@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/approval-ask-store-file.d.ts

@@ -1,4 +1,5 @@
 import { type ExecutionLane } from "../execution-lane-caps.js";
+import { type LocalAskLaneBackfillRefusal } from "./one-time-migrations.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { SettleCause } from "../approval-deny-reasons.js";
 import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
@@ -23,7 +24,7 @@ export declare const ASK_JOURNAL_COMPACT_GROWTH = 2;
  * 账本的**动词闭集**([ref] 形)。运行期的词表判定与编译期的穷尽 `switch` 读同一份:
  * 往这里加一个词,{@link FileApprovalAskStore.replayOp} 的 switch 立刻编译红(漏一口不可能发布)。
  */
-declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteByTask", "reapSettledAsks", "reapEmptyBatches"];
+declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteBySession", "reapSettledAsks", "reapEmptyBatches"];
 type JournalOpWord = (typeof JOURNAL_OPS)[number];
 /** 运行期词表(上面的数组)与类型面动词维({@link JournalCall})的**双向**对表 —— 任一边加词而另一边
  *  没跟上,这个别名解析成 `never`,{@link JOURNAL_OP_TABLE_GATE} 的赋值当场编译红。 */
@@ -94,9 +95,11 @@ type JournalCall = {
     from: AskState;
     to: AskState;
     patch: AskTransitionPatch;
-} | {
-    op: "deleteByTask";
-    taskId: string;
+}
+/** 删会话的审批腿。更老的读者不认这个动词 ⇒ 拒启并点名出路(与留存两动词同一条降级纪律);本版压实成功之后它不在盘上。 */
+ | {
+    op: "deleteBySession";
+    sessionId: string;
 }
 /** 留存律的问账两半(挂靠集落成数组;Set 不是 JSON)。更老的读者不认这两个动词 ⇒ 拒启并点名出路(与 `claimTerminalRefuse` 同一条降级纪律)。 */
  | {
@@ -130,6 +133,8 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     private journalV1Records;
     /** 盘上还有 v1 信封记录(随 M34):重放到 v1 记录时置位,任何一次压实(整本重写成 v2)清位 —— 已被压实过的账本不再为升级重写第二次。 */
     private journalV1OnDisk;
+    /** 本次启动按旧读法重放的退役动词 `deleteByTask` 记录数(随 M50;构造器末段那一行 stderr 的读数)。 */
+    private retiredDeleteByTaskRecordsM50;
     /**
      * 盘上还有删行记录({@link ROW_REMOVAL_OPS}):写下一条 / 重放到一条时置位,任何一次压实(整本重写成快照)清位 —— 与 {@link journalV1OnDisk} 同形。
      * 置位期间压实到期(顶注「压实」段的起因 ②):同一拍压实;压实失败 ⇒ 位留着,下一次写(或下一次起服)再试。
@@ -203,8 +208,13 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     abortBatch(batchId: string): Promise<string[]>;
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
-    /** 删一个 run 名下的全部问行与批行。与两只留存动词同律:内核的纯读选择为空 ⇒ 不落账本、不压实;否则「先落账、再翻内存」并同拍压实(顶注「压实」段起因 ②)。 */
-    deleteByTask(taskId: string): Promise<void>;
+    /**
+     * 删会话的审批腿(谓词在内核,见接口注)。与两只留存动词同律:内核的纯读选择为空 ⇒ 不落账本;否则「先落账、再翻内存」并同拍压实(顶注「压实」段起因 ②)。
+     * 🔴 **完成条件 = 被删行的字节离开账本**(删除面;顶注「边界」段):`write()` 尾段的压实失败按它的律不上抛(那条律管的是「已提交的写不因管家动作报失败」),
+     * 而本动词的成功说的是删除 —— 删行位仍置位(这一次或上一次删行之后的压实没成)⇒ 当场再压一次,失败原样上抛:删会话的协调器据此不删会话行,
+     * 幂等重试走到这里时选择为空、仍补这一次压实,成了才返回。
+     */
+    deleteBySession(sessionId: string): Promise<void>;
     /**
      * 留存律的问行半场(谓词在内核,见接口注)。空的一次(内核的纯读选择为空)不落账本、不碰内存、不压实;否则照常「先落账、再翻内存」,
      * 并在 `write()` 尾段同一拍压实(顶注「压实」段起因 ②)—— 选择非空 ⇒ 内核同步前缀里必删 ≥ 1 行,被删行的字节不留在盘上。
@@ -216,7 +226,7 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
     listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
-    listParkingBySession(sessionId: string): Promise<AskRow[]>;
+    listParkingBySourceSession(sourceSessionId: string): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     getBatch(batchId: string): Promise<BatchRow | null>;
@@ -235,9 +245,18 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
     /**
      * 执行放置切换 ④b 的 local 腿(一次性迁移登记表 M32;`LocalBackend.runOneTimeMigrations` 在任何读者之前调):升级前写下的问(日志 `ensureAsk` 记录行 /
      * 压实快照行没有 `executionLane`)记成本部署车道表的唯一项,然后**一次压实**把整本账重写成带车道的快照(压实 = 既有整本原子重写)。
-     * 没有缺车道的行 ⇒ 零写。车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸),一个字节没写。
+     * 只填**缺席**:记下了而不是车道词的问 ⇒ 抛 `unknown_lane`(由调用方铸,点名问与词)—— 拿此刻的车道盖掉它就是替问改了出处。没有缺车道的行 ⇒ 零写。
+     * 车道表不是一元而还有缺车道的行 ⇒ 抛与 SQL 同一只拒(`backfill_ambiguous`,由调用方铸)。两种拒都一个字节没写。
+     */
+    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (refusal: LocalAskLaneBackfillRefusal) => never): number;
+    /**
+     * 一次性迁移 M40 的 local 问账腿(`LocalBackend.runOneTimeMigrations` 调,排在 M32 的问回填 {@link backfillExecutionLanes} 之前 —— 否则旧词先撞那里的词表外拒):
+     * 出处车道记成退役词的问改记新名,然后**一次压实**重写整本账。没有 ⇒ 零写。返回改了的问数。词的属主 = `execution-lane-rename-m40.ts`。
+     * 压实写不进 ⇒ {@link ExecutionLaneRenameWriteRefusedError}(拒启;内存里已改的行随进程退出作废,盘上账本原样,下次起服重跑)。
      */
-    backfillExecutionLanes(lanes: readonly ExecutionLane[], refuse: (pending: number) => never): number;
+    /** 一次性迁移 **M42 的 local 腿**(场景前缀的切换检查;窗口见 `plugins/one-time-migrations.ts` 登记表):属主以保留前缀开头的问行数(重放后的内存账,零写)。 */
+    scenarioPrefixOwnerRowsM42(): number;
+    renameRetiredExecutionLaneWordM40(): number;
     /** 释放追加 fd(`LocalBackend.close` → 优雅重启重开)。不包 try/catch 的理由同
      *  {@link FileApprovalNonceStore.dispose}:core 的 `AppendLog.close()` 自己就是全函数。 */
     dispose(): void;

package/dist/plugins/approval-ask-store-file.js

@@ -1,5 +1,10 @@
+import { writeLogText } from "../observability/logger.js";
+import { SCENARIO_SUBJECT_PREFIX } from "../owner-brands.js";
 import { closeSync, copyFileSync, openSync, readSync, statSync, existsSync } from "node:fs";
 import { isExecutionLane } from "../execution-lane-caps.js";
+import { RENAMED_EXECUTION_LANE_M40, RETIRED_EXECUTION_LANE_WORD_M40 } from "./execution-lane-rename-m40.js";
+import { ExecutionLaneRenameWriteRefusedError } from "./one-time-migrations.js";
+import { RETIRED_DELETE_BY_TASK_OP_M50, retiredDeleteByTaskClosedWhyM50, retiredDeleteByTaskReplayOpenM50 } from "./approval-ask-retired-delete-by-task-m50.js";
 import { join } from "node:path";
 import { AppendLog, atomicWriteFile, ensureDir } from "@sema-agent/core";
 import { replayJsonlSkipping } from "../observability/corrupt-read-seat.js";
@@ -22,13 +27,13 @@ const JOURNAL_OPS = [
     "abortBatch",
     "deferReconcile",
     "resolveProvisional",
-    "deleteByTask",
+    "deleteBySession",
     "reapSettledAsks",
     "reapEmptyBatches",
 ];
 const JOURNAL_OP_WORDS = new Set(JOURNAL_OPS);
 export const JOURNAL_OP_TABLE_GATE = true;
-const ROW_REMOVAL_OPS = new Set(["reapSettledAsks", "reapEmptyBatches", "deleteByTask"]);
+const ROW_REMOVAL_OPS = new Set(["reapSettledAsks", "reapEmptyBatches", "deleteBySession"]);
 const JOURNAL_V1_CLAIM_INTENTS = ["expire", "cancel"];
 const JOURNAL_V1_CLAIM_INTENT_WORDS = new Set(JOURNAL_V1_CLAIM_INTENTS);
 const JOURNAL_ENVELOPE = 2;
@@ -95,6 +100,7 @@ export class FileApprovalAskStore {
     corruptLineCount = 0;
     journalV1Records = 0;
     journalV1OnDisk = false;
+    retiredDeleteByTaskRecordsM50 = 0;
     removalRecordsOnDisk = false;
     corruptQuarantinePath;
     constructor(root) {
@@ -112,16 +118,28 @@ export class FileApprovalAskStore {
         this.records = records.length;
         if (tornTail || this.corruptLineCount > 0) {
             const quarantine = `${this.path}.corrupt-${Date.now()}`;
-            copyFileSync(this.path, quarantine);
+            try {
+                copyFileSync(this.path, quarantine);
+                this.compact();
+            }
+            catch (e) {
+                throw new StoreBootRefusalError(`FileApprovalAskStore: approval ask journal ${this.path} has ${tornTail ? "a torn tail" : "no torn tail"} and ${this.corruptLineCount} unparseable line(s) ` +
+                    `and its recovery rewrite could not land on disk (${e?.code ?? (e instanceof Error ? e.message : String(e))}) — the journal is unchanged. ` +
+                    "Refusing to start rather than run without the approvals it holds: restore write access to the journal, its directory and that directory's .tmp " +
+                    "(clear an immutable flag, remount read-write, free disk space), then restart.", { cause: e });
+            }
             this.corruptQuarantinePath = quarantine;
-            console.warn(`FileApprovalAskStore: approval ask journal ${this.path} had ${tornTail ? "a torn tail" : "no torn tail"} and ` +
+            writeLogText("stderr", `FileApprovalAskStore: approval ask journal ${this.path} had ${tornTail ? "a torn tail" : "no torn tail"} and ` +
                 `${this.corruptLineCount} unparseable line(s) — replayed every COMPLETE record, quarantined the original at ${quarantine}, ` +
                 `and rewrote the live journal from the replayed state. A dropped record is a LOST approval-ask transition: inspect the quarantined file.`);
-            this.compact();
         }
         else if (this.removalRecordsOnDisk) {
             this.compactOrRecord();
         }
+        if (this.retiredDeleteByTaskRecordsM50 > 0) {
+            writeLogText("stderr", `FileApprovalAskStore: replayed ${this.retiredDeleteByTaskRecordsM50} retired deleteByTask record(s) from ${this.path} under one-time migration M50 ` +
+                "(each deletes the asks and batches of its run, as the build that wrote it did); the startup compaction rewrites them out of the journal.");
+        }
     }
     clockRead() {
         const pinned = this.pinnedNow;
@@ -216,8 +234,19 @@ export class FileApprovalAskStore {
         }
         if (probe.k !== "op")
             refuse("unknown record kind");
+        if (probe.op === RETIRED_DELETE_BY_TASK_OP_M50) {
+            if (!retiredDeleteByTaskReplayOpenM50(new Date().toISOString().slice(0, 10)))
+                refuse(retiredDeleteByTaskClosedWhyM50());
+            const taskId = raw.taskId;
+            if (typeof taskId !== "string" || taskId.length === 0)
+                refuse("deleteByTask record without a taskId");
+            this.removalRecordsOnDisk = true;
+            this.retiredDeleteByTaskRecordsM50 += 1;
+            this.core.deleteByTaskM50(taskId);
+            return;
+        }
         if (typeof probe.op !== "string" || !JOURNAL_OP_WORDS.has(probe.op))
-            refuse("verb outside this build's closed set (a DOWNGRADE: a newer server wrote it)");
+            refuse("verb outside this build's closed set (written by a build with a different verb set — a newer server, or an earlier one using a verb this build retired)");
         if (typeof probe.op === "string" && ROW_REMOVAL_OPS.has(probe.op))
             this.removalRecordsOnDisk = true;
         if (typeof probe.t !== "number" || !Number.isFinite(probe.t))
@@ -234,7 +263,7 @@ export class FileApprovalAskStore {
         try {
             void this.replayOp(rec).catch((e) => {
                 this.replayRejectedCount += 1;
-                console.warn(`FileApprovalAskStore: replaying ${rec.op} from ${this.path} was REFUSED by the store's own rules ` +
+                writeLogText("stderr", `FileApprovalAskStore: replaying ${rec.op} from ${this.path} was REFUSED by the store's own rules ` +
                     `(${e instanceof Error ? e.message : String(e)}). The live call was refused the same way and changed nothing, ` +
                     "so the state is faithful — but a record nobody can apply should not be on disk; inspect the journal.");
             });
@@ -265,8 +294,8 @@ export class FileApprovalAskStore {
                 return this.core.deferReconcile(rec.askId, rec.expectedState, rec.expectedRev, rec.nowMs);
             case "resolveProvisional":
                 return this.core.resolveProvisional(rec.askId, rec.from, rec.to, rec.patch);
-            case "deleteByTask":
-                return this.core.deleteByTask(rec.taskId);
+            case "deleteBySession":
+                return this.core.deleteBySession(rec.sessionId);
             case "reapSettledAsks":
                 return this.core.reapSettledAsks(rec.cutoffMs, rec.limit, new Set(rec.keepAnchors));
             case "reapEmptyBatches":
@@ -317,11 +346,12 @@ export class FileApprovalAskStore {
     async resolveProvisional(askId, from, to, patch) {
         return this.write({ op: "resolveProvisional", askId, from, to, patch }, (c) => this.core.resolveProvisional(c.askId, c.from, c.to, c.patch));
     }
-    async deleteByTask(taskId) {
-        const plan = this.core.planDeleteByTask(taskId);
-        if (plan.askIds.length === 0 && plan.batchIds.length === 0)
-            return;
-        return this.write({ op: "deleteByTask", taskId }, (c) => this.core.deleteByTask(c.taskId));
+    async deleteBySession(sessionId) {
+        const plan = this.core.planDeleteBySession(sessionId);
+        if (plan.askIds.length > 0 || plan.batchIds.length > 0)
+            await this.write({ op: "deleteBySession", sessionId }, (c) => this.core.deleteBySession(c.sessionId));
+        if (this.removalRecordsOnDisk)
+            this.compact();
     }
     async reapSettledAsks(cutoffMs, limit, keepAnchors) {
         if (this.core.planReapSettledAsks(cutoffMs, limit, keepAnchors).length === 0)
@@ -345,8 +375,8 @@ export class FileApprovalAskStore {
     listByCall(call) {
         return this.core.listByCall(call);
     }
-    listParkingBySession(sessionId) {
-        return this.core.listParkingBySession(sessionId);
+    listParkingBySourceSession(sourceSessionId) {
+        return this.core.listParkingBySourceSession(sourceSessionId);
     }
     getAsk(askId) {
         return this.core.getAsk(askId);
@@ -370,15 +400,41 @@ export class FileApprovalAskStore {
         return upgraded;
     }
     backfillExecutionLanes(lanes, refuse) {
-        const pending = this.core.exportRows().asks.filter((r) => !isExecutionLane(String(r.executionLane ?? ""))).length;
+        const asks = this.core.exportRows().asks;
+        const unknown = [];
+        let pending = 0;
+        for (const r of asks) {
+            const recorded = r.executionLane;
+            if (recorded === undefined)
+                pending += 1;
+            else if (typeof recorded !== "string" || !isExecutionLane(recorded))
+                unknown.push({ askId: r.askId, word: String(recorded) });
+        }
+        if (unknown.length > 0)
+            refuse({ kind: "unknown_lane", asks: unknown });
         if (pending === 0)
             return 0;
         if (lanes.length !== 1)
-            refuse(pending);
+            refuse({ kind: "backfill_ambiguous", pending });
         const filled = this.core.fillMissingExecutionLanes(lanes[0]);
         this.compact();
         return filled;
     }
+    scenarioPrefixOwnerRowsM42() {
+        return this.core.ownerRowsWithPrefix(SCENARIO_SUBJECT_PREFIX);
+    }
+    renameRetiredExecutionLaneWordM40() {
+        const renamed = this.core.renameExecutionLaneWord(RETIRED_EXECUTION_LANE_WORD_M40, RENAMED_EXECUTION_LANE_M40);
+        if (renamed === 0)
+            return 0;
+        try {
+            this.compact();
+        }
+        catch (e) {
+            throw new ExecutionLaneRenameWriteRefusedError(this.path, e);
+        }
+        return renamed;
+    }
     dispose() {
         this.log?.close();
         this.log = undefined;

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -30,7 +30,7 @@
  *  - resolveProvisional 故意不经 canAskTransition(同 SQL twin 头注：这是版本化补偿的例外通道）。
  */
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
-import { type ExecutionLane } from "../execution-lane-caps.js";
+import type { ExecutionLane } from "../execution-lane-caps.js";
 import type { AskCallCoordinate, AskDecision, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, EnsureAskResult, DecideResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
 /**
  * [ref] 的 `updatedInput` **入店编码**——两 twin 共用的那一只(本函数是唯一真源)。
@@ -75,10 +75,19 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
      */
     exportRows(): ApprovalAskRowsSnapshot;
     /**
-     * 执行放置切换 ④b 的 local 腿(File 形的内核口;`FileApprovalAskStore.backfillExecutionLanes` 调):出处车道还没记下的行(升级前写下的日志 / 快照行
-     * 装回后这一格缺席)记成 `lane`(一元车道表的唯一项 —— 调用方判过)。返回改了的行数;只碰缺这一格的行。
+     * 执行放置切换 ④b 的 local 腿(File 形的内核口;`FileApprovalAskStore.backfillExecutionLanes` 调):出处车道**缺席**的行(升级前写下的日志 / 快照行
+     * 装回后这一格不在)记成 `lane`(一元车道表的唯一项 —— 调用方判过)。返回改了的行数;只碰这一格缺席的行 —— 记下了而不是车道词的行不在这里改(调用方先拒)。
      */
     fillMissingExecutionLanes(lane: ExecutionLane): number;
+    /** 一次性迁移 M42 的 local 问账腿(File 形的内核口;`FileApprovalAskStore.scenarioPrefixOwnerRowsM42` 调):属主以 `prefix` 开头的问行数。纯读。 */
+    ownerRowsWithPrefix(prefix: string): number;
+    /** 一次性迁移 M40 的 local 问账腿(File 形的内核口;`FileApprovalAskStore.renameRetiredExecutionLaneWordM40` 调):出处车道记成 `from` 的行改记 `to`。返回改了的行数。 */
+    renameExecutionLaneWord(from: string, to: ExecutionLane): number;
+    /**
+     * 一次性迁移 M50 的 local 问账腿(File 形的内核口;`FileApprovalAskStore` 重放到退役动词 `deleteByTask` 的记录时调;窗口见 `plugins/one-time-migrations.ts` 登记表):
+     * 按写下那条记录的版本的读法重放 —— 删 `taskId` 名下的问(`taskId` 相等)与批(`taskId` 相等)。不是店接口的一口(那只动词已退役);随 M50 删。
+     */
+    deleteByTaskM50(taskId: string): void;
     /** [ref]:一行的**同步**点读(拷贝;纯读,零判定)—— File 形在写口的同步前缀里用它(见类顶注)。 */
     peekAsk(askId: string): AskRow | null;
     /** [ref]:把快照里的行**原样**装回两张 Map(同键覆盖)。零谓词、零状态机 —— 它不是一条转移,是重放
@@ -114,13 +123,14 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
     listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
-    listParkingBySession(sessionId: string): Promise<AskRow[]>;
+    listParkingBySourceSession(sourceSessionId: string): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
-    deleteByTask(taskId: string): Promise<void>;
-    /** {@link deleteByTask} 会删哪些行(纯读,零写;选择与删除共用这一只,没有第二份谓词)。 */
-    planDeleteByTask(taskId: string): {
+    /** 删会话的审批腿(语义见接口注;谓词 = {@link askAttachedToSession},与 SQL 两方言的语句同读)。方法体全同步(零 `await`)⇒ File 形重放逐字复现。 */
+    deleteBySession(sessionId: string): Promise<void>;
+    /** {@link deleteBySession} 会删哪些行(纯读,零写;选择与删除共用这一只,没有第二份谓词):挂靠该会话的问,与它们所在的批(还在的那些)。 */
+    planDeleteBySession(sessionId: string): {
         readonly askIds: readonly string[];
         readonly batchIds: readonly string[];
     };

package/dist/plugins/approval-ask-store-memory.js

@@ -1,7 +1,6 @@
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
-import { isExecutionLane } from "../execution-lane-caps.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
-import { askRowCarriesOwner, askRowOnCall, assertDecideSource, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
+import { askAttachedToSession, askRowCarriesOwner, askRowOnCall, assertDecideSource, assertIdempotencyKeyShape, assertIntegralEpochMs, assertReapBounds, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth, projectDecideReading } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -45,13 +44,38 @@ export class InMemoryApprovalAskStore {
     fillMissingExecutionLanes(lane) {
         let filled = 0;
         for (const [askId, row] of this.asks) {
-            if (isExecutionLane(String(row.executionLane ?? "")))
+            if (row.executionLane !== undefined)
                 continue;
             this.asks.set(askId, { ...row, executionLane: lane });
             filled += 1;
         }
         return filled;
     }
+    ownerRowsWithPrefix(prefix) {
+        let n = 0;
+        for (const row of this.asks.values())
+            if (row.owner !== null && row.owner.startsWith(prefix))
+                n += 1;
+        return n;
+    }
+    renameExecutionLaneWord(from, to) {
+        let renamed = 0;
+        for (const [askId, row] of this.asks) {
+            if (row.executionLane !== from)
+                continue;
+            this.asks.set(askId, { ...row, executionLane: to });
+            renamed += 1;
+        }
+        return renamed;
+    }
+    deleteByTaskM50(taskId) {
+        for (const [askId, row] of this.asks)
+            if (row.taskId === taskId)
+                this.asks.delete(askId);
+        for (const [batchId, batch] of this.batches)
+            if (batch.taskId === taskId)
+                this.batches.delete(batchId);
+    }
     peekAsk(askId) {
         const row = this.asks.get(askId);
         return row ? { ...row } : null;
@@ -335,9 +359,9 @@ export class InMemoryApprovalAskStore {
             .sort((a, b) => a.createdAtMs - b.createdAtMs || (a.askId < b.askId ? -1 : a.askId > b.askId ? 1 : 0))
             .map((r) => ({ ...r }));
     }
-    async listParkingBySession(sessionId) {
+    async listParkingBySourceSession(sourceSessionId) {
         return [...this.asks.values()]
-            .filter((r) => r.sessionId === sessionId && r.state === "PARKING")
+            .filter((r) => r.sourceSessionId === sourceSessionId && r.state === "PARKING")
             .sort((a, b) => a.createdAtMs - b.createdAtMs || (a.askId < b.askId ? -1 : a.askId > b.askId ? 1 : 0))
             .map((r) => ({ ...r }));
     }
@@ -364,18 +388,17 @@ export class InMemoryApprovalAskStore {
         row.updatedAtMs = patch.updatedAtMs;
         return true;
     }
-    async deleteByTask(taskId) {
-        const plan = this.planDeleteByTask(taskId);
+    async deleteBySession(sessionId) {
+        const plan = this.planDeleteBySession(sessionId);
         for (const id of plan.askIds)
             this.asks.delete(id);
         for (const id of plan.batchIds)
             this.batches.delete(id);
     }
-    planDeleteByTask(taskId) {
-        return {
-            askIds: [...this.asks.values()].filter((r) => r.taskId === taskId).map((r) => r.askId),
-            batchIds: [...this.batches.values()].filter((b) => b.taskId === taskId).map((b) => b.batchId),
-        };
+    planDeleteBySession(sessionId) {
+        const asks = [...this.asks.values()].filter((r) => askAttachedToSession(r, sessionId));
+        const batchIds = [...new Set(asks.map((r) => r.batchId))].filter((id) => this.batches.has(id));
+        return { askIds: asks.map((r) => r.askId), batchIds };
     }
     async getBatch(batchId) {
         const b = this.batches.get(batchId);

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -39,7 +39,7 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import type { PgQueryFn } from "./pg-query.js";
-import { type SqlDriver, type SqlDialect } from "./sql-driver.js";
+import { type SqlDriver, type SqlDialect, type SqlExec } from "./sql-driver.js";
 import { type AskState, type BatchState } from "../approval-ask-machine.js";
 import type { HostSettledBy } from "../host-decision.js";
 import { type DecidedVia } from "@sema-agent/core";
@@ -406,6 +406,9 @@ export type AskTerminalClaimCurrent = {
     settledBy: HostSettledBy | null;
     /** core 7.61.0([ref]):赢家决议的机器座位(语义见 {@link AskRow.decidedVia});必填,理由与 `settledBy` 同。 */
     decidedVia: DecidedVia | null;
+    /** 赢家决议的人写说明(`decision_note` 列,与决议同一条 UPDATE 落;`null` = 没说明);**必填**(可空),理由与 `settledBy` 同:可选会让投影漏挑这一列时静默编译过,
+     *  而漏挑的后果恰是 CAS 输家把赢家带说明的拒读成「一个人拒了、没说怎么办」(读回铸点 `outcomeOfDecidedRow` 把拒行上的非空说明铸成交给模型的 `reason`)。 */
+    decisionNote: string | null;
     /** 行上记着的终态成因(`ending_cause` 列,经唯一读口 `askRowEndingCause` 读出)。**只在读得出时在场**(没写 / 与 state 不配 ⇒ 缺席;DECIDED 的败方读数逐字不变)。
      *  CAS 输家据它按**行上那个成因**结算(而不是把别人撤的卡读成一次拒绝);投影的唯一函数是 {@link projectAskTerminalClaimTruth},三 twin 不各自挑列,原始列值不出店层。 */
     endingCause?: AskRowEndingCause;
@@ -469,19 +472,11 @@ export interface BatchRow {
 export type AskCallCoordinate = Pick<AskRow, "taskId" | "legKey" | "toolCallId" | "sourceSessionId">;
 /** 「这一行在这次调用上」的唯一判据(四列逐字相等):InMemory twin 的筛子与 SQL twin 的出口对齐读同一只。 */
 export declare function askRowOnCall(row: AskRow, call: AskCallCoordinate): boolean;
-/**
- * 🔴 [ref] —— **一只问的属主判据**(全仓唯一;两扇决议口 —— live 应答口 `POST /v1/tool-approvals/:id/respond`、耐久决断口
- * `POST /v1/tasks/:taskId/asks/:askId/decision` —— 与按问读口都调它):调用方是不是这只问的属主。`owner` 只有一条来源律:有行的问读行上
- * **当下的** `owner` 列(铸行写定,只有 `/v1/adoption` 改写它;进程内任何快照 —— 包括登记在铸卡那一刻记下的那一格 —— 都改不动);
- * 没有行的问(问账没上场 / 旧族腿)只有登记记下的那一位可读。`null` = auth-off 单用户行,恒过。
- * 门判过的那位属主再交给决议 CAS 的作用域({@link askRowCarriesOwner},[ref])。耐久决断口的 operator 越域臂不在这里 —— 那是那扇口自己的授权门。
- */
-export declare function askOwnerAdmits(owner: string | null, principal: string | undefined): boolean;
 /**
  * 🔴 [ref] —— **决议作用域的属主维**:这一行此刻带着的属主,是不是这次决议的门判过的那一位(逐字相等;`null` 只等于 `null`)。
  *
  * 律(一条):一次决议请求的作用域 = (ask, 批, **门判过的那位属主**)。属主的唯一来源是行上的 `owner` 列(铸行写定,只有 `/v1/adoption` 改写它);
- * 门(耐久回决口 `owner ∨ operator`、live 应答口 `owner`)照旧在门里判授权,本谓词**不复判授权**,只绑「门判的那一份属主事实」——
+ * 门(面表 `owner-faces.ts` 的 ask 两行:耐久回决口 `ask.decide` 属主 ∨ 无主 ∨ 运维、live 应答口 `ask.answer` 属主 ∨ 无主)照旧在门里判授权,本谓词**不复判授权**,只绑「门判的那一份属主事实」——
  * 门读行与 CAS 之间属主被改写,门的判断就不再是关于这一行的判断。于是这次请求拿到的**每一份**行读数(CAS 本身、CAS 输者的读数、
  * 提交歧义的确认读、幂等回放的命中)都过这一只:出域 = 缺席,门按缺席答(与行不在同体同码)。
  * InMemory twin 的判定、SQL twin 输者读数的投影、两扇门的确认读读同一只;SQL twin 的 UPDATE 谓词是它的方言镜像({@link decideOwnerWhere})。
@@ -489,6 +484,24 @@ export declare function askOwnerAdmits(owner: string | null, principal: string |
 export declare function askRowCarriesOwner(row: AskRow | null, owner: string | null): row is AskRow;
 /** [ref]:决议输者读数的投影(三 twin 共用一份):行出了这次决议的属主域 ⇒ 读作缺席,不交出别人的行。 */
 export declare function projectDecideReading(row: AskRow | null, owner: string | null): AskRow | null;
+/**
+ * 🔴 **问行挂靠会话 S 吗** —— 删一只会话时审批账本带走哪些行的唯一谓词(内存 / File 两形读本函数;SQL 两方言读它的镜像 {@link deleteSessionApprovalRows})。
+ *
+ * 律:一只问挂靠 S ⇔ 它的两只会话格之一 —— 宿主会话(`sessionId`,列 `session_id`)/ 发问那条腿的会话(`sourceSessionId`,列 `source_task_id`)—— 等于 S,
+ * 且那一格不是 **run 替身**。铸点(`tool-approval.ts` 的 `ensureAsk`)在出处没有会话时(adhoc 腿)把自己的 run id 折进两只会话格;那样的行挂靠的是 run,
+ * 不是任何会话 —— 会话 id 由调用方自选,恰取某条 adhoc run 的 id 再删,不得带走那条 run 的问。真会话的行 `taskId`(server 新铸的 run id)恒 ≠ 调用方事先选定的会话 id,
+ * 所以「`taskId ≠ S`」只排除替身,不排除任何真挂靠。两格都算:子代(后台 / 委派)发的问记在宿主 run 与宿主会话名下、发问格是子代自己的会话 ——
+ * 只按宿主格删,子代会话被删时它发的问(带工具实参字面的卡)就留在宿主名下。批随它的问走(见 {@link ApprovalAskStore.deleteBySession})。
+ */
+export declare function askAttachedToSession(row: Pick<AskRow, "taskId" | "sessionId" | "sourceSessionId">, sessionId: string): boolean;
+/**
+ * {@link askAttachedToSession} 的 SQL 镜像 —— 两条删除执行体(在线协调器经店的 {@link ApprovalAskStore.deleteBySession};托管留存在会话树事务里经部署钩
+ * `retention-deployment.ts` 的 `deleteDeploymentSessionRows`)发的是**同一组语句**,只有执行它的连接不同。每格两句:先批(`batch_id` 取自同一谓词选中的问 ——
+ * 子查询要读问,所以先于删问)、后问;谓词 `<格> ∈ ids ∧ <格> <> task_id`(行内比较,对一批 id 与单个 id 同读)。索引:宿主格走 `idx_ask_session_state` 的前缀,
+ * 发问格走 `idx_ask_source_session`。会话 id 在入口只收规范 uuid、发问格是引擎铸的会话 id 原值 ⇒ MySQL 协议 VARCHAR 等值的 PAD SPACE 近撞构造不出,不另做出口逐字再滤。
+ * 空集 ⇒ 零语句。
+ */
+export declare function deleteSessionApprovalRows(exec: SqlExec, dialect: SqlDialect, ids: readonly string[]): Promise<void>;
 export interface ApprovalAskStore {
     /** 幂等 upsert。返回**行 + 本次是否真插入**(判别位语义见 {@link EnsureAskResult})。 */
     ensureAsk(row: NewAskRow): Promise<EnsureAskResult>;
@@ -563,23 +576,31 @@ export interface ApprovalAskStore {
      */
     listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
     /**
-     * 一个会话里**仍在 `PARKING`** 的全部行(序 = `created_at_ms ASC, ask_id ASC`,确定性)。
+     * 发起会话(`sourceSessionId`,列 `source_task_id`)是给定会话、**仍在 `PARKING`** 的全部行(序 = `created_at_ms ASC, ask_id ASC`,确定性)。
      *
      * 唯一消费者 = 对账收敛器的 park 提交那一拍(`approval-reconciler.ts` 的 `bindCommittedPark`):一只审批停车行提交了,收敛器要对**这次调用**
      * 的 PARKING 行即时跑判据 1。停车行只陈述会话与调用 id(没有 taskId / legKey ⇒ `listByCall` 用不上);`listByState` 带 LIMIT 且按队列序,
-     * 新行排在队尾会被截掉。按会话读是**判据 1 能命中的行的超集**:判据 1 的候选读口按 `ask.sessionId` 查停车行,命中要求停车行的会话就是这一列。
+     * 新行排在队尾会被截掉。停车行陈述的会话 = 铸它的那条腿的会话 = 同一次调用的问的发起会话(core 同一只变量;委派 / 后台子代 = 子代自己的会话,
+     * 行上的 `sessionId` 记的是投递上下文)⇒ 按发起会话读是**判据 1 能命中的行的超集**:判据 1 的候选读口按同一格查停车行。
      *
-     * 不带租户门(内部读口,不上 wire):租户门在判据 1 的候选读口上(scope = 行的 owner)。索引走既有 `idx_ask_session_state (session_id, state)`。
-     * 三 twin 同答:SQL twin 读后按会话逐字再滤一遍(MySQL 协议 VARCHAR 等值的 PAD SPACE,与 `listByCall` 同一条出口对齐)。
+     * 不带租户门(内部读口,不上 wire):租户门在判据 1 的候选读口上(scope = 行的 owner)。索引走既有 `idx_ask_state (state)`(`PARKING` 是转移窗里的态,
+     * 行数随在途停驻,不随账本总量)。三 twin 同答:SQL twin 读后按发起会话逐字再滤一遍(MySQL 协议 VARCHAR 等值的 PAD SPACE,与 `listByCall` 同一条出口对齐)。
      */
-    listParkingBySession(sessionId: string): Promise<AskRow[]>;
+    listParkingBySourceSession(sourceSessionId: string): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     /** 回决幂等回放的读口。🔴 `taskId` **必填**且是键的第一维——UNIQUE 已改 `(task_id, idempotency_key)`
      *  (车4 §12-E),裸按 key 全局查在多租户库上既可能回**别人 task** 的行(存在性外泄),也可能在同 key
      *  合法共存于两 task 时任选一行返回(不确定)。租户门是读口自己的责任,同 `listPendingBySession`。 */
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
-    deleteByTask(taskId: string): Promise<void>;
+    /**
+     * **删一只会话时审批账本那一腿**(删净执行体两形同读:local 执行体 `session-erase.ts` 调本方法;SQL 上在线删除与托管留存同一段会话树事务发同一组 SQL,见
+     * {@link deleteSessionApprovalRows})。删掉挂靠该会话的全部问行({@link askAttachedToSession})与这些问所在的批 —— 一只批里的问共享同一 (发问会话, run)
+     * (`approval-ask-machine.ts` 的批 id 派生;铸点不变式,店不强制),整批同挂靠。**不碰**已经没有问的空批:批只带 `task_id`、不带会话格,归属不了任何会话,
+     * 归留存律的 {@link reapEmptyBatches} 按龄收。任意状态都删(删会话的协调器已先过活跑门并结束子代;留存腿的候选按定义没有活引用)。
+     * 幂等;删不到东西是零动作。File 形另有一条完成条件:被删行的字节离开账本才返回(见该形)。
+     */
+    deleteBySession(sessionId: string): Promise<void>;
     /**
      * **审批账本留存律的问账半场之一:问行**(律、节律与「还能动的 run」一处成文在 `approval-ask-retention.ts`;维护 tick 是唯一调用方)。
      * 删至多 `limit` 只**结了**的问行 —— `state ∈ ASK_TERMINAL` ∧ `provisional = false`(provisional 行还能被 {@link resolveProvisional} 改判,没结)
@@ -648,8 +669,8 @@ export declare const APPROVAL_BATCH_TABLE = "approval_batch";
  *     `task_run.task_id VARCHAR(64)` 同宽(此前 255 是本家族独有的偏离,无依据)。
  *   · `session_id` → 64:提交入口只收 canonical uuid(36 字符;7.125.x 及更早硬拒 >64),列宽仍容存量,
  *     与 `session_meta`/`task_run` 同宽。
- *   · `owner` → 190:`assertPrincipalShape` 的 `PRINCIPAL_MAX_LENGTH = 190`(`security.ts` 的同名导出常量,
- *     刻意不钉行号 —— 旧注写的 `security.ts:350` 已随该文件编辑漂走)硬拒更长者;
+ *   · `owner` → 190:`assertPrincipalShape` 按 `PRINCIPAL_MAX_BYTES = 190`(UTF-8 字节;`principal-shape.ts` 的同名导出常量,
+ *     刻意不钉行号 —— 旧注写的 `security.ts:350` 已随该文件编辑漂走)硬拒更长者(190 字节的串至多 190 字符);
  *     全仓每一根 owner/scope 轴都是 190,此前 255 同样是无依据偏离。
  *   · `gate_token` → 120:它抄的是 checkpoint 的 token(core `mintCheckpointToken` = 16 字节 hex = 32 字符),
  *     取与**被抄那一列** `checkpoint.token VARCHAR(120)` 同宽 —— 同一个值在两张表上宽度必须一致,
@@ -769,12 +790,13 @@ export declare class SqlApprovalAskStore implements ApprovalAskStore {
     listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
     listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
-    listParkingBySession(sessionId: string): Promise<AskRow[]>;
+    listParkingBySourceSession(sourceSessionId: string): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;
     resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
-    deleteByTask(taskId: string): Promise<void>;
+    /** 一个事务里发 {@link deleteSessionApprovalRows} 那组语句(与留存腿同一组;批与问同生同死,半途失败整组回滚、重试收敛)。 */
+    deleteBySession(sessionId: string): Promise<void>;
     /**
      * 留存律的问行半场(谓词见接口注)。一条带 `LIMIT` 的 `DELETE`(PG 无 `DELETE … LIMIT` ⇒ `ctid IN (SELECT … LIMIT)`,与
      * `permission-rule-store-sql.ts` 的清扫同形);终态闭集从 {@link ASK_TERMINAL} 展开成占位符,不在 SQL 里手抄态名;挂靠集对三格各一句