@sema-agent/server 7.137.0 → 7.139.0

package/dist/http/route-ctx.d.ts

@@ -31,6 +31,9 @@ import type { GateSighting } from "../approval-gate-currency.js";
 import type { VerifyRoundsSpec } from "./verify-rounds.js";
 import type { RunAbort } from "../run-cancel-context.js";
 import type { RunIdentity } from "../identity-source.js";
+import type { PeerLease } from "../peer-seat.js";
+import type { RootedTaskSpec } from "./execution-context.js";
+import type { GateCommitment, GateSettlementEvidence } from "../gate-settlement.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
  *  [ref]:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
  *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
@@ -115,11 +118,13 @@ export interface RouteRequestState {
 /** B4①(命名化):`prepareSpec` 的返回形(tasks.ts/runs.ts 两域共同消费的属性面)——原为 6 成员内联匿名对象。
  *  命名后好处不只是过 B4 门:两个消费域现在都能对同一个符号做 `import type` 标注,而不是各自重推断结构。 */
 export interface PreparedTaskSubmission {
-    spec: TaskSpec;
+    /** 盖过根的 spec(`http/execution-context.ts` `stampSpecRoot` 是唯一写者):`sessionId` 恒在 = 这次提交的根会话。 */
+    spec: RootedTaskSpec;
     /** [ref]:本次提交的执行 Runner —— 场景 hands=none 时是无手孪生(不挂 executionEnvFactory)。
      *  两个消费域一律用它,不再直接摸 `deps.runner`(那正是「场景表态了、执行点没听」的缝)。 */
     runner: Runner;
-    auth?: RequestAuth;
+    /** authorizer 交出的身份与根(必填席,恒在;续跑家族的内部车道交它从 checkpoint 重建的那一只)。 */
+    auth: RequestAuth;
     verify?: VerifyRoundsSpec;
     cascade?: boolean;
     jobId?: string;
@@ -135,19 +140,23 @@ export interface PreparedTaskSubmission {
      */
     warnings?: readonly EntryProblem[];
     /**
-     * [ref](device lane 首绑写协议,design §4.3.2 两阶段 placement)—— **已校验、未写库**的 placement 意图。
-     *
-     * 缺席的两种含义都等价于「本腿没有 placement 要提交」:①本部署不是 device 车道(绝大多数);
-     * ②本腿不是 fresh 根提交(resume 家族根本不经 `prepareSpec`)。在场 ⇒ 每个 `runStore.createRun(`
-     * 成功点**必须**把它交给 `commitPlacement`(唯一写入属主;类级机器门钉住每个调用点都接了)。
+     * 这次执行的**执行上下文**(唯一解析器 `http/execution-context.ts` `resolveExecutionContext` 的产物:根 · 住客 · 放置态 · 车道 · device 车道的设备意图)。
+     * 提交门在装配之前铸(fresh);`/decide` 的宿主新 turn 交续跑折叠器铸的那一只(continuation)。每个 `runStore.createRun(` 成功点**必须**把它交给
+     * 认领之后的唯一写口 `commitExecutionContext`(类级机器门钉住每个调用点都接了)。
      */
-    bindingIntent?: import("./device-placement.js").DevicePlacementIntent;
+    execution: import("./execution-context.js").RootedExecutionContext;
     /**
      * 这次提交的**受理座**(`run-acceptance.ts`):标题器只在引擎受理之后起。提交门(`prepareSpec`)随 spec 一起铸;
      * 三条提交腿只喂它(持流的形逐帧 `observe`,终局落行之后 `settle` 一次),不再各自判「什么时候起标题」。
      * 不经提交门的内部车道(`/decide` 的宿主新 turn)铸一只不带标题器的座:不起标题。
      */
     acceptance: import("../run-acceptance.js").RunAcceptance;
+    /**
+     * 这次装配的**宿主租约**:受理漏斗在装配之前开(`peerDesk.lease("fresh")`),装配在它之下登记交给引擎的对端声明;漏斗成功即把它交到这里 ——
+     * 拿到本产物的那只函数紧接着写 `try { … } finally { prepared.peerLease.release() }`,其后每个出口(早退、合流败方、建行拒、驱动返回)按构造都放。
+     * 活过那段作用域的驱动(后台腿)经 `heldFor(prepared.peerLease, () => …)` 自持一只,自己落定才放。续跑家族的内部车道交它自己漏斗开的那一只。
+     */
+    peerLease: PeerLease;
 }
 /**
  * 一条会话的**续跑重建输入**(`checkpoint_ctx` 的行体)—— 提交腿写一次,续跑腿读它重建 spec。
@@ -218,6 +227,11 @@ export interface WorkflowDecisionDelivery {
 /** B4①(命名化):`driveResumeIntoRunLog` 的入参形(resume 家族共用)——原为 9 成员内联匿名对象。 */
 export interface DriveResumeArgs {
     token: CheckpointToken;
+    /**
+     * 这条续跑的执行上下文(续跑折叠器经唯一解析器铸的 continuation 形:根 = checkpoint 的会话)。本腿认领之后(wake 的建行 / `markResuming` CAS 赢)
+     * 交给唯一写口 `commitExecutionContext`(按解析器那一读的住客再断言 writer(L) / absent 落格;住客换了 ⇒ 释放 + 404)。
+     */
+    execution: import("./execution-context.js").RootedExecutionContext;
     /**
      * 🔴 **[ref] 合并复审 F2 [high] —— 「本次续跑真正用的那个体」,由本腿在赢下 CAS 之后写回耐久层**
      * (验真后修;必填 —— `driveResumeIntoRunLog` 今天恰有**四个**调用点:legacy `/decide`(`resumeCheckpoint`)、
@@ -252,6 +266,11 @@ export interface DriveResumeArgs {
         sessionId: string;
         ctx: CheckpointCtx;
     };
+    /**
+     * 这条续跑的**宿主租约**(续跑漏斗 `resolveResumeSpecOrBlocked` 开、装配在它之下登记对端声明;调用方作用域的 `finally` 放)。
+     * 驱动腿经 `heldFor(args.peerLease, () => driveResumeLeg(…))` 自持一只:受理早回的那一形里,腿活过调用方作用域,自己落定才放。
+     */
+    peerLease: PeerLease;
     /** [ref]:续跑腿的执行 Runner。resume 会用同一条 resolveSpec 重解析场景,故与首跑选同一只 —— 否则
      *  一次续跑就把手带 band 重新 mount 回来(收窄只在首跑成立 = 没成立)。 */
     runner: Runner;
@@ -261,6 +280,12 @@ export interface DriveResumeArgs {
     taskConfig: Omit<TaskSpec, "objective" | "sessionId">;
     resumeObjective: string;
     outcome: ResumeOutcome;
+    /**
+     * 🔴 **这条腿到达边界时能证什么**(必填 —— 缺 = 编译错;闭集,语义属主 = `gate-settlement.ts` 的 {@link GateCommitment})。同一条驱动路径既续本请求点名的门
+     * (`/decide` 引擎臂、`/resume`、`/plan_review` ⇒ `gate_resolved`,带执行**前**从选中那一行捕获、过了信任边界的身份),也替宿主投递(wake ⇒ `delivered`)。
+     * 它只是分类:位由受理点与终局体两个边界按它铸,从不只凭这一句声明铸;缺席的取消出口(`checkpoint.resume_aborted` / 抛出臂)不铸。
+     */
+    commitment: GateCommitment;
     verifyRounds: VerifyRoundsSpec | undefined;
     /**
      * **R-1**(车CJ 收车档 §10 R-1;[ref] 批落地)—— 本条 resume 腿**装配期**铸下的用户面通告
@@ -433,10 +458,7 @@ export interface RouteLegs {
     decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }): Promise<{
-        status: number;
-        body: object;
-    }>;
+    }): Promise<ResumeLegOutcome>;
     /** notify-wake 域:唤醒一条 parked checkpoint。 */
     resumeWake(sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, 
     /** [ref] 件 S-1:透传给 {@link DriveResumeArgs.acceptEarly}(200 受理语义)。HTTP `/wake` 腿传 `true`
@@ -444,7 +466,7 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** 透传给 {@link DriveResumeArgs.workflowDecision}。HTTP `/wake` 腿**不设**此位 —— 它是 `/decide` 第三条车道投递腿的专用席,
      *  而两条腿共用这一条驱动路径正是 `notify-wake.ts` 那条「wake 会烧模型,所以复用 resume 家族的同一条腿」的成文纪律。 */
-    workflowDecision?: WorkflowDecisionDelivery): Promise<HostLegOutcome>;
+    workflowDecision?: WorkflowDecisionDelivery): Promise<ResumeLegOutcome>;
     /**
      * assistant plan_review 三态腿的**纯读段**([ref],7.97.0):选卡 → 属主轻读 → 载入 → 行级 scope → 门类 → 这条决断
      * 唯一的一次 ctx 读。任何一步拒 ⇒ `{ok:false, answer}`(不改任何状态;端点在消费一次性 nonce **之前**把它答出去);
@@ -481,10 +503,7 @@ export interface RouteLegs {
     acceptEarly?: boolean, 
     /** [ref]:批准之后这条会话继续用的 permission mode(闭集 `PLAN_APPROVE_PERMISSION_MODES_AFTER`;只在把计划带出 plan 的决定
      *  —— `approve` / `edit` —— 上有意义,缺席 ⇒ `"default"`)。语义与判据的唯一属主 = `resume-legs.ts` 的同名形参顶注。 */
-    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<{
-        status: number;
-        body: object;
-    }>;
+    permissionModeAfter?: PlanApprovePermissionModeAfter): Promise<ResumeLegOutcome>;
 }
 /**
  * [ref] 件 S-2 —— resume 族**受理点的断连留痕**(裁定:维持 detach,补观察面)。
@@ -673,48 +692,13 @@ export type RouteDecl = RouteDispatchDecl | RouteGateDecl;
  * api-error-text-freeze 基线流程。
  */
 /**
- * resume 家族**引擎腿**的结局:HTTP 应答(`status` / `body`)+ 一位**进程内**事实(不上 wire)。workflow 宿主腿的结局另型({@link HostLegOutcome}),并集 = {@link ResumeLegOutcome}。
- *
- * `decisionCommitted` —— **这条腿的终局是在引擎受理了这次决定之后才结出来的**([ref] X5,7.112.0):本腿走到了「引擎交回结果」那一步
- * (`resumeStream` / `resumeWithVerification` 解析 = core 的全部 pre-CAS 门 + checkpoint resolve CAS 都过了 —— 受理点的判据属主
- * = {@link DriveResumeArgs.acceptEarly} 顶注),之后才收场。只由 `driveResumeLeg` 走完引擎那一步的终局出口铸;`CheckpointError` 臂、
- * 「中止抛穿」臂、一切 4xx / 拒绝出口一律**不铸**(缺席 ⇒ 证不出提交,读者按「没提交」读 —— fail-closed)。
- *
- * 读者:`/decide` 的两道「这次决定提交了没有」门 —— [ref] 迟到结算留痕(`noteLateSettleIfAccepted`)与 remember 豁免落店
- * (`routes/approvals-assistant.ts`)。它们原先只读 wire 体的 `errorCode !== "cancelled"`(「取消 = 决定没提交」),[ref] 给续跑腿补了
- * 「引擎受理之后才被取消」的取消终局之后,`cancelled` 不再等价「没提交」⇒ 两门改读本位:`200 ∧ (errorCode≠cancelled ∨ decisionCommitted)`。
- * 🔴 为什么不放进 `result.cancelContext`(主会话初稿的落点):那只快照的契约是「分诊材料,不是状态机输入:任何门 / CAS / resume 判定都不许
- * 读它」(`plugins/store-contracts.ts` `RunCancelContext` 顶注)—— 这两道门正是判定;而且门读的是 `/decide` 的平面体、看不到结果对象。
- * 受理与否是腿自己的控制流事实,在腿上说,零 wire 变更。
- */
-export interface EngineLegOutcome {
-    status: number;
-    body: object;
-    decisionCommitted?: true;
-}
-/**
- * **workflow 宿主腿的结局(wake / fresh)—— 型上就没有 `decisionCommitted`**([ref] ②,7.113.0;`never` 让「这条路径不铸」成为**编译事实**,不是靠人记)。
- *
- * 为什么这条路径不该有该位:`/decide` 的 workflow 第三条车道(`resumeCheckpoint` 的 parked 分流,`planWorkflowParkedDecide` 之后)与 `POST /v1/sessions/:id/wake`
- * 把决定 / 消息交给**宿主会话的下一跑**(`resumeWake` / `startFreshHostTurn`)。它们的 200 只到「已交给宿主的下一跑」—— 子代 checkpoint 的 resolve CAS 发生在
- * workflow 引擎自己驱动那一步,server 观察不到(`resume-legs.ts` 该分流处「刻意不落 `late_settle`」同源)。「这次决定被引擎受理了」这句话在这里**没有可说的对象**,
- * 于是 `decisionCommitted` 在这条路径上语义含混(修前:`resumeWake` 的收尾是 `driveResumeIntoRunLog` 的 `ResumeLegOutcome`,非受理点早返形(无 `acceptEarly`)下它会把
- * 引擎腿的 `decisionCommitted:true` 原样带出去 —— 型被声明返回型 `{status, body}` 擦掉了,运行期仍在)。读者核实:两道提交门(`noteLateSettleIfAccepted` 迟到结算留痕、
- * `/decide` 的 remember 豁免落店)在这条路径上今天**零读取**(前者该分流直接 `return`、不调;后者的 `pendingGrant` 只由引擎腿的 `onResumeCommitted` 回调置位,宿主腿不调它,且 `planWorkflowParkedDecide` 对 workflow 车道的 `remember` 本就 fail-closed 拒 —— `decide.workflow_remember_unsupported`,`parked-decide.ts`)——
- * 无读者 ⇒ 剥掉该位,而不是留一个「铸了也没人读、读了不知道什么意思」的位。出口经 {@link buildHostLegOutcome} 只带 `status` / `body`。
+ * resume 家族一条腿的结局:HTTP 应答(`status` / `body`)。「这次决定提交了没有」只有一种说法 —— 体上的结清证据 `decisionCommitted`
+ * (唯一铸点 / 唯一读法 = `gate-settlement.ts`);进程内不另带第二个提交位。
  */
-export interface HostLegOutcome {
+export interface ResumeLegOutcome {
     status: number;
     body: object;
-    decisionCommitted?: never;
 }
-/** resume 家族一条腿的结局:引擎腿(可带 `decisionCommitted`)∪ workflow 宿主腿(型上没有)。`out.decisionCommitted === true` 同时收窄到引擎腿。 */
-export type ResumeLegOutcome = EngineLegOutcome | HostLegOutcome;
-/** 把任意腿的结局折成宿主腿结局:**只带 `status` / `body`**(丢掉引擎腿的 `decisionCommitted` —— 见 {@link HostLegOutcome})。纯数据。 */
-export declare function buildHostLegOutcome(out: {
-    status: number;
-    body: object;
-}): HostLegOutcome;
 /**
  * **「决定/续跑已受理」那一枚 200 收据的单一铸点**([ref])。
  *
@@ -724,11 +708,12 @@ export declare function buildHostLegOutcome(out: {
  * 都不该加**;写成两份字面量,漂开的那天没有任何东西会说话。
  *
  * `bindingEnforced` 的语义不因铸点而变(「这次决定按绑定坐标受理,不是盲目放行」),故两腿同带。
+ *
+ * `evidence` = 结清证据(`gate-settlement.ts`):引擎续跑腿的受理点交 `buildSettlementEvidence({ at: "engine_accepted", … })` 铸的那一份
+ * (`gate_resolved` 腿 ⇒ 位 + 身份;wake 的 `delivered` ⇒ 空);没跨过任何边界的回执(宿主新一跑、同一决定重投)交 `NO_SETTLEMENT_EVIDENCE`。
+ * 调用方不手写证据键 —— 体上的两键只有那一只铸点。
  */
-export declare function acceptedResumingReceipt(taskId: string, sessionId: string): {
-    status: number;
-    body: object;
-};
+export declare function acceptedResumingReceipt(taskId: string, sessionId: string, evidence: GateSettlementEvidence): ResumeLegOutcome;
 /** 一条腿的结局是不是一张「已受理」回执,是 ⇒ 回执上那一跑的 `taskId`(同一张回执的读法与 {@link acceptedResumingReceipt} 住在一起;
  *  `/decide` 的 workflow 车道据它把投递那一跑记在决定行上)。 */
 export declare function acceptedTaskIdOf(out: {

package/dist/http/route-ctx.js

@@ -21,11 +21,8 @@ export function assertNever(x) {
     throw new Error(`unreachable route id: ${String(x)}`);
 }
 export const ROUTE_METHOD_ORDER = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-export function buildHostLegOutcome(out) {
-    return { status: out.status, body: out.body };
-}
-export function acceptedResumingReceipt(taskId, sessionId) {
-    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true } };
+export function acceptedResumingReceipt(taskId, sessionId, evidence) {
+    return { status: 200, body: { taskId, sessionId, status: "resuming", bindingEnforced: true, ...evidence } };
 }
 export function acceptedTaskIdOf(out) {
     const body = out.body;

package/dist/http/routes/a2a-serve.js

@@ -272,11 +272,17 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         const prepared = await ctx.legs.prepareSpec(req, res, body, (e) => {
             typed = e;
         });
-        if (typed)
-            throw rpcErrorFromTypedFailure(typed, skillId);
-        if (!prepared)
+        if (!prepared) {
+            if (typed)
+                throw rpcErrorFromTypedFailure(typed, skillId);
             return undefined;
-        receipt = await createDurableRun(req, res, ctx, prepared, idem);
+        }
+        try {
+            receipt = await createDurableRun(req, res, ctx, prepared, idem);
+        }
+        finally {
+            prepared.peerLease.release();
+        }
     }
     if (!receipt)
         return undefined;

package/dist/http/routes/agents-roster.d.ts

@@ -25,7 +25,7 @@
  *  · **能力位同源**:`capabilities.agentRoster` 与这里的 501 谓词是同一个 `deps.backgroundAgentStore`。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { BackgroundAgentRowSummary } from "@sema-agent/core";
+import { type BackgroundAgentRowSummary } from "@sema-agent/core";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 /** 名册窗的扫描上限(与 fleet 的终态窗同姿势:读面要有界)。窗满时回体带 `truncated:true`,
  *  `total` 于是诚实地是「窗内行数」而不是租户全量 —— 一个悄悄封顶的 total 比没有 total 更坏。 */

package/dist/http/routes/agents-roster.js

@@ -1,7 +1,9 @@
+import { chosenAgentName } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { fleetViewOf, sendUnauthorized } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { backgroundAgentNameOf } from "../../background-agent-name.js";
 export const ROSTER_SCAN_LIMIT = 500;
 const ROSTER_STATUSES = ["running", "parked", "completed", "failed", "killed"];
 const ROSTER_KEY_DISPOSITION = {
@@ -24,9 +26,11 @@ export function rosterAgentId(row) {
     return row.handle;
 }
 function projectRow(r) {
+    const name = backgroundAgentNameOf(r);
     return {
         handle: rosterAgentId(r),
-        ...(r.name !== undefined ? { name: r.name } : {}),
+        name,
+        ...(chosenAgentName(r.handle, name) === undefined ? { anonymous: true } : {}),
         ...(r.agentType !== undefined ? { agentType: r.agentType } : {}),
         status: r.status,
         spawnedAt: r.spawnedAt,

package/dist/http/routes/approvals-assistant.js

@@ -22,7 +22,7 @@ import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal, sessionCaller
 import { readOwnedRun, readOwnedSession } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
-import { callGrantBindingOf, questionGrantBindingOf } from "../../standing-answer-grant.js";
+import { grantBindingOf } from "../../standing-answer-grant.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -31,6 +31,7 @@ import { recordFailOpen } from "../../observability/fail-open.js";
 import { MAX_CHECKPOINT_ID_CHARS, durableRowIdentity } from "../../checkpoint-identity.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
+import { buildSettlementEvidence, decisionCommittedOf } from "../../gate-settlement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decision", "feedback", "reason", "remember", "updatedInput",
 ];
@@ -259,6 +260,7 @@ async function decideIdempotentReplay(cs, args) {
             decision,
             bindingEnforced: true,
             ...(executionOutcome !== undefined ? { executionOutcome } : {}),
+            ...buildSettlementEvidence({ at: "replay_matched" }),
         },
     };
 }
@@ -352,8 +354,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                         sendError(res, 404, "request.route_unsupported", "not found");
                         return;
                     }
-                    const rows = await deps.approvalExemptionStore.list(exSessionId);
-                    sendJson(res, 200, { exemptions: rows.filter((r) => callGrantBindingOf({ toolName: r.toolName }).kind === "none") });
+                    sendJson(res, 200, { exemptions: await deps.approvalExemptionStore.list(exSessionId) });
                     return;
                 }
                 if (exToolName === undefined) {
@@ -870,8 +871,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 }
                 : undefined;
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, hostDecisionFacts(decidedBy, deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
-            const outErrorCode = out.body.errorCode;
-            if (pendingGrant !== undefined && out.status === 200 && (outErrorCode !== "cancelled" || out.decisionCommitted === true) && deps.approvalExemptionStore) {
+            if (pendingGrant !== undefined && decisionCommittedOf(out) && deps.approvalExemptionStore) {
                 try {
                     await deps.approvalExemptionStore.grant(pendingGrant.sessionId, pendingGrant.toolName, deciderPrincipal ?? null);
                     rememberApplied = true;
@@ -954,7 +954,7 @@ function projectPendingForWire(row, deployment) {
         governanceForced: governanceForced === true,
         requiresRealApproval: row.requiresRealApproval === true,
         mandated: row.mandated === true || row.ruleOffersAbsence === "mandated",
-        grantBinding: questionGrantBindingOf(row, deploymentListQuestion),
+        grantBinding: grantBindingOf(row),
         classes: row.classes,
         deploymentListQuestion,
     });

package/dist/http/routes/background.d.ts

@@ -1,7 +1,7 @@
 /**
  * [ref](core 7.32.0 [ref] 的 server 半场;wire 形 [ref] / [ref] / [ref] 定)—— **会话后台任务的两只读口**:
  *
- *   `GET  /v1/sessions/:id/background`        → 200 `{ rows: [{ id, description?, type, status, createdAt, sessionScoped, retained? }] }`
+ *   `GET  /v1/sessions/:id/background`        → 200 `{ rows: [{ id, description?, type, status, createdAt, sessionScoped, retained?, sessionId? }] }`
  *   `POST /v1/sessions/:id/background/stop`   body `{ includeRetained: boolean }` → 200 `{ receipts: [{ id, outcome }] }`
  *
  * 消费方:cli [ref] ①(删前核登记)/ [ref](退出三选一:「Exit and stop tasks」= `includeRetained:true`,`sema kill` =
@@ -28,6 +28,16 @@
  * oracle);显式 operator 可读可停任何会话(监督动作)。零模型工作 ⇒ 不进 billable、不吃 drain 503;停止口是 mutating ⇒
  * `rateLimited`。能力位 `background: { listFace, exitFaces }` 与两口的 501 从同一个谓词推导(会话属主面在场)。
  *
+ * ── 结清口:子代结清只有一只协调器 ─────────────────────────────────────────────────────────────────
+ * `POST /v1/sessions/:id/children/retire`(无体)→ 200 `{ children: string[] }`:**显式**结清以本会话为根的后台子代(running 停掉、parked
+ * 作废卡并对账翻终态),与 `DELETE /v1/sessions/:id` 同调**一只**预检 `probeSessionChildren` 与**一只**协调器 `retireSessionChildren`
+ * (`session-children-retire.ts`)、同一个 scope(`sessionChildrenScope`)。预检有本副本结束不了的 ⇒ 409 `conflict.session_children_alive{remaining}`
+ * (与删除门同码同投影,一只都不动);停不净(时序失败)⇒ 与删除门同一失败契约(通用 500,重试收敛)。`children` = 首轮观察到、且已全部
+ * 结清的子代,每项经名册的 id 投影 `rosterAgentId`(与换绑 / 导入两门 409 体的 `children` 同形同投影)。它不判根认领(停止口也不判):
+ * 根 run 活着时它可再派子代 —— 由换绑 / 导入门写事务内的认领读兜。鉴权 / 限流 / 无凭据写门与停止口同。
+ * **停止口的已发语义逐字不动**:它只中止 running 的后台 agent / workflow 并收 shell,停驻子代与待决卡留着 —— 「停别的、留卡待决」与
+ * 「把树结清」是两个意图、两只口。
+ *
  * 🔴 **停止口在无凭据写门内**(`credentialGated: ["POST"]`;车OL F1 = 7.102.0 合并复审 gpt-6 腿 [high]):门的两个合取项它都中
  *   —— ① 授权的唯一输入是 principal 头(属主判 `sessionOwnerOk` 与 operator 臂 `explicitOperatorOk` 读的都是 `gatedPrincipal`,
  *   无 service 凭证的部署上它收调用方自报的头);② 不可撤销、爆炸半径跨租户(知道会话 id + 自报它的属主 ⇒ 停掉那个会话的后台
@@ -53,12 +63,24 @@ export interface SessionBackgroundRow {
     createdAt: number;
     sessionScoped: boolean;
     retained?: true;
+    /** 后台 agent 行的子会话 id(引擎绑定之后才有;缺席 ⇒ 键不在)。 */
+    sessionId?: string;
 }
 /** 停止口的一条受据(`outcome` 逐字透传 core 闭集)。 */
 export interface SessionBackgroundReceipt {
     id: string;
     outcome: BackgroundShellHardKillReceipt["outcome"];
 }
+/** 结清口的路径(换绑 / 导入两门的子代半 409 以它点名下一步;与执行面拒体带 `forkPath` 同一形)。 */
+export declare function childrenRetirePath(sessionId: string): string;
+/**
+ * 子代半命中的拒体两键(换绑 409 `device.rebind_active_run`、导入 409 `session_active` 同一只):`children` = 预检那一次枚举观察到的活子代
+ * (`probeSessionChildren` 的 `liveChildren`)经名册 id 投影,`retirePath` = 结清口。
+ */
+export declare function liveChildrenRefusal(sessionId: string, liveChildren: readonly string[]): {
+    children: string[];
+    retirePath: string;
+};
 export declare function handleBackground(req: IncomingMessage, res: ServerResponse, match: RouteMatch<BackgroundRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const BACKGROUND_ROUTES: readonly [{
     readonly id: "session-background-list";
@@ -71,6 +93,12 @@ export declare const BACKGROUND_ROUTES: readonly [{
     readonly label: "/v1/sessions/:id/background/stop";
     readonly credentialGated: readonly ["POST"];
     readonly methods: readonly ["POST"];
+}, {
+    readonly id: "session-children-retire";
+    readonly pattern: RegExp;
+    readonly label: "/v1/sessions/:id/children/retire";
+    readonly credentialGated: readonly ["POST"];
+    readonly methods: readonly ["POST"];
 }];
 /** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
 export type BackgroundRouteId = RouteIdsOf<typeof BACKGROUND_ROUTES>;

package/dist/http/routes/background.js

@@ -1,6 +1,8 @@
 import { z } from "zod";
 import { defaultTaskRegistry } from "@sema-agent/core";
 import { reapSessionBackgroundHard } from "../../background-session-reap.js";
+import { probeSessionChildren, retireSessionChildren, sessionChildrenScope, SessionChildrenStopIncompleteError } from "../../session-children-retire.js";
+import { rosterAgentId } from "./agents-roster.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
@@ -20,6 +22,7 @@ const ROW_KEY_DISPOSITION = {
     description: "keep",
     toolUseId: "strip",
     updatedAt: "strip",
+    sessionId: "keep",
 };
 void ROW_KEY_DISPOSITION;
 function projectRow(r) {
@@ -31,13 +34,20 @@ function projectRow(r) {
         createdAt: r.createdAt,
         sessionScoped: r.sessionScoped,
         ...(r.retained === true ? { retained: true } : {}),
+        ...(r.sessionId !== undefined ? { sessionId: r.sessionId } : {}),
     };
 }
+export function childrenRetirePath(sessionId) {
+    return `/v1/sessions/${encodeURIComponent(sessionId)}/children/retire`;
+}
+export function liveChildrenRefusal(sessionId, liveChildren) {
+    return { children: liveChildren.map((handle) => rosterAgentId({ handle })), retirePath: childrenRetirePath(sessionId) };
+}
 const StopBodySchema = z.object({ includeRetained: z.boolean() }).strict();
 export async function handleBackground(req, res, match, ctx) {
     const { deps } = ctx;
     const id = match.decl.id;
-    if (id === "session-background-stop" && ctx.helpers.rateLimited(req, res))
+    if ((id === "session-background-stop" || id === "session-children-retire") && ctx.helpers.rateLimited(req, res))
         return;
     const principal = gatedPrincipal(req, deps.config);
     if (deps.config.requirePrincipal && principal === undefined) {
@@ -71,7 +81,7 @@ export async function handleBackground(req, res, match, ctx) {
     const operator = explicitOperatorOk(principal, deps.config);
     if (!operator && !ctx.helpers.sessionOwnerOk(req, res, await sessionOwnerCellOf(owned.sessionStorage, sessionId, owner)))
         return;
-    const scope = owner ?? "default";
+    const scope = sessionChildrenScope(owner);
     switch (id) {
         case "session-background-list": {
             const rows = defaultTaskRegistry.list({ owner: sessionId, sessionId, scope }, { limit: LIST_LIMIT }).map(projectRow);
@@ -83,6 +93,22 @@ export async function handleBackground(req, res, match, ctx) {
             sendJson(res, 200, { receipts: receipts.map((r) => ({ id: r.taskId, outcome: r.outcome })) });
             return;
         }
+        case "session-children-retire": {
+            const sources = { agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry };
+            const reach = await probeSessionChildren(sources, sessionId, scope);
+            if (!reach.reachable) {
+                deps.logger?.warn("session_children_retire_unreachable", { sessionId, remaining: reach.unreachableHandles.length, handles: reach.unreachableHandles });
+                sendError(res, 409, "conflict.session_children_alive", "this session still has background agents running where this replica cannot stop them (on another replica, for example), so nothing was retired — `remaining` lists their ids (the same ids `GET /v1/agents/roster` shows); retry once they finish, or stop them where they run", { remaining: reach.unreachableHandles.map((handle) => rosterAgentId({ handle })) });
+                return;
+            }
+            const out = await retireSessionChildren(sources, sessionId, scope);
+            if (out.stopped === "incomplete") {
+                deps.logger?.warn("session_children_retire_incomplete", { sessionId, remaining: out.remainingHandles.length, handles: out.remainingHandles });
+                throw new SessionChildrenStopIncompleteError(sessionId, out.remainingHandles.length);
+            }
+            sendJson(res, 200, { children: out.observed.map((handle) => rosterAgentId({ handle })) });
+            return;
+        }
         default:
             return assertNever(id);
     }
@@ -90,5 +116,6 @@ export async function handleBackground(req, res, match, ctx) {
 export const BACKGROUND_ROUTES = [
     { id: "session-background-list", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/background$/, label: "/v1/sessions/:id/background", methods: ["GET"] },
     { id: "session-background-stop", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/background\/stop$/, label: "/v1/sessions/:id/background/stop", credentialGated: ["POST"], methods: ["POST"] },
+    { id: "session-children-retire", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/children\/retire$/, label: "/v1/sessions/:id/children/retire", credentialGated: ["POST"], methods: ["POST"] },
 ];
 //# sourceMappingURL=background.js.map

package/dist/http/routes/capabilities.js

@@ -1,4 +1,4 @@
-import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus } from "@sema-agent/core";
+import { PERMISSION_MODES, USER_ATTACHMENT_SEAT, expandTiers, reasoningEffortLevelsOf, routePairingStatus, thinkingOffSpelled } from "@sema-agent/core";
 import { modelImageInput, modelReasoningDecl, isAtMentionable, selectableAliasNames, selectableCatalog } from "../../model-select.js";
 import { buildDroppedEntriesWire } from "../../web-admin-client/read-warnings.js";
 import { buildCandidateRejectedWire } from "../../web-admin-client/candidate-gate.js";
@@ -12,7 +12,7 @@ import { leaderEntryRefusal, leaderRunEntry } from "../../leader/run-entry.js";
 import { autonomyKeepsOpenWriteFace, autonomyModeFloor } from "../../runtime-governance.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
-import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
+import { buildEmptyMcpProbeFace, buildMcpInjectionRefusal, buildMcpProbeCacheKey, buildMcpProbeInflightRefusal, buildMcpProbeRateKey, buildMcpProbeRateRefusal, createMcpProbeLocal, buildMcpProbeDeclarationRefusal, buildMcpProbeIncompleteRefusal, McpProbeIncomplete, McpProbeMisaligned, MCP_PROBE_HTTP_STATUS, MCP_PROBE_MAX_INFLIGHT, MCP_PROBE_VERDICT_TIMEOUT_MS, countMcpProbeDeclarations, createMcpProbeWalk, readMcpProbeBody, } from "../../capabilities/mcp-probe.js";
 import { mcpForScenario } from "../../web-admin-client/facade.js";
 import { sendScenarioNotFound } from "../scenario-read-face.js";
 import { sendJson, sendError } from "../send.js";
@@ -87,6 +87,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 artifacts: facts.durableRuns(deps).available,
                 approvals: facts.checkpointPark(deps).available,
                 approvalReadRootGrant: facts.readRootGrant(deps).available,
+                modsDeploymentPackages: facts.deploymentModPackages(deps).available ? true : undefined,
                 sessions: facts.sessionAuditView(deps).available,
                 deviceExecutor: facts.deviceLane(deps).available
                     ? {
@@ -249,7 +250,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 return;
             }
             const scenarioName = await deps.scenarioGate(principal, scenarioParams[0]);
-            await serveMcpProbeFace(res, ctx, principal, mcpForScenario(deps.config.mcpServers, scenarioName) ?? [], "deployment");
+            await serveMcpProbeFace(res, ctx, principal, { declaredBy: "deployment", specs: mcpForScenario(deps.config.mcpServers, scenarioName) ?? [] });
             return;
         }
         case "capability-mcp-probe": {
@@ -267,7 +268,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sendMcpProbeRefusal(res, ctx, parsed.refusal, "bad_request");
                 return;
             }
-            await serveMcpProbeFace(res, ctx, principal, parsed.specs, "caller");
+            await serveMcpProbeFace(res, ctx, principal, { declaredBy: "caller", drafts: parsed.drafts });
             return;
         }
         case "models": {
@@ -282,6 +283,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 provider: m.provider,
                 ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
+                supportsThinkingOff: thinkingOffSpelled(m),
                 ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
@@ -322,18 +324,18 @@ function sendMcpProbeRefusal(res, ctx, refusal, outcome, retryAfterSec) {
         ...(retryAfterSec !== undefined ? { retryAfterSec } : {}),
     });
 }
-async function serveMcpProbeFace(res, ctx, principal, specs, declaredBy) {
+async function serveMcpProbeFace(res, ctx, principal, input) {
     const { deps } = ctx;
     const local = ctx.local.capabilities.mcpProbe;
-    if (specs.length === 0) {
+    if (countMcpProbeDeclarations(input) === 0) {
         deps.metrics?.inc("mcp_probe_total", { outcome: "empty" });
         sendJson(res, 200, buildEmptyMcpProbeFace());
         return;
     }
-    const key = buildMcpProbeCacheKey(principal, specs);
+    const key = buildMcpProbeCacheKey(principal, input);
     const hit = local.cached(key, Date.now());
     if (hit !== undefined) {
-        await answerMcpProbe(res, ctx, hit, "cached", declaredBy);
+        await answerMcpProbe(res, ctx, hit, "cached", input.declaredBy);
         return;
     }
     if (local.inflight() >= MCP_PROBE_MAX_INFLIGHT) {
@@ -345,9 +347,9 @@ async function serveMcpProbeFace(res, ctx, principal, specs, declaredBy) {
         sendMcpProbeRefusal(res, ctx, buildMcpProbeRateRefusal(), "rate_limited", verdict.retryAfterSec);
         return;
     }
-    const walk = createMcpProbeWalk(specs, principal);
+    const walk = createMcpProbeWalk(input, principal, deps.peerDesk);
     local.remember(key, Date.now(), walk);
-    await answerMcpProbe(res, ctx, walk.answer, "probed", declaredBy);
+    await answerMcpProbe(res, ctx, walk.answer, "probed", input.declaredBy);
 }
 async function answerMcpProbe(res, ctx, answer, outcome, declaredBy) {
     const { deps } = ctx;

package/dist/http/routes/devices.d.ts

@@ -8,19 +8,19 @@
  *     **hub 在场性**判 —— v1 部署形 = 单副本(基线稿 §4.6),汇聚端的活连接集就是本副本的 presence
  *     真源;`name` = displayName,空串诚实缺席;`lastSeenAt` ISO-8601)。**吊销行不列**:revoked 是
  *     终态(重注册 = 新 deviceId),列出来只会被壳当换绑目标然后撞 404。
- *   · `GET  /v1/devices/sessions/:rootSessionId` —— S-4 绑定读面(壳换绑 UX 的全部材料):
- *     `{ rootSessionId, boundDevice: { deviceId, rev, boundAt } }`。稿 §4 允许「并入 session 读面」或
- *     「独立读面」两形,选**独立读面**:sessions 的 GET 面承诺「无参请求字节不变」(routes/sessions.ts
- *     的 additive contract 注),且 audit 投影由 boot/session-faces 组装、不持 device 店 —— 并入即跨
- *     装配缝加一次店读;独立读面把 device wire 族收在一个文件里,户口与门序自洽。
- *   · `POST /v1/devices/sessions/:rootSessionId/rebind` —— 显式换绑动词(v2 稿 §2 门序五步,逐字):
- *     ① gatedPrincipal + owner 门(非属主 404 反枚举同串,[ref] 纪律)
+ *   · 绑定读面在会话族:`GET /v1/sessions/:id/execution-placement`(`routes/sessions.ts`;体 = 执行放置格的 wire 投影,
+ *     device 车道上是 `{ role: "writer", lane: "device", device: { deviceId, rev } }`)。绑定是根会话行上的执行格,读只有会话店的执行席一只。
+ *   · `POST /v1/devices/sessions/:rootSessionId/rebind` —— 显式换绑动词(v2 稿 §2 门序五步):
+ *     ① gatedPrincipal + owner 门 —— 一次行读(会话店执行席:住客 + 格),属主门判**格上**两属主列(非属主 404 反枚举同串,[ref] 纪律)
  *     ② 目标设备在场门(不存在 / 不是该域的 / 已吊销 ⇒ 404 **同串** —— 设备 id 也是不可枚举面)
- *     ③ 无活跃 run 门(**CAS 前判、CAS 语句不兼职**;durable 判据 = run store 的 session claim
- *        `getActiveTaskId`,hub 内存在途计数不作门 —— 内存态跨副本不可见;拒 = 409
- *        `device.rebind_active_run` 体带 `activeTaskId`)
- *     ④ 前态 CAS(店内单事务:`rev` 恒变列 + `session_rebound` 审计行;输 = 409
- *        `device.rebind_rev_conflict` 体带 `currentRev` —— [ref] currentPending 哲学,壳一跳重定位)
+ *     ③ 无活跃 run 门:池级 `getActiveTaskId` 读一次作**早拒**(零审计行);**保证**在设备店的换绑事务里 —— 同一连接先锁根会话行、
+ *        再锁定读 `task_active`,有认领 ⇒ 不写(读写序律;hub 内存在途计数不作门 —— 内存态跨副本不可见);两处同拒 409
+ *        `device.rebind_active_run` 体带 `activeTaskId`
+ *     ③′ 子代半(写前一次观察):以根为根的活后台子代(running / parked;`probeSessionChildren` 那一次枚举,scope = 会话属主 `sessionChildrenScope`,
+ *        与删除门同读)⇒ 同码 409,体 `children`(名册 id)+ `retirePath`(显式结清口 —— 先结清、再换绑)
+ *     ④ 前态 CAS(店内单事务:按门那一读的住客 ∧ 格上两属主列 ∧ rev 定址,`execution_rev` 恒变列 + `session_rebound` 审计行;输 = 409
+ *        `device.rebind_rev_conflict` 体带 `currentRev` —— [ref] currentPending 哲学,壳一跳重定位;门后会话被删并同 id 重登记 ⇒ 住客不符 ⇒ 设备 404,
+ *        永不写到新住客的格上)
  *     ⑤ 赢 = 200 `{ rootSessionId, deviceId, rev, workspaceCarryover: "none" }`。
  *     幂等形:toDeviceId ≡ 当前 ∧ expectedRev ≡ 当前 rev ⇒ 200 回显不加 rev(真幂等,不写审计)。
  *     `workspaceCarryover: "none"` 是 **wire 冻结字面**(v2 稿 §5):换绑只改路由,不搬字节 —— 壳据
@@ -34,7 +34,7 @@
  * 才构成一个 device 域;缺 tenant claim 的凭据(纯 principal 头 / 静态 token 直连)**判不出域** ⇒
  * 非 operator 一律响亮 403(fail-closed + loud,[ref]:静默空列表是假健康)——基线稿对 enrollment 的
  * 同向裁定是「缺 tenant/global scope 明确拒注册」。enrollment/管理端点与**首绑写协议**都从
- * 这同一个函数取域([ref] 起它住在 `http/device-placement.ts` —— 提交腿也要用,放在路由域里是层序倒挂),
+ * 这同一个函数取域(它住在 `http/execution-context.ts` —— 提交腿的设备准入也要用,放在路由域里是层序倒挂),
  * 不得手抄第二份派生。
  *
  * ── 反枚举 404 的单一铸造点 ──────────────────────────────────────────────────────────────────────
@@ -81,12 +81,6 @@ export declare const DEVICES_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/devices/sessions/:id/rebind";
     readonly methods: readonly ["POST"];
-}, {
-    readonly id: "device-session";
-    readonly pattern: RegExp;
-    readonly label: "/v1/devices/sessions/:id";
-    readonly credentialGated: readonly ["GET"];
-    readonly methods: readonly ["GET"];
 }, {
     readonly prefix: "/v1/devices/";
     readonly credentialGated: readonly ["POST"];