@sema-agent/server 7.148.0 → 7.149.0

package/dist/http/route-ctx.d.ts

@@ -36,6 +36,7 @@ import type { RootedTaskSpec } from "./execution-context.js";
 import type { GateCommitment, GateSettlementEvidence } from "../gate-settlement.js";
 import type { ResumeRestatement } from "./resume-restatement.js";
 import type { RememberLaneCannotRecord } from "../parked-decide.js";
+import type { RowWayOut } from "./resume-legs.js";
 import type { KeyCaller } from "../owner-faces.js";
 import type { Subject } from "../owner-brands.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
@@ -291,6 +292,11 @@ export interface DriveResumeArgs {
         sessionId: string;
         ctx: CheckpointCtx;
     };
+    /**
+     * 判官判本引擎续不了这条腿要续的那张卡时,这张卡的出路(`resume-legs.ts` 的 `rowWayOutOf`;判 `ok` / 说不出 ⇒ 缺席)。`/plan_review` 与 `/resume` 在驱动前对载入行求它;
+     * catch 臂在引擎的拒留卡 pending(处置 `retriable`)时把它作 `wayOut` 加进拒体 —— 引擎的拒原样不改(码、`field`、`blockedBy`、`thrownName`、诊断都在)。
+     */
+    rowWayOut?: RowWayOut;
     /**
      * 这条续跑的**宿主租约**(续跑漏斗 `resolveResumeSpecOrBlocked` 开、装配在它之下登记对端声明;调用方作用域的 `finally` 放)。
      * 驱动腿经 `heldFor(args.peerLease, () => driveResumeLeg(…))` 自持一只:受理早回的那一形里,腿活过调用方作用域,自己落定才放。

package/dist/http/routes/a2a-serve.js

@@ -311,6 +311,8 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
 function rpcErrorFromRefusedReceipt(receipt) {
     const code = receipt.body?.errorCode;
     const head = `the serving deployment did not accept this submission (it answered ${receipt.status}${typeof code === "string" ? ` ${code}` : ""})`;
+    if (receipt.status >= 500)
+        return new RpcError(JSONRPC_INTERNAL_ERROR, `${head}; the failure is on the serving side and nothing was started, so the same message can be sent again later`);
     if (isActiveRunConflictBody(receipt.body))
         return new RpcError(JSONRPC_INVALID_PARAMS, `${head}; a session already running a turn must finish or be cancelled before the next message on the same contextId`);
     if (isRunExistsConflictBody(receipt.body))

package/dist/http/routes/approvals-assistant.js

@@ -334,10 +334,11 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
+            const livePending = deps.toolApproval ? await deps.toolApproval.listLivePending(scope) : undefined;
             sendJson(res, 200, {
                 pending,
                 serverNowMs: Date.now(),
-                ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
+                ...(livePending !== undefined ? { livePending } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
             });
             return;
@@ -1122,7 +1123,7 @@ export async function streamApprovals(req, res, cs, live, peerInbound, sessions,
         let snapshot;
         try {
             const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions)), ...(peerInbound?.() ?? [])];
-            snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
+            snapshot = { pending, livePending: live ? await live.listLivePending(scope) : [] };
         }
         catch (err) {
             const failure = approvalsReadFailureOf(err);

package/dist/http/routes/capabilities.js

@@ -299,7 +299,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 supportsThinkingOff: thinkingOffSpelled(m),
-                ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
+                ...(m.contextWindow ? { contextWindow: m.contextWindow, ...(Object.hasOwn(deps.config.contextWindowSources, name) ? { contextWindowSource: deps.config.contextWindowSources[name] } : {}) } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),

package/dist/http/routes/diagnostics.d.ts

@@ -86,7 +86,9 @@ export interface StaticWiringFacts {
  *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
  *     park,窗到期依旧无降级目的地。
  *  ② 会话店持久性:manifest 声明 `declared_durable`,而会话店的介质(店持久性判定里的**数据根**那一行:SQL 两方言 = 委托给库、local = 数据根所在挂载、
- *     没有后端 = 内存)判为 `ephemeral` ⇒ 「替换后还在」的声明没有介质兑现 ⇒ 拒启 `config.store_not_durable`(拒句逐根列三根判定 + 两条出路)。
+ *     没有后端 = 内存)判为 `ephemeral` ⇒ 「替换后还在」的声明没有介质兑现 ⇒ 拒启 `config.store_not_durable`(拒句逐根列三根判定 + 三条出路)。
+ *     local 店的声明不是常量:它由 `local-store-declaration.ts` 的唯一读者定(运维声明 `LOCAL_STORE_DURABILITY=ephemeral`,或店落在调用方自己那块易失盘上 ⇒
+ *     会话店与检查点店两半一起声明 `process-local`)—— 那时清单读 `process_local`,本条恒过,改出 warn 一行(带依据与挂卷出路;同一件事 park 那条不再另说)。
  *     介质判不出(`unknown`:非 Linux / 挂载表读不到 / 介质形不在规则表里)⇒ 只 warn —— 判不了的部署不能因自报位停机;
  *     数据根持久而另两根(封签钥匙目录 / file 记忆根)易失或判不出 ⇒ 也只 warn:会话店的声明兑现了,掉的是停驻行的封签钥匙 / 记忆,不是会话(能力位如实报最弱)。
  *     声明不是 `declared_durable` ⇒ 恒过。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。

package/dist/http/routes/diagnostics.js

@@ -8,6 +8,7 @@ import { gatedPerson, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincip
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { STORE_NOT_DURABLE_CODE, StoreNotDurableError, describeStoreRoot, projectStoreDurabilityWiring, unwiredStorePosture } from "../../store-posture.js";
+import { describeLocalStoreDeclaration } from "../../local-store-declaration.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
@@ -44,6 +45,21 @@ export function buildServerWiringGates(input) {
         approvalGrant: [...input.approvalGrant],
     };
 }
+function processLocalMediumSentence(dataRoot, aggregate, listed) {
+    const readFaces = `Store durability by root: ${listed}; GET /v1/capabilities store.durability and /health.store.durability say "${aggregate}" (the weakest root).`;
+    switch (dataRoot) {
+        case "ephemeral":
+            return `The data root's medium does not survive a replacement either — sessions and parked approvals on it go with the next replacement. ${readFaces}`;
+        case "durable":
+            return `The data root's medium measures durable today — the declaration is what this deployment promises, not what the disk does today. ${readFaces}`;
+        case "unknown":
+            return `This server could not prove whether the data root survives a replacement. ${readFaces}`;
+        default: {
+            const unhandled = dataRoot;
+            throw new Error(`unhandled store durability ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export function buildStaticWiringAudit(facts) {
     const refusals = [];
     const warnings = [];
@@ -58,15 +74,16 @@ export function buildStaticWiringAudit(facts) {
             `A window expiry would then have no degradation target and adjudicate as a fail-closed deny — refusing to start.`);
     }
     let refusalCode;
+    const roots = facts.store.roots;
+    const listed = roots.map((r) => `${describeStoreRoot(r)}`).join("; ");
+    const processLocalDeclaration = facts.store.localDeclaration?.durability === "process-local" ? facts.store.localDeclaration : undefined;
     if (facts.manifest.session.store === "declared_durable") {
-        const roots = facts.store.roots;
         const session = roots.find((r) => r.root === "data");
-        const listed = roots.map((r) => `${describeStoreRoot(r)}`).join("; ");
         if (session === undefined || session.verdict === "ephemeral") {
             refusalCode = STORE_NOT_DURABLE_CODE;
             const wayOut = session?.rule === "backend_memory" || session === undefined
                 ? `No store backend was assembled (env-only worker or a degraded boot) — wire DB_BACKEND=mysql|pg|local, or fix the session store's durability declaration.`
-                : `Two ways out: mount a persistent volume at ${session.path ?? "the data root"} (or point LOCAL_DATA_ROOT at one), or declare this deployment non-durable (DB_BACKEND=memory).`;
+                : `Three ways out: mount a persistent volume at ${session.path ?? "the data root"} (or point LOCAL_DATA_ROOT at one); or declare the local store ephemeral (LOCAL_STORE_DURABILITY=ephemeral — sessions, parked approvals and memory then do not survive a container / Pod replacement); or keep nothing on disk (DB_BACKEND=memory).`;
             refusals.push(`${STORE_NOT_DURABLE_CODE}: the engine's static wiring reports session.store="declared_durable" while the session store's medium does not survive a container / Pod replacement (store durability by root: ${listed}). ` +
                 `A durable declaration on an ephemeral medium is a claim nothing can honor — sessions, parked approvals and memory would vanish with the next replacement while every read face said "durable". Refusing to start. ${wayOut}`);
         }
@@ -74,11 +91,19 @@ export function buildStaticWiringAudit(facts) {
             warnings.push(`store durability is "${facts.store.durability}" (by root: ${listed}). ` +
                 (facts.store.durability === "unknown"
                     ? `This server could not prove that every root survives a container / Pod replacement (no mount evidence for it — not Linux, an unreadable mount table, or a mount shape outside the rule table); GET /v1/capabilities store.durability and /health.store.durability say "unknown". `
-                    : `The session store's medium holds, but a root marked ephemeral does not survive a container / Pod replacement — mount a persistent volume there (SEALED_KEY_DIR / MEMORY_ENGINE_DIR name those directories). `) +
+                    : `The session store's medium holds, but a root marked ephemeral does not survive a container / Pod replacement — mount a persistent volume there (SEALED_KEY_DIR / MEMORY_ENGINE_DIR name those directories). ` +
+                        `A sealing-key directory declared with SEALED_KEY_DIR on such a medium is refused at boot while parked approvals are durable (the parked rows would outlive the key their credentials are sealed to); ` +
+                        `the default <data root>/sealed-key and the file memory root are reported here, not refused. `) +
                 `Per-root detail: GET /v1/diagnostics/wiring storeDurability.roots.`);
         }
     }
-    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
+    else if (processLocalDeclaration !== undefined) {
+        const declaration = processLocalDeclaration;
+        warnings.push(`the local store declares itself process-local (${describeLocalStoreDeclaration(declaration)}): its session store and checkpoint store promise their rows survive a process restart, not a container / Pod replacement. ` +
+            `${processLocalMediumSentence(roots.find((r) => r.root === "data")?.verdict ?? "unknown", facts.store.durability, listed)} ` +
+            `To keep them across replacements, mount a persistent volume at each root above that does not read durable (LOCAL_DATA_ROOT / SEALED_KEY_DIR / MEMORY_ENGINE_DIR point the three roots at one)${declaration.rule === "declared_ephemeral" ? " and unset LOCAL_STORE_DURABILITY" : ""}.`);
+    }
+    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable" && processLocalDeclaration === undefined) {
         warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +
             `(parkLane.checkpointDurability=${JSON.stringify(facts.manifest.parkLane.checkpointDurability ?? null)}). ` +
             `A parked approval survives a restart only on a durable store, and this reading folds "declared process-local" together with "declared nothing" — every in-tree adapter declares "durable", so a non-durable reading here means a store this build does not own. ` +

package/dist/http/routes/principal-inbox.d.ts

@@ -15,10 +15,12 @@
  *
  * 拒绝词 → HTTP 状态(穷举 `switch`,core 加词 ⇒ 编译红):
  *  · `not_member` → 404:「不同 org」「查无此人」「目录答不上来」同一份字节(门保证),404 与本仓反枚举的既有形一致;
- *  · `rate_limited` → 429;
+ *  · `rate_limited` → 429,体带 `retryAfterSec`、头带同值 `Retry-After`(门答案里的那一个数 —— 配额店按店钟算的到当前窗结束的整秒数;本口不再算一遍,
+ *    一个数两个投影,先例 `run-concurrency-cap.ts`);三界(尝试 / 对偶 / 聚合)同一句同一个数,另三只词没有这两样;
  *  · `inbox_full` → 409(收件人那一侧的状态,不是发件人的速率;与 `steering.queue_full` 同档);
  *  · `recipient_tombstoned` → 410(收件人正在被删除,这条路关了)。
  * 门缺席(本部署没声明收件箱消费方)⇒ 501 `capability.unavailable`,能力位 `principalInboxDelivery` 读同一只事实。
+ * 配额店读不出自己的状态 ⇒ 门抛 `OrgDeliveryQuotaUnreadableError`,由 HTTP 兜底(`http/server.ts`)答带因的 500(fail-closed,一封都没投)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";

package/dist/http/routes/principal-inbox.js

@@ -10,7 +10,8 @@ function sendRefusal(res, outcome) {
             sendError(res, 404, "org_delivery.not_member", outcome.message);
             return;
         case "org_delivery.rate_limited":
-            sendError(res, 429, "org_delivery.rate_limited", outcome.message);
+            res.setHeader("retry-after", String(outcome.retryAfterSec));
+            sendError(res, 429, "org_delivery.rate_limited", outcome.message, { retryAfterSec: outcome.retryAfterSec });
             return;
         case "org_delivery.inbox_full":
             sendError(res, 409, "org_delivery.inbox_full", outcome.message);
@@ -19,7 +20,7 @@ function sendRefusal(res, outcome) {
             sendError(res, 410, "org_delivery.recipient_tombstoned", outcome.message);
             return;
         default:
-            return assertNever(outcome.code);
+            return assertNever(outcome);
     }
 }
 export async function handlePrincipalInbox(req, res, match, ctx) {

package/dist/http/routes/runs.js

@@ -6,6 +6,8 @@ import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, valid
 import { isHolderDeathVerdict, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-face.js";
+import { runCancelCardOf } from "../../run-cancel-card.js";
+import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../../card-settle-stored-scope.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -30,6 +32,7 @@ import { assertNever } from "../route-ctx.js";
 import { readRunFace } from "../run-read-face.js";
 import { replayOfExistingRun } from "../submit-replay.js";
 import { mintAndDriveDurableRun } from "../durable-run-leg.js";
+import { SUBMISSION_CLAIM_FACE } from "../execution-context.js";
 import { admitRunById, admitRunRow, enter, runRowAt } from "../owner-access.js";
 import { keyAdmission, ownerCellOf, recoveredSubject } from "../../owner-faces.js";
 import { personOf } from "../../owner-brands.js";
@@ -285,14 +288,13 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         const run = cancelAdmitted.row;
         const rs = runStore;
-        const cancelSuspended = async () => {
+        const cancelSuspended = async (parked) => {
             const cs = deps.checkpointStore;
             let note = "cancelled while suspended (pending approval settled)";
             if (cs) {
-                const token = await cs.findPendingTokenBySession(run.sessionId, undefined, { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" });
+                const token = await runCancelCardOf(cs, run.sessionId);
                 if (token) {
-                    const cp = await cs.get(token);
-                    const won = cp ? await cs.expire(token, cp.scope) : false;
+                    const won = (await expireCardUnderStoredScope(cs, token)) === CARD_EXPIRE_OUTCOME.expired;
                     if (!won) {
                         const now = await rs.getRun(taskId);
                         const st = now?.status;
@@ -326,7 +328,7 @@ export async function handleRuns(req, res, match, ctx) {
             }
             const err = note;
             try {
-                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb" });
+                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb", parkedResult: parked });
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {
@@ -361,7 +363,7 @@ export async function handleRuns(req, res, match, ctx) {
             for (let attempt = 0; !flagged; attempt++) {
                 const now = await runStore.getRun(taskId);
                 if (now !== undefined && isParkedRunStatus(now.status)) {
-                    await cancelSuspended();
+                    await cancelSuspended(now.result);
                     return;
                 }
                 if (now?.status === "running" && attempt < CANCEL_RECLASSIFY_ATTEMPTS) {
@@ -379,7 +381,7 @@ export async function handleRuns(req, res, match, ctx) {
             sendJson(res, 202, { taskId, status: "cancelling", cancelRequested: true });
         }
         else if (isParkedRunStatus(run.status)) {
-            await cancelSuspended();
+            await cancelSuspended(run.result);
         }
         else {
             sendJson(res, 202, { taskId, status: run.status, cancelRequested: run.cancelRequested, note: "run already terminal — cancel is a no-op" });
@@ -1526,6 +1528,7 @@ async function createDurableRunHeld(req, res, ctx, prepared, idem) {
             source,
             identity: runIdentityOf(req, deps.config, prepared.auth?.subject ?? null),
             runSlot,
+            face: SUBMISSION_CLAIM_FACE,
         });
         const receipt = out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
         await prepared.seat.close();

package/dist/http/routes/session-sync.d.ts

@@ -36,16 +36,35 @@ export type PendingStaging = {
     /** The owner cell the gate judged when it opened this staging (head-read reading `headOf(id)?.owner`: `undefined` = no such session) — the commit lands only on
      *  this same cell (`StagedCommitOptions.expectedOwner`, `session-sync-kernel.ts`); `owner` above (the re-stamped importing principal) is derived from it for a fleet caller. */
     expectedOwner: string | null | undefined;
+    /** 开这张暂存时占下的导入租约的键({@link importLeaseKey});续期与放掉都按它,不再从会话 id 重算。 */
+    leaseKey: string;
+};
+/**
+ * 导入租约的键 = 这次导入**落在哪一格属主上**(与提交的属主 CAS 同一格)+ 会话 id。一条读法:
+ *  · id 被占着(活行 ∪ 在删行 —— 「被占着」的唯一读法,门读的 `occupant`)⇒ 落点是住客的属主格(`null` = 无主):所有碰得到这一行的调用方(属主、fleet、存量无主互认)共一把 —— 同一份会话上第二份在飞导入,谁发起的都 409;
+ *  · id 空闲 ⇒ 还没有谁的会话,落点是这位调用方自己将成的属主(`importingPrincipal`):各占各的,先提交者得(提交的属主 CAS 要求那一格仍空着,输的那一份
+ *    在提交前复判被拒)。一个主体的在飞导入既不挡、也不透给另一个主体 —— 租约键不含主体时,空闲 id 上任一主体都能占位,并从 409 读到「此 id 此刻有人在导」。
+ * 键的主体只来自门读的 `occupant` 与 `importingPrincipal`(两者都派生自属主存取器的 `listFilterOf` 与门读的会话面,不另读调用方),且占租约在 `pushGateOk` 之后。
+ */
+export declare function importLeaseKey(landingOwner: string | null, sessionId: string): string;
+/** 一把导入租约:最后活动时刻 + 持有它的暂存 + 它守的会话 id(清扫与运维日志用,不从键里反解)。 */
+export type ImportLease = {
+    at: number;
+    stagingId: string;
+    sessionId: string;
 };
 /** 单域独占状态 + 它的两个操作。每个 server 实例一份。 */
 export interface SessionSyncLocal {
     pendingStagings: Map<string, PendingStaging>;
-    importLeases: Map<string, {
-        at: number;
-        stagingId: string;
-    }>;
-    touchImportLease(sessionId: string): void;
+    importLeases: Map<string, ImportLease>;
+    touchImportLease(leaseKey: string): void;
     cleanupStaging(stagingId: string): void;
+    /** 把闲置 ≥ `staleMs` 的租约连同它的暂存登记一并放掉(`staleMs <= 0` = 关,什么都不清);返回被放掉的(供运维日志)。 */
+    sweepStaleLeases(staleMs: number): Array<{
+        readonly sessionId: string;
+        readonly stagingId: string;
+        readonly ageMs: number;
+    }>;
 }
 export declare function createSessionSyncLocal(): SessionSyncLocal;
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。 */

package/dist/http/routes/session-sync.js

@@ -18,26 +18,44 @@ import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
 import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 import { readSessionPinned, readSessionTitle } from "../../session-row.js";
-import { sessionFaceOfHead } from "../../session-incarnation.js";
+import { deletionHeadReadOf, sessionFaceOfHead } from "../../session-incarnation.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
 import { SessionActiveRunError, SessionForkInProgressError, SessionWriterPresentError } from "../../execution-placement.js";
 import { probeSessionChildren, sessionTenantScope } from "../../session-children-retire.js";
 import { liveChildrenRefusal } from "./background.js";
+export function importLeaseKey(landingOwner, sessionId) {
+    return JSON.stringify([landingOwner, sessionId]);
+}
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
-    const touchImportLease = (sessionId) => {
-        const cur = importLeases.get(sessionId);
+    const touchImportLease = (leaseKey) => {
+        const cur = importLeases.get(leaseKey);
         if (cur)
-            importLeases.set(sessionId, { ...cur, at: Date.now() });
+            importLeases.set(leaseKey, { ...cur, at: Date.now() });
     };
     const cleanupStaging = (stagingId) => {
         const p = pendingStagings.get(stagingId);
         if (p)
-            importLeases.delete(p.realSessionId);
+            importLeases.delete(p.leaseKey);
         pendingStagings.delete(stagingId);
     };
-    return { pendingStagings, importLeases, touchImportLease, cleanupStaging };
+    const sweepStaleLeases = (staleMs) => {
+        if (staleMs <= 0)
+            return [];
+        const now = Date.now();
+        const swept = [];
+        for (const [key, lease] of [...importLeases]) {
+            const ageMs = now - lease.at;
+            if (ageMs < staleMs)
+                continue;
+            swept.push({ sessionId: lease.sessionId, stagingId: lease.stagingId, ageMs });
+            cleanupStaging(lease.stagingId);
+            importLeases.delete(key);
+        }
+        return swept;
+    };
+    return { pendingStagings, importLeases, touchImportLease, cleanupStaging, sweepStaleLeases };
 }
 async function firstPhaseRefusal(sessionStorage, sessionId, relation, consented) {
     if (consented || (relation !== "fork" && relation !== "stale"))
@@ -57,7 +75,7 @@ async function firstPhaseRefusal(sessionStorage, sessionId, relation, consented)
 export async function handleSessionSync(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, readRawBody, safeDecode, rateLimited } = ctx.helpers;
-    const { pendingStagings, importLeases, touchImportLease, cleanupStaging } = ctx.local.sessionSync;
+    const { pendingStagings, importLeases, touchImportLease, cleanupStaging, sweepStaleLeases } = ctx.local.sessionSync;
     {
         {
             const sync = facts.sessionSync(deps);
@@ -77,8 +95,9 @@ export async function handleSessionSync(req, res, match, ctx) {
             }
             const judgeSessionGate = async () => {
                 const face = sessionFaceOfHead(sessionId, await sessionStorage.headOf(sessionId));
-                const mayTouch = face !== undefined && (await judgeSession(syncEntry, sessionStorage, sessionId, face)) !== undefined;
-                return { face, mayPull: mayTouch, mayPush: face === undefined || mayTouch };
+                const held = face ?? sessionFaceOfHead(sessionId, await deletionHeadReadOf(sessionStorage)?.(sessionId));
+                const mayTouch = held !== undefined && (await judgeSession(syncEntry, sessionStorage, sessionId, held)) !== undefined;
+                return { face, occupant: held, mayPull: face !== undefined && mayTouch, mayPush: held === undefined || mayTouch };
             };
             let gate;
             try {
@@ -408,6 +427,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (!payloadVerified)
                         digestSaysDiffer = true;
                 }
+                const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
+                const operatorOk = syncEntry.caller.operator;
                 const placed = gateFace === undefined ? undefined : await sessionStorage.executionPlacement?.read(sessionId);
                 if (placed !== undefined) {
                     switch (placed.cell.role) {
@@ -464,10 +485,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                             return;
                         }
                     }
-                    const opOk = syncEntry.caller.operator;
                     if (deps.sessionPolicyStore) {
                         try {
-                            await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, opOk);
+                            await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, operatorOk);
                         }
                         catch (e) {
                             if (sendSessionPolicyError(res, e))
@@ -475,10 +495,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                             throw e;
                         }
                     }
-                    const importingP = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
                     if (deps.resumeAnchorStore)
                         for (const a of anchors)
-                            await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingP);
+                            await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingPrincipal);
                     if (!(await replaySessionRow(row, gateFace))) {
                         sendError(res, 409, "conflict", "sync conflict");
                         return;
@@ -490,33 +509,26 @@ export async function handleSessionSync(req, res, match, ctx) {
                     });
                     return;
                 }
-                const heldLease = importLeases.get(sessionId);
+                const leaseKey = importLeaseKey(gate.occupant !== undefined ? gate.occupant.owner : importingPrincipal, sessionId);
+                const staleSecRaw = deps.config.syncImportLeaseStaleSec;
+                const staleSec = typeof staleSecRaw === "number" && Number.isFinite(staleSecRaw) ? staleSecRaw : 600;
+                const staleMs = staleSec * 1000;
+                for (const swept of sweepStaleLeases(staleMs))
+                    deps.logger?.warn?.("sync_import_lease_taken_over", { sessionId: swept.sessionId, ageMs: swept.ageMs, staleMs, stagingId: swept.stagingId });
+                const heldLease = importLeases.get(leaseKey);
                 if (heldLease) {
-                    const staleSecRaw = deps.config.syncImportLeaseStaleSec;
-                    const staleSec = typeof staleSecRaw === "number" && Number.isFinite(staleSecRaw) ? staleSecRaw : 600;
-                    const staleMs = staleSec * 1000;
-                    const ageMs = Date.now() - heldLease.at;
-                    if (staleMs > 0 && ageMs >= staleMs) {
-                        deps.logger?.warn?.("sync_import_lease_taken_over", { sessionId, ageMs, staleMs, stagingId: heldLease.stagingId });
-                        cleanupStaging(heldLease.stagingId);
-                        importLeases.delete(sessionId);
-                    }
-                    else {
-                        const retryAfterSec = staleMs > 0 ? Math.max(1, Math.ceil((staleMs - ageMs) / 1000)) : undefined;
-                        sendError(res, 409, "import_in_flight", "an import is already in flight for this session"
-                            + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""), retryAfterSec !== undefined ? { retryAfterSec } : undefined);
-                        return;
-                    }
+                    const retryAfterSec = staleMs > 0 ? Math.max(1, Math.ceil((staleMs - (Date.now() - heldLease.at)) / 1000)) : undefined;
+                    sendError(res, 409, "import_in_flight", "an import is already in flight for this session"
+                        + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""), retryAfterSec !== undefined ? { retryAfterSec } : undefined);
+                    return;
                 }
-                const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
-                const operatorOk = syncEntry.caller.operator;
                 const token = newStagingToken();
                 const handle = sessionStorage.beginImportStaging(sessionId, token);
                 const stagingId = handle.stagingId;
-                importLeases.set(sessionId, { at: Date.now(), stagingId });
+                importLeases.set(leaseKey, { at: Date.now(), stagingId, sessionId });
                 pendingStagings.set(stagingId, {
                     handle, realSessionId: sessionId, owner: importingPrincipal, ...(resolution ? { resolution } : {}), operatorOk,
-                    fileHistory, policy, anchors, row, declaredEntryIds: entryIds, openedBy: ownerKeyOf(scope.gateOwner), expectedOwner: owner,
+                    fileHistory, policy, anchors, row, declaredEntryIds: entryIds, openedBy: ownerKeyOf(scope.gateOwner), expectedOwner: owner, leaseKey,
                 });
                 sendJson(res, 200, { stagingId, relation: relA.relation });
                 return;
@@ -550,7 +562,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const utf8 = new StringDecoder("utf8");
                 try {
                     for await (const chunk of req) {
-                        touchImportLease(pending.realSessionId);
+                        touchImportLease(pending.leaseKey);
                         lineBuf += utf8.write(chunk);
                         if (Buffer.byteLength(lineBuf, "utf8") > SYNC_NDJSON_LINE_MAX_BYTES)
                             throw new PrecheckError(413, "NDJSON line too large");

package/dist/http/routes/sessions-list.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— 会话列表 / 发件链接列表。
  *
  * 路由:`GET /v1/sessions`(CC /resume picker,keyset 分页)、`GET /v1/sendfile-links`。
- * owner-scope 与 trace 列表同一权威模型(列表面 `list.read` 读档(`listFilterOf`):service 凭据不报主体〔部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` 时不算〕/ 只读 trace 凭据 / dev-open = fleet-wide;带验过的主体 = 钉住那位主体)。本域零可变状态。
+ * owner-scope 与 trace 列表同一权威模型(列表面 `list.read` 读档(`listFilterOf`):service 凭据不报主体〔部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` 时不算〕/ 只读 trace 凭据 / dev-open 上不报主体 = fleet-wide;报了主体 = 钉住那位主体,部署形不改这一句)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionListItem } from "../../security.js";