@sema-agent/server 7.148.0 → 7.150.0

package/dist/plugins/workspace-custody.d.ts

@@ -0,0 +1,44 @@
+/**
+ * 执行环境工厂的工作区托管表 —— 「这只工作区现在归谁持有 / 能不能删」的唯一答者。local-docker(容器)与 host(本服务铸的临时目录)两条车道的工厂都经它铸环境、读它判删。
+ *
+ * ## 律
+ * 引擎 park-only 契约:`suspendable:false` 的远端环境断言工作区活过环境对象 —— 续跑由工厂重连到**同一只**工作区;引擎在续跑赢下之后丢掉停驻腿的环境、不销毁它
+ * (销毁了就是拆掉续跑腿正在用的工作区)。所以:
+ *  · **一只身份一只工作区**(身份 = 工厂上下文的 `taskId ?? sessionId`,与引擎交给工具的宿主任务号同一读法):同一身份还有一只没开始收场的环境 ⇒ 交回那一只
+ *    (停驻腿的环境引擎还拿着,续跑腿拿到的就是它);那一只正在收场 ⇒ 等它的收场落定再铸,它欠着的账交给新的这只;没有 ⇒ 铸一只入表。
+ *    同一身份同一时刻只有一条腿(会话锁 + run 认领),交回同一只不会让两条腿同时用它。
+ *  · **工作区的生命归持有它的环境,不归铸它的那一只**:表里每一只成员自己说它此刻持有哪只工作区;一只工作区能不能删 = 表里除问者之外还有没有成员持有它
+ *    ({@link WorkspaceCustody.holder})—— 没有才删,有就把删交给最后放手的那一只。
+ *
+ * ## 两条车道怎么读同一张表
+ *  · local-docker:工作区 = 身份派生名的那只容器;一只身份同一时刻只有一只没收场的成员(上面的交回律),容器名又由身份派生 ⇒ 不可能有第二个持有者,成员收场即删
+ *    (读 {@link WorkspaceCustody.envOf};欠账 = 删除没证实的那只容器,交给同一身份的下一只)。
+ *  · host:工作区 = 本服务铸的临时根;委派子代按父的工作目录落根 ⇒ 子代的环境与父的共持那只根(铸时问 {@link WorkspaceCustody.holder}「谁持有包含这一处的根」),
+ *    收场放手时问同一只「还有谁持有它」—— 父收场时子代还停驻在里面 ⇒ 父不删,子代最后一条腿收场时删。
+ *
+ * ## 出表
+ * 成员收场落定、什么都不欠、什么都不持有({@link CustodyMember.settled})⇒ 出表;没收场的成员(停驻腿的环境)一直在表里(停驻中被店层取消 / 过期的,引擎不销毁它,它持有的工作区
+ * 活到进程退出 —— local-docker 的容器由回收器按 run 行收,host 的目录由退出边界收)。
+ */
+/** 表里的一只成员(一只执行环境)向表说的四件事。 */
+export interface CustodyMember<Leftover> {
+    /** 收场的进度:没开始 ⇒ `undefined`(可以交回给同一身份的下一条腿);开始了 ⇒ 那一次收场(落定之后同一身份才铸新的)。 */
+    readonly releasing: Promise<void> | undefined;
+    /** 收场已落定。 */
+    readonly released: boolean;
+    /** 收场之后仍欠着、要交给同一身份下一只环境的账(local-docker:删除没证实的那只容器);不欠 ⇒ `undefined`。 */
+    readonly leftover: Leftover | undefined;
+    /** 什么都不再欠、不再持有 —— 出表。 */
+    readonly settled: boolean;
+}
+export interface WorkspaceCustody<E extends CustodyMember<L>, L> {
+    /**
+     * 这只身份的环境:还有一只没开始收场的 ⇒ 交回它;正在收场的 ⇒ 等它落定(再看一遍);都落定了 ⇒ 拿走欠账、铸一只入表。
+     * `mint` 抛 ⇒ 什么都不入表,原样抛。
+     */
+    envOf(identity: string, mint: (leftover: L | undefined) => E): Promise<E>;
+    /** 表里一只满足 `holds` 的成员(没有 ⇒ `undefined`)—— 「这只工作区现在还有谁持有」的唯一读法:问者把自己排除在 `holds` 里。 */
+    holder(holds: (member: E) => boolean): E | undefined;
+}
+export declare function createWorkspaceCustody<E extends CustodyMember<L>, L = never>(): WorkspaceCustody<E, L>;
+//# sourceMappingURL=workspace-custody.d.ts.map

package/dist/plugins/workspace-custody.js

@@ -0,0 +1,47 @@
+export function createWorkspaceCustody() {
+    const members = new Map();
+    const sweep = () => {
+        for (const member of members.keys())
+            if (member.settled)
+                members.delete(member);
+    };
+    return {
+        async envOf(identity, mint) {
+            for (;;) {
+                sweep();
+                const closing = [];
+                const owing = [];
+                for (const [member, id] of members) {
+                    if (id !== identity)
+                        continue;
+                    if (member.releasing === undefined)
+                        return member;
+                    if (!member.released)
+                        closing.push(member.releasing);
+                    else if (member.leftover !== undefined)
+                        owing.push(member);
+                }
+                if (closing.length > 0) {
+                    await Promise.allSettled(closing);
+                    continue;
+                }
+                let leftover;
+                for (const member of owing) {
+                    leftover = member.leftover;
+                    members.delete(member);
+                }
+                const env = mint(leftover);
+                members.set(env, identity);
+                return env;
+            }
+        },
+        holder(holds) {
+            sweep();
+            for (const member of members.keys())
+                if (holds(member))
+                    return member;
+            return undefined;
+        },
+    };
+}
+//# sourceMappingURL=workspace-custody.js.map

package/dist/process-instance.d.ts

@@ -0,0 +1,3 @@
+/** 本进程的身份(第一次调用时铸,之后恒同值)。 */
+export declare function processInstanceId(): string;
+//# sourceMappingURL=process-instance.d.ts.map

package/dist/process-instance.js

@@ -0,0 +1,7 @@
+import { uuidv7 } from "@sema-agent/core";
+let minted;
+export function processInstanceId() {
+    minted ??= uuidv7();
+    return minted;
+}
+//# sourceMappingURL=process-instance.js.map

package/dist/project-context.d.ts

@@ -0,0 +1,66 @@
+import { type ProjectRegistration } from "@sema-agent/settings-schema";
+import type { ListFilter } from "./owner-faces.js";
+/** 进简报 / 进 `cwd` 的登记字段(闭集)。每一格的写角色不低于 `prompts` 域(`test/project-context-inheritance.test.ts` 按 settings-schema 的 `writeRoleFor` 钉);身份字段永不在表里。 */
+export declare const PROJECT_BRIEF_FIELDS: readonly ["goal", "notes", "contextItems"];
+/** 进简报 / 进 `cwd` 的登记字段。 */
+export type ProjectBriefField = (typeof PROJECT_BRIEF_FIELDS)[number];
+/** 内容证明:配置中心写口在一次按写权表判过内容字段的写之后盖的时刻(写角色同为 publisher)。本服务只读在不在。 */
+export declare const PROJECT_CONTENT_ATTESTATION_FIELD: "contentAttestedAt";
+/** 继承判读得到的登记成员(类型上只够得着表内字段 + 可见性的属主键 + 内容证明)。 */
+export type ProjectContextSource = Pick<ProjectRegistration, ProjectBriefField | "registeredBy" | typeof PROJECT_CONTENT_ATTESTATION_FIELD>;
+/** 一条 run 继承到的项目上下文(冻结记录;随 run 落进续跑重建输入,续跑腿原样重放)。 */
+export interface ProjectContext {
+    /** 判出它的项目(登记簿键,小写)。 */
+    readonly projectId: string;
+    /** 继承的工作目录:第一条 `folder` 条目 —— 只在射程内(`callerOwnsWorkerDisk`)且请求没带 `cwd` 时在场。 */
+    readonly cwd?: string;
+    /** 项目简报(系统提示追加折叠的第二段);`projectMemory: "disabled"` 或无可列内容 ⇒ 缺席。 */
+    readonly brief?: string;
+}
+/** 继承判的输入(全部是新提交腿此刻读得到的事实)。 */
+export interface ProjectContextInput {
+    /** 这条腿的项目(`legProjectIdOf`);缺席 ⇒ 不继承。 */
+    readonly projectId: string | undefined;
+    /** 本部署的登记簿(`capability-facts.ts` `projectRegistry` 的见证);缺席 = 本部署没有登记簿 ⇒ 不继承。 */
+    readonly registry: Readonly<Record<string, ProjectContextSource>> | undefined;
+    /** 提交者在读面上的视域(读面同一只推导);缺席 = 没有请求 ⇒ 不继承。 */
+    readonly viewer: ListFilter | undefined;
+    /** 部署形表行 `callerOwnsWorkerDisk`:路径条目(继承 `cwd`、简报的路径两段)只在它成立时兑现。 */
+    readonly pathsHonored: boolean;
+    /** 请求体带了 `cwd`(非空串)⇒ 显式值赢,不填。 */
+    readonly requestCwd: boolean;
+    /** 请求 `projectMemory: "disabled"` ⇒ 不出简报。 */
+    readonly projectMemoryOff: boolean;
+}
+/** 继承判的答案:继承到的上下文,外加射程外未列的路径条目数(server 侧 warn 只计数,不记路径)。 */
+export interface ProjectContextDecision {
+    readonly context: ProjectContext | undefined;
+    readonly withheldPathItems: number;
+}
+/** 一只登记对这位观者可见吗(读面与继承同调的唯一判):全舰队视域看全部;否则只看 `registeredBy` 恰是自己的。看不见与不存在同答。 */
+export declare function projectVisible(registration: Pick<ProjectRegistration, "registeredBy">, viewer: ListFilter): boolean;
+/**
+ * 项目简报的唯一铸点(纯串;各段缺席不出,全缺席 ⇒ 无简报)。只读 {@link PROJECT_BRIEF_FIELDS};路径两段只在 `pathsHonored` 时出,且只列名字 ——
+ * `file` 条目未附上,段名写明「相关时去读」。首行点名来源与项目 id(不带 `displayName`:身份字段不进提示)。
+ */
+export declare function buildProjectBrief(projectId: string, registration: Pick<ProjectRegistration, ProjectBriefField>, pathsHonored: boolean): string | undefined;
+/**
+ * 继承判(唯一;调用点只有装配器头部的新提交腿)。项目缺席 / 本部署无登记簿 / 没有观者 / 未登记 / 看不见 / 无内容证明 ⇒ 不继承(不拒,与随机 id 同答)。
+ */
+export declare function projectContextOf(input: ProjectContextInput): ProjectContextDecision;
+/** 续跑重建输入里冻结的那一份的读数:缺席(没继承 / 7.150.0 之前写下的行)· 读得出 · 形不对。 */
+export type FrozenProjectContextReading = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "ok";
+    readonly context: ProjectContext;
+} | {
+    readonly kind: "malformed";
+};
+/**
+ * 冻结的那一份的**唯一读法**(读者 = `http/resume-ctx-read.ts` 的续跑上下文读口)。服务端写下的形是闭集(本文件 {@link projectContextOf} 铸、`buildCheckpointCtx` 原样落盘):
+ * 自有键只在 `projectId` / `cwd` / `brief` 里;`projectId` = 规范小写 UUID;`cwd` 在场 = 宿主绝对路径;`brief` 在场 = 非空串、不超过系统提示追加折叠的帽;
+ * `cwd` 与 `brief` 至少其一(都缺的不会被冻结)。别的形 ⇒ `malformed`(读口答坏体:续跑不重放它、不登记它的 `cwd`)。
+ */
+export declare function frozenProjectContextOf(stored: unknown): FrozenProjectContextReading;
+//# sourceMappingURL=project-context.d.ts.map

package/dist/project-context.js

@@ -0,0 +1,70 @@
+import { PROJECT_ID_REGEX } from "@sema-agent/core";
+import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
+import { MAX_SETTINGS_OUTPUT_STYLE_CHARS } from "./task-settings.js";
+export const PROJECT_BRIEF_FIELDS = ["goal", "notes", "contextItems"];
+export const PROJECT_CONTENT_ATTESTATION_FIELD = "contentAttestedAt";
+export function projectVisible(registration, viewer) {
+    return viewer.fleetWide || registration.registeredBy === viewer.gateOwner;
+}
+export function buildProjectBrief(projectId, registration, pathsHonored) {
+    const sections = [];
+    if (registration.goal !== undefined && registration.goal.length > 0)
+        sections.push(`## Goal\n${registration.goal}`);
+    if (registration.notes !== undefined && registration.notes.length > 0)
+        sections.push(`## Notes\n${registration.notes}`);
+    const items = registration.contextItems ?? [];
+    const notes = items.flatMap((item) => (item.kind === "note" && item.value.length > 0 ? [item.value] : []));
+    if (notes.length > 0)
+        sections.push(`## Project notes\n${notes.join("\n\n")}`);
+    if (pathsHonored) {
+        const folders = items.flatMap((item) => (item.kind === "folder" ? [`- ${item.value}`] : []));
+        if (folders.length > 0)
+            sections.push(`## Project folders\n${folders.join("\n")}`);
+        const files = items.flatMap((item) => (item.kind === "file" ? [`- ${item.value}`] : []));
+        if (files.length > 0)
+            sections.push(`## Project files (not attached — read them when relevant)\n${files.join("\n")}`);
+    }
+    if (sections.length === 0)
+        return undefined;
+    return [`# Project context (from this deployment's project registry; project ${projectId})`, ...sections].join("\n\n");
+}
+export function projectContextOf(input) {
+    const { projectId, registry, viewer } = input;
+    if (projectId === undefined || registry === undefined || viewer === undefined)
+        return { context: undefined, withheldPathItems: 0 };
+    const registration = Object.hasOwn(registry, projectId) ? registry[projectId] : undefined;
+    if (registration === undefined || !projectVisible(registration, viewer))
+        return { context: undefined, withheldPathItems: 0 };
+    if (registration[PROJECT_CONTENT_ATTESTATION_FIELD] === undefined)
+        return { context: undefined, withheldPathItems: 0 };
+    const items = registration.contextItems ?? [];
+    const withheldPathItems = input.pathsHonored ? 0 : items.filter((item) => item.kind !== "note").length;
+    const firstFolder = input.pathsHonored ? items.find((item) => item.kind === "folder")?.value : undefined;
+    const cwd = input.requestCwd ? undefined : firstFolder;
+    const brief = input.projectMemoryOff ? undefined : buildProjectBrief(projectId, registration, input.pathsHonored);
+    if (cwd === undefined && brief === undefined)
+        return { context: undefined, withheldPathItems };
+    return { context: { projectId, ...(cwd !== undefined ? { cwd } : {}), ...(brief !== undefined ? { brief } : {}) }, withheldPathItems };
+}
+export function frozenProjectContextOf(stored) {
+    if (stored === undefined)
+        return { kind: "absent" };
+    if (typeof stored !== "object" || stored === null || Array.isArray(stored))
+        return { kind: "malformed" };
+    if (!Object.keys(stored).every((k) => k === "projectId" || k === "cwd" || k === "brief"))
+        return { kind: "malformed" };
+    const own = (k) => (Object.hasOwn(stored, k) ? stored[k] : undefined);
+    const projectId = own("projectId");
+    const cwd = own("cwd");
+    const brief = own("brief");
+    if (typeof projectId !== "string" || !PROJECT_ID_REGEX.test(projectId) || projectId !== projectId.toLowerCase())
+        return { kind: "malformed" };
+    if (cwd !== undefined && (typeof cwd !== "string" || !isAbsoluteHostPath(cwd)))
+        return { kind: "malformed" };
+    if (brief !== undefined && (typeof brief !== "string" || brief.length === 0 || brief.length > MAX_SETTINGS_OUTPUT_STYLE_CHARS))
+        return { kind: "malformed" };
+    if (cwd === undefined && brief === undefined)
+        return { kind: "malformed" };
+    return { kind: "ok", context: { projectId, ...(cwd !== undefined ? { cwd } : {}), ...(brief !== undefined ? { brief } : {}) } };
+}
+//# sourceMappingURL=project-context.js.map

package/dist/project-identity.d.ts

@@ -25,16 +25,17 @@ export declare function assertProjectLayerOwnable(scope: string, envName: string
  */
 export declare function normalizeGitRemoteUrl(url: string): string | undefined;
 /**
- * 任务根 → 项目层身份([ref]):当前档(`r` 优先,没有 origin 退 `p`)+ 本 checkout 的低档(`r` 档时 = 它的 `p` 档)。
- * 缺席形 = 找根的缺席词(`bare` / `unreadable`);git 配置在而读不了 ⇒ `unreadable`。
+ * 任务根 → 项目层身份(文件头「项目身份一条律」):按档序(`project-layer-key.ts` `PROJECT_IDENTITY_TIERS`)取本检出有的各档 ——
+ * 每一档 = 它的身份文本的 {@link digest24}(`m`:记号里的项目 id;`r`:归一后的网络 origin;`p`:canonical 项目根,恒有)。
+ * 链首 = 当前档,其余 = `lowerTiers`(折叠来源)。缺席 = 找根的缺席词(`bare` / `unreadable`);git 配置在而读不了、或记号读不出 ⇒ `unreadable`。
  */
-export declare function projectLayerIdentityOf(taskRoot: string): {
+export declare function projectLayerIdentityOf(taskRoot: string): Promise<{
     readonly root: string;
     readonly identity: ProjectLayerIdentity;
     readonly lowerTiers: readonly ProjectLayerIdentity[];
 } | {
     readonly absent: ProjectIdentityAbsentReason;
-};
+}>;
 /** 一个任务的项目层:core 声明席 + 本 checkout 要折进来的低档 / 退役层(按序,`memory-project-layer.ts` 折)。 */
 export interface ProjectLayerOfTask {
     readonly key: MemoryProjectKey;
@@ -43,11 +44,11 @@ export interface ProjectLayerOfTask {
 /**
  * 任务根 → 项目层([ref]:`userrepo:<属主段>/<档>.<摘要>`,属主 = `owner`,调用方由 `projectLayerOwnerOf(全局层)` 求得)。
  * `foldFrom` = 同一 checkout 能推出的旧层:退役 `repo:<同一路径哈希>`(一次性迁移,窗见 `plugins/one-time-migrations.ts` 登记表 M25)
- * + 当前档是 `r` 时它的 `p` 档(常设律)。
+ * + 当前档之下的每一档(常设律:`m` 档折 `r` / `p`,`r` 档折 `p`)。
  * `taskRoot === undefined` = 调用方**此刻不知道**任务根在本机哪里(根在沙箱/设备盘上;或 host 车道会话没登记 cwd、手落在 factory 现铸的
  * 临时目录)⇒ `unreadable` —— 「我看不到」,不是「这里没有项目」。
  */
-export declare function projectLayerForTaskRoot(taskRoot: string | undefined, owner: string): ProjectLayerOfTask;
+export declare function projectLayerForTaskRoot(taskRoot: string | undefined, owner: string): Promise<ProjectLayerOfTask>;
 /** {@link projectLayerForTaskRoot} 的声明席投影(core `TaskSpec.memory.projectKey`)。 */
-export declare function projectKeyForTaskRoot(taskRoot: string | undefined, owner: string): MemoryProjectKey;
+export declare function projectKeyForTaskRoot(taskRoot: string | undefined, owner: string): Promise<MemoryProjectKey>;
 //# sourceMappingURL=project-identity.d.ts.map

package/dist/project-identity.js

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
-import { encodeScopeSegment } from "@sema-agent/core";
-import { mintProjectLayerKey, PROJECT_LAYER_KEY_PREFIX, projectLayerOwnerOf } from "./project-layer-key.js";
+import { encodeScopeSegment, NodeExecutionEnv, resolveProjectId } from "@sema-agent/core";
+import { errorCodeOf } from "./observability/err-text.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+import { mintProjectLayerKey, PROJECT_IDENTITY_TIERS, PROJECT_LAYER_KEY_PREFIX, projectLayerOwnerOf } from "./project-layer-key.js";
 const UNREADABLE = { absent: "unreadable" };
 const BARE = { absent: "bare" };
 function isMissing(err) {
@@ -87,10 +89,7 @@ function canonicalTaskRoot(taskRoot) {
         p = parent;
     }
 }
-function locateProject(taskRoot) {
-    const root = canonicalTaskRoot(taskRoot);
-    if (root === "unreadable")
-        return UNREADABLE;
+function locateProject(root) {
     let sawBareLayout = false;
     for (let dir = root.existing;;) {
         const dotGit = statFact(join(dir, ".git"));
@@ -240,23 +239,47 @@ export function normalizeGitRemoteUrl(url) {
 function cleanRemotePath(p) {
     return p.replace(/\/+/g, "/").replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
 }
-export function projectLayerIdentityOf(taskRoot) {
-    const located = locateProject(taskRoot);
+async function markerFact(canonicalTaskRoot) {
+    try {
+        const marker = await resolveProjectId(new NodeExecutionEnv({ cwd: canonicalTaskRoot }), canonicalTaskRoot);
+        return marker === null ? "missing" : { ok: marker.projectId };
+    }
+    catch (err) {
+        recordFailOpen("server.memory.project-marker-unreadable", `code=${errorCodeOf(err) ?? "-"}`);
+        return "unreadable";
+    }
+}
+export async function projectLayerIdentityOf(taskRoot) {
+    const canonical = canonicalTaskRoot(taskRoot);
+    if (canonical === "unreadable")
+        return UNREADABLE;
+    const located = locateProject(canonical);
     if (!("root" in located))
         return located;
-    const path = { tier: "p", digest: digest24(located.root) };
     const origin = located.gitConfig !== undefined ? readOriginRemoteUrl(located.gitConfig) : "missing";
     if (origin === "unreadable")
         return UNREADABLE;
-    const remote = origin === "missing" || origin.ok === undefined ? undefined : normalizeGitRemoteUrl(origin.ok);
-    if (remote === undefined)
-        return { root: located.root, identity: path, lowerTiers: [] };
-    return { root: located.root, identity: { tier: "r", digest: digest24(remote) }, lowerTiers: [path] };
+    const marker = await markerFact(canonical.canonical);
+    if (marker === "unreadable")
+        return UNREADABLE;
+    const identityText = {
+        m: marker === "missing" ? undefined : marker.ok,
+        r: origin === "missing" || origin.ok === undefined ? undefined : normalizeGitRemoteUrl(origin.ok),
+        p: located.root,
+    };
+    const chain = PROJECT_IDENTITY_TIERS.flatMap((tier) => {
+        const text = identityText[tier];
+        return text === undefined ? [] : [{ tier, digest: digest24(text) }];
+    });
+    const [identity, ...lowerTiers] = chain;
+    if (identity === undefined)
+        return UNREADABLE;
+    return { root: located.root, identity, lowerTiers };
 }
-export function projectLayerForTaskRoot(taskRoot, owner) {
+export async function projectLayerForTaskRoot(taskRoot, owner) {
     if (taskRoot === undefined)
         return { key: UNREADABLE, foldFrom: [] };
-    const id = projectLayerIdentityOf(taskRoot);
+    const id = await projectLayerIdentityOf(taskRoot);
     if (!("identity" in id))
         return { key: { absent: id.absent }, foldFrom: [] };
     return {
@@ -264,7 +287,7 @@ export function projectLayerForTaskRoot(taskRoot, owner) {
         foldFrom: [mintRepoScopeKey(id.root), ...id.lowerTiers.map((tier) => mintProjectLayerKey(owner, tier))],
     };
 }
-export function projectKeyForTaskRoot(taskRoot, owner) {
-    return projectLayerForTaskRoot(taskRoot, owner).key;
+export async function projectKeyForTaskRoot(taskRoot, owner) {
+    return (await projectLayerForTaskRoot(taskRoot, owner)).key;
 }
 //# sourceMappingURL=project-identity.js.map

package/dist/project-layer-key.d.ts

@@ -1,7 +1,18 @@
 /** 项目层键的前缀(改名链的前缀词表也读它)。 */
 export declare const PROJECT_LAYER_KEY_PREFIX = "userrepo:";
-/** 身份档:`r` = 仓库身份(origin 远端,跨设备),`p` = 项目根路径(本机)。 */
-export type ProjectIdentityTier = "r" | "p";
+/** 身份档:`m` = 检出的记号(项目 id),`r` = 仓库身份(origin 远端,跨设备),`p` = 项目根路径(本机)。 */
+export type ProjectIdentityTier = "m" | "r" | "p";
+/**
+ * **档序**(高 → 低)—— 唯一成文处。两只读者:
+ *  · 一只检出的档链(`project-identity.ts` `projectLayerIdentityOf`):按本序取它有的各档,链首 = 当前档,其余 = 折叠来源(低档);
+ *  · 同步轮的层序({@link compareProjectLayersForSync}):低档先于高档。
+ */
+export declare const PROJECT_IDENTITY_TIERS: readonly ProjectIdentityTier[];
+/**
+ * 同步轮里两只项目层键的先后:**低档在前**,同档按键序。折叠把条目从低档搬到高档、id 保留 ⇒ 同一轮先在源层推删除、再在高档推新增,
+ * 中心那一侧同一个 id 不会先撞上源层里的自己。不是项目层的键(调用方本不该给)排在最后。
+ */
+export declare function compareProjectLayersForSync(a: string, b: string): number;
 /** 一个项目的身份段(档 + 24 位小写十六进制摘要)。 */
 export interface ProjectLayerIdentity {
     readonly tier: ProjectIdentityTier;

package/dist/project-layer-key.js

@@ -1,7 +1,15 @@
 import { decodeScopeSegment, encodeScopeSegment, parseScopeKey } from "@sema-agent/core";
 export const PROJECT_LAYER_KEY_PREFIX = "userrepo:";
+export const PROJECT_IDENTITY_TIERS = ["m", "r", "p"];
+export function compareProjectLayersForSync(a, b) {
+    const rank = (key) => {
+        const tier = parseProjectLayerKey(key)?.identity.tier;
+        return tier === undefined ? -1 : PROJECT_IDENTITY_TIERS.indexOf(tier);
+    };
+    return rank(b) - rank(a) || (a < b ? -1 : a > b ? 1 : 0);
+}
 const DIGEST = /^[0-9a-f]{24}$/;
-const KEY = /^userrepo:((?:[A-Za-z0-9._-]|%[0-9A-F]{2})+)\/([rp])\.([0-9a-f]{24})$/;
+const KEY = /^userrepo:((?:[A-Za-z0-9._-]|%[0-9A-F]{2})+)\/([mrp])\.([0-9a-f]{24})$/;
 export function projectLayerOwnerOf(globalScope) {
     const parsed = parseScopeKey(globalScope);
     return parsed.kind === "user" ? parsed.principal : globalScope;

package/dist/question.d.ts

@@ -9,15 +9,15 @@ export interface QuestionFrame {
     /** "question" only: the model's structured questions, secret-redacted. UNTRUSTED-for-display (shell renders; never
      *  re-feeds a model). Absent on an over-cap payload (the ask then reports unavailable — no frame is emitted at all). */
     questions?: AskQuestion[];
-    /** "question_complete" only: whether the human answered (`answered`) or the ask was released unanswered
-     *  (`unanswered` — ttl/abort → core was told nobody was reachable). Cosmetic dialog-dismiss. */
+    /** "question_complete" only: whether the human answered (`answered`) or the ask closed without an answer
+     *  (`unanswered` — window elapsed / abort / leg-exit sweep). Cosmetic dialog-dismiss. */
     outcome?: "answered" | "unanswered";
     /** Server-signed emit timestamp (additive, [ref]§五→[ref]). Server-minted side-frame ⇒ no core-stream
      *  `eventId` to carry (absence is honest); this is the frame's own time coordinate. */
     serverNowMs?: number;
     /** "question" only ([ref]③, additive, the `tool_approval` window-trio precedent from [ref]): the
-     *  coordinator's OWN answer window (`QUESTION_TTL_MS`, default 5min) — at expiry the ask releases
-     *  UNAVAILABLE ("unanswered") and core adjudicates park-vs-continue. Minted from the SAME `ttlMs` the
+     *  coordinator's OWN answer window (`QUESTION_TTL_MS`, default 5min) — at expiry the ask closes ("unanswered"); core hears
+     *  a delivery failure when a live face presented the card, `unavailable` otherwise ({@link seamOutcomeOf}). Minted from the SAME `ttlMs` the
      *  `setTimeout` below actually arms (single source; a shell countdown rendered from these can never
      *  disagree with the release). Relative + absolute + `serverNowMs` above = clock-skew-proof trio. */
     expiresInMs?: number;
@@ -30,9 +30,7 @@ export interface QuestionFrame {
  *  awaiting a human when the run aborts.
  *
  *  The ledger carries the CARD, not the answer door: `POST /v1/questions/:id/respond` stays live-only (this replica's
- *  memory, `ttlMs`), so a replayed card is answerable only until its own `expiresAtMs` and only on this replica.
- *  The adjudication probe ({@link QuestionCoordinator.hasLiveContext}) reads the same transport's `reachable()` — one
- *  reading of "can this leg's face show a card right now?". */
+ *  memory, `ttlMs`), so a replayed card is answerable only until its own `expiresAtMs` and only on this replica. */
 export interface QuestionRunContext {
     taskId: string;
     owner: string | null;
@@ -73,12 +71,11 @@ export declare class QuestionCoordinator {
     private readonly throttle;
     constructor(throttle?: QuestionThrottle);
     /** Run `fn` with the per-run question context ambient. On exit, release any still-pending question for this run (a
-     *  live-only question cannot outlive its leg → unavailable) and drop the run's counters (no leak). */
+     *  live-only question cannot outlive its leg → released) and drop the run's counters (no leak). */
     runWithContext<T>(ctx: QuestionRunContext, fn: () => Promise<T>): Promise<T>;
-    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; the resolved outcome is what
-     *  core acts on — a {@link QuestionAnswer} ONLY when a human really answered, otherwise `{kind:"unavailable"}` (core
-     *  then parks on a durable leg / continues with the `declined_unavailable` card on a non-durable one; either way the
-     *  run never hangs). Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
+    /** `RunnerDeps.onQuestion`. core calls this when the agent's AskUserQuestion tool fires; what it settles to is what core
+     *  acts on — a {@link QuestionAnswer} ONLY when a human really answered; a THROW when a live face presented the card and its
+     *  window elapsed unanswered; `{kind:"unavailable"}` otherwise ({@link seamOutcomeOf}). Either way the run never hangs. Arrow property so it can be passed as `onQuestion: coordinator.question` with `this` bound. */
     question: (req: AskQuestionRequest, signal?: AbortSignal) => Promise<OnQuestionOutcome>;
     /** `POST /v1/questions/:id/respond` — resolve a parked question with the shell's answer. Owner-gated with a 404 (no
      *  existence oracle): a non-owner AND an unknown id (answered / expired / wrong replica) both get 404. Returns the
@@ -89,15 +86,6 @@ export declare class QuestionCoordinator {
     };
     /** Test/observability hook: number of currently-parked questions. */
     pendingCount(): number;
-    /** [ref] ([ref] 案二):durable 部署上的 AskUserQuestion 判决探针——本调用点是否处在某条**投递得到人的**
-     *  活流腿上(runWithContext 包裹的 bg/SSE 腿=true;sync /v1/tasks、verify/cascade、durable resume 驱动=false)。
-     *  resolve-spec 的 durable question policy 用它在**判决时**分腿:有活流 ⇒ allow(问活人),无 ⇒
-     *  ask(durable park)。ALS 让这个判断天然 per-leg,policy 组装期不必预知腿别。
-     *  🔴 判据是「投递面此刻可达」而不只是「ALS 在场」(复审 A1):detach 腿断连后 run 仍在本作用域里跑,
-     *  只判 ALS 会把一条谁也收不到的问题判成 allow;park 才是它该走的腿。读的是本腿传输的 `reachable()`
-     *  (有直写面 ⇒ 直写此刻活着;只有账本 ⇒ 恒真,后台腿的 durable events tail 语义;谓词读不出 ⇒ 假,判决面 fail-closed 到 park)。
-     *  只服务判决面:判决放行之后的开帧投递只读传输律(有账本的腿上死直写 = 卡在账本里,送到)。 */
-    hasLiveContext(): boolean;
     private countersFor;
 }
 //# sourceMappingURL=question.d.ts.map

package/dist/question.js

@@ -12,6 +12,20 @@ export const DEFAULT_QUESTION_THROTTLE = {
     ttlMs: 5 * 60_000,
 };
 const UNAVAILABLE = Object.freeze({ kind: "unavailable" });
+const RELEASED = Object.freeze({ kind: "released" });
+const WINDOW_ELAPSED = Object.freeze({ kind: "window_elapsed" });
+function seamOutcomeOf(settlement, presentedLive, ttlMs) {
+    switch (settlement.kind) {
+        case "answered":
+            return settlement.answer;
+        case "released":
+            return UNAVAILABLE;
+        case "window_elapsed":
+            if (!presentedLive)
+                return UNAVAILABLE;
+            throw new Error(`the question was shown on this run's live stream and nobody answered it within its ${ttlMs / 1000}s answer window`);
+    }
+}
 export function parseQuestionResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
@@ -61,7 +75,7 @@ export class QuestionCoordinator {
             finally {
                 for (const [, p] of [...this.pending]) {
                     if (p.taskId === ctx.taskId)
-                        p.settle(UNAVAILABLE, "unanswered");
+                        p.settle(RELEASED);
                 }
                 this.counters.delete(ctx.taskId);
             }
@@ -83,9 +97,9 @@ export class QuestionCoordinator {
         rc.inflight += 1;
         let done = false;
         let timer;
-        let resolveAnswer;
-        const answerP = new Promise((resolve) => { resolveAnswer = resolve; });
-        const settle = (a, outcome) => {
+        let resolveSettled;
+        const settledP = new Promise((resolve) => { resolveSettled = resolve; });
+        const settle = (s) => {
             if (done)
                 return;
             done = true;
@@ -95,12 +109,10 @@ export class QuestionCoordinator {
             ctx.abortSignal?.removeEventListener("abort", onAbort);
             this.pending.delete(id);
             rc.inflight = Math.max(0, rc.inflight - 1);
-            lastOutcome = outcome;
-            resolveAnswer(a);
+            resolveSettled(s);
         };
-        let lastOutcome = "unanswered";
-        const onAbort = () => settle(UNAVAILABLE, "unanswered");
-        timer = setTimeout(() => settle(UNAVAILABLE, "unanswered"), this.throttle.ttlMs);
+        const onAbort = () => settle(RELEASED);
+        timer = setTimeout(() => settle(WINDOW_ELAPSED), this.throttle.ttlMs);
         timer.unref?.();
         signal?.addEventListener("abort", onAbort, { once: true });
         ctx.abortSignal?.addEventListener("abort", onAbort, { once: true });
@@ -108,7 +120,7 @@ export class QuestionCoordinator {
         const now = Date.now();
         const race = createHitlOpenRace({
             targets: [{ transport: ctx.transport, frame: { type: "question", questionId: id, questions, serverNowMs: now, expiresInMs: this.throttle.ttlMs, expiresAtMs: now + this.throttle.ttlMs } }],
-            settled: answerP,
+            settled: settledP,
         });
         const phase = await race.phase;
         if (phase === "delivered") {
@@ -116,7 +128,7 @@ export class QuestionCoordinator {
         }
         else if (phase === "undelivered") {
             recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
-            settle(UNAVAILABLE, "unanswered");
+            settle(RELEASED);
         }
         else {
             void race.landing.then((late) => {
@@ -126,9 +138,10 @@ export class QuestionCoordinator {
                     recordFailOpen("server.question.open-frame-undelivered", `question=${id}`);
             });
         }
-        const answer = await answerP;
-        race.close({ type: "question_complete", questionId: id, outcome: lastOutcome, serverNowMs: Date.now() });
-        return answer;
+        const settlement = await settledP;
+        race.close({ type: "question_complete", questionId: id, outcome: settlement.kind === "answered" ? "answered" : "unanswered", serverNowMs: Date.now() });
+        const presentedLive = settlement.kind === "window_elapsed" && phase === "delivered" && (await race.acceptedLive(0));
+        return seamOutcomeOf(settlement, presentedLive, this.throttle.ttlMs);
     };
     respond(id, principal, body) {
         const parsed = parseQuestionResponse(body);
@@ -138,16 +151,12 @@ export class QuestionCoordinator {
         if (!entry || !keyAdmits("ask.answer", { subject: recoveredSubject(principal), operator: false }, ownerCellOf(entry.owner))) {
             return { status: 404, body: refusalBody({ errorCode: "question.not_pending", message: "no pending question for this id (answered, expired, or not on this replica)" }) };
         }
-        entry.settle(parsed.value, "answered");
+        entry.settle({ kind: "answered", answer: parsed.value });
         return { status: 200, body: { questionId: id, delivery: "applied" } };
     }
     pendingCount() {
         return this.pending.size;
     }
-    hasLiveContext() {
-        const ctx = this.als.getStore();
-        return ctx !== undefined && ctx.transport.reachable();
-    }
     countersFor(taskId) {
         let rc = this.counters.get(taskId);
         if (!rc) {

package/dist/read-deny-floor-notice.d.ts

@@ -0,0 +1,36 @@
+/** 引擎的码(`tools/fs/read-floor.js` 的字面量;包根不导出)—— 通告与拒起同一个词。 */
+export declare const READ_DENY_FLOOR_UNKEPT = "config.read_deny_floor_unkept";
+/** 终局结果上的那一格(`PersistedResultSideKeys.readDenyFloor`):在场 ⇔ 这条 run 照跑了、它的读拒行不按字节守。 */
+export interface ReadDenyFloorSummary {
+    readonly code: typeof READ_DENY_FLOOR_UNKEPT;
+    readonly message: string;
+}
+/** 呈现只读部署的执行车道(活读,不拷值)。 */
+interface ReadDenyFloorDeployment {
+    readonly remoteExec: {
+        readonly provider: string;
+    };
+}
+/** 进程入口装一次(`boot/execution-lane.ts` 的 `settleReadDenyFloor`);再装 = 换成新的部署(同进程只有一个部署;测试按需各装)。 */
+export declare function installReadDenyFloorDeployment(deployment: ReadDenyFloorDeployment): void;
+/** 记录的上限:一条 run 从准备期(通告)到出口封口(结果)之间,本进程里又有这么多条照跑的 run 起步,它的那一条才会被挤掉。 */
+export declare const RAN_RUNS_CAP = 10000;
+/**
+ * 转发体的第一步(每条引擎通告都过,先于日志与分流):{@link READ_DENY_FLOOR_UNKEPT} ⇒ `message` 换成本仓那一句(`ran`),记下 `detail.runId`,
+ * 归属 = 这条 run 所在的腿(见顶注「帧投到哪条流」):顶层 `sessionId`(分流器先读它)= 腿的会话,投递键 `taskId` = 腿的 run;腿没有 run 资源 / 作用域外 ⇒ 引擎填的原样、无投递键;
+ * 其余码 / 没装部署 ⇒ 同一引用原样。`detail` 不动(引擎的 `rowCount` / `sessionId` / `runId`)。
+ */
+export declare function presentEngineNotice<N extends {
+    readonly code: string;
+    readonly message: string;
+    readonly detail?: Record<string, unknown>;
+    readonly sessionId?: unknown;
+}>(notice: N): N & {
+    readonly taskId?: string;
+};
+/** 失败终局的对外句(`terminal.ts` 两只出口属主读它):{@link READ_DENY_FLOOR_UNKEPT} ⇒ 本仓那一句(`refused`);别的码 / 没装部署 ⇒ `undefined`(句子不归这里)。 */
+export declare function readDenyFloorRefusalMessage(code: string): string | undefined;
+/** 一条结果(按它的 `runId`)该带的那一格;这条 run 没有被呈现过的通告 ⇒ `undefined`。 */
+export declare function readDenyFloorSummaryOf(runId: unknown): ReadDenyFloorSummary | undefined;
+export {};
+//# sourceMappingURL=read-deny-floor-notice.d.ts.map