@sema-agent/server 7.143.0 → 7.145.0

package/dist/plugins/local-session-store.js

@@ -3,17 +3,17 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readdirSync, rea
 import { AsyncLocalStorage } from "node:async_hooks";
 import { isDeepStrictEqual } from "node:util";
 import { dirname, join, resolve } from "node:path";
-import { assertFirstOwnerWritable, forkOwnerOf, importerOwnerOf } from "./session-ownership.js";
+import { assertFirstOwnerWritable, forkOwnerOf, importerOwnerOf, placedSessionOwnerOf } from "./session-ownership.js";
 import { SessionOwnerUnreadableError, StampedSessionArchiveError, sessionUnreadableOf } from "../session-error-wire.js";
 import { FileSessionRepo, SessionError, StoredSession, admitSessionPlacement, atomicWriteFile, sessionLogMarkOf, settledForkOptions, uuidv7, validateEntriesForImport } from "@sema-agent/core";
-import { createPlacedSessionRow, sourceFacesVia } from "../delegated-session-owner.js";
 import { placementCapabilityOf } from "./session-placement.js";
 import { z } from "zod";
 import { contentForkRelation, fastForwardSharedContentDiverged, identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { judgeSessionRowWrite, sessionRowTagKey, settleSessionRowWrite, } from "../session-row.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
-import { createZodColumnReader, decodeJsonColumn, readStringRecordColumn, SqlJsonColumnError } from "./sql-json-column.js";
+import { createZodColumnReader, decodeJsonColumn, isJsonColumnBodyProblem, readStringRecordColumn, SqlJsonColumnError } from "./sql-json-column.js";
+import { SCHEMA_MISMATCH_ERROR_CODE } from "./schema-consistency.js";
 import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./one-time-migrations.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createLogger } from "../observability/logger.js";
@@ -24,7 +24,6 @@ import { SessionForkInProgressError, SessionWriterPresentError, WRITABLE, assert
 import { classifyForkTarget, forkByFreshId } from "./session-fork.js";
 import { decodeInstructionSource, encodeInstructionSource, sameInstructionSourceBaseline } from "../instruction-source-notice.js";
 import { decodeSessionWorkspaceCell, encodeSessionWorkspaceCell } from "./session-workspace-cell.js";
-import { noteReplayInSessionOpenScope, openSessionForItself } from "../session-records-skipped-notice.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { buildObjectivePreview, isAttachmentFrame } from "../user-authored-text.js";
 import { classifySyncRelationshipByIds, ownerCellIs, SyncConflictError, StagedCommitOwnerChangedError, stagingIdFor, } from "../session-sync-kernel.js";
@@ -35,8 +34,8 @@ function archiveFaultWord(code) {
         case "not_found":
             return "absent";
         case "corrupt_session":
-        case "invalid_session":
             return code;
+        case "invalid_session":
         case "invalid_entry":
         case "invalid_fork_target":
         case "storage":
@@ -58,7 +57,7 @@ function ownerUnreadableArchive(probe) {
     const { fault } = probe;
     if (probe.word === "storage" || !(fault instanceof SessionError))
         return probe;
-    return { ...probe, fault: new SessionOwnerUnreadableError(probe.word, fault) };
+    return { ...probe, fault: new SessionOwnerUnreadableError(fault) };
 }
 function importRowRefused(sessionId, landing) {
     return new SessionError("conflict", landing === "create"
@@ -154,6 +153,32 @@ function ownerClaimWindowOpen() {
 }
 const SIDECAR_MAP_STATE_BY_PATH = new Map();
 const SESSION_WRITE_LOCKS_BY_ROOT = new Map();
+const quotedFieldNames = (names) => `${names.slice(0, 8).map((name) => JSON.stringify(name.slice(0, 64))).join(", ")}${names.length > 8 ? `, … (${names.length} in all)` : ""}`;
+function describeLocalDataRootMismatch(findings, when) {
+    const lines = [
+        when === "boot"
+            ? `${SCHEMA_MISMATCH_ERROR_CODE}: the local data root does not match this build's shape — refusing to start.`
+            : `${SCHEMA_MISMATCH_ERROR_CODE}: the local data root does not match this build's shape — refusing to read or write the file(s) named below until this process is restarted.`,
+    ];
+    for (const f of findings) {
+        lines.push(f.unknownFields.length > 0
+            ? `  ${f.label} at ${f.path}: UNKNOWN field(s) ${quotedFieldNames(f.unknownFields)} — the data root is NEWER than this build (a newer server engine wrote it).`
+            : `  ${f.label} at ${f.path}: unreadable (${f.problem}) — this build cannot read it, and an unreadable file is treated as a mismatch, not as empty.`);
+    }
+    lines.push("This build never reads such a file as empty and never writes over it: either would silently change what the file records.", "", "  Ways out (these three and no others):", "    (1) the data root is NEWER than this build (unknown fields): deploy the build that wrote it;", "    (2) roll back: restore the data-root backup taken before the upgrade, then start this build — also the way out when the file's bytes are damaged (not-json / malformed);", "    (3) the file could not be read at all (an I/O error such as EACCES): repair access to it (permissions, mount, disk) and restart — nothing in the file needs changing.", "The check behind this refusal only reads: the file was left in place and nothing in the data root was changed.");
+    return lines.join("\n");
+}
+export class LocalDataRootSchemaMismatchError extends StoreBootRefusalError {
+    findings;
+    when;
+    code = SCHEMA_MISMATCH_ERROR_CODE;
+    constructor(findings, when) {
+        super(describeLocalDataRootMismatch(findings, when));
+        this.findings = findings;
+        this.when = when;
+        this.name = "LocalDataRootSchemaMismatchError";
+    }
+}
 class SidecarMap {
     path;
     label;
@@ -180,32 +205,68 @@ class SidecarMap {
         if (!path)
             return Promise.resolve();
         const st = this.state;
+        if (st.refused !== undefined)
+            return Promise.reject(st.refused);
         if (!st.loaded) {
             st.loaded = (async () => {
-                try {
-                    const parsed = decodeJsonColumn(await readFile(path, "utf8"), this.read, this.label);
-                    for (const [id, v] of Object.entries(parsed)) {
+                const disk = await this.readDisk(path);
+                if (disk.state === "absent")
+                    return;
+                if (disk.state === "read") {
+                    for (const [id, v] of Object.entries(disk.entries)) {
                         if (!st.entries.has(id))
                             st.entries.set(id, v);
                     }
+                    return;
                 }
-                catch (e) {
-                    if (e?.code === "ENOENT")
-                        return;
-                    if (!this.strict) {
-                        this.onUnreadable(path, e);
-                        return;
-                    }
-                    const kind = e instanceof SqlJsonColumnError ? e.problem : (e?.code ?? "unreadable");
-                    throw new Error(`${this.label} is unreadable (${kind}) — refusing to read or write session owners and incarnations until it is repaired: ` +
-                        `reading it as empty would turn every session ownerless, and a replacement incarnation token for an existing session would ` +
-                        `make it a different occupant (its memory opt-out would stop binding it); a write would overwrite the unreadable bytes. ` +
-                        `The file is left in place at ${path}.`);
+                if (!this.strict) {
+                    this.onUnreadable(path, disk.fault);
+                    return;
                 }
+                st.loaded = undefined;
+                throw this.refuse(path, disk);
             })();
         }
         return st.loaded;
     }
+    async reconcile() {
+        const path = this.path;
+        if (!path)
+            return;
+        const st = this.state;
+        if (st.refused !== undefined)
+            throw st.refused;
+        if (!st.loaded)
+            return this.ensureLoaded();
+        await st.loaded;
+        const disk = await this.readDisk(path);
+        if (disk.state === "unreadable")
+            throw this.refuse(path, disk);
+    }
+    async readDisk(path) {
+        let text;
+        try {
+            text = await readFile(path, "utf8");
+        }
+        catch (e) {
+            return e?.code === "ENOENT" ? { state: "absent" } : { state: "unreadable", fault: e };
+        }
+        try {
+            return { state: "read", entries: decodeJsonColumn(text, this.read, this.label) };
+        }
+        catch (e) {
+            return { state: "unreadable", fault: e };
+        }
+    }
+    refuse(path, disk) {
+        const shape = isJsonColumnBodyProblem(disk.fault);
+        const problem = disk.fault instanceof SqlJsonColumnError ? disk.fault.problem : (disk.fault?.code ?? "unreadable");
+        const unknownFields = disk.fault instanceof SqlJsonColumnError ? disk.fault.unknownKeys : [];
+        const refusal = new LocalDataRootSchemaMismatchError([{ path, label: this.label, problem, unknownFields }], "serving");
+        if (shape)
+            this.state.refused = refusal;
+        return refusal;
+    }
     persist() {
         return this.commit(() => true);
     }
@@ -222,11 +283,22 @@ class SidecarMap {
         const path = this.path;
         const st = this.state;
         const link = st.writeChain.then(async () => {
+            if (st.refused !== undefined)
+                throw st.refused;
             const base = new Map(st.entries);
             const draft = new Map(base);
             if (!change(draft))
                 return true;
             if (path) {
+                if (this.strict) {
+                    const disk = await this.readDisk(path);
+                    if (disk.state === "unreadable") {
+                        if (isJsonColumnBodyProblem(disk.fault))
+                            throw this.refuse(path, disk);
+                        this.onWriteFailed(disk.fault);
+                        return false;
+                    }
+                }
                 try {
                     const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
                     await writeFile(tmp, JSON.stringify(Object.fromEntries(draft)), "utf8");
@@ -247,7 +319,7 @@ class SidecarMap {
             }
             return true;
         });
-        st.writeChain = link.then(() => undefined);
+        st.writeChain = link.then(() => undefined, () => undefined);
         return link;
     }
 }
@@ -261,10 +333,7 @@ function noteReplayInArchiveRewriteRead(info) {
 }
 export function createLocalSessionRepo(root) {
     return new FileSessionRepo(root, {
-        onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", (info) => {
-            noteReplayInSessionOpenScope(info);
-            noteReplayInArchiveRewriteRead(info);
-        }),
+        onCorruptRead: createCorruptReadFailOpenSeat("server.session-repo.corrupt-record-skipped", noteReplayInArchiveRewriteRead),
     });
 }
 function occupiedBy(session, row) {
@@ -357,7 +426,6 @@ export class LocalSessionStore {
     placements;
     placementOf;
     listPlaced;
-    claimOwnerless;
     recordedPlacementOf;
     pending = new Map();
     rowsDropped = new Set();
@@ -375,6 +443,7 @@ export class LocalSessionStore {
     instructionSources;
     workspaces;
     meta;
+    strictSidecars = [];
     log;
     sessionWriteLocks;
     executionPlacement;
@@ -395,7 +464,6 @@ export class LocalSessionStore {
             this.recordedPlacementOf = (sessionId) => repoPlacementOf.call(repo, sessionId);
             this.placementOf = this.recordedPlacementOf;
             this.listPlaced = (kind, o) => repoListPlaced.call(repo, kind, o);
-            this.claimOwnerless = (sessionId, incarnation, owner) => this.claimOwnerlessPlaced(sessionId, incarnation, owner);
         }
         else {
             this.recordedPlacementOf = async () => undefined;
@@ -415,7 +483,12 @@ export class LocalSessionStore {
             }
             this.durability = opts.durability;
         }
-        const sidecar = (file, which, read, strict = false) => new SidecarMap(dataDir ? resolve(join(dataDir, file)) : undefined, `${file} (the local ${which} sidecar)`, read, (path, e) => this.refuseSidecar(path, `LocalSessionStore ${which} sidecar`, e, which), (e) => this.warnSidecar("write", e, which), strict);
+        const sidecar = (file, which, read, strict = false) => {
+            const map = new SidecarMap(dataDir ? resolve(join(dataDir, file)) : undefined, `${file} (the local ${which} sidecar)`, read, (path, e) => this.refuseSidecar(path, `LocalSessionStore ${which} sidecar`, e, which), (e) => this.warnSidecar("write", e, which), strict);
+            if (strict)
+                this.strictSidecars.push(map);
+            return map;
+        };
         this.titles = sidecar("session-titles.json", "title", readStringRecordColumn);
         this.pinned = sidecar("session-pinned.json", "pinned", readPinnedSidecar);
         this.instructionSources = sidecar("session-instruction-sources.json", "instruction-source", readStringRecordColumn);
@@ -436,6 +509,19 @@ export class LocalSessionStore {
             place: (sessionId, occupant, cell) => this.placeExecution(sessionId, occupant, cell),
         };
     }
+    async assertStrictSidecarsReadable() {
+        const loads = await Promise.allSettled(this.strictSidecars.map((map) => map.reconcile()));
+        const findings = [];
+        for (const load of loads) {
+            if (load.status === "fulfilled")
+                continue;
+            if (!(load.reason instanceof LocalDataRootSchemaMismatchError))
+                throw load.reason;
+            findings.push(...load.reason.findings);
+        }
+        if (findings.length > 0)
+            throw new LocalDataRootSchemaMismatchError(findings, "boot");
+    }
     async forkingRead(sessionId, meta) {
         if (!isForkCreatedCell(meta))
             return false;
@@ -928,7 +1014,7 @@ export class LocalSessionStore {
     }
     async openForItselfHeld(sessionId, opts) {
         await this.meta.ensureLoaded();
-        const session = await openSessionForItself(sessionId, () => this.repo.open({ id: sessionId, createdAt: "" }));
+        const session = await this.repo.open({ id: sessionId, createdAt: "" });
         admitSessionPlacement(sessionId, (await session.getMetadata()).placement, opts ?? {}, placementCapabilityOf(this));
         return this.handOut(sessionId, session);
     }
@@ -936,18 +1022,51 @@ export class LocalSessionStore {
         if (this.metaCellOf(sessionId) !== undefined) {
             throw new SessionError("placement_refused", `session ${sessionId} is already registered as an ordinary session — refusing to create a subagent transcript on its id`);
         }
-        let session;
-        await createPlacedSessionRow(sessionId, placement, {
-            readFaces: sourceFacesVia((id) => this.headOf(id)),
-            insert: async (owner) => {
-                session = await this.repo.create({ id: sessionId, placement });
-                await this.writeMeta(sessionId, (before) => (before === undefined ? { incarnation: mintSessionIncarnation(), owner, createdAt: rowBornNow() } : undefined));
-            },
-            readOwner: async () => (await this.headOf(sessionId))?.owner,
-        }, this.log);
-        admitSessionPlacement(sessionId, (await session.getMetadata()).placement, opts, placementCapabilityOf(this));
+        const { owner: treeOwner, ...tuple } = placement;
+        const owner = placedSessionOwnerOf(sessionId, { owner: treeOwner });
+        const created = await this.writeMeta(sessionId, (before) => (before === undefined ? { incarnation: mintSessionIncarnation(), owner, createdAt: rowBornNow() } : undefined));
+        if (!created)
+            throw new SessionError("storage", `LocalSessionStore: session ${sessionId} gained a session-meta cell under its own write lock — refusing to guess`);
+        const stuck = (cause, drop) => `LocalSessionStore: creating the subagent transcript ${sessionId} failed (${cause}) and its session-meta cell could not be withdrawn (${drop}) — the cell stays on disk and a placed create on this id is refused; delete the session to clear it`;
+        const unsure = async (err) => {
+            const foreign = err instanceof SessionError && err.code === "conflict";
+            if (foreign || !(await this.holdsThisPlacement(sessionId, opts)))
+                await this.withdrawCreatedCell(sessionId, err, stuck);
+            throw err;
+        };
+        const session = await this.repo.create({ id: sessionId, placement: tuple }).catch(unsure);
+        const persisted = await session.getMetadata().then((meta) => meta.placement, unsure);
+        try {
+            admitSessionPlacement(sessionId, persisted, opts, placementCapabilityOf(this));
+        }
+        catch (err) {
+            await this.withdrawCreatedCell(sessionId, err, stuck);
+            throw err;
+        }
         return this.handOut(sessionId, session);
     }
+    async holdsThisPlacement(sessionId, opts) {
+        const probe = await this.placementProbe(sessionId);
+        if (probe.state === "unusable")
+            return true;
+        try {
+            admitSessionPlacement(sessionId, probe.state === "placed" ? probe.record : undefined, opts, placementCapabilityOf(this));
+            return true;
+        }
+        catch (e) {
+            if (e instanceof SessionError && e.code === "placement_refused")
+                return false;
+            throw e;
+        }
+    }
+    async withdrawCreatedCell(sessionId, cause, stuck) {
+        try {
+            await this.dropMeta(sessionId);
+        }
+        catch (dropErr) {
+            throw new SessionError("storage", stuck(cause instanceof Error ? cause.message : String(cause), dropErr instanceof Error ? dropErr.message : String(dropErr)), cause instanceof Error ? cause : undefined);
+        }
+    }
     async register(sessionId, owner) {
         await this.withSessionWriteLock(sessionId, async () => {
             await this.meta.ensureLoaded();
@@ -986,20 +1105,6 @@ export class LocalSessionStore {
             await this.repo.delete({ id: sessionId, createdAt: "" });
         });
     }
-    async claimOwnerlessPlaced(sessionId, incarnation, owner) {
-        return this.withSessionWriteLock(sessionId, async () => {
-            if ((await this.placedRecordOrThrow(sessionId)) === undefined)
-                return false;
-            return this.writeMeta(sessionId, (before) => {
-                if (before === undefined)
-                    return undefined;
-                const cell = readSessionMetaCell(before);
-                if (cell.incarnation !== incarnation || (cell.owner ?? null) !== null)
-                    return undefined;
-                return cellWith(before, { owner });
-            });
-        });
-    }
     async listSessions(opts) {
         await this.loadRowSidecars();
         const rows = [];
@@ -1105,8 +1210,7 @@ export class LocalSessionStore {
                 return null;
             throw e;
         }
-        if (((await source.getMetadata()).owner ?? null) !== null)
-            throw new StampedSessionArchiveError(sourceId);
+        await this.assertArchiveAnonymous(sourceId);
         const forkOptions = await settledForkOptions(source);
         const forkOwner = forkOwnerOf(owner, this.metaCellOf(sourceId)?.owner);
         const existing = this.metaCellOf(target.id);
@@ -1122,12 +1226,7 @@ export class LocalSessionStore {
                 await copy();
             }
             catch (err) {
-                try {
-                    await this.dropMeta(target.id);
-                }
-                catch (dropErr) {
-                    throw new SessionError("storage", `LocalSessionStore: fork into ${target.id} failed while copying (${err instanceof Error ? err.message : String(err)}) and its target cell could not be withdrawn (${dropErr instanceof Error ? dropErr.message : String(dropErr)}) — the target stays in the fork-in-progress state; retry the same fork or delete the session`, err instanceof Error ? err : undefined);
-                }
+                await this.withdrawCreatedCell(target.id, err, (cause, drop) => `LocalSessionStore: fork into ${target.id} failed while copying (${cause}) and its target cell could not be withdrawn (${drop}) — the target stays in the fork-in-progress state; retry the same fork or delete the session`);
                 throw err;
             }
             return { outcome: "created", id: target.id };
@@ -1195,8 +1294,6 @@ export class LocalSessionStore {
             case "judged":
                 try {
                     const archive = (await this.archiveHeadOf(sessionId)) ?? null;
-                    if ((archive?.owner ?? null) !== null)
-                        throw new StampedSessionArchiveError(sessionId);
                     await this.repo.importEntries(sessionId, undefined, entries, { expect: { row: archive } });
                 }
                 catch (err) {
@@ -1274,6 +1371,10 @@ export class LocalSessionStore {
     forgetStaging(stagingId) {
         this.stagings.delete(stagingId);
     }
+    async assertArchiveAnonymous(sessionId) {
+        if (((await this.archiveHeadOf(sessionId))?.owner ?? null) !== null)
+            throw new StampedSessionArchiveError(sessionId);
+    }
     async commitStagedImport(sessionId, owner, staged, opts) {
         return this.withImportLock(sessionId, owner, async (importer) => {
             const current = await this.metaOf(sessionId);
@@ -1284,6 +1385,9 @@ export class LocalSessionStore {
             await this.assertNotPlacedHeld(sessionId);
             const dstEntries = await this.exportEntries(sessionId);
             const rel = classifySyncRelationshipByIds(staged.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
+            const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(staged, dstEntries);
+            if (!contentEqual)
+                await this.assertArchiveAnonymous(sessionId);
             if ((rel.relation === "fork" || rel.relation === "stale") && opts.resolution !== "overwrite-dst") {
                 throw new SyncConflictError(sessionId, rel);
             }
@@ -1293,7 +1397,6 @@ export class LocalSessionStore {
                 if (diverged)
                     throw new SyncConflictError(sessionId, contentForkRelation(diverged, rel.newEntryIds));
             }
-            const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(staged, dstEntries);
             if (current?.execution?.role === "writer")
                 throw new SessionWriterPresentError(sessionId, current.execution.lane);
             if (rel.relation !== "identical" || !contentEqual) {

package/dist/plugins/local-session-window.d.ts

@@ -24,12 +24,14 @@
  *
  * ## Cost: one linear walk, the engine's
  * The branch is core's own `getPathToRoot` over the whole log (the walk every engine read of a local session makes, with its stop
- * rules: an entry without a parent ends it, a parent the log does not hold is `invalid_session`, an unknown leaf is `not_found`).
+ * rules: an entry without a parent ends it, a parent the log does not hold is `corrupt_session` — `invalid_session` up to core 7.61.x —, an unknown
+ * leaf is `not_found`). A missing parent whose replay dropped records is the one break a RUN does not refuse since core 7.62.0 ([ref]: it re-roots
+ * and says `session.lineage_rerooted`); this view is not a run and takes the walk's refusal as is.
  * Since core 7.54.0 ([ref]) that walk is linear; before, it built the path with `unshift` (quadratic — seconds on a long session, on
  * the event loop) and this module walked the `parentId` chain itself. The second walker is retired: the view reads the branch the
  * engine reads, by the engine's reading. Every later read of the window goes through the same walk, bounded by the floor.
  * A parent CYCLE (a corrupted log; the engine never writes one) is refused by that same walk: since core 7.54.1 it carries one
- * `ParentChainGuard`, and the entry it stands on twice ends it with `invalid_session` naming that entry — `wake` refuses a looped log
+ * `ParentChainGuard`, and the entry it stands on twice ends it with `corrupt_session` (`invalid_session` up to core 7.61.x) naming that entry — `wake` refuses a looped log
  * the way it refuses one whose parent is missing. Core 7.54.0's walk had no guard (a looped log spun it forever on the event loop,
  * and the view's wake with it). The retired walker's own cycle refusal went with it: the engine's guard is the one refusal now, shared
  * by `getPathToRoot` and the run's resume ancestor scan (the two walks core 7.54.1 guards; this module has no walker of its own left).

package/dist/plugins/memory-run-store.d.ts

@@ -57,6 +57,8 @@ export declare class MemoryRunStore implements InProcessClaimFence {
     bindIdemBodyFingerprint(taskId: string, idem: RunIdemBinding): Promise<string | null>;
     /** The run a submission's scoped `Idempotency-Key` names, if any. */
     getRunByIdem(idemKey: string): Promise<RunRecord | undefined>;
+    /** run 行预览的写一次补写(SQL 孪生同义:列仍是 null 才写,建行写过 / 已补过的不动;行不在 ⇒ 无事)。 */
+    fillObjectivePreview(taskId: string, preview: string): Promise<void>;
     requestCancel(taskId: string, owner: string | null): Promise<boolean>;
     isCancelRequested(taskId: string, owner: string | null): Promise<boolean>;
     requestPreempt(taskId: string, owner: string | null): Promise<boolean>;

package/dist/plugins/memory-run-store.js

@@ -109,6 +109,12 @@ export class MemoryRunStore {
         const r = taskId !== undefined ? this.runs.get(taskId) : undefined;
         return r ? this.toRecord(r) : undefined;
     }
+    async fillObjectivePreview(taskId, preview) {
+        const r = this.runs.get(taskId);
+        if (!r || r.objectivePreview !== null)
+            return;
+        r.objectivePreview = preview;
+    }
     async requestCancel(taskId, owner) {
         const r = this.runs.get(taskId);
         if (!r || !ownerEq(r.owner, owner) || r.status !== "running")

package/dist/plugins/one-time-migrations.d.ts

@@ -194,9 +194,10 @@
  *    (拒因点名版本与键);不带 ⇒ 载荷零改动读回,读回方按 5 写回原位,启动日志 `config_lkg_migrated` 一行。规则在 `config-lkg.ts` 顶注 formatVersion 5 一段与
  *    `migrateV4Lkg`。没有读数键(它不写库)。
  *  · **M23 存量 placed 子代行的属主**(7.133.0)—— 7.132.x 及以前两只 SQL 店建委派子代的 placed 行时属主恒 NULL,会话面的属主谓词对 NULL 放行 ⇒ 谁拿到子代的会话 id
- *    (父客户端在子代帧的 `transcriptId` 上收到)谁就读得到整段转录。7.133.0 起建行那一笔按委派继承律写属主(`src/delegated-session-owner.ts`,律的唯一属主),
+ *    (父客户端在子代帧的 `transcriptId` 上收到)谁就读得到整段转录。7.133.0–7.143.x 建行那一笔按本仓委派继承律写属主,7.144.0 起记引擎交的 `placement.owner`
+ *    (core 7.62.0 [ref];`src/delegated-session-owner.ts` 头注),
  *    属主为 NULL 的 placed 行只对 fleet 调用方放行(无主放行臂的唯一判据 `security.ts` 的 `ownerlessRowOpen`,常设的读面律,不随本条删);存量行 ⇒ **每次起服的幂等回填**,
- *    判据与建行逐字同一只(`judgeDelegatedOwner`,属主 = 判断时见证到的):根会话的行在 ⇒ 它的属主(根无主 ⇒ 子代仍无主,不写);根行不在 ⇒ 父会话的行;都不在(孤行)⇒
+ *    判据 = 旧律(`judgeDelegatedOwner`,属主 = 判断时见证到的;引擎当年的读数没有落库,读不回):根会话的行在 ⇒ 它的属主(根无主 ⇒ 子代仍无主,不写);根行不在 ⇒ 父会话的行;都不在(孤行)⇒
  *    哨兵属主 `_orphan:<id>`(保留主体前缀,任何已验身份都不等于它 —— 不留 NULL,宁可没人能读),计数 + 起服一行 warn `placed_session_owners_orphaned` 点名条数。记下的根 / 父是空串 ⇒ 读作没有那一格。
  *    **单趟**:按 `session_id` 键集分页扫 `placement_kind IS NOT NULL ∧ owner IS NULL` 的行,每一页一条语句连读根 / 父两行(属主、住客、是不是 placed 行;连接键套
  *    `NULLIF(…, '')`);回写 = 认领句(`CLAIM_OWNERLESS_PLACED_SQL`:只 CAS 子行自己 —— 扫描读到的化身 + `owner IS NULL` + `placement_kind IS NOT NULL`;扫描与回写之间根 / 父被删、
@@ -204,10 +205,9 @@
  *    化身为空的行(子代或来源行)⇒ 响亮拒(全仓「读到空化身」同一条律)。读数三格:写成的(`placedSessionOwnersInherited` / `placedSessionOwnersOrphaned`)与
  *    **残余** `placedSessionOwnersRemaining` = 律这一读判不出、因为它读到的来源本身还是一只无主的委派子代行的行(根已删、父是同样待回填的行,且排在它之后或在同一页里)。
  *    残余非零 ⇒ 读数行 warn;**不拒启、不重扫**:本文件的每一条在窗内每次起服都跑(「窗」一节),残余行只对 fleet 调用方放行(读面律),由之后起服的本条(一次至少再定下一层)
- *    或这一行的下一次停驻(停驻挂点按同一条律认领,`delegated-session-owner.ts` 的 `settleDelegatedOwner`)定下。根无主的子代(律就让它无主)不是残余,每次起服照样被扫到、照样不写。
- *    **够不到的一格(如实登记)**:local 车道没有 placed 行(引擎 File 店不实现 placement,子代住私店),本条不碰 local 的会话边档;local 店也不记委派树、
- *    不认领 ⇒ 经晋升腿进 local 宿主店的升级前子代行仍无主,它们再次停驻时停驻挂点照「属主不是律给的那一只 ⇒ 拒」处置(收口 = local 的 placement 协议;随包文字的补偿:
- *    local 带身份的部署升级前先把停驻待批的审批处理完)。窗 = 发布日 + 30 天(与 M19 / M21 同一条论证:
+ *    定下(7.144.0 起停驻挂点只比对、不认领)。根无主的子代(律就让它无主)不是残余,每次起服照样被扫到、照样不写。
+ *    **够不到的一格(如实登记)**:本条只扫 SQL 两店,不碰 local 的会话边档 ⇒ 经晋升腿进 local 宿主店的升级前子代行(普通行)仍无主;它们再次停驻时停驻挂点只比对
+ *    引擎交来的属主(复活腿 = 那一行自己的属主 ⇒ 无主照无主比对;随包文字的补偿:local 带身份的部署升级前先把停驻待批的审批处理完)。窗 = 发布日 + 30 天(与 M19 / M21 同一条论证:
  *    窗关时缺省部署上升级前的子代转录已被联合收割按 `BG_AGENT_RETENTION_MS` 收走;调长了留存的部署、滚动升级里旧副本在窗内新写的行如实登记,不为它们加长窗)。
  *  · **M24 workflow journal 的属主 scope 搬家**(7.133.0)—— 7.132.x 及以前 `workflow_journal` 的 scope 是**每一行**上的一列:读面按它判,写面(按
  *    `(run_id, ordinal)` 的 upsert)从不判它 ⇒ 别的 scope 的 append 落新序数插进一条 run、落既有序数覆盖属主的结果。7.133.0 起一条 run 的属主 scope 只记在
@@ -310,7 +310,7 @@
  *    · **local 车道**:没有绑定表、没有 `session_meta`(device 车道只在 SQL 后端)⇒ 只有 ④ 与回填前提:读本地 run 店有 run 的会话,执行席读出 absent 的 ⇒ 经同一只席 `place` 成 writer(表唯一项)
  *      (`LocalBackend.runOneTimeMigrations`);local 没有「切换收尾」的形可读 ⇒ 窗内每次起服都判,首跑之后它只碰认领与放置之间被打断的会话(与 `place` 会落下的格同值)。
  *      有 run、而**存档读不出**的会话 —— 会话元数据格缺(升级链上从没被再读过的老会话)而探针读不出,或 fork 创建的格而探针说不出存档在不在 ——:回填跳过它并点名
- *      (读数 `executionPlacementSessionsUnreadable` + 一行一条 warn `execution_placement_session_unreadable`,带会话 id 与故障词〔闭集 `corrupt_session` / `invalid_session` / `storage`;
+ *      (读数 `executionPlacementSessionsUnreadable` + 一行一条 warn `execution_placement_session_unreadable`,带会话 id 与故障词〔闭集 `corrupt_session` / `storage`;
  *      `storage` = 读存档文件时抛了别的故障:权限 / 磁盘 I/O / 超大,再带 `errno`〕),**不拒启**、一个字节没写 —— 回填只补一格放置、不动存档,读不出的存档不归它判
  *      (这一支只收**探针对这只会话的读故障**;会话元数据边档本身读不出、问账日志压实失败等整库级故障照旧拒启);该会话的请求照旧答存档的故障,存档修好(从留存副本恢复,
  *      或 `storage` 时权限 / 磁盘修好)后的下一次起服照常补放置;存档移走则它不再是本服务的会话(不补放置、不再点名;fork 创建的会话例外 —— 它的格还在,读作 fork 未落定,出路是同键重试那次 fork 或删除该会话)。
@@ -430,7 +430,7 @@ export interface OneTimeMigrationReport {
      *  行数(SQL 独有;local 恒 0)。非零 ⇒ 另一行 warn 点名条数。 */
     readonly placedSessionOwnersOrphaned: number;
     /** M23:这一次起服留着无主的存量 placed 子代行 —— 律这一读判不出,因为它读到的来源本身还是一只无主的委派子代行(根已删、父待回填)。它们只对 fleet 调用方
-     *  放行(读面律),由之后起服的本条或它的下一次停驻定下。根无主的子代(律就让它无主)不算。行数(SQL 独有;local 恒 0)。非零 ⇒ 读数行 warn(不拒启)。 */
+     *  放行(读面律),由之后起服的本条定下。根无主的子代(律就让它无主)不算。行数(SQL 独有;local 恒 0)。非零 ⇒ 读数行 warn(不拒启)。 */
     readonly placedSessionOwnersRemaining: number;
     /** M24:workflow journal 的属主 scope —— `moved` = 本次把行上的 scope 列搬进 `workflow_journal_owner`(回填 + 删跨 scope 行 + 删列);`current` = 早已是新形
      *  (新库 / 第二跑:`workflow_journal` 上没有 scope 列);`file-store` = local 车道(core 的 File 店,属主 = 每条 run 的 journal 文件首行)。 */
@@ -528,7 +528,7 @@ export interface ParkedApprovalCardRowTooLong extends ParkedApprovalCardRowUnrea
     readonly bytes: number;
 }
 /**
- * M32 local 腿被跳过的一只会话:会话 id 是点名坐标;故障词是闭集 {@link UnusableArchiveWord}(`corrupt_session` = 会话头读不出;`invalid_session` = 读得出、结构走不通;
+ * M32 local 腿被跳过的一只会话:会话 id 是点名坐标;故障词是闭集 {@link UnusableArchiveWord}(`corrupt_session` = 会话头读不出,或读得出而日志走不成一棵树;
  * `storage` = 读的时候抛了别的故障,I/O 级 —— 权限 / 磁盘 / 超大,此时 `errno` 带那只故障的 `code`)。盘上路径与故障句不出店。
  */
 export interface ExecutionPlacementSessionUnreadable {
@@ -846,13 +846,13 @@ export declare function repairParkedRows(db: MigrationDb, dialect: SqlDialect, r
 export declare function backfillParkedApprovalCards(db: MigrationDb, dialect: SqlDialect, receipts: MigrationReceipts): Promise<void>;
 /**
  * M23 —— 存量 placed 子代行的属主回填,**每次起服单趟、幂等**(规则、为什么、够不到的一格见头注 M23 段):键集分页扫完 placed ∧ 属主 NULL 的行,每一行按唯一判据判
- * (`judgeDelegatedOwner`,建行那一笔与停驻挂点同一只:来源顺序根、父;属主 = 这一读见证到的):
- *  · 判出属主 ⇒ {@link CLAIM_OWNERLESS_PLACED_SQL}(只 CAS 子行自己,绑扫描读到的化身;与停驻挂点的认领**同一句、同一份绑参**;第二跑零命中);写成的按属主计进
+ * (`judgeDelegatedOwner`,旧律:来源顺序根、父;属主 = 这一读见证到的):
+ *  · 判出属主 ⇒ {@link CLAIM_OWNERLESS_PLACED_SQL}(只 CAS 子行自己,绑扫描读到的化身;第二跑零命中);写成的按属主计进
  *    `placedSessionOwnersOrphaned`(谁都不匹配:孤行哨兵,或继承自孤行祖先的同一只哨兵)或 `placedSessionOwnersInherited`,每一次提交当场记进收据账;零命中(这一行在扫描之后
  *    被写过 / 删过 / 换了住客)⇒ 不计,下一次起服按那时的律重判;
  *  · 判出无主:读到的来源本身是一只 placed 行(还没定下的委派子代行)⇒ 计进 `placedSessionOwnersRemaining`(残余);来源是普通会话(根无主)⇒ 律就让它无主,不计;
  *  · 扫到的任何一行化身为空 ⇒ 响亮拒(不论判不判得出属主;来源行同一条律)。
- * 不重扫、不拒启:残余由下一次起服或那一行的下一次停驻定下,期间只对 fleet 调用方放行(头注 M23 段)。
+ * 不重扫、不拒启:残余由下一次起服定下,期间只对 fleet 调用方放行(头注 M23 段)。
  */
 export declare function inheritPlacedSessionOwners(db: MigrationDb, dialect: SqlDialect, receipts: MigrationReceipts): Promise<void>;
 /**

package/dist/plugins/one-time-migrations.js

@@ -404,17 +404,17 @@ export const ONE_TIME_MIGRATIONS = [
         introducedIn: "7.133.0",
         releasedOn: "2026-10-21",
         removableAfter: "2026-11-20",
-        removal: "删 migrateOn 的 M23 步(`inheritPlacedSessionOwners`:placed ∧ 属主 NULL 的行按 session_id 键集分页单趟扫描 + 同一条语句连读根 / 父两行 + 按认领句回写属主)与 `PLACED_OWNER_SCAN_PAGE` / `placedOwnerScanSql` / `scannedPlacement` / `scannedFaces` / `scannedPlacedSources`(`isOrphanSessionOwner` 若再无别的读者一并删);" +
-            "**同窗同删的另一半**(认领:按律给升级前写下的无主子代行写属主 —— 停驻挂点对宿主无主行做的就是本条对那一行的单行步):`delegated-session-owner.ts` 的 `CLAIM_OWNERLESS_PLACED_SQL` / `claimOwnerlessParams` / `OwnerlessClaim` / " +
-            "`settleDelegatedOwner` 的认领一步(删后它只剩树比对与属主比对)/ `DelegationTreeStore.claimOwnerless`," +
-            "两只 SQL 店(`tidb-session-store.ts` / `pg-session-storage.ts`)与 local 店(`local-session-store.ts` 的 `claimOwnerless` 字段与 `claimOwnerlessPlaced`)的 `claimOwnerless`、`CachingSessionStore` 的转发、`OwnerAwareSessionStore.claimOwnerless`、`delegatedOwnerHostOf` 对它的「与 `placementOf` 同在或同缺」;" +
+        removal: "删 migrateOn 的 M23 步(`inheritPlacedSessionOwners`:placed ∧ 属主 NULL 的行按 session_id 键集分页单趟扫描 + 同一条语句连读根 / 父两行 + 按认领句回写属主)与 `PLACED_OWNER_SCAN_PAGE` / `placedOwnerScanSql` / `scannedPlacement` / `scannedFaces` / `scannedPlacedSources`;" +
+            "**同窗同删的另一半**(旧律的判据与写句 —— 7.144.0 起建行与停驻挂点都不再读它们,M23 是唯一读者):`delegated-session-owner.ts` 头注 M23 一节与 `judgeDelegatedOwner` / `inheritedOwnerOf` / `ownerSourcesOf` / " +
+            "`orphanSessionOwner` / `isOrphanSessionOwner` / `SourceOwnerReading` / `InheritedOwner` / `PlacementSources` / `CLAIM_OWNERLESS_PLACED_SQL` / `claimOwnerlessParams`;" +
             "报告、日志行与 `NO_SQL_MIGRATIONS` 的 `placedSessionOwnersInherited` / `placedSessionOwnersOrphaned` / `placedSessionOwnersRemaining` 与 `placed_session_owners_orphaned` 那一行 warn;" +
             "`test/one-time-migrations.test.ts` 的 M23 组与 `test/one-time-migrations-db-integration.test.ts` 的 M23 格。" +
-            "**不随本条删**:属主为 NULL 的 placed 行只对 fleet 调用方放行(`security.ts` 的 `ownerlessRowOpen` / `sessionOwnerCellOf` 与各门读 `placementOf` 的那一次)—— 那是常设的读面律",
+            "**不随本条删**:`ORPHAN_SESSION_OWNER_PREFIX` 与它在 `security.ts` 保留主体前缀里的登记(已落库的行可能带哨兵,永久保留);" +
+            "属主为 NULL 的 placed 行只对 fleet 调用方放行(`security.ts` 的 `ownerlessRowOpen` / `sessionOwnerCellOf` 与各门读 `placementOf` 的那一次)—— 那是常设的读面律",
         afterRemoval: "会话面的读面律(常设,不随本条删)接住:跳过了带本条的版本直接升的库里,属主为 NULL 的存量 placed 子代行只对 fleet 调用方放行(出示 service 凭据、不报主体;dev-open)," +
             "其余调用方答 404(与别人的行同体)—— 出路是升级时先过一次带本条的版本,或运维按 `placement_root_session_id`(缺则 `placement_parent_session_id`)那一行的属主手工回填、" +
-            "推不出的写一个任何主体都不匹配的值;停驻挂点读到无主的宿主子代行 ⇒ 回到比对的既有臂:无主 ≠ 律给的属主 ⇒ 停驻否决(fail-closed,响亮;出路同上);" +
-            "建行那一笔的继承律不随本条删(那是常设的写法,不是迁移)",
+            "推不出的写一个任何主体都不匹配的值;停驻挂点只比对宿主行属主与引擎交来的属主(复活腿交那一行自己的属主),不写无主行;" +
+            "建行那一笔记 `placement.owner` 不随本条删(那是常设的写法 —— core 盒义务 7,不是迁移)",
         reportKeys: ["placedSessionOwnersInherited", "placedSessionOwnersOrphaned", "placedSessionOwnersRemaining"],
     },
     {
@@ -570,8 +570,8 @@ export const ONE_TIME_MIGRATIONS = [
             "报告 / 收据 / `changedAnything` / `readingsSnapshot` / `readingFields` 里的 `localArchiveRowFactsBackfilled` / `localArchivesAnonymized` / `localArchivesKeptStamped` / `localArchivesUnreadable` / `localArchiveSnapshotsRecovered`、" +
             "`local_archive_kept_stamped` / `local_archive_unreadable` 两行 warn、读数行 note 里的 M33 句与头注 M33 段;`test/local-archive-owner.test.ts` 里标题含 `P3` / `P4` / `P5` / `P6` / `F1` / `F2` / `F3` 的格与 `legacyRoot` / `writeArchive` / `boot` / `M33_ZERO` / `m33Of` 助手。" +
             "**不随本条删**:行格的 `createdAt` / `forkedFrom` 两键(常设的数据形)、`LocalArchiveSnapshotsPresentError` / `assertNoArchiveSnapshots` / `LOCAL_ARCHIVE_SNAPSHOT_DIR` 与 `LocalBackend.ensureSchema` 里调它的那一句、" +
-            "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店两处带戳判(fork 的源、改日志推送的落点)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
-        afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork 与改日志的推送同一只具名拒(409 `conflict` + 固定句,零写 / 行格净零写)," +
+            "`session-error-wire.ts` 的 `StampedSessionArchiveError` / `STAMPED_SESSION_ARCHIVE_SENTENCE` / `sessionErrorWireOf` 与本店带戳判的唯一读口 `assertArchiveAnonymous`(fork 的源、改日志推送的落点、会话同步导入第一阶段的早拒三处问它)、行上缺建档时刻的 F 类读法(`server.local-session-row.created-at-absent`)",
+        afterRemoval: "三只常设臂接住:① 数据根下的快照目录非空 ⇒ 拒启(`config.local_archive_snapshot_present`,点名文件与两条出路);② 跳过了带本条的版本直接升的数据根(或本条留着的存档),带属主戳的存档被 fork、改日志的推送与会话同步导入第一阶段对 fork / stale 的早拒同一只具名拒(409 `conflict.session_archive_stamped` + 固定句,零写 / 行格净零写)," +
             "读 / 续跑 / 拉取照常 —— 出路 = 删掉会话后重推,或升级时先过一次带本条的版本并在窗内起服;③ 行上没有建档时刻的格(同一类数据根)⇒ 列表 / 会话视图 / 交出的元数据读纪元(F 类 tag 计数)",
         reportKeys: ["localArchiveRowFactsBackfilled", "localArchivesAnonymized", "localArchivesKeptStamped", "localArchivesUnreadable", "localArchiveSnapshotsRecovered"],
     },
@@ -1687,10 +1687,10 @@ export async function inheritPlacedSessionOwners(db, dialect, receipts) {
             const sessionId = String(r.session_id);
             after = sessionId;
             const incarnation = incarnationFromCell(sessionId, r.incarnation);
-            const judged = judgeDelegatedOwner(sessionId, scannedPlacement(r), scannedFaces(r));
-            const owner = judged.inherited.owner;
+            const inherited = judgeDelegatedOwner(sessionId, scannedPlacement(r), scannedFaces(r));
+            const owner = inherited.owner;
             if (owner === null) {
-                if (judged.inherited.kind === "inherited" && scannedPlacedSources(r).has(judged.inherited.from))
+                if (inherited.kind === "inherited" && scannedPlacedSources(r).has(inherited.from))
                     receipts.placedSessionOwnersRemaining += 1;
                 continue;
             }
@@ -1858,7 +1858,7 @@ function logReceiptRows(log, backend, r) {
             ...(row.errno !== undefined ? { errno: row.errno } : {}),
             note: "a local session that has runs (and either no session-metadata cell — it was written before the cell existed and has not been read since — or a fork-created cell) has an archive the server cannot read, " +
                 "so its execution placement could not be backfilled. The session was skipped and nothing was written or changed: boot is not blocked, and every request that needs the " +
-                "session keeps answering the archive's own fault (fault names it: corrupt_session = the session header cannot be read; invalid_session = the stored log's structure is broken; " +
+                "session keeps answering the archive's own fault (fault names it: corrupt_session = the session header cannot be read, or the stored log does not form one tree; " +
                 "storage = reading the archive file itself failed — errno names it, e.g. EACCES = no permission, EIO = disk I/O error, ERR_STRING_TOO_LONG = the file is too large to read) until the " +
                 "archive file under the data root's sessions directory is readable again — restored from a kept copy, or (storage) its permissions or disk repaired; the next boot then backfills its placement as for any other session. " +
                 "(Removing the archive file ends the warning but places nothing: the session then no longer exists on this server — except a fork-created session, whose cell stays and reads as a fork that has not landed: retry the same fork, or delete the session.) The session is named on every boot until then",