@sema-agent/server 7.145.0 → 7.147.0

package/dist/orchestration/workflow-completion-inbox.js

@@ -1,12 +1,15 @@
-import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync } from "node:fs";
+import { openSync, writeSync, fsyncSync, closeSync } from "node:fs";
+import { OWNER_ONLY_FILE_MODE, atomicWriteFileSync } from "../plugins/owner-only-file-mode.js";
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { INBOX_PAYLOAD_MAX_BYTES } from "../plugins/inbox-payload-column.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
-import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
-import { resupplyFields, terminalFrameFacetFields } from "../trace/task-notification-facets.js";
-import { taskNotificationDedupKey } from "@sema-agent/core";
+import { semaProvenanceFields } from "../trace/sema-provenance.js";
+import { resupplyFields, sessionBoxCarrierFields, terminalFrameFacetFields } from "../trace/task-notification-facets.js";
+import { ensureDir, taskNotificationDedupKey } from "@sema-agent/core";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -155,7 +158,7 @@ export class FileWorkflowCompletionInbox extends InMemoryWorkflowCompletionInbox
         super(onWarn);
         this.fsyncEnabled = fsyncEnabled;
         this.dir = join(root, "workflow-completion-inbox");
-        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        ensureDir(this.dir);
         this.ledgerPath = join(this.dir, "inbox.jsonl");
         this.replay();
         this.compact();
@@ -187,7 +190,7 @@ export class FileWorkflowCompletionInbox extends InMemoryWorkflowCompletionInbox
     }
     commit(rec) {
         if (this.fd === undefined)
-            this.fd = openSync(this.ledgerPath, "a", 0o600);
+            this.fd = openSync(this.ledgerPath, "a", OWNER_ONLY_FILE_MODE);
         writeSync(this.fd, `${JSON.stringify(rec)}\n`);
         if (this.fsyncEnabled)
             fsyncSync(this.fd);
@@ -202,35 +205,11 @@ export class FileWorkflowCompletionInbox extends InMemoryWorkflowCompletionInbox
             closeSync(this.fd);
             this.fd = undefined;
         }
-        const tmp = `${this.ledgerPath}.tmp.${process.pid}`;
         const lines = [];
         for (const q of this.bySession.values())
             for (const entry of q.values())
                 lines.push(JSON.stringify({ op: "enqueue", entry }));
-        const tfd = openSync(tmp, "w", 0o600);
-        try {
-            if (lines.length)
-                writeSync(tfd, `${lines.join("\n")}\n`);
-            if (this.fsyncEnabled)
-                fsyncSync(tfd);
-        }
-        finally {
-            closeSync(tfd);
-        }
-        renameSync(tmp, this.ledgerPath);
-        if (this.fsyncEnabled) {
-            try {
-                const dfd = openSync(this.dir, "r");
-                try {
-                    fsyncSync(dfd);
-                }
-                finally {
-                    closeSync(dfd);
-                }
-            }
-            catch {
-            }
-        }
+        atomicWriteFileSync(this.ledgerPath, lines.length ? `${lines.join("\n")}\n` : "", { durability: "best-effort" });
         this.appendsSinceCompact = 0;
     }
     async enqueue(entry) {
@@ -274,18 +253,60 @@ function readEntryExtras(payload) {
     }
     return typeof extras === "object" && extras !== null && !Array.isArray(extras) ? extras : {};
 }
-function encodeWorkflowCompleteExtras(extras) {
+const STREAM_KEY_FIELDS = { task_type: true, task_id: true, status: true, seq: true, attempt: true };
+const ATTRIBUTION_MEMBERS = ["_sema_provenance", "agentMessage", "crossSessionMessage"];
+export const INBOX_SUMMARY_WITHHELD = "[payload over budget: summary withheld; see payloadTruncated]";
+function encodeInboxBody(summary, body, at) {
+    const full = JSON.stringify(body);
+    const bytes = Buffer.byteLength(full, "utf8");
+    const out = bytes <= INBOX_PAYLOAD_MAX_BYTES ? { summary, payload: full } : trimToBudget(summary, body, bytes, at);
+    return { summary: out.summary, payload: out.payload };
+}
+function trimToBudget(summary, body, bytes, at) {
+    const present = Object.entries(body).filter(([, v]) => v !== undefined);
+    const attributed = present.some(([k]) => ATTRIBUTION_MEMBERS.includes(k));
+    const minimal = (keepProvenance) => {
+        const kept = {};
+        const droppedKeys = [];
+        for (const [k, v] of present) {
+            if (Object.hasOwn(STREAM_KEY_FIELDS, k) || (keepProvenance && k === "_sema_provenance"))
+                kept[k] = v;
+            else
+                droppedKeys.push(k);
+        }
+        const withhold = attributed && !Object.hasOwn(kept, "_sema_provenance");
+        if (withhold)
+            droppedKeys.push("summary");
+        const payloadTruncated = { droppedKeys, bytes };
+        return { summary: withhold ? INBOX_SUMMARY_WITHHELD : summary, payload: JSON.stringify({ ...kept, payloadTruncated }), droppedKeys };
+    };
+    const withProvenance = minimal(true);
+    const out = Buffer.byteLength(withProvenance.payload, "utf8") <= INBOX_PAYLOAD_MAX_BYTES ? withProvenance : minimal(false);
+    recordFailOpen("server.workflow-completion-inbox.payload-over-budget", `sessionId=${at.sessionId} key=${at.key} bytes=${String(bytes)} budget=${String(INBOX_PAYLOAD_MAX_BYTES)} dropped=${out.droppedKeys.join(",")}`);
+    return out;
+}
+function readPayloadTruncated(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const { droppedKeys, bytes } = v;
+    return Array.isArray(droppedKeys) && droppedKeys.every((k) => typeof k === "string") && Number.isSafeInteger(bytes) && bytes >= 0
+        ? { droppedKeys: droppedKeys, bytes: bytes }
+        : undefined;
+}
+function encodeWorkflowCompleteExtras(summary, extras, at) {
     const body = {
         ...(extras.completionId ? { completionId: extras.completionId } : {}),
         ...(extras.diagnostics ? { diagnostics: extras.diagnostics } : {}),
     };
-    return Object.keys(body).length > 0 ? { payload: JSON.stringify(body) } : {};
+    return Object.keys(body).length > 0 ? encodeInboxBody(summary, body, at) : { summary };
 }
 function workflowCompleteFrameExtras(payload) {
-    const { completionId, diagnostics } = readEntryExtras(payload);
+    const { completionId, diagnostics, payloadTruncated } = readEntryExtras(payload);
+    const truncated = readPayloadTruncated(payloadTruncated);
     return {
         ...(typeof completionId === "string" && completionId !== "" ? { completionId } : {}),
         ...(typeof diagnostics === "string" && diagnostics !== "" ? { diagnostics } : {}),
+        ...(truncated !== undefined ? { payloadTruncated: truncated } : {}),
     };
 }
 export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
@@ -294,9 +315,8 @@ export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
         owner: route.owner,
         runId: p.runId,
         status: p.status,
-        summary: p.summary,
         enqueuedAt,
-        ...encodeWorkflowCompleteExtras({ completionId: p.completionId, diagnostics: p.diagnostics ? seatText("inbox-diagnostics-text", p.diagnostics) : undefined }),
+        ...encodeWorkflowCompleteExtras(p.summary, { completionId: p.completionId, diagnostics: p.diagnostics ? seatText("inbox-diagnostics-text", p.diagnostics) : undefined }, { sessionId: route.sessionId, key: p.runId }),
     };
 }
 export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPrincipal, emit, diag) {
@@ -384,24 +404,22 @@ export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, pare
         ...(n.result ? { result: cap(redactSecrets(n.result), 4000) } : {}),
         ...(n.output_file ? { output_file: cap(redactSecrets(n.output_file), 1024) } : {}),
         ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: cap(redactSecrets(n.agentMessage.body), 4000) } } : {}),
-        ...(() => {
-            if (n._sema_provenance === undefined)
-                return {};
-            const p = semaProvenanceOrAbsent(n._sema_provenance);
-            return p !== undefined ? { _sema_provenance: p } : {};
-        })(),
+        ...semaProvenanceFields(n, "inbox-frame-text"),
         ...terminalFrameFacetFields(n),
         ...resupplyFields(n),
+        ...sessionBoxCarrierFields(n, "inbox-frame-text"),
     };
+    const runId = taskNotificationFoldKey(n);
+    const out = encodeInboxBody(cap(redactSecrets(n.summary ?? ""), 4000), { ...extras, task_id: n.task_id }, { sessionId, key: runId });
     return {
         sessionId,
         owner,
-        runId: taskNotificationFoldKey(n),
+        runId,
         status: n.status === "completed" ? "completed" : "failed",
-        summary: cap(redactSecrets(n.summary ?? ""), 4000),
+        summary: out.summary,
         enqueuedAt,
         kind: "task_notification",
-        payload: JSON.stringify({ ...extras, task_id: n.task_id }),
+        payload: out.payload,
     };
 }
 export async function resolveCompletionRoute(p, getRun, requirePrincipal) {

package/dist/orchestration/workflow-notify-journal.js

@@ -4,6 +4,7 @@ import { buildFleetWorkflowRow } from "../fleet/fleet-bus.js";
 import { isTerminalWorkflowRowStatus, seedTerminalWorkflowRow } from "../fleet/fleet-terminal-window.js";
 import { buildParkSessionRows } from "./workflow-agent-session-index.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { seatText } from "../trace/exit-seat.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
 export const WORKFLOW_NOTIFY_KEY_DISPOSITION = {
     runId: "carry",
@@ -25,10 +26,8 @@ export function recoverySummary(status, error) {
     if (status === "completed")
         return "workflow completed";
     const base = error ? `workflow failed: ${error}` : "workflow failed";
-    const redacted = base
+    const redacted = seatText("workflow-recovery-summary", base)
         .replace(/https?:\/\/[^\s"'`]+/gi, REDACTION_MARKS.url)
-        .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "[redacted-token]")
-        .replace(/\b(?:api[_-]?key|secret|token|password|authorization)\b\s*[:=]\s*"?[^\s"',}]+/gi, "[redacted-secret]")
         .replace(/(?:\/[A-Za-z0-9_.-]+){2,}/g, REDACTION_MARKS.path)
         .replace(/(?:[A-Za-z]:)?(?:\\{1,2}[A-Za-z0-9_.$-]+){2,}/g, REDACTION_MARKS.path);
     return redacted.length > SUMMARY_MAX ? `${redacted.slice(0, SUMMARY_MAX)}…[+${redacted.length - SUMMARY_MAX} chars]` : redacted;

package/dist/org-delivery-gate.js

@@ -1,6 +1,6 @@
 import { CrossSessionCodecError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, PRINCIPAL_INBOX_HANDLE, peerSessionBoxHandle, mintCrossPrincipalRecord, uuidv7, } from "@sema-agent/core";
 import { principalShapeProblem } from "./security.js";
-import { mailboxKeyProblem } from "./plugins/mailbox-store-sql.js";
+import { mailboxKeyProblem } from "./stores-sql/mailbox-store-sql.js";
 export const ORG_DELIVERY_QUOTA = Object.freeze({ windowMs: 3_600_000, attemptsPerSender: 60, perPair: 10, perRecipient: 30 });
 export const PRINCIPAL_INBOX_BOUND = 50;
 export const ORG_DELIVERY_REFUSAL_MESSAGES = Object.freeze({

package/dist/org-memory-admission.d.ts

@@ -16,12 +16,13 @@
  * (请求来源的 scope 没有调用方 ⇒ 引擎在自己的门上先拒,不问本解析器)—— 本模块按这一判别式分支,不另判一次缺席;
  * 引擎型不可达的那一组合(无调用方 ∧ 请求来源 scope)若仍到了这里 ⇒ 抛,不放行。
  */
-import type { MemoryScopeAdmission } from "@sema-agent/core";
+import { type MemoryScopeAdmission } from "@sema-agent/core";
+import type { Logger } from "./observability/logger.js";
 /**
  * 单机腿:装载 `MEMORY_ORG_DIRECTORY_JSON`(`Record<principal, Record<orgScope, {write?}>>`)。启动期调用,
  * **fail-loud**——任何非法直接 throw 且消息点名坏在哪个键(响亮拒是正确方向:一张半坏的授权表比拒绝
  * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒不是名字的串 / 保留哨兵 / 超长租户名,与所有其它
- * principal 入口同一道闸;拒句按键在 JSON 文本里的出现序点名,不回显不是名字的键 —— 对象的枚举序会把整数形的键排到最前,不能拿它编号);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
+ * principal 入口同一道闸;拒句按键在 JSON 文本里的出现序点名,不回显不是名字的键 —— 对象的枚举序会把整数形的键排到最前,不能拿它编号);scope 键必须过 core 的 org scope 键判官(`isOrgScopeKey`:`org:` 加一段 v2 编码的名;判官只有 core 这一只,本仓不另存文法)、值必须是仅含可选 `write: boolean` 的 plain object。
  */
 export declare function parseOrgDirectoryStatic(json: string): Map<string, Record<string, {
     write?: boolean;
@@ -62,6 +63,8 @@ export interface OrgMemoryDirectoryOptions {
     unavailableBackoffMs: number;
     /** 时间注入(测试用);默认 `Date.now`。 */
     now?: () => number;
+    /** 远程腿一代目录被按坏形拒时的留声口(只用 `warn`;缺席 = 不留声)。 */
+    logger?: Pick<Logger, "warn">;
 }
 type OrgDirectoryUnavailableReason = "fetch_failed" | "section_absent" | "malformed" | "stale_generation";
 /**

package/dist/org-memory-admission.js

@@ -1,7 +1,15 @@
+import { isOrgScopeKey } from "@sema-agent/core";
 import { PrincipalOrgMemoryWire } from "@sema-agent/settings-schema";
+import { echoCallerText } from "./caller-text-echo.js";
 import { assertPrincipalShape } from "./security.js";
+function observe(hook) {
+    try {
+        hook();
+    }
+    catch {
+    }
+}
 const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-const ORG_SCOPE_RE = /^org:\S+$/;
 function topLevelKeysInTextOrder(json) {
     const keys = [];
     let depth = 0;
@@ -58,8 +66,8 @@ export function parseOrgDirectoryStatic(json) {
         }
         const scopes = {};
         for (const [scope, entryRaw] of Object.entries(scopesRaw)) {
-            if (!ORG_SCOPE_RE.test(scope)) {
-                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] has an invalid org scope key ${JSON.stringify(scope)} (must match /^org:\\S+$/)`);
+            if (!isOrgScopeKey(scope)) {
+                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] has an invalid org scope key ${JSON.stringify(scope)} (core's org scope key rule refuses it — spell the org with core's formatOrgScope: "org:" plus the name's percent-encoded segment)`);
             }
             if (!isPlainObject(entryRaw)) {
                 throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}][${JSON.stringify(scope)}] must be an object`);
@@ -78,6 +86,8 @@ export function parseOrgDirectoryStatic(json) {
     }
     return table;
 }
+const REFUSED_GENERATION_KEYS_NAMED = 5;
+const REFUSED_GENERATION_KEY_ECHO_CHARS = 80;
 export function createOrgMemoryDirectory(opts) {
     if ((opts.fetchSection !== undefined) === (opts.staticTable !== undefined)) {
         throw new Error("createOrgMemoryDirectory requires exactly one of fetchSection or staticTable (both given or both missing)");
@@ -117,6 +127,17 @@ export function createOrgMemoryDirectory(opts) {
         if (!parsed.success) {
             return markUnavailable(state, "malformed");
         }
+        const badKeys = Object.keys(parsed.data.scopes).filter((key) => !isOrgScopeKey(key));
+        if (badKeys.length > 0) {
+            const refused = markUnavailable(state, "malformed");
+            observe(() => opts.logger?.warn("org_directory_generation_refused", {
+                gen: parsed.data.gen,
+                badKeyCount: badKeys.length,
+                badKeys: badKeys.slice(0, REFUSED_GENERATION_KEYS_NAMED).map((key) => echoCallerText(key, { maxChars: REFUSED_GENERATION_KEY_ECHO_CHARS })),
+                kept: "this generation is not adopted (the whole generation, not just the keys core refuses); the lookup answers unavailable(malformed) and is retried after the backoff window",
+            }));
+            return refused;
+        }
         if (state.highWaterGen !== undefined && parsed.data.gen < state.highWaterGen) {
             return markUnavailable(state, "stale_generation");
         }
@@ -157,13 +178,7 @@ export class OrgMemoryAdmissionRetryError extends Error {
     }
 }
 export function createMemoryScopeAdmission(directory, opts) {
-    const emit = (outcome, details) => {
-        try {
-            opts.onOutcome?.(outcome, details);
-        }
-        catch {
-        }
-    };
+    const emit = (outcome, details) => observe(() => opts.onOutcome?.(outcome, details));
     return async (input) => {
         const { requested, requestedWriteScope } = input;
         const attributed = (details) => input.principal === undefined ? details : { principal: input.principal, ...details };

package/dist/parked-decide.d.ts

@@ -63,20 +63,16 @@ export type ParkOrigin = {
     park: WorkflowRunParkKey;
 }
 /**
- * **这条决定证不了属于哪一条记录**(core 7.44.0 [ref] 的「没有持有者」两臂;判决属主 = 索引模块的 `routeWorkflowPark`)。
- * `cause`:`unreadable` = 某一条点名这个子会话的记录 `parks[]` 读不出(条目形坏 / 这一位在场却不是列表;缺席 = 没有条目,不在此列)—— 它可能正是持有者;
- * `older_engine` = 点名它的条目没有持有者位(写于不带 `parkedBy` / `generation` 的引擎,升级那一刻还停驻着的存量记录)。
- * 两种都**响亮拒**(409 `decide.workflow_parks_unreadable`,码一个、句子按成因两句),一步都不驱动;出路按成因:`older_engine` = 去续跑 `runId` 那条 run
- * (新引擎准入后走到这张停驻会写下自己的持有者行,之后在这里决就正常);`unreadable` = 修好那条记录(它的指针不随任何后继记录消失,续跑解不开)。
- * 不回落读 `agents[]`(那是被退役的第二种读法)。
- * `readableHolderRunId`(只在 `unreadable` 上可能在场):其余可读记录里持有这张卡的最高代次恰一条 —— 读不出的那条引擎往往恰拒续跑,健康的持有者
+ * **这条决定证不了属于哪一条记录**(core 7.44.0 [ref] 的「没有持有者」一臂;判决属主 = 索引模块的 `routeWorkflowPark`):某一条点名这个子会话的记录
+ * `parks[]` 读不出(条目形坏 / 这一位在场却不是列表;缺席 = 没有条目,不在此列)—— 它可能正是持有者。**响亮拒**(409 `decide.workflow_parks_unreadable`),
+ * 一步都不驱动;出路 = 修好那条记录(`runId`;它的指针不随任何后继记录消失,续跑解不开)。不回落读 `agents[]`(那是被退役的第二种读法)。
+ * `readableHolderRunId`:其余可读记录里持有这张卡的最高代次恰一条 —— 读不出的那条引擎往往恰拒续跑,健康的持有者
  * 就在旁边,拒体多给这一条线索(判决不变,仍是整卡拒;不是解除阻断的出路)。
  */
  | {
     kind: "workflow_parks_unreadable";
     runId: string;
     run: WorkflowRun;
-    cause: "unreadable" | "older_engine";
     readableHolderRunId?: string;
 }
 /**
@@ -216,6 +212,24 @@ export interface ParkedDecideDeps {
     };
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
+/**
+ * 「本会话放行」落在**记不住的车道**上怎么答(闭集;两扇门之间唯一允许的差 —— 其余两口同读同答,铸点只有续跑腿一只):
+ *  · `refuse` —— `/decide` 体上的 `remember:"session"`:那是一个硬意图键,认领之前 400 点名车道(`decide.workflow_remember_unsupported` /
+ *    `decide.parked_remember_unsupported`),去掉它再决即可,零副作用;
+ *  · `decide_once` —— 应答口命中停驻行的 `allow_session`:那是卡上的一个选项,主内容是「放行」。照常放行这一次、不落豁免、回执
+ *    `rememberApplied:false` —— 与活卡上「记不住的卡点 allow_session」同一答法;不把一次已经成立的批准改成 400(窗到期那一拍的按键今天是成的)。
+ * 记不住的车道 = workflow 车道(它的 200 证不出引擎已提交这次决定)、无会话锚的 bg 停驻行(豁免无处可锚)。
+ */
+export type RememberLaneCannotRecord = "refuse" | "decide_once";
+/**
+ * 停驻车道上的「本会话放行」请求。`anchor` 由车道在认领赢下之后、驱动之前调,只**记下**锚(行的 root/host 会话 id —— 部署侧三个豁免探针
+ * (policy 层 / fs-write 门 / workflow 门)的闭包统一捕获 host 会话键,落子代会话则键永不相交;[ref] 候裁② 的 server 侧修,经两轮行为探针实证);
+ * 豁免**落店**只在续跑腿拿到「这次决定被证明已结清」之后(`resumeCheckpoint` 的唯一铸点),车道从不写店。
+ */
+export interface ParkedRemember {
+    readonly anchor: (rootSessionId: string) => Promise<void>;
+    readonly laneCannotRecord: RememberLaneCannotRecord;
+}
 export interface ParkedDecideRequest {
     token: string;
     scope: string;
@@ -235,13 +249,9 @@ export interface ParkedDecideRequest {
     /** D-1 决断绑定:决断方点名它看到的那一对(必在 —— 续跑腿的判官 `decidedActionOf` 判过才交下来)与决定体的其余两位;
      *  server 绝不重算、绝不从停驻行补,core resume 侧做 fail-closed 等值校验 —— 与 legacy 腿同姿势。 */
     binding: Omit<DecideBinding, "checkpointToken" | "boundCallId" | "boundInputHash"> & DecidedAction;
-    /** body 带了 `remember:"session"` 时路由传入的 grant 执行器([ref] 候裁② 的 server 侧修,经两轮
-     *  行为探针实证):豁免必须锚在**行的 root/host 会话 id**——部署侧三个豁免探针(policy 层/fs-write
-     *  门/workflow 门)的闭包统一捕获 host 会话键且签名不携身份(1.393 seam 亲读:`sourceSessionId` 只在
-     *  onAsk 层的 AskRequest,durable 车道无 onAsk),grant 落子代会话则键永不相交(G-F4 原案);落
-     *  root 会话则宿主键闭包立即命中,复活子代的后续同工具 ask 被短路(探针 v2 实证),语义与同步车道/
-     *  宿主任务的「本会话不再询问」一致(= host 会话树全域)。行无 root 锚(病态形)⇒ claim 前诚实 400。 */
-    grantRemember?: (rootSessionId: string) => Promise<void>;
+    /** 这次决定带着「本会话放行」请求(`/decide` 的 `remember:"session"` / 应答口命中停驻行的 `allow_session`,两口同一只请求;
+     *  铸点 = 续跑腿 `resumeCheckpoint`)时,续跑腿交下来的**锚点记录器** + 记不住时怎么答({@link ParkedRemember})。 */
+    remember?: ParkedRemember;
     /** [ref](core 5.7.0,F6 翻案):AskUserQuestion 的 approve 携操作员答案——原样透传进
      *  `ResumeOutcome.answer`(形状校验在路由层 isQuestionAnswer;header 逐字匹配等语义校验在 core,
      *  server 不预判)。core 拒绝形:同步腿 409 invalid_outcome field:"answer",parked 腿经 drive 失败
@@ -250,9 +260,6 @@ export interface ParkedDecideRequest {
     /** 决定体带的续跑请求重述键(`mcpServers` / `a2aPeers`;路由已过提交腿同一只判官)。两条车道各自决定拿它怎么办:workflow 车道盖在宿主会话的续跑输入上、
      *  并进决定的同一性({@link parkDecisionFingerprint});bg 赎回腿不从存量提交体重建任务规格,盖不上 ⇒ claim 前诚实 400(`decide.parked_restatement_unsupported`)。 */
     restatement?: ResumeRestatement;
-    /** claim CAS 赢了(≈ legacy 腿的 markResuming 赢)之后、execute 之前触发——remember 豁免 grant
-     *  的挂点(调用方自吞错,绝不抛落赎回)。claim 败/判别 miss 恒不触发。 */
-    onDecideCommitted?: () => Promise<void>;
 }
 /**
  * 后台子代赎回腿({@link decideParkedAgent})收的请求 = 两条车道共用的那一份 + 选中这张卡的**门身份片段**。workflow 车道是投递、不收它
@@ -331,7 +338,10 @@ export type WorkflowParkedDecidePlan = {
     ok: true;
     hostSessionId: string;
     runId: string;
-    message: string;
+    message: {
+        text: string;
+        trusted: true;
+    };
     outcome: WorkflowParkOutcome;
 } | {
     ok: false;
@@ -339,19 +349,16 @@ export type WorkflowParkedDecidePlan = {
 };
 /**
  * **证不了这条决定属于哪一条记录**的响亮拒(与上面那族拒臂同一种返回形)—— 判决属主 = 索引模块的 `routeWorkflowPark`
- * (「没有持有者」两臂)。码一个(409 `decide.workflow_parks_unreadable`),句子按成因两句,体键 `runId` = 去续跑的那一条;`unreadable` 臂另带顶层
+ * (「没有持有者」一臂:某一条点名这张卡的记录读不出)。码一个(409 `decide.workflow_parks_unreadable`),体键 `runId` = 读不出的那一条;另带顶层
  * `readableHolderRunId`(与 `runId` / `runIds` 同为顶层键)—— **在场才带,缺席整键不在**(没有 / 并列的可读持有者不编一个):读不出的那条引擎往往恰拒续跑,
  * 健康的持有者在旁时指给人看工作可以从哪条记录续上。**只是线索,不是解除阻断的出路**:判决仍是整卡拒(规则 ①),读不出的那条的指针不随任何后继记录消失 ——
  * 续跑可读持有者之后这张卡照旧答本码,直到读不出的那条被修好(拒句如实说了这一点)。
  *
  * 为什么是拒而不是「尽力而为地投递一次」:「这条记录的 run 站在这张停驻上」只有一种读法(`parkedBy === record.id`),读不出来 ⇒
  * 这条决定结构上送不出去,答 200「已交给宿主的下一跑」就是一张兑付不了的回执:卡还 pending、人以为决完了。⇒ 拒,把真话说出来;
- * 卡仍 pending,什么都没有被伪造。不回落读 `agents[]`(那正是被退役的第二种读法)。
- *  · `older_engine`:点名这张卡的条目写于不带持有者位的引擎(升级那一刻还停驻着的存量记录)。续跑这条 run ⇒ 新引擎准入、走到这张
- *    停驻时写下自己的持有者行 ⇒ 之后在这里决就正常;
- *  · `unreadable`:某一条点名这张卡的记录读不出(条目形坏 / 这一份在场却不是列表;记录上**没有**这一份 = 没有条目,不到这里 —— 规则见
- *    `readRunParks`)。续跑**不是**出路:读不出的那条记录的指针不随任何后继记录消失,续跑之后规则 ① 照旧整卡拒(条目形坏的记录引擎本来也拒续跑);
- *    出路 = 运维修好那条记录(`runId`),之后在这里决就正常。
+ * 卡仍 pending,什么都没有被伪造。不回落读 `agents[]`(那正是被退役的第二种读法)。读不出 = 条目形坏 / 这一份在场却不是列表(记录上**没有**这一份 = 没有条目,
+ * 不到这里 —— 规则见 `readRunParks`)。续跑**不是**出路:读不出的那条记录的指针不随任何后继记录消失,续跑之后规则 ① 照旧整卡拒(条目形坏的记录引擎本来也拒续跑);
+ * 出路 = 运维修好那条记录(`runId`),之后在这里决就正常。
  *
  * 🔴 **[ref](词域门)**:句子不提 `checkpointToken`(契约 D-1 逐字:server-INTERNAL、合规 SDK 绝不发送)与内部机件名;判据与冻结钉见
  * `test/api-error-text-lexicon.test.ts` / `test/api-error-text-freeze.test.ts`。

package/dist/parked-decide.js

@@ -43,7 +43,7 @@ export async function findParkOrigin(sources, cp) {
             case "forked":
                 return { kind: "workflow_park_forked", runIds: route.runIds };
             case "unproven":
-                return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, cause: route.cause, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
+                return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
             case "none":
                 return undefined;
             default: {
@@ -110,6 +110,18 @@ export async function findParkedAgentForCheckpoint(agentStore, cp) {
 function grantRootOf(row) {
     return row.rootSessionId ?? row.parentSessionId;
 }
+function refusesWhereUnrecordable(remember) {
+    switch (remember.laneCannotRecord) {
+        case "refuse":
+            return true;
+        case "decide_once":
+            return false;
+        default: {
+            const unhandled = remember.laneCannotRecord;
+            throw new Error(`unhandled remember lane answer: ${String(unhandled)}`);
+        }
+    }
+}
 function mintReviveArgs(row, knownAgentTypes) {
     return {
         prompt: row.description ?? "resume parked agent",
@@ -134,35 +146,17 @@ export function buildParkedResumeOutcome(req) {
     };
 }
 export function denyWorkflowParksUnreadable(origin) {
-    switch (origin.cause) {
-        case "older_engine":
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "decide.workflow_parks_unreadable",
-                    message: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
-                    facts: {
-                        runId: origin.runId,
-                    },
-                }),
-            };
-        case "unreadable":
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "decide.workflow_parks_unreadable",
-                    message: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
-                    facts: {
-                        runId: origin.runId,
-                        ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
-                    },
-                }),
-            };
-        default: {
-            const unhandled = origin.cause;
-            throw new Error(`unhandled workflow parks-unreadable cause: ${String(unhandled)}`);
-        }
-    }
+    return {
+        status: 409,
+        body: refusalBody({
+            errorCode: "decide.workflow_parks_unreadable",
+            message: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+            facts: {
+                runId: origin.runId,
+                ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
+            },
+        }),
+    };
 }
 export function denyWorkflowParkForked(origin) {
     return {
@@ -177,7 +171,7 @@ export function denyWorkflowParkForked(origin) {
     };
 }
 export function planWorkflowParkedDecide(origin, req) {
-    if (req.grantRemember !== undefined) {
+    if (req.remember !== undefined && refusesWhereUnrecordable(req.remember)) {
         return {
             ok: false,
             deny: {
@@ -214,10 +208,13 @@ export function planWorkflowParkedDecide(origin, req) {
         hostSessionId,
         runId: origin.runId,
         outcome: buildParkedResumeOutcome(req),
-        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.park.callKey}") has been ${verdict}. ` +
-            `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
-            `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
-            `agent; completed steps replay from the journal. Do not re-issue the original call.`,
+        message: {
+            text: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.park.callKey}") has been ${verdict}. ` +
+                `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
+                `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
+                `agent; completed steps replay from the journal. Do not re-issue the original call.`,
+            trusted: true,
+        },
     };
 }
 function sessionGone(taskId) {
@@ -256,8 +253,8 @@ async function voidUnrevivableCard(deps, req, match) {
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
-    const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
-    if (req.grantRemember !== undefined && rememberRoot === undefined) {
+    const rememberRoot = req.remember !== undefined ? grantRootOf(row) : undefined;
+    if (req.remember !== undefined && rememberRoot === undefined && refusesWhereUnrecordable(req.remember)) {
         return { status: 400, body: refusalBody({ errorCode: "decide.parked_remember_unsupported", message: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", facts: { taskId: match.handle } }) };
     }
     if (req.restatement !== undefined) {
@@ -325,14 +322,9 @@ export async function decideParkedAgent(deps, req, match) {
         await rollback("revive_surface_threw");
         throw e;
     }
-    try {
-        await req.onDecideCommitted?.();
-    }
-    catch {
-    }
-    if (req.grantRemember !== undefined && rememberRoot !== undefined) {
+    if (req.remember !== undefined && rememberRoot !== undefined) {
         try {
-            await req.grantRemember(rememberRoot);
+            await req.remember.anchor(rememberRoot);
         }
         catch {
         }

package/dist/peer-directory.d.ts

@@ -63,6 +63,9 @@
  *  · `tempo` = `sessionTempoOfRunStatus(lastStatus)`(`plugins/store-contracts.ts` 的那**一张**表,
  *    `GET /v1/sessions` 的 `tempo` 列读的是同一只函数 —— 一处定义两处读);
  *  · `inboundPosture` = managed 层 `crossSessionInbound === "refuse"` ⇒ `"unavailable"`,否则 `"available"`;
+ *  · `occupant` = 会话行的化身(`session_meta.incarnation`,与列表行**同一次读** —— lister 交 `{ row, occupant }`,化身从不进行本身)= 会话腿 acquire
+ *    读到的那一位(core 7.64.0 起跨会话信与回执按 (会话 id, 住客) 投:目录投的若是别的一格,寄往这只会话的每封信都会被判成「给另一位住客的」而丢弃);
+ *    行上没有化身(本仓的店每建一行铸一枚,只有坏行 / 人为改库才缺)⇒ `null`。令牌只进引擎(`ListAgents` 不渲染它),本仓不把它投上 wire / 日志正文;
  *  · `pid` / `procStartMs` / `sockPath` / `cwd` = **恒缺席**(server 会话是耐久可寻址实体,不是进程;
  *    缺席即 core 的探活臂按 `isPeerSessionProcessAlive` 直接跳过);
  *  · `peerProtocol` / `peerFeatures` = 不铸(v1 不声明 CC 能力位;core 侧全 optional)。
@@ -71,18 +74,9 @@ import { type PeerDirectory } from "@sema-agent/core";
 import type { CrossSessionInboundSettingLayers } from "@sema-agent/core";
 import type { Logger } from "./observability/logger.js";
 import type { MailboxRecipientLifecycle } from "./plugins/mailbox-recipient-lifecycle.js";
-import { type SessionListItem } from "./security.js";
-/** 会话枚举面(= `GET /v1/sessions` 用的那只 `OwnerAwareSessionStore.listSessions`)。 */
-export type PeerSessionLister = (opts: {
-    owner?: string;
-    includeUnowned?: boolean;
-    cursor?: {
-        lastActivityAt: string;
-        sessionId: string;
-    };
-    limit: number;
-    q?: string;
-}) => Promise<SessionListItem[]>;
+import { type OwnerAwareSessionStore } from "./security.js";
+/** 会话枚举面(= `GET /v1/sessions` 用的那只列表面的带住客形 `OwnerAwareSessionStore.listSessionRows`:每行配读到它时的住客)。 */
+export type PeerSessionLister = NonNullable<OwnerAwareSessionStore["listSessionRows"]>;
 /**
  * 一次 `listPeerSessions` 最多铸多少行。
  *

package/dist/peer-directory.js

@@ -14,7 +14,9 @@ export function createPeerDirectory(ctx) {
         listPeerSessions: async (access) => {
             const scope = access.scope;
             const includeUnowned = legacyUnownedAmnestyOpen({ requirePrincipal }, scope);
-            const rows = await lister({ owner: scope, ...(includeUnowned ? { includeUnowned: true } : {}), limit: PEER_DIRECTORY_CAP + 1 });
+            const answers = await lister({ owner: scope, ...(includeUnowned ? { includeUnowned: true } : {}), limit: PEER_DIRECTORY_CAP + 1 });
+            const rows = answers.map((a) => a.row);
+            const occupantOf = new Map(answers.map((a) => [a.row.sessionId, a.occupant.incarnation ?? null]));
             const truncated = rows.length > PEER_DIRECTORY_CAP;
             if (truncated) {
                 logger.warn("peer_directory_truncated", {
@@ -88,6 +90,7 @@ export function createPeerDirectory(ctx) {
                     where: "hosted",
                     ...(tempo !== undefined ? { tempo } : {}),
                     inboundPosture: posture,
+                    occupant: occupantOf.get(r.sessionId) ?? null,
                 });
             }
             if (ungrammatical > 0) {
@@ -129,6 +132,7 @@ export function createPeerDirectory(ctx) {
                     where: "hosted",
                     diedAt: t.retiredAt,
                     inboundPosture: posture,
+                    occupant: null,
                 });
             }
             return out;