@sema-agent/server 7.149.0 → 7.150.0

package/dist/session-incarnation.d.ts

@@ -129,14 +129,28 @@ export declare function sessionFaceOfHead(sessionId: string, head: SessionHead):
 export declare function sessionFaceOfHead(sessionId: string, head: SessionHead | undefined): SessionFace | undefined;
 /**
  * 「这只会话店有没有按 id 读(`headOf`)」—— 全仓**只判这一处**:授权口、各路由的属主门、能力位、起服门、k8s 工作区空间的每 run 读与
- * 一次性迁移 M23(窗内)的回填读的都是这一只返回值。缺席 = 店没有实装 `headOf`(读不出属主 / 住客 / 叶子,调用方各按自己的 fail-closed 臂处置)。
+ * 一次性迁移 M23(窗内)的回填读的都是这一只判({@link headReadOf} 的在不在 = 它)。缺席 = 店没有实装 `headOf`(读不出属主 / 住客 / 叶子,调用方各按自己的 fail-closed 臂处置)。
+ * 收的是任意店形(路由层的封住视图也行:在不在照判,读口在型上调不了 —— 带属主的行只经属主存取器读,`http/owner-access.ts`)。
  */
-export declare function headReadOf(store: object | undefined): HeadRead | undefined;
+export declare function headReadPresent(store: {
+    readonly headOf?: unknown;
+} | undefined): boolean;
+/** 会话店的按 id 读(绑好宿主的那一只;店没有 ⇒ `undefined`)。路由层的封住视图在这里读不出读口(封住的那一格型是 `undefined`,类型墙,`route-ctx.ts` 的 `RouteDeps`)。 */
+export declare function headReadOf(store: {
+    readonly headOf?: HeadRead;
+} | undefined): HeadRead | undefined;
 /**
  * 删除门(`DELETE /v1/sessions/:id` 的属主门 + 协调器的化身围栏)的头读 —— **只判这一处**:店交了 `deletionHeadOf`(删除已开始、还没收完的那一行也答得出属主与住客;local)⇒ 它;
- * 否则 ⇒ {@link headReadOf}(删除是一个事务的店,没有删到一半的行)。缺席 = 店没有按 id 读。
+ * 否则 ⇒ {@link headReadOf}(删除是一个事务的店,没有删到一半的行)。缺席 = 店没有按 id 读。同 {@link headReadOf}:只收值上交读口的店形。
  */
-export declare function deletionHeadReadOf(store: object | undefined): HeadRead | undefined;
+export declare function deletionHeadReadOf(store: {
+    readonly deletionHeadOf?: HeadRead;
+    readonly headOf: HeadRead;
+}): HeadRead;
+export declare function deletionHeadReadOf(store: {
+    readonly deletionHeadOf?: HeadRead;
+    readonly headOf?: HeadRead;
+} | undefined): HeadRead | undefined;
 /** 换装沿用的行格(化身 + fork 键):{@link carriedRowCells} 的答案。`forkKey: null` = 没有可沿用的键(新建行 / 行上本来没有)。 */
 export interface CarriedRowCells {
     readonly incarnation: string;

package/dist/session-incarnation.js

@@ -66,9 +66,12 @@ export function leafOfAdmittedHead(head) {
 export function sessionFaceOfHead(sessionId, head) {
     return head === undefined ? undefined : sessionFaceFromRow(sessionId, head.owner, head.incarnation);
 }
+export function headReadPresent(store) {
+    return typeof store?.headOf === "function";
+}
 export function headReadOf(store) {
     const read = store?.headOf;
-    return typeof read === "function" ? read.bind(store) : undefined;
+    return headReadPresent(store) ? read.bind(store) : undefined;
 }
 export function deletionHeadReadOf(store) {
     const read = store?.deletionHeadOf;

package/dist/session-notify-door.d.ts

@@ -9,7 +9,7 @@
  *    别的抛 = 活流刚收尾的竞态 ⇒ 落空闲臂。
  *  · **空闲**:这只会话的完成收件箱(`externalNotificationInboxEntry`,external 键域;脱敏 / 限长在入箱口内)⇒ 下次开流排空成 `task_notification` 帧。
  *    部署没有收件箱 ⇒ 如实交回 `no_inbox`(调用方各自答:HTTP 门 501,引擎完成告警)。
- *  · **复核住客**:两臂的投递动作(注入 / 入箱)之前**紧邻**一次头读,与目标的住客比 —— 判官是仓里那一只 `sameOccupant`(`execution-placement.ts`:属主 ∧ 化身,
+ *  · **复核住客**:两臂的投递动作(注入 / 入箱)之前**紧邻**一次头读,与目标的住客比(读与判在属主存取器的 `occupantRecheckOf`)—— 判官是仓里那一只 `sameOccupant`(`execution-placement.ts`:属主 ∧ 化身,
  *    写口与执行上下文解析器判的也是它):不在 ⇒ `withdrawn: gone`;两样里任一样变了 ⇒ `withdrawn: replaced`。会话店不铸化身(嵌入方自建的店)时两侧都没有令牌,
  *    判官只剩属主那一半:属主没变 ⇒ 投,变了 ⇒ 撤回。这一读是动作之前的最后一次让出:判活读(及活臂刚收尾时的那次注入)都在它前面 ——
  *    令牌永不复用,此刻还是那一位 ⇒ 判活读那一刻也是那一位 ⇒ 判出的 run 是它的 run。
@@ -33,7 +33,7 @@
 import type { ExternalNotificationInput, SessionHead, SubagentToolOptions, TaskStream } from "@sema-agent/core";
 import { type WorkflowCompletionInbox } from "./orchestration/workflow-completion-inbox.js";
 import type { DelegationRootWitness } from "./delegated-session-owner.js";
-import type { HeadRead } from "./session-incarnation.js";
+import type { OwnerAwareSessionStore } from "./security.js";
 import type { Logger } from "./observability/logger.js";
 /** 门的一次投递结局(闭集;调用方 `switch` 穷尽)。 */
 export type SessionNotifyOutcome = {
@@ -74,8 +74,8 @@ export interface SessionNotifyDoorIo {
     /** 本副本持活 core 流的腿(taskId → 流)。 */
     readonly liveRuns: ReadonlyMap<string, Pick<TaskStream, "notify">>;
     readonly inbox: WorkflowCompletionInbox | undefined;
-    /** 会话店的按 id 头读(复核住客的那一读)。店没有 ⇒ `undefined`:调用方先判(路由 501;后台完成 relay 照交,门响亮抛 ⇒ relay 告警)。 */
-    readonly headOf: HeadRead | undefined;
+    /** 会话店(复核住客的那一读只经属主存取器)。店没有按 id 头读 ⇒ 调用方先判(路由 501;后台完成 relay 照交,门响亮抛 ⇒ relay 告警)。 */
+    readonly sessionStorage: Pick<OwnerAwareSessionStore, "headOf"> | undefined;
 }
 export declare function createSessionNotifyDoor(io: SessionNotifyDoorIo): SessionNotifyDoor;
 /** 委派工具挂载期的完成 sink 的型(取自 core 的选项型,不手抄)。 */

package/dist/session-notify-door.js

@@ -1,14 +1,13 @@
 import { externalNotificationInboxEntry } from "./orchestration/workflow-completion-inbox.js";
-import { sameOccupant } from "./execution-placement.js";
+import { occupantRecheckOf } from "./http/owner-access.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 export function createSessionNotifyDoor(io) {
+    const occupantNow = occupantRecheckOf(io.sessionStorage);
     async function recheck(target) {
-        if (io.headOf === undefined)
+        if (occupantNow === undefined)
             throw new Error("session notify door: the session store has no head read (headOf); the occupant cannot be re-checked before delivery");
-        const head = await io.headOf(target.sessionId);
-        if (head === undefined)
-            return { delivery: "withdrawn", reason: "gone" };
-        return sameOccupant(target.occupant, head) ? undefined : { delivery: "withdrawn", reason: "replaced" };
+        const verdict = await occupantNow(target.sessionId, target.occupant);
+        return verdict === "same" ? undefined : { delivery: "withdrawn", reason: verdict };
     }
     return {
         async deliver(target, event) {

package/dist/session-rules-seat.d.ts

@@ -4,9 +4,10 @@
  * (引擎交界的身份格,`engine-identity.ts`):带场景的会话,人 ≠ 属主,原样查 = 落到另一只桶(运维在 health 会话上 PUT 的 deny 对引擎不存在 = 安全轴放宽)。
  *
  * 律(一句):引擎交来的人恰是这只会话属主背后的人 ⇒ 键换成会话属主;否则原样(与今天逐字节同 —— 没带场景的会话属主与人字节相同,两种读法同一个键)。
- * 属主只经会话店的头读一处(`headOf(id)?.owner`,会话行是属主的唯一事实);读不到头(会话不在 / 店不交头读)⇒ 原样。读写两腿与祖先会话的规则读同经这一只席。
+ * 属主只经会话店的头读一处(会话行是属主的唯一事实;读与判在属主存取器 `http/owner-access.ts` 的 `engineRulesKeyOf`);读不到头(会话不在 / 店不交头读)⇒ 原样。
+ * 读写两腿与祖先会话的规则读同经这一只席。
  */
 import type { SessionPolicyStore } from "@sema-agent/core";
-import type { HeadRead } from "./session-incarnation.js";
-export declare function createEngineSessionRulesSeat(store: SessionPolicyStore, headOf: HeadRead | undefined): SessionPolicyStore;
+import type { OwnerAwareSessionStore } from "./security.js";
+export declare function createEngineSessionRulesSeat(store: SessionPolicyStore, sessions: Pick<OwnerAwareSessionStore, "headOf"> | undefined): SessionPolicyStore;
 //# sourceMappingURL=session-rules-seat.d.ts.map

package/dist/session-rules-seat.js

@@ -1,14 +1,6 @@
-import { personOf } from "./owner-brands.js";
-import { recoveredSubject } from "./owner-faces.js";
-export function createEngineSessionRulesSeat(store, headOf) {
-    const keyFor = async (sessionId, principal) => {
-        if (principal === undefined || headOf === undefined)
-            return principal;
-        const owner = (await headOf(sessionId))?.owner;
-        if (owner === undefined || owner === null)
-            return principal;
-        return personOf(recoveredSubject(owner)) === principal ? owner : principal;
-    };
+import { engineRulesKeyOf } from "./http/owner-access.js";
+export function createEngineSessionRulesSeat(store, sessions) {
+    const keyFor = (sessionId, principal) => engineRulesKeyOf(sessions, sessionId, principal);
     return {
         getRules: async (sessionId, principal) => store.getRules(sessionId, await keyFor(sessionId, principal)),
         putRules: async (sessionId, principal, rules, opts) => store.putRules(sessionId, await keyFor(sessionId, principal), rules, opts),

package/dist/session-sync.js

@@ -1,7 +1,7 @@
 import { anchorEntryDeclared, classifySyncRelationship } from "./session-sync-kernel.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { loosenReasons, normalizeRules } from "@sema-agent/core";
-import { headReadOf } from "./session-incarnation.js";
+import { sessionFactsReadOf } from "./http/owner-access.js";
 import { fileHistoryBlobExchangeOf, judgeSessionRulesWrite } from "@sema-agent/core";
 export class FileHistoryUnreadableError extends Error {
     sessionId;
@@ -75,8 +75,8 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
     const entryIds = await listEntryIds(sessionId);
     if (entryIds === null)
         return null;
-    const headOf = headReadOf(session);
-    const leafId = headOf ? ((await headOf(sessionId))?.leafId ?? null) : null;
+    const sessionFactsOf = sessionFactsReadOf(session);
+    const leafId = sessionFactsOf ? ((await sessionFactsOf(sessionId))?.leafId ?? null) : null;
     const fs = historyStore;
     const fileHistory = await exportedFileHistory(fs, sessionId);
     const policyStore = srcBackend.sessionPolicy();

package/dist/stores-sql/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type CheckpointPage, type CheckpointRowRead, type CheckpointSessionCursor, type CheckpointSessionQuery, type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
 import { type SqlDialect, type SqlDriver } from "../plugins/sql-driver.js";
 import type { CtxWriteClaim } from "../plugins/store-contracts.js";
 import type { RetentionDeclaration } from "@sema-agent/core";
@@ -72,7 +72,6 @@ interface SteerColumnRead {
  * 列有内容却读不出 ⇒ `lossy`(两个调用点对它的处置见 {@link SteerColumnRead})。
  */
 export declare function readPendingSteerQueueColumn(queueRaw: unknown): SteerColumnRead;
-/** SQL checkpoint 店的装配选项:托管留存声明。(ctx 栅栏写口的认领由调用方每次交进来 —— [ref]:栅栏的来源是认领本身,店不另绑 run 店。) */
 export interface SqlCheckpointStoreOptions {
     readonly retention?: RetentionDeclaration;
 }
@@ -162,7 +161,27 @@ export declare class SqlCheckpointStore implements CheckpointStore {
     private pendingRowQuery;
     /** Create-once. core mints the token (`mintCheckpointToken`) and calls this during suspend. */
     put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
+    /** 一行的列组 —— `get` 与按会话列表读同一份投影、交同一只解码({@link readStoredCheckpoint})。 */
+    private storedCheckpointColumns;
     get(token: CheckpointToken): Promise<Checkpoint | null>;
+    /**
+     * 一行字节 → 检查点 —— **`get` 与按会话列表({@link listBySession})的唯一解码**(列组 = {@link storedCheckpointColumns})。读不成的格交回 `damaged`
+     * (`get` 原样抛那只拒绝,列表把这一行答 `unreadable`);非体问题(读腿漏投影 `not-text` / 连接)原样抛 —— 码坏不冒充一行数据坏。
+     */
+    private readStoredCheckpoint;
+    /**
+     * core `CheckpointStore.listBySession`(可选动词,按在不在探;core 7.66.0 契约):一只会话的行,任何状态,按查询的成员收窄、按 `createdAt` 再按令牌排、键集分页。
+     * **读法只有 core 那一只**:查询经 `readCheckpointSessionQuery` 读(坏查询在任何 SQL 之前带码拒),过滤 / 排序 / 游标 / 截断 / 损坏判 全由 core 的 `selectSessionPage` 答
+     * (内存店与文件店同调它);本店只交「这只会话的行」—— 按会话列(`session_id`,本店每一只按会话的读口同读这一列)取行,经 `get` 的同一只解码({@link readStoredCheckpoint})成检查点。
+     * SQL 只按会话收窄,别的成员(状态 / scope / 门型 / 工具调用 / 建行时刻)一律由 core 判 —— 列上的比较不是 core 的比较(MySQL 协议的 `utf8mb4_bin` 按补空格比,
+     * 带尾空格的集外状态词会被 SQL 当成三词之一排除,而 core 要把它答成 `unreadable`),所以 SQL 不预筛任何一格,预筛不可能排除 core 会留下的行。
+     * 读成本:这只会话的每一行读一份字节(检查点体 + 旁格)—— 只在页里的行交出去;会话的行数由留存扫车道界住。
+     * 一行读不成(体不是一只检查点 / 决议或执行记录那一格读不出 / 体没说出它归在的这只会话)⇒ 这一行**照列**为 `unreadable`(令牌 / scope / 会话 / 状态 / 建行时刻取本店在字节之外
+     * 握着的列组;体读成、归属对而旁格坏 ⇒ 过滤器照读体上的成员),不跳过、不让整页失败;拿它的令牌去 `get` 撞见同一只拒。体是对象而成员形读不动 ⇒ core 自己答 `unreadable`。
+     * 页里每一只这样的行计一次 `server.approvals.park-row-blob-unreadable`(本店停驻行读者的那一条律:一行的字节只坏它自己那一行):core 判的经它给的座(句子去掉令牌后作探针),
+     * 本店判、core 看着读得动的那几行由本店计。只读:列表不改任何一行;交出的行是这一次解码的新对象,改它不改库。
+     */
+    listBySession(query: CheckpointSessionQuery): Promise<CheckpointPage<CheckpointRowRead, CheckpointSessionCursor>>;
     /**
      * Atomic CAS: pending → resolved, scoped. Returns true for the single winner, false if already
      * resolved/expired (AlreadyResolved → caller no-ops, never re-executes). `outcome` is persisted atomically

package/dist/stores-sql/checkpoint-store-sql.js

@@ -1,9 +1,9 @@
 import { parkedApprovalCard } from "../approval-content-kind.js";
 import { createHash } from "node:crypto";
 import { CHECKPOINT_FACET_SQL, CHECKPOINT_SWEEP_ORDER_SQL, CheckpointIndexRefusedError, checkpointSweepAfterSql, hostSessionOf, judgeCheckpointIndexCells } from "../plugins/checkpoint-index-columns.js";
-import { CheckpointError, validatePendingSteer, appendPendingSteer, winnerFromOutcome, summarizeCheckpoint, checkpointRevOf, judgeCheckpointRow, CONTRACT_KIT_ENGINE_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
+import { CheckpointError, validatePendingSteer, appendPendingSteer, winnerFromOutcome, summarizeCheckpoint, checkpointRevOf, judgeCheckpointRow, CONTRACT_KIT_ENGINE_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, readCheckpointSessionQuery, selectSessionPage, } from "@sema-agent/core";
 import { parkRowFacts, skillCardFacts } from "../approval-card.js";
-import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, jsonColumnTextSha256, readJsonArrayColumn, readJsonColumnTextSha256, readNonNullJsonValueColumn, StoreCorruptError, } from "../plugins/sql-json-column.js";
+import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, isJsonObject, jsonColumnText, jsonColumnTextSha256, readJsonArrayColumn, readJsonColumnTextSha256, readNonNullJsonValueColumn, StoreCorruptError, } from "../plugins/sql-json-column.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { durableRowIdentity, withoutCheckpointToken } from "../checkpoint-identity.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "../plugins/sql-driver.js";
@@ -242,6 +242,12 @@ export function readPendingSteerQueueColumn(queueRaw) {
 }
 const STEER_CAS_ATTEMPTS = 8;
 const EXECUTION_RECORD_CAS_ATTEMPTS = 8;
+const STORED_ROW_DAMAGE = {
+    body: "its stored body is not a checkpoint object",
+    decision: "its stored decision record cannot be read",
+    execution: "its stored execution record cannot be read",
+    filing: "its stored body does not name the session the row is filed under",
+};
 export class SqlCheckpointStore {
     db;
     logger;
@@ -337,21 +343,62 @@ export class SqlCheckpointStore {
             throw rowTooLargeOrSelf(this.db.dialect, e, `the checkpoint row for session ${JSON.stringify(cp.sessionId)}`);
         }
     }
+    storedCheckpointColumns() {
+        const d = this.db.dialect;
+        return (`status, ${jsonColumnText(d, "checkpoint")}, ${jsonColumnText(d, "outcome")}, reopen_reason, rev, ` +
+            `${jsonColumnText(d, "pending_steer_queue")}, ${jsonColumnText(d, "execution_outcome")}, execution_at_ms`);
+    }
     async get(token) {
-        const { rows } = await this.db.query(this.q(`SELECT status, ${jsonColumnText("mysql", "checkpoint")}, ${jsonColumnText("mysql", "outcome")}, reopen_reason, rev, ` +
-            `${jsonColumnText("mysql", "pending_steer_queue")}, ${jsonColumnText("mysql", "execution_outcome")}, execution_at_ms FROM checkpoint WHERE token = ?`, `SELECT status, ${jsonColumnText("pg", "checkpoint")}, ${jsonColumnText("pg", "outcome")}, reopen_reason, rev, ` +
-            `${jsonColumnText("pg", "pending_steer_queue")}, ${jsonColumnText("pg", "execution_outcome")}, execution_at_ms FROM checkpoint WHERE token = $1`), [token]);
+        const { rows } = await this.db.query(`SELECT ${this.storedCheckpointColumns()} FROM checkpoint WHERE token = ${this.ph(1)}`, [token]);
         const r = rows[0];
         if (!r)
             return null;
-        const cp = readCheckpointBodyOrRefuse(r.checkpoint, `for token ${tokenFingerprint(token)}`);
+        const read = this.readStoredCheckpoint(r, token);
+        if (read.kind === "damaged")
+            throw read.error;
+        const cp = read.checkpoint;
+        this.logger?.info?.("checkpoint_get", {
+            tokenFp: tokenFingerprint(token),
+            status: cp.status,
+            hasWorkspaceHandle: !!cp.state?.workspaceHandle,
+            snapshotId: cp.state?.workspaceHandle?.snapshotId,
+        });
+        return cp;
+    }
+    readStoredCheckpoint(r, token) {
+        const where = `for token ${tokenFingerprint(token)}`;
+        let cp;
+        try {
+            cp = readCheckpointBodyOrRefuse(r.checkpoint, where);
+        }
+        catch (e) {
+            if (e instanceof StoreCorruptError)
+                return { kind: "damaged", member: "body", error: e };
+            throw e;
+        }
         cp.status = r.status;
-        const outcomeRaw = refusing("a decision record nobody can read", () => decodeOutcomeColumn(r.outcome, `for token ${tokenFingerprint(token)}`));
+        let outcomeRaw;
+        try {
+            outcomeRaw = refusing("a decision record nobody can read", () => decodeOutcomeColumn(r.outcome, where));
+        }
+        catch (e) {
+            if (e instanceof StoreCorruptError)
+                return { kind: "damaged", member: "decision", error: e, body: cp };
+            throw e;
+        }
         if (outcomeRaw)
             cp.resolvedOutcome = winnerFromOutcome(outcomeRaw);
         cp.reopenReason = r.reopen_reason ?? undefined;
         cp.rev = r.rev == null ? 0 : Number(r.rev);
-        const executionOutcome = refusing("an execution record nobody can read", () => decodeExecutionOutcomeColumn(r.execution_outcome, `for token ${tokenFingerprint(token)}`));
+        let executionOutcome;
+        try {
+            executionOutcome = refusing("an execution record nobody can read", () => decodeExecutionOutcomeColumn(r.execution_outcome, where));
+        }
+        catch (e) {
+            if (e instanceof StoreCorruptError)
+                return { kind: "damaged", member: "execution", error: e, body: cp };
+            throw e;
+        }
         if (executionOutcome !== undefined) {
             cp.executionOutcome = executionOutcome;
             if (r.execution_at_ms != null)
@@ -362,17 +409,58 @@ export class SqlCheckpointStore {
             recordFailOpen("server.sql-json.checkpoint.pending-steer-queue-lossy");
             this.logger?.info?.("checkpoint_pending_steer_unreadable", { tokenFp: tokenFingerprint(token) });
         }
-        if (cp.state) {
-            if (steer.state.pendingSteerQueue !== undefined)
-                cp.state.pendingSteerQueue = steer.state.pendingSteerQueue;
-        }
-        this.logger?.info?.("checkpoint_get", {
-            tokenFp: tokenFingerprint(token),
-            status: cp.status,
-            hasWorkspaceHandle: !!cp.state?.workspaceHandle,
-            snapshotId: cp.state?.workspaceHandle?.snapshotId,
+        if (isJsonObject(cp.state) && steer.state.pendingSteerQueue !== undefined)
+            cp.state.pendingSteerQueue = steer.state.pendingSteerQueue;
+        return { kind: "row", checkpoint: cp };
+    }
+    async listBySession(query) {
+        const read = readCheckpointSessionQuery(query);
+        const { rows } = await this.db.query(`SELECT token, scope, session_id, created_at_ms, ${this.storedCheckpointColumns()} FROM checkpoint WHERE session_id = ${this.ph(1)}`, [read.sessionId]);
+        const tokens = rows.map((r) => String(r.token));
+        const withoutTokens = (sentence) => tokens.reduce((out, t) => withoutCheckpointToken(out, t), sentence);
+        const damaged = new Map();
+        const candidates = [];
+        rows.forEach((r, i) => {
+            const token = tokens[i];
+            const got = this.readStoredCheckpoint(r, token);
+            const body = got.kind === "row" ? got.checkpoint : got.member === "body" ? undefined : got.body;
+            const filedHere = body !== undefined && body.sessionId === String(r.session_id);
+            if (got.kind === "row" && filedHere) {
+                candidates.push([token, body]);
+                return;
+            }
+            damaged.set(token, { problem: STORED_ROW_DAMAGE[got.kind === "damaged" ? got.member : "filing"], r, counted: filedHere });
+            if (filedHere) {
+                candidates.push([token, body]);
+                return;
+            }
+            const filing = { token: token, sessionId: String(r.session_id), scope: String(r.scope), status: String(r.status), createdAt: Number(r.created_at_ms) };
+            candidates.push([token, filing]);
         });
-        return cp;
+        const page = selectSessionPage(candidates, read, (cp) => cp, (sentence) => recordFailOpen("server.approvals.park-row-blob-unreadable", withoutTokens(sentence)));
+        if (damaged.size === 0)
+            return page;
+        return {
+            ...page,
+            rows: page.rows.map((row) => {
+                const token = row.kind === "row" ? row.checkpoint.token : row.token;
+                const hit = damaged.get(token);
+                if (hit === undefined)
+                    return row;
+                if (hit.counted && row.kind === "row")
+                    recordFailOpen("server.approvals.park-row-blob-unreadable", `session listing, session ${JSON.stringify(String(hit.r.session_id))}: ${hit.problem} — listed as unreadable`);
+                const createdAt = Number(hit.r.created_at_ms);
+                return {
+                    kind: "unreadable",
+                    token: token,
+                    scope: String(hit.r.scope),
+                    sessionId: String(hit.r.session_id),
+                    status: String(hit.r.status),
+                    createdAt: Number.isFinite(createdAt) ? createdAt : null,
+                    problem: hit.problem,
+                };
+            }),
+        };
     }
     async resolve(token, scope, outcome, expect) {
         const params = [this.json(outcome, "checkpoint outcome"), Date.now(), token, scope];

package/dist/stores-sql/retention-store-sql.d.ts

@@ -1,7 +1,7 @@
 /**
  * 托管留存(managed retention)的**执行器** —— 引擎座表那一半(阶段三逐字搬进 `@sema-agent/core-stores-sql` 的那一半)。
  * SINGLE-FILE DUAL-DIALECT([ref] A12 定型半场;先例 = `checkpoint-store-sql.ts`)。[ref] 车1,设计稿
- * `docs/DESIGN-270-retention-lane.md` v1.2。上游契约真源 = `@sema-agent/core` 的 `core/retention.d.ts`
+ * `docs/[ref]-retention-lane.md` v1.2。上游契约真源 = `@sema-agent/core` 的 `core/retention.d.ts`
  * (`ManagedRetentionCapability` / `RetentionReceipt`);事务内钩表的形 = core-stores-sql 的 `SqlTransactionHooks`(本文件的同名型是它的形,见下)。
  *
  * ── 一个事务、两个属主:执行器 + 部署钩 ─────────────────────────────────────────────────────────────

package/dist/task-cwd.d.ts

@@ -6,9 +6,10 @@ import type { RunInternals } from "@sema-agent/core";
  * 统一剥掉(根 `/` 除外),让同一目标只有一个 key —— 前缀判域(见 {@link dirCoversPath})靠的就是
  * key 的唯一性。
  *
- * 🔴 **单点**([ref] 起):此前它的一份私有副本住在 `boot/deferred-sandbox-path-env.ts`(沙箱代理的
- * `absolutePath` 词法臂),而写门豁免域与任务根的判域现在读的是同一条律 —— 两份各自归一就是两个 key
- * 空间,而「豁免域盖没盖住任务根」这种判断在两个 key 空间里可以同时答是和否。
+ * 🔴 **单点**([ref] 起):写门豁免域与任务根的判域读的是同一条律 —— 两份各自归一就是两个 key
+ * 空间,而「豁免域盖没盖住任务根」这种判断在两个 key 空间里可以同时答是和否。它只答**配置座**上的判域
+ * (env-facts 的 cwd / scratchpad 事实、{@link dirCoversPath});执行环境方法读路径不经它 —— 那一面是执行缝路径律
+ * (`plugins/exec-path-law.ts`,只锚不折,沙箱写门代理的 `absolutePath` 也读那一只)。
  * (core 内部有同形的 `normalizeAbsPathLexically`,但未从包根导出;此处是 Node 标准库的等价运算,
  *  不是它的抄本——若日后 core 导出,这里应改为直接复用。)
  */

package/dist/task-settings.d.ts

@@ -463,6 +463,19 @@ export declare function taskHooksHonored(config: {
  * 在 `server.ts` prepareSpec 里 400 响亮拒 + 逐字列名。双层姿势与 outputStyle / permissionMode 两处逐字相同。
  */
 export declare function parseTaskSettings(raw: unknown, seats?: ParseTaskSettingsSeats): ParseTaskSettingsResult;
+/** The one reading of `settings.outputStyle`: a non-empty string within {@link MAX_SETTINGS_OUTPUT_STYLE_CHARS} ⇒ it; anything else ⇒ absent.
+ *  Readers: the settings parser above and the system-prompt fold judgment at the head of `resolveSpec` (which runs before the parser's stage). */
+export declare function acceptOutputStyle(v: unknown): string | undefined;
+/**
+ * **系统提示追加折叠的唯一读法**(一个 spec 字段 `TaskSpec.appendSystemPrompt` 里折进几段):段按序、缺席 / 空段不出、`\n\n` 连接;`chars` = 折出来的字符数(含连接符)。
+ * 段序恒为 请求 `appendSystemPrompt` → 项目简报(`project-context.ts`)→ `settings.outputStyle`(字节稳定,前缀缓存靠它);三段共一只上限 16384。
+ * 读者四位,同读这一只:受理口的两段合计判(`http/admission.ts`)、装配器头部的三段判(`boot/resolve-spec.ts`,只在简报在场时)、装配合成(本文件 `applyTaskSettings` 接 style)、
+ * 续跑镜像(`resolve-spec.ts` 阶段⑤:存量体合计超帽 ⇒ 丢 style + warn)。
+ */
+export declare function appendFold(segments: readonly (string | undefined)[]): {
+    readonly text: string | undefined;
+    readonly chars: number;
+};
 /** Defensive acceptance of the `appendSystemPrompt` rider ([ref] R2 + codex F2): the HTTP 400 gate (prepareSpec,
  *  MAX_SYSTEM_PROMPT_CHARS) only covers FRESH submits — every resume family re-enters resolveSpec on a STORED body,
  *  and a pre-1.243 store preserved unknown request keys verbatim (the field was INERT then), so an over-cap legacy

package/dist/task-settings.js

@@ -360,9 +360,9 @@ export function parseTaskSettings(raw, seats = {}) {
     }
     if (typeof s.model === "string" && s.model.length > 0)
         out.model = s.model;
-    if (typeof s.outputStyle === "string" && s.outputStyle.length > 0 && s.outputStyle.length <= MAX_SETTINGS_OUTPUT_STYLE_CHARS) {
-        out.outputStyle = s.outputStyle;
-    }
+    const outputStyle = acceptOutputStyle(s.outputStyle);
+    if (outputStyle !== undefined)
+        out.outputStyle = outputStyle;
     if (shellEnv)
         out.shellEnv = shellEnv;
     if (s.ultracode === true)
@@ -388,6 +388,14 @@ export function parseTaskSettings(raw, seats = {}) {
         out.httpHookAllowlist = httpHookAllowlist;
     return { settings: Object.keys(out).length > 0 ? out : undefined, deferred, ...(hooksReread !== undefined ? { hooksReread } : {}) };
 }
+export function acceptOutputStyle(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= MAX_SETTINGS_OUTPUT_STYLE_CHARS ? v : undefined;
+}
+export function appendFold(segments) {
+    const present = segments.filter((segment) => segment !== undefined && segment.length > 0);
+    const text = present.length > 0 ? present.join("\n\n") : undefined;
+    return { text, chars: text?.length ?? 0 };
+}
 export function acceptAppendSystemPrompt(v, warn) {
     if (v === undefined)
         return undefined;
@@ -593,10 +601,8 @@ export function applyTaskSettings(base, settings, bases) {
     const allow = settings.permissions?.allow;
     if (allow !== undefined)
         next = { ...next, allowedTools: allow.map((entry) => allowMemberOf(entry, bases?.configRoot)) };
-    if (settings.outputStyle) {
-        const appended = next.appendSystemPrompt ? `${next.appendSystemPrompt}\n\n${settings.outputStyle}` : settings.outputStyle;
-        next = { ...next, appendSystemPrompt: appended };
-    }
+    if (settings.outputStyle)
+        next = { ...next, appendSystemPrompt: appendFold([next.appendSystemPrompt, settings.outputStyle]).text };
     return next;
 }
 //# sourceMappingURL=task-settings.js.map

package/dist/tool-approval.d.ts

@@ -300,9 +300,9 @@ export type StandingAnswerHome = "none" | "seat" | "server_store";
 /**
  * 🔴 **[ref] —— 会话级放行的唯一判据:站着的答案能不能退掉这一问,能的话它记在哪({@link StandingAnswerHome})。** 纯函数,读者:
  *  · **读侧**(`askBroadcast` 的会话授权短路 {@link ToolApprovalCoordinator.standingGrantSettles}):`seat` 才可能由既有授权代答,否则往下走真出卡;
- *  · **写侧**(`finishRespond` 的 `grantable` 与 `recordDeploymentListAnswer`):`seat` 把 `allow_session` 铸成进程内授权;`server_store` 落 server 的会话豁免店;
+ *  · **写侧**(`finishRespond` 与 `recordDeploymentListAnswer`,经 {@link liveSessionAnswer}):`seat` 把 `allow_session` 铸成进程内授权;`server_store` 落 server 的会话豁免店;
  *    `none` 只放行这一次、`rememberApplied:false`;
- *  · **卡面提示位**(活卡帧 / 条目 / `livePending` 行的 `rememberRefused`):在场 ⇔ `none`;
+ *  · **卡面提示位**(活卡帧 / 条目 / `livePending` 行的 `rememberRefused`):在场 ⇔ 本函数答 `none` 或这条腿记不下(读的是 {@link liveSessionAnswer},它先问本函数);
  *  · **耐久可记性**({@link standingAnswerDurablyRecordable}:`/decide` 的 remember、运维队列行、策略层两只豁免读面)。
  * 各读者读同一份事实、说同一句话:一问若不许被记住的放行答掉,它的应答也不许变成一条记住的放行 —— 否则
  * 同一只卡「重跑一遍」就被自己上一次的回答代答(test [ref] U1s-off 的真形)。读者侧没有任何按「问的属主」另判的臂:属主只在本函数里读一次。
@@ -469,11 +469,12 @@ export interface ToolApprovalFrame {
     mandated?: true;
     /**
      * **7.116.0(审计修复批 S4;ADDITIVE,`"tool_approval"` only)—— 这张卡上的「本会话放行」只放行这一次、不会被记住。**
-     * 在场 ⇔ 同一只判据 {@link standingAnswerHome} 答 `none`(治理强制 / 必须真人 / 强制 / 应答还授予别的东西 / 类集清不掉),回决侧写授权
-     * (`finishRespond`)读的是同一份事实 ⇒ 帧说不可记 ⇔ 点了 `allow_session` 回执 `rememberApplied:false`。壳读这一位决定渲不渲
+     * 在场 ⇔ 同一只判官 {@link liveSessionAnswer} 答 `none`(问本身记不住:治理强制 / 必须真人 / 强制 / 应答还授予别的东西 / 类集清不掉;或这条腿记不下:
+     * 没有会话 / 读不出会话住客),回决侧写授权(`finishRespond`)读的是同一只 ⇒ 帧说不可记 ⇔ 点了 `allow_session` 回执 `rememberApplied:false`。壳读这一位决定渲不渲
      * 「本会话放行」,不再从 `requiresRealApproval` / `mandated` / `governanceForced` 三位自己推断(那一推断漏掉第四个理由:core 7.41.0
      * 的 `Skill` 卡批准即授予清单,三位全无)。`card_json` 卡面、`livePending` 行、运维队列行同名同义。
-     * 🔴 **真才带,缺席绝不编 `false`**:缺席 = 可记(有会话时)或老服务端。没有会话的腿上、或读不出会话住客的腿上点了照样只放行一次(回执说明),本位不管那两形。
+     * 判官是 {@link liveSessionAnswer}(这一问的事实 + 这条腿记不记得下:没有会话的腿、读不出会话住客的腿同样在场),回决写侧读同一只。
+     * 🔴 **真才带,缺席绝不编 `false`**:缺席 = 在这条腿上记得住,或老服务端。
      */
     rememberRefused?: true;
     /**
@@ -528,7 +529,7 @@ export interface ToolApprovalFrame {
      * **[ref] ②(core 7.37.0 [ref];ADDITIVE,`"tool_approval"` only)** —— 这一问的**类**:`classes` 的首员(core `ASK_CLASSES` 序),
      * `MODE_ARBITRATION` 的行键(权限模式读的就是它 / 它们)。引擎在每一个铸 `origin` 的站盖章(策略自报的值在盖章处被替换),本仓经
      * `approval-card.ts` 的 `readAskClassPair(req)` 窄读(判法 = core 屏 `screenAskClassMembers`,[ref] ⑥ / [ref],本仓零自写对判;屏拒 ⇒ 两键都不投 + 计一次
-     * [ref] 集外 tag)。**与 {@link classes} 同在同缺**;缺席 = 老引擎 / 不盖类的站(共享制品读确认,core KL-1214-a),不是「无类」。
+     * [ref] 集外 tag)。**与 {@link classes} 同在同缺**;缺席 = 老引擎 / 不盖类的站(共享制品读确认,core [ref]),不是「无类」。
      * display:壳按类渲卡(cli 卡面、client-core [ref]),durable 审批席按类答;**本仓不按它裁决**(无人值守腿的按类作答读 core 交来的
      * `AskRequest.classes` 本身)。同一对的其余面:`card_json` 卡面 / `approval_request` 呈卡帧 / 断连重放帧(同一份素材)、运维队列行
      * (`parkRowFacts`,读停车行孪生座 `PendingAction.tool_approval.askClass`);inbox 行不带(core `CheckpointSummary` 不回显)。