@sema-agent/server 7.133.0 → 7.134.0

package/dist/main.js

@@ -17,7 +17,7 @@ async function main() {
     const s04 = await runStage04(s03);
     const s05 = await runStage05(s04);
     await settleHostLaneShell(s05.config, s05.logger);
-    const s06 = runStage06(s05);
+    const s06 = await runStage06(s05);
     const s07 = await runStage07(s06);
     const s08 = runStage08(s07);
     const s09 = runStage09(s08);

package/dist/memory-origin-fence.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { committedOriginOf } from "@sema-agent/core";
-import { canonicalJson } from "./canonical-json.js";
+import { canonicalJsonStringify } from "@sema-agent/core";
 export const ORIGIN_AWARE_QUERY = "originAware";
 export function readOriginAware(params) {
     return params.get(ORIGIN_AWARE_QUERY) === "1";
@@ -47,7 +47,7 @@ export function buildOriginFencedBundle(bundle, originAware) {
         integrity: {
             entryCount: kept.length,
             revs: Object.fromEntries(kept.map((e) => [e.id, e.rev])),
-            sectionHashes: { ...bundle.integrity.sectionHashes, entries: sha256Line(canonicalJson(kept)) },
+            sectionHashes: { ...bundle.integrity.sectionHashes, entries: sha256Line(canonicalJsonStringify(kept)) },
         },
         withheldOriginTagged: withheld,
     };

package/dist/model-compat.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Model.compat` —— 一只模型对 **openai-completions 线路**的兼容声明(core `OpenAICompletionsCompat`;
  * 声明面 settings-schema 1.10.0 `ModelEntry.compat`)。本模块是**两条腿共用的唯一判据点 + 唯一铸点**,
- * 与 {@link import("./mcp-tool-faces.js").readMcpToolFaces} 同一个「判据单点、多腿一致」的形。
+ * 与 `toolFaces` 的读法(引擎根导出的 `readToolFaces`,`task-mcp.ts` / `skills-mcp.ts` 两腿同问)同一个「判据单点、多腿一致」的形。
  *
  * ## 它治的病(1.10.0 CHANGELOG + core 型面顶注双向亲读)
  * 引擎的 openai brain 一直按这五键发请求,但声明写不进来:

package/dist/observability/prompt-manifest.d.ts

@@ -53,12 +53,23 @@ export declare function configAssembledRecordOf(e: {
     overrideReasons?: unknown;
     ts?: unknown;
 }): Record<string, unknown> | undefined;
+/**
+ * 一条 run 级的**伴随记录**:trace 帧在白名单读法之后要落成的那一行耐久事件(与清单行同生命周期:register 同门、drain 同拍、lease clear 同清)。
+ * 种类是一张闭表 —— 帧与账本行一一对应,加一种伴随记录 = 加一个词(`ledger-events.ts` 的账本行名闭集同批加),不另开一对 record / drain。
+ *  · `config_assembled` —— [ref]③ `config.assembled` 帧(生效配置逐字段来源);
+ *  · `cross_boundary_taint` —— core 7.54.0 [ref] O9b S1 `permission.cross_boundary_taint` 帧(设备车道发射闸:树的污染位与 governed;
+ *    只在执行于目标设备的树上发,宿主车道零帧;投影器 `trace/project.ts` `crossBoundaryTaintEventData`)。
+ */
+export type RunCompanionRecordType = "config_assembled" | "cross_boundary_taint";
+export interface RunCompanionRecord {
+    readonly type: RunCompanionRecordType;
+    readonly data: Record<string, unknown>;
+}
 export declare class PromptManifestTracker {
     private readonly byTask;
-    /** [ref]③:config.assembled 的同生命周期伴随记录(register 同门、drainConfig 同拍)。队列形
-     *  (codex F2):cascade 每 rung 独立解析配置,后到覆盖会把先前已计费 rung 的生效配置抹掉——与
-     *  prompt manifests 同姿势逐条保序。 */
-    private readonly configByTask;
+    /** 伴随记录({@link RunCompanionRecord}):清单之外、与清单同生命周期的 run 级耐久行。**一只**按发射序的队列(codex F2 当年给 config 一族立的保序律 ——
+     *  cascade 每 rung 各自成帧,后到覆盖会抹掉先前 rung 的那一份 —— 对每一种伴随记录同样成立,所以是一只队列,不是每种一只)。 */
+    private readonly companionsByTask;
     private readonly active;
     private leaseCounter;
     /** Mark a TOP-LEVEL run active (same fence as `ModelUsageTracker.register`, budget.ts). Returns this leg's
@@ -66,10 +77,10 @@ export declare class PromptManifestTracker {
     register(taskId: string): number;
     /** Queue this prepare's manifest — ONLY for a registered top-level run (else a no-op). Sync, never throws. */
     record(taskId: string, m: PromptManifestRecord): void;
-    /** [ref]③:队一条 config.assembled 投影(同 register 门;逐条保序——cascade 每 rung 各留其形)。 */
-    recordConfig(taskId: string, rec: Record<string, unknown>): void;
-    /** Return-and-clear ALL pending config records in emission order; `undefined` when none. */
-    drainConfig(taskId: string): Array<Record<string, unknown>> | undefined;
+    /** 队一条伴随记录(同 register 门;按发射序保序)。Sync, never throws. */
+    recordCompanion(taskId: string, type: RunCompanionRecordType, data: Record<string, unknown>): void;
+    /** Return-and-clear ALL pending companion records in emission order; `undefined` when none. */
+    drainCompanions(taskId: string): RunCompanionRecord[] | undefined;
     /** Return-and-clear ALL pending manifests in emission order; `undefined` when none. */
     drain(taskId: string): PromptManifestRecord[] | undefined;
     /** Drop pending + unregister (run end / abandoned leg) — but ONLY while `lease` still owns the slot;

package/dist/observability/prompt-manifest.js

@@ -140,7 +140,7 @@ export function configAssembledRecordOf(e) {
 }
 export class PromptManifestTracker {
     byTask = new Map();
-    configByTask = new Map();
+    companionsByTask = new Map();
     active = new Map();
     leaseCounter = 0;
     register(taskId) {
@@ -159,20 +159,21 @@ export class PromptManifestTracker {
         else
             this.byTask.set(taskId, [m]);
     }
-    recordConfig(taskId, rec) {
+    recordCompanion(taskId, type, data) {
         if (!taskId || !this.active.has(taskId))
             return;
-        const q = this.configByTask.get(taskId);
+        const q = this.companionsByTask.get(taskId);
+        const rec = { type, data };
         if (q)
             q.push(rec);
         else
-            this.configByTask.set(taskId, [rec]);
+            this.companionsByTask.set(taskId, [rec]);
     }
-    drainConfig(taskId) {
-        const q = this.configByTask.get(taskId);
+    drainCompanions(taskId) {
+        const q = this.companionsByTask.get(taskId);
         if (!q || q.length === 0)
             return undefined;
-        this.configByTask.delete(taskId);
+        this.companionsByTask.delete(taskId);
         return q;
     }
     drain(taskId) {
@@ -187,7 +188,7 @@ export class PromptManifestTracker {
             return;
         this.byTask.delete(taskId);
         this.active.delete(taskId);
-        this.configByTask.delete(taskId);
+        this.companionsByTask.delete(taskId);
     }
 }
 //# sourceMappingURL=prompt-manifest.js.map

package/dist/observability/tool-trace.js

@@ -1,6 +1,6 @@
 import { isClassifierDenyCause, isDeniedBy } from "@sema-agent/core";
 import { observeClassic } from "../hooks/classic-stations.js";
-import { redactSecrets } from "../trace/redact.js";
+import { seatText } from "../trace/exit-seat.js";
 import { echoCallerText } from "../caller-text-echo.js";
 export const PERMISSION_DENIED_METER_REGISTRATION = "server.permission-denied-meter";
 export const TOOL_TRACE_REGISTRATION = "server.tool-trace";
@@ -51,7 +51,7 @@ export function createToolTracer(logger) {
                     isError: true,
                     isInterrupt: e.failure.isInterrupt,
                     ...(e.failure.durationMs !== undefined ? { durationMs: e.failure.durationMs } : {}),
-                    out: echoCallerText(redactSecrets(e.failure.error), { maxChars: TRACE_OUT_ECHO_CHARS }),
+                    out: seatText("operator-log-text", e.failure.error),
                 });
             });
             observeClassic(on, "classic.PermissionDenied", (payload) => {
@@ -62,33 +62,32 @@ export function createToolTracer(logger) {
                     deniedBy: deniedByLabel(payload.gate),
                     ...(payload.gate.origin === undefined ? {} : { origin: payload.gate.origin }),
                     ...(payload.gate.settlement === undefined ? {} : { settlement: payload.gate.settlement.kind }),
-                    reason: echoCallerText(redactSecrets(payload.reason), { maxChars: TRACE_OUT_ECHO_CHARS }),
+                    reason: seatText("operator-log-text", payload.reason),
                     arg: summarize(payload.input),
                 });
             });
         },
     };
 }
-const TRACE_ARG_ECHO_CHARS = 120;
-const TRACE_OUT_ECHO_CHARS = 200;
+const TRACE_KEY_ECHO_CHARS = 120;
 function summarize(input) {
     if (!input || typeof input !== "object")
-        return { v: echoCallerText(redactSecrets(String(input)), { maxChars: TRACE_ARG_ECHO_CHARS }) };
+        return { v: seatText("operator-log-arg", String(input)) };
     const o = input;
     const s = {};
     for (const k of ["path", "file_path", "command", "cmd", "pattern", "glob", "old_string", "new_string"]) {
         if (typeof o[k] === "string")
-            s[k] = echoCallerText(redactSecrets(o[k]), { maxChars: TRACE_ARG_ECHO_CHARS });
+            s[k] = seatText("operator-log-arg", o[k]);
     }
     if (typeof o.content === "string")
         s.contentLen = o.content.length;
-    return Object.keys(s).length ? s : { keys: Object.keys(o).map((k) => echoCallerText(k, { maxChars: TRACE_ARG_ECHO_CHARS })) };
+    return Object.keys(s).length ? s : { keys: Object.keys(o).map((k) => echoCallerText(k, { maxChars: TRACE_KEY_ECHO_CHARS })) };
 }
 function textOf(content) {
     const text = content
         .map((c) => (c && typeof c === "object" && typeof c.text === "string" ? c.text : ""))
         .join("")
         .trim();
-    return echoCallerText(redactSecrets(text), { maxChars: TRACE_OUT_ECHO_CHARS });
+    return seatText("operator-log-text", text);
 }
 //# sourceMappingURL=tool-trace.js.map

package/dist/orchestration/workflow-park-decision.d.ts

@@ -52,7 +52,7 @@ export interface ParkDecisionLaneSeats {
  */
 export declare function parkDecisionStoreRefusal(seats: ParkDecisionLaneSeats): string | undefined;
 /**
- * 决定的同一性判据:判词 + 绑定两位 + 出处词(`decidedBy`)+ 载荷指纹(`updatedInput` / `answer` / `reason`,与 live 腿幂等回放的门⑦
+ * 决定的同一性判据:判词 + 绑定两位 + 出处词(`decidedBy`)+ 载荷指纹(`updatedInput` / `answer` / `reason` / `feedback`,与 live 腿幂等回放的门⑦
  * 同一只 {@link approvalPayloadFingerprint})。通道自报的 `approver` 不进 —— 它是归属标签,不改引擎铸的结算词。
  * 载荷序列化不了 ⇒ 抛(两侧都源自 JSON,走到这里是结构异常;那只函数自己已经响亮 warn)。
  */

package/dist/orchestration/workflow-park-decision.js

@@ -36,6 +36,7 @@ export function parkDecisionFingerprint(outcome) {
         ...(outcome.updatedInput !== undefined ? { updatedInput: outcome.updatedInput } : {}),
         ...(outcome.answer !== undefined ? { answer: outcome.answer } : {}),
         ...(outcome.reason !== undefined ? { reason: outcome.reason } : {}),
+        ...(outcome.feedback !== undefined ? { feedback: outcome.feedback } : {}),
     });
     if (payload === null)
         throw new Error("workflow park decision: the decision payload cannot be serialized — refusing to record a decision whose identity cannot be stated");

package/dist/parked-decide.d.ts

@@ -9,6 +9,7 @@
  * 行永 parked、生命周期分叉)。
  */
 import type { HostDecision } from "./host-decision.js";
+import type { DecideBinding } from "./http/wire-types.js";
 import type { BackgroundAgentRecord, BackgroundAgentStore, CheckpointStore, CheckpointToken, QuestionAnswer, RunInternals, TaskRegistry, ToolExecuteContext, WorkflowRun, WorkflowRunStore } from "@sema-agent/core";
 import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
@@ -204,11 +205,7 @@ export interface ParkedDecideRequest {
     reason?: string;
     /** D-1 decision-binding echo(操作员在 GET 看到的 boundCallId/boundInputHash 原样透传;server
      *  绝不重算,core resume 侧做 fail-closed 等值校验——与 legacy 腿同姿势)。 */
-    binding?: {
-        boundCallId?: string;
-        boundInputHash?: string;
-        updatedInput?: unknown;
-    };
+    binding?: Omit<DecideBinding, "checkpointToken">;
     /** body 带了 `remember:"session"` 时路由传入的 grant 执行器([ref] 候裁② 的 server 侧修,经两轮
      *  行为探针实证):豁免必须锚在**行的 root/host 会话 id**——部署侧三个豁免探针(policy 层/fs-write
      *  门/workflow 门)的闭包统一捕获 host 会话键且签名不携身份(1.393 seam 亲读:`sourceTaskId` 只在
@@ -247,6 +244,8 @@ export interface ParkedDecideResult {
  * · `hostDecision` = 结算**事实**逐字上 outcome;`gateOutcome` 一格 server **永不**填(core 对宿主
  *   自铸的结算词是 pre-CAS 响亮拒)。
  * · `answer` 原样透传([ref]:header 逐字匹配等语义校验全在 core,server 不预判)。
+ * · `feedback`(core 7.54.0):绑定里有就原样上 outcome —— 决定口只在人的放行上收它(拒决 / 策略的决定上带它是门口 400),本铸点不再按判词剪
+ *   (剪 = 静默丢一段人写的话;门口已拒的形到不了这里,引擎在 claim 前再判一次);什么算写了字(空白读作没写)是引擎的读法,本铸点不 trim。
  */
 export declare function buildParkedResumeOutcome(req: ParkedDecideRequest): WorkflowParkOutcome;
 /**

package/dist/parked-decide.js

@@ -5,7 +5,7 @@ import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope, ownerOfCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 import { sameSessionOccupant } from "./session-incarnation.js";
-import { refusalBody } from "./http/refusal-body.js";
+import { refusalBody, resumeRefusalFacts } from "./http/refusal-body.js";
 export async function findParkOrigin(sources, cp) {
     if (sources.agentStore !== undefined) {
         let match;
@@ -125,6 +125,7 @@ export function buildParkedResumeOutcome(req) {
         boundInputHash: req.binding?.boundInputHash ?? persistedHash,
         decision: req.decision === "approve" ? "allow" : "deny",
         ...(req.decision === "approve" && req.binding?.updatedInput !== undefined ? { updatedInput: req.binding.updatedInput } : {}),
+        ...(req.binding?.feedback !== undefined ? { feedback: req.binding.feedback } : {}),
         ...(req.answer !== undefined ? { answer: req.answer } : {}),
         ...(req.reason !== undefined ? { reason: req.reason } : {}),
         hostDecision: req.hostDecision,
@@ -369,6 +370,7 @@ export async function decideParkedAgent(deps, req, match) {
                         taskId: match.handle,
                         rollback: disp,
                         ...(cause !== undefined ? { cause } : {}),
+                        ...resumeRefusalFacts(receiptDetails.detail),
                     },
                 }),
             };

package/dist/permission-rule-vocab.d.ts

@@ -1,4 +1,4 @@
-import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
+import type { RuleBehavior } from "@sema-agent/core";
 /**
  * `PersistedRuleTool` **不再是闭词表**(core 7.9.0 / [ref]):工具名自 core 的**目录**派生
  * (`pathTarget` 声明 ⇒ 路径文法;`Bash` ⇒ 命令文法),型是 `string`。于是本文件对它的处置从
@@ -9,15 +9,6 @@ import type { RuleApprovalRecord, RuleBehavior } from "@sema-agent/core";
  * (既非命令文法也非路径文法 ⇒ 这条行永远匹配不上任何调用),两只店与票口一律拒。
  */
 export declare function isPersistedRuleTool(name: string): boolean;
-/**
- * `PersistedRuleMatch` 七员(core 顶注逐字):`exact` / `prefix`(历史 colon-star,永久兼容读、复合前缀形的
- * 唯一拼写)/ `wildcard`([ref] 尾 space-star,单命令体上与 prefix **同一谓词**,建议面自此铸它)/
- * `subpath`(Read 目录形,永不容纳任何命令)/ `path`(core 7.9.0 [ref]:路径族 deny/ask/allow 的模式文法
- * —— `//abs`、`~/`、`/root-relative`、cwd 相对,段内 `*`、跨段 `**`)/ `name` / `name_prefix`(core 7.43.0 #1318:`Skill` 的名字文法 ——
- * `Skill(<名>)` 精确、`Skill(<前缀>:*)` 名字前缀、无词界;技能卡的建议行 `match: "name"`)/ `host` / `subdomain`(core 7.49.0 #1365:
- * `WebFetch(domain:<host>)` 精确主机、`WebFetch(domain:*.<域>)` 域下每个主机 —— 只有 allow 形)。
- */
-export declare const PERSISTED_RULE_MATCHES: readonly ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
 /**
  * S-511 —— `RuleBehavior` 每一员在**无同意仪式的直接写口**(`POST /v1/rules`)上的逐员表态。
  *
@@ -44,19 +35,6 @@ export type DirectWritableRuleBehavior = {
 }[RuleBehavior];
 /** 判别式谓词(收窄到 {@link DirectWritableRuleBehavior}):端点判过之后,`allow` 在**类型上**到不了写家。 */
 export declare function isDirectWritableRuleBehavior(behavior: RuleBehavior): behavior is DirectWritableRuleBehavior;
-/** [ref] §2.3 B3:batch offer 成员的判别位(`command` = 历史逐段 Bash 规则;`directoryRead` = cd 段铸的目录只读授权)。 */
-export declare const RULE_OFFER_BATCH_MEMBER_KINDS: readonly ["command", "directoryRead"];
-/** [ref] §3.5:一段「为什么仍未被覆盖」的闭三词集(`redirection` 永久逐次 / `no_rule_form` 无可覆盖形 / `cap_overflow` 去重+帽挤出)。 */
-export declare const UNCOVERED_SEGMENT_REASONS: readonly ["redirection", "no_rule_form", "cap_overflow"];
-/** [ref] §3.3-5:卡编辑面的 breadth 警告码(记录 `edited.warnings` 存的就是这两个字面)。 */
-export declare const EDITED_RULE_BREADTH_WARNING_CODES: readonly ["broad_prefix", "compound_prefix"];
-/**
- * [ref] §4.5 / [ref] §3.5 —— 审批记录的**形版本号**(core `RuleApprovalRecord.schema`,本批 3→4;[ref] 三态 behavior 进候选行)。
- * 类型绑 core 的字面型:core 再升号 ⇒ 这里编译红,两只 durable 店(SQL 双方言 + File)的 stale 判别与写侧钉
- * 同批随之;判别是**等式**(`!==`)不是下限 —— 旧号的行按 stale 信封交还(不迁移、不 widen、不丢行),
- * pending 卡短命,重触发即取新卡(B7/B8 既诺)。
- */
-export declare const RULE_APPROVAL_RECORD_SCHEMA: RuleApprovalRecord["schema"];
 /**
  * 一次撤销之后「这条规则还活着吗」的**三词闭集**(core 7.25.0 [ref]:`RemovalLiveness`)。
  * `"yes"` = 店说它还在(add-wins:撤销期间又落了一次新批准);`"no"` = 店说它不在了;

package/dist/permission-rule-vocab.js

@@ -2,9 +2,6 @@ import { ruleToolGrammarOf } from "@sema-agent/core";
 export function isPersistedRuleTool(name) {
     return ruleToolGrammarOf(name) !== undefined;
 }
-export const PERSISTED_RULE_MATCHES = ["exact", "prefix", "wildcard", "subpath", "path", "name", "name_prefix", "host", "subdomain"];
-const MATCHES_PIN = true;
-void MATCHES_PIN;
 export const DIRECT_RULE_WRITE_ADMITS = {
     allow: false,
     deny: true,
@@ -13,14 +10,4 @@ export const DIRECT_RULE_WRITE_ADMITS = {
 export function isDirectWritableRuleBehavior(behavior) {
     return DIRECT_RULE_WRITE_ADMITS[behavior];
 }
-export const RULE_OFFER_BATCH_MEMBER_KINDS = ["command", "directoryRead"];
-const MEMBER_KINDS_PIN = true;
-void MEMBER_KINDS_PIN;
-export const UNCOVERED_SEGMENT_REASONS = ["redirection", "no_rule_form", "cap_overflow"];
-const REASONS_PIN = true;
-void REASONS_PIN;
-export const EDITED_RULE_BREADTH_WARNING_CODES = ["broad_prefix", "compound_prefix"];
-const WARNING_CODES_PIN = true;
-void WARNING_CODES_PIN;
-export const RULE_APPROVAL_RECORD_SCHEMA = 4;
 //# sourceMappingURL=permission-rule-vocab.js.map

package/dist/plugins/approval-payload-fingerprint.d.ts

@@ -1,5 +1,17 @@
+/** 决议载荷 —— 指纹的输入形(两条车道 + workflow 停驻决定共用一份;成员顺序见 {@link approvalPayloadFingerprint})。 */
+export interface ApprovalPayload {
+    updatedInput?: unknown;
+    answer?: unknown;
+    reason?: string;
+    /** core 7.54.0:人写在卡上的话(引擎逐字记在赢家上,空白也记)。 */
+    feedback?: string;
+}
 /**
- * [ref] 件1(codex R2-[high] 一)—— 决议载荷的比对指纹:`[updatedInput, answer, reason]` 三件的规范串。
+ * [ref] 件1(codex R2-[high] 一)—— 决议载荷的比对指纹:`[updatedInput, answer, reason]` 三件的规范串,其后**按在场追加**后来的成员(今天一员:`feedback`)。
+ *
+ * 🔴 成员律(一条):首发的三件恒占位(缺席折 `null`);之后加进来的成员**只在在场时**追加在尾部 —— workflow 停驻决定的同一性指纹
+ * ({@link parkDecisionFingerprint} 包它)是**落了库**的,新成员若恒占位,存量决定的指纹全部换字节、一次合法的重放被判成「另一个决定」;
+ * 按在场追加 ⇒ 不带新成员的决定字节不变,带了的与不带的不可能撞(串的元素个数不同)。
  *
  * 为什么是指纹而不是把三件原样交出来:`updatedInput` 可能携人写的命令原文/密钥形字节,而本读口的
  * 契约是「窄读、非凭据面」—— 交指纹够比对,也不给任何调用点把它误投上 wire 的机会。
@@ -15,9 +27,5 @@
  * 铸点丢掉的字节行上就没有,请求侧多喂一件会把一次合法重试误判成「不同的决议」。
  * 序列化失败(循环引用/BigInt 等)⇒ `null` = 判别不出,调用方据此拒绝回放(fail-closed)。
  */
-export declare function approvalPayloadFingerprint(v: {
-    updatedInput?: unknown;
-    answer?: unknown;
-    reason?: string;
-}): string | null;
+export declare function approvalPayloadFingerprint(v: ApprovalPayload): string | null;
 //# sourceMappingURL=approval-payload-fingerprint.d.ts.map

package/dist/plugins/approval-payload-fingerprint.js

@@ -12,7 +12,7 @@ function canonicalFingerprintJson(v) {
 }
 export function approvalPayloadFingerprint(v) {
     try {
-        const fp = canonicalFingerprintJson([v.updatedInput ?? null, v.answer ?? null, v.reason ?? null]);
+        const fp = canonicalFingerprintJson([v.updatedInput ?? null, v.answer ?? null, v.reason ?? null, ...(v.feedback !== undefined ? [v.feedback] : [])]);
         return fp;
     }
     catch (e) {

package/dist/plugins/caching-session-store.d.ts

@@ -1,4 +1,4 @@
-import type { AcquiredSession, PlacedSessionRow, RetentionDeclaration, SessionPlacementRecord, SessionStore, SessionTreeEntry } from "@sema-agent/core";
+import { type AcquiredSession, type PlacedSessionRow, type RetentionDeclaration, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { OwnerAwareSessionStore, SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";

package/dist/plugins/caching-session-store.js

@@ -1,4 +1,5 @@
-import { assertPlacementAdmission } from "./session-placement.js";
+import { admitSessionPlacement } from "@sema-agent/core";
+import { placementCapabilityOf } from "./session-placement.js";
 export class CachingSessionStore {
     inner;
     cache = new Map();
@@ -144,7 +145,7 @@ export class CachingSessionStore {
         }
         const hit = await this.freshHit(sessionId);
         if (hit && opts?.requireExisting !== true && this.placements !== undefined && this.placementOf !== undefined) {
-            assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
+            admitSessionPlacement(sessionId, await this.placementOf(sessionId), opts ?? {}, placementCapabilityOf(this));
         }
         if (hit) {
             hit.expiresAt = Date.now() + this.ttlMs;
@@ -159,7 +160,7 @@ export class CachingSessionStore {
         if (inflight) {
             const acquired = await inflight;
             if (this.placements !== undefined && this.placementOf !== undefined) {
-                assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
+                admitSessionPlacement(sessionId, await this.placementOf(sessionId), opts ?? {}, placementCapabilityOf(this));
             }
             return acquired;
         }

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -3,6 +3,15 @@ import type { Pool as PgPool } from "pg";
 import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity, type ToolApprovalCard } from "@sema-agent/core";
 import { type ParkRowFacts, type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDialect, type SqlDriver } from "./sql-driver.js";
+import type { SealedCheckpointCtx } from "../http/checkpoint-ctx.js";
+/** M28 店腿的读数(两孪生同形;随 M28 删):扫到的可读行 · 回写成的行 · 回写成的行里被改写的值 · 读不出的行 · 封好之后一行装不下的行。 */
+export interface CtxRowsRewriteM28 {
+    readonly scanned: number;
+    readonly rewritten: number;
+    readonly valuesRewritten: number;
+    readonly unreadable: number;
+    readonly tooLarge: number;
+}
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 /**
  * [ref] D-1 (§3 invariant #3 — crash-safe reaper backstop): an ABSOLUTE upper bound on a pending
@@ -818,8 +827,20 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      *  SUCCEED and replace a readable durable row with an unreadable one (caller sees 2xx, the next resume
      *  409s forever). So the serialized value is judged by {@link assertJsonColumnWritable} — the SAME shape
      *  reader the read leg uses — BEFORE the statement runs: refuse loudly, leave the row on disk untouched. */
-    putCtx(sessionId: string, ctx: object): Promise<void>;
+    putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
     getCtx<T extends object = object>(sessionId: string): Promise<T | null>;
+    /**
+     * 🔴 **一次性迁移 M28 的店腿**(窗与删法见 `plugins/one-time-migrations.ts` 登记表 M28;编排 = `checkpoint-ctx-seal-m28.ts`,行改写 =
+     * `http/checkpoint-ctx.ts` 的 `sealStoredCheckpointCtxM28`;本店不知道「封」是什么,只负责扫与回写):按 `session_id` 键集分页扫 `checkpoint_ctx`
+     * (每页 {@link CTX_REWRITE_PAGE} 行,只取会话 id 与 ctx 文本),行体经读腿**同一只**判形({@link decodeCtxColumn})—— 读不出 ⇒ 计数、跳过、不动;
+     * `rewrite` 交回新体 ⇒ 经写腿同一只编码与形闸,**按原文 CAS** 回写(MySQL 协议两边 `CAST(… AS BINARY)`,与 M17 / M18 同一条理由:连接排序规则大小写
+     * 不敏感;PG `text` 等值)。`updated_at_ms` **不动**(收割按它判,迁移不许延长或缩短一行的寿命)。CAS 打空(扫描与回写之间这一行被续跑腿 / 别的副本写过)
+     * ⇒ 不计、不重试(新写者是本版就已封好;是旧版副本就由之后的起服再扫到)。一行装不下(封签比明文长)⇒ 计 `tooLarge`、那一行留原样,其余照扫。
+     */
+    rewriteCtxRowsM28(rewrite: (sessionId: string, ctx: object) => {
+        readonly ctx: SealedCheckpointCtx;
+        readonly values: number;
+    } | undefined): Promise<CtxRowsRewriteM28>;
     /**
      * GC ctx rows whose lifecycle is over (bound to the checkpoint, don't leak):
      * a session with NO pending checkpoint, NO active run, AND not touched since `cutoff`.

package/dist/plugins/checkpoint-store-sql.js

@@ -8,10 +8,11 @@ import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, d
 import { recordFailOpen } from "../observability/fail-open.js";
 import { durableRowIdentity } from "../checkpoint-identity.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
-import { isDupKeyError, isMissingColumnError, rowTooLargeOrSelf } from "./sql-errors.js";
+import { isDupKeyError, isMissingColumnError, rowTooLargeOrSelf, StoreRowTooLargeError } from "./sql-errors.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
 import { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 const REAP_CLASSIFY_BATCH = 200;
+const CTX_REWRITE_PAGE = 500;
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 const MAX_TOOL_INPUT_CHARS = 8192;
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, (Number.isFinite(Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS)) ? Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) : 0) || 30 * 86_400_000);
@@ -755,6 +756,49 @@ export class SqlCheckpointStore {
         const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "ctx")} FROM checkpoint_ctx WHERE session_id=?`, `SELECT ${jsonColumnText("pg", "ctx")} FROM checkpoint_ctx WHERE session_id=$1`), [sessionId]);
         return rows[0] ? refusing("a resume context nobody can read", () => decodeCtxColumn(rows[0].ctx, `for session ${JSON.stringify(sessionId)}`)) : null;
     }
+    async rewriteCtxRowsM28(rewrite) {
+        const out = { scanned: 0, rewritten: 0, valuesRewritten: 0, unreadable: 0, tooLarge: 0 };
+        let after = "";
+        for (;;) {
+            const { rows } = await this.db.query(this.q(`SELECT session_id, ${jsonColumnText("tidb", "ctx")} FROM checkpoint_ctx WHERE session_id > ? ORDER BY session_id LIMIT ${CTX_REWRITE_PAGE}`, `SELECT session_id, ${jsonColumnText("pg", "ctx")} FROM checkpoint_ctx WHERE session_id > $1 ORDER BY session_id LIMIT ${CTX_REWRITE_PAGE}`), [after]);
+            for (const row of rows) {
+                const sessionId = String(row.session_id);
+                after = sessionId;
+                let ctx;
+                try {
+                    ctx = decodeCtxColumn(row.ctx, `for session ${JSON.stringify(sessionId)} (M28 scan)`);
+                }
+                catch {
+                    out.unreadable += 1;
+                    continue;
+                }
+                out.scanned += 1;
+                const next = rewrite(sessionId, ctx);
+                if (next === undefined)
+                    continue;
+                const text = this.json(next.ctx, "checkpoint ctx");
+                assertJsonColumnWritable(text, createObjectColumnReader(), `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (M28 write)`);
+                let affected;
+                try {
+                    ({ affected } = await this.db.query(this.q("UPDATE checkpoint_ctx SET ctx = ? WHERE session_id = ? AND CAST(CAST(ctx AS CHAR) AS BINARY) = CAST(? AS BINARY)", "UPDATE checkpoint_ctx SET ctx = $1::jsonb WHERE session_id = $2 AND ctx::text = $3"), [text, sessionId, String(row.ctx)]));
+                }
+                catch (e) {
+                    const folded = rowTooLargeOrSelf(this.db.dialect, e, `checkpoint_ctx.ctx for session ${JSON.stringify(sessionId)} (M28 write)`);
+                    if (!(folded instanceof StoreRowTooLargeError))
+                        throw folded;
+                    out.tooLarge += 1;
+                    continue;
+                }
+                if (affected > 0) {
+                    out.rewritten += 1;
+                    out.valuesRewritten += next.values;
+                }
+            }
+            if (rows.length < CTX_REWRITE_PAGE)
+                break;
+        }
+        return out;
+    }
     async reapCtx(cutoff) {
         const res = await this.db.query(this.q("DELETE FROM checkpoint_ctx WHERE updated_at_ms < ? " +
             "AND session_id NOT IN (SELECT session_id FROM checkpoint WHERE status='pending') " +

package/dist/plugins/local-checkpoint-store.d.ts

@@ -1,5 +1,6 @@
 import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ExecutionOutcomeRecordWord, type GateOutcome, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
-import { type CheckpointAskCandidate, type DecidedApprovalRecord, type PendingCheckpoint, type PendingRowBinding } from "./checkpoint-store-sql.js";
+import { type CheckpointAskCandidate, type CtxRowsRewriteM28, type DecidedApprovalRecord, type PendingCheckpoint, type PendingRowBinding } from "./checkpoint-store-sql.js";
+import type { SealedCheckpointCtx } from "../http/checkpoint-ctx.js";
 export interface LocalCheckpointStoreOptions {
     /** taskId join for the pending card (the local FileRunStore's `getActiveTaskId`). Absent ⇒ `taskId: null`. */
     getActiveTaskId?: (sessionId: string) => Promise<string | undefined>;
@@ -199,7 +200,7 @@ export declare class LocalCheckpointStore {
      * 一个 `toJSON(k){ return k === "ctx" ? null : {…} }` 的对象验的是 `{…}`、写的是 `{"ctx":null}`
      * (实测两串逐字不同)。有状态的序列化器同理。⇒ 整条记录**只序列化一次**,闸判那一串,写也写那一串。
      */
-    putCtx(sessionId: string, ctx: object): Promise<void>;
+    putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
     /**
      * 🔴 **坏体 ⇒ 拒,绝不读成缺席**(S-577,与 SQL 孪生同一条判据)。修前这里是
      * `catch { return null }` + `(rec.ctx as T) ?? null`,于是一个撕裂 / 手改 / 权限读不动的 ctx 文件与
@@ -211,6 +212,16 @@ export declare class LocalCheckpointStore {
      * 只收对象,读腿只认对象,两条腿一个类型。
      */
     getCtx<T extends object = object>(sessionId: string): Promise<T | null>;
+    /**
+     * 🔴 **一次性迁移 M28 的店腿**(local 孪生;窗与删法见 `plugins/one-time-migrations.ts` 登记表 M28,判词与 SQL 孪生 `rewriteCtxRowsM28` 逐条同):
+     * 逐档读(信封经读腿**同一只**判形 —— 读不出 ⇒ 计数、跳过、**不删**),`rewrite` 交回新体 ⇒ 信封原样(`sessionId` / `updatedAt` 不动:收割按 `updatedAt` 判)
+     * 只换 `ctx`,经写腿同一只形闸、同一只原子写落回原档。封签绑的是信封里的 `sessionId`(与 `getCtx` 认行的那一格同一个)。
+     * 数据根独占 + 起服在任何读写者之前跑 ⇒ 本车道没有并发写者,不需要 CAS;没有一行装不下这回事(`tooLarge` 恒 0)。
+     */
+    rewriteCtxRowsM28(rewrite: (sessionId: string, ctx: object) => {
+        readonly ctx: SealedCheckpointCtx;
+        readonly values: number;
+    } | undefined): Promise<CtxRowsRewriteM28>;
     /** GC ctx files whose lifecycle is over — same three guards as the SQL twins (stale ∧ no pending ∧ no active run). */
     reapCtx(cutoff: number): Promise<number>;
     /**

package/dist/plugins/local-checkpoint-store.js

@@ -327,6 +327,32 @@ export class LocalCheckpointStore {
         const rec = refusingCtx(sessionId, () => decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${ctxFileOf(sessionId)} for session ${JSON.stringify(sessionId)}`));
         return rec.sessionId === sessionId ? rec.ctx : null;
     }
+    async rewriteCtxRowsM28(rewrite) {
+        const out = { scanned: 0, rewritten: 0, valuesRewritten: 0, unreadable: 0, tooLarge: 0 };
+        for (const f of readdirSync(this.ctxDir)) {
+            if (!f.endsWith(".json"))
+                continue;
+            const p = join(this.ctxDir, f);
+            let rec;
+            try {
+                rec = decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${f} (M28 scan)`);
+            }
+            catch {
+                out.unreadable += 1;
+                continue;
+            }
+            out.scanned += 1;
+            const next = rewrite(rec.sessionId, rec.ctx);
+            if (next === undefined)
+                continue;
+            const text = JSON.stringify({ sessionId: rec.sessionId, updatedAt: rec.updatedAt, ctx: next.ctx });
+            assertJsonColumnWritable(text, createCtxRecordReader(), `checkpoint ctx for session ${JSON.stringify(rec.sessionId)} (local M28 write)`);
+            atomicWriteFile(this.tmpDir, p, text);
+            out.rewritten += 1;
+            out.valuesRewritten += next.values;
+        }
+        return out;
+    }
     async reapCtx(cutoff) {
         let n = 0;
         for (const f of readdirSync(this.ctxDir)) {

package/dist/plugins/local-session-store.d.ts

@@ -4,7 +4,7 @@ import type { SessionRowPatch } from "../session-row.js";
 import { type Logger } from "../observability/logger.js";
 import { type SessionFace } from "../session-incarnation.js";
 import { type InstructionSourceBaseline } from "../instruction-source-notice.js";
-import { type StagingHandle, type SyncRelation } from "../session-sync-kernel.js";
+import { type StagedCommitOptions, type StagingHandle, type SyncRelation } from "../session-sync-kernel.js";
 /**
  * local 车道会话存档的**唯一 repo 出口**:本仓里每一只读 `<root>/sessions/*.jsonl` 的 `FileSessionRepo` 都从这里取(`LocalSessionStore` 的底座与会话视图口
  * 窗口 `local-session-window.ts#LocalSessionWindow.wake` 的读旁路),所以坏记录的披露座只有这一份接线 —— 修前视图口自建一只不带座的 repo,同一份坏档在这里读到有计数 / 探针,
@@ -299,9 +299,13 @@ export declare class LocalSessionStore implements SessionStore {
     /** Synthesize a session's objective preview = the most-recent USER text message (the objective the run last saw).
      *  Reads the session's entries through the repo; any read error degrades to null (never fails the list). */
     private previewOf;
-    /** E17 — fork a session's WHOLE history to a NEW id owned by `owner` (core SessionRepo.fork). Returns the new id,
-     *  or null if the source does not exist (the route maps that to 404). */
-    fork(sourceId: string, owner: string | null): Promise<string | null>;
+    /** E17 — fork a session's WHOLE history to a NEW id (core SessionRepo.fork). Returns the new id, or null if the source does not exist.
+     *  属主按 core `SessionStore.fork` 契约(core 7.54.0 `sessionStoreContract` 的 [ownership] 格,唯一读法 {@link forkOwnerOf}):显式串 ⇒ 该串;
+     *  无参 / 显式 `null` ⇒ **源会话记下的属主**(一份有主历史的拷贝永不降成匿名 —— 匿名的拷贝谁都能认领);源会话没记属主 ⇒ 拷贝也不记(读作无主)。
+     *  修前把参数原样写进新格:`fork(owned, null)` 铸出一份匿名的有主历史。
+     *  🚧 已知分歧(不在本版收):拷的是整份日志,含在飞的 assistant 轮(契约:只拷**已提交**的叶)—— 剪在飞轮的判据只能是引擎的 `settledForkOptions`
+     *  (core 7.54.0 未导出,#2098 排在 7.55.0),本仓不写第二份;钉 `test/session-store-contract-kit.test.ts` 的 `it.fails` 格。 */
+    fork(sourceId: string, owner?: string | null): Promise<string | null>;
     /** 2c session-sync — EXPORT a session's full durable entry log (core `SessionRepo.exportEntries`; the
      *  in-memory/file repo holds the whole log so there is no floor to bypass). null if the source is unknown / the
      *  underlying repo lacks the optional seam. The owner is NOT exported — import re-stamps it. */
@@ -352,14 +356,13 @@ export declare class LocalSessionStore implements SessionStore {
     /** Drop a finished/aborted local staging handle from the registry (called by the handle on commit/abort). */
     forgetStaging(stagingId: string): void;
     /**
-     * {@link LocalStagingHandle.commit} 的整段 —— **一次持锁**(这只会话的写锁,{@link withSessionWriteLock}):提交时重新分类(目的端此刻的日志 vs staged)
+     * {@link LocalStagingHandle.commit} 的整段 —— **一次持锁**(这只会话的写锁,{@link withSessionWriteLock}):属主 CAS(此刻的属主格 = 这次导入的门判过的那一格,
+     * 否则抛 {@link StagedCommitOwnerChangedError},一个字节不写;在判目的端日志之前判,SQL 孪生同序)→ 提交时重新分类(目的端此刻的日志 vs staged)
      * → 拒未经同意的 fork / stale / 载荷分叉 → 换装(validate-first → 删 → 导入,化身按换装律沿用)或 identical 且内容相同时只重戳属主 → **在同一次持锁里**
      * 读出落定的会话面交回。锁放下之前谁也换不掉这一位住客,所以交回的面就是这次提交落下的那一位(SQL 孪生在提交事务里读同一行,同义);
-     * 提交之后按住客条件写的重放(会话行两位)只认这只面,不再重读。
+     * 提交之后按住客条件写的重放(会话行两位)只认这只面,不再重读。改属主的每一条写腿(登记 / 删除 / 导入 / 换装)都在同一把锁里,所以锁内这一读到锁放下都成立。
      */
-    commitStagedImport(sessionId: string, owner: string | null, staged: SessionTreeEntry[], opts?: {
-        resolution?: "overwrite-dst";
-    }): Promise<{
+    commitStagedImport(sessionId: string, owner: string | null, staged: SessionTreeEntry[], opts: StagedCommitOptions): Promise<{
         relation: SyncRelation["relation"];
         face: SessionFace;
     }>;