@sema-agent/server 7.150.0 → 7.152.0

package/dist/run-local.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { DEFAULT_MODEL_REF, pickUserModel } from "./model-select.js";
 import { defaultModelRefusal, modelNotAllowedMessage, modelUnavailableMessage } from "./model-entry-refusal.js";
-import { servedModelTableLeg } from "./model-select.js";
+import { modelRefusalLegOf, servedModelTableLeg } from "./model-select.js";
 import { outwardPlane, sealResultForExit } from "./terminal.js";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
@@ -22,12 +22,11 @@ import { buildUnpricedCeilingNotice, isRosterGateArmed, loadConfig, logConfigDia
 import { admitLocalDataRoot } from "./plugins/local-data-root-admission.js";
 import { openLocalBackend } from "./plugins/store-backend.js";
 import { runAndLogOneTimeMigrations } from "./plugins/one-time-migrations.js";
-import { configLocalRoot, createConfigProvider } from "./config-provider.js";
+import { configLocalRoot, configSourceKind, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, buildCandidateRejectionNotes, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane, settleHostLaneShell, settleReadDenyFloor } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
-import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
 import { logEnvModelsMigration, runEnvModelsMigration } from "./config-root-migration.js";
 import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { ConfigPullError, asConfigPullError, configPullFailureNote } from "./config-pull-failure.js";
@@ -376,7 +375,6 @@ export async function runLocal(argv, deps = {}) {
         await printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
-    logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     let config;
     try {
         config = await composeExecutionLane(loaded, { configSource: "local", localRoot: root, logger, entry: RUN_LOCAL_LANE_ENTRY });
@@ -435,10 +433,11 @@ export async function runLocal(argv, deps = {}) {
         else
             logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the candidate failed to apply at boot — running on env (run-local has no LKG); none of the candidate's domains is adopted; this is not a reachability failure" });
     }
-    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes }, servedModelTableLeg(config));
+    const webAdminIsConfigSource = configSourceKind(config) === "remote";
+    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes }, modelRefusalLegOf(servedModelTableLeg(config), webAdminIsConfigSource));
     if (noDefaultModel !== undefined)
         throw new Error(noDefaultModel);
-    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false });
+    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false, webAdminIsConfigSource });
     if (routeVerdict !== undefined)
         throw new Error(routeVerdict.reason);
     warnAssumedContextWindows(config, logger, { envTableIsPlaceholder: false });
@@ -612,6 +611,7 @@ export async function runLocal(argv, deps = {}) {
     assertGovernanceAssemblable(config);
     const { registrations: deploymentMods } = await assembleDeploymentMods({ metrics, brandIdentity: true, declaration: config.modsDeclaration, logger });
     const sharedRunnerDeps = createSharedRunnerDeps({
+        onError: engineOnError,
         metrics,
         config,
         engineDataRoot,
@@ -637,12 +637,12 @@ export async function runLocal(argv, deps = {}) {
         sharedMemoryStores: undefined,
         mcpRevocations: undefined,
         peerDesk,
+        runtimeCapsResolver: undefined,
     });
     const runnerDeps = {
         ...sharedRunnerDeps,
         sessionStore,
         ...(memoryEngine ? { memoryBackend: memoryEngine.backend } : {}),
-        onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled
             ? {
@@ -652,7 +652,7 @@ export async function runLocal(argv, deps = {}) {
             : {}),
     };
     const runner = new Runner(runnerDeps);
-    const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onError: engineOnError, onAsk };
+    const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onAsk };
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
     const deploymentSkills = loadDeploymentSkills(config, logger);
@@ -676,7 +676,7 @@ export async function runLocal(argv, deps = {}) {
     const sessionId = args.session ?? uuidv7();
     let cap;
     try {
-        scenarioName = await createScenarioGate({ config, scenarios, principalCaps: undefined, logger }, "enforce")(undefined, args.scenario);
+        scenarioName = (await createScenarioGate({ config, scenarios, principalCaps: undefined, logger }, "enforce")(undefined, args.scenario)).scenario;
         cap = selectScenario(scenarios, scenarioName)({ scenario: scenarioName, objective: args.objective }, undefined, { sessionId });
     }
     catch (err) {

package/dist/runs.d.ts

@@ -17,6 +17,9 @@ import type { RunAcceptance } from "./run-acceptance.js";
 import type { SessionWorkspaceRecorder } from "./session-workspace.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
 import { type ParkLedgerEventType } from "./trace/ledger-events.js";
+import type { LandedAttendantSeat } from "./plugins/landed-attendants.js";
+import type { DelegationRootWitness } from "./delegated-session-owner.js";
+import type { SessionFace } from "./session-incarnation.js";
 import type { UserInputLedger } from "./user-input-ledger.js";
 /**
  * stoppedBy (core 1.252): a service cancel is a USER stop — mark the run's still-running background
@@ -27,8 +30,8 @@ import type { UserInputLedger } from "./user-input-ledger.js";
  * cross-replica flag poll). Advisory only — the cancel itself must never fail on attribution.
  *
  * Access = TASK-scoped children ONLY: owner = the parent taskId (on a RESUME leg: the sessionId — core's
- * canonical taskId there), scope = `principal ?? "default"` (core registers children under
- * `spec.principal ?? "default"`, so an anonymous run's children live in scope "default" and an access
+ * canonical taskId there), scope = the engine-identity cell `engineScopeOfOwner(subject)` (core registers
+ * children under its task scope, so an anonymous run's children live in scope "default" and an access
  * WITHOUT scope matched nothing). Session-scoped children are DELIBERATELY not marked: a cancelled parent
  * does NOT take them down (CC Backgrounded semantics — core's teardown reaps with skipSessionScoped), so
  * pre-marking them "user" would misattribute a stop that isn't happening.
@@ -134,8 +137,14 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
     releaseIdemKey(taskId: string): Promise<void>;
 }, taskId: string, result: Pick<TaskResult, "terminal" | "stats">): Promise<void>;
 /**
- * E18 resume-at — per-turn anchor capture, shared by runInBackground, the resume-leg driveResume AND the sync `POST /v1/tasks`
- * leg's plain form so the (single, tricky) capture rule can't drift between the stream-drain loops.
+ * E18 resume-at — per-turn anchor capture, shared by runInBackground, the resume-leg driveResume, the `POST /v1/tasks/stream`
+ * leg AND the sync `POST /v1/tasks` leg's plain form so the (single, tricky) capture rule can't drift between the stream-drain loops.
+ *
+ * **One write moment for every leg**: an anchor is written in the drain loop the moment the event that decides it arrives
+ * (the prompt anchor on its `message_committed`, a turn anchor on its `turn_end`) — never deferred to a leg's finish /
+ * disconnect branch. A process that is killed (SIGKILL / host crash / OOM) runs no finish branch, so a deferred write is a
+ * write that a killed run never makes; the engine's file-history boundary for the prompt is already on disk by then, and
+ * the anchor is the only thing that translates the caller's handle to it.
  *
  * A "turn" in core = ONE assistant message + its tool batch. resume-at is valid ONLY at a SETTLED rewindable boundary
  * — core's prepare-task accepts "user messages or finished assistant-text turns" and REJECTS an assistant message that
@@ -153,8 +162,8 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  * observable instead of a silent feature outage.
  */
 /**
- * 「这一次用户消息提交是不是这个 run 的**开场提示**」的唯一读法 —— 四处用户回退锚(后台腿 / 续跑腿 / 同步腿 `POST /v1/tasks` 的 {@link TurnAnchorCapture}、`/v1/tasks/stream`
- * 腿的 `userMsgEntryId`)同调这一只;调用点零各自判、零按正文判,且都是「最后一次交出的赢」。
+ * 「这一次用户消息提交是不是这个 run 的**开场提示**」的唯一读法 —— 四条腿(后台腿 / 续跑腿 / 同步腿 `POST /v1/tasks` / 流式腿 `POST /v1/tasks/stream`)的用户回退锚
+ * 都经 {@link TurnAnchorCapture} 调这一只;调用点零各自判、零按正文判,交出一次写一次(「最后一次交出的赢」= 锚店按键 upsert)。
  *
  * **回退锚 = 该轮开场提示,一个 run 一个(开场窗 + 闩)**:run 一开始就开着一个**开场窗**,收集第一次模型输出之前的 user 提交;窗关上之后(闩上),同 run 的 user-role 提交 ——
  * 用户打断时引擎收尾追加的「[Request interrupted by user]」、第一次模型调用前后排进来的 steer 正文、答完之后再来的 steer —— 一律不交。这是 CC「rewind to the message that started this turn」的
@@ -177,7 +186,7 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  *  · 带附件的提交,窗内又应用了一条别的输入(`human_input{applied}`,如第一次模型调用前排进来的 steer;事件先于它的正文提交到手)⇒ 窗里多了一条别人的消息,数 N 会落在帧后面的 steer 上 ⇒ 不猜。
  *    不带附件的提交不看输入条数:多条 applied 输入可以合成一条提交(续跑把停驻的 steer 与 wake 文本并成一条续跑消息),按修前同读校正到窗内最后一条。排队未应用(`delivery: "queued"`)的输入不动窗。窗还开着时继续攒,直到被关上。
  *  · 「不猜」= 这个 run 不落(带附件)或不校正(不带附件),且窗关上之后闩上 —— 其后的 user 提交(steer 正文、打断标记)不是开场提示,不顶上来;拿这次 run 的 taskId 去 `resumeAt`
- *    得 404 `resume_at.unknown_event`(文案点名带附件这一类成因)。
+ *    得 404 `resume_at.unknown_event`(文案说「它是一条没有锚的提问」,不点名成因 —— `history-anchor.ts`)。
  * 窗关上之前一个 user 提交都没有就关了(续跑腿里先到的是工具结果 / 助手消息)⇒ 窗照开着,不闩:那一条之后第一条 user 提交才是这个 run 里的第一条。
  *
  * 已知边界(引擎在 `message_committed` 上带来源标 / 输入标之日见下):
@@ -186,7 +195,7 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  *  · 不带附件、第一次模型输出之前就应用了一条 steer:校正到窗内最后一条 = steer 正文(与修前同读)。
  *
  * 退役条件:引擎在落盘的帧上(`message_committed`)带上来源标(附件标记 / 引擎消息标)之日,本读法整体换成「第一条非引擎消息」(零计数、无窗口、无校正、无拒臂),
- * 窗口 / 严格吻合 / 不猜三臂与 `resume_at.unknown_event` 文案里对应的那一句一并删除,领头排队消息的边界随之消失。
+ * 窗口 / 严格吻合 / 不猜三臂一并删除,领头排队消息的边界随之消失。
  */
 export declare function createPromptCommitReader(): (ev: {
     readonly type: string;
@@ -197,14 +206,41 @@ export type ResumeAnchorLeg = "stream" | "sync" | "bg" | "resume";
  * 回退锚的**唯一**写法(四条腿同一只):**有界** await 写入(单行店操作期限 {@link BASELINE_IO_DEADLINE_MS},与项目指令基线的
  * 读写同一只数、同一只 {@link withinIoDeadline} —— 同为单行 PK 写、同在腿的关键路径上);写失败或到期 ⇒ 不抛(锚是这次提示词能不能
  * 回退的手柄,不是 run 的成败),记一次登记过的 fail-open `server.resume-anchor.capture-failed`(`reason=error|timeout`;计数 + 探针行 + 一次性 warn)。
- * 调用方在本腿的终帧(流式腿的 `done`、同步腿的 200 应答)**之前** await 它 ⇒ 客户端拿到终帧时锚已落定或已知没落定,没有「锚晚到」的窗;锚店挂住至多让终帧晚一个期限。
+ * 调用方在决定这只锚的那一帧到手时就 await 它({@link TurnAnchorCapture}:提示锚在开场提示的提交上,四条腿同一个时机)⇒ 早于本腿的终帧(流式腿的 `done`、同步腿的 200 应答)——
+ * 客户端拿到终帧时锚已落定或已知没落定,没有「锚晚到」的窗;进程在终帧之前被强杀,已到手的那一笔也已落定。锚店挂住至多让那一帧之后的处理晚一个期限。
  * 到期只放手不取消:那次写照常在飞,迟到落定的锚照样可用(迟到的失败被吞,不重复计数)。
  * 用户面的读数仍只有一处:会话视图用户消息行的 `taskId?`(present-iff 锚在)与 `resumeAt` 的 404 `resume_at.unknown_event`。
  */
-export declare function settleResumeAnchor(write: () => Promise<void>, where: {
+export declare function settleResumeAnchor(write: (held: () => boolean) => Promise<void>, where: {
     readonly leg: ResumeAnchorLeg;
     readonly kind: "prompt" | "turn";
 }): Promise<void>;
+/** 一条运行腿的两只回退锚写口(缺席 = 这条腿没有那一种锚:没有落定席位 / 没有提示手柄 / 没有叶子读)。 */
+export interface RunAnchorWriter {
+    /** 用户提示锚:键 = 这条 run 的 id(客户端手里的回退手柄),值 = 那条用户提交的条目 id。 */
+    readonly prompt?: (entryId: string, held: () => boolean) => Promise<void>;
+    /** 助手文本锚:键 = 这一轮第一个 text 帧的 eventId,值 = 此刻会话的叶子。 */
+    readonly turn?: (eventId: string, held: () => boolean) => Promise<void>;
+}
+/**
+ * **运行腿回退锚的唯一写法**(后台腿 / 同步腿 / 流式腿 / 续跑腿同一只):锚只经落定席位的 `putAnchors` 落(`plugins/landed-attendants.ts`:段首锁会话根行判住客),
+ * 住客 = **这条 run 自己的那一位** —— 受理时见证到的(`LegFacts.sessionWitness`,带化身);见证里还没有化身(这条腿新建了会话)⇒ 第一笔锚之前读一次头钉住。
+ * 钉住发生在腿还在等这一笔的期限之内(`held()`:腿被这一笔挡着 ⇒ run 在跑、认领在手 ⇒ 会话删不掉),到期之后才完成的钉住不发写;已发出的写到期只放手不取消
+ * (`settleResumeAnchor`),但它绑着钉住的那一位 —— run 收场、会话被删、同 id 被别人重建之后才落的那一笔落不进新住客,也落不进空闲 id(段判「不是那一位」⇒ 零写,
+ * 记一次同一只 fail-open,`reason=error`)。没有席位 ⇒ 两只都缺席(这台部署不存锚)。
+ */
+export declare function createRunAnchorWriter(args: {
+    readonly seat: Pick<LandedAttendantSeat, "putAnchors"> | undefined;
+    readonly sessionId: string;
+    readonly owner: string | null;
+    /** 用户提示锚的键(这条 run 的 id);缺 ⇒ 不写提示锚(没有手柄 / 续跑腿接着别的腿的 run)。 */
+    readonly promptKey: string | undefined;
+    readonly witness: DelegationRootWitness | undefined;
+    /** 头读投成的住客(属主存取器的 `sessionOccupantReadOf`);缺 ⇒ 见证里没有化身时钉不住 ⇒ 不写。 */
+    readonly occupantOf: ((sessionId: string) => Promise<SessionFace | undefined>) | undefined;
+    /** 会话此刻的叶子(属主存取器的 `sessionFactsReadOf` 投影);缺 ⇒ 不写助手文本锚。 */
+    readonly leafOf: ((sessionId: string) => Promise<string | null | undefined>) | undefined;
+}): RunAnchorWriter;
 export declare class TurnAnchorCapture {
     private readonly capture;
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
@@ -227,9 +263,11 @@ export declare class TurnAnchorCapture {
     private turnHadTool;
     /** 用户提交是不是开场提示的唯一读法({@link createPromptCommitReader};开场窗 + 闩 —— 开场提示之后打断标记 / steer 不改锚;附件帧不是提问)。 */
     private readonly promptCommit;
-    constructor(capture: ((eventId: string) => Promise<void>) | undefined, 
+    /** 上一笔提示锚写的落定(临时锚 → 校正写同一把键;下一笔等它落定再发,见 {@link TurnAnchorCapture.onMessageCommitted})。从不拒。 */
+    private promptLanding;
+    constructor(capture: ((eventId: string, held: () => boolean) => Promise<void>) | undefined, 
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
-    leg: Exclude<ResumeAnchorLeg, "stream">, 
+    leg: ResumeAnchorLeg, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
      *  `message_committed{role:"user"}` event — its `entryId` is the persisted user-message `SessionTreeEntry.id`,
      *  ALWAYS a valid `resumeAt` target (core accepts a user message; it rejects a tool-result / mid-tool-call
@@ -242,7 +280,7 @@ export declare class TurnAnchorCapture {
      *  user-role commit in the same run — the interruption marker, a steer — never moves it. The capture instance is per
      *  run: a leg that CONTINUES an existing run (same taskId) wires no `captureUser` (its opening prompt was anchored
      *  by the first leg). */
-    captureUser?: ((entryId: string) => Promise<void>) | undefined);
+    captureUser?: ((entryId: string, held: () => boolean) => Promise<void>) | undefined);
     /** A `human_input` arrived — the objective's declared attachments open the frame window of {@link createPromptCommitReader} (another applied input inside the window voids it). */
     onHumanInput(ev: {
         readonly type: string;
@@ -359,7 +397,7 @@ cascade?: CascadeConfig, instrumentDegenerate?: (result: TaskResult) => void, pl
 elicitOwner?: string | null, 
 /** E18 resume-at: capture the turn's (firstTextEventId → leaf entryId) anchor at each turn_end. Built by the caller
  *  closing over {sessionId, owner, the session store's head read (`headOf(id)?.leafId`), resumeAnchorStore}; undefined ⇒ no anchor store wired. */
-captureTurnAnchor?: (eventId: string) => Promise<void>, 
+captureTurnAnchor?: (eventId: string, held: () => boolean) => Promise<void>, 
 /** MF-Fleet (shell-host contract): the run-scoped fleet-row publisher. `onStart` adds the live row; `onEvent` accrues
  *  tokens (turn_end) + subagent child rows (task_progress); `onTerminal` flips/removes it. Fired for ALL legs
  *  (verify/cascade/plain-stream) so a background run TRANSITIONS its `GET /v1/fleet/stream` row exactly like the
@@ -367,7 +405,7 @@ captureTurnAnchor?: (eventId: string) => Promise<void>,
 fleetPublisher?: FleetRunPublisher, 
 /** R8 (CC-parity rewind): capture a USER-message anchor (keyed by this run's taskId) from `message_committed{role:"user"}`
  *  — the CC "rewind to the prompt" target. undefined ⇒ no anchor store wired. */
-captureUserMessageAnchor?: (entryId: string) => Promise<void>, 
+captureUserMessageAnchor?: (entryId: string, held: () => boolean) => Promise<void>, 
 /** §4④ : AskUserQuestion LIVE coordinator — establishes a per-run onQuestion ALS context (like `elicitation`)
  *  so an AskUserQuestion tool call routes to this run's stream + owner-gated respond. undefined ⇒ headless default. */
 question?: QuestionCoordinator, 
@@ -457,7 +495,7 @@ workspaceRecorder?: SessionWorkspaceRecorder,
  */
 runSkills?: readonly RunSkillEntry[], 
 /**
- * 这次提交登记的工作目录(部署事实 `LegFacts.registeredCwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
+ * 这条腿跑在的工作目录(部署事实 `LegFacts.sessionBindings.cwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
  * 梯子的级 / 验证器腿跑在引擎现铸的会话里,工厂按会话读不到它;普通流形跑在根会话上,工厂自己读得到。缺席 = 没登记 ⇒ 每一条腿照旧落临时目录。
  */
 registeredCwd?: string): Promise<void>;

package/dist/runs.js

@@ -9,9 +9,8 @@ import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js"
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withSubject } from "./observability/principal-context.js";
-import { partsOf } from "./owner-brands.js";
 import { recoveredSubject } from "./owner-faces.js";
-import { taskSpecIdentityOf } from "./engine-identity.js";
+import { engineScopeOfOwner } from "./engine-identity.js";
 import { withModelReachScope } from "./model-reach-scope.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
@@ -62,11 +61,10 @@ export async function taskHandleStop(registry, handle, access, agentStore) {
     return registry.stopTask(handle, access);
 }
 export function markChildrenStoppedByUserOnAbort(signal, taskId, subject) {
-    const recovered = recoveredSubject(subject);
-    const principal = taskSpecIdentityOf(recovered === undefined ? undefined : partsOf(recovered)).principal;
+    const scope = engineScopeOfOwner(subject);
     const mark = () => {
         try {
-            defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope: principal ?? "default" }, "user", { skipSessionScoped: true });
+            defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope }, "user", { skipSessionScoped: true });
         }
         catch {
         }
@@ -79,6 +77,10 @@ export function markChildrenStoppedByUserOnAbort(signal, taskId, subject) {
 }
 const EXECUTION_ENV_REFUSAL_HTTP_STATUS = {
     "env.home_unconfirmed": 409,
+    "env.snapshot_bucket_missing": 409,
+    "env.occupant_missing": 409,
+    "env.sandbox_refused": 409,
+    "env.host_key_rejected": 409,
 };
 const PREPARE_REFUSAL_HTTP_STATUS = {
     "resume.session_not_found": 404,
@@ -234,13 +236,52 @@ export function createPromptCommitReader() {
     };
 }
 export async function settleResumeAnchor(write, where) {
+    let open = true;
     try {
-        await withinIoDeadline(write);
+        await withinIoDeadline(() => write(() => open));
     }
     catch (err) {
         const why = err instanceof IoDeadlineExceeded ? `reason=timeout boundMs=${BASELINE_IO_DEADLINE_MS}` : `reason=error error=${err instanceof Error ? err.message : String(err)}`;
         recordFailOpen("server.resume-anchor.capture-failed", `leg=${where.leg} kind=${where.kind} ${why}`);
     }
+    finally {
+        open = false;
+    }
+}
+export function createRunAnchorWriter(args) {
+    const { seat, sessionId, owner, promptKey, witness, occupantOf, leafOf } = args;
+    if (seat === undefined)
+        return {};
+    let pinned = witness !== undefined && witness.incarnation !== null ? { owner: witness.owner, incarnation: witness.incarnation } : undefined;
+    const pin = async () => (pinned ??= await occupantOf?.(sessionId));
+    const put = async (landed, eventId, entryId) => {
+        const out = await seat.putAnchors(sessionId, landed, [{ eventId, entryId }], owner);
+        if (!out.landed)
+            throw new Error("the session's occupant is no longer this run's — the anchor was not written");
+    };
+    return {
+        ...(promptKey !== undefined
+            ? {
+                prompt: async (entryId, held) => {
+                    const landed = await pin();
+                    if (landed !== undefined && held())
+                        await put(landed, promptKey, entryId);
+                },
+            }
+            : {}),
+        ...(leafOf !== undefined
+            ? {
+                turn: async (eventId, held) => {
+                    const landed = await pin();
+                    if (landed === undefined || !held())
+                        return;
+                    const leaf = await leafOf(sessionId);
+                    if (leaf)
+                        await put(landed, eventId, leaf);
+                },
+            }
+            : {}),
+    };
 }
 export class TurnAnchorCapture {
     capture;
@@ -249,6 +290,7 @@ export class TurnAnchorCapture {
     firstTextEventId;
     turnHadTool = false;
     promptCommit = createPromptCommitReader();
+    promptLanding = Promise.resolve();
     constructor(capture, leg, captureUser) {
         this.capture = capture;
         this.leg = leg;
@@ -261,8 +303,20 @@ export class TurnAnchorCapture {
         const committed = { type: "message_committed", role, entryId };
         const prompt = this.promptCommit(committed);
         const captureUser = this.captureUser;
-        if (prompt !== undefined && captureUser)
-            await settleResumeAnchor(() => captureUser(prompt), { leg: this.leg, kind: "prompt" });
+        if (prompt === undefined || !captureUser)
+            return;
+        const prior = this.promptLanding;
+        let landed;
+        this.promptLanding = new Promise((resolve) => { landed = resolve; });
+        await settleResumeAnchor(async (held) => {
+            try {
+                await prior;
+                await captureUser(prompt, held);
+            }
+            finally {
+                landed();
+            }
+        }, { leg: this.leg, kind: "prompt" });
     }
     onText(eventId) {
         if (this.firstTextEventId === undefined) {
@@ -278,7 +332,7 @@ export class TurnAnchorCapture {
         const capture = this.capture;
         const handle = this.firstTextEventId;
         if (handle && !this.turnHadTool && capture)
-            await settleResumeAnchor(() => capture(handle), { leg: this.leg, kind: "turn" });
+            await settleResumeAnchor((held) => capture(handle, held), { leg: this.leg, kind: "turn" });
         this.firstTextEventId = undefined;
         this.turnHadTool = false;
     }
@@ -388,6 +442,7 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
         await sink.appendParked(word, grafted);
         const sealed = sealResultForExit(grafted);
         reached = { kind: word, result: sealed };
+        await acceptance?.settle(sealed);
         const committed = await commitParkRow({
             runStore, taskId, word, result: sealed, card: { token, sessionId: spec.sessionId }, cards: checkpointCards, leg: "bg",
             legId: parkCommit.legId, staleWindowMs: parkCommit.runStaleSec === undefined ? undefined : parkCommit.runStaleSec * 1000,
@@ -396,7 +451,6 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
             reached = undefined;
             settledAsCancel = committed.row?.errorCode === CANCELLED_CODE;
         }
-        acceptance?.settle(sealed);
     };
     const settleLegResult = async (engineResult) => {
         const result = atHostBoundary(engineResult);
@@ -410,10 +464,10 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
         const safe = await withModelUsage(sealResultForExit(settled));
         await sink.appendDone(safe);
         reached = { kind: "done", result: safe };
+        await acceptance?.settle(safe);
         const plane = outwardPlane(safe.terminal);
         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
         await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
-        acceptance?.settle(safe);
     };
     const instructionLeg = createInstructionSelectionLeg();
     const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkills }), usage: { modelUsage, taskId } });
@@ -609,12 +663,12 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
             if (reached?.kind === "done") {
                 const plane = outwardPlane(reached.result.terminal);
                 settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
+                await acceptance?.settle(reached.result);
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
                 await releaseKeyIfZeroWorkRefusal(runStore, taskId, reached.result);
-                acceptance?.settle(reached.result);
             }
             else if (reached !== undefined) {
-                acceptance?.settle(reached.result);
+                await acceptance?.settle(reached.result);
             }
             else if (thrownCancelCause === undefined && observedDone !== undefined && heldParkOf(atHostBoundary(observedDone)) !== undefined) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=park-held ${message}`);

package/dist/runtime-governance.d.ts

@@ -92,8 +92,9 @@ export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefi
  * `plan` 是有出口的**生命周期词**(`plan_review` 把计划带出 plan),不是围栏:它是**提交入口的模式词地板**({@link autonomyModeFloor}),
  * 盖在每一个 spec 出生点一次(词 = {@link entryPermissionMode} 的 `effective`):受理门盖进存储的提交体(`task-settings.ts` `stampEntryPermissionMode`)、run-local 盖在它自建的 spec 上、
  * leader run 盖在它出生时的入口体上(`leader/run-entry.ts`;入口词是 `plan` 的 leader run 进不了那条车道 —— worker 会话没有计划审阅通道 ⇒ 受理口响亮拒)。此后一条 run 的模式词
- * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)与 `plan_review` 写回。按段折一个模式词 = 第二个源:被批准的计划会在下一次挂起→续跑
- * 被拉回 plan。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
+ * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)、`plan_review` 写回与续跑口(停驻 run 的存储体被重放之前过一次**现**地板、
+ * 钳过的随 CAS 赢点写回;`permission-mode-admission.ts` `stampReplayEntryMode`,写据说那一格是地板的出口 —— `plan_review` 批准 —— 写下的且仍是它写下的那一格 ⇒ 原样读)。按段折一个模式词 = 第二个源:
+ * 被批准的计划会在下一次挂起→续跑被拉回 plan;续跑口不是按段折 —— 它与提交口同一只入口一步,写的是同一个源,且不碰出口写下的那一格。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
  * 写面 `roots`、与 `read-only` 同形 —— 运维 plan 那时根本不进 plan 模式,见下一段。)
  *
  * 🔴 **为什么 `plan` 不再与 `read-only` 同形**:修前两档同映「只读手 + roots」,外加 `resolve-spec.ts` 见只读手就剥委派工具 —— 于是 `plan` 有三套
@@ -145,8 +146,8 @@ export interface EntryPermissionMode<W extends PermissionMode | undefined = Perm
  *    无人值守腿(`unattended-permission-mode.ts` `withUnattendedLeg`:`default` 钳在 spec 的词之下);
  *  · 「这个词会变成什么」的读者 —— 能力面写面开不开({@link autonomyKeepsOpenWriteFace}:bypass 声明过地板)、能力面 auto 读面
  *    (`auto-mode-face.ts` `judgeAutoModeArming`:意图过地板;`clamped` 且不是 auto ⇒ 未武装原因 `operator_floor`)、
- *    存量停驻体能否按此刻的地板重放(`http/stored-body-replay.ts`:体的词经钳会变 ⇒ 拒)。
- * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,上面八处各调本函数一次。
+ *    受理判官的入口一步(`permission-mode-admission.ts` `entryStep`:提交口盖章、在飞切档口、续跑口 —— 停驻 run 的存储体被重放之前过**现**地板 —— 三口同经这一处)。
+ * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,本函数七处调用点各一次。
  */
 export declare function entryPermissionMode<W extends PermissionMode | undefined>(word: W, floor: PermissionMode | undefined): EntryPermissionMode<W>;
 /**

package/dist/security.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage } from "node:http";
+import type { EntriesStreamOptions } from "./session-sync-kernel.js";
 import { type SessionHead, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { Logger } from "./observability/logger.js";
@@ -9,6 +10,8 @@ import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
 import type { SessionDeletionFace } from "./session-deletion.js";
 import { type SessionBirth } from "./session-incarnation.js";
+import { type IdleSession, type IdleSessionCursor, type SessionKind, type SessionKindReading } from "./session-kind.js";
+import type { SessionListQuery } from "./plugins/store-contracts.js";
 import type { ClientSessionRowWrite, ReplaySessionRowWrite, ReplaySessionRowWriteOutcome, SessionRowAnswer, SessionRowPatch, SessionRowWriteOutcome } from "./session-row.js";
 import type { ExecutionPlacementSeat } from "./execution-placement.js";
 import type { SessionUnreadable } from "./session-error-wire.js";
@@ -56,6 +59,10 @@ export interface SessionListItem {
      *  by a fork after lineage was recorded (an older fork is not backfilled: its source is unknown). OMIT-when-absent, never `null`. Additive key, passed
      *  through unprojected (`sessions-list.ts`). Same name and meaning as `SessionSummary.forkedFrom` in `plugins/store-contracts.ts`. */
     forkedFrom?: string;
+    /** The session's kind (`session-kind.ts`): present-iff the session was created by a submission that declared `sessionKind`; a top-level session
+     *  never carries it (OMIT-when-absent, never `null`). The default list view lists only top-level sessions; `?sessionKind=<word>` lists that kind.
+     *  Additive key, passed through unprojected (`sessions-list.ts`). Same name and meaning as `SessionSummary.sessionKind` in `plugins/store-contracts.ts`. */
+    sessionKind?: SessionKind;
 }
 /**
  * 会话店的行格写原语(规则与判序:`session-row.ts` 头注「写原语」)—— 按入口分两只重载:客户端写(PATCH)的结局闭集四员;行重放(2c 导入落定后的那一笔)
@@ -74,7 +81,7 @@ export interface SessionRowCellsWriter {
  * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
  * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一风险形、爆炸半径**更大**,却没门。
  *
- * 风险形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * 风险形逐字同源(守卫自己的注释):「请求没带凭据门认的凭据 + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
  * fleet 写档(面表 fleet 列的 `dev_open` 格,`owner-faces.ts` 的 `listFilterOf`)判 fleet-wide ⇒ 集群内**任意**不报主体的调用方可对**任意** session 动手(报了主体的调用方只动得到那位主体的,`principal-gate.ts` 的 `actsForDeployment`)。
  * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
  *
@@ -104,6 +111,10 @@ export type SessionOwnerCell = {
 export declare function claimCallerOf(subject: Subject | undefined, config: DeploymentShapeInput<"principal">): Caller;
 /** 提交挂接「没有这只会话」那一答的句子(requireExisting 缺行与认领面看不见同一句;投影 `attach_absent`)。 */
 export declare const ATTACH_ABSENT_MESSAGE = "requireExistingSession: session does not exist (resume.session_not_found)";
+/** 带种类的提交撞上一只种类不同的既有会话的 409(律 `session-kind.ts`):体上机读位 `sessionKind` = 行上的词(顶层行缺席)。句子不回显请求的词以外的任何行事实。 */
+export declare const SESSION_KIND_MISMATCH_MESSAGE = "this session already exists with a different session kind \u2014 a session's kind is written once, when the session is created, and never changes; send the same sessionKind the session was created with, omit sessionKind to run the session as it is, or start a new session";
+/** 部署记不了种类(会话店没有出生回执面 / 种类读)⇒ 400 `request.precondition_unmet`(受理门读同一只能力事实 `capability-facts.ts` 的 `sessionKinds`,先拒在那里;这里是纵深)。 */
+export declare const SESSION_KIND_UNRECORDABLE_MESSAGE = "sessionKind requires a session store that records a session's kind and ages such sessions out (DB_BACKEND=mysql|pg|local) \u2014 this deployment cannot, so the session would be created as a top-level conversation; capabilities.sessionKinds lists the kinds a deployment accepts";
 /** 读一只会话行的 {@link SessionOwnerCell}:有主行 = 属主那一格(`owner-faces.ts` 的 `ownerCellOf`,属主列读数的唯一铸法);无主时问一次店的 `placementOf`
  *  (既有读口;店不交它 = 不实现 placement = 没有 placed 行)。`owner` = 调用点那一读。 */
 export declare function sessionOwnerCellOf(store: Pick<OwnerAwareSessionStore, "placementOf"> | undefined, sessionId: string, owner: string | null): Promise<SessionOwnerCell>;
@@ -141,29 +152,19 @@ export type OwnerAwareSessionStore = SessionStore & {
      *  `includeUnowned` = [ref] 窄互认第二臂的**第三条件**(`owner IS NULL`)的 SQL 承载位:置真时
      *  谓词放宽为 `owner = ? OR owner IS NULL`。只在 `owner` 在场时有意义(路由已判①③);`owner` 缺席
      *  (fleet-wide)时本位无效——那一面本来就不钉 owner。 */
-    listSessions?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<SessionListItem[]>;
+    listSessions?: (opts: SessionListQuery) => Promise<SessionListItem[]>;
     /** The SAME list face as {@link listSessions} (same SELECT, same mapper, same predicate and keyset) with each row's occupant — the row's owner and
      *  incarnation as read in that one read. The incarnation never enters the row (it is not a wire fact: `session-incarnation.ts`); this pair is for the
      *  in-process reader that must address a row by occupant — the peer directory's `PeerSessionRecord.occupant`. `listSessions` is this face's rows. */
-    listSessionRows?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<Array<SessionRowAnswer<SessionListItem>>>;
+    listSessionRows?: (opts: SessionListQuery) => Promise<Array<SessionRowAnswer<SessionListItem>>>;
+    /** 按 id 的种类读(律 `session-kind.ts`;授权口的种类判与会话视图的 `sessionKind` 读它):读到它时行上的住客 + 种类。三只持久店都交,包装原样转发。 */
+    sessionKindOf?: (sessionId: string) => Promise<SessionKindReading | undefined>;
+    /** 老化候选面(律 `session-kind.ts`;唯一读者 = 维护拍的老化腿 `boot/session-age-out.ts`):种类为 `kind`、最后活动早于 `idleBefore`、当下无活引用的会话(在删的照交),
+     *  最老先出、`(lastActivityAt, sessionId)` 升序 keyset 续页(`after` = 上一页最后一条)。与 `listPlaced`、删除面 `pending()` 同族的用途专一枚举 —— 不出列表投影。 */
+    listIdleOfKind?: (kind: SessionKind, idleBefore: Date, page: {
+        readonly after?: IdleSessionCursor;
+        readonly limit: number;
+    }) => Promise<IdleSession[]>;
     /** ONE session's list row — the SAME projection {@link listSessions} emits for it (same columns, same mapper). `undefined` = not a
      *  row of the list face (no such session, or a placed / delegation-transcript session, which never lists). Reader: the 2c
      *  manifest (`title` / `pinned`). */
@@ -215,10 +216,7 @@ export type OwnerAwareSessionStore = SessionStore & {
      *  `opts.batchSize` is the page size (default 500). Resolves to `null` (NOT an empty iterable) when the session does
      *  not exist (the existence probe is async — `session_meta` first, like {@link exportEntries} — so the method returns
      *  a Promise of the iterable-or-null; the iterable itself then pages lazily). The read half of exportEntries, paged. */
-    exportEntriesStream?: (sessionId: string, opts?: {
-        afterSeq?: number;
-        batchSize?: number;
-    }) => Promise<AsyncIterable<SessionTreeEntry> | null>;
+    exportEntriesStream?: (sessionId: string, opts: EntriesStreamOptions) => Promise<AsyncIterable<SessionTreeEntry> | null>;
     /** 2c session-sync — IMPORT a verbatim entry log into `sessionId`, re-stamping `owner` to the
      *  authenticated importing principal (never the bundle's). The log is passed through core's
      *  `validateEntriesForImport` (the single fail-closed invariant gate) before any write. */
@@ -303,7 +301,7 @@ export interface AuthContext {
      *  `PROJECT_ID_REGEX` 门后折小写回传;[ref]/[ref] 宽读严写 —— 词法带 /i 收下大写形,但派生 scope 键
      *  与 config.projects 查表都只认这一个归一形,否则同一个项目会按大小写分成两只记忆盘)。
      *  身份半场(scope 的 tenant 段)永远来自 verified principal — projectId 只选「哪个项目盘/哪条登记」
-     *  (config.projects 查表键 + proj: 键的 projectId 段),不是 capability。main.ts 拿它查 defaultScopes。 */
+     *  (config.projects 查表键 + proj: 键的 projectId 段),不是 capability。装配器拿它判 defaultScopes 种子项目(对提交者可见才算,`project-registry.ts`)。 */
     resolvedProjectId?: string;
 }
 /** 授权口的入参:请求、体,与提交出口收候选的口(`submission-exit.ts`;只有登记了新行才调,传了也可能一次不调)。 */
@@ -385,9 +383,9 @@ export declare const CHECKPOINT_PUBLIC_SCOPE: "_";
  *
  * 写侧不是本仓能单方面改的:core 的 `treeScope = reviveClaim?.row.scope ?? ctx.principal ??
  * opts.background?.scope` 同时喂**进程内** `defaultTaskRegistry` 与 **durable** 行,而本仓/`core` 全域的
- * 读侧是一整族 `principal ?? "default"`(`runs.ts` markStopSourceForOwner、会话的引擎租户分区 `session-children-retire.ts`
- * `sessionTenantScope`(删除协调器的子代 / 信箱 / 后台 shell 三腿)、`http/routes/runs.ts` 的 subagent output/stream 三口、`agents-roster.ts`、
- * `fleet.ts`)。⇒ **把铸点改成 `"_"` 会把这一整族读者一起打瞎**(本车实测:`subagent-tail-content-supply`
+ * 读侧经唯一换算 `engine-identity.ts` 的 `engineScopeOf` / `engineScopeOfOwner`(匿名 ⇒ `"default"`;读者:`runs.ts` markStopSourceForOwner、
+ * 会话的引擎租户分区 `session-children-retire.ts` `sessionTenantScope`(删除协调器的子代 / 信箱 / 后台 shell 三腿)、`http/routes/runs.ts` 的 subagent
+ * output/stream 与句柄三口、`agents-roster.ts`、`fleet.ts` 的工作流行)。⇒ **把铸点改成 `"_"` 会把这一整族读者一起打瞎**(本车实测:`subagent-tail-content-supply`
  * 的 tail 建连当场 404)。所以归一只能发生在**读侧**:checkpoint 侧拿着 `"_"` 去查 bg 分区时,
  * 显式把这两个键当同一格。
  */
@@ -396,9 +394,9 @@ export declare const BACKGROUND_REGISTRY_ANON_SCOPE: "default";
  * checkpoint 的 scope → 该在哪些 **bg 注册簿分区**里找它的 parked 子代([ref])。
  *
  * 匿名(`"_"`)⇒ 两个都查:`"_"`(将来若统一了写侧)与 `"default"`(今天 core 真写下去的那个)。
- * 其余 ⇒ 原样单查:有 principal 时两套约定折出**同一个**串(`encodeCheckpointScope` 只在 null/undefined
- * 时才替换,core 那侧也只在 `ctx.principal` 缺席时才落兜底),不存在第二个候选;而多租户部署里一个
- * **真名叫 `default`** 的租户必须只匹配自己那格 —— 所以别把别名做成双向。
+ * 其余 ⇒ 引擎那一格单查:停驻行的 scope 列是**主体**,bg 行是引擎按它的任务 scope 写的(落点今天只写人)⇒ 经唯一换算
+ * `engine-identity.ts` 的 `engineScopeOfOwner`:没带场景的主体逐字节同(两套约定折出同一个串),带场景的主体 ⇒ 那个人;
+ * 不存在第二个候选。多租户部署里一个**真名叫 `default`** 的租户只匹配自己那格 —— 所以别把别名做成双向。
  */
 export declare function backgroundScopesForCheckpointScope(scope: string): readonly string[];
 /** Encode a subject (the partition key — `owner-brands.ts`; or none) as the checkpoint `scope` column value. A row owner read back from a store is the