@sema-agent/server 7.134.0 → 7.136.0

package/dist/http/routes/session-sync.js

@@ -2,12 +2,13 @@ import { once } from "node:events";
 import { randomBytes, createHash } from "node:crypto";
 import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, validateFileHistoryExport } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
-import { exportSessionManifest, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
+import { FileHistoryUnreadableError, blobGetterOf, exportSessionManifest, exportedFileHistory, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
 import * as facts from "../../capability-facts.js";
 import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
+import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
@@ -16,6 +17,7 @@ import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 import { readSessionPinned, readSessionTitle } from "../../session-row.js";
+import { sessionFaceOfHead } from "../../session-incarnation.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -55,8 +57,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                 return;
             }
             const judgeSessionGate = async () => {
-                const face = await sessionStorage.sessionFaceOf(sessionId);
-                const mayTouch = face !== undefined && (scope.fleetWide || face.owner === scope.gateOwner || legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(sessionStorage, sessionId, face.owner)));
+                const face = sessionFaceOfHead(sessionId, await sessionStorage.headOf(sessionId));
+                const mayTouch = face !== undefined && (scope.fleetWide || face.owner === scope.gateOwner || legacyUnownedSessionOk(deps.config, sessionCallerOf(req, deps), await sessionOwnerCellOf(sessionStorage, sessionId, face.owner)));
                 return { face, mayPull: mayTouch, mayPush: face === undefined || mayTouch };
             };
             const gate = await judgeSessionGate();
@@ -82,6 +84,11 @@ export async function handleSessionSync(req, res, match, ctx) {
                     return true;
                 return face !== undefined && (await sessionStorage.patchSessionMeta(sessionId, row, face)) !== undefined;
             };
+            const canReplayHistory = fileHistoryImportFace(historyStore) !== undefined;
+            const replayHistory = async (envelope, allowReplace) => {
+                const r = await replayFileHistory(historyStore, sessionId, envelope, blobGetterOf(historyStore), { allowReplace });
+                return r.ok ? undefined : r;
+            };
             if (match.decl.id === "session-sync-manifest") {
                 if (!pullGateOk())
                     return;
@@ -90,7 +97,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     out = await exportSessionManifest(sessionId, backend, historyStore);
                 }
                 catch (e) {
-                    if (sendSessionPolicyError(res, e))
+                    if (sendSessionPolicyError(res, e) || sendPullUnreadable(req, res, deps.logger, e))
                         return;
                     throw e;
                 }
@@ -114,7 +121,15 @@ export async function handleSessionSync(req, res, match, ctx) {
                     }
                     afterSeq = n;
                 }
-                const it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
+                let it;
+                try {
+                    it = await sessionStorage.exportEntriesStream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
                 if (it === null) {
                     sendSessionAbsent();
                     return;
@@ -156,13 +171,29 @@ export async function handleSessionSync(req, res, match, ctx) {
                     return;
                 }
                 const fs = blobs.historyStore;
-                const envelope = typeof fs.exportHistory === "function" ? await fs.exportHistory(sessionId) : null;
-                const referenced = envelope !== null && envelope !== undefined && envelope.tracked.some((t) => t.versions.some((v) => v.blobHash === hash));
+                let envelope;
+                try {
+                    envelope = await exportedFileHistory(fs, sessionId);
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
+                const referenced = envelope !== null && envelope.tracked.some((t) => t.versions.some((v) => v.blobHash === hash));
                 if (!referenced) {
                     sendError(res, 404, "not_found.blob", "blob not found");
                     return;
                 }
-                const bytes = await fs.getBlob(hash);
+                let bytes;
+                try {
+                    bytes = await fs.getBlob(hash);
+                }
+                catch (e) {
+                    if (sendPullUnreadable(req, res, deps.logger, e))
+                        return;
+                    throw e;
+                }
                 if (!bytes) {
                     sendError(res, 404, "not_found.blob", "blob not found");
                     return;
@@ -275,6 +306,17 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 409, "conflict", "sync conflict", { relation: relA });
                     return;
                 }
+                if (fileHistory !== null) {
+                    const distinct = new Set();
+                    for (const t of fileHistory.tracked)
+                        for (const v of t.versions)
+                            if (v.blobHash !== null)
+                                distinct.add(v.blobHash);
+                    if (await firstMissingBlob(facts.sessionSyncFileHistory(deps), [...distinct]) !== undefined) {
+                        sendMissingBlob(res);
+                        return;
+                    }
+                }
                 let payloadVerified = false;
                 let digestSaysDiffer = false;
                 if (relA.relation === "identical" && srcLogDigest !== undefined) {
@@ -290,8 +332,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                         digestSaysDiffer = true;
                 }
                 if (relA.relation === "identical" && !digestSaysDiffer) {
-                    const blobFaces = facts.sessionSyncFileHistory(deps);
-                    if (fileHistory !== null && blobFaces.available && fileHistoryImportFace(blobFaces.historyStore)) {
+                    if (fileHistory !== null && canReplayHistory) {
                         if (resolution === "overwrite-dst") {
                             const activeNow = await deps.runStore?.getActiveTaskId(sessionId);
                             if (activeNow) {
@@ -299,11 +340,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                                 return;
                             }
                         }
-                        const getBlobA = (h) => blobFaces.historyStore.getBlob(h);
-                        const r = await replayFileHistory(blobFaces.historyStore, sessionId, fileHistory, getBlobA, { allowReplace: resolution === "overwrite-dst" });
-                        const failCode = r.ok ? undefined : r.error.code === "not_found" ? "missing_blob" : r.error.code;
-                        if (!r.ok) {
-                            sendError(res, 422, failCode, `file history import failed (${r.error.code})`);
+                        const failed = await replayHistory(fileHistory, resolution === "overwrite-dst");
+                        if (failed !== undefined) {
+                            sendFileHistoryReplayFailure(res, failed);
                             return;
                         }
                     }
@@ -356,31 +395,6 @@ export async function handleSessionSync(req, res, match, ctx) {
                         return;
                     }
                 }
-                const fss = historyStore;
-                if (fileHistory !== null && fileHistoryImportFace(fss) !== undefined) {
-                    const distinct = new Set();
-                    for (const t of fileHistory.tracked)
-                        for (const v of t.versions)
-                            if (v.blobHash !== null)
-                                distinct.add(v.blobHash);
-                    const all = [...distinct];
-                    if (typeof fss.hasBlobs === "function") {
-                        const present = await fss.hasBlobs(all);
-                        const missing = all.find((h) => !present.has(h));
-                        if (missing !== undefined) {
-                            sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
-                            return;
-                        }
-                    }
-                    else if (typeof fss.getBlob === "function") {
-                        for (const hash of all) {
-                            if (!(await fss.getBlob(hash))) {
-                                sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
-                                return;
-                            }
-                        }
-                    }
-                }
                 const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
                 const operatorOk = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
                 const token = randomBytes(8).toString("hex");
@@ -409,7 +423,6 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 404, "not_found.staging", "staging not found");
                     return;
                 }
-                const getBlob = (h) => historyStore.getBlob ? historyStore.getBlob(h) : Promise.resolve(undefined);
                 const validator = new StreamingImportValidator();
                 let lineBuf = "";
                 let pendingBatch = [];
@@ -515,11 +528,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (pending.resolution === "overwrite-dst" && (committed.relation === "fork" || committed.relation === "stale")) {
                         await wipeSessionAttendants({ fileHistoryStore: historyStore, sessionPolicyStore: deps.sessionPolicyStore, resumeAnchorStore: deps.resumeAnchorStore }, sessionId);
                     }
-                    if (pending.fileHistory !== null && fileHistoryImportFace(historyStore)) {
-                        const r = await replayFileHistory(historyStore, sessionId, pending.fileHistory, getBlob, { allowReplace: pending.resolution === "overwrite-dst" });
-                        const failCode = r.ok ? undefined : r.error.code === "not_found" ? "missing_blob" : r.error.code;
-                        if (!r.ok) {
-                            sendError(res, 422, failCode, `file history import failed (${r.error.code})`);
+                    if (pending.fileHistory !== null && canReplayHistory) {
+                        const failed = await replayHistory(pending.fileHistory, pending.resolution === "overwrite-dst");
+                        if (failed !== undefined) {
+                            sendFileHistoryReplayFailure(res, failed);
                             cleanupStaging(stagingId);
                             return;
                         }
@@ -574,6 +586,45 @@ export async function handleSessionSync(req, res, match, ctx) {
         }
     }
 }
+function sendPullUnreadable(req, res, logger, e) {
+    if (e instanceof FileHistoryUnreadableError) {
+        const permanence = e.failure.permanence;
+        const advice = permanence === "transient" ? "the history store judged the fault transient: retry later" : permanence === "terminal" ? "the history store judged the fault permanent: retrying will not help until the store is repaired" : "the history store did not judge whether retrying can help";
+        sendError(res, 503, "state.file_history_unreadable", `this session's file history cannot be read whole (${e.failure.code}), so nothing was exported — ${advice}`, permanence === undefined ? undefined : { permanence });
+        return true;
+    }
+    if (storeFaultClassOf(e) !== "connection")
+        return false;
+    logRequestError(logger, req, e);
+    sendError(res, 503, "state.file_history_unreadable", "this session's stored state could not be read right now (the store connection failed), so nothing was exported — retry later", { permanence: "transient" });
+    return true;
+}
+function sendMissingBlob(res) {
+    sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
+}
+function sendFileHistoryReplayFailure(res, failure) {
+    if (failure.missingBlob !== undefined) {
+        sendMissingBlob(res);
+        return;
+    }
+    const { code, permanence } = failure.error;
+    sendError(res, 422, code, `file history import failed (${code})`, permanence === undefined ? undefined : { permanence });
+}
+async function firstMissingBlob(blobFaces, referenced) {
+    if (referenced.length === 0)
+        return undefined;
+    if (!blobFaces.available)
+        return referenced[0];
+    const store = blobFaces.historyStore;
+    if (typeof store.hasBlobs === "function") {
+        const present = await store.hasBlobs([...referenced]);
+        return referenced.find((h) => !present.has(h));
+    }
+    for (const hash of referenced)
+        if (!(await store.getBlob(hash)))
+            return hash;
+    return undefined;
+}
 function sendSessionSyncUnavailable(res, why) {
     switch (why) {
         case "store_backend_absent":

package/dist/http/routes/sessions-list.js

@@ -20,7 +20,7 @@ export async function handleSessionsList(req, res, match, ctx) {
                 return;
             }
             const lister = listing.lister;
-            const includeUnowned = !fleetWide && legacyUnownedAmnestyOpen(deps.config.requirePrincipal, gateOwner);
+            const includeUnowned = !fleetWide && legacyUnownedAmnestyOpen(deps.config, gateOwner);
             await handleSessionList(res, lister, new URLSearchParams(match.search), gateOwner, includeUnowned);
             return;
         }

package/dist/http/routes/sessions.js

@@ -10,6 +10,7 @@ import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_EN
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sessionCallerOf, sessionOwnerReadable, sendPrincipalRefusal, sendUnauthorized } from "../principal-gate.js";
+import { headReadOf, leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
 import { runRowReadableOnSessionFace } from "../owner-access.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -73,9 +74,9 @@ export async function handleSessions(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, safeDecode, sessionOwnerOk } = ctx.helpers;
     const readOwnedSessionView = async (sessionAudit, sessionId, readOpts) => {
-        const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-        if (ownerOf !== undefined) {
-            const owner = await ownerOf(sessionId);
+        const headOf = headReadOf(deps.sessionStorage);
+        if (headOf !== undefined) {
+            const owner = (await headOf(sessionId))?.owner;
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return undefined;
@@ -88,7 +89,7 @@ export async function handleSessions(req, res, match, ctx) {
             audit = await sessionAudit(sessionId, readOpts);
         }
         catch (e) {
-            if (ownerOf !== undefined)
+            if (headOf !== undefined)
                 throw e;
             throw new Error(`session view read failed before ownership could be established: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
         }
@@ -168,9 +169,11 @@ export async function handleSessions(req, res, match, ctx) {
                 if (mcpStatusCache.size > 1024)
                     mcpStatusCache.clear();
                 const panel = (async () => {
-                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations);
+                    const stopDial = new AbortController();
+                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations, undefined, undefined, undefined, stopDial.signal);
                     const mat = await raceDeadline(matP, MCP_DIAL_DEADLINE_MS).catch(() => null);
                     if (!mat) {
+                        stopDial.abort();
                         void matP.then((m) => m?.dispose().catch(() => undefined)).catch(() => undefined);
                         return { servers: [], asOf: new Date().toISOString(), degraded: true };
                     }
@@ -187,7 +190,7 @@ export async function handleSessions(req, res, match, ctx) {
                         };
                     }
                     finally {
-                        await mat.dispose().catch(() => undefined);
+                        void mat.dispose().catch(() => undefined);
                     }
                 })();
                 mcpStatusCache.set(cacheKey, { at: Date.now(), panel });
@@ -252,9 +255,8 @@ export async function handleSessions(req, res, match, ctx) {
     }
     {
         if (match.decl.id === "session-head") {
-            const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-            const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-            if (!getLeafId || !ownerOf) {
+            const headOf = headReadOf(deps.sessionStorage);
+            if (!headOf) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
@@ -263,30 +265,14 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const getHead = deps.sessionStorage?.getHead?.bind(deps.sessionStorage);
-            let owner;
-            let leafId;
-            if (getHead) {
-                const head = await getHead(headSession);
-                if (head === undefined) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                    return;
-                }
-                owner = head.owner;
-                if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, owner ?? null)))
-                    return;
-                leafId = head.leafId;
-            }
-            else {
-                owner = await ownerOf(headSession);
-                if (owner === undefined) {
-                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-                    return;
-                }
-                if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, owner ?? null)))
-                    return;
-                leafId = await getLeafId(headSession);
+            const head = await headOf(headSession);
+            if (head === undefined) {
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                return;
             }
+            if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, headSession, head.owner)))
+                return;
+            const leafId = leafOfAdmittedHead(head);
             const etag = `"${leafId ?? "empty"}"`;
             if (req.headers["if-none-match"] === etag) {
                 res.writeHead(304, { etag }).end();
@@ -304,7 +290,8 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_store_required", "session events require a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
-            const ownerOf = evFact.sessionStorage.ownerOf.bind(evFact.sessionStorage);
+            const readHead = (id) => evFact.sessionStorage.headOf(id);
+            const readOwner = async (id) => (await readHead(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
             if (evSession === null) {
@@ -340,13 +327,13 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const cellP = ownerOf(evSession).then((o) => (o === undefined ? undefined : sessionOwnerCellOf(evFact.sessionStorage, evSession, o)));
-                void cellP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
+                const admissionP = readHead(evSession).then(async (head) => (head === undefined ? undefined : { head, cell: await sessionOwnerCellOf(evFact.sessionStorage, evSession, head.owner) }));
+                void admissionP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
-                let cell;
+                let admission;
                 try {
-                    cell = await Promise.race([
-                        cellP,
+                    admission = await Promise.race([
+                        admissionP,
                         new Promise((r) => { stallTimer = setTimeout(() => r("__stall__"), stallBound); stallTimer.unref?.(); }),
                     ]);
                 }
@@ -356,22 +343,23 @@ export async function handleSessions(req, res, match, ctx) {
                 }
                 if (closed)
                     return;
-                if (cell === "__stall__") {
+                if (admission === "__stall__") {
                     cleanup();
                     res.setHeader("retry-after", "5");
                     sendError(res, 503, "state.sse_owner_lookup_stalled", "session-events owner lookup stalled — retry");
                     return;
                 }
-                if (cell === undefined) {
+                if (admission === undefined) {
                     cleanup();
                     sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                     return;
                 }
-                if (!sessionOwnerOk(req, res, cell)) {
+                if (!sessionOwnerOk(req, res, admission.cell)) {
                     cleanup();
                     return;
                 }
-                const owner = cell.owner;
+                leafOfAdmittedHead(admission.head);
+                const owner = admission.cell.owner;
                 const q = new URLSearchParams(match.search);
                 const lastLeafId = q.get("lastLeafId");
                 let first = true;
@@ -470,7 +458,7 @@ export async function handleSessions(req, res, match, ctx) {
                     }
                     ownerCheckPending = true;
                     ownerCheckStartedAt = Date.now();
-                    void ownerOf(evSession).then((o) => {
+                    void readOwner(evSession).then((o) => {
                         ownerCheckPending = false;
                         if (!closed && o !== owner)
                             onEnd();
@@ -670,13 +658,15 @@ export async function handleSessions(req, res, match, ctx) {
         }
         const store = rowFact.sessionStorage;
         const sessionId = match.params.sessionId;
-        const face = await store.sessionFaceOf(sessionId);
-        if (face === undefined) {
+        const head = await store.headOf(sessionId);
+        if (head === undefined) {
             sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
             return;
         }
+        const face = sessionFaceOfHead(sessionId, head);
         if (!sessionOwnerOk(req, res, await sessionOwnerCellOf(store, sessionId, face.owner)))
             return;
+        leafOfAdmittedHead(head);
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {
             sendError(res, 400, read.problem.code, read.problem.message);
@@ -698,7 +688,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const fork = forkFact.sessionStorage.fork.bind(forkFact.sessionStorage);
-            const ownerOf = forkFact.sessionStorage.ownerOf.bind(forkFact.sessionStorage);
+            const readOwner = async (id) => (await forkFact.sessionStorage.headOf(id))?.owner;
             const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
@@ -709,12 +699,12 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sourceId);
+            const owner = await readOwner(sourceId);
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(forkFact.sessionStorage, sourceId, owner))) {
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config, sessionCallerOf(req, deps), await sessionOwnerCellOf(forkFact.sessionStorage, sourceId, owner))) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
@@ -736,7 +726,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const purge = deleteFact.purge;
-            const ownerOf = deleteFact.sessionStorage.ownerOf.bind(deleteFact.sessionStorage);
+            const readOwner = async (id) => (await deleteFact.sessionStorage.headOf(id))?.owner;
             const scope = fleetViewOf(req, deps, "write");
             if (!scope.fleetWide && scope.gateOwner === null) {
                 sendUnauthorized(res, "identity");
@@ -747,12 +737,12 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sessionId);
+            const owner = await readOwner(sessionId);
             if (owner === undefined) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
-            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, sessionCallerOf(req, deps), await sessionOwnerCellOf(deleteFact.sessionStorage, sessionId, owner))) {
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config, sessionCallerOf(req, deps), await sessionOwnerCellOf(deleteFact.sessionStorage, sessionId, owner))) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
@@ -782,7 +772,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const store = policyFact.policyStore;
-            const ownerOf = policyFact.sessionStorage.ownerOf.bind(policyFact.sessionStorage);
+            const readOwner = async (id) => (await policyFact.sessionStorage.headOf(id))?.owner;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
                 sendUnauthorized(res, "identity");
@@ -793,7 +783,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const owner = await ownerOf(sessionId);
+            const owner = await readOwner(sessionId);
             if (owner === undefined) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;

package/dist/http/routes/tasks.d.ts

@@ -12,7 +12,7 @@
  *   · `runSyncSubmitLeg` —— 同步腿(原 128 行匿名体);
  *   · 同步腿内 `verifyLeg` / `cascadeLeg` / `plainLeg` —— 三条模型驱动腿,判别顺序与短路语义逐字不变。
  * 提名**只改名字不改行为**:闭包捕获的自由变量、语句顺序、settle/registry 生命周期注释全部随代码原样迁移。
- * (S-947 起「这次是不是被 server 中止、为什么」读每腿自己的中止句柄 `RunAbort`,不再有按 taskId 键控的
+ * ([ref] 起「这次是不是被 server 中止、为什么」读每腿自己的中止句柄 `RunAbort`,不再有按 taskId 键控的
  * `cancelledViaVerb` 旁表与它「身份守卫内先取后删」的取值时点。)
  *
  * 与 runs 域共用 `ctx.legs.prepareSpec`(读体/校验/建 spec 的同一条前段)。

package/dist/http/routes/trace-usage.d.ts

@@ -6,7 +6,7 @@
  *
  * ⚠️ 三块都跑在全局 service-credential 门**之前**(与 /metrics 同款待遇)——只读 traceToken 单凭据的调用方
  * (registry 中继的姿势)在全局门会被 401,挂门后=门内 traceToken 支持成死代码(1.148 a2 实机抓获)。
- * S-672(7.105.0):门前不等于不设防 —— 本域坐在读路谓词段,先过 `dispatch.ts` 的 `readCredentialOk`
+ * [ref](7.105.0):门前不等于不设防 —— 本域坐在读路谓词段,先过 `dispatch.ts` 的 `readCredentialOk`
  * (部署配了 service 凭据时要「service token / traceToken / 已验 principal」之一),块内这几道门在它之后。
  * 因此本域在 `handle()` 里的位置就是契约的一部分:必须留在鉴权门上方,顺序不可与其他域对调。本域零可变状态。
  */

package/dist/http/routes/workflows.d.ts

@@ -175,6 +175,9 @@ export declare const WORKFLOW_RUN_DISPOSITIONS: {
     readonly id: "forward";
     readonly scope: "forward";
     readonly status: "forward";
+    readonly parked: {
+        readonly mint: (run: WorkflowRun) => true | undefined;
+    };
     readonly name: {
         readonly redact: "redactSecrets";
     };

package/dist/http/routes/workflows.js

@@ -1,9 +1,8 @@
 import { persistedPlaneOf } from "../../terminal.js";
 import { z } from "zod";
-import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
+import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal, runParkedOf, JOURNAL_INCOMPATIBLE_ERROR_CODE, WorkflowJournalIncompatibleError } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
-import { journalEntryOfBody, journalEntryPayload, journalRowPayloadOf, readJournalRowBody } from "../../orchestration/workflow-journal-entry.js";
-import { decodeJsonColumn } from "../../plugins/sql-json-column.js";
+import { journalEntryOfCell, journalEntryPayload, journalRowPayloadOf } from "../../plugins/workflow-journal-payload.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { createHash } from "node:crypto";
 import { redactHead } from "../../observability/run-terminal.js";
@@ -72,8 +71,8 @@ export async function handleWorkflows(req, res, match, ctx) {
             if (journalStore === undefined)
                 throw new Error("workflow-journal reached without the workflowsJournal journal witness");
             const jq = new URLSearchParams(match.search);
-            const jLimit = Math.min(50, Math.max(1, Number(jq.get("limit") ?? 20) || 20));
-            const jOffset = Math.max(0, Number(jq.get("offset") ?? 0) || 0);
+            const jLimit = Math.min(50, Math.max(1, Math.trunc(Number(jq.get("limit") ?? 20)) || 20));
+            const jOffset = Math.max(0, Math.trunc(Number(jq.get("offset") ?? 0)) || 0);
             const MAX_ROW_BYTES = 64 * 1024;
             const firstLine = (t) => (t ? redactHead(t.split("\n")[0], 300) : undefined);
             const MAX_RESULT_CHARS = 2000;
@@ -114,31 +113,34 @@ export async function handleWorkflows(req, res, match, ctx) {
             };
             const js = journalStore;
             let projected;
-            if (js.loadPage) {
-                const page = await js.loadPage(wfId, scope, { offset: jOffset, limit: jLimit, maxResultBytes: MAX_ROW_BYTES });
-                projected = page.map((row) => {
-                    if (row.resultJson === null) {
-                        return oversizeStub(row.callKey, row.resultBytes);
-                    }
-                    try {
-                        const { payload, parked } = journalEntryPayload(journalEntryOfBody(row.callKey, decodeJsonColumn(row.resultJson, readJournalRowBody, `workflow_journal.result for entry ${row.callKey}`)));
+            try {
+                if (js.loadPage) {
+                    const page = await js.loadPage(wfId, scope, { offset: jOffset, limit: jLimit, maxResultBytes: MAX_ROW_BYTES });
+                    projected = page.map((row) => {
+                        if (row.resultJson === null) {
+                            return oversizeStub(row.callKey, row.resultBytes);
+                        }
+                        const { payload, parked } = journalEntryPayload(journalEntryOfCell(wfId, row.callKey, row.resultJson, `workflow_journal.result for entry ${row.callKey}`));
                         return projectEntry(row.callKey, payload, parked);
-                    }
-                    catch {
-                        return oversizeStub(row.callKey, row.resultBytes);
-                    }
-                });
+                    });
+                }
+                else {
+                    const entries = await journalStore.load(wfId, scope);
+                    projected = entries
+                        .sort((a, b) => callKeyOrdinal(a.callKey) - callKeyOrdinal(b.callKey))
+                        .slice(jOffset, jOffset + jLimit)
+                        .map((en) => {
+                        const { payload, parked } = journalEntryPayload(en);
+                        const bytes = Buffer.byteLength(journalRowPayloadOf(en));
+                        return bytes > MAX_ROW_BYTES ? oversizeStub(en.callKey, bytes) : projectEntry(en.callKey, payload, parked);
+                    });
+                }
             }
-            else {
-                const entries = await journalStore.load(wfId, scope);
-                projected = entries
-                    .sort((a, b) => callKeyOrdinal(a.callKey) - callKeyOrdinal(b.callKey))
-                    .slice(jOffset, jOffset + jLimit)
-                    .map((en) => {
-                    const { payload, parked } = journalEntryPayload(en);
-                    const bytes = Buffer.byteLength(journalRowPayloadOf(en));
-                    return bytes > MAX_ROW_BYTES ? oversizeStub(en.callKey, bytes) : projectEntry(en.callKey, payload, parked);
-                });
+            catch (e) {
+                if (!(e instanceof WorkflowJournalIncompatibleError))
+                    throw e;
+                sendError(res, 500, JOURNAL_INCOMPATIBLE_ERROR_CODE, `this run's journal holds a record the engine cannot read (entry #${e.ordinal}): the journal cannot be listed or resumed until that record is repaired from a kept copy — do not delete it (a missing entry makes a resume run that step again)`, { ordinal: e.ordinal });
+                return;
             }
             sendJson(res, 200, { runId: wfId, entries: projected, ...(projected.length === jLimit ? { nextOffset: jOffset + jLimit } : {}) });
             return;
@@ -366,6 +368,7 @@ export const WORKFLOW_RUN_DISPOSITIONS = {
     id: "forward",
     scope: "forward",
     status: "forward",
+    parked: { mint: (run) => (runParkedOf({ status: run.status, agents: [...rowsOf(run.agents)] }) ? true : undefined) },
     name: { redact: "redactSecrets" },
     description: { redact: "redactSecrets" },
     stats: { nested: WORKFLOW_RUN_STATS_DISPOSITIONS },