@sema-agent/server 7.147.0 → 7.148.0

package/dist/adoption/runner.d.ts

@@ -1,5 +1,6 @@
 import { type AdoptionLogStore } from "../plugins/adoption-log-sql.js";
 import type { SqlDialect } from "../plugins/sql-driver.js";
+import { type AdoptionWiring } from "./plan.js";
 import { type AdoptionReceipt, type AdoptionRejectCode } from "./wire.js";
 /** 冲突表族的逐项读数(进 409 响应体;运维据此知道**该去清理哪张表**,不是一句「冲突了」)。 */
 export interface AdoptionConflict {
@@ -9,7 +10,9 @@ export interface AdoptionConflict {
     /** 目的地侧与源侧共享同一逻辑键的行对数(>0 即冲突)。 */
     overlapping: number;
 }
-/** 收编弧的三种结局。**回执与拒绝分家**:拒从不产出 200 回执(183 §7.3 拒绝可判别)。 */
+/** 收编弧的四种结局。**回执与拒绝分家**:拒从不产出 200 回执(183 §7.3 拒绝可判别)。
+ *  `tables_missing` 与 `rejected` 的分家:前者是**部署**事实(接线了的可选面在库上缺表),弧**不**落终态 —— 行停在 INTENT、零 UPDATE,补好表之后重发同一请求即续;
+ *  后者是**数据**事实(目的地冲突 / 装不下),落永久终态。 */
 export type AdoptionOutcome = {
     kind: "receipt";
     adoptionId: string;
@@ -25,12 +28,18 @@ export type AdoptionOutcome = {
     adoptionId: string;
     fromPrincipal: string;
     boundTo: string;
+} | {
+    kind: "tables_missing";
+    adoptionId: string;
+    tables: string[];
 };
 export interface AdoptionRunnerDeps {
     store: AdoptionLogStore;
     dialect: SqlDialect;
     /** 注入时钟(测试要确定性;生产传 `Date.now`)。 */
     now: () => number;
+    /** boot 的店接线事实(**必填、无默认值**:忘传 = 编译红)。只用来判「可选表面缺表是不是意外」,见 {@link AdoptionWiring}。 */
+    wiring: AdoptionWiring;
     /** 锁轮询次数/间隔——测试把它调到 1 次好确定性地打到「取不到锁」那条臂。 */
     lockAttempts?: number;
     lockSleepMs?: number;

package/dist/adoption/runner.js

@@ -3,7 +3,8 @@ import { ADOPTION_PHASE, adoptionLockName, } from "../plugins/adoption-log-sql.j
 import { policyKeyFor } from "../stores-sql/session-policy-store-sql.js";
 import { buildRuleOwnerKey } from "../plugins/permission-rule-store-sql.js";
 import { withAdoptionQuiesce } from "./quiesce.js";
-import { AFFECTED_CONFIG_TEMPLATES, MEMORY_PROJECT_SCOPE_PREFIXES, MEMORY_SCOPE_MAX_CHARS, NOT_MIGRATED_BY_DESIGN, REBIND_LEGS, buildVerbatimPair, rewriteMemoryScope, } from "./plan.js";
+import { readLiveColumns } from "../plugins/schema-live-columns.js";
+import { AFFECTED_CONFIG_TEMPLATES, MEMORY_PROJECT_SCOPE_PREFIXES, MEMORY_SCOPE_MAX_CHARS, NOT_MIGRATED_BY_DESIGN, REBIND_LEGS, buildVerbatimPair, planeExpected, rewriteMemoryScope, } from "./plan.js";
 import { buildBlobScanSql, buildBlobWriteSql, buildConflictProbeSql, buildMemoryScopeScanSql, buildResidualCountSql, buildRebindSql, buildRuleOwnerRekeySql, buildSessionPolicyRewriteSql, buildSessionPolicyScanSql, } from "./sql.js";
 import { AdoptionConfigsSchema, AdoptionLegsSchema, AdoptionReceiptSchema, AdoptionRejectDetailSchema, AdoptionReportSchema, } from "./wire.js";
 import { formatUserScope, encodeScopeSegment } from "@sema-agent/core";
@@ -36,11 +37,17 @@ async function resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal)
     return pairs;
 }
 export function createAdoptionRunner(deps) {
-    const { store, dialect, now } = deps;
-    async function unrepresentableScopes(exec, fromPrincipal, toPrincipal) {
+    const { store, dialect, now, wiring } = deps;
+    async function planLegs(exec) {
+        const live = await readLiveColumns(async (sql) => (await exec.query(sql)).rows, dialect);
+        const legs = REBIND_LEGS.filter((leg) => leg.plane === "core" || live.has(leg.table));
+        const missing = [...new Set(REBIND_LEGS.filter((leg) => leg.plane !== "core" && !live.has(leg.table) && planeExpected(leg.plane, wiring)).map((leg) => leg.table))];
+        return { legs, missing };
+    }
+    async function unrepresentableScopes(exec, legs, fromPrincipal, toPrincipal) {
         const bad = [];
         const seen = new Set();
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             if (leg.encoding !== "memory-scope")
                 continue;
             for (const pair of await resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal)) {
@@ -52,9 +59,9 @@ export function createAdoptionRunner(deps) {
         }
         return bad;
     }
-    async function preflight(exec, fromPrincipal, toPrincipal) {
+    async function preflight(exec, legs, fromPrincipal, toPrincipal) {
         const hits = [];
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             if (leg.residualKey === undefined)
                 continue;
             const pairs = await resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal);
@@ -109,9 +116,9 @@ export function createAdoptionRunner(deps) {
         }
         return rows;
     }
-    async function runLegs(exec, fromPrincipal, toPrincipal) {
+    async function runLegs(exec, legs, fromPrincipal, toPrincipal) {
         const out = [];
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             if (leg.kind === "blob-rewrite") {
                 out.push({ store: leg.leg, action: leg.action, rows: await runBlobLeg(exec, leg, fromPrincipal, toPrincipal) });
                 continue;
@@ -163,9 +170,9 @@ export function createAdoptionRunner(deps) {
     function parseConfigs(row) {
         return AdoptionConfigsSchema.parse(JSON.parse(row.configsJson));
     }
-    async function countResidual(exec, fromPrincipal, toPrincipal) {
+    async function countResidual(exec, legs, fromPrincipal, toPrincipal) {
         const byTable = new Map();
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             const slot = byTable.get(leg.table) ?? { match: new Set() };
             if (leg.kind === "blob-rewrite")
                 slot.blob = leg;
@@ -177,7 +184,7 @@ export function createAdoptionRunner(deps) {
             byTable.set(leg.table, slot);
         }
         for (const [table, slot] of byTable) {
-            const encodings = new Set(REBIND_LEGS.filter((l) => l.table === table && l.kind !== "blob-rewrite").map((l) => l.encoding));
+            const encodings = new Set(legs.filter((l) => l.table === table && l.kind !== "blob-rewrite").map((l) => l.encoding));
             if (encodings.size > 1) {
                 throw new Error(`adoption: table ${table} carries identity axes in more than one encoding (${[...encodings].sort().join(", ")}) — the residual count binds ONE value pair across the OR'd columns, so it would silently under-report. Split the count per encoding before adding such a leg.`);
             }
@@ -255,7 +262,10 @@ export function createAdoptionRunner(deps) {
         if (row.state === "rejected")
             return rejectedOutcome(row);
         if (row.state === "in_flight" && row.phase === ADOPTION_PHASE.INTENT) {
-            const unrepresentable = await unrepresentableScopes(conn, row.fromPrincipal, row.toPrincipal);
+            const plan = await planLegs(conn);
+            if (plan.missing.length > 0)
+                return { kind: "tables_missing", adoptionId: row.adoptionId, tables: [...plan.missing] };
+            const unrepresentable = await unrepresentableScopes(conn, plan.legs, row.fromPrincipal, row.toPrincipal);
             if (unrepresentable.length > 0) {
                 const detail = JSON.stringify({
                     detail: `the destination principal cannot be represented in every derived key: ${unrepresentable.join("; ")}`,
@@ -264,14 +274,14 @@ export function createAdoptionRunner(deps) {
                 await store.finalizeRejected(row.adoptionId, "adoption.destination_unrepresentable", detail, now(), conn);
                 return rejectedOutcome(await reread());
             }
-            const conflicts = await preflight(conn, row.fromPrincipal, row.toPrincipal);
+            const conflicts = await preflight(conn, plan.legs, row.fromPrincipal, row.toPrincipal);
             if (conflicts.length > 0) {
                 const detail = JSON.stringify({ detail: "destination already holds rows sharing a logical key with the source", conflicts });
                 await store.finalizeRejected(row.adoptionId, "adoption.destination_conflict", detail, now(), conn);
                 return rejectedOutcome(await reread());
             }
             try {
-                await store.rebindOn(conn, row.adoptionId, ADOPTION_PHASE.INTENT, ADOPTION_PHASE.REBOUND, now(), (exec) => runLegs(exec, row.fromPrincipal, row.toPrincipal), (legs) => JSON.stringify(legs));
+                await store.rebindOn(conn, row.adoptionId, ADOPTION_PHASE.INTENT, ADOPTION_PHASE.REBOUND, now(), (exec) => runLegs(exec, plan.legs, row.fromPrincipal, row.toPrincipal), (legs) => JSON.stringify(legs));
             }
             catch (err) {
                 if (!isDupKey(dialect, err))
@@ -315,7 +325,8 @@ export function createAdoptionRunner(deps) {
     }
     async function sweepLate(row, conn) {
         try {
-            const legs = await store.sweepOn(conn, (exec) => runLegs(exec, row.fromPrincipal, row.toPrincipal));
+            const { legs: present } = await planLegs(conn);
+            const legs = await store.sweepOn(conn, (exec) => runLegs(exec, present, row.fromPrincipal, row.toPrincipal));
             const moved = legs.reduce((n, l) => n + (l.rows ?? 0), 0);
             if (moved > 0) {
                 deps.logger?.warn?.("adoption_late_rows_swept", {
@@ -332,7 +343,8 @@ export function createAdoptionRunner(deps) {
     }
     async function residualOf(row, exec = store.reader) {
         try {
-            return await countResidual(exec, row.fromPrincipal, row.toPrincipal);
+            const { legs } = await planLegs(exec);
+            return await countResidual(exec, legs, row.fromPrincipal, row.toPrincipal);
         }
         catch (err) {
             deps.logger?.warn?.("adoption_residual_count_failed", { adoptionId: row.adoptionId, error: msgOf(err) });
@@ -403,6 +415,14 @@ export function createAdoptionRunner(deps) {
                         stalled.push(out.adoptionId);
                         deps.logger?.warn?.("adoption_resume_unexpected_outcome", { adoptionId: out.adoptionId, kind: out.kind });
                         break;
+                    case "tables_missing":
+                        stalled.push(out.adoptionId);
+                        deps.logger?.warn?.("adoption_resume_tables_missing", {
+                            adoptionId: out.adoptionId,
+                            tables: out.tables,
+                            note: "this deployment wires an optional store whose table is absent from the database — restart a replica (its boot creates missing tables) and the arc continues",
+                        });
+                        break;
                     case "receipt":
                         if (out.receipt.status === "adopted")
                             resumed.push(out.adoptionId);

package/dist/adoption/wire.d.ts

@@ -71,10 +71,10 @@ export declare const NOT_MIGRATED_FACES: readonly ["usage-window", "cost-quota",
 export type NotMigratedFace = (typeof NOT_MIGRATED_FACES)[number];
 export declare const AdoptionNotMigratedSchema: z.ZodObject<{
     face: z.ZodEnum<{
-        "org-delivery-quota": "org-delivery-quota";
         "usage-window": "usage-window";
         "cost-quota": "cost-quota";
         "rate-limit": "rate-limit";
+        "org-delivery-quota": "org-delivery-quota";
         "approval-exemption-grantor": "approval-exemption-grantor";
         "approval-ask-decision-actor": "approval-ask-decision-actor";
         "image-bake-requested-by": "image-bake-requested-by";
@@ -120,10 +120,10 @@ export declare const AdoptionReportSchema: z.ZodObject<{
     }, z.core.$strict>>;
     notMigratedByDesign: z.ZodArray<z.ZodObject<{
         face: z.ZodEnum<{
-            "org-delivery-quota": "org-delivery-quota";
             "usage-window": "usage-window";
             "cost-quota": "cost-quota";
             "rate-limit": "rate-limit";
+            "org-delivery-quota": "org-delivery-quota";
             "approval-exemption-grantor": "approval-exemption-grantor";
             "approval-ask-decision-actor": "approval-ask-decision-actor";
             "image-bake-requested-by": "image-bake-requested-by";
@@ -182,10 +182,10 @@ export declare const AdoptionReceiptSchema: z.ZodObject<{
         }, z.core.$strict>>;
         notMigratedByDesign: z.ZodArray<z.ZodObject<{
             face: z.ZodEnum<{
-                "org-delivery-quota": "org-delivery-quota";
                 "usage-window": "usage-window";
                 "cost-quota": "cost-quota";
                 "rate-limit": "rate-limit";
+                "org-delivery-quota": "org-delivery-quota";
                 "approval-exemption-grantor": "approval-exemption-grantor";
                 "approval-ask-decision-actor": "approval-ask-decision-actor";
                 "image-bake-requested-by": "image-bake-requested-by";

package/dist/approval-card.d.ts

@@ -83,17 +83,17 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"single">;
     rule: z.ZodString;
     match: z.ZodEnum<{
-        host: "host";
         name: "name";
         path: "path";
-        tool: "tool";
-        pattern: "pattern";
+        host: "host";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
+        pattern: "pattern";
         subpath: "subpath";
         name_prefix: "name_prefix";
         subdomain: "subdomain";
+        tool: "tool";
     }>;
     command: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
@@ -102,17 +102,17 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"command">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            host: "host";
             name: "name";
             path: "path";
-            tool: "tool";
-            pattern: "pattern";
+            host: "host";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
+            pattern: "pattern";
             subpath: "subpath";
             name_prefix: "name_prefix";
             subdomain: "subdomain";
+            tool: "tool";
         }>;
         command: z.ZodString;
         segment: z.ZodString;
@@ -379,7 +379,7 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  *    (成员表取 core 常量;core 的 `resumeStartupCauseOf` 从失败的**码**读出)。读者:`parked-decide.ts` 的 422 `parked_resume.startup_failed` 体(`cause`)。
  *    回执没说 ⇒ 缺席(不计数,「分不出」是一等状态);集外词 / 非串 ⇒ 按缺席(键不上 wire)+ 计一次,与卡上的闭集词同一只计数。
  *  · `differs`(core 7.44.0 [ref])—— **载体是引擎拒 steer 重放那只错的 `detail`**(不是 ask 的三个载体之一),值是 core `STEER_REPLAY_FACETS` 的**非空子集**
- *    (core:「恒非空」;筛 = 本文件 {@link isSteerReplayDiffers},成员表取 core 常量)。读者:`runs.ts` 的 409 `steering.duplicate_input_id` 体(`detail.differs`)。
+ *    (core:「恒非空」;筛 = 本文件 {@link isSteerReplayDiffers},成员表取 core 常量)。读者:`runs.ts` 的 409 `steering.duplicate_input_id` 体(根上的 `differs`)。
  *    集外成员 / 空数组 / 非数组 ⇒ 按缺席(不铸 `detail`,码仍是契约)+ 计一次;detail 只报形名(`differs=<array>` —— 数组从不展开成员,见 {@link outOfSetDetail})。
  *
  * 什么时候经本函数 —— 一句话:**筛点在 core;server 只在「读的是持久层原字节、中间没有 core 投影」的地方亲手调 core 的那一只筛**。
@@ -603,17 +603,17 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         kind: z.ZodLiteral<"single">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            host: "host";
             name: "name";
             path: "path";
-            tool: "tool";
-            pattern: "pattern";
+            host: "host";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
+            pattern: "pattern";
             subpath: "subpath";
             name_prefix: "name_prefix";
             subdomain: "subdomain";
+            tool: "tool";
         }>;
         command: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
@@ -622,17 +622,17 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             kind: z.ZodLiteral<"command">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                host: "host";
                 name: "name";
                 path: "path";
-                tool: "tool";
-                pattern: "pattern";
+                host: "host";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
+                pattern: "pattern";
                 subpath: "subpath";
                 name_prefix: "name_prefix";
                 subdomain: "subdomain";
+                tool: "tool";
             }>;
             command: z.ZodString;
             segment: z.ZodString;
@@ -781,17 +781,17 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             kind: z.ZodLiteral<"single">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                host: "host";
                 name: "name";
                 path: "path";
-                tool: "tool";
-                pattern: "pattern";
+                host: "host";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
+                pattern: "pattern";
                 subpath: "subpath";
                 name_prefix: "name_prefix";
                 subdomain: "subdomain";
+                tool: "tool";
             }>;
             command: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
@@ -800,17 +800,17 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 kind: z.ZodLiteral<"command">;
                 rule: z.ZodString;
                 match: z.ZodEnum<{
-                    host: "host";
                     name: "name";
                     path: "path";
-                    tool: "tool";
-                    pattern: "pattern";
+                    host: "host";
                     exact: "exact";
                     prefix: "prefix";
                     wildcard: "wildcard";
+                    pattern: "pattern";
                     subpath: "subpath";
                     name_prefix: "name_prefix";
                     subdomain: "subdomain";
+                    tool: "tool";
                 }>;
                 command: z.ZodString;
                 segment: z.ZodString;
@@ -1054,7 +1054,7 @@ export declare function adoptStoredLiveFacts(frame: ApprovalRequestLiveFacts, se
 /**
  * [ref] §3.1 的呈卡帧(设计稿 §4.1 逐字)。
  *
- * 🔴 **一条腿一个帧族**:呈卡协议在一条腿上场(腿的审批上下文接了 `emitCard`)⇒ 这条腿上一只 ask 的开卡 / 消卡 / 撤卡只走本族
+ * 🔴 **一条腿一个帧族**:呈卡协议在一条腿上场(腿的审批上下文族词 `approval_request`)⇒ 这条腿上一只 ask 的开卡 / 消卡 / 撤卡只走本族
  * (`approval_request` / {@link ApprovalCompleteFrame} / {@link ApprovalRevokeFrame}),旧族 `tool_approval` / `tool_approval_complete`
  * 一帧都不发;协议未上场的腿只发旧族。同一只 ask 在同一条腿上不再有两种开卡帧,消费方不再按 `approvalId` 去重。
  * 开卡的全部事实因此在本帧上:卡(`card`,耐久信封)+ 活面事实座({@link ApprovalRequestLiveFacts};活铸帧与重放帧同一份,见 {@link APPROVAL_REQUEST_LIVE_FACT_KEYS} 顶注)。
@@ -1096,8 +1096,8 @@ export interface ApprovalRequestFrame extends ApprovalRequestLiveFacts {
  * 不带逐卡终局);本帧是**单卡**的终局(人答 / 窗到期 / park 路由 / 取消 …)。同一只 ask 两帧都可能收到(被撤的兄弟自己的
  * 登记也按 settle 收场)—— 按 `askId` 清卡即可,两帧不冲突。
  *
- * 投递口 = 开卡帧的同一只口(`ToolApprovalRunContext.emitCard`):卡帧在哪,消卡帧就在哪(sync 腿 live + detach 账本,bg / resume 腿账本)。
- * 门 = 这条连接的**开卡帧真的送达过**(没见过开卡帧的连接收到消卡帧就是孤儿 close,与旧族同一条门)。
+ * 投递 = 开卡帧的同一只腿传输(`hitl-delivery.ts`:先本 run 账本、再直写 —— sync 腿有 durable run 行时两只都有,bg / resume 腿只有账本)。
+ * 门 = 这条连接上**接下过开卡帧的那几只 sink**(没见过开卡帧的 sink 收到消卡帧就是孤儿 close,与旧族同一条门;配对在竞速机一处)。
  */
 export interface ApprovalCompleteFrame {
     /** = SSE 具名事件名(同 `approval_request` 约定)。 */
@@ -1124,7 +1124,7 @@ export declare function buildApprovalCompleteFrame(input: {
     parked: boolean;
     nowMs: number;
 }): ApprovalCompleteFrame;
-/** 呈卡腿的单卡帧(开卡 / 消卡)—— `ToolApprovalRunContext.emitCard` 的入参形。 */
+/** 呈卡腿的单卡帧(开卡 / 消卡)—— 呈卡族腿传输收的单卡帧形(另一只是批级撤卡帧)。 */
 export type ApprovalCardLegFrame = ApprovalRequestFrame | ApprovalCompleteFrame;
 /**
  * [ref] §3.3 的**批级撤卡帧**(车6;设计稿 §3 逐字)。
@@ -1134,13 +1134,11 @@ export type ApprovalCardLegFrame = ApprovalRequestFrame | ApprovalCompleteFrame;
  * 那一次原子事务真正翻成 `VOID` 的行集(`expireAsk`/`bindBatch` 的 `voidedSiblings` 返回形),不是
  * 「本批全体」的推断。
  *
- * 🔴 **发射面 = 逐 ctx 分发,durable 腿落账本、sync 腿 live-only**([ref] [ref] 改述;原句「live emit
- * only——reaper/收敛器无 seq 可分配」把**调用点**的约束错安在投递面上):帧恒经 `emitRevokeTo` 交给各
- * ctx 的 `emitRevoke` 钩子,bg/resume 两条 durable 腿的钩子就是本腿账本的 `append`(seq 由腿的 ledger
- * 链步分配,与帧从哪个调用点来无关),于是「卡帧在哪个账本、撤帧就在哪个账本」逐 ctx 自洽;sync 腿的
- * 钩子仍是 live SSE 写(行为零变)。丢帧(ctx 已退场/append 失败)的结构补偿不变 = 172 §3.1 的
- * 「preamble 是壳侧卡集**全量对账基准**,不在基准内的一律清」——壳重连时的 preamble 本身就会让一张
- * 没收到撤卡帧的僵尸卡消失;账本里重放的撤帧只用于时间线渲染,不是卡集基准。
+ * 🔴 **发射面 = 逐 ctx 分发,经该腿那一只传输**(与开卡帧同一条律:先本 run 账本、再直写;账本落不下 ⇒ 这一帧不上直写):
+ * 帧恒经 `emitRevokeTo` 交给各呈卡族 ctx 的传输,seq 由该腿账本链步分配(与帧从哪个调用点来无关),于是「卡帧在哪个账本、撤帧就在
+ * 哪个账本」逐 ctx 自洽;三条腿(sync 腿有 durable run 行时)都落账本。账本里的序 = **入链序**:陈旧快照的竞态窄窗里撤帧可以先于它
+ * 点名的卡行入链 —— 消费方按 `askIds` 幂等应用(`batchId` 不是事件身份:取消对同批每只问各发一帧)。丢帧(ctx 已退场 / 账本写失败)
+ * 的结构补偿不变 = 172 §3.1 的「preamble 是壳侧卡集**全量对账基准**,不在基准内的一律清」;账本里重放的撤帧只用于时间线渲染,不是卡集基准。
  *
  * v1 **不带 per-ask 终态**(§7-4 裁定):中选者另有 `PARKED` 的下行面(410 体 + 重放消失),壳按
  * `askIds` 清卡即可。

package/dist/approval-gate-currency.js

@@ -97,14 +97,15 @@ function isReopenReason(word) {
     return typeof word === "string" && REOPEN_REASONS.includes(word);
 }
 function openReading(checkpoint, gateBoundCallId) {
+    const generation = checkpointRevOf(checkpoint);
     const reason = checkpoint.reopenReason;
     if (!isReopenReason(reason))
-        return { kind: "open" };
+        return { kind: "open", generation };
     const prior = decisionReading(checkpoint, gateBoundCallId);
     const reopened = prior.kind === "decided"
         ? { reason, decision: prior.decision, decidedAtMs: prior.decidedAtMs, ...(prior.decisionNote !== undefined ? { decisionNote: prior.decisionNote } : {}) }
         : { reason };
-    return { kind: "open", reopened };
+    return { kind: "open", generation, reopened };
 }
 export function createParkedGateRead(cs) {
     return async ({ gateToken, gateBoundCallId }) => {

package/dist/approval-reconciler.d.ts

@@ -176,19 +176,10 @@ export interface ReconcileStats {
     /**
      * 祖先冻结 approver 层 fold 中途铸点([ref] 件1④):退出硬相等,不是 mismatch 也不是单铸。
      *
-     * 🔴 **今天恒零,而且是结构性的**(扫描P2,2026-08-12 亲读验真;登记而不假称已解):读口
-     * `findCheckpointCandidatesForAsk` 按 `session_id = ask.sessionId` 查,`session_id` 列写的是
-     * `cp.sessionId`,而 core 每个 checkpoint 铸点都填 `sourceSessionId: sessionId`
-     * (`runner/prepare-task.js` 四处;`checkpoint-store.d.ts` 逐字「= sessionId at the mint」)⇒ 读口
-     * 返回的候选恒满足 `c.sourceSessionId === ask.sessionId`;而判据 1 命中要 `c.sourceSessionId ===
-     * ask.sourceSessionId`,祖先层否决要 `ask.sourceSessionId !== ask.sessionId` —— 两者互斥,这一臂在生产
-     * 接线下一次也不会被返回。
-     *
-     * 所以**别把零读数当健康信号**(与 {@link unmatchableNoHash} 的「恒零才是健康态」正相反:那条能非零,
-     * 这条不能)。根因是本文件 `reconcileOne` 里已登记的读口 session 维缺口(委派腿的候选压根进不来),
-     * 修它需要自带判据 + 真 checkpoint 店的宿主/子代双 session 端到端钉,不在扫描批的口径内。
-     * 否决臂**不删**:它是纯减法的安全臂,读口一修好就重新承重。结构事实的钉:
-     * `test/approval-reconciler.test.ts` 的「扫描P2 ④ 结构钉」(翻转钉——读口修好那天它会变红)。
+     * 读口按停车行所在的会话(`ask.sourceSessionId`)查,委派子代那条腿的停车行因此进得了候选集 ⇒ 这一臂在生产接线下**承重**:
+     * 祖先层那一次铸的问(行上 `parent_tool_call_id` 为 NULL、`sourceSessionId` 是子代的会话)读得到子代那只停车行,身份与摘要都可能
+     * 对得上,这里把它拦下(非零读数 = 本来会 bind、被这条裁定拦下的行)。结构事实的钉:`test/approval-reconciler.test.ts` 的
+     * 「扫描P2 ④ 翻面」(真 checkpoint 店:读口喂得出触发它的候选)。
      */
     ancestorFoldMint: number;
     parked: number;

package/dist/approval-reconciler.js

@@ -88,7 +88,7 @@ export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
     const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
     let gateMatch;
     if (checkpoints && !irreversibleBatch && !expired()) {
-        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
+        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sourceSessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
         gateMatch = classifyGateMatch(ask, candidates);
         if (gateMatch.kind === "hash_mismatch") {
             warn("approval_reconcile_hash_mismatch", {
@@ -177,7 +177,7 @@ export function createApprovalReconciler(deps) {
     const bindCommittedPark = async (calls) => {
         const deadlineMs = Date.now() + budgetMs;
         const work = (async () => {
-            const rows = await askStore.listParkingBySession(calls.sessionId);
+            const rows = await askStore.listParkingBySourceSession(calls.sessionId);
             for (const ask of rows) {
                 if (!calls.toolCallIds.includes(ask.toolCallId))
                     continue;

package/dist/approval.d.ts

@@ -151,7 +151,7 @@ export declare function buildForceDurableGateInertNotice(input: {
 export interface DurableAskOptions extends ApprovalListsView {
     autoBudget?: number;
     /** 本会话的「本会话放行」读面(server 的会话豁免店,键 = 会话 × wire 工具名)。缺席 = 这条腿没有会话 / 没有店 ⇒ 名单门照问。 */
-    exemption?: DeploymentListExemption;
+    exemption?: SessionExemptionRead;
 }
 /** 三张运维名单(一只调用由哪一张说话)的入参 —— 名单门与「问的属主」读法同读这一份。 */
 export interface ApprovalListsView {
@@ -181,24 +181,26 @@ export declare function createApprovalListVerdict(lists: ApprovalListsView): (ca
  */
 export declare function deploymentListAsks(config: Pick<GateIntentView, "approvalRequire" | "approvalDeny" | "approvalNeverAuto">, call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
 /**
- * 名单门的「本会话放行」读面:本会话的豁免店读一次 + server 自己的审计行。名单的问是 server 铸的,它的站着的答案记在 server 的
- * 会话豁免店(活卡的 `allow_session` 与耐久 `/decide` 的 `remember:"session"` 写同一只店),名单门在出问**之前**读它。
+ * 策略层「本会话放行」读面:本会话的豁免店读一次 + server 自己的审计行。策略层的两道门 —— 部署名单门与 workflow 问句门 —— 问的都是 server 自己铸的问,
+ * 它们的站着的答案记在 server 的会话豁免店(活卡的 `allow_session` 与耐久 `/decide` 的 `remember:"session"` 写同一只店),两道门都在出问**之前**读它。
  */
-export interface DeploymentListExemption {
-    /** 这只工具(wire 名)在本会话有没有豁免行。有界、fail-closed:读抛 / 超时 ⇒ `false`(照问,人多看一张卡)。 */
+export interface SessionExemptionRead {
+    /** 这只工具(wire 名)在本会话有没有豁免行。有界、fail-closed:读抛 / 超时 / 答非 `true` ⇒ `false`(照问,人多看一张卡)。 */
     readonly has: (toolName: string) => Promise<boolean>;
-    /** 名单门因为豁免行没出问 —— server 自己的审计行(宿主豁免;不是人答的、不是策略代答的、没有记住任何东西)。 */
+    /** 门因为豁免行没出问 —— server 自己的审计行(宿主豁免;不是人答的、不是策略代答的、没有记住任何东西)。 */
     readonly onExempted: (toolName: string) => void;
 }
+/** 策略层读豁免店的读位(闭集;审计行与读失败告警的 `seat` 字段):部署名单门 / workflow 问句门。审批席自己的读不经这只铸点(`seat: "approval_seat"`,见 `tool-approval.ts` 的 `durableGrantHas`)。 */
+export type SessionExemptionReadSeat = "deployment_list" | "workflow_gate";
 /**
- * 名单门豁免读面的**唯一**铸点(HTTP 腿 `resolve-spec` 与 park 赎回腿 `parked-revive-gate` 两处装配都经它):键 = 会话 × wire 工具名
- * (与活卡 `allow_session` / `/decide` remember 写下的键同形)。审计事件名 {@link APPROVAL_EXEMPTED_EVENT},字段只有会话、工具与读位
- * `seat: "deployment_list"`(审批席自己那一行是 `seat: "approval_seat"`)。读的期限与审批席读同一只店的期限同值。
+ * 策略层会话豁免读面的**唯一**铸点(部署名单门的两处装配 —— HTTP 腿 `resolve-spec` 与 park 赎回腿 `parked-revive-gate` —— 与 workflow 问句门都经它):
+ * 键 = 会话 × wire 工具名(与活卡 `allow_session` / `/decide` remember 写下的键同形)。审计事件名 {@link APPROVAL_EXEMPTED_EVENT},字段只有会话、工具与读位 `seat`
+ * ({@link SessionExemptionReadSeat};审批席自己那一行是 `seat: "approval_seat"`)。读的期限与审批席读同一只店的期限同值;判 `=== true`(真值不放行)。
  */
-export declare function createDeploymentListExemption(store: Pick<ApprovalExemptionStore, "has">, sessionId: string, logger: {
+export declare function createSessionExemptionRead(store: Pick<ApprovalExemptionStore, "has">, sessionId: string, logger: {
     info(event: string, fields?: Record<string, unknown>): void;
     warn(event: string, fields?: Record<string, unknown>): void;
-}, leg?: "parked_revive"): DeploymentListExemption;
+}, seat: SessionExemptionReadSeat, leg?: "parked_revive"): SessionExemptionRead;
 /**
  * **每腿自动批额度的审批人名**(本仓闭词;core `AskOutcome.approver` 契约逐字「a closed word the host owns, never a person」)。
  * 结算记录读 `policy_allowed` / `who.party: "policy"` / `who.approver` = 本词 —— 审计读者按它认出「这一次放行是部署的自动批额度答的」,

package/dist/approval.js

@@ -100,7 +100,7 @@ export function createApprovalListVerdict(lists) {
 export function deploymentListAsks(config, call) {
     return createApprovalListVerdict({ requireApproval: config.approvalRequire, deny: config.approvalDeny, neverAuto: config.approvalNeverAuto })(call).list === "require";
 }
-export function createDeploymentListExemption(store, sessionId, logger, leg) {
+export function createSessionExemptionRead(store, sessionId, logger, seat, leg) {
     const where = { sessionId, ...(leg !== undefined ? { leg } : {}) };
     return {
         has: async (toolName) => {
@@ -113,7 +113,7 @@ export function createDeploymentListExemption(store, sessionId, logger, leg) {
                 return (await Promise.race([store.has(sessionId, toolName), deadline])) === true;
             }
             catch (err) {
-                logger.warn("session_grant_read_failed", { ...where, toolName, seat: "deployment_list", error: String(err).slice(0, 200) });
+                logger.warn("session_grant_read_failed", { ...where, toolName, seat, error: String(err).slice(0, 200) });
                 return false;
             }
             finally {
@@ -121,7 +121,7 @@ export function createDeploymentListExemption(store, sessionId, logger, leg) {
                     clearTimeout(timer);
             }
         },
-        onExempted: (toolName) => logger.info(APPROVAL_EXEMPTED_EVENT, { ...where, toolName, seat: "deployment_list" }),
+        onExempted: (toolName) => logger.info(APPROVAL_EXEMPTED_EVENT, { ...where, toolName, seat }),
     };
 }
 function createNameSetMatcher(names) {

package/dist/audit.d.ts

@@ -2,6 +2,7 @@ import { type StoredPromptEpoch } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type LocalSessionRows } from "./plugins/local-session-window.js";
+import type { Subject } from "./owner-brands.js";
 /**
  * Audit view of a session = its **current context** (the live messages + the last compaction's
  * summary), i.e. the floor-bounded window — never the full raw transcript. This matches the
@@ -38,10 +39,10 @@ export type RewindHandles = ReadonlyMap<string, string>;
 /** 会话视图读口(`ServiceDeps.sessionAudit`)的读者参数:`reader` = 读这张视图的**已验身份**(无身份 = `null`)。给了 ⇒ 这是一次**视图读**:用户消息行投回退手柄、体顶层投 `agent`(`session-agent.ts` 的 `readSessionAgent`);
  *  不给(只要归属的调用方:memory-status / 自助抹除)⇒ 两样投影的读都不付。 */
 export interface SessionAuditReadOpts {
-    readonly reader: string | null;
+    readonly reader: Subject | null;
 }
 /**
- * {@link RewindHandles} 的唯一铸点。一条规则:**一只用户条目带手柄,当且仅当锚店里恰好一行 `entry_id` = 它、`owner` = 读者** ——
+ * {@link RewindHandles} 的唯一铸点。一条规则:**一只用户条目带手柄,当且仅当锚店里恰好一行 `entry_id` = 它、`owner` = 读者**(存储键的桥 `owner-faces.ts` 的 `sameKey`:锚属主经 `ownerKeyOf` 成键,null 只同 null)——
  * 这正是 `resumeAt` 解析的谓词(`resolve(sessionId, eventId, owner)`:同会话、同 event、属主 null-safe 相等),所以行上出现的手柄
  * 读者拿去回退一定解得出;别人的锚(混属主会话)不投,同一条目被两行锚点名不挑(两只都缺席,不猜)。老条目没有锚 ⇒ 缺席。
  * E18 助手文本锚(按 live eventId 键入,指向助手条目)也在锚店里 —— 它们只会点名助手条目,投影只看用户行,所以不上 wire。
@@ -50,7 +51,7 @@ export declare function buildRewindHandles(anchors: ReadonlyArray<{
     readonly eventId: string;
     readonly entryId: string;
     readonly owner: string | null;
-}>, reader: string | null): RewindHandles;
+}>, reader: Subject | null): RewindHandles;
 /** Build the audit view from the durable log. Returns undefined if the session does not exist. `handles` = the reader's
  *  rewind-handle projection ({@link buildRewindHandles}); absent ⇒ no `taskId` keys. */
 export declare function buildSessionAudit(pool: Pool, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
@@ -63,6 +64,12 @@ export declare function buildSessionAuditPg(pool: PgPool, sessionId: string, han
  *  floor — and on every backend that is what the run reads: the SQL twins' run wakes the same window; the local run wakes the whole
  *  tree, and the local window is cut from that tree's branch, with the anchor walking the branch below the floor. */
 export declare function buildSessionAuditLocal(rows: LocalSessionRows, sessionId: string, handles?: RewindHandles): Promise<SessionAudit | undefined>;
+/**
+ * 🔴 **历史读面过脱敏的叶名表**(能力位 `sessionReadRedaction` 的唯一来源)= {@link SESSION_READ_SHAPES} 里处置词不是 `"verbatim"` 的每一叶,写作 `<形>.<键>`(表序)。
+ * 不在表里的叶是**逐字**的(人写的输入、标识 / join 键、闭集词、数字);表外的键 / 角色 / 段类型整只深扫、从不放行,不进名单(名单只列表上登记过的叶)。
+ * `"parts"` 叶(`assistant.content` / `toolResult.content` / `attachmentFrame.content`)按段表读:文本段 / reasoning 段 / 工具实参脱,图片 / 文档字节与签名逐字。
+ */
+export declare const SESSION_READ_REDACTED_LEAVES: readonly string[];
 /**
  * 🔴 **会话视图的读面口 —— `GET /v1/sessions/:id` 的全部取法(整读 / `?tail` / `?before` / `?blobCap` / `?message=N`)共用这一只**。
  * 次序 = **选 → 脱 → 截**(路由 `http/routes/sessions.ts`):整条消息的选窗不切字符串,先选窗不改任何一条的脱敏读数、只把脱敏的量降到选中的那几条;

package/dist/audit.js

@@ -6,10 +6,11 @@ import { redactModelText } from "./observability/run-terminal.js";
 import { redactDeepWith } from "./trace/redact.js";
 import { projectToolStructured } from "./trace/tool-output-media.js";
 import { INJECTED_BLOCK_RE, isAttachmentFrame } from "./user-authored-text.js";
+import { ownerKeyOf, sameKey } from "./owner-faces.js";
 export function buildRewindHandles(anchors, reader) {
     const byEntry = new Map();
     for (const a of anchors) {
-        if ((a.owner ?? null) !== reader)
+        if (!sameKey(reader, ownerKeyOf(a.owner ?? null)))
             continue;
         byEntry.set(a.entryId, byEntry.has(a.entryId) && byEntry.get(a.entryId) !== a.eventId ? null : a.eventId);
     }
@@ -144,14 +145,21 @@ const MESSAGE_READ_TREATMENT = {
     },
 };
 const ATTACHMENT_FRAME_READ_TREATMENT = { ...MESSAGE_READ_TREATMENT.user, content: "parts" };
+const SESSION_READ_SHAPES = { ...MESSAGE_READ_TREATMENT, attachmentFrame: ATTACHMENT_FRAME_READ_TREATMENT };
+export const SESSION_READ_REDACTED_LEAVES = Object.freeze(Object.entries(SESSION_READ_SHAPES).flatMap(([shape, table]) => Object.entries(table)
+    .filter(([, treatment]) => treatment !== "verbatim")
+    .map(([key]) => `${shape}.${key}`)));
+function shapeOf(m) {
+    const role = m.role;
+    if (role === "user" && isAttachmentFrame(m))
+        return "attachmentFrame";
+    return typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role) ? role : undefined;
+}
 function readMessage(m) {
     if (isPlainRecord(m)) {
-        const role = m.role;
-        if (role === "user" && isAttachmentFrame(m))
-            return readByTable(m, ATTACHMENT_FRAME_READ_TREATMENT);
-        if (typeof role === "string" && Object.hasOwn(MESSAGE_READ_TREATMENT, role)) {
-            return readByTable(m, MESSAGE_READ_TREATMENT[role]);
-        }
+        const shape = shapeOf(m);
+        if (shape !== undefined)
+            return readByTable(m, SESSION_READ_SHAPES[shape]);
     }
     return deepScrub(m);
 }