@sema-agent/server 7.137.0 → 7.139.0

package/dist/plugins/execution-placement-sql.js

@@ -0,0 +1,223 @@
+import { isExecutionLane } from "../execution-lane-caps.js";
+import { sessionFaceFromRow } from "../session-incarnation.js";
+import { toIso } from "./sql-row-helpers.js";
+import { WRITABLE, assertPlaceableLane, settledMirrorOutcome, settledPlaceOutcome, } from "../execution-placement.js";
+export const SESSION_META_PLACEMENT_COLUMNS = [
+    { name: "execution_role", tidb: "execution_role VARCHAR(16) NULL", pg: `execution_role VARCHAR(16) COLLATE "C"` },
+    { name: "execution_lane", tidb: "execution_lane VARCHAR(32) NULL", pg: `execution_lane VARCHAR(32) COLLATE "C"` },
+    { name: "execution_device_id", tidb: "execution_device_id VARCHAR(64) NULL", pg: `execution_device_id VARCHAR(64) COLLATE "C"` },
+    { name: "execution_device_owner_tenant", tidb: "execution_device_owner_tenant VARCHAR(190) NULL", pg: `execution_device_owner_tenant VARCHAR(190) COLLATE "C"` },
+    { name: "execution_device_owner_subject", tidb: "execution_device_owner_subject VARCHAR(190) NULL", pg: `execution_device_owner_subject VARCHAR(190) COLLATE "C"` },
+    { name: "execution_placed_at", tidb: "execution_placed_at DATETIME(3) NULL", pg: "execution_placed_at TIMESTAMPTZ(3)" },
+    { name: "execution_rev", tidb: "execution_rev BIGINT NULL", pg: "execution_rev BIGINT" },
+    { name: "fork_key", tidb: "fork_key VARCHAR(255) NULL", pg: `fork_key VARCHAR(255) COLLATE "C"` },
+];
+export function sessionMetaPlacementColumnsDdl(dialect) {
+    return SESSION_META_PLACEMENT_COLUMNS.map((c) => c[dialect]).join(",\n     ");
+}
+const WRITER = "writer";
+const MIRROR = "mirror";
+const NOT_WRITER = "(execution_role IS NULL OR execution_role <> 'writer')";
+export const MIRROR_ON_COMMIT_SET = "execution_role = 'mirror'";
+export const MIRROR_ON_COMMIT_GUARD = NOT_WRITER;
+export function importedRowCells(forkKey) {
+    return { columns: "fork_key, execution_role", values: [forkKey, MIRROR] };
+}
+export const SESSION_META_PLACEMENT_READ_COLUMNS = "owner, incarnation, placement_kind, execution_role, execution_lane, execution_device_id, execution_device_owner_tenant, execution_device_owner_subject, execution_placed_at, execution_rev";
+function binder(dialect) {
+    const values = [];
+    return {
+        values,
+        p: (v) => {
+            values.push(v);
+            return dialect === "pg" ? `$${values.length}` : "?";
+        },
+    };
+}
+function occupantPredicate(dialect, p, root, occupant) {
+    const nullSafeEq = dialect === "pg" ? "IS NOT DISTINCT FROM" : "<=>";
+    return `session_id = ${p(root)} AND incarnation = ${p(occupant.incarnation)} AND owner ${nullSafeEq} ${p(occupant.owner)} AND placement_kind IS NULL`;
+}
+export function readPlacementRowStatement(dialect, root, opts) {
+    const b = binder(dialect);
+    return { text: `SELECT ${SESSION_META_PLACEMENT_READ_COLUMNS} FROM session_meta WHERE session_id = ${b.p(root)}${opts.lock ? " FOR UPDATE" : ""}`, values: b.values };
+}
+export function placeWriterStatement(dialect, root, occupant, cell, now) {
+    const b = binder(dialect);
+    const set = `execution_role = '${WRITER}', execution_lane = ${b.p(cell.lane)}, execution_device_id = ${b.p(cell.device?.id ?? null)}, ` +
+        `execution_device_owner_tenant = ${b.p(cell.device?.owner.tenant ?? null)}, execution_device_owner_subject = ${b.p(cell.device?.owner.subject ?? null)}, ` +
+        `execution_placed_at = ${b.p(now)}, execution_rev = 0`;
+    return { text: `UPDATE session_meta SET ${set} WHERE ${occupantPredicate(dialect, b.p, root, occupant)} AND execution_role IS NULL`, values: b.values };
+}
+export function bindDeviceStatement(dialect, root, occupant, device, now) {
+    const b = binder(dialect);
+    const set = `execution_device_id = ${b.p(device.id)}, execution_device_owner_tenant = ${b.p(device.owner.tenant)}, execution_device_owner_subject = ${b.p(device.owner.subject)}, execution_placed_at = ${b.p(now)}, execution_rev = 0`;
+    return {
+        text: `UPDATE session_meta SET ${set} WHERE ${occupantPredicate(dialect, b.p, root, occupant)} AND execution_role = '${WRITER}' AND execution_lane = 'device' AND execution_device_id IS NULL`,
+        values: b.values,
+    };
+}
+export function rebindDeviceStatement(dialect, root, occupant, owner, expectedRev, targetDeviceId, now) {
+    const b = binder(dialect);
+    const set = `execution_device_id = ${b.p(targetDeviceId)}, execution_placed_at = ${b.p(now)}, execution_rev = execution_rev + 1`;
+    const where = `${occupantPredicate(dialect, b.p, root, occupant)} AND execution_role = '${WRITER}' AND execution_lane = 'device' ` +
+        `AND execution_device_owner_tenant = ${b.p(owner.tenant)} AND execution_device_owner_subject = ${b.p(owner.subject)} AND execution_rev = ${b.p(expectedRev)}`;
+    return { text: `UPDATE session_meta SET ${set} WHERE ${where}`, values: b.values };
+}
+export function markMirrorStatement(dialect, root, occupant) {
+    const b = binder(dialect);
+    return { text: `UPDATE session_meta SET execution_role = '${MIRROR}' WHERE ${occupantPredicate(dialect, b.p, root, occupant)} AND ${NOT_WRITER}`, values: b.values };
+}
+export function backfillWriterStatement(dialect, lane, now) {
+    const b = binder(dialect);
+    return {
+        text: `UPDATE session_meta SET execution_role = '${WRITER}', execution_lane = ${b.p(lane)}, execution_placed_at = ${b.p(now)}, execution_rev = 0 ` +
+            "WHERE execution_role IS NULL AND placement_kind IS NULL AND EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = session_meta.session_id)",
+        values: b.values,
+    };
+}
+export function migrateDeviceBindingsStatement(dialect, sourceTable) {
+    if (dialect === "pg") {
+        return {
+            text: `UPDATE session_meta SET execution_role = '${WRITER}', execution_lane = 'device', execution_device_id = ds.device_id, ` +
+                "execution_device_owner_tenant = ds.owner_tenant, execution_device_owner_subject = ds.owner_subject, execution_placed_at = ds.bound_at, execution_rev = ds.rev " +
+                `FROM ${sourceTable} ds WHERE ds.root_session_id = session_meta.session_id AND session_meta.placement_kind IS NULL`,
+            values: [],
+        };
+    }
+    const str = (col) => `CONVERT(ds.${col} USING utf8mb4)`;
+    return {
+        text: `UPDATE session_meta sm JOIN ${sourceTable} ds ON ${str("root_session_id")} COLLATE utf8mb4_bin = sm.session_id ` +
+            `SET sm.execution_role = '${WRITER}', sm.execution_lane = 'device', sm.execution_device_id = ${str("device_id")}, ` +
+            `sm.execution_device_owner_tenant = ${str("owner_tenant")}, sm.execution_device_owner_subject = ${str("owner_subject")}, sm.execution_placed_at = ds.bound_at, sm.execution_rev = ds.rev ` +
+            "WHERE sm.placement_kind IS NULL",
+        values: [],
+    };
+}
+export function countOrphanBindingsStatement(dialect, sourceTable) {
+    const rootKey = dialect === "pg" ? "ds.root_session_id" : "CONVERT(ds.root_session_id USING utf8mb4) COLLATE utf8mb4_bin";
+    return {
+        text: `SELECT COUNT(*) AS orphans FROM ${sourceTable} ds WHERE NOT EXISTS (SELECT 1 FROM session_meta sm WHERE sm.session_id = ${rootKey} AND sm.placement_kind IS NULL)`,
+        values: [],
+    };
+}
+export class ExecutionPlacementRowError extends Error {
+    sessionId;
+    code = "execution_placement.row_unreadable";
+    constructor(sessionId, detail) {
+        super(`session ${sessionId}: the execution placement columns do not form a placement (${detail}) — refusing to read it as any placement`);
+        this.sessionId = sessionId;
+        this.name = "ExecutionPlacementRowError";
+    }
+}
+const isNull = (v) => v === null || v === undefined;
+const text = (v) => (Buffer.isBuffer(v) ? v.toString("utf8") : String(v));
+export function placementCellFromRow(root, row) {
+    const role = row.execution_role;
+    const deviceCols = [row.execution_device_id, row.execution_device_owner_tenant, row.execution_device_owner_subject];
+    if (isNull(role) || role === MIRROR) {
+        if (!isNull(row.execution_lane) || deviceCols.some((v) => !isNull(v)))
+            throw new ExecutionPlacementRowError(root, `role ${isNull(role) ? "NULL" : MIRROR} with a lane or device`);
+        return isNull(role) ? { role: "absent" } : { role: "mirror" };
+    }
+    if (role !== WRITER)
+        throw new ExecutionPlacementRowError(root, `role ${JSON.stringify(text(role))} is not writer / mirror / NULL`);
+    const lane = isNull(row.execution_lane) ? "" : text(row.execution_lane);
+    if (!isExecutionLane(lane))
+        throw new ExecutionPlacementRowError(root, `writer lane ${JSON.stringify(lane)} is not an execution lane`);
+    if (isNull(row.execution_device_id)) {
+        if (deviceCols.some((v) => !isNull(v)))
+            throw new ExecutionPlacementRowError(root, "device owner without a device");
+        return { role: "writer", lane };
+    }
+    if (lane !== "device")
+        throw new ExecutionPlacementRowError(root, `a device on the ${lane} lane`);
+    if (deviceCols.some(isNull) || isNull(row.execution_rev) || isNull(row.execution_placed_at))
+        throw new ExecutionPlacementRowError(root, "a device without its owner, rev or placement time");
+    return {
+        role: "writer",
+        lane,
+        device: {
+            id: text(row.execution_device_id),
+            owner: { tenant: text(row.execution_device_owner_tenant), subject: text(row.execution_device_owner_subject) },
+            rev: Number(row.execution_rev),
+            placedAt: toIso(row.execution_placed_at),
+        },
+    };
+}
+export function placementReadingFromRow(root, row) {
+    if (row === undefined || !isNull(row.placement_kind))
+        return undefined;
+    return { occupant: sessionFaceFromRow(root, isNull(row.owner) ? null : text(row.owner), row.incarnation), cell: placementCellFromRow(root, row) };
+}
+export function rowsOnSqlExec(exec) {
+    return async (sql, values) => (await exec.query(sql, [...values])).rows;
+}
+export async function lockRootAndReadClaim(conn, dialect, root) {
+    const ph = dialect === "pg" ? "$1" : "?";
+    const row = await conn(`SELECT session_id FROM session_meta WHERE session_id = ${ph} FOR UPDATE`, [root]);
+    if (row.length === 0)
+        return { rowPresent: false, activeTaskId: null };
+    const claim = await conn(`SELECT task_id FROM task_active WHERE session_id = ${ph} FOR UPDATE`, [root]);
+    return { rowPresent: true, activeTaskId: claim[0] === undefined ? null : text(claim[0].task_id) };
+}
+export async function readPlacementOn(conn, dialect, root) {
+    const s = readPlacementRowStatement(dialect, root, { lock: true });
+    return placementReadingFromRow(root, (await conn(s.text, s.values))[0]);
+}
+function placementInvariant(root, what) {
+    return new Error(`execution placement of session ${root}: ${what} matched no row while a re-read finds the cell writable — engine/driver anomaly, refusing to guess`);
+}
+export function createSqlExecutionPlacementSeat(db) {
+    const read = async (root) => {
+        const s = readPlacementRowStatement(db.dialect, root, { lock: false });
+        return placementReadingFromRow(root, (await db.query(s.text, [...s.values])).rows[0]);
+    };
+    return {
+        read,
+        async place(root, occupant, cell) {
+            assertPlaceableLane(root, cell);
+            const s = placeWriterStatement(db.dialect, root, occupant, { lane: cell.lane }, new Date());
+            if ((await db.query(s.text, [...s.values])).affected === 1)
+                return { outcome: "placed" };
+            const settled = settledPlaceOutcome(root, await read(root), occupant, cell);
+            if (settled === WRITABLE)
+                throw placementInvariant(root, "place");
+            return settled;
+        },
+        async markMirror(root, occupant) {
+            const conn = await db.connect();
+            try {
+                await conn.begin();
+                const rowsOn = rowsOnSqlExec(conn);
+                const claim = await lockRootAndReadClaim(rowsOn, db.dialect, root);
+                if (!claim.rowPresent) {
+                    await conn.rollback();
+                    return { outcome: "gone" };
+                }
+                const settled = settledMirrorOutcome(root, await readPlacementOn(rowsOn, db.dialect, root), occupant);
+                if (settled !== WRITABLE) {
+                    await conn.rollback();
+                    return settled;
+                }
+                if (claim.activeTaskId !== null) {
+                    await conn.rollback();
+                    return { outcome: "active", activeTaskId: claim.activeTaskId };
+                }
+                const s = markMirrorStatement(db.dialect, root, occupant);
+                if ((await conn.query(s.text, [...s.values])).affected !== 1)
+                    throw placementInvariant(root, "markMirror under a held row lock");
+                await conn.commit();
+                return { outcome: "mirrored" };
+            }
+            catch (err) {
+                await conn.rollback().catch(() => undefined);
+                throw err;
+            }
+            finally {
+                conn.release();
+            }
+        },
+    };
+}
+//# sourceMappingURL=execution-placement-sql.js.map

package/dist/plugins/file-history-store-sql.d.ts

@@ -183,15 +183,16 @@ export declare class PgFileHistoryStore extends SqlFileHistoryStore {
 }
 /**
  * [ref] D1② — A7-recipe upgrade precondition assert (**refuse to start**, never a warn; the form and
- * rationale follow `assertPermissionRuleTicketSchema` verbatim: this repo ships no ALTER TABLE, and
+ * rationale follow `assertPermissionRuleTicketSchema` verbatim: the boot check never alters a table, and
  * `CREATE TABLE IF NOT EXISTS` is a no-op on an existing table whose columns predate this build).
  *
  * The probe is one always-empty `WHERE 1=0` read per table naming every column this build references.
- * ONLY a provable missing-column error gets the destructive recreate guidance — everything else
- * (timeout / reset / permission / missing table) rethrows untouched: advising `DROP TABLE` for a
- * connection blip is more expensive than the defect this gate exists to stop. Honest cost statement:
- * dropping these tables loses per-file REWIND history (working-tree convenience state) — session
- * transcripts and every other durable subsystem are untouched.
+ * ONLY a provable missing-column error gets the missing-column refusal — everything else
+ * (timeout / reset / permission / missing table) rethrows untouched: diagnosing a connection blip as a
+ * schema drift is more expensive than the defect this gate exists to stop. The refusal's ways out are the
+ * closed set of three shared with the whole-database check (`describeProbedTableDrift`); none of them
+ * is destructive. Honest cost statement: the history lives in these tables (per-file REWIND history,
+ * working-tree convenience state) — session transcripts and every other durable subsystem are untouched.
  */
 export declare function assertFileHistorySchema(query: (sql: string) => Promise<{
     rows: Record<string, unknown>[];

package/dist/plugins/file-history-store-sql.js

@@ -3,6 +3,7 @@ import { captureFileBackupViaEnv, applyFileRestoreViaEnv, fileHistoryModeProvenD
 import { BlobTooLargeError, SqlBlobBackend } from "./blob-backend.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
+import { describeProbedTableDrift } from "./schema-drift-sentence.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { foldCaughtFailure } from "../file-history-disclosure.js";
 export const FILE_HISTORY_BLOB_TABLE = "file_history_blob";
@@ -721,12 +722,13 @@ export class SqlFileHistoryStore {
                 bytes = await srcGetBlob(hash);
             }
             catch (err) {
-                return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} fetch failed: ${foldCaughtFailure(err).text}` } };
+                const f = foldCaughtFailure(err);
+                return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} fetch failed: ${f.text}`, ...f.fault } };
             }
             if (bytes === undefined)
                 return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} is missing — the envelope's graph cannot be completed, so nothing is published` } };
             if (sha256hex(bytes) !== hash) {
-                return { ok: false, error: { code: "unsupported_format", message: `source blob ${hash} fails content-address integrity — refused, nothing published` } };
+                return { ok: false, error: { code: "adopt_failed", message: `source blob ${hash} served bytes that do not hash to its address — the source cannot supply this blob, so nothing is published` } };
             }
             await onVerified?.(hash, bytes);
         }
@@ -834,11 +836,10 @@ export async function assertFileHistorySchema(query, dialect) {
                 throw err;
             throw new Error(`${table} is missing required columns — refusing to start. This build's per-file rewind history (S-15) ` +
                 `references every probed column unconditionally; a partial table would fail mid-write and could publish a ` +
-                `half-shaped history graph. This repository ships no ALTER TABLE migrations, so the table must be recreated: run ` +
-                `\`DROP TABLE ${table};\` on the ${dialect === "pg" ? "PostgreSQL" : "MySQL-protocol"} backend and restart — the ` +
-                `schema is recreated at boot. Cost, honestly stated: dropping file_history_* tables loses per-file REWIND history ` +
-                `(working-tree convenience state); session transcripts and all other durable subsystems are untouched. ` +
-                `Underlying probe error: ${err instanceof Error ? err.message : String(err)}`);
+                `half-shaped history graph. The file_history_* tables hold the per-file REWIND history (working-tree convenience ` +
+                `state); session transcripts and all other durable subsystems are untouched, and an in-place ALTER keeps the history.\n` +
+                `Underlying probe error: ${err instanceof Error ? err.message : String(err)}\n\n` +
+                (await describeProbedTableDrift(query, dialect, [table])));
         }
     }
 }

package/dist/plugins/file-run-store.d.ts

@@ -152,7 +152,7 @@ export declare class FileRunStore implements InProcessClaimFence {
     whileHoldingClaim(sessionId: string, taskId: string, write: () => FenceLanded): boolean;
     getRun(taskId: string): Promise<RunRecord | undefined>;
     /** Undo THIS submission's binding (key + body fingerprint → null) — called only where the submit surface refuses the submission
-     *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, a device-placement reject):
+     *  before any work and terminalizes the row it just claimed (the sync leg's zero-work refusal, an execution-placement reject):
      *  the error answer invites a retry, and a retry with the same key must run, not replay the refusal. The row stays (it
      *  is the refusal's record); only the binding is freed. */
     releaseIdemKey(taskId: string): Promise<void>;
@@ -332,6 +332,11 @@ export declare class FileRunStore implements InProcessClaimFence {
      * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);数据根独占 ⇒ 本车道没有滚动升级窗,不需要读侧半场。幂等:第二跑零命中零写盘。
      */
     migrateLegacyHolderDeathCodes(): number;
+    /**
+     * 一次性迁移 **M32 的 local 腿**(执行放置回填;窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表):有 run 行的会话 id(去重)。
+     * 起服时调(`LocalBackend.runOneTimeMigrations`,任何读者之前);读内存索引(构造时已从盘上 hydrate),零写。
+     */
+    sessionIdsWithRuns(): ReadonlySet<string>;
     /** Release every open event-log fd (called by LocalBackend.close so a graceful restart can re-open the data dir). */
     dispose(): void;
 }

package/dist/plugins/file-run-store.js

@@ -280,6 +280,7 @@ export class FileRunStore {
                     "Refusing to boot with an EMPTY single-active claim index (every session would look unclaimed, so a delete or a fresh run could race a live/parked one). " +
                     "Fix the permissions/mount on that path, point LOCAL_DATA_ROOT at a readable dir, or unset RUN_STORE_STRICT_HYDRATE to boot anyway (the pre-existing behavior).");
             }
+            recordFailOpen("server.run-store.file-active-claims-unreadable", detail);
             claims = [];
         }
         const nonTerminalBySanitizedSession = new Map();
@@ -1009,6 +1010,9 @@ export class FileRunStore {
         }
         return migrated;
     }
+    sessionIdsWithRuns() {
+        return new Set([...this.runs.values()].map((r) => r.sessionId));
+    }
     dispose() {
         for (const log of this.eventLogs.values()) {
             try {

package/dist/plugins/fork-routing-session-store.d.ts

@@ -25,6 +25,8 @@
  */
 import { type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
 import { type DelegationTree } from "../delegated-session-owner.js";
+import type { ExecutionPlacementSeat } from "../execution-placement.js";
+import type { ForkToFn } from "./session-fork.js";
 /** acquire 选项形(core 5.48 SessionStore 契约):[ref] placement=受信 spawner 的分区建会话声明。 */
 type AcquireOpts = {
     requireExisting?: boolean;
@@ -54,6 +56,10 @@ export declare class ForkRoutingSessionStore implements SessionStore {
         olderThanMs?: number;
         scope?: string;
     }) => Promise<PlacedSessionRow[]>;
+    /** 执行席透传(host 有才有):执行放置是**根会话行**上的一格,根会话行住 host durable 店;transient 店没有会话行可放,也就不声明席。 */
+    readonly executionPlacement?: ExecutionPlacementSeat;
+    /** fork 续写的店契约透传(host 有才有):目标在 host 店原子新建,新 id 与源一并记 host 路由(与 {@link fork} 的 host 腿同)。 */
+    readonly forkTo?: ForkToFn;
     constructor(host: SessionStore, transient: SessionStore);
     private remember;
     private pick;

package/dist/plugins/fork-routing-session-store.js

@@ -11,6 +11,8 @@ export class ForkRoutingSessionStore {
     placed = new Set();
     placements;
     listPlaced;
+    executionPlacement;
+    forkTo;
     constructor(host, transient) {
         this.host = host;
         this.transient = transient;
@@ -23,6 +25,20 @@ export class ForkRoutingSessionStore {
         if (host.fork === undefined && transient.fork === undefined) {
             this.fork = undefined;
         }
+        const hostFaces = host;
+        if (hostFaces.executionPlacement !== undefined)
+            this.executionPlacement = hostFaces.executionPlacement;
+        const hostForkTo = hostFaces.forkTo;
+        if (typeof hostForkTo === "function") {
+            this.forkTo = async (sourceId, owner, target) => {
+                const out = await hostForkTo.call(host, sourceId, owner, target);
+                if (out !== null && out.outcome !== "occupied") {
+                    this.remember(sourceId, "host");
+                    this.remember(out.id, "host");
+                }
+                return out;
+            };
+        }
     }
     remember(id, where) {
         this.route.delete(id);

package/dist/plugins/k8s-pod-reaper.d.ts

@@ -7,9 +7,9 @@
  * 法(只删两形;判决链的缺省臂是「不动作」,删必须被显式选中 —— 销毁不可逆,拿不准恒不删,与 E2B 孤儿回收同一方向纪律):
  *  ② `status.phase ∈ {Succeeded, Failed}` —— 容器已全部结束,删它不掐断任何东西;不看 run、不看标签;
  *  ① 带 run 标签(`sema.io/run`,只有顶层 run 的 Pod 带)、run 行在 server 店里**已是终态**,且自 run 行**转终态的时刻**(行上的 `updatedAt` ——
- *     三只 run 店的终态写当拍盖它)起超过**这只 Pod 自带的**上界:`max(租约上限 + 宽限 = 6 min, 工作区快照时限 + 引擎拆环境放行 15 s)`
+ *     三只 run 店的终态写当拍盖它)起超过**这只 Pod 自带的**上界:`max(租约上限 + 宽限 = 6 min, 工作区快照时限 + 引擎拆环境放行 `teardownLegBudget()`)`
  *     ({@link sandboxRunEndHoldMs};租约上限 = 凭据代理的租约律那一只 `LEASE_TTL_MAX_MS`,本模块不另立)。
- *     第二项是 run 收尾的 `destroy()` 在终态之后还可能在 Pod 上存快照的最长时间(引擎的拆环境腿 15 s 放行、run 随即落终态,快照按数据时限接着跑)——
+ *     第二项是 run 收尾的 `destroy()` 在终态之后还可能在 Pod 上存快照的最长时间(引擎的拆环境腿按 `teardownLegBudget()` 放行、run 随即落终态,快照按数据时限接着跑)——
  *     那个数据时限是**建这只 Pod 的副本**的配置,所以上界**随 Pod 走、写一次读一次**:适配器建 Pod 时按自己的快照时限算一次、写进注解
  *     `sema.io/run-end-hold-ms`(`k8s-exec-protocol.ts` `SANDBOX_RUN_END_HOLD_ANNOTATION`),回收器只读 Pod 自带的这一格,**从不**读回收器所在副本的配置
  *     (列举是整个命名空间的 Pod:滚动改 `WORKSPACE_SNAPSHOT_TIMEOUT_MS` 时,一个时限短的副本不得替时限长的副本判它的 Pod)。
@@ -31,12 +31,6 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 /** ① 的宽限(在租约上限之外再等的一段)。常量。 */
 export declare const SANDBOX_POD_REAP_GRACE_MS = 60000;
-/**
- * 引擎在 run 收尾时给「拆执行环境」那条腿的放行时限:超过它 run 照样落终态,`destroy()` 脱离着继续跑。值 = core 的 `TEARDOWN_LEG_MAX_MS`
- * (`dist/core/runner/teardown-bounded.js`)—— core 不从包根导出它(包的 exports 只有 `.` / `./bench` / `./fixtures`),本仓只能照抄这一个数;
- * 收口 = 向 core 要一个包根读口后改读、删本常量。
- */
-export declare const ENGINE_TEARDOWN_RELEASE_MS = 15000;
 /** ① 的上界:`max(租约上限 + 宽限, 快照时限 + 引擎拆环境放行)`。唯一的调用方 = 适配器建 Pod 的那一拍(快照时限 = 建它的副本的 `dataTimeoutMs`),结果写进 Pod 的注解。 */
 export declare function sandboxRunEndHoldMs(snapshotTimeoutMs: number): number;
 /** 一个副本两轮回收之间的间隔。常量。 */

package/dist/plugins/k8s-pod-reaper.js

@@ -3,12 +3,12 @@ import { reportPodDeleteFailed } from "./k8s-pod-delete-failure.js";
 import { runStatusClassOf } from "./store-contracts.js";
 import { LEASE_TTL_MAX_MS } from "../broker/lease-file.js";
 import { WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE } from "../workspace-space.js";
+import { teardownLegBudget } from "@sema-agent/core";
 export const SANDBOX_POD_REAP_GRACE_MS = 60_000;
-export const ENGINE_TEARDOWN_RELEASE_MS = 15_000;
 export function sandboxRunEndHoldMs(snapshotTimeoutMs) {
-    return Math.max(LEASE_TTL_MAX_MS + SANDBOX_POD_REAP_GRACE_MS, snapshotTimeoutMs + ENGINE_TEARDOWN_RELEASE_MS);
+    return Math.max(LEASE_TTL_MAX_MS + SANDBOX_POD_REAP_GRACE_MS, snapshotTimeoutMs + teardownLegBudget());
 }
-const RUN_END_HOLD_READABLE = { min: LEASE_TTL_MAX_MS + SANDBOX_POD_REAP_GRACE_MS, max: WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max + ENGINE_TEARDOWN_RELEASE_MS };
+const RUN_END_HOLD_READABLE = { min: LEASE_TTL_MAX_MS + SANDBOX_POD_REAP_GRACE_MS, max: WORKSPACE_SNAPSHOT_TIMEOUT_MS_RANGE.max + teardownLegBudget() };
 function runEndHoldOf(raw) {
     if (raw === undefined || !/^[0-9]{1,16}$/.test(raw))
         return undefined;

package/dist/plugins/local-checkpoint-store.d.ts

@@ -32,17 +32,7 @@ export declare class LocalCheckpointStore {
      */
     readonly fidelity: StoreFidelity;
     /**
-     * `CheckpointStore.redecision` 声明(core 5.22.0 F-012 L2/L3;[ref] clay 裁放行)——**如实按内核判**,
-     * 与 durability/fidelity 同一条判据:内核 core `FileCheckpointStore` **自己**声明 `{ reopen: true }`,
-     * 本类的 {@link LocalCheckpointStore.reopen} 纯委派给它 ⇒ 抄内核的读数是诚实的。包装类**不继承**被
-     * 包装者的声明(委派不是子类),所以这一格必须自己写。`validatingLease` 不声明(内核也没声明)。
-     * 翻向钉:`wiring-governance-operator.test.ts`(修前恰红,与本声明同 commit)。
-     */
-    readonly redecision: {
-        readonly reopen: true;
-    };
-    /**
-     * `CheckpointStore.execution` 声明(core 7.7.0 [ref];[ref])——**必填**,与上面三格同一条判据:**如实
+     * `CheckpointStore.execution` 声明(core 7.7.0 [ref];[ref])——**必填**,与上面两格同一条判据:**如实
      * 按内核判**。内核 core `FileCheckpointStore` 自己声明 `{ outcome: true }`,并把执行记录落成 ledger 的
      * 一个新事件种类(`execution`,与 resolve 同款「先 append+fsync 再翻内存」的崩溃序),
      * {@link LocalCheckpointStore.recordExecutionOutcome} 与 {@link LocalCheckpointStore.reopen} 都是纯委派

package/dist/plugins/local-checkpoint-store.js

@@ -49,7 +49,6 @@ export class LocalCheckpointStore {
     retention = UNMANAGED_RETENTION;
     durability = "durable";
     fidelity = "json";
-    redecision = { reopen: true };
     execution = { outcome: true };
     inner;
     scopesPath;