@sema-agent/server 7.149.0 → 7.151.0

package/dist/boot/stage-10-http-server.js

@@ -31,18 +31,18 @@ import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import { seatText } from "../trace/exit-seat.js";
+function exactListeningLine(line) {
+    return line;
+}
 export async function runStage10(ctx) {
-    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, dropSessionScopedOf, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, sandboxCapacity, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekReading, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
+    const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, belowTaskChainPatterns, deploymentMods, deploymentModsLoaded, deviceLane, drainState, dropSessionScopedOf, durableEnabled, elicitation, fenceSessionOwner, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, sandboxCapacity, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekReading, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionTitler, sessionWatchRegistry, sessionBindings, sessionResidentBackground, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
         runStore,
-        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
         approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
         approvalNonceStore: approvalNonceStore ? approvalNonceStore : undefined,
         checkpointStore,
         checkpointCtxSealing,
-        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
         ruleConsent,
-        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
         toolResultStore,
         taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
@@ -85,7 +85,7 @@ export async function runStage10(ctx) {
         sessionAudit,
         routeJudgeBrain: brain,
         purgeSession: purgeSession ? purgeSession : undefined,
-        bindSessionInheritEnv: config.remoteExec.provider === "host" ? setSessionInheritEnv : undefined,
+        sessionBindings,
         dropSessionScopedOf,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
@@ -211,14 +211,14 @@ export async function runStage10(ctx) {
         config, logger, metrics, localRoot, scenarios, loadedSkills, principalCaps, centerRuntimeCapsResolver,
         peerDesk,
         getKeyResolver: () => webAdmin.getKeyResolver(),
-        taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner,
+        taskAttachmentStore, perSessionCwd, fenceSessionOwner,
         hookLlm, hookAgent, belowTaskChainPatterns, fleetBus, hookWakeBus, ownerAware, taskLimitCaps, taskTimeoutSec,
         historyAnchors: resumeAnchorStore && runStore ? { anchors: resumeAnchorStore, runs: runStore } : undefined,
         selectEnvTool, sendUserFileToolSpec, memoryEngine, memorySyncRunner, durableEnabled, approvalExemptionStore,
         checkpointStore, imageIndex, perTaskImage,
         sessionEnvSelection,
         lockedKeys: governanceSeams.lockedKeys,
-        liveQuestionFace: question,
+        questionSeat: question !== undefined,
         approverSeat: createRunnerDepsOnAsk(toolApproval),
     });
     const runnerFor = createHandsRunnerSelector({ full: runner, handsless: handslessRunner });
@@ -284,11 +284,12 @@ export async function runStage10(ctx) {
         version: serviceVersion(),
         signal: () => mintEngineSignal({ ...deployment, config }),
         modelRefusals: () => deployment.modelRefusalsState?.(),
-        ...(servingLease ? { onCenterCapabilities: (caps) => servingLease.noteCenterCapabilities(caps) } : {}),
+        ...(servingLease ? { onHeartbeat: (hearing) => servingLease.noteHeartbeat(hearing) } : {}),
         ...(fleetUsage ? { usage: fleetUsage } : {}),
         logger: { info: (m, d) => logger.info(m, d ?? {}), warn: (m, d) => logger.warn(m, d ?? {}) },
     });
     webAdmin.onSelfReportChange(() => void fleetClient?.announceNow());
+    servingLease?.onViewChange(() => void fleetClient?.announceNow());
     if (fleetClient) {
         const advertised = config.fleetAdvertiseAddress;
         logger.info("fleet_client_started", { worker: config.webAdmin?.worker, usageReport: fleetUsage !== undefined, announce: advertised !== undefined, ...(advertised !== undefined ? { address: buildDisplaySafeUrl(advertised) } : {}) });
@@ -299,12 +300,13 @@ export async function runStage10(ctx) {
     const bound = server.address();
     if (bound === null || typeof bound === "string")
         throw new Error(`http server listening without a TCP address (server.address() = ${JSON.stringify(bound)})`);
-    logger.info("listening", {
+    logger.info("listening", exactListeningLine({
         port: bound.port,
         bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
         ...(bindHost === "127.0.0.1" && !config.bindHost
             ? { bindHostNote: "auto-narrowed to loopback: write face is unauthenticated (ALLOW_UNAUTHED_WRITES with no service token). Set BIND_HOST explicitly to override." }
             : {}),
+        boundAddress: bound.address,
         model: config.model.id,
         brain: brainSummary(config),
         breakerState: config.resilience.circuitBreaker ? (breakerState ? `shared(${backend.kind})` : "in-process") : "off",
@@ -327,7 +329,7 @@ export async function runStage10(ctx) {
                     ? `db(${backend.kind})`
                     : "file"
             : "off",
-    });
+    }));
     if (workflowNotifyGate) {
         void workflowNotifyGate
             .recover(workflowRecoverOpts)

package/dist/boot/web-admin.d.ts

@@ -144,7 +144,7 @@ export interface WebAdminRuntime {
     /** [ref] ②:caps `centerWiring.effectivePull` / `effectiveRevision` 的取值口 —— `lastPull`(新状态,只此一枚:boot 实拉 / 迟到 boot 到货 /
      *  refresh 拍收尾写)+ 与 `configApplyState()` **同一只** ledger 视图的已应用修订号。形与词表见 `web-admin-client/pull-state.ts`。 */
     centerPullState(): CenterPullView;
-    /** DESIGN-278 §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog` 判
+    /** [ref] §5 S2([ref]):center **当前在管**的 ServiceConfig 键集 —— `GET /v1/config/catalog` 判
      *  `effectiveLane` 的 center 半场。投影自最近一次成功应用的候选(`latestEffective`,LKG/refresh 同一
      *  份推进点;判据单源 = apply-effective.ts `centerManagedConfigKeys`)。`undefined` = 没有配置管道。
      *  ⚠️ 部分应用窗(codex R2-F2 登记):某组整拒时 live config 已吃进其它组而 latestEffective 不推进,

package/dist/boot/web-admin.js

@@ -13,7 +13,7 @@ import { centerScenarios, centerScenarioDetails } from "../capabilities/scenario
 import { isRosterGateArmed } from "../config.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, preIdentityLkgLeftover, PRE_IDENTITY_LKG_REASON } from "../config-lkg.js";
-import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
+import { answerStillCurrent, buildAssertionTokenBootFields, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
 import { centerManagedConfigKeys } from "../web-admin-client/apply-effective.js";
@@ -103,6 +103,8 @@ export async function createWebAdminRuntime(ctx) {
     if (bootVerdict?.verdict === "loud") {
         logger.error("center_credential_unreadable", { key: WEB_ADMIN_ENV.tokenFile, failure: bootVerdict.failure, reason: bootVerdict.reason, effect: bootVerdict.effect });
     }
+    if (cc !== undefined)
+        logger.info("center_assertion_token", buildAssertionTokenBootFields(cc.assertionToken));
     const credentialRenewer = cc !== undefined && cc.credential.origin.from === "file"
         ? createCenterCredentialRenewer({ source: cc.credential, centerUrl: cc.baseUrl, leadMs: config.centerCredentialRenewLeadMs, logger })
         : undefined;

package/dist/boot/workflow-orchestration.d.ts

@@ -11,11 +11,12 @@
  *     → `workflowRunStore`(包装体)的顺序是数据依赖链,不可重排。
  *  3. `getRunStore()` 是晚绑取值(runStore 在本段之后构造),原文靠同作用域前向引用。
  */
-import { type WorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
+import { type WorkflowRun } from "@sema-agent/core";
 import type { ServiceConfig } from "../config.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { type WorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
 import type { WorkflowParkDecisionStore } from "../orchestration/workflow-park-decision.js";
+import { HeldParksHere } from "../orchestration/workflow-park-holder.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
 import { type WorkflowCompletionInbox } from "../orchestration/workflow-completion-inbox.js";
@@ -31,9 +32,12 @@ export interface WorkflowOrchestrationCtx {
     backend: StoreBackend | undefined;
     /** 晚绑(runStore 在本段之后构造)——见文件头「位置即契约」③。 */
     getRunStore: () => ReturnType<StoreBackend["run"]> | undefined;
+    /** 晚绑(HTTP 服务的产物,第 10 段之后才有):run 收场送达里把「带着已受理、未交付的决定收场」的那条 run 的行交给续跑车道的那一手。
+     *  抛 = 需要重投(会话正忙 / 店瞬态 / 收编弧在跑 / 本座还没绑)⇒ 不 ack、`recover` 在维护拍上重投。契约属主 = `http/resume-legs.ts` 的 `handOverRunEndedDecisions`。 */
+    getRunEndedHandoff: () => ((runId: string) => Promise<void>) | undefined;
 }
 export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCtx): {
-    sqlWorkflowRunStore: WorkflowRunStore | undefined;
+    sqlWorkflowRunStore: import("../plugins/workflow-run-store-sql.js").SqlWorkflowRunStore | undefined;
     workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
     workflowCompletionInbox: WorkflowCompletionInbox | undefined;
     deliverWorkflowCompletion: (p: WorkflowCompletionPayload) => Promise<void>;
@@ -51,5 +55,6 @@ export declare function createWorkflowOrchestration(ctx: WorkflowOrchestrationCt
     };
     workflowAgentSessionIndex: WorkflowAgentSessionIndex | undefined;
     workflowParkDecisions: WorkflowParkDecisionStore | undefined;
+    heldParksHere: HeldParksHere | undefined;
 };
 //# sourceMappingURL=workflow-orchestration.d.ts.map

package/dist/boot/workflow-orchestration.js

@@ -2,6 +2,8 @@ import { FileWorkflowRunStore, InMemoryWorkflowRunStore } from "@sema-agent/core
 import { join } from "node:path";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { LocalWorkflowAgentSessionIndex } from "../orchestration/workflow-agent-session-index.js";
+import { FencedWorkflowRecordStore } from "../orchestration/workflow-record-fence.js";
+import { HeldParksHere } from "../orchestration/workflow-park-holder.js";
 import { createCorruptReadFailOpenSeat } from "../observability/corrupt-read-seat.js";
 import { FileWorkflowCompletionInbox, InMemoryWorkflowCompletionInbox, buildWorkflowCompleteInboxEntry, resolveCompletionRoute } from "../orchestration/workflow-completion-inbox.js";
 import { FileWorkflowNotifyJournalStore, JournalingWorkflowRunStore, WorkflowNotifyGate } from "../orchestration/workflow-notify-journal.js";
@@ -10,16 +12,16 @@ import { WorkflowAgentRegistry } from "../orchestration/workflow-agent-steer.js"
 import { workflowJournalOf } from "../plugins/store-backend.js";
 import { seatText } from "../trace/exit-seat.js";
 export function createWorkflowOrchestration(ctx) {
-    const { config, logger, metrics, localRoot, backend, getRunStore } = ctx;
+    const { config, logger, metrics, localRoot, backend, getRunStore, getRunEndedHandoff } = ctx;
     const workflowBootAtMs = Date.now();
     const sqlWorkflowRunStore = config.workflowRunStoreBackend === "auto" ? backend?.workflowRun?.((msg, meta) => logger.warn(msg, meta)) : undefined;
     const baseWorkflowRunStore = config.selfOrchestrationEnabled
         ? config.workflowRunStoreBackend === "memory"
-            ? new InMemoryWorkflowRunStore()
+            ? new FencedWorkflowRecordStore(new InMemoryWorkflowRunStore())
             : (sqlWorkflowRunStore ??
-                new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows"), {
+                new FencedWorkflowRecordStore(new FileWorkflowRunStore(join(config.localDataRoot ?? localRoot, "workflows"), {
                     onCorruptRead: createCorruptReadFailOpenSeat("server.workflow-run.corrupt-record-skipped"),
-                }))
+                })))
         : undefined;
     const workflowNotifyJournal = config.selfOrchestrationEnabled && config.workflowRunStoreBackend !== "memory"
         ? (sqlWorkflowRunStore ? backend.notifyJournal() : new FileWorkflowNotifyJournalStore(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
@@ -36,6 +38,20 @@ export function createWorkflowOrchestration(ctx) {
             ...(p.sourceTaskId ? { sourceTaskId: p.sourceTaskId } : {}),
         });
         metrics.inc("workflow_runs_total", { status: p.status });
+        if (workflowParkDecisions !== undefined) {
+            const handOver = getRunEndedHandoff();
+            try {
+                if (handOver === undefined)
+                    throw new Error(`workflow run ${p.runId}: the run-ended decision handoff is not bound yet (the HTTP server is not up) — leaving the completion pending for the next recovery sweep`);
+                await handOver(p.runId);
+            }
+            catch (err) {
+                if (workflowNotifyGate !== undefined)
+                    throw err;
+                metrics.inc("workflow_park_handoff_total", { result: "not_redelivered" });
+                logger.warn("workflow_park_handoff_not_redelivered", { runId: p.runId, err: seatText("operator-log-text", String(err)) });
+            }
+        }
         if (!workflowCompletionInbox)
             return;
         try {
@@ -61,9 +77,10 @@ export function createWorkflowOrchestration(ctx) {
                 ? backend.workflowAgentSessionIndex()
                 : new LocalWorkflowAgentSessionIndex(join(config.localDataRoot ?? localRoot, "workflows"), undefined))
         : undefined;
-    const workflowParkDecisions = config.selfOrchestrationEnabled && backend !== undefined && (sqlWorkflowRunStore !== undefined || backend.kind === "local") ? backend.workflowParkDecisions?.() : undefined;
+    const workflowParkDecisions = config.selfOrchestrationEnabled && backend !== undefined && baseWorkflowRunStore !== undefined && (sqlWorkflowRunStore !== undefined || backend.kind === "local") ? backend.workflowParkDecisions?.(baseWorkflowRunStore) : undefined;
+    const heldParksHere = workflowParkDecisions !== undefined ? new HeldParksHere() : undefined;
     const workflowRunStore = baseWorkflowRunStore
-        ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex)
+        ? new JournalingWorkflowRunStore(baseWorkflowRunStore, workflowNotifyGate, fleetBus, workflowAgentSessionIndex, heldParksHere)
         : undefined;
     const replicaLocalNotifyJournal = workflowNotifyJournal instanceof FileWorkflowNotifyJournalStore;
     const workflowRecoverOpts = {
@@ -78,7 +95,7 @@ export function createWorkflowOrchestration(ctx) {
     return {
         sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion,
         workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink,
-        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex, workflowParkDecisions,
+        workflowAgentRegistry, subagentSteerRegistry, workflowRecoverOpts, workflowAgentSessionIndex, workflowParkDecisions, heldParksHere,
     };
 }
 //# sourceMappingURL=workflow-orchestration.js.map

package/dist/bounded-rotation.d.ts

@@ -0,0 +1,29 @@
+/**
+ * **维护拍上有界轮转扫一组候选**的唯一实现(两个调用方:审批族悬挂 ask 的跨副本执行通知 `ToolApprovalCoordinator.pollSuspendedDecisions`、
+ * workflow 停驻卡持有进程的拉取腿 `orchestration/workflow-park-holder.ts`)。
+ *
+ * 判据(审批族 codex R3 / R5 的两条修,原样搬来):
+ *  · **帽**:每拍最多 `maxPerTick` 条;**预算**:每拍最多 `budgetMs` 墙钟,超了当场停(剩下的下拍接着扫)—— 串行点读在慢店上不许把「一拍的延迟」变成分钟级;
+ *  · **轮转**:起点是「上一拍扫到第几个」的下一位 —— 没有它,帽把同样的前 N 条锁成永久前缀,后面的永远轮不到;
+ *  · 游标是**整数偏移**,不是条目身份:上一拍最后碰的那条恰好消失时,按身份找位置会塌回队首(永久饥饿);偏移只回答「扫到第几个」,集合变了也只是近似。
+ * 多层(`tiers`):按层序扫,每层各一只游标;前一层吃满帽 / 预算,后一层这一拍轮不到。截断的那一拍由调用方响亮报(`truncated` / `backlog`)。
+ */
+/** 一层候选的轮转游标(调用方持有,跨拍存活)。 */
+export interface RotationCursor {
+    offset: number;
+}
+export interface RotationLimits {
+    readonly maxPerTick: number;
+    readonly budgetMs: number;
+}
+/** 一拍的读数:`visited` = 本拍真处理的条数;`backlog` = 还没轮到的(下界 0);`truncated` = 帽 / 预算截断位。 */
+export interface RotationTally {
+    readonly visited: number;
+    readonly backlog: number;
+    readonly truncated: boolean;
+}
+export declare function boundedRotation<T>(tiers: ReadonlyArray<{
+    readonly items: readonly T[];
+    readonly cursor: RotationCursor;
+}>, limits: RotationLimits, visit: (item: T) => Promise<void>, now?: () => number): Promise<RotationTally>;
+//# sourceMappingURL=bounded-rotation.d.ts.map

package/dist/bounded-rotation.js

@@ -0,0 +1,24 @@
+export async function boundedRotation(tiers, limits, visit, now = Date.now) {
+    const ordered = [];
+    tiers.forEach(({ items, cursor }, tier) => {
+        const start = items.length > 0 ? cursor.offset % items.length : 0;
+        for (const item of [...items.slice(start), ...items.slice(0, start)])
+            ordered.push({ item, tier, start });
+    });
+    const deadlineMs = now() + limits.budgetMs;
+    const visitedPerTier = tiers.map(() => 0);
+    let visited = 0;
+    let truncated = false;
+    for (const { item, tier, start } of ordered) {
+        if (visited >= limits.maxPerTick || now() >= deadlineMs) {
+            truncated = true;
+            break;
+        }
+        visited++;
+        tiers[tier].cursor.offset = start + ++visitedPerTier[tier];
+        await visit(item);
+    }
+    const total = tiers.reduce((n, t) => n + t.items.length, 0);
+    return { visited, backlog: Math.max(0, total - visited), truncated };
+}
+//# sourceMappingURL=bounded-rotation.js.map

package/dist/capability-facts.d.ts

@@ -21,11 +21,10 @@
 import type { FlatServiceDeps } from "./http/server.js";
 import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
-import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/store-backend.js";
+import type { ServiceBlobExchange, ServiceFileHistoryStore, StoreBackend } from "./plugins/store-backend.js";
 import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
-import { type HeadRead } from "./session-incarnation.js";
 import type { HistoryAnchorReaders } from "./history-anchor.js";
 import type { EngineHandoverDoor } from "./boot/engine-lease.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
@@ -43,7 +42,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly session_fork_face_absent: "the session store has no fork face";
     readonly session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / writeSessionRowCells)";
     readonly session_purge_absent: "no session purge coordinator is wired";
-    readonly session_policy_store_absent: "no session policy store is wired";
+    readonly session_kind_faces_absent: "the session store cannot record a session kind (it needs the birth receipt face that takes a kind, sessionKindOf, listSessions and listIdleOfKind) or no session purge coordinator is wired to age such sessions out";
     readonly store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)";
     readonly file_history_store_absent: "no file-history store is wired";
     readonly resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through, with the run store an unknown handle is checked against — both come from the store backend)";
@@ -120,29 +119,40 @@ type Store<K extends keyof Deps> = NonNullable<Deps[K]>;
 type WithMethods<T, K extends keyof T> = T & {
     [P in K]-?: NonNullable<T[P]>;
 };
+/**
+ * 见证里的 run 店 / 会话店 / 会话视图读**随调用方交来的 deps**(`D`):路由层交的是封住的视图(`route-ctx.ts` 的 `RouteDeps`:带属主的读口在型上调不了)⇒ 见证照样封着
+ * (方法在不在照判,见证交给属主存取器的口照读);装配层交完整的店 ⇒ 见证完整。事实不另开一扇读口(视图只在 `owner-access.ts` 的 `sealRouteDeps` 铸一次)。
+ */
+type Held<D, K extends keyof D> = NonNullable<D[K]>;
+/** 判过在场的方法(`K`)在见证上必有;封住的读口在场照样封着(`never`)。 */
+type Present<T, K extends PropertyKey> = T & {
+    [P in K]-?: NonNullable<P extends keyof T ? T[P] : never>;
+};
 /** 持久 run 账面在场 —— `/v1/runs/*` 族、trace / 用量统计、assistant 的 preempt / resume / plan-review、
  *  会话 detach、设备换绑都站在这一只事实上。 */
-export declare function durableRuns(d: Pick<Deps, "runStore">): Fact<"run_store_absent", {
-    runStore: Store<"runStore">;
+export declare function durableRuns<D extends Pick<Deps, "runStore">>(d: D): Fact<"run_store_absent", {
+    runStore: Held<D, "runStore">;
 }>;
-export declare function subagentSteer(d: Pick<Deps, "runStore" | "subagentSteerRegistry">): Fact<"run_store_absent" | "subagent_registry_absent", {
-    runStore: Store<"runStore">;
+export declare function subagentSteer<D extends Pick<Deps, "runStore" | "subagentSteerRegistry">>(d: D): Fact<"run_store_absent" | "subagent_registry_absent", {
+    runStore: Held<D, "runStore">;
     registry: Store<"subagentSteerRegistry">;
 }>;
-export declare function subagentOutput(d: Pick<Deps, "runStore" | "subagentTaskOutput">): Fact<"run_store_absent" | "subagent_output_face_absent", {
-    runStore: Store<"runStore">;
+export declare function subagentOutput<D extends Pick<Deps, "runStore" | "subagentTaskOutput">>(d: D): Fact<"run_store_absent" | "subagent_output_face_absent", {
+    runStore: Held<D, "runStore">;
     output: Store<"subagentTaskOutput">;
 }>;
-export declare function taskHandles(d: Pick<Deps, "runStore" | "taskHandleOutput" | "taskHandleStop">): Fact<"run_store_absent" | "task_handle_faces_absent", {
-    runStore: Store<"runStore">;
+export declare function taskHandles<D extends Pick<Deps, "runStore" | "taskHandleOutput" | "taskHandleStop">>(d: D): Fact<"run_store_absent" | "task_handle_faces_absent", {
+    runStore: Held<D, "runStore">;
     output: Store<"taskHandleOutput">;
     stop: Store<"taskHandleStop">;
 }>;
 /** 会话店按 id 读一行的唯一读口在场(core `headOf`:属主 / 住客 / 叶子一次读;「有没有」与 `session-incarnation.ts` 的 `headReadOf` 同判)。 */
-type HeadReadingSessionStore = WithMethods<OwnerAwareSessionStore, "headOf">;
+type SessionDeps = Pick<Deps, "sessionStorage">;
+type SessionWith<D extends SessionDeps, K extends PropertyKey> = Present<Held<D, "sessionStorage">, K>;
+type HeadReadingSessionStore<D extends SessionDeps> = SessionWith<D, "headOf">;
 /** 会话属主面在场(入站 owner 门的地基;缺它,带会话的门一律 fail-closed)。属主 = `headOf(id)?.owner`。 */
-export declare function sessionOwnership(d: Pick<Deps, "sessionStorage">): Fact<"session_head_face_absent", {
-    sessionStorage: HeadReadingSessionStore;
+export declare function sessionOwnership<D extends SessionDeps>(d: D): Fact<"session_head_face_absent", {
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /**
  * 执行放置读面在场:会话店带执行席(`executionPlacement`:一次行读 = 住客 + 执行放置格;SQL 两孪生与 local 恒带,引擎缺省的内存会话店没有)。
@@ -151,90 +161,96 @@ export declare function sessionOwnership(d: Pick<Deps, "sessionStorage">): Fact<
 export declare function executionPlacementRead(d: Pick<Deps, "sessionStorage">): Fact<"execution_placement_seat_absent", {
     seat: NonNullable<OwnerAwareSessionStore["executionPlacement"]>;
 }>;
-export declare function mcpReconnect(d: Pick<Deps, "runStore" | "sessionStorage">): Fact<"run_store_absent" | "session_head_face_absent", {
-    runStore: Store<"runStore">;
-    sessionStorage: HeadReadingSessionStore;
+export declare function mcpReconnect<D extends Pick<Deps, "runStore" | "sessionStorage">>(d: D): Fact<"run_store_absent" | "session_head_face_absent", {
+    runStore: Held<D, "runStore">;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /**
  * 在飞 run 的切档口(`POST /v1/runs/:id/permission-mode`)= 持久 run 账面 ∧ checkpoint 店(ctx 面)。后一格是承重的:切档要读这条 run 的
  * **存储体**(本任务 settings 的 kill-switch 由受理判官折,与提交口同一份事实),也要把准入的词写回存储体(run 模式词的唯一来源,续跑腿读它);
  * 没有 ctx 面的部署两件都做不了 ⇒ 不提供这一口(能力位 `permissionModeWrite` 同读本事实)。
  */
-export declare function permissionModeWrite(d: Pick<Deps, "runStore" | "checkpointStore">): Fact<"run_store_absent" | "checkpoint_store_absent", {
-    runStore: Store<"runStore">;
+export declare function permissionModeWrite<D extends Pick<Deps, "runStore" | "checkpointStore">>(d: D): Fact<"run_store_absent" | "checkpoint_store_absent", {
+    runStore: Held<D, "runStore">;
     checkpointStore: Store<"checkpointStore">;
 }>;
-export declare function sessionAuditView(d: Pick<Deps, "sessionAudit">): Fact<"session_audit_absent", {
-    sessionAudit: Store<"sessionAudit">;
+export declare function sessionAuditView<D extends Pick<Deps, "sessionAudit">>(d: D): Fact<"session_audit_absent", {
+    sessionAudit: Held<D, "sessionAudit">;
 }>;
 /** 会话 SSE(watch 注册表 ∧ 头读:属主门与叶子都是 `headOf` 的投影)。 */
-export declare function sessionEventStream(d: Pick<Deps, "sessionWatch" | "sessionStorage">): Fact<"session_watch_absent" | "session_head_face_absent", {
+export declare function sessionEventStream<D extends Pick<Deps, "sessionWatch" | "sessionStorage">>(d: D): Fact<"session_watch_absent" | "session_head_face_absent", {
     watch: Store<"sessionWatch">;
-    sessionStorage: HeadReadingSessionStore;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 type SessionLister = NonNullable<OwnerAwareSessionStore["listSessions"]>;
 /** 会话枚举面:会话店的 `listSessions` —— 唯一的会话 lister(run 店不列会话:只有 run 行、没有会话行的面答不了「有哪些会话」)。见证 = 已绑好宿主的那一只。 */
 export declare function sessionList(d: Pick<Deps, "sessionStorage">): Fact<"session_lister_absent", {
     lister: SessionLister;
 }>;
-export declare function sessionFork(d: Pick<Deps, "sessionStorage">): Fact<"session_fork_face_absent" | "session_head_face_absent", {
-    sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "fork">;
+/**
+ * 会话种类在场(律 `session-kind.ts`):会话店交「带种类的出生回执」(`registerWithReceipt` 的第三参;授权口登记新行的那一笔)∧ 按 id 的种类读 `sessionKindOf`(既有会话上的比对)
+ * ∧ 列表面 `listSessions`(视图谓词在店里)∧ 老化候选面 `listIdleOfKind` ∧ 删除协调器(老化删走它)。读者三只、同读这一只:能力位 `capabilities.sessionKinds`、
+ * 受理门的 `request.precondition_unmet`、授权口的种类判。三只持久店恒在;内存店不在。
+ */
+export declare function sessionKinds(d: Pick<Deps, "sessionStorage" | "purgeSession">): Fact<"session_kind_faces_absent">;
+export declare function sessionFork<D extends SessionDeps>(d: D): Fact<"session_fork_face_absent" | "session_head_face_absent", {
+    sessionStorage: SessionWith<D, "headOf" | "fork">;
 }>;
 /** 会话行可写位(`PATCH /v1/sessions/:id`):会话店的头读(属主 + 化身一次读 —— 门判属主,那一读就是写原语的行期望)∧ 行格写原语(锁内判、提交后另读应答行)。
  *  三只 durable 店(SQL 双生 / local)都带;内存 dev 店没有行写口 ⇒ 501。
  *  本面**没有**独立能力位(契约附录 B.2c 登记):老 worker 对这一动词答 405,本事实为假的部署答 501;条件写也没有 —— 列表行上有 `rowTag` 即支持。 */
-export declare function sessionPatch(d: Pick<Deps, "sessionStorage">): Fact<"session_row_faces_absent", {
-    sessionStorage: WithMethods<OwnerAwareSessionStore, "headOf" | "writeSessionRowCells">;
+export declare function sessionPatch<D extends SessionDeps>(d: D): Fact<"session_row_faces_absent", {
+    sessionStorage: SessionWith<D, "headOf" | "writeSessionRowCells">;
 }>;
-/** 删除门读的会话店视图:按 id 读 = 删除门那一只头读,行格的 placement 问询 = 店自己的那一只。门照旧由属主存取器读头(`admitSessionById`),读的就是这一只。 */
-type DeletionGateStore = Pick<OwnerAwareSessionStore, "placementOf"> & {
-    readonly headOf: HeadRead;
-};
 /**
- * 会话删除面(purge 协调器 ∧ 删除门的头读)。见证 = 协调器 + 删除门的店视图 {@link DeletionGateStore}:按 id 读是 `deletionHeadReadOf`(local 店删到一半的行也答得出属主,
- * 开始删它的那位重发收得完;别的店 = `headOf`)—— 与协调器围栏读同一只。
+ * 会话删除面(purge 协调器 ∧ 会话店的头读)。见证 = 协调器 + 判过头读在场的会话店;删除门读哪一只头(删到一半的行也答得出属主的那一只,与协调器围栏读同一只)
+ * 只由属主存取器的删除口判(`owner-access.ts` 的 `admitSessionForDeletion`)。
  */
-export declare function sessionDelete(d: Pick<Deps, "purgeSession" | "sessionStorage">): Fact<"session_purge_absent" | "session_head_face_absent", {
+export declare function sessionDelete<D extends Pick<Deps, "purgeSession" | "sessionStorage">>(d: D): Fact<"session_purge_absent" | "session_head_face_absent", {
     purge: Store<"purgeSession">;
-    gateStore: DeletionGateStore;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
-export declare function sessionPolicy(d: Pick<Deps, "sessionPolicyStore" | "sessionStorage">): Fact<"session_policy_store_absent" | "session_head_face_absent", {
-    policyStore: Store<"sessionPolicyStore">;
-    sessionStorage: HeadReadingSessionStore;
+/** 会话规则面(`GET` / `PUT /v1/sessions/:id/policy`):后端 ∧ 会话头读。见证交后端:`GET` 读 `backend.sessionPolicy()`(恒同一只 —— 引擎的规则席读同一只),
+ *  `PUT` 写经同一只后端的落定席位 `landedAttendants()`(段首锁会话根行判门读的那一位住客,门后会话被删 / 同 id 重建 ⇒ 零写)写进的就是那一只。读与写同出一只后端,没有第二个店源。 */
+export declare function sessionPolicy<D extends Pick<Deps, "sessionStorage" | "backend">>(d: D): Fact<"session_head_face_absent" | "store_backend_absent", {
+    sessionStorage: HeadReadingSessionStore<D>;
+    backend: StoreBackend;
 }>;
-type SyncSessionStore = WithMethods<OwnerAwareSessionStore, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "writeSessionRowCells">;
-type SessionSyncWhy = "store_backend_absent" | "file_history_store_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
-/** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端 ∧ 文件历史店 ∧ 导出两面 ∧ staged 导入面 ∧
+type SyncSessionStore<D extends SessionDeps> = SessionWith<D, "exportEntries" | "exportEntriesStream" | "beginImportStaging" | "headOf" | "sessionSummaryOf" | "writeSessionRowCells">;
+type SessionSyncWhy = "store_backend_absent" | "session_export_absent" | "session_import_staging_absent" | "session_row_faces_absent" | "policy_purge_absent";
+/** 会话对等同步的**对话半族**(manifest / entries / plan / import 两相):后端(文件历史店 / 规则店 / 锚店都是它恒交的那一只,落定席位写的同一只)∧ 导出两面 ∧ staged 导入面 ∧
  *  会话行三口(门读头 `headOf` —— 属主 + 化身一次读,属主判门、化身给 identical 短路腿;manifest 带 `title` / `pinned`;导入经行格写原语以 `replay` 写者
  *  按导入落定的那一位住客重放它们)∧ policy 店能清(overwrite-dst 的 commit 要擦目的端旧 policy 行)。
  *  文件历史的 blob 搬运是另一只事实。 */
-export declare function sessionSync(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy, {
-    backend: Store<"backend">;
-    sessionStorage: SyncSessionStore;
+export declare function sessionSync<D extends Pick<Deps, "backend" | "sessionStorage">>(d: D): Fact<SessionSyncWhy, {
+    backend: Held<D, "backend">;
+    sessionStorage: SyncSessionStore<D>;
     historyStore: ServiceFileHistoryStore;
 }>;
 /** 会话同步的**文件历史半族**:对话半族 ∧ 文件历史店带 blob 交换组(只有 SQL 两只店有)。「店能不能交换 blob」只在 `blobExchangeOf` 判一次(core 判官),
  *  blob 取值口 `blobGetterOf` 读的是同一只 —— 本事实为真 ⟺ 取值口通到 `blobExchange.get`;判过的组随事实交出,路由的 GET / PUT / 在场预检只读它。 */
-export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage" | "fileHistoryStore" | "sessionPolicyStore">): Fact<SessionSyncWhy | "blob_exchange_absent", {
+export declare function sessionSyncFileHistory(d: Pick<Deps, "backend" | "sessionStorage">): Fact<SessionSyncWhy | "blob_exchange_absent", {
     historyStore: ServiceFileHistoryStore;
     blobExchange: ServiceBlobExchange;
 }>;
 type RewindFilesWhy = "file_history_store_absent" | "session_head_face_absent" | "resume_anchor_store_absent" | "execution_lane_handless" | "workspace_rebuilt_per_task" | "session_store_shared";
 /**
  * run 外的「只恢复代码」口(`POST /v1/sessions/:id/rewind-files`,[ref])这台部署**解不解得出** —— 能力位 `sessionRewindFiles` 与该口的 501 读这一只。
- * 四格缺一不可,每格都是那一口真要用的设施:文件历史店(引擎 `Runner.rewindFiles` 读的同一只;旋钮 `FILE_HISTORY_CAPTURE` 只关捕获、不摘店,
- * 所以与它无关 —— 已存边界照常可回退)∧ 会话头读(属主门 + 坏档判据)∧ 锚店与 run 店(`to` 手柄经锚店翻成 entry id,未知手柄的 404 成因半句读 run 店,
- * `history-anchor.ts`;两只同出存储后端,所以是同一格)∧ 执行车道有手
+ * 四格缺一不可,每格都是那一口真要用的设施:文件历史店(后端恒交的那一只 —— 引擎 `Runner.rewindFiles` 读的同一只;没有后端 ⇒ 没有它;旋钮 `FILE_HISTORY_CAPTURE` 只关捕获、
+ * 不摘店,所以与它无关 —— 已存边界照常可回退)∧ 会话头读(属主门 + 坏档判据)∧ 锚店与 run 店(`to` 手柄经锚店翻成 entry id,未知手柄的 404 成因半句读 run 店,
+ * `history-anchor.ts`;锚店是后端恒交的那一只,run 店同出存储后端,所以是同一格)∧ 执行车道有手
  * (无手车道上引擎恒拒 `rewind.files_env_unsupported`:没有工作区可回退 —— 位说有而口恒拒不许发生)∧ 即时回退的工作区活过一次执行(部署形表行 `rewindableWorkspace`;
  * 否则恢复的结果到不了下一次执行)∧ 会话店由本进程独占(local 后端:数据根被一个活进程锁住 ⇒ 引擎的进程内会话锁就是全局互斥;
  * SQL 后端被多副本共用,而 run 外回退还没有一只跨副本的持久认领 —— 「先查认领再交引擎」只是检查不是互斥,所以在共享店上位为假、口 501,不留「检查即放行」)。
  * 动词本身是引擎 `Runner` 的必有成员(型上必在),不是一格。
  * 见证 = 判过在场的设施(历史店 · 手柄翻译的两只读店 · 会话店);路由在拒臂之后只读见证。
  */
-export declare function sessionRewindFiles(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "runStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy, {
+export declare function sessionRewindFiles<D extends Pick<Deps, "runStore" | "sessionStorage" | "config" | "backend">>(d: D): Fact<RewindFilesWhy, {
     historyStore: ServiceFileHistoryStore;
-    anchors: HistoryAnchorReaders;
-    sessionStorage: HeadReadingSessionStore;
+    anchors: HistoryAnchorReaders & {
+        readonly runs: Held<D, "runStore">;
+    };
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /**
  * 同一口的 `dryRun` **带不带改动统计** —— 能力位 `sessionRewindFilesPreview`。= 立即回退可用 ∧ 店实现了 core 契约的可选座 `diffStats`
@@ -242,7 +258,7 @@ export declare function sessionRewindFiles(d: Pick<Deps, "fileHistoryStore" | "r
  * `previewFileDelta` 不在 core 包根导出面上,本仓不另写一份 —— 等 core 导出它,SQL 店补这一座、本位随之转真,路由零改)。本位为假**不是**口不收 `dryRun`:口照收,答 `preview: null`
  * (「这台给不出统计」≠「什么都不会变」);所以本事实没有 501 拒点,只有能力位读它。
  */
-export declare function sessionRewindFilesPreview(d: Pick<Deps, "fileHistoryStore" | "resumeAnchorStore" | "runStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy | "file_history_preview_absent">;
+export declare function sessionRewindFilesPreview(d: Pick<Deps, "runStore" | "sessionStorage" | "config" | "backend">): Fact<RewindFilesWhy | "file_history_preview_absent">;
 /** 持久审批底座(checkpoint 店)在场 —— `/v1/approvals/*` 与 `/v1/assistant/*` 整条车道、会话 wake 都站在它上面。 */
 export declare function checkpointPark(d: Pick<Deps, "checkpointStore">): Fact<"checkpoint_store_absent", {
     checkpointStore: Store<"checkpointStore">;
@@ -263,6 +279,7 @@ type ActiveStreamApproval = Extract<ReturnType<typeof resolveStreamApprovalGate>
 /** 流内审批协议在场 —— 判据的属主仍是 `resolveStreamApprovalGate`(三条执行腿的装配也读它);本事实把它的拒因译进 why 闭集。 */
 export declare function streamApproval(d: Pick<Deps, "toolApproval" | "config" | "backend" | "checkpointStore">): Fact<StreamApprovalWhy, {
     askStore: ActiveStreamApproval["askStore"];
+    coordinator: Store<"toolApproval">;
 }>;
 /**
  * 读根授权(「Yes, and add directory」)这台部署**受理不受理** —— `GET /v1/capabilities` 的 `approvalReadRootGrant` 位,与
@@ -291,11 +308,11 @@ export declare function deviceLane(d: Pick<Deps, "deviceHub">): Fact<"device_hub
     hub: Store<"deviceHub">;
 }>;
 /** 设备管理三动词(列 / 读 / 换绑):hub ∧ 设备店 ∧ 入网 ∧ 持久 run 账面(换绑的「无在飞 run」门要它)。 */
-export declare function deviceManagement(d: Pick<Deps, "deviceHub" | "deviceStore" | "deviceEnrollment" | "runStore">): Fact<"device_hub_absent" | "device_store_absent" | "device_enrollment_absent" | "run_store_absent", {
+export declare function deviceManagement<D extends Pick<Deps, "deviceHub" | "deviceStore" | "deviceEnrollment" | "runStore">>(d: D): Fact<"device_hub_absent" | "device_store_absent" | "device_enrollment_absent" | "run_store_absent", {
     hub: Store<"deviceHub">;
     store: Store<"deviceStore">;
     enrollment: Store<"deviceEnrollment">;
-    runStore: Store<"runStore">;
+    runStore: Held<D, "runStore">;
 }>;
 export declare function fleetStream(d: Pick<Deps, "fleetBus">): Fact<"fleet_bus_absent", {
     fleetBus: Store<"fleetBus">;
@@ -344,10 +361,10 @@ export declare function memorySyncServe(d: Pick<Deps, "memorySync" | "config">):
  * 会话记忆同步触发口(`POST /v1/sessions/:id/memory/sync`):本机同步腿在场 ∧ 持久 run 账面(读集 = 会话最近一条已结腿的记忆观测;收割栅栏读会话的 run 认领)
  * ∧ 会话头读(属主门与 `sourceRevision` = 同一次头读的叶子)。
  */
-export declare function sessionMemorySync(d: Pick<Deps, "memorySyncLeg" | "runStore" | "sessionStorage">): Fact<"memory_sync_leg_absent" | "run_store_absent" | "session_head_face_absent", {
+export declare function sessionMemorySync<D extends Pick<Deps, "memorySyncLeg" | "runStore" | "sessionStorage">>(d: D): Fact<"memory_sync_leg_absent" | "run_store_absent" | "session_head_face_absent", {
     leg: Store<"memorySyncLeg">;
-    runStore: Store<"runStore">;
-    sessionStorage: HeadReadingSessionStore;
+    runStore: Held<D, "runStore">;
+    sessionStorage: HeadReadingSessionStore<D>;
 }>;
 /** 跨主体投递门在座(`POST /v1/principal-inbox/messages` 的可用性门与能力位 `principalInboxDelivery` 同读这一只)。门的装配本身是
  *  一道合取(收件箱消费方声明 ∧ 耐久 mailbox ∧ org 成员目录 ∧ 配额店,缺一拒启 —— `boot/stage-06-runners.ts`),
@@ -368,20 +385,21 @@ export declare function engineHandover(d: Pick<Deps, "drainState">): Fact<"engin
 export declare function operatorLane(d: {
     readonly config: Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
 }): Fact<"operator_principals_empty">;
-type AdoptionCapableBackend = Store<"backend"> & {
+/** 带收编日志的后端(见证随调用方的 deps:路由层的后端视图上店工厂照样封着)。 */
+type AdoptionCapableBackend<D extends Pick<Deps, "backend">> = Held<D, "backend"> & {
     adoptionLog(): ReturnType<NonNullable<Store<"backend">["adoptionLog"]>>;
 };
-export declare function adoption(d: Pick<Deps, "config" | "backend">): Fact<"operator_principals_empty" | "adoption_store_absent", {
-    backend: AdoptionCapableBackend;
+export declare function adoption<D extends Pick<Deps, "config" | "backend">>(d: D): Fact<"operator_principals_empty" | "adoption_store_absent", {
+    backend: AdoptionCapableBackend<D>;
 }>;
-type AdoptionImportSessionStore = WithMethods<OwnerAwareSessionStore, "beginImportStaging">;
+type AdoptionImportSessionStore<D extends SessionDeps> = SessionWith<D, "beginImportStaging">;
 /**
  * 收编批量导入(`POST /v1/adoption/:id/sessions`)与能力位 `adoptionImport` 的部署半:收编日志 ∧ 会话店的暂存导入面(派生 id 那一格占没占由提交的属主判答,不另要头读面)。
  * **不判运维名册**:这扇门不是 operator 面 —— 调用者是那条收编行的源主体本人(名单空了,已收编的行照样在)。
  */
-export declare function adoptionSessionImport(d: Pick<Deps, "backend" | "sessionStorage">): Fact<"adoption_store_absent" | "session_import_staging_absent", {
-    backend: AdoptionCapableBackend;
-    sessionStorage: AdoptionImportSessionStore;
+export declare function adoptionSessionImport<D extends Pick<Deps, "backend" | "sessionStorage">>(d: D): Fact<"adoption_store_absent" | "session_import_staging_absent", {
+    backend: AdoptionCapableBackend<D>;
+    sessionStorage: AdoptionImportSessionStore<D>;
 }>;
 export declare function memoryBundle(d: Pick<Deps, "config" | "memoryBundleExport" | "memoryBundleImport">): Fact<"operator_principals_empty" | "memory_bundle_faces_absent", {
     exportScopes: Store<"memoryBundleExport">;
@@ -417,9 +435,9 @@ export declare function ruleLaneForCaller(d: Pick<Deps, "ruleConsent">, principa
 export declare function mcpInjection(d: Pick<Deps, "config">): Fact<"caller_mcp_injection_refused">;
 /** server-as-peer:旋钮开 ∧ 持久 run 账面在场。两只 JSON-RPC 方法(`message/send` / `tasks/get`)都要 run 店 ——
  *  没有它,这个 peer 什么都做不了,对外就不该存在(卡与 RPC 一起 404)。 */
-export declare function a2aServe(d: Pick<Deps, "config" | "runStore">): Fact<"a2a_serve_off" | "run_store_absent", {
+export declare function a2aServe<D extends Pick<Deps, "config" | "runStore">>(d: D): Fact<"a2a_serve_off" | "run_store_absent", {
     serve: NonNullable<ServiceConfig["a2aServe"]>;
-    runStore: Store<"runStore">;
+    runStore: Held<D, "runStore">;
 }>;
 /** 引擎能不能自编排(core 单源 `workflowsCapability`,boot 算好经 `workflowsCapable` 递来;缺席回落行店代理)。 */
 export declare function selfOrchestrationEngine(d: Pick<Deps, "workflowsCapable" | "workflowRunStore">): Fact<"workflow_engine_absent">;