@sema-agent/server 7.141.0 → 7.142.0

package/dist/plugins/local-task-attachment-store.js

@@ -1,6 +1,6 @@
 import { promises as fsp } from "node:fs";
 import { join } from "node:path";
-import { TaskAttachmentRecordSchema } from "./task-attachment-store.js";
+import { bindRowsInProcess, TaskAttachmentRecordSchema } from "./task-attachment-store.js";
 import { createZodColumnReader, decodeJsonColumn } from "./sql-json-column.js";
 const ID_RE = /^[0-9a-f-]{16,64}$/i;
 const readAttachmentMeta = createZodColumnReader(TaskAttachmentRecordSchema);
@@ -8,6 +8,7 @@ export class LocalTaskAttachmentStore {
     dir;
     metas;
     hydration;
+    mutationTail = Promise.resolve();
     constructor(rootDir) {
         this.dir = join(rootDir, "attachments");
     }
@@ -37,17 +38,24 @@ export class LocalTaskAttachmentStore {
         })();
         return this.hydration;
     }
-    async put(rec) {
-        const metas = await this.hydrate();
-        await fsp.mkdir(this.dir, { recursive: true });
-        const { content, ...meta } = rec;
-        const binTmp = join(this.dir, `${rec.id}.bin.tmp`);
-        const metaTmp = join(this.dir, `${rec.id}.json.tmp`);
-        await fsp.writeFile(binTmp, Buffer.from(content));
-        await fsp.rename(binTmp, join(this.dir, `${rec.id}.bin`));
-        await fsp.writeFile(metaTmp, JSON.stringify(meta));
-        await fsp.rename(metaTmp, join(this.dir, `${rec.id}.json`));
-        metas.set(rec.id, { ...meta });
+    serialized(op) {
+        const run = this.mutationTail.then(op);
+        this.mutationTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    put(rec) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            await fsp.mkdir(this.dir, { recursive: true });
+            const { content, ...meta } = rec;
+            const binTmp = join(this.dir, `${rec.id}.bin.tmp`);
+            const metaTmp = join(this.dir, `${rec.id}.json.tmp`);
+            await fsp.writeFile(binTmp, Buffer.from(content));
+            await fsp.rename(binTmp, join(this.dir, `${rec.id}.bin`));
+            await fsp.writeFile(metaTmp, JSON.stringify(meta));
+            await fsp.rename(metaTmp, join(this.dir, `${rec.id}.json`));
+            metas.set(rec.id, { ...meta });
+        });
     }
     async get(owner, id) {
         const m = (await this.hydrate()).get(id);
@@ -69,19 +77,29 @@ export class LocalTaskAttachmentStore {
         await fsp.writeFile(tmp, JSON.stringify(m));
         await fsp.rename(tmp, join(this.dir, `${m.id}.json`));
     }
-    async bind(owner, ids, sessionId, boundAtMs) {
-        const metas = await this.hydrate();
-        let bound = 0;
-        for (const id of ids) {
-            const m = metas.get(id);
-            if (!m || m.owner !== owner)
-                continue;
-            m.sessionId = sessionId;
-            m.boundAtMs = boundAtMs;
-            await this.persistMeta(m);
-            bound++;
-        }
-        return bound;
+    bind(owner, ids, sessionId, boundAtMs) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            const draft = new Map(metas);
+            for (const id of new Set(ids)) {
+                const row = metas.get(id);
+                if (row !== undefined)
+                    draft.set(id, { ...row });
+            }
+            const { outcome, claimed } = bindRowsInProcess(draft, owner, ids, sessionId, boundAtMs);
+            const landed = [];
+            try {
+                for (const m of claimed) {
+                    await this.persistMeta(m);
+                    landed.push(m);
+                }
+            }
+            finally {
+                for (const m of landed)
+                    metas.set(m.id, m);
+            }
+            return outcome;
+        });
     }
     async listBySession(sessionId) {
         const metas = await this.hydrate();
@@ -95,26 +113,32 @@ export class LocalTaskAttachmentStore {
         await fsp.rm(join(this.dir, `${id}.bin`), { force: true });
         this.metas?.delete(id);
     }
-    async delete(owner, id) {
-        const m = (await this.hydrate()).get(id);
-        if (!m || m.owner !== owner)
-            return false;
-        await this.removeRow(id);
-        return true;
+    delete(owner, id) {
+        return this.serialized(async () => {
+            const m = (await this.hydrate()).get(id);
+            if (!m || m.owner !== owner)
+                return false;
+            await this.removeRow(id);
+            return true;
+        });
     }
-    async deleteBySession(sessionId) {
-        const metas = await this.hydrate();
-        const hit = [...metas.values()].filter((m) => m.sessionId === sessionId);
-        for (const m of hit)
-            await this.removeRow(m.id);
-        return hit.length;
+    deleteBySession(sessionId) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            const hit = [...metas.values()].filter((m) => m.sessionId === sessionId);
+            for (const m of hit)
+                await this.removeRow(m.id);
+            return hit.length;
+        });
     }
-    async reapUnbound(olderThanMs) {
-        const metas = await this.hydrate();
-        const hit = [...metas.values()].filter((m) => m.sessionId === undefined && m.createdAtMs < olderThanMs);
-        for (const m of hit)
-            await this.removeRow(m.id);
-        return hit.length;
+    reapUnbound(olderThanMs) {
+        return this.serialized(async () => {
+            const metas = await this.hydrate();
+            const hit = [...metas.values()].filter((m) => m.sessionId === undefined && m.createdAtMs < olderThanMs);
+            for (const m of hit)
+                await this.removeRow(m.id);
+            return hit.length;
+        });
     }
 }
 //# sourceMappingURL=local-task-attachment-store.js.map

package/dist/plugins/memory-key-guards.d.ts

@@ -15,9 +15,9 @@ export declare const MEMORY_SLUG_COLUMN_CHARS = 512;
  *  sync_cursor/push_queue/history)。`formatUserScope`/`formatProjScope` 的段编码(百分号转义)会
  *  **膨胀**——非 ASCII principal 编码后可超列宽,故产出处与写口两道都要判。 */
 export declare const MEMORY_SCOPE_COLUMN_CHARS = 190;
-/** memory-sync 店 `sync_cursor.peer` 列宽(两方言 VARCHAR(190) 同宽)—— 中心侧请求的 `peer` 落这一列。两个读者:中心侧验型
- *  (`memory-sync.ts` `parseMemorySyncRequest`,超宽 400)与客户端的身份铸点(`memory-sync-client.ts` `memorySyncPeerOf`,超宽拒启:
- *  身份就是请求的 `peer`,装不进这一列的身份每一轮都会被中心拒)。 */
+/** memory-sync 店 `sync_cursor.peer` 列宽(两方言 VARCHAR(190) 同宽)—— 中心侧请求的 `peer` 落这一列。唯一读者 = 同步身份的铸点
+ *  (`memory-sync-identity.ts` `readMemorySyncIdentity`:规范化之后超宽 = `too-long`)—— 它的四个座位(客户端 `MEMORY_SYNC_URL` 拒启、中心声明
+ *  `MEMORY_SYNC_SERVE_IDENTITY` 拒启、会话触发的 `target` 400、中心入站的 `peer` 400)由此同宽:身份就是请求的 `peer`,装不进这一列的身份每一轮都会被中心拒。 */
 export declare const MEMORY_SYNC_PEER_COLUMN_CHARS = 190;
 export declare function assertSlugWidth(slug: string): void;
 export declare function assertMemoryScopeWidth(scope: string): void;

package/dist/plugins/memory-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskStatus } from "@sema-agent/core";
-import { type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef } from "./store-contracts.js";
+import { type FenceLanded, type FencedRun, type InProcessClaimFence, type CreateRunOutcome, type NewRunMeta, type RunIdemBinding, type RunListQuery, type RunRecord, type SessionSummary, type RunEvent, type PersistedTaskResult, type LatestRunRef, type SettledLegMemoryObservation } from "./store-contracts.js";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 import { type SpaceCommitClaim, type SpaceCommitReading, type SpaceCommitState } from "../workspace-space-commit.js";
 /**
@@ -92,6 +92,11 @@ export declare class MemoryRunStore implements InProcessClaimFence {
      *  `createdAt DESC, taskId DESC`,与本店 {@link MemoryRunStore.listSessions} 挑 `rn=1` 那一行的比较器逐字同一份)。
      */
     latestRunForSession(sessionId: string): Promise<LatestRunRef | undefined>;
+    /**
+     * [ref] —— 这个会话**最近一条已结腿**与它的记忆观测(规则属主 = `store-contracts.ts` 的 {@link SettledLegMemoryObservation};
+     * {@link SqlRunStore.latestMemoryObservationForSession} 的孪生:同一只已结谓词(`isTerminalRunStatus`)、同一个排序口径 —— 与本店 {@link MemoryRunStore.latestRunForSession} 的比较器逐字同一份)。
+     */
+    latestMemoryObservationForSession(sessionId: string): Promise<SettledLegMemoryObservation | undefined>;
     /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
     listSessions(opts: {
         owner?: string;

package/dist/plugins/memory-run-store.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactLedgerEventData, sealRunRowResult } from "../observability/run-terminal.js";
 import { outwardPlane } from "../terminal.js";
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR } from "./store-contracts.js";
+import { RUN_HOLDER_DEATH_CODES, RUN_STALLED_ERROR, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { createInProcessSpaceCommitTable, fenceSpaceCommitAtTerminal } from "../workspace-space-commit.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
@@ -273,6 +273,16 @@ export class MemoryRunStore {
         }
         return latest === undefined ? undefined : { taskId: latest.taskId, owner: latest.owner, createdAt: latest.createdAt.toISOString() };
     }
+    async latestMemoryObservationForSession(sessionId) {
+        let latest;
+        for (const r of this.runs.values()) {
+            if (r.sessionId !== sessionId || !isTerminalRunStatus(r.status))
+                continue;
+            if (latest === undefined || r.createdAt.getTime() > latest.createdAt.getTime() || (r.createdAt.getTime() === latest.createdAt.getTime() && r.taskId > latest.taskId))
+                latest = r;
+        }
+        return latest === undefined ? undefined : settledLegObservationOf(latest.taskId, latest.result);
+    }
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {

package/dist/plugins/one-time-migrations.d.ts

@@ -328,6 +328,16 @@
  *    **回滚**:边档对象形一格是严格形,上一版不认 `createdAt` / `forkedFrom` 两键 ⇒ 读本版写过的边档严格拒启 —— 回滚的唯一支持形 = 恢复升级前的数据根备份(MIGRATION 写了:升级前备份、先停光旧副本)。
  *    读数:`localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped`(点名数组 `{ sessionId, reason }`)/ `localArchivesUnreadable`(点名数组 `{ sessionId }`)/
  *    `localArchiveSnapshotsRecovered`;只 local(SQL 恒零 / 空)。
+ *  · **M34 问账行成因两列**(7.142.0)—— ≤7.141.x 的 `approval_ask` 只有一列 `denied_reason`,按行的 state 承载两种意思(PARKING / PARKED 行上是转 park 的触发成因,VOID / DENIED 行上是
+ *    终态成因),对账器把 PARKING 行收成 DENIED / VOID 时终态成因**覆盖**了触发成因。本版一列一义:`ending_cause`(终态成因)+ `park_trigger`(触发成因,只由 expire claim 写一次)。
+ *    **SQL 两方言**({@link splitApprovalAskCauseColumns},锁内,M18 之后):① `denied_reason` 在 ⇒ 改名成 `ending_cause`(MySQL 协议 `CHANGE COLUMN`、PG `RENAME COLUMN`;后置条件 `execUntil`)——
+ *    改名让滚动窗里的旧副本对这张表的每一条读写**响亮失败**(它们的列清单点名 `denied_reason`),而不是把触发词写进终态列;② `park_trigger` 不在 ⇒ 加列;
+ *    ③ PARKING / PARKED 行上那一格搬进 `park_trigger`(`park_trigger IS NULL` 才搬),再把这两态上的 `ending_cause` 置空(两句各自幂等;第二跑起零命中)。
+ *    中断 ⇒ 下一次起服从首个未满足的后置条件续(钉:真库在改名之后续跑收敛)。终态行上被覆盖掉的触发词没有出处可补 —— 如实缺席。
+ *    **local 车道**(File 问账日志):信封号 1 → 2;窗内读侧半场按意义译 v1 记录(`approval-ask-store-file.ts` 的 `translateJournalV1Record`),
+ *    起服迁移的 local 腿(`FileApprovalAskStore.upgradeJournalEnvelope`)一次压实把整本重写成 v2。
+ *    **回滚**:7.141.x 对改名后的表每一条读写都响亮失败、对 v2 日志拒启 —— 回滚的唯一支持形 = 恢复升级前的备份,或手工把列改回(MIGRATION 写了语句)。
+ *    读数:`askCauseColumnsChanged`(0–2 处表形改动)/ `askParkTriggersMoved`(SQL;local 恒 0)/ `askJournalRecordsUpgraded`(local;SQL 恒 0)。
  *
  * ## 收据账(一次起服一只,每一条迁移同一只)
  * 每一步把它**已提交**的改写 / 删除与点名读数当场记进同一只收据账({@link MigrationReceipts}):计数随每次提交累加、行随每次提交追加、形读数在那一步落定时写。走完 ⇒
@@ -446,6 +456,12 @@ export interface OneTimeMigrationReport {
     readonly localArchivesUnreadable: readonly LocalArchiveUnreadable[];
     /** M33:本次起服消化掉的快照记录数(上一次被打断的改写留下的;补回 / 丢弃)。local 独有;SQL 恒 0。 */
     readonly localArchiveSnapshotsRecovered: number;
+    /** M34:本次对 `approval_ask` 成因列做的表形改动数(改名 `denied_reason → ending_cause`、加 `park_trigger`;0–2)。非零 = 这次真改了表形。SQL 独有;local 恒 0。 */
+    readonly askCauseColumnsChanged: number;
+    /** M34:本次把那一格从 `ending_cause` 搬进 `park_trigger` 的 PARKING / PARKED 行数。非零 = 真写了存量行。SQL 独有;local 恒 0。 */
+    readonly askParkTriggersMoved: number;
+    /** M34 local 腿:问账日志里信封号 1 的记录数(窗内读侧已按意义译读;本次一次压实把整本重写成 v2)。非零 = 真重写了日志。local 独有;SQL 恒 0。 */
+    readonly askJournalRecordsUpgraded: number;
 }
 /** 退役的两只命令桶(引擎 7.51.0 起不是桶;只给 M17 点名认)。 */
 export type RetiredSessionRuleBucket = "commandAllow" | "commandDeny";
@@ -585,7 +601,7 @@ export declare function migrationWindowOpen(window: Pick<OneTimeMigrationWindow,
  */
 export declare function migrationWindowEnd(id: string): string;
 /** local 车道上 SQL 独有的几条(M8 / M9 / M11 / M17 / M18 / M21 / M23 / M24 / M26 / M27 / M29)的读数(M6 与 M32 的回填两车道都有、M33 只在 local,local 腿的读数由 `LocalBackend.runOneTimeMigrations` 现算):那几张表 / 列在文件底座上从来不存在 ⇒ 如实答 absent / 0。 */
-export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered">;
+export declare const NO_SQL_MIGRATIONS: Omit<OneTimeMigrationReport, "holderDeathCodeRowsBackfilled" | "executionPlacementsBackfilled" | "askExecutionLanesBackfilled" | "executionPlacementSessionsUnreadable" | "localArchiveRowFactsBackfilled" | "localArchivesAnonymized" | "localArchivesKeptStamped" | "localArchivesUnreadable" | "localArchiveSnapshotsRecovered" | "askJournalRecordsUpgraded">;
 /** 启动期的日志口(logger 的子集)。两级各有其用,见 {@link logOneTimeMigrations}。 */
 export interface MigrationLogSink {
     warn(msg: string, meta?: Record<string, unknown>): void;
@@ -619,6 +635,16 @@ export interface MigrationDb {
  * `createStoreBackend()` → `ensureSchema()` → `runOneTimeMigrations()` 的嵌入方与本服务的起服序列一样,有这一问、零动作。
  */
 export declare function runSqlOneTimeMigrations(dialect: SqlDialect, pool: MysqlPool | PgPool, input: ExecutionPlacementSwitchInput): Promise<OneTimeMigrationReport>;
+/**
+ * M34 —— 问账行成因两列(判据与形见头注 M34 段)。三步,每一步先读形再判,DDL 按后置条件收敛({@link execUntil}),中断 ⇒ 下一次起服从首个未满足的后置条件续:
+ *  ① `denied_reason` 在 ⇒ 改名成 `ending_cause`(后置条件:旧名不在 ∧ 新名在)—— 改名让滚动窗里的旧副本对这张表的每一条读写响亮失败;
+ *  ② `park_trigger` 不在 ⇒ 加列(列定义 = 建表 DDL 内联的同一份);
+ *  ③ PARKING / PARKED 行:`ending_cause` 里的词搬进 `park_trigger`(只搬 `park_trigger IS NULL` 的行),再把这两态上的 `ending_cause` 置空。两句而不是一句
+ *     `SET park_trigger = ending_cause, ending_cause = NULL`:一句的结果取决于赋值的求值次序(MySQL 协议方言按左到右读已改的值,PG 读原行),两句不依赖它;两句各自幂等,
+ *     中间被打断 ⇒ 下一次起服第一句零命中、第二句收尾(这期间读口照旧:终态成因读口在这两态上不作数)。本版写者不会在这两态上写终态成因 ⇒ 第二跑起两句都零命中。
+ * 表不在(中央 DDL 之前被调到)⇒ 零动作。读数:①② 各记 `askCauseColumnsChanged` +1;③ 第一句的受影响行数记 `askParkTriggersMoved`。
+ */
+export declare function splitApprovalAskCauseColumns(db: MigrationDb, dialect: SqlDialect, receipts: MigrationReceipts): Promise<void>;
 /** M32 的起服拒码(确定的拒启表态:再等也等不来另一个答案;不是线上 wire 码,与 `config.schema_mismatch` 同一族)。 */
 export declare const EXECUTION_PLACEMENT_SWITCH_REFUSED_CODE = "config.execution_placement_switch_refused";
 /** 拒因闭集:`fence` = 切换开始之后退役绑定表里又出现了行(旧版副本 / 手工写下的);`backfill_ambiguous` = 车道表不止一项而还有要回填的存量。 */

package/dist/plugins/one-time-migrations.js

@@ -17,7 +17,7 @@ import { redactSecrets } from "../trace/redact.js";
 import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, isOrphanSessionOwner, judgeDelegatedOwner } from "../delegated-session-owner.js";
 import { MAILBOX_KEYED_TABLES, mailboxKeyDeleteSql, storedMailboxKeyless } from "./mailbox-store-sql.js";
 import { SESSION_META_PLACEMENT_COLUMNS, backfillWriterStatement, countOrphanBindingsStatement, migrateDeviceBindingsStatement } from "./execution-placement-sql.js";
-import { APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
+import { APPROVAL_ASK_ENDING_CAUSE_COLUMN, APPROVAL_ASK_EXECUTION_LANE_COLUMN, APPROVAL_ASK_PARK_TRIGGER_COLUMN, APPROVAL_ASK_TABLE } from "./approval-ask-store-sql.js";
 import { isUnusableArchive } from "../execution-placement.js";
 const RETIRED_SESSION_RULE_BUCKETS = ["commandAllow", "commandDeny"];
 export function buildMigrationReceipts() {
@@ -60,6 +60,9 @@ export function buildMigrationReceipts() {
         localArchivesKeptStamped: [],
         localArchivesUnreadable: [],
         localArchiveSnapshotsRecovered: 0,
+        askCauseColumnsChanged: 0,
+        askParkTriggersMoved: 0,
+        askJournalRecordsUpgraded: 0,
     };
 }
 function completedReport(r) {
@@ -110,7 +113,10 @@ function changedAnything(r) {
         r.localArchivesAnonymized > 0 ||
         r.localArchivesKeptStamped.length > 0 ||
         r.localArchivesUnreadable.length > 0 ||
-        r.localArchiveSnapshotsRecovered > 0);
+        r.localArchiveSnapshotsRecovered > 0 ||
+        r.askCauseColumnsChanged > 0 ||
+        r.askParkTriggersMoved > 0 ||
+        r.askJournalRecordsUpgraded > 0);
 }
 function readingsSnapshot(r) {
     return {
@@ -561,6 +567,22 @@ export const ONE_TIME_MIGRATIONS = [
             "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
         reportKeys: ["localArchiveRowFactsBackfilled", "localArchivesAnonymized", "localArchivesKeptStamped", "localArchivesUnreadable", "localArchiveSnapshotsRecovered"],
     },
+    {
+        id: "M34",
+        introducedIn: "7.142.0",
+        releasedOn: "2026-10-30",
+        removableAfter: "2026-11-29",
+        removal: "删 migrateStepsOn 的 M34 步(`splitApprovalAskCauseColumns`、`RETIRED_ASK_CAUSE_COLUMN`、`renameAskCauseColumnSql`)与本文件的 `askCauseColumnsChanged` / `askParkTriggersMoved` / `askJournalRecordsUpgraded`" +
+            "(报告 / 收据 / `changedAnything` / `readingFields` / `NO_SQL_MIGRATIONS` 与读数行 note 里的 M34 句、头注 M34 段);`approval-ask-store-file.ts` 的 v1 读侧半场 " +
+            "(`translateJournalV1Record`、`JOURNAL_V1_ENVELOPE`、`V1_ENDING_STATES` / `V1_TRIGGER_STATES`、`replayRecord` 里认 v1 的那两行与 `journalV1Records`)与 local 腿 `upgradeJournalEnvelope`、" +
+            "`store-backend.ts` 的 `LocalBackend.runOneTimeMigrations` 里报 `askJournalRecordsUpgraded` 的那一行;`test/approval-ask-store-db-integration.test.ts` 的 M34 组与 " +
+            "`test/approval-ask-cause-columns.test.ts` 里标题含 ⑤ 与 local 腿读数的格。**不随本条删**:两列与它们的列定义(`APPROVAL_ASK_ENDING_CAUSE_COLUMN` / `APPROVAL_ASK_PARK_TRIGGER_COLUMN`)、" +
+            "两只读口(`askRowEndingCause` / `askRowParkTrigger`)、信封号 2 与「认不出的信封号 ⇒ 拒启」那一臂(常设的数据形)",
+        afterRemoval: "两只常设臂接住:① SQL —— 删码同版把 `approval_ask.denied_reason` 加进退役 schema 判据(`schema-consistency.ts` 的跳版库探针,先于建表)⇒ 跳过了带本条的版本直接升的库响亮拒启," +
+            "出路 = 先在带本条的版本起服一次让迁移走完,再升(列册对账见幽灵列 / 缺列同样拒启,但它的拒句给的是加列,不是这一出路 —— 所以退役判据要在删码同版加上);" +
+            "② local —— 信封号 1 的日志记录走 File 问账店「认不出的信封号」拒启(`unknown envelope version`,点名文件与出路:用写下它的那一版起服一次,或移开文件)",
+        reportKeys: ["askCauseColumnsChanged", "askParkTriggersMoved", "askJournalRecordsUpgraded"],
+    },
 ];
 export function migrationWindowOpen(window, today) {
     return window.removableAfter === null || today <= window.removableAfter;
@@ -606,6 +628,8 @@ export const NO_SQL_MIGRATIONS = {
     deviceBindingsMoved: 0,
     deviceBindingsOrphaned: 0,
     deviceBindingTablesDropped: 0,
+    askCauseColumnsChanged: 0,
+    askParkTriggersMoved: 0,
 };
 function mysqlDb(conn) {
     return {
@@ -701,6 +725,7 @@ async function migrateStepsOn(db, dialect, receipts, input) {
         : "UPDATE task_run SET error_code = $1 WHERE status = 'failed' AND error_code IS NULL AND (error = $2 OR error LIKE $3)", [RUN_HOLDER_DEATH_CODES.orphaned, RUN_ORPHANED_ERROR, `${RUN_ORPHANED_ERROR} (%`]);
     await migrateShadowedRuleKey(db, dialect, receipts);
     await migrateRetiredCardWords(db, dialect, receipts);
+    await splitApprovalAskCauseColumns(db, dialect, receipts);
     await reshapeWorkflowParkIndex(db, dialect, receipts);
     await migrateSessionRuleGrammar(db, dialect, receipts);
     await repairParkedRows(db, dialect, receipts);
@@ -715,6 +740,28 @@ async function migrateStepsOn(db, dialect, receipts, input) {
     await dropRejectedMailboxKeys(db, dialect, receipts);
     await switchExecutionPlacement(db, dialect, receipts, input);
 }
+const RETIRED_ASK_CAUSE_COLUMN = "denied_reason";
+function renameAskCauseColumnSql(dialect) {
+    return dialect === "mysql"
+        ? `ALTER TABLE ${APPROVAL_ASK_TABLE} CHANGE COLUMN ${RETIRED_ASK_CAUSE_COLUMN} ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.mysql}`
+        : `ALTER TABLE ${APPROVAL_ASK_TABLE} RENAME COLUMN ${RETIRED_ASK_CAUSE_COLUMN} TO ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.name}`;
+}
+export async function splitApprovalAskCauseColumns(db, dialect, receipts) {
+    if (!(await tableExists(db, dialect, APPROVAL_ASK_TABLE)))
+        return;
+    const has = (column) => columnExists(db, dialect, APPROVAL_ASK_TABLE, column);
+    if (await has(RETIRED_ASK_CAUSE_COLUMN)) {
+        await execUntil(db, renameAskCauseColumnSql(dialect), async () => !(await has(RETIRED_ASK_CAUSE_COLUMN)) && (await has(APPROVAL_ASK_ENDING_CAUSE_COLUMN.name)));
+        receipts.askCauseColumnsChanged += 1;
+    }
+    if (!(await has(APPROVAL_ASK_PARK_TRIGGER_COLUMN.name))) {
+        await execUntil(db, `ALTER TABLE ${APPROVAL_ASK_TABLE} ADD COLUMN ${APPROVAL_ASK_PARK_TRIGGER_COLUMN[dialect]}`, () => has(APPROVAL_ASK_PARK_TRIGGER_COLUMN.name));
+        receipts.askCauseColumnsChanged += 1;
+    }
+    receipts.askParkTriggersMoved += await db.exec(`UPDATE ${APPROVAL_ASK_TABLE} SET ${APPROVAL_ASK_PARK_TRIGGER_COLUMN.name} = ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.name} ` +
+        `WHERE state IN ('PARKING', 'PARKED') AND ${APPROVAL_ASK_PARK_TRIGGER_COLUMN.name} IS NULL AND ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.name} IS NOT NULL`);
+    await db.exec(`UPDATE ${APPROVAL_ASK_TABLE} SET ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.name} = NULL WHERE state IN ('PARKING', 'PARKED') AND ${APPROVAL_ASK_ENDING_CAUSE_COLUMN.name} IS NOT NULL`);
+}
 const RETIRED_DEVICE_BINDING_TABLE = "device_session";
 const PARKED_DEVICE_BINDING_TABLE = "device_session_retired";
 const BINDING_COLUMNS = "root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev";
@@ -1637,6 +1684,9 @@ function readingFields(r) {
         localArchivesKeptStamped: r.localArchivesKeptStamped.length,
         localArchivesUnreadable: r.localArchivesUnreadable.length,
         localArchiveSnapshotsRecovered: r.localArchiveSnapshotsRecovered,
+        askCauseColumnsChanged: r.askCauseColumnsChanged,
+        askParkTriggersMoved: r.askParkTriggersMoved,
+        askJournalRecordsUpgraded: r.askJournalRecordsUpgraded,
     };
 }
 export function logOneTimeMigrations(log, backend, report) {
@@ -1690,7 +1740,11 @@ export function logOneTimeMigrations(log, backend, report) {
             "that still carried an importer's owner stamp were rewritten as anonymous with every entry kept as it was (a snapshot of the log is written before each rewrite " +
             "and removed after it; an interrupted rewrite is finished from the snapshot on the next boot); an archive whose log the import check refuses, whose re-import would " +
             "change its content, or whose read skipped unreadable records is left byte for byte as it was and named by a local_archive_kept_stamped line, and a session whose " +
-            "archive header cannot be read is named by a local_archive_unreadable line). Each step " +
+            "archive header cannot be read is named by a local_archive_unreadable line; " +
+            "M34: the approval ask table's single cause column denied_reason — the reason a row was moved to the delivery surface while it is PARKING or PARKED, " +
+            "the reason it ended without a human answer while it is VOID or DENIED, overwritten by the second when a parked row was closed — renamed ending_cause, " +
+            "a column park_trigger added, and the word on PARKING and PARKED rows moved into park_trigger; on the local backend the approval ask journal is rewritten " +
+            "once with record envelope 2, its envelope-1 records read with the same meaning). Each step " +
             "runs on every boot until its window closes (the release that introduced it + 30 days; the per-step date is in " +
             "removableAfter, null while that release is not published yet) and is deleted in the first minor after that — start a " +
             "version that still carries a step at least once before upgrading past its deletion.",

package/dist/plugins/remote-env-e2b.d.ts

@@ -24,6 +24,7 @@ import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, typ
 import { type SandboxReadFloorKnob } from "../execution-lane-caps.js";
 import { type SandboxReadFloor } from "./sandbox-read-floor.js";
 import { type LaneHomeConfig } from "../lane-home-probe.js";
+import type { WorkspaceFill, WorkspaceFillOf } from "./workspace-fill.js";
 /** Options accepted by `ExecutionEnv.exec` (core does not re-export the type; derive it from the seam). */
 type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
 /** Minimal optional observability hooks (kept structural so the adapter stays standalone-testable). */
@@ -75,6 +76,8 @@ export interface RemoteContainerEnvConfig extends RemoteEnvObservers, LaneHomeCo
     dataTimeoutMs?: number;
     /** `SANDBOX_READ_FLOOR`(keep | off;缺席 ⇒ keep):本沙箱守不守读拒表的字节地板 = 读地板模块服务本车道 ∧ 本键不是 off(`sandbox-read-floor.ts`)。 */
     sandboxReadFloor?: SandboxReadFloorKnob;
+    /** 恢复点的填充座(`workspace-fill.ts`;工厂按 run 装配):沙箱新建 / 恢复之后、交给本环境之前,经本适配器已连上的通道往工作区里放内容。缺席 ⇒ 不放。 */
+    workspaceFill?: WorkspaceFill;
 }
 /** Minimal slice of the E2B `Sandbox` static API the adapter uses — injectable so tests pass a fake. */
 export interface SandboxApi {
@@ -124,9 +127,12 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
     private destroyed;
     /** 家目录的座(主张在场 ⇒ 每只沙箱对证 · 否则建沙箱那一拍实测 · 实测缺席 ⇒ 缺席 + 一行 warn)。 */
     private readonly homeSeat;
-    /** 家目录:沙箱答了而与主张不一致(或答的不是绝对路径)⇒ 这只环境的拒,记一次、此后每次连接 / 恢复原样回它(同一模板同一个答案:不再建沙箱、不再问)。 */
-    private homeRefusal?;
-    /** In-flight connect/resume, memoized so concurrent lazy first-use OR resume provisions exactly one VM (no double-bill). */
+    /** 这只环境的拒 —— 记一次、此后每次连接 / 恢复原样回它(同一模板同一个答案:不再建沙箱、不再问)。两个写者:家目录(沙箱答了而与主张不一致,或答的不是绝对路径)
+     *  与恢复点的填充(换一台沙箱也是同一个答的拒:种子不是项目包、摘要不符、镜像没有 `tar`、镜像预置撞名 —— `FillOutcome.standing`)。 */
+    private connectRefusal?;
+    /** In-flight connect/resume, memoized so concurrent lazy first-use OR resume provisions exactly one VM (no double-bill). `target` = the snapshot a resume
+     *  restores (`undefined` = a fresh sandbox): {@link resumeVM} shares only a resume of the SAME snapshot — a connect for anything else is not the
+     *  workspace it is asked to restore (it waits that one out, then releases the sandbox it left). */
     private connecting?;
     /** Count of exec/execStream calls in flight — `suspendVM` refuses while > 0 (council #4: never snapshot a running command). */
     private activeCommands;
@@ -150,6 +156,8 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
     /** 地板模块的三件原语。引导命令经 {@link startIn}(起动形 `bootstrap`:只在附着中合法);放置 = root 建目录 → `files.write`(root)写暂存件 →
      *  root `chmod 0755 && mv -f`;中继 = 以模块给的身份起一只长连后台命令(stdin 开着:`sendStdin` 写答,stdout 回调读问)。 */
     private floorTransport;
+    /** 收据句柄。还没连上(懒环境:续跑腿的引擎在 `resumeVM` **之前**先取它比车道)⇒ 未连接形 `{ sandboxId: "(unconnected)", provider, mountPath }`(与 k8s 车道同形),
+     *  不抛 —— 抛了,续跑腿在恢复之前就失败。 */
     workspaceHandle(): WorkspaceHandle;
     /**
      * Public host for a port inside the sandbox (E2B reverse proxy → `<port>-<id>.e2b.app`). The LSP sidecar
@@ -197,6 +205,11 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
         ok: false;
         error: RemoteExecutionError;
     }>;
+    /** The one walk of a resume ({@link resumeVM} memoizes it). */
+    private resumeWalk;
+    /** Kill the fresh sandbox this env holds (minted before a restore point that restores another): no second billable VM, no answer from the wrong workspace.
+     *  The connect memo is the calling resume's own ({@link resumeVM}) — left as it is. */
+    private releaseMinted;
     private doResumeVM;
     /** Cross-replica re-attach to a still-running VM = v2 ([ref] council #15: v1.5 always snapshots→resumeVM). */
     reconnect(_sessionToken: SessionToken): Promise<{
@@ -227,6 +240,10 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
      * 上界 = 控制面 RPC 的墙钟(`rpcTimeoutMs`:问一个环境变量,不是跑用户命令)。
      */
     private homeVerdict;
+    /** 恢复点的填充:有座 ⇒ 经这只沙箱的通道({@link fillChannel})放(`origin` = 新建的沙箱 / 恢复出来的沙箱);没有 ⇒ 什么都不放。 */
+    private fillAt;
+    /** 恢复点手里的通道:固定命令经唯一起动接缝(起动形 `adapter`,与引擎命令同一执行用户)、写 = `files.write`(与文件面同一个缺省用户);两件都受数据墙钟。 */
+    private fillChannel;
     /** BL-31 — (re)start the periodic sandbox-lifetime extension. `setTimeout(timeoutMs)` resets the auto-kill window
      *  from now; we re-arm at ~80% of the (clamped, ≤1h) window so a long-held sandbox never expires mid-run. A no-op
      *  when paused/destroyed; `unref`'d so it never keeps the process alive; cleared on destroy. */
@@ -380,6 +397,8 @@ export declare class RemoteContainerExecutionEnv implements RemoteExecutionEnv,
  * so a task that never touches the hand (e.g. a leader that only plans) pays zero VM cost. The Runner owns the
  * lifetime and calls `destroy()` on task end (via `hasDestroy`); a never-used env's destroy is a no-op.
  */
-export declare function e2bExecutionEnvFactory(config: RemoteContainerEnvConfig, deps?: RemoteContainerEnvDeps): ExecutionEnvFactory;
+export declare function e2bExecutionEnvFactory(config: Omit<RemoteContainerEnvConfig, "workspaceFill"> & {
+    readonly workspaceFillOf?: WorkspaceFillOf;
+}, deps?: RemoteContainerEnvDeps): ExecutionEnvFactory;
 export {};
 //# sourceMappingURL=remote-env-e2b.d.ts.map