@sema-agent/server 7.148.0 → 7.150.0

package/dist/read-deny-floor-notice.js

@@ -0,0 +1,40 @@
+import { buildReadDenyFloorSentence } from "./execution-lane-caps.js";
+import { currentModelReachLeg } from "./model-reach-scope.js";
+export const READ_DENY_FLOOR_UNKEPT = "config.read_deny_floor_unkept";
+let installed;
+export function installReadDenyFloorDeployment(deployment) {
+    installed = deployment;
+}
+export const RAN_RUNS_CAP = 10_000;
+const ranRuns = new Set();
+function noteRan(runId) {
+    ranRuns.delete(runId);
+    ranRuns.add(runId);
+    while (ranRuns.size > RAN_RUNS_CAP) {
+        const oldest = ranRuns.values().next();
+        if (oldest.done === true)
+            break;
+        ranRuns.delete(oldest.value);
+    }
+}
+export function presentEngineNotice(notice) {
+    if (notice.code !== READ_DENY_FLOOR_UNKEPT || installed === undefined)
+        return notice;
+    const runId = notice.detail?.runId;
+    if (typeof runId === "string" && runId.length > 0)
+        noteRan(runId);
+    const leg = currentModelReachLeg();
+    const message = buildReadDenyFloorSentence(installed.remoteExec.provider, "ran");
+    return leg?.taskId !== undefined ? { ...notice, message, sessionId: leg.sessionId, taskId: leg.taskId } : { ...notice, message };
+}
+export function readDenyFloorRefusalMessage(code) {
+    if (code !== READ_DENY_FLOOR_UNKEPT || installed === undefined)
+        return undefined;
+    return buildReadDenyFloorSentence(installed.remoteExec.provider, "refused");
+}
+export function readDenyFloorSummaryOf(runId) {
+    if (typeof runId !== "string" || !ranRuns.has(runId) || installed === undefined)
+        return undefined;
+    return { code: READ_DENY_FLOOR_UNKEPT, message: buildReadDenyFloorSentence(installed.remoteExec.provider, "ran") };
+}
+//# sourceMappingURL=read-deny-floor-notice.js.map

package/dist/{plain-string-record.d.ts → request-declaration-disposition.d.ts}

@@ -1,27 +1,13 @@
-/** 一个没进副本的成员:名字(调用方写的,原样;回显前由调用点清洗)与它为什么不能交(只说种类,不回显值)。 */
-export interface PlainStringRecordMemberFault {
-    readonly name: string;
-    readonly fault: string;
-}
 /**
- * {@link readPlainStringRecord} 的读数(见模块头注的律):`ok:false` = 记录不交(`fault` 只说种类;坏在某个成员时 `member` 点名它);
- * `ok:true` = 交出去的纯数据副本 + 被剔掉的 `__proto__` 名成员(按记录里的顺序;恒只有这一种成员会被剔)。
- * `ok:false` 的 `fault` 是接在「its member "<名>" 」后面的原因句;成员名恰是 `__proto__` 而值也坏时,这一句同时说两件事(名不许、值必须是串)。
+ * 请求面一份声明(MCP 条目 / A2A 对端)里每个键的**去处**:处置表机制与唯一拆法 —— 两条请求腿同读。
+ *
+ * ## 律(一条):「名 → 串」记录从不进交给引擎的声明
+ * 引擎的声明收据对带 `headers` / `env` 的声明整条拒(`config.credential_in_declaration`):一份声明至多带一只不透明引用,件由部署的对端座在每次发送时作答。
+ * 所以请求面一份声明按它的**处置表**({@link DeclarationDispositionTable};MCP 两臂在 `mcp-assertion-header.ts`,A2A 对端在 `task-a2a.ts`)由 {@link splitDeclaration} 一只函数拆开:
+ * 标 `engine` 的键进交给引擎的声明,标 `seat` 的那一张记录(契约包「名 → 串」记录读法 `readPlainStringRecord` 交出的副本 —— MCP `transport.env` / `transport.headers` 与 A2A `headers` 同一只读法)进草稿的件,
+ * 标 `withheld` 的键两边都不进。草稿只有胜出者(部署同名者赢)才交给对端座登记,登记换来的引用放进声明的引用位 —— 交给引擎的声明里零件值。
+ * 件的名与值由引擎的座答读器在每次发送时判(名不是头名 / 变量名、值带 CR / LF / NUL 等 ⇒ 那一台不发、兄弟照挂),受理只判形、不替它判。
  */
-export type PlainStringRecordRead = {
-    readonly ok: true;
-    readonly record: Record<string, string>;
-    readonly stripped: readonly PlainStringRecordMemberFault[];
-} | {
-    readonly ok: false;
-    readonly fault: string;
-    readonly member?: string;
-};
-/**
- * 读一份「名 → 串」记录(见模块头注的律)。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算,与引擎收据同读法),值按属性描述读:
- * 数据属性取值,访问器调一次。先判每个成员的值(`__proto__` 名的成员也判:它的值不是串 ⇒ 整只不交,与 7.131.x 同),再剔 `__proto__` 名。调用方的对象不被交出去、也不被改。
- */
-export declare function readPlainStringRecord(v: unknown): PlainStringRecordRead;
 /**
  * 请求面一份声明里每个键的**去处**(闭集;{@link splitDeclaration} 对它穷尽 `switch`):
  *  · `engine`   —— 进交给引擎的声明;
@@ -60,4 +46,4 @@ export declare function splitDeclaration<R extends object, T extends Declaration
     readonly engine: Pick<R, EngineKeysOf<T> & keyof R>;
     readonly pieces?: Readonly<Record<string, string>>;
 };
-//# sourceMappingURL=plain-string-record.d.ts.map
+//# sourceMappingURL=request-declaration-disposition.d.ts.map

package/dist/request-declaration-disposition.js

@@ -0,0 +1,39 @@
+export function declarationKeys(table) {
+    return Object.freeze(Object.keys(table));
+}
+export function splitDeclaration(declaration, table) {
+    const dispositions = table;
+    const engine = {};
+    let pieces;
+    let seatSeen = false;
+    for (const [key, value] of Object.entries(declaration)) {
+        if (value === undefined)
+            continue;
+        const disposition = Object.hasOwn(dispositions, key) ? dispositions[key] : undefined;
+        switch (disposition) {
+            case "engine":
+                engine[key] = value;
+                break;
+            case "seat": {
+                if (seatSeen)
+                    throw new Error("request declaration: two members are marked as pieces in one disposition table");
+                seatSeen = true;
+                const record = value;
+                if (Object.keys(record).length > 0)
+                    pieces = record;
+                break;
+            }
+            case "withheld":
+                break;
+            case undefined:
+                throw new Error(`request declaration: a member the disposition table does not classify (${JSON.stringify(key.slice(0, 40))})`);
+            default: {
+                const unknownDisposition = disposition;
+                void unknownDisposition;
+                throw new Error("request declaration: a disposition outside the closed set");
+            }
+        }
+    }
+    return { engine: engine, ...(pieces === undefined ? {} : { pieces }) };
+}
+//# sourceMappingURL=request-declaration-disposition.js.map

package/dist/run-cancel-card.d.ts

@@ -0,0 +1,28 @@
+/**
+ * **取消动词在一条 run 的会话上会结算的那一张卡 —— 找法的唯一属主**(怎么结算它是 `card-settle-stored-scope.ts` 全仓共用的那一只)。两个读者同读这里,没有第二份:
+ *  · `POST /v1/runs/:id/cancel` 的停驻取消腿找卡(`routes/runs.ts` 的 `cancelSuspended`);
+ *  · 判坏的停驻卡的出路投影(`resume-legs.ts` 的 `rowWayOutOf`:`cancel_run` 当且仅当取消动词会结算**这一张**)。
+ *
+ * ## 规则一条:取消只读店的列,不读行体
+ * 取消要的两样 —— 这条 run 在等哪一张卡、它是不是活 run 的门 —— 都是列上的事实:找卡读归属 / 门型列(`findPendingTokenBySession` 的 run 绑定)。
+ * 行体怎么坏(读不成检查点、属主格丢了或与列不一致、整格 `{}`)都不改变取消落不落得下。属主门是路由层的 run 行属主复核(`admitRunById`),不在这里。
+ *
+ * ## 为什么出路投影问同一问
+ * 投影若另按载入的行体判「取消落不落得下」,就是同一件事的第二个读者(行体坏得越厉害,它越说不出出路,而取消恰在那时最需要被指出来)。
+ * 所以投影问取消动词自己那一问:有 run 店、那条会话上的 run 停着、取消动词找到的恰是这一张卡({@link cancelSettlesCard})。
+ */
+import type { CheckpointToken } from "@sema-agent/core";
+import type { CheckpointStoreFull, RunStore } from "./plugins/store-backend.js";
+/** 取消动词在 `runSessionId` 这条 run 的会话上会结算的那一张卡;没有 ⇒ `null`。 */
+export declare function runCancelCardOf(cs: Pick<CheckpointStoreFull, "findPendingTokenBySession">, runSessionId: string): Promise<CheckpointToken | null>;
+/** 取消动词要问的 run 行的两口:这条会话上持着认领的 run、它的状态(不带属主的一格事实,只经属主存取器读)。 */
+export type CancelRunReader = Pick<RunStore, "getActiveTaskId" | "getRun">;
+/**
+ * 取消动词会不会结算 `token` 这一张 —— 出路投影问的就是这一问,三个条件都是取消口自己的:
+ *  · 有耐久 run 店(没有 ⇒ 取消口恒 `501 capability.run_store_required`,谈不上结算);
+ *  · 这张卡归属的 run 会话上持着认领的那条 run **停着**(`suspended` / `needs_review`):取消口只对停着的 run 走结算卡那一腿 ——
+ *    终局的 run 是空操作(卡不动),在跑的 run 只挂取消旗(卡不动);归属说不出 —— M49 回填前的老行 —— 也找不到 run;
+ *  · 取消动词在那条会话上找到的恰是这一张({@link runCancelCardOf};终局后的纯 park 排除在外)。
+ */
+export declare function cancelSettlesCard(cs: Pick<CheckpointStoreFull, "hostSessionOfCard" | "findPendingTokenBySession">, runs: CancelRunReader | undefined, token: CheckpointToken): Promise<boolean>;
+//# sourceMappingURL=run-cancel-card.d.ts.map

package/dist/run-cancel-card.js

@@ -0,0 +1,20 @@
+import { LIVE_RUN_GATE_KINDS } from "./plugins/checkpoint-store-face.js";
+import { isParkedRunStatus } from "./plugins/store-contracts.js";
+import { runFactsOf } from "./http/owner-access.js";
+const RUN_CANCEL_CARD = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
+export function runCancelCardOf(cs, runSessionId) {
+    return cs.findPendingTokenBySession(runSessionId, undefined, RUN_CANCEL_CARD);
+}
+export async function cancelSettlesCard(cs, runs, token) {
+    if (runs === undefined)
+        return false;
+    const host = await cs.hostSessionOfCard(token);
+    if (typeof host !== "string")
+        return false;
+    const holder = await runs.getActiveTaskId(host);
+    if (holder === undefined)
+        return false;
+    const run = await runFactsOf(runs, holder);
+    return run !== undefined && isParkedRunStatus(run.status) && (await runCancelCardOf(cs, host)) === token;
+}
+//# sourceMappingURL=run-cancel-card.js.map

package/dist/run-cancel-context.d.ts

@@ -68,13 +68,23 @@ export declare const CANCELLED_CODE = "cancelled";
  * `cause` 是**必填**:本函数是 server 铸取消终局的唯一出口,而每一次取消都有一个发起者 ⇒ 「本仓铸的取消终局上恒有
  * `abortCause`」由签名保证,不靠调用方记得。它走与补码、补快照**同一条**空座闸 —— 引擎给的终局不是无码的 failed
  * (与中止赛跑跑完了 / 引擎自带码)⇒ 整只原样返回,成因也不挂(那条终局不是这次中止的结果,挂上就是「完成了却带着取消便签」)。
+ *
+ * ## 停驻中的取消:这条 run 已经说过的那一格随终局走(`parkedResult`)
+ * park 中直接终局化的取消(`POST /v1/runs/:id/cancel` 的停驻臂)没有引擎终局可补标,合成形是这条 run 的终局 —— 但这条 run 不是没跑过:它停驻时那条结果
+ * (出口封口过、落在行上)已经带着 run 级的那一格 **读拒字节地板不守**(`readDenyFloor`,属主 `read-deny-floor-notice.ts`:准备期定下,停驻之前就已在 run 事件流上说过)。
+ * 合成形照抄行上那一格:同一句、同一个来源(行),不按取消这一拍的进程重判 —— 取消可以落在另一只副本上、或重启之后,进程内的记录不在那里;店的写口过出口封口时
+ * 那一格已在 ⇒ 原样(封口「已挂即原样」)。引擎给了终局的形不读它(那条终局自己带 `runId`,封口按它接)。
  */
 export declare function mintCancelledResult<R extends PersistedTaskResult>(args: CancelMintArgs & {
     engineResult: R;
+    parkedResult?: undefined;
 }): R;
 export declare function mintCancelledResult(args: CancelMintArgs & {
     engineResult?: undefined;
+    parkedResult?: ParkedLegResult;
 }): PersistedTaskResult;
+/** 停驻臂交来的那条行上的结果(停驻时出口封口过的;行可以没有结果 ⇒ `null`)。合成形只读它 run 级的那一格。 */
+export type ParkedLegResult = Pick<PersistedTaskResult, "readDenyFloor"> | null;
 /**
  * 被取消的续跑腿、且这张卡被本服务 expire 之后,终局上的那句话 —— **全仓单源**([ref])。
  *

package/dist/run-cancel-context.js

@@ -34,6 +34,7 @@ export function mintCancelledResult(args) {
         stats: { turns: 0, tokens: 0, usageMissing: true },
         ...(ctx ? { cancelContext: ctx } : {}),
         abortCause: args.cause,
+        ...(args.parkedResult?.readDenyFloor !== undefined ? { readDenyFloor: args.parkedResult.readDenyFloor } : {}),
     };
 }
 export const CARD_SETTLED_BY_CANCEL_MESSAGE = "Cancelled — the approved action never started, and the cancel settled this approval: it cannot be resumed (start a new run to continue)";

package/dist/run-local.js

@@ -2,7 +2,7 @@
 import { DEFAULT_MODEL_REF, pickUserModel } from "./model-select.js";
 import { defaultModelRefusal, modelNotAllowedMessage, modelUnavailableMessage } from "./model-entry-refusal.js";
 import { servedModelTableLeg } from "./model-select.js";
-import { outwardPlane } from "./terminal.js";
+import { outwardPlane, sealResultForExit } from "./terminal.js";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
@@ -19,12 +19,13 @@ import { ForkRoutingSessionStore } from "./plugins/fork-routing-session-store.js
 import { taskWallClockSec } from "./task-workflow.js";
 import { applyCenterArtifact, centerSourceOnError } from "./capabilities/center-prompts.js";
 import { buildUnpricedCeilingNotice, isRosterGateArmed, loadConfig, logConfigDiagnostics, parseConfigProvider, parseNumOrFailNonNegative } from "./config.js";
+import { admitLocalDataRoot } from "./plugins/local-data-root-admission.js";
 import { openLocalBackend } from "./plugins/store-backend.js";
 import { runAndLogOneTimeMigrations } from "./plugins/one-time-migrations.js";
 import { configLocalRoot, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, buildCandidateRejectionNotes, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
-import { composeExecutionLane, settleHostLaneShell, warnReadDenyFloorUnkept } from "./boot/execution-lane.js";
+import { composeExecutionLane, settleHostLaneShell, settleReadDenyFloor } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
 import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
 import { logEnvModelsMigration, runEnvModelsMigration } from "./config-root-migration.js";
@@ -49,6 +50,7 @@ import { createMemoryProjectLayers } from "./memory-project-layer.js";
 import { assertProjectLayerOwnable } from "./project-identity.js";
 import { declaredCredential } from "./model-route-gap.js";
 import { judgeServedModelRoute } from "./model-route-endpoint.js";
+import { warnAssumedContextWindows } from "./context-window-notice.js";
 import { startMemorySyncRunner } from "./memory-sync-client.js";
 import { buildPricing, cappedCeiling, createTracer } from "./budget.js";
 import { createSharedRunnerDeps, installDefaultEngineNoticeSeat } from "./boot/runner-deps.js";
@@ -67,6 +69,7 @@ import { createLspManager } from "./host-lsp-manager.js";
 import { installOutboundDispatcher } from "./outbound-dispatcher.js";
 import { announceConfigRootEnclosingWorkspace, provisionSemaConfigDir } from "./sema-config-dir.js";
 import { launchWorkspaceOf } from "./task-cwd.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { bindOwnCredentialsConfig, declareServerWithheldEnv } from "./server-secret-env.js";
 export function parseArgs(argv) {
     let objective;
@@ -356,7 +359,14 @@ export async function runLocal(argv, deps = {}) {
     installSecretEnvScrubRecorder({ logger, metrics });
     installDefaultEngineNoticeSeat(logger, metrics);
     logConfigDiagnostics(logger);
-    provisionSemaConfigDir(loaded, logger);
+    let admission;
+    try {
+        admission = admitLocalDataRoot(root);
+    }
+    catch (e) {
+        await printErr(e instanceof Error ? e.message : String(e));
+        return 2;
+    }
     installOutboundDispatcher(logger);
     const providerInput = { provider: "local", localDir: root, localOwnerUid: loaded.configLocalOwnerUid };
     try {
@@ -366,8 +376,6 @@ export async function runLocal(argv, deps = {}) {
         await printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
-    const envModelsMigration = { root, env: process.env, envTableIsPlaceholder: isRosterGateArmed(loaded.webAdmin) };
-    logEnvModelsMigration(logger, envModelsMigration, await runEnvModelsMigration(envModelsMigration));
     logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     let config;
     try {
@@ -377,6 +385,9 @@ export async function runLocal(argv, deps = {}) {
         await printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
+    provisionSemaConfigDir(config, logger);
+    const envModelsMigration = { root, env: process.env, envTableIsPlaceholder: isRosterGateArmed(config.webAdmin) };
+    logEnvModelsMigration(logger, envModelsMigration, await runEnvModelsMigration(envModelsMigration));
     const configProvider = createConfigProvider(providerInput);
     const peerDesk = createPeerDesk({ log: logger });
     const rosterLease = peerDesk.lease("roster");
@@ -430,6 +441,7 @@ export async function runLocal(argv, deps = {}) {
     const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false });
     if (routeVerdict !== undefined)
         throw new Error(routeVerdict.reason);
+    warnAssumedContextWindows(config, logger, { envTableIsPlaceholder: false });
     const unpricedCeiling = buildUnpricedCeilingNotice(config.models, config);
     if (unpricedCeiling)
         logger.warn(unpricedCeiling.event, unpricedCeiling.fields);
@@ -464,7 +476,7 @@ export async function runLocal(argv, deps = {}) {
     const pricing = buildPricing(config.models);
     let backend;
     try {
-        backend = openLocalBackend({ ...config, localDataRoot: root }, { lane: "run-local", onWarn: (msg, fields) => logger.warn(msg, fields), onError: (msg, fields) => logger.error(msg, fields) });
+        backend = openLocalBackend({ ...config, localDataRoot: root }, { lane: "run-local", admission, onWarn: (msg, fields) => logger.warn(msg, fields), onError: (msg, fields) => logger.error(msg, fields) });
     }
     catch (e) {
         await printErr(e instanceof Error ? e.message : String(e));
@@ -487,13 +499,13 @@ export async function runLocal(argv, deps = {}) {
     const workspaceDir = launchWorkspace.dir;
     announceConfigRootEnclosingWorkspace(config, logger, launchWorkspace);
     await settleHostLaneShell(config, logger);
-    warnReadDenyFloorUnkept(config, logger);
+    settleReadDenyFloor(config, logger);
     const homeDirSeat = buildLaneHomeClaim(config);
     const executionEnvFactory = hostRx
         ? hostExecutionEnvFactory({
             workspaceDir,
             ...homeDirSeat,
-            backgroundShell: config.requirePrincipal !== true,
+            backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config),
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
         : undefined;
@@ -774,21 +786,24 @@ export async function runLocal(argv, deps = {}) {
         return 1;
     }
     const unfinishedStop = unfinishedStopOf(result, refusedWithoutPerson);
+    const shown = sealResultForExit(result);
     if (args.json) {
-        await print(JSON.stringify(result, null, 2));
+        await print(JSON.stringify(shown, null, 2));
     }
-    else if (result.terminal.kind === "completed") {
-        await print(result.result);
+    else if (shown.terminal.kind === "completed") {
+        await print(shown.result);
         if (unfinishedStop !== undefined)
             await printErr(buildUnfinishedStopFooter(unfinishedStop, sessionId));
     }
     else {
-        const plane = outwardPlane(result.terminal);
-        const salvage = result.result || result.salvagedOutput || plane.blockedReason || "";
+        const plane = outwardPlane(shown.terminal);
+        const salvage = shown.result || shown.salvagedOutput || plane.blockedReason || "";
         if (salvage)
             await print(salvage);
         await printErr(`task ${plane.status}${plane.errorCode ? ` (${plane.errorCode})` : ""}${plane.errorMessage ? `: ${plane.errorMessage}` : ""}`);
     }
+    if (!args.json && shown.readDenyFloor !== undefined)
+        await printErr(shown.readDenyFloor.message);
     if (result.terminal.kind !== "completed" || unfinishedStop !== undefined)
         exitCode = 1;
     if (memorySync)

package/dist/runs.d.ts

@@ -9,12 +9,14 @@ import { type RunAbort } from "./run-cancel-context.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "./budget.js";
 import type { ElicitationCoordinator } from "./elicitation.js";
 import type { QuestionCoordinator } from "./question.js";
+import type { ApprovalLegOrigin } from "./approval-leg-origin.js";
 import { type ApprovalFrameFamily, type ToolApprovalCoordinator } from "./tool-approval.js";
 import { type FleetRunPublisher } from "./fleet/fleet-bus.js";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { RunAcceptance } from "./run-acceptance.js";
 import type { SessionWorkspaceRecorder } from "./session-workspace.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
+import { type ParkLedgerEventType } from "./trace/ledger-events.js";
 import type { UserInputLedger } from "./user-input-ledger.js";
 /**
  * stoppedBy (core 1.252): a service cancel is a USER stop — mark the run's still-running background
@@ -283,13 +285,21 @@ export declare function parkToolCallId(result: unknown, cs: ParkCheckpointReader
  *  不塞进 `checkpointGate`——那是 core 的类型,server 不改其形)。非 park / 无 token / tool-less /
  *  读失败 ⇒ **同一引用**原样返回(键缺席)。graft 不负责 strip——组合序恒为 graft → strip。 */
 export declare function graftParkToolCallId<T>(result: T, cs: ParkCheckpointReader | undefined): Promise<T>;
+/** 一份结果在等的那张卡与它停在的停驻词(暂停因由 ∧ 投影出口给的词是停驻词);不是停驻 ⇒ `undefined`。后台腿的停驻臂与兜底腿、续跑腿的兜底同读它。 */
+export interface HeldPark {
+    readonly word: ParkLedgerEventType;
+    readonly token: CheckpointToken;
+}
+export declare function heldParkOf(result: TaskResult): HeldPark | undefined;
 /**
- * 🔴 [ref] **停驻没落定就以失败收场的腿:卡的命运先于认领释放**(后台腿与续跑腿同读这一只;动词 = `card-void.ts` 的结算作废)。
+ * 🔴 [ref] **手里握着已提交的卡却以终局收场的腿:卡的命运先于认领释放**(后台腿与续跑腿同读这一只;动词 = `card-void.ts` 的结算作废)。
  *
- * 腿要以失败收场(行 `failed`、认领释放),而手里的结果是宿主层停驻 —— 引擎交回结果之前已把卡落进 checkpoint 店,卡在本 run 的会话上 ——
+ * 腿要以终局收场(行 `failed`、认领释放),而手里的结果是宿主层停驻 —— 引擎交回结果之前已把卡落进 checkpoint 店,卡在本 run 的会话上 ——
  * ⇒ 先把那张卡按它自己的 scope 作废,调用方再放认领。不作废 ⇒ 待决面上留一张卡,兑现它的 run 已经 `failed`、认领已放:决定口照样受理,
  * 续跑在没有认领的会话上驱动(`resume-legs.ts` 认领缺席的成因清单)。顺序承重:先放认领、后作废 ⇒ 两步之间(作废没做成时一直)就是那一形。
- * 停驻没落定的成因不在判据里(停驻行 / 用量行 / 结果到手之后的任何一笔账本写抛):判据只读手里那份结果。
+ * 走到这里的只剩「这条 run 真的不再等这张卡」的形:取消落在结果到手之后(两条腿)、暂停结果不是停驻词。
+ * 停驻簿记写抛(账本帧 / 用量差 / 结果到手之后的清单行与缓冲文本)**不**走到这里 —— 卡已提交 ⇒ 照常提交停驻({@link commitParkRow}),
+ * 簿记只留痕;行的停驻写被店答出拒(行已不是本腿的)由提交口自己作废那张卡。
  *
  * `held` = 手里那份结果过了宿主判官之后的形(判官提上来的嵌套停驻同样算 —— verify 的实现腿 / 修复轮、cascade 的级上卡,都归本 run 的会话)。
  * 不是停驻 ⇒ 零 I/O。不抛:作废没做成 ⇒ 卡回到「留在待决面上、由兜底收割收走」的形,响亮留痕。
@@ -328,7 +338,16 @@ export declare function voidHeldParkCard(held: {
  * only — a suspended run is steered durably via the checkpoint's `setPendingSteer` instead, and only the
  * plain-stream path holds a steerable stream (the verify/cascade branches return a result, not a stream).
  */
-export declare function runInBackground(runner: Runner, spec: TaskSpec, runStore: RunStore, taskId: string, metrics?: Metrics, 
+export declare function runInBackground(runner: Runner, spec: TaskSpec, runStore: RunStore, taskId: string, 
+/**
+ * 本腿停驻的两条事实,只有一个读者 —— 停驻提交({@link commitParkRow}):`legId` = 本腿的持有腿(建行 `createRun` 交回的 `{ ok: true, legId }`,
+ * 停驻写只许它落下);`runStaleSec` = 判活窗(秒,`REAP_RUN_STALE_SEC`,活配置;路由层 `deps.config.runStaleSec`;缺席 ⇒ 缺省窗),店故障时再提交的上界。
+ * 必填:持有腿是认领交给本腿的,不是读来的 —— 调用方不交它,停驻就无从提交(编译期红,不留运行期的缺席臂)。
+ */
+parkCommit: {
+    readonly legId: string;
+    readonly runStaleSec: number | undefined;
+}, metrics?: Metrics, 
 /** 本跑的属主主体(分区键;行属主 / ALS 读它)。 */
 principal?: string, verify?: VerifyRoundsSpec, // 快审 F1:number 参升整对象——cost 顶随传
 cascade?: CascadeConfig, instrumentDegenerate?: (result: TaskResult) => void, planCacheProbe?: {
@@ -388,8 +407,8 @@ approval?: {
     streamApprovalOn: boolean;
     windowMs: number | undefined;
     windowMarginMs: number;
-    declaredFamilies: ReadonlySet<ApprovalFrameFamily>; /** 出处带车道:这条执行上下文的车道(装配点 `durable-run-leg.ts` 写 `ctx.lane`)。 */
-    executionLane: import("./execution-lane-caps.js").ExecutionLane;
+    declaredFamilies: ReadonlySet<ApprovalFrameFamily>; /** 出处带车道 + 化身:这条执行上下文的车道与那一读的住客(装配点 `durable-run-leg.ts` 经 `approvalLegOriginOf` 写)。 */
+    origin: ApprovalLegOrigin;
 }, 
 /** 本腿结算用的 checkpoint 店(`deps.checkpointStore`),两件事:①[ref] park 投影腿的读口 —— 在场时 durable park 的
  *  `suspended` 事件带 `toolCallId`(graft 见 {@link parkToolCallId});②停驻没落定就以失败收场时作废手里那张卡({@link voidHeldParkCard})。
@@ -436,7 +455,12 @@ workspaceRecorder?: SessionWorkspaceRecorder,
  * 这条 run 交给引擎的技能名册(`wiring_manifest.skills` 段;部署事实 `LegFacts.skills`,`leg-facts.ts`:受理漏斗在复制之前读出)。
  * 缺席 = 嵌入方自带的装配器没铸 ⇒ 账本行不带技能段。
  */
-runSkills?: readonly RunSkillEntry[]): Promise<void>;
+runSkills?: readonly RunSkillEntry[], 
+/**
+ * 这次提交登记的工作目录(部署事实 `LegFacts.registeredCwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
+ * 梯子的级 / 验证器腿跑在引擎现铸的会话里,工厂按会话读不到它;普通流形跑在根会话上,工厂自己读得到。缺席 = 没登记 ⇒ 每一条腿照旧落临时目录。
+ */
+registeredCwd?: string): Promise<void>;
 /** 一次心跳要的那一面(run 店的带属主刷新;交回「行还在 running 吗」)。 */
 export interface RunHeartbeatStore {
     heartbeat(taskId: string, owner: string | null): Promise<boolean>;

package/dist/runs.js

@@ -2,6 +2,7 @@ import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationD
 import { atHostBoundary, failureCodeOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "./terminal.js";
 import { voidVerifierPauseCard } from "./verifier-pause-card.js";
 import { voidPendingCard } from "./card-void.js";
+import { commitParkRow } from "./park-row-commit.js";
 import { NOT_IN_ROSTER, entryProblemsFacts } from "./entry-problems.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js";
@@ -29,6 +30,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { BASELINE_IO_DEADLINE_MS, IoDeadlineExceeded, withinIoDeadline } from "./instruction-source-notice.js";
 import { errorText as errText } from "./observability/err-text.js";
 import { LIVENESS_HEARTBEAT_MS } from "./config-invariants.js";
+import { compositionLegRoot } from "./task-cwd.js";
 export async function backgroundAgentOutput(registry, handle, access, agentStore) {
     const row = registry.getAccessibleTask(handle, access);
     if (!row || row.type !== "background_agent") {
@@ -302,12 +304,18 @@ export async function graftParkToolCallId(result, cs) {
     const id = await parkToolCallId(result, cs);
     return id === undefined ? result : { ...result, toolCallId: id };
 }
+export function heldParkOf(result) {
+    if (result.terminal.kind !== "paused")
+        return undefined;
+    const word = outwardPlane(result.terminal).status;
+    return isParkLedgerEventType(word) ? { word, token: result.terminal.token } : undefined;
+}
 export async function voidHeldParkCard(held, hostSessionId, cards, leg) {
     if (held?.terminal.kind !== "paused")
         return;
     await voidPendingCard({ token: held.terminal.token, sessionId: hostSessionId }, cards, "server.park.held-card-void-failed", `leg=${leg}`);
 }
-export async function runInBackground(runner, spec, runStore, taskId, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, checkpointCards, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder, runSkills) {
+export async function runInBackground(runner, spec, runStore, taskId, parkCommit, metrics, principal, verify, cascade, instrumentDegenerate, planCacheProbe, persistThinking = false, inflight, preemptable, steerable, modelUsage, elicitation, elicitOwner, captureTurnAnchor, fleetPublisher, captureUserMessageAnchor, question, workflowCompletionInbox, subagentSteer, completionDiagLog, sendUserFile, promptManifests, approval, checkpointCards, pendingEngineNotices, trustedInternals, userInputLedger, acceptance, workspaceRecorder, runSkills, registeredCwd) {
     const startedAt = Date.now();
     metrics?.addGauge("runs_active", 1);
     fleetPublisher?.onStart();
@@ -345,12 +353,12 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     if (approval) {
         const coordinator = approval.coordinator;
         spec.onAsk = approvalLeg.unattended
-            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), executionLane: approval.executionLane }, approvalLeg.unattended)
+            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}), ...approval.origin }, approvalLeg.unattended)
             : coordinator.boundAsk({
                 owner: elicitOwner ?? owner,
                 taskId,
                 ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
-                executionLane: approval.executionLane,
+                ...approval.origin,
                 ...(approvalLeg.active ? { legKey: "", ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
             });
     }
@@ -375,23 +383,26 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     let legLive = true;
     const notifiedKeys = new NotifiedKeys();
     const subagentHandleEvictions = [];
-    const parkRowWrite = {
-        suspended: (sealed) => runStore.setSuspended(taskId, sealed),
-        needs_review: (sealed) => runStore.setNeedsReview(taskId, sealed),
-    };
-    const parkLeg = async (word, res) => {
+    const parkLeg = async ({ word, token }, res) => {
         const grafted = await graftParkToolCallId(res, checkpointCards);
         await sink.appendParked(word, grafted);
         const sealed = sealResultForExit(grafted);
         reached = { kind: word, result: sealed };
-        await parkRowWrite[word](sealed);
+        const committed = await commitParkRow({
+            runStore, taskId, word, result: sealed, card: { token, sessionId: spec.sessionId }, cards: checkpointCards, leg: "bg",
+            legId: parkCommit.legId, staleWindowMs: parkCommit.runStaleSec === undefined ? undefined : parkCommit.runStaleSec * 1000,
+        });
+        if (committed.kind === "ended") {
+            reached = undefined;
+            settledAsCancel = committed.row?.errorCode === CANCELLED_CODE;
+        }
         acceptance?.settle(sealed);
     };
     const settleLegResult = async (engineResult) => {
         const result = atHostBoundary(engineResult);
-        const parkWord = result.terminal.kind === "paused" ? outwardPlane(result.terminal).status : undefined;
-        if (parkWord !== undefined && isParkLedgerEventType(parkWord)) {
-            await parkLeg(parkWord, result);
+        const held = heldParkOf(result);
+        if (held !== undefined) {
+            await parkLeg(held, result);
             return;
         }
         const settled = causeAtDone !== undefined ? cancelledResult(causeAtDone, result) : result;
@@ -416,10 +427,13 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     const hitlTransport = createHitlTransport({ ledger: append });
     const unregisterEngineNotice = registerEngineNoticeLeg({
         sessionId: spec.sessionId,
+        taskId,
         ...(pendingEngineNotices !== undefined ? { pending: pendingEngineNotices } : {}),
         durable: (row) => append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=bg code=${row.code} task=${taskId}`), false)),
     });
     try {
+        if (typeof parkCommit?.legId !== "string" || parkCommit.legId === "")
+            throw new TypeError(`runInBackground: run ${taskId} was started without the holding leg its claim handed back (parkCommit.legId) — refusing to start a run whose park could never be committed`);
         if (userInputLedger && spec.sessionId)
             await userInputLedger.announceUndrained({ sessionId: spec.sessionId, taskId });
         await emitPendingWorkflowCompletions(workflowCompletionInbox, spec.sessionId, elicitOwner ?? owner, (frame) => {
@@ -476,10 +490,11 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     void sink.appendStatus(e).catch((err) => completionDiagLog?.("status_event_append_failed", { route: "bg-run-composite", taskId, err: err instanceof Error ? err.message : String(err) }));
                 },
             };
+            const compositeInternals = { ...fwdInternals, ...statusSeat, ...compositionLegRoot(registeredCwd) };
             const compositeLeg = verify !== undefined
-                ? () => runWithVerification(runner, { ...spec, taskId, signal: cancelCtrl.signal }, verify, { ...fwdInternals, ...statusSeat })
+                ? () => runWithVerification(runner, { ...spec, taskId, signal: cancelCtrl.signal }, verify, compositeInternals)
                 : cascade !== undefined
-                    ? () => runCascade(runner, { ...spec, taskId, signal: cancelCtrl.signal }, cascade, { ...fwdInternals, ...statusSeat })
+                    ? () => runCascade(runner, { ...spec, taskId, signal: cancelCtrl.signal }, cascade, compositeInternals)
                     : undefined;
             if (compositeLeg !== undefined) {
                 const result = await compositeLeg();
@@ -550,7 +565,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     owner: elicitOwner ?? owner,
                     abortSignal: cancelCtrl.signal,
                     ...(spec.sessionId ? { sessionId: spec.sessionId } : {}),
-                    executionLane: approval.executionLane,
+                    ...approval.origin,
                     family: "approval_request",
                     transport: hitlTransport,
                     legKey: "",
@@ -599,9 +614,12 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 acceptance?.settle(reached.result);
             }
             else if (reached !== undefined) {
-                await parkRowWrite[reached.kind](reached.result);
                 acceptance?.settle(reached.result);
             }
+            else if (thrownCancelCause === undefined && observedDone !== undefined && heldParkOf(atHostBoundary(observedDone)) !== undefined) {
+                recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=park-held ${message}`);
+                await settleLegResult(observedDone);
+            }
             else if (thrownCancelCause !== undefined && observedDone === undefined) {
                 const c = cancelledResult(thrownCancelCause);
                 settledAsCancel = failureCodeOf(c.terminal) === CANCELLED_CODE;

package/dist/security.d.ts

@@ -75,7 +75,7 @@ export interface SessionRowCellsWriter {
  * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一风险形、爆炸半径**更大**,却没门。
  *
  * 风险形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
- * fleet 写档(面表 fleet 列的 `dev_open` 格,`owner-faces.ts` 的 `listFilterOf`)判 fleet-wide ⇒ 集群内**任意**调用方可对**任意** session 动手。
+ * fleet 写档(面表 fleet 列的 `dev_open` 格,`owner-faces.ts` 的 `listFilterOf`)判 fleet-wide ⇒ 集群内**任意**不报主体的调用方可对**任意** session 动手(报了主体的调用方只动得到那位主体的,`principal-gate.ts` 的 `actsForDeployment`)。
  * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
  *
  * ⇒ 枚举改**族判定**:新增一条破坏性会话路由时自动落进门内,不必记得回来加白名单。
@@ -135,7 +135,7 @@ export type OwnerAwareSessionStore = SessionStore & {
     register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** [ref] placed 分区的元组读口(店的既有读口,一行 PK 读;`undefined` = 普通会话或无此行)。店不交它 = 不实现 placement = 没有 placed 行(无 repo 的内存店)。两个读者:
      *  ① 会话面的属主门只在属主为 NULL 时读它一次(无主的 placed 行不是公共行,`http/principal-gate.ts` 的 `sessionOwnerCellOf`);
-     *  ② `agent` 的唯一读口 `session-agent.ts` 的 `readSessionAgent`(会话视图体顶层、运维审批队列的停驻行同读):店没有这一面 ⇒ 键缺席,读面不凭别处另铸子代身份。 */
+     *  ② `agent` 的唯一读口 `http/owner-access.ts` 的 `readSessionAgent`(会话视图体顶层、运维审批队列的停驻行同读):店没有这一面 ⇒ 键缺席,读面不凭别处另铸子代身份。 */
     placementOf?: (sessionId: string) => Promise<SessionPlacementRecord | undefined>;
     /** E16 — enumerate the caller's sessions (owner-filtered on the session store's OWN owner column).
      *  `includeUnowned` = [ref] 窄互认第二臂的**第三条件**(`owner IS NULL`)的 SQL 承载位:置真时
@@ -190,7 +190,7 @@ export type OwnerAwareSessionStore = SessionStore & {
     /** 执行席(规则在 `execution-placement.ts`):根会话行上这一位住客的那一格的唯一读口(`read`)与 place / markMirror 两只写口。三店都有;两只包装原样转发。
      *  缺席 = 会话店没有执行放置(只有不带它的测试走廊 / 嵌入形),调用方各按自己的缺席臂处置。 */
     executionPlacement?: ExecutionPlacementSeat;
-    /** **删除门的头读**(读者只有删除门:`DELETE /v1/sessions/:id` 的属主门,经 `session-incarnation.ts` 的 `deletionHeadReadOf` 一只取法):
+    /** **「被占着」的头读**(读者:`DELETE /v1/sessions/:id` 的属主门 · 认领面 · 同步推送三口的门 —— 都问「这个 id 被占着吗」,经 `session-incarnation.ts` 的 `deletionHeadReadOf` 一只取法):
      *  活行 = {@link headOf} 同答;外加在删的行(会话三态 活 → 在删 → 没了 的中间一态,律在 `session-deletion.ts`;local 另有删序停在第一步之后的标记格)的属主与住客 ——
      *  开始删它的那位属主重发删除(= 接管)就收得完,别的属主得到与「不在」同一句(不可探测)。三只店都交。 */
     deletionHeadOf?: (sessionId: string) => Promise<SessionHead | undefined>;