@sema-agent/server 7.142.0 → 7.144.0

package/dist/plugins/local-session-store.d.ts

@@ -1,5 +1,4 @@
 import { FileSessionRepo, type AcquiredSession, type PlacedSessionRow, type SessionHead, type SessionPlacementRecord, type SessionStore, type SessionRepo, type SessionMetadata, type SessionTreeEntry, type StoreDurability } from "@sema-agent/core";
-import { type OwnerlessClaim } from "../delegated-session-owner.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import { z } from "zod";
 import { StoreBootRefusalError, type SessionRunClaimSource, type SessionRunRollupSource, type SessionSummary } from "./store-contracts.js";
@@ -30,11 +29,39 @@ export declare const SESSION_META_CELL_OBJECT: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodString>;
     forkedFrom: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+/** 严格边档清册里一只边档的对账读数(拒句的逐文件一段;{@link LocalDataRootSchemaMismatchError.findings})。 */
+export interface LocalSidecarMismatch {
+    /** 文件的绝对路径。 */
+    readonly path: string;
+    /** 角色(`<文件名> (the local <角色> sidecar)`)。 */
+    readonly label: string;
+    /** 读不出的种别:`not-json` / `malformed`(形),或 I/O 的 errno(`EACCES` …;没有 errno ⇒ `unreadable`)。 */
+    readonly problem: string;
+    /** 格里本构建不认得的键(非空 ⇒ 这只边档是更新的引擎写下的:数据根比本构建新)。 */
+    readonly unknownFields: readonly string[];
+}
+/**
+ * **local 数据根的「本构建读不出」拒**(起服对账一族的 local 腿;机读码与 SQL 列册对账同一个 `config.schema_mismatch`,拒句同形)。
+ * 一只严格边档用它那一只严格读者读不出 ⇒ 这一只拒,文件原地不动、一个字节不改。两处触发、一只类:
+ *  · `boot` —— 起服对账({@link LocalSessionStore.assertStrictSidecarsReadable},唯一调用点 `LocalBackend.ensureSchema()`)把清册里每一只读不出的合成一只:拒启;
+ *  · `serving` —— 起服之后这只边档第一次被碰时才读不出(嵌入方跳过了 `ensureSchema()`;或起服后别的写者把它写成本构建读不出的形,在替换之前那一读里看见):
+ *    读不出的是**形**(`not-json` / `malformed`,确定的判词)⇒ 这只边档在本进程里从此每一读每一写都交这一只(重启才重判);碰它的请求失败(把它交给 HTTP 全局兜底的路由:
+ *    500 `internal.error` + 一行 error 级 `request_error` 带本码;自己接住故障的路由按各自的 500 臂答)。I/O 故障(非确定)不粘。
+ * 属 {@link StoreBootRefusalError} 族:起服降级臂不吞它(缺省推导的 local 不会被吃成内存后端)。拒句零原文:只点名文件、种别与不认得的键名,不带任何值。
+ */
+export declare class LocalDataRootSchemaMismatchError extends StoreBootRefusalError {
+    readonly findings: readonly LocalSidecarMismatch[];
+    readonly when: "boot" | "serving";
+    /** 机读码(与 SQL 列册对账 / 退役 schema 的拒启同一个)。 */
+    readonly code = "config.schema_mismatch";
+    constructor(findings: readonly LocalSidecarMismatch[], when: "boot" | "serving");
+}
 /**
  * local 车道会话存档的**唯一 repo 出口**:本仓里每一只读 `<root>/sessions/*.jsonl` 的 `FileSessionRepo` 都从这里取(`LocalSessionStore` 的底座;会话视图窗不再自开 repo,
  * 它的元数据与日志都由店交出 —— `local-session-window.ts`),所以坏记录的披露座只有这一份接线。座 = F 类 `server.session-repo.corrupt-record-skipped`(会话存档里读不出的记录丢的是可用性:
- * 历史少一截 / 列表少一行,不开任何门;计数单位 = 一条被跳过的记录,逐命中探针行,warn 每进程一次),外加两条作用域腿:会话打开作用域(`noteReplayInSessionOpenScope`:
- * 只在 `openSessionForItself` 的作用域里才记)与一次性迁移 M33 的整档读作用域({@link noteReplayInArchiveRewriteRead});作用域外 —— 列表 / 导出 / 视图 —— 两条腿都是空操作,那些读只进运维面。
+ * 历史少一截 / 列表少一行,不开任何门;计数单位 = 一条被跳过的记录,逐命中探针行,warn 每进程一次),外加一条作用域腿:一次性迁移 M33 的整档读作用域({@link noteReplayInArchiveRewriteRead});
+ * 作用域外那条腿是空操作。用户面的丢失账不经这只座:core 的 `FileSessionRepo` 把回放的计数记在它交出的存储上(`getReplayLoss`),引擎在 run 里读它说
+ * `session.lineage_rerooted`(core 7.62.0 [ref];本仓 7.104.0–7.143.0 在这里另铸 `session.records_skipped`,7.144.0 退役 —— 一个事实一个来源)。
  */
 export declare function createLocalSessionRepo(root: string): FileSessionRepo;
 /** 快照目录名(数据根下;本店自有的目录与格式)。常设拒启臂 {@link assertNoArchiveSnapshots} 读它,所以它活得比 M33 的码久。 */
@@ -101,11 +128,6 @@ export declare class LocalSessionStore implements SessionStore {
         olderThanMs?: number;
         scope?: string;
     }) => Promise<PlacedSessionRow[]>;
-    /**
-     * 委派继承律的认领口(`delegated-session-owner.ts`;停驻挂点对宿主无主子代行的认领):这只会话的那一位住客(判断时读到的化身)仍无主、且是 placed 行 ⇒ 写 `owner`,
-     * 返回是否写成。与 `placementOf` 同在或同缺(`delegatedOwnerHostOf`)。随一次性迁移 M23 的窗同删(登记表 M23 行)。
-     */
-    readonly claimOwnerless?: OwnerlessClaim;
     /** placement 的唯一读法(repo 的 `placementOf`;repo 不记 placement ⇒ 恒答缺席 —— 那种 repo 里没有 placed 行)。 */
     private readonly recordedPlacementOf;
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) in one process share one (mirrors TiDBSessionStore). */
@@ -170,7 +192,12 @@ export declare class LocalSessionStore implements SessionStore {
      * 盘上有会话而边档里没有它那一格 ⇒ 第一次读补铸一格只有化身的(属主没有事实可写)并落盘。严格读(读不出 ⇒ 整只拒,见 `SidecarMap.strict`)。
      */
     private readonly meta;
-    /** 认领行(`session_owner_claimed`,一次性迁移 M10 的认领臂,窗口见 `plugins/one-time-migrations.ts` 登记表)与委派孤行 warn(`delegated_session_owner_orphaned`)的出口。 */
+    /**
+     * [ref] —— 本店的**严格边档清册**(今天一只:会话元数据)。唯一来源 = 构造里 `sidecar(…, strict)` 那一参:工厂造出严格读的边档时同一手登进来,
+     * 没有第二张手写名单。读者只有起服对账 {@link assertStrictSidecarsReadable}。
+     */
+    private readonly strictSidecars;
+    /** 认领行(`session_owner_claimed`,一次性迁移 M10 的认领臂,窗口见 `plugins/one-time-migrations.ts` 登记表)的出口(本店今天只有这一行经它;委派孤行 warn 的铸点已不在 `src/`)。 */
     private readonly log;
     /**
      * 按会话的写锁(表见 {@link SESSION_WRITE_LOCKS_BY_ROOT})—— 会话行两位的**每一笔**写(用户的行格写原语:判 → 边档草稿 → 落盘 → 发布;自动标题器的
@@ -204,12 +231,18 @@ export declare class LocalSessionStore implements SessionStore {
      *  @param dataDir  the SAME data dir the file-backed repo persists under (LocalBackend passes `fileBackend.root`).
      *                  When given, lastActivity is persisted to `<dataDir>/session-last-activity.json` so it survives a
      *                  restart (the file-backed deployment); omit it for the in-memory deployment (nothing survives).
-     *  @param opts.log the `session_owner_claimed` / `delegated_session_owner_orphaned` lines' sink (LocalBackend passes a logger at the deployment's
-     *                  LOG_LEVEL; absent ⇒ an info-level JSON-line logger — a claim or an orphaned delegated row is never silent).
+     *  @param opts.log the `session_owner_claimed` line's sink (LocalBackend passes a logger at the deployment's
+     *                  LOG_LEVEL; absent ⇒ an info-level JSON-line logger — a claim is never silent).
      *  @param opts.durability / opts.placements the deployment's declaration ({@link LocalSessionStoreDeclaration}; see the two fields). */
     constructor(repo: HeadReadingSessionRepo & Partial<PlacementRecordingRepo>, runs: SessionRunRollupSource & SessionRunClaimSource, dataDir?: string, opts?: {
         log?: Pick<Logger, "info" | "warn">;
     } & LocalSessionStoreDeclaration);
+    /**
+     * [ref] —— **起服对账的 local 腿**(SQL 列册对账的对位;唯一调用点 `LocalBackend.ensureSchema()`,排在 M33 快照消化之前 —— 消化会写会话元数据格):
+     * 严格边档清册里的每一只读一次盘(`SidecarMap.reconcile`:冷 ⇒ 载入那一读;已载入 ⇒ 重读只判);读不出的合成**一只** {@link LocalDataRootSchemaMismatchError}
+     * (`boot` 形,逐文件一段)⇒ 拒启,开始服务之前。每一只只会以那一只拒失败(严格读的拒臂把读不出的每一形都收成它);别的故障原样上抛(响亮,不归并)。内存部署(没有数据根)⇒ 零读。
+     */
+    assertStrictSidecarsReadable(): Promise<void>;
     /**
      * 这一格此刻是不是 `forking`(fork 创建的格 {@link isForkCreatedCell} ∧ 存档不在)。存档在不在只问 repo 的唯一探针 {@link probeArchive} 的「不在」—— **只问有没有**:存档在而用不了(会话头读不出 / 截断)
      * 是「在」,内容读不读得出归真正读内容的那一读(门之后、体之前读一次叶子,读不出 ⇒ `corrupt_session`)。所以带键的会话与不带键的会话在执行席上同形,坏档照样能被换装修好
@@ -258,10 +291,10 @@ export declare class LocalSessionStore implements SessionStore {
     private withSessionWriteLock;
     /**
      * 盘上这只会话的存档此刻是什么状态(repo 的**唯一探针**;`open` 读整只存档,所以只在边档里没有那一格、或要判 `forking` 时才走到这里)。三种答案:
-     * 不在(`not_found`)· 在而读得出 · 读不出({@link UnusableArchive}:`corrupt_session` / `invalid_session` = 在而内容用不了;`storage` = 读的时候抛了别的故障,I/O 级,
+     * 不在(`not_found`)· 在而读得出 · 读不出({@link UnusableArchive}:`corrupt_session` = 在而内容用不了;`storage` = 读的时候抛了别的故障,I/O 级,
      * 说不出在不在 —— 词的读法见 {@link archiveFaultWord})。探针**不吞也不改**那只故障:{@link UnusableArchive.fault} 就是抛出来的那一只,每个读者各自决定上抛还是点名 ——
      * 要对这份存档动手的({@link existsInRepo};{@link metaOf};{@link readExecutionPlacement})一律上抛它;一次性迁移 M32 的回填({@link executionPlacementBackfill})经
-     * {@link metaRead} / {@link forkingRead} 收下它、点名跳过,不上抛。只问有没有的 {@link forkingRead} 把 `corrupt_session` / `invalid_session` 读作「在」(存档找到了),`storage` 不替它答。
+     * {@link metaRead} / {@link forkingRead} 收下它、点名跳过,不上抛。只问有没有的 {@link forkingRead} 把 `corrupt_session` 读作「在」(存档找到了),`storage` 不替它答。
      */
     private probeArchive;
     /**
@@ -270,8 +303,10 @@ export declare class LocalSessionStore implements SessionStore {
      */
     private placementProbe;
     /**
-     * 改写面与执行席的读法({@link placementProbe} 的一形):placed ⇒ 那份元组;普通 ⇒ `undefined`;行头读不出(`corrupt_session` / `invalid_session`)⇒ `undefined` —— 没有可读的
+     * 改写面与执行席的读法({@link placementProbe} 的一形):placed ⇒ 那份元组;普通 ⇒ `undefined`;行头读不出(`corrupt_session`)⇒ `undefined` —— 没有可读的
      * placement 记录,这一行按普通行答,内容读不读得出归真正读内容的那一读(坏档照样换得掉,与 forking 探针同一条规矩);说不出(`storage`)⇒ 抛那只故障。
+     * core 7.61.0 起 repo 的探针按行头的元组自己读、不整头解码:placed 行的属主格坏了探针照答元组(本臂不再接得住 placed 行)—— 探针拒只剩「行头记录整个读不出」,
+     * 那时没有任何元组可守(`test/local-session-placement.test.ts` 的 [ref] 三格)。
      */
     private placedRecordOf;
     /** {@link placedRecordOf} 的是非形。 */
@@ -288,7 +323,8 @@ export declare class LocalSessionStore implements SessionStore {
     private metaOf;
     /**
      * {@link metaOf} 的本体(三态,不抛「用不了」):边档里有那一格 ⇒ 读它;没有 ⇒ 问**唯一探针** {@link probeArchive} 一次 —— 不在 ⇒ 无此会话;在而读得出 ⇒ 补铸({@link cellOfPresent});
-     * 读不出 ⇒ {@link UnusableArchive}(**不补铸**:不替一份读不出的存档铸化身)。要动存档的读者({@link metaOf})把它上抛;不动存档、只要「有没有」的读者
+     * 读不出 ⇒ {@link UnusableArchive}(**不补铸**:不替一份读不出的存档铸化身;`corrupt_session` 的故障换成具名拒 {@link SessionOwnerUnreadableError} ——
+     * 格缺 ∧ 存档用不了 = 这只会话没有可读的属主,见 {@link ownerUnreadableArchive})。要动存档的读者({@link metaOf})把它上抛;不动存档、只要「有没有」的读者
      * ({@link executionPlacementBackfill})原样收下。
      */
     private metaRead;
@@ -304,7 +340,8 @@ export declare class LocalSessionStore implements SessionStore {
      * 叶子出自会话存档(本店的**内容**;core `SessionRepo.headOf`:File repo 读日志首记录与尾、不重放 —— 存档首行的属主 / 令牌本店不读)。
      * 存档读不出(会话头坏了、I/O 故障)⇒ 头照答行上的属主与住客,叶子那一格带着那只故障(`UnreadableLeaf`,读叶子的人收到它):只判归属的读者
      * 不因坏存档改判,坏存档只让读内容的那一位看见(SQL 孪生的头不碰 `session_event`,同一条律;规则在 `session-incarnation.ts` 头注)。
-     * 行本身读不出(边档里还没有这一格、要从存档推出这只会话在不在,而存档读不出 —— {@link metaOf} 的探针)⇒ 整只拒。
+     * 行本身读不出(边档里还没有这一格、要从存档推出这只会话在不在,而存档读不出 —— {@link metaOf} 的探针)⇒ 整只拒:会话头坏 / 日志结构走不通 ⇒ 具名拒
+     * {@link SessionOwnerUnreadableError}(没有可读的属主;码与句子是原故障的),说不出在不在的 I/O 级故障 ⇒ 原故障。
      * 两样住在两只文件里 ⇒ 先读那一格、读叶子、再同步复读那一格:格没了(读间被删)或换了主 / 换了住客 ⇒ `undefined`(调用方按删处理),
      * 所以一只头从不把这一代的属主配上另一代的叶子([ref] 六轮复审同一条)。`undefined` = 无此会话。
      * 化身那一格经 `headFromRow` 的 `absent` 读法(边档对象形恒有令牌;读不出的边档整只严格拒在 `metaOf` 之前)。
@@ -447,17 +484,16 @@ export declare class LocalSessionStore implements SessionStore {
     /** 这次 acquire 要落的 placement:只有声明了分区的店才收(未声明 ⇒ `undefined`,会话就是普通会话 —— core `SessionStore.placements` 缺席的读法)。 */
     private declaredPlacement;
     private load;
-    /** 为这只会话打开它自己的存档,锁内一形(调用方持这只会话的写锁,见 {@link load})。[ref]:这是「为这只会话打开它自己的存档」的那一次
-     *  (引擎 prepare 的 acquire)⇒ 包在打开作用域里:这次回放跳过了记录 ⇒ 打开成功后铸一帧 `session.records_skipped` 投给这只会话(唯一铸点
-     *  与作用域见 `session-records-skipped-notice.ts`);读不出(`corrupt_session`)照旧原样上抛,不铸。存档只读这一次:住客那一格缺(更早版本
+    /** 为这只会话打开它自己的存档,锁内一形(调用方持这只会话的写锁,见 {@link load})。回放跳过了记录 ⇒ 交出的存储带着那份丢失账(core 文件店的
+     *  `getReplayLoss`,经 {@link occupiedBy} 的视图原样转发),引擎在 run 里说 `session.lineage_rerooted`;读不出(`corrupt_session`)原样上抛。存档只读这一次:住客那一格缺(更早版本
      *  写下的会话)时,这次打开就是补铸的证明({@link handOut})。GUARD(open 腿):打开一只已存在的会话**不写属主** —— 记下的属主(含「登记为
      *  无主」)一个字节不动,没被记下的也不在这里替它记成无主:打开不是一个属主事实(7.119.0 前这一腿把「不知道」记成进程内存里的 null,重启即失)。 */
     private openForItselfHeld;
     /**
      * 带 placement 的按 id 首建(锁内一形,调用方持这只会话的写锁、已判过存档不在且不是 fork 创建的格)。写序 = **判别位先落**:先建存档(引擎文件 repo 把元组写进行头、
-     * 首写不可变),再写会话元数据那一格(化身新铸;属主按委派继承律 —— 根会话的属主,根行不在取父,都不在 ⇒ 孤行哨兵 + 一行 warn;读法与次序只住在
-     * `delegated-session-owner.ts` 的 `createPlacedSessionRow`,三只店同调)。崩在两笔之间 = 存档在而格缺 = 一只 placed 行、属主从没被记下(读作无主;
-     * 这形只在 fleet 调用方可读,停驻挂点的认领口 {@link claimOwnerless} 按委派律补上)。
+     * 首写不可变),再写会话元数据那一格(化身新铸;属主 = `placement.owner` 原样 —— core 7.62.0 [ref] 盒义务 7:委派树的属主是引擎判的,店只记、不推断;
+     * 唯一读法 `placedSessionOwnerOf`,在建存档之前判,坏值 ⇒ 响亮拒、一个字节不写;SQL 孪生同调)。崩在两笔之间 = 存档在而格缺 = 一只 placed 行、属主从没被记下
+     * (读作无主;本店没有回填臂 —— M23 的扫描与回写是 SQL 语句,只在两只 SQL 店跑 —— 这一行在具名树的停驻挂点被否决、响亮,匿名树 `null === null` 照放;SQL 孪生的同形由 M23 在窗内回填)。
      * 格已在而存档不在(登记先落了格、存档还没建 —— 一只普通会话的行)⇒ `placement_refused`(SQL 孪生:登记过的行在,带 placement 的建读回缺席元组,同一判)。
      * 建后读回准入(镜像方向):别的进程(同一数据根上的 run-local 腿)在这一刻抢先建了同 id 的存档 ⇒ repo 返回的是那一只 ⇒ 元组缺席 / 异组 ⇒ 响亮拒。
      */
@@ -484,11 +520,6 @@ export declare class LocalSessionStore implements SessionStore {
      * 整段在这只会话的写锁里(与删除 / 换装 / 登记同一把)。
      */
     release(sessionId: string): Promise<void>;
-    /**
-     * 委派继承律的认领口(锁内 CAS):placed 行、那一格的化身 = `incarnation`、属主无主(记下的 `null` 或从没被记下)⇒ 写 `owner`、返回 true;任何一条不符 ⇒ false、零写
-     * (SQL 孪生的 `CLAIM_OWNERLESS_PLACED_SQL` 同四个条件)。placement 读不出 ⇒ 上抛(不写)。
-     */
-    private claimOwnerlessPlaced;
     /**
      * P0.5 variant-2 (E16, clay 2026-06-26) — enumerate the caller's sessions (CC /resume picker) from the SESSION
      * abstraction (`repo.list()`), keyset-paginated newest-first by last activity. Session IDENTITY comes from the
@@ -617,7 +648,7 @@ export declare class LocalSessionStore implements SessionStore {
      *  ③ 内容,按写口的动词(唯一读法在下面这一只 switch;这里不读那一格、不判属主,只换**内容**;交给引擎仓的属主恒缺席 —— 规则一):
      *    · `create` / `judged`(导入):原地换锁里读到的那一份存档的日志(没有存档 ⇒ 导入新建一只,匿名),以锁里读到的存档头为 `expect.row`(**行代号**:
      *      读与写之间存档换了一代 ⇒ 引擎仓拒 `conflict`;它判不出同一代里的追加)。匿名导入只换匿名存档的日志 —— 仍带属主戳的存档(更早的版本写下、一次性迁移 M33
-     *      改写不了的,或跳版升上来的)本店先以具名拒 `StampedSessionArchiveError` 答(与 fork 同一只;引擎导入律同样会拒,本店不重写、不绕,只让拒带对的出路)。
+     *      改写不了的,或跳版升上来的)到不了这里:暂存提交在一切「谁赢」的判之前就以具名拒答了它({@link assertArchiveAnonymousHeld},唯一的一读);`create` 落在没有存档的名上,`replace` 先清存档。
      *      读存档、校验、存档判与写在引擎仓里是一步,抛在哪一处内容都一个字节没动 ⇒ 撤回 ②({@link withdrawImportCell}:行原样 —— 净零写,SQL 孪生的事务回滚同义)再原样上抛;
      *    · `replace`(接口句「先清既有对话日志,再导入」):先清掉内容存档(不带 `expect` —— 带了就得先读它的头,读不出的存档就清不掉),再导入一只新存档。
      *      清不可撤:清过之后导入再抛(I/O 故障),内容就没了,行留 ② 落下的 mirror(只读方向,下次推送补齐)—— 已发版本的 replace 同形(删后导入)。
@@ -663,10 +694,18 @@ export declare class LocalSessionStore implements SessionStore {
     readStagedEntries(stagingId: string): Promise<SessionTreeEntry[]>;
     /** Drop a finished/aborted local staging handle from the registry (called by the handle on commit/abort). */
     forgetStaging(stagingId: string): void;
+    /**
+     * 带戳存档的唯一一判(调用方持这只会话的写锁;只读、零写):这份存档的头仍记着属主戳(更早的版本导入 / 换装写下的,一次性迁移 M33 改写不了的,或跳版升上来的)⇒
+     * {@link StampedSessionArchiveError}。引擎导入律不让匿名导入替换带戳存档,本店不重写、不绕 —— 只让拒带对的出路(fork 的源另有一读,同一只具名拒,见 {@link forkTo})。
+     * 这是「这份存档的日志根本换不了」的判,所以排在一切「谁赢」的判之前({@link commitStagedImport}):换不了的存档上谈不上同步冲突或载荷分叉,
+     * 那两条拒的出路(带同意重来)都是死路 —— 唯一的出路在这一句里。
+     */
+    private assertArchiveAnonymousHeld;
     /**
      * {@link LocalStagingHandle.commit} 的整段 —— **一次持锁**(这只会话的写锁,{@link withSessionWriteLock}):属主 CAS(此刻的属主格 = 这次导入的门判过的那一格,
-     * 否则抛 {@link StagedCommitOwnerChangedError},一个字节不写;在判目的端日志之前判,SQL 孪生同序)→ 提交时重新分类(目的端此刻的日志 vs staged)
-     * → 拒未经同意的 fork / stale / 载荷分叉 → 本处写者拒 → 换装(导入写序 ①②③,落点 `judged` = 上面这一判;化身与 fork 键按换装律沿用)或 identical 且内容相同时日志不动、
+     * 否则抛 {@link StagedCommitOwnerChangedError},一个字节不写;在判目的端日志之前判,SQL 孪生同序)→ 分区判 → 提交时重新分类(目的端此刻的日志 vs staged)→
+     * 这一提交要换日志(不是「id 与内容都相同」那一支)⇒ 带戳存档判({@link assertArchiveAnonymousHeld};只有 local 店有带戳存档,SQL 孪生没有这一步)→
+     * 拒未经同意的 fork / stale / 载荷分叉(带戳判在它们之前:带戳存档上日志换不了,同步冲突与载荷分叉的出路 —— 带同意重来 —— 无从谈起)→ 本处写者拒 → 换装(导入写序 ①②③,落点 `judged` = 上面这一判;化身与 fork 键按换装律沿用)或 identical 且内容相同时日志不动、
      * 行照样落(② 那一格:重戳属主 + mirror)→ 两支同记新近(推送即活动)→ **在同一次持锁里**
      * 读出落定的会话面交回。锁放下之前谁也换不掉这一位住客,所以交回的面就是这次提交落下的那一位(SQL 孪生在提交事务里读同一行,同义);
      * 提交之后按住客条件写的重放(会话行两位)只认这只面,不再重读。改属主的每一条写腿(登记 / 删除 / 导入 / 换装)都在同一把锁里,所以锁内这一读到锁放下都成立。

package/dist/plugins/local-session-store.js

@@ -3,17 +3,17 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, rea
 import { AsyncLocalStorage } from "node:async_hooks";
 import { isDeepStrictEqual } from "node:util";
 import { dirname, join, resolve } from "node:path";
-import { assertFirstOwnerWritable, forkOwnerOf, importerOwnerOf } from "./session-ownership.js";
-import { StampedSessionArchiveError, sessionUnreadableOf } from "../session-error-wire.js";
+import { assertFirstOwnerWritable, forkOwnerOf, importerOwnerOf, placedSessionOwnerOf } from "./session-ownership.js";
+import { SessionOwnerUnreadableError, StampedSessionArchiveError, sessionUnreadableOf } from "../session-error-wire.js";
 import { FileSessionRepo, SessionError, StoredSession, admitSessionPlacement, atomicWriteFile, sessionLogMarkOf, settledForkOptions, uuidv7, validateEntriesForImport } from "@sema-agent/core";
-import { createPlacedSessionRow, sourceFacesVia } from "../delegated-session-owner.js";
 import { placementCapabilityOf } from "./session-placement.js";
 import { z } from "zod";
 import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { judgeSessionRowWrite, sessionRowTagKey, settleSessionRowWrite, } from "../session-row.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
-import { createZodColumnReader, decodeJsonColumn, readStringRecordColumn, SqlJsonColumnError } from "./sql-json-column.js";
+import { createZodColumnReader, decodeJsonColumn, isJsonColumnBodyProblem, readStringRecordColumn, SqlJsonColumnError } from "./sql-json-column.js";
+import { SCHEMA_MISMATCH_ERROR_CODE } from "./schema-consistency.js";
 import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./one-time-migrations.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createLogger } from "../observability/logger.js";
@@ -24,7 +24,6 @@ import { SessionForkInProgressError, SessionWriterPresentError, WRITABLE, assert
 import { classifyForkTarget, forkByFreshId } from "./session-fork.js";
 import { decodeInstructionSource, encodeInstructionSource, sameInstructionSourceBaseline } from "../instruction-source-notice.js";
 import { decodeSessionWorkspaceCell, encodeSessionWorkspaceCell } from "./session-workspace-cell.js";
-import { noteReplayInSessionOpenScope, openSessionForItself } from "../session-records-skipped-notice.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { buildObjectivePreview, isAttachmentFrame } from "../user-authored-text.js";
 import { classifySyncRelationshipByIds, ownerCellIs, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, } from "../session-sync-kernel.js";
@@ -35,8 +34,8 @@ function archiveFaultWord(code) {
         case "not_found":
             return "absent";
         case "corrupt_session":
-        case "invalid_session":
             return code;
+        case "invalid_session":
         case "invalid_entry":
         case "invalid_fork_target":
         case "storage":
@@ -54,6 +53,12 @@ function unusableArchiveOf(word, fault) {
     const code = fault instanceof SessionError ? undefined : fault?.code;
     return { state: "unusable", word, fault, ...(word === "storage" && typeof code === "string" ? { errno: code } : {}) };
 }
+function ownerUnreadableArchive(probe) {
+    const { fault } = probe;
+    if (probe.word === "storage" || !(fault instanceof SessionError))
+        return probe;
+    return { ...probe, fault: new SessionOwnerUnreadableError(fault) };
+}
 function importRowRefused(sessionId, landing) {
     return new SessionError("conflict", landing === "create"
         ? `session ${sessionId} already exists — importEntries only creates a session (replaceEntries rewrites one); nothing was written`
@@ -148,6 +153,32 @@ function ownerClaimWindowOpen() {
 }
 const SIDECAR_MAP_STATE_BY_PATH = new Map();
 const SESSION_WRITE_LOCKS_BY_ROOT = new Map();
+const quotedFieldNames = (names) => `${names.slice(0, 8).map((name) => JSON.stringify(name.slice(0, 64))).join(", ")}${names.length > 8 ? `, … (${names.length} in all)` : ""}`;
+function describeLocalDataRootMismatch(findings, when) {
+    const lines = [
+        when === "boot"
+            ? `${SCHEMA_MISMATCH_ERROR_CODE}: the local data root does not match this build's shape — refusing to start.`
+            : `${SCHEMA_MISMATCH_ERROR_CODE}: the local data root does not match this build's shape — refusing to read or write the file(s) named below until this process is restarted.`,
+    ];
+    for (const f of findings) {
+        lines.push(f.unknownFields.length > 0
+            ? `  ${f.label} at ${f.path}: UNKNOWN field(s) ${quotedFieldNames(f.unknownFields)} — the data root is NEWER than this build (a newer server engine wrote it).`
+            : `  ${f.label} at ${f.path}: unreadable (${f.problem}) — this build cannot read it, and an unreadable file is treated as a mismatch, not as empty.`);
+    }
+    lines.push("This build never reads such a file as empty and never writes over it: either would silently change what the file records.", "", "  Ways out (these three and no others):", "    (1) the data root is NEWER than this build (unknown fields): deploy the build that wrote it;", "    (2) roll back: restore the data-root backup taken before the upgrade, then start this build — also the way out when the file's bytes are damaged (not-json / malformed);", "    (3) the file could not be read at all (an I/O error such as EACCES): repair access to it (permissions, mount, disk) and restart — nothing in the file needs changing.", "The check behind this refusal only reads: the file was left in place and nothing in the data root was changed.");
+    return lines.join("\n");
+}
+export class LocalDataRootSchemaMismatchError extends StoreBootRefusalError {
+    findings;
+    when;
+    code = SCHEMA_MISMATCH_ERROR_CODE;
+    constructor(findings, when) {
+        super(describeLocalDataRootMismatch(findings, when));
+        this.findings = findings;
+        this.when = when;
+        this.name = "LocalDataRootSchemaMismatchError";
+    }
+}
 class SidecarMap {
     path;
     label;
@@ -174,32 +205,68 @@ class SidecarMap {
         if (!path)
             return Promise.resolve();
         const st = this.state;
+        if (st.refused !== undefined)
+            return Promise.reject(st.refused);
         if (!st.loaded) {
             st.loaded = (async () => {
-                try {
-                    const parsed = decodeJsonColumn(await readFile(path, "utf8"), this.read, this.label);
-                    for (const [id, v] of Object.entries(parsed)) {
+                const disk = await this.readDisk(path);
+                if (disk.state === "absent")
+                    return;
+                if (disk.state === "read") {
+                    for (const [id, v] of Object.entries(disk.entries)) {
                         if (!st.entries.has(id))
                             st.entries.set(id, v);
                     }
+                    return;
                 }
-                catch (e) {
-                    if (e?.code === "ENOENT")
-                        return;
-                    if (!this.strict) {
-                        this.onUnreadable(path, e);
-                        return;
-                    }
-                    const kind = e instanceof SqlJsonColumnError ? e.problem : (e?.code ?? "unreadable");
-                    throw new Error(`${this.label} is unreadable (${kind}) — refusing to read or write session owners and incarnations until it is repaired: ` +
-                        `reading it as empty would turn every session ownerless, and a replacement incarnation token for an existing session would ` +
-                        `make it a different occupant (its memory opt-out would stop binding it); a write would overwrite the unreadable bytes. ` +
-                        `The file is left in place at ${path}.`);
+                if (!this.strict) {
+                    this.onUnreadable(path, disk.fault);
+                    return;
                 }
+                st.loaded = undefined;
+                throw this.refuse(path, disk);
             })();
         }
         return st.loaded;
     }
+    async reconcile() {
+        const path = this.path;
+        if (!path)
+            return;
+        const st = this.state;
+        if (st.refused !== undefined)
+            throw st.refused;
+        if (!st.loaded)
+            return this.ensureLoaded();
+        await st.loaded;
+        const disk = await this.readDisk(path);
+        if (disk.state === "unreadable")
+            throw this.refuse(path, disk);
+    }
+    async readDisk(path) {
+        let text;
+        try {
+            text = await readFile(path, "utf8");
+        }
+        catch (e) {
+            return e?.code === "ENOENT" ? { state: "absent" } : { state: "unreadable", fault: e };
+        }
+        try {
+            return { state: "read", entries: decodeJsonColumn(text, this.read, this.label) };
+        }
+        catch (e) {
+            return { state: "unreadable", fault: e };
+        }
+    }
+    refuse(path, disk) {
+        const shape = isJsonColumnBodyProblem(disk.fault);
+        const problem = disk.fault instanceof SqlJsonColumnError ? disk.fault.problem : (disk.fault?.code ?? "unreadable");
+        const unknownFields = disk.fault instanceof SqlJsonColumnError ? disk.fault.unknownKeys : [];
+        const refusal = new LocalDataRootSchemaMismatchError([{ path, label: this.label, problem, unknownFields }], "serving");
+        if (shape)
+            this.state.refused = refusal;
+        return refusal;
+    }
     persist() {
         return this.commit(() => true);
     }
@@ -216,11 +283,22 @@ class SidecarMap {
         const path = this.path;
         const st = this.state;
         const link = st.writeChain.then(async () => {
+            if (st.refused !== undefined)
+                throw st.refused;
             const base = new Map(st.entries);
             const draft = new Map(base);
             if (!change(draft))
                 return true;
             if (path) {
+                if (this.strict) {
+                    const disk = await this.readDisk(path);
+                    if (disk.state === "unreadable") {
+                        if (isJsonColumnBodyProblem(disk.fault))
+                            throw this.refuse(path, disk);
+                        this.onWriteFailed(disk.fault);
+                        return false;
+                    }
+                }
                 try {
                     const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
                     await writeFile(tmp, JSON.stringify(Object.fromEntries(draft)), "utf8");
@@ -241,7 +319,7 @@ class SidecarMap {
             }
             return true;
         });
-        st.writeChain = link.then(() => undefined);
+        st.writeChain = link.then(() => undefined, () => undefined);
         return link;
     }
 }
@@ -255,10 +333,7 @@ function noteReplayInArchiveRewriteRead(info) {
 }
 export function createLocalSessionRepo(root) {
     return new FileSessionRepo(root, {
-        onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", (info) => {
-            noteReplayInSessionOpenScope(info);
-            noteReplayInArchiveRewriteRead(info);
-        }),
+        onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInArchiveRewriteRead),
     });
 }
 function occupiedBy(session, row) {
@@ -351,7 +426,6 @@ export class LocalSessionStore {
     placements;
     placementOf;
     listPlaced;
-    claimOwnerless;
     recordedPlacementOf;
     pending = new Map();
     rowsDropped = new Set();
@@ -369,6 +443,7 @@ export class LocalSessionStore {
     instructionSources;
     workspaces;
     meta;
+    strictSidecars = [];
     log;
     sessionWriteLocks;
     executionPlacement;
@@ -389,7 +464,6 @@ export class LocalSessionStore {
             this.recordedPlacementOf = (sessionId) => repoPlacementOf.call(repo, sessionId);
             this.placementOf = this.recordedPlacementOf;
             this.listPlaced = (kind, o) => repoListPlaced.call(repo, kind, o);
-            this.claimOwnerless = (sessionId, incarnation, owner) => this.claimOwnerlessPlaced(sessionId, incarnation, owner);
         }
         else {
             this.recordedPlacementOf = async () => undefined;
@@ -409,7 +483,12 @@ export class LocalSessionStore {
             }
             this.durability = opts.durability;
         }
-        const sidecar = (file, which, read, strict = false) => new SidecarMap(dataDir ? resolve(join(dataDir, file)) : undefined, `${file} (the local ${which} sidecar)`, read, (path, e) => this.refuseSidecar(path, `LocalSessionStore ${which} sidecar`, e, which), (e) => this.warnSidecar("write", e, which), strict);
+        const sidecar = (file, which, read, strict = false) => {
+            const map = new SidecarMap(dataDir ? resolve(join(dataDir, file)) : undefined, `${file} (the local ${which} sidecar)`, read, (path, e) => this.refuseSidecar(path, `LocalSessionStore ${which} sidecar`, e, which), (e) => this.warnSidecar("write", e, which), strict);
+            if (strict)
+                this.strictSidecars.push(map);
+            return map;
+        };
         this.titles = sidecar("session-titles.json", "title", readStringRecordColumn);
         this.pinned = sidecar("session-pinned.json", "pinned", readPinnedSidecar);
         this.instructionSources = sidecar("session-instruction-sources.json", "instruction-source", readStringRecordColumn);
@@ -430,6 +509,19 @@ export class LocalSessionStore {
             place: (sessionId, occupant, cell) => this.placeExecution(sessionId, occupant, cell),
         };
     }
+    async assertStrictSidecarsReadable() {
+        const loads = await Promise.allSettled(this.strictSidecars.map((map) => map.reconcile()));
+        const findings = [];
+        for (const load of loads) {
+            if (load.status === "fulfilled")
+                continue;
+            if (!(load.reason instanceof LocalDataRootSchemaMismatchError))
+                throw load.reason;
+            findings.push(...load.reason.findings);
+        }
+        if (findings.length > 0)
+            throw new LocalDataRootSchemaMismatchError(findings, "boot");
+    }
     async forkingRead(sessionId, meta) {
         if (!isForkCreatedCell(meta))
             return false;
@@ -597,7 +689,7 @@ export class LocalSessionStore {
             return { state: "found", meta: readSessionMetaCell(cell) };
         const probe = await this.probeArchive(sessionId);
         if (probe.state === "unusable")
-            return probe;
+            return ownerUnreadableArchive(probe);
         if (probe.state === "absent")
             return { state: "absent" };
         const meta = await this.cellOfPresent(sessionId);
@@ -922,7 +1014,7 @@ export class LocalSessionStore {
     }
     async openForItselfHeld(sessionId, opts) {
         await this.meta.ensureLoaded();
-        const session = await openSessionForItself(sessionId, () => this.repo.open({ id: sessionId, createdAt: "" }));
+        const session = await this.repo.open({ id: sessionId, createdAt: "" });
         admitSessionPlacement(sessionId, (await session.getMetadata()).placement, opts ?? {}, placementCapabilityOf(this));
         return this.handOut(sessionId, session);
     }
@@ -930,15 +1022,9 @@ export class LocalSessionStore {
         if (this.metaCellOf(sessionId) !== undefined) {
             throw new SessionError("placement_refused", `session ${sessionId} is already registered as an ordinary session — refusing to create a subagent transcript on its id`);
         }
-        let session;
-        await createPlacedSessionRow(sessionId, placement, {
-            readFaces: sourceFacesVia((id) => this.headOf(id)),
-            insert: async (owner) => {
-                session = await this.repo.create({ id: sessionId, placement });
-                await this.writeMeta(sessionId, (before) => (before === undefined ? { incarnation: mintSessionIncarnation(), owner, createdAt: rowBornNow() } : undefined));
-            },
-            readOwner: async () => (await this.headOf(sessionId))?.owner,
-        }, this.log);
+        const owner = placedSessionOwnerOf(sessionId, placement);
+        const session = await this.repo.create({ id: sessionId, placement });
+        await this.writeMeta(sessionId, (before) => (before === undefined ? { incarnation: mintSessionIncarnation(), owner, createdAt: rowBornNow() } : undefined));
         admitSessionPlacement(sessionId, (await session.getMetadata()).placement, opts, placementCapabilityOf(this));
         return this.handOut(sessionId, session);
     }
@@ -980,20 +1066,6 @@ export class LocalSessionStore {
             await this.repo.delete({ id: sessionId, createdAt: "" });
         });
     }
-    async claimOwnerlessPlaced(sessionId, incarnation, owner) {
-        return this.withSessionWriteLock(sessionId, async () => {
-            if ((await this.placedRecordOrThrow(sessionId)) === undefined)
-                return false;
-            return this.writeMeta(sessionId, (before) => {
-                if (before === undefined)
-                    return undefined;
-                const cell = readSessionMetaCell(before);
-                if (cell.incarnation !== incarnation || (cell.owner ?? null) !== null)
-                    return undefined;
-                return cellWith(before, { owner });
-            });
-        });
-    }
     async listSessions(opts) {
         await this.loadRowSidecars();
         const rows = [];
@@ -1189,8 +1261,6 @@ export class LocalSessionStore {
             case "judged":
                 try {
                     const archive = (await this.archiveHeadOf(sessionId)) ?? null;
-                    if ((archive?.owner ?? null) !== null)
-                        throw new StampedSessionArchiveError(sessionId);
                     await this.repo.importEntries(sessionId, undefined, entries, { expect: { row: archive } });
                 }
                 catch (err) {
@@ -1268,6 +1338,10 @@ export class LocalSessionStore {
     forgetStaging(stagingId) {
         this.stagings.delete(stagingId);
     }
+    async assertArchiveAnonymousHeld(sessionId) {
+        if (((await this.archiveHeadOf(sessionId))?.owner ?? null) !== null)
+            throw new StampedSessionArchiveError(sessionId);
+    }
     async commitStagedImport(sessionId, owner, staged, opts) {
         return this.withImportLock(sessionId, owner, async (importer) => {
             const current = await this.metaOf(sessionId);
@@ -1278,6 +1352,9 @@ export class LocalSessionStore {
             await this.assertNotPlacedHeld(sessionId);
             const dstEntries = await this.exportEntries(sessionId);
             const rel = classifySyncRelationshipByIds(staged.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
+            const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(staged, dstEntries);
+            if (!contentEqual)
+                await this.assertArchiveAnonymousHeld(sessionId);
             if ((rel.relation === "fork" || rel.relation === "stale") && opts.resolution !== "overwrite-dst") {
                 throw new SyncConflictError(sessionId, rel);
             }
@@ -1287,7 +1364,6 @@ export class LocalSessionStore {
                 if (diverged)
                     throw new SyncConflictError(sessionId, contentForkRelation(diverged, rel.newEntryIds));
             }
-            const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(staged, dstEntries);
             if (current?.execution?.role === "writer")
                 throw new SessionWriterPresentError(sessionId, current.execution.lane);
             if (rel.relation !== "identical" || !contentEqual) {

package/dist/plugins/local-session-window.d.ts

@@ -24,12 +24,14 @@
  *
  * ## Cost: one linear walk, the engine's
  * The branch is core's own `getPathToRoot` over the whole log (the walk every engine read of a local session makes, with its stop
- * rules: an entry without a parent ends it, a parent the log does not hold is `invalid_session`, an unknown leaf is `not_found`).
+ * rules: an entry without a parent ends it, a parent the log does not hold is `corrupt_session` — `invalid_session` up to core 7.61.x —, an unknown
+ * leaf is `not_found`). A missing parent whose replay dropped records is the one break a RUN does not refuse since core 7.62.0 ([ref]: it re-roots
+ * and says `session.lineage_rerooted`); this view is not a run and takes the walk's refusal as is.
  * Since core 7.54.0 ([ref]) that walk is linear; before, it built the path with `unshift` (quadratic — seconds on a long session, on
  * the event loop) and this module walked the `parentId` chain itself. The second walker is retired: the view reads the branch the
  * engine reads, by the engine's reading. Every later read of the window goes through the same walk, bounded by the floor.
  * A parent CYCLE (a corrupted log; the engine never writes one) is refused by that same walk: since core 7.54.1 it carries one
- * `ParentChainGuard`, and the entry it stands on twice ends it with `invalid_session` naming that entry — `wake` refuses a looped log
+ * `ParentChainGuard`, and the entry it stands on twice ends it with `corrupt_session` (`invalid_session` up to core 7.61.x) naming that entry — `wake` refuses a looped log
  * the way it refuses one whose parent is missing. Core 7.54.0's walk had no guard (a looped log spun it forever on the event loop,
  * and the view's wake with it). The retired walker's own cycle refusal went with it: the engine's guard is the one refusal now, shared
  * by `getPathToRoot` and the run's resume ancestor scan (the two walks core 7.54.1 guards; this module has no walker of its own left).