@sema-agent/server 7.133.0 → 7.135.0

package/dist/http/routes/sessions.js

@@ -9,7 +9,8 @@ import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
-import { gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { headReadOf, sessionFaceOfHead } from "../../session-incarnation.js";
 import { runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -71,11 +72,11 @@ async function readLastLegMcp(deps, sessionId, caller) {
 }
 export async function handleSessions(req, res, match, ctx) {
     const { deps } = ctx;
-    const { readJson, safeDecode, sessionOwnerOk, sessionOwnerScopeForWrite } = ctx.helpers;
+    const { readJson, safeDecode, sessionOwnerOk } = ctx.helpers;
     const readOwnedSessionView = async (sessionAudit, sessionId, readOpts) => {
-        const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-        if (ownerOf !== undefined) {
-            const owner = await ownerOf(sessionId);
+        const headOf = headReadOf(deps.sessionStorage);
+        if (headOf !== undefined) {
+            const owner = (await headOf(sessionId))?.owner;
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return undefined;
@@ -88,7 +89,7 @@ export async function handleSessions(req, res, match, ctx) {
             audit = await sessionAudit(sessionId, readOpts);
         }
         catch (e) {
-            if (ownerOf !== undefined)
+            if (headOf !== undefined)
                 throw e;
             throw new Error(`session view read failed before ownership could be established: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
         }
@@ -168,9 +169,11 @@ export async function handleSessions(req, res, match, ctx) {
                 if (mcpStatusCache.size > 1024)
                     mcpStatusCache.clear();
                 const panel = (async () => {
-                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations);
+                    const stopDial = new AbortController();
+                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations, undefined, undefined, undefined, stopDial.signal);
                     const mat = await raceDeadline(matP, MCP_DIAL_DEADLINE_MS).catch(() => null);
                     if (!mat) {
+                        stopDial.abort();
                         void matP.then((m) => m?.dispose().catch(() => undefined)).catch(() => undefined);
                         return { servers: [], asOf: new Date().toISOString(), degraded: true };
                     }
@@ -187,7 +190,7 @@ export async function handleSessions(req, res, match, ctx) {
                         };
                     }
                     finally {
-                        await mat.dispose().catch(() => undefined);
+                        void mat.dispose().catch(() => undefined);
                     }
                 })();
                 mcpStatusCache.set(cacheKey, { at: Date.now(), panel });
@@ -252,9 +255,8 @@ export async function handleSessions(req, res, match, ctx) {
     }
     {
         if (match.decl.id === "session-head") {
-            const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-            const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-            if (!getLeafId || !ownerOf) {
+            const headOf = headReadOf(deps.sessionStorage);
+            if (!headOf) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
@@ -263,30 +265,14 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const getHead = deps.sessionStorage?.getHead?.bind(deps.sessionStorage);
-            let owner;
-            let leafId;
-            if (getHead) {
-                const head = await getHead(headSession);
-                if (head === undefined) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                    return;
-                }
-                owner = head.owner;
-                if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, owner ?? null)))
-                    return;
-                leafId = head.leafId;
-            }
-            else {
-                owner = await ownerOf(headSession);
-                if (owner === undefined) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                    return;
-                }
-                if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, owner ?? null)))
-                    return;
-                leafId = await getLeafId(headSession);
+            const head = await headOf(headSession);
+            if (head === undefined) {
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                return;
             }
+            if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, head.owner)))
+                return;
+            const leafId = head.leafId;
             const etag = `"${leafId ?? "empty"}"`;
             if (req.headers["if-none-match"] === etag) {
                 res.writeHead(304, { etag }).end();
@@ -304,7 +290,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const ownerOf = evFact.sessionStorage.ownerOf.bind(evFact.sessionStorage);
+            const readOwner = async (id) => (await evFact.sessionStorage.headOf(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
             if (evSession === null) {
@@ -340,7 +326,7 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const cellP = ownerOf(evSession).then((o) => (o === undefined ? undefined : sessionOwnerCellOf(evFact.sessionStorage, evSession, o)));
+                const cellP = readOwner(evSession).then((o) => (o === undefined ? undefined : sessionOwnerCellOf(evFact.sessionStorage, evSession, o)));
                 void cellP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
                 let cell;
@@ -470,7 +456,7 @@ export async function handleSessions(req, res, match, ctx) {
                     }
                     ownerCheckPending = true;
                     ownerCheckStartedAt = Date.now();
-                    void ownerOf(evSession).then((o) => {
+                    void readOwner(evSession).then((o) => {
                         ownerCheckPending = false;
                         if (!closed && o !== owner)
                             onEnd();
@@ -670,7 +656,7 @@ export async function handleSessions(req, res, match, ctx) {
         }
         const store = rowFact.sessionStorage;
         const sessionId = match.params.sessionId;
-        const face = await store.sessionFaceOf(sessionId);
+        const face = sessionFaceOfHead(sessionId, await store.headOf(sessionId));
         if (face === undefined) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return;
@@ -698,8 +684,8 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const fork = forkFact.sessionStorage.fork.bind(forkFact.sessionStorage);
-            const ownerOf = forkFact.sessionStorage.ownerOf.bind(forkFact.sessionStorage);
-            const scope = sessionOwnerScopeForWrite(req);
+            const readOwner = async (id) => (await forkFact.sessionStorage.headOf(id))?.owner;
+            const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -709,12 +695,12 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sourceId);
+            const owner = await readOwner(sourceId);
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(forkFact.sessionStorage, sourceId, owner))) {
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config, sessionCallerOf(req, deps), await sessionOwnerCellOf(forkFact.sessionStorage, sourceId, owner))) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
@@ -736,8 +722,8 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const purge = deleteFact.purge;
-            const ownerOf = deleteFact.sessionStorage.ownerOf.bind(deleteFact.sessionStorage);
-            const scope = sessionOwnerScopeForWrite(req);
+            const readOwner = async (id) => (await deleteFact.sessionStorage.headOf(id))?.owner;
+            const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
@@ -747,12 +733,12 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sessionId);
+            const owner = await readOwner(sessionId);
             if (owner === undefined) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
-            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(deleteFact.sessionStorage, sessionId, owner))) {
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config, sessionCallerOf(req, deps), await sessionOwnerCellOf(deleteFact.sessionStorage, sessionId, owner))) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
@@ -782,7 +768,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const store = policyFact.policyStore;
-            const ownerOf = policyFact.sessionStorage.ownerOf.bind(policyFact.sessionStorage);
+            const readOwner = async (id) => (await policyFact.sessionStorage.headOf(id))?.owner;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendUnauthorized(res, "identity");
@@ -793,7 +779,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sessionId);
+            const owner = await readOwner(sessionId);
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;

package/dist/http/routes/tasks.d.ts

@@ -12,7 +12,7 @@
  *   · `runSyncSubmitLeg` —— 同步腿(原 128 行匿名体);
  *   · 同步腿内 `verifyLeg` / `cascadeLeg` / `plainLeg` —— 三条模型驱动腿,判别顺序与短路语义逐字不变。
  * 提名**只改名字不改行为**:闭包捕获的自由变量、语句顺序、settle/registry 生命周期注释全部随代码原样迁移。
- * (S-947 起「这次是不是被 server 中止、为什么」读每腿自己的中止句柄 `RunAbort`,不再有按 taskId 键控的
+ * ([ref] 起「这次是不是被 server 中止、为什么」读每腿自己的中止句柄 `RunAbort`,不再有按 taskId 键控的
  * `cancelledViaVerb` 旁表与它「身份守卫内先取后删」的取值时点。)
  *
  * 与 runs 域共用 `ctx.legs.prepareSpec`(读体/校验/建 spec 的同一条前段)。

package/dist/http/routes/tasks.js

@@ -21,7 +21,7 @@ import { replayOfExistingRun } from "../submit-replay.js";
 import { httpErrorCode, sendJson, sendError, sseHeaders } from "../send.js";
 import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
-import { createApprovalCardEmitter, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
+import { approvalPreambleReplays, createApprovalCardEmitter, declaredApprovalFrameFamilies, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, isActiveRunConflictBody, toDoneFrameResult } from "../active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
 import { commitSessionInheritEnv } from "../session-inherit-env.js";
@@ -150,6 +150,18 @@ export async function handleTasks(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody, undefined, { liveStream });
         if (!prepared)
             return;
+        const declaredFamilies = declaredApprovalFrameFamilies(prepared.body.settings);
+        const approvalLegInput = (streamApprovalOn) => {
+            const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
+            return {
+                streamApprovalOn,
+                windowMs: deps.config.streamApproval?.windowMs,
+                windowMarginMs: deps.config.streamAskWindowMarginMs,
+                ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
+                declaredFamilies,
+            };
+        };
+        const assembleApprovalLeg = (streamApprovalOn) => resolveApprovalLeg({ ...approvalLegInput(streamApprovalOn), nowMonotonicMs: performance.now() });
         const principal = prepared.auth?.principal;
         const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
         let wiringReceipt;
@@ -215,9 +227,9 @@ export async function handleTasks(req, res, match, ctx) {
                 toolApprovalEnabled: Boolean(deps.toolApproval),
                 streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                 backend: deps.backend,
-                parkFacility: deps.checkpointStore !== undefined,
+                checkpointStore: deps.checkpointStore,
             });
-            const replaySessionId = replayGate.active ? prepared.spec.sessionId : undefined;
+            const replaySessionId = approvalPreambleReplays(approvalLegInput(replayGate.active)) ? prepared.spec.sessionId : undefined;
             const presentedOnConnection = new Set();
             const presentedCompleted = new Set();
             const admitPresentedComplete = (askId) => {
@@ -663,18 +675,11 @@ export async function handleTasks(req, res, match, ctx) {
                         toolApprovalEnabled: Boolean(deps.toolApproval),
                         streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                         backend: deps.backend,
-                        parkFacility: deps.checkpointStore !== undefined,
+                        checkpointStore: deps.checkpointStore,
                     }).active;
-                    const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
-                    const approvalLeg = resolveApprovalLeg({
-                        streamApprovalOn,
-                        windowMs: deps.config.streamApproval?.windowMs,
-                        windowMarginMs: deps.config.streamAskWindowMarginMs,
-                        ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
-                        nowMonotonicMs: performance.now(),
-                    });
+                    const approvalLeg = assembleApprovalLeg(streamApprovalOn);
                     const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-                    const windowZero = approvalLeg.windowZero;
+                    const unattended = approvalLeg.unattended;
                     const emitCard = createApprovalCardEmitter({
                         ...(ledgerSink
                             ? {
@@ -696,7 +701,7 @@ export async function handleTasks(req, res, match, ctx) {
                         if (!res.writableEnded && !res.destroyed)
                             emitAsk(frame);
                     };
-                    const approvalCtx = deps.toolApproval && !windowZero
+                    const approvalCtx = deps.toolApproval && unattended === undefined
                         ? {
                             taskId: askTaskId,
                             owner: askOwner,
@@ -714,8 +719,8 @@ export async function handleTasks(req, res, match, ctx) {
                         : undefined;
                     if (deps.toolApproval) {
                         const toolApproval = deps.toolApproval;
-                        prepared.spec.onAsk = windowZero
-                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })
+                        prepared.spec.onAsk = unattended
+                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) }, unattended)
                             : toolApproval.boundAsk({
                                 owner: askOwner,
                                 taskId: askTaskId,

package/dist/http/routes/trace-usage.d.ts

@@ -6,7 +6,7 @@
  *
  * ⚠️ 三块都跑在全局 service-credential 门**之前**(与 /metrics 同款待遇)——只读 traceToken 单凭据的调用方
  * (registry 中继的姿势)在全局门会被 401,挂门后=门内 traceToken 支持成死代码(1.148 a2 实机抓获)。
- * S-672(7.105.0):门前不等于不设防 —— 本域坐在读路谓词段,先过 `dispatch.ts` 的 `readCredentialOk`
+ * [ref](7.105.0):门前不等于不设防 —— 本域坐在读路谓词段,先过 `dispatch.ts` 的 `readCredentialOk`
  * (部署配了 service 凭据时要「service token / traceToken / 已验 principal」之一),块内这几道门在它之后。
  * 因此本域在 `handle()` 里的位置就是契约的一部分:必须留在鉴权门上方,顺序不可与其他域对调。本域零可变状态。
  */

package/dist/http/routes/trace-usage.js

@@ -6,16 +6,16 @@ import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
-import { gatedPrincipal, sendUnauthorized } from "../principal-gate.js";
+import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 const TOOL_RESULT_LIMIT_CAP = 262_144;
 const TOOL_RESULT_OFFSET_CAP = 2_147_483_646;
 export async function handleTraceUsage(req, res, match, ctx) {
     const { deps } = ctx;
-    const { isFleetWide, safeDecode } = ctx.helpers;
+    const { safeDecode } = ctx.helpers;
     if (match.decl.id === "tasks-source-summary") {
-        if (!isFleetWide(req)) {
+        if (!fleetViewOf(req, deps, "read").fleetWide) {
             sendUnauthorized(res, "operator");
             return;
         }
@@ -35,8 +35,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
         match.decl.id === "task-trace-stream" ||
         match.decl.id === "task-trace-artifacts" ||
         match.decl.id === "task-tool-result") {
-        const fleetWide = isFleetWide(req);
-        const gateOwner = fleetWide ? null : (gatedPrincipal(req, deps.config) || null);
+        const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
         if (!fleetWide && gateOwner === null) {
             sendUnauthorized(res, "identity");
             return;
@@ -89,9 +88,8 @@ export async function handleTraceUsage(req, res, match, ctx) {
                 return;
             }
             const runStore = runs.runStore;
-            const fleetWide = isFleetWide(req);
-            const jwtOwner = fleetWide ? undefined : gatedPrincipal(req, deps.config);
-            if (!fleetWide && !jwtOwner) {
+            const { fleetWide, gateOwner } = fleetViewOf(req, deps, "read");
+            if (!fleetWide && gateOwner === null) {
                 sendUnauthorized(res, "identity");
                 return;
             }
@@ -109,7 +107,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
                 sendError(res, 400, "request.query_invalid", "invalid from/to (ISO-8601 or epoch-ms; from < to)");
                 return;
             }
-            const owner = jwtOwner ?? (q.get("principal") ?? undefined);
+            const owner = gateOwner ?? (q.get("principal") ?? undefined);
             try {
                 const scan = await runStore.usageScan(from, to, owner !== undefined ? { owner } : undefined);
                 const base = { from: new Date(from).toISOString(), to: new Date(to).toISOString(), ...(scan.truncated ? { truncated: true } : {}) };

package/dist/http/routes/workflows.d.ts

@@ -175,6 +175,9 @@ export declare const WORKFLOW_RUN_DISPOSITIONS: {
     readonly id: "forward";
     readonly scope: "forward";
     readonly status: "forward";
+    readonly parked: {
+        readonly mint: (run: WorkflowRun) => true | undefined;
+    };
     readonly name: {
         readonly redact: "redactSecrets";
     };

package/dist/http/routes/workflows.js

@@ -1,9 +1,8 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { z } from "zod";
-import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
+import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal, runParkedOf, JOURNAL_INCOMPATIBLE_ERROR_CODE, WorkflowJournalIncompatibleError } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
-import { journalEntryOfBody, journalEntryPayload, journalRowPayloadOf, readJournalRowBody } from "../../orchestration/workflow-journal-entry.js";
-import { decodeJsonColumn } from "../../plugins/sql-json-column.js";
+import { journalEntryOfCell, journalEntryPayload, journalRowPayloadOf } from "../../plugins/workflow-journal-payload.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { createHash } from "node:crypto";
 import { redactHead } from "../../observability/run-terminal.js";
@@ -72,8 +71,8 @@ export async function handleWorkflows(req, res, match, ctx) {
             if (journalStore === undefined)
                 throw new Error("workflow-journal reached without the workflowsJournal journal witness");
             const jq = new URLSearchParams(match.search);
-            const jLimit = Math.min(50, Math.max(1, Number(jq.get("limit") ?? 20) || 20));
-            const jOffset = Math.max(0, Number(jq.get("offset") ?? 0) || 0);
+            const jLimit = Math.min(50, Math.max(1, Math.trunc(Number(jq.get("limit") ?? 20)) || 20));
+            const jOffset = Math.max(0, Math.trunc(Number(jq.get("offset") ?? 0)) || 0);
             const MAX_ROW_BYTES = 64 * 1024;
             const firstLine = (t) => (t ? redactHead(t.split("\n")[0], 300) : undefined);
             const MAX_RESULT_CHARS = 2000;
@@ -114,31 +113,34 @@ export async function handleWorkflows(req, res, match, ctx) {
             };
             const js = journalStore;
             let projected;
-            if (js.loadPage) {
-                const page = await js.loadPage(wfId, scope, { offset: jOffset, limit: jLimit, maxResultBytes: MAX_ROW_BYTES });
-                projected = page.map((row) => {
-                    if (row.resultJson === null) {
-                        return oversizeStub(row.callKey, row.resultBytes);
-                    }
-                    try {
-                        const { payload, parked } = journalEntryPayload(journalEntryOfBody(row.callKey, decodeJsonColumn(row.resultJson, readJournalRowBody, `workflow_journal.result for entry ${row.callKey}`)));
+            try {
+                if (js.loadPage) {
+                    const page = await js.loadPage(wfId, scope, { offset: jOffset, limit: jLimit, maxResultBytes: MAX_ROW_BYTES });
+                    projected = page.map((row) => {
+                        if (row.resultJson === null) {
+                            return oversizeStub(row.callKey, row.resultBytes);
+                        }
+                        const { payload, parked } = journalEntryPayload(journalEntryOfCell(wfId, row.callKey, row.resultJson, `workflow_journal.result for entry ${row.callKey}`));
                         return projectEntry(row.callKey, payload, parked);
-                    }
-                    catch {
-                        return oversizeStub(row.callKey, row.resultBytes);
-                    }
-                });
+                    });
+                }
+                else {
+                    const entries = await journalStore.load(wfId, scope);
+                    projected = entries
+                        .sort((a, b) => callKeyOrdinal(a.callKey) - callKeyOrdinal(b.callKey))
+                        .slice(jOffset, jOffset + jLimit)
+                        .map((en) => {
+                        const { payload, parked } = journalEntryPayload(en);
+                        const bytes = Buffer.byteLength(journalRowPayloadOf(en));
+                        return bytes > MAX_ROW_BYTES ? oversizeStub(en.callKey, bytes) : projectEntry(en.callKey, payload, parked);
+                    });
+                }
             }
-            else {
-                const entries = await journalStore.load(wfId, scope);
-                projected = entries
-                    .sort((a, b) => callKeyOrdinal(a.callKey) - callKeyOrdinal(b.callKey))
-                    .slice(jOffset, jOffset + jLimit)
-                    .map((en) => {
-                    const { payload, parked } = journalEntryPayload(en);
-                    const bytes = Buffer.byteLength(journalRowPayloadOf(en));
-                    return bytes > MAX_ROW_BYTES ? oversizeStub(en.callKey, bytes) : projectEntry(en.callKey, payload, parked);
-                });
+            catch (e) {
+                if (!(e instanceof WorkflowJournalIncompatibleError))
+                    throw e;
+                sendError(res, 500, JOURNAL_INCOMPATIBLE_ERROR_CODE, `this run's journal holds a record the engine cannot read (entry #${e.ordinal}): the journal cannot be listed or resumed until that record is repaired from a kept copy — do not delete it (a missing entry makes a resume run that step again)`, { ordinal: e.ordinal });
+                return;
             }
             sendJson(res, 200, { runId: wfId, entries: projected, ...(projected.length === jLimit ? { nextOffset: jOffset + jLimit } : {}) });
             return;
@@ -366,6 +368,7 @@ export const WORKFLOW_RUN_DISPOSITIONS = {
     id: "forward",
     scope: "forward",
     status: "forward",
+    parked: { mint: (run) => (runParkedOf({ status: run.status, agents: [...rowsOf(run.agents)] }) ? true : undefined) },
     name: { redact: "redactSecrets" },
     description: { redact: "redactSecrets" },
     stats: { nested: WORKFLOW_RUN_STATS_DISPOSITIONS },

package/dist/http/send.d.ts

@@ -51,7 +51,7 @@ export declare const SSE_MAX_STREAM_MS: number;
  */
 export declare const SSE_HEARTBEAT_IDLE_MS = 15000;
 /**
- * S-1281 —— 服务端**主动**收一条已开的 SSE 流:一帧 `event: error`(帧形与流帽那一帧同一套 `{type:"error", errorCode, message}`,
+ * [ref] —— 服务端**主动**收一条已开的 SSE 流:一帧 `event: error`(帧形与流帽那一帧同一套 `{type:"error", errorCode, message}`,
  * 消费端按既有「服务端收流 ⇒ 重连」协议处置,SDK 的流读口把它当一帧事件交出再重连)后 `end()`。
  *
  * 收流的是分派器,不是流自己的泵:泵此刻可能正停在一次 await 上,醒来还会写一帧。Node 上 `end()` 之后、`close` 之前的那一写会发一个
@@ -102,25 +102,25 @@ export declare function httpErrorBody(e: HttpError): RefusalBody;
 /** 整面拒:状态 = `e.status`,体 = {@link httpErrorBody}。手里拿着一只 `HttpError` 的路由站点一律调它。 */
 export declare function sendHttpError(res: ServerResponse, e: HttpError): void;
 /**
- * 🔴 B1 / S-535 —— `SessionPolicyError` → 应答,经 {@link sessionPolicyErrorHttp} 那**一只**映射
+ * 🔴 B1 / [ref] —— `SessionPolicyError` → 应答,经 {@link sessionPolicyErrorHttp} 那**一只**映射
  * (`src/session-policy-wire.ts`)。回 `true` = 已应答,调用点 `return`。
  *
  * 为什么是一只共享腿而不是每个站点一句 `instanceof`:映射本身早就收成一处了,而**咨询它的站点**只有两条
  * **写**腿 —— 偏偏 core 7.25.0 那个新词 `corrupt` 是在**读**上抛出来的(店读不出它自己写的那一行:
- * S-529 的两道读回拒 + C1 的体形拒)。于是 `GET /v1/sessions/:id/policy` 与 2c 的 manifest 导出腿把它交给了
+ * [ref] 的两道读回拒 + C1 的体形拒)。于是 `GET /v1/sessions/:id/policy` 与 2c 的 manifest 导出腿把它交给了
  * 域外通用臂 ⇒ `500 internal.error "internal error"`:码丢,连带**修复路径**也丢(同一行 `PUT` 却答
  * `500 corrupt` 并点名那一列)。一只腿之后,新站点只会忘记调它,不会再各自发明一份映射。
  */
 export declare function sendSessionPolicyError(res: ServerResponse, e: unknown, sentencePrefix?: string): boolean;
 /**
- * S-612 —— core `SessionError` → 应答,经 {@link sessionErrorHttp} 那**一只**映射(`src/session-error-wire.ts`)。
+ * [ref] —— core `SessionError` → 应答,经 {@link sessionErrorHttp} 那**一只**映射(`src/session-error-wire.ts`)。
  * 回 `true` = 已应答,调用点 `return`;`false` = 不是 `SessionError`,或这个词在这一面上是登记过的留白(站点的既有
  * 处置照旧 —— 通常是继续上抛到全局兜底)。
  *
  * 句子:属主给了固定句就发它(import 面 `invalid_session` / `placement_refused` 两句),否则发 core 的原句过既有脱敏(`redactErrorMessage`:
  * 不抛、有上限)。core 的 `corrupt_session` 原句只点名会话 id 与跳过计数(「Session <id> is unreadable: its log has no
  * meta header (N of M records skipped as corrupt)」),SQL 两店的原句点名 `<表>.<列>` 与行号 —— 两者都不含盘上路径
- * (路径只进运维面:`server.session-repo.corrupt-record-skipped` 的探针行,S-990;SQL 两店走各自的拒绝句)。
+ * (路径只进运维面:`server.session-repo.corrupt-record-skipped` 的探针行,[ref];SQL 两店走各自的拒绝句)。
  */
 export declare function sendSessionError(res: ServerResponse, e: unknown, face: SessionErrorFace): boolean;
 export declare function msg(e: unknown): string;