@sema-agent/server 7.133.0 → 7.135.0

package/dist/plugins/tidb-pool.d.ts

@@ -63,13 +63,13 @@ export declare const ENSURE_SCHEMA_LOCK = "sema_ensure_schema";
  *  lock row — which both exhausts TiDB's "pessimistic lock retry limit" (surfacing as a thrown error) AND starves the
  *  app's OWN `SELECT … FOR UPDATE` paths (image-bake admission/lease) of pessimistic-lock budget. So we acquire
  *  NON-BLOCKING (GET_LOCK(name, 0) returns 0 immediately if held) and POLL with jittered backoff: one holder, the
- *  rest sleeping (not blocked in-DB). Polls until acquired (7.83.0: never degrades to unserialized — the S-287
+ *  rest sleeping (not blocked in-DB). Polls until acquired (7.83.0: never degrades to unserialized — the [ref]
  *  `ADD INDEX` leg is not race-safe); a connection whose probe keeps throwing surfaces as a boot failure. */
 export declare function acquireEnsureSchemaLock(conn: PoolConnection, tag?: string): Promise<void>;
 /** Release {@link ENSURE_SCHEMA_LOCK} on `conn` (best-effort — the lock also auto-frees when the connection closes). */
 export declare function releaseEnsureSchemaLock(conn: PoolConnection, tag?: string): Promise<void>;
 /**
- * S-287:`SCHEMA_STATEMENTS` 建的那批表**在存量库上可能缺的索引**(声明与 PG 侧逐条共用同一份 —— 见
+ * [ref]:`SCHEMA_STATEMENTS` 建的那批表**在存量库上可能缺的索引**(声明与 PG 侧逐条共用同一份 —— 见
  * `plugins/ensure-index.ts` 头注与 `plugins/schema-indexes.ts`)。
  *
  * 组合口径与 `SCHEMA_STATEMENTS` **一一对应**:凡是它建的表,索引声明就进这个数组;它不建的表

package/dist/plugins/tidb-pool.js

@@ -286,6 +286,13 @@ export const SCHEMA_STATEMENTS = [
      -- NULL (a PRE-MIGRATION row, or a gate carrying no kind) ⇒ the LEGACY UNIFORM expire() path: the deny split
      -- is NEW-ROWS-ONLY. See tidb-checkpoint-store.ts reapExpired / listExpiredApprovalGates.
      gate_kind    VARCHAR(32)  NULL,
+     -- approval_card(core 7.55.0 #1468 P1 阶段二):门上的卡词**照存**(core checkpointIndexFacts(cp).approvalCard:TOOL_APPROVAL_CARDS 的词,或本引擎不认的串 ——
+     -- 留着,更晚的引擎读得对);非审批门 / 无卡 / 非串 = NULL。写口与一次性迁移 M29 的存量回填同一只派生(plugins/checkpoint-index-columns.ts)。
+     -- 读者:到期 facet 的生成谓词(由 core CARD_FACET_OVERRIDES + PAUSE_REGISTRY 生成;**不存 facet 本身** —— 存一份会在 core 改表那天陈旧)、运维队列行的卡。
+     -- 本仓不发 ALTER:存量库缺这一列 ⇒ 起服列册对账拒启并给 ADD COLUMN 句(持久数据:表里是在飞的停驻,不删表重建)。
+     -- 列型 TEXT 而不是定长 VARCHAR:引擎照存集外词,长度不由本仓定(191 字的集外词照存)。TEXT 自己的容量是 65,535 **字节**(plugins/checkpoint-index-columns.ts 的
+     -- APPROVAL_CARD_COLUMN_MAX_BYTES):引擎铸的卡词是闭集短词,超出只会是手改 / 外来写者的存量行 —— M29 回填对这样的行计数 + 点名跳过,不写、不挡起服。
+     approval_card TEXT         NULL,
      -- bound_input_hash (design/80 D-1): the server-minted opaque boundInputHash, stamped at put() from
      -- pendingAction.boundInputHash, surfaced via listPending so the operator/portal can ECHO it on /decide (the
      -- D-1 TOCTOU binding guard is UNREACHABLE by the portal without it — it can then only do the unbound legacy
@@ -605,8 +612,8 @@ export const SCHEMA_STATEMENTS = [
      -- tidb-workflow-run-store.ts projects kind only when non-null and workflow-completion-inbox.ts routes
      -- kind === "task_notification" vs everything-else. Do NOT "tidy" this into NOT NULL DEFAULT.
      kind           VARCHAR(24)  NULL,
-     -- payload: bounded + redacted JSON extras (task_type / result / …) for the task_notification family.
-     -- NULL for legacy / plain workflow_complete rows.
+     -- payload: bounded + redacted JSON extras of the entry's kind. task_notification: task_type / result / …;
+     -- workflow_complete: at most {"completionId": …} (the engine's own correlation id, verbatim; NULL when the engine minted none).
      payload        TEXT         NULL,
      PRIMARY KEY (session_id, run_id),
      UNIQUE KEY uq_wfinbox_seq (seq),

package/dist/plugins/tidb-session-store.d.ts

@@ -8,9 +8,9 @@
  * on acquire (core's F1).
  *
  * Persistence only. **Tenant authorization (who may wake which session) lives in the service layer**
- * (`src/security.ts`), which uses `ownerOf` / `register` below. The store does not infer identity.
+ * (`src/security.ts`), which uses `headOf` (the one by-id read of a row) / `register` below. The store does not infer identity.
  */
-import { type AcquiredSession, type PlacedSessionRow, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
+import { type AcquiredSession, type PlacedSessionRow, type SessionHead, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import { type InstructionSourceBaseline } from "../instruction-source-notice.js";
 import { type SessionFace } from "../session-incarnation.js";
@@ -45,21 +45,21 @@ export declare class TiDBSessionStore implements SessionStore {
     register(sessionId: string, owner: string | null): Promise<void>;
     /**
      * acquire 的建行(唯一一处):普通会话 ⇒ 无主(按 id 首建的既有读法);placed 会话 ⇒ 属主按委派继承律在**这一笔**里写入
-     * (S-1770:根会话的属主,根行不在取父,都不在 ⇒ 孤行哨兵 + warn;属主 = 判断时见证到的,读来源 → 判 → INSERT —— 读法与顺序只住在
+     * ([ref]:根会话的属主,根行不在取父,都不在 ⇒ 孤行哨兵 + warn;属主 = 判断时见证到的,读来源 → 判 → INSERT —— 读法与顺序只住在
      * `delegated-session-owner.ts` 的 `createPlacedSessionRow`,本店只交既有读写口,PG 孪生同调)。
      */
     private createOnAcquire;
     /**
-     * S-1770 委派继承律的**认领口**:这只会话的那一位住客(判断时读到的化身)仍是无主的 placed 行 ⇒ 写 `owner`,返回是否写成
+     * [ref] 委派继承律的**认领口**:这只会话的那一位住客(判断时读到的化身)仍是无主的 placed 行 ⇒ 写 `owner`,返回是否写成
      * (句 = `CLAIM_OWNERLESS_PLACED_SQL`,只 CAS 子行自己,与停驻挂点 / M23 同一只;规则在 `delegated-session-owner.ts`)。普通会话行不在射程(placed 判别位)。
      */
     claimOwnerless(sessionId: string, incarnation: string, owner: string): Promise<boolean>;
-    /** 若干来源行的会话面(属主 + 化身)一次读回(委派继承律的来源读;本店没有的 id 不在表里;化身经与 {@link sessionFaceOf} 同一只解码,空 ⇒ 响亮拒)。 */
+    /** 若干来源行的会话面(属主 + 化身)一次读回(委派继承律的来源读;本店没有的 id 不在表里;活住客的投影 `sessionFaceFromRow`,空化身 ⇒ 响亮拒)。 */
     private sourceFaces;
     /** The one session_meta INSERT. Existing owner is never overwritten.
      *  [ref]:`placement` 在场时与行同一条 INSERT 落六列;ON DUPLICATE 臂是 no-op ⇒ 已存在的行的元组
      *  **永不被重写**(first-write 不可变,义务 5 的写侧半场)。
-     *  S-790:化身与属主同一条 first-write 律 —— 新行铸一只(`mintSessionIncarnation`),已存在的行 no-op 臂一个字节不动。 */
+     *  [ref]:化身与属主同一条 first-write 律 —— 新行铸一只(`mintSessionIncarnation`),已存在的行 no-op 臂一个字节不动。 */
     private insertMeta;
     /**
      * [ref] 义务 6 的廉价探针 —— 一行 PK SELECT:`undefined` = 普通会话或无此行。
@@ -78,25 +78,15 @@ export declare class TiDBSessionStore implements SessionStore {
         olderThanMs?: number;
         scope?: string;
     }): Promise<PlacedSessionRow[]>;
-    /** Owner principal of a session, `null` if registered ownerless, `undefined` if no such session. */
-    ownerOf(sessionId: string): Promise<string | null | undefined>;
-    /** S-790:属主 + 化身**一次读**(单行单 SELECT —— 两次独立读在删除 / 重登记的缝里能拼出混世代组合)。`undefined` = 无此会话;
-     *  行在而化身为空 ⇒ `SessionIncarnationMissingError`(响亮拒,判据唯一属主 `sessionFaceFromRow`)。 */
-    sessionFaceOf(sessionId: string): Promise<SessionFace | undefined>;
-    /** core `SessionStore.incarnationOf`(按 id 读住客,给没取会话的那一侧):{@link sessionFaceOf} 的化身那一半 —— 同一次读、同一只解码。 */
-    incarnationOf(sessionId: string): Promise<string | undefined>;
+    /**
+     * core `SessionStore.headOf` —— 这一行的属主、住客、叶子,**一条 PK SELECT、一行**(两次独立读在删除 / 重登记的缝里能拼出混世代组合;
+     * 单行单读天然一致)。`undefined` = 无此会话。本店按 id 问这一行的**唯一**读口:授权口的属主、parked 两读的住客、SSE 探针的叶子、
+     * resume-at 的叶子都是它的投影(此前的 `ownerOf` / `sessionFaceOf` / `incarnationOf` / `getLeafId` / `getHead` 五只读全部并进来;规则见
+     * `session-incarnation.ts` 头注)。化身那一格经 `headFromRow` 的 `absent` 读法(空 ⇒ 住客未知);要一位活住客的读者经 `sessionFaceOfHead` 响亮拒空。
+     * 只读、不取会话、不上锁、绕过暖缓存 —— 跑到一半读也安全(写的安全是追加时的 CAS)。
+     */
+    headOf(sessionId: string): Promise<SessionHead | undefined>;
     touch(sessionId: string): Promise<void>;
-    /** E18 — the session's current leaf `SessionTreeEntry.id` (`session_meta.leaf_id`, set transactionally on every
-     *  persist). A single SELECT, NO acquire/lock/CAS — safe to call mid-run (write-safety is the append-time CAS, not
-     *  an acquire lease) and cache-bypassing (the resume-at turn-capture reads it without touching the warm session).
-     *  Returns the leaf id, or null when the session has none / no such session. */
-    getLeafId(sessionId: string): Promise<string | null>;
-    /** [ref] 六轮复审:owner+leafId **单行原子快照**(SSE watch 探针的租户围栏读)——两独立 SELECT 在
-     *  delete/reclaim 缝里可拼出「旧 owner+新 leaf」混世代组合;单 SELECT 单行=天然一致。undefined=无此会话。 */
-    getHead(sessionId: string): Promise<{
-        owner: string | null;
-        leafId: string | null;
-    } | undefined>;
     /**
      * Durable history is retained; just drop any in-flight cache entry.
      *
@@ -164,12 +154,12 @@ export declare class TiDBSessionStore implements SessionStore {
      *  writer order: `src/session-row.ts`). Returns whether this call set it. */
     setTitleIfNull(sessionId: string, title: string): Promise<boolean>;
     /**
-     * S-690 —— 换源通告的基线读(一行 PK SELECT;列的三态读法见 `tidb-pool.ts` 的列注)。行不在 ⇒ 读作「没记过」
+     * [ref] —— 换源通告的基线读(一行 PK SELECT;列的三态读法见 `tidb-pool.ts` 的列注)。行不在 ⇒ 读作「没记过」
      * (loader 跑在 acquire 之后,行恒在;不在 = 被带外删了,没有下一 run 可比)。
      */
     readInstructionSource(sessionId: string): Promise<InstructionSourceBaseline>;
     /**
-     * S-690 —— CAS 覆写基线(期望值 = 调用方读到的那一份;不符 ⇒ 0 行、不抛 —— 契约见 `InstructionSourceStore`)。
+     * [ref] —— CAS 覆写基线(期望值 = 调用方读到的那一份;不符 ⇒ 0 行、不抛 —— 契约见 `InstructionSourceStore`)。
      * **不**碰 `updated_at`(那是会话活动时刻,留存腿按它判龄;记基线不是一次会话活动)。
      * 两条基线查询都带每查询超时(`BASELINE_IO_DEADLINE_MS`,mysql2 的 `{sql, timeout}` 形):被行锁卡住的写由查询自己
      * 在期限内拒。⚠️ mysql2 的超时是客户端侧的 —— 拒之后那条连接仍被挂着的命令占到服务端结束(S-9 同形,如实披露)。
@@ -187,7 +177,7 @@ export declare class TiDBSessionStore implements SessionStore {
      * We instead SELECT the entire `session_event` log ordered by seq — every durable entry, compaction floor
      * bypassed — and re-seq it dense from 0 into the new session, ids/parents/payload byte-verbatim.
      */
-    fork(sourceId: string, owner: string | null): Promise<string | null>;
+    fork(sourceId: string, owner?: string | null): Promise<string | null>;
     /**
      * 2c session-sync — EXPORT a session's full durable entry log for cross-backend migration. This is the
      * READ half of {@link fork}, surfaced as the core `SessionRepo.exportEntries` seam: the WHOLE `session_event` log,

package/dist/plugins/tidb-session-store.js

@@ -1,16 +1,18 @@
-import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
+import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry, admitSessionPlacement } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./tidb-session-storage.js";
 import { decodeSessionEventPayload } from "./session-event-payload.js";
 import { jsonColumnText } from "./sql-json-column.js";
 import { escapeLike } from "./sql-escape.js";
 import { BASELINE_IO_DEADLINE_MS, decodeInstructionSource, encodeInstructionSource } from "../instruction-source-notice.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
-import { carriedIncarnation, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
+import { carriedIncarnation, headFromRow, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, createPlacedSessionRow } from "../delegated-session-owner.js";
 import { createLogger } from "../observability/logger.js";
-import { assertPlacementAdmission, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
+import { placementCapabilityOf, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
+import { classifySyncRelationshipByIds, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
+import { assertFirstOwnerWritable, forkOwnerOf } from "./session-ownership.js";
+import { forkCopyOf, forkPointOf } from "./session-fork.js";
 export class TiDBSessionStore {
     pool;
     retention = MANAGED_RETENTION;
@@ -32,7 +34,7 @@ export class TiDBSessionStore {
         const inflight = this.pending.get(sessionId);
         if (inflight) {
             const acquired = await inflight;
-            assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
+            admitSessionPlacement(sessionId, await this.placementOf(sessionId), opts ?? {}, placementCapabilityOf(this));
             return acquired;
         }
         const p = this.load(sessionId, false, opts).finally(() => this.pending.delete(sessionId));
@@ -42,7 +44,7 @@ export class TiDBSessionStore {
     async load(sessionId, requireExisting = false, opts) {
         let storage = await TiDBSessionStorage.wake(this.pool, sessionId);
         if (storage) {
-            assertPlacementAdmission(sessionId, (await storage.getMetadata()).placement, opts);
+            admitSessionPlacement(sessionId, (await storage.getMetadata()).placement, opts ?? {}, placementCapabilityOf(this));
             return { session: new StoredSession(storage), sessionId };
         }
         if (requireExisting)
@@ -52,10 +54,15 @@ export class TiDBSessionStore {
         if (!storage) {
             throw new SessionError("storage", `session ${sessionId} vanished between register and wake (a concurrent purge won the race) — retry`);
         }
-        assertPlacementAdmission(sessionId, (await storage.getMetadata()).placement, opts);
+        admitSessionPlacement(sessionId, (await storage.getMetadata()).placement, opts ?? {}, placementCapabilityOf(this));
         return { session: new StoredSession(storage), sessionId };
     }
     async register(sessionId, owner) {
+        if (typeof owner !== "string" && owner !== null) {
+            if ((await this.headOf(sessionId)) !== undefined)
+                return;
+            assertFirstOwnerWritable(sessionId, owner);
+        }
         await this.insertMeta(sessionId, owner, undefined);
     }
     async createOnAcquire(sessionId, placement) {
@@ -64,7 +71,7 @@ export class TiDBSessionStore {
         await createPlacedSessionRow(sessionId, placement, {
             readFaces: (ids) => this.sourceFaces(ids),
             insert: (owner) => this.insertMeta(sessionId, owner, placement),
-            readOwner: () => this.ownerOf(sessionId),
+            readOwner: async () => (await this.headOf(sessionId))?.owner,
         }, this.log);
     }
     async claimOwnerless(sessionId, incarnation, owner) {
@@ -101,20 +108,12 @@ export class TiDBSessionStore {
         const [rows] = await this.pool.query(sql, params);
         return rows.map((r) => placedRowFromRow(String(r.session_id), r, r.updated_at instanceof Date ? r.updated_at.getTime() : undefined));
     }
-    async ownerOf(sessionId) {
-        const [rows] = await this.pool.query("SELECT owner FROM session_meta WHERE session_id = ?", [sessionId]);
+    async headOf(sessionId) {
+        const [rows] = await this.pool.query("SELECT owner, incarnation, leaf_id FROM session_meta WHERE session_id = ?", [sessionId]);
         if (rows.length === 0)
             return undefined;
-        return rows[0].owner ?? null;
-    }
-    async sessionFaceOf(sessionId) {
-        const [rows] = await this.pool.query("SELECT owner, incarnation FROM session_meta WHERE session_id = ?", [sessionId]);
-        if (rows.length === 0)
-            return undefined;
-        return sessionFaceFromRow(sessionId, rows[0].owner ?? null, rows[0].incarnation);
-    }
-    async incarnationOf(sessionId) {
-        return (await this.sessionFaceOf(sessionId))?.incarnation;
+        const r = rows[0];
+        return headFromRow(sessionId, r.owner ?? null, r.incarnation, r.leaf_id ?? null);
     }
     async touch(sessionId) {
         await this.pool.query("UPDATE session_meta SET updated_at = ? WHERE session_id = ?", [
@@ -122,16 +121,6 @@ export class TiDBSessionStore {
             sessionId,
         ]);
     }
-    async getLeafId(sessionId) {
-        const [rows] = await this.pool.query("SELECT leaf_id FROM session_meta WHERE session_id = ?", [sessionId]);
-        return rows[0] ? (rows[0].leaf_id ?? null) : null;
-    }
-    async getHead(sessionId) {
-        const [rows] = await this.pool.query("SELECT owner, leaf_id FROM session_meta WHERE session_id = ?", [sessionId]);
-        if (rows.length === 0)
-            return undefined;
-        return { owner: rows[0].owner ?? null, leafId: rows[0].leaf_id ?? null };
-    }
     async release(sessionId) {
         this.pending.delete(sessionId);
         const placed = await this.placementOf(sessionId);
@@ -259,11 +248,17 @@ export class TiDBSessionStore {
         }
     }
     async fork(sourceId, owner) {
-        const [metaRows] = await this.pool.query("SELECT leaf_id FROM session_meta WHERE session_id = ?", [sourceId]);
+        const [metaRows] = await this.pool.query("SELECT leaf_id, owner FROM session_meta WHERE session_id = ?", [sourceId]);
         if (!metaRows[0])
             return null;
         const leafId = metaRows[0].leaf_id ?? null;
-        const [eventRows] = await this.pool.query(`SELECT entry_id, parent_id, type, ${jsonColumnText("tidb", "payload")}, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [sourceId]);
+        const forkOwner = forkOwnerOf(owner, metaRows[0].owner ?? null) ?? null;
+        const storage = await TiDBSessionStorage.wake(this.pool, sourceId);
+        if (storage === null)
+            return null;
+        const point = await forkPointOf(storage);
+        const [allRows] = await this.pool.query(`SELECT entry_id, parent_id, type, ${jsonColumnText("tidb", "payload")}, ts FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [sourceId]);
+        const { rows: eventRows, leafId: forkLeafId } = forkCopyOf(allRows, leafId, point);
         const newId = uuidv7();
         const now = new Date();
         const conn = await this.pool.getConnection();
@@ -274,7 +269,7 @@ export class TiDBSessionStore {
                 const payload = String(r.payload);
                 await conn.query("INSERT INTO session_event (session_id, seq, entry_id, parent_id, type, payload, ts) VALUES (?,?,?,?,?,?,?)", [newId, seq, r.entry_id, r.parent_id ?? null, r.type, payload, r.ts]);
             }
-            await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES (?,?,?,?,?,?,?)", [newId, owner, now, now, leafId, eventRows.length, mintSessionIncarnation()]);
+            await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES (?,?,?,?,?,?,?)", [newId, forkOwner, now, now, forkLeafId, eventRows.length, mintSessionIncarnation()]);
             await conn.commit();
             return newId;
         }
@@ -476,6 +471,23 @@ class TiDBStagingHandle {
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
+            const now = new Date();
+            const minted = mintSessionIncarnation();
+            if (opts.expectedOwner !== undefined) {
+                const [cas] = await conn.query("UPDATE session_meta SET leaf_seq = leaf_seq + 1 WHERE session_id = ? AND owner <=> ?", [this.realSessionId, opts.expectedOwner]);
+                if (cas.affectedRows !== 1) {
+                    await conn.rollback();
+                    throw new StagedCommitOwnerChangedError(this.realSessionId);
+                }
+            }
+            else {
+                await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES (?,?,?,?,NULL,0,?) ON DUPLICATE KEY UPDATE session_id = session_id", [this.realSessionId, owner, now, now, minted]);
+                const [claimed] = await conn.query("SELECT incarnation FROM session_meta WHERE session_id = ? FOR UPDATE", [this.realSessionId]);
+                if (String(claimed[0]?.incarnation) !== minted) {
+                    await conn.rollback();
+                    throw new StagedCommitOwnerChangedError(this.realSessionId);
+                }
+            }
             const [stagedRows] = await conn.query("SELECT entry_id FROM session_event WHERE session_id = ? ORDER BY seq ASC FOR UPDATE", [this.stagingId]);
             const [dstRows] = await conn.query("SELECT entry_id FROM session_event WHERE session_id = ? ORDER BY seq ASC FOR UPDATE", [this.realSessionId]);
             const [dstMeta] = await conn.query("SELECT placement_kind FROM session_meta WHERE session_id = ?", [this.realSessionId]);
@@ -484,15 +496,15 @@ class TiDBStagingHandle {
                 throw new SessionError("placement_refused", `session ${this.realSessionId} belongs to the ${String(dstMeta[0].placement_kind)} placement partition — a session-sync staged commit cannot overwrite a delegation transcript`);
             }
             const srcIds = stagedRows.map((r) => String(r.entry_id));
-            const dstIds = dstMeta[0] ? dstRows.map((r) => String(r.entry_id)) : null;
+            const dstIds = opts.expectedOwner !== undefined ? dstRows.map((r) => String(r.entry_id)) : null;
             const rel = classifySyncRelationshipByIds(srcIds, dstIds);
-            if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
+            if ((rel.relation === "fork" || rel.relation === "stale") && opts.resolution !== "overwrite-dst") {
                 await conn.rollback();
                 throw new SyncConflictError(this.realSessionId, rel);
             }
-            if (rel.relation === "fast_forward" && opts?.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
-                const [dstFull] = await conn.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [this.realSessionId]);
-                const [stagedFull] = await conn.query(`SELECT entry_id, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC`, [this.stagingId]);
+            if (rel.relation === "fast_forward" && opts.resolution !== "overwrite-dst" && dstIds !== null && dstIds.length > 0) {
+                const [dstFull] = await conn.query(`SELECT seq, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC FOR UPDATE`, [this.realSessionId]);
+                const [stagedFull] = await conn.query(`SELECT entry_id, ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq ASC FOR UPDATE`, [this.stagingId]);
                 const dstSet = new Set(dstIds);
                 const dstEntries = dstFull.map((r) => decodeSessionEventPayload(r.payload, this.realSessionId, r.seq));
                 const stagedShared = stagedFull
@@ -506,13 +518,11 @@ class TiDBStagingHandle {
             }
             await conn.query("DELETE FROM session_event WHERE session_id = ?", [this.realSessionId]);
             await conn.query("UPDATE session_event SET session_id = ? WHERE session_id = ?", [this.realSessionId, this.stagingId]);
-            const [lastRow] = await conn.query(`SELECT ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq DESC LIMIT 1`, [this.realSessionId]);
+            const [lastRow] = await conn.query(`SELECT ${jsonColumnText("tidb", "payload")} FROM session_event WHERE session_id = ? ORDER BY seq DESC LIMIT 1 FOR UPDATE`, [this.realSessionId]);
             let leafId = null;
             if (lastRow[0])
                 leafId = leafIdAfterEntry(decodeSessionEventPayload(lastRow[0].payload, this.realSessionId, "last staged row"));
-            const now = new Date();
-            await conn.query("INSERT INTO session_meta (session_id, owner, created_at, updated_at, leaf_id, leaf_seq, incarnation) VALUES (?,?,?,?,?,?,?) " +
-                "ON DUPLICATE KEY UPDATE owner = VALUES(owner), updated_at = VALUES(updated_at), leaf_id = VALUES(leaf_id), leaf_seq = VALUES(leaf_seq)", [this.realSessionId, owner, now, now, leafId, srcIds.length, mintSessionIncarnation()]);
+            await conn.query("UPDATE session_meta SET owner = ?, updated_at = ?, leaf_id = ?, leaf_seq = ? WHERE session_id = ?", [owner, now, leafId, srcIds.length, this.realSessionId]);
             const [afterMeta] = await conn.query("SELECT placement_kind, owner, incarnation FROM session_meta WHERE session_id = ?", [this.realSessionId]);
             if (afterMeta[0]?.placement_kind != null) {
                 await conn.rollback();

package/dist/plugins/tool-result-store-sql.d.ts

@@ -7,7 +7,7 @@ import { type IndexSpec } from "./ensure-index.js";
  *  (LONGTEXT→TEXT, DATETIME(3)→TIMESTAMPTZ(3), inline KEY→separate CREATE INDEX). Disjoint from other stores'
  *  tables, so a self-contained ensureSchema is safe (central pg-pool aggregation is done separately). */
 export declare const PG_TOOL_RESULT_SCHEMA: string[];
-/** S-287:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensureSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
+/** [ref]:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensureSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
 export declare const TOOL_RESULT_INDEXES: readonly IndexSpec[];
 /** Idempotent schema apply for the tool_result table (for the integration test to call). */
 export declare function ensureSchema(pool: PgPool | PgPoolClient): Promise<void>;

package/dist/plugins/usage-window-store-sql.d.ts

@@ -8,10 +8,10 @@
  *
  * 并发正确性(本 store 的靶心;两副本同 key 并发 charge 绝不能丢账——丢账方向=治理窗漏放):
  *  - **ensure-first + 行锁**(mailbox twin 正字先例,[ref] 复审靶1):事务内先幂等建空行
- *    (形 A,S-127:MySQL `ON DUPLICATE KEY UPDATE <pk> = <pk>` / PG `ON CONFLICT DO NOTHING`)⇒
+ *    (形 A,[ref]:MySQL `ON DUPLICATE KEY UPDATE <pk> = <pk>` / PG `ON CONFLICT DO NOTHING`)⇒
  *    `SELECT … FOR UPDATE` 时行恒在,「无行 FOR UPDATE + INSERT」的并发死锁/dup 撞车形整个消掉。
  *    MySQL 侧动词**不能**是 `INSERT IGNORE`:InnoDB 对重复键的 IGNORE 取 S 锁,随后的 FOR UPDATE 要升 X,
- *    两个并发 charge 各持一把 S 互等 ⇒ ER_LOCK_DEADLOCK(B-013);ON DUPLICATE 的重复键取的就是 X。
+ *    两个并发 charge 各持一把 S 互等 ⇒ ER_LOCK_DEADLOCK([ref]);ON DUPLICATE 的重复键取的就是 X。
  *  - charge 频率低(core 只在任务进场/turn 边界/收尾 delta 提交),悲观锁简单正确,不用乐观 CAS。
  *  - `read` 无锁单 SELECT(readUsageRecord 纯函数);行缺席 = EMPTY_USAGE_WINDOW_RECORD。
  *  - record JSON 坏形(手工污染)= **fail-loud throw**:治理窗算错=计费面撒谎,不 fail-open。
@@ -29,7 +29,7 @@ import type { UsageWindow, UsageWindowReading, UsageWindowRecord, UsageWindowSto
 import { type JsonColumnShape } from "./sql-json-column.js";
 export declare const USAGE_WINDOW_TABLE = "usage_window";
 /**
- * `usage_window.record` 的**形读者**(S-550 车③a:本店既有的那一份深度判据逐字搬进来,一个字没改判)。
+ * `usage_window.record` 的**形读者**([ref] 车③a:本店既有的那一份深度判据逐字搬进来,一个字没改判)。
  *
  * 判据深到内层元素:非数值 tokens 参与累加会得到 `"0oops"` ⇒ `exhausted:false` ⇒ **超额账户被判未耗尽**
  * (与 core `FileUsageWindowStore` 的 validateSlots/validateBuckets 同轴)。

package/dist/plugins/user-input-ledger-file.d.ts

@@ -15,7 +15,7 @@ export declare class MemoryUserInputLedgerStore implements UserInputLedgerStore
     listOpen(after?: OpenScanCursor, limit?: number): Promise<OpenScanPage>;
     listCrashed(sessionId: string): Promise<UserInputAcceptance[]>;
     listUnannounced(sessionId: string, limit: number): Promise<UserInputAcceptance[]>;
-    /** S-965:会话树删除 = 一行会话级墓碑(守卫:该会话此刻有行 ⇒ 落;否则零写、回 0)。写抛 ⇒ 原样抛(协调器据此不删会话本体)。 */
+    /** [ref]:会话树删除 = 一行会话级墓碑(守卫:该会话此刻有行 ⇒ 落;否则零写、回 0)。写抛 ⇒ 原样抛(协调器据此不删会话本体)。 */
     deleteBySession(sessionId: string): Promise<number>;
 }
 /** local 车道(File)孪生。 */

package/dist/plugins/user-input-ledger-sql.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-928 用户输入受理账本的 **SQL** 孪生(单文件双方言,[ref] A12 收拢形;两条语句并排写死,方言差异显式)。
+ * [ref] 用户输入受理账本的 **SQL** 孪生(单文件双方言,[ref] A12 收拢形;两条语句并排写死,方言差异显式)。
  * 语义属主 = `src/user-input-ledger.ts`;File / Memory 两只在 `user-input-ledger-file.ts`。四只孪生吃同一组试剂盒断言
  * (`test/helpers/user-input-ledger-kit.ts`;本孪生的真双库腿在 `test/store-contract-kit-db-integration.test.ts`)。
  *
@@ -13,12 +13,12 @@
  * 无 owner / principal / scope 列(行随它挂靠的会话走 —— 收编形Ⅲ);`writer` 是受理进程的 `instanceId`(随进程消亡,不是租户轴)。
  * 行里不存输入正文(只有身份与时刻)。
  *
- * ## 会话树删除(S-965)
+ * ## 会话树删除([ref])
  * `deleteBySession` = `DELETE … WHERE session_id = ?`(真删行;File 孪生是一行会话级墓碑,同义)。两条删会话树的级联各有一臂:在线删除协调器
  * 经本动词;托管留存的事务化孪生(`retention-store-sql.ts` `purgeSessionTrees` ④)在**自己的事务**里对本表发同一只谓词(`session_id` 单键,
  * 多值集合按方言)—— 它不调店,理由见该文件顶注的布局裁定(一个事务 ⇒ 一条连接 ⇒ 一个属主)。谓词走 `(session_id, state, accepted_at_ms)` 索引的前缀。
  *
- * ## 读不出的行(S-969 L6):逐行跳过,游标按原始行推进
+ * ## 读不出的行([ref] L6):逐行跳过,游标按原始行推进
  * 三只读口都按 `state` 列取行(`= 'open'` / `= 'converged'`),所以 `state` 词表外的行任何读口都取不到;被取到的行上读不出的列 —— `input_kind`
  * 词表外(新版本写的输入族:滚动发布 / 回滚的混版窗)、收敛行缺 `state_at_ms` —— 由 {@link readRows} 逐行跳过 + 计 F 类 tag
  * `server.user-input-ledger.corrupt-record-skipped`(File 孪生重放坏行的同一只登记座),其余行照交。修前一行读不出 ⇒ 整页抛:收敛断点不前进

package/dist/plugins/web-search.d.ts

@@ -5,7 +5,7 @@
  *
  * Multi-provider, picked by `WEB_SEARCH_PROVIDER`:
  *   - `brave`   — Brave Web Search API (GET, `X-Subscription-Token` header); with `WEB_SEARCH_ENDPOINT` set to a
- *                 Brave-compatible gateway's full search URL (e.g. a self-hosted Nólë gateway, S-669) the same leg
+ *                 Brave-compatible gateway's full search URL (e.g. a self-hosted Nólë gateway, [ref]) the same leg
  *                 serves that backend — no new provider word, `capabilities.webSearch.backend` still reads `brave`
  *   - `tavily`  — Tavily Search API (POST, `Authorization: Bearer`, native include/exclude_domains)
  *   - `searxng` — a self-hosted SearXNG instance (GET `?format=json`, no auth)
@@ -54,6 +54,7 @@
  *    验证搜索配对不对。挂哪儿(boot 期一次性 warn / `/health` 子字段 / 显式端点)未定 ——
  *    注意 boot 期探活会给每次启动加一次出网,多租/离线部署要能关。
  */
+import { type UrlCredentialFacts } from "../url-credential.js";
 /**
  * Search providers this backend speaks —— **词表的唯一属主**(运行期与类型同一份)。
  * Absent `WEB_SEARCH_PROVIDER` ⇒ no backend ⇒ WebSearch is not assembled.
@@ -69,7 +70,7 @@
 export declare const WEB_SEARCH_PROVIDERS: readonly ["brave", "tavily", "searxng"];
 export type WebSearchProvider = (typeof WEB_SEARCH_PROVIDERS)[number];
 /**
- * S-382:`GET /v1/capabilities` 的 `webSearch` 位 —— **部署默认后端**的闭集自述。
+ * [ref]:`GET /v1/capabilities` 的 `webSearch` 位 —— **部署默认后端**的闭集自述。
  *
  * ## 病
  * 「这台 worker 的搜索走哪只后端」此前只在 operator 面可知(`GET /v1/config/catalog` 的
@@ -159,7 +160,7 @@ export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) =
 /**
  * Build the `WebSearchConfig` (a `search` fn + `maxResults`) for `assembleFullBodyTools({ webSearch })`. The API key
  * stays captured in this closure — it is never surfaced to the model or the tool args. Every error a leg throws leaves
- * through {@link redactedBackendFailure} (S-716 ③).
+ * through {@link redactedBackendFailure} ([ref] ③).
  */
 export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
 /**
@@ -195,7 +196,7 @@ export declare function webSearchConfigFromEnv(env?: NodeJS.ProcessEnv): WebSear
  *  · `absent`    —— 没带(或 `null`)⇒ 用部署后端;
  *  · `honored`   —— 每个字段形对,且 `provider` 点名了一只本部署会说的后端 ⇒ 这次调用用它;
  *  · `malformed` —— 任一字段形错 ⇒ 受理面 400 `request.field_invalid`(`issue` 逐字点名字段)。
- * **`provider` 缺席或不在词表里也是形错**(S-199 主会话改判,codex 验修 V1 [high]):一段 `settings.webSearch` 就是
+ * **`provider` 缺席或不在词表里也是形错**([ref] 主会话改判,codex 验修 V1 [high]):一段 `settings.webSearch` 就是
  * 调用方在点名目的地(`endpoint` / `apiKey` 都挂在它点名的那只后端上),认不出就拒,不静默换成部署后端 —— 改判前
  * 这一形回落部署后端,`{provider:"searx", endpoint:<私有地址>}` 的查询于是发到了部署配的后端。env 腿的同一只
  * {@link isWebSearchProvider} 守卫对**部署**的词表外答「不装配」,那是部署自己的缺席,不是换别人的目的地。
@@ -210,9 +211,22 @@ export type RequestWebSearchVerdict = {
 } | {
     readonly kind: "honored";
     readonly config: WebSearchBackendConfig;
-} | {
+}
+/** `facts` = 拒体的机读位(`field` + `reason`;只有「endpoint 带凭据」这一族在场,与 MCP / A2A / http 钩子三座同一只铸点)。 */
+ | {
     readonly kind: "malformed";
     readonly issue: string;
+    readonly facts?: UrlCredentialFacts;
 };
 export declare function judgeRequestWebSearch(raw: unknown): RequestWebSearchVerdict;
+/**
+ * **fresh 提交门**读的判决([ref],受理面 `admission.ts` 独有):{@link judgeRequestWebSearch}(装配点读的那一只,续跑重放也走)+ 一条只属于新提交的 ——
+ * 采纳下来的 `endpoint` 带凭据(userinfo 一形已在上面的判官里拒,句子不变;这里补凭据名参数:名字在日志脱敏器凭据名表里的 query / fragment 参数)⇒ `malformed`,
+ * 拒句说出路,机读位 `field` + `reason` 与 MCP / A2A / http 钩子三座同一只铸点。
+ *
+ * 为什么不并进 {@link judgeRequestWebSearch}:那一只被装配点读(续跑重放存量 body),在那里答 `malformed` 的后果是「这次调用不装配 WebSearch」(见 `capabilities/scenarios.ts`)——
+ * 升级前停驻的任务会悄悄卸载这个工具,比不拒更糟;已落盘的字节也不因拒而消失。与 MCP 条目门 / A2A 对端门 / hooks matcher 判据同一条 `fresh` 限定律。
+ * 部署 env 的 `WEB_SEARCH_ENDPOINT` 同理不判:那是运维的配置,不进任何请求的停驻 ctx。
+ */
+export declare function judgeFreshRequestWebSearch(raw: unknown): RequestWebSearchVerdict;
 //# sourceMappingURL=web-search.d.ts.map

package/dist/plugins/web-search.js

@@ -2,6 +2,7 @@ import { validateHeaderValue } from "node:http";
 import { createSearxngSearchBackend } from "@sema-agent/core";
 import { isHierarchicalUrl } from "@sema-agent/settings-schema";
 import { redactSecrets } from "../trace/redact.js";
+import { buildRequestUrlCredentialRefusal, findUrlCredential, findUrlUserinfo, urlCredentialFacts } from "../url-credential.js";
 export const WEB_SEARCH_PROVIDERS = ["brave", "tavily", "searxng"];
 function isWebSearchProvider(word) {
     return WEB_SEARCH_PROVIDERS.includes(word);
@@ -201,8 +202,8 @@ function judgeEndpoint(raw) {
         return ABSENT;
     if (!isHierarchicalUrl(raw))
         return { ok: false, issue: ENDPOINT_FORM };
-    const url = new URL(raw);
-    return url.username !== "" || url.password !== "" ? { ok: false, issue: ENDPOINT_USERINFO } : { ok: true, value: raw };
+    const credential = findUrlUserinfo(raw);
+    return credential !== undefined ? { ok: false, issue: ENDPOINT_USERINFO, credential } : { ok: true, value: raw };
 }
 const COUNT_FORM = "must be a number ≥ 1";
 function judgeCount(raw) {
@@ -320,8 +321,10 @@ export function judgeRequestWebSearch(raw) {
         maxResults: judgeCount(s.maxResults),
     };
     for (const [field, j] of Object.entries(fields)) {
-        if (!j.ok)
-            return { kind: "malformed", issue: `settings.webSearch.${field} ${j.issue}` };
+        if (!j.ok) {
+            const at = `settings.webSearch.${field}`;
+            return { kind: "malformed", issue: `${at} ${j.issue}`, ...(j.credential === undefined ? {} : { facts: urlCredentialFacts(at, j.credential) }) };
+        }
     }
     return {
         kind: "honored",
@@ -333,4 +336,16 @@ export function judgeRequestWebSearch(raw) {
         }),
     };
 }
+const ENDPOINT_CREDENTIAL_EXIT = "settings.webSearch.apiKey is stored sealed: send the credential as settings.webSearch.apiKey (brave and tavily send it as a request header; " +
+    "the searxng backend sends no credential from a request, so a searxng instance that needs one is declared in the deployment's WEB_SEARCH_ENDPOINT instead)";
+export function judgeFreshRequestWebSearch(raw) {
+    const verdict = judgeRequestWebSearch(raw);
+    if (verdict.kind !== "honored" || verdict.config.endpoint === undefined)
+        return verdict;
+    const credential = findUrlCredential(verdict.config.endpoint);
+    if (credential === undefined)
+        return verdict;
+    const refusal = buildRequestUrlCredentialRefusal("settings.webSearch.endpoint", credential, ENDPOINT_CREDENTIAL_EXIT);
+    return { kind: "malformed", issue: refusal.message, facts: refusal.facts };
+}
 //# sourceMappingURL=web-search.js.map

package/dist/{orchestration/workflow-journal-entry.d.ts → plugins/workflow-journal-payload.d.ts}

@@ -1,5 +1,6 @@
 /**
- * S-185(core 7.10.0 [ref] / B-049)—— `WorkflowJournalEntry` **两臂**的单点读写。
+ * [ref](core 7.10.0 [ref] / [ref])—— `WorkflowJournalEntry` **两臂**的单点读写;`workflow_journal.result` 这一列的**单一属主叶**(写腿编码、读腿解码与判官
+ * 都在这里 —— SQL 店与 journal HTTP 读面的 SQL 分页腿共读,core 7.55.0 T3 起从 `orchestration/workflow-journal-entry.ts` 搬到列属主的家)。
  *
  * core 7.10.0 把 journal 记录从一个 interface 换成了判别联合:
  *   `{ callKey, result }`  —— 这一序数的子代跑完了,`result` 是它的 `TaskResult`;
@@ -15,17 +16,17 @@
  * 承重记录**——而 journal 是 LOAD-BEARING(丢一条 = 一次已完成的子代被当成没跑过而重跑,外部副作用重复)。
  * 收敛到这里之后,第三臂到货 ⇒ 本文件**一处**编译红。
  *
- * 🔴 **park 臂的形是 fail-closed 的**:core 的类型要求 `parked.terminal.kind === "paused"`。从盘上读回来的
- * 字节没有类型,所以 {@link readJournalRowBody} 在铸 park 臂时**亲验**这一位,不合就判坏——它是 LOAD-BEARING
- * 面上的坏行(一条说自己 park 了却拿不出暂停终局的记录,既不能驱动、也不能当成跑完),吞掉它会让 resume
- * 在一个被钉住的子代 session 旁边重新起一只活跑,正是 core 那条「一次性、响亮」的 schema 台阶要防的形。
+ * 🔴 **读回一行的判官是 core 的那一只**(core 7.55.0 [ref] T3 `readWorkflowJournalEntry`):从盘上读回来的字节没有类型,一条
+ * 「说自己 park 了却拿不出带令牌的暂停终局」的记录、一条完成臂不是对象的记录,既不能驱动、也不能当成跑完 —— 吞掉它会让 resume 在一个被
+ * 钉住的子代 session 旁边重新起一只活跑。本仓此前自判 park 臂的 `terminal.kind`(漏了 checkpoint 令牌那一条);现在本仓只做**信封解码**
+ * ({@link journalLogicalRow}:`{"parked": …}` 判别位活在载荷里),臂的判定全交 core,坏行 ⇒ `WorkflowJournalIncompatibleError`
+ * (码 `workflow.journal_incompatible`,点名序数)—— core 的两只内置 journal 与它的店契约盒对坏行要的就是这一只拒绝。
  *
  * 🔴 **盘上的编码是那道台阶的一部分**,不是实现细节:见 {@link journalRowPayloadOf} 的顶注(park 载荷走
  * `{"parked": …}` 信封,好让**回滚/混版**的老读者拿到一个没有 `terminal` 的对象、落进 core 的响亮拒绝臂,
  * 而不是把一个暂停终局当成可重放结果)。
  */
-import type { TaskResult, WorkflowJournalEntry } from "@sema-agent/core";
-import type { JsonColumnReader } from "../plugins/sql-json-column.js";
+import { type TaskResult, type WorkflowJournalEntry } from "@sema-agent/core";
 /** park 臂的载荷型(core 的 `WorkflowJournalEntry` park 成员逐字):一只 `terminal` 收敛到 `paused` 的 `TaskResult`。 */
 export type ParkedTaskResult = TaskResult & {
     terminal: Extract<TaskResult["terminal"], {
@@ -64,33 +65,23 @@ export declare function journalEntryPayload(entry: WorkflowJournalEntry): {
  */
 export declare function journalRowPayloadOf(entry: WorkflowJournalEntry): string;
 /**
- * 盘上一行 payload 的**形读者**(S-550 车③a:`workflow_journal.result` 这一列的唯一判据)。
- *
- * 判别式 = 解出来的对象上有没有**自有** `parked` 键。它与 `TaskResult` 结构上不相交(core 的 `TaskResult`
- * 没有这个成员),所以历史字节(裸 TaskResult)恒判 result 臂 —— 不需要任何「老字节 = result」的兼容规则,
- * 判别式自己就说清了。
- *
- * park 臂验 `terminal.kind === "paused"`;不合 ⇒ 判坏,由 LOAD-BEARING 的读腿把它当店故障传上去。
- * 一条「说自己 park 了却拿不出暂停终局」的行既驱动不了、也不能当跑完,吞掉它会让 resume 在被钉住的子代
- * session 旁边重新起一只活跑 —— 与 {@link journalRowPayloadOf} 那道信封屏障要防的是同一件事。
- *
- * 🔴 **「一只 JSON 对象」这一条也必须判**(S-550):此前回装点是裸 `JSON.parse` + `as TaskResult`,于是
- * 一行 `null` 字面 / JSON 字符串标量 / 双重编码的 `result` 会被当成一条**合法的已完成记录**端给 resume
- * (`{callKey, result: null}`)—— 那正是「一次已完成的子代被当成跑过而不再跑」与「一条坏行冒充跑完」
- * 两种最坏形的同一个入口。
+ * 盘上一行 payload 的**信封解码**(本仓唯一自判的部分;{@link journalRowPayloadOf} 的逆):载荷是一只对象且带**自有** `parked` 键 ⇒ 停驻臂(值 = 信封里那一份),
+ * 否则整份载荷是完成臂 —— `parked` 与 core 的 `TaskResult` 结构上不相交,所以历史字节(裸 TaskResult)恒判完成臂,不需要任何「老字节 = result」的兼容规则。
+ * 交出的是 core `readWorkflowJournalEntry` 要的**逻辑行**(`callKey` + 两臂之一);两臂里装的东西拿不拿得出续跑要读的(完成臂是对象 / 停驻臂是带令牌的
+ * paused 终局)归 core 判。
  */
-export declare const readJournalRowBody: JsonColumnReader<JournalRowBody>;
-/** {@link readJournalRowBody} 收窄出来的两臂(判别位已定,载荷已验形)。 */
-export type JournalRowBody = {
-    parked: true;
-    payload: ParkedTaskResult;
+export declare function journalLogicalRow(callKey: string, payload: unknown): {
+    readonly callKey: string;
+    readonly parked: unknown;
 } | {
-    parked: false;
-    payload: TaskResult;
+    readonly callKey: string;
+    readonly result: unknown;
 };
 /**
- * {@link journalRowPayloadOf} 的逆的**后半**:已解码、已验形的载荷 → 记录。**唯一**的铸点(SQL 店的 `load`
- * 与 HTTP journal 读面共读它;两处各自经 `decodeJsonColumn(text, readJournalRowBody, …)` 把文本收成这只体)。
+ * 一格 `workflow_journal.result` 读回一条记录的**唯一读法**(SQL 店的 `load` 与 HTTP journal 读面的 SQL 分页腿共读它):JSON 解码 → 信封解码
+ * ({@link journalLogicalRow})→ core `readWorkflowJournalEntry`。判官说坏 ⇒ 抛 `WorkflowJournalIncompatibleError`(码 `workflow.journal_incompatible`,
+ * 序数 = core 对 `callKey` 的解析;拒句是 core 判官的定句,不引存下的值)。读不成 JSON 的格是一条读不成对象的行(同判坏,同一只拒绝);
+ * 投影漏了的格(`not-text`,读腿写错)原样抛 —— 那是程序错,不是坏数据。
  */
-export declare function journalEntryOfBody(callKey: string, body: JournalRowBody): WorkflowJournalEntry;
-//# sourceMappingURL=workflow-journal-entry.d.ts.map
+export declare function journalEntryOfCell(runId: string, callKey: string, cell: unknown, where: string): WorkflowJournalEntry;
+//# sourceMappingURL=workflow-journal-payload.d.ts.map