@sema-agent/server 7.148.0 → 7.150.0

package/dist/http/routes/runs.d.ts

@@ -13,7 +13,7 @@ export declare function handleRuns(req: IncomingMessage, res: ServerResponse, ma
 /** 同上纪律(子代理 / 任务句柄 / HITL 应答段)。 */
 export declare function handleRunVerbs(req: IncomingMessage, res: ServerResponse, match: RouteMatch<RunVerbsRouteId>, ctx: RouteCtx): Promise<void>;
 /**
- * DESIGN-269 车2 件2 —— `POST /v1/runs` 的**建行 + 驱动**段,从路由体里原样搬出来的具名腿。
+ * [ref] 车2 件2 —— `POST /v1/runs` 的**建行 + 驱动**段,从路由体里原样搬出来的具名腿。
  *
  * 🔴 为什么提取:A2A 的 `message/send`(routes/a2a-serve.ts)必须走**同一条**提交链 —— 第二条提交
  * 路径就是第二个写者,而这条链上挂着 durable taskId 幂等重放、lease/治理窗 pre-admission、

package/dist/http/routes/runs.js

@@ -6,6 +6,8 @@ import { uuidv7, mintCheckpointToken, CheckpointError, policyCannotAnswer, valid
 import { isHolderDeathVerdict, isTerminalRunStatus, isParkedRunStatus, runProvenElsewhere } from "../../plugins/store-contracts.js";
 import { askRowCarriesOwner } from "../../plugins/approval-ask-store-sql.js";
 import { LIVE_RUN_GATE_KINDS, TERMINAL_PARK_GATE_KINDS } from "../../plugins/checkpoint-store-face.js";
+import { runCancelCardOf } from "../../run-cancel-card.js";
+import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../../card-settle-stored-scope.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { isUuidV7, encodeCheckpointScope } from "../../security.js";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -28,15 +30,15 @@ import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import * as facts from "../../capability-facts.js";
 import { assertNever } from "../route-ctx.js";
 import { readRunFace } from "../run-read-face.js";
-import { replayOfExistingRun } from "../submit-replay.js";
+import { replayOfExistingRun, replayOfKey } from "../submit-replay.js";
 import { mintAndDriveDurableRun } from "../durable-run-leg.js";
-import { admitRunById, admitRunRow, enter, runRowAt } from "../owner-access.js";
+import { SUBMISSION_CLAIM_FACE } from "../execution-context.js";
+import { admitRunById, admitRunByIdem, enter, readVisibleRun, sessionFactsReadOf } from "../owner-access.js";
 import { keyAdmission, ownerCellOf, recoveredSubject } from "../../owner-faces.js";
 import { personOf } from "../../owner-brands.js";
 import { withSubject } from "../../observability/principal-context.js";
 import { readResumeCtx, resumeCtxUnreadableAnswer } from "../resume-ctx-read.js";
 import { storedBodyReplayAnswer, storedBodyReplayLogFields } from "../checkpoint-ctx.js";
-import { headReadOf } from "../../session-incarnation.js";
 import { serviceVersion } from "../../service-version.js";
 import { storedBodyReplayRefusal } from "../stored-body-replay.js";
 import { haltBodyIssue, steerBodyKeyIssue } from "../../request-key-closure.js";
@@ -103,7 +105,7 @@ function sendHandleMiss(res, run, thisInstanceId) {
     }
     return false;
 }
-async function streamRunEvents(req, res, deps, runStore, taskId) {
+async function streamRunEvents(req, res, deps, runStore, entry, taskId) {
     await streamSseLog(req, res, {
         preamble: async (signal) => {
             const gate = resolveStreamApprovalGate({
@@ -132,10 +134,7 @@ async function streamRunEvents(req, res, deps, runStore, taskId) {
             return buildApprovalPreambleSseFrames(frames);
         },
         onPreambleFailure: (reason, err) => deps.logger?.warn?.("approval_preamble_failed", { taskId, reason, face: "run.events", error: err instanceof Error ? err.message : String(err ?? "") }),
-        statusOf: async (id) => {
-            const run = await runStore.getRun(id);
-            return run ? runRowAt("run-events", runStore, run) : undefined;
-        },
+        statusOf: async (id) => (await readVisibleRun(entry, runStore, id))?.row,
         getEvents: (id, after) => runStore.getEvents(id, after),
         formatEvent: (ev) => {
             const type = normalizeRunEventType(ev.type);
@@ -205,9 +204,9 @@ export async function handleRuns(req, res, match, ctx) {
                 return;
             }
             const inflight = idemCache.peek(inflightKeyOf(idem, "durable", clientTaskId));
-            const keyedRow = inflight ? undefined : await runStore.getRunByIdem(idem.key);
-            if (inflight || keyedRow) {
-                const resp = inflight ? await inflight : await replayOfExistingRun(keyedRow, { subject: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
+            const replayed = inflight ? undefined : await replayOfKey({ idemKey: idem.key }, { subject: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) }, "durable", deps, runStore);
+            const resp = inflight ? await inflight : replayed;
+            if (resp !== undefined) {
                 sendJson(res, resp.status, resp.body);
                 return;
             }
@@ -243,26 +242,23 @@ export async function handleRuns(req, res, match, ctx) {
         const entry = enter(req, res, deps, match.decl.id);
         if (entry === undefined)
             return;
-        let run;
-        let pathId;
+        let admitted;
         if (match.decl.id === "runs-by-idem") {
             const rawKey = new URLSearchParams(match.search).get("idempotencyKey");
             if (!rawKey) {
                 sendError(res, 400, "request.query_invalid", "idempotencyKey is required: pass the raw Idempotency-Key the submission was sent with");
                 return;
             }
-            run = await runStore.getRunByIdem(idemKeyOf(rawKey, idemCallerOf(req, ctx), "run"));
+            admitted = await admitRunByIdem(entry, res, runStore, idemKeyOf(rawKey, idemCallerOf(req, ctx), "run"));
         }
         else {
-            pathId = match.params.taskId;
-            run = await runStore.getRun(pathId);
+            admitted = await admitRunById(entry, res, runStore, match.params.taskId);
         }
-        const admitted = await admitRunRow(entry, res, runStore, run, pathId);
         if (admitted === undefined)
             return;
         const taskId = admitted.row.taskId;
         if (match.decl.id === "run-events") {
-            await streamRunEvents(req, res, deps, runStore, taskId);
+            await streamRunEvents(req, res, deps, runStore, entry, taskId);
         }
         else {
             sendJson(res, 200, await readRunFace(deps, runStore, admitted.row));
@@ -285,16 +281,15 @@ export async function handleRuns(req, res, match, ctx) {
             return;
         const run = cancelAdmitted.row;
         const rs = runStore;
-        const cancelSuspended = async () => {
+        const cancelSuspended = async (parked) => {
             const cs = deps.checkpointStore;
             let note = "cancelled while suspended (pending approval settled)";
             if (cs) {
-                const token = await cs.findPendingTokenBySession(run.sessionId, undefined, { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" });
+                const token = await runCancelCardOf(cs, run.sessionId);
                 if (token) {
-                    const cp = await cs.get(token);
-                    const won = cp ? await cs.expire(token, cp.scope) : false;
+                    const won = (await expireCardUnderStoredScope(cs, token)) === CARD_EXPIRE_OUTCOME.expired;
                     if (!won) {
-                        const now = await rs.getRun(taskId);
+                        const now = (await readVisibleRun(entry, rs, taskId))?.row;
                         const st = now?.status;
                         if (st !== undefined && (isParkedRunStatus(st) || st === "running")) {
                             sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active", { taskId, status: st });
@@ -308,7 +303,7 @@ export async function handleRuns(req, res, match, ctx) {
                 else {
                     const claimed = await rs.markResuming(taskId, deps.instanceId ?? "default");
                     if (!claimed) {
-                        const now = await rs.getRun(taskId);
+                        const now = (await readVisibleRun(entry, rs, taskId))?.row;
                         const st = now?.status;
                         if (st !== undefined && (st === "running" || isParkedRunStatus(st))) {
                             sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry cancel if it is still active", { taskId, status: st });
@@ -326,7 +321,7 @@ export async function handleRuns(req, res, match, ctx) {
             }
             const err = note;
             try {
-                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb" });
+                const result = mintCancelledResult({ taskId, sessionId: run.sessionId, startedAtMs: Date.parse(run.createdAt), message: err, cause: "cancel_verb", parkedResult: parked });
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {
@@ -348,7 +343,7 @@ export async function handleRuns(req, res, match, ctx) {
                 sendError(res, 500, "internal.cancel_not_terminalized", `cancel progressed (${note}) but could not terminalize the run row (retried) — retry cancel; a stuck row is reaped after the stale window (${e instanceof Error ? e.message : String(e)})`, { taskId });
                 return;
             }
-            const finalRow = await rs.getRun(taskId).catch(() => undefined);
+            const finalRow = (await readVisibleRun(entry, rs, taskId).catch(() => undefined))?.row;
             if (finalRow && finalRow.errorCode !== "cancelled" && isTerminalRunStatus(finalRow.status)) {
                 sendJson(res, 202, { taskId, status: finalRow.status, errorCode: finalRow.errorCode ?? null, cancelRequested: finalRow.cancelRequested, note: `session unlocked; the run was terminalized concurrently (${finalRow.errorCode ?? finalRow.status}) before this cancel's write — reporting the actual ledger state` });
                 return;
@@ -359,9 +354,9 @@ export async function handleRuns(req, res, match, ctx) {
             let flagged = await runStore.requestCancel(taskId, run.owner);
             const CANCEL_RECLASSIFY_ATTEMPTS = 3;
             for (let attempt = 0; !flagged; attempt++) {
-                const now = await runStore.getRun(taskId);
+                const now = (await readVisibleRun(entry, runStore, taskId))?.row;
                 if (now !== undefined && isParkedRunStatus(now.status)) {
-                    await cancelSuspended();
+                    await cancelSuspended(now.result);
                     return;
                 }
                 if (now?.status === "running" && attempt < CANCEL_RECLASSIFY_ATTEMPTS) {
@@ -379,7 +374,7 @@ export async function handleRuns(req, res, match, ctx) {
             sendJson(res, 202, { taskId, status: "cancelling", cancelRequested: true });
         }
         else if (isParkedRunStatus(run.status)) {
-            await cancelSuspended();
+            await cancelSuspended(run.result);
         }
         else {
             sendJson(res, 202, { taskId, status: run.status, cancelRequested: run.cancelRequested, note: "run already terminal — cancel is a no-op" });
@@ -503,7 +498,7 @@ export async function handleRuns(req, res, match, ctx) {
                 }
                 if (code !== "steering.not_running")
                     throw e;
-                const freshBeforePark = await runStore.getRun(taskId).catch(() => undefined);
+                const freshBeforePark = (await readVisibleRun(entry, runStore, taskId).catch(() => undefined))?.row;
                 const raced = await tryPark();
                 if (raced === "parked") {
                     sendParked(freshBeforePark?.status ?? run.status);
@@ -552,8 +547,8 @@ export async function handleRuns(req, res, match, ctx) {
             }
             return;
         }
-        const sessionHeadOf = headReadOf(deps.sessionStorage);
-        if (deps.checkpointStore && sessionHeadOf) {
+        const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
+        if (deps.checkpointStore && sessionFactsOf) {
             const activeTaskId = await runStore.getActiveTaskId?.(run.sessionId).catch(() => undefined);
             if (activeTaskId !== undefined && activeTaskId !== null && activeTaskId !== taskId) {
                 sendNotRunning(`run is ${run.status} and its session has an ACTIVE run (${activeTaskId}) — steer that run instead`);
@@ -603,7 +598,7 @@ export async function handleRuns(req, res, match, ctx) {
                     mintResult.duplicateKey = true;
                     return;
                 }
-                const leafId = await sessionHeadOf(run.sessionId).then((h) => h?.leafId).catch(() => undefined);
+                const leafId = await sessionFactsOf(run.sessionId).then((h) => h?.leafId).catch(() => undefined);
                 if (leafId === undefined || leafId === null)
                     return;
                 const resumeRead = await readResumeCtx(cs.getCtx(run.sessionId), { sessionId: run.sessionId, opener: deps.checkpointCtxSealing });
@@ -777,7 +772,7 @@ export async function handleRuns(req, res, match, ctx) {
         catch (e) {
             if (e.code !== "steering.not_running")
                 throw e;
-            const freshRun = await runStore.getRun(taskId).catch(() => undefined);
+            const freshRun = (await readVisibleRun(entry, runStore, taskId).catch(() => undefined))?.row;
             sendNoLiveTurn(freshRun?.status ?? run.status, true);
             return;
         }
@@ -1507,9 +1502,9 @@ async function createDurableRunHeld(req, res, ctx, prepared, idem) {
     const submitter = gatedSubject(req, deps.config);
     const caller = { subject: submitter, idem, ...(clientTaskId !== undefined ? { clientTaskId } : {}) };
     if (clientTaskId) {
-        const existing = await runStore.getRun(clientTaskId);
-        if (existing)
-            return await replayOfExistingRun(existing, caller, "durable", deps, runStore);
+        const replayed = await replayOfKey({ taskId: clientTaskId }, caller, "durable", deps, runStore);
+        if (replayed !== undefined)
+            return replayed;
     }
     if ((await leaseDenied(req, res, seat)) || (await usageWindowDenied(req, res, seat)))
         return null;
@@ -1526,6 +1521,7 @@ async function createDurableRunHeld(req, res, ctx, prepared, idem) {
             source,
             identity: runIdentityOf(req, deps.config, prepared.auth?.subject ?? null),
             runSlot,
+            face: SUBMISSION_CLAIM_FACE,
         });
         const receipt = out.existing ? await replayOfExistingRun(out.existing, caller, "durable", deps, runStore) : out;
         await prepared.seat.close();

package/dist/http/routes/session-memory-sync.js

@@ -1,6 +1,6 @@
 import { memorySyncReportOf } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
-import { admitSessionById, enter } from "../owner-access.js";
+import { admitSessionById, enter, latestRunIdOf, readVisibleSession } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { leafOfAdmittedHead } from "../../session-incarnation.js";
@@ -94,7 +94,6 @@ export async function handleSessionMemorySync(req, res, match, ctx) {
                 sendError(res, 400, "request.path_malformed", "session id segment is not valid percent-encoding");
                 return;
             }
-            const readHead = () => sessionStorage.headOf(sessionId);
             const admitted = await admitSessionById(entry, res, sessionStorage, sessionId);
             if (admitted === undefined)
                 return;
@@ -122,10 +121,10 @@ export async function handleSessionMemorySync(req, res, match, ctx) {
             const quiet = async () => {
                 if ((await runStore.getActiveTaskId(sessionId)) !== undefined)
                     return false;
-                if ((await runStore.latestRunForSession(sessionId))?.taskId !== observedTaskId)
+                if ((await latestRunIdOf(runStore, sessionId)) !== observedTaskId)
                     return false;
-                const now = await readHead();
-                return now !== undefined && leafOfAdmittedHead(now) === sourceRevision;
+                const now = await readVisibleSession(entry, sessionStorage, sessionId);
+                return now !== undefined && leafOfAdmittedHead(now.row) === sourceRevision;
             };
             const fenced = () => reportOf({ target, sourceRevision, scopes, refused: { code: "session_active", message: SESSION_ACTIVE_SYNC_MESSAGE } });
             let report;

package/dist/http/routes/session-sync.d.ts

@@ -36,16 +36,35 @@ export type PendingStaging = {
     /** The owner cell the gate judged when it opened this staging (head-read reading `headOf(id)?.owner`: `undefined` = no such session) — the commit lands only on
      *  this same cell (`StagedCommitOptions.expectedOwner`, `session-sync-kernel.ts`); `owner` above (the re-stamped importing principal) is derived from it for a fleet caller. */
     expectedOwner: string | null | undefined;
+    /** 开这张暂存时占下的导入租约的键({@link importLeaseKey});续期与放掉都按它,不再从会话 id 重算。 */
+    leaseKey: string;
+};
+/**
+ * 导入租约的键 = 这次导入**落在哪一格属主上**(与提交的属主 CAS 同一格)+ 会话 id。一条读法:
+ *  · id 被占着(活行 ∪ 在删行 —— 「被占着」的唯一读法,门读的 `occupant`)⇒ 落点是住客的属主格(`null` = 无主):所有碰得到这一行的调用方(属主、fleet、存量无主互认)共一把 —— 同一份会话上第二份在飞导入,谁发起的都 409;
+ *  · id 空闲 ⇒ 还没有谁的会话,落点是这位调用方自己将成的属主(`importingPrincipal`):各占各的,先提交者得(提交的属主 CAS 要求那一格仍空着,输的那一份
+ *    在提交前复判被拒)。一个主体的在飞导入既不挡、也不透给另一个主体 —— 租约键不含主体时,空闲 id 上任一主体都能占位,并从 409 读到「此 id 此刻有人在导」。
+ * 键的主体只来自门读的 `occupant` 与 `importingPrincipal`(两者都派生自属主存取器的 `listFilterOf` 与门读的会话面,不另读调用方),且占租约在 `pushGateOk` 之后。
+ */
+export declare function importLeaseKey(landingOwner: string | null, sessionId: string): string;
+/** 一把导入租约:最后活动时刻 + 持有它的暂存 + 它守的会话 id(清扫与运维日志用,不从键里反解)。 */
+export type ImportLease = {
+    at: number;
+    stagingId: string;
+    sessionId: string;
 };
 /** 单域独占状态 + 它的两个操作。每个 server 实例一份。 */
 export interface SessionSyncLocal {
     pendingStagings: Map<string, PendingStaging>;
-    importLeases: Map<string, {
-        at: number;
-        stagingId: string;
-    }>;
-    touchImportLease(sessionId: string): void;
+    importLeases: Map<string, ImportLease>;
+    touchImportLease(leaseKey: string): void;
     cleanupStaging(stagingId: string): void;
+    /** 把闲置 ≥ `staleMs` 的租约连同它的暂存登记一并放掉(`staleMs <= 0` = 关,什么都不清);返回被放掉的(供运维日志)。 */
+    sweepStaleLeases(staleMs: number): Array<{
+        readonly sessionId: string;
+        readonly stagingId: string;
+        readonly ageMs: number;
+    }>;
 }
 export declare function createSessionSyncLocal(): SessionSyncLocal;
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。 */

package/dist/http/routes/session-sync.js

@@ -7,10 +7,9 @@ import { classifySyncRelationshipByIds, createStagedLogFeed, MalformedImportEntr
 import { isUuidShape } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { StampedSessionArchiveError } from "../../session-error-wire.js";
-import { readSessionAgent } from "../../session-agent.js";
 import { buildDisplaySafeUrl } from "../../trace/redact.js";
 import { storeFaultClassOf } from "../../plugins/store-fault.js";
-import { enter, judgeSession, refuse } from "../owner-access.js";
+import { enter, readSessionAgent, readSyncGate, refuse } from "../owner-access.js";
 import { listFilterOf, ownerKeyOf, sameKey } from "../../owner-faces.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
@@ -18,26 +17,43 @@ import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever } from "../route-ctx.js";
 import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 import { readSessionPinned, readSessionTitle } from "../../session-row.js";
-import { sessionFaceOfHead } from "../../session-incarnation.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
 import { SessionActiveRunError, SessionForkInProgressError, SessionWriterPresentError } from "../../execution-placement.js";
 import { probeSessionChildren, sessionTenantScope } from "../../session-children-retire.js";
 import { liveChildrenRefusal } from "./background.js";
+export function importLeaseKey(landingOwner, sessionId) {
+    return JSON.stringify([landingOwner, sessionId]);
+}
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
-    const touchImportLease = (sessionId) => {
-        const cur = importLeases.get(sessionId);
+    const touchImportLease = (leaseKey) => {
+        const cur = importLeases.get(leaseKey);
         if (cur)
-            importLeases.set(sessionId, { ...cur, at: Date.now() });
+            importLeases.set(leaseKey, { ...cur, at: Date.now() });
     };
     const cleanupStaging = (stagingId) => {
         const p = pendingStagings.get(stagingId);
         if (p)
-            importLeases.delete(p.realSessionId);
+            importLeases.delete(p.leaseKey);
         pendingStagings.delete(stagingId);
     };
-    return { pendingStagings, importLeases, touchImportLease, cleanupStaging };
+    const sweepStaleLeases = (staleMs) => {
+        if (staleMs <= 0)
+            return [];
+        const now = Date.now();
+        const swept = [];
+        for (const [key, lease] of [...importLeases]) {
+            const ageMs = now - lease.at;
+            if (ageMs < staleMs)
+                continue;
+            swept.push({ sessionId: lease.sessionId, stagingId: lease.stagingId, ageMs });
+            cleanupStaging(lease.stagingId);
+            importLeases.delete(key);
+        }
+        return swept;
+    };
+    return { pendingStagings, importLeases, touchImportLease, cleanupStaging, sweepStaleLeases };
 }
 async function firstPhaseRefusal(sessionStorage, sessionId, relation, consented) {
     if (consented || (relation !== "fork" && relation !== "stale"))
@@ -57,7 +73,7 @@ async function firstPhaseRefusal(sessionStorage, sessionId, relation, consented)
 export async function handleSessionSync(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, readRawBody, safeDecode, rateLimited } = ctx.helpers;
-    const { pendingStagings, importLeases, touchImportLease, cleanupStaging } = ctx.local.sessionSync;
+    const { pendingStagings, importLeases, touchImportLease, cleanupStaging, sweepStaleLeases } = ctx.local.sessionSync;
     {
         {
             const sync = facts.sessionSync(deps);
@@ -76,9 +92,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                 return;
             }
             const judgeSessionGate = async () => {
-                const face = sessionFaceOfHead(sessionId, await sessionStorage.headOf(sessionId));
-                const mayTouch = face !== undefined && (await judgeSession(syncEntry, sessionStorage, sessionId, face)) !== undefined;
-                return { face, mayPull: mayTouch, mayPush: face === undefined || mayTouch };
+                const { face, occupant, mayTouch } = await readSyncGate(syncEntry, sessionStorage, sessionId);
+                return { face, occupant, mayPull: face !== undefined && mayTouch, mayPush: occupant === undefined || mayTouch };
             };
             let gate;
             try {
@@ -408,6 +423,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (!payloadVerified)
                         digestSaysDiffer = true;
                 }
+                const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
+                const operatorOk = syncEntry.caller.operator;
                 const placed = gateFace === undefined ? undefined : await sessionStorage.executionPlacement?.read(sessionId);
                 if (placed !== undefined) {
                     switch (placed.cell.role) {
@@ -464,10 +481,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                             return;
                         }
                     }
-                    const opOk = syncEntry.caller.operator;
                     if (deps.sessionPolicyStore) {
                         try {
-                            await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, opOk);
+                            await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, operatorOk);
                         }
                         catch (e) {
                             if (sendSessionPolicyError(res, e))
@@ -475,10 +491,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                             throw e;
                         }
                     }
-                    const importingP = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
                     if (deps.resumeAnchorStore)
                         for (const a of anchors)
-                            await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingP);
+                            await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingPrincipal);
                     if (!(await replaySessionRow(row, gateFace))) {
                         sendError(res, 409, "conflict", "sync conflict");
                         return;
@@ -490,33 +505,26 @@ export async function handleSessionSync(req, res, match, ctx) {
                     });
                     return;
                 }
-                const heldLease = importLeases.get(sessionId);
+                const leaseKey = importLeaseKey(gate.occupant !== undefined ? gate.occupant.owner : importingPrincipal, sessionId);
+                const staleSecRaw = deps.config.syncImportLeaseStaleSec;
+                const staleSec = typeof staleSecRaw === "number" && Number.isFinite(staleSecRaw) ? staleSecRaw : 600;
+                const staleMs = staleSec * 1000;
+                for (const swept of sweepStaleLeases(staleMs))
+                    deps.logger?.warn?.("sync_import_lease_taken_over", { sessionId: swept.sessionId, ageMs: swept.ageMs, staleMs, stagingId: swept.stagingId });
+                const heldLease = importLeases.get(leaseKey);
                 if (heldLease) {
-                    const staleSecRaw = deps.config.syncImportLeaseStaleSec;
-                    const staleSec = typeof staleSecRaw === "number" && Number.isFinite(staleSecRaw) ? staleSecRaw : 600;
-                    const staleMs = staleSec * 1000;
-                    const ageMs = Date.now() - heldLease.at;
-                    if (staleMs > 0 && ageMs >= staleMs) {
-                        deps.logger?.warn?.("sync_import_lease_taken_over", { sessionId, ageMs, staleMs, stagingId: heldLease.stagingId });
-                        cleanupStaging(heldLease.stagingId);
-                        importLeases.delete(sessionId);
-                    }
-                    else {
-                        const retryAfterSec = staleMs > 0 ? Math.max(1, Math.ceil((staleMs - ageMs) / 1000)) : undefined;
-                        sendError(res, 409, "import_in_flight", "an import is already in flight for this session"
-                            + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""), retryAfterSec !== undefined ? { retryAfterSec } : undefined);
-                        return;
-                    }
+                    const retryAfterSec = staleMs > 0 ? Math.max(1, Math.ceil((staleMs - (Date.now() - heldLease.at)) / 1000)) : undefined;
+                    sendError(res, 409, "import_in_flight", "an import is already in flight for this session"
+                        + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""), retryAfterSec !== undefined ? { retryAfterSec } : undefined);
+                    return;
                 }
-                const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
-                const operatorOk = syncEntry.caller.operator;
                 const token = newStagingToken();
                 const handle = sessionStorage.beginImportStaging(sessionId, token);
                 const stagingId = handle.stagingId;
-                importLeases.set(sessionId, { at: Date.now(), stagingId });
+                importLeases.set(leaseKey, { at: Date.now(), stagingId, sessionId });
                 pendingStagings.set(stagingId, {
                     handle, realSessionId: sessionId, owner: importingPrincipal, ...(resolution ? { resolution } : {}), operatorOk,
-                    fileHistory, policy, anchors, row, declaredEntryIds: entryIds, openedBy: ownerKeyOf(scope.gateOwner), expectedOwner: owner,
+                    fileHistory, policy, anchors, row, declaredEntryIds: entryIds, openedBy: ownerKeyOf(scope.gateOwner), expectedOwner: owner, leaseKey,
                 });
                 sendJson(res, 200, { stagingId, relation: relA.relation });
                 return;
@@ -550,7 +558,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 const utf8 = new StringDecoder("utf8");
                 try {
                     for await (const chunk of req) {
-                        touchImportLease(pending.realSessionId);
+                        touchImportLease(pending.leaseKey);
                         lineBuf += utf8.write(chunk);
                         if (Buffer.byteLength(lineBuf, "utf8") > SYNC_NDJSON_LINE_MAX_BYTES)
                             throw new PrecheckError(413, "NDJSON line too large");

package/dist/http/routes/sessions-list.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— 会话列表 / 发件链接列表。
  *
  * 路由:`GET /v1/sessions`(CC /resume picker,keyset 分页)、`GET /v1/sendfile-links`。
- * owner-scope 与 trace 列表同一权威模型(列表面 `list.read` 读档(`listFilterOf`):service 凭据不报主体〔部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` 时不算〕/ 只读 trace 凭据 / dev-open = fleet-wide;带验过的主体 = 钉住那位主体)。本域零可变状态。
+ * owner-scope 与 trace 列表同一权威模型(列表面 `list.read` 读档(`listFilterOf`):service 凭据不报主体〔部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` 时不算〕/ 只读 trace 凭据 / dev-open 上不报主体 = fleet-wide;报了主体 = 钉住那位主体,部署形不改这一句)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionListItem } from "../../security.js";

package/dist/http/routes/sessions.d.ts

@@ -26,7 +26,7 @@ export interface SessionsLocal {
             degraded?: boolean;
         }>;
     }>;
-    /** DESIGN-269 件4:`/a2a` 面板的短 TTL single-flight 缓存。与 `mcpStatusCache` **分开一张表**而不是
+    /** [ref] 件4:`/a2a` 面板的短 TTL single-flight 缓存。与 `mcpStatusCache` **分开一张表**而不是
      *  共用带前缀的键:两张面板的体不同形(`peers` vs `servers`),塞进一张表就得靠 unknown 兜住两形,
      *  于是「取到的是哪一形」变成运行期约定 —— 两张表让它回到类型上。 */
     a2aStatusCache: Map<string, {

package/dist/http/routes/sessions.js

@@ -14,8 +14,8 @@ import { readWritableSessionPermissionRules } from "../../session-policy-wire.js
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
 import { gatedPerson, gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
 import { personOf } from "../../owner-brands.js";
-import { headReadOf, leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
-import { admitSessionById, admitSessionRow, admittedAsFleet, callerEntry, callerOf, deliverVerdict, enter, judgeSessionRow, protocolEntry, readOwnerCell, refuse, seesRun, sessionRowPresent } from "../owner-access.js";
+import { leafOfAdmittedHead, sessionFaceOfHead } from "../../session-incarnation.js";
+import { admitSessionById, admitSessionForDeletion, admitSessionRow, admitSessionView, admittedAsFleet, callerEntry, callerOf, deliverVerdict, enter, judgeSessionById, protocolEntry, readOwnerCell, readVisibleLatestRun, refuse, sessionOwnerUnchanged } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { rosterAgentId } from "./agents-roster.js";
@@ -67,11 +67,9 @@ async function readLastLegMcp(deps, sessionId, entry) {
     const runStore = deps.runStore;
     if (!runStore || sessionId === null)
         return undefined;
-    const latest = await runStore.latestRunForSession(sessionId);
+    const latest = await readVisibleLatestRun(entry, runStore, sessionId);
     if (latest === undefined)
         return undefined;
-    if (!seesRun(entry, latest.owner))
-        return undefined;
     const events = await runStore.getEvents(latest.taskId, 0);
     for (let i = events.length - 1; i >= 0; i--) {
         const ev = events[i];
@@ -87,26 +85,7 @@ async function readLastLegMcp(deps, sessionId, entry) {
 export async function handleSessions(req, res, match, ctx) {
     const { deps } = ctx;
     const { readJson, safeDecode } = ctx.helpers;
-    const readOwnedSessionView = async (entry, sessionAudit, sessionId, readOpts) => {
-        const headOf = headReadOf(deps.sessionStorage);
-        if (headOf !== undefined) {
-            const head = await readOwnerCell(entry, sessionId, () => headOf(sessionId));
-            if ((await admitSessionRow(entry, res, deps.sessionStorage, sessionId, head)) === undefined)
-                return undefined;
-        }
-        let audit;
-        try {
-            audit = await sessionAudit(sessionId, readOpts);
-        }
-        catch (e) {
-            if (headOf !== undefined)
-                throw e;
-            throw new Error(`session view read failed before ownership could be established: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
-        }
-        if ((await admitSessionRow(entry, res, deps.sessionStorage, sessionId, audit)) === undefined)
-            return undefined;
-        return audit;
-    };
+    const readOwnedSessionView = (entry, sessionAudit, sessionId, readOpts) => admitSessionView(entry, res, deps.sessionStorage, sessionAudit, sessionId, readOpts);
     const sse = ctx.local.sessions;
     const { mcpStatusCache, a2aStatusCache } = ctx.local.sessions;
     {
@@ -262,8 +241,8 @@ export async function handleSessions(req, res, match, ctx) {
     }
     {
         if (match.decl.id === "session-head") {
-            const headOf = headReadOf(deps.sessionStorage);
-            if (!headOf) {
+            const headFact = facts.sessionOwnership(deps);
+            if (!headFact.available) {
                 sendError(res, 501, "capability.session_store_required", "session head probe requires a durable session store (DB_BACKEND=mysql|pg|local)");
                 return;
             }
@@ -273,8 +252,7 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const headEntry = callerEntry(req, deps, match.decl.id);
-            const headRead = await readOwnerCell(headEntry, headSession, () => headOf(headSession));
-            const admittedHead = await admitSessionRow(headEntry, res, deps.sessionStorage, headSession, headRead);
+            const admittedHead = await admitSessionById(headEntry, res, headFact.sessionStorage, headSession);
             if (admittedHead === undefined)
                 return;
             const leafId = leafOfAdmittedHead(admittedHead.row);
@@ -317,8 +295,6 @@ export async function handleSessions(req, res, match, ctx) {
                 return;
             }
             const evEntry = callerEntry(req, deps, match.decl.id);
-            const readHead = (id) => readOwnerCell(evEntry, id, () => evFact.sessionStorage.headOf(id));
-            const readOwner = async (id) => (await readHead(id))?.owner;
             const watch = evFact.watch;
             const evSession = safeDecode(match.params.sessionId);
             if (evSession === null) {
@@ -354,7 +330,7 @@ export async function handleSessions(req, res, match, ctx) {
                     return;
                 }
                 sse.sseOwnerLookups++;
-                const admissionP = readHead(evSession).then(async (head) => (!sessionRowPresent(head) ? undefined : { head, verdict: await judgeSessionRow(evEntry, evFact.sessionStorage, evSession, head) }));
+                const admissionP = judgeSessionById(evEntry, evFact.sessionStorage, evSession);
                 void admissionP.catch(() => undefined).then(() => { sse.sseOwnerLookups--; });
                 let stallTimer;
                 let admission;
@@ -381,12 +357,13 @@ export async function handleSessions(req, res, match, ctx) {
                     refuse(evEntry, res, "missing");
                     return;
                 }
-                if (deliverVerdict(evEntry, res, admission.verdict) === undefined) {
+                const evAdmitted = deliverVerdict(evEntry, res, admission);
+                if (evAdmitted === undefined) {
                     cleanup();
                     return;
                 }
-                leafOfAdmittedHead(admission.head);
-                const owner = admission.head.owner;
+                leafOfAdmittedHead(evAdmitted.row);
+                const owner = evAdmitted.row.owner;
                 const q = new URLSearchParams(match.search);
                 const lastLeafId = q.get("lastLeafId");
                 let first = true;
@@ -485,9 +462,9 @@ export async function handleSessions(req, res, match, ctx) {
                     }
                     ownerCheckPending = true;
                     ownerCheckStartedAt = Date.now();
-                    void readOwner(evSession).then((o) => {
+                    void sessionOwnerUnchanged(evEntry, evFact.sessionStorage, evSession, owner).then((same) => {
                         ownerCheckPending = false;
-                        if (!closed && o !== owner)
+                        if (!closed && !same)
                             onEnd();
                     }).catch(() => { ownerCheckPending = false; });
                 }, hbMs);
@@ -706,14 +683,11 @@ export async function handleSessions(req, res, match, ctx) {
         const store = rowFact.sessionStorage;
         const sessionId = match.params.sessionId;
         const patchEntry = callerEntry(req, deps, match.decl.id);
-        const head = await store.headOf(sessionId);
-        if (head === undefined) {
-            refuse(patchEntry, res, "missing");
+        const patchAdmitted = await admitSessionById(patchEntry, res, store, sessionId);
+        if (patchAdmitted === undefined)
             return;
-        }
+        const head = patchAdmitted.row;
         const face = sessionFaceOfHead(sessionId, head);
-        if ((await admitSessionRow(patchEntry, res, store, sessionId, face)) === undefined)
-            return;
         leafOfAdmittedHead(head);
         const read = readSessionRowPatch(await readJson(req));
         if ("problem" in read) {
@@ -903,7 +877,7 @@ export async function handleSessions(req, res, match, ctx) {
                 sendError(res, 400, "request.id_invalid", "invalid session id (must be a canonical uuid)");
                 return;
             }
-            const deleteAdmitted = await admitSessionById(deleteEntry, res, deleteFact.gateStore, sessionId);
+            const deleteAdmitted = await admitSessionForDeletion(deleteEntry, res, deleteFact.sessionStorage, sessionId);
             if (deleteAdmitted === undefined)
                 return;
             const owner = deleteAdmitted.row.owner;