@sema-agent/server 7.138.0 → 7.140.0

package/dist/http/routes/sessions.js

@@ -7,6 +7,8 @@ import { seatText } from "../../trace/exit-seat.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
+import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { foldPlaneStatuses } from "../../memory-operator-faces.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
@@ -18,6 +20,10 @@ import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
 import { projectSessionListRow } from "./sessions-list.js";
 import { readSessionRowPatch } from "../../session-row.js";
+import { forkPathOf } from "../execution-context.js";
+import { executionPlacementView } from "../../execution-placement.js";
+import { ForkTargetUnsettledError, forkKeyOf } from "../../plugins/session-fork.js";
+import { fieldConflictFacts } from "../../field-conflict.js";
 import { buildBoundedToolNames } from "../../panel-tool-names.js";
 import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const MCP_STATUS_TTL_MS = 5_000;
@@ -172,7 +178,7 @@ export async function handleSessions(req, res, match, ctx) {
                     mcpStatusCache.clear();
                 const panel = (async () => {
                     const stopDial = new AbortController();
-                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations, undefined, undefined, undefined, stopDial.signal, undefined, deps.peerDesk.seat.answer);
+                    const matP = materializeMcpTools(specs, principal, undefined, undefined, undefined, deps.mcpRevocations, undefined, undefined, undefined, stopDial.signal, undefined, deps.peerDesk.seat);
                     const mat = await raceDeadline(matP, MCP_DIAL_DEADLINE_MS).catch(() => null);
                     if (!mat) {
                         stopDial.abort();
@@ -221,7 +227,7 @@ export async function handleSessions(req, res, match, ctx) {
                 if (a2aStatusCache.size > 1024)
                     a2aStatusCache.clear();
                 const panel = (async () => {
-                    const matP = materializeA2aTools(specs, principal, undefined, undefined, deps.peerDesk.seat.answer);
+                    const matP = materializeA2aTools(specs, principal, undefined, undefined, deps.peerDesk.seat);
                     let timer;
                     const mat = await Promise.race([matP.catch(() => null), new Promise((r) => { timer = setTimeout(() => r(null), A2A_MATERIALIZE_TIMEOUT_MS); })]);
                     if (timer)
@@ -286,6 +292,29 @@ export async function handleSessions(req, res, match, ctx) {
             return;
         }
     }
+    {
+        if (match.decl.id === "session-execution-placement") {
+            const placementFact = facts.executionPlacementRead(deps);
+            if (!placementFact.available) {
+                sendError(res, 501, "capability.session_store_required", "the execution placement read requires a durable session store (DB_BACKEND=mysql|pg|local)");
+                return;
+            }
+            const placementSession = safeDecode(match.params.sessionId);
+            if (placementSession === null) {
+                sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
+                return;
+            }
+            const reading = await placementFact.seat.read(placementSession);
+            if (reading === undefined) {
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                return;
+            }
+            if (!explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config) && !sessionOwnerOk(req, res, await sessionOwnerCellOf(deps.sessionStorage, placementSession, reading.occupant.owner)))
+                return;
+            sendJson(res, 200, executionPlacementView(reading.cell));
+            return;
+        }
+    }
     {
         if (match.decl.id === "session-events") {
             const evFact = facts.sessionEventStream(deps);
@@ -524,11 +553,17 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "allowUnevidenced must be a boolean when present");
                 return;
             }
+            const at = readLayerSeat(res, Object.prototype.hasOwnProperty.call(raw, "scope"), raw.scope);
+            if (at === null)
+                return;
+            const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
             try {
-                sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
+                const input = { requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) };
+                sendJson(res, 200, await (at !== undefined ? faces.erase(input, at) : faces.erase(input)));
             }
             catch (err) {
-                const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
+                if (sentMemoryLayerRefusal(res, err, { kind: "session_owner", withheld }))
+                    return;
                 if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }, deps.logger))
                     return;
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
@@ -560,20 +595,27 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
+            const query = new URLSearchParams(match.search);
+            const at = readLayerSeat(res, query.has("scope"), query.get("scope"));
+            if (at === null)
+                return;
             try {
                 const { memoryStatusCache } = ctx.local.sessions;
-                let entry = memoryStatusCache.get(sessionId);
-                if (!entry || Date.now() - entry.at > MEMORY_STATUS_TTL_MS) {
+                const statusOf = (store) => {
+                    const cacheKey = JSON.stringify([sessionId, store.controlPlane]);
+                    const cached = memoryStatusCache.get(cacheKey);
+                    if (cached && Date.now() - cached.at <= MEMORY_STATUS_TTL_MS)
+                        return cached.status;
                     if (memoryStatusCache.size > 1024)
                         memoryStatusCache.clear();
-                    const status = face.status(sessionId);
+                    const status = store.status(sessionId);
                     const fresh = { at: Date.now(), status };
-                    memoryStatusCache.set(sessionId, fresh);
-                    status.catch(() => { if (memoryStatusCache.get(sessionId) === fresh)
-                        memoryStatusCache.delete(sessionId); });
-                    entry = fresh;
-                }
-                const s = await entry.status;
+                    memoryStatusCache.set(cacheKey, fresh);
+                    status.catch(() => { if (memoryStatusCache.get(cacheKey) === fresh)
+                        memoryStatusCache.delete(cacheKey); });
+                    return status;
+                };
+                const s = foldPlaneStatuses(await Promise.all(face.storesAt(at).map(statusOf)));
                 sendJson(res, 200, {
                     sessionId,
                     autoConsolidationArmed: deps.memoryAutoConsolidationArmed,
@@ -585,6 +627,8 @@ export async function handleSessions(req, res, match, ctx) {
                 });
             }
             catch (err) {
+                if (sentMemoryLayerRefusal(res, err, { kind: "session_owner", withheld: (message) => deps.logger?.warn?.("session_memory_status_refused", { sessionId, err: message }) }))
+                    return;
                 deps.logger?.warn?.("session_memory_status_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory status read failed");
             }
@@ -675,13 +719,25 @@ export async function handleSessions(req, res, match, ctx) {
             sendError(res, 400, read.problem.code, read.problem.message);
             return;
         }
-        const row = await store.patchSessionMeta(sessionId, read.patch, face);
-        if (row === undefined) {
-            sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
-            return;
+        const outcome = await store.writeSessionRowCells(sessionId, read.patch, { writer: "client", row: { row: face }, ...(read.expectedRowTag !== undefined ? { rowTag: read.expectedRowTag } : {}) });
+        switch (outcome.kind) {
+            case "written":
+                sendJson(res, 200, projectSessionListRow(outcome.row));
+                return;
+            case "changed":
+                sendError(res, 409, "conflict.session_row_changed", "the session row changed since the rowTag you sent was read — nothing was written; currentRow is the row as it stands now: decide again, then send its rowTag", { currentRow: projectSessionListRow(outcome.row) });
+                return;
+            case "mirror":
+                sendError(res, 409, "conflict.session_mirror", "this session is a read-only mirror of a session whose writer is elsewhere — it cannot be renamed or pinned here; fork it (forkPath) to continue here; nothing was written", { forkPath: forkPathOf(sessionId) });
+                return;
+            case "absent":
+                sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                return;
+            default: {
+                const unknownOutcome = outcome;
+                throw new Error(`PATCH /v1/sessions/:id: no answer for the row write outcome ${JSON.stringify(unknownOutcome)}`);
+            }
         }
-        sendJson(res, 200, projectSessionListRow(row));
-        return;
     }
     {
         if (match.decl.id === "session-fork") {
@@ -712,12 +768,57 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const newOwner = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
-            const newId = await fork(sourceId, newOwner);
-            if (newId === null) {
+            const keyed = readForkTarget(await readJson(req), sourceId);
+            if (keyed.kind === "refused") {
+                sendError(res, 400, keyed.errorCode, keyed.message, keyed.facts);
+                return;
+            }
+            if (keyed.kind === "none") {
+                const newId = await fork(sourceId, newOwner);
+                if (newId === null) {
+                    sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                    return;
+                }
+                sendJson(res, 200, { sessionId: newId });
+                return;
+            }
+            const forkTo = forkFact.sessionStorage.forkTo?.bind(forkFact.sessionStorage);
+            if (forkTo === undefined) {
+                sendError(res, 501, "capability.session_store_required", "a keyed fork (forkId + forkNonce) requires a session store that creates the target row atomically (DB_BACKEND=mysql|pg|local)");
+                return;
+            }
+            let outcome;
+            try {
+                outcome = await forkTo(sourceId, newOwner, { id: keyed.forkId, key: forkKeyOf(sourceId, keyed.forkNonce) });
+            }
+            catch (e) {
+                if (e instanceof ForkTargetUnsettledError) {
+                    sendError(res, 503, "state.fork_target_unsettled", e.message, { permanence: "transient" });
+                    return;
+                }
+                throw e;
+            }
+            if (outcome === null) {
                 sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
                 return;
             }
-            sendJson(res, 200, { sessionId: newId });
+            switch (outcome.outcome) {
+                case "created":
+                    sendJson(res, 200, { sessionId: outcome.id });
+                    return;
+                case "replayed":
+                    sendJson(res, 200, { sessionId: outcome.id, replayed: true });
+                    return;
+                case "occupied":
+                    if (!outcome.sameOwner) {
+                        sendError(res, 404, "not_found.session", SESSION_NOT_FOUND_MESSAGE);
+                        return;
+                    }
+                    sendError(res, 409, "conflict.fork_id_taken", "forkId already names another session of yours (a different fork, or a session that was not created by this fork request) — pick a new forkId and forkNonce; nothing was forked", { forkId: keyed.forkId });
+                    return;
+                default:
+                    assertNever(outcome);
+            }
             return;
         }
     }
@@ -853,6 +954,7 @@ export const SESSIONS_ROUTES = [
     { id: "session-mcp", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/mcp$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
     { id: "session-a2a", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/a2a$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
     { id: "session-head", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/head$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
+    { id: "session-execution-placement", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/execution-placement$/, label: "/v1/sessions/:id/execution-placement", credentialGated: ["GET"], methods: ["GET"] },
     { id: "session-events", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/events$/, label: "/v1/sessions/:id/$verb", methods: ["GET"], subscription: true },
     { id: "session-fork", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/fork$/, label: "/v1/sessions/:id/$verb", methods: ["POST"] },
     { id: "session-policy-get", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)\/policy$/, label: "/v1/sessions/:id/$verb", methods: ["GET"] },
@@ -864,4 +966,23 @@ export const SESSIONS_ROUTES = [
     { id: "session-patch", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)$/, label: "/v1/sessions/:id", methods: ["PATCH"] },
     { id: "session-delete", pattern: /^\/v1\/sessions\/(?<sessionId>[^/]+)$/, label: "/v1/sessions/:id", methods: ["DELETE"] },
 ];
+function readForkTarget(raw, sourceId) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return { kind: "refused", errorCode: "request.field_invalid", message: "the fork body must be an object { forkId?, forkNonce? }" };
+    const { forkId, forkNonce } = raw;
+    if (forkId === undefined && forkNonce === undefined)
+        return { kind: "none" };
+    if (forkId === undefined || forkNonce === undefined) {
+        return { kind: "refused", errorCode: "request.field_conflict", message: "forkId and forkNonce come together — send both (a keyed, retryable fork) or neither (a fork under a freshly minted id)", facts: fieldConflictFacts("fork_target", ["forkId", "forkNonce"]) };
+    }
+    if (typeof forkId !== "string" || !isUuidShape(forkId))
+        return { kind: "refused", errorCode: "request.id_invalid", message: "forkId must be a canonical uuid (the id the forked session will have)" };
+    if (forkId === sourceId)
+        return { kind: "refused", errorCode: "request.field_invalid", message: "forkId must name a new session — it equals the session being forked" };
+    if (typeof forkNonce !== "string" || forkNonce.length === 0 || forkNonce.length > FORK_NONCE_MAX_CHARS) {
+        return { kind: "refused", errorCode: "request.field_invalid", message: `forkNonce must be a non-empty string of at most ${FORK_NONCE_MAX_CHARS} characters (the caller's key for this fork request; a retry sends the same one)` };
+    }
+    return { kind: "keyed", forkId, forkNonce };
+}
+const FORK_NONCE_MAX_CHARS = 255;
 //# sourceMappingURL=sessions.js.map

package/dist/http/routes/side-query.d.ts

@@ -8,10 +8,18 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
-/** 表内=core 的前置校验形(客户端可改请求)⇒ 400;表外一律 500。 */
-export declare function isCorePreflightValidationError(message: string): boolean;
-/** 供跨仓锚门读:门要拿这张表去装机的 core 里逐条对账(见上方 doc)。 */
-export declare const CORE_PREFLIGHT_VALIDATION_ANCHORS: readonly string[];
+/**
+ * [ref] —— core 前置校验异常的分类(400 客户端可改 / 500 我方缺陷):**只读引擎的码**。
+ * 引擎角色族的拒(未知模型引用 / 不是模型引用 / 角色词出表 / 角色链给不出模型)一律带码 `config.unknown_role`(`detail.reason` 分臂;
+ * core 7.60.0 [ref] 起最后一臂也带码)—— 这是引擎写明的判别位,本路由的 400 只认它;句子不读(修前是一张按英文开头匹配的两行前缀表,
+ * 引擎改一个字就会把客户端错误静默翻成 500)。失败方向:别的码 / 没有码一律 500(响亮、可告警、可重试),绝不把不认识的异常猜成客户端错误。
+ * 跨仓锚:test/side-query-http.test.ts 调装机 core 的两个导出解析器真抛,拿真错误过本谓词。
+ *
+ * 🪦 原表还有第三臂 `requires a non-empty messages array`(core `core/side-query.js`)—— 不可达(本路由在调 core 之前就有
+ * `!Array.isArray(body.messages) || body.messages.length === 0 ⇒ 400 request.body_shape` 的前拦),已删;前拦一旦被摘,
+ * side-query-http 的「空/非数组 messages → 400 request.body_shape」两格先红。
+ */
+export declare function isCorePreflightValidationError(err: unknown): boolean;
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。 */
 export declare function handleSideQuery(req: IncomingMessage, res: ServerResponse, match: RouteMatch<SideQueryRouteId>, ctx: RouteCtx): Promise<void>;
 export declare const SIDE_QUERY_ROUTES: readonly [{

package/dist/http/routes/side-query.js

@@ -4,15 +4,14 @@ import { echoCallerText } from "../../caller-text-echo.js";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, selectableCatalog } from "../../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../../model-entry-refusal.js";
 import { redactSecrets } from "../../trace/redact.js";
+import { errorCodeOf } from "../../observability/err-text.js";
 import { admitProviderEcho, redactErrorMessage } from "../../observability/run-terminal.js";
 import { sendJson, sendError, sendHttpError, msg } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
 import { assertNever } from "../route-ctx.js";
-const CORE_PREFLIGHT_VALIDATION_PREFIXES = ["Unknown model ref ", "No model for role "];
-export function isCorePreflightValidationError(message) {
-    return CORE_PREFLIGHT_VALIDATION_PREFIXES.some((prefix) => message.startsWith(prefix));
+export function isCorePreflightValidationError(err) {
+    return errorCodeOf(err) === "config.unknown_role";
 }
-export const CORE_PREFLIGHT_VALIDATION_ANCHORS = CORE_PREFLIGHT_VALIDATION_PREFIXES;
 const MODEL_ROLE_ECHO_CHARS = 80;
 function isModelRole(value) {
     return typeof value === "string" && MODEL_ROLES.includes(value);
@@ -105,7 +104,7 @@ export async function handleSideQuery(req, res, match, ctx) {
                     deps.metrics?.inc?.("side_query_total", { result: "error" });
                     if (!res.writableEnded && !ac.signal.aborted) {
                         const m = msg(e);
-                        const isValidation = isCorePreflightValidationError(m);
+                        const isValidation = isCorePreflightValidationError(e);
                         sendError(res, isValidation ? 400 : 500, isValidation ? "request.field_invalid" : "internal.error", redactSecrets(m));
                     }
                 }

package/dist/http/routes/tasks.js

@@ -2,7 +2,7 @@ import { redactErrorMessage, redactHead, redactTerminalResult } from "../../obse
 import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
 import { heldFor } from "../../peer-seat.js";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, HEARTBEAT_MS } from "../../runs.js";
-import { sealResultForExit, outwardPlane } from "../../terminal.js";
+import { atHostBoundary, sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
@@ -24,7 +24,8 @@ import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble, buildApprovalPreambleSseFrames } from "../../approval-card.js";
 import { approvalPreambleReplays, createApprovalCardEmitter, declaredApprovalFrameFamilies, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, isActiveRunConflictBody, toDoneFrameResult } from "../active-run-conflict.js";
-import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
+import { commitExecutionContext } from "../execution-context.js";
+import { rootSessionAbsentAnswer } from "../execution-context.js";
 import { commitSessionInheritEnv } from "../session-inherit-env.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk, runIdentityOf } from "../principal-gate.js";
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
@@ -177,7 +178,7 @@ export async function handleTasks(req, res, match, ctx) {
                     sendError(res, 400, "request.field_conflict", "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs", fieldConflictFacts("cascade_verify", prepared.verify ? (prepared.cascade ? ["verify", "cascade"] : ["verify"]) : ["cascade"]));
                     return;
                 }
-                const earlyDurableTid = facts.durableRuns(deps).available && prepared.spec.sessionId ? uuidv7() : undefined;
+                const earlyDurableTid = facts.durableRuns(deps).available ? uuidv7() : undefined;
                 const streamLegStartedAt = Date.now();
                 const detachOnDisconnect = headerStr(req.headers["x-detach-on-disconnect"]) === "true";
                 if (detachOnDisconnect && earlyDurableTid === undefined) {
@@ -289,19 +290,19 @@ export async function handleTasks(req, res, match, ctx) {
                     let runRowSettled = false;
                     let durableTaskId;
                     let durableHeartbeat;
-                    const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: errorMessage, cause });
+                    const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId, startedAtMs: streamLegStartedAt, message: errorMessage, cause });
                     let userMsgEntryId;
                     const promptCommit = createPromptCommitReader();
                     let anchorPut = false;
                     const putRewindAnchor = () => {
-                        if (anchorPut || !userMsgEntryId || !durableTaskId || !prepared.spec.sessionId || !deps.resumeAnchorStore)
+                        if (anchorPut || !userMsgEntryId || !durableTaskId || !deps.resumeAnchorStore)
                             return;
                         anchorPut = true;
                         void deps.resumeAnchorStore
                             .put(prepared.spec.sessionId, durableTaskId, userMsgEntryId, principal ?? null)
                             .catch(() => deps.metrics?.inc("resume_anchor_capture_failed"));
                     };
-                    if (deps.runStore && prepared.spec.sessionId) {
+                    if (deps.runStore) {
                         const tid = earlyDurableTid ?? uuidv7();
                         const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null });
                         if (created.ok)
@@ -313,22 +314,25 @@ export async function handleTasks(req, res, match, ctx) {
                             sseData(res, { type: "done", result: doneResultOfOutcome(replay), replay: true });
                             return replay;
                         }
+                        if (created.sessionAbsent) {
+                            const refused = rootSessionAbsentAnswer();
+                            sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
+                            return refused;
+                        }
                         if (!created.ok) {
                             const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId);
                             const refused = { status: 409, body: conflict };
                             sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
                             return refused;
                         }
-                        const placementReject = await commitPlacement(deps, deps.runStore, tid, prepared.bindingIntent);
+                        const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: tid }, prepared.execution);
                         if (placementReject) {
-                            const body = devicePlacementErrorBody(placementReject);
-                            const refused = { status: placementReject.status, body };
-                            sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
-                            return refused;
+                            sseData(res, { type: "done", result: doneResultOfOutcome(placementReject) });
+                            return placementReject;
                         }
                         durableTaskId = tid;
                     }
-                    if (deps.checkpointStore && prepared.spec.sessionId) {
+                    if (deps.checkpointStore) {
                         const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
                         if (ctxRefusal) {
                             sseData(res, { type: "done", result: doneResultOfOutcome(ctxRefusal) });
@@ -336,8 +340,7 @@ export async function handleTasks(req, res, match, ctx) {
                         }
                     }
                     commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
-                    if (prepared.spec.sessionId)
-                        markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
+                    markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                     let ledgerSink;
                     let ledgerTerminal = false;
                     if (durableTaskId && deps.runStore) {
@@ -412,7 +415,7 @@ export async function handleTasks(req, res, match, ctx) {
                             }
                             : {}),
                     });
-                    if (deps.userInputLedger && durableTaskId && prepared.spec.sessionId)
+                    if (deps.userInputLedger && durableTaskId)
                         await deps.userInputLedger.announceUndrained({ sessionId: prepared.spec.sessionId, taskId: durableTaskId });
                     try {
                         const streamBody = async () => {
@@ -420,7 +423,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 const tailContentMode = prepared.spec.forwardSubagentEvents === true ? "on" : "progress_only";
                                 const childReasoning = createReasoningSegments();
                                 const topReasoning = createReasoningSegments();
-                                const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
+                                const heldDecisions = await heldWorkflowParkDecisions(deps, prepared.spec.sessionId);
                                 const fwdInternals = {
                                     ...heldDecisions,
                                     onForwardEvent: (e) => {
@@ -476,7 +479,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         }
                                         const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
                                         const deliverable = syncLegLive && !res.writableEnded && !res.destroyed;
-                                        const parked = !deliverable && Boolean(deps.workflowCompletionInbox && prepared.spec.sessionId);
+                                        const parked = !deliverable && deps.workflowCompletionInbox !== undefined;
                                         deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
                                         if (parked) {
                                             void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
@@ -521,7 +524,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         if (durableTaskId && finalResult)
                                             finalResult = { ...finalResult, taskId: durableTaskId };
                                         if (causeAtDone !== undefined && finalResult !== undefined) {
-                                            finalResult = mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: "cancelled by user", cause: causeAtDone, engineResult: finalResult });
+                                            finalResult = mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId, startedAtMs: streamLegStartedAt, message: "cancelled by user", cause: causeAtDone, engineResult: finalResult });
                                         }
                                         finalizeTaskResult(ev.result, principal, prepared.spec.objective);
                                         noteRunOutcome(finalResult);
@@ -714,7 +717,8 @@ export async function handleTasks(req, res, match, ctx) {
                                 taskId: askTaskId,
                                 owner: askOwner,
                                 abortSignal: ac.signal,
-                                ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
+                                sessionId: prepared.spec.sessionId,
+                                executionLane: prepared.execution.lane,
                                 ...(streamApprovalOn
                                     ? {
                                         emitCard,
@@ -728,11 +732,12 @@ export async function handleTasks(req, res, match, ctx) {
                         if (deps.toolApproval) {
                             const toolApproval = deps.toolApproval;
                             prepared.spec.onAsk = unattended
-                                ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) }, unattended)
+                                ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, sessionId: prepared.spec.sessionId, executionLane: prepared.execution.lane }, unattended)
                                 : toolApproval.boundAsk({
                                     owner: askOwner,
                                     taskId: askTaskId,
-                                    ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
+                                    sessionId: prepared.spec.sessionId,
+                                    executionLane: prepared.execution.lane,
                                     ...(streamApprovalOn ? { legKey: "", ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
                                 });
                         }
@@ -815,7 +820,7 @@ export async function handleTasks(req, res, match, ctx) {
                             try {
                                 const row = await deps.runStore.getRun(durableTaskId);
                                 if (row?.status === "running") {
-                                    const pending = prepared.spec.sessionId ? await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId) : undefined;
+                                    const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
                                     const backstopCause = ac.cause();
                                     if (pending) {
                                         if (ledgerSink && !ledgerTerminal) {
@@ -896,7 +901,7 @@ export async function handleTasks(req, res, match, ctx) {
                     const syncLegStartedAt = Date.now();
                     let durableTaskId;
                     let durableHeartbeat;
-                    if (deps.runStore && prepared.spec.sessionId) {
+                    if (deps.runStore) {
                         const tid = uuidv7();
                         const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null });
                         if (created.ok)
@@ -905,22 +910,23 @@ export async function handleTasks(req, res, match, ctx) {
                             recordResourceWindow(tid, prepared.spec.resourceSuspend);
                         if (created.existing)
                             return await replayOfExistingRun(created.existing, { principal: submitter, idem }, "sync", deps, deps.runStore);
+                        if (created.sessionAbsent)
+                            return rootSessionAbsentAnswer();
                         if (!created.ok)
                             return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) };
-                        const placementReject = await commitPlacement(deps, deps.runStore, tid, prepared.bindingIntent);
+                        const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: tid }, prepared.execution);
                         if (placementReject)
-                            return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
+                            return placementReject;
                         durableTaskId = tid;
                     }
-                    if (deps.checkpointStore && prepared.spec.sessionId) {
+                    if (deps.checkpointStore) {
                         const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
                         if (ctxRefusal)
                             return ctxRefusal;
                     }
                     commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                     const syncCancelCtrl = createRunAbort();
-                    if (prepared.spec.sessionId)
-                        markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
+                    markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                     if (durableTaskId && deps.runStore) {
                         const rs = deps.runStore;
                         const tid = durableTaskId;
@@ -950,7 +956,7 @@ export async function handleTasks(req, res, match, ctx) {
                     let result;
                     counters.uncountedBillableInflight++;
                     try {
-                        const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
+                        const heldDecisions = await heldWorkflowParkDecisions(deps, prepared.spec.sessionId);
                         const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, heldDecisions);
                         const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), heldDecisions);
                         const plainLeg = async () => {
@@ -963,7 +969,7 @@ export async function handleTasks(req, res, match, ctx) {
                             }
                             return stream.result();
                         };
-                        result = await instructionLeg.run(prepared.spec.sessionId, () => withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg()));
+                        result = atHostBoundary(await instructionLeg.run(prepared.spec.sessionId, () => withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg())), prepared.spec.sessionId);
                     }
                     finally {
                         counters.uncountedBillableInflight--;
@@ -976,7 +982,7 @@ export async function handleTasks(req, res, match, ctx) {
                     if (syncAbortCause !== undefined) {
                         result = mintCancelledResult({
                             taskId: durableTaskId ?? "",
-                            sessionId: prepared.spec.sessionId ?? "",
+                            sessionId: prepared.spec.sessionId,
                             startedAtMs: syncLegStartedAt,
                             message: "cancelled by user",
                             cause: syncAbortCause,
@@ -998,12 +1004,14 @@ export async function handleTasks(req, res, match, ctx) {
                     }
                     const exitResult = await mintSubmitExitResult(result, deps.checkpointStore);
                     const syncPlane = outwardPlane(result.terminal);
-                    if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && durableTaskId && prepared.spec.sessionId) {
+                    if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && durableTaskId) {
                         await deps.runStore.setSuspended(durableTaskId, exitResult);
+                        prepared.acceptance.settle(result);
                         return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" })) };
                     }
-                    if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && durableTaskId && prepared.spec.sessionId) {
+                    if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && durableTaskId) {
                         await deps.runStore.setNeedsReview(durableTaskId, exitResult);
+                        prepared.acceptance.settle(result);
                         return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" })) };
                     }
                     if (durableTaskId && deps.runStore)