@sema-agent/server 7.140.0 → 7.141.0

package/dist/plugins/local-session-window.d.ts

@@ -16,6 +16,12 @@
  *    branch below the floor — so the record the engine reads is the one the run's walk reaches.
  * Read-only: the log is read once (`exportEntries`, pure), no append log is opened, and the window refuses writes.
  *
+ * ## The metadata is the store's, not the archive's
+ * Both halves come from the local session store ({@link LocalSessionRows}) — this module opens no repo of its own. The metadata is the
+ * store's one projection of the session's row (`LocalSessionStore.sessionMetadataOf`: owner, creation time and fork lineage read from the
+ * session-meta cell, the same projection the store hands the engine), never the archive header's copy — an archive rebuilt by a log swap
+ * keeps the row's creation time. The log is the store's export of the archive.
+ *
  * ## Cost: one linear walk, the engine's
  * The branch is core's own `getPathToRoot` over the whole log (the walk every engine read of a local session makes, with its stop
  * rules: an entry without a parent ends it, a parent the log does not hold is `invalid_session`, an unknown leaf is `not_found`).
@@ -29,7 +35,15 @@
  * by `getPathToRoot` and the run's resume ancestor scan (the two walks core 7.54.1 guards; this module has no walker of its own left).
  * Pinned in `test/session-log-parent-cycle.test.ts`.
  */
-import { BaseSessionStorage } from "@sema-agent/core";
+import { BaseSessionStorage, type SessionMetadata, type SessionTreeEntry } from "@sema-agent/core";
+/**
+ * What the window reads, and from whom: the local session store's row projection and its export of the log (`LocalSessionStore` is the one
+ * implementation; `store-backend.ts#localSessionRowsOf` hands it out). `undefined` / `null` = no such session.
+ */
+export interface LocalSessionRows {
+    sessionMetadataOf(sessionId: string): Promise<SessionMetadata | undefined>;
+    exportEntries(sessionId: string): Promise<SessionTreeEntry[] | null>;
+}
 export declare class LocalSessionWindow extends BaseSessionStorage {
     /** The branch below the floor, root first (empty when the window is the whole branch). */
     private readonly below;
@@ -39,7 +53,7 @@ export declare class LocalSessionWindow extends BaseSessionStorage {
     /** `SessionStorage.getEpochAnchor?()` — the nearest carrier on the branch below the floor, as stored ({@link scanEpochAnchor}).
      *  A row's `seq` is its position on the branch; the whole branch is in memory, so one page holds every row. */
     getEpochAnchor(): Promise<unknown>;
-    /** Wake the window of `sessionId` under the local data root `root`; `null` if there is no such session. */
-    static wake(root: string, sessionId: string): Promise<LocalSessionWindow | null>;
+    /** Wake the window of `sessionId` from the local session store's rows; `null` if there is no such session. */
+    static wake(rows: LocalSessionRows, sessionId: string): Promise<LocalSessionWindow | null>;
 }
 //# sourceMappingURL=local-session-window.d.ts.map

package/dist/plugins/local-session-window.js

@@ -1,5 +1,4 @@
 import { BaseSessionStorage, InMemorySessionStorage, SessionError, boundedTail } from "@sema-agent/core";
-import { createLocalSessionRepo } from "./local-session-store.js";
 import { scanEpochAnchor } from "./session-epoch-anchor.js";
 export class LocalSessionWindow extends BaseSessionStorage {
     below;
@@ -16,18 +15,13 @@ export class LocalSessionWindow extends BaseSessionStorage {
     async getEpochAnchor() {
         return scanEpochAnchor(this.below.length, async (beforeSeq) => this.below.slice(0, beforeSeq).map((entry, seq) => ({ seq, entry })).reverse(), (row) => row.entry);
     }
-    static async wake(root, sessionId) {
-        const repo = createLocalSessionRepo(root);
-        let log;
-        try {
-            log = await repo.exportEntries(sessionId);
-        }
-        catch (e) {
-            if (e.code === "not_found")
-                return null;
-            throw e;
-        }
-        const metadata = (await repo.list()).find((m) => m.id === sessionId) ?? { id: sessionId, createdAt: new Date().toISOString() };
+    static async wake(rows, sessionId) {
+        const log = await rows.exportEntries(sessionId);
+        if (log === null)
+            return null;
+        const metadata = await rows.sessionMetadataOf(sessionId);
+        if (metadata === undefined)
+            return null;
         const whole = new InMemorySessionStorage({ entries: log });
         const leafId = await whole.getLeafId();
         const branch = await whole.getPathToRoot(leafId);

package/dist/plugins/memory-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { type FenceLanded, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
@@ -83,7 +83,7 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     markResuming(taskId: string, instanceId: string): Promise<boolean>;
     getActiveTaskId(sessionId: string): Promise<string | undefined>;
     /** 认领当写栅栏用(契约 = `store-contracts.ts` 的 `InProcessClaimFence`):判、刷新活性与 `write` 是同一个同步段。 */
-    whileHoldingClaim(sessionId: string, taskId: string, write: () => FenceLanded): boolean;
+    whileHoldingClaim(sessionId: string, taskId: string, write: (run: FencedRun) => FenceLanded): boolean;
     getRun(taskId: string): Promise<RunRecord | undefined>;
     /** Runs newest-first, keyset on (createdAt, taskId) DESC; optional exact-match filters (owner is exact, like the SQL). */
     listRuns(opts: RunListQuery): Promise<RunRecord[]>;

package/dist/plugins/memory-run-store.js

@@ -238,7 +238,7 @@ export class MemoryRunStore {
         if (this.active.get(sessionId) !== taskId || r === undefined || r.status !== "running")
             return false;
         r.updatedAt = new Date();
-        write();
+        write({ instanceId: r.instanceId });
         return true;
     }
     async getRun(taskId) {

package/dist/plugins/one-time-migrations.d.ts

@@ -316,6 +316,18 @@
  *      或 `storage` 时权限 / 磁盘修好)后的下一次起服照常补放置;存档移走则它不再是本服务的会话(不补放置、不再点名;fork 创建的会话例外 —— 它的格还在,读作 fork 未落定,出路是同键重试那次 fork 或删除该会话)。
  *    · **旧版在已切换库上**:≤7.137.x 起服建回空 `device_session`,随后列册对账见执行列为幽灵列拒启、零行写;再起本版 ⇒ ⓪ 删掉那张空表。回滚的唯一支持形 = 恢复切换前的备份。
  *    读数:`executionPlacementColumnsAdded` / `deviceBindingsMoved` / `deviceBindingsOrphaned`(非零 ⇒ 另一行 warn)/ `deviceBindingTablesDropped` / `executionPlacementsBackfilled` / `executionPlacementSessionsUnreadable`(点名数组 `{ sessionId, fault, errno? }`,只 local;一行一条 warn),收据只记起服日志行。
+ *  · **M33 local 存档的行事实搬进行、带戳存档改写成匿名**(7.141.0;local 独有 —— SQL 孪生的行事实本来就只在 `session_meta` 行上)—— local 店的行事实(属主 / 化身 / 执行放置 /
+ *    建档时刻 / fork 谱系)只住在会话元数据边档的那一格,引擎仓是匿名内容仓(`local-session-store.ts` 头注「规则一」):本店交给引擎仓的写一律不交属主,交出的会话元数据是那一格的一只投影。
+ *    ≤7.140.x 写下的存量 ① 格里没有建档时刻 / 谱系(那两样只在存档头上)② 换装 / 导入写下的存档头带着导入者的属主戳(及其 fork 后代 —— fork 抄戳)⇒ **一次性**:
+ *    步 0 恢复先行(上一次被打断留下的快照逐份消化,`LocalSessionStore.settleArchiveSnapshots`;起服 `ensureSchema` 先调,迁移开头再调)· 步 1 枚举(引擎仓列表 ∪ 边档全部键;
+ *    只在边档里、头读不出的 ⇒ 点名 unreadable)· 步 2 行回填(列表里每只存档:格缺 ⇒ 建一格、属主「从没被记下」;格缺建档时刻 / 谱系 ⇒ 从存档头补;一次边档提交 + 文件与目录各 fsync,
+ *    在这之前不碰任何存档)· 步 3 存档归一(每只带戳存档,在它的会话写锁里):整档一次读 → 读时跳过了记录 ⇒ 留着(`records_skipped`)→ 引擎导入闸先验(带发言者归属)不过 ⇒ 留着
+ *    (`invalid`)→ 验后与原日志不逐条相等 ⇒ 留着(`normalizes`;迁移从不改内容)→ 快照记录(core `atomicWriteFile`)→ 以这一代为条件删存档 → 匿名导入 → 删快照。
+ *    留着的存档字节不动、点名(一行一条 warn);它们之后被 fork 拒、改日志的推送答 `conflict`(读、续跑、拉取照常),出路 = 删掉会话后重推。
+ *    **快照目录的常设拒启臂**(`assertNoArchiveSnapshots`,无窗;删码后仍在):起服时数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,`StoreBootRefusalError` 族)。
+ *    **回滚**:边档对象形一格是严格形,上一版不认 `createdAt` / `forkedFrom` 两键 ⇒ 读本版写过的边档严格拒启 —— 回滚的唯一支持形 = 恢复升级前的数据根备份(MIGRATION 写了:升级前备份、先停光旧副本)。
+ *    读数:`localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped`(点名数组 `{ sessionId, reason }`)/ `localArchivesUnreadable`(点名数组 `{ sessionId }`)/
+ *    `localArchiveSnapshotsRecovered`;只 local(SQL 恒零 / 空)。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒
@@ -424,6 +436,16 @@ export interface OneTimeMigrationReport {
     /** M32 local 腿:该回填放置、却读不出的会话 —— 有 run、存档读不出(会话头读不出 / 结构走不通 / 读存档文件时抛了别的故障:权限 / 磁盘 I/O / 超大)。一个字节没写,起服不挡:
      *  该会话的请求照旧答存档的故障;存档修好(从留存副本恢复,或权限 / 磁盘修好)后的下一次起服照常补放置。点名行数组(会话 id + 故障词,`storage` 再带 errno),一行一条 warn,每次起服都报直到处置。SQL 独有的反面:SQL 没有这一形(行就是会话);SQL 恒空。 */
     readonly executionPlacementSessionsUnreadable: readonly ExecutionPlacementSessionUnreadable[];
+    /** M33:本次补了行事实(建档时刻 / fork 谱系)的会话元数据格数(含为「有存档、没有格」的会话新建的格)。local 独有;SQL 恒 0。非零 = 真写了存量行。 */
+    readonly localArchiveRowFactsBackfilled: number;
+    /** M33:本次由带属主戳改写成匿名的存档数(条目逐条相等,内容不改)。local 独有;SQL 恒 0。非零 = 真写了存量存档。 */
+    readonly localArchivesAnonymized: number;
+    /** M33:留着带戳的存档(点名 + 原因,一行一条 warn,每次起服都报直到处置)。local 独有;SQL 恒空。 */
+    readonly localArchivesKeptStamped: readonly LocalArchiveKeptStamped[];
+    /** M33:存档读不出的会话(边档里有格而存档头读不出,或整档读抛;点名,一行一条 warn,每次起服都报直到处置)。local 独有;SQL 恒空。 */
+    readonly localArchivesUnreadable: readonly LocalArchiveUnreadable[];
+    /** M33:本次起服消化掉的快照记录数(上一次被打断的改写留下的;补回 / 丢弃)。local 独有;SQL 恒 0。 */
+    readonly localArchiveSnapshotsRecovered: number;
 }
 /** 退役的两只命令桶(引擎 7.51.0 起不是桶;只给 M17 点名认)。 */
 export type RetiredSessionRuleBucket = "commandAllow" | "commandDeny";
@@ -474,6 +496,24 @@ export interface ExecutionPlacementSessionUnreadable {
     /** 仅 `fault === "storage"` 且那只故障带字符串 `code` 时在场(`EACCES` / `EIO` / `ERR_STRING_TOO_LONG` ……)。 */
     readonly errno?: string;
 }
+/**
+ * M33 留着带戳的一只存档的原因(闭集):`invalid` = 引擎导入闸不收这份日志(重导会被拒);`normalizes` = 引擎导入会改写它的内容(重导不再逐条相等);
+ * `records_skipped` = 读这只存档时跳过了读不出的记录(重写会把盘上那几行字节抹掉)。三种都一个字节不动。
+ */
+export type LocalArchiveKeptReason = "invalid" | "normalizes" | "records_skipped";
+/** M33 留着带戳的一只存档:会话 id 是点名坐标 + 原因。日志内容与盘上路径不出店。 */
+export interface LocalArchiveKeptStamped {
+    readonly sessionId: string;
+    readonly reason: LocalArchiveKeptReason;
+    /** `reason: "invalid"` 时在场:引擎导入闸拒的那一句(条目 id + 结构毛病,不含条目内容)—— 运维据它找到挡住改写的那一条。 */
+    readonly detail?: string;
+}
+/** M33 读不出的一只:会话元数据边档里有它的格而存档头读不出(会话头坏),或列表读得出头、整档读抛。一个字节没写;会话的请求照旧答存档的故障。 */
+export interface LocalArchiveUnreadable {
+    readonly sessionId: string;
+    /** 读的时候抛的那只故障带串型 `code` 时在场(`EACCES` / `EIO` / `corrupt_session` …);盘上路径与故障句不出店。 */
+    readonly errno?: string;
+}
 /** 三个形读数(M9 主键 / M17 列名 / M24 scope 列)—— 那一步**落定**之前收据账里缺席(读数行要它们齐;被打断的那一行只带已落定的)。 */
 type ShapeReadingKey = "workflowParkIndexKey" | "sessionRuleColumn" | "workflowJournalScopeColumn";
 /**
@@ -544,8 +584,8 @@ export declare function migrationWindowOpen(window: Pick<OneTimeMigrationWindow,
  * 还没有日期可写)⇒ 响亮抛,不铸一句带空日期的句子。
  */
 export declare function migrationWindowEnd(id: string): string;
-/** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
-export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable">;
+/** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有、M33 只在 local,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
+export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
     warn(msg: string, meta?: Record<string, unknown>): void;

package/dist/plugins/one-time-migrations.js

@@ -55,6 +55,11 @@ export function buildMigrationReceipts() {
         executionPlacementsBackfilled: 0,
         askExecutionLanesBackfilled: 0,
         executionPlacementSessionsUnreadable: [],
+        localArchiveRowFactsBackfilled: 0,
+        localArchivesAnonymized: 0,
+        localArchivesKeptStamped: [],
+        localArchivesUnreadable: [],
+        localArchiveSnapshotsRecovered: 0,
     };
 }
 function completedReport(r) {
@@ -100,7 +105,12 @@ function changedAnything(r) {
         r.deviceBindingTablesDropped > 0 ||
         r.executionPlacementsBackfilled > 0 ||
         r.askExecutionLanesBackfilled > 0 ||
-        r.executionPlacementSessionsUnreadable.length > 0);
+        r.executionPlacementSessionsUnreadable.length > 0 ||
+        r.localArchiveRowFactsBackfilled > 0 ||
+        r.localArchivesAnonymized > 0 ||
+        r.localArchivesKeptStamped.length > 0 ||
+        r.localArchivesUnreadable.length > 0 ||
+        r.localArchiveSnapshotsRecovered > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -113,6 +123,8 @@ function readingsSnapshot(r) {
         parkedApprovalCardRowsUnreadable: [...r.parkedApprovalCardRowsUnreadable],
         parkedApprovalCardRowsTooLong: [...r.parkedApprovalCardRowsTooLong],
         executionPlacementSessionsUnreadable: [...r.executionPlacementSessionsUnreadable],
+        localArchivesKeptStamped: [...r.localArchivesKeptStamped],
+        localArchivesUnreadable: [...r.localArchivesUnreadable],
     };
 }
 function receiptSentence(r) {
@@ -381,7 +393,7 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "删 migrateOn 的 M23 步(`inheritPlacedSessionOwners`:placed ∧ 属主 NULL 的行按 session_id 键集分页单趟扫描 + 同一条语句连读根 / 父两行 + 按认领句回写属主)与 `PLACED_OWNER_SCAN_PAGE` / `placedOwnerScanSql` / `scannedPlacement` / `scannedFaces` / `scannedPlacedSources`(`isOrphanSessionOwner` 若再无别的读者一并删);" +
             "**同窗同删的另一半**(认领:按律给升级前写下的无主子代行写属主 —— 停驻挂点对宿主无主行做的就是本条对那一行的单行步):`delegated-session-owner.ts` 的 `CLAIM_OWNERLESS_PLACED_SQL` / `claimOwnerlessParams` / `OwnerlessClaim` / " +
             "`settleDelegatedOwner` 的认领一步(删后它只剩树比对与属主比对)/ `DelegationTreeStore.claimOwnerless`," +
-            "两只 SQL 店(`tidb-session-store.ts` / `pg-session-storage.ts`)的 `claimOwnerless`、`CachingSessionStore` 的转发、`OwnerAwareSessionStore.claimOwnerless`、`delegatedOwnerHostOf` 对它的「与 `placementOf` 同在或同缺」;" +
+            "两只 SQL 店(`tidb-session-store.ts` / `pg-session-storage.ts`)与 local 店(`local-session-store.ts` 的 `claimOwnerless` 字段与 `claimOwnerlessPlaced`)的 `claimOwnerless`、`CachingSessionStore` 的转发、`OwnerAwareSessionStore.claimOwnerless`、`delegatedOwnerHostOf` 对它的「与 `placementOf` 同在或同缺」;" +
             "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `placedSessionOwnersInherited` / `placedSessionOwnersOrphaned` / `placedSessionOwnersRemaining` 与 `placed_session_owners_orphaned` 那一行 warn;" +
             "`test/one-time-migrations.test.ts` 的 M23 组与 `test/one-time-migrations-db-integration.test.ts` 的 M23 格。" +
             "**不随本条删**:属主为 NULL 的 placed 行只对 fleet 调用方放行(`security.ts` 的 `ownerlessRowOpen` / `sessionOwnerCellOf` 与各门读 `placementOf` 的那一次)—— 那是常设的读面律",
@@ -531,6 +543,24 @@ export const ONE_TIME_MIGRATIONS = [
             "跳过了带本条的版本直接升的库响亮拒启,出路 = 先在带本条的版本起服一次让切换走完,再升;缺执行放置列的库由列集对账缺列拒启(`config.schema_mismatch`,拒句给 ALTER),同一出路",
         reportKeys: ["executionPlacementColumnsAdded", "deviceBindingsMoved", "deviceBindingsOrphaned", "deviceBindingTablesDropped", "executionPlacementsBackfilled", "askExecutionLanesBackfilled", "executionPlacementSessionsUnreadable"],
     },
+    {
+        id: "M33",
+        introducedIn: "7.141.0",
+        releasedOn: "2026-10-30",
+        removableAfter: "2026-11-29",
+        removal: "删 `LocalSessionStore.migrateLocalArchives` 与它的私有助手 `anonymizeArchiveHeld` / `fillRowFacts`、`settleArchiveSnapshots` 里除最后一句常设臂 `assertNoArchiveSnapshots(dir)` 以外的一切(逐份消化的循环与 `settleArchiveSnapshot`)、" +
+            "`archiveSnapshotsSettled` 字段、`syncArchiveDirectory`、`rowFactsFilled` / `ArchivedRowFacts` / `archivedRowFactsOf` / `ARCHIVE_SNAPSHOT_RECORD` / `ArchiveSnapshotRecord` / `readArchiveSnapshotRecord` / `sameLog` / " +
+            "`ArchiveRewriteStep` / `LocalArchiveMigrationReading` / `errnoOf`、" +
+            "`archiveRewriteReadScope` / `noteReplayInArchiveRewriteRead` 与 `createLocalSessionRepo` 座里调它的那一腿、`SidecarMap.syncToDisk`(若再无别的调用方)与 `fsyncPaths`(同);" +
+            "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里对 `migrateLocalArchives` 的调用与报告五键的那五行;本文件的 `LocalArchiveKeptReason` / `LocalArchiveKeptStamped` / `LocalArchiveUnreadable`、" +
+            "报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` 里的 `localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped` / `localArchivesUnreadable` / `localArchiveSnapshotsRecovered`、" +
+            "`local_archive_kept_stamped` / `local_archive_unreadable` 两行 warn、读数行 note 里的 M33 句与头注 M33 段;`test/local-archive-owner.test.ts` 里标题含 `P3` / `P4` / `P5` / `P6` / `F1` / `F2` / `F3` 的格与 `legacyRoot` / `writeArchive` / `boot` / `M33_ZERO` / `m33Of` 助手。" +
+            "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
+            "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店两处带戳判(fork 的源、改日志推送的落点)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
+        afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork 与改日志的推送同一只具名拒(409 `conflict` + 固定句,零写 / 行格净零写)," +
+            "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
+        reportKeys: ["localArchiveRowFactsBackfilled", "localArchivesAnonymized", "localArchivesKeptStamped", "localArchivesUnreadable", "localArchiveSnapshotsRecovered"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -1602,6 +1632,11 @@ function readingFields(r) {
         executionPlacementsBackfilled: r.executionPlacementsBackfilled,
         askExecutionLanesBackfilled: r.askExecutionLanesBackfilled,
         executionPlacementSessionsUnreadable: r.executionPlacementSessionsUnreadable.length,
+        localArchiveRowFactsBackfilled: r.localArchiveRowFactsBackfilled,
+        localArchivesAnonymized: r.localArchivesAnonymized,
+        localArchivesKeptStamped: r.localArchivesKeptStamped.length,
+        localArchivesUnreadable: r.localArchivesUnreadable.length,
+        localArchiveSnapshotsRecovered: r.localArchiveSnapshotsRecovered,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1650,7 +1685,12 @@ export function logOneTimeMigrations(log, backend, report) {
             "M32: session↔device bindings moved from the retired table device_session onto the root session rows (the table is first renamed device_session_retired, " +
             "the eight execution placement columns are added to session_meta, every binding overwrites the device placement of its root session row — a binding whose " +
             "root session row is gone is dropped and counted, named by a device_bindings_orphaned line — and the renamed table is dropped), and session rows that have " +
-            "runs but no execution placement placed on the only declared lane; once the switch is complete this step does nothing). Each step " +
+            "runs but no execution placement placed on the only declared lane; once the switch is complete this step does nothing; " +
+            "M33 (local backend only): each local session's creation time and fork lineage were copied from its stored archive into its session-metadata cell, and archives " +
+            "that still carried an importer's owner stamp were rewritten as anonymous with every entry kept as it was (a snapshot of the log is written before each rewrite " +
+            "and removed after it; an interrupted rewrite is finished from the snapshot on the next boot); an archive whose log the import check refuses, whose re-import would " +
+            "change its content, or whose read skipped unreadable records is left byte for byte as it was and named by a local_archive_kept_stamped line, and a session whose " +
+            "archive header cannot be read is named by a local_archive_unreadable line). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",
@@ -1658,6 +1698,28 @@ export function logOneTimeMigrations(log, backend, report) {
     logReceiptRows(log, backend, report);
 }
 function logReceiptRows(log, backend, r) {
+    for (const row of r.localArchivesKeptStamped) {
+        log.warn("local_archive_kept_stamped", {
+            backend,
+            sessionId: row.sessionId,
+            reason: row.reason,
+            ...(row.detail !== undefined ? { detail: row.detail } : {}),
+            note: "this local session's stored archive still carries the owner stamp an earlier version wrote, and the one-time migration that rewrites such archives as anonymous left it byte for byte as it was " +
+                "(reason invalid = the import check refuses its log; normalizes = re-importing would change its content; records_skipped = reading it skipped unreadable records, which a rewrite would erase). " +
+                "Reading, resuming and pulling the session work as before; forking it is refused and a push that changes its log answers 409 conflict. Way out: delete the session and push it again " +
+                "(a push onto an absent session creates it anew), or repair the archive under the data root's sessions directory. Named on every boot until then",
+        });
+    }
+    for (const row of r.localArchivesUnreadable) {
+        log.warn("local_archive_unreadable", {
+            backend,
+            sessionId: row.sessionId,
+            ...(row.errno !== undefined ? { errno: row.errno } : {}),
+            note: "this local session's stored archive cannot be read (its header, or the whole archive), so the one-time migration could neither copy its creation time into its session-metadata cell nor rewrite it; " +
+                "nothing was written. Every request that needs the session keeps answering the archive's own fault until the archive under the data root's sessions directory is restored from a kept copy " +
+                "(the next boot then migrates it) or the session is deleted. Named on every boot until then",
+        });
+    }
     if (r.deviceBindingsOrphaned > 0) {
         log.warn("device_bindings_orphaned", {
             backend,

package/dist/plugins/pg-pool.js

@@ -347,8 +347,9 @@ export const PG_SCHEMA_STATEMENTS = [
      enqueued_at_ms BIGINT       NOT NULL,
      -- 1.109 delivery envelope. kind NULL = a LEGACY \`workflow_complete\` row (the shape that predates the
      -- envelope); readers must keep treating NULL as that kind, it is not "unknown". payload = the kind's JSON
-     -- extras: task_notification: task_type / result / …; workflow_complete: at most {"completionId": …} (the
-     -- engine's own correlation id, verbatim; NULL when the engine minted none).
+     -- extras: task_notification: task_type / result / …; workflow_complete: at most {"completionId": …, "diagnostics": …}
+     -- (the engine's own correlation id, verbatim; the engine's diagnostic teaching text, redacted + bounded at enqueue;
+     -- each key absent when the engine minted none, NULL when neither).
      kind           VARCHAR(24) COLLATE "C",
      payload        TEXT COLLATE "C",
      PRIMARY KEY (session_id, run_id),

package/dist/plugins/pg-session-storage.d.ts

@@ -67,6 +67,8 @@ export declare class PgSessionStore implements SessionStore {
             readonly durability: "durable";
         };
     };
+    /** 会话耐久声明(TiDB 孪生同格,同一只常量 {@link SESSION_DURABILITY};理由见 `session-placement.ts` 的常量注)。 */
+    readonly durability: "durable";
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) in one process share one. */
     private readonly pending;
     /** 委派子代孤行那一行 warn 的去处(TiDB 孪生同格)。 */

package/dist/plugins/pg-session-storage.js

@@ -8,7 +8,7 @@ import { scanEpochAnchor } from "./session-epoch-anchor.js";
 import { jsonColumnText } from "./sql-json-column.js";
 import { pgSafeJsonStringify } from "./pg-safe-json.js";
 import { toIso } from "./sql-row-helpers.js";
-import { placementCapabilityOf, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SQL_SESSION_PLACEMENTS, } from "./session-placement.js";
+import { placementCapabilityOf, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SESSION_DURABILITY, SESSION_PLACEMENTS, } from "./session-placement.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, createPlacedSessionRow } from "../delegated-session-owner.js";
 import { createLogger } from "../observability/logger.js";
@@ -188,7 +188,8 @@ export class PgSessionStorage extends BaseSessionStorage {
 export class PgSessionStore {
     pool;
     retention;
-    placements = SQL_SESSION_PLACEMENTS;
+    placements = SESSION_PLACEMENTS;
+    durability = SESSION_DURABILITY;
     pending = new Map();
     log;
     executionPlacement;

package/dist/plugins/remote-env-e2b.d.ts

@@ -20,7 +20,9 @@
  * iterator MAY throw `RemoteExecutionError` mid-stream before an `exit` chunk (seam contract, OutputChunk).
  */
 import { Sandbox, type SandboxOpts, type SandboxConnectOpts } from "e2b";
-import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type ExecutionEnvFactory, type VmLifecycleOptions, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll } from "@sema-agent/core";
+import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type ExecutionEnvFactory, type VmLifecycleOptions, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll, type ExecutionEnvCapabilities } from "@sema-agent/core";
+import { type SandboxReadFloorKnob } from "../execution-lane-caps.js";
+import { type SandboxReadFloor } from "./sandbox-read-floor.js";
 import { type LaneHomeConfig } from "../lane-home-probe.js";
 /** Options accepted by `ExecutionEnv.exec` (core does not re-export the type; derive it from the seam). */
 type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
@@ -71,6 +73,8 @@ export interface RemoteContainerEnvConfig extends RemoteEnvObservers, LaneHomeCo
      *  create/connect) — wider than {@link rpcTimeoutMs} so a legit multi-minute transfer is not killed. Default
      *  {@link DEFAULT_DATA_TIMEOUT_MS}. */
     dataTimeoutMs?: number;
+    /** `SANDBOX_READ_FLOOR`(keep | off;缺席 ⇒ keep):本沙箱守不守读拒表的字节地板 = 读地板模块服务本车道 ∧ 本键不是 off(`sandbox-read-floor.ts`)。 */
+    sandboxReadFloor?: SandboxReadFloorKnob;
 }
 /** Minimal slice of the E2B `Sandbox` static API the adapter uses — injectable so tests pass a fake. */
 export interface SandboxApi {
@@ -80,6 +84,8 @@ export interface SandboxApi {
 /** Inject the E2B SDK for tests (a fake `Sandbox`). Defaults to the real SDK. */
 export interface RemoteContainerEnvDeps {
     sandboxApi?: SandboxApi;
+    /** 这只环境手里的读地板模块(缺席 ⇒ `createSandboxReadFloor` 按旋钮选;钉注入守地板的模块)。能力块的 `keepsReadFloor` 读它的状态。 */
+    readFloor?: SandboxReadFloor;
 }
 /**
  * E2B-backed remote `ExecutionEnv`. **Lazy by default (v1b):** the VM is provisioned on the
@@ -130,8 +136,20 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
      *  SAME env instance skips the reconnect and every later fs/exec runs against the dead VM. */
     private paused;
     constructor(config: RemoteContainerEnvConfig, deps?: RemoteContainerEnvDeps);
-    /** 能力块的唯一作者 = `capabilitiesFor`(`execution-lane-caps.ts`;逐键表态与理由在那里,本类零能力字面量)。 */
-    readonly capabilities: import("@sema-agent/core").ExecutionEnvCapabilities;
+    /** 能力块的唯一作者 = `capabilitiesFor`(`execution-lane-caps.ts`;逐键表态与理由在那里,本类零能力字面量)。读地板旋钮是它的输入,{@link floor} 由同一只判据、同一个旋钮值选出。 */
+    readonly capabilities: ExecutionEnvCapabilities;
+    /** 读拒表字节地板模块:沙箱里每一次 `commands.run` 起动都先经它的 `wrap`({@link startIn} → {@link runIn},唯一接缝)。 */
+    private readonly floor;
+    /**
+     * **唯一起动接缝(上半)**:一次起动 → 地板模块 `wrap` → e2b 编码(身份 + 命令行;不守地板 ⇒ 命令与每命令 env 原样,与改前逐字同)。
+     * 本适配器对地板零判断;模块拒 ⇒ `spawn_error`,命令从未起。
+     */
+    private startIn;
+    /** **唯一起动接缝(下半)**:本文件里每一次 `commands.run`(中继除外:那是地板模块自己的进程)都经这里,身份与 env 只取起动编码。 */
+    private runIn;
+    /** 地板模块的三件原语。引导命令经 {@link startIn}(起动形 `bootstrap`:只在附着中合法);放置 = root 建目录 → `files.write`(root)写暂存件 →
+     *  root `chmod 0755 && mv -f`;中继 = 以模块给的身份起一只长连后台命令(stdin 开着:`sendStdin` 写答,stdout 回调读问)。 */
+    private floorTransport;
     workspaceHandle(): WorkspaceHandle;
     /**
      * Public host for a port inside the sandbox (E2B reverse proxy → `<port>-<id>.e2b.app`). The LSP sidecar
@@ -224,6 +242,9 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
             shellId: string;
         };
     }, ExecutionError>>;
+    /** 适配器自己的固定命令(文件面助手:readlink / realpath / rm / mktemp / 暂存写的提交)—— 与 {@link exec} 同一条路,起动形 `adapter`。 */
+    private execInternal;
+    private execAs;
     execStream(command: string, options?: ExecStreamOptions): AsyncIterable<OutputChunk>;
     readonly backgroundCapabilities: {
         readonly supported: true;