@sema-agent/server 7.148.0 → 7.150.0

package/dist/http/routes/tasks.js

@@ -1,7 +1,8 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
 import { heldFor } from "../../peer-seat.js";
-import { beatRunHeartbeat, graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, settleResumeAnchor, TurnAnchorCapture, HEARTBEAT_MS } from "../../runs.js";
+import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, settleResumeAnchor, TurnAnchorCapture, HEARTBEAT_MS } from "../../runs.js";
+import { commitParkRow } from "../../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, sealResultForExit, outwardPlane } from "../../terminal.js";
 import { voidVerifierPauseCard } from "../../verifier-pause-card.js";
 import { withSubject } from "../../observability/principal-context.js";
@@ -20,13 +21,15 @@ import { writeLiveFrame, writeLiveHeartbeat } from "../live-frame.js";
 import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestFaceEventData, toolRosterDeltaEventData, toolProgressEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, createPromptManifestSeat, identityFields } from "../../trace/project.js";
 import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
-import { isReplayedOutcome, replayedOutcome, replayOfExistingRun } from "../submit-replay.js";
+import { answerReplay, isReplayedOutcome, replayedOutcome, replayOfExistingRun } from "../submit-replay.js";
+import { readReplayHit, runFactsOf } from "../owner-access.js";
 import { httpErrorCode, sendJson, sseHeaders } from "../send.js";
 import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble } from "../../approval-card.js";
+import { approvalLegOriginOf } from "../../approval-leg-origin.js";
 import { approvalPreambleReplays, declaredApprovalFrameFamilies, resolveApprovalLeg, resolveStreamApprovalGate } from "../../tool-approval.js";
 import { buildActiveRunConflict, isActiveRunConflictBody, toDoneFrameResult } from "../active-run-conflict.js";
-import { commitExecutionContext } from "../execution-context.js";
+import { SUBMISSION_CLAIM_FACE, commitExecutionContext, faultedAnswerOf } from "../execution-context.js";
 import { rootSessionAbsentAnswer } from "../execution-context.js";
 import { recheckClaimBeforeLaunch, startClaimHeartbeat } from "../claim-heartbeat.js";
 import { timeClaim } from "../claim-latency.js";
@@ -34,7 +37,7 @@ import { commitSessionInheritEnv } from "../session-inherit-env.js";
 import { headerStr, gatedPerson, gatedSubject, explicitOperatorOk, runIdentityOf } from "../principal-gate.js";
 import { recoveredSubject } from "../../owner-faces.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
-import { buildSyncSubmitBody } from "../sync-submit-body.js";
+import { buildSyncSubmitBody, syncSubmitBodyOfRow } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { persistSubmissionCtx, SUBMIT_CTX_CLAIM_LOST } from "../submit-ctx.js";
@@ -42,6 +45,7 @@ import { withModelReachScope } from "../../model-reach-scope.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 import { refusalBody } from "../refusal-body.js";
 import { heldWorkflowParkDecisions } from "../../parked-decide.js";
+import { compositionLegRoot } from "../../task-cwd.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../../session-workspace.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 async function mintSubmitExitResult(result, checkpoints) {
@@ -106,12 +110,12 @@ export async function handleTasks(req, res, match, ctx) {
         const idem = rawIdem ? submissionIdemOf(rawIdem, idemCallerOf(req, ctx), keyedBody) : undefined;
         const inflightKey = idem ? inflightKeyOf(idem, "sync") : undefined;
         const cached = inflightKey ? idemCache.peek(inflightKey) : undefined;
-        const keyedRow = idem && !cached && deps.runStore ? await deps.runStore.getRunByIdem(idem.key) : undefined;
-        if (keyedRow && deps.runStore) {
-            const replay = await replayOfExistingRun(keyedRow, { subject: submitter, idem }, "sync", deps, deps.runStore);
-            if (liveStream && replay.status === 200) {
-                sseHeaders(res, { "x-task-id": keyedRow.taskId });
-                writeMetaFrame(res, keyedRow.taskId, keyedRow.sessionId);
+        const keyedHit = idem && !cached && deps.runStore ? await readReplayHit(submitter, deps.config, deps.runStore, { idemKey: idem.key }, undefined) : undefined;
+        if (keyedHit && deps.runStore) {
+            const replay = await answerReplay(keyedHit, { subject: submitter, idem }, "sync", deps.runStore);
+            if (liveStream && replay.status === 200 && keyedHit.kind === "visible") {
+                sseHeaders(res, { "x-task-id": keyedHit.row.taskId });
+                writeMetaFrame(res, keyedHit.row.taskId, keyedHit.row.sessionId);
                 writeLiveFrame(res, doneFrameOfOutcome(replay));
                 res.end();
             }
@@ -277,8 +281,14 @@ export async function handleTasks(req, res, match, ctx) {
                 const runStreamSubmitLeg = async () => {
                     ranLive = true;
                     let finalResult;
+                    let heldCard;
+                    const commitSyncPark = (runStore, runId, word, parkResult, cardToken) => commitParkRow({
+                        runStore, taskId: runId, word, result: parkResult, card: { token: cardToken, sessionId: prepared.spec.sessionId }, cards: deps.checkpointStore, leg: "sync",
+                        legId: heldLegOf(durableLegId, runId), staleWindowMs: deps.config.runStaleSec * 1000,
+                    });
                     let runRowSettled = false;
                     let durableTaskId;
+                    let durableLegId;
                     let durableHeartbeat;
                     const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId, startedAtMs: streamLegStartedAt, message: errorMessage, cause });
                     let userMsgEntryId;
@@ -293,52 +303,60 @@ export async function handleTasks(req, res, match, ctx) {
                         anchorPut = true;
                         await settleResumeAnchor(() => store.put(prepared.spec.sessionId, key, entryId, principal ?? null), { leg: "stream", kind: "prompt" });
                     };
-                    if (deps.runStore) {
-                        const tid = earlyDurableTid ?? uuidv7();
-                        const created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null }));
-                        if (created.ok)
-                            clearTurnActivity(tid);
-                        if (created.ok)
-                            recordResourceWindow(tid, prepared.spec.resourceSuspend);
-                        if (created.existing) {
-                            const replay = await replayOfExistingRun(created.existing, { subject: submitter, idem }, "sync", deps, deps.runStore);
-                            writeTerminalFrame(doneFrameOfOutcome(replay));
-                            return replay;
+                    try {
+                        if (deps.runStore) {
+                            const tid = earlyDurableTid ?? uuidv7();
+                            const created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null }));
+                            if (created.ok)
+                                clearTurnActivity(tid);
+                            if (created.ok)
+                                recordResourceWindow(tid, prepared.spec.resourceSuspend);
+                            if (created.existing) {
+                                const replay = await replayOfExistingRun(created.existing, { subject: submitter, idem }, "sync", deps, deps.runStore);
+                                writeTerminalFrame(doneFrameOfOutcome(replay));
+                                return replay;
+                            }
+                            if (created.sessionAbsent) {
+                                const refused = rootSessionAbsentAnswer();
+                                writeTerminalFrame(doneFrameOfOutcome(refused));
+                                return refused;
+                            }
+                            if (!created.ok) {
+                                const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId);
+                                const refused = { status: 409, body: conflict };
+                                writeTerminalFrame(doneFrameOfOutcome(refused));
+                                return refused;
+                            }
+                            prepared.seat.noteOwnRun(tid);
+                            stopClaimHeartbeat = startClaimHeartbeat(deps.runStore, tid, principal ?? null, deps.metrics);
+                            const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: tid, legId: created.legId }, prepared.execution);
+                            if (placementReject) {
+                                writeTerminalFrame(doneFrameOfOutcome(placementReject));
+                                return placementReject;
+                            }
+                            durableTaskId = tid;
+                            durableLegId = created.legId;
+                            fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
                         }
-                        if (created.sessionAbsent) {
-                            const refused = rootSessionAbsentAnswer();
-                            writeTerminalFrame(doneFrameOfOutcome(refused));
-                            return refused;
+                        if (deps.checkpointStore) {
+                            const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId, legId: heldLegOf(durableLegId, durableTaskId) } : undefined, prepared);
+                            if (ctxRefusal !== undefined && ctxRefusal !== SUBMIT_CTX_CLAIM_LOST) {
+                                writeTerminalFrame(doneFrameOfOutcome(ctxRefusal));
+                                return ctxRefusal;
+                            }
                         }
-                        if (!created.ok) {
-                            const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId);
-                            const refused = { status: 409, body: conflict };
-                            writeTerminalFrame(doneFrameOfOutcome(refused));
-                            return refused;
+                        const lostClaim = durableTaskId !== undefined && deps.runStore ? await recheckClaimBeforeLaunch(deps, deps.runStore, prepared.spec.sessionId, durableTaskId, heldLegOf(durableLegId, durableTaskId)) : undefined;
+                        if (lostClaim !== undefined) {
+                            writeTerminalFrame(doneFrameOfOutcome(lostClaim));
+                            return lostClaim;
                         }
-                        prepared.seat.noteOwnRun(tid);
-                        if (detachOnDisconnect)
+                        if (durableTaskId !== undefined && detachOnDisconnect)
                             prepared.seat.markRecord();
-                        stopClaimHeartbeat = startClaimHeartbeat(deps.runStore, tid, principal ?? null, deps.metrics);
-                        const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: tid }, prepared.execution);
-                        if (placementReject) {
-                            writeTerminalFrame(doneFrameOfOutcome(placementReject));
-                            return placementReject;
-                        }
-                        durableTaskId = tid;
-                        fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
-                    }
-                    if (deps.checkpointStore) {
-                        const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared);
-                        if (ctxRefusal !== undefined && ctxRefusal !== SUBMIT_CTX_CLAIM_LOST) {
-                            writeTerminalFrame(doneFrameOfOutcome(ctxRefusal));
-                            return ctxRefusal;
-                        }
                     }
-                    const lostClaim = durableTaskId !== undefined && deps.runStore ? await recheckClaimBeforeLaunch(deps, deps.runStore, prepared.spec.sessionId, durableTaskId) : undefined;
-                    if (lostClaim !== undefined) {
-                        writeTerminalFrame(doneFrameOfOutcome(lostClaim));
-                        return lostClaim;
+                    catch (e) {
+                        const claimFault = faultedAnswerOf(e, SUBMISSION_CLAIM_FACE.faulted);
+                        writeTerminalFrame(doneFrameOfOutcome(claimFault));
+                        return claimFault;
                     }
                     commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.subject);
@@ -407,6 +425,7 @@ export async function handleTasks(req, res, match, ctx) {
                     const noticeLedger = ledgerSink;
                     const unregisterEngineNotice = registerEngineNoticeLeg({
                         sessionId: prepared.spec.sessionId,
+                        ...(durableTaskId !== undefined ? { taskId: durableTaskId } : {}),
                         ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
                         live: (row) => {
                             if (res.writableEnded || res.destroyed) {
@@ -517,6 +536,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     if (ledgerSink)
                                         await manifestSeat?.drain(ledgerSink.append);
                                     if (ev.type === "done") {
+                                        heldCard = heldParkOf(ev.result);
                                         finalResult = await mintSubmitExitResult(ev.result, deps.checkpointStore);
                                         if (durableTaskId && finalResult)
                                             finalResult = { ...finalResult, taskId: durableTaskId };
@@ -526,7 +546,8 @@ export async function handleTasks(req, res, match, ctx) {
                                         finalizeTaskResult(ev.result, principal, prepared.spec.objective);
                                         noteRunOutcome(finalResult);
                                         await putRewindAnchor();
-                                        settleFleet(outwardPlane(finalResult.terminal).status, fleetRunResiduals(finalResult, failureCodeOf(finalResult.terminal)));
+                                        if (!(durableTaskId && deps.runStore && deps.checkpointStore && heldCard !== undefined))
+                                            settleFleet(outwardPlane(finalResult.terminal).status, fleetRunResiduals(finalResult, failureCodeOf(finalResult.terminal)));
                                         if (ledgerSink && finalResult) {
                                             if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                                 const rs2 = deps.runStore;
@@ -679,7 +700,7 @@ export async function handleTasks(req, res, match, ctx) {
                                 owner: askOwner,
                                 abortSignal: ac.signal,
                                 sessionId: prepared.spec.sessionId,
-                                executionLane: prepared.execution.lane,
+                                ...approvalLegOriginOf(prepared.execution),
                                 ...(streamApprovalOn
                                     ? {
                                         family: "approval_request",
@@ -693,12 +714,12 @@ export async function handleTasks(req, res, match, ctx) {
                         if (deps.toolApproval) {
                             const toolApproval = deps.toolApproval;
                             prepared.spec.onAsk = unattended
-                                ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, sessionId: prepared.spec.sessionId, executionLane: prepared.execution.lane }, unattended)
+                                ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, sessionId: prepared.spec.sessionId, ...approvalLegOriginOf(prepared.execution) }, unattended)
                                 : toolApproval.boundAsk({
                                     owner: askOwner,
                                     taskId: askTaskId,
                                     sessionId: prepared.spec.sessionId,
-                                    executionLane: prepared.execution.lane,
+                                    ...approvalLegOriginOf(prepared.execution),
                                     ...(streamApprovalOn ? { legKey: "", ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
                                 });
                         }
@@ -718,10 +739,10 @@ export async function handleTasks(req, res, match, ctx) {
                             : withApproval()));
                         if (durableTaskId && deps.runStore) {
                             const finalPlane = finalResult ? outwardPlane(finalResult.terminal) : undefined;
-                            if (finalResult && finalPlane?.status === "suspended" && deps.checkpointStore)
-                                await deps.runStore.setSuspended(durableTaskId, finalResult);
-                            else if (finalResult && finalPlane?.status === "needs_review" && deps.checkpointStore)
-                                await deps.runStore.setNeedsReview(durableTaskId, finalResult);
+                            if (finalResult && heldCard !== undefined && deps.checkpointStore) {
+                                const parked = await commitSyncPark(deps.runStore, durableTaskId, heldCard.word, finalResult, heldCard.token);
+                                settleFleet(parked.kind === "ended" ? "failed" : outwardPlane(finalResult.terminal).status, fleetRunResiduals(finalResult, failureCodeOf(finalResult.terminal)));
+                            }
                             else if (finalResult && finalPlane) {
                                 await deps.runStore.setTerminal(durableTaskId, finalPlane.status, finalResult, finalPlane.errorMessage ?? null);
                                 await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, finalResult);
@@ -736,8 +757,8 @@ export async function handleTasks(req, res, match, ctx) {
                                         await ledgerSink.flush().catch(() => undefined);
                                         await ledgerSink.appendParked("suspended", {}).catch(() => undefined);
                                     }
-                                    await deps.runStore.setSuspended(durableTaskId, null);
-                                    settleFleet("suspended");
+                                    const parked = await commitSyncPark(deps.runStore, durableTaskId, "suspended", null, pending);
+                                    settleFleet(parked.kind === "ended" ? "failed" : "suspended");
                                 }
                                 else if (dcCause !== undefined) {
                                     const dcErr = "stream client disconnected before completion (run aborted)";
@@ -780,7 +801,7 @@ export async function handleTasks(req, res, match, ctx) {
                             evict();
                         if (!runRowSettled && durableTaskId && deps.runStore) {
                             try {
-                                const row = await deps.runStore.getRun(durableTaskId);
+                                const row = await runFactsOf(deps.runStore, durableTaskId);
                                 if (row?.status === "running") {
                                     const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId, undefined, { axis: "run" });
                                     const backstopCause = ac.cause();
@@ -790,8 +811,8 @@ export async function handleTasks(req, res, match, ctx) {
                                             await ledgerSink.flush().catch(() => undefined);
                                             await ledgerSink.appendParked("suspended", {}).catch(() => undefined);
                                         }
-                                        await deps.runStore.setSuspended(durableTaskId, null);
-                                        settleFleet("suspended");
+                                        const parked = await commitSyncPark(deps.runStore, durableTaskId, "suspended", null, pending);
+                                        settleFleet(parked.kind === "ended" ? "failed" : "suspended");
                                     }
                                     else if (finalResult) {
                                         if (ledgerSink && !ledgerTerminal) {
@@ -881,36 +902,43 @@ export async function handleTasks(req, res, match, ctx) {
                 const runSyncSubmitLeg = async () => {
                     const syncLegStartedAt = Date.now();
                     let durableTaskId;
+                    let durableLegId;
                     let durableHeartbeat;
-                    if (deps.runStore) {
-                        const tid = uuidv7();
-                        const created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null }));
-                        if (created.ok)
-                            clearTurnActivity(tid);
-                        if (created.ok)
-                            recordResourceWindow(tid, prepared.spec.resourceSuspend);
-                        if (created.existing)
-                            return await replayOfExistingRun(created.existing, { subject: submitter, idem }, "sync", deps, deps.runStore);
-                        if (created.sessionAbsent)
-                            return rootSessionAbsentAnswer();
-                        if (!created.ok)
-                            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) };
-                        prepared.seat.noteOwnRun(tid);
-                        stopSyncClaimHeartbeat = startClaimHeartbeat(deps.runStore, tid, principal ?? null, deps.metrics);
-                        const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: tid }, prepared.execution);
-                        if (placementReject)
-                            return placementReject;
-                        durableTaskId = tid;
-                        fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
+                    try {
+                        if (deps.runStore) {
+                            const tid = uuidv7();
+                            const created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null }));
+                            if (created.ok)
+                                clearTurnActivity(tid);
+                            if (created.ok)
+                                recordResourceWindow(tid, prepared.spec.resourceSuspend);
+                            if (created.existing)
+                                return await replayOfExistingRun(created.existing, { subject: submitter, idem }, "sync", deps, deps.runStore);
+                            if (created.sessionAbsent)
+                                return rootSessionAbsentAnswer();
+                            if (!created.ok)
+                                return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) };
+                            prepared.seat.noteOwnRun(tid);
+                            stopSyncClaimHeartbeat = startClaimHeartbeat(deps.runStore, tid, principal ?? null, deps.metrics);
+                            const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: tid, legId: created.legId }, prepared.execution);
+                            if (placementReject)
+                                return placementReject;
+                            durableTaskId = tid;
+                            durableLegId = created.legId;
+                            fillRunPreviewOnDelivery(prepared.acceptance, deps.runStore, tid);
+                        }
+                        if (deps.checkpointStore) {
+                            const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId, legId: heldLegOf(durableLegId, durableTaskId) } : undefined, prepared);
+                            if (ctxRefusal !== undefined && ctxRefusal !== SUBMIT_CTX_CLAIM_LOST)
+                                return ctxRefusal;
+                        }
+                        const lostClaim = durableTaskId !== undefined && deps.runStore ? await recheckClaimBeforeLaunch(deps, deps.runStore, prepared.spec.sessionId, durableTaskId, heldLegOf(durableLegId, durableTaskId)) : undefined;
+                        if (lostClaim !== undefined)
+                            return lostClaim;
                     }
-                    if (deps.checkpointStore) {
-                        const ctxRefusal = await persistSubmissionCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared);
-                        if (ctxRefusal !== undefined && ctxRefusal !== SUBMIT_CTX_CLAIM_LOST)
-                            return ctxRefusal;
+                    catch (e) {
+                        return faultedAnswerOf(e, SUBMISSION_CLAIM_FACE.faulted);
                     }
-                    const lostClaim = durableTaskId !== undefined && deps.runStore ? await recheckClaimBeforeLaunch(deps, deps.runStore, prepared.spec.sessionId, durableTaskId) : undefined;
-                    if (lostClaim !== undefined)
-                        return lostClaim;
                     commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
                     const syncCancelCtrl = createRunAbort(principal ?? null);
                     markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.subject);
@@ -947,8 +975,9 @@ export async function handleTasks(req, res, match, ctx) {
                     counters.uncountedBillableInflight++;
                     try {
                         const heldDecisions = await heldWorkflowParkDecisions(deps, prepared.spec.sessionId);
-                        const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, heldDecisions);
-                        const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), heldDecisions);
+                        const compositionInternals = { ...heldDecisions, ...compositionLegRoot(prepared.legFacts?.registeredCwd) };
+                        const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, compositionInternals);
+                        const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), compositionInternals);
                         const plainLeg = async () => {
                             const stream = prepared.runner.runTaskStream(specWithSignal, undefined, heldDecisions);
                             const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), prepared.legFacts?.sessionWitness);
@@ -1009,15 +1038,16 @@ export async function handleTasks(req, res, match, ctx) {
                     }
                     const exitResult = await mintSubmitExitResult(result, deps.checkpointStore);
                     const syncPlane = outwardPlane(result.terminal);
-                    if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && durableTaskId) {
-                        await deps.runStore.setSuspended(durableTaskId, exitResult);
-                        prepared.acceptance.settle(result);
-                        return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" })) };
-                    }
-                    if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && durableTaskId) {
-                        await deps.runStore.setNeedsReview(durableTaskId, exitResult);
+                    const syncHeld = heldParkOf(result);
+                    if (syncHeld !== undefined && deps.checkpointStore && deps.runStore && durableTaskId) {
+                        const parked = await commitParkRow({
+                            runStore: deps.runStore, taskId: durableTaskId, word: syncHeld.word, result: exitResult, card: { token: syncHeld.token, sessionId: prepared.spec.sessionId }, cards: deps.checkpointStore, leg: "sync",
+                            legId: heldLegOf(durableLegId, durableTaskId), staleWindowMs: deps.config.runStaleSec * 1000,
+                        });
                         prepared.acceptance.settle(result);
-                        return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" })) };
+                        if (parked.kind === "ended")
+                            return { status: 200, body: withSyncSubmitKeys(parked.row !== undefined ? syncSubmitBodyOfRow(parked.row) : { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "failed" }) };
+                        return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: syncHeld.word })) };
                     }
                     if (durableTaskId && deps.runStore)
                         await deps.runStore.setTerminal(durableTaskId, syncPlane.status, exitResult, syncPlane.errorMessage ?? null);
@@ -1055,4 +1085,9 @@ export const TASKS_ROUTES = [
     { id: "tasks-submit", path: "/v1/tasks", billable: "submit", methods: ["POST"] },
     { id: "tasks-submit-stream", path: "/v1/tasks/stream", billable: "submit", methods: ["POST"] },
 ];
+function heldLegOf(legId, taskId) {
+    if (legId === undefined)
+        throw new Error(`tasks route: run ${taskId} has no record of the holding leg its createRun handed back — wiring error, nothing keyed on the leg can be written`);
+    return legId;
+}
 //# sourceMappingURL=tasks.js.map

package/dist/http/routes/trace-usage.js

@@ -9,7 +9,7 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
 import { sendUnauthorized } from "../principal-gate.js";
-import { admitRunById, enter, entryIsFleet, readVisibleRun, routeListFilter, runRowAt } from "../owner-access.js";
+import { admitRunById, enter, entryIsFleet, listVisibleRuns, readVisibleRun, routeListFilter, runListOwnerOf, toolResultRefOwned } from "../owner-access.js";
 import { listFilterOf } from "../../owner-faces.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -42,7 +42,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
         const traceEntry = enter(req, res, deps, match.decl.id);
         if (traceEntry === undefined)
             return;
-        const gateOwner = listFilterOf(traceEntry.face, traceEntry.caller).gateOwner;
+        const traceFilter = listFilterOf(traceEntry.face, traceEntry.caller);
         const runs = facts.durableRuns(deps);
         if (!runs.available) {
             sendError(res, 501, "capability.run_store_required", "trace API requires a durable run store (DB_BACKEND=mysql|pg|local)");
@@ -61,20 +61,20 @@ export async function handleTraceUsage(req, res, match, ctx) {
         }
         switch (match.decl.id) {
             case "task-trace-list":
-                await handleTaskList(res, runStore, query, gateOwner);
+                await handleTaskList(res, runStore, query, traceFilter);
                 return;
             case "task-trace-turns":
                 await handleTaskTurns(res, runStore, admittedRun, query);
                 return;
             case "task-trace-stream":
-                await streamTaskTrace(req, res, runStore, admittedRun, match.search);
+                await streamTaskTrace(req, res, runStore, traceEntry, admittedRun, match.search);
                 return;
             case "task-trace-artifacts":
                 await handleTaskArtifacts(res, runStore, admittedRun);
                 return;
             case "task-tool-result": {
                 const ownedRun = admittedRun;
-                const readRun = ownedRun !== undefined ? async () => ownedRun : () => readVisibleRun(traceEntry, runStore, taskId);
+                const readRun = ownedRun !== undefined ? async () => ownedRun : async () => (await readVisibleRun(traceEntry, runStore, taskId))?.row;
                 await handleToolResult(res, deps.toolResultStore, taskId, readRun, safeDecode(match.params.ref), query);
                 return;
             }
@@ -161,11 +161,12 @@ function decodeCursor(s, expectF) {
         return undefined;
     }
 }
-async function handleTaskList(res, runStore, query, forceOwner) {
+async function handleTaskList(res, runStore, query, filter) {
     const status = query.get("status") ?? undefined;
     const jobId = query.get("jobId") ?? undefined;
     const source = query.get("source") ?? undefined;
-    const owner = forceOwner != null ? forceOwner : (query.get("owner") ?? undefined);
+    const namedOwner = query.get("owner") ?? undefined;
+    const owner = runListOwnerOf(filter, namedOwner);
     const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
     const f = filterFingerprint([status, jobId, source, owner]);
     const cursor = decodeCursor(query.get("cursor"), f);
@@ -173,7 +174,7 @@ async function handleTaskList(res, runStore, query, forceOwner) {
         sendError(res, 400, "request.cursor_filter_mismatch", "cursor was issued under a different filter (status/jobId/source/owner) — restart from the first page without a cursor");
         return;
     }
-    const rows = await runStore.listRuns({ ...(status ? { status } : {}), ...(jobId ? { jobId } : {}), ...(source ? { source } : {}), ...(owner ? { owner } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1 });
+    const rows = await listVisibleRuns(runStore, filter, namedOwner, { ...(status ? { status } : {}), ...(jobId ? { jobId } : {}), ...(source ? { source } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1 });
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const tasks = page.map((r) => taskSummary(r));
@@ -216,8 +217,7 @@ async function handleToolResult(res, store, taskId, readRun, ref, query) {
     const run = await readRun();
     if (!run)
         return notFound();
-    const owner = store?.ownerOf ? await store.ownerOf(ref) : undefined;
-    const ownedByThisCaller = owner !== undefined && owner.sessionId === run.sessionId && (owner.taskId === undefined || owner.taskId === taskId);
+    const ownedByThisCaller = await toolResultRefOwned(store, ref, run);
     if (!ownedByThisCaller)
         return notFound();
     if (!store)
@@ -240,7 +240,7 @@ async function handleTaskTurns(res, runStore, run, query) {
     const nextCursor = eligible.length > limit && oldest ? String(oldest.seq) : undefined;
     sendJson(res, 200, { turns, ...(nextCursor ? { nextCursor } : {}), retainedFrom });
 }
-async function streamTaskTrace(req, res, runStore, admitted, search) {
+async function streamTaskTrace(req, res, runStore, entry, admitted, search) {
     const taskId = admitted.taskId;
     const lastId = Number(req.headers["last-event-id"] ?? new URLSearchParams(search).get("from") ?? 0);
     let from = Number.isFinite(lastId) ? lastId : 0;
@@ -264,11 +264,11 @@ async function streamTaskTrace(req, res, runStore, admitted, search) {
         }
     };
     while (!closed) {
-        const [events, raw] = await Promise.all([runStore.getEvents(taskId, from), runStore.getRun(taskId)]);
+        const [events, reread] = await Promise.all([runStore.getEvents(taskId, from), readVisibleRun(entry, runStore, taskId)]);
         write(events);
-        if (!raw)
+        if (!reread)
             break;
-        const run = await runRowAt("task-trace-stream", runStore, raw);
+        const run = reread.row;
         if (run.status !== "running") {
             write(await runStore.getEvents(taskId, from));
             if (!deliveredTerminal && isHolderDeathVerdict(run))

package/dist/http/routes/workflows.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { type WorkflowRun } from "@sema-agent/core";
 import { type Admit } from "../../trace/projection-table.js";
 import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/** SVC-5 的 steer 路——`handle()` 里位置在 tasks/runs 之后(鉴权门之后),故是**独立**的域入口。 */
 /** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
  *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
 export declare function handleWorkflows(req: IncomingMessage, res: ServerResponse, match: RouteMatch<WorkflowsRouteId>, ctx: RouteCtx): Promise<void>;