@sema-agent/server 7.151.0 → 7.152.0

package/dist/plugins/task-attachment-store.js

@@ -5,7 +5,7 @@ import { attachmentKindOf, PROJECT_BUNDLE_MIME } from "../project-bundle.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError, retryOnDeadlock } from "./sql-errors.js";
 import { countClientWriteOn } from "./session-withdraw-sql.js";
-import { readAtAddress } from "./blob-backend.js";
+import { isContentAddress, readAtAddress } from "./blob-backend.js";
 import { sealStoreClass } from "./store-boundary.js";
 export const TaskAttachmentRecordSchema = z.object({
     id: z.string(),
@@ -386,6 +386,8 @@ export class TiDBTaskAttachmentStore {
             batch = [];
         };
         for await (const o of lister.listObjects()) {
+            if (!isContentAddress(o.hash))
+                continue;
             if (nowMs - o.lastModifiedMs < graceMs)
                 continue;
             batch.push(o.hash);
@@ -506,6 +508,8 @@ export class PgTaskAttachmentStore {
             batch = [];
         };
         for await (const o of lister.listObjects()) {
+            if (!isContentAddress(o.hash))
+                continue;
             if (nowMs - o.lastModifiedMs < graceMs)
                 continue;
             batch.push(o.hash);

package/dist/plugins/tidb-pool.js

@@ -33,6 +33,7 @@ import { acquireAdvisoryLock, releaseAdvisoryLock } from "./ensure-schema-lock-p
 import { SKILL_EXEMPTION_CUTOFF_ID, markIfAbsentSql, migrationMarkerDdl } from "./one-time-migration-marker.js";
 import { replicaRegistrationDdl } from "./replica-registration.js";
 import { servingRequirementDdl } from "./serving-requirement.js";
+import { sessionBlobNamespaceClaimDdl } from "./session-blob-claim-token.js";
 import { createCloseAwarePool } from "./sql-driver.js";
 export function tidbPoolOptions(tidb) {
     const { host, port, user, password, database, connectionLimit } = tidb;
@@ -268,12 +269,11 @@ export const SCHEMA_STATEMENTS = [
      session_id   VARCHAR(190) NOT NULL,
      version      INT          NOT NULL DEFAULT 1,
      status       VARCHAR(16)  NOT NULL DEFAULT 'pending',
-     tool_name    VARCHAR(190) NULL,
      tool_call_id VARCHAR(190) NULL,
-     -- tool_input: the pending-approval tool args = the approval card's payload, surfaced in listPending so the
-     -- BFF need not N+1-fetch trace.turns per pending item. Redacted + bounded at put().
-     -- NULL on PRE-MIGRATION rows (suspended before the column existed) ⇒ the consumer falls back.
-     tool_input   JSON         NULL,
+     -- (no display-copy columns: the approval queue row's action facts — tool name, input, risk descriptor, rule offers,
+     --  bidi bit — are projected at read time from ONE whole-row decode of checkpoint, the copy a resume executes;
+     --  the stored copies tool_name / tool_input / risk_descriptor / rule_suggestions / has_bidi_controls were retired by
+     --  one-time migration M54. tool_call_id / bound_input_hash / approval_card / gate_kind stay: readers find rows by them.)
      checkpoint   JSON         NOT NULL,
      outcome      JSON         NULL,
      deadline     BIGINT       NULL,
@@ -331,25 +331,6 @@ export const SCHEMA_STATEMENTS = [
      --  那条:文本相等性有太多与业务无关的自由度,整数没有。)
      -- **绝不**用它做 resolve 的 OCC:bump 它不影响 core 的 rev 语义。
      pending_steer_rev BIGINT  NOT NULL DEFAULT 0,
-     -- risk_descriptor (design/80 riskDescriptor inbox): core's INERT CheckpointGate.riskDescriptor ({severity
-     -- 1-5, axes, toolName, redacted summary, touchedPaths}), stamped at put() so listPending can surface it +
-     -- triage-sort the supervisor inbox by severity DESC — WITHOUT parsing the checkpoint blob per row.
-     -- NULL on gates with no descriptor.
-     risk_descriptor TEXT        NULL,
-     -- rule_suggestions ([3683]-2/[3684]② mint 面归因):core 挂在 pendingAction.ruleOffers 上的规则
-     -- 候选(design/179 §4;与同步腿 AskRequest.ruleOffers 同一条契约;design/375 换形后载荷=判别联合,列名保留),在 put() 落列 —— 于是
-     -- listPending 不必为一格展示材料去拖整只 checkpoint blob(那是整份 suspend 快照)。落列前过
-     -- boundedRuleOffers:窄读(坏条丢弃)+ redactSecrets(候选文本由命令原文铸出,而运维队列跨租户
-     -- 可见)+ 基数截断。NULL = 无供给(规则车道没武装 / 命令说不出规则 / 这只 ask 规则清不掉),读口
-     -- 据此省键而不是铸空数组。
-     rule_suggestions TEXT       NULL,
-     -- has_bidi_controls(S-30① / #356②;core 5.60.0 #438):bidi **在场位** —— core 在 park mint 写在
-     -- pendingAction(tool_approval 臂)上的那一位,put() 反范式成列,listPending 据它给 /v1/approvals 与
-     -- /v1/approvals/stream 的行铸 hasBidiControls:true(此前耐久运维队列一个位都没有:同一张卡
-     -- 「活着看得到告警、park 之后看不到」)。取值 **1 或 NULL、恒不写 0**:core 的契约是 true 或缺席
-     -- (缺席 = 没检出 ≠ 干净),一个 0 会把「没检出」谎成「已确认干净」。老行(本列诞生前 park 的)
-     -- NULL ⇒ 读口省键。clay 批 2026-07-26 TINYINT(1) 归一先例:布尔列 TiDB 侧 TINYINT(1)。
-     has_bidi_controls TINYINT(1) NULL,
      -- execution_outcome / execution_at_ms(S-160;core 7.7.0 #602 的耐久半场):**决定被怎么处置了**的
      -- 结算记录 —— resume 腿上那次调用的 tool_end 帧携带的 GateOutcome,与 outcome 列(决定本身,不可变)
      -- 是两个轴:一个人批了(outcome 里 disposition=allowed),部署自己的复核在 post-CAS 否了他改过的参数
@@ -365,6 +346,10 @@ export const SCHEMA_STATEMENTS = [
      -- plugins/checkpoint-index-columns.ts 的 hostSessionOf 求值一次;存量行由一次性迁移 M49 自 session_id 回填。按会话找卡的读口(决断 / 取消 / 收割 /
      -- 续跑输入回收 / 运维队列行)只读它;session_id 只答「这是哪段对话」。列定义的唯一属主 = 同模块的 CHECKPOINT_HOST_SESSION_COLUMN。
      ${CHECKPOINT_HOST_SESSION_COLUMN.mysql},
+     -- card_scope_root:这张卡上「不再询问」规则的 project root **铸卡快照**(停驻那一刻由跑这条 run 的副本写一次,读法与问行 rule_scope_root 同义;
+     -- 不在兑付时重推)。NULL = 授权发生地在 server 坐标系里不可知(远程沙箱 / 未登记的 host / 多租 host 车道),或行由加这一列之前的构建落下 ⇒
+     -- 规则兑付不铸 scope(core 答 scope-unresolved,只会拒不会放宽)。写口 put,读口 cardScopeRootOf;上界同 rule_scope_root(ABSOLUTE_HOST_PATH_MAX)。
+     card_scope_root   VARCHAR(4096) NULL,
      PRIMARY KEY (token),
      KEY idx_checkpoint_status_deadline (status, deadline),
      KEY idx_checkpoint_session_status (session_id, status),
@@ -564,6 +549,15 @@ export const SCHEMA_STATEMENTS = [
      created_at DATETIME(3) NOT NULL,
      PRIMARY KEY (blob_hash),
      KEY idx_file_history_blob_created (created_at)
+   ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS file_history_blob_grant (
+     scope         VARCHAR(64)  NOT NULL,
+     landing_owner VARBINARY(${PRINCIPAL_MAX_BYTES}) NOT NULL,
+     blob_hash     CHAR(64)     NOT NULL,
+     granted_at    DATETIME(3)  NOT NULL,
+     PRIMARY KEY (scope, landing_owner, blob_hash),
+     KEY idx_file_history_blob_grant_granted (granted_at),
+     KEY idx_file_history_blob_grant_blob (blob_hash)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id        VARCHAR(191) NOT NULL,
@@ -784,6 +778,7 @@ export const SCHEMA_STATEMENTS = [
     migrationMarkerDdl("mysql"),
     replicaRegistrationDdl("mysql"),
     servingRequirementDdl("mysql"),
+    sessionBlobNamespaceClaimDdl("mysql"),
     ...TIDB_APPROVAL_ASK_STATEMENTS,
     ...TIDB_MEMORY_OPTOUT_GRANT_STATEMENTS,
     ...TIDB_SESSION_CAPTURE_OPTOUT_STATEMENTS,

package/dist/plugins/workspace-custody.d.ts

@@ -8,13 +8,14 @@
  *    (停驻腿的环境引擎还拿着,续跑腿拿到的就是它);那一只正在收场 ⇒ 等它的收场落定再铸,它欠着的账交给新的这只;没有 ⇒ 铸一只入表。
  *    同一身份同一时刻只有一条腿(会话锁 + run 认领),交回同一只不会让两条腿同时用它。
  *  · **工作区的生命归持有它的环境,不归铸它的那一只**:表里每一只成员自己说它此刻持有哪只工作区;一只工作区能不能删 = 表里除问者之外还有没有成员持有它
- *    ({@link WorkspaceCustody.holder})—— 没有才删,有就把删交给最后放手的那一只。
+ *    ({@link WorkspaceCustody.holder})—— 没有才删,有就把删交给最后放手的那一只(host 车道另问一句「此刻谁在里面」,见下)。
  *
  * ## 两条车道怎么读同一张表
  *  · local-docker:工作区 = 身份派生名的那只容器;一只身份同一时刻只有一只没收场的成员(上面的交回律),容器名又由身份派生 ⇒ 不可能有第二个持有者,成员收场即删
  *    (读 {@link WorkspaceCustody.envOf};欠账 = 删除没证实的那只容器,交给同一身份的下一只)。
- *  · host:工作区 = 本服务铸的临时根;委派子代按父的工作目录落根 ⇒ 子代的环境与父的共持那只根(铸时问 {@link WorkspaceCustody.holder}「谁持有包含这一处的根」),
- *    收场放手时问同一只「还有谁持有它」—— 父收场时子代还停驻在里面 ⇒ 父不删,子代最后一条腿收场时删。
+ *  · host:工作区 = 本服务铸的临时根;委派子代按父的工作目录落根 ⇒ 子代的环境与父的共持那只根(铸时问 {@link WorkspaceCustody.holder}「谁持有包含这一处的根」,
+ *    只能多记持有者)。删只在最后一只持有者放手那一拍、同一同步段里问同一只 `holder`「还有谁持有它,或此刻还没离场、工作目录读得出地在它里面」之后发生 ——
+ *    有 ⇒ 不删(在里面的那一只当场接过删除);读不出 ⇒ 不删不交接,留给退出边界;没人才删。父收场时子代还停驻在里面 ⇒ 父不删,子代最后一条腿收场时再判。
  *
  * ## 出表
  * 成员收场落定、什么都不欠、什么都不持有({@link CustodyMember.settled})⇒ 出表;没收场的成员(停驻腿的环境)一直在表里(停驻中被店层取消 / 过期的,引擎不销毁它,它持有的工作区

package/dist/question.d.ts

@@ -7,7 +7,8 @@ export interface QuestionFrame {
     type: "question" | "question_complete";
     questionId: string;
     /** "question" only: the model's structured questions, secret-redacted. UNTRUSTED-for-display (shell renders; never
-     *  re-feeds a model). Absent on an over-cap payload (the ask then reports unavailable — no frame is emitted at all). */
+     *  re-feeds a model). Always the WHOLE questions — no size cap (the question IS the decision; the same bytes already ride
+     *  `tool_start.args` uncapped). An unserializable payload emits no frame at all (the ask then reports unavailable). */
     questions?: AskQuestion[];
     /** "question_complete" only: whether the human answered (`answered`) or the ask closed without an answer
      *  (`unanswered` — window elapsed / abort / leg-exit sweep). Cosmetic dialog-dismiss. */

package/dist/question.js

@@ -1,11 +1,10 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7 } from "@sema-agent/core";
-import { redactDeep } from "./trace/redact.js";
+import { humanFacingArgs } from "./human-facing-args.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { refusalBody } from "./http/refusal-body.js";
 import { keyAdmits, ownerCellOf, recoveredSubject } from "./owner-faces.js";
 import { createHitlOpenRace } from "./hitl-delivery.js";
-const MAX_QUESTIONS_BYTES = 16384;
 export const DEFAULT_QUESTION_THROTTLE = {
     maxConcurrentPerRun: 2,
     maxTotalPerRun: 20,
@@ -48,16 +47,9 @@ export function parseQuestionResponse(body) {
     }
     return { ok: true, value: { answers: out } };
 }
-function boundQuestions(questions) {
-    const redacted = redactDeep(questions);
-    try {
-        if (JSON.stringify(redacted).length > MAX_QUESTIONS_BYTES)
-            return undefined;
-    }
-    catch {
-        return undefined;
-    }
-    return redacted;
+function presentableQuestions(questions) {
+    const shown = humanFacingArgs(questions, "question");
+    return shown.kind === "whole" ? shown.value : undefined;
 }
 export class QuestionCoordinator {
     als = new AsyncLocalStorage();
@@ -90,7 +82,7 @@ export class QuestionCoordinator {
         const rc = this.countersFor(ctx.taskId);
         if (rc.inflight >= this.throttle.maxConcurrentPerRun || rc.total >= this.throttle.maxTotalPerRun)
             return UNAVAILABLE;
-        const questions = boundQuestions(req.questions);
+        const questions = presentableQuestions(req.questions);
         if (!questions)
             return UNAVAILABLE;
         const id = uuidv7();

package/dist/request-form.d.ts

@@ -16,7 +16,7 @@
 import type { IncomingMessage } from "node:http";
 import { type TaskHostPostureScope, type TaskWriteFaceInput } from "./hosted-posture.js";
 import { type ToolListSide } from "./rule-entry-list.js";
-import { type Scenario } from "./owner-brands.js";
+import { type Scenario, type Subject } from "./owner-brands.js";
 import type { PermissionMode } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
@@ -25,6 +25,11 @@ import type { TaskRequestBody } from "./http/wire-types.js";
  * (只在提交腿:读面没有体)。没带头 ⇒ 体原样(缺席 ⇒ 门走指派链)。
  */
 export declare function scenarioRequestedBy(headerScenario: Scenario | undefined, bodyScenario: unknown): unknown;
+/**
+ * {@link scenarioRequestedBy} 的主体形:场景头读**验过的主体**带的那一格(分派层判过在册,判决已记忆化),显式点名 = 体 `scenario`(提交受理门)或读面的 `?scenario=`。
+ * 受理门与读面(`GET /v1/capabilities/scenario` · `GET /v1/capabilities/mcp` · 两张会话面板)同调这一只 —— 同一只请求形在读面上点到的场景与提交时逐字同。
+ */
+export declare function scenarioRequestedBySubject(subject: Subject | undefined, named: unknown): unknown;
 /**
  * `inheritEnv:"all"` 的车道与射程两判(值形判在 `request-value-closure.ts` 的 `inheritEnvFieldIssue`,先于本函数):只有 host 车道消费这一位 ⇒ 别的车道 400 + 机读位
  * `reason: lane_not_host`;射程读写容纳面那一只谓词(`hosted-posture.ts` 腿④)⇒ 托管 422 `request.host_posture_refused`。`"scrub"` 是缺省,任何车道受理。

package/dist/request-form.js

@@ -16,6 +16,9 @@ export function scenarioRequestedBy(headerScenario, bodyScenario) {
     }
     return headerScenario;
 }
+export function scenarioRequestedBySubject(subject, named) {
+    return scenarioRequestedBy(subject === undefined ? undefined : partsOf(subject).scenario, named);
+}
 export function assertInheritEnvServed(body, config) {
     if (body.inheritEnv !== "all")
         return;
@@ -61,7 +64,7 @@ export function assertRequestFormBeforeMint(body, req, config) {
     assertToolListsReadable(body);
     assertRequestA2aEntries(snapshotRequestA2a(body.a2aPeers, { reread: false }));
     assertRequestImages(body.images);
-    scenarioRequestedBy(subject === undefined ? undefined : partsOf(subject).scenario, body.scenario);
+    scenarioRequestedBySubject(subject, body.scenario);
     assertAttachmentIdsShape(body.attachmentIds);
     assertWriteFaceAdmitted(effectivePermissionMode(body, parseTaskSettings(body.settings).settings), config);
     const ruleTables = ruleTablesRefusalWithoutTaskRoot(body, config);

package/dist/rule-issue-reading.d.ts

@@ -51,7 +51,7 @@ export type PersonFacingRuleIssue = {
  * 码与句逐字是 core 的;`libraryOption` 不进句子、也不进出口(出口只有 `code` / `guidance`)。
  */
 export declare function deploymentRuleRefusal(issue: PermissionRuleIssue): {
-    readonly code: string;
+    readonly code: PermissionRuleIssue["code"];
     readonly guidance: string;
 };
 export {};

package/dist/rules-consent.d.ts

@@ -467,7 +467,7 @@ export type CardRulePersisted = {
      * 导出成一只纯函数 —— 在本层照抄一个更严的校验器会把 `Bash(adb *)` 这条**成因形**当场误拒。」
      *
      * 现况:那只纯函数到货了,于是**文本能独立判定的那一半**({@link precheckEditedRuleText} 的语法门
-     * + 覆盖门)搬到了**裁决之前**——`POST /v1/tool-approvals/:id/respond` 在结算之前就 400,卡**还在**
+     * + 覆盖门)搬到了**裁决之前**—— 决断口 `POST /v1/tasks/:taskId/asks/:askId/decision` 在结算之前就 400,卡**还在**
      * (与 `persistRule.rule` 的形/上限 400 同一姿势,那条 400 早就是这个形)。所以壳今天可以渲
      * 「改一下再来」,而且真能来。
      *

package/dist/run-local.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { DEFAULT_MODEL_REF, pickUserModel } from "./model-select.js";
 import { defaultModelRefusal, modelNotAllowedMessage, modelUnavailableMessage } from "./model-entry-refusal.js";
-import { servedModelTableLeg } from "./model-select.js";
+import { modelRefusalLegOf, servedModelTableLeg } from "./model-select.js";
 import { outwardPlane, sealResultForExit } from "./terminal.js";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
@@ -22,12 +22,11 @@ import { buildUnpricedCeilingNotice, isRosterGateArmed, loadConfig, logConfigDia
 import { admitLocalDataRoot } from "./plugins/local-data-root-admission.js";
 import { openLocalBackend } from "./plugins/store-backend.js";
 import { runAndLogOneTimeMigrations } from "./plugins/one-time-migrations.js";
-import { configLocalRoot, createConfigProvider } from "./config-provider.js";
+import { configLocalRoot, configSourceKind, createConfigProvider } from "./config-provider.js";
 import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, buildCandidateRejectionNotes, judgeConfigCandidate } from "./web-admin-client/candidate-gate.js";
 import { buildUnreadConfigFileFields, buildUnreadConfigKeyFields } from "./web-admin-client/read-warnings.js";
 import { composeExecutionLane, settleHostLaneShell, settleReadDenyFloor } from "./boot/execution-lane.js";
 import { judgeConsolidationValve } from "./boot/memory-consolidation.js";
-import { logConfigDirMigration, migrateLocalConfigDirectory } from "./config-d-migration.js";
 import { logEnvModelsMigration, runEnvModelsMigration } from "./config-root-migration.js";
 import { assertLocalConfigDirTrusted, ConfigDirUntrustedError } from "./config-dir-trust.js";
 import { ConfigPullError, asConfigPullError, configPullFailureNote } from "./config-pull-failure.js";
@@ -376,7 +375,6 @@ export async function runLocal(argv, deps = {}) {
         await printErr(err instanceof Error ? err.message : String(err));
         return 2;
     }
-    logConfigDirMigration(logger, await migrateLocalConfigDirectory(root));
     let config;
     try {
         config = await composeExecutionLane(loaded, { configSource: "local", localRoot: root, logger, entry: RUN_LOCAL_LANE_ENTRY });
@@ -435,10 +433,11 @@ export async function runLocal(argv, deps = {}) {
         else
             logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the candidate failed to apply at boot — running on env (run-local has no LKG); none of the candidate's domains is adopted; this is not a reachability failure" });
     }
-    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes }, servedModelTableLeg(config));
+    const webAdminIsConfigSource = configSourceKind(config) === "remote";
+    const noDefaultModel = defaultModelRefusal({ models: config.models, modelRefusals: config.modelRefusals, candidateRejectionNotes }, modelRefusalLegOf(servedModelTableLeg(config), webAdminIsConfigSource));
     if (noDefaultModel !== undefined)
         throw new Error(noDefaultModel);
-    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false });
+    const routeVerdict = judgeServedModelRoute(config, { envTableIsPlaceholder: false, webAdminIsConfigSource });
     if (routeVerdict !== undefined)
         throw new Error(routeVerdict.reason);
     warnAssumedContextWindows(config, logger, { envTableIsPlaceholder: false });
@@ -612,6 +611,7 @@ export async function runLocal(argv, deps = {}) {
     assertGovernanceAssemblable(config);
     const { registrations: deploymentMods } = await assembleDeploymentMods({ metrics, brandIdentity: true, declaration: config.modsDeclaration, logger });
     const sharedRunnerDeps = createSharedRunnerDeps({
+        onError: engineOnError,
         metrics,
         config,
         engineDataRoot,
@@ -643,7 +643,6 @@ export async function runLocal(argv, deps = {}) {
         ...sharedRunnerDeps,
         sessionStore,
         ...(memoryEngine ? { memoryBackend: memoryEngine.backend } : {}),
-        onError: engineOnError,
         onAsk,
         ...(config.projectMemoryEnabled
             ? {
@@ -653,7 +652,7 @@ export async function runLocal(argv, deps = {}) {
             : {}),
     };
     const runner = new Runner(runnerDeps);
-    const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onError: engineOnError, onAsk };
+    const subRunnerDeps = { ...sharedRunnerDeps, sessionStore: new ForkRoutingSessionStore(sessionStore, new TtlSessionStore({ defaultTtlDays: 1 / 24 })), onAsk };
     const subRunner = new Runner(subRunnerDeps);
     const handslessRunner = new Runner(withoutHands(runnerDeps));
     const deploymentSkills = loadDeploymentSkills(config, logger);
@@ -677,7 +676,7 @@ export async function runLocal(argv, deps = {}) {
     const sessionId = args.session ?? uuidv7();
     let cap;
     try {
-        scenarioName = await createScenarioGate({ config, scenarios, principalCaps: undefined, logger }, "enforce")(undefined, args.scenario);
+        scenarioName = (await createScenarioGate({ config, scenarios, principalCaps: undefined, logger }, "enforce")(undefined, args.scenario)).scenario;
         cap = selectScenario(scenarios, scenarioName)({ scenario: scenarioName, objective: args.objective }, undefined, { sessionId });
     }
     catch (err) {

package/dist/runs.d.ts

@@ -137,8 +137,14 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
     releaseIdemKey(taskId: string): Promise<void>;
 }, taskId: string, result: Pick<TaskResult, "terminal" | "stats">): Promise<void>;
 /**
- * E18 resume-at — per-turn anchor capture, shared by runInBackground, the resume-leg driveResume AND the sync `POST /v1/tasks`
- * leg's plain form so the (single, tricky) capture rule can't drift between the stream-drain loops.
+ * E18 resume-at — per-turn anchor capture, shared by runInBackground, the resume-leg driveResume, the `POST /v1/tasks/stream`
+ * leg AND the sync `POST /v1/tasks` leg's plain form so the (single, tricky) capture rule can't drift between the stream-drain loops.
+ *
+ * **One write moment for every leg**: an anchor is written in the drain loop the moment the event that decides it arrives
+ * (the prompt anchor on its `message_committed`, a turn anchor on its `turn_end`) — never deferred to a leg's finish /
+ * disconnect branch. A process that is killed (SIGKILL / host crash / OOM) runs no finish branch, so a deferred write is a
+ * write that a killed run never makes; the engine's file-history boundary for the prompt is already on disk by then, and
+ * the anchor is the only thing that translates the caller's handle to it.
  *
  * A "turn" in core = ONE assistant message + its tool batch. resume-at is valid ONLY at a SETTLED rewindable boundary
  * — core's prepare-task accepts "user messages or finished assistant-text turns" and REJECTS an assistant message that
@@ -156,8 +162,8 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  * observable instead of a silent feature outage.
  */
 /**
- * 「这一次用户消息提交是不是这个 run 的**开场提示**」的唯一读法 —— 四处用户回退锚(后台腿 / 续跑腿 / 同步腿 `POST /v1/tasks` 的 {@link TurnAnchorCapture}、`/v1/tasks/stream`
- * 腿的 `userMsgEntryId`)同调这一只;调用点零各自判、零按正文判,且都是「最后一次交出的赢」。
+ * 「这一次用户消息提交是不是这个 run 的**开场提示**」的唯一读法 —— 四条腿(后台腿 / 续跑腿 / 同步腿 `POST /v1/tasks` / 流式腿 `POST /v1/tasks/stream`)的用户回退锚
+ * 都经 {@link TurnAnchorCapture} 调这一只;调用点零各自判、零按正文判,交出一次写一次(「最后一次交出的赢」= 锚店按键 upsert)。
  *
  * **回退锚 = 该轮开场提示,一个 run 一个(开场窗 + 闩)**:run 一开始就开着一个**开场窗**,收集第一次模型输出之前的 user 提交;窗关上之后(闩上),同 run 的 user-role 提交 ——
  * 用户打断时引擎收尾追加的「[Request interrupted by user]」、第一次模型调用前后排进来的 steer 正文、答完之后再来的 steer —— 一律不交。这是 CC「rewind to the message that started this turn」的
@@ -180,7 +186,7 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  *  · 带附件的提交,窗内又应用了一条别的输入(`human_input{applied}`,如第一次模型调用前排进来的 steer;事件先于它的正文提交到手)⇒ 窗里多了一条别人的消息,数 N 会落在帧后面的 steer 上 ⇒ 不猜。
  *    不带附件的提交不看输入条数:多条 applied 输入可以合成一条提交(续跑把停驻的 steer 与 wake 文本并成一条续跑消息),按修前同读校正到窗内最后一条。排队未应用(`delivery: "queued"`)的输入不动窗。窗还开着时继续攒,直到被关上。
  *  · 「不猜」= 这个 run 不落(带附件)或不校正(不带附件),且窗关上之后闩上 —— 其后的 user 提交(steer 正文、打断标记)不是开场提示,不顶上来;拿这次 run 的 taskId 去 `resumeAt`
- *    得 404 `resume_at.unknown_event`(文案点名带附件这一类成因)。
+ *    得 404 `resume_at.unknown_event`(文案说「它是一条没有锚的提问」,不点名成因 —— `history-anchor.ts`)。
  * 窗关上之前一个 user 提交都没有就关了(续跑腿里先到的是工具结果 / 助手消息)⇒ 窗照开着,不闩:那一条之后第一条 user 提交才是这个 run 里的第一条。
  *
  * 已知边界(引擎在 `message_committed` 上带来源标 / 输入标之日见下):
@@ -189,7 +195,7 @@ export declare function releaseKeyIfZeroWorkRefusal(runStore: {
  *  · 不带附件、第一次模型输出之前就应用了一条 steer:校正到窗内最后一条 = steer 正文(与修前同读)。
  *
  * 退役条件:引擎在落盘的帧上(`message_committed`)带上来源标(附件标记 / 引擎消息标)之日,本读法整体换成「第一条非引擎消息」(零计数、无窗口、无校正、无拒臂),
- * 窗口 / 严格吻合 / 不猜三臂与 `resume_at.unknown_event` 文案里对应的那一句一并删除,领头排队消息的边界随之消失。
+ * 窗口 / 严格吻合 / 不猜三臂一并删除,领头排队消息的边界随之消失。
  */
 export declare function createPromptCommitReader(): (ev: {
     readonly type: string;
@@ -200,7 +206,8 @@ export type ResumeAnchorLeg = "stream" | "sync" | "bg" | "resume";
  * 回退锚的**唯一**写法(四条腿同一只):**有界** await 写入(单行店操作期限 {@link BASELINE_IO_DEADLINE_MS},与项目指令基线的
  * 读写同一只数、同一只 {@link withinIoDeadline} —— 同为单行 PK 写、同在腿的关键路径上);写失败或到期 ⇒ 不抛(锚是这次提示词能不能
  * 回退的手柄,不是 run 的成败),记一次登记过的 fail-open `server.resume-anchor.capture-failed`(`reason=error|timeout`;计数 + 探针行 + 一次性 warn)。
- * 调用方在本腿的终帧(流式腿的 `done`、同步腿的 200 应答)**之前** await 它 ⇒ 客户端拿到终帧时锚已落定或已知没落定,没有「锚晚到」的窗;锚店挂住至多让终帧晚一个期限。
+ * 调用方在决定这只锚的那一帧到手时就 await 它({@link TurnAnchorCapture}:提示锚在开场提示的提交上,四条腿同一个时机)⇒ 早于本腿的终帧(流式腿的 `done`、同步腿的 200 应答)——
+ * 客户端拿到终帧时锚已落定或已知没落定,没有「锚晚到」的窗;进程在终帧之前被强杀,已到手的那一笔也已落定。锚店挂住至多让那一帧之后的处理晚一个期限。
  * 到期只放手不取消:那次写照常在飞,迟到落定的锚照样可用(迟到的失败被吞,不重复计数)。
  * 用户面的读数仍只有一处:会话视图用户消息行的 `taskId?`(present-iff 锚在)与 `resumeAt` 的 404 `resume_at.unknown_event`。
  */
@@ -256,9 +263,11 @@ export declare class TurnAnchorCapture {
     private turnHadTool;
     /** 用户提交是不是开场提示的唯一读法({@link createPromptCommitReader};开场窗 + 闩 —— 开场提示之后打断标记 / steer 不改锚;附件帧不是提问)。 */
     private readonly promptCommit;
+    /** 上一笔提示锚写的落定(临时锚 → 校正写同一把键;下一笔等它落定再发,见 {@link TurnAnchorCapture.onMessageCommitted})。从不拒。 */
+    private promptLanding;
     constructor(capture: ((eventId: string, held: () => boolean) => Promise<void>) | undefined, 
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
-    leg: Exclude<ResumeAnchorLeg, "stream">, 
+    leg: ResumeAnchorLeg, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
      *  `message_committed{role:"user"}` event — its `entryId` is the persisted user-message `SessionTreeEntry.id`,
      *  ALWAYS a valid `resumeAt` target (core accepts a user message; it rejects a tool-result / mid-tool-call

package/dist/runs.js

@@ -290,6 +290,7 @@ export class TurnAnchorCapture {
     firstTextEventId;
     turnHadTool = false;
     promptCommit = createPromptCommitReader();
+    promptLanding = Promise.resolve();
     constructor(capture, leg, captureUser) {
         this.capture = capture;
         this.leg = leg;
@@ -302,8 +303,20 @@ export class TurnAnchorCapture {
         const committed = { type: "message_committed", role, entryId };
         const prompt = this.promptCommit(committed);
         const captureUser = this.captureUser;
-        if (prompt !== undefined && captureUser)
-            await settleResumeAnchor((held) => captureUser(prompt, held), { leg: this.leg, kind: "prompt" });
+        if (prompt === undefined || !captureUser)
+            return;
+        const prior = this.promptLanding;
+        let landed;
+        this.promptLanding = new Promise((resolve) => { landed = resolve; });
+        await settleResumeAnchor(async (held) => {
+            try {
+                await prior;
+                await captureUser(prompt, held);
+            }
+            finally {
+                landed();
+            }
+        }, { leg: this.leg, kind: "prompt" });
     }
     onText(eventId) {
         if (this.firstTextEventId === undefined) {

package/dist/runtime-governance.d.ts

@@ -93,8 +93,8 @@ export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefi
  * 盖在每一个 spec 出生点一次(词 = {@link entryPermissionMode} 的 `effective`):受理门盖进存储的提交体(`task-settings.ts` `stampEntryPermissionMode`)、run-local 盖在它自建的 spec 上、
  * leader run 盖在它出生时的入口体上(`leader/run-entry.ts`;入口词是 `plan` 的 leader run 进不了那条车道 —— worker 会话没有计划审阅通道 ⇒ 受理口响亮拒)。此后一条 run 的模式词
  * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)、`plan_review` 写回与续跑口(停驻 run 的存储体被重放之前过一次**现**地板、
- * 钳过的随 CAS 赢点写回;`permission-mode-admission.ts` `stampReplayEntryMode`,地板的出口词 —— `plan_review` 批准写下的词 —— 原样读)。按段折一个模式词 = 第二个源:
- * 被批准的计划会在下一次挂起→续跑被拉回 plan;续跑口不是按段折 —— 它与提交口同一只入口一步,写的是同一个源,且不碰出口词。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
+ * 钳过的随 CAS 赢点写回;`permission-mode-admission.ts` `stampReplayEntryMode`,写据说那一格是地板的出口 —— `plan_review` 批准 —— 写下的且仍是它写下的那一格 ⇒ 原样读)。按段折一个模式词 = 第二个源:
+ * 被批准的计划会在下一次挂起→续跑被拉回 plan;续跑口不是按段折 —— 它与提交口同一只入口一步,写的是同一个源,且不碰出口写下的那一格。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
  * 写面 `roots`、与 `read-only` 同形 —— 运维 plan 那时根本不进 plan 模式,见下一段。)
  *
  * 🔴 **为什么 `plan` 不再与 `read-only` 同形**:修前两档同映「只读手 + roots」,外加 `resolve-spec.ts` 见只读手就剥委派工具 —— 于是 `plan` 有三套

package/dist/sema-config-dir.d.ts

@@ -30,7 +30,8 @@ export declare function provisionSemaConfigDir(config: {
  * (与记忆根那一判共用同一只规范形,那一判的失败方向是多报,这一判的是漏报;如实披露)。
  * 句子只描述位置关系,后果限定在引擎**缺省**写保护表上:用 `WRITE_PROTECTED_TABLE_REPLACE` 去掉那一行的部署不受影响(这一行不读那张表),可忽略它。
  *
- * 规范形读不出(盘上竞态:探完到取值之间目录被挪走 / 搜索权限被收)⇒ 披露面不得把起服打死:响亮报另一行 `sema_config_root_workspace_check_unavailable`(类名 + 机器码),起服照常。
+ * 规范形读不出(两边路径上有一段没有搜索权限 / 链接成环,或盘上竞态:探完到取值之间目录被挪走 / 搜索权限被收)⇒ 不给位置结论(看不见的一段不当成「还不存在」),
+ * 披露面也不得把起服打死:响亮报另一行 `sema_config_root_workspace_check_unavailable`(类名 + 机器码),起服照常。
  * 位置:HTTP 服务在装配第 2 段执行车道合成之后(读的是合成后的车道与工作区底),`run-local` 在工作区定下之后 —— 车道在这两处才定形,所以不与 {@link provisionSemaConfigDir} 同一拍。
  */
 export declare function announceConfigRootEnclosingWorkspace(config: {

package/dist/session-sync.d.ts

@@ -48,7 +48,7 @@
 import type { StoreBackend } from "./plugins/store-backend.js";
 import { type SyncRelation } from "./session-sync-kernel.js";
 import type { SessionTreeEntry, SessionRulesRecord, FileHistoryError, FileHistoryExport } from "@sema-agent/core";
-import type { ServiceBlobExchange, ServiceFileHistoryStore } from "./plugins/store-backend.js";
+import type { ServiceBlobExchange, ServiceFileHistoryStore, SqlBlobPutResult, SyncLanding } from "./plugins/store-backend.js";
 /**
  * core 7.55.0 [ref] T2([ref]):一只会话的文件历史**读不全**(撕裂 / 读不出的边界、读不出的跟踪集 —— 店的 `exportHistory` 答 `{ ok: false }`,`adopt_failed`
  * 带店判的 `permanence`)。它**不是**「没有历史」:读成 `null` 的同步会把这只会话的全部 rewind 历史丢在路上、还答成功。会话同步的两只拉取口
@@ -66,19 +66,38 @@ export declare class FileHistoryUnreadableError extends Error {
  */
 export declare function exportedFileHistory(store: Pick<ServiceFileHistoryStore, "exportHistory">, sessionId: string): Promise<FileHistoryExport | null>;
 /** A blob getter: content-addressed bytes for a sha256 hash, or `undefined` if the source can't supply them.
- *  Returned by {@link exportSessionManifest} (closes over the source store); consumed wherever a caller pulls
- *  content-addressed history bytes lazily (the live PUSH route's `importHistory` replay). */
+ *  The live PUSH route's `importHistory` replay reads one — always the getter of a {@link VisibleBlobs} answer (never an unscoped read of the store). */
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
 /**
  * 「这只文件历史店能不能交换 blob」的**唯一**读法:店的 `blobExchange` 组,经 core 的判官 `fileHistoryBlobExchangeOf` 读 —— 没有组 ⇒ `undefined`
  * (core 的 local 文件店);整组 ⇒ 三只成员(判官已绑好);缺一员 / 组不是对象 / 店还带退役的标记词 ⇒ 判官拒(`config.invalid_argument`,响亮,不是「没有」)。
- * 能力事实 `sessionSyncFileHistory`(capability-facts)与取值口 {@link blobGetterOf} 都读它 —— 事实说有,取值口就通到同一组的 `get`;事实说没有,取值口恒空。
+ * 会话同步的 blob 面 {@link landingBlobFacesOf} 读它取字节;交换组的 `put` / `has` 路由不握有 —— 读它们的是 core 契约套件与店自己的按落点来历面(经它写字节、问在场)。
  * 返回型收窄到本仓的 {@link ServiceBlobExchange}:判官交回的是店自己那一组的成员(只绑定、不包装),店型声明的组就是那一型。
  */
 export declare function blobExchangeOf(store: ServiceFileHistoryStore): ServiceBlobExchange | undefined;
-/** 一只文件历史店自己的 blob 取值口({@link BlobGetter}):从 {@link blobExchangeOf} 派生 —— 有交换组 ⇒ 组的 `get`;没有(core 的 local 文件店)⇒ 恒答 `undefined`(「这里取不到」)。
- *  拉取面(manifest 的 `getBlob`)、identical 自愈臂、提交臂三处读同一只,不各写一份「无组则 undefined」。 */
-export declare function blobGetterOf(store: ServiceFileHistoryStore): BlobGetter;
+/**
+ * 一次可见性读的答案:这个落点此刻看得见的 hash 集,和**只答这几枚**的取值口(集外的一律 `undefined` —— 重放观察到它,答与预检同一个 `missing_blob`)。
+ * 预检的答案就是重放取值口的许可集:第一阶段读一次、冻结进暂存随第二阶段走 —— 覆盖写的擦除排在重放之前,擦掉旧图不改许可。
+ */
+export interface VisibleBlobs {
+    readonly hashes: ReadonlySet<string>;
+    readonly get: BlobGetter;
+}
+/** 什么都看不见的答案:信封不引用 blob,或这台部署没有 blob 面(下面 {@link landingBlobFacesOf} 答 `undefined`)。 */
+export declare const NO_VISIBLE_BLOBS: VisibleBlobs;
+/**
+ * 会话同步路由读写 blob 的**唯一**面(按落点):上传 = 店的按落点来历面 `putAt`(核址 → 字节 → 授予);可见 = 店的 `visibleAt`,取字节经交换组的 `get`、只放行可见集里的那几枚。
+ * 预检、identical 自愈臂与提交臂的重放取值、`GET …/sync/history/blobs/:hash` 三口读的是同一只 `visible`。
+ */
+export interface LandingBlobFaces {
+    put(landing: SyncLanding, hash: string, bytes: Uint8Array): Promise<SqlBlobPutResult>;
+    visible(landing: SyncLanding, hashes: readonly string[]): Promise<VisibleBlobs>;
+}
+/**
+ * 「这只文件历史店有没有会话同步的 blob 面」的**唯一**读法(能力事实 `sessionSyncFileHistory` 读它):交换组({@link blobExchangeOf})∧ 按落点来历面(`blobLanding`)两样都在 ⇒ 面;
+ * 缺一样 ⇒ `undefined`(fail-closed:给不出按落点可见性的店没有 blob 两口 —— 只有交换组而无来历面,就只能按全局内容地址表答「在不在」,那正是这只面要关掉的预言机)。
+ */
+export declare function landingBlobFacesOf(store: ServiceFileHistoryStore): LandingBlobFaces | undefined;
 /**
  * The portable state of ONE session, ready to replay into another backend. Blobs are deliberately NOT inlined
  * (§5: a turn's working-tree blobs can be tens of MiB → OOM/413 if buffered); each snapshot carries only its
@@ -149,10 +168,7 @@ export interface SessionManifest {
 export declare function exportSessionManifest(sessionId: string, srcBackend: StoreBackend, 
 /** [ref]:文件历史读**装配结果**(捕获脸),不直取 `srcBackend.fileHistory()` —— 「这台部署有没有文件历史店」
  *  只在 `assembleFileHistory` 判一次。同一个后端铸的同一只店,四店同源的不变式不变。 */
-historyStore: ServiceFileHistoryStore): Promise<{
-    manifest: SessionManifest;
-    getBlob: BlobGetter;
-} | null>;
+historyStore: ServiceFileHistoryStore): Promise<SessionManifest | null>;
 /**
  * §7 DRY-RUN — classify what importing `sessionId` from `srcBackend` into `dstBackend` WOULD do, WITHOUT writing
  * anything (the shell can present a keep-local / keep-cloud / fork-new choice up front).

package/dist/session-sync.js

@@ -24,9 +24,21 @@ export async function exportedFileHistory(store, sessionId) {
 export function blobExchangeOf(store) {
     return fileHistoryBlobExchangeOf(store);
 }
-export function blobGetterOf(store) {
+export const NO_VISIBLE_BLOBS = { hashes: new Set(), get: async () => undefined };
+export function landingBlobFacesOf(store) {
     const exchange = blobExchangeOf(store);
-    return exchange ? exchange.get : async () => undefined;
+    const provenance = store.blobLanding;
+    if (exchange === undefined || provenance === undefined)
+        return undefined;
+    return {
+        put: (landing, hash, bytes) => provenance.putAt(landing, hash, bytes),
+        visible: async (landing, hashes) => {
+            if (hashes.length === 0)
+                return NO_VISIBLE_BLOBS;
+            const seen = await provenance.visibleAt(landing, hashes);
+            return { hashes: seen, get: async (hash) => (seen.has(hash) ? exchange.get(hash) : undefined) };
+        },
+    };
 }
 function ownerAware(backend) {
     return backend.session();
@@ -57,7 +69,6 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
     if (summaryOf === undefined)
         throw new Error("exportSessionManifest: the session store has no row read face (sessionSummaryOf) — the sessionSync fact should have refused this deployment");
     const row = await summaryOf(sessionId);
-    const getBlob = blobGetterOf(fs);
     const declared = new Set(entryIds);
     const soundAnchors = anchors.filter((a) => {
         if (anchorEntryDeclared(declared, a.entryId))
@@ -65,10 +76,7 @@ export async function exportSessionManifest(sessionId, srcBackend, historyStore)
         recordFailOpen("server.session-sync.dangling-anchor-export", `sessionId=${brief(sessionId)} eventId=${brief(a.eventId)} entryId=${brief(a.entryId)}`);
         return false;
     });
-    return {
-        manifest: { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors: soundAnchors, ...(row !== undefined ? { title: row.title, pinned: row.pinned } : {}) },
-        getBlob,
-    };
+    return { sessionId, entryIds, entryCount: entryIds.length, leafId, fileHistory, policy, anchors: soundAnchors, ...(row !== undefined ? { title: row.title, pinned: row.pinned } : {}) };
 }
 export async function planSync(sessionId, srcBackend, dstBackend) {
     const srcEntries = (await ownerAware(srcBackend).exportEntries?.(sessionId)) ?? null;