@sema-agent/server 7.30.0 → 7.31.0-rc.1

package/dist/boot/session-faces.js

@@ -39,7 +39,7 @@ export function createSessionFaces(ctx) {
         : undefined;
     // §0.5 E21 — DELETE /v1/sessions/:id purge coordinator. Deletes the session abstraction's CONVERSATION HISTORY
     // (sessionStorage.deleteSession → session_meta/session_event) PLUS the service-owned operational rows for that
-    // session: the runs ledger (runStore.deleteBySession → task_run/task_active/task_event, owner-guarded), the
+    // session: the runs ledger (runStore.deleteBySession → task_run/task_active/task_event, session_id-scoped), the
     // durable checkpoints + resume-ctx (checkpointStore.deleteBySession, present only under DURABLE_APPROVAL), and
     // offloaded tool results (toolResultStore.deleteBySession). Wired only when the session store can actually
     // delete (a DB backend).
@@ -74,6 +74,36 @@ export function createSessionFaces(ctx) {
             // window it returns `{ active }` and deletes nothing → we bubble it up so the route 409s, BEFORE touching
             // any other table (no partial purge of a live session). Each leg propagates its error so a child failure
             // aborts the purge BEFORE the history-delete gate is removed (keeping the idempotent retry convergent).
+            // 🔴 run 账本按 session_id 单键删,**没有**行级属主门(F-A 修,2026-08-17 合并码扫描):`task_run.owner`
+            // 是每次提交的 principal,与会话的 canonical owner 会分叉(无主存量会话被带 principal 的壳续聊 ⇒ 新行
+            // owner="default",而这里递的是会话行的 owner=null)。行级门于是只删一半、把具名行连同 task_event 留成
+            // 孤儿(session_meta 已删 ⇒ 留存腿的 sessionCandidates 永远枚举不到它们),路由却回 {deleted:true} ——
+            // 与下面 anchors 腿注里那句 "a right-to-delete violation reported as success" 是同一个病,理由也同一条:
+            // 会话所有权已在路由的 DELETE 门证过。
+            // 🔴 **化身围栏**(codex R1-[high] 验真后加):属主门下来了,「路由验过权」这句话就必须还**成立到此刻**。
+            // 会话 id 由调用方自选、删除后可被别人 `register` 重新登记 ⇒ 两只并发 purge 交错时(A 与 A' 同时过门,
+            // A' 跑完整条 purge、租户 B 用同一 uuid 重登记并跑完一次 run),慢的那只会按 session_id 把 **B 的**行删掉。
+            // 复读一次 canonical owner,不齐即整条中止(一行不删、回 {deleted:false} —— 属于调用方的那个化身已经不在)。
+            // 这一读是**所有后端**都有的那道围栏;SQL 双生在 store 事务里还有一道 `session_meta … FOR UPDATE` 的
+            // 原子复核(那才是真正消灭竞态的一道),local 车道靠它 + 数据根独占 BootLock。
+            // 「行不在」(undefined)与「换了主」一律中止(codex R2 采纳):meta 不在 = 调用方验过权的那个化身
+            // 已经没了,再按 session_id 往下删,删到的只可能是**别人**重新登记后写的行。E21 的次序契约保证
+            // meta 是**最后**删的(子腿失败就不删 meta,让幂等重试收敛)⇒ 「meta 不在却还有本会话的孤儿子行」
+            // 在协调器这条路上构造不出来,中止不会丢掉任何该删的东西。
+            // ⚠️ `ownerOf` **方法缺席**的后端(可选 seam)与「行不在」必须分开判:合起来会让那些后端的删除
+            // 整条恒中止(fail-closed 到把功能关掉),那是另一种缺陷。
+            if (ownerAware.ownerOf) {
+                const stillOwner = await ownerAware.ownerOf(sessionId);
+                if (stillOwner !== owner)
+                    return { deleted: false };
+            }
+            // 📌 **残余,如实登记**(codex R2 判真但**射程外**,不在本批修):本围栏钉住的是「purge 开始那一刻
+            // 化身是对的」+ run 腿的事务内原子复核。其余按 session_id 单键删的腿(anchors / exemption / policy /
+            // attachment / snapshot / tool_result 的 provenance 形)在**本批之前就是**这个 scoping(理由逐字见下方
+            // anchors 腿注,可追到公开快照那一版),它们各自开始的时刻理论上仍可能落在一次化身漂移之后。
+            // 要真正消灭它得让**整条**级联化身原子(SQL 单事务横跨十余张表 + 对象存储,即留存腿那个形),而在线
+            // 删除面刻意不是那个形:它要跨事务崩溃收敛(meta 最后删 ⇒ 幂等重试),还要动 MinIO 字节。那是设计级
+            // 改动(属主裁决 + 三问),不是复审批能顺手做的事;已作后续件登记,别把这条注读成「已解」。
             const runs = runStore ? await runStore.deleteBySession(sessionId, owner) : { removed: 0 };
             if ("active" in runs)
                 return { active: runs.active };

package/dist/http/route-ctx.d.ts

@@ -163,7 +163,12 @@ export interface RouteLegs {
         body: object;
     }>;
     /** assistant plan_review 三态腿。 */
-    resumePlanReview(sessionId: string, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined): Promise<{
+    resumePlanReview(sessionId: string, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, req: IncomingMessage | undefined, 
+    /** [4277]/[4288] 件5:`decide_404` 判别日志的附加位(只进日志,不上 wire;身份只记有无不记值)。 */
+    log?: {
+        taskId?: string;
+        principalPresent?: boolean;
+    }): Promise<{
         status: number;
         body: object;
     }>;

package/dist/http/routes/approvals-assistant.js

@@ -451,6 +451,12 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     sendError(res, 401, "principal_unverified", "principal proof required");
                     return;
                 }
+                // [4268]/[4274] 件5(#43 P0 联调观测件):**只进日志,不上 wire**。两支 404 在 wire 面必须逐字同形
+                // (反枚举:「不存在」与「不属于你」不可区分是本门的要求,不是疏漏),代价是服务端自己也说不清撞的
+                // 是哪一支 —— 联调一次 404 只能靠猜。判别位放在服务端日志:运维/联调拿得到成因,枚举者拿不到。
+                // `principalPresent` 只记**有无**([4288]):principal / owner 两个身份串一个都不许进日志 ——
+                // 日志的读者面比 wire 宽,把值写进去等于在日志面重建一条本来被封住的枚举通道。
+                deps.logger?.info?.("decide_404", { reason: "no-row", taskId, principalPresent: principal !== undefined });
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
             }
@@ -472,10 +478,16 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             const operators = deps.config.operatorPrincipals;
             const explicitOperator = explicitOperatorOk(deciderPrincipal, operators); // E1: single mint point (principal-gate)
             if (!explicitOperator && run.owner !== null && run.owner !== deciderPrincipal) {
+                // no existence oracle (verified principal on a direct worker) —— wire 面与上面的「查无此行」逐字同形;
+                // 判别位同样只进服务端日志(件5,理由见上一处注)。刻意**不记** owner/principal 两个值:判别成因用
+                // reason 一个词就够,把两个身份写进日志等于在日志面重建一条本来被封住的枚举通道。
+                deps.logger?.info?.("decide_404", { reason: "owner-mismatch", taskId, principalPresent: principal !== undefined });
                 sendError(res, 404, "not_found.run", "task not found");
                 return;
-            } // no existence oracle (verified principal on a direct worker)
-            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req);
+            }
+            const out = await resumePlanReview(run.sessionId, decision, decision === "edit" ? body.editedPlan : undefined, typeof body.reason === "string" ? body.reason : undefined, req, 
+            // [4277]/[4288] 件5:让四个 reason 的判别日志共用同一个 id 字段 + 同一个 principalPresent 口径。
+            { taskId, principalPresent: principal !== undefined });
             sendJson(res, out.status, out.body);
             return;
         }

package/dist/http/routes/sessions-list.js

@@ -1,4 +1,4 @@
-import { isUuidV7 } from "../../security.js";
+import { isUuidV7, legacyUnownedAmnestyOpen } from "../../security.js";
 import { sendJson, sendError } from "../send.js";
 export async function handleSessionsList(req, res, url, ctx) {
     const miss = { fell: false };
@@ -30,7 +30,11 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
             sendError(res, 501, "capability.session_store_required", "session list requires a durable session store (SESSION_BACKEND=tidb)");
             return;
         }
-        await handleSessionList(res, lister, new URL(req.url ?? "", "http://x").searchParams, gateOwner);
+        // [4198] 窄互认第二臂(列表面)—— 条件①③ 在此判,条件②(`owner === null`)由 store 的
+        // `owner = ? OR owner IS NULL` 谓词承载(见 legacyUnownedAmnestyOpen 的注)。fleet-wide 面不经本臂:
+        // 它本来就不钉 owner ⇒ 无主行早已在结果集内,多带位是噪声。
+        const includeUnowned = !fleetWide && legacyUnownedAmnestyOpen(deps.config.requirePrincipal, gateOwner);
+        await handleSessionList(res, lister, new URL(req.url ?? "", "http://x").searchParams, gateOwner, includeUnowned);
         return;
     }
     // GET /v1/sendfile-links — the SendUserFile ledger's thin read face (multi-tenant governance: which links
@@ -130,7 +134,7 @@ function decodeSessionCursor(s) {
         return undefined;
     }
 }
-async function handleSessionList(res, lister, query, forceOwner) {
+async function handleSessionList(res, lister, query, forceOwner, includeUnowned = false) {
     const owner = forceOwner != null ? forceOwner : (query.get("owner") ?? undefined);
     const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
     const cursor = decodeSessionCursor(query.get("cursor"));
@@ -138,7 +142,7 @@ async function handleSessionList(res, lister, query, forceOwner) {
     // synthesized preview). Trimmed + bounded (256 — a search box, not a payload); empty after trim = no filter.
     const qRaw = (query.get("q") ?? "").trim();
     const q = qRaw ? qRaw.slice(0, 256) : undefined;
-    const rows = await lister({ ...(owner ? { owner } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1, ...(q ? { q } : {}) });
+    const rows = await lister({ ...(owner ? { owner } : {}), ...(includeUnowned ? { includeUnowned: true } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1, ...(q ? { q } : {}) });
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const last = page[page.length - 1];

package/dist/http/routes/sessions.js

@@ -1,6 +1,6 @@
 import { materializeA2aTools, materializeMcpTools, sanitizePathComponent, SessionPolicyError } from "@sema-agent/core";
 import { a2aForScenario, mcpForScenario } from "../../config-center/facade.js";
-import { isUuidV7, isUuidShape } from "../../security.js";
+import { isUuidV7, isUuidShape, legacyUnownedSessionOk } from "../../security.js";
 import { windowMessages, truncateMessageBlobs } from "../../audit.js";
 import { redactSecrets } from "../../trace/redact.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
@@ -602,13 +602,16 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             }
             // Owner gate (no existence oracle for non-owners — 404, parity with runOwnerOk): a principal caller may
             // only fork its OWN session; a fleet-wide (system/trace) caller may fork any (ops).
-            if (!scope.fleetWide && owner !== scope.gateOwner) {
+            // [4198] 窄互认第二臂:单机形下 default 主对**存量无主行**放行(三条件齐,见 legacyUnownedSessionOk)。
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, scope.gateOwner, owner)) {
                 sendError(res, 404, "not_found.session", "session not found");
                 return;
             }
             // New-session ownership — DELIBERATE (no security issue either way; documented per adversarial-review):
             //  • principal caller → the NEW session is owned by the CALLER (scope.gateOwner): you fork your own session,
             //    you own the copy.
+            //  • [4198] 窄臂放行的 default 主 → 走 principal 支 ⇒ 副本铸给 `default`(具名行)。刻意如此:副本
+            //    离开无主池,本臂**不被 fork 传播延寿**,墓碑注(存量随生命周期消亡后可整删)仍然成立。
             //  • fleet-wide (ops, fork-on-behalf) → the NEW session INHERITS the SOURCE owner (`owner ?? null`) so the
             //    fork is TENANT-owned (an ops/system fork-on-behalf hands the copy to the same tenant as the source,
             //    NOT to the ownerless/system pool) — a later attach is then governed by the normal authorizer for that
@@ -658,7 +661,9 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
             // Foreign-owner ⇒ the SAME response as missing (a 404 here vs 200 above was an existence
             // oracle — a prober could distinguish "absent" from "another tenant's"). deleted:false is also honest
             // (nothing was deleted) and keeps the route idempotent-shaped for both cases.
-            if (!scope.fleetWide && owner !== scope.gateOwner) {
+            // [4198] 窄互认第二臂:不放行时,存量无主会话对 default 主是**静默假成功**(用户永远删不掉自己的历史)。
+            // 放行后 purge 的 owner 守卫仍传**行的真 owner**(下面的 `owner`,即 null)——SQL 侧 null-safe 属主门不被放宽。
+            if (!scope.fleetWide && owner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, scope.gateOwner, owner)) {
                 sendJson(res, 200, { deleted: false });
                 return;
             }
@@ -799,10 +804,11 @@ async function handleSessionsBody(req, res, url, ctx, miss) {
                 return;
             }
             const wsOwner = await ownerOf(wsSession);
-            if (wsOwner === undefined || (!scope.fleetWide && wsOwner !== scope.gateOwner)) {
+            // PULL 门:必须存在且属己,无 oracle。[4198] 窄互认第二臂同样覆盖本读面(存量会话的工作区浏览)。
+            if (wsOwner === undefined || (!scope.fleetWide && wsOwner !== scope.gateOwner && !legacyUnownedSessionOk(deps.config.requirePrincipal, scope.gateOwner, wsOwner))) {
                 sendError(res, 404, "not_found.session", "session not found");
                 return;
-            } // PULL 门:必须存在且属己,无 oracle
+            }
             const q = new URL(req.url ?? "", "http://x").searchParams;
             const keys = (await fs.listKeys(wsSession)).sort().reverse(); // uuidv7 entryId:字典序 desc = 时间序 新→旧
             const sub = wm[3];

package/dist/http/server.js

@@ -21,6 +21,7 @@ import { HANDS_BAND_TOOL_NAMES } from "../capabilities/hands-lane.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import { createApprovalCardEmitter, isApprovalGateKind, resolveApprovalLeg, resolveStreamApprovalGate } from "../tool-approval.js";
+import { createWallClockJumpGuard } from "../wall-clock-jump-guard.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
@@ -2775,11 +2776,26 @@ export function createHttpServer(rawDeps) {
      * suspend (that would bypass the correct /decide allow-deny + action binding). Rejects PRE-CAS so a wrong-gate
      * call never consumes the checkpoint (core's resume gate-match is the fail-closed backstop).
      */
-    async function resumePlanReview(sessionId, decision, editedPlan, reason, req) {
+    async function resumePlanReview(sessionId, decision, editedPlan, reason, req, 
+    /** [4277]/[4288] 件5:判别日志的两个附加位。调用方(plan_review 端点)手上有 taskId 与 gatedPrincipal,
+     *  本函数只有 sessionId —— 穿进来是为了让 `decide_404` 的**四个 reason 共用同一套字段**(联调 grep 一条
+     *  msg 就拿到同一个 id 键与同一个 principalPresent 口径,不必按 reason 分两种形)。
+     *  缺席 ⇒ id 退回 sessionId 并如实换键名(不假装那是 taskId)。 */
+    log) {
         const cs = deps.checkpointStore;
+        // [4268]/[4274]/[4277]/[4288] 件5:404 成因判别位——**只进服务端日志,不上 wire**(响应体一字不改,
+        // 反枚举不破)。词表四值全在本函数与 approvals-assistant.ts 两处铸,合起来覆盖 plan_review 一条决裁
+        // 路径的全部 404 出口。`principalPresent` 只记**有无**:身份串一个都不许进日志(日志读者面比 wire 宽)。
+        const log404 = (r) => deps.logger?.info?.("decide_404", {
+            reason: r,
+            ...(log?.taskId !== undefined ? { taskId: log.taskId } : { sessionId }),
+            ...(log?.principalPresent !== undefined ? { principalPresent: log.principalPresent } : {}),
+        });
         const token = await cs.findPendingTokenBySession(sessionId);
-        if (!token)
+        if (!token) {
+            log404("no-pending-checkpoint");
             return { status: 404, body: { error: "no pending plan_review for this session (already decided or expired)", errorCode: "not_found.plan_review" } };
+        }
         let cp;
         try {
             cp = await cs.get(token); // throws if the checkpoint format is newer than this build (version guard)
@@ -2787,8 +2803,10 @@ export function createHttpServer(rawDeps) {
         catch (e) {
             return { status: 409, body: { error: e instanceof Error ? e.message : String(e), errorCode: "conflict.checkpoint_unreadable" } };
         }
-        if (!cp)
+        if (!cp) {
+            log404("checkpoint-missing");
             return { status: 404, body: { error: "checkpoint not found", errorCode: "not_found.checkpoint" } };
+        }
         // 🔴 GATE-KIND GUARD: a plan_review decision must ONLY resolve a plan_review gate. A human/irreversible_ask
         // (tool approval) or resource_limit/needs_review gate routed here would let approve/edit/reject bypass the
         // correct wire (a tool approval needs /decide's allow/deny + action binding; resource_limit needs /resume).
@@ -3080,10 +3098,33 @@ export function createHttpServer(rawDeps) {
      * pending and is retried next tick, with the terminal_at_ms backstop as the eventual abort if the deny never
      * succeeds. Bounded per tick by the store query's LIMIT. Wired into main.ts's reaper.
      */
+    const denySweepClockGuard = createWallClockJumpGuard({
+        slaMs: deps.config.approvalTimeoutSec > 0 ? deps.config.approvalTimeoutSec * 1000 : undefined,
+        onJump: ({ jumpMs, graceMs }) => deps.logger?.warn?.("deny_sweep_wall_clock_jump", {
+            jumpMs,
+            graceMs,
+            note: jumpMs > 0
+                ? "the wall clock stepped FORWARD relative to the monotonic clock; the approval SLA deny-sweep stands down for graceMs of MONOTONIC time so no pending gate is denied earlier than one full SLA of REAL time ([4232]①/[4235]). The checkpoint terminal_at_ms backstop is unaffected — nothing can hang forever."
+                : "the wall clock stepped BACKWARD relative to the monotonic clock; the deny-sweep needs no grace for this direction (a receding deadline only DELAYS a deny) but the step itself is an operational fact worth recording.",
+        }),
+        onSuppressed: ({ remainingMs }) => deps.logger?.info?.("deny_sweep_clock_grace", { remainingMs }),
+        // codex R2 [high] 五:连续跳变撞上累计上限 ⇒ 守卫**响亮**恢复判定。这一行是运维必须看见的:
+        // 它说的是「本机墙钟在持续抖,我不再为它让路了,接下来的 deny 判定基于一个不稳的钟」。
+        onGraceCapped: ({ totalGraceMs }) => deps.logger?.warn?.("deny_sweep_clock_grace_capped", {
+            totalGraceMs,
+            note: "the wall clock kept stepping forward; the approval SLA deny-sweep has stood down for the maximum cumulative grace and now RESUMES on a demonstrably unstable clock — a fail-closed leg that never runs is worse than one running on a bad clock. Fix NTP on this host.",
+        }),
+    });
     async function denyExpiredApprovals(now) {
         const cs = deps.checkpointStore;
         if (!cs)
             return;
+        // [4232]①/[4235]:**判定**钟的单调佐证。`now` 是墙钟(生产由 reaper 传 `Date.now()`),而
+        // `checkpoint.deadline` 是 core 按铸卡当时的墙钟算的绝对时刻 —— 墙钟凭空前跳 ⇒ 判定钟凭空多走同样的量,
+        // 人还没走开窗就没了(真机实测:SLA 45s,真实等 14s 即被自动拒)。守卫按单调钟宽限整拍让开;
+        // **记账钟一律不动**(下面 resumeCheckpoint 的审计/时间戳仍是真墙钟,core 的 totalWaitMs 账面同样不碰)。
+        if (!denySweepClockGuard.admit(now))
+            return;
         const expired = await cs.listExpiredApprovalGates(now).catch(() => []);
         // [1591] 候裁③ 静默臂:parked 后台子代的过期 cp 不走 sweep 的重活赎回(deadline→terminal_at_ms 窗内
         // 每行每 tick 一条 warn 的噪声源)——其收割属 reaper 的 expire+reconcileParkedAgents 车道。判别在

package/dist/observability/fail-open.d.ts

@@ -9,6 +9,10 @@ export interface FailOpenTagEntry {
 }
 /** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
 export declare const FAIL_OPEN_TAGS: {
+    readonly "server.run-store.file-hydrate-unreadable": {
+        readonly cls: "P-DEBT";
+        readonly note: "件6(#43 案 [4281]):`FileRunStore.hydrate()` 的 `readdirSync(runs/)` 失败 ⇒ 引擎以**空账**起动。旧形是空 catch + return:data root 不可读(权限/挂载丢失/路径被换走)时零告警,此后每一次 getRun 恒 miss —— 而「恒 miss」正是 #43 现场看到的形,一次环境故障被伪装成「本来就没有这条 run」。方向问题在于吞掉之后被读成的是「证不出有行 ⇒ 没有行」,两句话不等价。**不拒启是刻意保留的行为**(拒启是行为变更,另立),所以这条留作债:响亮化(error 级启动日志带 runs 绝对路径+异常文案)+ 本计数,让它在遥测里显形而不是只活在一行日志里。终局=给 file 后端一条可选的 fail-closed 启动门。";
+    };
     readonly "server.hitl.frame-undelivered-stream-closed": {
         readonly cls: "P-DEBT";
         readonly note: "HITL 的 **open** 帧写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,该 ask 挂到 TTL 才按无人应答结算。⚠️ #173 后 question 开帧改走断流 THROW(立即结算 unavailable),因此本 tag 在产的只剩 **elicitation** 一族——读计数时勿把它当作 question 的人在环缺口。no-op 而非 throw 对 elicitation 仍是既有的刻意决定,本条只保证它不再无声。";

package/dist/observability/fail-open.js

@@ -32,6 +32,10 @@
 import { appendFileSync } from "node:fs";
 /** 闭集 tag 词表。形=`<repo>.<domain>.<site>`(跨仓同形,便于三仓遥测并表)。 */
 export const FAIL_OPEN_TAGS = {
+    "server.run-store.file-hydrate-unreadable": {
+        cls: "P-DEBT",
+        note: "件6(#43 案 [4281]):`FileRunStore.hydrate()` 的 `readdirSync(runs/)` 失败 ⇒ 引擎以**空账**起动。旧形是空 catch + return:data root 不可读(权限/挂载丢失/路径被换走)时零告警,此后每一次 getRun 恒 miss —— 而「恒 miss」正是 #43 现场看到的形,一次环境故障被伪装成「本来就没有这条 run」。方向问题在于吞掉之后被读成的是「证不出有行 ⇒ 没有行」,两句话不等价。**不拒启是刻意保留的行为**(拒启是行为变更,另立),所以这条留作债:响亮化(error 级启动日志带 runs 绝对路径+异常文案)+ 本计数,让它在遥测里显形而不是只活在一行日志里。终局=给 file 后端一条可选的 fail-closed 启动门。",
+    },
     "server.hitl.frame-undelivered-stream-closed": {
         cls: "P-DEBT",
         note: "HITL 的 **open** 帧写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,该 ask 挂到 TTL 才按无人应答结算。⚠️ #173 后 question 开帧改走断流 THROW(立即结算 unavailable),因此本 tag 在产的只剩 **elicitation** 一族——读计数时勿把它当作 question 的人在环缺口。no-op 而非 throw 对 elicitation 仍是既有的刻意决定,本条只保证它不再无声。",

package/dist/plugins/caching-session-store.d.ts

@@ -40,6 +40,7 @@ export declare class CachingSessionStore implements SessionStore {
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */
     readonly listSessions?: (opts: {
         owner?: string;
+        includeUnowned?: boolean;
         cursor?: {
             lastActivityAt: string;
             sessionId: string;

package/dist/plugins/file-run-store.d.ts

@@ -53,7 +53,11 @@ export declare class FileRunStore {
     private readonly claimOwner;
     /** #213 —— sessionId → 该会话 claim 获取的临界区链尾(见 {@link withClaimLock})。 */
     private readonly claimLocks;
-    constructor(root: string);
+    /** 件6(#43 案 [4281]):启动期告警座(可选)。既有调用方不传 ⇒ 只走 fail-open 遥测那一半,不炸。 */
+    private readonly logger;
+    constructor(root: string, logger?: {
+        error?(msg: string, fields?: Record<string, unknown>): void;
+    });
     private runDir;
     private runJsonPath;
     private eventsPath;
@@ -118,6 +122,7 @@ export declare class FileRunStore {
     /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
     listSessions(opts: {
         owner?: string;
+        includeUnowned?: boolean;
         cursor?: {
             lastActivityAt: string;
             sessionId: string;
@@ -125,8 +130,11 @@ export declare class FileRunStore {
         limit: number;
         q?: string;
     }): Promise<SessionSummary[]>;
-    /** E21 (§0.5 delete) — purge the runs ledger for one session, owner-guarded; aborts (returns {active}) if a run is live. */
-    deleteBySession(sessionId: string, owner: string | null): Promise<{
+    /** E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
+     *  submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
+     *  aborts (returns {active}) if a run is live。`expectedSessionOwner` = SQL 双生的化身围栏入参,本孪生执行不了
+     *  (账本里没有 session_meta),理由与替代围栏逐字见 {@link MemoryRunStore.deleteBySession}。 */
+    deleteBySession(sessionId: string, expectedSessionOwner: string | null): Promise<{
         removed: number;
     } | {
         active: string;

package/dist/plugins/file-run-store.js

@@ -104,7 +104,10 @@ export class FileRunStore {
     claimOwner = { nonce: randomBytes(12).toString("hex"), ...PROCESS_FACTS };
     /** #213 —— sessionId → 该会话 claim 获取的临界区链尾(见 {@link withClaimLock})。 */
     claimLocks = new Map();
-    constructor(root) {
+    /** 件6(#43 案 [4281]):启动期告警座(可选)。既有调用方不传 ⇒ 只走 fail-open 遥测那一半,不炸。 */
+    logger;
+    constructor(root, logger) {
+        this.logger = logger;
         this.runsDir = join(root, "runs");
         this.activeDir = join(root, "runs", "active");
         this.tmpDir = join(root, "tmp"); // atomicWriteFile temp dir (same FS as runs → rename is atomic)
@@ -160,7 +163,20 @@ export class FileRunStore {
         try {
             entries = readdirSync(this.runsDir);
         }
-        catch {
+        catch (err) {
+            // 🔴 件6(#43 案 [4281],静默降级纪律):旧形是**空 catch + return** —— data root 不可读时引擎以
+            // 空账起动、零告警,此后每一次 getRun 恒 miss,而「恒 miss」正是 #43 现场看到的形。方向错在这里:
+            // 吞掉之后被读成的是「**证不出有行 ⇒ 没有行**」,而这两句话不等价,一次环境故障就此被伪装成
+            // 「本来就没有这条 run」。
+            // **行为不变**(仍不拒启 —— 拒启是行为变更,另立),只从静默变响亮:一行 error 级日志带 runs 目录
+            // **绝对路径** + 异常文案(运维一眼能判是权限还是路径),外加登记进 fail-open 遥测让这条债显形。
+            const detail = err instanceof Error ? err.message : String(err);
+            this.logger?.error?.("file_run_store_hydrate_unreadable", {
+                runsDir: this.runsDir,
+                error: detail,
+                note: "the file run-store booted with an EMPTY ledger because its runs/ directory could not be listed — every getRun will miss until this is fixed. This is NOT 'no such run'; check permissions/mount on the path above.",
+            });
+            recordFailOpen("server.run-store.file-hydrate-unreadable", detail);
             return;
         }
         for (const name of entries) {
@@ -493,8 +509,9 @@ export class FileRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner !== undefined && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
+            // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10). `includeUnowned` = [4198] 窄臂第三条件(SQL `OR owner IS NULL`)。
+            if (opts.owner !== undefined && r.owner !== opts.owner && !(opts.includeUnowned === true && r.owner === null))
+                continue;
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);
@@ -535,14 +552,18 @@ export class FileRunStore {
             .sort((a, b) => Date.parse(b.lastActivityAt) - Date.parse(a.lastActivityAt) || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0))
             .slice(0, opts.limit);
     }
-    /** E21 (§0.5 delete) — purge the runs ledger for one session, owner-guarded; aborts (returns {active}) if a run is live. */
-    async deleteBySession(sessionId, owner) {
+    /** E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
+     *  submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
+     *  aborts (returns {active}) if a run is live。`expectedSessionOwner` = SQL 双生的化身围栏入参,本孪生执行不了
+     *  (账本里没有 session_meta),理由与替代围栏逐字见 {@link MemoryRunStore.deleteBySession}。 */
+    async deleteBySession(sessionId, expectedSessionOwner) {
+        void expectedSessionOwner; // 见上:围栏在协调器那一侧(local 无 session_meta)
         const claimed = this.active.get(sessionId);
         if (claimed !== undefined)
             return { active: claimed };
         let removed = 0;
         for (const [taskId, r] of [...this.runs]) {
-            if (r.sessionId !== sessionId || !ownerEq(r.owner, owner))
+            if (r.sessionId !== sessionId)
                 continue;
             this.dropRun(taskId);
             removed += 1;

package/dist/plugins/local-session-store.d.ts

@@ -161,6 +161,8 @@ export declare class LocalSessionStore implements SessionStore {
      */
     listSessions(opts: {
         owner?: string;
+        /** [4198] 窄互认第二臂的第三条件(SQL 孪生里是 `owner IS NULL` 谓词;此处是同义的 `owner === null` 放行)。 */
+        includeUnowned?: boolean;
         cursor?: {
             lastActivityAt: string;
             sessionId: string;

package/dist/plugins/local-session-store.js

@@ -443,8 +443,8 @@ export class LocalSessionStore {
         const all = [];
         for (const meta of metas) {
             const owner = this.owners.has(meta.id) ? (this.owners.get(meta.id) ?? null) : null;
-            if (opts.owner !== undefined && owner !== opts.owner)
-                continue; // owner-scope (best-effort, process-local map)
+            if (opts.owner !== undefined && owner !== opts.owner && !(opts.includeUnowned === true && owner === null))
+                continue; // owner-scope (best-effort, process-local map) + [4198] 窄臂第三条件
             const firstActivityAt = meta.createdAt || new Date(0).toISOString();
             const lastActivityAt = this.lastActivity.get(meta.id) ?? firstActivityAt;
             all.push({

package/dist/plugins/memory-run-store.d.ts

@@ -90,6 +90,7 @@ export declare class MemoryRunStore {
     /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
     listSessions(opts: {
         owner?: string;
+        includeUnowned?: boolean;
         cursor?: {
             lastActivityAt: string;
             sessionId: string;
@@ -97,8 +98,18 @@ export declare class MemoryRunStore {
         limit: number;
         q?: string;
     }): Promise<SessionSummary[]>;
-    /** E21 (§0.5 delete) — purge the runs ledger for one session, owner-guarded; aborts (returns {active}) if a run is live. */
-    deleteBySession(sessionId: string, owner: string | null): Promise<{
+    /**
+     * E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
+     * submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
+     * aborts (returns {active}) if a run is live.
+     *
+     * `expectedSessionOwner` 是 SQL 双生的**化身围栏**入参(事务内复核 `session_meta.owner`,防「A 验权后 A' 删完、
+     * 别人用同一 uuid 重新登记」那一形)。本孪生**执行不了**它:local 车道的会话表在另一只店里,这只账本没有
+     * session_meta 可读 —— 参数只作契约对齐(签名不齐会让 RunStore 联合类型的调用点直接不可调)。local 的替代
+     * 围栏是两条:①协调器在本调用**紧前**复读一次 canonical owner(不齐即整条中止);②数据根的独占 BootLock
+     * 保证一个数据根恒一个进程,交错只可能发生在同进程的 await 缝里。这条不对称是**明写**的,不是遗漏。
+     */
+    deleteBySession(sessionId: string, expectedSessionOwner: string | null): Promise<{
         removed: number;
     } | {
         active: string;

package/dist/plugins/memory-run-store.js

@@ -207,8 +207,9 @@ export class MemoryRunStore {
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            if (opts.owner !== undefined && r.owner !== opts.owner)
-                continue; // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10)
+            // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10). `includeUnowned` = [4198] 窄臂第三条件(SQL `OR owner IS NULL`)。
+            if (opts.owner !== undefined && r.owner !== opts.owner && !(opts.includeUnowned === true && r.owner === null))
+                continue;
             const arr = bySession.get(r.sessionId) ?? [];
             arr.push(r);
             bySession.set(r.sessionId, arr);
@@ -247,14 +248,25 @@ export class MemoryRunStore {
             .sort((a, b) => Date.parse(b.lastActivityAt) - Date.parse(a.lastActivityAt) || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0))
             .slice(0, opts.limit);
     }
-    /** E21 (§0.5 delete) — purge the runs ledger for one session, owner-guarded; aborts (returns {active}) if a run is live. */
-    async deleteBySession(sessionId, owner) {
+    /**
+     * E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
+     * submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
+     * aborts (returns {active}) if a run is live.
+     *
+     * `expectedSessionOwner` 是 SQL 双生的**化身围栏**入参(事务内复核 `session_meta.owner`,防「A 验权后 A' 删完、
+     * 别人用同一 uuid 重新登记」那一形)。本孪生**执行不了**它:local 车道的会话表在另一只店里,这只账本没有
+     * session_meta 可读 —— 参数只作契约对齐(签名不齐会让 RunStore 联合类型的调用点直接不可调)。local 的替代
+     * 围栏是两条:①协调器在本调用**紧前**复读一次 canonical owner(不齐即整条中止);②数据根的独占 BootLock
+     * 保证一个数据根恒一个进程,交错只可能发生在同进程的 await 缝里。这条不对称是**明写**的,不是遗漏。
+     */
+    async deleteBySession(sessionId, expectedSessionOwner) {
+        void expectedSessionOwner; // 见上:本孪生无 session_meta 可复核,围栏在协调器那一侧
         const claimed = this.active.get(sessionId);
         if (claimed !== undefined)
             return { active: claimed };
         let removed = 0;
         for (const [taskId, r] of [...this.runs]) {
-            if (r.sessionId !== sessionId || !ownerEq(r.owner, owner))
+            if (r.sessionId !== sessionId)
                 continue;
             this.events.delete(taskId);
             this.runs.delete(taskId);

package/dist/plugins/permission-rule-store-file.d.ts

@@ -1,5 +1,5 @@
 import { FilePermissionRuleStoreProvider, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleScope } from "@sema-agent/core";
-import { type RuleImportTicket, type RuleTicketRedeemResult } from "./permission-rule-store-sql.js";
+import { type RuleImportTicket, type RuleTicketDecisionClock, type RuleTicketRedeemResult } from "./permission-rule-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
 /**
  * `RuleApprovalRecordStore` 的 File 形。
@@ -52,10 +52,10 @@ export declare class FileRuleImportTicketStore {
     }): Promise<RuleImportTicket>;
     /** 一次性**认领**。四条否定项的判序与 SQL 形逐字相同(unknown → wrong-principal → consumed → expired),
      *  于是两形的服务端日志归因可比;wire 面把四类折成同一个 404(零存在性 oracle)。 */
-    consume(ticketId: string, principal: string): Promise<RuleTicketRedeemResult>;
+    consume(ticketId: string, principal: string, opts?: RuleTicketDecisionClock): Promise<RuleTicketRedeemResult>;
     /** 把认领**放回去**。`mustRemainValidMs` = 放回之后至少还要能用多久 —— 撑不过就不算放回成功
      *  (理由逐字见 SQL 侧 `release` 的头注:承诺一次必然兑现不了的重试比不承诺更坏)。 */
-    release(ticketId: string, principal: string, mustRemainValidMs?: number): Promise<boolean>;
+    release(ticketId: string, principal: string, mustRemainValidMs?: number, opts?: RuleTicketDecisionClock): Promise<boolean>;
 }
 /** local 车道的三面束 + 生命周期。`dispose()` 释放 core File provider 的写锁(见 {@link createFilePermissionRuleStores})。 */
 export interface FilePermissionRuleStores extends PermissionRuleStoreBundle {

package/dist/plugins/permission-rule-store-file.js

@@ -294,7 +294,7 @@ export class FileRuleImportTicketStore {
     }
     /** 一次性**认领**。四条否定项的判序与 SQL 形逐字相同(unknown → wrong-principal → consumed → expired),
      *  于是两形的服务端日志归因可比;wire 面把四类折成同一个 404(零存在性 oracle)。 */
-    async consume(ticketId, principal) {
+    async consume(ticketId, principal, opts) {
         this.gate.assertUsable();
         const row = this.rows.get(ticketId);
         if (row === undefined)
@@ -303,21 +303,22 @@ export class FileRuleImportTicketStore {
             return { ok: false, reason: "wrong-principal" };
         if (row.consumedAtMs !== undefined)
             return { ok: false, reason: "consumed" };
-        const nowMs = this.now();
-        if (row.expiresAtMs <= nowMs)
+        // [4232]③:判定钟(可被同意车道的单调锚覆写)与记账钟(恒真墙钟,写进日志/行)分家 —— 逐字同 SQL 形。
+        const stampMs = this.now();
+        if (row.expiresAtMs <= (opts?.decisionNowMs ?? stampMs))
             return { ok: false, reason: "expired" };
-        this.log.append({ op: "consume", ticketId, atMs: nowMs }, true);
-        row.consumedAtMs = nowMs;
+        this.log.append({ op: "consume", ticketId, atMs: stampMs }, true);
+        row.consumedAtMs = stampMs;
         return { ok: true, approvalId: row.approvalId, payloadHash: row.payloadHash };
     }
     /** 把认领**放回去**。`mustRemainValidMs` = 放回之后至少还要能用多久 —— 撑不过就不算放回成功
      *  (理由逐字见 SQL 侧 `release` 的头注:承诺一次必然兑现不了的重试比不承诺更坏)。 */
-    async release(ticketId, principal, mustRemainValidMs = 0) {
+    async release(ticketId, principal, mustRemainValidMs = 0, opts) {
         this.gate.assertUsable();
         const row = this.rows.get(ticketId);
         if (row === undefined || row.ownerKey !== principal || row.consumedAtMs === undefined)
             return false;
-        if (row.expiresAtMs <= this.now() + mustRemainValidMs)
+        if (row.expiresAtMs <= (opts?.decisionNowMs ?? this.now()) + mustRemainValidMs)
             return false;
         this.log.append({ op: "release", ticketId }, true);
         delete row.consumedAtMs;

package/dist/plugins/permission-rule-store-sql.d.ts

@@ -111,6 +111,28 @@ export type RuleTicketRedeemResult = {
     ok: false;
     reason: "unknown" | "wrong-principal" | "expired" | "consumed";
 };
+/**
+ * [4232]③/[4235]③ —— 票的**判定钟**覆写(记账钟永远不覆写,见 `consume` 内注)。
+ *
+ * 缺席 = 墙钟,既有行为逐字不变。在场 = 调用方(同意车道)按**单调锚**投影出来的那个时刻:
+ * 铸票时刻的墙钟 + 自铸票起单调钟走过的量。它只能让判定更贴近**真实经过的时间**,给不了票额外寿命
+ * (投影按单调钟前进,走满 TTL 就必然越过 `expires_at_ms`)。
+ */
+export interface RuleTicketDecisionClock {
+    decisionNowMs?: number;
+}
+/**
+ * [4232]③ 同族的 **GC 宽限**:`reapExpired` 只收「按墙钟至少已死一个完整 TTL」的票行。
+ *
+ * 为什么需要它:判定侧改单调锚之后,一张「按墙钟已过期、按单调钟还在窗内」的票是**可兑付**的;
+ * 若 GC 仍按 `expires_at_ms <= now` 收行,判定修好了而行先没了 —— 用户拿到的从 `expired` 变成 `unknown`,
+ * 缺陷只是换了个归因。宽限一个 TTL 覆盖住「铸票时钟慢了不到一个 TTL」这一族(含 [4232]③ 的真实构造)。
+ *
+ * 残余(如实登记,不假称已解):墙钟被拨慢**超过**一个 TTL 时,行仍可能在单调窗内被收。彻底解需要行上
+ * 存单调基准,而单调基准跨进程无意义(core [4235] 的判词)。补偿是现成的:prepare 廉价,重铸一张即可
+ * ——这正是 core 建议的姿态(「接受 + 票廉价重铸」)。
+ */
+export declare const RULE_IMPORT_TICKET_GC_GRACE_MS: number;
 /** prepare 时刻候选集的规范摘要(载荷绑定 F1 ④ 的判据)。纯数据 ⇒ `build*`。 */
 export declare function buildRulePayloadHash(candidates: ReadonlyArray<{
     rule: string;
@@ -146,7 +168,7 @@ export declare class SqlRuleImportTicketStore {
      * expired/consumed 四类给服务端日志;wire 面把四类折成同一个 404)。预读说「可以」而 UPDATE 命中零行,
      * 只可能是我们在这两跳之间输给了一个并发认领者 —— 如实报 `consumed`,而不是把这次失败当成成功。
      */
-    consume(ticketId: string, principal: string): Promise<RuleTicketRedeemResult>;
+    consume(ticketId: string, principal: string, opts?: RuleTicketDecisionClock): Promise<RuleTicketRedeemResult>;
     /**
      * **认领的释放**(codex 交叉复审 round1 [high] 一,验真后修)。
      *
@@ -163,7 +185,7 @@ export declare class SqlRuleImportTicketStore {
      * 期间属主可以重新走 prepare 拿一张新票(导入是幂等的:同一条规则再兑付只是同一个 dot 的重放)。
      * 要彻底消灭它需要一条带租约到期的认领状态机,属协议改动,列为后续件。
      */
-    release(ticketId: string, principal: string, mustRemainValidMs?: number): Promise<boolean>;
+    release(ticketId: string, principal: string, mustRemainValidMs?: number, opts?: RuleTicketDecisionClock): Promise<boolean>;
     private readRow;
 }
 /**