@sema-agent/server 7.144.0 → 7.145.0

package/dist/fleet/fleet-bus.js

@@ -230,7 +230,7 @@ export class FleetEventBus {
 }
 export function fleetRunPublisher(bus, run) {
     if (!bus)
-        return { onStart: () => undefined, onEvent: () => undefined, onForwardEvent: () => undefined, onTerminal: () => undefined };
+        return { onStart: () => undefined, onEvent: () => undefined, onForwardEvent: () => undefined, onTerminal: () => undefined, onNamed: () => undefined };
     let tokens = 0;
     const startedAt = Date.now();
     const sessionField = run.sessionId ? { sessionId: run.sessionId } : {};
@@ -282,7 +282,14 @@ export function fleetRunPublisher(bus, run) {
     };
     return {
         onStart() {
-            bus.publishTask({ id: run.runId, name: run.name, ...(run.description ? { description: run.description } : {}), scope: run.scope, ...sessionField, status: "running", tokens: 0, elapsedMs: 0 });
+            bus.publishTask({ id: run.runId, ...(run.name !== undefined ? { name: run.name } : {}), ...(run.description ? { description: run.description } : {}), scope: run.scope, ...sessionField, status: "running", tokens: 0, elapsedMs: 0 });
+        },
+        onNamed(name) {
+            if (settledLeg)
+                return;
+            if (bus.taskRow(run.runId) === undefined)
+                return;
+            bus.publishTask({ id: run.runId, name });
         },
         onEvent(ev) {
             if (settledLeg)
@@ -595,7 +602,14 @@ export function buildRunName(preview) {
     return oneLine.length > RUN_NAME_CHARS ? `${oneLine.slice(0, RUN_NAME_CHARS - 1)}…` : oneLine;
 }
 export function fleetRunLabels(objective) {
-    return { name: buildRunName(buildRunObjectivePreview(objective ?? "")) };
+    return objective === undefined ? {} : { name: buildRunName(buildRunObjectivePreview(objective)) };
+}
+export function nameFleetRowOnDelivery(acceptance, publisher) {
+    acceptance.onDelivered("fleet-name", async (objective) => {
+        const { name } = fleetRunLabels(objective);
+        if (name !== undefined)
+            publisher.onNamed(name);
+    });
 }
 export function isTerminalFleetStatus(status) {
     switch (status) {

package/dist/http/admission.js

@@ -24,6 +24,7 @@ import { legFactsOf } from "../leg-facts.js";
 import { resolveExecutionContext, stampSpecRoot } from "./execution-context.js";
 import { callerTrust, requestTrustRefusal } from "./caller-trust.js";
 import { createRunAcceptance } from "../run-acceptance.js";
+import { promptScreenDeclared } from "../prompt-screen.js";
 import { sendError, sendHttpError } from "./send.js";
 import { refuseSubmitBody } from "./request-guards.js";
 import { sqlWallsOf } from "../plugins/sql-driver.js";
@@ -750,7 +751,7 @@ export function createAdmission(ctx) {
             const runner = runnerFor(resolved);
             const spec = stampSpecRoot(resolved, execution);
             const model = modelIdOf(spec.model);
-            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, ...(model !== undefined ? { model } : {}) });
+            const acceptance = createRunAcceptance({ sessionTitler: deps.sessionTitler }, { sessionId: spec.sessionId, objective: spec.objective, screened: promptScreenDeclared([deps.deploymentMods, spec.mods]), ...(model !== undefined ? { model } : {}) });
             const clampNotice = buildEntryModeClampNotice(entryMode, spec.sessionId);
             const pendingNotices = clampNotice !== undefined ? [clampNotice, ...engineNotices] : engineNotices;
             const warnings = allowSelectorWarningsOf(admitted, spec.tools ?? []);

package/dist/http/checkpoint-ctx.d.ts

@@ -96,6 +96,7 @@ export declare function buildCheckpointCtx(fields: {
     body: TaskRequestBody;
     memoryScope?: string | undefined;
     unattendedLeg?: true;
+    promptScreened?: true;
     writerVersion: string;
 }, sealer: CheckpointCtxSealer | undefined, sessionId: string): SealedCheckpointCtx;
 /**

package/dist/http/checkpoint-ctx.js

@@ -18,6 +18,7 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         writerVersion: fields.writerVersion,
         ...(fields.memoryScope !== undefined ? { memoryScope: fields.memoryScope } : {}),
         ...(fields.unattendedLeg === true ? { unattendedLeg: true } : {}),
+        ...(fields.promptScreened === true ? { promptScreened: true } : {}),
         ...(bodyCarriesAllowList(fields.body) ? { permissionsAllowReading: "allow_layer" } : {}),
         permissionModeReading: "entry_word",
     };

package/dist/http/durable-run-leg.js

@@ -2,8 +2,8 @@ import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
 import { HEARTBEAT_MS, runInBackground } from "../runs.js";
 import { heldFor } from "../peer-seat.js";
-import { fleetRunPublisher, fleetRunLabels } from "../fleet/fleet-bus.js";
-import { cascadeConfig, runMeta } from "./run-meta.js";
+import { fleetRunPublisher, fleetRunLabels, nameFleetRowOnDelivery } from "../fleet/fleet-bus.js";
+import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "./run-meta.js";
 import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../tool-approval.js";
 import { buildActiveRunConflict } from "./active-run-conflict.js";
 import { commitExecutionContext } from "./execution-context.js";
@@ -11,9 +11,8 @@ import { rootSessionAbsentAnswer } from "./execution-context.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { clearTurnActivity, readTurnActivityMs } from "../turn-activity.js";
 import { recordResourceWindow } from "../resource-window.js";
-import { persistSubmitCtx } from "./submit-ctx.js";
+import { persistSubmissionCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
-import { serviceVersion } from "../service-version.js";
 import { headReadOf } from "../session-incarnation.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
@@ -34,6 +33,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
     if (!created.ok) {
         return { status: 409, body: await buildActiveRunConflict({ runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
     }
+    fillRunPreviewOnDelivery(args.prepared.acceptance, runStore, taskId);
     const owner = args.prepared.auth?.principal ?? null;
     const preLaunchHeartbeat = setInterval(() => {
         void runStore.heartbeat(taskId, owner).catch(() => { deps.metrics?.inc("run_signal_poll_errors_total", { kind: "heartbeat" }); });
@@ -44,7 +44,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         if (placementReject)
             return placementReject;
         if (deps.checkpointStore) {
-            const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, { runStore, taskId }, sessionId, { body: args.prepared.body, memoryScope: args.prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+            const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, { runStore, taskId }, args.prepared);
             if (ctxRefusal)
                 return ctxRefusal;
         }
@@ -81,8 +81,9 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         scope: args.fleetScope,
         rootTaskId: taskId,
         sessionId,
-        ...fleetRunLabels(args.prepared.spec.objective),
+        ...fleetRunLabels(args.prepared.acceptance.objectiveAtSubmit),
     });
+    nameFleetRowOnDelivery(args.prepared.acceptance, fleetPub);
     void heldFor(args.prepared.peerLease, () => runInBackground(args.prepared.runner, args.prepared.spec, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
         ? {
             coordinator: deps.toolApproval,

package/dist/http/resume-legs.js

@@ -54,6 +54,7 @@ import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow }
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "./resume-ctx-read.js";
+import { objectiveWithheldIn } from "./submit-ctx.js";
 import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
@@ -615,6 +616,7 @@ export function createResumeLegs(ctx) {
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
         const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx, execution } = args;
+        const heldObjective = objectiveWithheldIn(resumeCtx.ctx) ? undefined : resumeObjective;
         const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
         const commitResumeCtx = () => Promise.resolve().then(() => deps.checkpointStore.putCtx(resumeCtx.sessionId, sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId))).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
@@ -653,7 +655,7 @@ export function createResumeLegs(ctx) {
             const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
                 source: args.mintFreshRun.source,
                 identity: args.mintFreshRun.identity,
-                objectivePreview: buildRunObjectivePreview(resumeObjective ?? ""),
+                objectivePreview: heldObjective === undefined ? null : buildRunObjectivePreview(heldObjective),
             });
             if (created.existing) {
                 throw new Error(`wake fresh run: createRun observed an existing row for the freshly minted taskId ${freshId} (no idempotency key was sent) — refusing to treat it as a busy session`);
@@ -670,7 +672,7 @@ export function createResumeLegs(ctx) {
             freshRunClaimed = true;
         }
         const fleetPub = taskId && deps.fleetBus
-            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, sessionId, ...fleetRunLabels(resumeObjective) })
+            ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, sessionId, ...fleetRunLabels(heldObjective) })
             : undefined;
         const resumeTaskConfig = taskId ? { ...taskConfig, taskId } : taskConfig;
         if (deps.toolApproval && taskId) {
@@ -1429,7 +1431,7 @@ export function createResumeLegs(ctx) {
             const { spec, engineNotices } = resolved;
             const hostSpec = { ...spec, objective };
             const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, ...(objectiveWithheldIn(ctx) ? { bodyFromScreenedCtx: true } : {}), acceptance: createRunAcceptance({}, { objective, screened: false }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
                 fleetScope: resumeFleetScope(req, auth),
                 elicitOwner: principal ?? null,
                 source: "workflow_parked_decide",

package/dist/http/route-ctx.d.ts

@@ -146,6 +146,12 @@ export interface PreparedTaskSubmission {
      * 判的是**这一次提交**的体:幂等重放从 run 记录答,不重判、不带。
      */
     warnings?: readonly EntryProblem[];
+    /**
+     * `body` 是从一份标着 `promptScreened` 的续跑输入里取回的存量体(今天唯一的这种提交 = `/decide` 的宿主新 turn:这一跑的目标是本服务铸的指路文本,
+     * 体是宿主会话自己的那一份)⇒ 这一跑新写的续跑输入照样标上(`submit-ctx.ts` `persistSubmissionCtx`)。体里的目标不是这一跑的目标,
+     * 它能不能展示在它第一次落盘时就定了,这一跑的受理座答不了。缺席 = 体是这次请求自己的,标不标由受理座定。
+     */
+    bodyFromScreenedCtx?: true;
     /**
      * 这次执行的**执行上下文**(唯一解析器 `http/execution-context.ts` `resolveExecutionContext` 的产物:根 · 住客 · 放置态 · 车道 · device 车道的设备意图)。
      * 提交门在装配之前铸(fresh);`/decide` 的宿主新 turn 交续跑折叠器铸的那一只(continuation)。每个 `runStore.createRun(` 成功点**必须**把它交给
@@ -208,6 +214,15 @@ export interface CheckpointCtx {
      * 缺席 = 本版之前写下的行(不回填):那一码的体不带两键,如实不猜。不是一次性迁移 —— 这一格是常设的事实位,没有删除条件。
      */
     writerVersion?: string;
+    /**
+     * 体里的目标**不是可展示的那一份**:写这份续跑输入的提交腿上装着 prompt 屏(判据 `prompt-screen.ts` 的 `promptScreenDeclared`),
+     * 体里的 `objective` 不是引擎交付的文本 —— 留空,或 verify 形为验证器留着的请求原文(律的属主 = `run-acceptance.ts`「交付的是哪一份」;
+     * 写法与那条 P-DEBT 见 `submit-ctx.ts` 头注)。**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
+     * 读者只有一只:`submit-ctx.ts` 的 `objectiveWithheldIn`(续跑腿的两张展示面 —— wake 新行的预览、fleet 行名 —— 经它问,在场 ⇒ 缺席)。
+     * 写点:`buildCheckpointCtx`(提交腿那一笔,经 `persistSubmissionCtx`;体从一份标着它的续跑输入里取回时照样标上);续跑腿的写回传原 ctx / 其展开 ⇒ 标随行。
+     * 缺席 = 体里的目标就是交付的那一份(腿上没有屏)。
+     */
+    promptScreened?: true;
 }
 /**
  * `/decide` 第三条车道交给宿主投递腿(wake:`DriveResumeArgs` / fresh:`DurableRunLegArgs`)的**一件**:这一跑在内存里带着的决定,

package/dist/http/routes/approvals-assistant.d.ts

@@ -7,6 +7,7 @@ import { type GateIntentView } from "../../approval.js";
 import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 import { type PeerInboundPendingRow } from "../../peer-inbound-face.js";
+import { type PlacementReadingSessionStore, type SessionAgent } from "../../session-agent.js";
 /** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
 export type DecisionDoorId = Extract<ApprovalsAssistantRouteId, "approval-decide" | "assistant-task-plan-review">;
 /** 一道门的静态描述 —— 只写**这道门自己**的东西;路径、路径段、别门的键一概不在这里写(从来源读)。 */
@@ -104,6 +105,19 @@ export type QuestionAnswerCheck = {
  */
 export declare function checkQuestionAnswer(v: unknown): QuestionAnswerCheck;
 export declare function handleApprovalsAssistant(req: IncomingMessage, res: ServerResponse, match: RouteMatch<ApprovalsAssistantRouteId>, ctx: RouteCtx): Promise<void>;
+/** `listPending()` 的行形(两条 durable 读面共用;从 store 的返回类型取,不手抄)。 */
+type PendingRow = Awaited<ReturnType<CheckpointStoreFull["listPending"]>>[number];
+/**
+ * 两条 durable 读面共用的行形 —— 行 + [ref]② 追加的**出身格**(派生位,不是列)+ [ref] 行族词(`checkpoint`)+ [ref] 行的会话在委派树里的位置 `agent`
+ * (会话视图 `GET /v1/sessions/:id` 体顶层的同名键,同一只读口 `readSessionAgent`;在场 ⇔ 这一次列表读到行的会话是一只 placed 委派子代,见 {@link projectDurableQueue})。
+ * 导出只为自铸登记表按键绑型(`trace/self-minted-wire.ts` 的 `approvalQueueRowAgent`)。
+ */
+export type PendingRowForWire = PendingRow & {
+    kind: "checkpoint";
+    governanceForced?: true;
+    rememberRefused?: true;
+    agent?: SessionAgent;
+};
 /**
  * 🔴 [ref]-2 / [ref]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
  * 投影 —— 脱敏([ref] 件4)+ 出身归因([ref] 的另一半)一次做完。
@@ -145,7 +159,12 @@ live: Pick<ToolApprovalCoordinator, "listLivePending"> | undefined,
  * (`pending` / `resolved`):两族同一扇决断口,帧上的 `kind` 判别。`undefined` = 本腿没有这一半场(流字节只差每帧的 `kind`)。
  * 位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
  */
-peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined, scope: string | undefined, 
+peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined, 
+/**
+ * 🔴 [ref]:停驻行 `agent` 的会话店面 —— 与 `GET /v1/approvals` 同一只(`deps.sessionStorage`),经同一只整批投影 {@link projectDurableQueue}。
+ * `undefined` / 店不交 `placementOf` = 这台部署不存委派元组 ⇒ 没有一帧带 `agent`(帧字节与 [ref] 之前逐字相同)。位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
+ */
+sessions: PlacementReadingSessionStore | undefined, scope: string | undefined, 
 /** [ref]②:出身归因的部署侧一半 + 三张审批名单(问的属主)。缺席 ⇒ 归不出治理出身(键缺席,与 best-effort 同方向)、没有一行读作
  *  部署名单的问(记不住,方向是多问)。**位置在 `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
 governance?: PendingProjectionDeployment, pollMs?: number): Promise<void>;

package/dist/http/routes/approvals-assistant.js

@@ -36,6 +36,7 @@ import { seatText } from "../../trace/exit-seat.js";
 import { approvalQueueKindOfDoorId } from "../../approval-queue-kind.js";
 import { defaultPeerInboundFace, parsePeerInboundId, peerBoxScope } from "../../peer-inbound-face.js";
 import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
+import { readSessionAgent } from "../../session-agent.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
     ...RESUME_RESTATABLE_KEYS,
@@ -315,7 +316,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
         if (match.decl.id === "approvals-stream") {
             const ownerParam = operator ? (new URLSearchParams(match.search).get("owner") ?? undefined) : undefined;
             const scope = operator ? ownerParam : ownScope;
-            await streamApprovals(req, res, cs, deps.toolApproval, peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam), scope, deps.config);
+            await streamApprovals(req, res, cs, deps.toolApproval, peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam), deps.sessionStorage, scope, deps.config);
             return;
         }
         if (match.decl.id === "approvals-list") {
@@ -331,7 +332,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 sendApprovalsReadFailure(req, res, deps.logger, err);
                 return;
             }
-            const pending = [...durableRows.map((r) => projectPendingForWire(r, deps.config)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
+            const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
             sendJson(res, 200, {
                 pending,
                 serverNowMs: Date.now(),
@@ -1036,7 +1037,7 @@ function peerInboundRowsFor(face, principal, operatorOwnerParam) {
     const scope = peerBoxScope(principal);
     return () => face.list(scope);
 }
-function projectPendingForWire(row, deployment) {
+function projectPendingForWire(row, deployment, agent) {
     const governance = deployment;
     const redacted = redactPendingDisclosures(row);
     const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
@@ -1049,7 +1050,27 @@ function projectPendingForWire(row, deployment) {
         classes: row.classes,
         deploymentListQuestion,
     });
-    return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}) };
+    return { kind: "checkpoint", ...redacted, ...(governanceForced ? { governanceForced } : {}), ...(rememberRefused ? { rememberRefused: true } : {}), ...(agent !== undefined ? { agent } : {}) };
+}
+async function projectDurableQueue(rows, deployment, sessions) {
+    const agents = await sessionAgentsOf(rows.map((r) => r.sessionId), sessions);
+    return rows.map((r) => projectPendingForWire(r, deployment, agents.get(r.sessionId)));
+}
+async function sessionAgentsOf(sessionIds, sessions) {
+    const out = new Map();
+    if (sessions?.placementOf === undefined)
+        return out;
+    await Promise.all([...new Set(sessionIds)].map(async (sessionId) => {
+        try {
+            const agent = await readSessionAgent(sessions, sessionId);
+            if (agent !== undefined)
+                out.set(sessionId, agent);
+        }
+        catch (err) {
+            recordFailOpen("server.approvals.queue-row-agent-unreadable", `session ${JSON.stringify(sessionId)}: ${seatText("operator-log-text", err instanceof Error ? err.message : String(err))}`);
+        }
+    }));
+    return out;
 }
 function createSseDeltaLane(res, spec) {
     let prev = new Map();
@@ -1068,7 +1089,7 @@ function createSseDeltaLane(res, spec) {
         },
     };
 }
-export async function streamApprovals(req, res, cs, live, peerInbound, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
+export async function streamApprovals(req, res, cs, live, peerInbound, sessions, scope, governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     const keyOf = (p) => {
         switch (p.kind) {
             case "checkpoint":
@@ -1118,7 +1139,7 @@ export async function streamApprovals(req, res, cs, live, peerInbound, scope, go
     while (!closed) {
         let snapshot;
         try {
-            const pending = [...(await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance)), ...(peerInbound?.() ?? [])];
+            const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions)), ...(peerInbound?.() ?? [])];
             snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
         }
         catch (err) {

package/dist/http/routes/rules.d.ts

@@ -3,7 +3,7 @@
  *
  *   POST   /v1/rules                    → 写一条**收紧**规则(deny/ask)进 durable 分区,单步、无票仪式
  *   POST   /v1/rules/cc-import/prepare  → 预览 + 一张**一次性、principal 绑定、有期、载荷绑定**的票
- *   POST   /v1/rules/cc-import/redeem   → 原子消费票 → confirm → 批量兑付进店
+ *   POST   /v1/rules/cc-import/redeem   → 原子消费票 → confirm → 批量兑付进店 → 回执 `{ members, rev }`(与 local-import 口同一张,{@link sendImportReceipt})
  *   GET    /v1/rules                    → 列出自己名下**活着**的规则(keyset 分页,游标绑 rev)
  *   DELETE /v1/rules                    → 按 (rule, scope) 内容撤销,**恒经** core `removePersistedRule`
  *

package/dist/http/routes/rules.js

@@ -159,7 +159,7 @@ export async function handleRules(req, res, match, ctx) {
         }
         const redeemed = await lane.redeemLocalImport(principal, parsed.data.ticket);
         if (redeemed.ok) {
-            sendJson(res, 200, { members: redeemed.outcome.members, rev: redeemed.outcome.rev });
+            sendImportReceipt(res, redeemed.outcome);
             return;
         }
         logger.info("local rule import ticket refused", { reason: redeemed.reason, detail: redeemed.detail, retryable: redeemed.reason !== "ticket-unusable" && redeemed.reason !== "in-flight" && redeemed.retryable === true });
@@ -218,7 +218,10 @@ export async function handleRules(req, res, match, ctx) {
         sendError(res, 404, "not_found.rule_ticket", "no such import ticket");
         return;
     }
-    sendJson(res, 200, { result: redeemed.result });
+    sendImportReceipt(res, redeemed.outcome);
+}
+function sendImportReceipt(res, outcome) {
+    sendJson(res, 200, { members: outcome.members, rev: outcome.rev });
 }
 function resolveTargetPrincipal(requested, caller, config) {
     if (requested === undefined || requested === caller)

package/dist/http/routes/session-sync.js

@@ -7,6 +7,8 @@ import * as facts from "../../capability-facts.js";
 import { classifySyncRelationshipByIds, readImportAnchors, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
+import { StampedSessionArchiveError } from "../../session-error-wire.js";
+import { readSessionAgent } from "../../session-agent.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
 import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
@@ -359,6 +361,16 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const dstIds = (await sessionStorage.listEntryIds?.(sessionId)) ?? null;
                 const relA = classifySyncRelationshipByIds(entryIds, dstIds);
                 if ((relA.relation === "fork" || relA.relation === "stale") && resolution !== "overwrite-dst") {
+                    if (sessionStorage.assertArchiveAnonymous !== undefined && (await readSessionAgent(sessionStorage, sessionId)) === undefined) {
+                        try {
+                            await sessionStorage.assertArchiveAnonymous(sessionId);
+                        }
+                        catch (e) {
+                            if (e instanceof StampedSessionArchiveError && sendSessionError(res, e, "import"))
+                                return;
+                            throw e;
+                        }
+                    }
                     sendError(res, 409, "conflict", "sync conflict", { relation: relA });
                     return;
                 }

package/dist/http/routes/tasks.js

@@ -5,7 +5,7 @@ import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpS
 import { atHostBoundary, sealResultForExit, outwardPlane } from "../../terminal.js";
 import { voidVerifierPauseCard } from "../../verifier-pause-card.js";
 import { withPrincipal } from "../../observability/principal-context.js";
-import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../../fleet/fleet-bus.js";
+import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, nameFleetRowOnDelivery } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../../fleet/subagent-tail-bus.js";
 import { createLiveModelText, modelStreamOfTask } from "../../trace/model-segment.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../../orchestration/workflow-completion-inbox.js";
@@ -17,7 +17,7 @@ import { recordResourceWindow } from "../../resource-window.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { writeLiveFrame, writeLiveHeartbeat } from "../live-frame.js";
 import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, liveIdentityFields } from "../../trace/project.js";
-import { cascadeConfig, runMeta } from "../run-meta.js";
+import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { replayOfExistingRun } from "../submit-replay.js";
 import { httpErrorCode, sendJson, sendError, sseHeaders } from "../send.js";
@@ -33,8 +33,7 @@ import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { persistSubmitCtx } from "../submit-ctx.js";
-import { serviceVersion } from "../../service-version.js";
+import { persistSubmissionCtx } from "../submit-ctx.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
@@ -326,9 +325,10 @@ export async function handleTasks(req, res, match, ctx) {
                             return placementReject;
                         }
                         durableTaskId = tid;
+                        fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
                     }
                     if (deps.checkpointStore) {
-                        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                        const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared);
                         if (ctxRefusal) {
                             writeLiveFrame(res, { type: "done", result: doneResultOfOutcome(ctxRefusal) });
                             return ctxRefusal;
@@ -361,8 +361,10 @@ export async function handleTasks(req, res, match, ctx) {
                     let fleetPub;
                     try {
                         fleetPub = durableTaskId
-                            ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, sessionId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) })
+                            ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, sessionId: prepared.spec.sessionId, ...fleetRunLabels(prepared.acceptance.objectiveAtSubmit) })
                             : undefined;
+                        if (fleetPub)
+                            nameFleetRowOnDelivery(prepared.acceptance, fleetPub);
                     }
                     catch (e) {
                         if (durableHeartbeat)
@@ -499,7 +501,7 @@ export async function handleTasks(req, res, match, ctx) {
                                         userMsgEntryId = promptEntryId;
                                     const causeAtDone = ev.type === "done" ? ac.cause() : undefined;
                                     await deps.userInputLedger?.observeLegEvent(liveStream, ev);
-                                    prepared.acceptance.observe(ev);
+                                    await prepared.acceptance.observe(ev);
                                     await liveWorkspace.observe(ev);
                                     if (ev.type === "done") {
                                         finalResult = await mintSubmitExitResult(ev.result, deps.checkpointStore);
@@ -894,9 +896,10 @@ export async function handleTasks(req, res, match, ctx) {
                         if (placementReject)
                             return placementReject;
                         durableTaskId = tid;
+                        fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
                     }
                     if (deps.checkpointStore) {
-                        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                        const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared);
                         if (ctxRefusal)
                             return ctxRefusal;
                     }
@@ -940,7 +943,7 @@ export async function handleTasks(req, res, match, ctx) {
                             const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), prepared.legFacts?.sessionWitness);
                             for await (const ev of stream) {
                                 observeSyncLegEvent(ev);
-                                prepared.acceptance.observe(ev);
+                                await prepared.acceptance.observe(ev);
                                 await syncWorkspace.observe(ev);
                             }
                             return stream.result();

package/dist/http/run-meta.d.ts

@@ -1,21 +1,28 @@
 /**
- * [ref] A9 装配缝的一片小叶子 —— 提交路径共用的两个纯函数(run 行元数据 + cascade 配置)。
+ * [ref] A9 装配缝的一片小叶子 —— 提交路径共用的三只小件(run 行元数据 + run 行预览的补写口 + cascade 配置)。
  *
- * 为什么单独成文件:`runMeta` 被 tasks 与 runs **两个**域模块调用,`cascadeConfig` 同理(还被测试直接引)。
- * 挂在任一域模块上都会造出 routes/* 互相值 import 的第二条边;它们又是纯函数(只依赖入参 + redact 叶子),
+ * 为什么单独成文件:`runMeta` 与预览补写口被 tasks 与 runs **两个**域模块调用,`cascadeConfig` 同理(还被测试直接引)。
+ * 挂在任一域模块上都会造出 routes/* 互相值 import 的第二条边;它们只依赖入参(受理座 / run 店两只口)+ 预览读法叶子,
  * 所以正确归处是叶子。server.ts 转出口 `cascadeConfig` 以保住既有 import 点。
  */
-import type { TaskSpec, CascadeConfig } from "@sema-agent/core";
+import type { CascadeConfig } from "@sema-agent/core";
+import type { RunAcceptance } from "../run-acceptance.js";
+import type { RunStore } from "../plugins/store-backend.js";
 /** The denormalized run-row metadata captured at submit: correlation (jobId), credential-derived source,
- *  and a redacted objective glance for lists. One place so the three submit paths can't drift. */
+ *  and a redacted objective glance for lists. One place so the three submit paths can't drift.
+ *
+ *  预览只取受理座交出的、提交那一刻就知道的交付文本(律的属主 = `run-acceptance.ts`「交付的是哪一份」):腿上没有 prompt 屏 ⇒ 交付的就是请求原文,
+ *  建行即写;腿上有屏 ⇒ 建行**不写**(列 NULL = 没建过预览),引擎交付可写的那一份时经 {@link fillRunPreviewOnDelivery} 补写一次。本函数不读请求体。 */
 export declare function runMeta(prepared: {
     jobId?: string;
-    spec: TaskSpec;
+    acceptance: Pick<RunAcceptance, "objectiveAtSubmit">;
 }, source: string | null): {
     jobId: string | null;
     source: string | null;
-    objectivePreview: string;
+    objectivePreview: string | null;
 };
+/** 腿上有屏时 run 行预览的补写口(建行之后、起跑之前登记):交付的那一份 → 同一只读法 → 店的写一次口(列已有值则不动)。腿上没有屏 ⇒ 受理座永不调它。 */
+export declare function fillRunPreviewOnDelivery(acceptance: Pick<RunAcceptance, "onDelivered">, runStore: Pick<RunStore, "fillObjectivePreview">, taskId: string): void;
 /** Build the cascade config from the operator ladder. Default gate = `status==="completed"` (escalate
  *  on a cheap-rung failure); cost-ceiling from the task's budget bounds the cold-rerun tax. */
 export declare function cascadeConfig(ladder: readonly string[], maxCostUsd?: number): CascadeConfig;

package/dist/http/run-meta.js

@@ -1,12 +1,15 @@
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 export function runMeta(prepared, source) {
-    const obj = prepared.spec.objective ?? "";
+    const delivered = prepared.acceptance.objectiveAtSubmit;
     return {
         jobId: prepared.jobId ?? null,
         source,
-        objectivePreview: buildRunObjectivePreview(obj),
+        objectivePreview: delivered === undefined ? null : buildRunObjectivePreview(delivered),
     };
 }
+export function fillRunPreviewOnDelivery(acceptance, runStore, taskId) {
+    acceptance.onDelivered("run-preview", (objective) => runStore.fillObjectivePreview(taskId, buildRunObjectivePreview(objective)));
+}
 export function cascadeConfig(ladder, maxCostUsd) {
     return {
         ladder: ladder.map((model) => ({ model })),

package/dist/http/server.d.ts

@@ -2,7 +2,7 @@ import http from "node:http";
 import type { MemoryComplianceFaces, MemoryOriginFaces, SessionMemoryStatusFace } from "../memory-operator-faces.js";
 import type { SideQueryAccounting } from "../budget.js";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
@@ -65,7 +65,7 @@ export interface RequestAuth {
  * 平铺形的直接后果 = main.ts 一个上千行的装配字面量,键与键之间没有任何「属于同一件事」的编译期表达,
  * 键落错家/从未接线只能靠源码钉逐个盯(1.300/1.301/1.304/1.307/1.310 五起真缺陷都是这个病族)。
  *
- * 药:七个**窄**接口 + 顶层必填八件。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
+ * 药:七个**窄**接口 + 顶层必填件(今天九件)。装配点按组构造(每组一个带类型标注的中间 const ⇒ 受 TS 多余
  * 属性检查保护),键放错组当场编译红。
  *
  * 兼容形(本批**不动消费点**):`ServiceDeps` = 平铺视图 ∩ 组槽。旧的平铺构造(96 个测试文件 +
@@ -73,8 +73,8 @@ export interface RequestAuth {
  * 入口摊平回平铺视图,server.ts 内的 ~700 处 `deps.x` 消费点原样保留。消费点迁移是后批的事——
  * 一步到位需要同批改 ~700 处 src + ~800 处 test 键位,与「先立形、后搬家」相比没有额外收益。
  */
-/** createHttpServer 的**必填八件**——引擎、部署配置、提交的身份与根会话(authorizer)、请求→TaskSpec 的映射、选路席、side-query 执行席、读口场景门、对端座的 desk。
- *  八者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
+/** createHttpServer 的**必填九件**——引擎、部署配置、提交的身份与根会话(authorizer)、请求→TaskSpec 的映射、选路席、side-query 执行席、读口场景门、对端座的 desk、部署座的 mod 注册。
+ *  九者恒在场,故留在顶层(不进任何可选组):没有它们 server 根本起不来,包一层可选组只会把编译期
  *  错误推迟到运行期(本仓 E-HIGH-1 病族的成因就是「可选键从未接线、编译期无声」)。 */
 export interface ServiceCoreDeps {
     runner: Runner;
@@ -172,6 +172,14 @@ export interface ServiceCoreDeps {
      * 🔴 **必填**:没有 MCP / A2A 凭据的嵌入也给一只 `createPeerDesk()`(零 IO)—— 一个部署只有一张登记表,缺席不是「没有座」的另一种读法。
      */
     peerDesk: PeerDesk;
+    /**
+     * 部署座的 mod 注册(`RunnerDeps.mods`:这个部署每只 Runner 都带的同一份;起服第五段装配口 `assembleDeploymentMods` 交回,装配点把同一个值交给 Runner 与这里)。
+     * 本层只问它一件事:这条腿上有没有 prompt 屏(`prompt-screen.ts` 的 `promptScreenDeclared`,读注册**声明**的事件,连同任务座 `TaskSpec.mods`)——
+     * 有屏 ⇒ 受理座把目标落盘(run 行预览 · 续跑体 · 会话标题 · fleet 行名)推迟到引擎原样交付之后(读法全文 `run-acceptance.ts`「交付的是哪一份」)。
+     * 🔴 **必填**:缺席若读成「没有屏」,装了屏的部署会把屏前文本落进上面四处,而且谁也看不见 —— 机密轴上没有静默的那一侧。没有 mod 的嵌入显式传 `[]`;
+     * 与交给 Runner 的必须是同一个值(两处不同 = 嵌入方的装配错,本层读不出来)。
+     */
+    deploymentMods: NonNullable<RunnerDeps["mods"]>;
 }
 /** **durable 持久面**:每个键 present ⇔ 对应路由/能力位在场,absent ⇒ 501(诚实缺席),
  *  绝不静默降级。装配点 = main.ts 的 store backend 开箱段。 */
@@ -880,7 +888,7 @@ export interface ServiceDepGroups {
     deployment?: ServiceDeploymentDeps;
     knobs?: ServiceKnobDeps;
 }
-/** 平铺视图 = 必填八件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
+/** 平铺视图 = 必填九件 + 其余七组的全可选并集。**派生**自组接口,故与分组形永不漂。 */
 export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & ServiceCoordinatorDeps & ServiceSeamDeps & ServiceObservabilityDeps & ServiceGovernanceDeps & ServiceDeploymentDeps & ServiceKnobDeps>;
 /** createHttpServer 的入参:两形皆可(平铺=存量,分组=推荐)。同名键两形都给时,**顶层显式键赢**
  *  (含显式 `undefined`)——一处装配点只该用一形,混用时以肉眼最近的那个为准。 */

package/dist/http/server.js

@@ -66,6 +66,9 @@ export function createHttpServer(rawDeps) {
     if (typeof deps.authorize !== "function") {
         throw new Error("createHttpServer: the authorize seat is required — it is the only resolver of a submission's root session; pass `createAuthorizer(config, runner.sessions)` for a single-user embedding; refusing to start rather than run submissions on a root nobody attested");
     }
+    if (!Array.isArray(deps.deploymentMods)) {
+        throw new Error("createHttpServer: the deploymentMods seat is required — it is how the server learns whether a prompt screen runs on its legs (the same registrations the Runners carry as `mods`); pass `[]` for an embedding without mods; refusing to start rather than store objective text before the screen decides");
+    }
     {
         const retired = retiredServiceDepsRefusal(deps);
         if (retired !== undefined)

package/dist/http/submit-ctx.d.ts

@@ -3,6 +3,9 @@ import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { buildCheckpointCtx, type CheckpointCtxSealer, type SealedCheckpointCtx } from "./checkpoint-ctx.js";
 import { type RefusalBody } from "./refusal-body.js";
+import type { CheckpointCtx, PreparedTaskSubmission } from "./route-ctx.js";
+/** 这份续跑输入里体的目标是不是**不可展示**的那一份(`CheckpointCtx.promptScreened` 在场)。读续跑体目标的展示面只经这一只问;落盘的 JSON 逐位判形,不信型面。 */
+export declare function objectiveWithheldIn(ctx: Pick<CheckpointCtx, "promptScreened">): boolean;
 /** 写不进的那一种可答复的结局(各腿把它交回自己的出口:同步 / durable 腿直接回,活流腿编码成终帧)。 */
 export interface SubmitCtxRefusal {
     readonly status: 413 | 409;
@@ -23,4 +26,13 @@ export declare function persistSubmitCtx(store: {
     readonly runStore: RunStore;
     readonly taskId: string;
 } | undefined, sessionId: string, fields: Parameters<typeof buildCheckpointCtx>[0]): Promise<SubmitCtxRefusal | undefined>;
+/**
+ * 提交腿写续跑输入的入口(三个调用点同调这一只):体与标记按受理座提交时交出的那一份定(见文件头「体里的目标按哪一份写」),只写这一笔。
+ * 写不进的处置与答复 = {@link persistSubmitCtx}(本函数只定体、不另判)。
+ */
+export declare function persistSubmissionCtx(store: {
+    putCtx(sessionId: string, ctx: SealedCheckpointCtx): Promise<void>;
+}, deps: Parameters<typeof persistSubmitCtx>[1], claim: Parameters<typeof persistSubmitCtx>[2], prepared: Pick<PreparedTaskSubmission, "body" | "auth" | "verify" | "acceptance" | "bodyFromScreenedCtx"> & {
+    readonly spec: Pick<PreparedTaskSubmission["spec"], "sessionId" | "model">;
+}): Promise<SubmitCtxRefusal | undefined>;
 //# sourceMappingURL=submit-ctx.d.ts.map