@sema-agent/server 7.134.0 → 7.136.0

package/dist/http/routes/capabilities.js

@@ -1,12 +1,12 @@
 import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
-import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableCatalog } from "../../model-select.js";
+import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableAliasNames, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
 import { buildModelPlaneFace } from "../../model-plane-face.js";
 import { isRosterGateArmed } from "../../config.js";
 import { modelKeyPoisonOf, resolveModelApiKey } from "../../key-resolver.js";
 import { projectSealedKeyCapability } from "../../sealed-key.js";
-import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../../deployment-shape.js";
 import { taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
@@ -32,7 +32,9 @@ import * as facts from "../../capability-facts.js";
 import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { headReadOf } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
+import { sessionRulesNamespaceFormsHonored } from "../../session-policy-wire.js";
 function routePairingOf(deps, name, m) {
     if (modelKeyPoisonOf(name, deps.config.modelApiKeyEnv ?? {}, process.env, deps.config.modelApiKeys ?? {}) !== undefined)
         return "unknown";
@@ -131,7 +133,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 scratchpadDir: true,
                 subagentSteer: facts.subagentSteer(deps).available,
                 subagentResume: facts.subagentSteer(deps).available,
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: cwdHonored(deps.config) || deviceCwdHonored(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
+                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config), hooks: taskHooksHonored(deps.config), pluginHooks: taskHooksHonored(deps.config), managedHookGroups: taskHooksHonored(deps.config), tightenOnlySeats: true, approvalFrameFamilies: true },
                 settings: { permissions: { allowGrant: true, allowLayer: true, callerTrust: callerTrust(req, deps.config).trust } },
                 permissionModeAuto: {
                     accepted: true,
@@ -143,6 +145,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 writeProtection: projectWriteProtectionCapability(deps.writeProtection),
                 appendSystemPrompt: true,
                 outputStyle: true,
+                projectMemory: true,
                 compactionModel: true,
                 subagentOutput: facts.subagentOutput(deps).available,
                 subagentStream: facts.subagentOutput(deps).available,
@@ -154,9 +157,10 @@ export async function handleCapabilities(req, res, match, ctx) {
                 disableSkills: true,
                 userInvokedSkills: true,
                 skillToolLists: true,
+                scenarioSkills: true,
                 userAttachments: USER_ATTACHMENT_SEAT,
-                projectContext: cwdHonored(deps.config),
-                callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                projectContext: DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(deps.config),
+                callerCwd: DEPLOYMENT_SHAPE_PREDICATES.callerCwd.holds(deps.config),
                 taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined && autonomyKeepsOpenWriteFace(deps.config.autonomy),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: facts.mcpInjection(deps).available,
@@ -186,12 +190,13 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sessionSearch: facts.sessionList(deps).available,
                 sessionFork: facts.sessionFork(deps).available,
                 sessionDelete: facts.sessionDelete(deps).available,
-                resumeAt: Boolean(deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+                resumeAt: Boolean(deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
                 promptSuggestions: true,
                 sessionPolicy: facts.sessionPolicy(deps).available,
+                sessionRulesNamespaceForms: sessionRulesNamespaceFormsHonored(),
                 rewindFiles: Boolean(deps.fileHistoryStore),
                 restoreFiles: Boolean(deps.fileHistoryStore),
-                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
+                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
                 fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore, deps.config.fileHistoryCapture),
                 scheduler: facts.hostScheduler(deps.config).available,
                 sessionSync: facts.sessionSync(deps).available,
@@ -258,6 +263,7 @@ export async function handleCapabilities(req, res, match, ctx) {
         case "models": {
             const atCatalog = selectableCatalog(deps.config.models, deps.config.tiers, deps.config.modelRefusals);
             const atMention = deps.config.atMention;
+            const mentionBit = (name) => (atMention.mode !== "all" ? { atMentionable: isAtMentionable(name, atCatalog, atMention, deps.config.modelRefusals) } : {});
             const models = Object.entries(deps.config.models)
                 .filter(([name]) => name !== "default")
                 .map(([name, m]) => ({
@@ -270,7 +276,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),
-                ...(atMention.mode !== "all" ? { atMentionable: isAtMentionable(name, atCatalog, atMention, deps.config.modelRefusals) } : {}),
+                ...mentionBit(name),
                 routePairing: routePairingOf(deps, name, m),
             }));
             const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
@@ -287,6 +293,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                     candidateRejection,
                     modelRefusals: deps.modelRefusalsState?.(),
                 }),
+                aliases: selectableAliasNames(deps.config.models, atCatalog, deps.config.modelRefusals).map((name) => ({ name, ...mentionBit(name) })),
             });
             return;
         }
@@ -301,6 +308,7 @@ function sendMcpProbeRefusal(res, ctx, refusal, outcome, retryAfterSec) {
         res.setHeader("retry-after", String(retryAfterSec));
     sendError(res, status, refusal.errorCode, refusal.message, {
         ...(refusal.unknownKeys !== undefined ? { unknownKeys: refusal.unknownKeys } : {}),
+        ...(refusal.facts ?? {}),
         ...(retryAfterSec !== undefined ? { retryAfterSec } : {}),
     });
 }

package/dist/http/routes/config-catalog.d.ts

@@ -10,7 +10,7 @@
  * 刻意不吃 drain / roster-pending 两道 503(排障读面在停机窗里恰恰要打得通)。
  *
  * 🔴 鉴权 = `explicitOperatorOk`(「谁是 operator」的唯一读法:空名单 = 谁都不是)—— 设计稿 §0.5 点名禁「空名单 = 人人都是」的 fail-open 读法
- * (S-1050 起整只删):本面是部署事实外泄口(env 在场性 / 后端形态 / 限额值)。单用户形只在部署方显式声明 `OPERATOR_SINGLE_USER=true`
+ * ([ref] 起整只删):本面是部署事实外泄口(env 在场性 / 后端形态 / 限额值)。单用户形只在部署方显式声明 `OPERATOR_SINGLE_USER=true`
  * (每个调用方都是运维)时对调用方开。
  *
  * 🔴 旋钮 `CONFIG_CATALOG_ENABLED=false` / operator 名单空 ⇒ 501(事实 `configCatalog`,与能力位同一只函数):

package/dist/http/routes/devices.d.ts

@@ -34,7 +34,7 @@
  * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
  * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的
  * 同向裁定是「缺 tenant/global scope 明确拒注册」。enrollment/管理端点与**首绑写协议**都从
- * 这同一个函数取域(S-470 起它住在 `http/device-placement.ts` —— 提交腿也要用,放在路由域里是层序倒挂),
+ * 这同一个函数取域([ref] 起它住在 `http/device-placement.ts` —— 提交腿也要用,放在路由域里是层序倒挂),
  * 不得手抄第二份派生。
  *
  * ── 反枚举 404 的单一铸造点 ──────────────────────────────────────────────────────────────────────

package/dist/http/routes/diagnostics.d.ts

@@ -16,13 +16,13 @@ import { type StreamApprovalGate, type StreamApprovalGateInput } from "../../too
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 流内审批门的读数形:上场即 `"active"`,否则是那**四**个合取项里**第一个**不满足的原因词
  *  (与 `resolveStreamApprovalGate` 同一闭集,词表**取型**自它 ⇒ 增删 reason 在此处自动跟随/编译红;
- *  S-384 删掉第 5 项「账必须持久」时本行数字漏改过一次,**数字是手抄的那一半**)。 */
+ *  [ref] 删掉第 5 项「账必须持久」时本行数字漏改过一次,**数字是手抄的那一半**)。 */
 export type StreamApprovalGateReading = "active" | Extract<StreamApprovalGate, {
     active: false;
 }>["reason"];
 /** server 自己的装配谓词读数(core 的静态半场之外的那一半:本仓在这台 worker 上做出的判断)。
  *
- *  🔴 S-178:三个 **posture 家族**旋钮改报 `{value, source, note}`(与 S-167 的 `readFace` 同一张四词表、
+ *  🔴 [ref]:三个 **posture 家族**旋钮改报 `{value, source, note}`(与 [ref] 的 `readFace` 同一张四词表、
  *  同一只 note 函数)。裸布尔答不出裁定的补偿项要求的那句话 —— 单机形升级后 `durableApproval` 缺席即
  *  ON、审批窗缺席即 24h,运维必须在一个读面上看得见「这是 posture 派生的」以及「怎么钉回」。
  *  `streamApproval` 那一格是**门读数**(另一根轴:这条腿现在通不通),不是旋钮,故形不变。 */
@@ -46,7 +46,7 @@ export interface ServerWiringGateInput {
     /** 谓词自己的入参类型(只收店的形,工厂方法过不了 tsc)—— 取型而非重述,与 `backend` 同理;在场性即事实,本面不读实例的内容。 */
     checkpointStore: StreamApprovalGateInput["checkpointStore"];
     durableApproval: boolean;
-    /** S-178:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
+    /** [ref]:三个 posture 旋钮的**来源**,取自 config 上与值同处写的那一格(不在这里重判)。 */
     durableApprovalSource: PostureSource;
     streamAskWindowMs: number;
     streamAskWindowMsSource: PostureSource;

package/dist/http/routes/fleet.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— MF-Fleet 实时舰队流。
  *
  * 路由:`GET /v1/fleet/stream`(SSE PUSH:连上先快照,之后每条 per-row delta)。跑在服务凭据门**之前**的
- * 读路谓词段(S-672:先过 `dispatch.ts` 的 `readCredentialOk`「服务凭据 ∨ 已验 principal」,再按 principal 自门,
+ * 读路谓词段([ref]:先过 `dispatch.ts` 的 `readCredentialOk`「服务凭据 ∨ 已验 principal」,再按 principal 自门,
  * 与 workflow 只读路由同段)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";

package/dist/http/routes/fleet.js

@@ -76,7 +76,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
             return rest;
         };
         const SCOPED_WORKFLOW_KEY_DISPOSITION = {
-            id: "keep", status: "keep", errorCode: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
+            id: "keep", status: "keep", errorCode: "keep", parked: "keep", doneCount: "keep", totalCount: "keep", failedCount: "keep",
             startedCount: "keep", elapsedMs: "keep", tokens: "keep",
             name: "rewrite", scope: "strip", sessionId: "strip",
             description: "scrub",
@@ -90,6 +90,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                     status: rest.status,
                     name: "(unattributed)",
                     ...(rest.errorCode !== undefined ? { errorCode: rest.errorCode } : {}),
+                    ...(rest.parked !== undefined ? { parked: rest.parked } : {}),
                     ...(rest.doneCount !== undefined ? { doneCount: rest.doneCount } : {}),
                     ...(rest.totalCount !== undefined ? { totalCount: rest.totalCount } : {}),
                     ...(rest.failedCount !== undefined ? { failedCount: rest.failedCount } : {}),

package/dist/http/routes/mcp-reconnect.d.ts

@@ -1,5 +1,5 @@
 /**
- * S-381(core 7.22.0 [ref] 的 server 半场;提货单 [ref] ⓪ @server 第 3 条 / 判据帖 [ref] G1)——
+ * [ref](core 7.22.0 [ref] 的 server 半场;提货单 [ref] ⓪ @server 第 3 条 / 判据帖 [ref] G1)——
  * **会话内 MCP re-dial** 的 wire 面:
  *
  *   `POST /v1/sessions/:id/mcp/reconnect`  body `{ server: string }`
@@ -30,13 +30,13 @@
  * 消费端**不许**解析它。名册**按 `tools` 的在场性**投成 `toolNames`(present-iff),**不按 `outcome`**。
  *
  * ── 查找与拒绝形(与 steer / capture-optout **同一只**,不新造)───────────────────────────────────
- * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.ownerOf`,未知与他人**同码同串**
+ * 路径是 session,动词挂在 **run 句柄**上 ⇒ 会话属主门(`sessionStorage.headOf(id)?.owner`,未知与他人**同码同串**
  * 404 无 oracle,与 `POST /v1/sessions/:id/notify` 逐字同形)→ `getActiveTaskId` 取本会话的活 run →
  * `steerableRuns` 取本副本活流。非 live 的四臂一码 409 `steering.not_running`,判据取词表属主
- * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,S-430 起同住 `plugins/store-contracts.ts`)。
+ * (`isParkedRunStatus` / `isTerminalRunStatus`)与 `runProvenElsewhere`(手抄已收编成一只谓词,[ref] 起同住 `plugins/store-contracts.ts`)。
  * 显式 operator 可重拨任何租户的会话(监督动作,与 notify / steer 同臂;「谁是 operator」的唯一读法 `explicitOperatorOk`)。
  *
- * ── 应答期限(S-431)────────────────────────────────────────────────────────────────────────────
+ * ── 应答期限([ref])────────────────────────────────────────────────────────────────────────────
  * 修前这一口对 `live.reconnectMcpServer(server)` 是裸 `await`:server 侧没有期限,上界只来自 core 自己的启动期钟
  * (env `MCP_TIMEOUT`,未设落 SDK 缺省 60s;拨号之前还有一次不在那条钟里的旧连接 `close()`),一台拨不通 / 半开的远端能把这一口
  * HTTP 请求挂很久。现在与 `GET /v1/sessions/:id/mcp` 面板读**同一只**数 `MCP_DIAL_DEADLINE_MS`(`../mcp-dial-deadline.ts`),

package/dist/http/routes/mcp-reconnect.js

@@ -65,8 +65,8 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     case "run_store_absent":
                         sendError(res, 501, "capability.run_store_required", "async runs require a durable run store (DB_BACKEND=mysql|pg|local)");
                         return;
-                    case "session_owner_face_absent":
-                        sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.ownerOf)");
+                    case "session_head_face_absent":
+                        sendError(res, 501, "capability.session_ownership_required", "the MCP re-dial verb requires the session-ownership face (sessionStorage.headOf)");
                         return;
                     default:
                         return assertNever(fact.why);
@@ -89,7 +89,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const owner = await sessionStorage.ownerOf(sessionId);
+            const owner = (await sessionStorage.headOf(sessionId))?.owner;
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;

package/dist/http/routes/memory-consolidation.d.ts

@@ -11,7 +11,7 @@
  *
  * ── 缺席形(D4):**501**,与能力位同一只事实 ─────────────────────────────────────────────────────
  * 两口恒挂载;域头调事实 `memoryConsolidation`(`src/capability-facts.ts`,`capabilities.memoryConsolidationDriver` 读的是同一只):
- *  · 阀门关(`MEMORY_CONSOLIDATION_DRIVER=off`,或 S-824 出厂缺省派生成关 —— 未设而整理座落主模型)⇒ 501
+ *  · 阀门关(`MEMORY_CONSOLIDATION_DRIVER=off`,或 [ref] 出厂缺省派生成关 —— 未设而整理座落主模型)⇒ 501
  *    `feature.memory_consolidation_disabled`。旋钮关是一句运维表态,不是部署能力缺失 —— 「去开旋钮」由 `feature.*` 这一族码
  *    与拒句承担(同仓旋钮关的既有答法),不靠状态码:HTTP 上「这台部署上不可用」只有 501 一种答。
  *  · operator 名单空 ⇒ 501 `capability.operator_principals_required`(对谁都打不通 = 部署不可用,先于授权答)。

package/dist/http/routes/notify-wake.d.ts

@@ -15,7 +15,7 @@ import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js
  * `NOTIFY_WAKE_ROUTES`)。历史:2026-07-31 的缝合审查出这两件事**曾经不同步** —— 匹配形写死在本文件的
  * 判路代码里、`isBillableSubmitPath` 的名单写在 `server.ts` 里,wake 从来没进过名单,于是同一条
  * `driveResumeIntoRunLog` 模型腿从 `/v1/assistant/tasks/:id/resume` 进来受三道提交门管、从 wake 进来
- * 一道都不受。S-146 让两件事变成同一行的两列,再想漏就得把一行拆成两处才做得到。
+ * 一道都不受。[ref] 让两件事变成同一行的两列,再想漏就得把一行拆成两处才做得到。
  */
 export declare function handleNotifyWake(req: IncomingMessage, res: ServerResponse, match: RouteMatch<NotifyWakeRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const NOTIFY_WAKE_ROUTES: readonly [{

package/dist/http/routes/notify-wake.js

@@ -54,10 +54,10 @@ export async function handleNotifyWake(req, res, match, ctx) {
             }
             const owned = facts.sessionOwnership(deps);
             if (!owned.available) {
-                sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.ownerOf)");
+                sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.headOf)");
                 return;
             }
-            const notifyOwner = await owned.sessionStorage.ownerOf(notifySession);
+            const notifyOwner = (await owned.sessionStorage.headOf(notifySession))?.owner;
             if (notifyOwner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;

package/dist/http/routes/rules.d.ts

@@ -12,7 +12,7 @@
  * 因此**导入两口**只认已验明的 principal,连 `explicitOperatorOk` 的旁路都不给:一个 operator 想给
  * 自己导规则,用他自己的 principal 走同一条路即可(那时他就是租户)。
  *
- * 🔴 **`POST /v1/rules` 是撤销口的对偶,不是导入口的简写**(S-511):它写的只有**收紧**方向
+ * 🔴 **`POST /v1/rules` 是撤销口的对偶,不是导入口的简写**([ref]):它写的只有**收紧**方向
  * (deny/ask),而收紧不需要同意仪式 —— 与撤销为什么不需要是同一条理由(core `removePersistedRule`
  * 头注逐字:「a host may narrow on a user's behalf, it may not widen」)。放宽(allow)仍然只有两条路:
  * 一张卡上的人点头,或一次显式的 settings 导入。方向表在 `permission-rule-vocab.ts`,不在本文件。

package/dist/http/routes/runs.js

@@ -3,6 +3,7 @@ import { redactHead, redactLedgerEventForRead } from "../../observability/run-te
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, validatePendingSteer, TASK_OUTPUT_REPLAY_KINDS, isSystemInjectionPriority } from "@sema-agent/core";
 import { isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
+import { askOwnerAdmits, askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-sql.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
@@ -13,8 +14,7 @@ import { streamSseLog } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames, readClosedWordSeat, storedCardDemandsAPerson } from "../../approval-card.js";
 import { heldAskOf, liveSettledBy, readDecidedBy, retiredDecisionKeyFacts, DECIDED_BY_NOT_IN_PROOF, DECIDED_BY_OUTSIDE_CLOSED_SET, POLICY_CANNOT_ALLOW_PERSON_ASK } from "../../host-decision.js";
-import { ASK_DECISION_CONSUMER_ABSENT, approvalPreambleReplays, outcomeOfDecidedRow, resolveStreamApprovalGate } from "../../tool-approval.js";
-import { readRunDeclaredFamilies } from "../run-declared-families.js";
+import { ASK_DECISION_CONSUMER_ABSENT, approvalPreambleReplays, outcomeOfDecidedRow, presentedApprovalFrameFamily, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { MAX_DECISION_NOTE_CHARS, noteLandedOnRow, noteRecordedReceipt } from "../../approval-ask-machine.js";
 import { causeOfAskRow } from "../../approval-deny-reasons.js";
 import { normalizeRunEventType, screenedStoredEventData } from "../../trace/project.js";
@@ -33,6 +33,7 @@ import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { readResumeCtx } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields } from "../checkpoint-ctx.js";
+import { headReadOf } from "../../session-incarnation.js";
 import { serviceVersion } from "../../service-version.js";
 import { storedBodyReplayRefusal } from "../stored-body-replay.js";
 import { steerBodyKeyIssue } from "../../request-key-closure.js";
@@ -110,7 +111,7 @@ function sendHandleMiss(res, run, thisInstanceId) {
     }
     return false;
 }
-async function streamRunEvents(req, res, deps, runStore, taskId, sessionId, staleMs) {
+async function streamRunEvents(req, res, deps, runStore, taskId, staleMs) {
     await streamSseLog(req, res, {
         preamble: async (signal) => {
             const gate = resolveStreamApprovalGate({
@@ -121,12 +122,11 @@ async function streamRunEvents(req, res, deps, runStore, taskId, sessionId, stal
             });
             if (!gate.active)
                 return [];
-            const declaredFamilies = await readRunDeclaredFamilies(gate.checkpointStore, sessionId, (where) => deps.logger?.warn?.("approval_preamble_declaration_unreadable", { taskId, where, face: "run.events" }));
             if (!approvalPreambleReplays({
                 streamApprovalOn: gate.active,
                 windowMs: deps.config.streamApproval?.windowMs,
                 windowMarginMs: deps.config.streamAskWindowMarginMs,
-                declaredFamilies,
+                declaredFamilies: new Set([presentedApprovalFrameFamily(gate.active)]),
             })) {
                 return [];
             }
@@ -265,7 +265,7 @@ export async function handleRuns(req, res, match, ctx) {
         if (!runSessionAcceptOk(req, res, run, match.decl.id === "run-events" ? "run.events" : "run.poll"))
             return;
         if (match.decl.id === "run-events") {
-            await streamRunEvents(req, res, deps, runStore, taskId, run.sessionId, deps.config.runStaleSec * 1000);
+            await streamRunEvents(req, res, deps, runStore, taskId, deps.config.runStaleSec * 1000);
         }
         else {
             sendJson(res, 200, await readRunFace(deps, runStore, run));
@@ -570,7 +570,8 @@ export async function handleRuns(req, res, match, ctx) {
             }
             return;
         }
-        if (deps.checkpointStore && deps.sessionStorage?.getLeafId) {
+        const sessionHeadOf = headReadOf(deps.sessionStorage);
+        if (deps.checkpointStore && sessionHeadOf) {
             const activeTaskId = await runStore.getActiveTaskId?.(run.sessionId).catch(() => undefined);
             if (activeTaskId !== undefined && activeTaskId !== null && activeTaskId !== taskId) {
                 sendNotRunning(`run is ${run.status} and its session has an ACTIVE run (${activeTaskId}) — steer that run instead`);
@@ -620,7 +621,7 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.duplicateKey = true;
                     return;
                 }
-                const leafId = await Promise.resolve(deps.sessionStorage.getLeafId(run.sessionId)).catch(() => undefined);
+                const leafId = await sessionHeadOf(run.sessionId).then((h) => h?.leafId).catch(() => undefined);
                 if (leafId === undefined || leafId === null)
                     return;
                 const resumeRead = await readResumeCtx(cs.getCtx(run.sessionId), { sessionId: run.sessionId, opener: deps.checkpointCtxSealing });
@@ -1344,7 +1345,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
             askNotFound();
             return;
         }
-        const ownerOk = row0.owner === null || (principal !== undefined && row0.owner === principal);
+        const ownerOk = askOwnerAdmits(row0.owner, principal);
         const operatorOk = explicitOperatorOk(principal, deps.config);
         if (!ownerOk && !operatorOk) {
             askNotFound();
@@ -1453,6 +1454,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 });
                 return;
             }
+            if (hit && !askRowCarriesOwner(hit, row0.owner)) {
+                askNotFound();
+                return;
+            }
             if (hit && hit.state === "DECIDED") {
                 if (!syncLiveFromDecidedRow(hit))
                     return;
@@ -1471,7 +1476,7 @@ export async function handleRunVerbs(req, res, match, ctx) {
         let outcome;
         const releaseEditMark = body.decision === "approve" && hasUpdatedInput ? deps.toolApproval?.markEditedDecisionInFlight(askId) : undefined;
         try {
-            outcome = await askStore.decideAsk(askId, row0.batchId, {
+            outcome = await askStore.decideAsk(askId, row0.batchId, row0.owner, {
                 decision: body.decision,
                 decisionActor: actor,
                 decisionNote: body.note ?? null,
@@ -1487,13 +1492,16 @@ export async function handleRunVerbs(req, res, match, ctx) {
                 hadIdempotencyKey: body.idempotencyKey !== undefined,
                 error: err instanceof Error ? err.message : String(err ?? ""),
             });
+            let confirmedOutOfScope = false;
             if (releaseEditMark !== undefined &&
                 body.idempotencyKey !== undefined &&
                 deps.toolApproval &&
                 deps.toolApproval.editedDecisionInFlightCount(askId) === 1) {
                 try {
                     const confirmed = await withDeadline(askStore.getAsk(askId), ASK_DECISION_CONFIRM_TIMEOUT_MS, "getAsk(ambiguous-commit-confirm)");
-                    if (confirmed !== null &&
+                    if (confirmed !== null && !askRowCarriesOwner(confirmed, row0.owner))
+                        confirmedOutOfScope = true;
+                    else if (confirmed !== null &&
                         confirmed.state === "DECIDED" &&
                         confirmed.decision === body.decision &&
                         confirmed.idempotencyKey === body.idempotencyKey &&
@@ -1506,6 +1514,10 @@ export async function handleRunVerbs(req, res, match, ctx) {
                     deps.logger?.warn?.("ask_decision_edit_confirm_failed", { taskId, askId, error: confirmErr instanceof Error ? confirmErr.message : String(confirmErr ?? "") });
                 }
             }
+            if (confirmedOutOfScope) {
+                askNotFound();
+                return;
+            }
             if (body.idempotencyKey !== undefined) {
                 sendError(res, 500, "internal.error", "the ask decision store failed around commit — the decision MAY already be persisted; retry with the same idempotencyKey to replay it instead of colliding with it");
             }

package/dist/http/routes/session-sync.d.ts

@@ -34,7 +34,7 @@ export type PendingStaging = {
     declaredEntryIds: string[];
     /** The principal that opened this staging — a different caller may not drive it (404, no oracle). */
     openedBy: string | null;
-    /** The owner cell the gate judged when it opened this staging (`ownerOf` reading: `undefined` = no such session) — the commit lands only on
+    /** The owner cell the gate judged when it opened this staging (head-read reading `headOf(id)?.owner`: `undefined` = no such session) — the commit lands only on
      *  this same cell (`StagedCommitOptions.expectedOwner`, `session-sync-kernel.ts`); `owner` above (the re-stamped importing principal) is derived from it for a fleet caller. */
     expectedOwner: string | null | undefined;
 };