@sema-agent/server 7.148.0 → 7.150.0

package/dist/http/route-ctx.d.ts

@@ -36,8 +36,10 @@ import type { RootedTaskSpec } from "./execution-context.js";
 import type { GateCommitment, GateSettlementEvidence } from "../gate-settlement.js";
 import type { ResumeRestatement } from "./resume-restatement.js";
 import type { RememberLaneCannotRecord } from "../parked-decide.js";
+import type { RowWayOut } from "./resume-legs.js";
 import type { KeyCaller } from "../owner-faces.js";
 import type { Subject } from "../owner-brands.js";
+import type { RouteBackend, RouteRunStore, RouteSessionStore } from "./owner-access.js";
 /** 跨域可变状态 = lens1 §C2 实测的那 8 条「运行期登记簿」,一个对象。
  *  [ref]:`cancelledViaVerb`(按 taskId 键控的「这次是取消动词」旁表)删除 —— 中止成因改挂在每条腿自己的
  *  {@link RunAbort} 句柄上(`inflightRuns` 的值),同寿同删,不再有一张与腿不同寿的旁表。 */
@@ -198,14 +200,6 @@ export interface CheckpointCtx {
      * 传原 ctx / 其展开 ⇒ 标随行。缺席 = 不是无人值守腿(HTTP 提交腿;7.106.0 前落盘的行 —— 那时这些腿不铸模式,checkpoint 里也没有)。
      */
     unattendedLeg?: true;
-    /**
-     * 体里**模式词的读法记号**(闭集只有当前一词 `"entry_word"`):在场 = 这一行体的顶层 `permissionMode` 是这条 run 模式词唯一的源(提交入口盖过运维
-     * `AUTONOMY=plan` 的地板;`plan_review` 写回改它),续跑照它读。**服务端写、不来自请求体**。缺席(7.121.x 及以前写下的行 —— 那时运维的 plan 由治理层每段重钳)
-     * 而本部署此刻有入口地板、体的词被地板钳会变 ⇒ 续跑腿响亮拒、行字节不动(规则与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注「模式词问」)。
-     * 写点两个(写模式词的人盖记号,同模块):`buildCheckpointCtx`(每一次新的持久化写都写)与 `withPermissionModeRewritten`(`plan_review` 改词的写回);
-     * 不改词的续跑腿写回传原 ctx ⇒ 记号随行。
-     */
-    permissionModeReading?: import("./checkpoint-ctx.js").PermissionModeReading;
     /**
      * 🔴 [ref] —— **写这份上下文的服务版本**(`package.json` 的 `version`),**服务端写、不来自请求体**(与 {@link unattendedLeg} 同为 `body` 的兄弟键)。
      * 写点两个:`buildCheckpointCtx`(每一次新的持久化写)与续跑腿的写回({@link DriveResumeArgs.resumeCtx} 的唯一写点,CAS 赢点盖本进程的版本 —— 接下来写下一张停车行的就是它)。
@@ -225,6 +219,14 @@ export interface CheckpointCtx {
      * 缺席 = 体里的目标就是交付的那一份(腿上没有屏)。
      */
     promptScreened?: true;
+    /**
+     * 这条 run 继承到的**项目上下文**(`project-context.ts` 的 {@link import("../project-context.js").ProjectContext}:项目 id · 继承的 `cwd` · 项目简报)——
+     * 新提交腿在装配器头部判一次,**服务端写、不来自请求体**(与 {@link memoryScope} 同为 `body` 的兄弟键,先例同形:提交腿推导、落盘,续跑原样读回)。
+     * 写点:`buildCheckpointCtx`(提交腿那一笔,经 `persistSubmissionCtx` 读这条腿的部署事实);leader worker 的写者不带(它的 spec 不经新提交腿的判)。续跑腿的写回传原 ctx / 其展开 ⇒ 随行。
+     * 读者只有一只:`resume-legs.ts` `resolveResumeSpec` 把它原样递给装配器(`opts.projectContext`)—— 续跑腿不再读登记簿、不再推观者(停驻期间登记被改 / 被删 / 看不见了,续跑照旧用这一份)。
+     * 缺席 = 没继承(含 7.150.0 之前写下的行:不回填,续跑不继承 = 那时的行为)。
+     */
+    projectContext?: import("../project-context.js").ProjectContext;
 }
 /**
  * `/decide` 第三条车道交给宿主投递腿(wake:`DriveResumeArgs` / fresh:`DurableRunLegArgs`)的**一件**:这一跑在内存里带着的决定,
@@ -291,6 +293,11 @@ export interface DriveResumeArgs {
         sessionId: string;
         ctx: CheckpointCtx;
     };
+    /**
+     * 判官判本引擎续不了这条腿要续的那张卡时,这张卡的出路(`resume-legs.ts` 的 `rowWayOutOf`;判 `ok` / 说不出 ⇒ 缺席)。`/plan_review` 与 `/resume` 在驱动前对载入行求它;
+     * catch 臂在引擎的拒留卡 pending(处置 `retriable`)时把它作 `wayOut` 加进拒体 —— 引擎的拒原样不改(码、`field`、`blockedBy`、`thrownName`、诊断都在)。
+     */
+    rowWayOut?: RowWayOut;
     /**
      * 这条续跑的**宿主租约**(续跑漏斗 `resolveResumeSpecOrBlocked` 开、装配在它之下登记对端声明;调用方作用域的 `finally` 放)。
      * 驱动腿经 `heldFor(args.peerLease, () => driveResumeLeg(…))` 自持一只:受理早回的那一形里,腿活过调用方作用域,自己落定才放。
@@ -436,13 +443,13 @@ export interface RouteLegs {
     /** POST /v1/tasks · /v1/tasks/stream · /v1/runs 的共同前段:读体 → 校验 → resolveSpec。null = 已应答(400/…)。
      *
      *  `body` = **已解析好的**请求体,给那些体不是「这条 HTTP 请求的 JSON 正文」的调用方
-     *  (DESIGN-269 车2:A2A JSON-RPC 腿已经把正文读成了一条 `message/send` 请求,再 `readJson(req)`
+     *  ([ref] 车2:A2A JSON-RPC 腿已经把正文读成了一条 `message/send` 请求,再 `readJson(req)`
      *  一次只会读到空流)。缺席 ⇒ 照旧自己读体,既有三个调用方一字不改。
      *  ⚠️ 这是**入口形**的分歧,不是校验面的分歧:传进来的体与自己读的体走**同一段**校验/授权/
      *  resolveSpec —— 分叉出第二条校验路径正是本参数存在的理由的反面。
      *
      *  `onTypedFailure` = 「typed 拒绝**别写响应**,交回给我」。默认(缺席)行为不变:`HttpError` 走
-     *  `sendError` 连 `extra` 一起回显。DESIGN-269 车2 的 A2A 腿必须传它 —— 那些 `extra`(尤其
+     *  `sendError` 连 `extra` 一起回显。[ref] 车2 的 A2A 腿必须传它 —— 那些 `extra`(尤其
      *  `scenario_unknown` 的**全部场景名**)对壳是指路材料,对一个外部 peer 是内部词表外泄。 */
     prepareSpec(req: IncomingMessage, res: ServerResponse, body?: TaskRequestBody, onTypedFailure?: (err: import("../security.js").HttpError) => void, 
     /** [ref] 件C:**腿身份**(不是能力表态)。`liveStream: true` 只由 `POST /v1/tasks/stream` 的装配点按
@@ -594,8 +601,19 @@ export declare function sendResumeOutcome(res: ServerResponse, out: {
 }, logger: {
     info?: (msg: string, fields?: Record<string, unknown>) => void;
 } | undefined, extraBody?: Record<string, unknown>): void;
+/**
+ * 🔴 **路由层的服务 deps(类型墙,[ref] 第二阶段)**:run 店 / 会话店上带属主的读口(按 id / 按键 / 按会话 / 列表 —— `owner-access.ts` 的 {@link RouteRunStore} /
+ * {@link RouteSessionStore})、会话视图读 `sessionAudit` 与后端铸这两只店的工厂(`backend.run()` / `backend.session()`,{@link RouteBackend})在型上调不了:路由在不在照判(能力事实只问方法在不在,见证随视图封着),带属主的行只经属主存取器读。
+ * 值上就是服务的那一只 deps,只在 `owner-access.ts` 的 `sealRouteDeps` 铸一次;视图是完整 deps 的子型(交给持认领腿的写口照常)。
+ */
+export type RouteDeps = Omit<FlatServiceDeps, "runStore" | "sessionStorage" | "sessionAudit" | "backend"> & {
+    runStore?: RouteRunStore;
+    sessionStorage?: RouteSessionStore;
+    sessionAudit?: never;
+    backend?: RouteBackend;
+};
 export interface RouteCtxBase {
-    deps: FlatServiceDeps;
+    deps: RouteDeps;
     registry: RunRegistry;
     helpers: RouteHelpers;
     local: RouteLocals;

package/dist/http/routes/a2a-serve.js

@@ -4,12 +4,13 @@ import { memoRedactedRead, redactErrorMessage } from "../../observability/run-te
 import { isParkedRunStatus, isTerminalRunStatus } from "../../plugins/store-contracts.js";
 import { HttpError } from "../../security.js";
 import { idemCallerOf, idemIdentityOf, idemKeyOf, inflightKeyOf } from "../idempotency.js";
-import { isRunExistsConflictBody, replayOfExistingRun } from "../submit-replay.js";
+import { answerReplay, isRunExistsConflictBody } from "../submit-replay.js";
 import { isActiveRunConflictBody } from "../active-run-conflict.js";
 import { sendJson, sendError, sendHttpError } from "../send.js";
 import { admissionRefusalOf, readinessOf, sendBillableRefusal } from "../readiness.js";
+import { memberLeaseOf } from "../../fleet/engine-signal.js";
 import { gatedPerson, gatedSubject, sendPrincipalRefusal, verifiedIdentitySource } from "../principal-gate.js";
-import { callerOf, protocolEntry, readVisibleRun, runRowAt } from "../owner-access.js";
+import { callerOf, protocolEntry, readReplayHit, readVisibleRun, runRowAt } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { createDurableRun } from "./runs.js";
@@ -181,7 +182,7 @@ function rpcErrorFromTypedFailure(err) {
 }
 function submitUnavailable(res, ctx) {
     const { deps } = ctx;
-    const refusal = admissionRefusalOf(readinessOf(deps), deps.servingLease?.(), "submit");
+    const refusal = admissionRefusalOf(readinessOf(deps), memberLeaseOf(deps), "submit");
     if (refusal === undefined)
         return false;
     sendBillableRefusal(res, refusal);
@@ -197,15 +198,14 @@ function readBlocking(params) {
         throw new RpcError(JSONRPC_INVALID_PARAMS, "params.configuration.blocking must be a boolean");
     return c.blocking;
 }
-async function waitForRun(ctx, store, res, taskId, budgetMs) {
+async function waitForRun(ctx, entry, store, res, taskId, budgetMs) {
     const { deps } = ctx;
     const deadline = Date.now() + budgetMs;
     let last = null;
     for (;;) {
         let run;
         try {
-            const raw = await store.getRun(taskId);
-            run = raw ? await runRowAt("run.a2a", store, raw) : null;
+            run = (await readVisibleRun(entry, store, taskId))?.row ?? null;
         }
         catch (e) {
             deps.logger?.warn?.("a2a_serve_wait_read_failed", { error: e?.message });
@@ -254,10 +254,11 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
         ...(contextId !== undefined ? { sessionId: contextId } : {}),
         ...(scenario !== undefined ? { scenario } : {}),
     };
-    const keyed = (await runStore.getRunByIdem(idem.key).catch(() => undefined)) ?? (await runStore.getRun(body.taskId).catch(() => undefined));
-    const replay = keyed ? await replayOfExistingRun(keyed, { subject: submitter, clientTaskId: body.taskId, idem }, "durable", deps, runStore) : undefined;
-    if (keyed && replay?.status === 202) {
-        return taskFromRun(await runRowAt("run.a2a", runStore, keyed));
+    const keyed = (await readReplayHit(submitter, deps.config, runStore, { idemKey: idem.key }, body.taskId).catch(() => undefined)) ??
+        (await readReplayHit(submitter, deps.config, runStore, { taskId: body.taskId }, body.taskId).catch(() => undefined));
+    const replay = keyed ? await answerReplay(keyed, { subject: submitter, clientTaskId: body.taskId, idem }, "durable", runStore) : undefined;
+    if (keyed?.kind === "visible" && replay?.status === 202) {
+        return taskFromRun(await runRowAt("run.a2a", runStore, keyed.row));
     }
     const inflight = replay === undefined ? ctx.registry.idemCache.peek(inflightKeyOf(idem, "durable", body.taskId)) : undefined;
     let receipt;
@@ -298,7 +299,7 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
     }
     const taskId = receiptBody.taskId;
     const sessionId = receiptBody.sessionId;
-    const run = await waitForRun(ctx, runStore, res, taskId, blocking ? serve.blockingWaitMs : 0);
+    const run = await waitForRun(ctx, protocolEntry(req, deps, "run.a2a", callerOf(req, deps)), runStore, res, taskId, blocking ? serve.blockingWaitMs : 0);
     if (run)
         return taskFromRun(run);
     return {
@@ -311,6 +312,8 @@ async function handleMessageSend({ req, res, ctx, params, serve, runStore }) {
 function rpcErrorFromRefusedReceipt(receipt) {
     const code = receipt.body?.errorCode;
     const head = `the serving deployment did not accept this submission (it answered ${receipt.status}${typeof code === "string" ? ` ${code}` : ""})`;
+    if (receipt.status >= 500)
+        return new RpcError(JSONRPC_INTERNAL_ERROR, `${head}; the failure is on the serving side and nothing was started, so the same message can be sent again later`);
     if (isActiveRunConflictBody(receipt.body))
         return new RpcError(JSONRPC_INVALID_PARAMS, `${head}; a session already running a turn must finish or be cancelled before the next message on the same contextId`);
     if (isRunExistsConflictBody(receipt.body))
@@ -328,10 +331,10 @@ function durableIdempotencyTaskId(scope, messageId) {
 async function handleTasksGet({ req, ctx, params, runStore }) {
     const { deps } = ctx;
     const id = asNonEmptyString(params.id, "params.id", MAX_TASK_ID_CHARS);
-    const run = await readVisibleRun(protocolEntry(req, deps, "run.a2a", callerOf(req, deps)), runStore, id);
-    if (!run)
+    const admitted = await readVisibleRun(protocolEntry(req, deps, "run.a2a", callerOf(req, deps)), runStore, id);
+    if (!admitted)
         throw new RpcError(A2A_TASK_NOT_FOUND, A2A_TASK_NOT_FOUND_MESSAGE);
-    return taskFromRun(run);
+    return taskFromRun(admitted.row);
 }
 async function handleExtendedCard({ req, ctx, serve }) {
     return buildAgentCard(serve, cardReaderOf(req, ctx.deps.config), A2A_METHODS);

package/dist/http/routes/approvals-assistant.d.ts

@@ -2,12 +2,13 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type ToolApprovalCoordinator } from "../../tool-approval.js";
+import { type RouteSessionStore } from "../owner-access.js";
 import { type GovernancePosture } from "../../runtime-governance.js";
 import { type GateIntentView } from "../../approval.js";
 import { type RouteCtx, type RouteDecl, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 import { type PeerInboundPendingRow } from "../../peer-inbound-face.js";
-import { type PlacementReadingSessionStore, type SessionAgent } from "../../session-agent.js";
+import type { SessionAgent } from "../../session-agent.js";
 /** 族的成员 = 路由表行 id(改名 / 删行 ⇒ 下表的键当场编译红)。 */
 export type DecisionDoorId = Extract<ApprovalsAssistantRouteId, "approval-decide" | "assistant-task-plan-review">;
 /** 一道门的静态描述 —— 只写**这道门自己**的东西;路径、路径段、别门的键一概不在这里写(从来源读)。 */
@@ -164,7 +165,7 @@ peerInbound: (() => readonly PeerInboundPendingRow[]) | undefined,
  * 🔴 [ref]:停驻行 `agent` 的会话店面 —— 与 `GET /v1/approvals` 同一只(`deps.sessionStorage`),经同一只整批投影 {@link projectDurableQueue}。
  * `undefined` / 店不交 `placementOf` = 这台部署不存委派元组 ⇒ 没有一帧带 `agent`(帧字节与 [ref] 之前逐字相同)。位置在 `scope` 之前、与 `live` 并列:每个生产调用点都必须表态。
  */
-sessions: PlacementReadingSessionStore | undefined, scope: string | undefined, 
+sessions: Pick<RouteSessionStore, "placementOf"> | undefined, scope: string | undefined, 
 /** [ref]②:出身归因的部署侧一半 + 三张审批名单(问的属主)。缺席 ⇒ 归不出治理出身(键缺席,与 best-effort 同方向)、没有一行读作
  *  部署名单的问(记不住,方向是多问)。**位置在 `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
 governance?: PendingProjectionDeployment, pollMs?: number): Promise<void>;

package/dist/http/routes/approvals-assistant.js

@@ -8,7 +8,7 @@ import { approvalPayloadFingerprint } from "../../plugins/approval-payload-finge
 import { carriesDeploymentListQuestion, standingAnswerDurablyRecordable } from "../../tool-approval.js";
 import { APPROVAL_GATE_KINDS } from "../../approval-content-kind.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
-import { principalFrom, ownerOfCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
+import { principalFrom, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { keyAdmits } from "../../owner-faces.js";
 import { personOf } from "../../owner-brands.js";
 import { editedPlanBinding, verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -23,7 +23,7 @@ import { sleep } from "../sse-log.js";
 import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, logRequestError, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedSubject, explicitOperatorOk, sendPrincipalRefusal } from "../principal-gate.js";
-import { admitRunById, admitSessionById, callerEntry, callerOf, callerOfDecision, deciderSubjectOf, enter, judgeRun, protocolEntry, readVisibleRun, refuse, withCaller } from "../owner-access.js";
+import { admitRunById, admitSessionById, callerEntry, callerOf, callerOfDecision, deciderSubjectOf, enter, latestRunIdOf, listRunsOfScope, protocolEntry, readSessionAgent, readVisibleRun, refuse, runFactsOf, withCaller } from "../owner-access.js";
 import { governanceOriginOf } from "../../runtime-governance.js";
 import { deploymentListAsks } from "../../approval.js";
 import { grantBindingOf } from "../../standing-answer-grant.js";
@@ -40,7 +40,6 @@ import { seatText } from "../../trace/exit-seat.js";
 import { approvalQueueKindOfDoorId } from "../../approval-queue-kind.js";
 import { defaultPeerInboundFace, parsePeerInboundId, peerBoxScope } from "../../peer-inbound-face.js";
 import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
-import { readSessionAgent } from "../../session-agent.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
     ...RESUME_RESTATABLE_KEYS,
@@ -280,8 +279,8 @@ async function decideIdempotentReplay(cs, args) {
     };
 }
 async function gateObjectivePreview(reader, runStore, agentStore, gate, runSessionId) {
-    const previewOf = (taskId) => readVisibleRun(reader, runStore, taskId);
-    const own = typeof runSessionId === "string" ? ((await runStore.getActiveTaskId(runSessionId)) ?? (await runStore.latestRunForSession(runSessionId))?.taskId) : undefined;
+    const previewOf = async (taskId) => (await readVisibleRun(reader, runStore, taskId))?.row;
+    const own = typeof runSessionId === "string" ? ((await runStore.getActiveTaskId(runSessionId)) ?? (await latestRunIdOf(runStore, runSessionId))) : undefined;
     if (own !== undefined)
         return (await previewOf(own))?.objectivePreview ?? null;
     if (agentStore === undefined)
@@ -334,10 +333,11 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 return;
             }
             const pending = [...(await projectDurableQueue(durableRows, deps.config, deps.sessionStorage)), ...peerInboundRowsFor(defaultPeerInboundFace, principal, ownerParam)()];
+            const livePending = deps.toolApproval ? await deps.toolApproval.listLivePending(scope) : undefined;
             sendJson(res, 200, {
                 pending,
                 serverNowMs: Date.now(),
-                ...(deps.toolApproval ? { livePending: deps.toolApproval.listLivePending(scope) } : {}),
+                ...(livePending !== undefined ? { livePending } : {}),
                 ...(deps.approvalAskAudit ? { crashConverged: deps.approvalAskAudit.listCrashConverged(scope) } : {}),
             });
             return;
@@ -461,7 +461,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 if (typeof host === "string")
                     byGate.set(host, s);
             });
-            const runs = await runStore.listRuns({ owner: ownerOfCheckpointScope(scope), limit: 100 });
+            const runs = await listRunsOfScope(runStore, scope, 100);
             const tasks = runs
                 .filter((r) => r.status === "running" || isParkedRunStatus(r.status))
                 .map((r) => {
@@ -510,7 +510,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 let flagged = await runStore.requestPreempt(taskId, run.owner);
                 const PREEMPT_RECLASSIFY_ATTEMPTS = 3;
                 for (let attempt = 0; !flagged; attempt++) {
-                    const now = await runStore.getRun(taskId);
+                    const now = (await readVisibleRun(preemptEntry, runStore, taskId))?.row;
                     if (now !== undefined && isParkedRunStatus(now.status)) {
                         sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: now.status });
                         return;
@@ -660,7 +660,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
             }
             const sighting = typeof body.checkpointId === "string" ? { face: "checkpointId", value: body.checkpointId } : undefined;
             const decisionEntry = callerEntry(req, deps, match.decl.id);
-            const run = await runStore.getRun(taskId);
+            const run = await runFactsOf(runStore, taskId);
             if (!run) {
                 if (!deps.config.directDoorActive)
                     deps.logger?.info?.("decide_404", { reason: "no-row", taskId, principalPresent: principal !== undefined });
@@ -693,7 +693,7 @@ export async function handleApprovalsAssistant(req, res, match, ctx) {
                 singleUse = proof.singleUse === undefined ? undefined : { proof: proof.singleUse, store };
             }
             const deciderEntry = withCaller(decisionEntry, callerOfDecision(decisionEntry.caller, deciderPrincipal, deps.config));
-            const decisionAdmitted = judgeRun(deciderEntry, run);
+            const decisionAdmitted = await readVisibleRun(deciderEntry, runStore, taskId);
             if (decisionAdmitted === undefined) {
                 deps.logger?.info?.("decide_404", { reason: "owner-mismatch", taskId, principalPresent: principal !== undefined });
                 refuse(deciderEntry, res, "not_visible");
@@ -1122,7 +1122,7 @@ export async function streamApprovals(req, res, cs, live, peerInbound, sessions,
         let snapshot;
         try {
             const pending = [...(await projectDurableQueue(await cs.listPending(scope), governance, sessions)), ...(peerInbound?.() ?? [])];
-            snapshot = { pending, livePending: live ? live.listLivePending(scope) : [] };
+            snapshot = { pending, livePending: live ? await live.listLivePending(scope) : [] };
         }
         catch (err) {
             const failure = approvalsReadFailureOf(err);

package/dist/http/routes/capabilities.js

@@ -37,7 +37,7 @@ import { judgeAutoModeArming } from "../../auto-mode-face.js";
 import { coercePermissionModeStrict, PERMISSION_MODE_WORDS, taskHooksHonored } from "../../task-settings.js";
 import { gatedPerson, sendPrincipalRefusal } from "../principal-gate.js";
 import { readAdoptionImportCapability } from "../../adoption/import.js";
-import { headReadOf } from "../../session-incarnation.js";
+import { headReadPresent } from "../../session-incarnation.js";
 import { callerTrust } from "../caller-trust.js";
 import { sessionRulesNamespaceFormsHonored } from "../../session-policy-wire.js";
 function routePairingOf(deps, name, m) {
@@ -207,6 +207,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sideQuery: true,
                 agentRoster: facts.agentRoster(deps).available,
                 projects: facts.projectRegistry(deps).available,
+                projectInheritance: facts.projectRegistry(deps).available,
                 retention: retentionAdvertisement(deps.config),
                 peerLane: Boolean(deps.peerDirectory),
                 scenarioSubject: true,
@@ -214,12 +215,12 @@ export async function handleCapabilities(req, res, match, ctx) {
                 sessionSearch: facts.sessionList(deps).available,
                 sessionFork: facts.sessionFork(deps).available,
                 sessionDelete: facts.sessionDelete(deps).available,
-                resumeAt: Boolean(deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
+                resumeAt: Boolean(deps.resumeAnchorStore && headReadPresent(deps.sessionStorage)),
                 promptSuggestions: true,
                 sessionPolicy: facts.sessionPolicy(deps).available,
                 sessionRulesNamespaceForms: sessionRulesNamespaceFormsHonored(),
                 restoreFiles: Boolean(deps.fileHistoryStore),
-                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadOf(deps.sessionStorage)),
+                rewindFilesTo: Boolean(deps.fileHistoryStore && deps.resumeAnchorStore && headReadPresent(deps.sessionStorage)),
                 sessionRewindFiles: facts.sessionRewindFiles(deps).available,
                 sessionRewindFilesPreview: facts.sessionRewindFilesPreview(deps).available,
                 fileHistoryCapture: fileHistoryCaptureOf(deps.fileHistoryStore, deps.config.fileHistoryCapture),
@@ -299,7 +300,7 @@ export async function handleCapabilities(req, res, match, ctx) {
                 ...(modelReasoningDecl(m) !== undefined ? { reasoning: modelReasoningDecl(m) } : {}),
                 ...(modelImageInput(m) !== "undeclared" ? { vision: modelImageInput(m) === "yes" } : {}),
                 supportsThinkingOff: thinkingOffSpelled(m),
-                ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
+                ...(m.contextWindow ? { contextWindow: m.contextWindow, ...(Object.hasOwn(deps.config.contextWindowSources, name) ? { contextWindowSource: deps.config.contextWindowSources[name] } : {}) } : {}),
                 ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
                 ...((levels) => (levels !== undefined ? { supportedEffortLevels: [...levels] } : {}))(reasoningEffortLevelsOf(m)),
                 ...(m.compat !== undefined ? { compat: m.compat } : {}),

package/dist/http/routes/config-catalog.d.ts

@@ -1,5 +1,5 @@
 /**
- * DESIGN-278 §5 S2([ref])—— `GET /v1/config/catalog`:配置目录自描述端点(operator lane)。
+ * [ref] §5 S2([ref])—— `GET /v1/config/catalog`:配置目录自描述端点(operator lane)。
  *
  * TOB 运维在 web 上要一个**不撒谎**的配置目录:哪个键、什么腿(env/center)、改了何时生效
  * (hot/restart-片名/deploy/inert)、本机实际值 —— 今天这些事实散在 config.ts 数千行与三份文档里,

package/dist/http/routes/diagnostics.d.ts

@@ -86,7 +86,9 @@ export interface StaticWiringFacts {
  *     白白关掉一个可用的协议。`capable` 真而 `effective` 不真同样致命:能力在、这条部署形上却不会真的
  *     park,窗到期依旧无降级目的地。
  *  ② 会话店持久性:manifest 声明 `declared_durable`,而会话店的介质(店持久性判定里的**数据根**那一行:SQL 两方言 = 委托给库、local = 数据根所在挂载、
- *     没有后端 = 内存)判为 `ephemeral` ⇒ 「替换后还在」的声明没有介质兑现 ⇒ 拒启 `config.store_not_durable`(拒句逐根列三根判定 + 两条出路)。
+ *     没有后端 = 内存)判为 `ephemeral` ⇒ 「替换后还在」的声明没有介质兑现 ⇒ 拒启 `config.store_not_durable`(拒句逐根列三根判定 + 三条出路)。
+ *     local 店的声明不是常量:它由 `local-store-declaration.ts` 的唯一读者定(运维声明 `LOCAL_STORE_DURABILITY=ephemeral`,或店落在调用方自己那块易失盘上 ⇒
+ *     会话店与检查点店两半一起声明 `process-local`)—— 那时清单读 `process_local`,本条恒过,改出 warn 一行(带依据与挂卷出路;同一件事 park 那条不再另说)。
  *     介质判不出(`unknown`:非 Linux / 挂载表读不到 / 介质形不在规则表里)⇒ 只 warn —— 判不了的部署不能因自报位停机;
  *     数据根持久而另两根(封签钥匙目录 / file 记忆根)易失或判不出 ⇒ 也只 warn:会话店的声明兑现了,掉的是停驻行的封签钥匙 / 记忆,不是会话(能力位如实报最弱)。
  *     声明不是 `declared_durable` ⇒ 恒过。这条与 memory+durable 两条既有拒启同族(声明与介质必须对得上)。

package/dist/http/routes/diagnostics.js

@@ -8,6 +8,7 @@ import { gatedPerson, explicitOperatorOk, isLoopbackAddress, sendOperatorPrincip
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { STORE_NOT_DURABLE_CODE, StoreNotDurableError, describeStoreRoot, projectStoreDurabilityWiring, unwiredStorePosture } from "../../store-posture.js";
+import { describeLocalStoreDeclaration } from "../../local-store-declaration.js";
 export function buildServerWiringGates(input) {
     const gate = resolveStreamApprovalGate({
         toolApprovalEnabled: input.toolApprovalEnabled,
@@ -44,6 +45,21 @@ export function buildServerWiringGates(input) {
         approvalGrant: [...input.approvalGrant],
     };
 }
+function processLocalMediumSentence(dataRoot, aggregate, listed) {
+    const readFaces = `Store durability by root: ${listed}; GET /v1/capabilities store.durability and /health.store.durability say "${aggregate}" (the weakest root).`;
+    switch (dataRoot) {
+        case "ephemeral":
+            return `The data root's medium does not survive a replacement either — sessions and parked approvals on it go with the next replacement. ${readFaces}`;
+        case "durable":
+            return `The data root's medium measures durable today — the declaration is what this deployment promises, not what the disk does today. ${readFaces}`;
+        case "unknown":
+            return `This server could not prove whether the data root survives a replacement. ${readFaces}`;
+        default: {
+            const unhandled = dataRoot;
+            throw new Error(`unhandled store durability ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export function buildStaticWiringAudit(facts) {
     const refusals = [];
     const warnings = [];
@@ -58,15 +74,16 @@ export function buildStaticWiringAudit(facts) {
             `A window expiry would then have no degradation target and adjudicate as a fail-closed deny — refusing to start.`);
     }
     let refusalCode;
+    const roots = facts.store.roots;
+    const listed = roots.map((r) => `${describeStoreRoot(r)}`).join("; ");
+    const processLocalDeclaration = facts.store.localDeclaration?.durability === "process-local" ? facts.store.localDeclaration : undefined;
     if (facts.manifest.session.store === "declared_durable") {
-        const roots = facts.store.roots;
         const session = roots.find((r) => r.root === "data");
-        const listed = roots.map((r) => `${describeStoreRoot(r)}`).join("; ");
         if (session === undefined || session.verdict === "ephemeral") {
             refusalCode = STORE_NOT_DURABLE_CODE;
             const wayOut = session?.rule === "backend_memory" || session === undefined
                 ? `No store backend was assembled (env-only worker or a degraded boot) — wire DB_BACKEND=mysql|pg|local, or fix the session store's durability declaration.`
-                : `Two ways out: mount a persistent volume at ${session.path ?? "the data root"} (or point LOCAL_DATA_ROOT at one), or declare this deployment non-durable (DB_BACKEND=memory).`;
+                : `Three ways out: mount a persistent volume at ${session.path ?? "the data root"} (or point LOCAL_DATA_ROOT at one); or declare the local store ephemeral (LOCAL_STORE_DURABILITY=ephemeral — sessions, parked approvals and memory then do not survive a container / Pod replacement); or keep nothing on disk (DB_BACKEND=memory).`;
             refusals.push(`${STORE_NOT_DURABLE_CODE}: the engine's static wiring reports session.store="declared_durable" while the session store's medium does not survive a container / Pod replacement (store durability by root: ${listed}). ` +
                 `A durable declaration on an ephemeral medium is a claim nothing can honor — sessions, parked approvals and memory would vanish with the next replacement while every read face said "durable". Refusing to start. ${wayOut}`);
         }
@@ -74,11 +91,19 @@ export function buildStaticWiringAudit(facts) {
             warnings.push(`store durability is "${facts.store.durability}" (by root: ${listed}). ` +
                 (facts.store.durability === "unknown"
                     ? `This server could not prove that every root survives a container / Pod replacement (no mount evidence for it — not Linux, an unreadable mount table, or a mount shape outside the rule table); GET /v1/capabilities store.durability and /health.store.durability say "unknown". `
-                    : `The session store's medium holds, but a root marked ephemeral does not survive a container / Pod replacement — mount a persistent volume there (SEALED_KEY_DIR / MEMORY_ENGINE_DIR name those directories). `) +
+                    : `The session store's medium holds, but a root marked ephemeral does not survive a container / Pod replacement — mount a persistent volume there (SEALED_KEY_DIR / MEMORY_ENGINE_DIR name those directories). ` +
+                        `A sealing-key directory declared with SEALED_KEY_DIR on such a medium is refused at boot while parked approvals are durable (the parked rows would outlive the key their credentials are sealed to); ` +
+                        `the default <data root>/sealed-key and the file memory root are reported here, not refused. `) +
                 `Per-root detail: GET /v1/diagnostics/wiring storeDurability.roots.`);
         }
     }
-    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable") {
+    else if (processLocalDeclaration !== undefined) {
+        const declaration = processLocalDeclaration;
+        warnings.push(`the local store declares itself process-local (${describeLocalStoreDeclaration(declaration)}): its session store and checkpoint store promise their rows survive a process restart, not a container / Pod replacement. ` +
+            `${processLocalMediumSentence(roots.find((r) => r.root === "data")?.verdict ?? "unknown", facts.store.durability, listed)} ` +
+            `To keep them across replacements, mount a persistent volume at each root above that does not read durable (LOCAL_DATA_ROOT / SEALED_KEY_DIR / MEMORY_ENGINE_DIR point the three roots at one)${declaration.rule === "declared_ephemeral" ? " and unset LOCAL_STORE_DURABILITY" : ""}.`);
+    }
+    if (facts.parkFacility && facts.manifest.parkLane.checkpointDurability !== "declared_durable" && processLocalDeclaration === undefined) {
         warnings.push(`park facility is enabled but the checkpoint store does not declare durable storage ` +
             `(parkLane.checkpointDurability=${JSON.stringify(facts.manifest.parkLane.checkpointDurability ?? null)}). ` +
             `A parked approval survives a restart only on a durable store, and this reading folds "declared process-local" together with "declared nothing" — every in-tree adapter declares "durable", so a non-durable reading here means a store this build does not own. ` +

package/dist/http/routes/mcp-reconnect.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { isParkedRunStatus, isTerminalRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { DeadlineExceeded, MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sendJson, sendError } from "../send.js";
-import { admitSessionById, enter } from "../owner-access.js";
+import { admitSessionById, enter, runFactsOf } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { seatText } from "../../trace/exit-seat.js";
@@ -118,7 +118,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     }
                 }
             }
-            const run = activeTaskId === undefined ? undefined : await runStore.getRun(activeTaskId);
+            const run = activeTaskId === undefined ? undefined : await runFactsOf(runStore, activeTaskId);
             if (run && isParkedRunStatus(run.status)) {
                 sendError(res, 409, "steering.not_running", "run is waiting on a pending decision — the MCP re-dial verb needs a live turn; a resumed continuation dials every declared server afresh (the re-dial applies to the current turn only and is not persisted), so resume this run first — a re-dial cannot be queued behind the decision");
                 return;

package/dist/http/routes/memory-origin.d.ts

@@ -116,7 +116,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
+        cause?: "static" | "observed" | "derived" | "unattributed" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/notify-wake.js

@@ -1,6 +1,6 @@
 import { sendJson, sendError } from "../send.js";
 import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
-import { admitSessionRow, enter, refuse } from "../owner-access.js";
+import { admitSessionById, enter, refuse } from "../owner-access.js";
 import { sendResumeOutcome } from "../route-ctx.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -54,8 +54,7 @@ export async function handleNotifyWake(req, res, match, ctx) {
                 sendError(res, 501, "capability.session_ownership_required", "external notify requires the session-ownership face (sessionStorage.headOf)");
                 return;
             }
-            const notifyHead = await owned.sessionStorage.headOf(notifySession);
-            const notifyAdmitted = await admitSessionRow(notifyEntry, res, owned.sessionStorage, notifySession, notifyHead);
+            const notifyAdmitted = await admitSessionById(notifyEntry, res, owned.sessionStorage, notifySession);
             if (notifyAdmitted === undefined)
                 return;
             const payload = {

package/dist/http/routes/principal-inbox.d.ts

@@ -15,10 +15,12 @@
  *
  * 拒绝词 → HTTP 状态(穷举 `switch`,core 加词 ⇒ 编译红):
  *  · `not_member` → 404:「不同 org」「查无此人」「目录答不上来」同一份字节(门保证),404 与本仓反枚举的既有形一致;
- *  · `rate_limited` → 429;
+ *  · `rate_limited` → 429,体带 `retryAfterSec`、头带同值 `Retry-After`(门答案里的那一个数 —— 配额店按店钟算的到当前窗结束的整秒数;本口不再算一遍,
+ *    一个数两个投影,先例 `run-concurrency-cap.ts`);三界(尝试 / 对偶 / 聚合)同一句同一个数,另三只词没有这两样;
  *  · `inbox_full` → 409(收件人那一侧的状态,不是发件人的速率;与 `steering.queue_full` 同档);
  *  · `recipient_tombstoned` → 410(收件人正在被删除,这条路关了)。
  * 门缺席(本部署没声明收件箱消费方)⇒ 501 `capability.unavailable`,能力位 `principalInboxDelivery` 读同一只事实。
+ * 配额店读不出自己的状态 ⇒ 门抛 `OrgDeliveryQuotaUnreadableError`,由 HTTP 兜底(`http/server.ts`)答带因的 500(fail-closed,一封都没投)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";

package/dist/http/routes/principal-inbox.js

@@ -10,7 +10,8 @@ function sendRefusal(res, outcome) {
             sendError(res, 404, "org_delivery.not_member", outcome.message);
             return;
         case "org_delivery.rate_limited":
-            sendError(res, 429, "org_delivery.rate_limited", outcome.message);
+            res.setHeader("retry-after", String(outcome.retryAfterSec));
+            sendError(res, 429, "org_delivery.rate_limited", outcome.message, { retryAfterSec: outcome.retryAfterSec });
             return;
         case "org_delivery.inbox_full":
             sendError(res, 409, "org_delivery.inbox_full", outcome.message);
@@ -19,7 +20,7 @@ function sendRefusal(res, outcome) {
             sendError(res, 410, "org_delivery.recipient_tombstoned", outcome.message);
             return;
         default:
-            return assertNever(outcome.code);
+            return assertNever(outcome);
     }
 }
 export async function handlePrincipalInbox(req, res, match, ctx) {

package/dist/http/routes/projects.d.ts

@@ -48,6 +48,7 @@ export declare const PROJECT_ROW_DISPOSITIONS: {
     readonly registeredBy: "forward";
     readonly registeredAt: "forward";
     readonly archivedAt: "forward";
+    readonly contentAttestedAt: "forward";
 };
 /** 项目行的键全集(处置表的键 = wire 上可能出现的每一个键;自铸登记表 `trace/self-minted-wire.ts` 的 `projectRowKey` 按它 `satisfies`)。 */
 export type ProjectRowKey = keyof typeof PROJECT_ROW_DISPOSITIONS;

package/dist/http/routes/projects.js

@@ -4,6 +4,7 @@ import { sendUnauthorized } from "../principal-gate.js";
 import { routeListFilter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
+import { projectVisible } from "../../project-context.js";
 import { projectByTable } from "../../trace/projection-table.js";
 export const PROJECT_NOT_FOUND_MESSAGE = "no such project";
 export const PROJECT_ROW_DISPOSITIONS = {
@@ -19,6 +20,7 @@ export const PROJECT_ROW_DISPOSITIONS = {
     registeredBy: "forward",
     registeredAt: "forward",
     archivedAt: "forward",
+    contentAttestedAt: "forward",
 };
 export function projectRowOf(id, registration) {
     return projectByTable("project", PROJECT_ROW_DISPOSITIONS, registration, { id });
@@ -37,8 +39,8 @@ function readArchivedQuery(raw) {
 export async function handleProjects(req, res, match, ctx) {
     const { deps } = ctx;
     const { safeDecode } = ctx.helpers;
-    const { fleetWide, gateOwner } = routeListFilter(req, deps, match.decl.id);
-    if (!fleetWide && gateOwner === null) {
+    const viewer = routeListFilter(req, deps, match.decl.id);
+    if (!viewer.fleetWide && viewer.gateOwner === null) {
         sendUnauthorized(res, "identity");
         return;
     }
@@ -47,7 +49,7 @@ export async function handleProjects(req, res, match, ctx) {
         sendError(res, 501, "capability.unavailable", "the project registry is not available on this deployment: projects are published only by the configuration center, and no center configuration is applied here");
         return;
     }
-    const visible = (registration) => fleetWide || registration.registeredBy === gateOwner;
+    const visible = (registration) => projectVisible(registration, viewer);
     switch (match.decl.id) {
         case "projects-list": {
             const archived = readArchivedQuery(new URLSearchParams(match.search).get("archived"));

package/dist/http/routes/retention-ops.d.ts

@@ -1,5 +1,5 @@
 /**
- * [ref] 车2 —— **托管留存的 operator 治理面**(设计稿 `docs/DESIGN-270-retention-lane.md` §5/§6)。
+ * [ref] 车2 —— **托管留存的 operator 治理面**(设计稿 `docs/[ref]-retention-lane.md` §5/§6)。
  *
  *   · `PUT    /v1/ops/retention/holds/:domain` —— 放置 legal hold;
  *   · `DELETE /v1/ops/retention/holds/:domain` —— 解除;

package/dist/http/routes/run-permission-mode.d.ts

@@ -43,7 +43,7 @@ export type PermissionModePersistMiss = (typeof PERMISSION_MODE_PERSIST_MISSES)[
  *  · run 行仍在本副本(`runProvenElsewhere` 的反面 —— 别的副本续跑了它,续跑的 CAS 赢点把行上的副本改成它自己);
  *  · 本副本这条 run 此刻登记的活流仍是接下切档的那一只(本副本上续跑的新腿登记的是另一只流对象;腿收场时按对象身份摘掉自己的)。
  */
-export declare function switchLegHolds<S extends object>(fenced: FencedRun, thisInstanceId: string | undefined, liveNow: S | undefined, switched: S): boolean;
+export declare function switchLegHolds<S extends object>(fenced: Pick<FencedRun, "instanceId">, thisInstanceId: string | undefined, liveNow: S | undefined, switched: S): boolean;
 /** 本判官改了词时回执旁的那一格(`admission`)。 */
 interface PermissionModeAdmissionNote {
     readonly requested: PermissionMode;

package/dist/http/routes/run-permission-mode.js

@@ -7,7 +7,7 @@ import * as facts from "../../capability-facts.js";
 import { PERMISSION_MODE_WORDS, coercePermissionModeStrict, parseTaskSettings } from "../../task-settings.js";
 import { admitPermissionModeWord } from "../../permission-mode-admission.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer } from "../resume-ctx-read.js";
-import { sealCheckpointCtx, withPermissionModeRewritten } from "../checkpoint-ctx.js";
+import { sealCheckpointCtx } from "../checkpoint-ctx.js";
 import { serviceVersion } from "../../service-version.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
 export const PERMISSION_MODE_PERSIST_MISSES = ["claim_released", "context_absent", "store_failed"];
@@ -114,7 +114,7 @@ export async function handlePermissionMode(req, res, match, ctx) {
                 }
                 let persistMiss;
                 try {
-                    const next = sealCheckpointCtx({ ...withPermissionModeRewritten(stored, { ...stored.body, permissionMode: admitted }), writerVersion: serviceVersion() }, deps.checkpointCtxSealing, sessionId);
+                    const next = sealCheckpointCtx({ ...stored, body: { ...stored.body, permissionMode: admitted }, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, sessionId);
                     const rewrite = await checkpointStore.rewriteCtxWhileClaimed(sessionId, next, { fence: runStore, taskId, legHolds: (fenced) => switchLegHolds(fenced, deps.instanceId, ctx.registry.steerableRuns.get(taskId), live) });
                     persistMiss = rewrite === "written" ? undefined : rewrite;
                 }