@sema-agent/server 7.134.0 → 7.136.0

package/dist/plugins/approval-ask-store-memory.js

@@ -1,6 +1,6 @@
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
-import { askRowOnCall, assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
+import { askRowCarriesOwner, askRowOnCall, assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -41,6 +41,10 @@ export class InMemoryApprovalAskStore {
     exportRows() {
         return { asks: [...this.asks.values()].map((r) => ({ ...r })), batches: [...this.batches.values()].map((b) => ({ ...b })) };
     }
+    peekAsk(askId) {
+        const row = this.asks.get(askId);
+        return row ? { ...row } : null;
+    }
     importRows(snapshot) {
         for (const r of snapshot.asks ?? [])
             this.asks.set(r.askId, { ...r, settledBy: r.settledBy ?? null });
@@ -112,19 +116,18 @@ export class InMemoryApprovalAskStore {
         row.updatedAtMs = patch.updatedAtMs;
         return true;
     }
-    async decideAsk(askId, batchId, decision) {
+    async decideAsk(askId, batchId, owner, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
         assertDecideSettledBy(decision);
-        const now = this.now();
+        const reading = (row) => projectDecideReading(row ? { ...row } : null, owner);
         const batch = this.batches.get(batchId);
         if (!batch || batch.state !== "OPEN") {
-            const row = this.asks.get(askId);
-            return { ok: false, reason: "batch_closed", row: row ? { ...row } : null };
+            return { ok: false, reason: "batch_closed", row: reading(this.asks.get(askId)) };
         }
         const ask = this.asks.get(askId);
-        if (!ask || ask.state !== "STREAM_PENDING" || ask.batchId !== batchId) {
-            return { ok: false, reason: "ask_not_pending", row: ask ? { ...ask } : null };
+        if (!ask || ask.state !== "STREAM_PENDING" || ask.batchId !== batchId || !askRowCarriesOwner(ask, owner)) {
+            return { ok: false, reason: "ask_not_pending", row: reading(ask) };
         }
         if (decision.idempotencyKey != null) {
             for (const [id, r] of this.asks) {
@@ -136,6 +139,7 @@ export class InMemoryApprovalAskStore {
         let encodedUpdatedInput;
         if (decision.updatedInput !== undefined)
             encodedUpdatedInput = encodeDecideUpdatedInput(decision.updatedInput);
+        const now = this.now();
         batch.rev += 1;
         batch.updatedAtMs = now;
         ask.state = "DECIDED";

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -82,8 +82,8 @@ export interface AskRow {
     decisionActor: unknown | null;
     decisionNote: string | null;
     /**
-     * 🔴 S-558(#1016 的持久半场)—— 这条决议的**结算来源**:`null` = 一个人答的(= 缺席律,core 对
-     * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词(S-1154 起写进来的只有决定体出处位
+     * 🔴 [ref]([ref] 的持久半场)—— 这条决议的**结算来源**:`null` = 一个人答的(= 缺席律,core 对
+     * 不带这一格的 outcome 逐字按 `"human"` 读),非 null = 宿主自报的那个词([ref] 起写进来的只有决定体出处位
      * `decidedBy:"policy"` 经 `liveSettledBy` 映射来的 `"policy"`,allow 与 deny 两向都写;词表属主恒是 core —— 见 {@link HostSettledBy})。
      *
      * **为什么必须是行上的一格**(病灶,7.93.3 合并树 codex ① 验真):`settledBy` 此前只到达**当次**回决的
@@ -92,7 +92,7 @@ export interface AskRow {
      * 在一条根本没有人的 run 里。不变量:**一条决议的来源在所有读回路径上是同一个事实**;唯一读回铸点 =
      * `tool-approval.ts` 的 `outcomeOfDecidedRow`。
      *
-     * 🔴 **为什么是自己一列,不是塞进 `decision_actor` 那只袋**(S-558 取舍,亲读后定):
+     * 🔴 **为什么是自己一列,不是塞进 `decision_actor` 那只袋**([ref] 取舍,亲读后定):
      *  · 那只袋是**自由载荷**——型是 `unknown`(见上一格),读回不过任何 schema(`parseJsonColumn` 返回
      *    `unknown`),schema 属主在别处([ref] ActorAssertion),`adoption/plan.ts` 的裁定 D2 把它连同
      *    `decision_note` 一起定为**史实字段,永不改写**。往一只没有属主、没有类型化读回的袋里塞一个
@@ -228,11 +228,11 @@ export interface DecideAskInput {
     /** 车4 §12-E:回决幂等键,赢 CAS 时随决议一起落列(见 `AskRow.idempotencyKey`)。缺席 ⇒ 列保持 NULL。 */
     idempotencyKey?: string | null;
     /**
-     * 🔴 S-558:本次回决的**结算来源**,与决议同一条 UPDATE 落列 `settled_by`(语义/两态读法/为什么是
+     * 🔴 [ref]:本次回决的**结算来源**,与决议同一条 UPDATE 落列 `settled_by`(语义/两态读法/为什么是
      * 自己一列,全在 {@link AskRow.settledBy})。缺席 ⇒ 列 NULL ⇒ 读回是「一个人答的」。
      *
      * 店**不判词**(词表属主是 core):写什么存什么。店只判**形** —— `assertDecideSettledBy` 的那一条
-     * (长度 ≤ 列宽;S-1154 起 approve 行也可以带来源位),理由见那只门的顶注;三 twin 同判。
+     * (长度 ≤ 列宽;[ref] 起 approve 行也可以带来源位),理由见那只门的顶注;三 twin 同判。
      */
     settledBy?: HostSettledBy;
     /** [ref]:ctrl+g 编辑实参,与决议同一条 UPDATE 落列(语义三态见 {@link AskRow.updatedInput})。
@@ -244,7 +244,8 @@ export interface DecideAskInput {
  * `idempotency_conflict`(车4 §12-E):同一 (task_id, idempotency_key) 已被**另一条** ask 的回决占用。
  * 🔴 方言错误的判别**收在店内**(TiDB `ER_DUP_ENTRY`/errno 1062 与 PG SQLSTATE 23505),端点只认这个
  * typed 臂 —— 否则每个消费层都得自己认两套驱动的错误对象形状,方言就漏出了持久层。
- * `row` = 判定时刻读到的本 ask 行(可能为 null:并发删)。
+ * `row` = 判定时刻读到的本 ask 行,经这次决议的属主维投影({@link projectDecideReading}):行不在(并发删)**或行已不带着
+ * 门判过的那位属主**(出域,[ref])⇒ `null` —— 两者同读,出域的输者拿不到别人的行。
  */
 export type DecideResult = {
     ok: true;
@@ -274,17 +275,17 @@ export declare function assertIdempotencyKeyShape(key: string): void;
 /** `settled_by` 列宽 = 这一格的唯一尺(两方言 DDL 与下面的形门读同一个常量,不手抄第二份)。 */
 export declare const MAX_SETTLED_BY_CHARS = 16;
 /** `settled_by` 这一列装得下这个词吗(1..{@link MAX_SETTLED_BY_CHARS})—— 店门口形门({@link assertDecideSettledBy})的**谓词本身**。
- *  S-1154 起决定口不再读它:wire 上的出处位是闭集(`host-decision.ts` 的 `APPROVAL_DECIDED_BY`),映射到这一列的词恒在尺内。 */
+ *  [ref] 起决定口不再读它:wire 上的出处位是闭集(`host-decision.ts` 的 `APPROVAL_DECIDED_BY`),映射到这一列的词恒在尺内。 */
 export declare function settledByFitsColumn(v: string): boolean;
 /**
- * S-558 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
+ * [ref] 的**入店卫生门**(三 twin 同判,与 {@link assertIdempotencyKeyShape} / {@link assertIntegralEpochMs} 同族)。
  * 判的是**形**,不是**词** —— 词表属主恒是 core,本层一个词都不认识。一条:
  *
  * **长度 ≤ 列宽**。`settled_by` 是 `VARCHAR(16)` 的闭集词列。不拦的话:MySQL 协议侧非严格模式**静默截断**、PG 侧直接
  * 报错 —— 同一份调用方代码在两个后端拿到两种答案(`assertIdempotencyKeyShape` 的 PAD SPACE 论证逐字同源),而**被截断过的
  * 词与原词是两个词**:一条决议的来源在库里变成了另一件事。空串同拒(core 那边它不是词,存进去只会读成一个假的「非人」)。
  *
- * 🔴 S-1154:此前的第二条「只与 `deny` 同行」**删了** —— 它的前提(「只有人能批准一个要执行的动作,core 对 `{allow:true,settledBy}`
+ * 🔴 [ref]:此前的第二条「只与 `deny` 同行」**删了** —— 它的前提(「只有人能批准一个要执行的动作,core 对 `{allow:true,settledBy}`
  * 一律 fail-closed 拒」)自 core 7.39.0 起不成立:策略的放行铸 `policy_allowed`,决定体的出处位 `decidedBy:"policy"` 在 allow 与 deny
  * 上都落这一列,approve 行带来源位是一条合法的行(读回铸点 `outcomeOfDecidedRow` 两向都读它)。今天写这一列的只有两条路:决定口经
  * `liveSettledBy` 映射来的 `"policy"`,与 `claimTerminal(refuse)` 的 {@link POLICY_REFUSAL_DECISION} —— 都是 core 在两向上都收的词。
@@ -362,7 +363,7 @@ export type AskTerminalClaimCurrent = {
     decision: AskDecision | null;
     /** [ref] 三态读法照 {@link AskRow.updatedInput}:键缺席 = 没带编辑;`null` 是编辑成 null 的值。 */
     updatedInput?: unknown;
-    /** S-558:赢家决议的**结算来源**(语义与两态读法见 {@link AskRow.settledBy})。**必填**(不是可选)——
+    /** [ref]:赢家决议的**结算来源**(语义与两态读法见 {@link AskRow.settledBy})。**必填**(不是可选)——
      *  可选会让投影漏挑这一列时静默编译过,而漏挑的后果恰是本批要修的病:CAS 输家把赢家的策略拒读成人拒。 */
     settledBy: HostSettledBy | null;
     /** 行上记着的成因,经问账行成因的唯一读口 `causeOfAskRow` 读出(`kind` 说它在这一行上的意思:VOID / DENIED = 终态成因,PARKING / PARKED = 转 park 的触发成因);
@@ -427,11 +428,37 @@ export interface BatchRow {
 export type AskCallCoordinate = Pick<AskRow, "taskId" | "legKey" | "toolCallId" | "sourceTaskId">;
 /** 「这一行在这次调用上」的唯一判据(四列逐字相等):InMemory twin 的筛子与 SQL twin 的出口对齐读同一只。 */
 export declare function askRowOnCall(row: AskRow, call: AskCallCoordinate): boolean;
+/**
+ * 🔴 [ref] —— **一只问的属主判据**(全仓唯一;两扇决议口 —— live 应答口 `POST /v1/tool-approvals/:id/respond`、耐久决断口
+ * `POST /v1/tasks/:taskId/asks/:askId/decision` —— 与按问读口都调它):调用方是不是这只问的属主。`owner` 只有一条来源律:有行的问读行上
+ * **当下的** `owner` 列(铸行写定,只有 `/v1/adoption` 改写它;进程内任何快照 —— 包括登记在铸卡那一刻记下的那一格 —— 都改不动);
+ * 没有行的问(问账没上场 / 旧族腿)只有登记记下的那一位可读。`null` = auth-off 单用户行,恒过。
+ * 门判过的那位属主再交给决议 CAS 的作用域({@link askRowCarriesOwner},[ref])。耐久决断口的 operator 越域臂不在这里 —— 那是那扇口自己的授权门。
+ */
+export declare function askOwnerAdmits(owner: string | null, principal: string | undefined): boolean;
+/**
+ * 🔴 [ref] —— **决议作用域的属主维**:这一行此刻带着的属主,是不是这次决议的门判过的那一位(逐字相等;`null` 只等于 `null`)。
+ *
+ * 律(一条):一次决议请求的作用域 = (ask, 批, **门判过的那位属主**)。属主的唯一来源是行上的 `owner` 列(铸行写定,只有 `/v1/adoption` 改写它);
+ * 门(耐久回决口 `owner ∨ operator`、live 应答口 `owner`)照旧在门里判授权,本谓词**不复判授权**,只绑「门判的那一份属主事实」——
+ * 门读行与 CAS 之间属主被改写,门的判断就不再是关于这一行的判断。于是这次请求拿到的**每一份**行读数(CAS 本身、CAS 输者的读数、
+ * 提交歧义的确认读、幂等回放的命中)都过这一只:出域 = 缺席,门按缺席答(与行不在同体同码)。
+ * InMemory twin 的判定、SQL twin 输者读数的投影、两扇门的确认读读同一只;SQL twin 的 UPDATE 谓词是它的方言镜像({@link decideOwnerWhere})。
+ */
+export declare function askRowCarriesOwner(row: AskRow | null, owner: string | null): row is AskRow;
+/** [ref]:决议输者读数的投影(三 twin 共用一份):行出了这次决议的属主域 ⇒ 读作缺席,不交出别人的行。 */
+export declare function projectDecideReading(row: AskRow | null, owner: string | null): AskRow | null;
 export interface ApprovalAskStore {
     /** 幂等 upsert。返回**行 + 本次是否真插入**(判别位语义见 {@link EnsureAskResult})。 */
     ensureAsk(row: NewAskRow): Promise<EnsureAskResult>;
     transitionAsk(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
-    decideAsk(askId: string, batchId: string, decision: DecideAskInput): Promise<DecideResult>;
+    /**
+     * 人答臂的单赢者 CAS。🔴 [ref]:`owner` = 这次决议的门**判过的**那位属主(门读到的行上 `owner` 列;活登记 = 铸卡时记下的那一份),
+     * **不是**调用方的主体 —— 运维代决别人的问,传的是那个别人。它是作用域的第三维(与 ask_id / batch_id 并列,判据 {@link askRowCarriesOwner}):
+     * 行此刻不带这位属主(门读之后被 `/v1/adoption` 改写)⇒ CAS 输、零写,`row` 读作 `null`(与行不在同读)。**必填**,不是可选:
+     * 缺省等于不绑属主,安全轴上那是静默放行。
+     */
+    decideAsk(askId: string, batchId: string, owner: string | null, decision: DecideAskInput): Promise<DecideResult>;
     /**
      * [ref]:原子终局 claim —— 把「争终局」与「读真相」并成**一次**店往返(胜负判定与败方 `current` 读数
      * 在同一原子单元内,语义见 {@link AskTerminalClaimOutcome})。[ref]-R1 的病根「CAS 与读真相是两次店
@@ -482,12 +509,12 @@ export interface ApprovalAskStore {
      *  后续件。 */
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
     /**
-     * 🔴 S-944 / SN-C1:**这次调用在这条腿上的全部行** —— 任意状态、任意 ask 身份(同一调用不同类集 = 不同 askId 的几只问、升级前按旧派生
+     * 🔴 [ref] / SN-C1:**这次调用在这条腿上的全部行** —— 任意状态、任意 ask 身份(同一调用不同类集 = 不同 askId 的几只问、升级前按旧派生
      * 写的行,都在其中)。坐标 = {@link AskCallCoordinate} 四列**精确**匹配;序 = `created_at_ms ASC, ask_id ASC`(确定性)。
      *
      * 唯一消费者 = 会话授权短路的争议判据(`tool-approval.ts` `sessionGrantUncontestedByRow`):「这次调用在腿内有行 ⇒ 一揽子放行不得代答」。
      * 为什么按调用而不是按 askId 点读:争议的真源是**调用**(人对这次调用说过什么 / 这次调用还有一张卡挂着),ask 身份只是其中一问的主键;
-     * 身份可以加轴(S-944 加了类集),争议判据不得依赖身份 —— 按身份点读在身份加轴的那一刻就把同调用的别的问、旧派生的行读成「不存在」。
+     * 身份可以加轴([ref] 加了类集),争议判据不得依赖身份 —— 按身份点读在身份加轴的那一刻就把同调用的别的问、旧派生的行读成「不存在」。
      *
      * 三 twin 同答:SQL twin 读后按四列逐字再滤一遍 —— MySQL 协议的 VARCHAR 等值带 PAD SPACE(`'tc'` = `'tc '`),PG(`COLLATE "C"`)与
      * InMemory 严格比较;不在入口拒(调用 id 是引擎铸的原值,首尾空白不归本店判),在出口对齐。索引:走 `idx_ask_task_state`
@@ -585,7 +612,7 @@ export declare const TIDB_APPROVAL_ASK_STATEMENTS: readonly string[];
 /** {@link TIDB_APPROVAL_ASK_STATEMENTS} 的遍历壳——生产路径走 `tidb-pool.ts` 的中央 `ensureSchema`
  *  (那里展开了同一份数组),本函数留给只需要这两张表的集成测试。 */
 export declare function ensureTiDBApprovalAskSchema(pool: MySqlPool): Promise<void>;
-/** S-287:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgApprovalAskSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
+/** [ref]:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgApprovalAskSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
 export declare const APPROVAL_ASK_INDEXES: readonly IndexSpec[];
 export declare function ensurePgApprovalAskSchema(q: PgQueryFn): Promise<void>;
 /**
@@ -638,7 +665,7 @@ export declare class SqlApprovalAskStore implements ApprovalAskStore {
     private getBatchOn;
     ensureAsk(row: NewAskRow): Promise<EnsureAskResult>;
     transitionAsk(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
-    decideAsk(askId: string, batchId: string, decision: DecideAskInput): Promise<DecideResult>;
+    decideAsk(askId: string, batchId: string, owner: string | null, decision: DecideAskInput): Promise<DecideResult>;
     /**
      * [ref] 原子终局 claim(接口契约见 {@link ApprovalAskStore.claimTerminal};类型语义见
      * {@link AskTerminalClaimOutcome})。expire 意图 = 既有 `expireAsk` 事务**原体**(步⓪-③ 逐字保留,

package/dist/plugins/approval-ask-store-sql.js

@@ -89,6 +89,15 @@ export function projectAskTerminalClaimTruth(row) {
 export function askRowOnCall(row, call) {
     return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceTaskId === call.sourceTaskId;
 }
+export function askOwnerAdmits(owner, principal) {
+    return owner === null || owner === principal;
+}
+export function askRowCarriesOwner(row, owner) {
+    return row !== null && row.owner === owner;
+}
+export function projectDecideReading(row, owner) {
+    return askRowCarriesOwner(row, owner) ? row : null;
+}
 export const APPROVAL_ASK_TABLE = "approval_ask";
 export const APPROVAL_BATCH_TABLE = "approval_batch";
 export const TIDB_APPROVAL_ASK_STATEMENTS = [
@@ -365,6 +374,11 @@ function ph(dialect, n) {
 function pendingClaimWhere(dialect, firstParam) {
     return `ask_id = ${ph(dialect, firstParam)} AND batch_id = ${ph(dialect, firstParam + 1)} AND state = 'STREAM_PENDING'`;
 }
+function decideOwnerWhere(dialect, owner, param) {
+    if (owner === null)
+        return { sql: "owner IS NULL", params: [] };
+    return dialect === "tidb" ? { sql: "CAST(owner AS BINARY) = CAST(? AS BINARY)", params: [owner] } : { sql: `owner = ${ph(dialect, param)}`, params: [owner] };
+}
 export class SqlApprovalAskStore {
     db;
     constructor(db) {
@@ -451,23 +465,24 @@ export class SqlApprovalAskStore {
         const res = await this.db.query(`UPDATE ${APPROVAL_ASK_TABLE} SET ${setSql}, rev = rev + 1 WHERE ask_id = ${askIdPh} AND state = ${fromPh}`, [...vals, askId, from]);
         return res.affected === 1;
     }
-    async decideAsk(askId, batchId, decision) {
+    async decideAsk(askId, batchId, owner, decision) {
         if (decision.idempotencyKey != null)
             assertIdempotencyKeyShape(decision.idempotencyKey);
         assertDecideSettledBy(decision);
         const now = Date.now();
         const dialect = this.db.dialect;
+        const ownerWhere = decideOwnerWhere(dialect, owner, 11);
         const conn = await this.db.connect();
         try {
             await conn.begin();
             const batchRes = await conn.query(this.q(`UPDATE ${APPROVAL_BATCH_TABLE} SET rev = rev + 1, updated_at_ms = ? WHERE batch_id = ? AND state = 'OPEN'`, `UPDATE ${APPROVAL_BATCH_TABLE} SET rev = rev + 1, updated_at_ms = $1 WHERE batch_id = $2 AND state = 'OPEN'`), [now, batchId]);
             if (batchRes.affected !== 1) {
                 await conn.rollback();
-                return { ok: false, reason: "batch_closed", row: await this.getAskOn(conn, askId) };
+                return { ok: false, reason: "batch_closed", row: projectDecideReading(await this.getAskOn(conn, askId), owner) };
             }
             let askRes;
             try {
-                askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, updated_input=${ph(dialect, 5)}, decided_at_ms=${ph(dialect, 6)}, idempotency_key=${ph(dialect, 7)}, rev=rev+1, updated_at_ms=${ph(dialect, 8)} WHERE ${pendingClaimWhere(dialect, 9)}`, [
+                askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, updated_input=${ph(dialect, 5)}, decided_at_ms=${ph(dialect, 6)}, idempotency_key=${ph(dialect, 7)}, rev=rev+1, updated_at_ms=${ph(dialect, 8)} WHERE ${pendingClaimWhere(dialect, 9)} AND ${ownerWhere.sql}`, [
                     decision.decision,
                     decision.decisionActor == null ? null : this.json(decision.decisionActor),
                     decision.decisionNote ?? null,
@@ -478,18 +493,19 @@ export class SqlApprovalAskStore {
                     now,
                     askId,
                     batchId,
+                    ...ownerWhere.params,
                 ]);
             }
             catch (err) {
                 if (this.isDupKey(err)) {
                     await conn.rollback();
-                    return { ok: false, reason: "idempotency_conflict", row: await this.getAskOn(conn, askId) };
+                    return { ok: false, reason: "idempotency_conflict", row: projectDecideReading(await this.getAskOn(conn, askId), owner) };
                 }
                 throw err;
             }
             if (askRes.affected !== 1) {
                 await conn.rollback();
-                return { ok: false, reason: "ask_not_pending", row: await this.getAskOn(conn, askId) };
+                return { ok: false, reason: "ask_not_pending", row: projectDecideReading(await this.getAskOn(conn, askId), owner) };
             }
             await conn.commit();
         }

package/dist/plugins/approval-exemption-store.d.ts

@@ -49,7 +49,7 @@ export declare class MemoryApprovalExemptionStore implements ApprovalExemptionSt
     deleteBySession(sessionId: string): Promise<number>;
 }
 /**
- * 🔴 S-582 —— **fail-closed per session file.** A record in the MIDDLE of a session's log that cannot be read (bit rot,
+ * 🔴 [ref] —— **fail-closed per session file.** A record in the MIDDLE of a session's log that cannot be read (bit rot,
  * a hand edit, a line `42`, an object missing `toolName`) used to be skipped silently. When that line was a REVOKE
  * tombstone, the grant before it survived the replay: a "don't ask again" the operator had revoked came back and the
  * tool ran WITHOUT asking — the fail-open direction on the approval axis. We cannot tell which fact the line held, so
@@ -63,14 +63,14 @@ export declare class FileApprovalExemptionStore implements ApprovalExemptionStor
     private readonly dir;
     private readonly bySession;
     private readonly logs;
-    /** S-582: sanitized session key → that session log's gate (only files that replayed a bad record are listed). */
+    /** [ref]: sanitized session key → that session log's gate (only files that replayed a bad record are listed). */
     private readonly corruptGates;
     private readonly warn;
     /** @param opts.warn corrupt-read disclosure seat (`LocalBackend` wires `discloseWarn`; absent ⇒ the owner falls back to `console.warn`, never to silence). */
     constructor(root: string, opts?: {
         warn?: Logger["warn"];
     });
-    /** S-582: first line of every judging / appending method (see the class note). */
+    /** [ref]: first line of every judging / appending method (see the class note). */
     private assertUsable;
     private pathFor;
     /** Replay every session log (torn-tail-safe; last-wins with revoke tombstones). Index keyed by the SANITIZED id. */

package/dist/plugins/approval-nonce-store.d.ts

@@ -74,9 +74,9 @@ export declare class MemoryApprovalNonceStore implements ApprovalNonceStore {
  * 的既有暴露同级,且 SQL 车道不受此影响);**绝不**能出现的是反向 —— 记录还在却被读成不在,那要靠
  * core JSONL 读法的断尾安全(半行丢弃)兜住。
  *
- * 🔴 **S-582:中间一行读不出 ⇒ 整本拒用(fail-closed)**。撕尾是崩溃的正常形(core 丢弃且不报);而**中间**
+ * 🔴 **[ref]:中间一行读不出 ⇒ 整本拒用(fail-closed)**。撕尾是崩溃的正常形(core 丢弃且不报);而**中间**
  * 那一行读不出(位腐 / 手改 / 一行 `42` / 缺键的对象)时,我们不知道它是哪一只 nonce —— 修前静默跳过它,等于
- * 让那只已消费的证明再被受理一次(S-280 要关的重放洞换了个入口)。现在由属主披露(`approval_nonce_corrupt_read`)
+ * 让那只已消费的证明再被受理一次([ref] 要关的重放洞换了个入口)。现在由属主披露(`approval_nonce_corrupt_read`)
  * 并合上 {@link gate}:`consume` / `reapExpired` 第一行即带码拒(`JsonlStoreCorruptError`,外层答 500);`nowMs` 不读账、
  * 不经闸。清扫同样要拒:压实会把幸存者原样写回、把坏行连同证据一起抹掉,下一次重启读到的就是一本「干净」的账 ——
  * 闸自己打开,而那只 nonce 仍然没被记住。出路在拒绝句里(移开文件的代价与安全时机)。
@@ -89,7 +89,7 @@ export declare class FileApprovalNonceStore implements ApprovalNonceStore {
      *  从复合键里**解析**出来是一条没必要的反向铸形 —— 记录留着就不必解析。 */
     private readonly rows;
     private log;
-    /** S-582:本账的损坏闸(见类注)。 */
+    /** [ref]:本账的损坏闸(见类注)。 */
     private readonly gate;
     /** @param opts.warn 腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 属主退回 `console.warn`,不退回沉默)。 */
     constructor(root: string, opts?: {

package/dist/plugins/background-agent-store-sql.d.ts

@@ -44,7 +44,7 @@ type ListOpts = {
     limit?: number;
 };
 export declare function ensureTiDBBackgroundAgentSchema(pool: Pool): Promise<void>;
-/** S-287:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgBackgroundAgentSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
+/** [ref]:本 store 的索引**声明**(两方言共用一份)。PG 侧由下面的 `ensurePgBackgroundAgentSchema` 应用,MySQL 侧由 `tidb-pool.ts` 的中央 `ensureSchema` 应用(那里内联 `KEY` 已在 `CREATE TABLE` 里 ⇒ 新建库探到即零 DDL,存量库缺谁补谁)。加索引以外的 schema 变更仍归运维,见 `plugins/ensure-index.ts` 头注。 */
 export declare const BACKGROUND_AGENT_INDEXES: readonly IndexSpec[];
 export declare function ensurePgBackgroundAgentSchema(q: PgQueryFn): Promise<void>;
 export declare class TiDBBackgroundAgentStore implements BackgroundAgentStore {

package/dist/plugins/background-shell-support.d.ts

@@ -106,7 +106,7 @@ export interface BackgroundShellDriver<S> {
     /** Best-effort cleanup of ONE shell's transport resources (kill + remove temp dirs/handles). Should not throw. */
     disposeOne(state: S): Promise<void>;
     /**
-     * S-745(core 7.32.0 #1107)—— **可选**的同步硬收一枪(`BackgroundShellCapability.killBackgroundNow` 的 driver 半场)。
+     * [ref](core 7.32.0 [ref])—— **可选**的同步硬收一枪(`BackgroundShellCapability.killBackgroundNow` 的 driver 半场)。
      * 只有**本机有进程组可发**的 driver 实现它(今天只有 host 车道);远端 / 沙箱车道留空 ⇒ 座位根本不挂出来,core 对那些行
      * 答 `no_pgid` 并派普通 kill。契约(core `docs/background-process-lifetime.md`):同步(无 TERM、无定时器、无 await)、
      * 幂等、永不抛、只对**证明得了还是自己的** pid 发信号(观察到退出 ⇒ `already_gone`,一枪都不发)。
@@ -162,7 +162,7 @@ export declare class BackgroundShellManager<S> {
     poll(shellId: BackgroundShellId): Promise<Result<BackgroundPoll, BackgroundShellError>>;
     kill(shellId: BackgroundShellId): Promise<Result<void, BackgroundShellError>>;
     /**
-     * S-745 —— 座位 `killBackgroundNow(shellId)` 的 manager 半场:**同步**、永不抛。
+     * [ref] —— 座位 `killBackgroundNow(shellId)` 的 manager 半场:**同步**、永不抛。
      *  · 不是本 env 的 shell(未知 / 伪造 / 已被驱逐的终态行)⇒ `already_gone`(core 契约「or not its shell」);
      *  · driver 不实现 {@link BackgroundShellDriver.killNow} ⇒ `no_pgid`(没有同步硬收可落;实现座位的 env 才会走到这里);
      *  · driver 答出三词之外 ⇒ `no_pgid`(没有落地,可重试)。driver 的座位按契约**永不抛**(host 的那只由构造保证:只读子进程句柄

package/dist/plugins/blob-backend.d.ts

@@ -121,7 +121,7 @@ export declare class SqlBlobBackend implements BlobBackend {
      *  (a): an over-cap blob is REJECTED (typed {@link BlobTooLargeError}) BEFORE the driver ever sees the bytes —
      *  the alternative is an inscrutable packet-limit error deep in the driver, and on the HTTP face a 502 that
      *  invites the peer to retry a blob that can never land.
-     *  🔴 The cap is judged ON THE CONNECTION THAT WRITES (S-1746): `max_allowed_packet` is a session value, fixed per
+     *  🔴 The cap is judged ON THE CONNECTION THAT WRITES ([ref]): `max_allowed_packet` is a session value, fixed per
      *  connection, so the write borrows one connection through {@link connectJudged}, which reads ITS walls, judges, and — when
      *  the refusal is that connection's packet wall and the server's global wall is higher — replaces the stale connection and
      *  judges once more; the INSERT runs on the connection that passed. Never a pool-level reading, never a bare `pool.query`. */

package/dist/plugins/blob-backend.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
+import { isNoSuchBucketAnswer } from "./s3-answer.js";
 import { connectJudged, mysqlDriver, packetWallStatementBytes, pgDriver, rowWallPayloadBytes, sqlWallsOf } from "./sql-driver.js";
 import { createLogger } from "../observability/logger.js";
 const BLOB_GC_GRACE_MS = 3_600_000;
@@ -328,7 +329,7 @@ export class MinioBlobBackend {
         if (res.ok)
             return { state: "present" };
         const body = await res.text().catch(() => "");
-        if (res.status === 404 && /<Code>NoSuchBucket<\/Code>/.test(body))
+        if (isNoSuchBucketAnswer(res.status, body))
             return { state: "missing" };
         return { state: "unknown", detail: `HTTP ${res.status}` };
     }

package/dist/plugins/caching-session-store.d.ts

@@ -3,33 +3,34 @@ import type { OwnerAwareSessionStore, SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import type { InstructionSourceStore } from "../instruction-source-notice.js";
-import type { SessionFaceReader } from "../session-incarnation.js";
 import type { OwnerlessClaim } from "../delegated-session-owner.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
     sweepIntervalMs?: number;
-    /** Called once per warm hit that turned out stale (the store's head no longer names the cached leaf, or the session is
-     *  gone): the entry was dropped and the session woken from the store again. Not an error — the operator signal for
+    /** Called once per warm hit that turned out stale (the store's head no longer names the cached occupant and leaf, or the
+     *  session is gone): the entry was dropped and the session woken from the store again. Not an error — the operator signal for
      *  "requests for one session alternate between replicas within the TTL" (the hit rate affinity would buy back). */
     onStaleHit?: (sessionId: string) => void;
 }
-/** The store's current head for one session — the one read every warm hit is checked against (`undefined` = no such
- *  session). The same single-row read `OwnerAwareSessionStore.getHead` names; this cache requires its inner store to have it. */
-export type SessionHeadReader = Required<Pick<OwnerAwareSessionStore, "getHead">>;
+/** The store's current head for one session — core `SessionStore.headOf`, the one by-id read of the row every warm hit is checked
+ *  against (`undefined` = no such session). This cache requires its inner store to have it. */
+export type SessionHeadReader = Required<Pick<SessionStore, "headOf">>;
 /**
  * Warm cache in front of a durable {@link SessionStore}.
  *
  * Keeps a woken session in memory and **reuses the same storage instance across turns**, so an active session is not
  * woken from the store (meta row + event log) on every short turn. Idle sessions expire after `ttlSec`; `release` evicts.
  *
- * **One rule: a warm entry is served only while the store's head for that session still names the leaf the entry
- * holds.** Every hit reads the head first (`getHead` — one primary-key row read on the SQL twins); head gone or leaf
- * moved ⇒ the entry is dropped and the session is woken from the store again ({@link CachingOptions.onStaleHit}). The
- * leaf is the token because it is exactly what the stores' conditional writes compare (`expectedLeafId`): a handle this
- * cache hands out is never behind the store's leaf, so those writes fail only on a genuinely concurrent write — two runs
- * writing one session at the same time. Any number of replicas may share one store under any routing; session affinity
- * only raises the hit rate.
+ * **One rule: a warm entry is served only while the store's head for that session still names the occupant and the leaf
+ * the entry holds.** Every hit reads the head first (`headOf` — one primary-key row read on the SQL twins); head gone, another
+ * occupant (core `compareOccupants` — anything but `same`, `unknown` included), or leaf moved ⇒ the entry is dropped and the
+ * session is woken from the store again ({@link CachingOptions.onStaleHit}). The leaf is half the token because it is exactly
+ * what the stores' conditional writes compare (`expectedLeafId`): a handle this cache hands out is never behind the store's
+ * leaf, so those writes fail only on a genuinely concurrent write — two runs writing one session at the same time. The
+ * occupant is the other half: a row another replica deleted and created again under the same id can stand at the leaf the
+ * entry holds (both empty — `null`), and serving the old view would hand a run the previous occupant's token. Any number of
+ * replicas may share one store under any routing; session affinity only raises the hit rate.
  *
  * Open item (the same before this rule): a write that rewrites history while leaving the final leaf id where it was —
  * a session-sync replace / `overwrite-dst` staged commit on ANOTHER replica that changes entry payloads under the same
@@ -50,17 +51,12 @@ export declare class CachingSessionStore implements SessionStore {
     private readonly ttlMs;
     private readonly timer?;
     private readonly onStaleHit?;
-    /** Delegated tenant-ownership ops, present only if the inner store exposes them (the TiDB store does). */
-    readonly ownerOf?: (sessionId: string) => Promise<string | null | undefined>;
-    /** S-790:属主 + 化身一次读,纯转发(不经暖缓存 —— 化身判的就是「此刻坐在座位上的是谁」,缓存的旧答案正是要消灭的那一形)。
-     *  🔴 必须转发(与 retention / placements / instruction-source 同一条教训):生产默认把真店包进本类,不转发 = parked 决定腿
-     *  与记忆座在默认部署上读不到化身。 */
-    readonly sessionFaceOf?: SessionFaceReader;
-    /** core `SessionStore.incarnationOf`(按 id 读住客)—— 同一条纯转发、同一条理由:答的是行上那一格,绝不从暖缓存里那只会话的元数据答
-     *  (缓存的会话活得比「另一只店删掉又重建了这一行」长)。🔴 必须转发:k8s 工作区空间的每 run 读与起服门读的就是本类。 */
-    readonly incarnationOf?: SessionStore["incarnationOf"];
+    /** core `SessionStore.headOf` —— 按 id 读一行(属主 / 住客 / 叶子)的唯一读口,**纯转发、不经暖缓存**(答的是行,绝不从暖缓存里那只会话的元数据答 ——
+     *  缓存的会话活得比「另一只店删掉又重建了这一行」长)。内层店必有(本类的暖命中按它核新鲜)。🔴 必须转发:生产默认把真店包进本类,授权口 / 属主门 /
+     *  parked 两读 / k8s 工作区空间 / SSE 探针 / resume-at 读的都是本类。 */
+    readonly headOf: SessionHeadReader["headOf"];
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
-    /** S-1770 委派继承律的认领口,纯转发(写的是行上的属主那一格 —— 只 CAS 子行自己,不碰暖缓存里的会话;停驻挂点在默认部署上读的就是本类 —— 与 `placementOf` 同转发同缺:内店记录委派树 ⇒ 两只都在)。 */
+    /** [ref] 委派继承律的认领口,纯转发(写的是行上的属主那一格 —— 只 CAS 子行自己,不碰暖缓存里的会话;停驻挂点在默认部署上读的就是本类 —— 与 `placementOf` 同转发同缺:内店记录委派树 ⇒ 两只都在)。 */
     readonly claimOwnerless?: OwnerlessClaim;
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */
@@ -84,16 +80,11 @@ export declare class CachingSessionStore implements SessionStore {
     /** The auto-titler's NULL-only title write (SQL twins + local sidecar carry it; pure pass-through). */
     readonly setTitleIfNull?: (sessionId: string, title: string) => Promise<boolean>;
     readonly probeTitle?: (sessionId: string) => Promise<"none" | "untitled" | "titled">;
-    /** S-690 —— 换源通告的基线面(`session_meta.instruction_source` / local sidecar),纯转发、不经暖缓存。
+    /** [ref] —— 换源通告的基线面(`session_meta.instruction_source` / local sidecar),纯转发、不经暖缓存。
      *  🔴 必须转发(与 retention / placements 同一条教训):默认 `SESSION_CACHE_TTL_SEC=300` 把真店包进本类,
      *  而装配点按「店上两个方法都在」判席 —— 不转发 = 默认部署上换源通告**静默不发**,且没有任何一处报错。 */
     readonly readInstructionSource?: InstructionSourceStore["readInstructionSource"];
     readonly recordInstructionSource?: InstructionSourceStore["recordInstructionSource"];
-    /** E18 — delegate the leaf read straight to inner (a cache-bypassing single SELECT; the resume-at turn-capture
-     *  reads the DURABLE leaf, not a possibly-stale cached view — same discipline as the §0.5 repo ops above). */
-    readonly getLeafId?: (sessionId: string) => Promise<string | null>;
-    /** [ref] 六轮复审:owner+leafId 原子快照透传(cache-bypassing,getLeafId 同姿势)。内层店必有(本类的暖命中按它核新鲜)。 */
-    readonly getHead: SessionHeadReader["getHead"];
     /** 2c session-sync — delegated export/import seam, DURABLE (bypasses the warm cache exactly like
      *  list/fork: an export reads the full durable log, an import writes durable state). */
     readonly exportEntries?: (sessionId: string) => Promise<SessionTreeEntry[] | null>;
@@ -154,9 +145,9 @@ export declare class CachingSessionStore implements SessionStore {
     touch(sessionId: string): Promise<void>;
     release(sessionId: string): Promise<void>;
     /**
-     * The cache's one rule: the warm entry for `sessionId`, if the store's head still names the leaf it holds; otherwise
-     * the entry is dropped (counted once via `onStaleHit`) and `undefined` sends the caller to the store. The head is read
-     * first, the cached leaf second: a write this replica commits in between can only turn a fresh verdict into a stale
+     * The cache's one rule: the warm entry for `sessionId`, if the store's head still names the occupant and the leaf it holds;
+     * otherwise the entry is dropped (counted once via `onStaleHit`) and `undefined` sends the caller to the store. The head is
+     * read first, the cached view second: a write this replica commits in between can only turn a fresh verdict into a stale
      * one (an extra wake), never the reverse.
      */
     private freshHit;

package/dist/plugins/caching-session-store.js

@@ -1,4 +1,4 @@
-import { admitSessionPlacement } from "@sema-agent/core";
+import { admitSessionPlacement, compareOccupants } from "@sema-agent/core";
 import { placementCapabilityOf } from "./session-placement.js";
 export class CachingSessionStore {
     inner;
@@ -7,9 +7,7 @@ export class CachingSessionStore {
     ttlMs;
     timer;
     onStaleHit;
-    ownerOf;
-    sessionFaceOf;
-    incarnationOf;
+    headOf;
     register;
     claimOwnerless;
     listSessions;
@@ -21,8 +19,6 @@ export class CachingSessionStore {
     probeTitle;
     readInstructionSource;
     recordInstructionSource;
-    getLeafId;
-    getHead;
     exportEntries;
     listEntryIds;
     exportEntriesStream;
@@ -39,7 +35,7 @@ export class CachingSessionStore {
         this.inner = inner;
         this.ttlMs = Math.max(0, opts.ttlSec) * 1000;
         this.onStaleHit = opts.onStaleHit;
-        this.getHead = inner.getHead.bind(inner);
+        this.headOf = inner.headOf.bind(inner);
         const declared = inner.retention;
         if (declared !== undefined)
             this.retention = declared;
@@ -51,12 +47,6 @@ export class CachingSessionStore {
         if (typeof innerPlacementOf === "function")
             this.placementOf = (id) => innerPlacementOf.call(inner, id);
         const ownerAware = inner;
-        if (ownerAware.ownerOf)
-            this.ownerOf = ownerAware.ownerOf.bind(inner);
-        if (ownerAware.sessionFaceOf)
-            this.sessionFaceOf = ownerAware.sessionFaceOf.bind(inner);
-        if (typeof inner.incarnationOf === "function")
-            this.incarnationOf = inner.incarnationOf.bind(inner);
         if (ownerAware.register)
             this.register = ownerAware.register.bind(inner);
         if (ownerAware.claimOwnerless)
@@ -77,8 +67,6 @@ export class CachingSessionStore {
             this.recordInstructionSource = ownerAware.recordInstructionSource.bind(inner);
         if (ownerAware.fork)
             this.fork = ownerAware.fork.bind(inner);
-        if (ownerAware.getLeafId)
-            this.getLeafId = ownerAware.getLeafId.bind(inner);
         if (ownerAware.exportEntries)
             this.exportEntries = ownerAware.exportEntries.bind(inner);
         if (ownerAware.listEntryIds)
@@ -188,8 +176,8 @@ export class CachingSessionStore {
         const hit = this.cache.get(sessionId);
         if (hit === undefined)
             return undefined;
-        const head = await this.inner.getHead(sessionId);
-        if (head !== undefined && head.leafId === (await hit.acquired.session.getLeafId()))
+        const head = await this.inner.headOf(sessionId);
+        if (head !== undefined && compareOccupants(head, await hit.acquired.session.getMetadata()) === "same" && head.leafId === (await hit.acquired.session.getLeafId()))
             return hit;
         if (this.cache.get(sessionId) === hit)
             this.cache.delete(sessionId);