@sema-agent/server 7.139.0 → 7.141.0

package/dist/resource-suspend.d.ts

@@ -5,24 +5,26 @@
  * task opts in, a budget/turns/walltime limit OR a scheduler preempt durably SUSPENDS the task (resumable via
  * `POST /v1/assistant/tasks/:id/resume`) instead of FAILING; absent ⇒ a limit still FAILS.
  *
- * 🔴 EXCLUDE verify/cascade tasks. Core runs their implementation via `runWithVerification`/`runCascade`, which
- * map an inner durable suspend to a FAILED result (`errorCode: "unexpected.suspended"`,内层 status
- * "needs_review" 时铸 `"unexpected.needs_review"` —— 真源是 core `agents/suspend-guard.js` 的
- * `mapNestedSuspend`;`suspended.*` 三码是 bg 子代/委派报告面的词,不落在这条 TaskResult 腿上). The service would then
- * `setTerminal(failed)` while core had already minted a pending `resource_limit` checkpoint + suspended the
- * remote VM — ORPHANING both (the run row is terminal, so nothing resumes them). So a resource-limit hit on a
- * verify/cascade task must FAIL CLEANLY (no suspend), exactly as before the flag. This exclusion is the SAME
- * boundary the `preemptSignal` wiring enforces in runs.ts (stream-path only), so eligibility and the signal stay
- * aligned. (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended
- * VM + checkpoint on every verify/cascade task that hits a resource limit.)
+ * 🔴 EXCLUDE cascade tasks. Core runs a cascade through `runCascade`, which maps a rung's durable suspend to a FAILED
+ * result carrying the pause (`errorCode: "unexpected.suspended"`, 内层 status "needs_review" 时铸 `"unexpected.needs_review"`,
+ * 停驻因由在 `terminal.nestedPause` —— 真源是 core `agents/suspend-guard.js` 的 `mapNestedSuspend`;`suspended.*` 三码是 bg
+ * 子代/委派报告面的词,不落在这条 TaskResult 腿上). A rung's pause lands on the rung's own engine-minted session, which the
+ * host-boundary judge (`atHostBoundary`, src/terminal.ts) leaves terminal: the service would `setTerminal(failed)` while core
+ * had already minted a pending `resource_limit` checkpoint + suspended the remote VM — ORPHANING both (the run row is
+ * terminal, so nothing resumes them). A resource-limit hit on a cascade task must FAIL CLEANLY (no suspend).
+ * (Cross review wtyc7ist3 HIGH finding: without this, enabling RESOURCE_SUSPEND leaks a suspended VM + checkpoint on every
+ * cascade task that hits a resource limit.) The arm is the judge's session cell seen from the opt-in side: the day the engine
+ * lets a rung's pause land on a session the host's resume chain reaches (core [ref]), the judge's answer flips and this arm goes.
+ * Every other task — a verify task included — opts in alike. A verify task's implementation leg and fix rounds run on the
+ * run's own session, so the judge lifts their pause into a park of the run row (resumable through
+ * `POST /v1/assistant/tasks/:id/resume`); the verifier's own leg is built by the engine without an opt-in, so a limit there
+ * still fails that leg.
  */
 export declare function resourceSuspendOptIn(opts: {
     /** `RESOURCE_SUSPEND=true` (the worker-level switch). */
     enabled: boolean;
     /** `RESOURCE_SUSPEND_TTL_SEC` — 0 ⇒ core default (30d) by omitting `ttlMs`. */
     ttlSec: number;
-    /** This task requested the developer-mode verify gate (`body.verify === true`). */
-    isVerify: boolean;
     /** This task requested the cascade ladder (`body.cascade === true`). */
     isCascade: boolean;
     /** Multi-tenant isolation key — the SAME key durableApproval uses (the principal; "_" when auth is off). */

package/dist/resource-suspend.js

@@ -1,5 +1,5 @@
 export function resourceSuspendOptIn(opts) {
-    if (!opts.enabled || opts.isVerify || opts.isCascade)
+    if (!opts.enabled || opts.isCascade)
         return undefined;
     return {
         scope: opts.scope,

package/dist/resource-window.d.ts

@@ -9,7 +9,7 @@
  * 【两半各自的真源(刻意不自建第三本账)】
  *  · **上限半**:本模块的进程内登记册 —— 记的是**这条 run 真正铸给 core 的那只 `resourceSuspend`**
  *    (装配点 `boot/resolve-spec.ts` 的 `resourceSuspendOptIn`),不是读时现取 env。差别是承重的:
- *    ① verify/cascade 腿被 `resourceSuspendOptIn` **整只排除**(opt-in 不成立)⇒ 登记册里没有它 ⇒
+ *    ① cascade 腿被 `resourceSuspendOptIn` **整只排除**(opt-in 不成立)⇒ 登记册里没有它 ⇒
  *       整键缺席,绝不显示一个没人执行的天花板;② 滚动改 env 之后,已在跑的 run 报的仍是它自己那份。
  *  · **已耗半**:run 自己的 durable 账本行 `model_usage`(`trace/project.ts` 的 `aggregateModelUsage`)——
  *    与 `TaskStats.modelUsage` 回声**同一份账**,append-only、跨 slice、跨进程(每条腿只追加自己的
@@ -21,7 +21,8 @@
  * core 的 `spentTokens` 轴 = 每片 `TaskStats.tokens`(= Σ 每次调用 `usage.totalTokens`,**不含**委派子代,
  * 子代在 `stats.nested`),而 `model_usage` 行正是同一批 `brain.call` 的逐 turn delta、同样只收顶层 run。
  * 已知差:① **滞后至多一个 turn**(delta 在 turn 边界 drain,进行中的那一 turn 还没入账);② 账本行
- * 写失败(F 类)会少计。⇒ 本投影是**分诊/预警**读面,**不是**任何门/CAS/resume 判定的输入。
+ * 写失败(F 类)会少计;③ 只回结果的组合腿(verify)没有逐 turn 落账的流,`model_usage` 行只在停驻 / 终局那一拍写 ⇒
+ * running 期读到的是上一次停驻时的量,滞后**一整片**(钉:`test/resource-suspend.test.ts` 的 🚧 格)。⇒ 本投影是**分诊/预警**读面,**不是**任何门/CAS/resume 判定的输入。
  *
  * 【登记册的语义边界(与 `turn-activity.ts` 的 `msSinceLastActivity` 逐字同族)】
  *  · **同副本 best-effort**:只活在本进程。跨副本 poll(run 跑在别的副本)或本副本重启后 ⇒ 读不到 ⇒
@@ -34,7 +35,7 @@
  * 【已声明的代价:每次 poll 一次全量账本读(codex 交叉复审 R2-[medium],如实登记、本批不修)】
  * {@link buildCrossSliceUsage} 要对**全部** `model_usage` 行求和 ⇒ 调用点(`routes/runs.ts` 的 poll)在
  * 窗已登记时每拍读一次 `getEvents(taskId, 0)`,工作量随「轮询次数 × 已积累事件数」增长。三条限幅是**结构性**
- * 的,不是「应该很少见」:① **只有登记过窗的 run 才读**(没开三旋钮的部署、以及 verify/cascade 腿,一次都不读);
+ * 的,不是「应该很少见」:① **只有登记过窗的 run 才读**(没开三旋钮的部署、以及 cascade 腿,一次都不读);
  * ② 只在 `running` 且非 stale 时读;③ 同一条路上早已存在同形读(终局 + 配了 infra 价目表时的 `needCost` 臂,
  * 同样是 `getEvents(taskId, 0)`)—— 本批加的是**跑动期**这一档,不是新病种。
  * 🔴 真正的收口在**存储面**(不在本模块):给 run store 加一条「累计用量 + resource_limit park 计数」的

package/dist/run-cancel-context.d.ts

@@ -1,3 +1,20 @@
+/**
+ * [ref] 件3(cli [ref] sema-bug4 (d) / server [ref]):**取消现场快照**的唯一铸点。
+ *
+ * 语义边界、缺席纪律、「为什么不写模型调用相位」全部成文在类型属主处 —— 见
+ * `plugins/store-contracts.ts` 的 `RunCancelContext` 顶注。本文件只做装配。
+ *
+ * 三条用户取消腿共用它(**判别材料只许有一份口径**):
+ *  · `POST /v1/runs/:id/cancel` 的 park 取消腿(`http/routes/runs.ts` cancelSuspended);
+ *  · `/v1/tasks/stream` 的客户端断连腿(`http/routes/tasks.ts`,没读到 done 的那一支);
+ *  · durable bg 腿的 abort 结算(`runs.ts` —— 同一条 cancel 动词打到 running 行上时的终局形)。
+ *
+ * [ref] 起,「取消终局整只长什么样」也收在本文件({@link mintCancelledResult})—— 快照与它所在的
+ * 那条结果由同一个属主铸,三条腿一份口径。
+ *
+ * [ref] 起,「这次取消是谁发起的」也收在本文件:中止那一刻经 {@link createRunAbort} 的句柄登记成因,终局铸点从同一只句柄读。
+ */
+import type { TerminalCause } from "@sema-agent/core";
 import type { AbortCause, PersistedTaskResult, RunCancelContext } from "./plugins/store-contracts.js";
 /**
  * @param taskId  这条 run 的账本 id(turn 活性登记的键)。
@@ -58,6 +75,23 @@ export declare function mintCancelledResult<R extends PersistedTaskResult>(args:
 export declare function mintCancelledResult(args: CancelMintArgs & {
     engineResult?: undefined;
 }): PersistedTaskResult;
+/**
+ * 被取消的续跑腿、且这张卡被本服务 expire 之后,终局上的那句话 —— **全仓单源**([ref])。
+ *
+ * 引擎对一条「批过的那一步没开跑就结束」的续跑腿,在终局文案上补一句通用的话:「…the checkpoint was REOPENED (pending): the same approval can be resumed again」
+ * (它对想再续的宿主是真话:引擎确实把卡放回了 pending)。而本服务按取消语义结算这张卡(取消 = run 死:绝不重新 park,卡 expire),于是写在终局上的那句话与可操作面
+ * 不一致 —— 文案说可再续,待办队列里没有这张卡、同一张卡再决断 404。取消不可逆(契约),所以真话是这一句。
+ * 引擎那句里「放回 pending」的事实与「同一批准可再续」的结论都是**引擎当时**的,本服务在其后改了卡的状态,最后一个写手的句子才对。
+ */
+export declare const CARD_SETTLED_BY_CANCEL_MESSAGE = "Cancelled \u2014 the approved action never started, and the cancel settled this approval: it cannot be resumed (start a new run to continue)";
+/**
+ * 一条被取消的续跑腿的失败终局,在本服务亲手 expire 了它那张卡之后的形:**只换文案**,码(引擎补的 `resume.reopened_unstarted` 等)、成因位、统计与其余字段原样
+ * (码立住是成文契约;换码是另一条 wire 变更)。非 `failed` 终局原样返回。纯函数,不改入参。
+ * 调用点只有 `http/resume-legs.ts` 的 `reopenedAfterLeg`(判据 = 店的事实「本座 expire 了一张 pending 的卡」,不嗅引擎文案)。
+ */
+export declare function withCardSettledByCancelMessage<R extends {
+    terminal: TerminalCause;
+}>(leg: R): R;
 /** {@link mintCancelledResult} 的公共实参(`engineResult` 另列:在场与否决定返回型)。 */
 interface CancelMintArgs {
     /** 这条 run 的账本 id(活性登记的键;账本不在场时给空串,快照按「证不出」处理)。 */

package/dist/run-cancel-context.js

@@ -36,6 +36,13 @@ export function mintCancelledResult(args) {
         abortCause: args.cause,
     };
 }
+export const CARD_SETTLED_BY_CANCEL_MESSAGE = "Cancelled — the approved action never started, and the cancel settled this approval: it cannot be resumed (start a new run to continue)";
+export function withCardSettledByCancelMessage(leg) {
+    const t = leg.terminal;
+    if (t.kind !== "failed")
+        return leg;
+    return { ...leg, terminal: { ...t, message: CARD_SETTLED_BY_CANCEL_MESSAGE } };
+}
 export function buildCancelledLedgerRow(c) {
     const t = c.terminal;
     return {

package/dist/run-local.js

@@ -25,13 +25,13 @@ import { acquireLocalBackendWithWait } from "./plugins/store-lock-wait.js";
 import { configLocalRoot, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
-import { composeExecutionLane, settleHostLaneShell } from "./boot/execution-lane.js";
+import { composeExecutionLane, settleHostLaneShell, warnReadDenyFloorUnkept } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
 import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { applyEffective, applyCenterReadFace, applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./web-admin-client/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
-import { executionLaneHomeDir, executionLaneOf } from "./execution-lane-caps.js";
+import { buildLaneHomeClaim, executionLaneOf } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { createInstructionSourceSeat } from "./instruction-source-notice.js";
 import { loadDeploymentSkills } from "./capabilities/skills.js";
@@ -42,12 +42,13 @@ import { createTaskListLane } from "./boot/task-list-lane.js";
 import { pickHandsRunner, withoutHands } from "./capabilities/hands-lane.js";
 import { HttpError, sessionIdShapeIssue } from "./security.js";
 import { createMemoryEngineIncidentSink } from "./memory-incident-sink.js";
-import { fileMemoryEngineRoot, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+import { fileMemoryEngineRoot, memoryEngineBackendFor, memoryLayersNamedBy, memorySpecForRequest } from "./memory-scope.js";
+import { createMemoryScopeStores } from "./memory-scope-stores.js";
 import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
 import { declaredCredential } from "./model-route-gap.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
-import { buildMemorySyncEnabledFields, createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
+import { startMemorySyncRunner } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps } from "./boot/runner-deps.js";
 import { createPeerDesk } from "./peer-seat.js";
@@ -472,17 +473,22 @@ export async function runLocal(argv, deps = {}) {
     const hostRx = config.remoteExec?.provider === "host" ? config.remoteExec : undefined;
     const workspaceDir = args.workspace ?? hostRx?.workspaceBase ?? process.cwd();
     await settleHostLaneShell(config, logger);
+    warnReadDenyFloorUnkept(config, logger);
+    const homeDirSeat = buildLaneHomeClaim(config);
     const executionEnvFactory = hostRx
         ? hostExecutionEnvFactory({
             workspaceDir,
-            ...((h) => (h === undefined ? {} : { homeDir: h }))(executionLaneHomeDir(config)),
+            ...homeDirSeat,
             backgroundShell: config.requirePrincipal !== true,
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
     const lspManager = hostRx && config.lspHostEnabled && config.requirePrincipal !== true ? createHostLspManager(config, (event, fields) => logger.info(event, fields)) : undefined;
-    const memoryEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
     const engineDataRoot = fileMemoryEngineRoot(config, root);
+    const fileEngine = memoryEngineBackendFor(config, root, memoryEngineIncident);
+    const memoryEngine = fileEngine !== undefined
+        ? createMemoryScopeStores({ backend: fileEngine.backend, root: engineDataRoot, namedLayers: () => memoryLayersNamedBy({ ...config, memoryScope: args.user ?? "local" }), onIncident: memoryEngineIncident })
+        : undefined;
     try {
         judgeConsolidationValve({ config, memoryEngine });
     }
@@ -494,18 +500,7 @@ export async function runLocal(argv, deps = {}) {
     }
     let memorySync;
     if (config.memorySync && memoryEngine) {
-        const transport = createMemorySyncTransport({ url: config.memorySync.url, token: config.memorySync.token });
-        memorySync = createMemorySyncRunner({
-            backend: memoryEngine.backend,
-            scope: config.memorySync.scope,
-            memoryRoot: memoryEngine.root,
-            transport,
-            log: logger,
-            ...(config.memorySync.maxPushEntries !== undefined ? { maxPushEntries: config.memorySync.maxPushEntries } : {}),
-            ...(config.memorySync.maxPullEntries !== undefined ? { maxPullEntries: config.memorySync.maxPullEntries } : {}),
-        });
-        logger.info("memory_sync_enabled", buildMemorySyncEnabledFields(transport.peer, config.memorySync.scope, memorySync.cursorPathFor(config.memorySync.scope)));
-        memorySync.trigger("boot");
+        memorySync = startMemorySyncRunner({ sync: config.memorySync, stores: memoryEngine, log: logger });
     }
     else if (config.memorySync) {
         logger.warn("memory_sync_configured_but_memory_dark", { note: "MEMORY_SYNC_URL is set but the file memory engine is dark (MEMORY_ENGINE=off / remote exec lane) — no sync rounds will run" });
@@ -687,7 +682,7 @@ export async function runLocal(argv, deps = {}) {
         }
     }
     const projectKey = memoryEngine
-        ? await createMemoryProjectLayers({ backend: memoryEngine.backend, syncRunner: memorySync, log: logger }).prepare(config, scope, workspaceDir)
+        ? await createMemoryProjectLayers({ stores: memoryEngine, syncRunner: memorySync, log: logger }).prepare(config, scope, workspaceDir)
         : undefined;
     const taskTimeoutSec = Math.floor(parseNumOrFailNonNegative("TASK_TIMEOUT_SEC", process.env.TASK_TIMEOUT_SEC || "0"));
     const timeoutSec = taskWallClockSec(taskTimeoutSec, false);

package/dist/runs.d.ts

@@ -1,4 +1,5 @@
 import { defaultTaskRegistry, type CascadeConfig, type CheckpointToken, type RunInternals, type Runner, type SubagentSteerHandle, type TaskResult, type TaskSpec, type TaskStream, type TerminalCause } from "@sema-agent/core";
+import { type CardVoidPort } from "./card-void.js";
 import { type EntryProblem } from "./entry-problems.js";
 import type { SendUserFileEmitter } from "./capabilities/send-user-file-tool.js";
 import type { RunStore } from "./plugins/store-backend.js";
@@ -181,9 +182,24 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
 export declare function createPromptCommitReader(): (ev: {
     readonly type: string;
 }) => string | undefined;
+/** 回退锚写在哪条腿上(探针行的 `leg=`):流式腿 `POST /v1/tasks/stream`、后台腿 `POST /v1/runs`、续跑腿。 */
+export type ResumeAnchorLeg = "stream" | "bg" | "resume";
+/**
+ * 回退锚的**唯一**写法(三条腿同一只):**有界** await 写入(单行店操作期限 {@link BASELINE_IO_DEADLINE_MS},与项目指令基线的
+ * 读写同一只数、同一只 {@link withinIoDeadline} —— 同为单行 PK 写、同在腿的关键路径上);写失败或到期 ⇒ 不抛(锚是这次提示词能不能
+ * 回退的手柄,不是 run 的成败),记一次登记过的 fail-open `server.resume-anchor.capture-failed`(`reason=error|timeout`;计数 + 探针行 + 一次性 warn)。
+ * 调用方在本腿的终帧(流式腿的 `done`)**之前** await 它 ⇒ 客户端拿到终帧时锚已落定或已知没落定,没有「锚晚到」的窗;锚店挂住至多让终帧晚一个期限。
+ * 到期只放手不取消:那次写照常在飞,迟到落定的锚照样可用(迟到的失败被吞,不重复计数)。
+ * 用户面的读数仍只有一处:会话视图用户消息行的 `taskId?`(present-iff 锚在)与 `resumeAt` 的 404 `resume_at.unknown_event`。
+ */
+export declare function settleResumeAnchor(write: () => Promise<void>, where: {
+    readonly leg: ResumeAnchorLeg;
+    readonly kind: "prompt" | "turn";
+}): Promise<void>;
 export declare class TurnAnchorCapture {
     private readonly capture;
-    private readonly onCaptureFail?;
+    /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
+    private readonly leg;
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
      *  `message_committed{role:"user"}` event — its `entryId` is the persisted user-message `SessionTreeEntry.id`,
      *  ALWAYS a valid `resumeAt` target (core accepts a user message; it rejects a tool-result / mid-tool-call
@@ -197,7 +213,9 @@ export declare class TurnAnchorCapture {
     private turnHadTool;
     /** 用户提交是不是提问的唯一读法({@link createPromptCommitReader};附件帧不是提问)。 */
     private readonly promptCommit;
-    constructor(capture: ((eventId: string) => Promise<void>) | undefined, onCaptureFail?: (() => void) | undefined, 
+    constructor(capture: ((eventId: string) => Promise<void>) | undefined, 
+    /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
+    leg: Exclude<ResumeAnchorLeg, "stream">, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
      *  `message_committed{role:"user"}` event — its `entryId` is the persisted user-message `SessionTreeEntry.id`,
      *  ALWAYS a valid `resumeAt` target (core accepts a user message; it rejects a tool-result / mid-tool-call
@@ -247,6 +265,20 @@ export declare function parkToolCallId(result: unknown, cs: ParkCheckpointReader
  *  不塞进 `checkpointGate`——那是 core 的类型,server 不改其形)。非 park / 无 token / tool-less /
  *  读失败 ⇒ **同一引用**原样返回(键缺席)。graft 不负责 strip——组合序恒为 graft → strip。 */
 export declare function graftParkToolCallId<T>(result: T, cs: ParkCheckpointReader | undefined): Promise<T>;
+/**
+ * 🔴 [ref] **停驻没落定就以失败收场的腿:卡的命运先于认领释放**(后台腿与续跑腿同读这一只;动词 = `card-void.ts` 的结算作废)。
+ *
+ * 腿要以失败收场(行 `failed`、认领释放),而手里的结果是宿主层停驻 —— 引擎交回结果之前已把卡落进 checkpoint 店,卡在本 run 的会话上 ——
+ * ⇒ 先把那张卡按它自己的 scope 作废,调用方再放认领。不作废 ⇒ 待决面上留一张卡,兑现它的 run 已经 `failed`、认领已放:决定口照样受理,
+ * 续跑在没有认领的会话上驱动(`resume-legs.ts` 认领缺席的成因清单)。顺序承重:先放认领、后作废 ⇒ 两步之间(作废没做成时一直)就是那一形。
+ * 停驻没落定的成因不在判据里(停驻行 / 用量行 / 结果到手之后的任何一笔账本写抛):判据只读手里那份结果。
+ *
+ * `held` = 手里那份结果过了宿主判官之后的形(判官提上来的嵌套停驻同样算;不在本 run 会话上的嵌套停驻 —— cascade 级上的卡 —— 判官不提,
+ * 不归本腿作废)。不是停驻 ⇒ 零 I/O。不抛:作废没做成 ⇒ 卡回到「留在待决面上、由兜底收割收走」的形,响亮留痕。
+ */
+export declare function voidHeldParkCard(held: {
+    readonly terminal: TerminalCause;
+} | undefined, hostSessionId: string | undefined, cards: CardVoidPort | undefined, leg: "bg" | "resume"): Promise<void>;
 /**
  * Drive a task to completion in the background, persisting its events to the durable run log (S2).
  *
@@ -263,10 +295,14 @@ export declare function graftParkToolCallId<T>(result: T, cs: ParkCheckpointRead
  * Preemption (POST /v1/assistant/tasks/:id/preempt, [ref] seam #2): a SECOND, INDEPENDENT controller
  * (`preemptCtrl`, registered in `preemptable`) carries the scheduler's graceful "yield this task" — when raised,
  * core durably SUSPENDS the task at the next clean turn boundary (gate resource_limit, reason "preempt") so it is
- * RESUMABLE, the opposite of cancel's kill. It is wired ONLY on the plain-stream path: the verify/cascade
- * branches finalize with `setTerminal` unconditionally (no `setSuspended`), so a preempt-suspend there would write
- * a non-terminal "suspended" as terminal and release the session lock — and preempt's contract is graceful, not a
- * failure. Cross-replica via the `preempt_requested` flag (same heartbeat tick). Eligibility (resourceSuspend +
+ * RESUMABLE, the opposite of cancel's kill. It is wired ONLY on the plain-stream path. A cascade cannot honor it: a
+ * rung's pause lands on the rung's own engine-minted session, which the host's resume chain cannot reach (the
+ * host-boundary judge settles it terminal). A verify task carries the resource-suspend opt-in (a budget / turns /
+ * walltime limit parks its implementation leg or fix round), but its FIRST slice here is not wired to the preempt
+ * signal (`preemptEligible` below is false for verify, so the preempt endpoint answers a no-op for a verify run this
+ * replica owns); a RESUMED verify leg is wired (`resume-legs.ts` registers every resume leg in `preemptableRuns` and
+ * threads `preemptSignal` into `resumeWithVerification`). Cross-replica via the `preempt_requested` flag (same heartbeat
+ * tick). Eligibility (resourceSuspend +
  * durable store + durable tool-results + remote env) is core's call: an ineligible task's preemptSignal no-ops.
  *
  * Steering (POST /v1/runs/:id/steer, [ref]): the live core `TaskStream` is registered in `steerable` so the
@@ -335,16 +371,11 @@ approval?: {
     declaredFamilies: ReadonlySet<ApprovalFrameFamily>; /** 出处带车道:这条执行上下文的车道(装配点 `durable-run-leg.ts` 写 `ctx.lane`)。 */
     executionLane: import("./execution-lane-caps.js").ExecutionLane;
 }, 
-/** [ref]:park 投影腿的 checkpoint 读口(`deps.checkpointStore`)。在场时,durable park 的
- *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});缺席=旧字节逐字不变。 */
-parkCheckpointReader?: {
-    get(token: CheckpointToken): Promise<{
-        pendingAction?: {
-            kind?: unknown;
-            toolCallId?: unknown;
-        };
-    } | null>;
-}, 
+/** 本腿结算用的 checkpoint 店(`deps.checkpointStore`),两件事:①[ref] park 投影腿的读口 —— 在场时 durable park 的
+ *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});②验证门结算时作废验证器自己的停驻卡
+ *  ({@link voidVerifierPauseCard}:本服务兑现不了的卡不留在待决面上);③停驻没落定就以失败收场时作废手里那张卡({@link voidHeldParkCard})。
+ *  缺席 ⇒ ①旧字节逐字不变;②③带凭据的停驻响亮留痕、卡由兜底收割。 */
+checkpointCards?: ParkCheckpointReader & CardVoidPort, 
 /** [ref]:装配期(`prepareSpec` → `resolveSpec`)铸下的用户面通告 —— 那一刻本腿的通告口还没开,
  *  所以由本腿在 `registerEngineNoticeLeg` 那一拍连同 `pending` 一起投(投递单点仍是 `route()`)。
  *  缺席 ⇒ 一个字节不投(既有调用方逐字不变)。 */