@sema-agent/server 7.150.0 → 7.151.0

package/dist/http/routes/tasks.js

@@ -1,7 +1,7 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
 import { heldFor } from "../../peer-seat.js";
-import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, settleResumeAnchor, TurnAnchorCapture, HEARTBEAT_MS } from "../../runs.js";
+import { beatRunHeartbeat, createRunAnchorWriter, graftParkToolCallId, heldParkOf, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, settleResumeAnchor, TurnAnchorCapture, HEARTBEAT_MS } from "../../runs.js";
 import { commitParkRow } from "../../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, sealResultForExit, outwardPlane } from "../../terminal.js";
 import { voidVerifierPauseCard } from "../../verifier-pause-card.js";
@@ -22,7 +22,7 @@ import { contextUsageEventData, turnEndEventData, toolStartEventData, toolEndEve
 import { cascadeConfig, fillRunPreviewOnDelivery, runMeta } from "../run-meta.js";
 import { idemCallerOf, inflightKeyOf, submissionIdemOf } from "../idempotency.js";
 import { answerReplay, isReplayedOutcome, replayedOutcome, replayOfExistingRun } from "../submit-replay.js";
-import { readReplayHit, runFactsOf } from "../owner-access.js";
+import { readReplayHit, runFactsOf, sessionOccupantReadOf } from "../owner-access.js";
 import { httpErrorCode, sendJson, sseHeaders } from "../send.js";
 import { collectSsePreamble } from "../sse-log.js";
 import { buildApprovalPreamble } from "../../approval-card.js";
@@ -33,7 +33,7 @@ import { SUBMISSION_CLAIM_FACE, commitExecutionContext, faultedAnswerOf } from "
 import { rootSessionAbsentAnswer } from "../execution-context.js";
 import { recheckClaimBeforeLaunch, startClaimHeartbeat } from "../claim-heartbeat.js";
 import { timeClaim } from "../claim-latency.js";
-import { commitSessionInheritEnv } from "../session-inherit-env.js";
+import { commitLegBindings } from "../../session-bindings.js";
 import { headerStr, gatedPerson, gatedSubject, explicitOperatorOk, runIdentityOf } from "../principal-gate.js";
 import { recoveredSubject } from "../../owner-faces.js";
 import { recordFailOpen } from "../../observability/fail-open.js";
@@ -295,13 +295,20 @@ export async function handleTasks(req, res, match, ctx) {
                     const promptCommit = createPromptCommitReader();
                     let anchorPut = false;
                     const putRewindAnchor = async () => {
-                        const store = deps.resumeAnchorStore;
-                        const key = durableTaskId;
                         const entryId = userMsgEntryId;
-                        if (anchorPut || !entryId || !key || !store)
+                        const write = createRunAnchorWriter({
+                            seat: deps.backend?.landedAttendants(),
+                            sessionId: prepared.spec.sessionId,
+                            owner: principal ?? null,
+                            promptKey: durableTaskId,
+                            witness: prepared.legFacts?.sessionWitness,
+                            occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+                            leafOf: undefined,
+                        }).prompt;
+                        if (anchorPut || !entryId || write === undefined)
                             return;
                         anchorPut = true;
-                        await settleResumeAnchor(() => store.put(prepared.spec.sessionId, key, entryId, principal ?? null), { leg: "stream", kind: "prompt" });
+                        await settleResumeAnchor((held) => write(entryId, held), { leg: "stream", kind: "prompt" });
                     };
                     try {
                         if (deps.runStore) {
@@ -358,7 +365,7 @@ export async function handleTasks(req, res, match, ctx) {
                         writeTerminalFrame(doneFrameOfOutcome(claimFault));
                         return claimFault;
                     }
-                    commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
+                    commitLegBindings(deps, prepared.seat, prepared.spec.sessionId, prepared.legFacts?.sessionBindings);
                     markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.subject);
                     let ledgerSink;
                     let ledgerTerminal = false;
@@ -531,7 +538,7 @@ export async function handleTasks(req, res, match, ctx) {
                                     await deps.userInputLedger?.observeLegEvent(liveStream, ev);
                                     await prepared.acceptance.observe(ev);
                                     if (ev.type === "done")
-                                        prepared.acceptance.settle(ev.result);
+                                        await prepared.acceptance.settle(ev.result);
                                     await liveWorkspace.observe(ev);
                                     if (ledgerSink)
                                         await manifestSeat?.drain(ledgerSink.append);
@@ -939,7 +946,7 @@ export async function handleTasks(req, res, match, ctx) {
                     catch (e) {
                         return faultedAnswerOf(e, SUBMISSION_CLAIM_FACE.faulted);
                     }
-                    commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
+                    commitLegBindings(deps, prepared.seat, prepared.spec.sessionId, prepared.legFacts?.sessionBindings);
                     const syncCancelCtrl = createRunAbort(principal ?? null);
                     markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.subject);
                     if (durableTaskId && deps.runStore) {
@@ -975,15 +982,22 @@ export async function handleTasks(req, res, match, ctx) {
                     counters.uncountedBillableInflight++;
                     try {
                         const heldDecisions = await heldWorkflowParkDecisions(deps, prepared.spec.sessionId);
-                        const compositionInternals = { ...heldDecisions, ...compositionLegRoot(prepared.legFacts?.registeredCwd) };
+                        const compositionInternals = { ...heldDecisions, ...compositionLegRoot(prepared.legFacts?.sessionBindings.cwd) };
                         const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, compositionInternals);
                         const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), compositionInternals);
                         const plainLeg = async () => {
                             const stream = prepared.runner.runTaskStream(specWithSignal, undefined, heldDecisions);
                             const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), prepared.legFacts?.sessionWitness);
-                            const anchorKey = durableTaskId;
-                            const anchorStore = deps.resumeAnchorStore;
-                            const anchor = new TurnAnchorCapture(undefined, "sync", anchorStore && anchorKey ? async (entryId) => { await anchorStore.put(prepared.spec.sessionId, anchorKey, entryId, principal ?? null); } : undefined);
+                            const anchorWriter = createRunAnchorWriter({
+                                seat: deps.backend?.landedAttendants(),
+                                sessionId: prepared.spec.sessionId,
+                                owner: principal ?? null,
+                                promptKey: durableTaskId,
+                                witness: prepared.legFacts?.sessionWitness,
+                                occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+                                leafOf: undefined,
+                            });
+                            const anchor = new TurnAnchorCapture(undefined, "sync", anchorWriter.prompt);
                             for await (const ev of stream) {
                                 observeSyncLegEvent(ev);
                                 switch (ev.type) {
@@ -1040,18 +1054,18 @@ export async function handleTasks(req, res, match, ctx) {
                     const syncPlane = outwardPlane(result.terminal);
                     const syncHeld = heldParkOf(result);
                     if (syncHeld !== undefined && deps.checkpointStore && deps.runStore && durableTaskId) {
+                        await prepared.acceptance.settle(result);
                         const parked = await commitParkRow({
                             runStore: deps.runStore, taskId: durableTaskId, word: syncHeld.word, result: exitResult, card: { token: syncHeld.token, sessionId: prepared.spec.sessionId }, cards: deps.checkpointStore, leg: "sync",
                             legId: heldLegOf(durableLegId, durableTaskId), staleWindowMs: deps.config.runStaleSec * 1000,
                         });
-                        prepared.acceptance.settle(result);
                         if (parked.kind === "ended")
                             return { status: 200, body: withSyncSubmitKeys(parked.row !== undefined ? syncSubmitBodyOfRow(parked.row) : { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "failed" }) };
                         return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: syncHeld.word })) };
                     }
+                    await prepared.acceptance.settle(result);
                     if (durableTaskId && deps.runStore)
                         await deps.runStore.setTerminal(durableTaskId, syncPlane.status, exitResult, syncPlane.errorMessage ?? null);
-                    prepared.acceptance.settle(result);
                     finalizeTaskResult(result, principal, prepared.spec.objective);
                     noteRunOutcome(result);
                     return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult)) };

package/dist/http/routes/trace-usage.js

@@ -9,7 +9,7 @@ import { bindSseLifecycle } from "../sse-lifecycle.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { filterFingerprint } from "../cursor-fingerprint.js";
 import { sendUnauthorized } from "../principal-gate.js";
-import { admitRunById, enter, entryIsFleet, listVisibleRuns, readVisibleRun, routeListFilter, runListOwnerOf, toolResultRefOwned } from "../owner-access.js";
+import { admitRunById, enter, entryIsFleet, listVisibleRuns, readVisibleRun, routeListFilter, listOwnerOf, toolResultRefOwned } from "../owner-access.js";
 import { listFilterOf } from "../../owner-faces.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
@@ -166,7 +166,7 @@ async function handleTaskList(res, runStore, query, filter) {
     const jobId = query.get("jobId") ?? undefined;
     const source = query.get("source") ?? undefined;
     const namedOwner = query.get("owner") ?? undefined;
-    const owner = runListOwnerOf(filter, namedOwner);
+    const owner = listOwnerOf(filter, namedOwner);
     const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
     const f = filterFingerprint([status, jobId, source, owner]);
     const cursor = decodeCursor(query.get("cursor"), f);

package/dist/http/server.d.ts

@@ -1,10 +1,11 @@
 import http from "node:http";
 import type { MemoryComplianceFaces, MemoryOriginFaces, SessionMemoryStatusFace } from "../memory-operator-faces.js";
 import type { SideQueryAccounting } from "../budget.js";
-import type { SessionPurgeOutcome } from "../session-deletion.js";
+import type { SessionAgeOutExpectation, SessionPurgeOutcome } from "../session-deletion.js";
 import type { IncomingMessage } from "node:http";
 import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { ProjectContext } from "../project-context.js";
+import type { MemorySeed } from "../project-registry.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
@@ -12,7 +13,7 @@ import type { RestartSignal } from "@sema-agent/settings-schema/fleet";
 import { type AuthorizeInput, type OwnerAwareSessionStore } from "../security.js";
 import type { PeerDesk, PeerLease } from "../peer-seat.js";
 import type { ExecutionRoot, ResolvedTaskSpec } from "./execution-context.js";
-import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ApprovalNonceStore, ServiceSessionPolicyStore, ServiceFileHistoryStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
+import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ApprovalExemptionStore, ApprovalNonceStore, ToolResultStoreFull, StoreBackend } from "../plugins/store-backend.js";
 import type { RuleConsentLane } from "../rules-consent.js";
 import { type MemorySyncAnswer, type MemorySyncRequest } from "../memory-sync.js";
 import type { MemorySyncRunner } from "../memory-sync-client.js";
@@ -58,9 +59,9 @@ export interface RequestAuth {
     sessionId: string;
     memoryScope?: string;
     /** 142-S4:the SHAPE-VALIDATED **且已归一(小写)** 的 `body.projectId`(authorizer 的 core
-     *  `PROJECT_ID_REGEX` 门通过后折小写回传;[ref]/[ref] 宽读严写)。main.ts 拿它查 config.projects 的
-     *  defaultScopes(memory.scopes 种子)。resume 腿(checkpoint 重建 auth)缺席 — 回落持久化的
-     *  body.projectId(原始提交已验形),那条回落腿自己再折一次小写,两腿查同一个键。 */
+     *  `PROJECT_ID_REGEX` 门通过后折小写回传;[ref]/[ref] 宽读严写)。装配器拿它判 memory.scopes 种子项目(对提交者可见才算,
+     *  `project-registry.ts`)与这条腿的项目。resume 腿(checkpoint 重建 auth)缺席 — 项目回落持久化的
+     *  body.projectId(原始提交已验形,那条回落腿自己再折一次小写);种子不回落,读冻结的种子项目。 */
     resolvedProjectId?: string;
     /** authorizer 判过的头(`security.ts` `createAuthorizer` 交出;语义见 `AuthContext.head`)⇒ fresh 执行上下文的 `judged`。自建 authorizer 不给 = 解析器不比住客。 */
     head?: import("@sema-agent/core").SessionHead;
@@ -133,7 +134,9 @@ export interface ServiceCoreDeps {
      *  装配器在**全部折叠之后**经首跑同一只合并口 `withUnattendedLeg` 重挂那条腿(`default` + 按类作答的 onAsk)。只由续跑腿
      *  按服务端写的 ctx 位递,绝不从请求体读。
      *  `opts.projectContext`(项目上下文继承):续跑家族把提交腿冻结的那一份(`CheckpointCtx.projectContext`,服务端写)原样递回 —— 装配器在续跑腿上只重放它、不读登记簿;
-     *  新提交腿不递(装配器自己在头部判)。同样只由续跑腿按服务端写的 ctx 位递,绝不从请求体读。 */
+     *  新提交腿不递(装配器自己在头部判)。同样只由续跑腿按服务端写的 ctx 位递,绝不从请求体读。
+     *  `opts.memorySeed`(登记簿默认读层种子):续跑家族把提交腿冻结的种子(`CheckpointCtx.memorySeed`:种子项目 + 判出它的那一位观者,服务端写)原样递回 —— 装配器在续跑腿上
+     *  只认它(以冻结的观者经同一只可见性判读此刻的登记)、不推观者、不按存体的 `projectId` 现查;新提交腿不递(装配器自己在头部判)。只由续跑腿按服务端写的 ctx 位递,绝不从请求体读。 */
     /** `opts.execution`(必填):这条腿的执行上下文(`http/execution-context.ts`;只 `fresh` / `continuation` 两形,`root` 恒在)。装配器要用这条腿的根会话
      *  (场景设施的分区键、受理见证)读 `opts.execution.root` —— 它与 server 随后盖进 spec 的根是同一个值,装配器自己不写根。 */
     /** `opts.lease`(必填):这条腿的**宿主租约** —— 装配在它之下登记本腿交给引擎的对端声明(`peerDesk.declare(草稿, opts.lease)`)。
@@ -145,6 +148,7 @@ export interface ServiceCoreDeps {
         onNotice?: (notice: EngineNotice) => void;
         unattendedLeg?: true;
         projectContext?: ProjectContext;
+        memorySeed?: MemorySeed | null;
         lease: PeerLease;
         execution: ExecutionRoot;
     }) => ResolvedTaskSpec | Promise<ResolvedTaskSpec>;
@@ -196,9 +200,6 @@ export interface ServiceCoreDeps {
 export interface ServiceStoreDeps {
     /** Durable async-run registry + event log (S1/S2). Enables /v1/runs when present. */
     runStore?: RunStore;
-    /** E18 resume-at: the eventId→entryId anchor map (tidb/pg/local). Present whenever a backend is — resolveSpec
-     *  resolves body.resumeAt(eventId)→entryId, the run lifecycle captures per-turn anchors, E21 purges them. */
-    resumeAnchorStore?: ResumeAnchorStore;
     /** Per-session approval exemption store — enables decide body `remember:"session"` + the
      *  exemptions list/revoke surfaces on /v1/approvals. The ask-gate probe is wired separately (main.ts). */
     approvalExemptionStore?: ApprovalExemptionStore;
@@ -215,9 +216,6 @@ export interface ServiceStoreDeps {
      *  封不了就不落,没有「明文照写」的第二种装配。嵌入方:`checkpointCtxSealing: await ensureCheckpointCtxSealing(sealedKeyDir)`
      *  (保管目录要跨重启持久、多副本各副本是同一份钥匙,否则封它的那把钥匙不在 ⇒ 409 `conflict.checkpoint_ctx_unsealable` `reason:"key_not_held"`)。 */
     checkpointCtxSealing?: import("./checkpoint-ctx.js").CheckpointCtxSealing;
-    /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). Enables PUT/GET /v1/sessions/:id/policy
-     *  when present; core reads the rules at prepare-time (subtract-only) via RunnerDeps.sessionPolicyStore (wired separately). */
-    sessionPolicyStore?: ServiceSessionPolicyStore;
     /** [ref] tool-results 读面([ref] 请求,core [ref] `buildToolResultRef` 到货):`GET /v1/tasks/:id/
      *  tool-results/:ref` 的数据源 —— 与 RunnerDeps 侧的 offload 店**同实例**(main.ts 的 `toolResultStore`,
      *  即「durable 后端在场」那一只;无 backend 部署里 Runner 用的内存兜底 `runnerOffloadStore` **不接**这里)。
@@ -225,14 +223,6 @@ export interface ServiceStoreDeps {
      *  与 unknown-ref / 归属不符两臂**同形** 404 才是防 oracle 的收口([ref] 的「另定」项按防 oracle 收紧)。
      *  这是本组「absent ⇒ 501 诚实缺席」通例的**唯一具名例外**,例外理由即上一句。 */
     toolResultStore?: ToolResultStoreFull;
-    /** [ref] per-edited-file rewind history store. Present ⇒ the rewind capabilities are advertised; core uses it
-     *  via RunnerDeps.fileHistoryStore (first-touch tracking + per-turn boundaries + tracked-set restore, ANY
-     *  env). Also the 2c history-transfer store (exportHistory/importHistory + blob negotiation faces).
-     *  🔴 [ref]:这是装配单点 `assembleFileHistory` 的**店**(后端在即在,与 `FILE_HISTORY_CAPTURE` 无关 —— 旋钮只关捕获,
-     *  落在 core 的 `RunnerDeps.fileHistoryCapture` 上)。rewind 族四位与 2c sync 路由族跟它走;能力词 `fileHistoryCapture`
-     *  = `fileHistoryCaptureOf(本键, config.fileHistoryCapture)`(与 core 捕获位同一只判定)。
-     *  擦除(E21 / 孤儿 blob GC)不读本键,读 boot 侧的擦除脸。 */
-    fileHistoryStore?: ServiceFileHistoryStore;
     /** D-1 通用文件上传(clay 拍 2026-07-27:独立附件 store,不骑 snapshot blob 面):enables
      *  POST/GET/DELETE /v1/attachments*。缺席 ⇒ 501(与其他可选 store 面同姿)。绑定/物化半场在
      *  main.ts(resolveSpec + env factory 包装);本面只管上传/取回/删除三动词 + server 权威上限。 */
@@ -423,11 +413,11 @@ export interface ServiceSeamDeps {
      */
     deviceEnrollment?: import("../device-enrollment.js").DeviceEnrollment;
     /**
-     * [ref] × 7.106.0 合并复审 X1:host 车道会话登记簿的 `inheritEnv` **写口**(`boot/execution-env.ts` 的 `setSessionInheritEnv`)。
-     * 唯一调用者 = `http/session-inherit-env.ts` 的 `commitSessionInheritEnv`(四个 run 认领点在认领之后调;判据与残余见那只文件)。
-     * 缺席 = 本部署不是 host 车道(没有工厂读这一格)⇒ 提交点 no-op。装配 = `boot/stage-10-http-server.ts`(host 车道才给)。
+     * 会话登记簿的**绑定写座**(`boot/execution-env.ts` `createSessionScopedRegistries`:cwd / shellEnv / inheritEnv 三格写一笔、按回执撤一笔)。
+     * 唯一写者 = `session-bindings.ts` 的 `commitLegBindings`(四个 run 认领点在认领之后调);唯一撤回者 = 提交出口(`submission-exit.ts`,
+     * 写了之后才收场 `refused` 的提交)。律与残余见 `session-bindings.ts` 头注。缺席(夹具 / 嵌入方没接)= 没有登记簿 ⇒ 提交点 no-op。
      */
-    bindSessionInheritEnv?: import("./session-inherit-env.js").SessionInheritEnvCommitCtx["bindSessionInheritEnv"];
+    sessionBindings?: import("../session-bindings.js").SessionBindingSeat;
     /**
      * 会话登记簿四表(cwd / shellEnv / inheritEnv / 属主,`boot/execution-env.ts` `createSessionScopedRegistries` 的 `dropSessionOf`)按**住客**清掉一只 ——
      * 记下的住客恰是交来的化身才清、答 `true`。读者只有提交出口(`submission-exit.ts`):被拒提交铸下的会话撤回之后清(同 id 的下一位已登记、写下的条目不动)。
@@ -442,12 +432,14 @@ export interface ServiceSeamDeps {
     } & Record<string, unknown>) | undefined>;
     /** E21 删除协调器(会话三态 活 → 在删 → 没了,`session-deletion.ts`):删会话的对话史与服务自己的 run 账 / 检查点 / 卸载结果等全部挂靠行,一次调用。
      *  结局 = {@link SessionPurgeOutcome}(删了 / 不在 · 围栏判到认领 · 子代预检拒 · 被接管)。点亮 DELETE /v1/sessions/:id。 */
-    purgeSession?: (sessionId: string, owner: string | null) => Promise<SessionPurgeOutcome>;
+    purgeSession?: (sessionId: string, owner: string | null, opts?: {
+        readonly ageOut?: SessionAgeOutExpectation;
+    }) => Promise<SessionPurgeOutcome>;
     /** [ref]③(b): read a BACKGROUND agent-handle child's final report / current status out of the core
      *  TaskRegistry (the same face the TaskOutput tool reads — agent handles are NEVER in the run store).
      *  Wired in main.ts to `defaultTaskRegistry.pollTask` (non-blocking). Access is the REGISTRATION tuple:
      *  owner = the parent run's taskId (resume legs register children under the sessionId — the registry's
-     *  sessionScoped arm matches via `access.sessionId`), scope = the run's principal ?? "default". */
+     *  sessionScoped arm matches via `access.sessionId`), scope = the run owner's engine-identity cell (`engineScopeOfOwner`). */
     subagentTaskOutput?: (handle: string, access: {
         owner: string;
         scope: string;
@@ -724,7 +716,7 @@ export interface ServiceDeploymentDeps {
      */
     deploymentModPackages?: number;
     /**
-     * 会话 → 调用方登记的工作目录(提交体 `cwd` 的唯一写口 `setSessionCwd` 写的那一张进程内表,`boot/execution-env.ts` `createSessionScopedRegistries`)。
+     * 会话 → 登记的工作目录(受理的提交经绑定写座 {@link ServiceDeps.sessionBindings} 写的那一张进程内表,`boot/execution-env.ts` `createSessionScopedRegistries`)。
      * **只读**,读者只有 run 外回退口(`POST /v1/sessions/:id/rewind-files`):host 工厂按 `effectiveHostWorkspace(本表.get(会话), ctx)` 定根(`execution-env.ts`
      * host 臂),口在交引擎之前用**同一只函数、同一份入参**问「工厂这一次会不会落到一只用完即删的临时目录」—— 会 ⇒ 拒,不让台账说恢复了而项目没动。
      * 缺席(夹具 / 嵌入方没接)⇒ 读作「没有登记」⇒ host 车道上口拒(fail-closed)。
@@ -950,6 +942,8 @@ export declare function createHttpServer(rawDeps: ServiceDeps): http.Server & {
     redeemParkedAsk: ParkedAskRedeem;
     /** 会话通知门(装配层把它接进场景层后台完成 sink 的晚绑座;门与律见 `session-notify-door.ts`)。 */
     sessionNotifyDoor: SessionNotifyDoor;
+    /** run 收场送达的转交(装配层把它接进 workflow 编排面完成送达的晚绑座;律见 `resume-legs.ts` 的 `handOverRunEndedDecisions`)。 */
+    handOverRunEndedDecisions: (runId: string) => Promise<void>;
 };
 /** SSE: replay durable events after Last-Event-ID, then tail until the run is terminal (or stale). */
 /**

package/dist/http/server.js

@@ -226,7 +226,7 @@ export function createHttpServer(rawDeps) {
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
     const { admitRun } = createRunConcurrencyGate({ deps, inflightRuns, steerableRuns });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor, handOverRunEndedDecisions } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, decisionRowAdmits });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {
@@ -289,6 +289,6 @@ export function createHttpServer(rawDeps) {
         deps.planCacheProbe?.record(principal, objective, result.terminal.kind === "completed");
     }
     const isRunLiveOnThisReplica = (taskId) => liveRunIdsOf(inflightRuns, steerableRuns).has(taskId);
-    return Object.assign(server, { denyExpiredApprovals, isRunLiveOnThisReplica, redeemParkedAsk, sessionNotifyDoor });
+    return Object.assign(server, { denyExpiredApprovals, isRunLiveOnThisReplica, redeemParkedAsk, sessionNotifyDoor, handOverRunEndedDecisions });
 }
 //# sourceMappingURL=server.js.map

package/dist/http/submit-ctx.js

@@ -29,11 +29,11 @@ function unsealableRefusal(e) {
 function rowTooLargeRefusal(tooLarge) {
     switch (tooLarge.wall) {
         case "row":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database keeps in one row — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's single-row limit (TiDB performance.txn-entry-size-limit)`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "statement":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than the database accepts in one statement — nothing was run; shrink the inline images / userAttachments, or ask the operator to raise the database's max_allowed_packet`, facts: limitFactsUnmeasured("body", "bytes") }) };
         case "value":
-            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value (${tooLarge.dbMessage}) — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
+            return { status: 413, body: refusalBody({ errorCode: "request.payload_too_large", message: `the database refused to store this task: it is larger than PostgreSQL holds in one value — nothing was run; shrink the inline images / userAttachments`, facts: limitFactsUnmeasured("body", "bytes") }) };
         default: {
             const unhandled = tooLarge.wall;
             throw new Error(`row-too-large refusal without an HTTP answer: ${String(unhandled)}`);
@@ -62,7 +62,7 @@ export async function persistSubmitCtx(store, deps, claim, sessionId, fields) {
         }
         if (tooLarge === undefined)
             throw err;
-        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall, db: tooLarge.dbMessage });
+        deps.logger?.warn("submit_ctx_row_too_large", { sessionId, taskId: claim?.taskId, wall: tooLarge.wall });
         return rowTooLargeRefusal(tooLarge);
     }
     return landed === "claim_released" ? SUBMIT_CTX_CLAIM_LOST : undefined;
@@ -77,6 +77,7 @@ export async function persistSubmissionCtx(store, deps, claim, prepared) {
         memoryScope: prepared.auth?.memoryScope,
         ...(screened || prepared.bodyFromScreenedCtx === true ? { promptScreened: true } : {}),
         ...(prepared.legFacts?.projectContext !== undefined ? { projectContext: prepared.legFacts.projectContext } : {}),
+        ...(prepared.legFacts?.memorySeed !== undefined ? { memorySeed: prepared.legFacts.memorySeed } : {}),
         writerVersion: serviceVersion(),
     });
 }

package/dist/http/wire-types.d.ts

@@ -41,6 +41,14 @@ export interface TaskRequestAttachments {
 export interface TaskRequestBody {
     objective: string;
     sessionId?: string;
+    /**
+     * 这一次提交建的会话是哪一**种**(闭集一词 `"sidechain"` = 客户端放置的子代对话;缺席 = 顶层对话;律在 `session-kind.ts`)。
+     * 只在**建这只会话的那一笔**写下(不带 `sessionId` / 带一只还不存在的 id),此后终身不改:带键提交到一只既有的会话 ⇒ 种类相等照常、不等 409
+     * `conflict.session_kind_mismatch`(会话一字节不变,体上机读位 `sessionKind` = 行上的词,顶层行缺席);不带键 = 不声明(续轮不必重发)。
+     * 词表外 ⇒ 400 `request.field_invalid`;部署记不了种类(能力位 `sessionKinds` 为空)⇒ 400 `request.precondition_unmet`,都在任何写之前。
+     * 续跑腿不读不判(键随存体留着)。
+     */
+    sessionKind?: "sidechain";
     /** Which deployment SCENARIO assembles this task's tools/prompt/skills (the keys of the worker's scenario
      *  table — e.g. "default"/"code"/"code-review"/"scan"/"cowork"). An INTENT bounded by the deployment's own table AND,
      *  on a governed worker, by the principal's center-resolved allowlist: an unknown name is a typed 400
@@ -240,7 +248,9 @@ export interface TaskRequestBody {
      *  (unknown ⇒ 404 `rewind_files_to.unknown_event`). Honored ONLY when `resumeAt` is ABSENT (the two modes are mutually
      *  exclusive). Requires the anchor map + a FileHistoryStore + the session store's head read (capability
      *  `rewindFilesTo`). Its out-of-run twin — no run, no model call — is `POST /v1/sessions/:id/rewind-files` with the same
-     *  handle in `to` (capability `sessionRewindFiles`). */
+     *  handle in `to` (capability `sessionRewindFiles`). Not accepted together with `cascade: true` — the ladder's rungs
+     *  run on sessions the engine mints, so there is no history of this session to restore from ⇒ 400 `request.field_conflict`
+     *  (`reason: "cascade_verify"`, `fields: ["rewindFilesTo", "cascade"]`) at admission, before any side effect. */
     rewindFilesTo?: string;
     /** [ref](core 7.31.0 [ref] `TaskSpec.fileHistory`)—— 请求级的**文件历史关断词**,唯一词 `"disabled"`(core 的拼法,
      *  与 `checkpointStore` 同;没有 `"enabled"` —— 缺席就是「部署说了算」的唯一形,声明只能单向收紧)。`"disabled"` ⇒
@@ -449,9 +459,9 @@ export interface TaskRequestBody {
      *  authorizer(core `PROJECT_ID_REGEX`,不合形状=422 typed `invalid_project_id`)。**大小写不敏感收、
      *  归一小写用**([ref]/[ref]:词法与 core 的格式单源对齐,带 /i;收下后折小写再派生 scope/查表 ——
      *  同一个 id 的两种大小写写法落同一只记忆盘)。多租户 DB 记忆面下它把派生
-     *  scope 从 user 盘切到项目盘(`proj:<tenant>/<projectId>`)并以 config.projects[projectId].defaultScopes
-     *  作 memory.scopes 种子;单用户部署忽略派生(memoryScopeFor 不变),仅 defaultScopes 种子生效。
-     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)。
+     *  scope 从 user 盘切到项目盘(`proj:<tenant>/<projectId>`);它对提交者**可见**时(`project-registry.ts`,与 `GET /v1/projects/:id` 同一只判)
+     *  那只登记的 defaultScopes 作 memory.scopes 种子(看不见 / 未登记 ⇒ 无种子,同答);单用户部署忽略派生(memoryScopeFor 不变),仅种子生效。
+     *  Rides the persisted body onto resume legs(与 memoryWrite 同姿势)—— 种子不随体:续跑腿只认提交腿冻结的种子(`CheckpointCtx.memorySeed`,以冻结的观者重判)。
      *  7.150.0 起它(或会话行上声明过的项目)也选这条 run **继承的项目上下文**(`project-context.ts`;能力位 `projectInheritance`):登记对提交者可见且带内容证明 ⇒
      *  项目简报进系统提示追加折叠的中段、射程内第一条 folder 填缺席的 `cwd`;判一次、随 run 冻结。项目继承来的成员参与的拒,`fields` 以本键为坐标。 */
     projectId?: string;

package/dist/identity-source.d.ts

@@ -2,7 +2,7 @@
  * **身份来源闭集 + run 行身份元组** —— 叶子模块(零依赖):凭据门(`http/principal-gate.ts`)、run 店契约(`plugins/store-contracts.ts`)、
  * 三只 run 店与 leader run 店(`plugins/leader-run-store-sql.ts`)、中央建表语句(`plugins/tidb-pool.ts` / `plugins/pg-pool.ts`)与 `/health` 自报位读同一份。
  *
- * ## 律(三句;全仓只在这里写一次)
+ * ## 律(五条;全仓只在这里写一次)
  * 1. **一张表、一个次序**:{@link IDENTITY_SOURCES} 的序 = 凭据门的判定次序(`verifiedIdentitySource` 答表里第一个验得过的词)= `/health.auth.kinds` 的出现序。
  *    出示了部署的 service 凭据就是 `service_token` —— 哪怕同一枚 Bearer 也被鉴权桥验成登录令牌、哪怕运维给这枚凭据起的系统名叫 `sso`;
  *    验不过 service 凭据而鉴权桥挂了身份 ⇒ `sso`;都没有而直连门 principal 令牌验过 ⇒ `direct_door_jwt`。
@@ -15,6 +15,10 @@
  * 4. **令牌声明装不进它的列就不记**(不截断:截断 = 两个不同的值折成一个):`sso` 臂从验过的令牌铸元组时,某一格装不进它的列宽({@link RUN_IDENTITY_CLAIM_COLUMNS})
  *    ⇒ 那一格「未记录」—— 可空的格(化身号)记 `null`;必填的格(scope)装不下就铸不出合形元组 ⇒ 无元组。两格结果不同来自元组的型,不是两条规则:
  *    同一只判({@link runIdentityClaimOverflow})、同一行告警 `run_identity_claim_unrecorded { claim, chars, max }`(凭据门的铸点发;只名与长度,不带值)。
+ * 5. **凭据门认哪几类来源,一列答**({@link passesCredentialGate}):service 凭据与鉴权桥验过的登录令牌过门,直连门 principal 令牌不过(它只证审批决定者是谁)。
+ *    两道门读这同一列、各问各的事:全局凭据门(401)只在部署配了 service 凭据时武装({@link hasServiceAuth});fail-closed 写门(503:计费提交 / bake / 改写门 /
+ *    破坏性会话写 / 停驻赎回开新腿)恒武装,问的是**这次请求**带没带过门的凭据,`ALLOW_UNAUTHED_WRITES` 是它唯一的逃生口 —— 写门不读任何部署级布尔:
+ *    部署接没接过门的来源,落在「这次请求验不验得出」里(没接 ⇒ 没有一次请求验得出 ⇒ 照拒)。
  *
  * 化身号 `principalInc`:令牌 `sub_inc` 声明原样(契约包 `VerifiedIdentity.principalInc`)。来源链只有一条 —— 验证器读出 → 注入边界再判形(`auth-bridge.ts` 的
  * `admitBridgeIdentity`)→ 入口预认证挂 request-local(`security.ts` 的 `setSsoPrincipalInc`)→ 凭据门 `admitRunIdentity` 的 `sso` 臂铸进元组(律 4)→ 建行原样写入。
@@ -46,9 +50,22 @@ export declare function authBridgeIssuerOf(config: Pick<IdentitySourceConfig, "a
     readonly issuer: string;
     readonly source: "explicit" | "fallback";
 } | undefined;
-/** 「这台部署配了任何一把 service 凭证吗」—— fail-closed 写门族的真值源,也是身份来源 `service_token` 接没接线的那一句。**单一属主**:全局凭据门(`http/dispatch.ts`)、
- *  停驻行的赎回席(`http/approval-sweeps.ts`)、记忆整理阀门的启动期告警(`boot/stage-06-runners.ts`)、以及 {@link configuredIdentitySources} 读同一句(手抄迟早只改一处,而这条判据决定的是「无凭证部署上写口开不开」)。 */
+/**
+ * 「这台部署配了任何一把 service 凭证吗」—— 身份来源 `service_token` 接没接线的那一句,也是**全局凭据门的武装谓词**(配了 ⇒ 门后各口不带过门凭据就 401;
+ * 没配 ⇒ 门不武装,写门照样只认过门的凭据,见文件头律 5)。**单一属主**(手抄迟早只改一处):全局凭据门的武装(`http/dispatch.ts`)、门前读路谓词与 `/health` 读者档
+ * (同文件 `readCredentialOk` / `healthReaderOf`,问的都是「门武装没有」)、监听收窄与两条单用户边界不变量(`bind-host.ts` 的 `bindMustNarrow`,`config-invariants.ts`)、
+ * 多租无 fleet 凭据的启动期告警(`boot/stage-07-capability-layer.ts`)、以及 {@link configuredIdentitySources} 读同一句。**不是**写门的判据(写门问请求,律 5)。
+ */
 export declare function hasServiceAuth(config: Pick<IdentitySourceConfig, "authToken" | "authTokens">): boolean;
+/** 凭据门认的那几类来源(律 5;{@link passesCredentialGate} 收窄到它)。 */
+export type CredentialGateSource = Extract<IdentitySource, "service_token" | "sso">;
+/**
+ * 🔴 **律 5 的那一列:这一类来源过不过凭据门**(缺席 = 这次请求没有验过的来源 ⇒ 不过)。service 凭据是部署发的凭据;鉴权桥验过的登录令牌由本部署信任的签发方签、
+ * 主体就是令牌里的那一位(主体头盖不过它);直连门 principal 令牌只证审批决定者是谁,从来不替代凭据。穷举:加一个来源不接这里 ⇒ 编译红。
+ * 读者:全局凭据门的 401 与 fail-closed 写门的 503(`http/dispatch.ts`,读同一次 `verifiedIdentitySource` 的答案)、停驻赎回席(`http/approval-sweeps.ts`)、
+ * 以及它在部署上的投影 —— 部署形表行 `credentialGateSource`(`deployment-shape.ts`;请求面不读那一行,写门问的是请求)。
+ */
+export declare function passesCredentialGate(kind: IdentitySource | undefined): kind is CredentialGateSource;
 /**
  * 🔴 **「这台部署能回哪几个身份来源」的唯一读法**({@link IDENTITY_SOURCES} 里配置接了线的那几个词,序同表)。读者:部署形表的 `identity` 轴
  * (`deployment-shape.ts`,「有没有身份边界」那一行由它答)、`/health.auth`(自报位,`http/health-self-report.ts`)、server-as-peer 受众门(`http/server.ts`)。

package/dist/identity-source.js

@@ -23,6 +23,20 @@ function identitySourceConfigured(kind, config) {
         }
     }
 }
+export function passesCredentialGate(kind) {
+    switch (kind) {
+        case "service_token":
+        case "sso":
+            return true;
+        case "direct_door_jwt":
+        case undefined:
+            return false;
+        default: {
+            const unknownKind = kind;
+            throw new Error(`identity sources: unknown identity source ${String(unknownKind)}`);
+        }
+    }
+}
 export function configuredIdentitySources(config) {
     return IDENTITY_SOURCES.filter((k) => identitySourceConfigured(k, config));
 }

package/dist/index.d.ts

@@ -41,5 +41,9 @@ export { judgeServedModelRoute, type ServedModelRouteView, type ServedModelRoute
 export type { UserInputLedgerStore, UserInputAcceptance, NewUserInputAcceptance, OpenScanCursor, OpenScanPage, SettleHow, WriterGoneEvidence } from "./user-input-ledger.js";
 export type { OrgDeliveryQuotaStore, OrgDeliveryQuotaPolicy, OrgDeliveryQuotaVerdict } from "./plugins/org-delivery-quota-store.js";
 export type { ServerOrgDeliveryGate, ServerOrgDeliveryOutcome } from "./org-delivery-gate.js";
+export type { LandedAttendantSeat, LandedAnchor, FileHistoryReplayResult, FileHistoryReplayFailure } from "./plugins/landed-attendants.js";
+export type { LandedOutcome } from "./session-row.js";
+export type { SessionFace } from "./session-incarnation.js";
+export type { BlobGetter } from "./session-sync.js";
 export { APPROVAL_GATE_KINDS, type ApprovalGateKind } from "./approval-content-kind.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lane-home-probe.d.ts

@@ -23,6 +23,7 @@
  * 读不了家目录的车道(device:设备协议没有读数)不持座 —— 声明就是座,起服披露「来自声明、未实测」(`execution-lane-caps.ts` `buildLaneHomeBootNote`)。
  * 规则基与 422 门在下单那一刻就要家目录,而那一刻执行环境还没开 —— 它们只读主张(`executionLaneHomeDir`);环境开起来时主张被证,证不了的环境不开。
  */
+import type { ExecutionEnvRefusalCode } from "./execution-env-refusal.js";
 /** 探针答案的行首标记:登录脚本 / profile 往 stdout 打的横幅不会被读成家目录 —— 只认带这个标记的那一行(恰一条,见 `markedHome`)。 */
 export declare const LANE_HOME_PROBE_MARKER = "sema-lane-home=";
 /**
@@ -72,14 +73,9 @@ export type LanePathFlavor = "posix" | "win32";
  */
 export declare function judgeLaneHome(lane: string, claim: LaneHomeClaim, probe: LaneHomeProbe, paths?: LanePathFlavor): LaneHomeVerdict;
 /**
- * 本仓自铸的**执行环境拒码**闭集(`env.*` 族;今天一员)—— 一只执行环境在交给引擎之前就被拒时,工厂抛出的错带的 `code`。引擎在准备期原样再抛、不建环境,
- * run 的 `failed` 终局原样承运码与句;同步提交腿按零工作拒落档(`runs.ts` 的 `EXECUTION_ENV_REFUSAL_HTTP_STATUS`,按本闭集键控:加一员而档没跟 ⇒ tsc 红)。
- *  · `env.home_unconfirmed` —— 家目录主张证不了({@link judgeLaneHome} 的三形拒句:读不出 / 不是绝对路径 / 与实测不一致)。三形一个码:出路都在部署
- *    (声明、环境里的 `HOME`,或会话 `settings.env` 里的 `HOME`),消费端不按形分岔;是哪一形、怎么改,句子里说。
+ * 家目录拒的带码错误:句 = 判官的拒句原文,码 = `env.home_unconfirmed`(本仓 `env.*` 族的一员,闭集属主 `execution-env-refusal.ts`)。读数在铸环境时就到手的车道(host)
+ * 构造时抛它,工厂原样抛出;读数要环境起来才有的车道在建连时以同一码答(建连座的拒因表 `home_unconfirmed`)。
  */
-export declare const EXECUTION_ENV_REFUSAL_CODES: readonly ["env.home_unconfirmed"];
-export type ExecutionEnvRefusalCode = (typeof EXECUTION_ENV_REFUSAL_CODES)[number];
-/** 家目录拒的带码错误:句 = 判官的拒句原文,码 = `env.home_unconfirmed`。读数在铸环境时就到手的车道(host)构造时抛它,工厂原样抛出。 */
 export declare function laneHomeRefusal(verdict: NonNullable<LaneHomeVerdict>): Error & {
     readonly code: Extract<ExecutionEnvRefusalCode, "env.home_unconfirmed">;
 };

package/dist/lane-home-probe.js

@@ -61,7 +61,6 @@ export function judgeLaneHome(lane, claim, probe, paths = "posix") {
         answered: true,
     };
 }
-export const EXECUTION_ENV_REFUSAL_CODES = ["env.home_unconfirmed"];
 export function laneHomeRefusal(verdict) {
     return Object.assign(new Error(verdict.refusal), { code: "env.home_unconfirmed" });
 }

package/dist/leader/leader.d.ts

@@ -70,7 +70,8 @@ export interface ProvisionedWorker {
  * (`runtime-governance.ts` `entryPermissionMode`)得出的入口词(`run-entry.ts` `leaderRunEntry`);地板缺席 ⇒ `{}`。leader 请求不带调用方的模式词,所以入口词就是地板本身(与 run-local 同)。
  * 本 run 铸的每一条 spec 经 {@link withLeaderLeg} 从这一份取词;worker 的续跑体由它展开(`{ ...entry, objective }`)⇒ 首跑、续跑、修复腿同一个词。
  * 入口词是 `plan` 的 run 进不了这条车道(`run-entry.ts` `leaderEntryRefusal`:worker 会话没有计划审阅通道)—— 受理口与出生处同判,到不了 worker。
- * 热改 `AUTONOMY` 只影响之后起的 leader run:在飞的 run 保持它出生时盖下的这一份。
+ * 热改 `AUTONOMY` 只影响之后起的 leader run:在飞的 run(含它后来 provision 的 worker,与经 HTTP 续跑腿赎回的停驻 worker —— 续跑口对带无人值守标的行照写下的体重放,
+ * `http/resume-legs.ts` `replayCtxOf`)保持它出生时盖下的这一份。
  */
 export interface LeaderRunEntry {
     readonly permissionMode?: PermissionMode;

package/dist/leg-facts.d.ts

@@ -1,7 +1,7 @@
 /**
- * 一条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证 · 登记的工作目录 · 继承的项目上下文)—— server 自有的载体,**不搭引擎 spec 的车**。
+ * 一条腿的**部署事实**(执行车道 · run 技能名册 · 受理见证 · 会话绑定 · 继承的项目上下文 · 登记簿默认读层的种子项目)—— server 自有的载体,**不搭引擎 spec 的车**。
  *
- * 规则:`TaskSpec` 是引擎的类型面,上面只放引擎读的成员。本仓装配器(`boot/resolve-spec.ts` 的 `createResolveSpec`)同时还判出五件
+ * 规则:`TaskSpec` 是引擎的类型面,上面只放引擎读的成员。本仓装配器(`boot/resolve-spec.ts` 的 `createResolveSpec`)同时还判出六件
  * 只有 server 自己读的事实 —— 它们以装配器**自己的输出对象**为键登记在这一张表里(单一铸点 {@link mintLegFacts}),由两只漏斗
  * (受理 `http/admission.ts` 的 `prepareSpec` · 续跑 `http/resume-legs.ts` 的 `resolveResumeSpec`)在拿到装配输出的**同一只对象**时
  * 读一次(唯一读口 {@link legFactsOf},读在 `stampSpecRoot` 复制之前),此后作普通值随 `PreparedTaskSubmission.legFacts` /
@@ -19,6 +19,8 @@ import type { ScenarioHands } from "./capabilities/hands-lane.js";
 import type { RunSkillEntry } from "./capabilities/skills.js";
 import type { DelegationRootWitness } from "./delegated-session-owner.js";
 import type { ProjectContext } from "./project-context.js";
+import type { MemorySeed } from "./project-registry.js";
+import type { SessionBindings } from "./session-bindings.js";
 /** 一条腿的部署事实(冻结记录)。 */
 export interface LegFacts {
     /** 执行车道:`none` ⇒ 无手孪生 Runner。读者 = 生产选路器。 */
@@ -28,15 +30,21 @@ export interface LegFacts {
     /** 受理时读根会话行的那一读(会话 id + 住客)。读者 = 腿的会话行记录座(`session-workspace.ts`)。 */
     readonly sessionWitness: DelegationRootWitness;
     /**
-     * 这次提交的根会话登记的工作目录(提交体 `cwd` 经唯一写口 `setSessionCwd` 登记的那一枚;装配器在登记之后读一次)。缺席 = 没登记。
-     * 读者 = 三只组合入口(同步 / 后台 / 续跑腿的梯子与验证门):经 `compositionLegRoot`(`task-cwd.ts`)交给它们驱动的每一条腿当交活方的工作目录。
+     * 这条腿要写在根会话上的绑定(工作目录 · shell 环境 · 继承策略;装配器只算)。读者 = run 认领之后的唯一提交点(`session-bindings.ts` 的 `commitLegBindings`):
+     * 受理的那一刻写这一笔,写了之后才收场 `refused` 的提交由提交出口按回执撤回;以及三只组合入口(同步 / 后台 / 续跑腿的梯子与验证门):工作目录那一格
+     * (这条腿跑在的那一枚)经 `compositionLegRoot`(`task-cwd.ts`)交给它们驱动的每一条腿当交活方的工作目录。
      */
-    readonly registeredCwd?: string;
+    readonly sessionBindings: SessionBindings;
     /**
      * 这条 run 继承到的项目上下文(`project-context.ts`):新提交腿在装配器头部判出的那一份,续跑腿是从续跑重建输入重放的那一份。缺席 = 没继承。
      * 读者 = 提交腿写续跑重建输入的那一笔(`submit-ctx.ts` `persistSubmissionCtx` → `CheckpointCtx.projectContext`):判一次、随 run 冻结。
      */
     readonly projectContext?: ProjectContext;
+    /**
+     * 这条 run 的登记簿默认读层种子(`project-registry.ts`:种子项目 + 判出它的那一位观者;`null` = 提交带了项目、判过,无):新提交腿判出的,续跑腿是从续跑重建输入重放的那一份。
+     * 缺席 = 没什么可判(提交没带项目)或没判过(续跑重放的行早于种子判)。读者 = 提交腿写续跑重建输入的那一笔(`submit-ctx.ts` `persistSubmissionCtx` → `CheckpointCtx.memorySeed`):判一次、随 run 冻结。
+     */
+    readonly memorySeed?: MemorySeed | null;
 }
 /**
  * 铸事实(**单一属主**:只允许 `createResolveSpec` 的出口调用)。同一只对象被第二次铸 ⇒ 当场抛 —— 两个写者是漂移的成因,

package/dist/leg-facts.js

@@ -6,8 +6,9 @@ export function mintLegFacts(resolved, facts) {
         hands: facts.hands,
         skills: Object.freeze(facts.skills.map((e) => Object.freeze({ ...e }))),
         sessionWitness: Object.freeze({ ...facts.sessionWitness }),
-        ...(facts.registeredCwd !== undefined ? { registeredCwd: facts.registeredCwd } : {}),
+        sessionBindings: Object.freeze({ ...facts.sessionBindings, ...(facts.sessionBindings.shellEnv !== undefined ? { shellEnv: Object.freeze({ ...facts.sessionBindings.shellEnv }) } : {}) }),
         ...(facts.projectContext !== undefined ? { projectContext: Object.freeze({ ...facts.projectContext }) } : {}),
+        ...(facts.memorySeed !== undefined ? { memorySeed: facts.memorySeed === null ? null : Object.freeze({ projectId: facts.memorySeed.projectId, viewer: Object.freeze({ ...facts.memorySeed.viewer }) }) } : {}),
     }));
     return resolved;
 }

package/dist/memory-scope.d.ts

@@ -175,8 +175,8 @@ export declare function memoryEngineRootFor(config: Pick<ServiceConfig, "memoryE
  *  记忆搬到 `<localDataRoot>/memory-work`,存量记忆与控制面升级后隐形)。 */
 export declare function fileMemoryEngineRoot(config: Pick<ServiceConfig, "memoryEngineDir">, fallbackRoot?: string): string;
 /**
- * 一条路径的**规范形**(给 {@link judgeMemoryRootOutsideDataRoot} 的 `canonical` 座用的生产实现):
- *  · 既存的绝对路径 ⇒ **原样**交给 `realpath`(`.native`:大小写不敏感的文件系统上返回盘上的拼写;符号链接、macOS 的 `/var` → `/private/var` 在这一步展平)。
+ * 一条路径的**规范形**(给 {@link judgeMemoryRootOutsideDataRoot} 的 `canonical` 座用的生产实现;host 车道的工作区托管判也读它):
+ *  · 既存的绝对路径 ⇒ **原样**交给 `realpath`(core `physicalPathOf` = realpath(3):大小写不敏感的文件系统上返回盘上的拼写;符号链接、macOS 的 `/var` → `/private/var` 在这一步展平)。
  *    不先在字串上折 `..`:操作系统在展开符号链接**之后**才折 `..`,`/link/..` 的真身是链接目标的父目录,字串折叠会把它读成 `/`;
  *  · 其余(尚不存在 / 相对)⇒ 绝对化(**不折叠**)后逐段走:既存的前缀每进一段取一次 `realpath`(符号链接在这一步展开),`..` 折在**已展开**的前缀上 ——
  *    与操作系统同序(`/别名/../新目录` 的真身在链接目标的父目录下;先在字串上折会读成别名的父目录,判到另一只挂载上);第一段不存在起,余下是尚不存在的尾巴
@@ -194,8 +194,9 @@ export declare function canonicalPathOf(p: string): string;
 /**
  * **路径包含**(含相等)的判官:`child` 是不是 `root` 本身或它的后代 —— `path.relative(canonical(root), canonical(child))` 不是 `..`、不以 `..` 加分隔符起头、也不是绝对路径(跨盘符)。
  * `..` 要按**整段**判:名为 `..data` 的子目录在其下;`startsWith("..")` 会把它读成在其外。`canonical` 座缺省 `path.resolve`(字串规范形),boot 递 {@link canonicalPathOf} 取符号链接展平后的形;
- * 两侧同一只座(先 root、后 child)。读者两处:记忆根「在数据根之外」那一判({@link judgeMemoryRootOutsideDataRoot})与起服时「配置根是不是工作区的祖先」那一判(`sema-config-dir.ts`);
- * 树里别处内联的同形表达式(`boot/deployment-mods.ts` · `plugins/local-data-dir-modes-m39.ts` · `plugins/remote-env-host.ts` · `plugins/worktree-isolation.ts`)不在本次收口范围。
+ * 两侧同一只座(先 root、后 child)。读者三处:记忆根「在数据根之外」那一判({@link judgeMemoryRootOutsideDataRoot})、起服时「配置根是不是工作区的祖先」那一判(`sema-config-dir.ts`)
+ * 与 host 车道工厂「腿的目录落在哪只本服务铸的临时根里」那一判(`plugins/remote-env-host.ts`,座 = {@link canonicalPathOf});
+ * 树里别处内联的同形表达式(`boot/deployment-mods.ts` · `plugins/local-data-dir-modes-m39.ts` · `plugins/remote-env-host.ts` 的残余镜像写判 · `plugins/worktree-isolation.ts`)不在本次收口范围。
  */
 export declare function pathIsWithin(root: string, child: string, canonical?: (p: string) => string): boolean;
 /** {@link judgeMemoryRootOutsideDataRoot} 的读数:记忆引擎的根落在本机数据根**之外**。三键即 boot 日志行的字段(`hint` 是一句带两条真路径的人话)。 */