@sema-agent/server 7.142.0 → 7.144.0

package/dist/plugins/file-run-store.js

@@ -4,9 +4,10 @@ import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
+import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, sanitizePathComponent, sanitizeScope, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
+import { joinFromStore, splitForStore } from "./wiring-section-codec.js";
 import { RUN_HOLDER_DEATH_CODES, RUN_ORPHANED_ERROR, RUN_STALLED_ERROR, StoreBootRefusalError, buildRunOrphanedError, readLegacyHolderDeathCode, isTerminalRunStatus, settledLegObservationOf } from "./store-contracts.js";
 import { notifyRunTerminal } from "../observability/run-terminal.js";
 import { readRunIdentityCells, runIdentityCells } from "../identity-source.js";
@@ -26,6 +27,13 @@ const EVENT_RECORD_SHAPE = {
         return typeof record.seq === "number" ? record : undefined;
     },
 };
+const SECTION_BLOB_SHAPE = {
+    what: "wiring-section blob record without a string digest and an object/array body",
+    read(record) {
+        const r = record;
+        return typeof r.digest === "string" && typeof r.body === "object" && r.body !== null ? record : undefined;
+    },
+};
 const CLAIM_RECORD_SHAPE = {
     what: "active-run claim record without a string sessionId / taskId",
     read(record) {
@@ -61,6 +69,10 @@ export class FileRunStore {
     byIdem = new Map();
     events = new Map();
     eventLogs = new Map();
+    blobsDir;
+    sectionBlobs = new Map();
+    blobLogs = new Map();
+    unresolvedReported = new Set();
     checkpointProbe;
     claimOwner = { nonce: randomBytes(12).toString("hex"), ...processFingerprint() };
     claimLocks = new Map();
@@ -72,6 +84,7 @@ export class FileRunStore {
         this.runsDir = join(root, "runs");
         this.activeDir = join(root, "runs", "active");
         this.tmpDir = join(root, "tmp");
+        this.blobsDir = join(root, "run-blobs");
         this.spaceCommitsDir = join(root, "space-commits");
         this.spaceCommits = createInProcessSpaceCommitTable({
             load: (spaceKey) => this.loadSpaceCommit(spaceKey),
@@ -109,6 +122,9 @@ export class FileRunStore {
     activePath(sessionId) {
         return join(this.activeDir, sanitizePathComponent(sessionId));
     }
+    blobLedgerPath(sessionId) {
+        return typeof sessionId === "string" ? join(this.blobsDir, `${sanitizeScope(sessionId)}.jsonl`) : undefined;
+    }
     spaceCommitPath(spaceKey) {
         return join(this.spaceCommitsDir, `${sanitizePathComponent(spaceKey)}.json`);
     }
@@ -144,6 +160,7 @@ export class FileRunStore {
         const { identitySource, identityScope, identityPrincipalInc, ...rest } = d;
         return {
             ...rest,
+            result: d.result ?? null,
             idemKey: typeof d.idemKey === "string" ? d.idemKey : null,
             idemBodyFingerprint: typeof d.idemBodyFingerprint === "string" ? d.idemBodyFingerprint : null,
             identity: readRunIdentityCells(identitySource, identityScope, identityPrincipalInc),
@@ -261,6 +278,19 @@ export class FileRunStore {
                 this.events.set(disk.taskId, list);
             }
         }
+        for (const sessionId of new Set([...this.runs.values()].map((r) => r.sessionId))) {
+            const path = this.blobLedgerPath(sessionId);
+            if (path === undefined)
+                continue;
+            const recs = this.replay(path, SECTION_BLOB_SHAPE).records;
+            if (recs.length === 0)
+                continue;
+            const index = new Map();
+            for (const b of recs)
+                if (!index.has(b.digest))
+                    index.set(b.digest, b.body);
+            this.sectionBlobs.set(sessionId, index);
+        }
         let claims;
         try {
             claims = readdirSync(this.activeDir);
@@ -435,10 +465,58 @@ export class FileRunStore {
             return;
         const clone = data == null ? null : structuredClone(data);
         const ts = new Date().toISOString();
-        this.eventLogFor(taskId).append({ seq, type, data: clone, ts }, false);
-        list.push({ seq, type, data: clone, ts });
+        const stored = this.storeSections(taskId, type, clone);
+        this.eventLogFor(taskId).append({ seq, type, data: stored, ts }, false);
+        list.push({ seq, type, data: stored, ts });
         this.events.set(taskId, list);
     }
+    storeSections(taskId, type, data) {
+        const { stored, blobs } = splitForStore(type, data);
+        if (blobs.length === 0)
+            return stored;
+        const sessionId = this.runs.get(taskId)?.sessionId;
+        const path = sessionId === undefined ? undefined : this.blobLedgerPath(sessionId);
+        if (sessionId === undefined || path === undefined)
+            return data;
+        let index = this.sectionBlobs.get(sessionId);
+        if (index === undefined) {
+            index = new Map();
+            this.sectionBlobs.set(sessionId, index);
+        }
+        const fresh = blobs.filter((b) => !index.has(b.digest));
+        if (fresh.length > 0) {
+            const log = this.blobLogFor(sessionId, path);
+            for (const [i, b] of fresh.entries())
+                log.append({ digest: b.digest, body: b.body }, i === fresh.length - 1);
+            for (const b of fresh)
+                index.set(b.digest, b.body);
+        }
+        return stored;
+    }
+    blobLogFor(sessionId, path) {
+        let log = this.blobLogs.get(sessionId);
+        if (!log) {
+            log = new AppendLog(path);
+            this.blobLogs.set(sessionId, log);
+        }
+        return log;
+    }
+    dropSectionBlobs(sessionId) {
+        const path = this.blobLedgerPath(sessionId);
+        if (path !== undefined)
+            rmSync(path, { force: true });
+        this.blobLogs.get(sessionId)?.close();
+        this.blobLogs.delete(sessionId);
+        this.sectionBlobs.delete(sessionId);
+    }
+    reportUnresolved(taskId, seq, missing) {
+        const key = `${taskId}\u0000${seq}`;
+        if (this.unresolvedReported.has(key))
+            return;
+        this.unresolvedReported.add(key);
+        const sections = missing.map((m) => `${m.section}:${m.digest}`).join(",");
+        recordFailOpen("server.run-store.corrupt-record-skipped", `kind=section-ref taskId=${taskId} seq=${seq} sections=${sections} reason=wiring_manifest row references section blobs its session's ledger does not hold (row withheld from reads)`);
+    }
     async maxSeq(taskId) {
         const list = this.events.get(taskId);
         return list && list.length ? Math.max(...list.map((e) => e.seq)) : 0;
@@ -449,10 +527,19 @@ export class FileRunStore {
     }
     async getEvents(taskId, afterSeq) {
         const list = this.events.get(taskId) ?? [];
-        return list
-            .filter((e) => e.seq > afterSeq)
-            .sort((a, b) => a.seq - b.seq)
-            .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
+        const sessionId = this.runs.get(taskId)?.sessionId;
+        const blobs = sessionId === undefined ? undefined : this.sectionBlobs.get(sessionId);
+        const lookup = (digest) => blobs?.get(digest);
+        const out = [];
+        for (const e of list.filter((x) => x.seq > afterSeq).sort((a, b) => a.seq - b.seq)) {
+            const joined = joinFromStore(e.type, e.data, lookup);
+            if (joined.kind === "unresolved") {
+                this.reportUnresolved(taskId, e.seq, joined.missing);
+                continue;
+            }
+            out.push({ ...e, data: joined.data == null ? null : structuredClone(joined.data) });
+        }
+        return out;
     }
     async setTerminal(taskId, status, result, error) {
         await fenceSpaceCommitAtTerminal(taskId, async (spaceCommit) => this.writeTerminal(taskId, status, result, error, spaceCommit));
@@ -661,6 +748,7 @@ export class FileRunStore {
         const claimed = this.active.get(sessionId);
         if (claimed !== undefined)
             return { active: claimed };
+        this.dropSectionBlobs(sessionId);
         let removed = 0;
         for (const [taskId, r] of [...this.runs]) {
             if (r.sessionId !== sessionId)
@@ -1024,7 +1112,7 @@ export class FileRunStore {
         return new Set([...this.runs.values()].map((r) => r.sessionId));
     }
     dispose() {
-        for (const log of this.eventLogs.values()) {
+        for (const log of [...this.eventLogs.values(), ...this.blobLogs.values()]) {
             try {
                 log.close();
             }
@@ -1032,6 +1120,7 @@ export class FileRunStore {
             }
         }
         this.eventLogs.clear();
+        this.blobLogs.clear();
     }
 }
 //# sourceMappingURL=file-run-store.js.map

package/dist/plugins/fork-routing-session-store.d.ts

@@ -32,7 +32,7 @@
  * 路由表 LRU 上限 {@link ROUTE_MAX}:满额逐最老(refresh-on-use);被逐后下次 `acquire` 按上述规则重derive
  * (requireExisting 的 host-first 重试仍落对店),中途 touch/noteTaskRun 缺路由=落 transient(no-op 级)。
  */
-import { type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
+import { type SessionStore, type AcquiredSession, type SessionHead, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { ForkToFn } from "./session-fork.js";
 /** acquire 选项形(core 5.48 SessionStore 契约):[ref] placement=受信 spawner 的分区建会话声明。 */
@@ -63,6 +63,13 @@ export declare class ForkRoutingSessionStore implements SessionStore {
     readonly executionPlacement?: ExecutionPlacementSeat;
     /** fork 续写的店契约透传(host 有才有):目标在 host 店原子新建,新 id 与源一并记 host 路由(与 {@link fork} 的 host 腿同)。 */
     readonly forkTo?: ForkToFn;
+    /**
+     * core `SessionStore.headOf`(按 id 读一行:属主 / 住客 / 叶子)—— **按 acquire 的路由转发**({@link pick}:placed 名册 → 路由表 → 未知落 transient,
+     * 与 acquire 对同一只 id 落的店同一只),所以答的就是 acquire 交出的那只会话所在的行(core 7.62.0 [ref] 盒义务 7:声明 placements 的店答 `headOf`,
+     * 住客与 acquire 交出的同源;引擎在子 Runner 上据它读「没人派生的 run」自己那一行定委派树属主)。两只店都答 `headOf` 才声明:有一边答不了 ⇒ 不声明
+     * (半只读口会把那一边的行答成「不在」)。
+     */
+    readonly headOf?: (sessionId: string) => Promise<SessionHead | undefined>;
     constructor(host: SessionStore, transient: SessionStore);
     private remember;
     private pick;

package/dist/plugins/fork-routing-session-store.js

@@ -11,6 +11,7 @@ export class ForkRoutingSessionStore {
     listPlaced;
     executionPlacement;
     forkTo;
+    headOf;
     constructor(host, transient) {
         this.host = host;
         this.transient = transient;
@@ -23,6 +24,11 @@ export class ForkRoutingSessionStore {
         if (host.fork === undefined && transient.fork === undefined) {
             this.fork = undefined;
         }
+        const hostHeadOf = host.headOf;
+        const transientHeadOf = transient.headOf;
+        if (typeof hostHeadOf === "function" && typeof transientHeadOf === "function") {
+            this.headOf = (id) => (this.pick(id) === host ? hostHeadOf.call(host, id) : transientHeadOf.call(transient, id));
+        }
         const hostFaces = host;
         if (hostFaces.executionPlacement !== undefined)
             this.executionPlacement = hostFaces.executionPlacement;

package/dist/plugins/imported-layer-root-retirement.d.ts

@@ -0,0 +1,82 @@
+/**
+ * 🔴 一次性迁移 M36(窗口见 `plugins/one-time-migrations.ts` 登记表)—— **引擎 7.61.0 之前导入的、在每个项目根放行的全局 allow,按引擎写下的那一句判据退役**。
+ *
+ * ## 为什么
+ * 引擎 7.61.0 之前的设置导入门把用户层(用户配置目录下的那份 settings)里从 `/` 写起的路径规则存成**全局行**。全局行在每个任务的**项目根**读 `/x`,
+ * 用户层却在**它自己的配置目录**读 —— 同一串字落店之后守着 / 放着的是另一个地方:一条本意是「配置目录下的 notes」的放行 `Edit(/notes/**)`
+ * 在每个项目里放行 `notes/` 的编辑、不问。引擎 7.61.0 起导入门不再这样存(`preview.skipped`,理由前缀 `unsupported.layer_root:`);
+ * **存量行**引擎不迁、也不在读侧丢 —— 判据只写成一句话(引擎 INTEGRATION-CORE §5.14),由店的属主跑。本文件就是那一次跑。
+ *
+ * ## 判据(逐字照引擎那一句;不加条件、不减条件)
+ * 一个已存的 add 被退役,当且仅当四条都成立:行的态是 `allow`;add 的出处是 `imported-cc`;行的 scope 是 `global`;`ruleBasesNeeded(row)` 点名 `root`。
+ * **按 add 退役、不按行**:每只选中的行写**一只** observed-remove 墓碑,`removedDots` 恰是选中的那几只 add —— 同一行另有一只 `user` add 的,那一行照旧活着
+ * (人亲手同意过的那一份不跟着导入一起走)。deny / ask 的 add **不退役**:它们按店的读法(`<task>/x`)只收紧,退役会把部署有意带进来的收紧放掉。
+ *
+ * ## 读哪些桶(店自己答;答不全的那一种如实写下)
+ * 一律问**店**:它能叫出名字的每一只桶,判据在桶里判(不在桶外按「谁可能有」预筛)。
+ *  · SQL:规则表里的每一只桶(`listRuleBucketOwners`,按 `owner_key` 分页)。不从审批记录推 —— 收编把规则桶整桶改键到新身份、审批史留在旧身份名下,
+ *    从记录推出的属主集在收编之后漏掉新桶。
+ *  · File:引擎的 File 分区后端**没有**列桶口(桶文件按属主名的单向摘要命名),本步能叫出名字的只有本店导入记录点名过的属主
+ *    (`FileRuleApprovalRecordStore.importRecordOwners`;`imported-cc` 只由导入记录派生,记录是只增日志)。**已知缺口(如实)**:引擎的本地数据根收编
+ *    把一只桶改名到一个没有任何导入记录点名的身份之后,那只桶本步叫不出、不读 —— 等引擎给 File 分区后端一个列桶口再收。
+ *
+ * ## 写在哪里(一处)
+ * 墓碑经**这只桶自己的写面**落(`writerOf(partition).apply({ kind: "tighten-delete" })`,引擎的写面契约)—— SQL 两孪生走 `SqlDurableRulePartition` 的那只
+ * (店内唯一写法 `writeBucket`),File 走引擎 File 分区的那只。同一个函数、同一次调用,不分叉。删除点(`deletedBy`)由这只桶的写面 `nextDot()` 铸
+ * —— 与引擎撤销口 `removePersistedRule` 同一约定(本副本的 actor,一次删除一枚)。OCC:读到的 rev 交给 `apply`,输了就重读重选(另一只副本可能刚退役过,
+ * 重选为空 ⇒ 零写),有界次数后点名跳过、下一次起服再来。
+ *
+ * ## 失败方向
+ * 列桶 / 解析桶 / 读桶 / 取点 / 写面**抛** ⇒ 原样抛:起服拒,收据账里已提交的墓碑随拒因交出(与本段其余各步同一条路)。例外两条,都由店的判官按抛出物的**类**判(不按文案):
+ * 取点时店说这只桶**在写它的那一步里没了**(`source.isVanishedBucket`:另一只副本删桶恰落在这一窗)⇒ 无可退役、点名跳过 `vanished`(桶都没了,它什么都不放行);
+ * 另一条是解析桶(属主 → 分区)或读桶时**店的唯一判官整桶拒**了
+ * 这只桶(解析与读同一条律、同一只判官;`source.isWholeBucketRefusal`:确定性判决,引擎读侧对它同样整桶拒、它什么都不放行;SQL = 读腿真往外交的那两类 —— 判官四道的拒与某只 JSON 列的体读不出)
+ * ⇒ 点名跳过 `bucket_unreadable`,接着读下一只桶(一只读不出的桶不挡别的桶,也不挡起服);一次读失败(连接 / 超时)
+ * 证明不了以后也读不出,所以它**不**归这一类 —— 跳过它就是让那几行在读恢复之后照旧放行。File 店没有这种判决证据(引擎的 File 分区对损坏与 I/O 失败抛同一种错,
+ * 解析时读收编标记也是:一次 EIO 与一份坏标记同一种错)⇒ 那一侧解析 / 读桶抛一律起服拒。另两种店**答了**却做不了的(没有写面或写面拒 / 并发争不过)⇒ 点名跳过,下一次起服再试,其间那几行照旧放行,每次起服都点名。
+ */
+import { type DurableRulePartitionProvider, type PersistedRule, type RuleAdd, type RuleOwner } from "@sema-agent/core";
+/** 一只被退役的导入 add 所在的行(一行一条读数)。**不带规则正文**(与 M11 同一条纪律:规则正文不出店)—— 桶键 + 工具名足够让运维去列举面对上它。 */
+export interface ImportedLayerRootAllowRetired {
+    /** 桶键(`buildRuleOwnerKey`:属主的单向摘要;两种店同一把,日志里不出属主名)。 */
+    readonly ownerKey: string;
+    readonly tool: string;
+    /** 这一行被退役的导入 add 数(≥ 1)。 */
+    readonly addsRetired: number;
+    /** 退役之后这一行是否仍活着 —— 它另有别的出处的 add(人亲手同意过的那一份)。`false` = 这一行不再生效。 */
+    readonly stillLive: boolean;
+}
+/**
+ * 跳过一只桶的成因(闭集;日志句按它穷尽分)。
+ *  · `bucket_unreadable` —— 解析或读这只桶时,店的唯一判官整桶拒了它(`isWholeBucketRefusal` 真)。引擎读侧对它同样整桶拒:它什么都不放行。
+ *  · `vanished` —— 读到了要退役的行,写它的那一步里这只桶被并发删掉了(店的判官按类说)。桶没了 ⇒ 无可退役,什么都不放行;不拒启。
+ *  · `not_writable` —— 选中了行,而这只桶没有写面(只读视图)或写面拒了这只墓碑。那几行照旧放行,每次起服都点名。
+ *  · `contended` —— 每一次写都输给并发写者,有界次数用完。下一次起服再来;其间照旧放行。
+ */
+export type ImportedLayerRootSkipReason = "bucket_unreadable" | "vanished" | "not_writable" | "contended";
+export interface ImportedLayerRootBucketSkipped {
+    readonly ownerKey: string;
+    readonly reason: ImportedLayerRootSkipReason;
+    /** 一句不带行内容的话:读 / 解析桶抛出来的东西只报它的种类(原句可能引到桶里的行 —— 与 M11 `contentFreeRefusal` 同一条纪律;
+     *  原句由店自己的披露口说,File 店的 `permission_rule_store_disclosure`、SQL 店的整桶拒句);写面拒的是闭集词,原样带。 */
+    readonly why: string;
+}
+/** 本步记进收据账的两格(`OneTimeMigrationReport` 的两只键,随提交追加)。 */
+export interface ImportedLayerRootReadings {
+    importedLayerRootAllowsRetired: ImportedLayerRootAllowRetired[];
+    importedLayerRootBucketsSkipped: ImportedLayerRootBucketSkipped[];
+}
+/** 一种店交给本步的三样东西:它能叫出名字的桶的属主(见头注「读哪些桶」)、它的 durable 分区后端(读桶、写墓碑)、它的整桶拒判别(见头注「失败方向」)。 */
+export interface ImportedLayerRootRetirementSource {
+    candidateOwners(): Promise<readonly RuleOwner[]>;
+    readonly durable: DurableRulePartitionProvider;
+    /** 这只读桶抛出物是不是店的唯一判官的**确定性**整桶拒(真 ⇒ 点名跳过、读下一只桶;假 ⇒ 原样抛、起服拒)。判的是读面**真往外交的**抛出物的类,不按文案。 */
+    isWholeBucketRefusal(e: unknown): boolean;
+    /** 这只取点抛出物是不是店说的「桶在写它的那一步里没了」(真 ⇒ 点名跳过 `vanished`;假 ⇒ 原样抛、起服拒)。 */
+    isVanishedBucket(e: unknown): boolean;
+}
+/** 判据(引擎 §5.14 那一句,逐字):这一行里该退役的 add;不选 ⇒ 空。 */
+export declare function importedLayerRootAddsOf(row: PersistedRule): readonly RuleAdd[];
+/** 跑一遍:读记录点名的每只桶(按桶键去重),退役判据选中的 add。读数随每次提交记进 `into`。 */
+export declare function retireImportedLayerRootAllows(source: ImportedLayerRootRetirementSource, into: ImportedLayerRootReadings): Promise<void>;
+//# sourceMappingURL=imported-layer-root-retirement.d.ts.map

package/dist/plugins/imported-layer-root-retirement.js

@@ -0,0 +1,96 @@
+import { ruleBasesNeeded, writerOf } from "@sema-agent/core";
+import { buildRuleOwnerKey } from "./permission-rule-store-sql.js";
+const RETIREMENT_OCC_ATTEMPTS = 5;
+export function importedLayerRootAddsOf(row) {
+    if (row.behavior !== "allow" || row.scope.kind !== "global" || !ruleBasesNeeded(row).includes("root"))
+        return [];
+    return row.adds.filter((a) => a.origin === "imported-cc");
+}
+export async function retireImportedLayerRootAllows(source, into) {
+    const seen = new Set();
+    for (const owner of await source.candidateOwners()) {
+        const ownerKey = buildRuleOwnerKey(owner);
+        if (seen.has(ownerKey))
+            continue;
+        seen.add(ownerKey);
+        await retireInBucket(source, owner, ownerKey, into);
+    }
+}
+async function retireInBucket(source, owner, ownerKey, into) {
+    const durable = source.durable;
+    const skip = (reason, why) => void into.importedLayerRootBucketsSkipped.push({ ownerKey, reason, why });
+    const unreadable = (what, e) => {
+        if (!source.isWholeBucketRefusal(e))
+            throw e;
+        skip("bucket_unreadable", withheld(what, e));
+    };
+    let partition;
+    try {
+        partition = partitionOf(durable, owner);
+    }
+    catch (e) {
+        return unreadable("the store refused this bucket as a whole while resolving it", e);
+    }
+    for (let attempt = 0; attempt < RETIREMENT_OCC_ATTEMPTS; attempt++) {
+        let stored;
+        try {
+            stored = await partition.list();
+        }
+        catch (e) {
+            return unreadable("the store refused this bucket as a whole", e);
+        }
+        const selected = stored.rules.flatMap((row) => {
+            const adds = importedLayerRootAddsOf(row);
+            return adds.length > 0 ? [{ row, adds }] : [];
+        });
+        if (selected.length === 0)
+            return;
+        const writer = writerOf(partition);
+        if (writer === undefined)
+            return skip("not_writable", "this bucket is served through a read-only view (it has no write face)");
+        let rev = stored.rev;
+        let lost = false;
+        for (const { row, adds } of selected) {
+            let deletedBy;
+            try {
+                deletedBy = await writer.nextDot();
+            }
+            catch (e) {
+                if (!source.isVanishedBucket(e))
+                    throw e;
+                return skip("vanished", "the bucket was deleted while this step was writing to it (a concurrent delete); nothing is left to retire");
+            }
+            const tombstone = { behavior: row.behavior, rule: row.rule, scope: row.scope, removedDots: adds.map((a) => a.dot), deletedBy };
+            const out = await writer.apply({ kind: "tighten-delete", tombstone }, { expectedRev: rev });
+            if ("conflict" in out) {
+                lost = true;
+                break;
+            }
+            if ("refused" in out)
+                return skip("not_writable", `the store refused the tombstone (${out.refused})`);
+            rev = out.rev;
+            into.importedLayerRootAllowsRetired.push({ ownerKey, tool: row.tool, addsRetired: adds.length, stillLive: row.adds.length > adds.length });
+        }
+        if (!lost)
+            return;
+    }
+    skip("contended", `every write lost to a concurrent writer ${RETIREMENT_OCC_ATTEMPTS} times`);
+}
+function partitionOf(durable, owner) {
+    switch (owner.kind) {
+        case "principal":
+            return durable.forPrincipal(owner.principal);
+        case "local-owner":
+            if (durable.forLocalOwner === undefined)
+                throw new Error("this provider has no local-owner bucket");
+            return durable.forLocalOwner();
+        default: {
+            const unknown = owner;
+            throw new Error(`M36: an owner of a kind this pass does not know: ${JSON.stringify(unknown)}`);
+        }
+    }
+}
+function withheld(what, e) {
+    return `${what} threw ${e instanceof Error ? e.name : typeof e} (its text is withheld here: it may quote the bucket's rows)`;
+}
+//# sourceMappingURL=imported-layer-root-retirement.js.map

package/dist/plugins/local-checkpoint-store.d.ts

@@ -147,11 +147,9 @@ export declare class LocalCheckpointStore {
      *  · **没有列,所以没有列/blob 一致性门**:SQL 孪生的两道矛盾门(`tool_call_id` 与 `bound_input_hash`
      *    的列 vs blob)在本形结构上不存在 —— 本形只有 blob 这一个真源,谈不上两份互相矛盾。判别力因此**不弱**:
      *    那两道门防的是「外部改库 / schema 偏斜让列与 blob 分家」,而本形没有可分家的第二份。
-     *  · **没有行级版本闸**:本类 `peekScopeByToken` 顶注已亲核过这条事实 —— 本形的 `get()` 没有行级版本闸,
-     *    唯一的读不动形是账本重放级(整店同时读不动)。所以 SQL 孪生那道 `version > MAX_SUPPORTED` 的
-     *    `unparseable` 臂在这里没有对应物;本口的 `unparseable` 只由**窄读器**判(blob 形不合)。
-     *  · **窄读器是同一只** `pendingActionToolCallId`(与 SQL 孪生共用,零第二份手抄):身份三元组的第一维
-     *    `sourceTaskId`、`boundInputHash`、以及「读不出 vs 确定不匹配」的三态,全部由它一家判。
+     *  · **身份判词是同一只** `candidateIdentityOf`(与 SQL 孪生共用,零第二份手抄):先问 core 判官(答 `lacking` ⇒ `unparseable`,
+     *    7.144.0 起两只孪生同一臂 —— 修前只有 SQL 孪生按版本列比,本形没有对应物),再由窄读器判身份三元组的第一维 `sourceSessionId`、
+     *    `boundInputHash`、以及「读不出 vs 确定不匹配」的三态。
      */
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;
     /**
@@ -159,9 +157,9 @@ export declare class LocalCheckpointStore {
      * 语义与存在理由的唯一属主 = SQL 侧 `peekScopeByToken` 顶注。
      *
      * ⚠️ 形差如实记:SQL 孪生那口是真「轻读」(只 SELECT scope 一列),本形没有列可选 —— core 的 File 店
-     * 只给 `get(token)`,所以这里读的是**整行**。后果对本形无害:本形的 `get()` 没有行级版本闸(唯一的
-     * 读不动形是账本重放级 = 整店同时读不动,`findPendingTokenBySession` 先抛),所以「行体读得出而 scope
-     * 读不出」这一支在本形结构上不存在。哪天本形补了行级闸,这里要跟着改成不碰行体的读。
+     * 只给 `get(token)`,所以这里读的是**整行**。后果对本形无害:本形的 `get()` 没有行级拒(两只孪生 7.144.0 起都不按版本拒 ——
+     * 本引擎续不续由 core 判官在续跑时答;本形连 SQL 孪生剩下的坏体一臂也没有,唯一的读不动形是账本重放级 = 整店同时读不动,
+     * `findPendingTokenBySession` 先抛),所以「行体读得出而 scope 读不出」这一支在本形结构上不存在。哪天本形补了行级拒,这里要跟着改成不碰行体的读。
      */
     peekScopeByToken(token: CheckpointToken): Promise<string | null | undefined>;
     /** `undefined` = no pending row; else the owner scope (local scopes are always strings — never null).

package/dist/plugins/local-checkpoint-store.js

@@ -6,7 +6,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { FileCheckpointStore, atomicWriteFile, executionVerdict, sanitizePathComponent, } from "@sema-agent/core";
-import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingActionToolCallId, pendingRowPrecedes, queueRowGateKind, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
+import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, candidateIdentityOf, pendingRowPrecedes, queueRowGateKind, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
 import { createZodColumnReader, decodeJsonColumn, foldJsonColumn, readStringArrayColumn } from "./sql-json-column.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
@@ -194,6 +194,7 @@ export class LocalCheckpointStore {
                 ...((card) => (card !== undefined ? { approvalCard: card } : {}))(parkedApprovalCard(cp.gate)),
                 ...parkRowFacts(cp.pendingAction),
                 ...skillCardFacts(summary),
+                rowVerdict: summary.rowVerdict,
             });
         }
         return rows.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
@@ -276,14 +277,14 @@ export class LocalCheckpointStore {
             if (cp.scope !== scope || cp.sessionId !== sessionId || cp.createdAt < sinceMs)
                 continue;
             const base = { token: t, status: cp.status, createdAtMs: cp.createdAt };
-            const derived = pendingActionToolCallId(cp);
+            const derived = candidateIdentityOf(cp);
             if (!derived.readable) {
-                out.push({ ...base, sourceTaskId: null, boundCallId: null, boundInputHash: null, unparseable: true });
+                out.push({ ...base, sourceSessionId: null, boundCallId: null, boundInputHash: null, unparseable: true });
                 continue;
             }
             if (derived.toolCallId !== toolCallId)
                 continue;
-            out.push({ ...base, sourceTaskId: derived.sourceTaskId, boundCallId: derived.toolCallId, boundInputHash: derived.boundInputHash });
+            out.push({ ...base, sourceSessionId: derived.sourceSessionId, boundCallId: derived.toolCallId, boundInputHash: derived.boundInputHash });
         }
         return out.sort((a, b) => a.createdAtMs - b.createdAtMs || (a.token < b.token ? -1 : a.token > b.token ? 1 : 0));
     }