@sema-agent/server 7.136.0 → 7.138.0

package/dist/plugins/local-session-store.d.ts

@@ -4,6 +4,7 @@ import type { SessionRowPatch } from "../session-row.js";
 import { type Logger } from "../observability/logger.js";
 import { type SessionFace } from "../session-incarnation.js";
 import { type InstructionSourceBaseline } from "../instruction-source-notice.js";
+import type { SessionWorkspace } from "../session-workspace.js";
 import { type StagedCommitOptions, type StagingHandle, type SyncRelation } from "../session-sync-kernel.js";
 /**
  * local 车道会话存档的**唯一 repo 出口**:本仓里每一只读 `<root>/sessions/*.jsonl` 的 `FileSessionRepo` 都从这里取(`LocalSessionStore` 的底座与会话视图口
@@ -64,6 +65,9 @@ export declare class LocalSessionStore implements SessionStore {
      *  run selected, encoded like the SQL twins' `session_meta.instruction_source` column ('' = none; missing key = never
      *  recorded). Its own file for the same reason titles have theirs: one small map per concern, no format coupling. */
     private readonly instructionSources;
+    /** 会话行的位置与项目那一格(`session-workspaces.json`)—— SQL 孪生 `session_meta.workspace` 的 local 对位:`{ [sessionId]: 那一格的文本 }`,
+     *  文本与 SQL 列同一只编解码(`session-workspace-cell.ts`,一格读不出 ⇒ 读作没有记录并计一次)。缺键 = 没有记录。一事一档,理由同 titles。 */
+    private readonly workspaces;
     /**
      * 会话元数据(`session-incarnations.json`,一格的形与两种读法见 {@link SessionMetaCell}):**属主与化身的唯一真源**,SQL 孪生
      * `session_meta` 行上 `owner` / `incarnation` 两列在本店的对位。两样都**必须落盘**:
@@ -175,6 +179,13 @@ export declare class LocalSessionStore implements SessionStore {
      * 开始之前共享的那张表只含落过盘的值,判定永远不会建立在一个没落过盘的值上(codex che-NM r2 [medium])。
      */
     recordInstructionSource(sessionId: string, expected: InstructionSourceBaseline, source: string | null): Promise<void>;
+    /** 会话行的位置与项目那一格(local 孪生;读法与 SQL 两孪生同一只 `decodeSessionWorkspaceCell`)。缺键 ⇒ `undefined`。 */
+    readSessionWorkspace(sessionId: string): Promise<SessionWorkspace | undefined>;
+    /**
+     * 整格覆写(最后一帧胜;唯一调用方 = 腿的记录座)。与 SQL 孪生「`UPDATE … WHERE session_id = ? AND incarnation = ?`」同义:**会话不在、或同 id
+     * 已换了住客 ⇒ 不写**,判与写排在这只会话的写锁里(删除 / 换人同锁 —— 判过的住客在这一笔落盘之前换不掉)。落不了盘 ⇒ 内存不动、抛。
+     */
+    recordSessionWorkspace(sessionId: string, incarnation: string, workspace: SessionWorkspace): Promise<void>;
     /** Best-effort, one-shot hydrate of the persisted lastActivity map (no-op when not persisting / no sidecar yet). A
      *  read/parse error degrades to an empty map (createdAt ordering) rather than failing the list — the picker still
      *  works, just without restart-persisted recency. Memoized so concurrent listSessions share one read. */
@@ -235,11 +246,6 @@ export declare class LocalSessionStore implements SessionStore {
      * `REQUIRE_PRINCIPAL=true`,授权口也只在那时才把 principal 递过来认领(`security.ts` `createAuthorizer`)。
      */
     register(sessionId: string, owner: string | null): Promise<void>;
-    /** 2c P1d-β — re-stamp the session's owner WITHOUT rewriting entries (the staged-commit `identical` path: the log is
-     *  already present & equal, so only the owner needs re-stamping to the importing principal, §9). Persisted like every
-     *  owner write; the incarnation is untouched (same occupant). No cell (no such session) ⇒ no-op. Only caller:
-     *  {@link commitStagedImport}, inside the session's write lock. */
-    private restampOwner;
     touch(sessionId: string): Promise<void>;
     /** Durable history is retained by the repo; just drop the in-flight cache entry (mirrors TiDBSessionStore.release). */
     release(sessionId: string): Promise<void>;
@@ -322,27 +328,60 @@ export declare class LocalSessionStore implements SessionStore {
         afterSeq?: number;
         batchSize?: number;
     }): Promise<AsyncIterable<SessionTreeEntry> | null>;
-    /** 2c session-sync — IMPORT a verbatim entry log into `sessionId` via core `SessionRepo.importEntries`
-     *  (which runs the `validateEntriesForImport` fail-closed gate before writing). `owner` is the authenticated
-     *  importing principal (re-stamped into the service-side owner map; core's local repo has no owner column, §9).
-     *  `owner=null` (single-user local) is passed as `undefined` to the core seam (its owner param is `string | undefined`).
-     *  The owner is recorded in the session-meta cell (persisted), together with the incarnation. */
+    /**
+     * 2c session-sync — IMPORT a verbatim entry log into `sessionId`(引擎的 `validateEntriesForImport` 闸在引擎仓的导入里先跑:坏包一个字节不写)。`owner` = 鉴权过的导入者。
+     * 与引擎 `SessionRepo.importEntries` 的导入律同一句,只是**属主在本店的属主格上判**(会话元数据那一格是本店唯一的属主真源;本店建的存档在引擎仓里
+     * 不带属主戳 —— `register` 只 `repo.create({ id })` —— 引擎仓的属主比较替这一格答不了):落在既有行上 ⇒ 只落在导入者自己的行上(读不中 ⇒ `conflict`,
+     * 一个字节不写),存档原地换日志、行原样;落在不存在的 id 上 ⇒ 新行(属主 = 导入者,铸一只化身)。整段在这只会话的写锁里;日志 = {@link swapLogHeld},行收尾 = {@link finishSwap}。
+     */
     importEntries(sessionId: string, owner: string | null, entries: SessionTreeEntry[]): Promise<void>;
-    /** importEntries / replaceEntries 的共用写半场:导日志 + 一格写全属主与化身(新建铸的那只,或换装沿用的那只)。调用方持这只会话的写锁。 */
-    private importEntriesAs;
-    /** 2c session-sync (§7/§8) — IDEMPOTENT REPLACE. The local twin's replace is DELETE-then-IMPORT: core's
-     *  InMemorySessionRepo / FileSessionRepo expose no single replace primitive, but the local backend is single-writer
-     *  with NO compaction floor / cross-instance race (a process-local in-memory map / a single-process file repo), so
-     *  deleteSession-then-importEntries is effectively atomic for the local case (no concurrent reader can observe the
-     *  gap, unlike the durable cross-instance backends which do it in ONE SQL txn). Both halves are best-effort feature-
-     *  gated: a repo lacking either seam throws the same clear error importEntries does (no silent half-write). */
+    /**
+     * 2c session-sync (§7/§8) — IDEMPOTENT REPLACE,按接口句(`SessionStorage.replaceEntries`:先清这只会话既有的对话日志,再导入 `entries`)。
+     * 与 {@link importEntries} 同一个入口、同一只属主判、同一个行收尾,只差日志那一半:先清内容存档再导入(`purge_first`,见 {@link LogSwap})——
+     * 所以一只会话头读不出的存档也换得掉;存档是重建的那一只,建档时刻 = 换装时刻(SQL 孪生 replace 重插行、`created_at` 重记,同义)。
+     */
     replaceEntries(sessionId: string, owner: string | null, entries: SessionTreeEntry[]): Promise<void>;
-    /** {@link replaceEntries} 的锁内一形(调用方持这只会话的写锁)。 */
-    private replaceEntriesHeld;
+    /**
+     * 换装三条写腿(公开 {@link importEntries} / {@link replaceEntries} 与暂存提交 {@link commitStagedImport})的**同一个入口**:调用方给的属主先过
+     * {@link importerOwnerOf}(主体名或 `null`;否则 `TypeError`,什么都没读、一个字节没写),再进这只会话的写锁 —— 锁里的写体只见判过的那一个值,
+     * 写进行的属主就是它。引擎导入口的属主判管不到这一格:换装交给引擎的是存档自己的戳(见 {@link swapLogHeld}),不是调用方的属主。
+     */
+    private withImportLock;
+    /**
+     * 公开导入口({@link importEntries} / {@link replaceEntries})的锁内一形(调用方持这只会话的写锁)。属主判 —— 这条路径上**唯一**一次读那一格:
+     * 行在而它的属主格不是导入者 ⇒ `conflict`,一个字节不写;判过才交给写体(写体不读那一格、不判属主)。
+     */
+    private importHeld;
+    /**
+     * 换装的**日志**一半(公开导入 / 换装与暂存提交三条腿共用;行那一半在 {@link finishSwap})。调用方持这只会话的写锁,并已在本店的属主格上判过 ——
+     * 这里不读那一格、不判属主。只换**内容**;会话元数据那一格、标题 / 置顶 / 指令来源 / 工作区四只行边档、新近,这里一个字节不碰。
+     * 一次引擎仓导入,落在 {@link archiveToSwap} 交回的那一份存档上(怎么对待既有存档由写腿的动词定,{@link LogSwap}):
+     * 落在既有存档上 = 整份日志换成 `entries`、存档的元数据整只留着(其中的建档时刻是列表行的 firstActivityAt,与 SQL 孪生留在行上的 `created_at` 同义);
+     * 校验(`validateEntriesForImport`)、存档判与写在它里面是一步,抛在哪一处都一个字节没写。
+     * 存档上的属主戳不是本店的事实(属主只在那一格;本店建的存档一律不带戳,存量存档可能带着此前导入者的戳),只是引擎仓原地换的条件:
+     * 按那一份存档自己的戳导入,并以它为 `expect`(戳 + 存档的令牌;没有存档 ⇒ `row: null`,导入新建一只不带戳的存档)——
+     * 换的就是这一份;读与写之间它换了一代 ⇒ 引擎仓拒 `conflict`,一个字节不写。
+     */
+    private swapLogHeld;
+    /**
+     * 换装落在哪一份存档上(`null` = 没有存档,导入新建一只)—— {@link LogSwap} 的唯一读法。
+     * `in_place`:锁里读到的那一份(读不出 ⇒ 引擎的故障原样上抛,一个字节没写)。
+     * `purge_first`:先清掉内容存档(不带 `expect` —— 带了就得先读它的头,读不出的存档就清不掉),再交回 `null`;清不可撤,所以引擎导入里的那一只闸
+     * (`validateEntriesForImport`)在清之前先跑一遍,坏包什么都不清。清过之后导入再抛(I/O 故障),内容就没了、行与四只边档还在 —— 已发版本的 replace 同形(删后导入)。
+     */
+    private archiveToSwap;
+    /**
+     * 推送的**行**收尾 —— 换了日志的与内容相同只重戳的,都经这**一处**(暂存提交两支之后、公开两口的写体之后;调用方持写锁,`owner` 的形已在入口
+     * {@link withImportLock} 判过、归属已在锁里判过):
+     * 会话元数据那一格属主重戳为导入者;化身经 {@link carriedIncarnation}(三只店同一句)读那一格自己 —— 行在 ⇒ 沿用(同一行 = 同一位住客),
+     * 刚建的行 ⇒ 铸一只;然后记新近 = 此刻:推送即活动,不因内容相同分叉。标题 / 置顶 / 指令来源 / 工作区四只行边档不碰。
+     * SQL 孪生暂存提交那一句 `UPDATE session_meta SET owner = ?, updated_at = now, leaf_id, leaf_seq` 的 local 对位(那一句两支同写)。
+     */
+    private finishSwap;
     /** 2c session-sync P1d-β (PUSH streaming) — begin a STAGED import. The LOCAL backend is single-writer with no
      *  cross-instance / cross-replica concurrency story (the durable twins carry that), so the staging handle simply
-     *  ACCUMULATES the streamed batches in memory then, on commit, runs the SAME validate-first → replaceEntries the
-     *  whole-bundle local import uses (effectively atomic locally — no concurrent reader can observe the gap). Keep it
+     *  ACCUMULATES the streamed batches in memory then, on commit, runs the SAME in-place log swap ({@link swapLogHeld}: one
+     *  engine-repo import onto the archive as it stands — validate, judge and write in one step) the whole-bundle local import uses. Keep it
      *  simple per §1: the durable twins are where the SHADOW-id swap + bounded-memory + concurrency matter. */
     beginImportStaging(realSessionId: string, token: string): StagingHandle;
     /** 2c P1d-β (staged-row inspection) — the in-memory staged entries for a local staging id. No longer the import gate
@@ -354,7 +393,7 @@ export declare class LocalSessionStore implements SessionStore {
     /**
      * {@link LocalStagingHandle.commit} 的整段 —— **一次持锁**(这只会话的写锁,{@link withSessionWriteLock}):属主 CAS(此刻的属主格 = 这次导入的门判过的那一格,
      * 否则抛 {@link StagedCommitOwnerChangedError},一个字节不写;在判目的端日志之前判,SQL 孪生同序)→ 提交时重新分类(目的端此刻的日志 vs staged)
-     * → 拒未经同意的 fork / stale / 载荷分叉 → 换装(validate-first → 删 → 导入,化身按换装律沿用)或 identical 且内容相同时只重戳属主 → **在同一次持锁里**
+     * → 拒未经同意的 fork / stale / 载荷分叉 → 换日志({@link swapLogHeld},原地换;属主只在 CAS 那一读上判)或 identical 且内容相同时日志不动 → 两支同一收尾 {@link finishSwap}(重戳属主 + 记新近)→ **在同一次持锁里**
      * 读出落定的会话面交回。锁放下之前谁也换不掉这一位住客,所以交回的面就是这次提交落下的那一位(SQL 孪生在提交事务里读同一行,同义);
      * 提交之后按住客条件写的重放(会话行两位)只认这只面,不再重读。改属主的每一条写腿(登记 / 删除 / 导入 / 换装)都在同一把锁里,所以锁内这一读到锁放下都成立。
      */
@@ -367,10 +406,10 @@ export declare class LocalSessionStore implements SessionStore {
      *  tool-result rows are purged separately by the route's purgeSession coordinator. 整段在这只会话的写锁里(换人)。 */
     deleteSession(sessionId: string, owner: string | null): Promise<boolean>;
     /**
-     * {@link deleteSession} 的锁内一形(调用方持这只会话的写锁;换装 {@link replaceEntriesHeld} 也走它)。
-     * 删的是 SQL 孪生 `session_meta` 那一行在本店的全部对位:会话存档、三只行边档(标题 / 置顶 / [ref] 的指令来源基线)、属主 + 化身那一格。
-     * 三只边档的那一键**都经各自的写链删**(`commit`:草稿上删、落盘、再发布 —— 与写它们的那一笔同一条链、同一把会话锁),落不了盘 ⇒ 抛:
-     * 留在盘上的值会挂到同 id 的下一位住客身上(E21 的删除权残留)。元数据格**最后**删:三只边档任一只落不了而抛时,那一格还在 ⇒ 会话对属主门仍
+     * {@link deleteSession} 的锁内一形(调用方持这只会话的写锁;换装不走它 —— 换装只换内容存档,行原样,见 {@link swapLogHeld})。
+     * 删的是 SQL 孪生 `session_meta` 那一行在本店的全部对位:会话存档、四只行边档(标题 / 置顶 / 指令来源基线 / 工作区)、新近标记、属主 + 化身那一格。
+     * 四只边档的那一键**都经各自的写链删**(`commit`:草稿上删、落盘、再发布 —— 与写它们的那一笔同一条链、同一把会话锁),落不了盘 ⇒ 抛:
+     * 留在盘上的值会挂到同 id 的下一位住客身上(E21 的删除权残留)。元数据格**最后**删:四只边档任一只落不了而抛时,那一格还在 ⇒ 会话对属主门仍
      * 「在」,重发删除照样走得进来、收敛;反过来先删格,重发就成了 no-op,残留永远留下。
      * 🔴 hydrate FIRST (workflow audit 2026-07-13): after a restart the maps start empty — an un-hydrated delete would find nothing and
      * the sidecar would keep the value (an E21 right-to-delete residue that would RESURRECT onto a same-id re-import). ensureLoaded is

package/dist/plugins/local-session-store.js

@@ -1,6 +1,6 @@
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { assertFirstOwnerWritable, forkOwnerOf } from "./session-ownership.js";
+import { assertFirstOwnerWritable, forkOwnerOf, importerOwnerOf } from "./session-ownership.js";
 import { FileSessionRepo, SessionError, StoredSession, settledForkOptions, validateEntriesForImport } from "@sema-agent/core";
 import { z } from "zod";
 import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
@@ -11,6 +11,7 @@ import { createLogger } from "../observability/logger.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
 import { UnreadableLeaf, carriedIncarnation, headFromRow, mintSessionIncarnation, sessionFaceFromRow } from "../session-incarnation.js";
 import { decodeInstructionSource, encodeInstructionSource, sameInstructionSourceBaseline } from "../instruction-source-notice.js";
+import { decodeSessionWorkspaceCell, encodeSessionWorkspaceCell } from "./session-workspace-cell.js";
 import { noteReplayInSessionOpenScope, openSessionForItself } from "../session-records-skipped-notice.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { buildObjectivePreview, isAttachmentFrame } from "../user-authored-text.js";
@@ -35,7 +36,7 @@ function userText(entry) {
     }
     return null;
 }
-const SIDECAR_DEGRADES = { lastActivity: "recency", title: "title", pinned: "pin state", "instruction-source": "instruction-source baseline", "session-meta": "session owner + incarnation (the write that needed it failed loudly)" };
+const SIDECAR_DEGRADES = { lastActivity: "recency", title: "title", pinned: "pin state", "instruction-source": "instruction-source baseline", workspace: "each session's last recorded place and project (the next frame records it again)", "session-meta": "session owner + incarnation (the write that needed it failed loudly)" };
 const readPinnedSidecar = createZodColumnReader(z.record(z.string(), z.literal(true)));
 function readSessionMetaCell(cell) {
     return typeof cell === "string" ? { incarnation: cell, owner: undefined } : cell;
@@ -180,6 +181,7 @@ export class LocalSessionStore {
     titles;
     pinned;
     instructionSources;
+    workspaces;
     meta;
     log;
     sessionWriteLocks;
@@ -192,6 +194,7 @@ export class LocalSessionStore {
         this.titles = sidecar("session-titles.json", "title", readStringRecordColumn);
         this.pinned = sidecar("session-pinned.json", "pinned", readPinnedSidecar);
         this.instructionSources = sidecar("session-instruction-sources.json", "instruction-source", readStringRecordColumn);
+        this.workspaces = sidecar("session-workspaces.json", "workspace", readStringRecordColumn);
         this.meta = sidecar("session-incarnations.json", "session-meta", readSessionMetaSidecar, true);
         const root = dataDir ? resolve(dataDir) : undefined;
         if (root !== undefined && !SESSION_WRITE_LOCKS_BY_ROOT.has(root))
@@ -352,6 +355,26 @@ export class LocalSessionStore {
         if (!committed)
             throw new Error("LocalSessionStore: instruction-source sidecar write failed — baseline not recorded");
     }
+    async readSessionWorkspace(sessionId) {
+        await this.workspaces.ensureLoaded();
+        return decodeSessionWorkspaceCell(this.workspaces.state.entries.get(sessionId) ?? null, sessionId);
+    }
+    async recordSessionWorkspace(sessionId, incarnation, workspace) {
+        const text = encodeSessionWorkspaceCell(workspace, JSON.stringify, sessionId);
+        await this.withSessionWriteLock(sessionId, async () => {
+            if ((await this.metaOf(sessionId))?.incarnation !== incarnation)
+                return;
+            await this.workspaces.ensureLoaded();
+            const committed = await this.workspaces.commit((draft) => {
+                if (draft.get(sessionId) === text)
+                    return false;
+                draft.set(sessionId, text);
+                return true;
+            });
+            if (!committed)
+                throw new SessionError("storage", `LocalSessionStore: workspace sidecar write failed for session ${sessionId} — its place was not recorded`);
+        });
+    }
     async ensureLoaded() {
         if (!this.sidecarPath)
             return;
@@ -480,9 +503,6 @@ export class LocalSessionStore {
                 this.log.info("session_owner_claimed", { sessionId });
         });
     }
-    async restampOwner(sessionId, owner) {
-        await this.writeMeta(sessionId, (before) => (before === undefined ? undefined : { incarnation: readSessionMetaCell(before).incarnation, owner }));
-    }
     async touch(sessionId) {
         this.lastActivity.set(sessionId, new Date().toISOString());
         this.scheduleFlush();
@@ -607,28 +627,42 @@ export class LocalSessionStore {
         return gen();
     }
     async importEntries(sessionId, owner, entries) {
-        await this.withSessionWriteLock(sessionId, () => this.importEntriesAs(sessionId, owner, entries, mintSessionIncarnation()));
-    }
-    async importEntriesAs(sessionId, owner, entries, incarnation) {
-        if (!this.repo.importEntries)
-            throw new SessionError("storage", "session import is not supported by this local backend");
-        await this.meta.ensureLoaded();
-        await this.repo.importEntries(sessionId, owner ?? undefined, entries);
-        await this.writeMeta(sessionId, () => ({ incarnation, owner }));
+        await this.withImportLock(sessionId, owner, (importer) => this.importHeld(sessionId, importer, entries, "in_place"));
     }
     async replaceEntries(sessionId, owner, entries) {
-        await this.withSessionWriteLock(sessionId, () => this.replaceEntriesHeld(sessionId, owner, entries));
+        await this.withImportLock(sessionId, owner, (importer) => this.importHeld(sessionId, importer, entries, "purge_first"));
+    }
+    async withImportLock(sessionId, owner, body) {
+        const importer = importerOwnerOf(owner);
+        return this.withSessionWriteLock(sessionId, () => body(importer));
     }
-    async replaceEntriesHeld(sessionId, owner, entries) {
+    async importHeld(sessionId, owner, entries, swap) {
+        const row = await this.metaOf(sessionId);
+        if (row !== undefined && !ownerEq(row.owner ?? null, owner)) {
+            throw new SessionError("conflict", `session ${sessionId} is not the importer's row (its owner cell differs) — nothing was written`);
+        }
+        await this.swapLogHeld(sessionId, entries, swap);
+        await this.finishSwap(sessionId, owner);
+    }
+    async swapLogHeld(sessionId, entries, swap) {
         if (!this.repo.importEntries)
             throw new SessionError("storage", "session import is not supported by this local backend");
-        if (!this.repo.delete)
-            throw new SessionError("storage", "session replace is not supported by this local backend (no delete seam)");
-        validateEntriesForImport(entries);
-        const current = await this.metaOf(sessionId);
-        const prior = current === undefined ? undefined : { owner: current.owner ?? null, incarnation: current.incarnation };
-        await this.deleteSessionHeld(sessionId, owner);
-        await this.importEntriesAs(sessionId, owner, entries, carriedIncarnation(sessionId, prior, owner));
+        const archive = await this.archiveToSwap(sessionId, entries, swap);
+        await this.repo.importEntries(sessionId, archive?.owner ?? undefined, entries, { expect: { row: archive } });
+    }
+    async archiveToSwap(sessionId, entries, swap) {
+        switch (swap) {
+            case "in_place":
+                return (await this.repo.headOf(sessionId)) ?? null;
+            case "purge_first":
+                validateEntriesForImport(entries);
+                await this.repo.delete({ id: sessionId, createdAt: "" });
+                return null;
+        }
+    }
+    async finishSwap(sessionId, owner) {
+        await this.writeMeta(sessionId, (before) => ({ incarnation: carriedIncarnation(sessionId, before === undefined ? undefined : readSessionMetaCell(before)), owner }));
+        await this.touch(sessionId);
     }
     beginImportStaging(realSessionId, token) {
         const h = new LocalStagingHandle(this, realSessionId, stagingIdFor(realSessionId, token));
@@ -642,7 +676,7 @@ export class LocalSessionStore {
         this.stagings.delete(stagingId);
     }
     async commitStagedImport(sessionId, owner, staged, opts) {
-        return this.withSessionWriteLock(sessionId, async () => {
+        return this.withImportLock(sessionId, owner, async (importer) => {
             const current = await this.metaOf(sessionId);
             if (!ownerCellIs(opts.expectedOwner, current === undefined ? undefined : (current.owner ?? null)))
                 throw new StagedCommitOwnerChangedError(sessionId);
@@ -659,11 +693,9 @@ export class LocalSessionStore {
             }
             const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(staged, dstEntries);
             if (rel.relation !== "identical" || !contentEqual) {
-                await this.replaceEntriesHeld(sessionId, owner, staged);
-            }
-            else {
-                await this.restampOwner(sessionId, owner);
+                await this.swapLogHeld(sessionId, staged, "in_place");
             }
+            await this.finishSwap(sessionId, importer);
             const meta = await this.metaOf(sessionId);
             if (meta === undefined)
                 throw new SessionError("storage", `LocalSessionStore: staged commit for session ${sessionId} left no session face — nothing was settled`);
@@ -685,7 +717,7 @@ export class LocalSessionStore {
             if (!isNotFound(e))
                 throw e;
         }
-        for (const [map, which] of [[this.titles, "title"], [this.pinned, "pinned"], [this.instructionSources, "instruction-source"]]) {
+        for (const [map, which] of [[this.titles, "title"], [this.pinned, "pinned"], [this.instructionSources, "instruction-source"], [this.workspaces, "workspace"]]) {
             await map.ensureLoaded();
             if (!(await map.deleteKey(sessionId)))
                 throw new SessionError("storage", `LocalSessionStore: ${which} sidecar write failed while deleting session ${sessionId} — its ${which} is still on disk; retry the delete`);

package/dist/plugins/mailbox-store-sql.d.ts

@@ -1,13 +1,13 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { MailboxAckResult, MailboxAppendMessage, MailboxLease, MailboxStore } from "@sema-agent/core";
+import type { MailboxAckResult, MailboxAppendMessage, MailboxDecision, MailboxDecisionOutcome, MailboxLease, MailboxStore } from "@sema-agent/core";
 import { type IndexSpec } from "./ensure-index.js";
 import type { MailboxRecipientLifecycle, MailboxRecipientTombstone } from "./mailbox-recipient-lifecycle.js";
 export declare const MAILBOX_TABLE = "mailbox";
 export declare const MAILBOX_MSG_TABLE = "mailbox_message";
 /** [ref] 收件人墓碑表(预删除态的**唯一**真源;形与理由见 `mailbox-recipient-lifecycle.ts` 模块头)。
- *  🔴 为什么是**新表**而不是给 `mailbox` 加两列:加列走的是本仓「删库重建、不开 ALTER seam」那条政策
- *  (存量库首跑必红);而 `CREATE TABLE IF NOT EXISTS` 一张新表在存量库上零破坏、零运维动作。语义上也更干净
+ *  🔴 为什么是**新表**而不是给 `mailbox` 加两列:加列走的是本仓「启动 DDL 不开 ALTER seam」那条政策
+ *  (存量库缺列起服列册对账拒启、要运维先手工 `ALTER`);而 `CREATE TABLE IF NOT EXISTS` 一张新表在存量库上零破坏、零运维动作。语义上也更干净
  *  —— `mailbox` 行是**盒**事实(next_seq / lease),墓碑是**收件人**事实,两者的生命周期本来就不同
  *  (`drop` 同时终结两者 —— 墓碑随箱亡,理由全文见 `mailbox-recipient-lifecycle.ts` 模块头)。 */
 export declare const MAILBOX_TOMBSTONE_TABLE = "mailbox_tombstone";
@@ -69,6 +69,12 @@ export declare class TiDBMailboxStore implements MailboxStore, MailboxRecipientL
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
     ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<MailboxAckResult>;
+    /**
+     * core 7.57.0 #972b —— 一条记录的留置决定从 `expect`(缺席 = 从未 held)移到 `next`:比较并设置,对每一次别的移动与 `ack` 原子
+     * (锁序与 ack / drop / reap 同为「盒行 → 消息行」,当前读);**不受租约围栏**(人从哪个终端答都行)。坏调用(词不在闭集 / seq 不是正整数 /
+     * 决定律不许的边)先于键判官与任何副作用以 `mailbox.invalid_decision_move` 拒(core 的唯一验证器 `assertMailboxDecisionMove`);判官拒的键没有箱 ⇒ gone。
+     */
+    moveDecision(scope: string, handle: string, seq: number, expect: MailboxDecision | undefined, next: MailboxDecision): Promise<MailboxDecisionOutcome>;
     releaseLease(scope: string, handle: string, owner: string): Promise<void>;
     peekCount(scope: string, handle: string): Promise<number>;
     drop(scope: string, handle: string): Promise<void>;
@@ -93,6 +99,8 @@ export declare class PgMailboxStore implements MailboxStore, MailboxRecipientLif
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
     ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<MailboxAckResult>;
+    /** core 7.57.0 #972b 留置决定的比较并设置(TiDB 孪生同注:验证先于一切、锁序盒行 → 消息行、不受租约围栏、判官拒的键 ⇒ gone)。 */
+    moveDecision(scope: string, handle: string, seq: number, expect: MailboxDecision | undefined, next: MailboxDecision): Promise<MailboxDecisionOutcome>;
     releaseLease(scope: string, handle: string, owner: string): Promise<void>;
     peekCount(scope: string, handle: string): Promise<number>;
     drop(scope: string, handle: string): Promise<void>;

package/dist/plugins/mailbox-store-sql.js

@@ -1,5 +1,5 @@
 import { isUtf8 } from "node:buffer";
-import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MailboxStoreError, readMailboxPeerMeta } from "@sema-agent/core";
+import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_RECORD_ID_MAX_CHARS, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MailboxStoreError, assertMailboxDecisionMove, judgeMailboxAppendById, readMailboxAppend, readMailboxPeerMeta, readStoredMailboxDecision } from "@sema-agent/core";
 import { pgHasUnstorable, pgSanitizeText, PgUnstorableError } from "./pg-safe-json.js";
 import { isWellFormedUnicode } from "../principal-jwt.js";
 import { ensureIndexes } from "./ensure-index.js";
@@ -25,15 +25,36 @@ export const MAILBOX_KEY_MAX_UTF8_BYTES = 190;
 export function mailboxKeyProblem(what, v) {
     if (what === "scope" && (v === undefined || v === ""))
         return "MailboxStore: refusing a message without a scope (an empty scope addresses no box)";
+    const unaddressable = byteExactIdentityProblem(what, v);
+    if (unaddressable !== undefined)
+        return unaddressable;
+    if (Buffer.byteLength(v, "utf8") > MAILBOX_KEY_MAX_UTF8_BYTES) {
+        return `MailboxStore: ${what} exceeds the ${MAILBOX_KEY_MAX_UTF8_BYTES}-byte key column (refusing — a truncated key would desync from its byte-exact lookups)`;
+    }
+    return undefined;
+}
+function byteExactIdentityProblem(what, v) {
     if (!isWellFormedUnicode(v))
         return `MailboxStore: ${what} is not well-formed Unicode (lone surrogate) (refusing — the driver would store it as U+FFFD and alias a different key)`;
     if ([...v].some((ch) => ch.charCodeAt(0) < 0x20 || ch.charCodeAt(0) === 0x7f))
         return `MailboxStore: ${what} contains control characters (refusing — identity keys must be byte-exact addressable)`;
-    if (Buffer.byteLength(v, "utf8") > MAILBOX_KEY_MAX_UTF8_BYTES) {
-        return `MailboxStore: ${what} exceeds the ${MAILBOX_KEY_MAX_UTF8_BYTES}-byte key column (refusing — a truncated key would desync from its byte-exact lookups)`;
-    }
     return undefined;
 }
+function appendSnapshot(msg) {
+    const rec = readMailboxAppend(msg);
+    if (rec.id !== undefined) {
+        const problem = byteExactIdentityProblem("record id", rec.id);
+        if (problem !== undefined)
+            throw new Error(problem);
+    }
+    return rec;
+}
+function replayedSeq(held, scope, handle, logger, asStored) {
+    return judgeMailboxAppendById(rowsToMessages(held, scope, handle, logger), asStored);
+}
+function asUtf8Stored(v) {
+    return Buffer.from(v, "utf8").toString("utf8");
+}
 function assertMailboxKey(what, v) {
     const problem = mailboxKeyProblem(what, v);
     if (problem !== undefined)
@@ -130,6 +151,7 @@ function rowsToMessages(rows, scope, handle, logger) {
         };
         const hopChain = read("hop_chain", () => decodeHopChain(r.hop_chain, r.seq));
         const peerMeta = read("peer_meta", () => decodePeerMeta(r.peer_meta, r.seq));
+        const decision = decisionOfColumn(r.decision);
         out.push({
             seq: Number(r.seq),
             ...(r.from_id !== null && r.from_id !== undefined ? { from: bufToStr(r.from_id) } : {}),
@@ -137,10 +159,21 @@ function rowsToMessages(rows, scope, handle, logger) {
             sentAt: Number(r.sent_at_ms),
             ...(hopChain !== undefined ? { hopChain } : {}),
             ...(peerMeta !== undefined ? { peerMeta } : {}),
+            ...(decision !== undefined ? { decision } : {}),
+            ...(r.record_id !== null && r.record_id !== undefined ? { id: String(r.record_id) } : {}),
         });
     }
     return out;
 }
+function decisionOfColumn(raw) {
+    return raw === null || raw === undefined ? undefined : readStoredMailboxDecision(bufToStr(raw));
+}
+function decisionMoveVerdict(rows, expect) {
+    if (rows.length === 0)
+        return { ok: false, current: "gone" };
+    const current = decisionOfColumn(rows[0].decision);
+    return current === expect ? "write" : { ok: false, current: current ?? "unset" };
+}
 export async function ensureTiDBMailboxSchema(pool) {
     await pool.query(`CREATE TABLE IF NOT EXISTS ${MAILBOX_TABLE} (
     scope_key VARBINARY(190) NOT NULL,
@@ -166,8 +199,15 @@ export async function ensureTiDBMailboxSchema(pool) {
     -- peer_meta(S-90;core fc52b4d4 design/385 片2b):drain 点权威判断读的 typed peer 记录,JSON 文本;
     -- NULL = 缺席(**有语义**:pre-385/foreign 记录,drain 永不回溯准入;与空对象绝不互折)。写入面先过 core
     -- readMailboxPeerMeta(坏值带码拒于任何副作用前)+ PEER_META_MAX_BYTES 守卫关掉静默截断类。
-    -- 新列按 2026-07-26 schema policy 直接折进 CREATE(不开 ALTER seam,存量库删库重建)。
+    -- 新列直接折进 CREATE(启动 DDL 不开 ALTER seam);存量库缺列 ⇒ 起服列册对账拒启并给出可粘贴的 ALTER 语句,由运维在升级前执行。
     peer_meta TEXT NULL,
+    -- decision(core 7.57.0 #972b):收件人设置留置的这条记录的**决定**(七词闭集 MAILBOX_DECISIONS);NULL = 从未 held。
+    -- 只经 moveDecision 的比较并设置移动,从不随 append 写;随记录生随记录亡(ack / reap / drop 删行即删它)—— 决定是记录自己的字段。
+    decision VARCHAR(16) NULL,
+    -- record_id(core 7.59.0):生产者铸的记录身份;NULL = 没说身份(每次 append 都是一条新记录)。盒持有一条这身份的记录时,append 经引擎的
+    -- judgeMailboxAppendById 判(同记录 ⇒ 答它的 seq、零写;不同 ⇒ mailbox.duplicate_record_id),判在 append 的盒行锁之内 —— 盒行 FOR UPDATE 串行了
+    -- 同一只盒的全部 append,「(scope, handle, id) 在持有行里至多一行」由它成立;ack / reap / drop 删行即还身份。宽 = 引擎的 MAILBOX_RECORD_ID_MAX_CHARS(列宽读那只常量,不抄数)。
+    record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) NULL,
     PRIMARY KEY (scope_key, handle, seq),
     KEY idx_mbm_sent (scope_key, handle, sent_at_ms)
   ) COLLATE utf8mb4_bin`);
@@ -204,6 +244,8 @@ export async function ensurePgMailboxSchema(q) {
     sent_at_ms BIGINT NOT NULL,
     hop_chain TEXT COLLATE "C", -- core 5.17.0 design/176(TiDB twin 同注:NULL = 缺席且有语义)
     peer_meta TEXT COLLATE "C", -- S-90 core fc52b4d4 design/385 片2b(TiDB twin 同注:typed peer 记录 JSON;NULL = 缺席且有语义)
+    decision VARCHAR(16) COLLATE "C", -- core 7.57.0 #972b(TiDB twin 同注:留置决定,NULL = 从未 held;只经 moveDecision 移动,随记录亡)
+    record_id VARCHAR(${MAILBOX_RECORD_ID_MAX_CHARS}) COLLATE "C", -- core 7.59.0(TiDB twin 同注:生产者铸的记录身份,NULL = 没说身份;盒行锁之内经引擎判,随记录亡)
     PRIMARY KEY (scope_key, handle, seq)
   )`);
     await q(`CREATE TABLE IF NOT EXISTS ${MAILBOX_TOMBSTONE_TABLE} (
@@ -242,8 +284,9 @@ export class TiDBMailboxStore {
     async append(scope, handle, msg) {
         assertMailboxKey("scope", scope);
         assertMailboxKey("handle", handle);
-        const hopChain = encodeHopChain(msg.hopChain);
-        const peerMeta = encodePeerMeta(msg.peerMeta);
+        const rec = appendSnapshot(msg);
+        const hopChain = encodeHopChain(rec.hopChain);
+        const peerMeta = encodePeerMeta(rec.peerMeta);
         return this.tx(async (c) => {
             await c.query(`INSERT INTO ${MAILBOX_TABLE} (scope_key, handle, scope, next_seq) VALUES (?, ?, ?, 1) ON DUPLICATE KEY UPDATE scope_key = scope_key`, [scope, handle, scope]);
             let [rows] = (await c.query(`SELECT next_seq FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]));
@@ -254,9 +297,15 @@ export class TiDBMailboxStore {
             const [tomb] = await c.query(`SELECT 1 FROM ${MAILBOX_TOMBSTONE_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]);
             if (tomb.length > 0)
                 throw tombstonedRecipientError(scope, handle);
+            if (rec.id !== undefined) {
+                const [held] = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("tidb", "hop_chain")}, ${jsonColumnText("tidb", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND record_id = ? FOR UPDATE`, [scope, handle, rec.id]);
+                const replay = replayedSeq(held, scope, handle, this.logger, { ...rec, content: asUtf8Stored(rec.content), ...(rec.from !== undefined ? { from: asUtf8Stored(rec.from) } : {}) });
+                if (replay !== undefined)
+                    return replay;
+            }
             const seq = Number(rows[0].next_seq);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET next_seq = ? WHERE scope_key = ? AND handle = ?`, [seq + 1, scope, handle]);
-            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain, peer_meta) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [scope, handle, seq, msg.from ?? null, msg.content, msg.sentAt, hopChain, peerMeta]);
+            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain, peer_meta, record_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [scope, handle, seq, rec.from ?? null, rec.content, rec.sentAt, hopChain, peerMeta, rec.id ?? null]);
             return seq;
         });
     }
@@ -274,7 +323,7 @@ export class TiDBMailboxStore {
                 bufToStr(box.lease_owner) !== owner) {
                 return null;
             }
-            const [msgs] = (await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("tidb", "hop_chain")}, ${jsonColumnText("tidb", "peer_meta")} FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY seq FOR UPDATE`, [scope, handle]));
+            const [msgs] = (await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("tidb", "hop_chain")}, ${jsonColumnText("tidb", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? ORDER BY seq FOR UPDATE`, [scope, handle]));
             if (msgs.length === 0)
                 return null;
             const maxSeq = Number(msgs[msgs.length - 1].seq);
@@ -295,6 +344,22 @@ export class TiDBMailboxStore {
             return { acked: true };
         });
     }
+    async moveDecision(scope, handle, seq, expect, next) {
+        assertMailboxDecisionMove(seq, expect, next);
+        if (keyless(scope, handle))
+            return { ok: false, current: "gone" };
+        return this.tx(async (c) => {
+            const [boxes] = await c.query(`SELECT 1 FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]);
+            if (boxes.length === 0)
+                return { ok: false, current: "gone" };
+            const [rows] = await c.query(`SELECT decision FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND seq = ? FOR UPDATE`, [scope, handle, seq]);
+            const verdict = decisionMoveVerdict(rows, expect);
+            if (verdict !== "write")
+                return verdict;
+            await c.query(`UPDATE ${MAILBOX_MSG_TABLE} SET decision = ? WHERE scope_key = ? AND handle = ? AND seq = ?`, [next, scope, handle, seq]);
+            return { ok: true };
+        });
+    }
     async releaseLease(scope, handle, owner) {
         if (keyless(scope, handle, owner))
             return;
@@ -384,11 +449,12 @@ export class PgMailboxStore {
     async append(scope, handle, msg) {
         assertMailboxKey("scope", scope);
         assertMailboxKey("handle", handle);
-        if (msg.from !== undefined && pgHasUnstorable(msg.from))
+        const rec = appendSnapshot(msg);
+        if (rec.from !== undefined && pgHasUnstorable(rec.from))
             throw new PgUnstorableError("mailbox from");
-        const content = pgSanitizeText(msg.content);
-        const hopChain = encodeHopChain(msg.hopChain);
-        const peerMeta = encodePeerMeta(msg.peerMeta);
+        const content = pgSanitizeText(rec.content);
+        const hopChain = encodeHopChain(rec.hopChain);
+        const peerMeta = encodePeerMeta(rec.peerMeta);
         return this.tx(async (c) => {
             await c.query(`INSERT INTO ${MAILBOX_TABLE} (scope_key, handle, scope, next_seq) VALUES ($1, $2, $3, 1) ON CONFLICT (scope_key, handle) DO NOTHING`, [
                 scope,
@@ -407,9 +473,15 @@ export class PgMailboxStore {
             const { rows: tomb } = await c.query(`SELECT 1 FROM ${MAILBOX_TOMBSTONE_TABLE} WHERE scope_key = $1 AND handle = $2 FOR UPDATE`, [scope, handle]);
             if (tomb.length > 0)
                 throw tombstonedRecipientError(scope, handle);
+            if (rec.id !== undefined) {
+                const { rows: held } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND record_id = $3 FOR UPDATE`, [scope, handle, rec.id]);
+                const replay = replayedSeq(held, scope, handle, this.logger, { ...rec, content });
+                if (replay !== undefined)
+                    return replay;
+            }
             const seq = Number(rows[0].next_seq);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET next_seq = $1 WHERE scope_key = $2 AND handle = $3`, [seq + 1, scope, handle]);
-            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain, peer_meta) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [scope, handle, seq, msg.from ?? null, content, msg.sentAt, hopChain, peerMeta]);
+            await c.query(`INSERT INTO ${MAILBOX_MSG_TABLE} (scope_key, handle, seq, from_id, content, sent_at_ms, hop_chain, peer_meta, record_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [scope, handle, seq, rec.from ?? null, content, rec.sentAt, hopChain, peerMeta, rec.id ?? null]);
             return seq;
         });
     }
@@ -424,7 +496,7 @@ export class PgMailboxStore {
             const box = boxes[0];
             if (box.lease_owner !== null && Number(box.lease_expires_at_ms) > now && String(box.lease_owner) !== owner)
                 return null;
-            const { rows: msgs } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")} FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY seq FOR UPDATE`, [scope, handle]);
+            const { rows: msgs } = await c.query(`SELECT seq, from_id, content, sent_at_ms, ${jsonColumnText("pg", "hop_chain")}, ${jsonColumnText("pg", "peer_meta")}, decision, record_id FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 ORDER BY seq FOR UPDATE`, [scope, handle]);
             if (msgs.length === 0)
                 return null;
             const maxSeq = Number(msgs[msgs.length - 1].seq);
@@ -445,6 +517,22 @@ export class PgMailboxStore {
             return { acked: true };
         });
     }
+    async moveDecision(scope, handle, seq, expect, next) {
+        assertMailboxDecisionMove(seq, expect, next);
+        if (keyless(scope, handle))
+            return { ok: false, current: "gone" };
+        return this.tx(async (c) => {
+            const { rows: boxes } = await c.query(`SELECT 1 FROM ${MAILBOX_TABLE} WHERE scope_key = $1 AND handle = $2 FOR UPDATE`, [scope, handle]);
+            if (boxes.length === 0)
+                return { ok: false, current: "gone" };
+            const { rows } = await c.query(`SELECT decision FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq = $3 FOR UPDATE`, [scope, handle, seq]);
+            const verdict = decisionMoveVerdict(rows, expect);
+            if (verdict !== "write")
+                return verdict;
+            await c.query(`UPDATE ${MAILBOX_MSG_TABLE} SET decision = $1 WHERE scope_key = $2 AND handle = $3 AND seq = $4`, [next, scope, handle, seq]);
+            return { ok: true };
+        });
+    }
     async releaseLease(scope, handle, owner) {
         if (keyless(scope, handle, owner))
             return;

package/dist/plugins/memory-run-store.js

@@ -43,6 +43,7 @@ export class MemoryRunStore {
             errorCode: r.errorCode,
             jobId: r.jobId,
             source: r.source,
+            identity: r.identity,
             instanceId: r.instanceId,
             cancelRequested: r.cancelRequested,
             objectivePreview: r.objectivePreview,
@@ -75,6 +76,7 @@ export class MemoryRunStore {
             objectivePreview: meta.objectivePreview ?? null,
             idemKey,
             idemBodyFingerprint: meta.idem?.bodyFingerprint ?? null,
+            identity: meta.identity ?? null,
             createdAt: now,
             updatedAt: now,
             cancelRequested: false,