@sema-agent/server 7.143.0 → 7.145.0

package/dist/hooks/classic-stations.d.ts

@@ -11,7 +11,7 @@
  *     它是 handler 体的第二个入参 —— 触发之后 handler 不再起新事、在飞的子进程要叫停(`hooks/hook-runner.ts` 的命令钩子腿)。
  *
  * 站的集合 = 引擎事件表里有站的 `classic.*` 名(一条钉从 `MOD_EVENT_TABLE` 派生对拍,不手抄第二份)。
- * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
+ * 观察站(`StopFailure` / `PostCompact` / `PermissionDenied` / `SessionStart` / `SessionEnd`)只许观察者:答案形是「无」,core 的迁移配方要求挂 `{ observe: true }`。
  */
 import type { ClassicEventMap, ClassicEventName, EngineDollar, On } from "@sema-agent/core";
 /** 引擎有站的 `classic.*` 名(core 的 `ClassicEventMap` 键集)。 */
@@ -30,6 +30,8 @@ export declare const CLASSIC_STATION_ROLE: {
     readonly "classic.PreCompact": "chain";
     readonly "classic.PostCompact": "observe";
     readonly "classic.PermissionDenied": "observe";
+    readonly "classic.SessionStart": "observe";
+    readonly "classic.SessionEnd": "observe";
 };
 /** 本仓 handler 体对一站作的答:观察站不作答(`void`);链站 = core 的答案形,去掉本仓从不作的 `null` / `false`(PreToolUse 的两个「不表态」词)。 */
 type StationAnswer<K extends ClassicStation> = (typeof CLASSIC_STATION_ROLE)[K] extends "observe" ? void : Exclude<ClassicEventMap[K]["answer"], null | false>;

package/dist/hooks/classic-stations.js

@@ -11,6 +11,8 @@ export const CLASSIC_STATION_ROLE = {
     "classic.PreCompact": "chain",
     "classic.PostCompact": "observe",
     "classic.PermissionDenied": "observe",
+    "classic.SessionStart": "observe",
+    "classic.SessionEnd": "observe",
 };
 export function hangClassic(on, station, answer) {
     if (CLASSIC_STATION_ROLE[station] === "observe") {

package/dist/http/admission.js

@@ -24,6 +24,7 @@ import { legFactsOf } from "../leg-facts.js";
 import { resolveExecutionContext, stampSpecRoot } from "./execution-context.js";
 import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
+import { promptScreenDeclared } from "../prompt-screen.js";
 import { sendError, sendHttpError } from "./send.js";
 import { refuseSubmitBody } from "./request-guards.js";
 import { sqlWallsOf } from "../plugins/sql-driver.js";
@@ -750,7 +751,7 @@ export function createAdmission(ctx) {
             const runner = runnerFor(resolved);
             const spec = stampSpecRoot(resolved, execution);
             const model = modelIdOf(spec.model);
-            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, ...(model !== undefined ? { model } : {}) });
+            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, screened: promptScreenDeclared([deps.deploymentMods, spec.mods]), ...(model !== undefined ? { model } : {}) });
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);

package/dist/http/checkpoint-ctx.d.ts

@@ -96,6 +96,7 @@ export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
+    promptScreened?: true;
     writerVersion: string;
 }, sealer: CheckpointCtxSealer | undefined, sessionId: string): SealedCheckpointCtx;
 /**

package/dist/http/checkpoint-ctx.js

@@ -18,6 +18,7 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         writerVersion: fields.writerVersion,
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        ...(fields.promptScreened === true ? { promptScreened: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
         permissionModeReading: "entry_word",
     };

package/dist/http/durable-run-leg.js

@@ -2,8 +2,8 @@ import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
 import { HEARTBEAT_MS, runInBackground } from "../runs.js";
 import { heldFor } from "../peer-seat.js";
-import { fleetRunPublisher, fleetRunLabels } from "../fleet/fleet-bus.js";
-import { cascadeConfig, runMeta } from "./run-meta.js";
+import { fleetRunPublisher, fleetRunLabels, nameFleetRowOnDelivery } from "../fleet/fleet-bus.js";
+import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "./run-meta.js";
 import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext } from "./execution-context.js";
@@ -11,9 +11,8 @@ import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
-import { persistSubmitCtx } from "./submit-ctx.js";
+import { persistSubmissionCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
-import { serviceVersion } from "../service-version.js";
 import { headReadOf } from "../session-incarnation.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
@@ -34,6 +33,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     if (!created.ok) {
         return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
     }
+    fillRunPreviewOnDelivery(args.prepared.acceptance, runStore, taskId);
     const owner = args.prepared.auth?.principal ?? null;
     const preLaunchHeartbeat = setInterval(() => {
         void runStore.heartbeat(taskId, owner).catch(() => { deps.metrics?.inc("run_signal_poll_errors_total", { kind: "heartbeat" }); });
@@ -44,7 +44,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         if (placementReject)
             return placementReject;
         if (deps.checkpointStore) {
-            const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, { runStore, taskId }, sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+            const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, { runStore, taskId }, args.prepared);
             if (ctxRefusal)
                 return ctxRefusal;
         }
@@ -81,8 +81,9 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         scope: args.fleetScope,
         rootTaskId: taskId,
         sessionId,
-        ...fleetRunLabels(args.prepared.spec.objective),
+        ...fleetRunLabels(args.prepared.acceptance.objectiveAtSubmit),
     });
+    nameFleetRowOnDelivery(args.prepared.acceptance, fleetPub);
     void heldFor(args.prepared.peerLease, () => runInBackground(args.prepared.runner, args.prepared.spec, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
         ? {
             coordinator: deps.toolApproval,

package/dist/http/principal-gate.d.ts

@@ -159,7 +159,7 @@ export declare function fleetViewOf(req: IncomingMessage, w: IdentityWiring, fac
  * 有身份边界的部署上:
  *  · **无主的行**经无主臂的唯一判据 `ownerlessRowOpen`(`security.ts`):普通会话照旧对任何调用方开放;委派子代的 placed 行只对 fleet 调用方
  *    ({@link sessionCallerOf})开放 —— 任何具名主体、没有 service 凭据的无身份调用方都与别人的行同体(调用点答 404)([ref])。
- *    代价如实:属主还没定下的子代行连它将来的属主也暂时读不到(由一次性迁移 M23 / 那一行的下一次停驻定下);
+ *    代价如实:升级前写下、属主还没定下的存量子代行连它将来的属主也暂时读不到(SQL 两店由一次性迁移 M23 在窗内每次起服回填;本机文件店没有回填臂;7.144.0 起没有任何店在停驻时定属主 —— 属主只由建行那一笔记下引擎交来的 `placement.owner`);
  *  · 有主的行就是 run 面那一条谓词({@link runOwnerReadable}),一字不变。
  * run 面(poll / events / cancel …)不读本谓词 —— 那是 run 资源的门,另一只。
  */

package/dist/http/refusal-body.d.ts

@@ -19,15 +19,19 @@ export type RefusalBody = {
 /** 拒体:`{ error, errorCode, ...facts }`。 */
 export declare function refusalBody(r: Refusal): RefusalBody;
 /**
- * 引擎拒一次续跑时的**三个机读判别位** → 拒体的同名事实键(唯一读法;续跑家族的每一只拒答都读它):
- * `detail.code` ⇒ `blockedBy`(挡住它的准入码)· `detail.field` ⇒ `field`(哪一侧 / 哪一格)· `detail.reason` ⇒ `reason`(同码多臂时哪一臂)。
+ * 引擎拒一次续跑时的**机读事实位** → 拒体的同名事实键(唯一读法;续跑家族的每一只拒答都读它):
+ * `detail.code` ⇒ `blockedBy`(挡住它的准入码)· `detail.field` ⇒ `field`(哪一侧 / 哪一格)· `detail.reason` ⇒ `reason`(同码多臂时哪一臂)·
+ * `detail.thrownName` ⇒ `thrownName`(引擎 7.62.0 起,只在 `reason: requirements_damaged` 的拒上:判官读这一行时被抛出的东西的名字,有界、不带 message ——
+ * 在场 = 引擎缺陷〔判官被一个读时会抛的成员绊倒〕,缺席 = 行的内容与它自述的对不上〔数据损坏〕,运维凭这一位分诊)。
  * 一员在场 ⇔ 它是非空串;其余(缺席、非串、空串)一律不铸键 —— 引擎没说就是没说,本层不编值,也不把一个非串原样推上 wire。
  * 载体有两种,读法同一只:同步腿的 `CheckpointError.detail`(`http/resume-legs.ts` `checkpointRefusalAnswer`),与后台停驻子代赎回回执的
- * `details.detail`(`parked-decide.ts` 的 422 `parked_resume.startup_failed`;引擎 7.54.0 起它把认领前那只失败的同三位交到回执上)。
+ * `details.detail`(`parked-decide.ts` 的 422 `parked_resume.startup_failed`;引擎 7.54.0 起它把认领前那只失败的 `code` / `field` / `reason` 交到回执上 ——
+ * 回执只带这三位,`thrownName` 今天不在回执里,所以这条腿的体上它恒缺席;回执哪天多带,同一只读法自然过境)。
  */
 export declare function resumeRefusalFacts(detail: unknown): {
     blockedBy?: string;
     field?: string;
     reason?: string;
+    thrownName?: string;
 };
 //# sourceMappingURL=refusal-body.d.ts.map

package/dist/http/refusal-body.js

@@ -10,6 +10,7 @@ export function resumeRefusalFacts(detail) {
         ...(word(d.code) ? { blockedBy: d.code } : {}),
         ...(word(d.field) ? { field: d.field } : {}),
         ...(word(d.reason) ? { reason: d.reason } : {}),
+        ...(word(d.thrownName) ? { thrownName: d.thrownName } : {}),
     };
 }
 //# sourceMappingURL=refusal-body.js.map

package/dist/http/resume-legs.js

@@ -32,7 +32,7 @@ import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
 import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
-import { reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
+import { blockText, reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
 import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
@@ -54,6 +54,7 @@ import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow }
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "./resume-ctx-read.js";
+import { objectiveWithheldIn } from "./submit-ctx.js";
 import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
@@ -615,6 +616,7 @@ export function createResumeLegs(ctx) {
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx, execution } = args;
+        const heldObjective = objectiveWithheldIn(resumeCtx.ctx) ? undefined : resumeObjective;
         const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
         const commitResumeCtx = () => Promise.resolve().then(() => deps.checkpointStore.putCtx(resumeCtx.sessionId, sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId))).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
@@ -653,7 +655,7 @@ export function createResumeLegs(ctx) {
             const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
                 source: args.mintFreshRun.source,
                 identity: args.mintFreshRun.identity,
-                objectivePreview: buildRunObjectivePreview(resumeObjective ?? ""),
+                objectivePreview: heldObjective === undefined ? null : buildRunObjectivePreview(heldObjective),
             });
             if (created.existing) {
                 throw new Error(`wake fresh run: createRun observed an existing row for the freshly minted taskId ${freshId} (no idempotency key was sent) — refusing to treat it as a busy session`);
@@ -670,7 +672,7 @@ export function createResumeLegs(ctx) {
             freshRunClaimed = true;
         }
         const fleetPub = taskId && deps.fleetBus
-            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, sessionId, ...fleetRunLabels(resumeObjective) })
+            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, sessionId, ...fleetRunLabels(heldObjective) })
             : undefined;
         const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
         if (deps.toolApproval && taskId) {
@@ -912,6 +914,7 @@ export function createResumeLegs(ctx) {
                 const rs = deps.runStore;
                 const startSeq = rs && taskId ? await rs.maxSeq(taskId) : 0;
                 let text = "";
+                let block = "";
                 let reasoning = "";
                 let reasoningEventId;
                 const persistThinking = deps.config.traceThinking;
@@ -945,9 +948,11 @@ export function createResumeLegs(ctx) {
                         reasoning = "";
                         reasoningEventId = undefined;
                     }
-                    if (text) {
-                        await append("text", modelTextEventData({ text, eventId: anchor.firstTextEventId }));
+                    const segment = text + blockText(block);
+                    if (segment) {
+                        await append("text", modelTextEventData({ text: segment, eventId: anchor.firstTextEventId }));
                         text = "";
+                        block = "";
                     }
                 };
                 const driveResume = async () => {
@@ -1037,9 +1042,13 @@ export function createResumeLegs(ctx) {
                         await appendPromptManifest(append, deps.promptManifests, taskId);
                         switch (ev.type) {
                             case "text_delta":
-                                text += ev.delta;
+                                block += ev.delta;
                                 anchor.onText(ev.eventId);
                                 break;
+                            case "text_end":
+                                text += blockText(block, ev);
+                                block = "";
+                                break;
                             case "reasoning_delta": {
                                 const rb = reasoningDeltaBytes(ev);
                                 if (persistThinking && rb !== undefined) {
@@ -1422,7 +1431,7 @@ export function createResumeLegs(ctx) {
             const { spec, engineNotices } = resolved;
             const hostSpec = { ...spec, objective };
             const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, ...(objectiveWithheldIn(ctx) ? { bodyFromScreenedCtx: true } : {}), acceptance: createRunAcceptance({}, { objective, screened: false }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
                 fleetScope: resumeFleetScope(req, auth),
                 elicitOwner: principal ?? null,
                 source: "workflow_parked_decide",

package/dist/http/route-ctx.d.ts

@@ -146,6 +146,12 @@ export interface PreparedTaskSubmission {
      * 判的是**这一次提交**的体:幂等重放从 run 记录答,不重判、不带。
      */
     warnings?: readonly EntryProblem[];
+    /**
+     * `body` 是从一份标着 `promptScreened` 的续跑输入里取回的存量体(今天唯一的这种提交 = `/decide` 的宿主新 turn:这一跑的目标是本服务铸的指路文本,
+     * 体是宿主会话自己的那一份)⇒ 这一跑新写的续跑输入照样标上(`submit-ctx.ts` `persistSubmissionCtx`)。体里的目标不是这一跑的目标,
+     * 它能不能展示在它第一次落盘时就定了,这一跑的受理座答不了。缺席 = 体是这次请求自己的,标不标由受理座定。
+     */
+    bodyFromScreenedCtx?: true;
     /**
      * 这次执行的**执行上下文**(唯一解析器 `http/execution-context.ts` `resolveExecutionContext` 的产物:根 · 住客 · 放置态 · 车道 · device 车道的设备意图)。
      * 提交门在装配之前铸(fresh);`/decide` 的宿主新 turn 交续跑折叠器铸的那一只(continuation)。每个 `runStore.createRun(` 成功点**必须**把它交给
@@ -208,6 +214,15 @@ export interface CheckpointCtx {
      * 缺席 = 本版之前写下的行(不回填):那一码的体不带两键,如实不猜。不是一次性迁移 —— 这一格是常设的事实位,没有删除条件。
      */
     writerVersion?: string;
+    /**
+     * 体里的目标**不是可展示的那一份**:写这份续跑输入的提交腿上装着 prompt 屏(判据 `prompt-screen.ts` 的 `promptScreenDeclared`),
+     * 体里的 `objective` 不是引擎交付的文本 —— 留空,或 verify 形为验证器留着的请求原文(律的属主 = `run-acceptance.ts`「交付的是哪一份」;
+     * 写法与那条 P-DEBT 见 `submit-ctx.ts` 头注)。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 读者只有一只:`submit-ctx.ts` 的 `objectiveWithheldIn`(续跑腿的两张展示面 —— wake 新行的预览、fleet 行名 —— 经它问,在场 ⇒ 缺席)。
+     * 写点:`buildCheckpointCtx`(提交腿那一笔,经 `persistSubmissionCtx`;体从一份标着它的续跑输入里取回时照样标上);续跑腿的写回传原 ctx / 其展开 ⇒ 标随行。
+     * 缺席 = 体里的目标就是交付的那一份(腿上没有屏)。
+     */
+    promptScreened?: true;
 }
 /**
  * `/decide` 第三条车道交给宿主投递腿(wake:`DriveResumeArgs` / fresh:`DurableRunLegArgs`)的**一件**:这一跑在内存里带着的决定,

package/dist/http/routes/approvals-assistant.d.ts

@@ -7,6 +7,7 @@ import { type GateIntentView } from "../../approval.js";
 import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 import { type PeerInboundPendingRow } from "../../peer-inbound-face.js";
+import { type PlacementReadingSessionStore, type SessionAgent } from "../../session-agent.js";
 /** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
 export type DecisionDoorId = Extract<ApprovalsAssistantRouteId, "approval-decide" | "assistant-task-plan-review">;
 /** 一道门的静态描述 —— 只写**这道门自己**的东西;路径、路径段、别门的键一概不在这里写(从来源读)。 */
@@ -104,6 +105,19 @@ export type QuestionAnswerCheck = {
  */
 export declare function checkQuestionAnswer(v: unknown): QuestionAnswerCheck;
 export declare function handleApprovalsAssistant(req: IncomingMessage, res: ServerResponse, match: RouteMatch<ApprovalsAssistantRouteId>, ctx: RouteCtx): Promise<void>;
+/** `listPending()` 的行形(两条 durable 读面共用;从 store 的返回类型取,不手抄)。 */
+type PendingRow = Awaited<ReturnType<CheckpointStoreFull["listPending"]>>[number];
+/**
+ * 两条 durable 读面共用的行形 —— 行 + [ref]② 追加的**出身格**(派生位,不是列)+ [ref] 行族词(`checkpoint`)+ [ref] 行的会话在委派树里的位置 `agent`
+ * (会话视图 `GET /v1/sessions/:id` 体顶层的同名键,同一只读口 `readSessionAgent`;在场 ⇔ 这一次列表读到行的会话是一只 placed 委派子代,见 {@link projectDurableQueue})。
+ * 导出只为自铸登记表按键绑型(`trace/self-minted-wire.ts` 的 `approvalQueueRowAgent`)。
+ */
+export type PendingRowForWire = PendingRow & {
+    kind: "checkpoint";
+    governanceForced?: true;
+    rememberRefused?: true;
+    agent?: SessionAgent;
+};
 /**
  * 🔴 [ref]-2 / [ref]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
  * 投影 —— 脱敏([ref] 件4)+ 出身归因([ref] 的另一半)一次做完。
@@ -145,7 +159,12 @@ live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined,
  * (`pending` / `resolved`):两族同一扇决断口,帧上的 `kind` 判别。`undefined` = 本腿没有这一半场(流字节只差每帧的 `kind`)。
  * 位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
  */
-peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined, scope: string | undefined, 
+peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined, 
+/**
+ * 🔴 [ref]:停驻行 `agent` 的会话店面 —— 与 `GET /v1/approvals` 同一只(`deps.sessionStorage`),经同一只整批投影 {@link projectDurableQueue}。
+ * `undefined` / 店不交 `placementOf` = 这台部署不存委派元组 ⇒ 没有一帧带 `agent`(帧字节与 [ref] 之前逐字相同)。位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
+ */
+sessions: PlacementReadingSessionStore | undefined, scope: string | undefined, 
 /** [ref]②:出身归因的部署侧一半 + 三张审批名单(问的属主)。缺席 ⇒ 归不出治理出身(键缺席,与 best-effort 同方向)、没有一行读作
  *  部署名单的问(记不住,方向是多问)。**位置在 `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
 governance?: PendingProjectionDeployment, pollMs?: number): Promise<void>;

package/dist/http/routes/approvals-assistant.js

@@ -36,6 +36,7 @@ import { seatText } from "../../trace/exit-seat.js";
 import { approvalQueueKindOfDoorId } from "../../approval-queue-kind.js";
 import { defaultPeerInboundFace, parsePeerInboundId, peerBoxScope } from "../../peer-inbound-face.js";
 import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
+import { readSessionAgent } from "../../session-agent.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
     ...RESUME_RESTATABLE_KEYS,
@@ -315,7 +316,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         if (match.decl.id === "approvals-stream") {
             const ownerParam = operator ? (new URLSearchParams(match.search).get("owner") ?? undefined) : undefined;
             const scope = operator ? ownerParam : ownScope;
-            await streamApprovals(req, res, cs, deps.toolApproval, peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam), scope, deps.config);
+            await streamApprovals(req, res, cs, deps.toolApproval, peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam), deps.sessionStorage, scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
@@ -331,7 +332,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendApprovalsReadFailure(req, res, deps.logger, err);
                 return;
             }
-            const pending = [...durableRows.map((r) => projectPendingForWire(r, deps.config)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
+            const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
             sendJson(res, 200, {
                 pending,
                 serverNowMs: Date.now(),
@@ -412,6 +413,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                     ...durableRowIdentity("assistant-inbox", s.checkpointId, s.token),
                     scope: s.scope,
                     createdAt: s.createdAt,
+                    rowVerdict: s.rowVerdict,
                     ...(s.gateKind !== undefined ? { gateKind: s.gateKind } : {}),
                     ...(s.severity !== undefined ? { severity: s.severity } : {}),
                     ...(s.spentMicroUsd !== undefined ? { spentMicroUsd: s.spentMicroUsd } : {}),
@@ -1035,7 +1037,7 @@ function peerInboundRowsFor(face, principal, operatorOwnerParam) {
     const scope = peerBoxScope(principal);
     return () => face.list(scope);
 }
-function projectPendingForWire(row, deployment) {
+function projectPendingForWire(row, deployment, agent) {
     const governance = deployment;
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
@@ -1048,7 +1050,27 @@ function projectPendingForWire(row, deployment) {
         classes: row.classes,
         deploymentListQuestion,
     });
-    return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
+    return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}), ...(agent !== undefined ? { agent } : {}) };
+}
+async function projectDurableQueue(rows, deployment, sessions) {
+    const agents = await sessionAgentsOf(rows.map((r) => r.sessionId), sessions);
+    return rows.map((r) => projectPendingForWire(r, deployment, agents.get(r.sessionId)));
+}
+async function sessionAgentsOf(sessionIds, sessions) {
+    const out = new Map();
+    if (sessions?.placementOf === undefined)
+        return out;
+    await Promise.all([...new Set(sessionIds)].map(async (sessionId) => {
+        try {
+            const agent = await readSessionAgent(sessions, sessionId);
+            if (agent !== undefined)
+                out.set(sessionId, agent);
+        }
+        catch (err) {
+            recordFailOpen("server.approvals.queue-row-agent-unreadable", `session ${JSON.stringify(sessionId)}: ${seatText("operator-log-text", err instanceof Error ? err.message : String(err))}`);
+        }
+    }));
+    return out;
 }
 function createSseDeltaLane(res, spec) {
     let prev = new Map();
@@ -1067,7 +1089,7 @@ function createSseDeltaLane(res, spec) {
         },
     };
 }
-export async function streamApprovals(req, res, cs, live, peerInbound, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
+export async function streamApprovals(req, res, cs, live, peerInbound, sessions, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     const keyOf = (p) => {
         switch (p.kind) {
             case "checkpoint":
@@ -1117,7 +1139,7 @@ export async function streamApprovals(req, res, cs, live, peerInbound, scope, go
     while (!closed) {
         let snapshot;
         try {
-            const pending = [...(await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance)), ...(peerInbound?.() ?? [])];
+            const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions)), ...(peerInbound?.() ?? [])];
             snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
         catch (err) {

package/dist/http/routes/rules.d.ts

@@ -3,7 +3,7 @@
  *
  *   POST   /v1/rules                    → 写一条**收紧**规则(deny/ask)进 durable 分区,单步、无票仪式
  *   POST   /v1/rules/cc-import/prepare  → 预览 + 一张**一次性、principal 绑定、有期、载荷绑定**的票
- *   POST   /v1/rules/cc-import/redeem   → 原子消费票 → confirm → 批量兑付进店
+ *   POST   /v1/rules/cc-import/redeem   → 原子消费票 → confirm → 批量兑付进店 → 回执 `{ members, rev }`(与 local-import 口同一张,{@link sendImportReceipt})
  *   GET    /v1/rules                    → 列出自己名下**活着**的规则(keyset 分页,游标绑 rev)
  *   DELETE /v1/rules                    → 按 (rule, scope) 内容撤销,**恒经** core `removePersistedRule`
  *

package/dist/http/routes/rules.js

@@ -159,7 +159,7 @@ export async function handleRules(req, res, match, ctx) {
         }
         const redeemed = await lane.redeemLocalImport(principal, parsed.data.ticket);
         if (redeemed.ok) {
-            sendJson(res, 200, { members: redeemed.outcome.members, rev: redeemed.outcome.rev });
+            sendImportReceipt(res, redeemed.outcome);
             return;
         }
         logger.info("local rule import ticket refused", { reason: redeemed.reason, detail: redeemed.detail, retryable: redeemed.reason !== "ticket-unusable" && redeemed.reason !== "in-flight" && redeemed.retryable === true });
@@ -218,7 +218,10 @@ export async function handleRules(req, res, match, ctx) {
         sendError(res, 404, "not_found.rule_ticket", "no such import ticket");
         return;
     }
-    sendJson(res, 200, { result: redeemed.result });
+    sendImportReceipt(res, redeemed.outcome);
+}
+function sendImportReceipt(res, outcome) {
+    sendJson(res, 200, { members: outcome.members, rev: outcome.rev });
 }
 function resolveTargetPrincipal(requested, caller, config) {
     if (requested === undefined || requested === caller)

package/dist/http/routes/session-sync.js

@@ -7,6 +7,8 @@ import * as facts from "../../capability-facts.js";
 import { classifySyncRelationshipByIds, readImportAnchors, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
+import { StampedSessionArchiveError } from "../../session-error-wire.js";
+import { readSessionAgent } from "../../session-agent.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
 import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
@@ -359,6 +361,16 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const dstIds = (await sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);
                 if ((relA.relation === "fork" || relA.relation === "stale") && resolution !== "overwrite-dst") {
+                    if (sessionStorage.assertArchiveAnonymous !== undefined && (await readSessionAgent(sessionStorage, sessionId)) === undefined) {
+                        try {
+                            await sessionStorage.assertArchiveAnonymous(sessionId);
+                        }
+                        catch (e) {
+                            if (e instanceof StampedSessionArchiveError && sendSessionError(res, e, "import"))
+                                return;
+                            throw e;
+                        }
+                    }
                     sendError(res, 409, "conflict", "sync conflict", { relation: relA });
                     return;
                 }

package/dist/http/routes/tasks.js

@@ -5,7 +5,7 @@ import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpS
 import { atHostBoundary, sealResultForExit, outwardPlane } from "../../terminal.js";
 import { voidVerifierPauseCard } from "../../verifier-pause-card.js";
 import { withPrincipal } from "../../observability/principal-context.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, nameFleetRowOnDelivery } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createLiveModelText, modelStreamOfTask } from "../../trace/model-segment.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
@@ -17,7 +17,7 @@ import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { writeLiveFrame, writeLiveHeartbeat } from "../live-frame.js";
 import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, liveIdentityFields } from "../../trace/project.js";
-import { cascadeConfig, runMeta } from "../run-meta.js";
+import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { replayOfExistingRun } from "../submit-replay.js";
 import { httpErrorCode, sendJson, sendError, sseHeaders } from "../send.js";
@@ -33,8 +33,7 @@ import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { persistSubmitCtx } from "../submit-ctx.js";
-import { serviceVersion } from "../../service-version.js";
+import { persistSubmissionCtx } from "../submit-ctx.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
@@ -326,9 +325,10 @@ export async function handleTasks(req, res, match, ctx) {
                             return placementReject;
                         }
                         durableTaskId = tid;
+                        fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
                     }
                     if (deps.checkpointStore) {
-                        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                        const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared);
                         if (ctxRefusal) {
                             writeLiveFrame(res, { type: "done", result: doneResultOfOutcome(ctxRefusal) });
                             return ctxRefusal;
@@ -361,8 +361,10 @@ export async function handleTasks(req, res, match, ctx) {
                     let fleetPub;
                     try {
                         fleetPub = durableTaskId
-                            ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, sessionId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) })
+                            ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, sessionId: prepared.spec.sessionId, ...fleetRunLabels(prepared.acceptance.objectiveAtSubmit) })
                             : undefined;
+                        if (fleetPub)
+                            nameFleetRowOnDelivery(prepared.acceptance, fleetPub);
                     }
                     catch (e) {
                         if (durableHeartbeat)
@@ -499,7 +501,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         userMsgEntryId = promptEntryId;
                                     const causeAtDone = ev.type === "done" ? ac.cause() : undefined;
                                     await deps.userInputLedger?.observeLegEvent(liveStream, ev);
-                                    prepared.acceptance.observe(ev);
+                                    await prepared.acceptance.observe(ev);
                                     await liveWorkspace.observe(ev);
                                     if (ev.type === "done") {
                                         finalResult = await mintSubmitExitResult(ev.result, deps.checkpointStore);
@@ -894,9 +896,10 @@ export async function handleTasks(req, res, match, ctx) {
                         if (placementReject)
                             return placementReject;
                         durableTaskId = tid;
+                        fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
                     }
                     if (deps.checkpointStore) {
-                        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                        const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared);
                         if (ctxRefusal)
                             return ctxRefusal;
                     }
@@ -940,7 +943,7 @@ export async function handleTasks(req, res, match, ctx) {
                             const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), prepared.legFacts?.sessionWitness);
                             for await (const ev of stream) {
                                 observeSyncLegEvent(ev);
-                                prepared.acceptance.observe(ev);
+                                await prepared.acceptance.observe(ev);
                                 await syncWorkspace.observe(ev);
                             }
                             return stream.result();

package/dist/http/run-meta.d.ts

@@ -1,21 +1,28 @@
 /**
- * [ref] A9 装配缝的一片小叶子 —— 提交路径共用的两个纯函数(run 行元数据 + cascade 配置)。
+ * [ref] A9 装配缝的一片小叶子 —— 提交路径共用的三只小件(run 行元数据 + run 行预览的补写口 + cascade 配置)。
  *
- * 为什么单独成文件:`runMeta` 被 tasks 与 runs **两个**域模块调用,`cascadeConfig` 同理(还被测试直接引)。
- * 挂在任一域模块上都会造出 routes/* 互相值 import 的第二条边;它们又是纯函数(只依赖入参 + redact 叶子),
+ * 为什么单独成文件:`runMeta` 与预览补写口被 tasks 与 runs **两个**域模块调用,`cascadeConfig` 同理(还被测试直接引)。
+ * 挂在任一域模块上都会造出 routes/* 互相值 import 的第二条边;它们只依赖入参(受理座 / run 店两只口)+ 预览读法叶子,
  * 所以正确归处是叶子。server.ts 转出口 `cascadeConfig` 以保住既有 import 点。
  */
-import type { TaskSpec, CascadeConfig } from "@sema-agent/core";
+import type { CascadeConfig } from "@sema-agent/core";
+import type { RunAcceptance } from "../run-acceptance.js";
+import type { RunStore } from "../plugins/store-backend.js";
 /** The denormalized run-row metadata captured at submit: correlation (jobId), credential-derived source,
- *  and a redacted objective glance for lists. One place so the three submit paths can't drift. */
+ *  and a redacted objective glance for lists. One place so the three submit paths can't drift.
+ *
+ *  预览只取受理座交出的、提交那一刻就知道的交付文本(律的属主 = `run-acceptance.ts`「交付的是哪一份」):腿上没有 prompt 屏 ⇒ 交付的就是请求原文,
+ *  建行即写;腿上有屏 ⇒ 建行**不写**(列 NULL = 没建过预览),引擎交付可写的那一份时经 {@link fillRunPreviewOnDelivery} 补写一次。本函数不读请求体。 */
 export declare function runMeta(prepared: {
     jobId?: string;
-    spec: TaskSpec;
+    acceptance: Pick<RunAcceptance, "objectiveAtSubmit">;
 }, source: string | null): {
     jobId: string | null;
     source: string | null;
-    objectivePreview: string;
+    objectivePreview: string | null;
 };
+/** 腿上有屏时 run 行预览的补写口(建行之后、起跑之前登记):交付的那一份 → 同一只读法 → 店的写一次口(列已有值则不动)。腿上没有屏 ⇒ 受理座永不调它。 */
+export declare function fillRunPreviewOnDelivery(acceptance: Pick<RunAcceptance, "onDelivered">, runStore: Pick<RunStore, "fillObjectivePreview">, taskId: string): void;
 /** Build the cascade config from the operator ladder. Default gate = `status==="completed"` (escalate
  *  on a cheap-rung failure); cost-ceiling from the task's budget bounds the cold-rerun tax. */
 export declare function cascadeConfig(ladder: readonly string[], maxCostUsd?: number): CascadeConfig;

package/dist/http/run-meta.js

@@ -1,12 +1,15 @@
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function runMeta(prepared, source) {
-    const obj = prepared.spec.objective ?? "";
+    const delivered = prepared.acceptance.objectiveAtSubmit;
     return {
         jobId: prepared.jobId ?? null,
         source,
-        objectivePreview: buildRunObjectivePreview(obj),
+        objectivePreview: delivered === undefined ? null : buildRunObjectivePreview(delivered),
     };
 }
+export function fillRunPreviewOnDelivery(acceptance, runStore, taskId) {
+    acceptance.onDelivered("run-preview", (objective) => runStore.fillObjectivePreview(taskId, buildRunObjectivePreview(objective)));
+}
 export function cascadeConfig(ladder, maxCostUsd) {
     return {
         ladder: ladder.map((model) => ({ model })),