@sema-agent/server 7.146.0 → 7.147.0

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,4 +1,3 @@
-import { type SemaProvenanceInput } from "../trace/sema-provenance.js";
 import { type SystemInjectionPriority, type TaskNotificationPayload } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
@@ -17,11 +16,12 @@ export interface WorkflowCompletionInboxEntry {
      *  originating leg was IDLE (core's in-process injection had no harness to steer — the durable half
      *  is the deployment's job). `runId` then holds the core task_id (disjoint id spaces). */
     kind?: "workflow_complete" | "task_notification";
-    /** The per-kind extras as a JSON text — bounded + redacted AT ENQUEUE (the store carries only egress-safe bytes).
+    /** The per-kind extras as a JSON text — bounded + redacted AT ENQUEUE (the store carries only egress-safe bytes) and judged against
+     *  the entry byte budget by {@link encodeInboxBody}, the only minter of {@link InboxPayload}.
      *  `task_notification`: {task_type, toolUseId?, result?, output_file?, …}. `workflow_complete`: at most `{"completionId": …, "diagnostics": …}`
-     *  (see {@link buildWorkflowCompleteInboxEntry}; each key absent when the engine minted none). The SQL stores' existing `payload`
-     *  column carries it verbatim for both kinds — no DDL. */
-    payload?: string;
+     *  (see {@link buildWorkflowCompleteInboxEntry}; each key absent when the engine minted none). Over budget, either kind carries its minimal
+     *  form instead (stream-key fields + `_sema_provenance` when it fits + `payloadTruncated`). The SQL stores' existing `payload` column carries it verbatim for both kinds — no DDL. */
+    payload?: InboxPayload;
 }
 /** Session-keyed queue of finished-workflow completions awaiting a push to the originating session.
  *  Two-phase delivery (1.80, closes the 1.77-review "drained-but-append-failed" at-most-once window): `pending`
@@ -199,6 +199,21 @@ export declare class FileWorkflowCompletionInbox extends InMemoryWorkflowComplet
     /** Close the ledger fd (shutdown). */
     close(): void;
 }
+/** 品牌键:模块私有的 `unique symbol` —— 别处写不出一个 {@link InboxPayload} 字面量。 */
+declare const INBOX_PAYLOAD: unique symbol;
+/** 判过条目字节预算的 `payload` 文本(JSON)。`string` 的子型:读者零改;条目的 `payload` 位只收 {@link encodeInboxBody} 铸的值 ⇒ 绕过预算座是 tsc 红。
+ *  读侧(SQL 店把列读回来、File 店重放账本)单跳收窄:那些字节只可能是本座写下的(或预算立座之前的存量行,drain 照读)。 */
+export type InboxPayload = string & {
+    readonly [INBOX_PAYLOAD]: true;
+};
+/** 被裁条目在 payload(与 drain 出的补投帧)上的点名:`droppedKeys` = 全形里被丢的成员名(全形键序;末尾的 `summary` = 摘要原句被扣下、帧上的 `summary`
+ *  是 {@link INBOX_SUMMARY_WITHHELD}),`bytes` = 全形的 UTF-8 字节数。 */
+export interface PayloadTruncated {
+    droppedKeys: string[];
+    bytes: number;
+}
+/** 摘要原句因失去归因被扣下时,帧上 `summary` 换成的**本服务铸**的一句(受信、不含任何对端字节)。 */
+export declare const INBOX_SUMMARY_WITHHELD = "[payload over budget: summary withheld; see payloadTruncated]";
 /**
  * 一次 workflow 完成 → 入箱条目(`workflow_complete` 家族;启动期投递闭包的**唯一**构造点)。`summary` 在 core 的 notifier seam 上已脱敏 + 限长,这里原样入箱;
  * `completionId`(引擎铸,`WorkflowCompletionPayload` 上在场 iff 引擎给了)逐字落进 `payload` 列 —— 同一次完成的补投帧与 live 帧同一个相关 id,本服务零自铸。
@@ -286,7 +301,12 @@ export type EngineNotificationParkInput = ParkedNotificationFields & {
         from: string;
         body: string;
     };
-    _sema_provenance?: SemaProvenanceInput;
+    _sema_provenance?: unknown;
+    /** [ref]:会话箱车道的三只载体 —— 判据与 live 腿同一只(`trace/task-notification-facets.ts`,入参按 `unknown` 收)。park 腿**真的会**收到它们:
+     *  会话箱 drain 的注入先经本服务的 `onTaskNotification` 观察者,sync 腿的停驻判据含「客户端已断开」(run 未收束的窗里一次轮界 drain 就走到这里)。 */
+    crossSessionMessage?: unknown;
+    crossSessionNotice?: unknown;
+    inboxNotice?: unknown;
     /** [ref](core 7.30.0 [ref] S1 / [ref] / [ref]):委派终态帧三枚 facet + 重供两键 —— 判据与 live 腿同一只
      *  (`trace/task-notification-facets.ts`,入参按 `unknown` 收、判过形才成 typed)。 */
     spawnName?: string;

package/dist/orchestration/workflow-completion-inbox.js

@@ -1,12 +1,15 @@
-import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, renameSync } from "node:fs";
+import { openSync, writeSync, fsyncSync, closeSync } from "node:fs";
+import { OWNER_ONLY_FILE_MODE, atomicWriteFileSync } from "../plugins/owner-only-file-mode.js";
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
+import { recordFailOpen } from "../observability/fail-open.js";
+import { INBOX_PAYLOAD_MAX_BYTES } from "../plugins/inbox-payload-column.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
-import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
-import { resupplyFields, terminalFrameFacetFields } from "../trace/task-notification-facets.js";
-import { taskNotificationDedupKey } from "@sema-agent/core";
+import { semaProvenanceFields } from "../trace/sema-provenance.js";
+import { resupplyFields, sessionBoxCarrierFields, terminalFrameFacetFields } from "../trace/task-notification-facets.js";
+import { ensureDir, taskNotificationDedupKey } from "@sema-agent/core";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -155,7 +158,7 @@ export class FileWorkflowCompletionInbox extends InMemoryWorkflowCompletionInbox
         super(onWarn);
         this.fsyncEnabled = fsyncEnabled;
         this.dir = join(root, "workflow-completion-inbox");
-        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        ensureDir(this.dir);
         this.ledgerPath = join(this.dir, "inbox.jsonl");
         this.replay();
         this.compact();
@@ -187,7 +190,7 @@ export class FileWorkflowCompletionInbox extends InMemoryWorkflowCompletionInbox
     }
     commit(rec) {
         if (this.fd === undefined)
-            this.fd = openSync(this.ledgerPath, "a", 0o600);
+            this.fd = openSync(this.ledgerPath, "a", OWNER_ONLY_FILE_MODE);
         writeSync(this.fd, `${JSON.stringify(rec)}\n`);
         if (this.fsyncEnabled)
             fsyncSync(this.fd);
@@ -202,35 +205,11 @@ export class FileWorkflowCompletionInbox extends InMemoryWorkflowCompletionInbox
             closeSync(this.fd);
             this.fd = undefined;
         }
-        const tmp = `${this.ledgerPath}.tmp.${process.pid}`;
         const lines = [];
         for (const q of this.bySession.values())
             for (const entry of q.values())
                 lines.push(JSON.stringify({ op: "enqueue", entry }));
-        const tfd = openSync(tmp, "w", 0o600);
-        try {
-            if (lines.length)
-                writeSync(tfd, `${lines.join("\n")}\n`);
-            if (this.fsyncEnabled)
-                fsyncSync(tfd);
-        }
-        finally {
-            closeSync(tfd);
-        }
-        renameSync(tmp, this.ledgerPath);
-        if (this.fsyncEnabled) {
-            try {
-                const dfd = openSync(this.dir, "r");
-                try {
-                    fsyncSync(dfd);
-                }
-                finally {
-                    closeSync(dfd);
-                }
-            }
-            catch {
-            }
-        }
+        atomicWriteFileSync(this.ledgerPath, lines.length ? `${lines.join("\n")}\n` : "", { durability: "best-effort" });
         this.appendsSinceCompact = 0;
     }
     async enqueue(entry) {
@@ -274,18 +253,60 @@ function readEntryExtras(payload) {
     }
     return typeof extras === "object" && extras !== null && !Array.isArray(extras) ? extras : {};
 }
-function encodeWorkflowCompleteExtras(extras) {
+const STREAM_KEY_FIELDS = { task_type: true, task_id: true, status: true, seq: true, attempt: true };
+const ATTRIBUTION_MEMBERS = ["_sema_provenance", "agentMessage", "crossSessionMessage"];
+export const INBOX_SUMMARY_WITHHELD = "[payload over budget: summary withheld; see payloadTruncated]";
+function encodeInboxBody(summary, body, at) {
+    const full = JSON.stringify(body);
+    const bytes = Buffer.byteLength(full, "utf8");
+    const out = bytes <= INBOX_PAYLOAD_MAX_BYTES ? { summary, payload: full } : trimToBudget(summary, body, bytes, at);
+    return { summary: out.summary, payload: out.payload };
+}
+function trimToBudget(summary, body, bytes, at) {
+    const present = Object.entries(body).filter(([, v]) => v !== undefined);
+    const attributed = present.some(([k]) => ATTRIBUTION_MEMBERS.includes(k));
+    const minimal = (keepProvenance) => {
+        const kept = {};
+        const droppedKeys = [];
+        for (const [k, v] of present) {
+            if (Object.hasOwn(STREAM_KEY_FIELDS, k) || (keepProvenance && k === "_sema_provenance"))
+                kept[k] = v;
+            else
+                droppedKeys.push(k);
+        }
+        const withhold = attributed && !Object.hasOwn(kept, "_sema_provenance");
+        if (withhold)
+            droppedKeys.push("summary");
+        const payloadTruncated = { droppedKeys, bytes };
+        return { summary: withhold ? INBOX_SUMMARY_WITHHELD : summary, payload: JSON.stringify({ ...kept, payloadTruncated }), droppedKeys };
+    };
+    const withProvenance = minimal(true);
+    const out = Buffer.byteLength(withProvenance.payload, "utf8") <= INBOX_PAYLOAD_MAX_BYTES ? withProvenance : minimal(false);
+    recordFailOpen("server.workflow-completion-inbox.payload-over-budget", `sessionId=${at.sessionId} key=${at.key} bytes=${String(bytes)} budget=${String(INBOX_PAYLOAD_MAX_BYTES)} dropped=${out.droppedKeys.join(",")}`);
+    return out;
+}
+function readPayloadTruncated(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const { droppedKeys, bytes } = v;
+    return Array.isArray(droppedKeys) && droppedKeys.every((k) => typeof k === "string") && Number.isSafeInteger(bytes) && bytes >= 0
+        ? { droppedKeys: droppedKeys, bytes: bytes }
+        : undefined;
+}
+function encodeWorkflowCompleteExtras(summary, extras, at) {
     const body = {
         ...(extras.completionId ? { completionId: extras.completionId } : {}),
         ...(extras.diagnostics ? { diagnostics: extras.diagnostics } : {}),
     };
-    return Object.keys(body).length > 0 ? { payload: JSON.stringify(body) } : {};
+    return Object.keys(body).length > 0 ? encodeInboxBody(summary, body, at) : { summary };
 }
 function workflowCompleteFrameExtras(payload) {
-    const { completionId, diagnostics } = readEntryExtras(payload);
+    const { completionId, diagnostics, payloadTruncated } = readEntryExtras(payload);
+    const truncated = readPayloadTruncated(payloadTruncated);
     return {
         ...(typeof completionId === "string" && completionId !== "" ? { completionId } : {}),
         ...(typeof diagnostics === "string" && diagnostics !== "" ? { diagnostics } : {}),
+        ...(truncated !== undefined ? { payloadTruncated: truncated } : {}),
     };
 }
 export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
@@ -294,9 +315,8 @@ export function buildWorkflowCompleteInboxEntry(route, p, enqueuedAt) {
         owner: route.owner,
         runId: p.runId,
         status: p.status,
-        summary: p.summary,
         enqueuedAt,
-        ...encodeWorkflowCompleteExtras({ completionId: p.completionId, diagnostics: p.diagnostics ? seatText("inbox-diagnostics-text", p.diagnostics) : undefined }),
+        ...encodeWorkflowCompleteExtras(p.summary, { completionId: p.completionId, diagnostics: p.diagnostics ? seatText("inbox-diagnostics-text", p.diagnostics) : undefined }, { sessionId: route.sessionId, key: p.runId }),
     };
 }
 export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPrincipal, emit, diag) {
@@ -384,24 +404,22 @@ export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, pare
         ...(n.result ? { result: cap(redactSecrets(n.result), 4000) } : {}),
         ...(n.output_file ? { output_file: cap(redactSecrets(n.output_file), 1024) } : {}),
         ...(n.agentMessage !== undefined ? { agentMessage: { from: n.agentMessage.from, body: cap(redactSecrets(n.agentMessage.body), 4000) } } : {}),
-        ...(() => {
-            if (n._sema_provenance === undefined)
-                return {};
-            const p = semaProvenanceOrAbsent(n._sema_provenance);
-            return p !== undefined ? { _sema_provenance: p } : {};
-        })(),
+        ...semaProvenanceFields(n, "inbox-frame-text"),
         ...terminalFrameFacetFields(n),
         ...resupplyFields(n),
+        ...sessionBoxCarrierFields(n, "inbox-frame-text"),
     };
+    const runId = taskNotificationFoldKey(n);
+    const out = encodeInboxBody(cap(redactSecrets(n.summary ?? ""), 4000), { ...extras, task_id: n.task_id }, { sessionId, key: runId });
     return {
         sessionId,
         owner,
-        runId: taskNotificationFoldKey(n),
+        runId,
         status: n.status === "completed" ? "completed" : "failed",
-        summary: cap(redactSecrets(n.summary ?? ""), 4000),
+        summary: out.summary,
         enqueuedAt,
         kind: "task_notification",
-        payload: JSON.stringify({ ...extras, task_id: n.task_id }),
+        payload: out.payload,
     };
 }
 export async function resolveCompletionRoute(p, getRun, requirePrincipal) {

package/dist/org-memory-admission.d.ts

@@ -16,12 +16,13 @@
  * (请求来源的 scope 没有调用方 ⇒ 引擎在自己的门上先拒,不问本解析器)—— 本模块按这一判别式分支,不另判一次缺席;
  * 引擎型不可达的那一组合(无调用方 ∧ 请求来源 scope)若仍到了这里 ⇒ 抛,不放行。
  */
-import type { MemoryScopeAdmission } from "@sema-agent/core";
+import { type MemoryScopeAdmission } from "@sema-agent/core";
+import type { Logger } from "./observability/logger.js";
 /**
  * 单机腿:装载 `MEMORY_ORG_DIRECTORY_JSON`(`Record<principal, Record<orgScope, {write?}>>`)。启动期调用,
  * **fail-loud**——任何非法直接 throw 且消息点名坏在哪个键(响亮拒是正确方向:一张半坏的授权表比拒绝
  * 启动更危险)。principal 键复用 {@link assertPrincipalShape}(拒不是名字的串 / 保留哨兵 / 超长租户名,与所有其它
- * principal 入口同一道闸;拒句按键在 JSON 文本里的出现序点名,不回显不是名字的键 —— 对象的枚举序会把整数形的键排到最前,不能拿它编号);scope 键必须是 `org:` 前缀、值必须是仅含可选 `write: boolean` 的 plain object。
+ * principal 入口同一道闸;拒句按键在 JSON 文本里的出现序点名,不回显不是名字的键 —— 对象的枚举序会把整数形的键排到最前,不能拿它编号);scope 键必须过 core 的 org scope 键判官(`isOrgScopeKey`:`org:` 加一段 v2 编码的名;判官只有 core 这一只,本仓不另存文法)、值必须是仅含可选 `write: boolean` 的 plain object。
  */
 export declare function parseOrgDirectoryStatic(json: string): Map<string, Record<string, {
     write?: boolean;
@@ -62,6 +63,8 @@ export interface OrgMemoryDirectoryOptions {
     unavailableBackoffMs: number;
     /** 时间注入(测试用);默认 `Date.now`。 */
     now?: () => number;
+    /** 远程腿一代目录被按坏形拒时的留声口(只用 `warn`;缺席 = 不留声)。 */
+    logger?: Pick<Logger, "warn">;
 }
 type OrgDirectoryUnavailableReason = "fetch_failed" | "section_absent" | "malformed" | "stale_generation";
 /**

package/dist/org-memory-admission.js

@@ -1,7 +1,15 @@
+import { isOrgScopeKey } from "@sema-agent/core";
 import { PrincipalOrgMemoryWire } from "@sema-agent/settings-schema";
+import { echoCallerText } from "./caller-text-echo.js";
 import { assertPrincipalShape } from "./security.js";
+function observe(hook) {
+    try {
+        hook();
+    }
+    catch {
+    }
+}
 const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
-const ORG_SCOPE_RE = /^org:\S+$/;
 function topLevelKeysInTextOrder(json) {
     const keys = [];
     let depth = 0;
@@ -58,8 +66,8 @@ export function parseOrgDirectoryStatic(json) {
         }
         const scopes = {};
         for (const [scope, entryRaw] of Object.entries(scopesRaw)) {
-            if (!ORG_SCOPE_RE.test(scope)) {
-                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] has an invalid org scope key ${JSON.stringify(scope)} (must match /^org:\\S+$/)`);
+            if (!isOrgScopeKey(scope)) {
+                throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}] has an invalid org scope key ${JSON.stringify(scope)} (core's org scope key rule refuses it — spell the org with core's formatOrgScope: "org:" plus the name's percent-encoded segment)`);
             }
             if (!isPlainObject(entryRaw)) {
                 throw new Error(`MEMORY_ORG_DIRECTORY_JSON[${JSON.stringify(principal)}][${JSON.stringify(scope)}] must be an object`);
@@ -78,6 +86,8 @@ export function parseOrgDirectoryStatic(json) {
     }
     return table;
 }
+const REFUSED_GENERATION_KEYS_NAMED = 5;
+const REFUSED_GENERATION_KEY_ECHO_CHARS = 80;
 export function createOrgMemoryDirectory(opts) {
     if ((opts.fetchSection !== undefined) === (opts.staticTable !== undefined)) {
         throw new Error("createOrgMemoryDirectory requires exactly one of fetchSection or staticTable (both given or both missing)");
@@ -117,6 +127,17 @@ export function createOrgMemoryDirectory(opts) {
         if (!parsed.success) {
             return markUnavailable(state, "malformed");
         }
+        const badKeys = Object.keys(parsed.data.scopes).filter((key) => !isOrgScopeKey(key));
+        if (badKeys.length > 0) {
+            const refused = markUnavailable(state, "malformed");
+            observe(() => opts.logger?.warn("org_directory_generation_refused", {
+                gen: parsed.data.gen,
+                badKeyCount: badKeys.length,
+                badKeys: badKeys.slice(0, REFUSED_GENERATION_KEYS_NAMED).map((key) => echoCallerText(key, { maxChars: REFUSED_GENERATION_KEY_ECHO_CHARS })),
+                kept: "this generation is not adopted (the whole generation, not just the keys core refuses); the lookup answers unavailable(malformed) and is retried after the backoff window",
+            }));
+            return refused;
+        }
         if (state.highWaterGen !== undefined && parsed.data.gen < state.highWaterGen) {
             return markUnavailable(state, "stale_generation");
         }
@@ -157,13 +178,7 @@ export class OrgMemoryAdmissionRetryError extends Error {
     }
 }
 export function createMemoryScopeAdmission(directory, opts) {
-    const emit = (outcome, details) => {
-        try {
-            opts.onOutcome?.(outcome, details);
-        }
-        catch {
-        }
-    };
+    const emit = (outcome, details) => observe(() => opts.onOutcome?.(outcome, details));
     return async (input) => {
         const { requested, requestedWriteScope } = input;
         const attributed = (details) => input.principal === undefined ? details : { principal: input.principal, ...details };

package/dist/parked-decide.d.ts

@@ -63,20 +63,16 @@ export type ParkOrigin = {
     park: WorkflowRunParkKey;
 }
 /**
- * **这条决定证不了属于哪一条记录**(core 7.44.0 [ref] 的「没有持有者」两臂;判决属主 = 索引模块的 `routeWorkflowPark`)。
- * `cause`:`unreadable` = 某一条点名这个子会话的记录 `parks[]` 读不出(条目形坏 / 这一位在场却不是列表;缺席 = 没有条目,不在此列)—— 它可能正是持有者;
- * `older_engine` = 点名它的条目没有持有者位(写于不带 `parkedBy` / `generation` 的引擎,升级那一刻还停驻着的存量记录)。
- * 两种都**响亮拒**(409 `decide.workflow_parks_unreadable`,码一个、句子按成因两句),一步都不驱动;出路按成因:`older_engine` = 去续跑 `runId` 那条 run
- * (新引擎准入后走到这张停驻会写下自己的持有者行,之后在这里决就正常);`unreadable` = 修好那条记录(它的指针不随任何后继记录消失,续跑解不开)。
- * 不回落读 `agents[]`(那是被退役的第二种读法)。
- * `readableHolderRunId`(只在 `unreadable` 上可能在场):其余可读记录里持有这张卡的最高代次恰一条 —— 读不出的那条引擎往往恰拒续跑,健康的持有者
+ * **这条决定证不了属于哪一条记录**(core 7.44.0 [ref] 的「没有持有者」一臂;判决属主 = 索引模块的 `routeWorkflowPark`):某一条点名这个子会话的记录
+ * `parks[]` 读不出(条目形坏 / 这一位在场却不是列表;缺席 = 没有条目,不在此列)—— 它可能正是持有者。**响亮拒**(409 `decide.workflow_parks_unreadable`),
+ * 一步都不驱动;出路 = 修好那条记录(`runId`;它的指针不随任何后继记录消失,续跑解不开)。不回落读 `agents[]`(那是被退役的第二种读法)。
+ * `readableHolderRunId`:其余可读记录里持有这张卡的最高代次恰一条 —— 读不出的那条引擎往往恰拒续跑,健康的持有者
  * 就在旁边,拒体多给这一条线索(判决不变,仍是整卡拒;不是解除阻断的出路)。
  */
  | {
     kind: "workflow_parks_unreadable";
     runId: string;
     run: WorkflowRun;
-    cause: "unreadable" | "older_engine";
     readableHolderRunId?: string;
 }
 /**
@@ -216,6 +212,24 @@ export interface ParkedDecideDeps {
     };
     warn?: (event: string, fields: Record<string, unknown>) => void;
 }
+/**
+ * 「本会话放行」落在**记不住的车道**上怎么答(闭集;两扇门之间唯一允许的差 —— 其余两口同读同答,铸点只有续跑腿一只):
+ *  · `refuse` —— `/decide` 体上的 `remember:"session"`:那是一个硬意图键,认领之前 400 点名车道(`decide.workflow_remember_unsupported` /
+ *    `decide.parked_remember_unsupported`),去掉它再决即可,零副作用;
+ *  · `decide_once` —— 应答口命中停驻行的 `allow_session`:那是卡上的一个选项,主内容是「放行」。照常放行这一次、不落豁免、回执
+ *    `rememberApplied:false` —— 与活卡上「记不住的卡点 allow_session」同一答法;不把一次已经成立的批准改成 400(窗到期那一拍的按键今天是成的)。
+ * 记不住的车道 = workflow 车道(它的 200 证不出引擎已提交这次决定)、无会话锚的 bg 停驻行(豁免无处可锚)。
+ */
+export type RememberLaneCannotRecord = "refuse" | "decide_once";
+/**
+ * 停驻车道上的「本会话放行」请求。`anchor` 由车道在认领赢下之后、驱动之前调,只**记下**锚(行的 root/host 会话 id —— 部署侧三个豁免探针
+ * (policy 层 / fs-write 门 / workflow 门)的闭包统一捕获 host 会话键,落子代会话则键永不相交;[ref] 候裁② 的 server 侧修,经两轮行为探针实证);
+ * 豁免**落店**只在续跑腿拿到「这次决定被证明已结清」之后(`resumeCheckpoint` 的唯一铸点),车道从不写店。
+ */
+export interface ParkedRemember {
+    readonly anchor: (rootSessionId: string) => Promise<void>;
+    readonly laneCannotRecord: RememberLaneCannotRecord;
+}
 export interface ParkedDecideRequest {
     token: string;
     scope: string;
@@ -235,13 +249,9 @@ export interface ParkedDecideRequest {
     /** D-1 决断绑定:决断方点名它看到的那一对(必在 —— 续跑腿的判官 `decidedActionOf` 判过才交下来)与决定体的其余两位;
      *  server 绝不重算、绝不从停驻行补,core resume 侧做 fail-closed 等值校验 —— 与 legacy 腿同姿势。 */
     binding: Omit<DecideBinding, "checkpointToken" | "boundCallId" | "boundInputHash"> & DecidedAction;
-    /** body 带了 `remember:"session"` 时路由传入的 grant 执行器([ref] 候裁② 的 server 侧修,经两轮
-     *  行为探针实证):豁免必须锚在**行的 root/host 会话 id**——部署侧三个豁免探针(policy 层/fs-write
-     *  门/workflow 门)的闭包统一捕获 host 会话键且签名不携身份(1.393 seam 亲读:`sourceSessionId` 只在
-     *  onAsk 层的 AskRequest,durable 车道无 onAsk),grant 落子代会话则键永不相交(G-F4 原案);落
-     *  root 会话则宿主键闭包立即命中,复活子代的后续同工具 ask 被短路(探针 v2 实证),语义与同步车道/
-     *  宿主任务的「本会话不再询问」一致(= host 会话树全域)。行无 root 锚(病态形)⇒ claim 前诚实 400。 */
-    grantRemember?: (rootSessionId: string) => Promise<void>;
+    /** 这次决定带着「本会话放行」请求(`/decide` 的 `remember:"session"` / 应答口命中停驻行的 `allow_session`,两口同一只请求;
+     *  铸点 = 续跑腿 `resumeCheckpoint`)时,续跑腿交下来的**锚点记录器** + 记不住时怎么答({@link ParkedRemember})。 */
+    remember?: ParkedRemember;
     /** [ref](core 5.7.0,F6 翻案):AskUserQuestion 的 approve 携操作员答案——原样透传进
      *  `ResumeOutcome.answer`(形状校验在路由层 isQuestionAnswer;header 逐字匹配等语义校验在 core,
      *  server 不预判)。core 拒绝形:同步腿 409 invalid_outcome field:"answer",parked 腿经 drive 失败
@@ -250,9 +260,6 @@ export interface ParkedDecideRequest {
     /** 决定体带的续跑请求重述键(`mcpServers` / `a2aPeers`;路由已过提交腿同一只判官)。两条车道各自决定拿它怎么办:workflow 车道盖在宿主会话的续跑输入上、
      *  并进决定的同一性({@link parkDecisionFingerprint});bg 赎回腿不从存量提交体重建任务规格,盖不上 ⇒ claim 前诚实 400(`decide.parked_restatement_unsupported`)。 */
     restatement?: ResumeRestatement;
-    /** claim CAS 赢了(≈ legacy 腿的 markResuming 赢)之后、execute 之前触发——remember 豁免 grant
-     *  的挂点(调用方自吞错,绝不抛落赎回)。claim 败/判别 miss 恒不触发。 */
-    onDecideCommitted?: () => Promise<void>;
 }
 /**
  * 后台子代赎回腿({@link decideParkedAgent})收的请求 = 两条车道共用的那一份 + 选中这张卡的**门身份片段**。workflow 车道是投递、不收它
@@ -331,7 +338,10 @@ export type WorkflowParkedDecidePlan = {
     ok: true;
     hostSessionId: string;
     runId: string;
-    message: string;
+    message: {
+        text: string;
+        trusted: true;
+    };
     outcome: WorkflowParkOutcome;
 } | {
     ok: false;
@@ -339,19 +349,16 @@ export type WorkflowParkedDecidePlan = {
 };
 /**
  * **证不了这条决定属于哪一条记录**的响亮拒(与上面那族拒臂同一种返回形)—— 判决属主 = 索引模块的 `routeWorkflowPark`
- * (「没有持有者」两臂)。码一个(409 `decide.workflow_parks_unreadable`),句子按成因两句,体键 `runId` = 去续跑的那一条;`unreadable` 臂另带顶层
+ * (「没有持有者」一臂:某一条点名这张卡的记录读不出)。码一个(409 `decide.workflow_parks_unreadable`),体键 `runId` = 读不出的那一条;另带顶层
  * `readableHolderRunId`(与 `runId` / `runIds` 同为顶层键)—— **在场才带,缺席整键不在**(没有 / 并列的可读持有者不编一个):读不出的那条引擎往往恰拒续跑,
  * 健康的持有者在旁时指给人看工作可以从哪条记录续上。**只是线索,不是解除阻断的出路**:判决仍是整卡拒(规则 ①),读不出的那条的指针不随任何后继记录消失 ——
  * 续跑可读持有者之后这张卡照旧答本码,直到读不出的那条被修好(拒句如实说了这一点)。
  *
  * 为什么是拒而不是「尽力而为地投递一次」:「这条记录的 run 站在这张停驻上」只有一种读法(`parkedBy === record.id`),读不出来 ⇒
  * 这条决定结构上送不出去,答 200「已交给宿主的下一跑」就是一张兑付不了的回执:卡还 pending、人以为决完了。⇒ 拒,把真话说出来;
- * 卡仍 pending,什么都没有被伪造。不回落读 `agents[]`(那正是被退役的第二种读法)。
- *  · `older_engine`:点名这张卡的条目写于不带持有者位的引擎(升级那一刻还停驻着的存量记录)。续跑这条 run ⇒ 新引擎准入、走到这张
- *    停驻时写下自己的持有者行 ⇒ 之后在这里决就正常;
- *  · `unreadable`:某一条点名这张卡的记录读不出(条目形坏 / 这一份在场却不是列表;记录上**没有**这一份 = 没有条目,不到这里 —— 规则见
- *    `readRunParks`)。续跑**不是**出路:读不出的那条记录的指针不随任何后继记录消失,续跑之后规则 ① 照旧整卡拒(条目形坏的记录引擎本来也拒续跑);
- *    出路 = 运维修好那条记录(`runId`),之后在这里决就正常。
+ * 卡仍 pending,什么都没有被伪造。不回落读 `agents[]`(那正是被退役的第二种读法)。读不出 = 条目形坏 / 这一份在场却不是列表(记录上**没有**这一份 = 没有条目,
+ * 不到这里 —— 规则见 `readRunParks`)。续跑**不是**出路:读不出的那条记录的指针不随任何后继记录消失,续跑之后规则 ① 照旧整卡拒(条目形坏的记录引擎本来也拒续跑);
+ * 出路 = 运维修好那条记录(`runId`),之后在这里决就正常。
  *
  * 🔴 **[ref](词域门)**:句子不提 `checkpointToken`(契约 D-1 逐字:server-INTERNAL、合规 SDK 绝不发送)与内部机件名;判据与冻结钉见
  * `test/api-error-text-lexicon.test.ts` / `test/api-error-text-freeze.test.ts`。

package/dist/parked-decide.js

@@ -43,7 +43,7 @@ export async function findParkOrigin(sources, cp) {
             case "forked":
                 return { kind: "workflow_park_forked", runIds: route.runIds };
             case "unproven":
-                return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, cause: route.cause, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
+                return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
             case "none":
                 return undefined;
             default: {
@@ -110,6 +110,18 @@ export async function findParkedAgentForCheckpoint(agentStore, cp) {
 function grantRootOf(row) {
     return row.rootSessionId ?? row.parentSessionId;
 }
+function refusesWhereUnrecordable(remember) {
+    switch (remember.laneCannotRecord) {
+        case "refuse":
+            return true;
+        case "decide_once":
+            return false;
+        default: {
+            const unhandled = remember.laneCannotRecord;
+            throw new Error(`unhandled remember lane answer: ${String(unhandled)}`);
+        }
+    }
+}
 function mintReviveArgs(row, knownAgentTypes) {
     return {
         prompt: row.description ?? "resume parked agent",
@@ -134,35 +146,17 @@ export function buildParkedResumeOutcome(req) {
     };
 }
 export function denyWorkflowParksUnreadable(origin) {
-    switch (origin.cause) {
-        case "older_engine":
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "decide.workflow_parks_unreadable",
-                    message: "this decision cannot be matched to the pending step it belongs to: the run's record was written by an earlier engine version, which did not record which run is waiting on each pending step — and that record is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resume the run itself instead — `Workflow({resumeFromRunId})` with the runId below — and once the resumed run is waiting on this step again it records itself as the one waiting, after which deciding here works normally. Only if the engine also refuses that resume is the run truly unrecoverable",
-                    facts: {
-                        runId: origin.runId,
-                    },
-                }),
-            };
-        case "unreadable":
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "decide.workflow_parks_unreadable",
-                    message: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
-                    facts: {
-                        runId: origin.runId,
-                        ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
-                    },
-                }),
-            };
-        default: {
-            const unhandled = origin.cause;
-            throw new Error(`unhandled workflow parks-unreadable cause: ${String(unhandled)}`);
-        }
-    }
+    return {
+        status: 409,
+        body: refusalBody({
+            errorCode: "decide.workflow_parks_unreadable",
+            message: "this decision cannot be matched to the pending step it belongs to: this run's record cannot be read (the list of pending steps the run owns is damaged: one of its entries is malformed, or it is not a list at all) — and that list is the only proof that the approval you are deciding belongs to this run. The decision is therefore NOT delivered, rather than answered with a receipt nothing can redeem: the approval card stays pending and nothing is forged. Resuming does not clear this: the damaged record keeps naming this step whatever runs after it, so the decision stays undeliverable until whoever operates this deployment repairs that record (the runId below); after that, deciding here works normally. When the response also carries readableHolderRunId, that run's record is readable and is the latest one waiting on this step — it is where the work can be carried on, but the damaged record above still keeps this decision from being delivered until that record is fixed",
+            facts: {
+                runId: origin.runId,
+                ...(origin.readableHolderRunId !== undefined ? { readableHolderRunId: origin.readableHolderRunId } : {}),
+            },
+        }),
+    };
 }
 export function denyWorkflowParkForked(origin) {
     return {
@@ -177,7 +171,7 @@ export function denyWorkflowParkForked(origin) {
     };
 }
 export function planWorkflowParkedDecide(origin, req) {
-    if (req.grantRemember !== undefined) {
+    if (req.remember !== undefined && refusesWhereUnrecordable(req.remember)) {
         return {
             ok: false,
             deny: {
@@ -214,10 +208,13 @@ export function planWorkflowParkedDecide(origin, req) {
         hostSessionId,
         runId: origin.runId,
         outcome: buildParkedResumeOutcome(req),
-        message: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.park.callKey}") has been ${verdict}. ` +
-            `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
-            `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
-            `agent; completed steps replay from the journal. Do not re-issue the original call.`,
+        message: {
+            text: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.park.callKey}") has been ${verdict}. ` +
+                `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
+                `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
+                `agent; completed steps replay from the journal. Do not re-issue the original call.`,
+            trusted: true,
+        },
     };
 }
 function sessionGone(taskId) {
@@ -256,8 +253,8 @@ async function voidUnrevivableCard(deps, req, match) {
 }
 export async function decideParkedAgent(deps, req, match) {
     const row = match.row;
-    const rememberRoot = req.grantRemember !== undefined ? grantRootOf(row) : undefined;
-    if (req.grantRemember !== undefined && rememberRoot === undefined) {
+    const rememberRoot = req.remember !== undefined ? grantRootOf(row) : undefined;
+    if (req.remember !== undefined && rememberRoot === undefined && refusesWhereUnrecordable(req.remember)) {
         return { status: 400, body: refusalBody({ errorCode: "decide.parked_remember_unsupported", message: "remember cannot be applied: this parked agent row carries no root/parent session anchor for the exemption", facts: { taskId: match.handle } }) };
     }
     if (req.restatement !== undefined) {
@@ -325,14 +322,9 @@ export async function decideParkedAgent(deps, req, match) {
         await rollback("revive_surface_threw");
         throw e;
     }
-    try {
-        await req.onDecideCommitted?.();
-    }
-    catch {
-    }
-    if (req.grantRemember !== undefined && rememberRoot !== undefined) {
+    if (req.remember !== undefined && rememberRoot !== undefined) {
         try {
-            await req.grantRemember(rememberRoot);
+            await req.remember.anchor(rememberRoot);
         }
         catch {
         }

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,4 +1,5 @@
 import { type ExecutionLane } from "../execution-lane-caps.js";
+import { type LocalAskLaneBackfillRefusal } from "./one-time-migrations.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { SettleCause } from "../approval-deny-reasons.js";
 import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
@@ -235,9 +236,16 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     /**
      * 执行放置切换 ④b 的 local 腿(一次性迁移登记表 M32;`LocalBackend.runOneTimeMigrations` 在任何读者之前调):升级前写下的问(日志 `ensureAsk` 记录行 /
      * 压实快照行没有 `executionLane`)记成本部署车道表的唯一项,然后**一次压实**把整本账重写成带车道的快照(压实 = 既有整本原子重写)。
-     * 没有缺车道的行 ⇒ 零写。车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸),一个字节没写。
+     * 只填**缺席**:记下了而不是车道词的问 ⇒ 抛 `unknown_lane`(由调用方铸,点名问与词)—— 拿此刻的车道盖掉它就是替问改了出处。没有缺车道的行 ⇒ 零写。
+     * 车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸)。两种拒都一个字节没写。
      */
-    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (pending: number) => never): number;
+    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (refusal: LocalAskLaneBackfillRefusal) => never): number;
+    /**
+     * 一次性迁移 M40 的 local 问账腿(`LocalBackend.runOneTimeMigrations` 调,排在 M32 的问回填 {@link backfillExecutionLanes} 之前 —— 否则旧词先撞那里的词表外拒):
+     * 出处车道记成退役词的问改记新名,然后**一次压实**重写整本账。没有 ⇒ 零写。返回改了的问数。词的属主 = `execution-lane-rename-m40.ts`。
+     * 压实写不进 ⇒ {@link ExecutionLaneRenameWriteRefusedError}(拒启;内存里已改的行随进程退出作废,盘上账本原样,下次起服重跑)。
+     */
+    renameRetiredExecutionLaneWordM40(): number;
     /** 释放追加 fd(`LocalBackend.close` → 优雅重启重开)。不包 try/catch 的理由同
      *  {@link FileApprovalNonceStore.dispose}:core 的 `AppendLog.close()` 自己就是全函数。 */
     dispose(): void;