@sema-agent/server 7.150.0 → 7.152.0

package/dist/session-kind.js

@@ -0,0 +1,22 @@
+export const SESSION_KINDS = ["sidechain"];
+export function isSessionKind(v) {
+    return typeof v === "string" && SESSION_KINDS.includes(v);
+}
+export function sessionKindListed(rowKind, view) {
+    return rowKind === view;
+}
+export function sessionKindFaceOf(store) {
+    const s = store;
+    return typeof s?.sessionKindOf === "function" ? { sessionKindOf: s.sessionKindOf.bind(s) } : undefined;
+}
+export function sessionKindFromCell(sessionId, cell) {
+    if (cell === null || cell === undefined)
+        return undefined;
+    if (isSessionKind(cell))
+        return cell;
+    throw new Error(`session ${sessionId} carries a session kind this build does not know (${JSON.stringify(String(cell).slice(0, 32))}) — refusing to read it as a top-level session; a newer build wrote it, or the row was edited by hand`);
+}
+export function idleSessionAfter(row, cursor) {
+    return cursor === undefined || row.lastActivityAt > cursor.lastActivityAt || (row.lastActivityAt === cursor.lastActivityAt && row.sessionId > cursor.sessionId);
+}
+//# sourceMappingURL=session-kind.js.map

package/dist/session-row.d.ts

@@ -1,4 +1,5 @@
 import { type SessionLogMark, type SessionRowExpectation } from "@sema-agent/core";
+import type { SessionFace } from "./session-incarnation.js";
 /** `title` 列的宽度(字符)= 用户标题的上界。两方言 DDL 内插它。 */
 export declare const SESSION_TITLE_MAX_CHARS = 120;
 /** 会话行的可写位(体闭集;两键至少一键)。会话店唯一行格写口 `writeSessionRowCells` 的格参。`title: null` = 清回自动标题(列写 NULL)。 */
@@ -81,6 +82,9 @@ export interface LockedSessionRow {
     readonly incarnation: string | undefined;
     /** 委派分区行(SQL `placement_kind` 非空;local 没有)—— 不在列表面上,不写。 */
     readonly placed: boolean;
+    /** 这只会话在删(会话三态 活 → 在删 → 没了,`src/session-deletion.ts`):SQL = 锁读的旁表在删令牌非空;local 的锁内读法({@link LockedSessionRow} 的 local 半)
+     *  只交活格,在删格在那里已读作「没有行」⇒ 恒 `false`。判官把它读作行不在(三态律:删除门之外的一切写者把在删读作行不在)。 */
+    readonly deleting: boolean;
     /** 执行格是 `mirror`(写者在别处,本处只读)。 */
     readonly mirror: boolean;
     readonly cells: SessionRowCells;
@@ -89,7 +93,7 @@ export interface LockedSessionRow {
 export type SessionRowVerdict = "write" | "changed" | "mirror" | "absent";
 /**
  * 写原语的**唯一判官**(头注「写原语」):三店在各自的锁下读出那一行、交这一只,判序因此逐字同形 ——
- *  ① **行期望**:core 的 `sessionRowMatches(how.row, 锁住的行, logNow)`;不中、没有行(`undefined`)、委派分区行 ⇒ `absent`;
+ *  ① **行期望**:core 的 `sessionRowMatches(how.row, 锁住的行, logNow)`;不中、没有行(`undefined`)、在删行、委派分区行 ⇒ `absent`(在删 = 行不在,三态律);
  *  ② **写者身份**:`client` ∧ 执行格为 `mirror` ⇒ `mirror`(镜像在本处只读;`replay` 是镜像的名写者,照写);
  *  ③ **标签**:`client` 带 `rowTag` ∧ 锁住的行算出的标签({@link sessionRowTagOf})≠ 它 ⇒ `changed`(行上没有化身 ⇒ 算不出标签 ⇒ 任何标签都不中);
  *  ④ `write`。
@@ -97,6 +101,22 @@ export type SessionRowVerdict = "write" | "changed" | "mirror" | "absent";
  * `logNow` 只在行期望带 `log` 时被调(调用方在同一把锁下先读好那只 mark)。
  */
 export declare function judgeSessionRowWrite(sessionId: string, how: SessionRowWrite, locked: LockedSessionRow | undefined, logNow: () => SessionLogMark): SessionRowVerdict;
+/**
+ * **落定段**的结局(SQL `withLandedRow` · local `LocalSessionStore.withLanded` 两只实现同一形):`landed: true` = 段首锁住的那一行仍是落定的那一位住客
+ * ({@link judgeLandedRow} 答 `write`),段体在同一事务 / 同一把会话写锁里跑完、交回它的值;`landed: false` = 那一位已不在(行不在 / 在删 / 换了住客 / 属主换代 /
+ * 委派分区行),段体一个字节都没跑。会话的附随物(文件历史图 · 会话规则行 · 回退锚 · 自动标题)只经这一段写 —— 律在 `plugins/landed-attendants.ts` 头注。
+ */
+export type LandedOutcome<T> = {
+    readonly landed: true;
+    readonly value: T;
+} | {
+    readonly landed: false;
+};
+/**
+ * 落定段的判:锁住的那一行是不是 `landed` 那一位住客 —— **就是**行格写原语的判官 {@link judgeSessionRowWrite} 以 `replay` 写者问(行期望 = `{ row: landed }`;
+ * 行在 ∧ 非在删 ∧ 非委派分区 ∧ 属主与化身整对同,core `sessionRowMatches`)。一只判官,没有第二份比较。
+ */
+export declare function judgeLandedRow(sessionId: string, landed: SessionFace, locked: LockedSessionRow | undefined): boolean;
 /** 应答行:提交 / 回滚之后另读的那一行 + 读到它时行上的住客(属主 + 化身那一格)。 */
 export interface SessionRowAnswer<Row> {
     readonly row: Row;

package/dist/session-row.js

@@ -13,7 +13,7 @@ export function sessionRowTagKey(row) {
     return row.incarnation === undefined ? {} : { rowTag: sessionRowTagOf({ sessionId: row.sessionId, owner: row.owner, incarnation: row.incarnation, cells: row.cells }) };
 }
 export function judgeSessionRowWrite(sessionId, how, locked, logNow) {
-    if (locked === undefined || !sessionRowMatches(how.row, { owner: locked.owner, incarnation: locked.incarnation }, logNow) || locked.placed)
+    if (locked === undefined || locked.deleting || !sessionRowMatches(how.row, { owner: locked.owner, incarnation: locked.incarnation }, logNow) || locked.placed)
         return "absent";
     switch (how.writer) {
         case "replay":
@@ -32,6 +32,12 @@ export function judgeSessionRowWrite(sessionId, how, locked, logNow) {
         }
     }
 }
+export function judgeLandedRow(sessionId, landed, locked) {
+    return judgeSessionRowWrite(sessionId, { writer: "replay", row: { row: landed } }, locked, landedCarriesNoLogMark) === "write";
+}
+function landedCarriesNoLogMark() {
+    throw new Error("judgeLandedRow: a landed-section expectation carries no log mark, yet the judge asked for one");
+}
 export function settleSessionRowWrite(how, verdict, answer) {
     const judged = how.row.row;
     if (judged === null || answer === undefined)

package/dist/session-sync-kernel.d.ts

@@ -28,11 +28,11 @@ export interface StagingHandle {
     /** Append a bounded batch of entries to the staging id, re-seq'd dense from a running counter held in the handle.
      *  Idempotent (ON DUPLICATE KEY / ON CONFLICT DO NOTHING) — a re-streamed batch is a no-op. One txn per batch. */
     appendBatch(entries: SessionTreeEntry[]): Promise<void>;
-    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): owner CAS ({@link StagedCommitOptions.expectedOwner},
+    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): occupant CAS ({@link StagedCommitOptions.expectedOccupant},
      *  before anything about the row is classified or reported, so a refused commit reveals nothing about a row it did not judge — no
      *  placement, no relation, no entry ids) → in-txn re-classify
      *  (TOCTOU close) → purge dst → row-key rename staging→real → session_meta settled; COMMIT is the commit point. `owner` is re-stamped (§9).
-     *  Throws {@link StagedCommitOwnerChangedError} when the owner cell is not the one the import's gate judged, and
+     *  Throws {@link StagedCommitOccupantChangedError} when the row is not the occupant the import's gate judged, and
      *  {@link SyncConflictError} on an unconsented fork/stale flip — both after rolling back. Returns the committed relation **and the settled session
      *  face** — the occupant (owner + incarnation) the commit left in the real session id, read INSIDE the same txn (the local
      *  store: the same hold of the session's write lock), never re-read afterwards. The post-commit replays conditioned on the
@@ -47,29 +47,39 @@ export interface StagingHandle {
     abort(): Promise<void>;
 }
 /**
- * What a staged commit is conditioned on ([ref] — one gate predicate, two phases). `expectedOwner` = the owner cell the import's gate
- * judged when it opened the staging, in the head-read reading (`headOf(id)?.owner`): `undefined` = no such session (a fresh push), `null` = ownerless, a string =
- * that owner. The route judges `mayTouch` on that cell at Phase A and again on the session's current cell right before Phase B commits; the
- * commit itself lands only on that same cell — each store compares it inside the commit txn (local: inside the session's write lock) and, when
- * the cell differs, rolls back and throws {@link StagedCommitOwnerChangedError} without writing a byte. The compare is on the owner cell, not
- * on the incarnation: the gate's predicate reads only the owner (plus placement, which the commit gate refuses on its own), so a same-owner
- * re-create is judged the same and is not a reason to refuse.
+ * What a staged commit is conditioned on ([ref] — one gate predicate, two phases). `expectedOccupant` = the occupant the import's gate judged when it
+ * opened the staging — the live row's owner **and** incarnation, one head read (`undefined` = no live session: a fresh push, which claims the id).
+ * The route judges `mayTouch` at Phase A and again on the session's current row right before Phase B commits; the commit itself lands only on that
+ * same occupant — each store compares owner ∧ incarnation inside the commit txn (SQL `owner <=> ? AND incarnation = ?`; local: the same judge as every
+ * occupant check, `sameOccupant`, inside the session's write lock) and, when it differs, rolls back and throws {@link StagedCommitOccupantChangedError}
+ * without writing a byte. So a session deleted and re-created while the entries streamed — by anyone, the same owner included — is not the session
+ * phase one classified, and the commit does not land on it (the push restarts from phase one).
  */
+/**
+ * 拉取流的选项:`afterSeq` 续传游标(后端原生 seq)· `batchSize` 页长 · `recheck` = 调用方的住客复判 —— **每页读后、交出那一页的任何一条之前**调一次
+ * (local 孪生整读之后、交出第一条之前调一次);它抛 ⇒ 流在那里结束(调用方读作截断)。必填:流不会在没有复判的情况下交出条目。
+ */
+export interface EntriesStreamOptions {
+    readonly afterSeq?: number;
+    readonly batchSize?: number;
+    readonly recheck: () => Promise<void>;
+}
 export interface StagedCommitOptions {
-    readonly expectedOwner: string | null | undefined;
+    readonly expectedOccupant: {
+        readonly owner: string | null;
+        readonly incarnation: string;
+    } | undefined;
     readonly resolution?: "overwrite-dst";
 }
 /**
- * The staged commit's owner CAS did not hold: the session's owner cell at commit time is not the one the import's gate judged (another replica
+ * The staged commit's occupant CAS did not hold: the session row at commit time is not the occupant the import's gate judged (another replica
  * deleted / re-created / claimed / created the session while the import streamed). Code = core's closed-set `conflict` (wire: the import face's
  * row in `session-error-wire.ts`, 409); thrown after the commit txn rolled back — the destination is untouched. The three stores throw this one
  * class (one sentence, minted here).
  */
-export declare class StagedCommitOwnerChangedError extends SessionError {
+export declare class StagedCommitOccupantChangedError extends SessionError {
     constructor(sessionId: string);
 }
-/** The owner-cell comparison of {@link StagedCommitOptions.expectedOwner} against a store's own owner read (`headOf(id)?.owner`; `undefined` = no row). */
-export declare function ownerCellIs(expectedOwner: string | null | undefined, actual: string | null | undefined): boolean;
 /** A session store that can stage a streamed import (P1d-β). The 3 backends implement it; the in-memory dev store
  *  does not → the method is optional (the route 501s when absent, parity with the other §0.5 optional seams). */
 export type ImportStagingStore = {

package/dist/session-sync-kernel.js

@@ -1,14 +1,11 @@
 import { randomBytes } from "node:crypto";
 import { SessionError, StreamingImportValidator } from "@sema-agent/core";
-export class StagedCommitOwnerChangedError extends SessionError {
+export class StagedCommitOccupantChangedError extends SessionError {
     constructor(sessionId) {
-        super("conflict", `session ${sessionId}: owner changed while the import streamed — the staged commit was rolled back`);
-        this.name = "StagedCommitOwnerChangedError";
+        super("conflict", `session ${sessionId}: the session changed hands while the import streamed (deleted, re-created or re-owned) — the staged commit was rolled back`);
+        this.name = "StagedCommitOccupantChangedError";
     }
 }
-export function ownerCellIs(expectedOwner, actual) {
-    return expectedOwner === undefined ? actual === undefined : actual !== undefined && (actual ?? null) === expectedOwner;
-}
 export function stagingIdFor(realSessionId, token) {
     return `${realSessionId}#stg-${token}`;
 }

package/dist/session-sync.d.ts

@@ -36,6 +36,8 @@
  * Neither gap is fixed by this car (mechanical removal, no behavior changes) — they are reported here + in the
  * removal's final report for separate triage (port the fix to the live route, or explicitly accept the regression).
  *
+ * ✅ **STATUS UPDATE(会话附随物绑住客)**:附随物的写半(擦除 / 文件历史重放 / 规则重放与等内容判据 / 锚)整体搬到落定席位 `plugins/landed-attendants.ts`
+ * —— 每一笔写都在锁住会话根行、判过住客的落定段里;本模块只剩读半(manifest 导出、文件历史导出、blob 取值口)与干跑。
  * ✅ **STATUS UPDATE (2026-08-06 同日,[ref] 红先修绿)**:上面两条「NO live-route equivalent」已作废——
  * 两个保护都已移植到活路由(本文件尾部 [ref] 段:`sameRulesContent`/`replayPolicyRecords`/
  * `overwriteWipeIncapable`/`wipeSessionAttendants`;路由接线=src/http/routes/session-sync.ts 的两条重放腿
@@ -45,8 +47,8 @@
  */
 import type { StoreBackend } from "./plugins/store-backend.js";
 import { type SyncRelation } from "./session-sync-kernel.js";
-import { type SessionTreeEntry, type SessionRulesRecord, type FileHistoryError, type FileHistoryExport, type FileHistoryResult, type SessionPermissionRules, type StoredSessionRules, type SessionPolicyStore } from "@sema-agent/core";
-import type { ServiceBlobExchange, ServiceFileHistoryStore, ServiceSessionPolicyStore, ResumeAnchorStore } from "./plugins/store-backend.js";
+import type { SessionTreeEntry, SessionRulesRecord, FileHistoryError, FileHistoryExport } from "@sema-agent/core";
+import type { ServiceBlobExchange, ServiceFileHistoryStore, SqlBlobPutResult, SyncLanding } from "./plugins/store-backend.js";
 /**
  * core 7.55.0 [ref] T2([ref]):一只会话的文件历史**读不全**(撕裂 / 读不出的边界、读不出的跟踪集 —— 店的 `exportHistory` 答 `{ ok: false }`,`adopt_failed`
  * 带店判的 `permanence`)。它**不是**「没有历史」:读成 `null` 的同步会把这只会话的全部 rewind 历史丢在路上、还答成功。会话同步的两只拉取口
@@ -64,68 +66,38 @@ export declare class FileHistoryUnreadableError extends Error {
  */
 export declare function exportedFileHistory(store: Pick<ServiceFileHistoryStore, "exportHistory">, sessionId: string): Promise<FileHistoryExport | null>;
 /** A blob getter: content-addressed bytes for a sha256 hash, or `undefined` if the source can't supply them.
- *  Returned by {@link exportSessionManifest} (closes over the source store); consumed wherever a caller pulls
- *  content-addressed history bytes lazily (the live PUSH route's `importHistory` replay). */
+ *  The live PUSH route's `importHistory` replay reads one — always the getter of a {@link VisibleBlobs} answer (never an unscoped read of the store). */
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
 /**
  * 「这只文件历史店能不能交换 blob」的**唯一**读法:店的 `blobExchange` 组,经 core 的判官 `fileHistoryBlobExchangeOf` 读 —— 没有组 ⇒ `undefined`
  * (core 的 local 文件店);整组 ⇒ 三只成员(判官已绑好);缺一员 / 组不是对象 / 店还带退役的标记词 ⇒ 判官拒(`config.invalid_argument`,响亮,不是「没有」)。
- * 能力事实 `sessionSyncFileHistory`(capability-facts)与取值口 {@link blobGetterOf} 都读它 —— 事实说有,取值口就通到同一组的 `get`;事实说没有,取值口恒空。
+ * 会话同步的 blob 面 {@link landingBlobFacesOf} 读它取字节;交换组的 `put` / `has` 路由不握有 —— 读它们的是 core 契约套件与店自己的按落点来历面(经它写字节、问在场)。
  * 返回型收窄到本仓的 {@link ServiceBlobExchange}:判官交回的是店自己那一组的成员(只绑定、不包装),店型声明的组就是那一型。
  */
 export declare function blobExchangeOf(store: ServiceFileHistoryStore): ServiceBlobExchange | undefined;
-/** 一只文件历史店自己的 blob 取值口({@link BlobGetter}):从 {@link blobExchangeOf} 派生 —— 有交换组 ⇒ 组的 `get`;没有(core 的 local 文件店)⇒ 恒答 `undefined`(「这里取不到」)。
- *  拉取面(manifest 的 `getBlob`)、identical 自愈臂、提交臂三处读同一只,不各写一份「无组则 undefined」。 */
-export declare function blobGetterOf(store: ServiceFileHistoryStore): BlobGetter;
-/** The history-import capability face of a `FileHistoryStore` (`importHistory` is OPTIONAL on the core
- *  contract — a store without it cannot be a 2c history sink). */
-export interface FileHistoryImportFace {
-    importHistory(scope: string, data: FileHistoryExport, srcGetBlob: BlobGetter): Promise<FileHistoryResult>;
+/**
+ * 一次可见性读的答案:这个落点此刻看得见的 hash 集,和**只答这几枚**的取值口(集外的一律 `undefined` —— 重放观察到它,答与预检同一个 `missing_blob`)。
+ * 预检的答案就是重放取值口的许可集:第一阶段读一次、冻结进暂存随第二阶段走 —— 覆盖写的擦除排在重放之前,擦掉旧图不改许可。
+ */
+export interface VisibleBlobs {
+    readonly hashes: ReadonlySet<string>;
+    readonly get: BlobGetter;
 }
-/** Single-point capability probe ([ref] R7): does `fs` carry the optional `importHistory` seam?
- *  Returns the bound method (never a naked function reference — `this` inside must resolve to `fs`) or
- *  `undefined` when absent. Callers gate on the RETURN VALUE, not a separate `typeof` check, so there is
- *  exactly one place that knows the shape of the probe. */
-export declare function fileHistoryImportFace(fs: unknown): FileHistoryImportFace | undefined;
+/** 什么都看不见的答案:信封不引用 blob,或这台部署没有 blob 面(下面 {@link landingBlobFacesOf} 答 `undefined`)。 */
+export declare const NO_VISIBLE_BLOBS: VisibleBlobs;
 /**
- * {@link replayFileHistory} 的结果 = 店的 {@link FileHistoryResult};失败臂可再带 `missingBlob` —— 这一次尝试里**重放自己交给店的 getter 亲口答过 `undefined`** 的那枚 hash
- * (「这枚 blob 不在」是 getter 观察到的事实,不是从店码里猜的:同一个 `adopt_failed` 也可能是取值抛了 / 发布步撞上库的故障,那两形 `missingBlob` 缺席)。
- * 下发口({@link sendFileHistoryReplayFailure} 在路由里)据它铸 wire `missing_blob`,否则原样送店的码。
+ * 会话同步路由读写 blob 的**唯一**面(按落点):上传 = 店的按落点来历面 `putAt`(核址 → 字节 → 授予);可见 = 店的 `visibleAt`,取字节经交换组的 `get`、只放行可见集里的那几枚。
+ * 预检、identical 自愈臂与提交臂的重放取值、`GET …/sync/history/blobs/:hash` 三口读的是同一只 `visible`。
  */
-export type FileHistoryReplayResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly error: FileHistoryError;
-    readonly missingBlob?: string;
-};
-export type FileHistoryReplayFailure = Extract<FileHistoryReplayResult, {
-    ok: false;
-}>;
+export interface LandingBlobFaces {
+    put(landing: SyncLanding, hash: string, bytes: Uint8Array): Promise<SqlBlobPutResult>;
+    visible(landing: SyncLanding, hashes: readonly string[]): Promise<VisibleBlobs>;
+}
 /**
- * The 2c PUSH replay of a session's file-history graph — keep-SOURCE convergence over core's
- * non-destructive-target law. `importHistory` refuses a target that already holds a DIFFERENT graph
- * (typed `conflict`; the identical envelope re-publishes idempotently). On that arm, when the store has
- * the purge seam, the sync's documented semantic (the destination converges to the source's state, same
- * posture as the policy/anchor replays) is applied: wipe the scope, then import once more. Every bundled
- * store carries the verb (the SQL twins, and core's local File store from core 7.64.0), so the three backends
- * read one rule; a store WITHOUT `deleteBySession` (an embedder's) surfaces the typed conflict unchanged —
- * an honest capability limit, never a silent half-state. The wipe throws on a store fault (and core's stores
- * refuse it while they run a write of the scope): the throw propagates, nothing is re-imported.
- *
- * Honest residual (recorded, not hidden): if the RE-import after the wipe fails (a blob corrupted in
- * transit past the Phase-A presence check), the destination's old graph is already gone and the target
- * is left EMPTY — worse than the moment before this call, but strictly self-healing: the client re-PUTs
- * the blob and re-POSTs, and the retry lands on an empty target (importHistory's first-import arm).
- * The alternative (keeping the old graph) would wedge every retry on the same typed conflict forever.
- *
- * 缺 blob 的事实只在这里读一次:每次尝试给店的 getter 都包一层观察,店取到 `undefined` 就记下那枚 hash(按次计,替换臂的第二次尝试从空白起),
- * 失败时随结果交出({@link FileHistoryReplayResult.missingBlob})。预检({@link sessionSyncFileHistory} 事实 + 交换组的 `has`)管「这台部署根本收不到 / 索引里没有」,
- * 这里管「预检过了而这一枚取不到」(对象存储里已丢 / 校验和不符按缺席读 / 预检与重放之间被孤儿回收清走)—— 同一只不变量的两端,wire 上同一个词。
+ * 「这只文件历史店有没有会话同步的 blob 面」的**唯一**读法(能力事实 `sessionSyncFileHistory` 读它):交换组({@link blobExchangeOf})∧ 按落点来历面(`blobLanding`)两样都在 ⇒ 面;
+ * 缺一样 ⇒ `undefined`(fail-closed:给不出按落点可见性的店没有 blob 两口 —— 只有交换组而无来历面,就只能按全局内容地址表答「在不在」,那正是这只面要关掉的预言机)。
  */
-export declare function replayFileHistory(store: ServiceFileHistoryStore, scope: string, envelope: FileHistoryExport, srcGetBlob: BlobGetter, opts: {
-    allowReplace: boolean;
-}): Promise<FileHistoryReplayResult>;
+export declare function landingBlobFacesOf(store: ServiceFileHistoryStore): LandingBlobFaces | undefined;
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its
@@ -196,10 +168,7 @@ export interface SessionManifest {
 export declare function exportSessionManifest(sessionId: string, srcBackend: StoreBackend, 
 /** [ref]:文件历史读**装配结果**(捕获脸),不直取 `srcBackend.fileHistory()` —— 「这台部署有没有文件历史店」
  *  只在 `assembleFileHistory` 判一次。同一个后端铸的同一只店,四店同源的不变式不变。 */
-historyStore: ServiceFileHistoryStore): Promise<{
-    manifest: SessionManifest;
-    getBlob: BlobGetter;
-} | null>;
+historyStore: ServiceFileHistoryStore): Promise<SessionManifest | null>;
 /**
  * §7 DRY-RUN — classify what importing `sessionId` from `srcBackend` into `dstBackend` WOULD do, WITHOUT writing
  * anything (the shell can present a keep-local / keep-cloud / fork-new choice up front).
@@ -208,51 +177,4 @@ historyStore: ServiceFileHistoryStore): Promise<{
  * between the source's full durable log and the destination's current log (a `null` dst log ⇒ `fresh`). No writes.
  */
 export declare function planSync(sessionId: string, srcBackend: StoreBackend, dstBackend: StoreBackend): Promise<SyncRelation | null>;
-/** [ref] ①(死码 A6 修的移植):同内容判据 —— 比较「归一化、去 rev」后的字节形。putRules 每次
- *  无条件写都 rev+1,而 rev 是 operator 乐观锁的 CAS 令牌(`PutRulesOptions.expectedRev`),
- *  幂等重试/无害重复同步不该把在途 CAS 打失败。归一化用 core 的 `normalizeRules`(store 落盘
- *  前走同一函数 ⇒ 两侧同坐标);它略过店的戳 `rev` / `gen`(`listBySession` 的 rules 含 rev,
- *  它不是内容;core 7.51.0 [ref] 起 `normalizeRules` 自己略过,修前的 `stripRev` 包裹随之退役)。
- *  两侧过的是同一只形读法(core 7.51.0 `readSessionRulesShape`):`incoming` 由写口读者(引擎的写口判官)交出,`stored` 由店的读回交出 ——
- *  店读回读不出形的行答 `corrupt`、根本到不了这里,所以 `normalizeRules` 对两侧都不抛(修前本仓的读回比引擎宽,另有一只判官先挡一次)。
- *  🔴 字节同 ≠ 意思同(core 7.51.2 行自带文法戳;codex r1 [high] 验真):`normalizeRules` 把店的戳 `rev` / `gen` / `grammar` 都略过,而同一串桶字节在两种文法里是两句话 ——
- *  目的行无戳(文法 0:`toolAllow` 里的 `Bash(rm:*)` 什么都不放行)、导入记录带 `grammar: 1`(放行 rm),只比字节会判「同内容」、零次 putRules、同步答 200 而目的行仍是旧意思。
- *  所以字节同之外还问引擎的收紧比对 `loosenReasons` **双向**(两侧各在自己的文法里读:`stored` 带 `rev`,`incoming` 带 `grammar`):两个方向都「没放宽」才是同一句话;
- *  意思不同就交给 `putRules` 的判官(非 operator ⇒ `loosen_forbidden`;operator ⇒ 改写成当前文法、盖戳)。本仓仍零处读 / 比戳值;意思由引擎说。
- *  🔴 core 7.55.0 [ref]:行还有一格 **operator 部分**(`StoredSessionRules.operatorRules`:非 operator 的写只能收回非 operator 写加上去的东西;缺席 = 整行归 operator)。
- *  桶同、意思同,这一次写仍可能挪动它 —— operator 重放把整行变成 operator 的(引擎写口判官的答:operator 写的值整只归 operator)。只比桶会判「同内容」⇒ 零次 putRules ⇒
- *  属主盖过戳的目的行保持「属主收得回」,源端 operator 断言过的条目在目的端被属主一条非 operator 的写收回(安全轴的静默放宽)。所以第三问:这一次写之后的部分
- *  = 引擎写口判官对(目的行, 记录, 这次重放的态度)的答,与目的行现有的部分按同一读法(缺席 = 整行)比;不同就交给 `putRules`。判官拒 ⇒ 原样上抛(`putRules` 会拒同一句)。
- *  `operator` 必填:同一份记录在 operator 与非 operator 的重放下是两种写(漏传是编译错,不是一条静默的读法)。 */
-export declare function sameRulesContent(stored: StoredSessionRules | null, incoming: SessionPermissionRules, operator: boolean): boolean;
-/** [ref] ① 的重放腿共享实现:PUSH 路由的两条 policy 重放腿(Phase A identical 短路支 / Phase B
- *  commit 后支)都从这里走 —— 等内容跳过(rev 零漂移),真变更照常落地(E6 tighten-only 门在
- *  putRules 内部,此处不重述)。 */
-export declare function replayPolicyRecords(store: Pick<SessionPolicyStore, "getRules" | "putRules">, sessionId: string, records: readonly SessionRulesRecord[], operatorOk: boolean): Promise<void>;
-/** [ref] ② 能力预检(fail-loud 方向,[ref] 判据:保护型能力缺席=fail-closed):consented
- *  overwrite-dst 需要 policy 店的 `deleteBySession` purge seam 才能不留混合态;缺席=true,路由在
- *  commit **之前**用它干净中止(此时零写入落地),wire 拒因字面量归路由所有(api-error-text-freeze
- *  锚字面站点)。anchor 店的 deleteBySession 是类型必填、history 店有 core 必填的 `reap` 兜底(+
- *  {@link replayFileHistory} 的 conflict 收敛臂),都不构成缺席面;唯一可缺的就是 policy 这条
- *  (core 接口上是可选方法)。 */
-export declare function overwriteWipeIncapable(policyStore: ServiceSessionPolicyStore | undefined): boolean;
-/** [ref] ②(死码 ⓪ 擦除步的移植):consented overwrite-dst = keep-source,结果必须是**源端那
- *  一份**,不得混成「源端对话 + 目的端遗留 policy/anchor/历史」(混合态比丢历史更危险:悬空
- *  anchor 指向已 purge 的 entry、被放弃分支的 policy 行继续 gating、目的端旧历史图挡住源端图的
- *  importHistory 空目标法则)。调用时点=commit(原子 swap)成功**之后**、附随物重放**之前**:
- *  死码在任何写入前擦(其 entries 写本身非原子);活路由有真 commit point,擦在 commit 前会在
- *  「commit 失败」时留下反向混合态(目的端对话完好、附随物已毁)——方向更坏。
- *  诚实残余:进程在 commit 与本函数之间崩溃时,重试落 Phase A identical 支(无 wipe)⇒ 遗留行
- *  可存活;该窗口窄于修前世界(修前=遗留行**恒**存活),与 §8「历史重放失败 ⇒ 422 重试自愈」
- *  同款接受,记录于此不装没有。
- *  各店姿势:file history=deleteBySession(整 scope 清空;blob 走异步孤儿 GC)缺席则 core 必填
- *  `reap(scope, [])`(丢全部 boundary;v1 基线按 core 契约留存 —— 随后 {@link replayFileHistory}
- *  的 conflict 臂在有 purge 缝的店上收敛,无缝的店如实 422);anchor=直调(类型必填);
- *  policy=deleteBySession(路由已用 {@link overwriteWipeIncapable} 预检过,此处缺席=类型外的
- *  JS 层残缺实现,直调抛 TypeError 即 fail-loud)。 */
-export declare function wipeSessionAttendants(stores: {
-    fileHistoryStore?: ServiceFileHistoryStore | undefined;
-    sessionPolicyStore?: ServiceSessionPolicyStore | undefined;
-    resumeAnchorStore?: Pick<ResumeAnchorStore, "deleteBySession"> | undefined;
-}, sessionId: string): Promise<void>;
 //# sourceMappingURL=session-sync.d.ts.map

package/dist/session-sync.js

@@ -1,8 +1,7 @@
 import { anchorEntryDeclared, classifySyncRelationship } from "./session-sync-kernel.js";
 import { recordFailOpen } from "./observability/fail-open.js";
-import { loosenReasons, normalizeRules } from "@sema-agent/core";
 import { sessionFactsReadOf } from "./http/owner-access.js";
-import { fileHistoryBlobExchangeOf, judgeSessionRulesWrite } from "@sema-agent/core";
+import { fileHistoryBlobExchangeOf } from "@sema-agent/core";
 export class FileHistoryUnreadableError extends Error {
     sessionId;
     failure;
@@ -25,38 +24,21 @@ export async function exportedFileHistory(store, sessionId) {
 export function blobExchangeOf(store) {
     return fileHistoryBlobExchangeOf(store);
 }
-export function blobGetterOf(store) {
+export const NO_VISIBLE_BLOBS = { hashes: new Set(), get: async () => undefined };
+export function landingBlobFacesOf(store) {
     const exchange = blobExchangeOf(store);
-    return exchange ? exchange.get : async () => undefined;
-}
-export function fileHistoryImportFace(fs) {
-    const candidate = fs?.importHistory;
-    if (typeof candidate !== "function")
+    const provenance = store.blobLanding;
+    if (exchange === undefined || provenance === undefined)
         return undefined;
-    return { importHistory: candidate.bind(fs) };
-}
-export async function replayFileHistory(store, scope, envelope, srcGetBlob, opts) {
-    const face = fileHistoryImportFace(store);
-    if (face === undefined) {
-        return { ok: false, error: { code: "unsupported_format", message: "this deployment's file-history store has no importHistory seam" } };
-    }
-    const attempt = async () => {
-        let missing;
-        const observed = async (hash) => {
-            const bytes = await srcGetBlob(hash);
-            if (bytes === undefined && missing === undefined)
-                missing = hash;
-            return bytes;
-        };
-        const r = await face.importHistory(scope, envelope, observed);
-        return r.ok || missing === undefined ? r : { ok: false, error: r.error, missingBlob: missing };
+    return {
+        put: (landing, hash, bytes) => provenance.putAt(landing, hash, bytes),
+        visible: async (landing, hashes) => {
+            if (hashes.length === 0)
+                return NO_VISIBLE_BLOBS;
+            const seen = await provenance.visibleAt(landing, hashes);
+            return { hashes: seen, get: async (hash) => (seen.has(hash) ? exchange.get(hash) : undefined) };
+        },
     };
-    let r = await attempt();
-    if (!r.ok && r.error.code === "conflict" && opts.allowReplace && typeof store.deleteBySession === "function") {
-        await store.deleteBySession(scope);
-        r = await attempt();
-    }
-    return r;
 }
 function ownerAware(backend) {
     return backend.session();
@@ -87,7 +69,6 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
     if (summaryOf === undefined)
         throw new Error("exportSessionManifest: the session store has no row read face (sessionSummaryOf) — the sessionSync fact should have refused this deployment");
     const row = await summaryOf(sessionId);
-    const getBlob = blobGetterOf(fs);
     const declared = new Set(entryIds);
     const soundAnchors = anchors.filter((a) => {
         if (anchorEntryDeclared(declared, a.entryId))
@@ -95,10 +76,7 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
         recordFailOpen("server.session-sync.dangling-anchor-export", `sessionId=${brief(sessionId)} eventId=${brief(a.eventId)} entryId=${brief(a.entryId)}`);
         return false;
     });
-    return {
-        manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors: soundAnchors, ...(row !== undefined ? { title: row.title, pinned: row.pinned } : {}) },
-        getBlob,
-    };
+    return { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors: soundAnchors, ...(row !== undefined ? { title: row.title, pinned: row.pinned } : {}) };
 }
 export async function planSync(sessionId, srcBackend, dstBackend) {
     const srcEntries = (await ownerAware(srcBackend).exportEntries?.(sessionId)) ?? null;
@@ -107,44 +85,4 @@ export async function planSync(sessionId, srcBackend, dstBackend) {
     const dstEntries = (await ownerAware(dstBackend).exportEntries?.(sessionId)) ?? null;
     return classifySyncRelationship(srcEntries, dstEntries);
 }
-export function sameRulesContent(stored, incoming, operator) {
-    if (stored === null)
-        return false;
-    const norm = (r) => JSON.stringify(normalizeRules(r));
-    if (norm(stored) !== norm(incoming))
-        return false;
-    if (loosenReasons(stored, incoming).length !== 0 || loosenReasons(incoming, stored).length !== 0)
-        return false;
-    return operatorPartUnmoved(stored, incoming, operator);
-}
-function operatorPartUnmoved(stored, incoming, operator) {
-    const next = judgeSessionRulesWrite(stored, incoming, { operator });
-    const partOf = (row) => JSON.stringify(normalizeRules(row.operatorRules ?? row));
-    return partOf(next) === partOf(stored);
-}
-export async function replayPolicyRecords(store, sessionId, records, operatorOk) {
-    for (const rec of records) {
-        const cur = await store.getRules(sessionId, rec.principal);
-        if (sameRulesContent(cur, rec.rules, operatorOk))
-            continue;
-        await store.putRules(sessionId, rec.principal, rec.rules, { operator: operatorOk });
-    }
-}
-export function overwriteWipeIncapable(policyStore) {
-    return policyStore !== undefined && typeof policyStore.deleteBySession !== "function";
-}
-export async function wipeSessionAttendants(stores, sessionId) {
-    const fs = stores.fileHistoryStore;
-    if (fs !== undefined) {
-        if (typeof fs.deleteBySession === "function")
-            await fs.deleteBySession(sessionId);
-        else
-            await fs.reap(sessionId, []);
-    }
-    if (stores.resumeAnchorStore !== undefined)
-        await stores.resumeAnchorStore.deleteBySession(sessionId);
-    const policy = stores.sessionPolicyStore;
-    if (policy !== undefined)
-        await policy.deleteBySession(sessionId);
-}
 //# sourceMappingURL=session-sync.js.map

package/dist/session-titler.d.ts

@@ -28,9 +28,15 @@
  */
 import type { HookLlmCall } from "./hooks/hook-runner.js";
 import { type SessionTitledFrame } from "./session-titled-frame.js";
+import type { SessionFace } from "./session-incarnation.js";
 export interface SessionTitlerDeps {
-    /** Write-once store leg (SQL twins / local sidecar). Resolves false when a title already existed. */
-    setTitleIfNull(sessionId: string, title: string): Promise<boolean>;
+    /** Write-once store leg (SQL twins / local sidecar). Resolves false when a title already existed — or when the session is no longer `landed`
+     *  (the occupant read at acceptance: the store judges it under the session's row lock with the row-write judge, so a title generated for one
+     *  occupant never lands on a session deleted and re-created under the same id meanwhile, nor on a freed id). */
+    setTitleIfNull(sessionId: string, title: string, landed: SessionFace): Promise<boolean>;
+    /** The session's occupant now (the owner accessor's `sessionOccupantReadOf`) — read once, at acceptance, while the accepting leg waits on it
+     *  (so the run is live and the occupant is that run's); `undefined` ⇒ no row to title. */
+    occupantOf(sessionId: string): Promise<SessionFace | undefined>;
     /** Cheap pre-LLM probe: "titled" = skip (a restart/evicted-seen/another replica
      *  already paid — don't re-spend an LLM call); "untitled" = generate; "none" = the session_meta row hasn't
      *  been REGISTERED (or was deleted meanwhile) — retry after a grace window,
@@ -54,7 +60,8 @@ export interface SessionTitler {
     /** `model`([ref]②)= 本 turn 真实驱动的模型——带上则标题 hook 同链路,不再裸落 env 缺省。 */
     /** `onTitled` = 这一次调用**自己**把标题写成之后(`setTitleIfNull` 落行)交出的活通知(`session_titled` 帧,契约 §4a-ttl):只在落行的那一支调用恰一次 ——
      *  已有标题 / 竞态输了 / 模型失败 / 空标题 / 这个会话已有一次在飞的调用,都不调。回调同步执行、**不许抛**;抛了也不影响已落行的标题(见下 `frame_failed`)。 */
-    maybeTitle(sessionId: string, objective: string, model?: string, onTitled?: (frame: SessionTitledFrame) => void): void;
+    /** Resolves once the occupant to title is pinned (bounded; the accepting leg awaits it), the model call and the write then run in the background. */
+    maybeTitle(sessionId: string, objective: string, model?: string, onTitled?: (frame: SessionTitledFrame) => void): Promise<void>;
 }
 /** 标题的显示预算(码元,含截断记号)—— 界的属主是出口座的 `session-title` 行,这里读它;落在 `title` 列宽 `SESSION_TITLE_MAX_CHARS`(session-row.ts)之内。 */
 export declare const TITLE_MAX_CHARS: number;

package/dist/session-titler.js

@@ -2,6 +2,7 @@ import { recordFailOpen } from "./observability/fail-open.js";
 import { seatMaxChars, seatText } from "./trace/exit-seat.js";
 import { userAuthoredText } from "./user-authored-text.js";
 import { buildSessionTitledFrame } from "./session-titled-frame.js";
+import { withinIoDeadline } from "./instruction-source-notice.js";
 export const TITLE_MAX_CHARS = seatMaxChars("session-title");
 const OBJECTIVE_SNIPPET_CHARS = 600;
 const LLM_TIMEOUT_MS = 15_000;
@@ -52,7 +53,7 @@ export function createSessionTitler(deps) {
         .then((state) => ({ state, unreadable: false }))
         .catch(() => ({ state: continueWord, unreadable: true }));
     return {
-        maybeTitle(sessionId, objective, model, onTitled) {
+        async maybeTitle(sessionId, objective, model, onTitled) {
             if (!sessionId || !userAuthoredText(objective))
                 return;
             if (seen.has(sessionId))
@@ -63,6 +64,19 @@ export function createSessionTitler(deps) {
                     seen.delete(oldest);
             }
             seen.add(sessionId);
+            let landed;
+            try {
+                landed = await withinIoDeadline(() => deps.occupantOf(sessionId));
+            }
+            catch {
+                landed = undefined;
+            }
+            if (landed === undefined) {
+                seen.delete(sessionId);
+                deps.metrics?.inc("session_title_total", { outcome: "row_not_yet" });
+                return;
+            }
+            const occupant = landed;
             void (async () => {
                 let state = (await probeOrContinue(sessionId, "untitled")).state;
                 if (state === "none") {
@@ -90,12 +104,11 @@ export function createSessionTitler(deps) {
                     deps.metrics?.inc("session_title_total", { outcome: "empty" });
                     return;
                 }
-                const landed = await deps.setTitleIfNull(sessionId, title);
-                if (!landed) {
+                const wrote = await deps.setTitleIfNull(sessionId, title, occupant);
+                if (!wrote) {
                     const after = await probeOrContinue(sessionId, "none");
-                    if (after.state !== "untitled")
-                        seen.delete(sessionId);
-                    deps.metrics?.inc("session_title_total", { outcome: after.unreadable ? "probe_failed" : after.state === "none" ? "row_not_yet" : "already_titled" });
+                    seen.delete(sessionId);
+                    deps.metrics?.inc("session_title_total", { outcome: after.unreadable ? "probe_failed" : after.state === "none" ? "row_not_yet" : after.state === "untitled" ? "occupant_changed" : "already_titled" });
                     return;
                 }
                 seen.delete(sessionId);

package/dist/ssh-host-key.d.ts

@@ -36,12 +36,17 @@ export interface SshHostKeyPolicy {
     knownHostsPath?: string;
 }
 /** {@link createSshHostKeyVerifier} 的判词。`verified:false` = 两旋钮都缺席那一格(照连,但响亮)。 */
+/**
+ * 判官的一次判。拒的那一臂带 `standing`:对面出示的密钥被钉判了不过(指纹不符 / 条目换了钥 / `@revoked` / 没有可用条目)⇒ `true` —— 同一配置同一主机每次同答;
+ * 钉的文件此刻读不出 ⇒ `false`(这一次判不了,文件可能正被换写,下一次连接重判)。
+ */
 export type SshHostKeyVerdict = {
     ok: true;
     verified: boolean;
 } | {
     ok: false;
     reason: string;
+    standing: boolean;
 };
 /** SHA256 base64 指纹的**归一**:`SHA256:` 前缀可选、`=` 填充可选;形不合 ⇒ **抛**(调用方在 boot 期拒启)。 */
 export declare function normalizeSshFingerprint(raw: string): string;

package/dist/ssh-host-key.js

@@ -82,6 +82,7 @@ export function createSshHostKeyVerifier(opts) {
                 ok: false,
                 reason: `SSH host key rejected for ${host}:${port} — fingerprint mismatch. presented=${presented} expected=SHA256:${fingerprint} (SSH_HOST_FINGERPRINT). ` +
                     keyscanHint(host, port),
+                standing: true,
             };
         }
         if (knownHostsPath !== undefined) {
@@ -95,6 +96,7 @@ export function createSshHostKeyVerifier(opts) {
                     reason: `SSH host key rejected for ${host}:${port} — SSH_KNOWN_HOSTS (${knownHostsPath}) could not be read at connect time: ` +
                         `${e instanceof Error ? e.message : String(e)}. presented=${presented}. ` +
                         keyscanHint(host, port),
+                    standing: false,
                 };
             }
             const verdict = matchKnownHosts(text, host, port, key.toString("base64"));
@@ -108,6 +110,7 @@ export function createSshHostKeyVerifier(opts) {
                     ok: false,
                     reason: `SSH host key rejected for ${host}:${port} — ${why}. presented=${presented} source=SSH_KNOWN_HOSTS:${knownHostsPath}. ` +
                         keyscanHint(host, port),
+                    standing: true,
                 };
             }
         }