@sema-agent/server 7.133.0 → 7.135.0

package/dist/session-sync-kernel.d.ts

@@ -6,10 +6,11 @@
  * symbols WITHOUT touching the orchestration module — session-sync.ts value-imports StoreBackend and type-imports
  * security's OwnerAwareSessionStore, so importing it from security.ts formed the repo's only true type cycle
  * (security ↔ session-sync; lens2 §B/§E). This file imports nothing from the repo but TYPES from leaves (core types, and
- * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
+ * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. Its one VALUE import is
+ * core's `SessionError` class (the closed-set store error the three adapters already throw). session-sync.ts re-exports everything here, so existing import sites
  * keep working unchanged.
  */
-import type { SessionTreeEntry } from "@sema-agent/core";
+import { SessionError, type SessionTreeEntry } from "@sema-agent/core";
 import type { SessionFace } from "./session-incarnation.js";
 /**
  * P1d-β (PUSH streaming, sema-internal server/docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
@@ -22,9 +23,10 @@ import type { SessionFace } from "./session-incarnation.js";
  *
  * Invariants the implementations uphold:
  *  - The staging rows live under `stagingId = ${realSessionId}#stg-${token}` (the `#` is illegal in a real uuidv7, so
- *    it can NEVER collide with a real session id) and have NO `session_meta` row → they are INVISIBLE to wake / ownerOf
- *    / listSessions (the existing orphan invariant) until `commit` writes the real session_meta LAST as the sole
- *    commit point. A crash before commit leaves only collectable orphan staging rows, never a half-session.
+ *    it can NEVER collide with a real session id) and have NO `session_meta` row → they are INVISIBLE to wake / the head read (`headOf`)
+ *    / listSessions (the existing orphan invariant) until `commit`'s transaction COMMITs the real session_meta row together
+ *    with the swap (the sole commit point; a fresh push claims that row first inside the same txn, invisible to everyone else
+ *    until COMMIT). A crash before commit leaves only collectable orphan staging rows, never a half-session.
  *  - `appendBatch` is IDEMPOTENT (INSERT … ON DUPLICATE KEY / ON CONFLICT DO NOTHING on the `(session_id, entry_id)`
  *    uk), so a re-streamed batch (a resumed Phase B) is a no-op.
  *  - `commit` re-classifies the relation IN-TXN against the dst's CURRENT entry ids (closing the Phase-A plan→commit
@@ -38,23 +40,48 @@ export interface StagingHandle {
     /** Append a bounded batch of entries to the staging id, re-seq'd dense from a running counter held in the handle.
      *  Idempotent (ON DUPLICATE KEY / ON CONFLICT DO NOTHING) — a re-streamed batch is a no-op. One txn per batch. */
     appendBatch(entries: SessionTreeEntry[]): Promise<void>;
-    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): in-txn re-classify (TOCTOU close) → purge dst
-     *  → row-key rename staging→real → session_meta LAST (the commit point). `owner` is re-stamped (§9). Throws
-     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation **and the settled session
+    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): owner CAS ({@link StagedCommitOptions.expectedOwner},
+     *  before anything about the row is classified or reported, so a refused commit reveals nothing about a row it did not judge — no
+     *  placement, no relation, no entry ids) → in-txn re-classify
+     *  (TOCTOU close) → purge dst → row-key rename staging→real → session_meta settled; COMMIT is the commit point. `owner` is re-stamped (§9).
+     *  Throws {@link StagedCommitOwnerChangedError} when the owner cell is not the one the import's gate judged, and
+     *  {@link SyncConflictError} on an unconsented fork/stale flip — both after rolling back. Returns the committed relation **and the settled session
      *  face** — the occupant (owner + incarnation) the commit left in the real session id, read INSIDE the same txn (the local
      *  store: the same hold of the session's write lock), never re-read afterwards. The post-commit replays conditioned on the
      *  occupant (the session row's two bits) write on exactly this face — a session deleted and re-created after the commit,
      *  even by the same owner, is a different occupant and is not written. A row without an incarnation is refused at that read
      *  (`sessionFaceFromRow`, the same law as every face read). */
-    commit(owner: string | null, opts?: {
-        resolution?: "overwrite-dst";
-    }): Promise<{
+    commit(owner: string | null, opts: StagedCommitOptions): Promise<{
         relation: SyncRelation["relation"];
         face: SessionFace;
     }>;
     /** Drop the staging rows (Phase B aborted before commit) — DELETE the staging-id session_event rows. Idempotent. */
     abort(): Promise<void>;
 }
+/**
+ * What a staged commit is conditioned on ([ref] — one gate predicate, two phases). `expectedOwner` = the owner cell the import's gate
+ * judged when it opened the staging, in the head-read reading (`headOf(id)?.owner`): `undefined` = no such session (a fresh push), `null` = ownerless, a string =
+ * that owner. The route judges `mayTouch` on that cell at Phase A and again on the session's current cell right before Phase B commits; the
+ * commit itself lands only on that same cell — each store compares it inside the commit txn (local: inside the session's write lock) and, when
+ * the cell differs, rolls back and throws {@link StagedCommitOwnerChangedError} without writing a byte. The compare is on the owner cell, not
+ * on the incarnation: the gate's predicate reads only the owner (plus placement, which the commit gate refuses on its own), so a same-owner
+ * re-create is judged the same and is not a reason to refuse.
+ */
+export interface StagedCommitOptions {
+    readonly expectedOwner: string | null | undefined;
+    readonly resolution?: "overwrite-dst";
+}
+/**
+ * The staged commit's owner CAS did not hold: the session's owner cell at commit time is not the one the import's gate judged (another replica
+ * deleted / re-created / claimed / created the session while the import streamed). Code = core's closed-set `conflict` (wire: the import face's
+ * row in `session-error-wire.ts`, 409); thrown after the commit txn rolled back — the destination is untouched. The three stores throw this one
+ * class (one sentence, minted here).
+ */
+export declare class StagedCommitOwnerChangedError extends SessionError {
+    constructor(sessionId: string);
+}
+/** The owner-cell comparison of {@link StagedCommitOptions.expectedOwner} against a store's own owner read (`headOf(id)?.owner`; `undefined` = no row). */
+export declare function ownerCellIs(expectedOwner: string | null | undefined, actual: string | null | undefined): boolean;
 /** A session store that can stage a streamed import (P1d-β). The 3 backends implement it; the in-memory dev store
  *  does not → the method is optional (the route 501s when absent, parity with the other §0.5 optional seams). */
 export type ImportStagingStore = {

package/dist/session-sync-kernel.js

@@ -1,3 +1,13 @@
+import { SessionError } from "@sema-agent/core";
+export class StagedCommitOwnerChangedError extends SessionError {
+    constructor(sessionId) {
+        super("conflict", `session ${sessionId}: owner changed while the import streamed — the staged commit was rolled back`);
+        this.name = "StagedCommitOwnerChangedError";
+    }
+}
+export function ownerCellIs(expectedOwner, actual) {
+    return expectedOwner === undefined ? actual === undefined : actual !== undefined && (actual ?? null) === expectedOwner;
+}
 export function stagingIdFor(realSessionId, token) {
     return `${realSessionId}#stg-${token}`;
 }

package/dist/session-sync.d.ts

@@ -45,12 +45,31 @@
  */
 import type { StoreBackend } from "./plugins/store-backend.js";
 import { type SyncRelation } from "./session-sync-kernel.js";
-import { type SessionTreeEntry, type SessionRulesRecord, type FileHistoryExport, type FileHistoryResult, type SessionPermissionRules, type StoredSessionRules, type SessionPolicyStore } from "@sema-agent/core";
+import { type SessionTreeEntry, type SessionRulesRecord, type FileHistoryError, type FileHistoryExport, type FileHistoryResult, type SessionPermissionRules, type StoredSessionRules, type SessionPolicyStore } from "@sema-agent/core";
 import type { ServiceFileHistoryStore, ServiceSessionPolicyStore, ResumeAnchorStore } from "./plugins/store-backend.js";
+/**
+ * core 7.55.0 [ref] T2([ref]):一只会话的文件历史**读不全**(撕裂 / 读不出的边界、读不出的跟踪集 —— 店的 `exportHistory` 答 `{ ok: false }`,`adopt_failed`
+ * 带店判的 `permanence`)。它**不是**「没有历史」:读成 `null` 的同步会把这只会话的全部 rewind 历史丢在路上、还答成功。会话同步的两只拉取口
+ * (manifest、history blob)对它答同一句 503 `state.file_history_unreadable`(路由 `sendFileHistoryUnreadable`)。
+ */
+export declare class FileHistoryUnreadableError extends Error {
+    readonly sessionId: string;
+    readonly failure: FileHistoryError;
+    readonly code = "state.file_history_unreadable";
+    constructor(sessionId: string, failure: FileHistoryError);
+}
+/**
+ * 一只会话的文件历史导出 —— `exportHistory` 三臂的**唯一读法**(会话同步两只拉取口都经它):`{ ok: true, history }` ⇒ 信封;`{ ok: true, history: null }`
+ * ⇒ `null`(没有可导出的,null 的唯一意思);`{ ok: false }` ⇒ 抛 {@link FileHistoryUnreadableError}(读不全不是没有)。店不带 `exportHistory` ⇒ 不是 2c 历史源 ⇒ `null`。
+ */
+export declare function exportedFileHistory(store: Pick<ServiceFileHistoryStore, "exportHistory">, sessionId: string): Promise<FileHistoryExport | null>;
 /** A blob getter: content-addressed bytes for a sha256 hash, or `undefined` if the source can't supply them.
  *  Returned by {@link exportSessionManifest} (closes over the source store); consumed wherever a caller pulls
  *  content-addressed history bytes lazily (the live PUSH route's `importHistory` replay). */
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
+/** 一只文件历史店自己的 blob 取值口({@link BlobGetter}):店带 `getBlob` ⇒ 绑在店上;没有这条面(core 的 local 文件店)⇒ 恒答 `undefined`(「这里取不到」)。
+ *  拉取面(manifest 的 `getBlob`)、identical 自愈臂、提交臂三处读同一只,不各写一份「无面则 undefined」。 */
+export declare function blobGetterOf(store: Pick<ServiceFileHistoryStore, "getBlob">): BlobGetter;
 /** The history-import capability face of a `FileHistoryStore` (`importHistory` is OPTIONAL on the core
  *  contract — a store without it cannot be a 2c history sink). */
 export interface FileHistoryImportFace {
@@ -61,6 +80,21 @@ export interface FileHistoryImportFace {
  *  `undefined` when absent. Callers gate on the RETURN VALUE, not a separate `typeof` check, so there is
  *  exactly one place that knows the shape of the probe. */
 export declare function fileHistoryImportFace(fs: unknown): FileHistoryImportFace | undefined;
+/**
+ * {@link replayFileHistory} 的结果 = 店的 {@link FileHistoryResult};失败臂可再带 `missingBlob` —— 这一次尝试里**重放自己交给店的 getter 亲口答过 `undefined`** 的那枚 hash
+ * (「这枚 blob 不在」是 getter 观察到的事实,不是从店码里猜的:同一个 `adopt_failed` 也可能是取值抛了 / 发布步撞上库的故障,那两形 `missingBlob` 缺席)。
+ * 下发口({@link sendFileHistoryReplayFailure} 在路由里)据它铸 wire `missing_blob`,否则原样送店的码。
+ */
+export type FileHistoryReplayResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: FileHistoryError;
+    readonly missingBlob?: string;
+};
+export type FileHistoryReplayFailure = Extract<FileHistoryReplayResult, {
+    ok: false;
+}>;
 /**
  * The 2c PUSH replay of a session's file-history graph — keep-SOURCE convergence over core's
  * non-destructive-target law. `importHistory` refuses a target that already holds a DIFFERENT graph
@@ -75,10 +109,14 @@ export declare function fileHistoryImportFace(fs: unknown): FileHistoryImportFac
  * is left EMPTY — worse than the moment before this call, but strictly self-healing: the client re-PUTs
  * the blob and re-POSTs, and the retry lands on an empty target (importHistory's first-import arm).
  * The alternative (keeping the old graph) would wedge every retry on the same typed conflict forever.
+ *
+ * 缺 blob 的事实只在这里读一次:每次尝试给店的 getter 都包一层观察,店取到 `undefined` 就记下那枚 hash(按次计,替换臂的第二次尝试从空白起),
+ * 失败时随结果交出({@link FileHistoryReplayResult.missingBlob})。预检({@link sessionSyncFileHistory} 事实 + `hasBlobs`)管「这台部署根本收不到 / 索引里没有」,
+ * 这里管「预检过了而这一枚取不到」(对象存储里已丢 / 校验和不符按缺席读 / 预检与重放之间被孤儿回收清走)—— 同一只不变量的两端,wire 上同一个词。
  */
 export declare function replayFileHistory(store: ServiceFileHistoryStore, scope: string, envelope: FileHistoryExport, srcGetBlob: BlobGetter, opts: {
     allowReplace: boolean;
-}): Promise<FileHistoryResult>;
+}): Promise<FileHistoryReplayResult>;
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its
@@ -147,7 +185,7 @@ export interface SessionManifest {
  * with the history store's own export verb.)
  */
 export declare function exportSessionManifest(sessionId: string, srcBackend: StoreBackend, 
-/** S-589:文件历史读**装配结果**(捕获脸),不直取 `srcBackend.fileHistory()` —— 「这台部署有没有文件历史店」
+/** [ref]:文件历史读**装配结果**(捕获脸),不直取 `srcBackend.fileHistory()` —— 「这台部署有没有文件历史店」
  *  只在 `assembleFileHistory` 判一次。同一个后端铸的同一只店,四店同源的不变式不变。 */
 historyStore: ServiceFileHistoryStore): Promise<{
     manifest: SessionManifest;
@@ -165,14 +203,19 @@ export declare function planSync(sessionId: string, srcBackend: StoreBackend, ds
  *  无条件写都 rev+1,而 rev 是 operator 乐观锁的 CAS 令牌(`PutRulesOptions.expectedRev`),
  *  幂等重试/无害重复同步不该把在途 CAS 打失败。归一化用 core 的 `normalizeRules`(store 落盘
  *  前走同一函数 ⇒ 两侧同坐标);它略过店的戳 `rev` / `gen`(`listBySession` 的 rules 含 rev,
- *  它不是内容;core 7.51.0 #1474 起 `normalizeRules` 自己略过,修前的 `stripRev` 包裹随之退役)。
+ *  它不是内容;core 7.51.0 [ref] 起 `normalizeRules` 自己略过,修前的 `stripRev` 包裹随之退役)。
  *  两侧过的是同一只形读法(core 7.51.0 `readSessionRulesShape`):`incoming` 由写口读者(引擎的写口判官)交出,`stored` 由店的读回交出 ——
  *  店读回读不出形的行答 `corrupt`、根本到不了这里,所以 `normalizeRules` 对两侧都不抛(修前本仓的读回比引擎宽,另有一只判官先挡一次)。
  *  🔴 字节同 ≠ 意思同(core 7.51.2 行自带文法戳;codex r1 [high] 验真):`normalizeRules` 把店的戳 `rev` / `gen` / `grammar` 都略过,而同一串桶字节在两种文法里是两句话 ——
  *  目的行无戳(文法 0:`toolAllow` 里的 `Bash(rm:*)` 什么都不放行)、导入记录带 `grammar: 1`(放行 rm),只比字节会判「同内容」、零次 putRules、同步答 200 而目的行仍是旧意思。
  *  所以字节同之外还问引擎的收紧比对 `loosenReasons` **双向**(两侧各在自己的文法里读:`stored` 带 `rev`,`incoming` 带 `grammar`):两个方向都「没放宽」才是同一句话;
- *  意思不同就交给 `putRules` 的判官(非 operator ⇒ `loosen_forbidden`;operator ⇒ 改写成当前文法、盖戳)。本仓仍零处读 / 比戳值;意思由引擎说。 */
-export declare function sameRulesContent(stored: StoredSessionRules | null, incoming: SessionPermissionRules): boolean;
+ *  意思不同就交给 `putRules` 的判官(非 operator ⇒ `loosen_forbidden`;operator ⇒ 改写成当前文法、盖戳)。本仓仍零处读 / 比戳值;意思由引擎说。
+ *  🔴 core 7.55.0 [ref]:行还有一格 **operator 部分**(`StoredSessionRules.operatorRules`:非 operator 的写只能收回非 operator 写加上去的东西;缺席 = 整行归 operator)。
+ *  桶同、意思同,这一次写仍可能挪动它 —— operator 重放把整行变成 operator 的(引擎写口判官的答:operator 写的值整只归 operator)。只比桶会判「同内容」⇒ 零次 putRules ⇒
+ *  属主盖过戳的目的行保持「属主收得回」,源端 operator 断言过的条目在目的端被属主一条非 operator 的写收回(安全轴的静默放宽)。所以第三问:这一次写之后的部分
+ *  = 引擎写口判官对(目的行, 记录, 这次重放的态度)的答,与目的行现有的部分按同一读法(缺席 = 整行)比;不同就交给 `putRules`。判官拒 ⇒ 原样上抛(`putRules` 会拒同一句)。
+ *  `operator` 必填:同一份记录在 operator 与非 operator 的重放下是两种写(漏传是编译错,不是一条静默的读法)。 */
+export declare function sameRulesContent(stored: StoredSessionRules | null, incoming: SessionPermissionRules, operator: boolean): boolean;
 /** [ref] ① 的重放腿共享实现:PUSH 路由的两条 policy 重放腿(Phase A identical 短路支 / Phase B
  *  commit 后支)都从这里走 —— 等内容跳过(rev 零漂移),真变更照常落地(E6 tighten-only 门在
  *  putRules 内部,此处不重述)。 */

package/dist/session-sync.js

@@ -1,5 +1,30 @@
 import { classifySyncRelationship } from "./session-sync-kernel.js";
 import { loosenReasons, normalizeRules } from "@sema-agent/core";
+import { headReadOf } from "./session-incarnation.js";
+import { judgeSessionRulesWrite } from "@sema-agent/core";
+export class FileHistoryUnreadableError extends Error {
+    sessionId;
+    failure;
+    code = "state.file_history_unreadable";
+    constructor(sessionId, failure) {
+        super(`file history of session ${sessionId} cannot be read whole (${failure.code}): ${failure.message}`);
+        this.sessionId = sessionId;
+        this.failure = failure;
+        this.name = "FileHistoryUnreadableError";
+    }
+}
+export async function exportedFileHistory(store, sessionId) {
+    if (typeof store.exportHistory !== "function")
+        return null;
+    const exported = await store.exportHistory(sessionId);
+    if (!exported.ok)
+        throw new FileHistoryUnreadableError(sessionId, exported.error);
+    return exported.history;
+}
+export function blobGetterOf(store) {
+    const get = store.getBlob?.bind(store);
+    return get ? (hash) => get(hash) : async () => undefined;
+}
 export function fileHistoryImportFace(fs) {
     const candidate = fs?.importHistory;
     if (typeof candidate !== "function")
@@ -11,10 +36,21 @@ export async function replayFileHistory(store, scope, envelope, srcGetBlob, opts
     if (face === undefined) {
         return { ok: false, error: { code: "unsupported_format", message: "this deployment's file-history store has no importHistory seam" } };
     }
-    let r = await face.importHistory(scope, envelope, srcGetBlob);
+    const attempt = async () => {
+        let missing;
+        const observed = async (hash) => {
+            const bytes = await srcGetBlob(hash);
+            if (bytes === undefined && missing === undefined)
+                missing = hash;
+            return bytes;
+        };
+        const r = await face.importHistory(scope, envelope, observed);
+        return r.ok || missing === undefined ? r : { ok: false, error: r.error, missingBlob: missing };
+    };
+    let r = await attempt();
     if (!r.ok && r.error.code === "conflict" && opts.allowReplace && typeof store.deleteBySession === "function") {
         await store.deleteBySession(scope);
-        r = await face.importHistory(scope, envelope, srcGetBlob);
+        r = await attempt();
     }
     return r;
 }
@@ -29,10 +65,10 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
     const entryIds = await listEntryIds(sessionId);
     if (entryIds === null)
         return null;
-    const getLeafId = session.getLeafId?.bind(session);
-    const leafId = getLeafId ? await getLeafId(sessionId) : null;
+    const headOf = headReadOf(session);
+    const leafId = headOf ? ((await headOf(sessionId))?.leafId ?? null) : null;
     const fs = historyStore;
-    const fileHistory = typeof fs.exportHistory === "function" ? await fs.exportHistory(sessionId) : null;
+    const fileHistory = await exportedFileHistory(fs, sessionId);
     const policyStore = srcBackend.sessionPolicy();
     const policy = typeof policyStore.listBySession === "function"
         ? await policyStore.listBySession(sessionId)
@@ -43,8 +79,7 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
     if (summaryOf === undefined)
         throw new Error("exportSessionManifest: the session store has no row read face (sessionSummaryOf) — the sessionSync fact should have refused this deployment");
     const row = await summaryOf(sessionId);
-    const getBlobFn = fs.getBlob?.bind(fs);
-    const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;
+    const getBlob = blobGetterOf(fs);
     return {
         manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors, ...(row !== undefined ? { title: row.title, pinned: row.pinned } : {}) },
         getBlob,
@@ -57,18 +92,25 @@ export async function planSync(sessionId, srcBackend, dstBackend) {
     const dstEntries = (await ownerAware(dstBackend).exportEntries?.(sessionId)) ?? null;
     return classifySyncRelationship(srcEntries, dstEntries);
 }
-export function sameRulesContent(stored, incoming) {
+export function sameRulesContent(stored, incoming, operator) {
     if (stored === null)
         return false;
     const norm = (r) => JSON.stringify(normalizeRules(r));
     if (norm(stored) !== norm(incoming))
         return false;
-    return loosenReasons(stored, incoming).length === 0 && loosenReasons(incoming, stored).length === 0;
+    if (loosenReasons(stored, incoming).length !== 0 || loosenReasons(incoming, stored).length !== 0)
+        return false;
+    return operatorPartUnmoved(stored, incoming, operator);
+}
+function operatorPartUnmoved(stored, incoming, operator) {
+    const next = judgeSessionRulesWrite(stored, incoming, { operator });
+    const partOf = (row) => JSON.stringify(normalizeRules(row.operatorRules ?? row));
+    return partOf(next) === partOf(stored);
 }
 export async function replayPolicyRecords(store, sessionId, records, operatorOk) {
     for (const rec of records) {
         const cur = await store.getRules(sessionId, rec.principal);
-        if (sameRulesContent(cur, rec.rules))
+        if (sameRulesContent(cur, rec.rules, operatorOk))
             continue;
         await store.putRules(sessionId, rec.principal, rec.rules, { operator: operatorOk });
     }

package/dist/session-titler.d.ts

@@ -27,10 +27,6 @@
 import type { HookLlmFailureCode } from "./hooks/hook-runner.js";
 import { type SessionTitledFrame } from "./session-titled-frame.js";
 export interface SessionTitlerDeps {
-    /** Secret scrub applied to the RAW llm text before sanitize/persist (workflow audit 2026-07-13: the
-     *  objective may carry a pasted secret and the model can echo it into the title — titles are persisted,
-     *  listed over HTTP, and logged, all outside the trace redact pipeline; wire src/trace/redact.ts here). */
-    redact?: (text: string) => string;
     /** Write-once store leg (SQL twins / local sidecar). Resolves false when a title already existed. */
     setTitleIfNull(sessionId: string, title: string): Promise<boolean>;
     /** Cheap pre-LLM probe: "titled" = skip (a restart/evicted-seen/another replica
@@ -68,8 +64,13 @@ export interface SessionTitler {
      *  已有标题 / 竞态输了 / 模型失败 / 空标题 / 这个会话已有一次在飞的调用,都不调。回调同步执行、**不许抛**;抛了也不影响已落行的标题(见下 `frame_failed`)。 */
     maybeTitle(sessionId: string, objective: string, model?: string, onTitled?: (frame: SessionTitledFrame) => void): void;
 }
-export declare const TITLE_MAX_CHARS = 80;
-/** Single line, control chars stripped, hard cap; surrounding quotes (a common LLM tic) trimmed. */
+/** 标题的显示预算(码元,含截断记号)—— 界的属主是出口座的 `session-title` 行,这里读它;落在 `title` 列宽 `SESSION_TITLE_MAX_CHARS`(session-row.ts)之内。 */
+export declare const TITLE_MAX_CHARS: number;
+/**
+ * 模型回的标题 → 落行的标题:**经出口座的 `session-title` 行**([ref])—— 脱敏(按单行出门形读:被控制字符拆开、被换行拆开的令牌都读过)→ 渲染 →
+ * 单行化(换行折成空格、剥控制与双向字符、去首尾空白与首尾引号)→ 按记号边界截到 {@link TITLE_MAX_CHARS} 码元(含 `…`)。
+ * 此前是「可选注入的脱敏 → 剥 → 截」三步各在一处:没注入就不脱;剥在脱之后,BEL 拆开的令牌两半在剥时拼回整枚;截在脱之后,界切进记号留半枚。
+ */
 export declare function sanitizeTitle(raw: string): string;
 export declare function buildTitlePrompt(objective: string): string;
 export declare function createSessionTitler(deps: SessionTitlerDeps): SessionTitler;

package/dist/session-titler.js

@@ -1,13 +1,11 @@
-import { stripControlAndBidi } from "@sema-agent/settings-schema";
 import { recordFailOpen } from "./observability/fail-open.js";
-import { redactSecrets } from "./trace/redact.js";
+import { seatMaxChars, seatText } from "./trace/exit-seat.js";
 import { userAuthoredText } from "./user-authored-text.js";
 import { buildSessionTitledFrame } from "./session-titled-frame.js";
-export const TITLE_MAX_CHARS = 80;
+export const TITLE_MAX_CHARS = seatMaxChars("session-title");
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
 const NO_ROW_RETRY_MS = 20_000;
-const FAIL_CAUSE_KEY_CHARS = 80;
 const SEEN_CAP = 10_000;
 function failOpenTagFor(code) {
     switch (code) {
@@ -30,9 +28,7 @@ function failOpenTagFor(code) {
     }
 }
 export function sanitizeTitle(raw) {
-    const oneLine = stripControlAndBidi(raw.replace(/[\r\n]+/g, " ")).trim();
-    const unquoted = oneLine.replace(/^["'「『]+/, "").replace(/["'」』]+$/, "").trim();
-    return unquoted.length > TITLE_MAX_CHARS ? `${unquoted.slice(0, TITLE_MAX_CHARS - 1)}…` : unquoted;
+    return seatText("session-title", raw);
 }
 export function buildTitlePrompt(objective) {
     const text = userAuthoredText(objective);
@@ -46,11 +42,10 @@ export function buildTitlePrompt(objective) {
 }
 export function createSessionTitler(deps) {
     const seen = new Set();
-    const redactedError = (error) => redactSecrets(error);
     const logFailure = (sessionId, error, code) => {
-        const safe = redactedError(error);
-        deps.logger?.debug?.("session_title_failed", { sessionId, error: safe.slice(0, 200) });
-        recordFailOpen(failOpenTagFor(code), safe.slice(0, FAIL_CAUSE_KEY_CHARS));
+        const safe = seatText("operator-log-text", error);
+        deps.logger?.debug?.("session_title_failed", { sessionId, error: safe });
+        recordFailOpen(failOpenTagFor(code), safe);
     };
     const probeOrContinue = async (sessionId, continueWord) => deps
         .probeTitle(sessionId)
@@ -90,7 +85,7 @@ export function createSessionTitler(deps) {
                     logFailure(sessionId, r.error, r.code);
                     return;
                 }
-                const title = sanitizeTitle(deps.redact ? deps.redact(r.text) : r.text);
+                const title = sanitizeTitle(r.text);
                 if (!title) {
                     deps.metrics?.inc("session_title_total", { outcome: "empty" });
                     return;
@@ -112,7 +107,7 @@ export function createSessionTitler(deps) {
                     }
                     catch (e) {
                         deps.metrics?.inc("session_title_total", { outcome: "frame_failed" });
-                        deps.logger?.warn?.("session_titled_frame_failed", { sessionId, error: redactedError(String(e)).slice(0, 200) });
+                        deps.logger?.warn?.("session_titled_frame_failed", { sessionId, error: seatText("operator-log-text", String(e)) });
                     }
                 }
             })().catch((e) => {

package/dist/session-watch.d.ts

@@ -16,7 +16,7 @@
  *  - **冷启动 warm**:新条目 lastChangeAt=0(没观测到变化就不算热)——首拍一次 hotMs 快确认后即落
  *    warm 拍距,直到真观测到跳变才进热窗(codex:重连风暴下 256 会话×200ms=对存储的自造尖峰)。
  *
- * Deliberately backend-agnostic (tidb|pg|local all go through getLeafId — the seamless-local-cloud
+ * Deliberately backend-agnostic (tidb|pg|local all go through the session store's one by-id read `headOf` — the seamless-local-cloud
  * invariant): no PG LISTEN/NOTIFY specialization, no shared bus. Latest-wins semantics: subscribers
  * converge on the newest leafId; intermediate hops may be dropped (content still comes from tail faces).
  */
@@ -38,7 +38,7 @@ export declare class SessionWatchRegistry {
     /** 五轮复审:owner 与 leaf **同拍原子读**——探针每拍先核 owner(被删=undefined/换主=≠条目 owner
      *  ⇒ dropSession 断全部订阅者),匹配才应用 leaf。跨副本 reclaim 的披露窗从 25s 心跳收紧到
      *  ≤一个探针拍(hot 200ms/warm 2s),且旧流在新主推进**之前**先死(owner 检查先于 leaf 应用)。 */
-    private readonly getHead;
+    private readonly readHead;
     private readonly entries;
     private readonly hotMs;
     private readonly warmMs;
@@ -48,7 +48,7 @@ export declare class SessionWatchRegistry {
     /** 五轮复审:owner 与 leaf **同拍原子读**——探针每拍先核 owner(被删=undefined/换主=≠条目 owner
      *  ⇒ dropSession 断全部订阅者),匹配才应用 leaf。跨副本 reclaim 的披露窗从 25s 心跳收紧到
      *  ≤一个探针拍(hot 200ms/warm 2s),且旧流在新主推进**之前**先死(owner 检查先于 leaf 应用)。 */
-    getHead: (sessionId: string) => Promise<{
+    readHead: (sessionId: string) => Promise<{
         leafId: string | null | undefined;
         owner: string | null | undefined;
     }>, opts?: SessionWatchOptions);

package/dist/session-watch.js

@@ -5,14 +5,14 @@ export function posIntEnv(raw, fallback, max = 3_600_000) {
     return Number.isInteger(n) && n > 0 && n <= max ? n : fallback;
 }
 export class SessionWatchRegistry {
-    getHead;
+    readHead;
     entries = new Map();
     hotMs;
     warmMs;
     hotWindowMs;
     maxWatched;
-    constructor(getHead, opts) {
-        this.getHead = getHead;
+    constructor(readHead, opts) {
+        this.readHead = readHead;
         this.hotMs = opts?.hotMs ?? 200;
         this.warmMs = opts?.warmMs ?? 2000;
         this.hotWindowMs = opts?.hotWindowMs ?? 60_000;
@@ -109,7 +109,7 @@ export class SessionWatchRegistry {
             e.urgent = false;
             const revAtStart = e.rev;
             try {
-                const head = await this.getHead(sessionId);
+                const head = await this.readHead(sessionId);
                 if (this.entries.get(sessionId) !== e)
                     return;
                 if (head.owner === undefined || head.owner !== e.owner) {

package/dist/sighup-idle.d.ts

@@ -9,14 +9,14 @@
  *
  * 诚实边界:idle-but-live 的 peer(两 turn 之间静默超过窗口)会碰到引擎已退→壳 dead-respawn 1-2s 自愈
  * (伤害面从 mid-turn 斩降级为冷启动)。
- * S-1281:附着(打开着的 SSE 流)是判据的第二格 `attached` —— 只读订阅自此不进 inflight(排空不该等一个看着的壳),而一个只挂着订阅流的
+ * [ref]:附着(打开着的 SSE 流)是判据的第二格 `attached` —— 只读订阅自此不进 inflight(排空不该等一个看着的壳),而一个只挂着订阅流的
  * peer 壳(cli 附着形:`GET /v1/approvals/stream` 常开)仍然是「有人在用」,靠这一格不被当成孤儿。修前这一形是订阅流被算进 inflight
  * 时顺带挡住的;拆开之后两件事各有一格,规则不变:inflight = 0 ∧ attached = 0 ∧ 活性静默满窗才关。
  */
 export interface SighupIdleDeps {
     /** This replica's in-flight legs (drainState.inflight). */
     inflight: () => number;
-    /** S-1281:打开着的 SSE 流条数(drainState.attachedStreams,附着租约同一只 getter)。> 0 ⇒ 有壳挂着,同 inflight 一样重置窗口。
+    /** [ref]:打开着的 SSE 流条数(drainState.attachedStreams,附着租约同一只 getter)。> 0 ⇒ 有壳挂着,同 inflight 一样重置窗口。
      *  缺席 ⇒ 视为 0(单测 / 嵌入形)。 */
     attached?: () => number;
     /** MONOTONIC-clock ms of the last non-probe HTTP request (drainState.lastActivityAt). Covers what inflight

package/dist/spec-fields.d.ts

@@ -44,9 +44,9 @@ export declare function normalizeResumeAtMode(v: unknown, resumeAtResolved: bool
  *  **技能**条数帽不是同一轴:技能清单由引擎按预算渲染(超了裁描述),agent 定义没有那个预算面。 */
 export declare const MAX_TASK_AGENTS = 32;
 /**
- * core 7.41.0 #1303 —— 技能的两只清单 `allowedTools` / `disallowedTools`(`dist/core/agent-definition.d.ts`:本次 run 的 allow 规则来源 /
+ * core 7.41.0 [ref] —— 技能的两只清单 `allowedTools` / `disallowedTools`(`dist/core/agent-definition.d.ts`:本次 run 的 allow 规则来源 /
  * deny 规则来源,不是围栏)的**形**谓词。两道技能门(顶层 `body.skills[]` 的 `validateUserSkills`、`agents[].skills[]` 的
- * {@link SKILL_FIELD_SHAPES})**同一只**:一边判一边不判 = 同一个键两种话(S-377 baseDir 吃过的亏)。
+ * {@link SKILL_FIELD_SHAPES})**同一只**:一边判一边不判 = 同一个键两种话([ref] baseDir 吃过的亏)。
  *
  * 本谓词只判「字符串数组」(core 7.42.0 起与请求的 `settings.permissions.allow`、运维的 `APPROVAL_GRANT` **同一只**:`rule-entry-list.ts` 的
  * `ruleEntryListShapeOk`):引擎直接 `for (const entry of list)` —— 一个裸字符串 `"Bash"` 会被逐字符迭代成 `B` / `a` / `s` / `h` 四条
@@ -80,7 +80,7 @@ export interface TaskAgentsRefusal {
 /** [ref] 单条 agent 定义的形状裁决:null=合法;否则一句可 400 的英文错误(不带索引,调用方自己加)。
  *  白名单外键 fail-loud —— 与 resilience/limits 的「容忍未知键」相反:agents 是能力定义,静默丢字段 =
  *  定义被悄悄削(一个丢掉的 isolation 就是放宽),比 400 更危险,故整条拒。`allowTools` / `denyTools` 本门只判形与条数(`toolList`),
- *  **名字归引擎一只判**(core 7.49.0 #1623 / #1433 第二步起与根 run 的 `allowTools` / `excludeTools` 是同一只选择器,开跑前,三来源同判):core 7.51.0 #1736 起
+ *  **名字归引擎一只判**(core 7.49.0 [ref] / [ref] 第二步起与根 run 的 `allowTools` / `excludeTools` 是同一只选择器,开跑前,三来源同判):core 7.51.0 [ref] 起
  *  没有任何工具答应的名字(无人挂的名、大小写孪生 / 退役名 `bash` / `BASH`)**引擎不拒 run** —— 条目原样保留、经 onError(config)告知一次(带该写的拼法);
  *  其中**写错现名的**(`denyTools:["BASH"]` 想禁的照用 = 静默放行;`allowTools:["BASH"]` 想放的什么也没放 = 静默收窄)由 `resolveSpec` 前置拒:**限制侧**(`denyTools`)四类全拒(近似名 · 退役名 · 文法读不出 · `*`),
  *  **放行侧**(`allowTools`)只拒近似名 —— 放行侧的内容形 / 没有后继的退役名 / 文法读不出照 7.130.0 受理、交引擎既有通告(有后继的退役名〔`bash` · `Task`〕与文法读不出的放行条目引擎在子代 prepare 整 run 拒 `config.agent.unknown_tool`,根 `allowTools` 拒 `config.tool_face_control`,同步腿两码同为 400〔`runs.ts` `PREPARE_REFUSAL_HTTP_STATUS`〕;`rule-entry-list.ts` `inertToolListEntryOf`:近似名提交 400 `config.agent.unknown_tool` 点名现名、续跑按方向分流;
@@ -150,7 +150,7 @@ export declare function retainBackgroundProcessesFromBody(raw: unknown, requireP
  *  undefined(不挂键=core 缺省,byte-compat)。HTTP 门另有 fail-loud 400(提交面邻居姿势)。 */
 export declare function toolNameListFromBody(raw: unknown): string[] | undefined;
 /**
- * S-1448(core 7.49.0 #1623 / [ref])—— body.allowTools → `TaskSpec.allowTools`:引擎的**可用性选择器**,原样透传。
+ * [ref](core 7.49.0 [ref] / [ref])—— body.allowTools → `TaskSpec.allowTools`:引擎的**可用性选择器**,原样透传。
  *
  * 一条规则:这一 run 能用哪些工具由引擎一只运算答(`universe ∩ ceiling ∩ allow − deny`,prepare 对真实挂载的一切算一次)。
  * 本仓**零读法** —— 不算补集、不逐项过滤(`[]` = 什么都不给,是合法值,不折成缺席;非串条目与未知名由引擎在 prepare 拒,

package/dist/sql-engine-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-131 —— SQL **引擎姿态**的运维读面(单一推导点,同 `memory-posture.ts` 的形制)。
+ * [ref] —— SQL **引擎姿态**的运维读面(单一推导点,同 `memory-posture.ts` 的形制)。
  *
  * ## 病
  *
@@ -11,7 +11,7 @@
  *
  * `sql-driver.ts` 的连接初始化在**每条池连接**上钉死这两件事并**回读复核**(`@contract txn.read-semantics`)。
  * 本模块把那份读数拿出来,一次推导两个读面:operator 面(`GET /v1/diagnostics/wiring` 的 `sqlEngine` 段,
- * 全量)与消费端面(`GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,S-866 ①),窄投影)。两面同源 —— 「诊断页说悲观、能力位说
+ * 全量)与消费端面(`GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,[ref] ①),窄投影)。两面同源 —— 「诊断页说悲观、能力位说
  * 乐观」在结构上不可能。
  *
  * ## 两条诚实纪律(与 memory-posture 同源)
@@ -52,7 +52,7 @@ export type SqlEngineSeatIssue = "required" | "bad_shape";
  * 都是 fail-closed:墙门只认这一席,席坏了或漏了,代价是每份超出库墙的体照样受理或每次提交 500,不是起服时一句话。
  */
 export declare function sqlEngineSeatIssue(backend: Pick<StoreBackend, "mysqlPool" | "pgPool"> | undefined, sqlEngine: unknown): SqlEngineSeatIssue | undefined;
-/** 消费端窄投影(`GET /v1/capabilities` 的 `store.sql` 位;7.106.0 前是顶层 `sql`,S-866 ①)。`null` = 驱动此刻给不出事实 ⇒ `store.sql` 缺席。 */
+/** 消费端窄投影(`GET /v1/capabilities` 的 `store.sql` 位;7.106.0 前是顶层 `sql`,[ref] ①)。`null` = 驱动此刻给不出事实 ⇒ `store.sql` 缺席。 */
 export interface SqlEngineCapability {
     engine: SqlEngineFacts["engine"];
     isolation: string;

package/dist/store-posture.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-866 ①(设计稿 v1.1 §2①)—— 「这台副本**真的在持久化吗**」的单一推导点:caps `store`、`/health.storeDegraded` / `durable:false`、
+ * [ref] ①(设计稿 v1.1 §2①)—— 「这台副本**真的在持久化吗**」的单一推导点:caps `store`、`/health.storeDegraded` / `durable:false`、
  * gauge `store_backend_degraded` 三面读**同一只装配值**({@link StorePosture},`boot/stores.ts` 铸一次)。
  *
  * ## 病
@@ -53,7 +53,7 @@ export interface StoreCapability {
     readonly durable: boolean;
     readonly degradedReason?: StoreDegradedReason;
     /** 7.105.0 及以前的顶层 `sql` 对象,原样搬入(`{engine, isolation, txnMode}`)。present-iff `backend ∈ {mysql, pg}` ∧ 驱动此刻给得出
-     *  回读复核过的事实 —— 最近一次连接初始化被拒(S-137 ④)时驱动交 `null`,本键随之缺席(此前是顶层 `sql:null`)。 */
+     *  回读复核过的事实 —— 最近一次连接初始化被拒([ref] ④)时驱动交 `null`,本键随之缺席(此前是顶层 `sql:null`)。 */
     readonly sql?: SqlEngineCapability;
 }
 /** 装配值 → caps 投影(纯函数)。 */

package/dist/stored-request-tool-axes-m19.d.ts

@@ -9,7 +9,7 @@
  * ⇒ 永远批不过去。持久数据面不能「翻红」,所以给它一次性迁移:窗开着时,续跑重放腿把判官判不过的那一格按升级前的读法重读一次,产物**再交同一只判官**
  * (不过 ⇒ 原臂:整条不进);真挂上的这类 server 由请求腿说一行运维 warn `mcp_tool_axes_read_as_before_upgrade`。窗关之后回到今天的读法,删码零行为变化。
  *
- * ## A2A 一面(同一种病,同一只重读座;core 7.53.0 #1835 提货批)
+ * ## A2A 一面(同一种病,同一只重读座;core 7.53.0 [ref] 提货批)
  * core 7.53.0 起 A2A 请求腿的 `toolAxes` 读者也是引擎的判官(`readToolAxes(…, "a2a")`)。7.131.x 的 A2A 请求腿读者对每只 skill 的记录只挑三个轴、**多余成员静默忽略**、
  * 照挂 ⇒ 存量体里带多余成员的那条对端,续跑重放时整条不进,停驻在它某只 skill 审批上的任务同样永远批不过去。同一只重读座覆盖它,律只有一句:**重读复现那一面升级前
  * 的读法,一个成员都不多救** —— A2A 那一面交 {@link readA2aToolAxesAsServer7131M19}(7.131.x 的读者逐字:未知成员忽略;已知轴写坏 —— `effect` / `irreversibility` 出词表、

package/dist/task-a2a.d.ts

@@ -61,7 +61,7 @@ export interface A2aGateConfig {
  *      hand every consumer an affordance whose every use 400s (`config.locked_key`); "says yes ⟺ route
  *      works" breaks on the spot. Same conjunction, same reason, as `mcpInjectionHonored`'s lock veto;
  *   ② the compliance posture denies `a2a_peers` — advertised-but-refused again;
- *   ③ multi-tenant (`requirePrincipal === true`) — a tenant cannot point the shared worker at an agent.
+ *   ③ multi-tenant (deployment-shape row `multiTenant`) — a tenant cannot point the shared worker at an agent.
  *
  * ⚠️ **`resolveComplianceDenies` is deliberately NOT wrapped in try/catch** (same ruling as the MCP twin):
  * it is fail-loud on a posture outside the closed set, and the posture has already been validated twice
@@ -80,6 +80,8 @@ export declare function validateRequestA2a(raw: unknown): {
     ok: A2aServerSpec[];
     dropped: string[];
 } | null;
+/** fresh 提交腿的 `a2aPeers` URL 门:{@link requestA2aPeerUrlRefusal} 有答案 ⇒ 同步 400(码 / 句 / 机读位原样)。 */
+export declare function assertRequestA2aPeerUrls(bodyA2a: unknown): void;
 /**
  * DESIGN-269 §2.4 —— **同步**拒面:部署锁了 `a2a` 而请求仍带 `a2aPeers` ⇒ 400 `config.locked_key`
  * (逐字沿用 `assertRequestMcpUnlocked` 的裁定,连错误码都同一个 —— 消费端判的是「某个键被行政锁住了」,