@sema-agent/server 7.139.0 → 7.141.0

package/dist/http/routes/run-permission-mode.d.ts

@@ -0,0 +1,75 @@
+/**
+ * 在飞 run 的**权限模式切档口** —— 引擎动词 `TaskStream.setPermissionMode(word)` 的 wire 面:
+ *
+ *   `POST /v1/runs/:id/permission-mode`  body `{ mode }`(`mode` ∈ 引擎 `PERMISSION_MODES` 闭集)
+ *     → 200 `{ taskId, sessionId, status: "running", permissionMode, admission?, persisted, persistMiss? }`
+ *
+ * 语义 = 引擎的切档:改写这条腿的请求词,部署的折叠(`RuntimeCaps` 拒位 / 分类器席缺席)由引擎重判,**下一次**工具调用按新档仲裁;
+ * 进 `auto` 当场武装分类器,武装失败 ⇒ 引擎回滚(被替换的词照旧)并拒。`permissionMode` 是引擎回执原样(`{ requested?, effective, foldedBy? }`,
+ * 与 `wiring_manifest.permissionMode` 同形):每次都回,动没动都回 —— 壳渲染引擎说的,不渲染它自己发的。
+ *
+ * ── 一条规则:切档口与提交口是同一只受理判官(`permission-mode-admission.ts`)───────────────────────────────
+ * 交给引擎的不是调用方的原词,是受理判官对它的答:本任务 settings 的 kill-switch 折叠(读这条 run 的**存储体**)→ 运维 `AUTONOMY` 入口地板钳
+ * → 托管写围栏拒。提交口在受理时拒过 / 折过的词,切档口同样拒 / 折(两口一张表的钉在 `test/run-permission-mode-admission.test.ts`);
+ * 引擎在根腿上没有这三问的拒位,所以它们必须在这里答。折了 ⇒ 回执旁带 `admission: { requested, admitted, foldedBy }`(present-iff:本判官改了词);
+ * 拒 ⇒ 422 `request.host_posture_refused`(与提交口同码同句)。
+ *
+ * ── 回写:准入的词写回存储体(run 模式词的唯一来源)────────────────────────────────────────────────────────
+ * 续跑腿(停驻后续跑 / 重启后续跑)按存储体顶层 `permissionMode` 重建 spec;不写回 = 下一腿回到切档前的词。写回走**认领栅栏**
+ * (checkpoint 店的 `rewriteCtxWhileClaimed`:只在**接下切档的那条腿**此刻仍持有这条 run 时写,只改既有行)—— 这条 run 终局放掉认领、同会话新 run
+ * 已写下它自己的存储体之后,或这条 run 停驻、续跑的新腿(同一个 taskId 回到 running、认领仍在)已写下它续跑用的体之后,迟到的回写零写,
+ * 不会拿旧腿的体盖掉新腿的。腿身份 = {@link switchLegHolds}(栅栏里问)。同一条腿上的切档在本进程按活流对象串行(引擎受理序 = 落盘序;活流只在本副本)。
+ * 写不进(`persisted:false` + `persistMiss` ∈ {@link PERMISSION_MODE_PERSIST_MISSES})⇒ 本腿的切档照样生效、下一腿读到的是切档前的词:
+ * 一行运维 warn + fail-open 计数(`server.run-permission-mode.write-back-unpersisted`),壳据 `persisted` 判要不要在续跑后重切。
+ *
+ * ── 门(与 steer 同一组)──────────────────────────────────────────────────────────────────────────────
+ * 零模型工作(不进 billable);mutating ⇒ `rateLimited`。属主门与 steer / interrupt 同一组放行臂(行经属主存取器 `readOwnedRun` 取,`owner_or_operator`):
+ * 显式 operator 可切任一租户的 run(监督动作),普通调用方只切自己的(非属主 404 同串,不给存在性 oracle);`?session=` 的受理期断言同族。非 live 四臂一码 409 `steering.not_running`
+ * (停驻 / 终局 / 他副本 / 本副本无活流);坏词 422 `steering.invalid_content`(引擎同码,受理前判)。能力位 `permissionModeWrite`
+ * = 事实 `permissionModeWrite`(持久 run 账面 ∧ checkpoint 店),与两道 501 同一只。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { PermissionMode, PermissionModeReceipt } from "@sema-agent/core";
+import { type FencedRun } from "../../plugins/store-contracts.js";
+import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
+import { type PermissionModeAdmissionFold } from "../../permission-mode-admission.js";
+/** 回写没落定的成因(闭集;wire `persistMiss`):`claim_released` 接下切档的那条腿这一刻已不持有这条 run(终局 / 停驻 / 已由续跑的新腿接手);
+ *  `context_absent` 持有但会话没有存储体行;`store_failed` 店写抛(库抖 / 一行装不下 / 封签失败)。 */
+export declare const PERMISSION_MODE_PERSIST_MISSES: readonly ["claim_released", "context_absent", "store_failed"];
+export type PermissionModePersistMiss = (typeof PERMISSION_MODE_PERSIST_MISSES)[number];
+/**
+ * **接下切档的那条腿此刻是否仍持有这条 run** —— 回写的腿身份,在认领栅栏里问(`rewriteCtxWhileClaimed` 的 `legHolds`,锁住 / 同步段里那一行的 {@link FencedRun})。
+ * 认领与 `running` 只认 taskId,续跑腿让同一个 taskId 停驻之后回到 `running`、认领仍在(ABA);分开两条腿的是:
+ *  · run 行仍在本副本(`runProvenElsewhere` 的反面 —— 别的副本续跑了它,续跑的 CAS 赢点把行上的副本改成它自己);
+ *  · 本副本这条 run 此刻登记的活流仍是接下切档的那一只(本副本上续跑的新腿登记的是另一只流对象;腿收场时按对象身份摘掉自己的)。
+ */
+export declare function switchLegHolds<S extends object>(fenced: FencedRun, thisInstanceId: string | undefined, liveNow: S | undefined, switched: S): boolean;
+/** 本判官改了词时回执旁的那一格(`admission`)。 */
+interface PermissionModeAdmissionNote {
+    readonly requested: PermissionMode;
+    readonly admitted: PermissionMode;
+    readonly foldedBy: PermissionModeAdmissionFold;
+}
+/** 200 体(键集属主:`trace/self-minted-wire.ts` 的 `permissionModeVerbBodyKey` 按它的键 `satisfies`)。`permissionMode` = 引擎回执原样。 */
+export interface PermissionModeVerbReply {
+    readonly taskId: string;
+    readonly sessionId: string;
+    readonly status: "running";
+    readonly permissionMode: PermissionModeReceipt;
+    /** present-iff 受理判官改了词。 */
+    readonly admission?: PermissionModeAdmissionNote;
+    readonly persisted: boolean;
+    /** present-iff `persisted: false`。 */
+    readonly persistMiss?: PermissionModePersistMiss;
+}
+export declare function handlePermissionMode(req: IncomingMessage, res: ServerResponse, match: RouteMatch<RunPermissionModeRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const RUN_PERMISSION_MODE_ROUTES: readonly [{
+    readonly id: "run-permission-mode";
+    readonly pattern: RegExp;
+    readonly label: "/v1/runs/:id/permission-mode";
+    readonly methods: readonly ["POST"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type RunPermissionModeRouteId = RouteIdsOf<typeof RUN_PERMISSION_MODE_ROUTES>;
+export {};
+//# sourceMappingURL=run-permission-mode.d.ts.map

package/dist/http/routes/run-permission-mode.js

@@ -0,0 +1,170 @@
+import { z } from "zod";
+import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
+import { readOwnedRun } from "../owner-access.js";
+import { runNotFoundMessage } from "../route-ctx.js";
+import { assertNever } from "../route-ctx.js";
+import * as facts from "../../capability-facts.js";
+import { PERMISSION_MODE_WORDS, coercePermissionModeStrict, parseTaskSettings } from "../../task-settings.js";
+import { admitPermissionModeWord } from "../../permission-mode-admission.js";
+import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "../resume-ctx-read.js";
+import { sealCheckpointCtx, withPermissionModeRewritten } from "../checkpoint-ctx.js";
+import { serviceVersion } from "../../service-version.js";
+import { recordFailOpen } from "../../observability/fail-open.js";
+export const PERMISSION_MODE_PERSIST_MISSES = ["claim_released", "context_absent", "store_failed"];
+const BodySchema = z.object({ mode: z.string() }).strict();
+const switchChains = new WeakMap();
+function serialOnStream(stream, work) {
+    const prior = switchChains.get(stream) ?? Promise.resolve();
+    const job = prior.then(work, work);
+    switchChains.set(stream, job.catch(() => undefined));
+    return job;
+}
+export function switchLegHolds(fenced, thisInstanceId, liveNow, switched) {
+    return !runProvenElsewhere(fenced, thisInstanceId) && liveNow === switched;
+}
+export async function handlePermissionMode(req, res, match, ctx) {
+    const { deps } = ctx;
+    switch (match.decl.id) {
+        case "run-permission-mode": {
+            if (ctx.helpers.rateLimited(req, res))
+                return;
+            const seat = facts.permissionModeWrite(deps);
+            if (!seat.available) {
+                switch (seat.why) {
+                    case "run_store_absent":
+                        sendError(res, 501, "capability.run_store_required", "changing a running run's permission mode requires a durable run store (DB_BACKEND=mysql|pg|local)");
+                        return;
+                    case "checkpoint_store_absent":
+                        sendError(res, 501, "capability.checkpoint_store_required", "changing a running run's permission mode requires the checkpoint store (DURABLE_APPROVAL): the run's stored request is where its permission mode lives and where the task's own settings are read");
+                        return;
+                    default:
+                        return assertNever(seat.why);
+                }
+            }
+            const { runStore, checkpointStore } = seat;
+            const principal = gatedPrincipal(req, deps.config);
+            if (deps.config.requirePrincipal && principal === undefined) {
+                sendPrincipalRefusal(res, req, deps.config);
+                return;
+            }
+            const taskId = match.params.taskId;
+            const parsed = BodySchema.safeParse((await ctx.helpers.readJson(req)) ?? {});
+            if (!parsed.success) {
+                sendError(res, 400, "request.body_shape", `body must be { mode: ${PERMISSION_MODE_WORDS} } — the permission-mode verb takes no other keys`);
+                return;
+            }
+            const word = coercePermissionModeStrict(parsed.data.mode);
+            if (word === undefined) {
+                sendError(res, 422, "steering.invalid_content", `mode must be one of ${PERMISSION_MODE_WORDS} (got ${JSON.stringify(parsed.data.mode.slice(0, 64))})`);
+                return;
+            }
+            const run = await readOwnedRun(deps.config, runStore, principal, taskId, "owner_or_operator");
+            if (!run) {
+                sendError(res, 404, "not_found.run", runNotFoundMessage(taskId));
+                return;
+            }
+            if (!ctx.helpers.runSessionAcceptOk(req, res, run, "run.permission_mode"))
+                return;
+            const live = ctx.registry.steerableRuns.get(taskId);
+            if (!live) {
+                if (isParkedRunStatus(run.status)) {
+                    sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the permission-mode verb changes a running run; when it resumes, its mode is rebuilt from the run's stored request (a plan review's approval names the mode it continues in)");
+                    return;
+                }
+                if (isTerminalRunStatus(run.status)) {
+                    sendError(res, 409, "steering.not_running", "run already ended — the permission-mode verb changes a running run; submit the next turn of this session with the permissionMode you want");
+                    return;
+                }
+                if (runProvenElsewhere(run, deps.instanceId)) {
+                    sendError(res, 409, "steering.not_running", "run is live on another replica — the permission-mode verb must reach the replica holding the stream; resend it there");
+                    return;
+                }
+                sendError(res, 409, "steering.not_running", "no live steerable face for this run on this replica — a verify or cascade submission exposes none, so the permission-mode verb has nothing to switch");
+                return;
+            }
+            const sessionId = run.sessionId;
+            const out = await serialOnStream(live, async () => {
+                const read = await readResumeCtx(checkpointStore.getCtx(sessionId), { sessionId, opener: deps.checkpointCtxSealing });
+                if (read.kind === "corrupt" || read.kind === "unsealable") {
+                    const { status, body: { error, errorCode, ...facts } } = read.kind === "corrupt" ? resumeCtxCorruptAnswer(read.where) : resumeCtxUnsealableAnswer(read);
+                    sendError(res, status, errorCode, error, facts);
+                    return { kind: "answered" };
+                }
+                if (read.kind === "absent") {
+                    sendError(res, 409, "conflict.resume_context_unavailable", "this run's stored request is missing — its permission mode cannot be changed (the task's settings are read from it and the new mode is written back to it)");
+                    return { kind: "answered" };
+                }
+                const stored = read.ctx;
+                const admission = admitPermissionModeWord(word, { deployment: deps.config, settings: parseTaskSettings(stored.body.settings).settings });
+                if (admission.kind === "refused") {
+                    sendError(res, admission.status, admission.code, admission.message);
+                    return { kind: "answered" };
+                }
+                const admitted = admission.admitted ?? word;
+                let receipt;
+                try {
+                    receipt = await live.setPermissionMode(admitted);
+                }
+                catch (e) {
+                    const code = e.code;
+                    if (code === "steering.invalid_content") {
+                        sendError(res, 422, "steering.invalid_content", e instanceof Error ? e.message : String(e));
+                        return { kind: "answered" };
+                    }
+                    if (code === "steering.not_running") {
+                        sendError(res, 409, "steering.not_running", "run just finished — the permission-mode verb needs a running run; submit the next turn of this session with the permissionMode you want");
+                        return { kind: "answered" };
+                    }
+                    throw e;
+                }
+                let persistMiss;
+                try {
+                    const next = sealCheckpointCtx({ ...withPermissionModeRewritten(stored, { ...stored.body, permissionMode: admitted }), writerVersion: serviceVersion() }, deps.checkpointCtxSealing, sessionId);
+                    const rewrite = await checkpointStore.rewriteCtxWhileClaimed(sessionId, taskId, next, (fenced) => switchLegHolds(fenced, deps.instanceId, ctx.registry.steerableRuns.get(taskId), live));
+                    persistMiss = rewrite === "written" ? undefined : rewrite;
+                }
+                catch (e) {
+                    persistMiss = "store_failed";
+                    deps.logger?.warn?.("run_permission_mode_write_back_failed", { taskId, sessionId, err: e instanceof Error ? e.message : String(e) });
+                }
+                if (persistMiss !== undefined) {
+                    recordFailOpen("server.run-permission-mode.write-back-unpersisted", `miss=${persistMiss} mode=${admitted}`);
+                    deps.logger?.warn?.("run_permission_mode_unpersisted", { taskId, sessionId, mode: admitted, miss: persistMiss });
+                }
+                return {
+                    kind: "switched",
+                    receipt,
+                    ...(admission.foldedBy !== undefined ? { admission: { requested: word, admitted, foldedBy: admission.foldedBy } } : {}),
+                    ...(persistMiss !== undefined ? { persistMiss } : {}),
+                };
+            });
+            switch (out.kind) {
+                case "answered":
+                    return;
+                case "switched": {
+                    const reply = {
+                        taskId,
+                        sessionId,
+                        status: "running",
+                        permissionMode: out.receipt,
+                        ...(out.admission !== undefined ? { admission: out.admission } : {}),
+                        persisted: out.persistMiss === undefined,
+                        ...(out.persistMiss !== undefined ? { persistMiss: out.persistMiss } : {}),
+                    };
+                    sendJson(res, 200, reply);
+                    return;
+                }
+                default:
+                    return assertNever(out);
+            }
+        }
+        default:
+            return assertNever(match.decl.id);
+    }
+}
+export const RUN_PERMISSION_MODE_ROUTES = [
+    { id: "run-permission-mode", pattern: /^\/v1\/runs\/(?<taskId>[^/]+)\/permission-mode$/, label: "/v1/runs/:id/permission-mode", methods: ["POST"] },
+];
+//# sourceMappingURL=run-permission-mode.js.map

package/dist/http/routes/session-sync.d.ts

@@ -9,7 +9,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionRulesRecord, type FileHistoryExport } from "@sema-agent/core";
-import { type StagingHandle } from "../../session-sync-kernel.js";
+import { type ImportAnchor, type StagingHandle } from "../../session-sync-kernel.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
 import { type SessionRowPatch } from "../../session-row.js";
 export type PendingStaging = {
@@ -21,11 +21,8 @@ export type PendingStaging = {
     /** [ref]: the session's file-history envelope (or null — no history travelled). Replaces the E19 per-key manifests. */
     fileHistory: FileHistoryExport | null;
     policy: SessionRulesRecord[];
-    anchors: Array<{
-        eventId: string;
-        entryId: string;
-        owner: string | null;
-    }>;
+    /** 已在 Phase A 入口判过的锚(`readImportAnchors`:每条 `entryId` 都在 `declaredEntryIds` 里)—— 提交后的重放腿只迭代它,不再判;owner 不带(重钉到 `owner`)。 */
+    anchors: ImportAnchor[];
     /** 会话行的两位可写位(Phase A 体里带了哪几键就重放哪几键;老客户端不带 ⇒ `{}`,目的端两位不动)。提交后经会话店唯一写口落。 */
     row: SessionRowPatch;
     /** 交叉复查 A-3(HIGH):Phase A's DECLARED entry-id set — Phase B verifies the streamed NDJSON matches it

package/dist/http/routes/session-sync.js

@@ -4,7 +4,7 @@ import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator
 import { StringDecoder } from "node:string_decoder";
 import { FileHistoryUnreadableError, blobGetterOf, exportSessionManifest, exportedFileHistory, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
 import * as facts from "../../capability-facts.js";
-import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
+import { classifySyncRelationshipByIds, readImportAnchors, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
@@ -307,6 +307,11 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 400, "request.body_shape", "malformed import metadata");
                     return;
                 }
+                const anchorsRead = readImportAnchors(body.anchors, body.entryIds);
+                if ("problem" in anchorsRead) {
+                    sendError(res, 400, "request.field_invalid", anchorsRead.problem);
+                    return;
+                }
                 const policyRead = readSessionRulesRecords(body.policy);
                 if (policyRead.problem !== undefined) {
                     if (policyRead.problem.kind === "rules") {
@@ -350,7 +355,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const srcLogDigest = typeof body.logDigest === "string" && body.logDigest.length > 0 ? body.logDigest : undefined;
                 const entryIds = body.entryIds;
                 const policy = policyRead.records;
-                const anchors = body.anchors;
+                const anchors = anchorsRead.anchors;
                 const dstIds = (await sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);
                 if ((relA.relation === "fork" || relA.relation === "stale") && resolution !== "overwrite-dst") {

package/dist/http/routes/sessions.js

@@ -7,6 +7,8 @@ import { seatText } from "../../trace/exit-seat.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
+import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { foldPlaneStatuses } from "../../memory-operator-faces.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
@@ -524,14 +526,14 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const auditFact = facts.sessionAuditView(deps);
             if (!auditFact.available) {
-                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             if ((await readOwnedSessionView(auditFact.sessionAudit, sessionId)) === undefined)
                 return;
             const faces = deps.memoryCompliance;
             if (faces === undefined) {
-                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             const raw = (await readJson(req));
@@ -551,11 +553,17 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.field_invalid", "allowUnevidenced must be a boolean when present");
                 return;
             }
+            const at = readLayerSeat(res, Object.prototype.hasOwnProperty.call(raw, "scope"), raw.scope);
+            if (at === null)
+                return;
+            const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
             try {
-                sendJson(res, 200, await faces.erase({ requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) }));
+                const input = { requestId: raw.requestId, select: { sessionId }, ...(raw.allowUnevidenced !== undefined ? { allowUnevidenced: raw.allowUnevidenced } : {}) };
+                sendJson(res, 200, await (at !== undefined ? faces.erase(input, at) : faces.erase(input)));
             }
             catch (err) {
-                const withheld = (coreMessage) => deps.logger?.warn?.("session_memory_erase_refused", { sessionId, err: coreMessage });
+                if (sentMemoryLayerRefusal(res, err, { kind: "session_owner", withheld }))
+                    return;
                 if (sentMemoryComplianceFailure(res, err, { kind: "session_owner", withheld }, deps.logger))
                     return;
                 deps.logger?.warn?.("session_memory_erase_failed", { sessionId, err: String(err) });
@@ -577,33 +585,41 @@ export async function handleSessions(req, res, match, ctx) {
             }
             const auditFact = facts.sessionAuditView(deps);
             if (!auditFact.available) {
-                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
             if ((await readOwnedSessionView(auditFact.sessionAudit, sessionId)) === undefined)
                 return;
             const face = deps.sessionMemoryStatus;
             if (face === undefined) {
-                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/tidb memory backends do not (their control plane would land on a replica's local disk)");
+                sendError(res, 501, "capability.memory_engine_required", "session memory status is not available on this deployment — it requires a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             }
+            const query = new URLSearchParams(match.search);
+            const at = readLayerSeat(res, query.has("scope"), query.get("scope"));
+            if (at === null)
+                return;
             try {
                 const { memoryStatusCache } = ctx.local.sessions;
-                let entry = memoryStatusCache.get(sessionId);
-                if (!entry || Date.now() - entry.at > MEMORY_STATUS_TTL_MS) {
+                const statusOf = (store) => {
+                    const cacheKey = JSON.stringify([sessionId, store.controlPlane]);
+                    const cached = memoryStatusCache.get(cacheKey);
+                    if (cached && Date.now() - cached.at <= MEMORY_STATUS_TTL_MS)
+                        return cached.status;
                     if (memoryStatusCache.size > 1024)
                         memoryStatusCache.clear();
-                    const status = face.status(sessionId);
+                    const status = store.status(sessionId);
                     const fresh = { at: Date.now(), status };
-                    memoryStatusCache.set(sessionId, fresh);
-                    status.catch(() => { if (memoryStatusCache.get(sessionId) === fresh)
-                        memoryStatusCache.delete(sessionId); });
-                    entry = fresh;
-                }
-                const s = await entry.status;
+                    memoryStatusCache.set(cacheKey, fresh);
+                    status.catch(() => { if (memoryStatusCache.get(cacheKey) === fresh)
+                        memoryStatusCache.delete(cacheKey); });
+                    return status;
+                };
+                const s = foldPlaneStatuses(await Promise.all(face.storesAt(at).map(statusOf)));
                 sendJson(res, 200, {
                     sessionId,
                     autoConsolidationArmed: deps.memoryAutoConsolidationArmed,
+                    ...(deps.memorySyncLeg !== undefined ? { memorySync: { parked: deps.memorySyncLeg.parked().map((p) => ({ scope: p.scope, wayOut: p.wayOut })) } } : {}),
                     ...(s.captureOptedOut !== undefined ? { captureOptedOut: s.captureOptedOut } : {}),
                     ...(s.committedCount !== undefined ? { committedCount: s.committedCount } : {}),
                     ...(s.foldedCount !== undefined ? { foldedCount: s.foldedCount } : {}),
@@ -612,6 +628,8 @@ export async function handleSessions(req, res, match, ctx) {
                 });
             }
             catch (err) {
+                if (sentMemoryLayerRefusal(res, err, { kind: "session_owner", withheld: (message) => deps.logger?.warn?.("session_memory_status_refused", { sessionId, err: message }) }))
+                    return;
                 deps.logger?.warn?.("session_memory_status_failed", { sessionId, err: String(err) });
                 sendError(res, 500, "internal.error", "session memory status read failed");
             }