是 JSON)。更老的读者不认这两个动词 ⇒ 拒启并点名出路(与 `claimTerminalRefuse` 同一条降级纪律)。 */
+ | {
+    op: "reapSettledAsks";
+    cutoffMs: number;
+    limit: number;
+    keepAnchors: string[];
+} | {
+    op: "reapEmptyBatches";
+    cutoffMs: number;
+    limit: number;
 };
 export declare class FileApprovalAskStore implements ApprovalAskStore {
     /** 语义内核(转移判定的唯一真源)。本类对它只做两件事:重放、代理。 */
@@ -171,6 +182,10 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
     deleteByTask(taskId: string): Promise<void>;
+    /** 留存律的问行半场(谓词在内核,见接口注)。空的一次(内核的纯读选择为空)不落账本、不碰内存;否则照常「先落账、再翻内存」。 */
+    reapSettledAsks(cutoffMs: number, limit: number, keepAnchors: ReadonlySet<string>): Promise<number>;
+    /** 留存律的批行半场(同上)。 */
+    reapEmptyBatches(cutoffMs: number, limit: number): Promise<number>;
     listByState(state: AskState, limit: number): Promise<AskRow[]>;
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;