@sema-agent/server 7.150.0 → 7.151.0

package/dist/project-registry.d.ts

@@ -0,0 +1,46 @@
+import type { ProjectRegistration } from "@sema-agent/settings-schema";
+import type { ListFilter } from "./owner-faces.js";
+/** 一张登记簿(键 = 小写规范 UUID;值至少带可见性的属主键)。缺席 = 本部署没有登记簿(`capability-facts.ts` `projectRegistry` 答 no)。 */
+export type ProjectRegistryTable<R> = Readonly<Record<string, R>> | undefined;
+/**
+ * 谓词读的观者事实(列表面视域 {@link ListFilter} 里与登记可见性有关的两格)。`gateOwner` 只拿来与登记的 `registeredBy`(settings-schema 的纯串)逐字节比,
+ * 所以这里收纯串:新提交腿交来的是读面推导出的主体(品牌串,天然是串),续跑腿交来的是冻结时落成字节的那一串(不重铸品牌 —— 它不进任何属主门,只比这一格)。
+ */
+export interface ProjectViewer {
+    readonly fleetWide: ListFilter["fleetWide"];
+    readonly gateOwner: string | null;
+}
+/** 一只登记对这位观者可见吗(唯一判):全舰队视域看全部;否则只看 `registeredBy` 恰是自己的(无身份的观者 `gateOwner = null` 恒看不见)。 */
+export declare function projectVisibleTo(viewer: ProjectViewer, registration: Pick<ProjectRegistration, "registeredBy">): boolean;
+/** 这位观者看得见的那只登记(唯一取法):未登记 / 看不见 / 没有观者 / 本部署没有登记簿 ⇒ 同答 `undefined`。按 id 只认自有键。 */
+export declare function visibleProjectOf<R extends Pick<ProjectRegistration, "registeredBy">>(registry: ProjectRegistryTable<R>, projectId: string | undefined, viewer: ProjectViewer | undefined): R | undefined;
+/** 一条 run 的登记簿默认读层种子:种子项目(这次提交带的、提交者看得见的那只)+ 判出它的那一位观者。随 run 冻结(续跑重建输入 `CheckpointCtx.memorySeed`)。 */
+export interface MemorySeed {
+    readonly projectId: string;
+    readonly viewer: ProjectViewer;
+}
+/**
+ * 新提交腿的种子判(一条 run 一次):这次**提交**没带项目 ⇒ `undefined`(没什么可判);带了而对提交者可见 ⇒ 种子;带了而判不出(未登记 / 看不见 / 没有观者 / 没有登记簿)
+ * ⇒ `null`(判过,无 —— 冻结下来,续跑腿据它与「停驻在种子判出现之前」分开)。
+ */
+export declare function memorySeedOf(registry: ProjectRegistryTable<Pick<ProjectRegistration, "registeredBy">>, submittedProjectId: string | undefined, viewer: ProjectViewer | undefined): MemorySeed | null | undefined;
+/** 种子的词(两腿同调):种子的那一位观者此刻仍看得见的那只登记声明的 `defaultScopes`;没有种子 / 判过无 / 登记已不在 / 不再对他可见 ⇒ 缺席。 */
+export declare function memorySeedScopesOf(registry: ProjectRegistryTable<Pick<ProjectRegistration, "registeredBy" | "defaultScopes">>, seed: MemorySeed | null | undefined): string[] | undefined;
+/** 续跑重建输入里冻结的种子的读数:缺席(提交没带项目 / 本格出现之前写下的行)· 判过无(`null`)· 读得出 · 形不对。 */
+export type FrozenMemorySeedReading = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "none";
+} | {
+    readonly kind: "ok";
+    readonly seed: MemorySeed;
+} | {
+    readonly kind: "malformed";
+};
+/**
+ * 冻结的种子的**唯一读法**(读者 = `http/resume-ctx-read.ts` 的续跑上下文读口,开封之后、任何续跑消费者之前)。服务端写下的形是闭集({@link memorySeedOf} 铸、经部署事实落盘):
+ * `null`(判过,无)或 `{ projectId, viewer: { fleetWide, gateOwner } }` —— `projectId` = 规范小写 UUID;`fleetWide` 布尔;`gateOwner` = 非空串(冻结时落成字节的主体,原样)或 `null`;
+ * 观者至少看得见点什么(`fleetWide` 或 `gateOwner` 在场 —— 看不见的提交不冻结种子)。别的形 ⇒ `malformed`(读口答坏体:续跑不按它挑种子)。
+ */
+export declare function frozenMemorySeedOf(stored: unknown): FrozenMemorySeedReading;
+//# sourceMappingURL=project-registry.d.ts.map

package/dist/project-registry.js

@@ -0,0 +1,44 @@
+import { PROJECT_ID_REGEX } from "@sema-agent/core";
+export function projectVisibleTo(viewer, registration) {
+    return viewer.fleetWide || registration.registeredBy === viewer.gateOwner;
+}
+export function visibleProjectOf(registry, projectId, viewer) {
+    if (registry === undefined || projectId === undefined || viewer === undefined || !Object.hasOwn(registry, projectId))
+        return undefined;
+    const registration = registry[projectId];
+    return registration !== undefined && projectVisibleTo(viewer, registration) ? registration : undefined;
+}
+export function memorySeedOf(registry, submittedProjectId, viewer) {
+    if (submittedProjectId === undefined)
+        return undefined;
+    if (viewer === undefined || visibleProjectOf(registry, submittedProjectId, viewer) === undefined)
+        return null;
+    return { projectId: submittedProjectId, viewer: { fleetWide: viewer.fleetWide, gateOwner: viewer.gateOwner } };
+}
+export function memorySeedScopesOf(registry, seed) {
+    return visibleProjectOf(registry, seed?.projectId, seed?.viewer)?.defaultScopes;
+}
+export function frozenMemorySeedOf(stored) {
+    if (stored === undefined)
+        return { kind: "absent" };
+    if (stored === null)
+        return { kind: "none" };
+    const own = (o, k) => (Object.hasOwn(o, k) ? o[k] : undefined);
+    const closedObject = (v, keys) => typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).every((k) => keys.includes(k));
+    if (!closedObject(stored, ["projectId", "viewer"]))
+        return { kind: "malformed" };
+    const projectId = own(stored, "projectId");
+    const viewer = own(stored, "viewer");
+    if (typeof projectId !== "string" || !PROJECT_ID_REGEX.test(projectId) || projectId !== projectId.toLowerCase())
+        return { kind: "malformed" };
+    if (!closedObject(viewer, ["fleetWide", "gateOwner"]))
+        return { kind: "malformed" };
+    const fleetWide = own(viewer, "fleetWide");
+    const gateOwner = own(viewer, "gateOwner");
+    if (typeof fleetWide !== "boolean" || (gateOwner !== null && (typeof gateOwner !== "string" || gateOwner.length === 0)))
+        return { kind: "malformed" };
+    if (!fleetWide && gateOwner === null)
+        return { kind: "malformed" };
+    return { kind: "ok", seed: { projectId, viewer: { fleetWide, gateOwner } } };
+}
+//# sourceMappingURL=project-registry.js.map

package/dist/request-key-closure.js

@@ -29,7 +29,7 @@ const TASK_BODY_DECLARED_KEYS = [
     "outputSchema", "permissionMode", "projectId", "projectMemory", "promptLean", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",
     "rewindFilesTo", "sandboxImageProfile", "scenario", "scratchpadDir", "selfOrchestration",
-    "sessionId", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
+    "sessionId", "sessionKind", "settings", "skills", "suggestNextPrompts", "systemPrompt", "taskId", "toolMaterializeStrategy",
     "userAttachments", "userInvokedSkills", "verify", "verifyRounds",
 ];
 const TASK_BODY_SCENARIO_KEYS = ["repo"];

package/dist/request-value-closure.d.ts

@@ -148,5 +148,9 @@ export interface InheritEnvFieldIssue {
  * 句子对两种坏值形是同一句(点名两词与「名单不是请求值」);`reason` 区分它们。
  */
 export declare function inheritEnvFieldIssue(raw: unknown): InheritEnvFieldIssue | null;
+/** 词表外的拒句(wire 可见、字节冻结在 `test/api-error-text-freeze.test.ts` 的常量锚格)。 */
+export declare const SESSION_KIND_VALUE_MESSAGE: string;
+/** `sessionKind` 在场且不在闭集里 ⇒ 拒句;缺席或合法 ⇒ `null`(只在 fresh 受理门调)。 */
+export declare function sessionKindFieldIssue(raw: unknown): string | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -1,3 +1,4 @@
+import { SESSION_KINDS, isSessionKind } from "./session-kind.js";
 export const MEMORY_CAPTURE_SPELLING_MESSAGE = "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)";
 export const MEMORY_OFF_SPELLING_MESSAGE = "memory must be the string 'off' when present (the request-level declaration that this run mounts no memory face at all; absent = memory as usual — there is no 'on' spelling; to keep memory mounted but stop this session's content from entering long-term memory, send memoryCapture: 'off' instead)";
 export const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be the string 'disabled' when present (the request-level declaration that this run records no file history — no backup of an edited file, and no file restore in the same request; absent = the deployment's setting — there is no 'enabled' spelling)";
@@ -49,4 +50,13 @@ export function inheritEnvFieldIssue(raw) {
         return null;
     return { message: INHERIT_ENV_VALUE_MESSAGE, facts: inheritEnvFacts(typeof value === "string" ? "unknown_word" : "not_a_string") };
 }
+export const SESSION_KIND_VALUE_MESSAGE = `sessionKind must be one of ${SESSION_KINDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
+    `("sidechain" = the session this submission creates is a client-placed sub-conversation: it is not listed by GET /v1/sessions unless asked for with ?sessionKind=sidechain, ` +
+    `and it is deleted after BG_AGENT_RETENTION_MS of inactivity; absent = a top-level conversation) — the kind is written once, when the session is created`;
+export function sessionKindFieldIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const value = raw.sessionKind;
+    return value === undefined || isSessionKind(value) ? null : SESSION_KIND_VALUE_MESSAGE;
+}
 //# sourceMappingURL=request-value-closure.js.map

package/dist/run-acceptance.d.ts

@@ -76,12 +76,13 @@ export interface RunAcceptance {
     observe(ev: {
         type: string;
     }): Promise<void>;
-    /** 终局落行之后:还没在流上见过受理帧、而结果里跑过 turn(只回结果的腿)⇒ 受理。只读 `stats.turns`。不抛、不等。 */
+    /** 结果到手、**放掉这条 run 的认领之前**(收场写 / 停驻提交之前):还没在流上见过受理帧、而结果里跑过 turn(只回结果的腿)⇒ 受理。只读 `stats.turns`。不抛;
+     *  交回的那一拍等标题器钉住要起名的住客(有界一读;认领在手 ⇒ 会话删不掉 ⇒ 住客就是这条 run 的)与补写落定 —— 腿 await 它再放认领。 */
     settle(result: {
         readonly stats: {
             readonly turns: number;
         };
-    }): void;
+    }): Promise<void>;
     /** 提交那一刻就知道的交付文本(腿上没有屏 ⇒ 请求原文);腿上有屏 ⇒ 缺席:各面提交时不写,交付时经 {@link onDelivered} 补。 */
     readonly objectiveAtSubmit: string | undefined;
     /**

package/dist/run-acceptance.js

@@ -35,11 +35,10 @@ export function createRunAcceptance(deps, input) {
         delivered = objective;
         if (objective === undefined)
             return Promise.resolve();
-        if (input.sessionId)
-            deps.sessionTitler?.maybeTitle(input.sessionId, objective, input.model, deliver);
+        const titled = input.sessionId ? (deps.sessionTitler?.maybeTitle(input.sessionId, objective, input.model, deliver) ?? Promise.resolve()) : Promise.resolve();
         if (!input.screened)
-            return Promise.resolve();
-        return Promise.all(fills.map(({ face, fill }) => runFill(face, fill, objective))).then(() => undefined);
+            return titled;
+        return Promise.all([titled, ...fills.map(({ face, fill }) => runFill(face, fill, objective))]).then(() => undefined);
     };
     return {
         objectiveAtSubmit: input.screened ? undefined : input.objective,
@@ -51,8 +50,7 @@ export function createRunAcceptance(deps, input) {
             return Promise.resolve();
         },
         settle(result) {
-            if (result.stats.turns > 0)
-                void accept(input.screened ? undefined : input.objective);
+            return result.stats.turns > 0 ? accept(input.screened ? undefined : input.objective) : Promise.resolve();
         },
         onDelivered(face, fill) {
             if (!input.screened)

package/dist/run-local.js

@@ -637,6 +637,7 @@ export async function runLocal(argv, deps = {}) {
         sharedMemoryStores: undefined,
         mcpRevocations: undefined,
         peerDesk,
+        runtimeCapsResolver: undefined,
     });
     const runnerDeps = {
         ...sharedRunnerDeps,

package/dist/runs.d.ts

@@ -17,6 +17,9 @@ import type { RunAcceptance } from "./run-acceptance.js";
 import type { SessionWorkspaceRecorder } from "./session-workspace.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
 import { type ParkLedgerEventType } from "./trace/ledger-events.js";
+import type { LandedAttendantSeat } from "./plugins/landed-attendants.js";
+import type { DelegationRootWitness } from "./delegated-session-owner.js";
+import type { SessionFace } from "./session-incarnation.js";
 import type { UserInputLedger } from "./user-input-ledger.js";
 /**
  * stoppedBy (core 1.252): a service cancel is a USER stop — mark the run's still-running background
@@ -27,8 +30,8 @@ import type { UserInputLedger } from "./user-input-ledger.js";
  * cross-replica flag poll). Advisory only — the cancel itself must never fail on attribution.
  *
  * Access = TASK-scoped children ONLY: owner = the parent taskId (on a RESUME leg: the sessionId — core's
- * canonical taskId there), scope = `principal ?? "default"` (core registers children under
- * `spec.principal ?? "default"`, so an anonymous run's children live in scope "default" and an access
+ * canonical taskId there), scope = the engine-identity cell `engineScopeOfOwner(subject)` (core registers
+ * children under its task scope, so an anonymous run's children live in scope "default" and an access
  * WITHOUT scope matched nothing). Session-scoped children are DELIBERATELY not marked: a cancelled parent
  * does NOT take them down (CC Backgrounded semantics — core's teardown reaps with skipSessionScoped), so
  * pre-marking them "user" would misattribute a stop that isn't happening.
@@ -201,10 +204,36 @@ export type ResumeAnchorLeg = "stream" | "sync" | "bg" | "resume";
  * 到期只放手不取消:那次写照常在飞,迟到落定的锚照样可用(迟到的失败被吞,不重复计数)。
  * 用户面的读数仍只有一处:会话视图用户消息行的 `taskId?`(present-iff 锚在)与 `resumeAt` 的 404 `resume_at.unknown_event`。
  */
-export declare function settleResumeAnchor(write: () => Promise<void>, where: {
+export declare function settleResumeAnchor(write: (held: () => boolean) => Promise<void>, where: {
     readonly leg: ResumeAnchorLeg;
     readonly kind: "prompt" | "turn";
 }): Promise<void>;
+/** 一条运行腿的两只回退锚写口(缺席 = 这条腿没有那一种锚:没有落定席位 / 没有提示手柄 / 没有叶子读)。 */
+export interface RunAnchorWriter {
+    /** 用户提示锚:键 = 这条 run 的 id(客户端手里的回退手柄),值 = 那条用户提交的条目 id。 */
+    readonly prompt?: (entryId: string, held: () => boolean) => Promise<void>;
+    /** 助手文本锚:键 = 这一轮第一个 text 帧的 eventId,值 = 此刻会话的叶子。 */
+    readonly turn?: (eventId: string, held: () => boolean) => Promise<void>;
+}
+/**
+ * **运行腿回退锚的唯一写法**(后台腿 / 同步腿 / 流式腿 / 续跑腿同一只):锚只经落定席位的 `putAnchors` 落(`plugins/landed-attendants.ts`:段首锁会话根行判住客),
+ * 住客 = **这条 run 自己的那一位** —— 受理时见证到的(`LegFacts.sessionWitness`,带化身);见证里还没有化身(这条腿新建了会话)⇒ 第一笔锚之前读一次头钉住。
+ * 钉住发生在腿还在等这一笔的期限之内(`held()`:腿被这一笔挡着 ⇒ run 在跑、认领在手 ⇒ 会话删不掉),到期之后才完成的钉住不发写;已发出的写到期只放手不取消
+ * (`settleResumeAnchor`),但它绑着钉住的那一位 —— run 收场、会话被删、同 id 被别人重建之后才落的那一笔落不进新住客,也落不进空闲 id(段判「不是那一位」⇒ 零写,
+ * 记一次同一只 fail-open,`reason=error`)。没有席位 ⇒ 两只都缺席(这台部署不存锚)。
+ */
+export declare function createRunAnchorWriter(args: {
+    readonly seat: Pick<LandedAttendantSeat, "putAnchors"> | undefined;
+    readonly sessionId: string;
+    readonly owner: string | null;
+    /** 用户提示锚的键(这条 run 的 id);缺 ⇒ 不写提示锚(没有手柄 / 续跑腿接着别的腿的 run)。 */
+    readonly promptKey: string | undefined;
+    readonly witness: DelegationRootWitness | undefined;
+    /** 头读投成的住客(属主存取器的 `sessionOccupantReadOf`);缺 ⇒ 见证里没有化身时钉不住 ⇒ 不写。 */
+    readonly occupantOf: ((sessionId: string) => Promise<SessionFace | undefined>) | undefined;
+    /** 会话此刻的叶子(属主存取器的 `sessionFactsReadOf` 投影);缺 ⇒ 不写助手文本锚。 */
+    readonly leafOf: ((sessionId: string) => Promise<string | null | undefined>) | undefined;
+}): RunAnchorWriter;
 export declare class TurnAnchorCapture {
     private readonly capture;
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
@@ -227,7 +256,7 @@ export declare class TurnAnchorCapture {
     private turnHadTool;
     /** 用户提交是不是开场提示的唯一读法({@link createPromptCommitReader};开场窗 + 闩 —— 开场提示之后打断标记 / steer 不改锚;附件帧不是提问)。 */
     private readonly promptCommit;
-    constructor(capture: ((eventId: string) => Promise<void>) | undefined, 
+    constructor(capture: ((eventId: string, held: () => boolean) => Promise<void>) | undefined, 
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
     leg: Exclude<ResumeAnchorLeg, "stream">, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
@@ -242,7 +271,7 @@ export declare class TurnAnchorCapture {
      *  user-role commit in the same run — the interruption marker, a steer — never moves it. The capture instance is per
      *  run: a leg that CONTINUES an existing run (same taskId) wires no `captureUser` (its opening prompt was anchored
      *  by the first leg). */
-    captureUser?: ((entryId: string) => Promise<void>) | undefined);
+    captureUser?: ((entryId: string, held: () => boolean) => Promise<void>) | undefined);
     /** A `human_input` arrived — the objective's declared attachments open the frame window of {@link createPromptCommitReader} (another applied input inside the window voids it). */
     onHumanInput(ev: {
         readonly type: string;
@@ -359,7 +388,7 @@ cascade?: CascadeConfig, instrumentDegenerate?: (result: TaskResult) => void, pl
 elicitOwner?: string | null, 
 /** E18 resume-at: capture the turn's (firstTextEventId → leaf entryId) anchor at each turn_end. Built by the caller
  *  closing over {sessionId, owner, the session store's head read (`headOf(id)?.leafId`), resumeAnchorStore}; undefined ⇒ no anchor store wired. */
-captureTurnAnchor?: (eventId: string) => Promise<void>, 
+captureTurnAnchor?: (eventId: string, held: () => boolean) => Promise<void>, 
 /** MF-Fleet (shell-host contract): the run-scoped fleet-row publisher. `onStart` adds the live row; `onEvent` accrues
  *  tokens (turn_end) + subagent child rows (task_progress); `onTerminal` flips/removes it. Fired for ALL legs
  *  (verify/cascade/plain-stream) so a background run TRANSITIONS its `GET /v1/fleet/stream` row exactly like the
@@ -367,7 +396,7 @@ captureTurnAnchor?: (eventId: string) => Promise<void>,
 fleetPublisher?: FleetRunPublisher, 
 /** R8 (CC-parity rewind): capture a USER-message anchor (keyed by this run's taskId) from `message_committed{role:"user"}`
  *  — the CC "rewind to the prompt" target. undefined ⇒ no anchor store wired. */
-captureUserMessageAnchor?: (entryId: string) => Promise<void>, 
+captureUserMessageAnchor?: (entryId: string, held: () => boolean) => Promise<void>, 
 /** §4④ : AskUserQuestion LIVE coordinator — establishes a per-run onQuestion ALS context (like `elicitation`)
  *  so an AskUserQuestion tool call routes to this run's stream + owner-gated respond. undefined ⇒ headless default. */
 question?: QuestionCoordinator, 
@@ -457,7 +486,7 @@ workspaceRecorder?: SessionWorkspaceRecorder,
  */
 runSkills?: readonly RunSkillEntry[], 
 /**
- * 这次提交登记的工作目录(部署事实 `LegFacts.registeredCwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
+ * 这条腿跑在的工作目录(部署事实 `LegFacts.sessionBindings.cwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
  * 梯子的级 / 验证器腿跑在引擎现铸的会话里,工厂按会话读不到它;普通流形跑在根会话上,工厂自己读得到。缺席 = 没登记 ⇒ 每一条腿照旧落临时目录。
  */
 registeredCwd?: string): Promise<void>;

package/dist/runs.js

@@ -9,9 +9,8 @@ import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js"
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withSubject } from "./observability/principal-context.js";
-import { partsOf } from "./owner-brands.js";
 import { recoveredSubject } from "./owner-faces.js";
-import { taskSpecIdentityOf } from "./engine-identity.js";
+import { engineScopeOfOwner } from "./engine-identity.js";
 import { withModelReachScope } from "./model-reach-scope.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
@@ -62,11 +61,10 @@ export async function taskHandleStop(registry, handle, access, agentStore) {
     return registry.stopTask(handle, access);
 }
 export function markChildrenStoppedByUserOnAbort(signal, taskId, subject) {
-    const recovered = recoveredSubject(subject);
-    const principal = taskSpecIdentityOf(recovered === undefined ? undefined : partsOf(recovered)).principal;
+    const scope = engineScopeOfOwner(subject);
     const mark = () => {
         try {
-            defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope: principal ?? "default" }, "user", { skipSessionScoped: true });
+            defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope }, "user", { skipSessionScoped: true });
         }
         catch {
         }
@@ -79,6 +77,10 @@ export function markChildrenStoppedByUserOnAbort(signal, taskId, subject) {
 }
 const EXECUTION_ENV_REFUSAL_HTTP_STATUS = {
     "env.home_unconfirmed": 409,
+    "env.snapshot_bucket_missing": 409,
+    "env.occupant_missing": 409,
+    "env.sandbox_refused": 409,
+    "env.host_key_rejected": 409,
 };
 const PREPARE_REFUSAL_HTTP_STATUS = {
     "resume.session_not_found": 404,
@@ -234,13 +236,52 @@ export function createPromptCommitReader() {
     };
 }
 export async function settleResumeAnchor(write, where) {
+    let open = true;
     try {
-        await withinIoDeadline(write);
+        await withinIoDeadline(() => write(() => open));
     }
     catch (err) {
         const why = err instanceof IoDeadlineExceeded ? `reason=timeout boundMs=${BASELINE_IO_DEADLINE_MS}` : `reason=error error=${err instanceof Error ? err.message : String(err)}`;
         recordFailOpen("server.resume-anchor.capture-failed", `leg=${where.leg} kind=${where.kind} ${why}`);
     }
+    finally {
+        open = false;
+    }
+}
+export function createRunAnchorWriter(args) {
+    const { seat, sessionId, owner, promptKey, witness, occupantOf, leafOf } = args;
+    if (seat === undefined)
+        return {};
+    let pinned = witness !== undefined && witness.incarnation !== null ? { owner: witness.owner, incarnation: witness.incarnation } : undefined;
+    const pin = async () => (pinned ??= await occupantOf?.(sessionId));
+    const put = async (landed, eventId, entryId) => {
+        const out = await seat.putAnchors(sessionId, landed, [{ eventId, entryId }], owner);
+        if (!out.landed)
+            throw new Error("the session's occupant is no longer this run's — the anchor was not written");
+    };
+    return {
+        ...(promptKey !== undefined
+            ? {
+                prompt: async (entryId, held) => {
+                    const landed = await pin();
+                    if (landed !== undefined && held())
+                        await put(landed, promptKey, entryId);
+                },
+            }
+            : {}),
+        ...(leafOf !== undefined
+            ? {
+                turn: async (eventId, held) => {
+                    const landed = await pin();
+                    if (landed === undefined || !held())
+                        return;
+                    const leaf = await leafOf(sessionId);
+                    if (leaf)
+                        await put(landed, eventId, leaf);
+                },
+            }
+            : {}),
+    };
 }
 export class TurnAnchorCapture {
     capture;
@@ -262,7 +303,7 @@ export class TurnAnchorCapture {
         const prompt = this.promptCommit(committed);
         const captureUser = this.captureUser;
         if (prompt !== undefined && captureUser)
-            await settleResumeAnchor(() => captureUser(prompt), { leg: this.leg, kind: "prompt" });
+            await settleResumeAnchor((held) => captureUser(prompt, held), { leg: this.leg, kind: "prompt" });
     }
     onText(eventId) {
         if (this.firstTextEventId === undefined) {
@@ -278,7 +319,7 @@ export class TurnAnchorCapture {
         const capture = this.capture;
         const handle = this.firstTextEventId;
         if (handle && !this.turnHadTool && capture)
-            await settleResumeAnchor(() => capture(handle), { leg: this.leg, kind: "turn" });
+            await settleResumeAnchor((held) => capture(handle, held), { leg: this.leg, kind: "turn" });
         this.firstTextEventId = undefined;
         this.turnHadTool = false;
     }
@@ -388,6 +429,7 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
         await sink.appendParked(word, grafted);
         const sealed = sealResultForExit(grafted);
         reached = { kind: word, result: sealed };
+        await acceptance?.settle(sealed);
         const committed = await commitParkRow({
             runStore, taskId, word, result: sealed, card: { token, sessionId: spec.sessionId }, cards: checkpointCards, leg: "bg",
             legId: parkCommit.legId, staleWindowMs: parkCommit.runStaleSec === undefined ? undefined : parkCommit.runStaleSec * 1000,
@@ -396,7 +438,6 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
             reached = undefined;
             settledAsCancel = committed.row?.errorCode === CANCELLED_CODE;
         }
-        acceptance?.settle(sealed);
     };
     const settleLegResult = async (engineResult) => {
         const result = atHostBoundary(engineResult);
@@ -410,10 +451,10 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
         const safe = await withModelUsage(sealResultForExit(settled));
         await sink.appendDone(safe);
         reached = { kind: "done", result: safe };
+        await acceptance?.settle(safe);
         const plane = outwardPlane(safe.terminal);
         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
         await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
-        acceptance?.settle(safe);
     };
     const instructionLeg = createInstructionSelectionLeg();
     const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkills }), usage: { modelUsage, taskId } });
@@ -609,12 +650,12 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
             if (reached?.kind === "done") {
                 const plane = outwardPlane(reached.result.terminal);
                 settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
+                await acceptance?.settle(reached.result);
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
                 await releaseKeyIfZeroWorkRefusal(runStore, taskId, reached.result);
-                acceptance?.settle(reached.result);
             }
             else if (reached !== undefined) {
-                acceptance?.settle(reached.result);
+                await acceptance?.settle(reached.result);
             }
             else if (thrownCancelCause === undefined && observedDone !== undefined && heldParkOf(atHostBoundary(observedDone)) !== undefined) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=park-held ${message}`);

package/dist/runtime-governance.d.ts

@@ -92,8 +92,9 @@ export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefi
  * `plan` 是有出口的**生命周期词**(`plan_review` 把计划带出 plan),不是围栏:它是**提交入口的模式词地板**({@link autonomyModeFloor}),
  * 盖在每一个 spec 出生点一次(词 = {@link entryPermissionMode} 的 `effective`):受理门盖进存储的提交体(`task-settings.ts` `stampEntryPermissionMode`)、run-local 盖在它自建的 spec 上、
  * leader run 盖在它出生时的入口体上(`leader/run-entry.ts`;入口词是 `plan` 的 leader run 进不了那条车道 —— worker 会话没有计划审阅通道 ⇒ 受理口响亮拒)。此后一条 run 的模式词
- * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)与 `plan_review` 写回。按段折一个模式词 = 第二个源:被批准的计划会在下一次挂起→续跑
- * 被拉回 plan。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
+ * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)、`plan_review` 写回与续跑口(停驻 run 的存储体被重放之前过一次**现**地板、
+ * 钳过的随 CAS 赢点写回;`permission-mode-admission.ts` `stampReplayEntryMode`,地板的出口词 —— `plan_review` 批准写下的词 —— 原样读)。按段折一个模式词 = 第二个源:
+ * 被批准的计划会在下一次挂起→续跑被拉回 plan;续跑口不是按段折 —— 它与提交口同一只入口一步,写的是同一个源,且不碰出口词。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
  * 写面 `roots`、与 `read-only` 同形 —— 运维 plan 那时根本不进 plan 模式,见下一段。)
  *
  * 🔴 **为什么 `plan` 不再与 `read-only` 同形**:修前两档同映「只读手 + roots」,外加 `resolve-spec.ts` 见只读手就剥委派工具 —— 于是 `plan` 有三套
@@ -145,8 +146,8 @@ export interface EntryPermissionMode<W extends PermissionMode | undefined = Perm
  *    无人值守腿(`unattended-permission-mode.ts` `withUnattendedLeg`:`default` 钳在 spec 的词之下);
  *  · 「这个词会变成什么」的读者 —— 能力面写面开不开({@link autonomyKeepsOpenWriteFace}:bypass 声明过地板)、能力面 auto 读面
  *    (`auto-mode-face.ts` `judgeAutoModeArming`:意图过地板;`clamped` 且不是 auto ⇒ 未武装原因 `operator_floor`)、
- *    存量停驻体能否按此刻的地板重放(`http/stored-body-replay.ts`:体的词经钳会变 ⇒ 拒)。
- * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,上面八处各调本函数一次。
+ *    受理判官的入口一步(`permission-mode-admission.ts` `entryStep`:提交口盖章、在飞切档口、续跑口 —— 停驻 run 的存储体被重放之前过**现**地板 —— 三口同经这一处)。
+ * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,本函数七处调用点各一次。
  */
 export declare function entryPermissionMode<W extends PermissionMode | undefined>(word: W, floor: PermissionMode | undefined): EntryPermissionMode<W>;
 /**

package/dist/security.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage } from "node:http";
+import type { EntriesStreamOptions } from "./session-sync-kernel.js";
 import { type SessionHead, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { Logger } from "./observability/logger.js";
@@ -9,6 +10,8 @@ import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
 import type { SessionDeletionFace } from "./session-deletion.js";
 import { type SessionBirth } from "./session-incarnation.js";
+import { type IdleSession, type IdleSessionCursor, type SessionKind, type SessionKindReading } from "./session-kind.js";
+import type { SessionListQuery } from "./plugins/store-contracts.js";
 import type { ClientSessionRowWrite, ReplaySessionRowWrite, ReplaySessionRowWriteOutcome, SessionRowAnswer, SessionRowPatch, SessionRowWriteOutcome } from "./session-row.js";
 import type { ExecutionPlacementSeat } from "./execution-placement.js";
 import type { SessionUnreadable } from "./session-error-wire.js";
@@ -56,6 +59,10 @@ export interface SessionListItem {
      *  by a fork after lineage was recorded (an older fork is not backfilled: its source is unknown). OMIT-when-absent, never `null`. Additive key, passed
      *  through unprojected (`sessions-list.ts`). Same name and meaning as `SessionSummary.forkedFrom` in `plugins/store-contracts.ts`. */
     forkedFrom?: string;
+    /** The session's kind (`session-kind.ts`): present-iff the session was created by a submission that declared `sessionKind`; a top-level session
+     *  never carries it (OMIT-when-absent, never `null`). The default list view lists only top-level sessions; `?sessionKind=<word>` lists that kind.
+     *  Additive key, passed through unprojected (`sessions-list.ts`). Same name and meaning as `SessionSummary.sessionKind` in `plugins/store-contracts.ts`. */
+    sessionKind?: SessionKind;
 }
 /**
  * 会话店的行格写原语(规则与判序:`session-row.ts` 头注「写原语」)—— 按入口分两只重载:客户端写(PATCH)的结局闭集四员;行重放(2c 导入落定后的那一笔)
@@ -74,7 +81,7 @@ export interface SessionRowCellsWriter {
  * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
  * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一风险形、爆炸半径**更大**,却没门。
  *
- * 风险形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * 风险形逐字同源(守卫自己的注释):「请求没带凭据门认的凭据 + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
  * fleet 写档(面表 fleet 列的 `dev_open` 格,`owner-faces.ts` 的 `listFilterOf`)判 fleet-wide ⇒ 集群内**任意**不报主体的调用方可对**任意** session 动手(报了主体的调用方只动得到那位主体的,`principal-gate.ts` 的 `actsForDeployment`)。
  * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
  *
@@ -104,6 +111,10 @@ export type SessionOwnerCell = {
 export declare function claimCallerOf(subject: Subject | undefined, config: DeploymentShapeInput<"principal">): Caller;
 /** 提交挂接「没有这只会话」那一答的句子(requireExisting 缺行与认领面看不见同一句;投影 `attach_absent`)。 */
 export declare const ATTACH_ABSENT_MESSAGE = "requireExistingSession: session does not exist (resume.session_not_found)";
+/** 带种类的提交撞上一只种类不同的既有会话的 409(律 `session-kind.ts`):体上机读位 `sessionKind` = 行上的词(顶层行缺席)。句子不回显请求的词以外的任何行事实。 */
+export declare const SESSION_KIND_MISMATCH_MESSAGE = "this session already exists with a different session kind \u2014 a session's kind is written once, when the session is created, and never changes; send the same sessionKind the session was created with, omit sessionKind to run the session as it is, or start a new session";
+/** 部署记不了种类(会话店没有出生回执面 / 种类读)⇒ 400 `request.precondition_unmet`(受理门读同一只能力事实 `capability-facts.ts` 的 `sessionKinds`,先拒在那里;这里是纵深)。 */
+export declare const SESSION_KIND_UNRECORDABLE_MESSAGE = "sessionKind requires a session store that records a session's kind and ages such sessions out (DB_BACKEND=mysql|pg|local) \u2014 this deployment cannot, so the session would be created as a top-level conversation; capabilities.sessionKinds lists the kinds a deployment accepts";
 /** 读一只会话行的 {@link SessionOwnerCell}:有主行 = 属主那一格(`owner-faces.ts` 的 `ownerCellOf`,属主列读数的唯一铸法);无主时问一次店的 `placementOf`
  *  (既有读口;店不交它 = 不实现 placement = 没有 placed 行)。`owner` = 调用点那一读。 */
 export declare function sessionOwnerCellOf(store: Pick<OwnerAwareSessionStore, "placementOf"> | undefined, sessionId: string, owner: string | null): Promise<SessionOwnerCell>;
@@ -141,29 +152,19 @@ export type OwnerAwareSessionStore = SessionStore & {
      *  `includeUnowned` = [ref] 窄互认第二臂的**第三条件**(`owner IS NULL`)的 SQL 承载位:置真时
      *  谓词放宽为 `owner = ? OR owner IS NULL`。只在 `owner` 在场时有意义(路由已判①③);`owner` 缺席
      *  (fleet-wide)时本位无效——那一面本来就不钉 owner。 */
-    listSessions?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<SessionListItem[]>;
+    listSessions?: (opts: SessionListQuery) => Promise<SessionListItem[]>;
     /** The SAME list face as {@link listSessions} (same SELECT, same mapper, same predicate and keyset) with each row's occupant — the row's owner and
      *  incarnation as read in that one read. The incarnation never enters the row (it is not a wire fact: `session-incarnation.ts`); this pair is for the
      *  in-process reader that must address a row by occupant — the peer directory's `PeerSessionRecord.occupant`. `listSessions` is this face's rows. */
-    listSessionRows?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<Array<SessionRowAnswer<SessionListItem>>>;
+    listSessionRows?: (opts: SessionListQuery) => Promise<Array<SessionRowAnswer<SessionListItem>>>;
+    /** 按 id 的种类读(律 `session-kind.ts`;授权口的种类判与会话视图的 `sessionKind` 读它):读到它时行上的住客 + 种类。三只持久店都交,包装原样转发。 */
+    sessionKindOf?: (sessionId: string) => Promise<SessionKindReading | undefined>;
+    /** 老化候选面(律 `session-kind.ts`;唯一读者 = 维护拍的老化腿 `boot/session-age-out.ts`):种类为 `kind`、最后活动早于 `idleBefore`、当下无活引用的会话(在删的照交),
+     *  最老先出、`(lastActivityAt, sessionId)` 升序 keyset 续页(`after` = 上一页最后一条)。与 `listPlaced`、删除面 `pending()` 同族的用途专一枚举 —— 不出列表投影。 */
+    listIdleOfKind?: (kind: SessionKind, idleBefore: Date, page: {
+        readonly after?: IdleSessionCursor;
+        readonly limit: number;
+    }) => Promise<IdleSession[]>;
     /** ONE session's list row — the SAME projection {@link listSessions} emits for it (same columns, same mapper). `undefined` = not a
      *  row of the list face (no such session, or a placed / delegation-transcript session, which never lists). Reader: the 2c
      *  manifest (`title` / `pinned`). */
@@ -215,10 +216,7 @@ export type OwnerAwareSessionStore = SessionStore & {
      *  `opts.batchSize` is the page size (default 500). Resolves to `null` (NOT an empty iterable) when the session does
      *  not exist (the existence probe is async — `session_meta` first, like {@link exportEntries} — so the method returns
      *  a Promise of the iterable-or-null; the iterable itself then pages lazily). The read half of exportEntries, paged. */
-    exportEntriesStream?: (sessionId: string, opts?: {
-        afterSeq?: number;
-        batchSize?: number;
-    }) => Promise<AsyncIterable<SessionTreeEntry> | null>;
+    exportEntriesStream?: (sessionId: string, opts: EntriesStreamOptions) => Promise<AsyncIterable<SessionTreeEntry> | null>;
     /** 2c session-sync — IMPORT a verbatim entry log into `sessionId`, re-stamping `owner` to the
      *  authenticated importing principal (never the bundle's). The log is passed through core's
      *  `validateEntriesForImport` (the single fail-closed invariant gate) before any write. */
@@ -303,7 +301,7 @@ export interface AuthContext {
      *  `PROJECT_ID_REGEX` 门后折小写回传;[ref]/[ref] 宽读严写 —— 词法带 /i 收下大写形,但派生 scope 键
      *  与 config.projects 查表都只认这一个归一形,否则同一个项目会按大小写分成两只记忆盘)。
      *  身份半场(scope 的 tenant 段)永远来自 verified principal — projectId 只选「哪个项目盘/哪条登记」
-     *  (config.projects 查表键 + proj: 键的 projectId 段),不是 capability。main.ts 拿它查 defaultScopes。 */
+     *  (config.projects 查表键 + proj: 键的 projectId 段),不是 capability。装配器拿它判 defaultScopes 种子项目(对提交者可见才算,`project-registry.ts`)。 */
     resolvedProjectId?: string;
 }
 /** 授权口的入参:请求、体,与提交出口收候选的口(`submission-exit.ts`;只有登记了新行才调,传了也可能一次不调)。 */
@@ -385,9 +383,9 @@ export declare const CHECKPOINT_PUBLIC_SCOPE: "_";
  *
  * 写侧不是本仓能单方面改的:core 的 `treeScope = reviveClaim?.row.scope ?? ctx.principal ??
  * opts.background?.scope` 同时喂**进程内** `defaultTaskRegistry` 与 **durable** 行,而本仓/`core` 全域的
- * 读侧是一整族 `principal ?? "default"`(`runs.ts` markStopSourceForOwner、会话的引擎租户分区 `session-children-retire.ts`
- * `sessionTenantScope`(删除协调器的子代 / 信箱 / 后台 shell 三腿)、`http/routes/runs.ts` 的 subagent output/stream 三口、`agents-roster.ts`、
- * `fleet.ts`)。⇒ **把铸点改成 `"_"` 会把这一整族读者一起打瞎**(本车实测:`subagent-tail-content-supply`
+ * 读侧经唯一换算 `engine-identity.ts` 的 `engineScopeOf` / `engineScopeOfOwner`(匿名 ⇒ `"default"`;读者:`runs.ts` markStopSourceForOwner、
+ * 会话的引擎租户分区 `session-children-retire.ts` `sessionTenantScope`(删除协调器的子代 / 信箱 / 后台 shell 三腿)、`http/routes/runs.ts` 的 subagent
+ * output/stream 与句柄三口、`agents-roster.ts`、`fleet.ts` 的工作流行)。⇒ **把铸点改成 `"_"` 会把这一整族读者一起打瞎**(本车实测:`subagent-tail-content-supply`
  * 的 tail 建连当场 404)。所以归一只能发生在**读侧**:checkpoint 侧拿着 `"_"` 去查 bg 分区时,
  * 显式把这两个键当同一格。
  */
@@ -396,9 +394,9 @@ export declare const BACKGROUND_REGISTRY_ANON_SCOPE: "default";
  * checkpoint 的 scope → 该在哪些 **bg 注册簿分区**里找它的 parked 子代([ref])。
  *
  * 匿名(`"_"`)⇒ 两个都查:`"_"`(将来若统一了写侧)与 `"default"`(今天 core 真写下去的那个)。
- * 其余 ⇒ 原样单查:有 principal 时两套约定折出**同一个**串(`encodeCheckpointScope` 只在 null/undefined
- * 时才替换,core 那侧也只在 `ctx.principal` 缺席时才落兜底),不存在第二个候选;而多租户部署里一个
- * **真名叫 `default`** 的租户必须只匹配自己那格 —— 所以别把别名做成双向。
+ * 其余 ⇒ 引擎那一格单查:停驻行的 scope 列是**主体**,bg 行是引擎按它的任务 scope 写的(落点今天只写人)⇒ 经唯一换算
+ * `engine-identity.ts` 的 `engineScopeOfOwner`:没带场景的主体逐字节同(两套约定折出同一个串),带场景的主体 ⇒ 那个人;
+ * 不存在第二个候选。多租户部署里一个**真名叫 `default`** 的租户只匹配自己那格 —— 所以别把别名做成双向。
  */
 export declare function backgroundScopesForCheckpointScope(scope: string): readonly string[];
 /** Encode a subject (the partition key — `owner-brands.ts`; or none) as the checkpoint `scope` column value. A row owner read back from a store is the