@sema-agent/server 7.150.0 → 7.151.0

package/dist/http/resume-legs.js

@@ -1,16 +1,18 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, resumeCascade, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
-import { decideParkedAgent, deliverToHoldingRun, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
+import { answerOfHolderFence, answerOfHolderRedeem, decideParkedAgent, deliverableEntryOf, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, holderFenceFaultAnswer, planWorkflowParkedDecide, redeemHere, runChannelEnded, workflowParkGuidance } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
-import { runFactsOf, sealRouteDeps, sessionFactsReadOf } from "./owner-access.js";
+import { heldParksOf, readRunParks } from "../orchestration/workflow-agent-session-index.js";
+import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
+import { runFactsOf, sealRouteDeps, sessionFactsReadOf, sessionOccupantReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 import { HttpError, checkpointPartsOf, decodeCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { keyAdmits } from "../owner-faces.js";
 import { personOf } from "../owner-brands.js";
 import { recoveredSubject } from "../owner-faces.js";
-import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
+import { beatRunHeartbeat, createRunAnchorWriter, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
 import { commitParkRow } from "../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "../terminal.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
@@ -60,7 +62,7 @@ import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflic
 import { refusalAfterLostClaim } from "./claim-heartbeat.js";
 import { CONTINUATION_CLAIM_FACE, ClaimFaultAnswer, commitExecutionContext, faultedAnswerOf, isRootSessionGoneError, resolveBeforeClaim, rootSessionAbsentAnswer, stampSpecRoot, withdrawClaim } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
-import { commitSessionInheritEnv } from "./session-inherit-env.js";
+import { commitLegBindings } from "../session-bindings.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
@@ -70,11 +72,18 @@ import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalW
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { restateResumeCtx } from "./resume-restatement.js";
+import { stampReplayEntryMode } from "../permission-mode-admission.js";
 import { httpErrorRefusal } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { createSubmissionSeat } from "../submission-exit.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 import { createSessionNotifyDoor } from "../session-notify-door.js";
+const HANDOFF_RETRY_CODES = new Set(["conflict.session_active_run", "not_found.parked_checkpoint", "conflict.claim_lost"]);
+function handoffResultOf(refusal, refusedWhy) {
+    const errorCode = "errorCode" in refusal.body ? refusal.body.errorCode : undefined;
+    const code = typeof errorCode === "string" ? errorCode : `status_${refusal.status}`;
+    return refusal.status >= 500 || HANDOFF_RETRY_CODES.has(code) ? { kind: "retry", why: code } : { kind: "refused", why: refusedWhy ?? code };
+}
 function compositionUnlinkedAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context does not match this card — the run is a cascade but the card records no ladder rung, so the ladder cannot be continued" }) };
 }
@@ -302,6 +311,13 @@ export function decidedActionOf(binding) {
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const ctxOpening = (sessionId) => ({ sessionId, opener: deps.checkpointCtxSealing });
+    const replayCtxOf = (stored, restatement) => {
+        const restated = restateResumeCtx(stored, restatement);
+        if (restated.unattendedLeg === true)
+            return restated;
+        const body = stampReplayEntryMode(restated.body, deps.config);
+        return body === restated.body ? restated : { ...restated, body };
+    };
     const resumeFleetScope = (req, auth) => req ? (gatedSubject(req, deps.config) ?? "default") : (auth.subject ?? "default");
     function createRememberIntent(sessionId, remember) {
         let pending;
@@ -569,73 +585,56 @@ export function createResumeLegs(ctx) {
                 if (!plan.ok)
                     return plan.deny;
                 const fingerprint = parkDecisionFingerprint(plan.outcome, restatement);
-                const live = await deliverToHoldingRun(origin, { token, outcome: plan.outcome, decision: parkedReq.decision, fingerprint, restated: restatement !== undefined });
-                if (live.kind === "answered")
-                    return live.answer;
                 const decisions = deps.workflowParkDecisions;
-                const runStore = deps.runStore;
-                if (decisions === undefined || runStore === undefined) {
+                if (decisions === undefined || deps.runStore === undefined) {
                     return { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) };
                 }
-                const liveReceiptOf = async (held) => {
-                    if (held === null || held.fingerprint !== fingerprint)
-                        return undefined;
-                    const run = await runFactsOf(runStore, held.deliveredTaskId);
-                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
-                };
-                const replay = await liveReceiptOf(await decisions.get(token));
-                if (replay !== undefined)
-                    return replay;
-                let recordFailure;
-                const answerOfRecordFailure = async (failed) => {
-                    if (failed.kind === "faulted")
-                        return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+                if (origin.run.status === "running") {
+                    let verdict;
                     try {
-                        return await refusalAfterLostClaim(deps, runStore, plan.hostSessionId, failed.deliveredTaskId);
+                        verdict = await decisions.recordForRunningHolder({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId: plan.runId, acceptedAtMs: Date.now() }, { restated: restatement !== undefined });
                     }
-                    catch (e) {
-                        return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+                    catch (err) {
+                        return faultedAnswerOf(err, () => holderFenceFaultAnswer(plan.runId));
                     }
-                };
-                const delivery = {
-                    carried: [{ runId: plan.runId, token, outcome: plan.outcome }],
-                    commitBeforeLaunch: async (deliveredTaskId) => {
-                        let recorded;
-                        try {
-                            recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
-                        }
-                        catch (err) {
-                            recordFailure = { kind: "faulted", err };
-                            throw err;
-                        }
-                        if (!recorded) {
-                            recordFailure = { kind: "not_recorded", deliveredTaskId };
-                            throw new Error(DELIVERY_NOT_RECORDED);
+                    switch (verdict) {
+                        case "not_running":
+                            break;
+                        case "not_held":
+                        case "restated":
+                        case "other_decision":
+                            return answerOfHolderFence(verdict, plan.runId);
+                        case "stands":
+                            return answerOfHolderRedeem(await redeemHere(plan.runId, origin.run.scope, { token, outcome: plan.outcome }), plan.runId, parkedReq.decision);
+                        default: {
+                            const unhandled = verdict;
+                            throw new Error(`unhandled workflow holder fence verdict: ${String(unhandled)}`);
                         }
-                    },
-                };
-                const hostToken = await cs
-                    .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
-                    .catch(() => undefined);
-                const admittedPayer = decodeCheckpointScope(cp.scope);
-                let out;
-                try {
-                    out = hostToken
-                        ? await resumeWake(plan.hostSessionId, plan.message, decider?.subject, req, acceptEarly, delivery, admittedPayer, restatement)
-                        : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
+                    }
                 }
-                catch (err) {
-                    const failed = recordFailure;
-                    if (failed === undefined)
-                        throw err;
-                    return await answerOfRecordFailure(failed);
+                const laned = await deliverViaResumeLane({
+                    hostSessionId: plan.hostSessionId,
+                    runId: plan.runId,
+                    runScope: origin.run.scope,
+                    token,
+                    outcome: plan.outcome,
+                    fingerprint,
+                    message: plan.message,
+                    ...(restatement !== undefined ? { restatement } : {}),
+                    initiator: { kind: "decide", req, caller: decider?.subject, ...(acceptEarly === true ? { acceptEarly: true } : {}), admittedPayer: decodeCheckpointScope(cp.scope) },
+                });
+                switch (laned.kind) {
+                    case "launched":
+                    case "replayed":
+                    case "refused":
+                        return laned.out;
+                    case "record_failed":
+                        return await answerOfRecordFailure(laned.failure, plan.hostSessionId);
+                    default: {
+                        const unhandled = laned;
+                        throw new Error(`unhandled resume lane delivery: ${JSON.stringify(unhandled)}`);
+                    }
                 }
-                const failed = recordFailure;
-                if (failed !== undefined)
-                    return await answerOfRecordFailure(failed);
-                if (acceptedTaskIdOf(out) === undefined)
-                    return (await liveReceiptOf(await decisions.get(token))) ?? out;
-                return out;
             }
         }
         const runCtx = await ctxPromise;
@@ -644,7 +643,7 @@ export function createResumeLegs(ctx) {
         if (runCtx === undefined || runCtx.ctx === null)
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const { runSessionId, ctx: storedCtx } = runCtx;
-        const ctx = restateResumeCtx(storedCtx, restatement);
+        const ctx = replayCtxOf(storedCtx, restatement);
         const auth = { sessionId: runSessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -691,6 +690,7 @@ export function createResumeLegs(ctx) {
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
             ...(ctx.projectContext !== undefined ? { projectContext: ctx.projectContext } : {}),
+            ...(ctx.memorySeed !== undefined ? { memorySeed: ctx.memorySeed } : {}),
             lease,
             execution,
         });
@@ -979,7 +979,7 @@ export function createResumeLegs(ctx) {
             ...heldDecisions,
             ...(workflowDecision !== undefined && taskId !== undefined ? { afterCheckpointResolve: () => workflowDecision.commitBeforeLaunch(taskId) } : {}),
         };
-        commitSessionInheritEnv(deps, sessionId, resumeCtx.ctx.body);
+        commitLegBindings(deps, undefined, sessionId, args.legFacts?.sessionBindings);
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
@@ -1036,7 +1036,7 @@ export function createResumeLegs(ctx) {
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
                         ...launchInternals,
-                        ...compositionLegRoot(args.legFacts?.registeredCwd),
+                        ...compositionLegRoot(args.legFacts?.sessionBindings.cwd),
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -1148,15 +1148,18 @@ export function createResumeLegs(ctx) {
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
                 cancelLedgerAppend = append;
                 await openEngineNoticePort(append);
-                const anchorOwner = subject ?? null;
                 const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && sessionFactsOf
-                    ? async (eventId) => { const leaf = (await sessionFactsOf(sessionId))?.leafId; if (leaf)
-                        await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
-                    : undefined;
-                const captureUserMessageAnchor = deps.resumeAnchorStore && taskId && freshRunClaimed
-                    ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-                    : undefined;
+                const anchors = createRunAnchorWriter({
+                    seat: deps.backend?.landedAttendants(),
+                    sessionId,
+                    owner: subject ?? null,
+                    promptKey: taskId && freshRunClaimed ? taskId : undefined,
+                    witness: args.legFacts?.sessionWitness,
+                    occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+                    leafOf: sessionFactsOf === undefined ? undefined : async (id) => (await sessionFactsOf(id))?.leafId,
+                });
+                const captureTurnAnchor = anchors.turn;
+                const captureUserMessageAnchor = anchors.prompt;
                 const anchor = new TurnAnchorCapture(captureTurnAnchor, "resume", captureUserMessageAnchor);
                 const flush = async () => {
                     if (reasoning) {
@@ -1623,7 +1626,7 @@ export function createResumeLegs(ctx) {
             return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const auth = { sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -1668,7 +1671,7 @@ export function createResumeLegs(ctx) {
                 }),
             };
         }
-        const ctx = restateResumeCtx(storedCtx, restatement);
+        const ctx = replayCtxOf(storedCtx, restatement);
         const windowDenial = await usageWindowDenialFor(subject === undefined ? undefined : personOf(recoveredSubject(subject)));
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
@@ -1757,7 +1760,7 @@ export function createResumeLegs(ctx) {
             return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const auth = { sessionId: cp.sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -1784,7 +1787,7 @@ export function createResumeLegs(ctx) {
                 ...(workflowDecision !== undefined ? { workflowDecision } : {}),
                 ...(engineNotices.length > 0 ? { engineNotices } : {}),
                 ...(acceptEarly === true ? { acceptEarly: true } : {}),
-                ...(req !== undefined ? { callerInitiated: true } : {}),
+                ...(req !== undefined || workflowDecision !== undefined ? { callerInitiated: true } : {}),
                 ...(ownerLeaseAdmittedFor !== undefined && auth.subject === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
             });
         }
@@ -1792,6 +1795,183 @@ export function createResumeLegs(ctx) {
             resolved.peerLease.release();
         }
     }
+    async function answerOfRecordFailure(failed, hostSessionId) {
+        if (failed.kind === "faulted")
+            return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+        const runStore = deps.runStore;
+        if (runStore === undefined)
+            throw new Error("workflow park decide: a decision row failed to land without a run store — the claim fence it was written under is the run store");
+        try {
+            return await refusalAfterLostClaim(deps, runStore, hostSessionId, failed.deliveredTaskId);
+        }
+        catch (e) {
+            return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+        }
+    }
+    async function deliverViaResumeLane(d) {
+        const decisions = deps.workflowParkDecisions;
+        const runStore = deps.runStore;
+        const cs = deps.checkpointStore;
+        if (decisions === undefined || runStore === undefined || cs === undefined) {
+            return { kind: "refused", out: { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) } };
+        }
+        const liveReceiptOf = async (held) => {
+            if (held === null || held.fingerprint !== d.fingerprint)
+                return undefined;
+            const run = await runFactsOf(runStore, held.deliveredTaskId);
+            return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
+        };
+        const replay = await liveReceiptOf(await decisions.get(d.token));
+        if (replay !== undefined)
+            return { kind: "replayed", out: replay };
+        await runChannelEnded(d.runId, d.runScope);
+        const condition = d.initiator.kind === "run_ended" ? { expect: d.fingerprint } : undefined;
+        let recordFailure;
+        const delivery = {
+            carried: [{ runId: d.runId, token: d.token, outcome: d.outcome }],
+            commitBeforeLaunch: async (deliveredTaskId) => {
+                let recorded;
+                try {
+                    recorded = await decisions.record({ token: d.token, runId: d.runId, hostSessionId: d.hostSessionId, outcome: d.outcome, fingerprint: d.fingerprint, deliveredTaskId, acceptedAtMs: Date.now() }, condition);
+                }
+                catch (err) {
+                    recordFailure = { kind: "faulted", err };
+                    throw err;
+                }
+                if (!recorded) {
+                    recordFailure = { kind: "not_recorded", deliveredTaskId };
+                    throw new Error(DELIVERY_NOT_RECORDED);
+                }
+            },
+        };
+        const hostToken = await cs.findPendingTokenBySession(d.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" }).catch(() => undefined);
+        const req = d.initiator.kind === "decide" ? d.initiator.req : undefined;
+        const acceptEarly = d.initiator.kind === "decide" ? d.initiator.acceptEarly : undefined;
+        let out;
+        try {
+            out = hostToken
+                ? await resumeWake(d.hostSessionId, d.message, d.initiator.caller, req, acceptEarly, delivery, d.initiator.admittedPayer, d.restatement)
+                : await startFreshHostTurn(d.hostSessionId, d.message.text, d.initiator.admittedPayer, req, delivery, d.runId, d.restatement);
+        }
+        catch (err) {
+            const failed = recordFailure;
+            if (failed === undefined)
+                throw err;
+            return { kind: "record_failed", failure: failed };
+        }
+        const failed = recordFailure;
+        if (failed !== undefined)
+            return { kind: "record_failed", failure: failed };
+        if (acceptedTaskIdOf(out) === undefined) {
+            const raced = await liveReceiptOf(await decisions.get(d.token));
+            return raced !== undefined ? { kind: "replayed", out: raced } : { kind: "refused", out };
+        }
+        return { kind: "launched", out };
+    }
+    async function handOverRunEndedDecisions(runId) {
+        if (isAdoptionQuiescing())
+            throw new Error(`workflow run ${runId}: an adoption arc is running in this process — the decision handoff yields and is retried on the next recovery sweep`);
+        const handing = handOverHeldRows(runId);
+        trackMaintenanceLeg(handing);
+        await handing;
+    }
+    async function handOverHeldRows(runId) {
+        const decisions = deps.workflowParkDecisions;
+        const records = deps.workflowRunStore;
+        const cs = deps.checkpointStore;
+        const index = deps.workflowAgentSessionIndex;
+        if (decisions === undefined || records === undefined || cs === undefined || index === undefined)
+            return;
+        const run = await records.get(runId);
+        if (run === null)
+            return;
+        const parks = readRunParks(run);
+        if (parks === undefined) {
+            deps.logger?.warn?.("workflow_park_handoff_refused", { runId, why: "parks_unreadable" });
+            return;
+        }
+        const held = heldParksOf(runId, parks);
+        if (run.status === "running") {
+            for (const park of held) {
+                if ((await decisions.get(park.token)) !== null) {
+                    throw new Error(`workflow run ${runId}: its completion arrived while its record still reads running (the terminal record write did not land) and it holds an accepted decision — leaving the completion pending until recovery ends the record`);
+                }
+            }
+            return;
+        }
+        for (const park of held) {
+            const row = await decisions.get(park.token);
+            if (row === null)
+                continue;
+            const deliverable = await deliverableEntryOf({ checkpointStore: cs, workflowAgentSessionIndex: index, workflowRunStore: records }, row);
+            if (deliverable.kind === "unreadable")
+                throw new Error(`workflow run ${runId}: the card or the holder of a recorded decision could not be read — leaving the completion pending for the next recovery sweep`);
+            if (deliverable.kind === "not_deliverable" || deliverable.entry.runId !== runId)
+                continue;
+            const result = await handOverOne(runId, run.scope, deliverable, row);
+            deps.metrics?.inc("workflow_park_handoff_total", { result: result.kind });
+            switch (result.kind) {
+                case "delivered":
+                    continue;
+                case "retry":
+                    throw new Error(`workflow run ${runId}: the decision handoff must be retried (${result.why}) — leaving the completion pending for the next recovery sweep`);
+                case "refused":
+                    deps.logger?.warn?.("workflow_park_handoff_refused", { runId, why: result.why });
+                    continue;
+                default: {
+                    const unhandled = result;
+                    throw new Error(`unhandled workflow park handoff result: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        }
+    }
+    async function handOverOne(runId, runScope, parkEntry, row) {
+        const cs = deps.checkpointStore;
+        const hostSessionId = parkEntry.origin.run.originatingSessionId;
+        if (hostSessionId === undefined || hostSessionId === "")
+            return { kind: "refused", why: "host_unknown" };
+        const ownerScope = parkEntry.card.scope;
+        const hostToken = await cs.findPendingTokenBySession(hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" });
+        if (hostToken) {
+            const hostCard = await cs.get(hostToken);
+            if (hostCard !== null && hostCard.scope !== ownerScope)
+                return { kind: "refused", why: "owner_mismatch" };
+        }
+        const parts = checkpointPartsOf(ownerScope);
+        const quota = ownerCostQuotaDenied(parts?.person);
+        if (quota !== undefined)
+            return handoffResultOf(quota, "payer_cost_quota");
+        const lease = await ownerFleetLeaseDenied(parts?.person);
+        if (lease !== undefined)
+            return handoffResultOf(lease, "payer_fleet_lease");
+        const laned = await deliverViaResumeLane({
+            hostSessionId,
+            runId,
+            runScope,
+            token: row.token,
+            outcome: row.outcome,
+            fingerprint: row.fingerprint,
+            message: workflowParkGuidance(runId, parkEntry.origin.park.callKey, row.outcome.decision === "allow" ? "approve" : "deny"),
+            initiator: { kind: "run_ended", caller: parts?.subject, admittedPayer: decodeCheckpointScope(ownerScope) },
+        });
+        switch (laned.kind) {
+            case "launched":
+            case "replayed":
+                return { kind: "delivered" };
+            case "refused":
+                return handoffResultOf(laned.out);
+            case "record_failed": {
+                if (laned.failure.kind === "faulted")
+                    return { kind: "retry", why: "store_fault" };
+                const now = await deps.workflowParkDecisions.get(row.token);
+                return now?.fingerprint === row.fingerprint ? { kind: "retry", why: "claim_lost" } : { kind: "refused", why: "superseded" };
+            }
+            default: {
+                const unhandled = laned;
+                throw new Error(`unhandled resume lane delivery: ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
     async function preparePlanReview(sessionId, log, decider, sighting, restatement) {
         const cs = deps.checkpointStore;
         const refuse = (answer) => ({ ok: false, answer });
@@ -1865,7 +2045,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxUnreadableAnswer());
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) });
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
@@ -1920,6 +2100,6 @@ export function createResumeLegs(ctx) {
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview, sessionNotify: sessionNotifyDoor },
     };
-    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor };
+    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor, handOverRunEndedDecisions };
 }
 //# sourceMappingURL=resume-legs.js.map

package/dist/http/route-ctx.d.ts

@@ -227,6 +227,16 @@ export interface CheckpointCtx {
      * 缺席 = 没继承(含 7.150.0 之前写下的行:不回填,续跑不继承 = 那时的行为)。
      */
     projectContext?: import("../project-context.js").ProjectContext;
+    /**
+     * 这条 run 的**登记簿默认读层种子**(`project-registry.ts` 的 {@link import("../project-registry.js").MemorySeed}:种子项目 + 判出它的那一位观者)—— 新提交腿判一次:
+     * 这次提交带的项目对提交者可见(与 `GET /v1/projects/:id` 同一只判,观者 = 读面同一只推导)⇒ 种子;带了而判不出 ⇒ `null`(判过,无);没带项目 ⇒ 缺席。**服务端写、不来自请求体**(与 {@link memoryScope} 同为
+     * `body` 的兄弟键:提交腿推导、落盘,续跑原样读回)。冻结的是**观者**不是词:续跑以这一位观者经同一只可见性判重读此刻的登记(停驻期间改了词 ⇒ 新词;删了 / 换了主人 /
+     * 不再对他可见 ⇒ 没有种子)。写点:`buildCheckpointCtx`(提交腿那一笔,经 `persistSubmissionCtx` 读这条腿的部署事实);leader worker 的写者不带(它的体不带项目)。
+     * 续跑腿的写回传原 ctx / 其展开 ⇒ 随行。读者只有一只:`resume-legs.ts` `resolveResumeSpec` 把它原样递给装配器(`opts.memorySeed`)—— 续跑腿不推观者、不按 `body.projectId` 现查。
+     * 缺席而存体带了项目 = 本格出现之前写下的行(不回填:那时的提交腿没有判过可见性)⇒ 续跑不取种子,装配器记运维一行 `resume_memory_seed_unjudged`。
+     * 形只有一种读法(`frozenMemorySeedOf`,读口 `resume-ctx-read.ts`)。
+     */
+    memorySeed?: import("../project-registry.js").MemorySeed | null;
 }
 /**
  * `/decide` 第三条车道交给宿主投递腿(wake:`DriveResumeArgs` / fresh:`DurableRunLegArgs`)的**一件**:这一跑在内存里带着的决定,
@@ -378,7 +388,8 @@ export interface DriveResumeArgs {
     /**
      * 🔴 **[ref](codex 交叉复审 r2-[medium] 验真后修):这条腿是**调用方发起**的吗?**
      *
-     * `true` = 有人在 HTTP 上点了按钮(resume / plan_review / wake / decide / 赎回席)⇒ 吃按**付费方**
+     * `true` = 有人在 HTTP 上点了按钮(resume / plan_review / wake / decide / 赎回席),或这一跑交付的是一条**已受理的人的决定**
+     * (workflow 停驻卡的 run 收场送达把它交给宿主会话的下一跑 —— 没有请求,但花的是卡属主的钱)⇒ 吃按**付费方**
      * (卡属主)判的成本配额准入(`ownerCostQuotaDenied`)。缺席/`false` = **部署自己的结算腿**
      * (内部 D-D SLA deny-sweep)⇒ **不吃**那道门。
      *
@@ -392,9 +403,8 @@ export interface DriveResumeArgs {
      * 并且整段时间攥着会话 claim。**方向也自洽**:deny 是**停下**这条 run 的动作,为了省钱而拒绝执行「停」
      * 与 preempt 路由早就成文的那句同一条(「否则超顶租户连自己的花费都停不下来」)。
      *
-     * 判别子取 `req` 的在场与否 —— 这在 `resumeCheckpoint` 里**已经是**「系统腿 vs 调用方腿」的既有判据
-     * (绑定强制、parked 分流两处都写着 `req !== undefined` 与「内部 D-D SLA deny-sweep(req 缺席)豁免」),
-     * 本位只是把同一条判据显式化成一个有名字的位,而不是让下游去猜。
+     * 判别子**不再**只是 `req` 的在场与否:`req` 缺席的腿有两种 —— SLA 拒扫(结算,不吃门)与 workflow 停驻卡的 run 收场送达(交付一条人的决定,
+     * 吃门,fail-closed)。所以本位是一个**有名字的事实**,由起腿的那一处写明(wake 腿:`req` 在场 ∨ 这一跑带着一件决定投递),下游只读这一位、不去猜 `req`。
      * ⚠️ **射程覆盖两道门**:紧邻的 fleet-lease 准入(`ownerFleetLeaseDenied`)读**同一位** —— [ref] 件⑤②
      * (codex r3-[high])把它一并改吃了 `callerInitiated`,理由与三问逐字同 cost 半场。
      * 🔴 本句是 [ref] R4 改写的(2026-09-03,7.57.0 发车前合并重扫 wf_1abaaa9a):此处原文写着「紧邻的
@@ -417,7 +427,7 @@ export interface DriveResumeArgs {
      *
      * 所以由上游把「已受理」这个事实传下来,`driveResumeLeg` 据此跳过重复协商。**安全性**:两处的键是
      * **同一个表达式**(`decodeCheckpointScope(cp.scope)`,上游门与下游 `auth.principal` 同源),射程条件也
-     * 同一条(`req !== undefined` ⇔ `callerInitiated`)⇒ 跳过的是一次**逐字相同**的判定,不是一道门。
+     * 同一条(上游判过两门 ⇔ 下游 `callerInitiated`:`/decide` 与 workflow 停驻卡的 run 收场送达都在交下来之前按卡属主判过)⇒ 跳过的是一次**逐字相同**的判定,不是一道门。
      * 缺席/`false` ⇒ 照常自己判(其余三条驱动腿与 sweep 一字不变)。
      */
     ownerLeaseAdmitted?: boolean;
@@ -675,15 +685,15 @@ export interface RouteDeclFacts {
      *  编排器片 2 件 2:值 = 这一种计费请求的**种类**(`submit` 新工作 / `hitl-answer` 对等人的卡作答 / `resume` 续跑;闭集属主
      *  `http/readiness.ts` 的 `BILLABLE_KINDS`)—— 排空与租约过期只拒 `submit`(放行闭集表 `ADMISSION_TABLE`),无凭证门不看种类。 */
     readonly billable?: import("./readiness.js").BillableKind;
-    /** 「本条 url 在**没有任何 service credential** 的部署形下,这几个方法必须 fail-closed」。
+    /** 「本条 url 上这几个方法在**请求没带凭据门认的凭据**(service 凭据 / 鉴权桥验过的登录令牌;`identity-source.ts` 头注律 5)时必须 fail-closed」。
      *  判据(两个合取项)= 「授权的唯一输入是 principal 头」∧「持久改写,或爆炸半径跨租户的治理读」;
      *  逐口论证在各 `routes/*.ts` 的头注里,声明行只记结论。 */
     readonly credentialGated?: readonly RouteMethod[];
     /** 「这条 url **是**计费提交面,但它到底提不提交由**请求体里的方法**决定」—— 单 URL 多方法的
      *  JSON-RPC 端点。两道**可用性** 503(drain / roster-pending)按 url 一刀切会把同端点上的纯读一起
      *  关掉,所以分派器对本行**跳过**那两道,改由域模块在写分支里施加同样的两道(文案逐字同源)。
-     *  🔴 只豁免那两道,**不豁免安全轴**:`billable` 本身仍为 true,无 service token 那道 fail-closed
-     *  503 照旧罩着(它判的是「这台机能不能收写」,与方法无关,且必须在解析请求体之前)。 */
+     *  🔴 只豁免那两道,**不豁免安全轴**:`billable` 本身仍为 true,写门那道 fail-closed
+     *  503 照旧罩着(它判的是「这次请求带没带过门的凭据」,与方法无关,且必须在解析请求体之前)。 */
     readonly methodDispatched?: true;
 }
 /** **可分派行**多出来的列([ref] 第三刀):身份 + 它真认的方法(+ [ref] 的订阅类)。纯门行一列都没有(见下)。 */

package/dist/http/route-table.d.ts

@@ -136,7 +136,7 @@ export declare function routeLabel(_method: string, url: string): string;
 export declare function isBillableSubmitPath(url: string): boolean;
 /** 编排器片 2 件 2:这条 url 是哪一**种**计费请求(`undefined` = 不在计费面)。声明序第一条命中的行定种类(今天每条 url 至多命中一行)。 */
 export declare function billableKindOf(url: string): BillableKind | undefined;
-/** [ref]([ref] 件5)—— **改写门**:不烧模型、但在没有任何 service credential 的部署形下必须
+/** [ref]([ref] 件5)—— **改写门**:不烧模型、但在请求没带凭据门认的凭据时(`identity-source.ts` 头注律 5)必须
  *  与 billable / bake 两族一样 fail-closed 的写门。与 `isBillableSubmitPath` **刻意分开**:这几扇门
  *  `billable=false`(零模型工作),塞进那张名单会让它们连带吃 drain 与 roster-pending 两道 503 ——
  *  而收编与规则读写在排空期/roster 未落时做完全无害。 */

package/dist/http/routes/admin-memory-optout.d.ts

@@ -26,7 +26,7 @@
  * 的调用方不该从「这台有没有授权表」上读出部署形态。
  * 🔴 四口都在 `isCredentialGatedRewrite`(server.ts)门内(codex R1-[high] 验真后补):授权的**唯一**输入是
  * principal 头 ∧ 一次调用的爆炸半径跨租户(改缺省行 = 改整台部署每个 principal 的 verdict;读面 = 全部授权行 +
- * operator 手写的 note)—— 无 service 凭证且未开 `ALLOW_UNAUTHED_WRITES` 的 worker 上那个头**可自造**,与
+ * operator 手写的 note)—— 请求没带凭据门认的凭据(且部署未开 `ALLOW_UNAUTHED_WRITES`)时那个头**可自造**,与
  * `/v1/memory/erase` / `POST /v1/memory/export` 同一条论证。
  *
  * ── 为什么缺席形是 **501 `capability.*`** 而不是 404(与 consolidation 阀门刻意分家)──────────────────

package/dist/http/routes/agents-roster.js

@@ -2,8 +2,7 @@ import { chosenAgentName } from "@sema-agent/core";
 import { sendJson, sendError } from "../send.js";
 import { gatedSubject, sendUnauthorized } from "../principal-gate.js";
 import { PRINCIPAL_MAX_BYTES } from "../../principal-shape.js";
-import { partsOf } from "../../owner-brands.js";
-import { taskSpecIdentityOf } from "../../engine-identity.js";
+import { engineScopeOf } from "../../engine-identity.js";
 import { routeListFilter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -99,7 +98,7 @@ export async function handleAgentRoster(req, res, match, ctx) {
             }
             const status = statusRaw === null ? undefined : statusRaw;
             const subject = gatedSubject(req, deps.config);
-            const ownScope = taskSpecIdentityOf(subject === undefined ? undefined : partsOf(subject)).principal ?? "default";
+            const ownScope = engineScopeOf(subject);
             let scope;
             if (gateOwner !== null) {
                 scope = ownScope;

package/dist/http/routes/approvals-assistant.js

@@ -38,7 +38,8 @@ import { fieldConflictFacts } from "../../field-conflict.js";
 import { buildSettlementEvidence } from "../../gate-settlement.js";
 import { seatText } from "../../trace/exit-seat.js";
 import { approvalQueueKindOfDoorId } from "../../approval-queue-kind.js";
-import { defaultPeerInboundFace, parsePeerInboundId, peerBoxScope } from "../../peer-inbound-face.js";
+import { defaultPeerInboundFace, parsePeerInboundId } from "../../peer-inbound-face.js";
+import { engineScopeOfOwner } from "../../engine-identity.js";
 import { RESUME_RESTATABLE_KEYS, readResumeRestatement } from "../resume-restatement.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decidedBy", "decidedVia", "decision", "feedback", "reason", "remember", "updatedInput",
@@ -949,7 +950,7 @@ async function decidePeerInbound(req, res, id, env) {
         decider = proof.principal;
     }
     const coord = parsePeerInboundId(id);
-    const outcome = coord === undefined ? { kind: "not_found" } : await env.face.decide(peerBoxScope(decider), coord, decision);
+    const outcome = coord === undefined ? { kind: "not_found" } : await env.face.decide(engineScopeOfOwner(decider), coord, decision);
     switch (outcome.kind) {
         case "not_found":
             sendError(res, 404, "not_found.approval", "approval not found");
@@ -1016,7 +1017,7 @@ function redactPendingDisclosures(row) {
 function peerInboundRowsFor(face, principal, operatorOwnerParam) {
     if (operatorOwnerParam !== undefined && operatorOwnerParam !== principal)
         return () => [];
-    const scope = peerBoxScope(principal);
+    const scope = engineScopeOfOwner(principal);
     return () => face.list(scope);
 }
 function projectPendingForWire(row, deployment, agent) {