@sema-agent/server 7.147.0 → 7.148.0

package/dist/plugins/approval-ask-store-sql.js

@@ -1,4 +1,5 @@
 import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
+import { retentionIdSet } from "./retention-sql.js";
 import { ASK_TERMINAL, canAskTransition } from "../approval-ask-machine.js";
 import { DECIDED_VIA } from "@sema-agent/core";
 import { APPROVAL_ENDING_CAUSES, askRowEndingCause, askRowParkTrigger } from "../approval-deny-reasons.js";
@@ -119,15 +120,26 @@ export function projectAskTerminalClaimTruth(row) {
 export function askRowOnCall(row, call) {
     return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceSessionId === call.sourceSessionId;
 }
-export function askOwnerAdmits(owner, principal) {
-    return owner === null || owner === principal;
-}
 export function askRowCarriesOwner(row, owner) {
     return row !== null && row.owner === owner;
 }
 export function projectDecideReading(row, owner) {
     return askRowCarriesOwner(row, owner) ? row : null;
 }
+export function askAttachedToSession(row, sessionId) {
+    return row.taskId !== sessionId && (row.sessionId === sessionId || row.sourceSessionId === sessionId);
+}
+const ASK_SESSION_CELLS = ["session_id", "source_task_id"];
+export async function deleteSessionApprovalRows(exec, dialect, ids) {
+    if (ids.length === 0)
+        return;
+    for (const cell of ASK_SESSION_CELLS) {
+        const inAsk = retentionIdSet(dialect, `a.${cell}`, ids, 1);
+        await exec.query(`DELETE FROM ${APPROVAL_BATCH_TABLE} WHERE batch_id IN (SELECT a.batch_id FROM ${APPROVAL_ASK_TABLE} a WHERE ${inAsk.sql} AND a.${cell} <> a.task_id)`, inAsk.params);
+        const own = retentionIdSet(dialect, cell, ids, 1);
+        await exec.query(`DELETE FROM ${APPROVAL_ASK_TABLE} WHERE ${own.sql} AND ${cell} <> task_id`, own.params);
+    }
+}
 export const APPROVAL_ASK_TABLE = "approval_ask";
 export const APPROVAL_ASK_EXECUTION_LANE_COLUMN = {
     mysql: "execution_lane VARCHAR(32) NOT NULL DEFAULT ''",
@@ -235,7 +247,9 @@ export const TIDB_APPROVAL_ASK_STATEMENTS = [
     -- 表尚未进生产 ⇒ 此刻加索引零迁移成本,晚一车加就要动生产表。
     KEY idx_ask_session_state (session_id, state),
     KEY idx_ask_batch (batch_id),
-    KEY idx_ask_state (state)
+    KEY idx_ask_state (state),
+    -- idx_ask_source_session:删会话的审批腿按发问格选行(deleteSessionApprovalRows);宿主格走上面 idx_ask_session_state 的前缀。
+    KEY idx_ask_source_session (source_task_id)
   ) COLLATE utf8mb4_bin`,
 ];
 export async function ensureTiDBApprovalAskSchema(pool) {
@@ -244,10 +258,12 @@ export async function ensureTiDBApprovalAskSchema(pool) {
 }
 export const APPROVAL_ASK_INDEXES = [
     { table: `${APPROVAL_BATCH_TABLE}`, name: "idx_batch_task", columns: ["task_id"] },
+    { table: `${APPROVAL_ASK_TABLE}`, name: "uq_approval_ask_idem", columns: ["task_id", "idempotency_key"], unique: true },
     { table: `${APPROVAL_ASK_TABLE}`, name: "idx_ask_task_state", columns: ["task_id", "state"] },
     { table: `${APPROVAL_ASK_TABLE}`, name: "idx_ask_session_state", columns: ["session_id", "state"] },
     { table: `${APPROVAL_ASK_TABLE}`, name: "idx_ask_batch", columns: ["batch_id"] },
     { table: `${APPROVAL_ASK_TABLE}`, name: "idx_ask_state", columns: ["state"] },
+    { table: `${APPROVAL_ASK_TABLE}`, name: "idx_ask_source_session", columns: ["source_task_id"] },
 ];
 export async function ensurePgApprovalAskSchema(q) {
     await q(`CREATE TABLE IF NOT EXISTS ${APPROVAL_BATCH_TABLE} (
@@ -776,9 +792,9 @@ export class SqlApprovalAskStore {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ? AND leg_key = ? AND tool_call_id = ? AND source_task_id = ? ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1 AND leg_key = $2 AND tool_call_id = $3 AND source_task_id = $4 ORDER BY created_at_ms ASC, ask_id ASC`), [call.taskId, call.legKey, call.toolCallId, call.sourceSessionId]);
         return rows.map(mapAskRow).filter((r) => askRowOnCall(r, call));
     }
-    async listParkingBySession(sessionId) {
-        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = ? AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE session_id = $1 AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`), [sessionId]);
-        return rows.map(mapAskRow).filter((r) => r.sessionId === sessionId);
+    async listParkingBySourceSession(sourceSessionId) {
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = ? AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = $1 AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`), [sourceSessionId]);
+        return rows.map(mapAskRow).filter((r) => r.sourceSessionId === sourceSessionId);
     }
     async getAsk(askId) {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [
@@ -808,9 +824,24 @@ export class SqlApprovalAskStore {
         const res = await this.db.query(`UPDATE ${APPROVAL_ASK_TABLE} SET ${setSql}, rev = rev + 1 WHERE ask_id = ${askIdPh} AND provisional = ${provPh} AND state = ${fromPh}`, [...vals, askId, 1, from]);
         return res.affected === 1;
     }
-    async deleteByTask(taskId) {
-        await this.db.query(this.q(`DELETE FROM ${APPROVAL_ASK_TABLE} WHERE task_id = ?`, `DELETE FROM ${APPROVAL_ASK_TABLE} WHERE task_id = $1`), [taskId]);
-        await this.db.query(this.q(`DELETE FROM ${APPROVAL_BATCH_TABLE} WHERE task_id = ?`, `DELETE FROM ${APPROVAL_BATCH_TABLE} WHERE task_id = $1`), [taskId]);
+    async deleteBySession(sessionId) {
+        const conn = await this.db.connect();
+        try {
+            await conn.begin();
+            await deleteSessionApprovalRows(conn, this.db.dialect, [sessionId]);
+            await conn.commit();
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+            }
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
     }
     async reapSettledAsks(cutoffMs, limit, keepAnchors) {
         assertReapBounds(cutoffMs, limit);

package/dist/plugins/approval-exemption-skill-m46.d.ts

@@ -0,0 +1,20 @@
+import type { FileApprovalExemptionStore } from "./approval-exemption-store.js";
+/** 本条在标记表(`one-time-migration-marker.ts`)里的那一行的键。 */
+export declare const LEGACY_SKILL_EXEMPTION_MARKER_ID = "M46";
+/** local 车道的标记文件(数据根下,文件名即本条;正文 = T0 的 ISO 时刻一行,人可直接读)。 */
+export declare const LOCAL_LEGACY_SKILL_EXEMPTION_MARKER_FILE = "one-time-migration-M46.marker";
+/** 被删行的 wire 工具名 —— 引擎 `Skill` 工具的名字,core 导出(core 改名 ⇒ 谓词跟着走,不会静默指向空气)。 */
+export declare const LEGACY_SKILL_EXEMPTION_TOOL_NAME: string;
+/** SQL 腿一页的会话数(键集分批:`session_id` 升序,一页一次读、一句删)。 */
+export declare const LEGACY_SKILL_EXEMPTION_PAGE = 500;
+/**
+ * local 腿的 T0:标记文件在 ⇒ 读它(正文 = T0 的 ISO 时刻);不在 ⇒ **先**原子落盘再返回(`required`:标记没落盘就不算开始过 —— 写不进 ⇒ 抛,起服拒,下一次起服重来,一行没删)。
+ * 标记文件在而读不出(正文不是时刻 —— 手改过 / 写坏了)⇒ **响亮拒启**,点名文件与出路:不替人猜一个 T0(猜晚了会多删、猜早了会少删)。出路 = 删掉那只文件再起服(本步取新的 T0)。
+ */
+export declare function legacySkillExemptionCutoffLocal(markerPath: string, now?: () => number): number;
+/**
+ * 🔴 M46 的 local 腿(唯一调用点 `LocalBackend.runOneTimeMigrations`):T0 先落盘,再对 File 店删「首次放行早于 T0 的 `Skill` 行」(墓碑,与按名撤销同形)。返回删了几行。
+ * 数据根独占(根锁):同一只根上没有第二个起服者,也没有更早版本的副本与本次并跑。
+ */
+export declare function dropLocalLegacySkillExemptionsM46(markerPath: string, store: Pick<FileApprovalExemptionStore, "dropToolRowsCreatedBeforeM46">): number;
+//# sourceMappingURL=approval-exemption-skill-m46.d.ts.map

package/dist/plugins/approval-exemption-skill-m46.js

@@ -0,0 +1,25 @@
+import { existsSync, readFileSync } from "node:fs";
+import { SKILL_TOOL_NAME } from "@sema-agent/core";
+import { atomicWriteFileSync } from "./owner-only-file-mode.js";
+import { StoreBootRefusalError } from "./store-contracts.js";
+export const LEGACY_SKILL_EXEMPTION_MARKER_ID = "M46";
+export const LOCAL_LEGACY_SKILL_EXEMPTION_MARKER_FILE = "one-time-migration-M46.marker";
+export const LEGACY_SKILL_EXEMPTION_TOOL_NAME = SKILL_TOOL_NAME;
+export const LEGACY_SKILL_EXEMPTION_PAGE = 500;
+export function legacySkillExemptionCutoffLocal(markerPath, now = Date.now) {
+    if (existsSync(markerPath)) {
+        const marked = Date.parse(readFileSync(markerPath, "utf8").trim());
+        if (!Number.isFinite(marked)) {
+            throw new StoreBootRefusalError(`one-time migration ${LEGACY_SKILL_EXEMPTION_MARKER_ID}: ${markerPath} exists but does not hold a readable cutoff time (expected one ISO time, e.g. 2026-11-06T09:00:00.000Z); ` +
+                `refusing to start rather than guess which stored Skill exemption rows predate the upgrade. Delete the file and restart: the step then records a new cutoff (now) and deletes the stored Skill exemption rows older than it.`);
+        }
+        return marked;
+    }
+    const t0 = now();
+    atomicWriteFileSync(markerPath, `${new Date(t0).toISOString()}\n`, { durability: "required" });
+    return t0;
+}
+export function dropLocalLegacySkillExemptionsM46(markerPath, store) {
+    return store.dropToolRowsCreatedBeforeM46(LEGACY_SKILL_EXEMPTION_TOOL_NAME, legacySkillExemptionCutoffLocal(markerPath));
+}
+//# sourceMappingURL=approval-exemption-skill-m46.js.map

package/dist/plugins/approval-exemption-store.d.ts

@@ -66,7 +66,7 @@ export declare class FileApprovalExemptionStore implements ApprovalExemptionStor
     /** [ref]: sanitized session key → that session log's gate (only files that replayed a bad record are listed). */
     private readonly corruptGates;
     private readonly warn;
-    /** @param opts.warn corrupt-read disclosure seat (`LocalBackend` wires `discloseWarn`; absent ⇒ the owner falls back to `console.warn`, never to silence). */
+    /** @param opts.warn corrupt-read disclosure seat (`LocalBackend` wires `discloseWarn`; absent ⇒ the owner falls back to the log seam's text exit `writeLogText`, never to silence). */
     constructor(root: string, opts?: {
         warn?: Logger["warn"];
     });
@@ -80,6 +80,11 @@ export declare class FileApprovalExemptionStore implements ApprovalExemptionStor
     has(sessionId: string, toolName: string): Promise<boolean>;
     list(sessionId: string): Promise<ApprovalExemptionRow[]>;
     revoke(sessionId: string, toolName: string): Promise<boolean>;
+    /**
+     * 一次性迁移 M46 的 local 腿(窗关随 M46 删;登记表 `removal` 点名):每只会话上 `toolName` 那一行的**首次放行**早于 `beforeMs` 的,追加一条墓碑(与 {@link revoke} 同形、fsync)并出索引。
+     * 返回删了几行。日志已被判坏的会话不碰(它的 `has` / `list` 本来就拒;删会话即清闸)。幂等:删过的行不在索引里,第二跑零命中。
+     */
+    dropToolRowsCreatedBeforeM46(toolName: string, beforeMs: number): number;
     deleteBySession(sessionId: string): Promise<number>;
     /** Release every open append-log fd (LocalBackend.close → graceful-restart re-open). */
     dispose(): void;

package/dist/plugins/approval-exemption-store.js

@@ -212,6 +212,20 @@ export class FileApprovalExemptionStore {
         m.delete(toolName);
         return true;
     }
+    dropToolRowsCreatedBeforeM46(toolName, beforeMs) {
+        let dropped = 0;
+        for (const [key, m] of this.bySession) {
+            if (this.corruptGates.has(key))
+                continue;
+            const row = m.get(toolName);
+            if (row === undefined || !(row.createdAt < beforeMs))
+                continue;
+            this.logFor(key).append({ toolName, grantedBy: null, ts: new Date().toISOString(), revoked: true }, true);
+            m.delete(toolName);
+            dropped += 1;
+        }
+        return dropped;
+    }
     async deleteBySession(sessionId) {
         const key = sanitizePathComponent(sessionId);
         const removed = this.bySession.get(key)?.size ?? 0;

package/dist/plugins/approval-nonce-store.d.ts

@@ -1,7 +1,7 @@
 import type { Pool as MysqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SqlDriver } from "./sql-driver.js";
-import type { Logger } from "../observability/logger.js";
+import { type Logger } from "../observability/logger.js";
 /** 表名(单数形;`test/schema-naming-invariants.test.ts` 的闭集词表钉着)。 */
 export declare const APPROVAL_NONCE_TABLE = "approval_nonce";
 /**
@@ -10,6 +10,12 @@ export declare const APPROVAL_NONCE_TABLE = "approval_nonce";
  * 设限是**保守**方向(星平面字符在 JS 里算 2、在两个引擎的 VARCHAR 里算 1),永远不会撞到列宽。
  */
 export declare const MAX_APPROVAL_NONCE_CHARS = 190;
+/** 时间地板的表名(单行表,与 `retention_lease` 同形:`singleton` 恒 `'x'`)。判据见头注「时间地板」。 */
+export declare const APPROVAL_NONCE_FLOOR_TABLE = "approval_nonce_floor";
+/** 原始钟低于地板(钟被往回拨)时那一行 warn 的事件名。字段:`rolledBackMs`(地板 − 原始钟)/ `floorMs` / `clockMs`(原始钟读数)/ `store`(哪条腿)。 */
+export declare const APPROVAL_NONCE_CLOCK_ROLLBACK_EVENT = "approval_nonce_clock_rollback";
+/** 回拨 warn 的落点;店没接日志座时退回日志出口接缝的缺省 logger(不退回沉默)。 */
+export type ApprovalNonceWarn = Logger["warn"];
 export interface ApprovalNonceStore {
     /**
      * **这只店为它的记录计时的那口钟**(epoch ms)—— 见头注「到期 —— 一口钟」。
@@ -17,9 +23,8 @@ export interface ApprovalNonceStore {
      * 它是消费记录这条命上**唯一**的参照:受理窗的判定、落地后的复核、到期清扫三处全读它,于是
      * 「还受理 ⇒ 记录还在」是结构性的,不靠「两台副本的钟差不多」这条没人声明过的假设。
      *
-     * ⚠️ **要求:单调不减**。同源只挡「两只钟各走各的」,挡不住「这一只往回走」—— 钟回拨会让一条已被
-     * 清扫的记录所对应的证明重新过验签(头注「由构造」那段的残余,🚧 见 `approval-nonce-store.test.ts`)。
-     * 现役三实现都**不**自己强制这一条(Memory/File = `Date.now()`,SQL = 库钟),登记在案。
+     * 🔴 **由构造不低于地板**(头注「时间地板」):答 `max(原始钟, 地板)`。原始钟低于地板 ⇒ 答地板 + 一行
+     * {@link APPROVAL_NONCE_CLOCK_ROLLBACK_EVENT} warn(点名回拨量)。于是三处判决都不会读到「已删记录的到期时刻之前」的钟。
      * 🔴 读不出来 ⇒ **响亮抛**([ref] fail-closed):调用方必须把它当不确定失败,**绝不**掉回本地墙钟。
      */
     nowMs(): Promise<number>;
@@ -30,7 +35,8 @@ export interface ApprovalNonceStore {
      */
     consume(sessionId: string, nonce: string, expiresAtMs: number): Promise<boolean>;
     /**
-     * GC:删掉 `expires_at_ms <= ` **{@link nowMs}** 的记录,返回删除行数(维护 tick 调)。
+     * GC:读一次 **{@link nowMs}** → 把地板抬到这一读数(**先落地**)→ 删掉 `expires_at_ms <=` 这一读数的记录,返回删除行数(维护 tick 调)。
+     * 地板的唯一写者:行不会在已落地的地板低于它的到期时刻时消失,中途崩溃只留下「地板已抬、行还在」(下一拍再删)。
      *
      * 🔴 **一个时钟入参都没有**,而且这不是省事:形参会让删除线由**跑清理的那台副本**说了算,而它跟
      * 验签那台不是同一口钟 —— 那正是本店要消灭的那条依赖(与票据店 [ref] 删掉 `now: () => number`
@@ -41,24 +47,42 @@ export interface ApprovalNonceStore {
 }
 export declare class SqlApprovalNonceStore implements ApprovalNonceStore {
     private readonly db;
-    constructor(db: SqlDriver);
+    private readonly warn;
+    /** @param opts.warn 回拨 warn 的落点(缺席 ⇒ 日志出口接缝的缺省 logger,不退回沉默)。 */
+    constructor(db: SqlDriver, opts?: {
+        readonly warn?: ApprovalNonceWarn;
+    });
     private q;
-    /** 库钟({@link sqlDbNowMs})—— 一组无状态副本唯一共享的那口钟。读不出 ⇒ 响亮抛。 */
+    /**
+     * 店钟 = max(库钟, 地板)。库钟({@link SQL_DB_NOW_MS})是一组无状态副本唯一共享的那口钟;地板与它**同一条语句**读出(两条语句之间
+     * 一次清扫会把地板抬到第一读之后,于是一次正常的读也会被报成回拨)。没有地板行 = 这只店从没删过记录。读不出 ⇒ 响亮抛。
+     */
     nowMs(): Promise<number>;
     consume(sessionId: string, nonce: string, expiresAtMs: number): Promise<boolean>;
     reapExpired(): Promise<number>;
 }
 /** MySQL 协议腿的构造绑定(与兄弟店同形:类名/构造元数不变,消费方不必动)。 */
 export declare class TiDBApprovalNonceStore extends SqlApprovalNonceStore {
-    constructor(pool: MysqlPool);
+    constructor(pool: MysqlPool, opts?: {
+        readonly warn?: ApprovalNonceWarn;
+    });
 }
 /** PostgreSQL 腿的构造绑定。 */
 export declare class PgApprovalNonceStore extends SqlApprovalNonceStore {
-    constructor(pool: PgPool);
+    constructor(pool: PgPool, opts?: {
+        readonly warn?: ApprovalNonceWarn;
+    });
 }
 export declare class MemoryApprovalNonceStore implements ApprovalNonceStore {
     private readonly rows;
-    /** 单进程腿:店 = 这个进程,所以店钟就是本进程的墙钟(验签、复核、清扫本来就同一只钟,无第二口)。 */
+    /** 时间地板(头注「时间地板」):进程内即可 —— 店随进程死,它保护的记录同亡。缺席 = 从没删过。 */
+    private floorMs;
+    private readonly warn;
+    /** @param opts.warn 回拨 warn 的落点(缺席 ⇒ 日志出口接缝的缺省 logger)。 */
+    constructor(opts?: {
+        readonly warn?: ApprovalNonceWarn;
+    });
+    /** 单进程腿:店 = 这个进程,所以原始钟就是本进程的墙钟(验签、复核、清扫本来就同一只钟,无第二口);店钟 = 它与地板取大。 */
     nowMs(): Promise<number>;
     consume(sessionId: string, nonce: string, expiresAtMs: number): Promise<boolean>;
     reapExpired(): Promise<number>;
@@ -91,12 +115,15 @@ export declare class FileApprovalNonceStore implements ApprovalNonceStore {
     private log;
     /** [ref]:本账的损坏闸(见类注)。 */
     private readonly gate;
-    /** @param opts.warn 腐读披露座(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 属主退回 `console.warn`,不退回沉默)。 */
+    /** 时间地板(头注「时间地板」):重放时取账里的地板行,每次压实与幸存行一起写回。缺席 = 这本账从没被清扫过。 */
+    private floorMs;
+    private readonly warn;
+    /** @param opts.warn 腐读披露座与回拨 warn 的落点(`LocalBackend` 接 `discloseWarn`;缺席 ⇒ 日志出口接缝的缺省出口,不退回沉默)。 */
     constructor(root: string, opts?: {
         warn?: Logger["warn"];
     });
     private logFor;
-    /** local 车道:店 = 这台机器上的这个数据根,所以店钟就是本进程的墙钟(理由同 Memory 腿)。 */
+    /** local 车道:店 = 这台机器上的这个数据根,所以原始钟就是本进程的墙钟(理由同 Memory 腿);店钟 = 它与地板取大(地板活过重启)。 */
     nowMs(): Promise<number>;
     consume(sessionId: string, nonce: string, expiresAtMs: number): Promise<boolean>;
     reapExpired(): Promise<number>;

package/dist/plugins/approval-nonce-store.js

@@ -1,20 +1,48 @@
 import { join } from "node:path";
 import { atomicWriteFile, ensureDir, AppendLog } from "@sema-agent/core";
-import { mysqlDriver, pgDriver, sqlDbNowMs, SQL_DB_NOW_MS } from "./sql-driver.js";
+import { mysqlDriver, pgDriver, SQL_DB_NOW_MS } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
+import { createLogger } from "../observability/logger.js";
 export const APPROVAL_NONCE_TABLE = "approval_nonce";
 export const MAX_APPROVAL_NONCE_CHARS = 190;
+export const APPROVAL_NONCE_FLOOR_TABLE = "approval_nonce_floor";
+export const APPROVAL_NONCE_CLOCK_ROLLBACK_EVENT = "approval_nonce_clock_rollback";
+let seamLogger;
+const warnToLogSeam = (msg, fields) => (seamLogger ??= createLogger()).warn(msg, fields);
+function storeClockOf(rawMs, floorMs, store, warn) {
+    if (floorMs === undefined || rawMs >= floorMs)
+        return rawMs;
+    warn(APPROVAL_NONCE_CLOCK_ROLLBACK_EVENT, {
+        store,
+        rolledBackMs: floorMs - rawMs,
+        floorMs,
+        clockMs: rawMs,
+        note: "the approval-nonce store's clock reads below the line it already deleted consumption records under (the clock was stepped back: an NTP step, a failover to a lagging host, or another database node answering) — " +
+            "the store answers that line instead, so proofs that expired before it stay refused; check time sync on the database host (SQL backends) or on this host (local lane)",
+    });
+    return floorMs;
+}
 export class SqlApprovalNonceStore {
     db;
-    constructor(db) {
+    warn;
+    constructor(db, opts) {
         this.db = db;
+        this.warn = opts?.warn ?? warnToLogSeam;
     }
     q(mysql, pg) {
         return this.db.dialect === "mysql" ? mysql : pg;
     }
     async nowMs() {
-        return sqlDbNowMs(this.db, APPROVAL_NONCE_TABLE);
+        const { rows } = await this.db.query(this.q(`SELECT ${SQL_DB_NOW_MS.mysql} AS db_now_ms, (SELECT floor_ms FROM ${APPROVAL_NONCE_FLOOR_TABLE} WHERE singleton = 'x') AS floor_ms`, `SELECT ${SQL_DB_NOW_MS.pg} AS db_now_ms, (SELECT floor_ms FROM ${APPROVAL_NONCE_FLOOR_TABLE} WHERE singleton = 'x') AS floor_ms`), []);
+        const raw = Number(rows[0]?.["db_now_ms"] ?? Number.NaN);
+        if (!Number.isFinite(raw))
+            throw new Error(`${APPROVAL_NONCE_TABLE}: the database clock came back unreadable (${String(rows[0]?.["db_now_ms"])})`);
+        const floorCell = rows[0]?.["floor_ms"];
+        const floor = floorCell === null || floorCell === undefined ? undefined : Number(floorCell);
+        if (floor !== undefined && !Number.isFinite(floor))
+            throw new Error(`${APPROVAL_NONCE_FLOOR_TABLE}: the time floor came back unreadable (${String(floorCell)})`);
+        return storeClockOf(raw, floor, "sql", this.warn);
     }
     async consume(sessionId, nonce, expiresAtMs) {
         try {
@@ -28,25 +56,32 @@ export class SqlApprovalNonceStore {
         }
     }
     async reapExpired() {
-        const res = await this.db.query(this.q(`DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ${SQL_DB_NOW_MS.mysql}`, `DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ${SQL_DB_NOW_MS.pg}`), []);
+        const line = await this.nowMs();
+        await this.db.query(this.q(`INSERT INTO ${APPROVAL_NONCE_FLOOR_TABLE} (singleton, floor_ms) VALUES ('x', ?) ON DUPLICATE KEY UPDATE floor_ms = GREATEST(floor_ms, VALUES(floor_ms))`, `INSERT INTO ${APPROVAL_NONCE_FLOOR_TABLE} (singleton, floor_ms) VALUES ('x', $1) ON CONFLICT (singleton) DO UPDATE SET floor_ms = GREATEST(${APPROVAL_NONCE_FLOOR_TABLE}.floor_ms, EXCLUDED.floor_ms)`), [line]);
+        const res = await this.db.query(this.q(`DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= ?`, `DELETE FROM ${APPROVAL_NONCE_TABLE} WHERE expires_at_ms <= $1`), [line]);
         return res.affected;
     }
 }
 export class TiDBApprovalNonceStore extends SqlApprovalNonceStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, opts) {
+        super(mysqlDriver(pool), opts);
     }
 }
 export class PgApprovalNonceStore extends SqlApprovalNonceStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, opts) {
+        super(pgDriver(pool), opts);
     }
 }
 const keyOf = (sessionId, nonce) => JSON.stringify([sessionId, nonce]);
 export class MemoryApprovalNonceStore {
     rows = new Map();
+    floorMs;
+    warn;
+    constructor(opts) {
+        this.warn = opts?.warn ?? warnToLogSeam;
+    }
     async nowMs() {
-        return Date.now();
+        return storeClockOf(Date.now(), this.floorMs, "memory", this.warn);
     }
     async consume(sessionId, nonce, expiresAtMs) {
         const k = keyOf(sessionId, nonce);
@@ -56,10 +91,11 @@ export class MemoryApprovalNonceStore {
         return true;
     }
     async reapExpired() {
-        const now = await this.nowMs();
+        const line = await this.nowMs();
+        this.floorMs = this.floorMs === undefined ? line : Math.max(this.floorMs, line);
         let n = 0;
         for (const [k, exp] of this.rows) {
-            if (exp <= now) {
+            if (exp <= line) {
                 this.rows.delete(k);
                 n++;
             }
@@ -67,11 +103,15 @@ export class MemoryApprovalNonceStore {
         return n;
     }
 }
-const NONCE_RECORD_SHAPE = {
-    what: "approval-nonce record without a string s / string n / numeric e",
+const NONCE_LOG_LINE_SHAPE = {
+    what: "approval-nonce line that is neither a record (string s / string n / numeric e) nor a time floor (numeric f alone)",
     read(record) {
-        const { s, n, e } = record;
-        return typeof s === "string" && typeof n === "string" && typeof e === "number" ? { s, n, e } : undefined;
+        const { s, n, e, f } = record;
+        if (typeof s === "string" && typeof n === "string" && typeof e === "number")
+            return { s, n, e };
+        if (typeof f === "number" && s === undefined && n === undefined && e === undefined)
+            return { f };
+        return undefined;
     },
 };
 export class FileApprovalNonceStore {
@@ -80,22 +120,29 @@ export class FileApprovalNonceStore {
     rows = new Map();
     log;
     gate;
+    floorMs;
+    warn;
     constructor(root, opts) {
+        this.warn = opts?.warn ?? warnToLogSeam;
         const dir = join(root, "approval-nonces");
         ensureDir(dir);
         this.tmpDir = join(dir, ".tmp");
         ensureDir(this.tmpDir);
         this.path = join(dir, "consumed.jsonl");
-        const { records, gate } = replayJsonlGuarded(this.path, "approval-nonce", NONCE_RECORD_SHAPE, opts?.warn);
+        const { records, gate } = replayJsonlGuarded(this.path, "approval-nonce", NONCE_LOG_LINE_SHAPE, opts?.warn);
         this.gate = gate;
-        for (const r of records)
-            this.rows.set(keyOf(r.s, r.n), r);
+        for (const r of records) {
+            if ("f" in r)
+                this.floorMs = this.floorMs === undefined ? r.f : Math.max(this.floorMs, r.f);
+            else
+                this.rows.set(keyOf(r.s, r.n), r);
+        }
     }
     logFor() {
         return (this.log ??= new AppendLog(this.path));
     }
     async nowMs() {
-        return Date.now();
+        return storeClockOf(Date.now(), this.floorMs, "file", this.warn);
     }
     async consume(sessionId, nonce, expiresAtMs) {
         this.gate.assertUsable();
@@ -109,11 +156,11 @@ export class FileApprovalNonceStore {
     }
     async reapExpired() {
         this.gate.assertUsable();
-        const nowMs = await this.nowMs();
+        const line = await this.nowMs();
         const survivors = [];
         let removed = 0;
         for (const record of this.rows.values()) {
-            if (record.e <= nowMs) {
+            if (record.e <= line) {
                 removed++;
                 continue;
             }
@@ -122,9 +169,11 @@ export class FileApprovalNonceStore {
         if (removed === 0)
             return 0;
         this.log?.closeForSwap();
-        atomicWriteFile(this.tmpDir, this.path, survivors.map((r) => `${JSON.stringify(r)}\n`).join(""));
+        const floor = { f: this.floorMs === undefined ? line : Math.max(this.floorMs, line) };
+        atomicWriteFile(this.tmpDir, this.path, [floor, ...survivors].map((r) => `${JSON.stringify(r)}\n`).join(""));
+        this.floorMs = floor.f;
         for (const [k, record] of [...this.rows])
-            if (record.e <= nowMs)
+            if (record.e <= line)
                 this.rows.delete(k);
         return removed;
     }

package/dist/plugins/blob-backend.d.ts

@@ -57,6 +57,8 @@ export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
     private readonly keyPrefix;
     private readonly ttl;
+    /** 六个站点(put / get / delete / listObjects / headObject / probeBucket)的唯一出口:端点回重定向 ⇒ 拒,预签名 URL 与对象体不被带去 `Location`。 */
+    private readonly egressFetch;
     constructor(cfg: MinioBlobBackendConfig);
     private objectKey;
     private presign;

package/dist/plugins/blob-backend.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { isNoSuchBucketAnswer } from "./s3-answer.js";
+import { createEgressFetch } from "../egress-redirect.js";
 export async function readAtAddress(port, hash) {
     const bytes = await port.get(hash);
     if (bytes === undefined)
@@ -23,10 +24,12 @@ export class MinioBlobBackend {
     cfg;
     keyPrefix;
     ttl;
+    egressFetch;
     constructor(cfg) {
         this.cfg = cfg;
         this.keyPrefix = cfg.keyPrefix ?? "blobs/";
         this.ttl = cfg.presignTtlSec ?? 3600;
+        this.egressFetch = createEgressFetch("declare the final object-store address as MINIO_ENDPOINT / S3_ENDPOINT", cfg.fetchImpl);
     }
     objectKey(key) {
         return `${this.keyPrefix}${key}`;
@@ -45,7 +48,7 @@ export class MinioBlobBackend {
     }
     async put(key, bytes) {
         const url = this.presign(key, "PUT");
-        const res = await (this.cfg.fetchImpl ?? fetch)(url, { method: "PUT", body: bytes, signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
+        const res = await this.egressFetch(url, { method: "PUT", body: bytes, signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         if (!res.ok) {
             const detail = await res.text().catch(() => "");
             throw new Error(`MinioBlobBackend.put ${key}: HTTP ${res.status} ${detail.slice(0, 200)}`);
@@ -55,7 +58,7 @@ export class MinioBlobBackend {
         const url = this.presign(key, "GET");
         let res;
         try {
-            res = await (this.cfg.fetchImpl ?? fetch)(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
+            res = await this.egressFetch(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         }
         catch (err) {
             throw new Error(`MinioBlobBackend.get ${key}: transient fetch failure: ${err.message}`);
@@ -74,7 +77,7 @@ export class MinioBlobBackend {
         let firstFailure;
         await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (key) => {
             try {
-                const res = await (this.cfg.fetchImpl ?? fetch)(this.presign(key, "DELETE"), { method: "DELETE", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
+                const res = await this.egressFetch(this.presign(key, "DELETE"), { method: "DELETE", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
                 if (res.ok || res.status === 404)
                     return;
                 failed++;
@@ -89,7 +92,7 @@ export class MinioBlobBackend {
             throw new Error(`MinioBlobBackend.delete: ${failed} of ${distinct.length} object(s) could not be deleted (first: ${firstFailure})`);
     }
     async *listObjects() {
-        const f = this.cfg.fetchImpl ?? fetch;
+        const f = this.egressFetch;
         let token;
         const MAX_PAGES = 1000;
         let pages = 0;
@@ -127,7 +130,7 @@ export class MinioBlobBackend {
         } while (token !== undefined);
     }
     async headObject(hash) {
-        const f = this.cfg.fetchImpl ?? fetch;
+        const f = this.egressFetch;
         const res = await f(this.presign(hash, "HEAD"), { method: "HEAD", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
         if (!res.ok)
             return undefined;
@@ -136,7 +139,7 @@ export class MinioBlobBackend {
         return { lastModifiedMs: Number.isFinite(ms) ? ms : Date.now() };
     }
     async probeBucket(timeoutMs = OBJECT_STORE_IO_TIMEOUT_MS) {
-        const f = this.cfg.fetchImpl ?? fetch;
+        const f = this.egressFetch;
         const url = presignS3ListUrl({
             endpoint: this.cfg.endpoint,
             bucket: this.cfg.bucket,

package/dist/plugins/caching-session-store.d.ts

@@ -1,9 +1,12 @@
 import { type AcquiredSession, type PlacedSessionRow, type RetentionDeclaration, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
+import type { LocalSessionDeletionSection } from "../session-erase.js";
 import type { OwnerAwareSessionStore, SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
+import type { SessionDeletionFace } from "../session-deletion.js";
 import { type PlacementAcquireOpts } from "./session-placement.js";
 import type { InstructionSourceStore } from "../instruction-source-notice.js";
 import type { SessionWorkspaceStore } from "../session-workspace.js";
+import { type SessionBirthFace, type SessionWithdrawFace } from "./session-birth.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
@@ -60,7 +63,13 @@ export declare class CachingSessionStore implements SessionStore {
      *  缓存的会话活得比「另一只店删掉又重建了这一行」长)。内层店必有(本类的暖命中按它核新鲜)。🔴 必须转发:生产默认把真店包进本类,授权口 / 属主门 /
      *  k8s 工作区空间 / SSE 探针 / resume-at 读的都是本类。 */
     readonly headOf: SessionHeadReader["headOf"];
+    /** 删除门的头读(`OwnerAwareSessionStore.deletionHeadOf`;local 店才交):**纯转发、不经暖缓存**(与 `headOf` 同理)。内层店不交 ⇒ 本类也不交(删除门读 `headOf`)。 */
+    readonly deletionHeadOf?: OwnerAwareSessionStore["deletionHeadOf"];
     readonly register?: (sessionId: string, owner: string | null) => Promise<void>;
+    /** 出生回执面(`session-birth.ts`;纯转发 —— 写的是持久行)。🔴 必须转发:授权口读的是本类,不转发 = 永远没有候选 = 永不撤回。 */
+    readonly registerWithReceipt?: SessionBirthFace["registerWithReceipt"];
+    /** 条件撤回面(`session-birth.ts`;转发后逐出暖缓存,与 `deleteSession` 同一条纪律)。 */
+    readonly withdrawBirth?: SessionWithdrawFace["withdrawBirth"];
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */
     readonly listSessions?: (opts: {
@@ -80,7 +89,10 @@ export declare class CachingSessionStore implements SessionStore {
     readonly forkTo?: OwnerAwareSessionStore["forkTo"];
     /** 执行席(原样转发:放置是会话**行**上的一格,缓存只缓存会话日志的暖句柄,不缓存行格 —— 读与写都直达内层店)。 */
     readonly executionPlacement?: OwnerAwareSessionStore["executionPlacement"];
-    readonly deleteSession?: (sessionId: string, owner: string | null) => Promise<boolean>;
+    /** 删净一只在删会话的 local 执行体锁节(转发后逐出暖缓存)。 */
+    readonly deleteSession?: LocalSessionDeletionSection;
+    /** 删除面(会话三态的围栏 / 复核 / 收尾输入;`fence` 转发后逐出暖缓存 —— 在删即读作不在,暖条目不许再交出那只会话)。内层店不交 ⇒ 本类也不交。 */
+    readonly sessionDeletion?: SessionDeletionFace;
     /** The session row's list projection for one id + its writable bits (`title` / `pinned`) — DURABLE, pure pass-through
      *  (they read / write `session_meta` / the local sidecars, never the warm cache). 🔴 Must forward (the retention / placements
      *  lesson): the production default wraps the real store in this class, and the route's fact `sessionPatch` reads THIS object. */