@sema-agent/server 7.149.0 → 7.151.0

package/dist/boot/execution-env.js

@@ -32,6 +32,7 @@ import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-
 import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
+import { bindingsOf } from "../session-bindings.js";
 import { sessionFaceOfHead } from "../session-incarnation.js";
 import { isCodeToken } from "../terminal.js";
 import { createCacheMissMemory } from "../workspace-cache.js";
@@ -61,16 +62,40 @@ function sandboxLaneEnvMerged(lane) {
     return Object.keys(merged).length > 0 ? merged : undefined;
 }
 const MAX_CWD_SESSIONS = 4096;
+function withWrites(cells, writes) {
+    return bindingsOf(writes.cwd ?? cells.cwd, writes.shellEnv !== undefined ? { ...writes.shellEnv } : cells.shellEnv, writes.inheritEnv);
+}
+function restoreCell(map, sid, value) {
+    if (value === undefined)
+        map.delete(sid);
+    else
+        map.set(sid, value);
+}
 export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionCwd = new Map();
     const perSessionShellEnv = new Map();
     const perSessionInheritEnv = new Map();
     const owners = new Map();
     const occupants = new Map();
+    const logs = new Map();
+    const cellsOf = (sid) => bindingsOf(perSessionCwd.get(sid), perSessionShellEnv.get(sid), perSessionInheritEnv.get(sid));
+    const materialize = (sid, log) => {
+        const cells = log.entries.reduce((acc, e) => withWrites(acc, e.writes), log.base);
+        restoreCell(perSessionCwd, sid, cells.cwd);
+        restoreCell(perSessionShellEnv, sid, cells.shellEnv);
+        restoreCell(perSessionInheritEnv, sid, cells.inheritEnv);
+    };
+    const compact = (sid, log) => {
+        while (log.entries[0]?.settled === true)
+            log.base = withWrites(log.base, log.entries.shift().writes);
+        if (log.entries.length === 0)
+            logs.delete(sid);
+    };
     const dropSession = (sid) => {
         perSessionCwd.delete(sid);
         perSessionShellEnv.delete(sid);
         perSessionInheritEnv.delete(sid);
+        logs.delete(sid);
         owners.delete(sid);
         occupants.delete(sid);
     };
@@ -85,22 +110,34 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         perSessionCwd,
         perSessionShellEnv,
         sessionOwners: owners,
-        setSessionCwd: (sid, cwd) => {
-            perSessionCwd.set(sid, cwd);
+        perSessionInheritEnv,
+        commitSessionBindings: (sid, bindings) => {
+            const log = logs.get(sid) ?? { base: cellsOf(sid), entries: [] };
+            logs.set(sid, log);
+            const token = Symbol(sid);
+            log.entries.push({ token, writes: { ...bindings, ...(bindings.shellEnv !== undefined ? { shellEnv: { ...bindings.shellEnv } } : {}) }, settled: false });
+            materialize(sid, log);
             touch(sid, undefined);
+            return { sessionId: sid, token };
         },
-        setSessionShellEnv: (sid, env) => {
-            perSessionShellEnv.set(sid, env);
-            touch(sid, undefined);
+        withdrawSessionBindings: (receipt) => {
+            const log = logs.get(receipt.sessionId);
+            const at = log?.entries.findIndex((e) => e.token === receipt.token) ?? -1;
+            if (log === undefined || at < 0)
+                return false;
+            log.entries.splice(at, 1);
+            materialize(receipt.sessionId, log);
+            compact(receipt.sessionId, log);
+            return true;
         },
-        perSessionInheritEnv,
-        setSessionInheritEnv: (sid, policy) => {
-            if (policy === undefined) {
-                perSessionInheritEnv.delete(sid);
-                return;
-            }
-            perSessionInheritEnv.set(sid, policy);
-            touch(sid, undefined);
+        settleSessionBindings: (receipt) => {
+            const log = logs.get(receipt.sessionId);
+            const entry = log?.entries.find((e) => e.token === receipt.token);
+            if (log === undefined || entry === undefined)
+                return false;
+            entry.settled = true;
+            compact(receipt.sessionId, log);
+            return true;
         },
         fenceSessionOwner: (sid, owner, incarnation) => {
             const ownerChanged = owners.has(sid) && owners.get(sid) !== owner;
@@ -113,6 +150,7 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
                 perSessionCwd.delete(sid);
                 perSessionShellEnv.delete(sid);
                 perSessionInheritEnv.delete(sid);
+                logs.delete(sid);
             }
             touch(sid, owner);
         },
@@ -250,9 +288,7 @@ export function createExecutionEnv(ctx) {
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
     const sessionScoped = createSessionScopedRegistries();
-    const { perSessionCwd, setSessionCwd } = sessionScoped;
-    const { perSessionShellEnv, setSessionShellEnv } = sessionScoped;
-    const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
+    const { perSessionCwd, perSessionShellEnv, perSessionInheritEnv } = sessionScoped;
     const lspManager = createLspManager(config, (event, fields) => logger.info(event, fields));
     if (lspManager)
         logger.info("lsp_enabled", { provider: config.remoteExec.provider });
@@ -533,7 +569,8 @@ export function createExecutionEnv(ctx) {
         },
     });
     return {
-        perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
+        perTaskImage, sessionEnvSelection, perSessionCwd,
+        sessionBindings: { commitSessionBindings: sessionScoped.commitSessionBindings, withdrawSessionBindings: sessionScoped.withdrawSessionBindings, settleSessionBindings: sessionScoped.settleSessionBindings },
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
         dropSessionScopedOf: sessionScoped.dropSessionOf,

package/dist/boot/execution-lane.js

@@ -1,7 +1,7 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { entryDeclarableRemoteExec } from "../config.js";
+import { entryDeclarableRemoteExec, FILE_LANE_CELL_ENV, logConfigDiagnostics, parseHostLaneEnv, parseLocalDockerLaneEnv, } from "../config.js";
 import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { installReadDenyFloorDeployment } from "../read-deny-floor-notice.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
@@ -27,6 +27,29 @@ function fileLaneUnresolvableRefusal(entry, lane, envReading, root) {
         `(file-source name→value resolution is not wired yet), and ${envReading}. The file's declaration ends the lane selection: no other declaration may stand in for it. ` +
         `Refusing before any task starts: set REMOTE_EXEC=${lane} with that lane's required env, or change the file to the lane you mean.`);
 }
+function envReadingOfFileLane(minted, read, logger) {
+    if (minted !== undefined)
+        return minted;
+    const reading = read();
+    logConfigDiagnostics(logger);
+    return reading;
+}
+function discloseFileCellOverrides(lane, envReading, fileCells, logger, root) {
+    const cellEnvKeys = FILE_LANE_CELL_ENV[lane];
+    const keys = Object.entries(cellEnvKeys)
+        .filter(([cell]) => envReading[cell] !== undefined && fileCells[cell] !== undefined && envReading[cell] !== fileCells[cell])
+        .map(([, envKey]) => envKey);
+    if (keys.length === 0)
+        return;
+    logger.warn("remote_exec_file_overrides", {
+        provider: lane,
+        root,
+        keys,
+        note: `config.d/remote-exec.json (CONFIG_PROVIDER=local, file-wins) gives a different value than env for ${keys.join(", ")} on the "${lane}" lane — the file's value is in effect and ` +
+            `the env value for ${keys.length === 1 ? "that key is" : "those keys are"} INERT. The lane's other env parameters are read as usual. ` +
+            `Make the two agree: unset the env key if the file's value is the intended one, or change the file's cell (an optional cell can be removed from the file; "image" is mandatory there).`,
+    });
+}
 export async function composeExecutionLane(loaded, ctx) {
     if (ctx.configSource === "local")
         await applyRemoteExecFile(loaded, ctx);
@@ -127,25 +150,29 @@ async function applyRemoteExecFile(config, ctx) {
     };
     const drives = (lane) => ctx.entry.runs.includes(lane);
     if (fileRx.provider === "host" && drives("host")) {
-        config.remoteExec = {
-            provider: "host",
+        const envReading = envReadingOfFileLane(config.remoteExec?.provider === "host" ? config.remoteExec : undefined, parseHostLaneEnv, logger);
+        const fileCells = {
             ...(fileRx.workdir ? { workspaceBase: fileRx.workdir } : {}),
             ...(fileRx.commandTimeoutMs != null ? { commandTimeoutMs: fileRx.commandTimeoutMs } : {}),
         };
+        config.remoteExec = { provider: "host", ...envReading, ...fileCells };
         disclosePreemption("host");
+        discloseFileCellOverrides("host", envReading, fileCells, logger, localRoot);
         logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
         return;
     }
     if (fileRx.provider === "local-docker" && drives("local-docker")) {
-        config.remoteExec = {
-            provider: "local-docker",
+        const envReading = envReadingOfFileLane(config.remoteExec?.provider === "local-docker" ? config.remoteExec : undefined, () => parseLocalDockerLaneEnv(config.requirePrincipal !== true), logger);
+        const fileCells = {
             image: fileRx.image,
             ...(fileRx.mountPath ? { mountPath: fileRx.mountPath } : fileRx.workdir ? { mountPath: fileRx.workdir } : {}),
             ...(fileRx.memory ? { memory: fileRx.memory } : {}),
             ...(fileRx.cpus != null ? { cpus: fileRx.cpus } : {}),
             ...(fileRx.network ? { network: fileRx.network } : {}),
         };
+        config.remoteExec = { provider: "local-docker", ...envReading, ...fileCells };
         disclosePreemption("local-docker");
+        discloseFileCellOverrides("local-docker", envReading, fileCells, logger, localRoot);
         logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
         return;
     }

package/dist/boot/late-binds.d.ts

@@ -1,5 +1,5 @@
 /**
- * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 五只 cell,读点在前段、写点在后段。
+ * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 六只 cell,读点在前段、写点在后段。
  *
  * 为什么是模块级 live binding 而不是 ctx 字段:读点的原文是**裸标识符**(`() => runStore`、
  * `() => parkedAskRedeem`),而 ctx 字段是**快照** —— 把读点改成 `ctx.runStore` 就是正文改写,
@@ -9,9 +9,10 @@
  *  · `parkedAskRedeem` / `runDenySweep` —— 它们的**声明行本身**就是 `let`(逐字搬进本文件,含缩进),
  *    赋值点(server 造出来之后那两处)也随之搬进 `bindServerLateSeats` —— 跨模块给 import 赋值是非法的,
  *    所以 cell 与它的写点必须同居一个模块;
- *  · `sessionNotifyDoor` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`)。
+ *  · `sessionNotifyDoor` / `runEndedHandoff` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`);
+ *  · `sessionAgeOut` —— 会话老化腿(`boot/session-age-out.ts`):读点在第 8 段的维护拍,它要的删除协调器在第 9 段铸 ⇒ 写点 `bindSessionAgeOut` 在第 9 段协调器之后。
  *
- * 时序与修前逐字相同:五只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
+ * 时序与修前逐字相同:六只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
  * listen 之后的请求/tick 上),写点仍在各自原来的那一拍。未绑窗内取值得到 `undefined` —— 这正是
  * 各消费座既有的 fail-closed 臂(device 限速座:`gate()` 取不到就抛,见 boot/device-lane.ts:68)。
  */
@@ -27,7 +28,10 @@ declare let rateLimiter: RateGate | undefined;
 declare let parkedAskRedeem: ParkedAskRedeem | undefined;
 declare let runDenySweep: ((now: number) => Promise<void>) | undefined;
 declare let sessionNotifyDoor: SessionNotifyDoor | undefined;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
+declare let runEndedHandoff: ((runId: string) => Promise<void>) | undefined;
+declare let sessionAgeOut: (() => Promise<unknown>) | undefined;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor, runEndedHandoff, sessionAgeOut };
+export declare function bindSessionAgeOut(v: (() => Promise<unknown>) | undefined): void;
 export declare function bindRunStore(v: ReturnType<StoreBackend["run"]> | undefined): void;
 export declare function bindRateLimiter(v: RateGate): void;
 export declare function bindServerLateSeats(ctx: {

package/dist/boot/late-binds.js

@@ -3,7 +3,12 @@ let rateLimiter;
 let parkedAskRedeem;
 let runDenySweep;
 let sessionNotifyDoor;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
+let runEndedHandoff;
+let sessionAgeOut;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor, runEndedHandoff, sessionAgeOut };
+export function bindSessionAgeOut(v) {
+    sessionAgeOut = v;
+}
 export function bindRunStore(v) {
     runStore = v;
 }
@@ -14,6 +19,7 @@ export function bindServerLateSeats(ctx) {
     const { config, logger, server } = ctx;
     runDenySweep = server.denyExpiredApprovals;
     sessionNotifyDoor = server.sessionNotifyDoor;
+    runEndedHandoff = server.handOverRunEndedDecisions;
     if (!config.directDoorActive)
         parkedAskRedeem = server.redeemParkedAsk;
     else

package/dist/boot/memory-consolidation.d.ts

@@ -326,8 +326,9 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
 export declare function buildConsolidationValveAudit(input: {
     /** 阀门判决({@link resolveConsolidationValve} 的 `enabled` + `source`)。 */
     valve: Pick<ConsolidationValve, "enabled" | "source">;
-    /** 这台部署配了任何一把 service 凭证吗(`config.authToken` 或 `config.authTokens` 非空)。 */
-    hasServiceAuth: boolean;
+    /** 这台部署接没接任何一类过凭据门的来源(service 凭据 / 鉴权桥;部署形表行 `credentialGateSource`,写门律 5 在部署上的投影)。
+     *  没接 ⇒ 没有一次请求过得了写门(逃生口之外)。 */
+    credentialGateSource: boolean;
     /** 本地开发的显式逃生口(`ALLOW_UNAUTHED_WRITES=true`)。 */
     allowUnauthedWrites: boolean;
 }): {

package/dist/boot/memory-consolidation.js

@@ -282,17 +282,17 @@ export function buildConsolidationValveAudit(input) {
     if (!input.valve.enabled || input.valve.source !== "explicit")
         return { warnings: [] };
     const warnings = [];
-    if (!input.hasServiceAuth && !input.allowUnauthedWrites) {
+    if (!input.credentialGateSource && !input.allowUnauthedWrites) {
         warnings.push({
             tag: "memory_consolidation_run_credential_gated",
-            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve, but this worker has NO service credential " +
-                "(SERVICE_AUTH_TOKEN / per-system tokens are unset) and ALLOW_UNAUTHED_WRITES is not on. POST " +
+            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve, but this worker accepts NO credential on its write face " +
+                "(SERVICE_AUTH_TOKEN / per-system tokens are unset and no SSO bridge verifies registry sign-in tokens) and ALLOW_UNAUTHED_WRITES is not on. POST " +
                 "/v1/admin/memory/consolidation/run runs the model, so it rides the billable-submit gate and is refused " +
-                "with 503 auth.service_token_required BEFORE it reaches the route — while capabilities." +
+                "with 503 auth.service_token_required BEFORE it reaches the route for every caller — while capabilities." +
                 "memoryConsolidationDriver still reports true (a family-wide gap this worker shares with adoption / memory " +
                 "bundle / memory compliance; it is documented, not silently accepted). GET /v1/admin/memory/consolidation " +
-                "is unaffected (it runs no model). Set SERVICE_AUTH_TOKEN, or set ALLOW_UNAUTHED_WRITES=true for local " +
-                "development only.",
+                "is unaffected (it runs no model). Set SERVICE_AUTH_TOKEN (or configure the SSO bridge, AUTH_BRIDGE_ISSUER, so verified " +
+                "sign-in tokens pass), or set ALLOW_UNAUTHED_WRITES=true for local development only.",
         });
     }
     return { warnings };

package/dist/boot/parked-revive-gate.d.ts

@@ -1,7 +1,7 @@
 import { type BackgroundAgentRecord, type RunnerDeps, type ToolExecuteContext } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import type { RunnerDepsOnAsk } from "./runner-deps.js";
-import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView, type LiveQuestionFace } from "../deployment-governance.js";
+import { type ApprovalBaselineConfigView, type DeploymentGovernanceConfigView } from "../deployment-governance.js";
 import { type SandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import type { ApprovalExemptionStore } from "../plugins/approval-exemption-store.js";
 /** 本腿读的配置切面(`ServiceConfig` 结构满足)。两个构造口各自的切面 + lane 判别式读的 `remoteExec`。 */
@@ -15,9 +15,9 @@ export interface ParkedReviveGateConfigView extends DeploymentGovernanceConfigVi
 export interface ParkedReviveGateDeps {
     /** ⚠️ **活引用**:热改字段(autonomy/commandPolicy/守卫集/审批四旋钮)每次赎回现读,见下方「禁 memoize」。 */
     readonly config: ParkedReviveGateConfigView;
-    /** [ref]:活体 AskUserQuestion 面。赎回腿今天无 ALS ctx ⇒ 判 ask,与原形同判。
-     *  ⚠️ 它同时是**决议链元数据** `contentMandate` 的唯一判据(见 {@link mandatePostureOf})。 */
-    readonly question: LiveQuestionFace | undefined;
+    /** 问题席在场(与 resolve-spec 的 `questionSeat` 同一位,装配点递的是同一只协调器的在场性)。
+     *  它是**决议链元数据** `contentMandate` 的唯一判据(见 {@link chainMetadataOf})。 */
+    readonly questionSeat: boolean;
     /**
      * 部署级活体审批席 —— `RunnerDeps.onAsk` 的**同源铸法**(main.ts 递 `createRunnerDepsOnAsk(toolApproval)`,
      * 单一属主同 boot/runner-deps.ts)。
@@ -90,7 +90,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
 /**
  * 赎回腿的父约束链重建([ref] 件二)。
  *
- * 语义:**同/跨副本一致地重建「部署 ⊇ 操作员」两层完整链**——审批基线(durable question 门 + F4 高危写
+ * 语义:**同/跨副本一致地重建「部署 ⊇ 操作员」两层完整链**——审批基线(core 的问答策略 + F4 高危写
  * 审批门 + 部署名单那一问的豁免读面)作 base 的 `toolPolicy` 座,经**折叠属主** `applyRuntimeGovernance`
  * (→ core `tightenTaskSpec`)叠上部署治理段(autonomy / commandPolicy / MANUAL_MODE_SHELL_GATE /
  * 守卫集),取其 `toolPolicy` 装进单层 `parentConstraints`。

package/dist/boot/parked-revive-gate.js

@@ -13,7 +13,7 @@ function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
 export function createParkedReviveInheritedGate(deps) {
-    const { config, question, approvalExemptionStore, logger, localRoot, approverSeat } = deps;
+    const { config, approvalExemptionStore, logger, localRoot, approverSeat } = deps;
     const slots = deps.slots ?? sandboxPathEnvSlots;
     return async (row, identity) => {
         const metadata = await chainMetadataOf(deps, row, identity);
@@ -32,7 +32,6 @@ export function createParkedReviveInheritedGate(deps) {
         const rootSessionId = row.rootSessionId;
         const baseline = createApprovalBaselinePolicy(config, {
             kind: "durable",
-            question,
             ...(approvalExemptionStore !== undefined && rootSessionId ? { exemption: createSessionExemptionRead(approvalExemptionStore, rootSessionId, logger, "deployment_list", "parked_revive") } : {}),
         });
         const governed = applyRuntimeGovernance({ objective: "", toolPolicy: baseline }, createDeploymentGovernanceInputs(config, pathAdjudication));
@@ -53,7 +52,7 @@ async function chainMetadataOf(deps, row, identity) {
     const forced = caps?.forceDurableGate === true;
     return {
         ...(forced || deps.approverSeat === undefined ? { durableMandate: true } : {}),
-        ...(forced || deps.question === undefined ? { contentMandate: true } : {}),
+        ...(forced || !deps.questionSeat ? { contentMandate: true } : {}),
         ...autoModePostureOf(deps, row, caps),
     };
 }

package/dist/boot/reapers.d.ts

@@ -28,6 +28,7 @@ import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { type SandboxReaper } from "../plugins/sandbox-reaper.js";
 import { type AuditRotationPort } from "../approval-ask-retention.js";
+import type { HolderPullTally } from "../orchestration/workflow-park-holder.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -103,6 +104,8 @@ export interface ReapersCtx {
      *  `TOOL_APPROVAL_ENABLED=false` 的部署恒 undefined ⇒ 收敛器照常收敛,只是不发通知帧(壳侧靠
      *  重连 preamble 对账,见 approval-card.ts 的 `ApprovalRevokeFrame` 顶注)。 */
     toolApproval: ToolApprovalCoordinator | undefined;
+    /** workflow 停驻卡持有进程的拉取腿(`orchestration/workflow-park-holder.ts`;第 8 段按决定店 / 执行器视图在场装配)。缺席 = 没有 workflow 停驻车道 ⇒ 本腿零调用。 */
+    workflowParkHolderPull?: () => Promise<HolderPullTally>;
     /** [ref]:规则店的**保留期口**。`PERMISSION_RULES_ENABLED=false` 或后端没实装 ⇒ undefined
      *  ⇒ 本腿根本不注册(零扫描),与它的同族旋钮腿同姿势。
      *
@@ -122,6 +125,8 @@ export interface ReapersCtx {
     approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
+    /** 会话老化腿(晚绑:它要的删除协调器在第 9 段铸,`late-binds.ts` 的 `sessionAgeOut`)。缺席 = 这台部署记不了会话种类 / 还没绑 ⇒ 本腿零调用。 */
+    getSessionAgeOut?: () => (() => Promise<unknown>) | undefined;
     /** 本车道的沙箱回收座(`plugins/sandbox-reaper.ts`;第 5 段与 run 工厂同一份车道配置铸):k8s 车道 = 沙箱 Pod reaper(`plugins/k8s-pod-reaper.ts`),local-docker 车道 = 无主容器 reaper
      *  (`plugins/local-docker-reaper.ts`)。缺席 = 别的车道 ⇒ 本腿零调用。一次部署一条执行车道 ⇒ 一只座、一个节拍。 */
     sandboxReaper?: SandboxReaper;

package/dist/boot/reapers.js

@@ -86,7 +86,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, sandboxReaper, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, getSessionAgeOut, userInputLedger, approvalAskAudit, sandboxReaper, workflowParkHolderPull, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -119,6 +119,7 @@ export function startReapers(ctx) {
     const approvalNonceReapExpiredGuard = createThrottledReaperCatch("approval_nonce_reap_expired", logger);
     const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
+    const sessionAgeOutGuard = createThrottledReaperCatch("session_age_out", logger);
     const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
     const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
     const storeSweepGuards = {
@@ -158,6 +159,8 @@ export function startReapers(ctx) {
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
     const approvalSuspendedPollGuard = createThrottledReaperCatch("approval_suspended_poll", logger);
     let approvalSuspendedPollInFlight = false;
+    const workflowParkHolderPullGuard = createThrottledReaperCatch("workflow_park_holder_pull", logger);
+    let workflowParkHolderPullInFlight = false;
     const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
     let permissionRuleReapInFlight = false;
     let approvalReconcileInFlight = false;
@@ -265,6 +268,8 @@ export function startReapers(ctx) {
             leg(getRunDenySweep()?.(Date.now())
                 .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError));
         }
+        leg(getSessionAgeOut?.()?.()
+            .then(() => sessionAgeOutGuard.onSuccess(), sessionAgeOutGuard.onError));
         leg(approvalNonceStore
             ?.reapExpired()
             .then(reapCount("approval_nonces_reaped_total", {}))
@@ -360,6 +365,12 @@ export function startReapers(ctx) {
                 .then(() => approvalSuspendedPollGuard.onSuccess(), approvalSuspendedPollGuard.onError)
                 .finally(() => (approvalSuspendedPollInFlight = false)));
         }
+        if (workflowParkHolderPull && !workflowParkHolderPullInFlight) {
+            workflowParkHolderPullInFlight = true;
+            leg(workflowParkHolderPull()
+                .then(() => workflowParkHolderPullGuard.onSuccess(), workflowParkHolderPullGuard.onError)
+                .finally(() => (workflowParkHolderPullInFlight = false)));
+        }
         if (!permissionRuleReapInFlight) {
             permissionRuleReapInFlight = true;
             leg(permissionRuleStores

package/dist/boot/resolve-spec.d.ts

@@ -3,7 +3,6 @@ import { sendUserFileTool } from "../capabilities/send-user-file-tool.js";
 import { selectScenario } from "../capabilities/scenarios.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
 import type { ServiceConfig } from "../config.js";
-import { type LiveQuestionFace } from "../deployment-governance.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { type HookLlmCall } from "../hooks/hook-runner.js";
 import type { createHookLlm } from "../hooks/hook-llm.js";
@@ -34,9 +33,9 @@ export interface ResolveSpecCtx {
     /** 活引用(registry 热应用换引用)—— 见文件头「位置即契约」。 */
     getKeyResolver: () => ReturnType<typeof createKeyResolver>;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    perSessionCwd: Map<string, string>;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    /** 会话登记簿的工作目录那一格(**只读**:这条腿没带工作目录时它是会话上已登记的那一枚)。会话绑定(cwd / shellEnv / inheritEnv)本装配器只判、只算
+     *  (`LegFacts.sessionBindings`),写在路由层 run 认领之后的唯一提交点(`session-bindings.ts` 的 `commitLegBindings`)—— 律见那只文件头注。 */
+    perSessionCwd: ReadonlyMap<string, string>;
     /** 两张 per-session 登记簿的**租户围栏**(codex R1-F1):每次提交对拍本会话的主人,换主即清。
      *  论证(为什么 device lane 把这条从「不需要」变成「必需」)逐字见 `createSessionScopedRegistries` 头注。 */
     fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
@@ -64,10 +63,10 @@ export interface ResolveSpecCtx {
     /** [ref]:记忆同步腿(开 `MEMORY_SYNC_*` 且记忆引擎接线时在场)—— 项目层准备一步把本任务的项目层交给它跟踪(`memory-project-layer.ts`)。 */
     memorySyncRunner: MemorySyncRunner | undefined;
     durableEnabled: boolean;
-    /** [ref] ([ref] 案二):活体 AskUserQuestion 面(QuestionCoordinator 的判决探针切面)。在场(=
-     *  ASK_QUESTION_ENABLED)时 durable question 门按活流上下文分腿、spec 不再 stamp QUESTION_AWAITS_RESUME
-     *  (否则 spec.onQuestion 恒遮蔽 RunnerDeps.onQuestion 的活人腿);缺席时行为与旧形逐字一致。 */
-    liveQuestionFace: LiveQuestionFace | undefined;
+    /** 问题席在场(= `ASK_QUESTION_ENABLED` 装了 `QuestionCoordinator`,`RunnerDeps.onQuestion` 是它):本仓「问题席在不在」这一事实的**一位**,
+     *  三个读者同读 —— 本文件的 posture 判据与 sentinel 铸不铸、赎回链的 `contentMandate`(`parked-revive-gate.ts`)。在场 ⇒ spec 不铸
+     *  `QUESTION_AWAITS_RESUME`(否则 `spec.onQuestion` 恒遮蔽 `RunnerDeps.onQuestion` 的问题席);落点归 core 的同步优先。 */
+    questionSeat: boolean;
     /**
      * [ref] 件C —— 部署级**活体审批席**(`RunnerDeps.onAsk` 的同源铸法,main.ts 递
      * `createRunnerDepsOnAsk(toolApproval)`;单一属主同 `boot/runner-deps.ts`,与 `parked-revive-gate.ts`