@sema-agent/server 7.143.0 → 7.144.0

package/dist/plugins/remote-env-host.js

@@ -13,7 +13,7 @@ import { IS_WIN32, resolveHostShell, hostShell, pinHostShell, spawnGroupOptions,
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
 import { FileError, NodeExecutionEnv, inheritEnvPolicyProblem, ExecutionError, RemoteExecutionError, RollingTailBuffer, walkSymlinkChain, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
 import { capabilitiesFor } from "../execution-lane-caps.js";
-import { LaneHomeSeat } from "../lane-home-probe.js";
+import { LaneHomeSeat, laneHomeRefusal } from "../lane-home-probe.js";
 import { composeHostSubprocessEnv, hostSubprocessEnv, withheldFromHostSubprocess } from "../server-secret-env.js";
 import { nameTooLongCode } from "./remote-env-file-error.js";
 import { trackEphemeralHostWorkspace, untrackEphemeralHostWorkspace } from "./host-workspace-registry.js";
@@ -64,11 +64,13 @@ export class RemoteHostExecutionEnv {
         return this.homeSeat.home;
     }
     homeSeat;
-    homeRefusal;
     get cdPath() {
         const value = this.childEnv(undefined, undefined).CDPATH;
         return value === undefined || value === "" ? [] : value.split(":");
     }
+    get receivedEnvNames() {
+        return Object.entries(this.childEnv(undefined, undefined)).flatMap(([name, value]) => (value === undefined ? [] : [name]));
+    }
     get withheldEnv() {
         return withheldFromHostSubprocess({ policy: this.cfg.inheritEnv, allow: [] }, this.cfg.env);
     }
@@ -148,7 +150,9 @@ export class RemoteHostExecutionEnv {
         this.cwd = this.workspaceDir;
         this.handle = { sandboxId: this.workspaceDir, provider: PROVIDER, mountPath: this.workspaceDir };
         this.homeSeat = new LaneHomeSeat(PROVIDER, config, IS_WIN32 ? "win32" : "posix");
-        this.homeRefusal = this.homeSeat.settle(this.childHome())?.refusal;
+        const homeVerdict = this.homeSeat.settle(this.childHome());
+        if (homeVerdict !== undefined)
+            throw laneHomeRefusal(homeVerdict);
     }
     workspaceHandle() {
         return this.handle;
@@ -158,8 +162,6 @@ export class RemoteHostExecutionEnv {
             return unsupported("connect(snapshotId)");
         if (this.destroyed)
             return { ok: false, error: new RemoteExecutionError("connect_failed", "execution env already destroyed") };
-        if (this.homeRefusal !== undefined)
-            return { ok: false, error: new RemoteExecutionError("connect_failed", this.homeRefusal) };
         if (config?.abortSignal?.aborted)
             return { ok: false, error: new RemoteExecutionError("aborted", "connect aborted") };
         try {
@@ -1262,8 +1264,6 @@ export class RemoteHostExecutionEnv {
     async shellReady() {
         if (this.destroyed)
             return { ok: false, error: new ExecutionError("shell_unavailable", "execution env already destroyed") };
-        if (this.homeRefusal !== undefined)
-            return { ok: false, error: new ExecutionError("shell_unavailable", this.homeRefusal) };
         try {
             try {
                 await resolveHostShell();
@@ -1295,8 +1295,6 @@ export class RemoteHostExecutionEnv {
         return (this.spoolRootDir !== undefined && inside(this.spoolRootDir)) || (this.persistent && inside(this.workspaceDir));
     }
     async fsReady(p, opts) {
-        if (this.homeRefusal !== undefined)
-            return { ok: false, error: new FileError("target_unavailable", this.homeRefusal, this.resolve(p)) };
         if (this.destroyed) {
             const lingering = opts?.lingeringBgWrite === true && this._bgManager?.hasShells() === true && this.isLingeringMirrorTarget(p);
             if (!lingering)

package/dist/plugins/remote-shell.js

@@ -157,7 +157,7 @@ export async function runSymlinkChain(absPath, run) {
 const STAGED_FILE = "data";
 const STAGE_DIR_REFUSED_EXIT = 3;
 const STAGE_DIR_UNSEALED_EXIT = 4;
-const STAGE_DIR_UNSEALED_MESSAGE = "sema: the private staging directory could not be made private (chmod 700 failed or did not take effect, or the mode or owner read back differently — the filesystem ignores permission bits or the parent directory carries a default ACL); nothing was staged";
+const STAGE_DIR_UNSEALED_MESSAGE = "sema: the private staging directory could not be made private (chmod 700 failed or did not take effect, the mode or owner read back differently, or an inherited ACL entry could not be removed or read on this platform — the filesystem ignores permission bits or the parent directory carries a default or inheritable ACL); nothing was staged";
 export const STAGE_DIR_LEFT_MARK = "sema: staging directory left behind:";
 export function buildStagingPaths(abs, nonce = randomBytes(6).toString("hex")) {
     const cut = abs.lastIndexOf("/");
@@ -174,7 +174,17 @@ function privateMkdir(dir) {
 }
 function hardenPrivate(dir) {
     const statOf = (gnu, bsd) => `$(stat -c ${gnu} -- ${dir} 2>/dev/null || stat -f ${bsd} -- ${dir} 2>/dev/null)`;
-    return `( chmod -- 700 ${dir} 2>/dev/null && m=${statOf("%a", "%Lp")} && u=${statOf("%u", "%u")} && case "$m" in 700|[1-7]700) [ "$u" = "$(id -u)" ];; *) false;; esac )`;
+    return `( chmod -- 700 ${dir} 2>/dev/null && m=${statOf("%a", "%Lp")} && u=${statOf("%u", "%u")} && case "$m" in 700|[1-7]700) [ "$u" = "$(id -u)" ];; *) false;; esac && ${aclCleared(dir)} )`;
+}
+function aclCleared(dir) {
+    const marker = `ls_out=$(cd ${dir} && ls -ld . 2>&1) && [ -z "$(printf '%s\\n' "$ls_out" | sed -n 2p)" ] && mode_word=\${ls_out%% *} && ` +
+        `case "$mode_word" in d?????????*+*) echo +;; d?????????*) ;; *) false;; esac`;
+    return (`plat=$(uname -s 2>/dev/null) && case "$plat" in ` +
+        `Linux) acl_read() { :; }; acl_strip() { false; };; ` +
+        `Darwin) acl_read() { ls_out=$(cd ${dir} && ls -led . 2>&1) && case "$ls_out" in d?????????*) ;; *) false;; esac && printf '%s\\n' "$ls_out" | sed 1d; }; acl_strip() { chmod -N ${dir}; };; ` +
+        `FreeBSD) acl_read() { ${marker}; }; acl_strip() { setfacl -b ${dir}; };; ` +
+        `SunOS) acl_read() { ${marker}; }; acl_strip() { chmod A- ${dir}; };; ` +
+        `*) false;; esac && acl=$(acl_read 2>/dev/null) && { [ -z "$acl" ] || { acl_strip 2>/dev/null && acl=$(acl_read 2>/dev/null) && [ -z "$acl" ]; }; }`);
 }
 function emptyPrivate(dir) {
     return `[ ! -e ${dir}/${STAGED_FILE} ] && [ ! -L ${dir}/${STAGED_FILE} ]`;

package/dist/plugins/schema-consistency.d.ts

@@ -73,7 +73,11 @@ export interface ParsedTable {
 export declare function parseCreateTable(stmt: string): ParsedTable | undefined;
 /** 启动时真会建出来的**全部**表形(录制 → 解析)。同名表二次出现以**先到**为准(`IF NOT EXISTS` 的真语义)。 */
 export declare function expectedTableShapes(dialect: SqlDialect): Promise<Map<string, ParsedTable>>;
-/** 拒启码(机读)。附录 A / 拒启码表的登记名。 */
+/**
+ * 拒启码(机读)。附录 A / 拒启码表的登记名。含义 = 「本构建读不出的持久形,开始服务之前判」,一个码三只臂:本文件的列册对账与退役 schema 两道(SQL),
+ * 以及 local 数据根的严格边档对账(`local-session-store.ts` 的 `LocalDataRootSchemaMismatchError`,`LocalBackend.ensureSchema()` 调;拒句同形:
+ * 码开头的表头 · 逐坐标一段 · 「NEWER than this build」方向句 · 闭集出路)。
+ */
 export declare const SCHEMA_MISMATCH_ERROR_CODE = "config.schema_mismatch";
 /** 一张表的对账结论。 */
 export interface TableMismatch {

package/dist/plugins/session-fork.d.ts

@@ -28,7 +28,7 @@ export interface ForkLogRow {
     readonly ts: unknown;
 }
 /**
- * 两只 SQL 孪生的行怎么交给引擎的 `selectForkRows`(按答案挑行 + 新会话的叶;分叉点不在日志里 ⇒ `invalid_fork_target`、路径中途悬空父 / 父链成环 ⇒ `invalid_session`,
+ * 两只 SQL 孪生的行怎么交给引擎的 `selectForkRows`(按答案挑行 + 新会话的叶;分叉点不在日志里 ⇒ `invalid_fork_target`、路径中途悬空父 / 父链成环 ⇒ `corrupt_session`〔core 7.61.x 及以前 `invalid_session`〕,
  * 引擎的原词原句)。本仓不再自写父链走法 —— 那曾是与引擎 `getPathToRoot` 同义的第二份。
  */
 export declare const FORK_LOG_ROW_SHAPE: ForkRowShape<ForkLogRow>;

package/dist/plugins/session-ownership.d.ts

@@ -22,6 +22,15 @@ export declare function forkOwnerOf(requested: string | null | undefined, source
  * 「首写」由调用方判(已记下属主的会话上的调用照旧静默不改,不经这里)。判官 = {@link isSessionOwnerValue}(core 7.56.0 [ref] `principalNameOf`)。
  */
 export declare function assertFirstOwnerWritable(sessionId: string, owner: unknown): asserts owner is string | null;
+/**
+ * placed 行属主格的唯一读法(core 7.62.0 [ref] 盒义务 7;三只持久会话店的 placing write 同调):记下的属主 = 引擎交来的 `placement.owner` **原样** ——
+ * 委派树的属主由引擎判(没人派生的 run 读自己那一行、按化身绑一次,原样带给每一层子代;`null` = 根匿名),店只记、不判、不推断,也不进元组
+ * (`SessionPlacementRecord` 没有属主)。值不是主体名也不是 `null`(空串、空白、缺席 —— 绕过类型的调用)⇒ 响亮拒(`SessionError("storage")`,一个字节不写):
+ * 一只谁也不指的属主会让行要么谁都读得到、要么谁都读不到。判官 = {@link isSessionOwnerValue},与 `register` 首写同一只。
+ */
+export declare function placedSessionOwnerOf(sessionId: string, placement: {
+    readonly owner?: unknown;
+}): string | null;
 /**
  * 导入者的属主 —— 换装的写腿(公开 `importEntries` / `replaceEntries` 与暂存提交)把调用方给的属主重戳进会话行之前的唯一读法:
  * 主体名或 `null`(匿名)⇒ 原样交回;别的一切(空串、空白串、带控制 / 分隔 / 非连接符格式字符的串、非串)⇒ `TypeError` 响亮拒 ——

package/dist/plugins/session-ownership.js

@@ -22,6 +22,12 @@ export function assertFirstOwnerWritable(sessionId, owner) {
     throw new SessionError("storage", `register(${sessionId}): a first ownership write must carry a principal name or null (anonymous), got ${ownerValueFault(owner)} — ` +
         "a value that names nobody would leave the session claimable by anyone or ownable by no one; refusing, nothing written");
 }
+export function placedSessionOwnerOf(sessionId, placement) {
+    const owner = placement.owner;
+    if (isSessionOwnerValue(owner))
+        return owner;
+    throw new SessionError("storage", `acquire(${sessionId}): a placed session's owner (placement.owner, the delegation tree's owner the engine judged) must be a principal name or null (an anonymous tree), got ${ownerValueFault(owner)} — refusing, nothing written`);
+}
 export function importerOwnerOf(owner) {
     if (isSessionOwnerValue(owner))
         return owner;

package/dist/plugins/session-store.d.ts

@@ -1,8 +1,6 @@
 import { type SessionStore } from "@sema-agent/core";
 import type { ServiceConfig } from "../config-types.js";
 import type { StoreBackend } from "./store-backend.js";
-import { type DelegationRootWitness, type OrphanOwnerLog } from "../delegated-session-owner.js";
-import type { OwnerAwareSessionStore } from "../security.js";
 /**
  * Session-store plugin seam.
  *
@@ -43,23 +41,22 @@ export declare function createSessionStore(config: Pick<ServiceConfig, "sessionB
  */
 export declare function ensureSessionDurable(hostStore: SessionStore, sessionId: string): Promise<void>;
 /**
- * core `SubagentToolOptions.background.ensureChildSessionDurable` 的实现体 —— 停驻挂点的**见证**:这只后台子代的转录此刻是 host 店里一只有真内容、
- * 属主按委派继承律定得下来的会话,才放行停驻;任何一步不成立 ⇒ 抛 = 否决(core 收 veto 即 expire checkpoint + settle failed,pre-153 行为,不放大)。
+ * core `SubagentToolOptions.background.ensureChildSessionDurable(sessionId, given)` 的实现体 —— 停驻挂点的**见证**:这只后台子代的转录此刻是 host 店里一只有真内容、
+ * 属主恰是引擎交来的委派树属主(`given.owner`)的会话,才放行停驻;任何一步不成立 ⇒ 抛 = 否决(core 收 veto 即 expire checkpoint + settle failed,pre-153 行为,不放大)。
  *
  * 规则(`fork-routing-session-store.ts` 头注):一只后台子代的 durable 行在,它的转录就是 host 店委派分区里的一只 placed 行。挂点只装在声明了
  * durable 委派分区的部署上(stage-07:core `resolveSubagentTranscriptTier(...) === "full"`),那里 core 给每只新起的后台子代铸 placement、
- * 转录生来就在 host 店 —— 所以这里**只验、不搬**(此前的「晋升」把私店的转录整树拷进 host 店,随这条规则退役)。
- *   0. 属主(`delegated-session-owner.ts`):按委派继承律判一次(唯一判据 `judgeDelegatedOwner`)—— 来源集 = 见证的根这一只(调用方交出的委派树根 + 调用方判断那一刻
- *      读到的根行住客:请求腿 = 本请求经鉴权解析的会话与受理时那一读,`/decide` 赎回腿 = 行上的 `rootSessionId` 与写口放行的那一位(认领之前解析器那一读);core 的挂点签名只给子代 id,
- *      场景层把见证绑进闭包交下来)。此刻根行在而住客不是见证的那一位(删了、同 id 被重新登记)⇒ **拒**(`assertRootStillWitnessed`);
- *      缺席(行上没有根)或根行此刻不在 ⇒ 孤行哨兵。
+ * 转录生来就在 host 店 —— 所以这里**只验、不搬、不判属主**:属主是引擎判的(core 7.62.0 [ref] L1:没人派生的 run 读自己那一行、按化身绑一次,原样带给每一层子代;
+ * 复活的子代 = 它自己那一行的属主),placed 行建行那一笔原样记下了它(盒义务 7,三只持久会话店 + `session-ownership.ts` 的 `placedSessionOwnerOf`)。
+ * 挂点不认领、不推断、不收委派树根见证([ref] P-5;本仓的委派继承律在这一写点退役 —— 存量无主 placed 行:SQL 两店由一次性迁移 M23 在窗内回填,本机文件店没有回填臂,见 `local-session-store.ts` 头注)。
+ *   0. 宿主店读不出属主(没有 `headOf`,唯一判法 `headReadOf`)⇒ 响亮拒,一次读都不发。
  *   1. 在不在、有没有真内容:{@link ensureSessionDurable}(`requireExisting` 打开 + 叶子非空 + forget 收尾)。任何失败(不在、空壳、读故障)⇒ 原样上抛 = 否决
- *      (读故障也否决:说不准转录在不在,就不让一次审批押在它上面)。这里**不判它是不是 placed 行**:复活的是旧行时 id 取行上的会话(升级前停驻、当年晋升进来的普通行),
- *      它照样是这只子代的转录;判据只问「host 店里有这份真内容」。
- *   2. 属主定夺(`settleDelegatedOwner`):记着别的委派树 ⇒ 抛;记着这一棵 ⇒ 按它记录的根、父再判一次(与 M23 同读数),无主 ⇒ 认领(CAS 子行,写判断时的读数)、没落下 ⇒ 抛;
- *      此刻属主不是律给的那一只 ⇒ 那是别人的同 id 会话,不是这只子代的转录 ⇒ 抛 = 停驻否决。认领写下的是哨兵 ⇒ 写落下之后一行 warn(`site: "park"`)。
- * 宿主店必须读得出属主(`delegatedOwnerHostOf`:`headOf`;记录委派树的店另交 `placementOf` + `claimOwnerless`,两只同在或同缺;生产的 SQL / local 店与缓存包装层都满足),
- * 否则响亮拒。
+ *      (读故障也否决:说不准转录在不在,就不让一次审批押在它上面)。不判它是不是 placed 行:复活的是旧行时 id 取行上的会话(升级前停驻、当年晋升进来的普通行),
+ *      它照样是这只子代的转录。
+ *   2. 此刻行上的属主 ≠ `given.owner` ⇒ 那是别人的同 id 会话,或这一行在引擎读之后被改写 ⇒ 抛 = 停驻否决(拒句不带任何一方的属主值 —— 它会进停驻否决的错误面)。
+ *      契约只承诺属主值相等(化身不比:复活腿的 `given` 只带属主)。
  */
-export declare function attestChildSessionDurable(hostStore: OwnerAwareSessionStore, sessionId: string, root: DelegationRootWitness | undefined, log: OrphanOwnerLog): Promise<void>;
+export declare function attestChildSessionDurable(hostStore: SessionStore, sessionId: string, given: {
+    readonly owner: string | null;
+}): Promise<void>;
 //# sourceMappingURL=session-store.d.ts.map

package/dist/plugins/session-store.js

@@ -1,6 +1,6 @@
 import { TtlSessionStore } from "@sema-agent/core";
 import { CachingSessionStore } from "./caching-session-store.js";
-import { assertRootStillWitnessed, delegatedOwnerHostOf, readDelegatedOwner, reportWrittenOwner, settleDelegatedOwner, sourceFacesVia, } from "../delegated-session-owner.js";
+import { headReadOf } from "../session-incarnation.js";
 export function createSessionStore(config, backend, metrics) {
     if (config.sessionBackend === "tidb") {
         if (!backend)
@@ -23,16 +23,15 @@ export async function ensureSessionDurable(hostStore, sessionId) {
         await hostStore.forget?.(acquired.sessionId);
     }
 }
-export async function attestChildSessionDurable(hostStore, sessionId, root, log) {
-    const host = delegatedOwnerHostOf(hostStore);
-    if (host === undefined) {
-        throw new Error(`session "${sessionId}" cannot be parked: the host session store cannot read a session's owner (headOf), or records delegation trees without being able to claim under them (placementOf / claimOwnerless), so the delegated transcript's owner cannot be derived or checked`);
+export async function attestChildSessionDurable(hostStore, sessionId, given) {
+    const headOf = headReadOf(hostStore);
+    if (headOf === undefined) {
+        throw new Error(`session "${sessionId}" cannot be parked: the host session store cannot read a session's owner (headOf), so the delegated transcript's owner cannot be checked`);
     }
-    const judged = await readDelegatedOwner(sessionId, root === undefined ? {} : { rootSessionId: root.sessionId }, sourceFacesVia(host.headOf));
-    assertRootStillWitnessed(sessionId, root, judged);
     await ensureSessionDurable(hostStore, sessionId);
-    const settled = await settleDelegatedOwner(host, sessionId, judged.inherited.owner, judged.tree);
-    if (settled.claimed)
-        reportWrittenOwner(log, "park", sessionId, settled.judged ?? judged);
+    if ((await headOf(sessionId))?.owner !== given.owner) {
+        throw new Error(`session "${sessionId}" cannot be parked as this delegated session: the host session store holds a session with this id whose owner is not this delegation tree's owner, ` +
+            "so it does not attest this delegated transcript");
+    }
 }
 //# sourceMappingURL=session-store.js.map

package/dist/plugins/sql-json-column.d.ts

@@ -68,12 +68,13 @@ export interface JsonColumnMember {
  * 同一只投影的**裸表达式**(不带别名)—— 给 `WHERE` / `UPDATE … WHERE` 这种**没有别名位**的地方用。
  *
  * 🔴 存在的唯一理由是「别名位在那里不合法」,**不是**给读腿留第二条路:读腿一律用 {@link jsonColumnText}
- * (别名是它的产物的一部分,理由见那只函数)。今天整仓**两处**消费方,各自的「别名位不合法」都是真的:
+ * (别名是它的产物的一部分,理由见那只函数)。今天整仓**三处**消费方,各自的「别名位不合法」都是真的:
  *  · `one-time-migrations.ts` 的几条改写(M8 / M17 / M18 / M21 的候选扫描与按原文 CAS 回写)——
  *    它们要在 `WHERE` 里判这一列的**文本**,而 `WHERE` 没有别名位;
  *  · `workflow-journal-store-sql.ts` 的 `loadPage`([ref] 车③a)—— 那一列的投影裹在一条
  *    `CASE WHEN LENGTH(result) > ? THEN NULL ELSE <expr> END AS result_json` 里:**别名属于整条 CASE**
  *    (`result_json`,因为超字节门的那一支要给 `NULL`),CASE 里面的表达式位上写别名是语法错。
+ *  · 本模块的 {@link jsonColumnTextSha256} —— 投影裹在摘要函数里,**别名属于整条摘要表达式**(产物是摘要不是体)。
  * 而「怎么把一列 JSON 取成文本」这件事整仓只能有一种写法:两种承载(真 JSON 列 / LONGTEXT 别名)在这条
  * 表达式下合成同一只串,迁移的判等、分页腿的取文本因此与读腿的判形**看同一份字节**。
  *
@@ -82,6 +83,20 @@ export interface JsonColumnMember {
  * 误用的落点是真库上当场的 `SqlJsonColumnError("not-text")` 响亮抛(行上没有那个键 ⇒ `undefined`),不是静默。
  */
 export declare function jsonColumnTextExpr(dialect: SqlDialect, column: string, memberKey?: string): string;
+/**
+ * 一列 JSON 的**投影文本的 sha256**(十六进制小写,引擎内算 —— 整只文档不出库),带别名。输入恰是 {@link jsonColumnTextExpr} 那一只投影:
+ * 同一行、同一次读里,本表达式的摘要就是 {@link jsonColumnText} 交给读腿的那串字节的摘要,于是「字节没变 ⇒ 摘要没变」只有一种读法。
+ * MySQL 协议 `SHA2(<文本>, 256)`(TiDB / MySQL / MariaDB 都认);PG `encode(sha256(convert_to(<文本>, 'UTF8')), 'hex')`(PG 11+)。
+ *
+ * 读者今天一处:`checkpoint-store-sql.ts` 的停驻行投影记忆(运维队列 / 调度视图对一份停驻行字节的判决按 (摘要, 引擎构建) 记,
+ * 记忆命中就不拉整只文档)。产物是摘要不是体,所以它**不是**体的第二条投影路;回读走 {@link readJsonColumnTextSha256}。
+ */
+export declare function jsonColumnTextSha256(dialect: SqlDialect, column: string, as: string): string;
+/**
+ * {@link jsonColumnTextSha256} 那一格的回读:恒是 64 位十六进制小写串。别的一切(键不在 = 读腿漏了投影;串形不对 = 驱动换了行为)都是**码坏**,
+ * 响亮抛 —— 不当作「这一行没有摘要」退成每次整行读(那会让记忆静默失效,代价无声地涨回去)。
+ */
+export declare function readJsonColumnTextSha256(cell: unknown, where: string): string;
 /**
  * 一次读回失败的**种别**(店层码,**闭集**;运行期词表在这里,类型从它推导 —— 一张词表只有一个写者):
  *  · `not-text` —— 拿到的不是串 = **读腿漏了投影**,那是**码的问题不是数据的问题** ⇒ 响亮的程序错,
@@ -114,7 +129,12 @@ export declare class SqlJsonColumnError extends Error {
     readonly problem: SqlJsonColumnProblem;
     /** 出事的坐标(`<table>.<column> for <identity>`)—— 进错误文案,让运维知道去看哪一行。 */
     readonly where: string;
-    constructor(problem: SqlJsonColumnProblem, where: string, detail: string);
+    /**
+     * `malformed` 时形读者交出的「它不认得的键」({@link JsonColumnShapeBad.unknownKeys};别的种别 / 读者说不出 ⇒ 空)—— 体是更新的写者写下的那一形的判据
+     * (例:local 数据根的严格边档据它把拒句点名成「比本构建新」)。判词只有形读者一个写者,本类原样携带。
+     */
+    readonly unknownKeys: readonly string[];
+    constructor(problem: SqlJsonColumnProblem, where: string, detail: string, unknownKeys?: readonly string[]);
 }
 /** 形读者认了:带上收窄后的值。 */
 export interface JsonColumnShapeOk<T> {
@@ -125,6 +145,8 @@ export interface JsonColumnShapeOk<T> {
 export interface JsonColumnShapeBad {
     readonly value?: undefined;
     readonly problem: string;
+    /** 读者因为**不认得**而拒的键(去重、排序;没有 / 读者说不出 ⇒ 缺)—— 更新的写者给这一形加了位。{@link decodeJsonColumn} 原样交给 {@link SqlJsonColumnError.unknownKeys}。 */
+    readonly unknownKeys?: readonly string[];
 }
 /** {@link JsonColumnReader} 的答复。 */
 export type JsonColumnShape<T> = JsonColumnShapeOk<T> | JsonColumnShapeBad;

package/dist/plugins/sql-json-column.js

@@ -20,15 +20,30 @@ export function jsonColumnTextExpr(dialect, column, memberKey) {
     }
     return dialect === "pg" ? `(${column}::jsonb -> '${memberKey}')::text` : `CAST(JSON_EXTRACT(${column}, '$.${memberKey}') AS CHAR)`;
 }
+export function jsonColumnTextSha256(dialect, column, as) {
+    if (!MEMBER_ALIAS_RE.test(as)) {
+        throw new Error(`jsonColumnTextSha256: alias ${JSON.stringify(as)} must be a lower-case bare identifier — PostgreSQL folds unquoted aliases to lower case, so any other spelling would give the two dialects different row keys`);
+    }
+    const text = jsonColumnTextExpr(dialect, column);
+    return dialect === "pg" ? `encode(sha256(convert_to(${text}, 'UTF8')), 'hex') AS ${as}` : `SHA2(${text}, 256) AS ${as}`;
+}
+const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+export function readJsonColumnTextSha256(cell, where) {
+    if (typeof cell === "string" && SHA256_HEX_RE.test(cell))
+        return cell;
+    throw new Error(`${where}: expected a lower-case sha256 hex digest from the read leg, got ${cell === undefined ? "no such key (the SELECT dropped the projection)" : typeof cell} — refusing rather than guess`);
+}
 export const SQL_JSON_COLUMN_PROBLEMS = ["not-text", "not-json", "malformed"];
 export class SqlJsonColumnError extends Error {
     problem;
     where;
-    constructor(problem, where, detail) {
+    unknownKeys;
+    constructor(problem, where, detail, unknownKeys = []) {
         super(`${where}: ${detail}`);
         this.name = "SqlJsonColumnError";
         this.problem = problem;
         this.where = where;
+        this.unknownKeys = unknownKeys;
     }
 }
 function describeBody(body) {
@@ -53,7 +68,7 @@ export function decodeJsonColumn(text, read, where) {
     }
     const shape = read(body);
     if (shape.problem !== undefined) {
-        throw new SqlJsonColumnError("malformed", where, `carries ${describeBody(body)} that this store cannot read (${shape.problem}) — refusing rather than serve it as an empty/partial value`);
+        throw new SqlJsonColumnError("malformed", where, `carries ${describeBody(body)} that this store cannot read (${shape.problem}) — refusing rather than serve it as an empty/partial value`, shape.unknownKeys);
     }
     return shape.value;
 }
@@ -85,8 +100,28 @@ export function assertJsonColumnWritable(text, read, where) {
 export function createZodColumnReader(schema) {
     return (body) => {
         const parsed = schema.safeParse(body);
-        return parsed.success ? { value: parsed.data } : { problem: parsed.error.message };
+        if (parsed.success)
+            return { value: parsed.data };
+        const unknownKeys = unrecognizedKeysOf(parsed.error.issues);
+        return { problem: parsed.error.message, ...(unknownKeys.length > 0 ? { unknownKeys } : {}) };
+    };
+}
+function unrecognizedKeysOf(issues) {
+    const keys = new Set();
+    const walk = (list) => {
+        for (const issue of list) {
+            if (issue.code === "unrecognized_keys")
+                for (const key of issue.keys)
+                    keys.add(key);
+            else if (issue.code === "invalid_union")
+                for (const branch of issue.errors)
+                    walk(branch);
+            else if (issue.code === "invalid_key" || issue.code === "invalid_element")
+                walk(issue.issues);
+        }
     };
+    walk(issues);
+    return [...keys].sort();
 }
 export function createObjectColumnReader() {
     return (body) => (isJsonObject(body) ? { value: body } : { problem: "expected a JSON object" });

package/dist/plugins/store-backend.js

@@ -165,7 +165,7 @@ class TiDBBackend {
     breaker(onWriteFail) { return new TiDBBreakerState(this.pool, onWriteFail); }
     costQuota(limitMicroUsd, windowMs, onDegraded) { return new TiDBCostQuota(this.pool, limitMicroUsd, windowMs, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
     rateLimiter(limit, onDegraded) { return new TiDBRateLimiter(this.pool, limit, undefined, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
-    session() { return new TiDBSessionStore(this.pool, { log: createLogger(this.config.logLevel), retention: sqlStoreRetention(this.config.retentionSweep) }); }
+    session() { return new TiDBSessionStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     adoptionLog() { return new TiDBAdoptionLogStore(this.pool); }
     mysqlPool() { return this.pool; }
     pgPool() { return undefined; }
@@ -219,7 +219,7 @@ class PgBackend {
     breaker(onWriteFail) { return new PgBreakerState(this.pool, onWriteFail); }
     costQuota(limitMicroUsd, windowMs, onDegraded) { return new PgCostQuota(this.pool, limitMicroUsd, windowMs, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
     rateLimiter(limit, onDegraded) { return new PgRateLimiter(this.pool, limit, undefined, undefined, onDegraded, this.config.dbQueryTimeoutMs); }
-    session() { return new PgSessionStore(this.pool, { log: createLogger(this.config.logLevel), retention: sqlStoreRetention(this.config.retentionSweep) }); }
+    session() { return new PgSessionStore(this.pool, { retention: sqlStoreRetention(this.config.retentionSweep) }); }
     adoptionLog() { return new PgAdoptionLogStore(this.pool); }
     mysqlPool() { return undefined; }
     pgPool() { return this.pool; }
@@ -294,6 +294,7 @@ class LocalBackend {
             : (plane) => fileSessionCaptureRecordStore(plane?.controlDir ?? ownControlDir);
     }
     async ensureSchema() {
+        await this.sessionStore.assertStrictSidecarsReadable();
         await this.sessionStore.settleArchiveSnapshots();
     }
     async runOneTimeMigrations() {

package/dist/plugins/tidb-session-store.d.ts

@@ -17,7 +17,6 @@ import type { SessionWorkspace } from "../session-workspace.js";
 import type { RetentionDeclaration } from "@sema-agent/core";
 import type { SessionSummary } from "./store-contracts.js";
 import { type ClientSessionRowWrite, type ReplaySessionRowWrite, type ReplaySessionRowWriteOutcome, type SessionRowPatch, type SessionRowWriteOutcome } from "../session-row.js";
-import { type OrphanOwnerLog } from "../delegated-session-owner.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import { type StagingHandle } from "../session-sync-kernel.js";
 import { type ForkTarget, type ForkToOutcome } from "./session-fork.js";
@@ -40,8 +39,6 @@ export declare class TiDBSessionStore implements SessionStore {
     readonly durability: "durable";
     /** In-flight acquisitions keyed by id, so concurrent acquire(sameId) in one process share one. */
     private readonly pending;
-    /** 委派子代孤行那一行 warn 的去处(`delegated-session-owner.ts`;装配给部署的 logger,缺席 ⇒ 缺省 logger,不静默)。 */
-    private readonly log;
     /**
      * 执行席 —— 根会话行上这一位住客的那一格的唯一读口与 place / markMirror 两只写口(规则在 `src/execution-placement.ts`;
      * 实现与语句的唯一属主 = `execution-placement-sql.ts`,两孪生同一只实现,本店只交自己的池)。
@@ -50,7 +47,6 @@ export declare class TiDBSessionStore implements SessionStore {
     /** 本店的池包成的 SqlDriver:执行席与会话行格写原语的事务都经它借连接(连接初始化钉住事务读语义,`sql-driver.ts`)。 */
     private readonly db;
     constructor(pool: Pool, opts?: {
-        readonly log?: OrphanOwnerLog;
         readonly retention?: RetentionDeclaration;
     });
     acquire(sessionId?: string, opts?: PlacementAcquireOpts): Promise<AcquiredSession>;
@@ -58,18 +54,10 @@ export declare class TiDBSessionStore implements SessionStore {
     /** Idempotently create a session_meta row with an owner (core `SessionStore.register`). Existing owner is never overwritten. */
     register(sessionId: string, owner: string | null): Promise<void>;
     /**
-     * acquire 的建行(唯一一处):普通会话 ⇒ 无主(按 id 首建的既有读法);placed 会话 ⇒ 属主按委派继承律在**这一笔**里写入
-     * ([ref]:根会话的属主,根行不在取父,都不在 ⇒ 孤行哨兵 + warn;属主 = 判断时见证到的,读来源 → 判 → INSERT —— 读法与顺序只住在
-     * `delegated-session-owner.ts` 的 `createPlacedSessionRow`,本店只交既有读写口,PG 孪生同调)。
+     * acquire 的建行(唯一一处):普通会话 ⇒ 无主(按 id 首建的既有读法);placed 会话 ⇒ 属主 = `placement.owner` 原样,与元组同一条 INSERT 落库
+     * (core 7.62.0 [ref] 盒义务 7:委派树的属主是引擎判的,店只记、不判、不推断;唯一读法 `placedSessionOwnerOf`,值不是主体名也不是 null ⇒ 响亮拒、不留行。PG 孪生同调)。
      */
     private createOnAcquire;
-    /**
-     * [ref] 委派继承律的**认领口**:这只会话的那一位住客(判断时读到的化身)仍是无主的 placed 行 ⇒ 写 `owner`,返回是否写成
-     * (句 = `CLAIM_OWNERLESS_PLACED_SQL`,只 CAS 子行自己,与停驻挂点 / M23 同一只;规则在 `delegated-session-owner.ts`)。普通会话行不在射程(placed 判别位)。
-     */
-    claimOwnerless(sessionId: string, incarnation: string, owner: string): Promise<boolean>;
-    /** 若干来源行的会话面(属主 + 化身)一次读回(委派继承律的来源读;本店没有的 id 不在表里;活住客的投影 `sessionFaceFromRow`,空化身 ⇒ 响亮拒)。 */
-    private sourceFaces;
     /** The one session_meta INSERT. Existing owner is never overwritten.
      *  [ref]:`placement` 在场时与行同一条 INSERT 落六列;ON DUPLICATE 臂是 no-op ⇒ 已存在的行的元组
      *  **永不被重写**(first-write 不可变,义务 5 的写侧半场)。

package/dist/plugins/tidb-session-store.js

@@ -10,11 +10,9 @@ import { carriedRowCells, headFromRow, incarnationFromCell, mintSessionIncarnati
 import { sessionRowTagKey } from "../session-row.js";
 import { writeSessionRowCellsSql } from "./session-row-sql.js";
 import { contentForkRelation, fastForwardSharedContentDiverged } from "../session-sync-content.js";
-import { CLAIM_OWNERLESS_PLACED_SQL, claimOwnerlessParams, createPlacedSessionRow } from "../delegated-session-owner.js";
-import { createLogger } from "../observability/logger.js";
 import { placementCapabilityOf, LIST_PLACED_BATCH, PLACEMENT_SELECT_COLUMNS, placedRowFromRow, placementFromRow, placementInsertValues, SESSION_DURABILITY, SESSION_PLACEMENTS, } from "./session-placement.js";
 import { classifySyncRelationshipByIds, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, STAGING_ID_MARKER, STAGING_GC_GRACE_MS, } from "../session-sync-kernel.js";
-import { assertFirstOwnerWritable, forkOwnerOf, isSessionOwnerValue } from "./session-ownership.js";
+import { assertFirstOwnerWritable, forkOwnerOf, isSessionOwnerValue, placedSessionOwnerOf } from "./session-ownership.js";
 import { selectForkRows } from "@sema-agent/core";
 import { FORK_LOG_ROW_SHAPE, ForkTargetUnsettledError, classifyForkTarget, forkByFreshId, forkPointOf } from "./session-fork.js";
 import { isMysqlDupKeyError } from "./sql-errors.js";
@@ -28,12 +26,10 @@ export class TiDBSessionStore {
     placements = SESSION_PLACEMENTS;
     durability = SESSION_DURABILITY;
     pending = new Map();
-    log;
     executionPlacement;
     db;
     constructor(pool, opts = {}) {
         this.pool = pool;
-        this.log = opts.log ?? createLogger();
         this.retention = opts.retention ?? UNMANAGED_RETENTION;
         this.db = mysqlDriver(pool);
         this.executionPlacement = createSqlExecutionPlacementSeat(this.db);
@@ -81,21 +77,7 @@ export class TiDBSessionStore {
         await this.insertMeta(sessionId, owner, undefined);
     }
     async createOnAcquire(sessionId, placement) {
-        if (placement === undefined)
-            return this.insertMeta(sessionId, null, undefined);
-        await createPlacedSessionRow(sessionId, placement, {
-            readFaces: (ids) => this.sourceFaces(ids),
-            insert: (owner) => this.insertMeta(sessionId, owner, placement),
-            readOwner: async () => (await this.headOf(sessionId))?.owner,
-        }, this.log);
-    }
-    async claimOwnerless(sessionId, incarnation, owner) {
-        const [res] = await this.pool.query(CLAIM_OWNERLESS_PLACED_SQL.mysql, [...claimOwnerlessParams(sessionId, incarnation, owner)]);
-        return res.affectedRows > 0;
-    }
-    async sourceFaces(ids) {
-        const [rows] = await this.pool.query(`SELECT session_id, owner, incarnation FROM session_meta WHERE session_id IN (${ids.map(() => "?").join(", ")})`, [...ids]);
-        return new Map(rows.map((r) => [String(r.session_id), sessionFaceFromRow(String(r.session_id), r.owner ?? null, r.incarnation)]));
+        await this.insertMeta(sessionId, placement === undefined ? null : placedSessionOwnerOf(sessionId, placement), placement);
     }
     async insertMeta(sessionId, owner, placement) {
         const now = new Date();

package/dist/run-local.js

@@ -51,7 +51,7 @@ import { declaredCredential } from "./model-route-gap.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
 import { startMemorySyncRunner } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
-import { createSharedRunnerDeps } from "./boot/runner-deps.js";
+import { createSharedRunnerDeps, installDefaultEngineNoticeSeat } from "./boot/runner-deps.js";
 import { createPeerDesk } from "./peer-seat.js";
 import { assertGovernanceAssemblable, createGovernanceSeams } from "./boot/governance-seams.js";
 import { assertRetentionLaneWirable } from "./boot/retention-lane.js";
@@ -352,6 +352,7 @@ export async function runLocal(argv, deps = {}) {
     const metrics = createMetrics();
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     installSecretEnvScrubRecorder({ logger, metrics });
+    installDefaultEngineNoticeSeat(logger, metrics);
     logConfigDiagnostics(logger);
     provisionSemaConfigDir(config, logger);
     installOutboundDispatcher(logger);

package/dist/runs.js

@@ -69,6 +69,9 @@ export function markChildrenStoppedByUserOnAbort(signal, taskId, principal) {
     }
     signal.addEventListener("abort", mark, { once: true });
 }
+const EXECUTION_ENV_REFUSAL_HTTP_STATUS = {
+    "env.home_unconfirmed": 409,
+};
 const PREPARE_REFUSAL_HTTP_STATUS = {
     "resume.session_not_found": 404,
     "rewind_snapshot.unresolvable": 422,
@@ -93,6 +96,7 @@ const PREPARE_REFUSAL_HTTP_STATUS = {
     "config.memory_project_marker_nested": 409,
     "config.read_deny_floor_unkept": 409,
     "config.mcp_server_name_collision": 409,
+    ...EXECUTION_ENV_REFUSAL_HTTP_STATUS,
 };
 export function resumeAtHttpStatus(result) {
     const code = failureCodeOf(result.terminal);

package/dist/security.d.ts

@@ -8,7 +8,6 @@ import type { ClientSessionRowWrite, ReplaySessionRowWrite, ReplaySessionRowWrit
 import type { ExecutionPlacementSeat } from "./execution-placement.js";
 import type { SessionUnreadable } from "./session-error-wire.js";
 import type { ForkTarget, ForkToOutcome } from "./plugins/session-fork.js";
-import { type OwnerlessClaim } from "./delegated-session-owner.js";
 /** One row of the session-list projection (CC /resume picker) — the durable session abstraction's enumeration
  *  output (§0.5). Mirrors {@link RunStore}'s shipped `SessionSummary` shape so the wire response is unchanged. */
 export interface SessionListItem {
@@ -183,9 +182,6 @@ export declare function legacyUnownedAmnestyOpen(deployment: DeploymentShapeInpu
 export type OwnerAwareSessionStore = SessionStore & {
     /** 属主登记(core `SessionStore.register` 的契约:对没有行的 id 建行并记下属主,首写赢;对已有的行什么都不做)。读回走 `headOf`。 */
     register?: (sessionId: string, owner: string | null) => Promise<void>;
-    /** [ref] 委派继承律的**认领口** —— 只在记录委派树的店上(三只持久会话店,只命中 placed 行;不记委派树的店没有):判断时读到的那一位住客仍是无主的 placed 行 ⇒ 写 `owner`,
-     *  返回是否写成(只 CAS 子行自己)。唯一调用方 = 停驻挂点的 `settleDelegatedOwner`(`delegated-session-owner.ts`;M23 走同一句 SQL);规则写在那个模块。 */
-    claimOwnerless?: OwnerlessClaim;
     /** [ref] placed 分区的元组读口(店的既有读口,一行 PK 读;`undefined` = 普通会话或无此行)。店不交它 = 不实现 placement = 没有 placed 行(无 repo 的内存店)。两个读者:
      *  ① 会话面的属主门只在属主为 NULL 时读它一次(无主的 placed 行不是公共行,`http/principal-gate.ts` 的 `sessionOwnerCellOf`);
      *  ② 会话视图读它投影体顶层 `agent` 键(`audit.ts` 的 `sessionAgentOf`,只在视图读上付):店没有这一面 ⇒ 键缺席,读面不凭别处另铸子代身份。 */