@sema-agent/server 7.138.0 → 7.140.0

package/dist/observability/fail-open.d.ts

@@ -87,6 +87,10 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "P-DEBT";
         readonly note: "件6(#43 案 [4281]):`FileRunStore.hydrate()` 的 `readdirSync(runs/)` 失败 ⇒ 引擎以**空账**起动。旧形是空 catch + return:data root 不可读(权限/挂载丢失/路径被换走)时零告警,此后每一次 getRun 恒 miss —— 而「恒 miss」正是 #43 现场看到的形,一次环境故障被伪装成「本来就没有这条 run」。方向问题在于吞掉之后被读成的是「证不出有行 ⇒ 没有行」,两句话不等价。**缺省不拒启是刻意保留的行为**,所以这条留作债:响亮化(error 级启动日志带 runs 绝对路径+异常文案)+ 本计数,让它在遥测里显形而不是只活在一行日志里。⚠️ 2026-08-29(S-46 件B)起终局格已兑现:部署可用 `RUN_STORE_STRICT_HYDRATE=on` 把这一格换成 **fail-closed 启动门**(拒启,遗言同样带绝对路径+异常文案);本计数因此只在**缺省 off** 档上产生 —— 读遥测时别把「计数为零」直接读成「没有部署踩到这条路」,也可能是它们开了拒启门、根本起不来。";
     };
+    readonly "server.run-store.file-active-claims-unreadable": {
+        readonly cls: "P-DEBT";
+        readonly note: "`FileRunStore.hydrate()` 的第二处 `readdirSync(runs/active/)`(claim 平面 = 单活索引)失败,且 `RUN_STORE_STRICT_HYDRATE` 关(缺省)⇒ 服务照常起动、单活索引为**空**。放行的后果两条,都不报错:① 已有 run 行仍可读(`GET /v1/runs/:id` 照常答),但此后对这些会话的审批决定在请求里同步跑完、却找不到要更新的 run 行 —— run 行停在决前的 `suspended`;② 读单活索引的各处读到「没人占用」—— `getActiveTaskId` 恒答空,例如会话同步推送前的「会话有在飞 run」检查(与 `server.run-store.file-hydrate-unreadable` 同一句错话:「证不出有占用 ⇒ 没有占用」,只是换了一个盘面);新提交不读这张索引,claim 文件完好时仍按盘上的 claim 裁定,不受影响。同一条债的另一个盘面:缺省不拒启是刻意保留的行为,所以留作 P-DEBT —— error 级启动日志(`file_run_store_active_claims_unreadable`,带 `runs/active/` 绝对路径)早已在,本计数补的是遥测轴(此前 `runs/` 臂有计数、这一臂没有)。`RUN_STORE_STRICT_HYDRATE=on` 把这一格换成 fail-closed 启动门,本计数因此只在缺省 off 档的真放行时产生(拒启那一形不记)—— 读遥测时「计数为零」也可能是部署开了拒启门、根本起不来。";
+    };
     readonly "server.fork-routing.placed-probe-host-error": {
         readonly cls: "F";
         readonly note: "#292 placement 半场:hostPlacedProbe 对 host 店的 requireExisting 探针失败且**不是 not_found**(host 读故障)时折叠为 absent —— 路由回旧规则(claim-create 会在 transient 建新会话)。放行的是「host 暂不可达时 transient 腿保持独立可用」;最坏后果=故障窗内对一个真 placed id 铸出 transient 影子(host 恢复后双身,requireExisting 冷探针会重新指回 host 真身)。not_found 是常态路径不计数;只有真故障臂进本计数。";
@@ -549,6 +553,14 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "P-DEBT";
         readonly note: "S-163(`config-dir-trust.ts` `judgeWin32`,本地配置源 `config.d` 读之前的目录信任判官在 win32 上的那一半):Node 在 win32 上 `uid` 恒 0、模式位是只读属性的投影 ⇒ 「属主 ∈ {本服务用户, root, CONFIG_LOCAL_OWNER_UID}」与「不得组 / 他人可写」两判不可做;结构判(常规文件 / 16 MiB 上界 / 链接成环)照做。每一次读照常进行(起服一次 + 每拍一次)记一次。放行的最坏后果 = 一台多用户 Windows 机器上,别的本机用户若能写这台服务的 `config.d`(缺省的用户目录 ACL 不允许),改一份 `mcp.json` 就能让本服务以它的身份起命令 —— 与 7.132.x 逐字同。照 POSIX 拒启会让每个 Windows 本机引擎(含 cli 起的)升级即起不来,而让 cli 替用户设豁免键是中间层替部署者设安全旋钮。收口 = 有了 ACL 判据或一次裁定(改 R 或改拒启)那一版,本 tag 删或改类。detail = `config.d=<物理路径>`。";
     };
+    readonly "server.remote-write.staging-dir-left": {
+        readonly cls: "F";
+        readonly note: "远端五条车道的写(`plugins/remote-shell.ts` 的暂存编排):准备 / 提交脚本删一只私有暂存目录(`.<名>.stage-<十六进制>/`,生来 0700;只删这次写放进去的 `data` 与这只空目录,从不递归删)没删掉、在 stdout 写一条记录点名 —— 五处:`mv` 已把暂存件换到目标上之后删当前那只;跟一跳到别的目录重新暂存成功之后删原来那只;重新暂存却没用上(收紧不成 / 拷不成)的那一只;就地拷入 / 追加时删暂存名失败、或写完关掉 fd 后删私有目录失败(有的文件系统为仍打开着的文件留隐藏项:NFS / libfuse / SMB);准备时收不成私有 / 里面已有 `data` 的那一只。目录里多出了不是这次写放进去的东西(同一身份或 root 的别的进程往里写过 / 收紧之前别人放进来的)、目录被换成了符号链接、或文件系统拒删。写照它自己的结局答(提交已成 ⇒ 成功:答失败会让调用方以为目标没变),残留只在这里留痕。放行的最坏后果 = 目标(或链接所指)目录里多一只隐藏目录(空的,或装着别人放进去的东西;重新暂存没用上的那只可能装着这次写的半份新内容),只有写入方进得去;不是门、不是凭据、不碰目标内容。计数非零 = 那台目标机上有东西在往别人的暂存目录里写,或删不动,去看那只目录。detail = 残留目录的路径(一次写最多两只,逐只计)。";
+    };
+    readonly "server.remote-write.stage-seal-fallback": {
+        readonly cls: "F";
+        readonly note: "远端五条车道的写(`plugins/remote-shell.ts` 的暂存编排):准备脚本把刚建的私有暂存目录收成 0700 并读回核实(`chmod 700` 退出 0 ∧ `stat` 读回的模式低三位恰是 700 ∧ 属主 = 本身份),任一步不成 —— `chmod` 被文件系统 / 内核拒;退出 0 却没生效(不认权限位的文件系统);父目录带缺省 ACL 而掩码收不下来;目标机上没有 `stat` —— 准备退出 4、这次写**不暂存**,两只文件面、五条腿一律改为直接写目标(与「目标目录不收新名字」同一条回落;能追加写的腿直接追加,e2b / adb 的追加 = 读旧 + 拼 + 整份写目标 —— adb 的这一形就是 7.138.x 的追加,push 没有追加写)。修前这一步是 `chmod 700 … || :`:加固失败照样放行上传,字节落在一只别的身份可能读得到的目录里(P 轴 fail-open),那一臂已删,字节从不进一只没核成私有的目录。放行的最坏后果 = 这一次写失去「整旧或整新」(非原子:中途断 / 取消 ⇒ 目标可能只写了一半,整份写目标的 e2b / adb 上可能没了或只剩半份;写目标那一步因取消中断答 `unknown`,那一步开始之前取消答 `aborted`、目标未碰,那一步不收取消(ssh 的 sftp)照样写完);ssh / local-docker / k8s 写进原 inode、权限位不变,e2b 的 `files.write` 与 adb 的 push 整份写目标、inode / 权限位由对端定(adbd 不保,与 7.138.x 同形);不是门、不是凭据。Android 共享存储(`/sdcard` 一类:权限位由挂载派生、不认 chmod)上 adb 的写按 sdcardfs / MediaProvider FUSE 的权限语义**推断**每一次都走这里(未上真机,真机读数候 test;结构性,运维修不掉;工作区放在 `/data/local/tmp` 一类认权限位的目录就不走)。计数非零 = 这台目标机的这个目录上私有目录收不成私有(文件系统不认权限位 / 缺省 ACL 掩码收不下来 / 缺 `stat`),写在走非原子的退路,去看那个目录。detail = `<目标路径>: <准备脚本写的原因句>`。";
+    };
 };
 /** 词表键推导的闭集类型——未登记的 tag 传不进 {@link recordFailOpen}(编译期拒)。 */
 export type FailOpenTag = keyof typeof FAIL_OPEN_TAGS;

package/dist/observability/fail-open.js

@@ -68,6 +68,10 @@ export const FAIL_OPEN_TAGS = {
         cls: "P-DEBT",
         note: "件6(#43 案 [4281]):`FileRunStore.hydrate()` 的 `readdirSync(runs/)` 失败 ⇒ 引擎以**空账**起动。旧形是空 catch + return:data root 不可读(权限/挂载丢失/路径被换走)时零告警,此后每一次 getRun 恒 miss —— 而「恒 miss」正是 #43 现场看到的形,一次环境故障被伪装成「本来就没有这条 run」。方向问题在于吞掉之后被读成的是「证不出有行 ⇒ 没有行」,两句话不等价。**缺省不拒启是刻意保留的行为**,所以这条留作债:响亮化(error 级启动日志带 runs 绝对路径+异常文案)+ 本计数,让它在遥测里显形而不是只活在一行日志里。⚠️ 2026-08-29(S-46 件B)起终局格已兑现:部署可用 `RUN_STORE_STRICT_HYDRATE=on` 把这一格换成 **fail-closed 启动门**(拒启,遗言同样带绝对路径+异常文案);本计数因此只在**缺省 off** 档上产生 —— 读遥测时别把「计数为零」直接读成「没有部署踩到这条路」,也可能是它们开了拒启门、根本起不来。",
     },
+    "server.run-store.file-active-claims-unreadable": {
+        cls: "P-DEBT",
+        note: "`FileRunStore.hydrate()` 的第二处 `readdirSync(runs/active/)`(claim 平面 = 单活索引)失败,且 `RUN_STORE_STRICT_HYDRATE` 关(缺省)⇒ 服务照常起动、单活索引为**空**。放行的后果两条,都不报错:① 已有 run 行仍可读(`GET /v1/runs/:id` 照常答),但此后对这些会话的审批决定在请求里同步跑完、却找不到要更新的 run 行 —— run 行停在决前的 `suspended`;② 读单活索引的各处读到「没人占用」—— `getActiveTaskId` 恒答空,例如会话同步推送前的「会话有在飞 run」检查(与 `server.run-store.file-hydrate-unreadable` 同一句错话:「证不出有占用 ⇒ 没有占用」,只是换了一个盘面);新提交不读这张索引,claim 文件完好时仍按盘上的 claim 裁定,不受影响。同一条债的另一个盘面:缺省不拒启是刻意保留的行为,所以留作 P-DEBT —— error 级启动日志(`file_run_store_active_claims_unreadable`,带 `runs/active/` 绝对路径)早已在,本计数补的是遥测轴(此前 `runs/` 臂有计数、这一臂没有)。`RUN_STORE_STRICT_HYDRATE=on` 把这一格换成 fail-closed 启动门,本计数因此只在缺省 off 档的真放行时产生(拒启那一形不记)—— 读遥测时「计数为零」也可能是部署开了拒启门、根本起不来。",
+    },
     "server.fork-routing.placed-probe-host-error": {
         cls: "F",
         note: "#292 placement 半场:hostPlacedProbe 对 host 店的 requireExisting 探针失败且**不是 not_found**(host 读故障)时折叠为 absent —— 路由回旧规则(claim-create 会在 transient 建新会话)。放行的是「host 暂不可达时 transient 腿保持独立可用」;最坏后果=故障窗内对一个真 placed id 铸出 transient 影子(host 恢复后双身,requireExisting 冷探针会重新指回 host 真身)。not_found 是常态路径不计数;只有真故障臂进本计数。",
@@ -509,6 +513,14 @@ export const FAIL_OPEN_TAGS = {
         cls: "P-DEBT",
         note: "S-163(`config-dir-trust.ts` `judgeWin32`,本地配置源 `config.d` 读之前的目录信任判官在 win32 上的那一半):Node 在 win32 上 `uid` 恒 0、模式位是只读属性的投影 ⇒ 「属主 ∈ {本服务用户, root, CONFIG_LOCAL_OWNER_UID}」与「不得组 / 他人可写」两判不可做;结构判(常规文件 / 16 MiB 上界 / 链接成环)照做。每一次读照常进行(起服一次 + 每拍一次)记一次。放行的最坏后果 = 一台多用户 Windows 机器上,别的本机用户若能写这台服务的 `config.d`(缺省的用户目录 ACL 不允许),改一份 `mcp.json` 就能让本服务以它的身份起命令 —— 与 7.132.x 逐字同。照 POSIX 拒启会让每个 Windows 本机引擎(含 cli 起的)升级即起不来,而让 cli 替用户设豁免键是中间层替部署者设安全旋钮。收口 = 有了 ACL 判据或一次裁定(改 R 或改拒启)那一版,本 tag 删或改类。detail = `config.d=<物理路径>`。",
     },
+    "server.remote-write.staging-dir-left": {
+        cls: "F",
+        note: "远端五条车道的写(`plugins/remote-shell.ts` 的暂存编排):准备 / 提交脚本删一只私有暂存目录(`.<名>.stage-<十六进制>/`,生来 0700;只删这次写放进去的 `data` 与这只空目录,从不递归删)没删掉、在 stdout 写一条记录点名 —— 五处:`mv` 已把暂存件换到目标上之后删当前那只;跟一跳到别的目录重新暂存成功之后删原来那只;重新暂存却没用上(收紧不成 / 拷不成)的那一只;就地拷入 / 追加时删暂存名失败、或写完关掉 fd 后删私有目录失败(有的文件系统为仍打开着的文件留隐藏项:NFS / libfuse / SMB);准备时收不成私有 / 里面已有 `data` 的那一只。目录里多出了不是这次写放进去的东西(同一身份或 root 的别的进程往里写过 / 收紧之前别人放进来的)、目录被换成了符号链接、或文件系统拒删。写照它自己的结局答(提交已成 ⇒ 成功:答失败会让调用方以为目标没变),残留只在这里留痕。放行的最坏后果 = 目标(或链接所指)目录里多一只隐藏目录(空的,或装着别人放进去的东西;重新暂存没用上的那只可能装着这次写的半份新内容),只有写入方进得去;不是门、不是凭据、不碰目标内容。计数非零 = 那台目标机上有东西在往别人的暂存目录里写,或删不动,去看那只目录。detail = 残留目录的路径(一次写最多两只,逐只计)。",
+    },
+    "server.remote-write.stage-seal-fallback": {
+        cls: "F",
+        note: "远端五条车道的写(`plugins/remote-shell.ts` 的暂存编排):准备脚本把刚建的私有暂存目录收成 0700 并读回核实(`chmod 700` 退出 0 ∧ `stat` 读回的模式低三位恰是 700 ∧ 属主 = 本身份),任一步不成 —— `chmod` 被文件系统 / 内核拒;退出 0 却没生效(不认权限位的文件系统);父目录带缺省 ACL 而掩码收不下来;目标机上没有 `stat` —— 准备退出 4、这次写**不暂存**,两只文件面、五条腿一律改为直接写目标(与「目标目录不收新名字」同一条回落;能追加写的腿直接追加,e2b / adb 的追加 = 读旧 + 拼 + 整份写目标 —— adb 的这一形就是 7.138.x 的追加,push 没有追加写)。修前这一步是 `chmod 700 … || :`:加固失败照样放行上传,字节落在一只别的身份可能读得到的目录里(P 轴 fail-open),那一臂已删,字节从不进一只没核成私有的目录。放行的最坏后果 = 这一次写失去「整旧或整新」(非原子:中途断 / 取消 ⇒ 目标可能只写了一半,整份写目标的 e2b / adb 上可能没了或只剩半份;写目标那一步因取消中断答 `unknown`,那一步开始之前取消答 `aborted`、目标未碰,那一步不收取消(ssh 的 sftp)照样写完);ssh / local-docker / k8s 写进原 inode、权限位不变,e2b 的 `files.write` 与 adb 的 push 整份写目标、inode / 权限位由对端定(adbd 不保,与 7.138.x 同形);不是门、不是凭据。Android 共享存储(`/sdcard` 一类:权限位由挂载派生、不认 chmod)上 adb 的写按 sdcardfs / MediaProvider FUSE 的权限语义**推断**每一次都走这里(未上真机,真机读数候 test;结构性,运维修不掉;工作区放在 `/data/local/tmp` 一类认权限位的目录就不走)。计数非零 = 这台目标机的这个目录上私有目录收不成私有(文件系统不认权限位 / 缺省 ACL 掩码收不下来 / 缺 `stat`),写在走非原子的退路,去看那个目录。detail = `<目标路径>: <准备脚本写的原因句>`。",
+    },
 };
 export function failOpenTagForDroppedFrame(frameType) {
     switch (frameType) {

package/dist/observability/run-terminal.js

@@ -593,7 +593,6 @@ const STATS_KEY_TREATMENT = {
     humanReview: "human-review",
 };
 const STATS_MECHANISMS_TREATMENT = {
-    finalVerifyInjected: "verbatim",
     finalVerifyInjections: "verbatim",
     attachmentsInjected: "verbatim",
     approachNoticesSent: "verbatim",

package/dist/orchestration/workflow-notify-journal.js

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { AppendLog, ensureDir } from "@sema-agent/core";
+import { AppendLog, REDACTION_MARKS, ensureDir } from "@sema-agent/core";
 import { buildFleetWorkflowRow } from "../fleet/fleet-bus.js";
 import { isTerminalWorkflowRowStatus, seedTerminalWorkflowRow } from "../fleet/fleet-terminal-window.js";
 import { buildParkSessionRows } from "./workflow-agent-session-index.js";
@@ -26,11 +26,11 @@ export function recoverySummary(status, error) {
         return "workflow completed";
     const base = error ? `workflow failed: ${error}` : "workflow failed";
     const redacted = base
-        .replace(/https?:\/\/[^\s"'`]+/gi, "[redacted-url]")
+        .replace(/https?:\/\/[^\s"'`]+/gi, REDACTION_MARKS.url)
         .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "[redacted-token]")
         .replace(/\b(?:api[_-]?key|secret|token|password|authorization)\b\s*[:=]\s*"?[^\s"',}]+/gi, "[redacted-secret]")
-        .replace(/(?:\/[A-Za-z0-9_.-]+){2,}/g, "[redacted-path]")
-        .replace(/(?:[A-Za-z]:)?(?:\\{1,2}[A-Za-z0-9_.$-]+){2,}/g, "[redacted-path]");
+        .replace(/(?:\/[A-Za-z0-9_.-]+){2,}/g, REDACTION_MARKS.path)
+        .replace(/(?:[A-Za-z]:)?(?:\\{1,2}[A-Za-z0-9_.$-]+){2,}/g, REDACTION_MARKS.path);
     return redacted.length > SUMMARY_MAX ? `${redacted.slice(0, SUMMARY_MAX)}…[+${redacted.length - SUMMARY_MAX} chars]` : redacted;
 }
 export class WorkflowNotifyGate {

package/dist/org-memory-admission.d.ts

@@ -12,8 +12,9 @@
  * core 侧契约(RunnerDeps.memoryScopeAdmission,core types.d.ts):resolver 返回 {ok:false} ⇒ core 铸终局码
  * memory.admission_denied;resolver throw 一个带 `retryAfterMs`(ms)属性的 Error ⇒ core 铸瞬时码
  * memory.admission_required 并透传 retryAfterMs;{ok:true}.scopes 只能 ⊆ requested(多给 = resolver fault
- * 会被 core 整拒)。core 只在「存在 request-origin org scope 且 principal 缺席」时自己先拒——本模块仍防御
- * `principal === undefined` 这一支(不能信任「core 一定先拒过」这件事)。
+ * 会被 core 整拒)。「谁在问」只有引擎一处读法:入参按调用方在不在场分两形,无调用方那一形只装部署来源的 scope
+ * (请求来源的 scope 没有调用方 ⇒ 引擎在自己的门上先拒,不问本解析器)—— 本模块按这一判别式分支,不另判一次缺席;
+ * 引擎型不可达的那一组合(无调用方 ∧ 请求来源 scope)若仍到了这里 ⇒ 抛,不放行。
  */
 import type { MemoryScopeAdmission } from "@sema-agent/core";
 /**
@@ -72,7 +73,7 @@ export interface MemoryScopeAdmissionOptions {
     /** "audit": 判决照算但从不真拒——会拒的结果（终局 ok:false 或瞬时 throw）一律换成全额放行 + 观测记录
      *  would-deny；真通过的判决（含 write 收窄为 null）照常返回。"enforce": 判决即结果。 */
     mode: "audit" | "enforce";
-    /** 观测 hook。outcome ∈ "ok" | "denied" | "principal_missing" | "directory_absent" | "directory_stale" |
+    /** 观测 hook。outcome ∈ "ok" | "denied" | "directory_absent" | "directory_stale" |
      *  "directory_malformed"。audit 模式下的 would-deny 也走这里，`details.audited === true`。hook 本身绝不
      *  允许打断准入判决——一律吞掉它可能抛出的异常。 */
     onOutcome?: (outcome: string, details?: Record<string, unknown>) => void;

package/dist/org-memory-admission.js

@@ -164,8 +164,9 @@ export function createMemoryScopeAdmission(directory, opts) {
         catch {
         }
     };
-    return async ({ principal, requested, requestedWriteScope }) => {
-        const attributed = (details) => principal === undefined ? details : { principal, ...details };
+    return async (input) => {
+        const { requested, requestedWriteScope } = input;
+        const attributed = (details) => input.principal === undefined ? details : { principal: input.principal, ...details };
         const requestOriginRequested = requested.filter((r) => r.origin === "request");
         const writeIsRequestOrigin = requestedWriteScope?.origin === "request";
         const hasRequestOrigin = requestOriginRequested.length > 0 || writeIsRequestOrigin;
@@ -175,10 +176,9 @@ export function createMemoryScopeAdmission(directory, opts) {
         async function decide() {
             if (!hasRequestOrigin)
                 return { kind: "admit", verdict: admitFull() };
-            if (principal === undefined) {
-                return { kind: "deny", reason: "principal absent", outcome: "principal_missing" };
-            }
-            const lookup = await directory.lookup(principal);
+            if (input.principal === undefined)
+                throw new Error("org memory admission was asked with no caller yet holds a request-origin scope — the engine's caller-less arm carries deployment-origin scopes only, so this input is an engine contract break and is refused, never admitted");
+            const lookup = await directory.lookup(input.principal);
             if (lookup.kind === "unavailable") {
                 const outcome = lookup.reason === "stale_generation" ? "directory_stale" : lookup.reason === "malformed" ? "directory_malformed" : "directory_absent";
                 return { kind: "unavailable", retryAfterMs: lookup.retryAfterMs, outcome, lookupReason: lookup.reason, details: { reason: lookup.reason } };

package/dist/parked-decide.d.ts

@@ -15,8 +15,15 @@ import type { ParkedReviveSurfaceFactory } from "./parked-revive-surface.js";
 import type { RebuiltInheritedGate } from "./boot/parked-revive-gate.js";
 import { type WorkflowRunParkKey, type WorkflowAgentSessionIndex } from "./orchestration/workflow-agent-session-index.js";
 import type { WorkflowParkDecisionStore, WorkflowParkOutcome } from "./orchestration/workflow-park-decision.js";
-import { type HeadRead } from "./session-incarnation.js";
+import type { SessionFace } from "./session-incarnation.js";
+import { type ExecutionCommitDeps, type RootedExecutionContext } from "./http/execution-context.js";
 import type { GateIdentity } from "./checkpoint-identity.js";
+/**
+ * 本腿的**装配前提**(`createHttpServer` 起服拒的拒句;规则见 {@link ParkedDecideDeps} 的 `execution`):接了本腿(`parkedReviveSurface` 在场)的部署,
+ * 会话店必须带执行席 —— 认领之后对根会话住客的唯一判官是执行席上的写口,无席 ⇒ 认领之后没有任何判官(安全轴上不留静默放开的臂,所以拒启,
+ * 不留「无席时照旧两读」的臂)。
+ */
+export declare const PARKED_REVIVE_EXECUTION_SEAT_REQUIRED = "the parked-agent revive leg (parkedReviveSurface) needs a session store with an execution placement seat (sessionStorage.executionPlacement) \u2014 after the claim, the root session's occupant is judged only by the write on that seat; every built-in session store carries one (the MySQL-protocol and PostgreSQL stores and the local store, i.e. the session store a StoreBackend hands out; the caching and fork-routing wrappers forward it), and an in-memory test or embedding passes InMemoryExecutionPlacementSeat; refusing to start rather than revive parked agents with nobody judging the root session's occupant after the claim";
 export interface ParkedAgentMatch {
     handle: string;
     row: BackgroundAgentRecord;
@@ -151,14 +158,6 @@ export interface ParkedDecideDeps {
      *  checkpointStore 同实例,[ref] 设计稿 §4),以及与它同出一张列表的继承座 `mountsCallerTool`(一层行才有;属主与全部判据
      *  在 `parked-revive-surface.ts`)。修前是 boot 期的一只裸 Agent 工具、从不交座 ⇒ 7.32.0 起停在继承工具上的 allow 恒 422。 */
     reviveSurface: ParkedReviveSurfaceFactory;
-    /**
-     * [ref]([ref] §4)—— 会话店按 id 读一行的唯一读口(`sessionStorage.headOf`:属主 + 化身 + 叶子一次读;活住客经 `sessionFaceOfHead`
-     * 投影,空化身响亮拒)。**必填**:本腿对根会话读两次 ——
-     * claim 之前一次、claim 成功之后一次 —— 会话不在或两次不是同一位住客 ⇒ 回滚 claim、答既有的 `409 decide.not_parked`;赎回面只在
-     * 属主相等且两次是同一位住客时交继承座。读抛 ⇒ claim 前原样上抛(没有东西要回滚),claim 后先回滚再上抛。
-     * ([ref] 那只可选的 `sessionOwnerOf` 退役:可选 ⇒ 缺席时静默不复核,正是 [ref] 那个窗的形。)
-     */
-    headOf: HeadRead;
     /** revive args 的 `subagent_type` 成员性判定集([ref] Q1 修正:非 roster 成员必须省略,否则
      *  unknown subagent_type 拒;字面比对 general-purpose 在 roster 撞名时会错省)。缺省空集=恒省略。 */
     knownAgentTypes?: ReadonlySet<string>;
@@ -187,7 +186,33 @@ export interface ParkedDecideDeps {
         owner: string | null;
         taskId: string;
         sessionId: string;
+        executionLane: import("./execution-lane-caps.js").ExecutionLane;
     }) => NonNullable<ToolExecuteContext["onAsk"]>;
+    /**
+     * 边界 9 的执行上下文(设计 §3.2;与提交腿 / 续跑家族同一只解析器、同一只写口)—— 本腿对根会话的住客**一读一判**:
+     *  · `resolve` —— **认领之前**按行的根取上下文:解析器那一次行读(执行席:住客 + 格)就是本腿对根会话的**唯一一读**;根行不在 ⇒ `gone`
+     *    (本腿答既有的 `decide.not_parked`);其余拒(mirror / 车道不再服务 / 主体的车道裁定)按续跑家族的折叠律答好交回(`answer`)—— 不认领、不驱动。
+     *    成功形的 `occupant` **必有**:接本腿的部署必须带执行席(无席的会话店交不出这一读;`createHttpServer` 在装配时拒无席形);
+     *  · `commitDeps` —— 认领之后 `commitExecutionContext` 读的部署件:唯一写口按那一读的住客定址写 / 再读(化身 ∧ 属主),这就是认领之后对根住客的
+     *    **唯一一判**(拒 ⇒ 先回滚认领)。写口放行的那一位就是赎回面的根住客见证;写口之后本腿不再读根。
+     * 复活子代的审批席带这只上下文的车道(`approverSeatFor` 的 `executionLane`)。
+     */
+    execution: {
+        resolve: (root: string) => Promise<{
+            readonly ok: true;
+            readonly ctx: RootedExecutionContext & {
+                readonly occupant: SessionFace;
+            };
+        } | {
+            readonly ok: false;
+            readonly gone: true;
+        } | {
+            readonly ok: false;
+            readonly gone: false;
+            readonly answer: ParkedDecideResult;
+        }>;
+        commitDeps: ExecutionCommitDeps;
+    };
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
 export interface ParkedDecideRequest {

package/dist/parked-decide.js

@@ -1,14 +1,15 @@
-import { compareOccupants } from "@sema-agent/core";
 import { readClosedWordSeat } from "./approval-card.js";
 import { routeWorkflowPark } from "./orchestration/workflow-agent-session-index.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { defaultSubagentTailBus } from "./fleet/subagent-tail-bus.js";
 import { backgroundScopesForCheckpointScope, decodeCheckpointScope, ownerOfCheckpointScope } from "./security.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isEngineQuestionRow } from "./approval-content-kind.js";
-import { sessionFaceOfHead } from "./session-incarnation.js";
 import { refusalBody, resumeRefusalFacts } from "./http/refusal-body.js";
 import { backgroundAgentNameOf } from "./background-agent-name.js";
 import { buildSettlementEvidence } from "./gate-settlement.js";
+import { commitExecutionContext } from "./http/execution-context.js";
+import { EXECUTION_PLACEMENT_SEAT_CARRIERS } from "./execution-placement.js";
+export const PARKED_REVIVE_EXECUTION_SEAT_REQUIRED = `the parked-agent revive leg (parkedReviveSurface) needs a session store with an execution placement seat (sessionStorage.executionPlacement) — after the claim, the root session's occupant is judged only by the write on that seat; ${EXECUTION_PLACEMENT_SEAT_CARRIERS}; refusing to start rather than revive parked agents with nobody judging the root session's occupant after the claim`;
 export async function findParkOrigin(sources, cp) {
     if (sources.agentStore !== undefined) {
         let match;
@@ -270,9 +271,10 @@ export async function decideParkedAgent(deps, req, match) {
     if (revivability.kind === "unrevivable")
         return req.decision === "deny" ? voidUnrevivableCard(deps, req, match) : revivability.approveRefusal;
     const root = revivability.root;
-    const faceBefore = sessionFaceOfHead(root, await deps.headOf(root));
-    if (faceBefore === undefined)
-        return sessionGone(match.handle);
+    const resolved = await deps.execution.resolve(root);
+    if (!resolved.ok)
+        return resolved.gone ? sessionGone(match.handle) : resolved.answer;
+    const execution = resolved.ctx;
     const inheritedGate = deps.rebuildInheritedGate ? await deps.rebuildInheritedGate(row, { principal: decodeCheckpointScope(req.scope) }) : undefined;
     const stores = { agentStore: deps.agentStore, checkpointStore: deps.checkpointStore };
     const claim = await deps.registry.claimParkedAgent(stores, match.handle, { scope: row.scope, owner: row.owner });
@@ -312,21 +314,12 @@ export async function decideParkedAgent(deps, req, match) {
         await rollback("claimed_token_moved");
         return gateMoved(match.handle);
     }
-    let faceAfter;
-    try {
-        faceAfter = sessionFaceOfHead(root, await deps.headOf(root));
-    }
-    catch (e) {
-        await rollback("session_face_unreadable");
-        throw e;
-    }
-    if (compareOccupants(faceBefore, faceAfter) !== "same") {
-        await rollback("session_occupant_changed");
-        return sessionGone(match.handle);
-    }
+    const placementRefusal = await commitExecutionContext(deps.execution.commitDeps, { kind: "parked", taskId: match.handle, rollback, goneAnswer: sessionGone(match.handle) }, execution);
+    if (placementRefusal)
+        return placementRefusal;
     let surface;
     try {
-        surface = deps.reviveSurface(row, { principal: decodeCheckpointScope(req.scope), root: { before: faceBefore, after: faceAfter } });
+        surface = deps.reviveSurface(row, { principal: decodeCheckpointScope(req.scope), rootOccupant: execution.occupant });
     }
     catch (e) {
         await rollback("revive_surface_threw");
@@ -350,7 +343,7 @@ export async function decideParkedAgent(deps, req, match) {
         toolCallId: `drv-${ticket.claimId}`,
         ...(surface.mountsCallerTool !== undefined ? { mountsCallerTool: surface.mountsCallerTool } : {}),
         ...(deps.approverSeatFor !== undefined && seatRoot !== undefined
-            ? { onAsk: deps.approverSeatFor({ owner: ownerOfCheckpointScope(req.scope), taskId: match.handle, sessionId: seatRoot }) }
+            ? { onAsk: deps.approverSeatFor({ owner: ownerOfCheckpointScope(req.scope), taskId: match.handle, sessionId: seatRoot, executionLane: execution.lane }) }
             : {}),
         reviveClaim: {
             row: { ...ticket.row, parkClaimId: ticket.claimId },

package/dist/parked-revive-surface.d.ts

@@ -11,12 +11,12 @@
  *    给那个会话的 run 组 `spec.tools` 的同一只工厂、同一个会话分区(任务清单店 `taskListStoreFor(root)` 与领队那一张是同一张;
  *    多租户的 WebFetch 过滤同样生效 ⇒ 子代同样拿不到)。座 = `(t) => tools.includes(t)`(身份判:同名副本不算)。
  *  · **禁**用 boot 期单例填座:那只 bundle 没有会话,它的任务清单是一张私有表 —— 填了座,每个会话 / 租户的复活队友都会共用它。
- *  · **根会话现在还是这张卡的那一位住客**才填座(codex r1 [high] + [ref] 加严):任务清单店只按会话 id 分区,而会话 id 由调用方自选、
- *    删后可被别人(或同一个人)重领 —— 根会话删了(或删了重建)之后赎回一张旧卡,按 id 重解出来的是**下一位住客**的清单。判据两条都要:
- *    ① 根会话的属主与卡的权威 principal 逐字相等;② 赎回腿 claim 前 / 后两次读到的是**同一位住客**(化身逐字相等,
- *    core 的 `compareOccupants` 答 `same`;`unknown` 不算)—— 只比属主比不出「同一个人删了重建」。任一条不成立 / 读数缺席 ⇒ 不交座
- *    (fail-closed:子代不继承,继承工具上的 allow 回 422、审批待决,deny 照结)。赎回腿自己在两次读不一致时整条拒(`409 decide.not_parked`),
- *    这里的第 ② 条是同一条事实在交座这一处的判据(规则只写在这里,腿只负责读两次)。根删除时把子孙的 parked 卡一并作废 = [ref] 件 B
+ *  · **根会话属于这张卡的租户**才填座(codex r1 [high]):任务清单店只按会话 id 分区,而会话 id 由调用方自选、删后可被别人(或同一个人)重领 ——
+ *    根会话删了(或删了重建)之后赎回一张旧卡,按 id 重解出来的是**下一位住客**的清单。两件事,两处判,各判一次:
+ *    ① **住客判**(根会话现在还是这次决定判过的那一位:化身 ∧ 属主)只在赎回腿认领之后的唯一写口(执行放置,按解析器那一读的住客定址)——
+ *       不是那一位 ⇒ 赎回腿整条拒(`409 decide.not_parked`),走不到这里;只比属主比不出「同一个人删了重建」,所以住客判比化身;
+ *    ② **租户判**在这里:写口放行的那一位(`rootOccupant`)的属主与卡的权威 principal 逐字相等(匿名会话 `null` ≡ 无 principal)。
+ *    不成立 ⇒ 不交座(fail-closed:子代不继承,继承工具上的 allow 回 422、审批待决,deny 照结)。根删除时把子孙的 parked 卡一并作废 = [ref] 件 B
  *    (`boot/session-faces.ts` 的删除协调器)。
  *  · 只对**一层**行填座(`rootSessionId` 在场且 = `parentSessionId`:派它的 run 就是根会话的 run,列表正是那个 run 的挂载)。更深的行
  *    (孙代:派它的是一个子代,它的挂载是继承裁剪后的子集,行上读不出来)不填 —— 无座 = core 的 fail-closed 臂;
@@ -25,9 +25,9 @@
  * 座只判 bundle 实例的成员性,继承面是 `[...web, ...scaffolds]`,那两项差异不改变谁在面内。
  *
  * **属主来源([ref] / [ref])与交座是两个独立判据**:赎回工具的停驻挂点(复活的子代再要审批时停驻,`plugins/session-store.ts`)按委派继承律定宿主行属主,
- * 律要的是**委派树根的见证**:根 id(行上本来就带 `rootSessionId`)+ 判断那一刻读到的根行住客(赎回腿 claim 前后两读的那一位 —— 两读不是同一位时赎回腿整条拒,
- * 走不到这里;读数缺席 ⇒ 见证不带住客,挂点那一刻根行在 ⇒ 停驻否决)。所以**每一行**都交出它({@link ScenarioContext} 的 `delegationRoot`):交座的一层行以
- * `{ sessionId: root, delegationRoot }` 重解,不交座的行(更深的行、根住客已变的一层行、读数缺席)以 `{ delegationRoot }` 重解 —— 只喂停驻挂点,不挂任何会话级设施、
+ * 律要的是**委派树根的见证**:根 id(行上本来就带 `rootSessionId`)+ 判断那一刻的根行住客 = 写口放行的那一位(赎回腿解析器那一读;不是那一位时
+ * 写口整条拒,走不到这里)—— 见证恒带住客。所以**每一行**都交出它({@link ScenarioContext} 的 `delegationRoot`):交座的一层行以
+ * `{ sessionId: root, delegationRoot }` 重解,不交座的行(更深的行、根属主不是卡的租户的一层行)以 `{ delegationRoot }` 重解 —— 只喂停驻挂点,不挂任何会话级设施、
  * 不带 principal,交座判据(上面三条)一个字不动。行上没有根 ⇒ boot 期那只裸 Agent(没有根可交 ⇒ 律给哨兵)。挂点那一刻根行已不在 ⇒ 律给哨兵;在而不是见证的那一位
  * (批准之后删了、同 id 被重新登记)⇒ 停驻否决 —— 两件都在挂点那一侧判,与这里无关。
  */
@@ -41,15 +41,12 @@ export interface ParkedReviveSurface {
     readonly mountsCallerTool?: (tool: ToolSpec) => boolean;
 }
 /**
- * 按行解析赎回面的入参身份:`principal` = 权威 principal(取 checkpoint 的 scope 列,不取行上有损的 `row.scope`);`root` = 赎回腿对行的
- * 根会话读到的两次会话面(claim 之前 / 之后;属主 `null` = 匿名会话)。缺席 = 没有读数 ⇒ 不交座。
+ * 按行解析赎回面的入参身份:`principal` = 权威 principal(取 checkpoint 的 scope 列,不取行上有损的 `row.scope`);`rootOccupant` = 写口放行的那一位
+ * 根会话住客(赎回腿认领之前解析器那一次行读;属主 `null` = 匿名会话)—— 型上恒在:接赎回腿的部署必须带执行席。
  */
 export interface ParkedReviveSurfaceIdentity {
     readonly principal: string | undefined;
-    readonly root?: {
-        readonly before: SessionFace;
-        readonly after: SessionFace;
-    };
+    readonly rootOccupant: SessionFace;
 }
 /** 按行解析赎回面。 */
 export type ParkedReviveSurfaceFactory = (row: BackgroundAgentRecord, identity: ParkedReviveSurfaceIdentity) => ParkedReviveSurface;

package/dist/parked-revive-surface.js

@@ -1,4 +1,4 @@
-import { DEFAULT_SUBAGENT_TOOL_NAME, compareOccupants } from "@sema-agent/core";
+import { DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
 const agentOf = (tools) => tools.find((t) => t.name === DEFAULT_SUBAGENT_TOOL_NAME);
 export function createParkedReviveSurface(defaultScenario) {
     const bootTool = agentOf(defaultScenario({}).tools);
@@ -9,7 +9,7 @@ export function createParkedReviveSurface(defaultScenario) {
         if (root === undefined)
             return { reviveTool: bootTool };
         const seated = holdsSeat(row.parentSessionId === root, identity);
-        const delegationRoot = { sessionId: root, incarnation: identity.root?.after.incarnation ?? null };
+        const delegationRoot = { sessionId: root, incarnation: identity.rootOccupant.incarnation };
         const tools = (seated ? defaultScenario({}, identity.principal, { sessionId: root, delegationRoot }) : defaultScenario({}, undefined, { delegationRoot })).tools;
         const reviveTool = agentOf(tools);
         if (reviveTool === undefined)
@@ -18,9 +18,6 @@ export function createParkedReviveSurface(defaultScenario) {
     };
 }
 function holdsSeat(oneLevel, identity) {
-    const face = identity.root;
-    if (!oneLevel || face === undefined || compareOccupants(face.before, face.after) !== "same")
-        return false;
-    return (face.before.owner ?? undefined) === identity.principal && (face.after.owner ?? undefined) === identity.principal;
+    return oneLevel && (identity.rootOccupant.owner ?? undefined) === identity.principal;
 }
 //# sourceMappingURL=parked-revive-surface.js.map

package/dist/peer-seat.d.ts

@@ -1,4 +1,4 @@
-import type { A2aServerSpec, McpServerSpec, PeerAnswer, PeerQuestion, PeerSeatTarget } from "@sema-agent/core";
+import type { A2aServerSpec, McpServerSpec, PeerAnswer, PeerQuestion, PeerSeat, PeerSeatTarget } from "@sema-agent/core";
 import { type Logger } from "./observability/logger.js";
 import { type SafeText } from "./trace/exit-seat.js";
 type StdioArm = Extract<McpServerSpec["transport"], {
@@ -95,16 +95,22 @@ export interface PeerLease {
     /** Stop holding. Entries no other holder holds are dropped now. A second call does nothing. */
     release(): void;
 }
-/** What the engine asks: the pieces for one send. The seat holds nothing itself — an entry's holders are host leases only. */
-export interface PeerDeskSeat {
-    /** The pieces for one send, or a throw (refused: logged as one `peer_seat_refused` row naming protocol, peer and reason only). */
-    answer(question: PeerQuestion): Promise<PeerAnswer>;
-}
-/** Live entries and the host leases holding them, summed across entries — the registry's whole observable state. */
+/** Live entries and their holders — host leases and engine holds — summed across entries: the registry's whole observable state. */
 export interface PeerDeskSize {
     readonly entries: number;
     readonly holders: number;
 }
+/**
+ * The engine's seat as the desk is it (`RunnerDeps.peerSeat`, the probe's and the panels' `peerSeat`): `answer` the pieces for one send, or a
+ * throw (refused: logged as one `peer_seat_refused` row naming protocol, peer and reason only) — it reads no signal (the desk does no IO);
+ * `hold` / `release` one engine holder of a reference this desk minted. Every hold the desk cannot count throws — a reference this desk did not
+ * mint (any kind but `handle`), a handle whose entry is gone — and so does a release with no counted hold: the engine reads a hold that returns
+ * as held, so a quiet return would be a hold nobody keeps (security axis, fail-closed). The engine reports each throw once as `peer-seat-hold`;
+ * a refused hold holds nothing and gets no release, a refused release changes nothing.
+ */
+export interface PeerDeskSeat extends PeerSeat {
+    answer(question: PeerQuestion, signal?: AbortSignal): Promise<PeerAnswer>;
+}
 export interface PeerDesk {
     readonly seat: PeerDeskSeat;
     /**

package/dist/peer-seat.js

@@ -104,7 +104,7 @@ export function createPeerDesk(opts = {}) {
         return entry;
     };
     const dropIfUnheld = (id, entry) => {
-        if (entry.hosts.size === 0)
+        if (entry.hosts.size === 0 && entry.engineHolds === 0)
             table.delete(id);
     };
     const liveState = (lease) => {
@@ -151,7 +151,41 @@ export function createPeerDesk(opts = {}) {
                 return { kind: "carry", env: entry.pieces };
         }
     };
+    const handleIdOf = (ref) => {
+        switch (ref.kind) {
+            case "handle":
+                return ref.id;
+            case "env":
+            case "vault":
+            case "assertion":
+                return undefined;
+            default: {
+                const unknownKind = ref;
+                void unknownKind;
+                return undefined;
+            }
+        }
+    };
     const seat = Object.freeze({
+        hold: (ref) => {
+            const id = handleIdOf(ref);
+            if (id === undefined)
+                throw new Error("peer desk: hold of a reference this desk did not mint — not held");
+            const entry = table.get(id);
+            if (entry === undefined)
+                throw new Error("peer desk: hold of a handle whose entry is gone — not held (a hold never revives an entry)");
+            entry.engineHolds += 1;
+        },
+        release: (ref) => {
+            const id = handleIdOf(ref);
+            if (id === undefined)
+                throw new Error("peer desk: release of a reference this desk did not mint — nothing released");
+            const entry = table.get(id);
+            if (entry === undefined || entry.engineHolds === 0)
+                throw new Error("peer desk: release of a handle with no counted engine hold — nothing released");
+            entry.engineHolds -= 1;
+            dropIfUnheld(id, entry);
+        },
         answer: async (question) => {
             const target = question.peer;
             const ref = target.credentials;
@@ -193,7 +227,7 @@ export function createPeerDesk(opts = {}) {
             const id = mintId(canonical);
             const known = table.get(id);
             if (known === undefined) {
-                table.set(id, { binding, lane, pieces, hosts: new Set([holder.id]) });
+                table.set(id, { binding, lane, pieces, hosts: new Set([holder.id]), engineHolds: 0 });
             }
             else if (canonicalOf(known.binding, known.lane, known.pieces) !== canonical) {
                 throw new PeerDeskError("peer_binding_conflict", "peer desk: two different declarations were minted one id; the registered one stands");
@@ -212,7 +246,7 @@ export function createPeerDesk(opts = {}) {
         size: () => {
             let holders = 0;
             for (const entry of table.values())
-                holders += entry.hosts.size;
+                holders += entry.hosts.size + entry.engineHolds;
             return { entries: table.size, holders };
         },
     });

package/dist/plugins/adoption-log-sql.js

@@ -86,8 +86,8 @@ export class SqlAdoptionLogStore {
     constructor(db) {
         this.db = db;
     }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
+    q(mysql, pg) {
+        return this.db.dialect === "mysql" ? mysql : pg;
     }
     get reader() {
         return this.db;
@@ -191,7 +191,7 @@ export class SqlAdoptionLogStore {
         try {
             lockName = qualifyAdoptionLockName(await this.resolveLockKeyspace(conn), name);
             for (let i = 0; i < attempts && !held; i += 1) {
-                const res = await conn.query(this.q("SELECT GET_LOCK(?, 0) AS got", "SELECT pg_try_advisory_lock($1, $2) AS got"), this.db.dialect === "tidb" ? [lockName] : [PG_ADOPTION_LOCK_CLASS, pgLockObjectKey(lockName)]);
+                const res = await conn.query(this.q("SELECT GET_LOCK(?, 0) AS got", "SELECT pg_try_advisory_lock($1, $2) AS got"), this.db.dialect === "mysql" ? [lockName] : [PG_ADOPTION_LOCK_CLASS, pgLockObjectKey(lockName)]);
                 const got = res.rows[0]?.got;
                 held = got === 1 || got === true || got === "1";
                 if (!held)
@@ -204,7 +204,7 @@ export class SqlAdoptionLogStore {
         finally {
             if (held) {
                 try {
-                    await conn.query(this.q("SELECT RELEASE_LOCK(?) AS released", "SELECT pg_advisory_unlock($1, $2) AS released"), this.db.dialect === "tidb" ? [lockName] : [PG_ADOPTION_LOCK_CLASS, pgLockObjectKey(lockName)]);
+                    await conn.query(this.q("SELECT RELEASE_LOCK(?) AS released", "SELECT pg_advisory_unlock($1, $2) AS released"), this.db.dialect === "mysql" ? [lockName] : [PG_ADOPTION_LOCK_CLASS, pgLockObjectKey(lockName)]);
                 }
                 catch (releaseErr) {
                     console.warn("[adoption-log] releasing the adoption arc lock failed (it auto-frees when the connection closes):", releaseErr);

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,3 +1,4 @@
+import { type ExecutionLane } from "../execution-lane-caps.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { SettleCause } from "../approval-deny-reasons.js";
 import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
@@ -209,6 +210,12 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     };
     /** 释放追加 fd(`LocalBackend.close` → 优雅重启重开)。不包 try/catch 的理由同
      *  {@link FileApprovalNonceStore.dispose}:core 的 `AppendLog.close()` 自己就是全函数。 */
+    /**
+     * 执行放置切换 ④b 的 local 腿(一次性迁移登记表 M32;`LocalBackend.runOneTimeMigrations` 在任何读者之前调):升级前写下的问(日志 `ensureAsk` 记录行 /
+     * 压实快照行没有 `executionLane`)记成本部署车道表的唯一项,然后**一次压实**把整本账重写成带车道的快照(压实 = 既有整本原子重写)。
+     * 没有缺车道的行 ⇒ 零写。车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸),一个字节没写。
+     */
+    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (pending: number) => never): number;
     dispose(): void;
 }
 export {};

package/dist/plugins/approval-ask-store-file.js

@@ -1,4 +1,5 @@
 import { closeSync, copyFileSync, openSync, readSync, statSync, existsSync } from "node:fs";
+import { isExecutionLane } from "../execution-lane-caps.js";
 import { join } from "node:path";
 import { AppendLog, atomicWriteFile, ensureDir } from "@sema-agent/core";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
@@ -295,6 +296,16 @@ export class FileApprovalAskStore {
     replayStats() {
         return { rejected: this.replayRejectedCount, corruptLines: this.corruptLineCount, records: this.records };
     }
+    backfillExecutionLanes(lanes, refuse) {
+        const pending = this.core.exportRows().asks.filter((r) => !isExecutionLane(String(r.executionLane ?? ""))).length;
+        if (pending === 0)
+            return 0;
+        if (lanes.length !== 1)
+            refuse(pending);
+        const filled = this.core.fillMissingExecutionLanes(lanes[0]);
+        this.compact();
+        return filled;
+    }
     dispose() {
         this.log?.close();
         this.log = undefined;

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -29,6 +29,7 @@
  *  - resolveProvisional 故意不经 canAskTransition(同 SQL twin 头注：这是版本化补偿的例外通道）。
  */
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
 import type { AskCallCoordinate, AskDecision, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, EnsureAskResult, DecideResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /**
  * [ref] 的 `updatedInput` **入店编码**——两 twin 共用的那一只(本函数是唯一真源)。
@@ -72,6 +73,11 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
      * 两种可变性)。
      */
     exportRows(): ApprovalAskRowsSnapshot;
+    /**
+     * 执行放置切换 ④b 的 local 腿(File 形的内核口;`FileApprovalAskStore.backfillExecutionLanes` 调):出处车道还没记下的行(升级前写下的日志 / 快照行
+     * 装回后这一格缺席)记成 `lane`(一元车道表的唯一项 —— 调用方判过)。返回改了的行数;只碰缺这一格的行。
+     */
+    fillMissingExecutionLanes(lane: ExecutionLane): number;
     /** [ref]:一行的**同步**点读(拷贝;纯读,零判定)—— File 形在写口的同步前缀里用它(见类顶注)。 */
     peekAsk(askId: string): AskRow | null;
     /** [ref]:把快照里的行**原样**装回两张 Map(同键覆盖)。零谓词、零状态机 —— 它不是一条转移,是重放

package/dist/plugins/approval-ask-store-memory.js

@@ -1,4 +1,5 @@
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
+import { isExecutionLane } from "../execution-lane-caps.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
 import { askRowCarriesOwner, askRowOnCall, assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
@@ -41,6 +42,16 @@ export class InMemoryApprovalAskStore {
     exportRows() {
         return { asks: [...this.asks.values()].map((r) => ({ ...r })), batches: [...this.batches.values()].map((b) => ({ ...b })) };
     }
+    fillMissingExecutionLanes(lane) {
+        let filled = 0;
+        for (const [askId, row] of this.asks) {
+            if (isExecutionLane(String(row.executionLane ?? "")))
+                continue;
+            this.asks.set(askId, { ...row, executionLane: lane });
+            filled += 1;
+        }
+        return filled;
+    }
     peekAsk(askId) {
         const row = this.asks.get(askId);
         return row ? { ...row } : null;
@@ -74,6 +85,7 @@ export class InMemoryApprovalAskStore {
             sourceTaskId: row.sourceTaskId,
             sessionId: row.sessionId,
             owner: row.owner ?? null,
+            executionLane: row.executionLane,
             batchId: row.batchId,
             toolCallId: row.toolCallId,
             legKey: row.legKey,