@sema-agent/server 7.37.0 → 7.38.0-rc.1

package/dist/observability/cost-quota.js

@@ -1,16 +1,37 @@
 export class CostQuota {
-    limitMicroUsd;
-    windowMs;
     now;
     windows = new Map();
-    /** @param limitMicroUsd ceiling per window (integer micro-USD). @param windowMs rolling window. */
+    /** 🔴 不再 `readonly`:限额/窗长是比较参数,换代只动它们,窗内已累计的花费一个不动(design/322 §5)。 */
+    limitMicroUsd;
+    windowMs;
+    /** @param limitMicroUsd ceiling per window (integer micro-USD; `<=0` = OFF sentinel). @param windowMs rolling window. */
     constructor(limitMicroUsd, windowMs, now = () => Date.now()) {
+        this.now = now;
         this.limitMicroUsd = limitMicroUsd;
         this.windowMs = windowMs;
-        this.now = now;
+    }
+    /**
+     * 值换代。两件事**语义不同**,别混:
+     *  · **限额**换代 = 纯比较参数 ⇒ 窗内已累计的花费一个不动(design/322 §5 定案:调小当场更严)。
+     *  · **窗长**换代 = 换**记账周期** ⇒ 当代累计重开。
+     *
+     * 🔴 后者是 codex R1-F4(真 finding,红先):SQL 腿的窗长是**桶键的一部分**(`floor(now/windowMs)`),
+     * 换窗长后当代桶天然重算 ⇒ 已累计不跟着搬家;内存腿修前却保留原窗口累计。于是**同一条发布**在
+     * 内存部署上继续拒绝超额 principal、在 PG/TiDB 部署上重新放行一整个额度 —— 后端相关的成本 fail-open。
+     * 统一取 SQL 腿那一侧(唯一能在两条腿上都实现的语义:SQL 侧无法把旧桶累计搬进新桶)。
+     */
+    setLimits(next) {
+        this.limitMicroUsd = next.limitMicroUsd;
+        if (next.windowMs !== this.windowMs) {
+            this.windowMs = next.windowMs;
+            this.windows.clear();
+        }
     }
     /** Is this principal under quota right now? (Reads only — does not consume.) */
     check(key) {
+        // 关断哨兵:零窗表访问,如实报 `limitMicroUsd: 0`(消费方据此知道「本部署此刻没有 ceiling」)。
+        if (this.limitMicroUsd <= 0)
+            return { allowed: true, usedMicroUsd: 0, limitMicroUsd: 0, retryAfterSec: 0 };
         const t = this.now();
         const w = this.windows.get(key);
         const live = w && t - w.start < this.windowMs;
@@ -21,6 +42,8 @@ export class CostQuota {
     }
     /** Add spend for a principal, starting a fresh window if the prior one expired. */
     add(key, micro) {
+        if (this.limitMicroUsd <= 0)
+            return; // 关断哨兵:不为一个不存在的门攒内存(0→N 打开时是全新的窗口)
         if (micro <= 0)
             return;
         const t = this.now();

package/dist/observability/fail-open.d.ts

@@ -13,6 +13,14 @@ export declare const FAIL_OPEN_TAGS: {
         readonly cls: "P-DEBT";
         readonly note: "件6(#43 案 [4281]):`FileRunStore.hydrate()` 的 `readdirSync(runs/)` 失败 ⇒ 引擎以**空账**起动。旧形是空 catch + return:data root 不可读(权限/挂载丢失/路径被换走)时零告警,此后每一次 getRun 恒 miss —— 而「恒 miss」正是 #43 现场看到的形,一次环境故障被伪装成「本来就没有这条 run」。方向问题在于吞掉之后被读成的是「证不出有行 ⇒ 没有行」,两句话不等价。**不拒启是刻意保留的行为**(拒启是行为变更,另立),所以这条留作债:响亮化(error 级启动日志带 runs 绝对路径+异常文案)+ 本计数,让它在遥测里显形而不是只活在一行日志里。终局=给 file 后端一条可选的 fail-closed 启动门。";
     };
+    readonly "server.fork-routing.placed-probe-host-error": {
+        readonly cls: "F";
+        readonly note: "#292 placement 半场:hostPlacedProbe 对 host 店的 requireExisting 探针失败且**不是 not_found**(host 读故障)时折叠为 absent —— 路由回旧规则(claim-create 会在 transient 建新会话)。放行的是「host 暂不可达时 transient 腿保持独立可用」;最坏后果=故障窗内对一个真 placed id 铸出 transient 影子(host 恢复后双身,requireExisting 冷探针会重新指回 host 真身)。not_found 是常态路径不计数;只有真故障臂进本计数。";
+    };
+    readonly "server.fork-routing.placed-roster-meta-unreadable": {
+        readonly cls: "F";
+        readonly note: "#292 placement 半场:host-fallback 命中后顺手读 meta 入 placed 名册失败(stub 会话无 getMetadata / 读故障)。名册只是省探针的缓存,不是判定 —— 缺一条=该 id 下次 acquire 多付一次 hostPlacedProbe,正确性零影响。计数留痕是为了让「meta 读一直在失败」这种环境病显形。";
+    };
     readonly "server.hitl.frame-undelivered-stream-closed": {
         readonly cls: "P-DEBT";
         readonly note: "HITL 的 **open** 帧写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,该 ask 挂到 TTL 才按无人应答结算。⚠️ #173 后 question 开帧改走断流 THROW(立即结算 unavailable),因此本 tag 在产的只剩 **elicitation** 一族——读计数时勿把它当作 question 的人在环缺口。no-op 而非 throw 对 elicitation 仍是既有的刻意决定,本条只保证它不再无声。";

package/dist/observability/fail-open.js

@@ -36,6 +36,14 @@ export const FAIL_OPEN_TAGS = {
         cls: "P-DEBT",
         note: "件6(#43 案 [4281]):`FileRunStore.hydrate()` 的 `readdirSync(runs/)` 失败 ⇒ 引擎以**空账**起动。旧形是空 catch + return:data root 不可读(权限/挂载丢失/路径被换走)时零告警,此后每一次 getRun 恒 miss —— 而「恒 miss」正是 #43 现场看到的形,一次环境故障被伪装成「本来就没有这条 run」。方向问题在于吞掉之后被读成的是「证不出有行 ⇒ 没有行」,两句话不等价。**不拒启是刻意保留的行为**(拒启是行为变更,另立),所以这条留作债:响亮化(error 级启动日志带 runs 绝对路径+异常文案)+ 本计数,让它在遥测里显形而不是只活在一行日志里。终局=给 file 后端一条可选的 fail-closed 启动门。",
     },
+    "server.fork-routing.placed-probe-host-error": {
+        cls: "F",
+        note: "#292 placement 半场:hostPlacedProbe 对 host 店的 requireExisting 探针失败且**不是 not_found**(host 读故障)时折叠为 absent —— 路由回旧规则(claim-create 会在 transient 建新会话)。放行的是「host 暂不可达时 transient 腿保持独立可用」;最坏后果=故障窗内对一个真 placed id 铸出 transient 影子(host 恢复后双身,requireExisting 冷探针会重新指回 host 真身)。not_found 是常态路径不计数;只有真故障臂进本计数。",
+    },
+    "server.fork-routing.placed-roster-meta-unreadable": {
+        cls: "F",
+        note: "#292 placement 半场:host-fallback 命中后顺手读 meta 入 placed 名册失败(stub 会话无 getMetadata / 读故障)。名册只是省探针的缓存,不是判定 —— 缺一条=该 id 下次 acquire 多付一次 hostPlacedProbe,正确性零影响。计数留痕是为了让「meta 读一直在失败」这种环境病显形。",
+    },
     "server.hitl.frame-undelivered-stream-closed": {
         cls: "P-DEBT",
         note: "HITL 的 **open** 帧写向一条已断/已关的 SSE 连接 ⇒ 静默丢弃,上游据此把投递记成成功,该 ask 挂到 TTL 才按无人应答结算。⚠️ #173 后 question 开帧改走断流 THROW(立即结算 unavailable),因此本 tag 在产的只剩 **elicitation** 一族——读计数时勿把它当作 question 的人在环缺口。no-op 而非 throw 对 elicitation 仍是既有的刻意决定,本条只保证它不再无声。",

package/dist/observability/rate-limit.d.ts

@@ -10,18 +10,28 @@ export interface RateDecision {
     retryAfterSec: number;
     remaining: number;
 }
+/** #322 批1:限额的**值换代**入参(六实现类同一形)。语义定案(design/322 §5):窗口内计数**不清零**,
+ *  新限额即时用于比较 —— 调小 = 窗内立刻更严(可能当场 429,符合运营意图),调大 = 立刻放宽。 */
+export interface RateLimits {
+    /** 每窗请求上限;`<= 0` = **关断哨兵**(恒放行、不记账、SQL 腿不起刷新环)。 */
+    rateLimitPerMin: number;
+}
 /** The surface the HTTP layer uses — satisfied by the in-memory {@link RateLimiter} (single replica)
  *  and the cross-replica {@link import("../plugins/tidb-rate-limiter.js").TiDBRateLimiter}. */
 export interface RateGate {
     check(key: string): RateDecision;
     sweep(now?: number): void;
+    /** #322:值换代座位。**接口级**声明(不是各类自选):新实现漏掉它 = 编译红,而不是热更新在那条腿上静默失效。 */
+    setLimits(next: RateLimits): void;
 }
 export declare class RateLimiter implements RateGate {
-    private readonly limit;
     private readonly windowMs;
     private readonly windows;
+    /** 🔴 不再 `readonly`:限额是**比较参数**,不是窗表状态 —— 换代只动它,窗内已计的数一个不动(§5)。 */
+    private limit;
     constructor(limit: number, windowMs?: number);
     check(key: string): RateDecision;
+    setLimits(next: RateLimits): void;
     /** Drop expired windows (call periodically). */
     sweep(now?: number): void;
 }

package/dist/observability/rate-limit.js

@@ -1,12 +1,15 @@
 export class RateLimiter {
-    limit;
     windowMs;
     windows = new Map();
+    /** 🔴 不再 `readonly`:限额是**比较参数**,不是窗表状态 —— 换代只动它,窗内已计的数一个不动(§5)。 */
+    limit;
     constructor(limit, windowMs = 60_000) {
-        this.limit = limit;
         this.windowMs = windowMs;
+        this.limit = limit;
     }
     check(key) {
+        // 关断哨兵:零比较、零窗表写入。off 期间不攒计数是刻意的——0→N 打开时应该是一个完整的新窗口,
+        // 而不是「上来就超」(那段时间根本没有 ceiling,补记账等于追溯执法)。
         if (this.limit <= 0)
             return { allowed: true, retryAfterSec: 0, remaining: Number.POSITIVE_INFINITY };
         const now = Date.now();
@@ -21,6 +24,9 @@ export class RateLimiter {
         }
         return { allowed: true, retryAfterSec: 0, remaining: this.limit - w.count };
     }
+    setLimits(next) {
+        this.limit = next.rateLimitPerMin;
+    }
     /** Drop expired windows (call periodically). */
     sweep(now = Date.now()) {
         for (const [k, w] of this.windows)

package/dist/plan-cache-probe.d.ts

@@ -8,11 +8,11 @@
  * does an agent's traffic actually re-pose near-duplicate objectives per tenant? (arXiv 2602.18922:
  * heterogeneous queries can hit 0–12%.) We hold the real multi-tenant traffic, so this is ours to count.
  *
- * **The token criterion is copied verbatim from core `src/core/strategy-store.ts`** (`tokens()` /
- * `significant()` / `find()` lines 46-52, 107-110) — otherwise we'd measure something other than what
- * plan-cache retrieval would actually use. Note the **asymmetry**: a stored problem is matched on its
- * full `tokens()` set, the query on its `significant()` set, and a hit = every significant query token
- * is present in some stored problem (`significant(new) ⊆ tokens(historical)`).
+ * **The token criterion is copied verbatim from core `strategy-store` (`compileStrategyQuery`)** —
+ * otherwise we'd measure something other than what plan-cache retrieval would actually use. Note the
+ * **asymmetry**: a stored problem is matched on its full `tokens()` set, the query on its
+ * `significant()` set. A hit = `significant(new) ⊆ tokens(historical)` OR (5.49 legacy acceptance
+ * arm) the non-CJK subset `qAlnum` is non-empty and fully contained (`qAlnum ⊆ tokens(historical)`).
  *
  * Fidelity choices (stated to search AI for confirmation): the history ring holds only **completed**
  * tasks (plan-cache only stores plans from successful runs), while the hit test runs for **every**
@@ -21,9 +21,7 @@
  */
 import type { Metrics } from "./observability/metrics.js";
 import type { Logger } from "./observability/logger.js";
-/** Lowercased word tokens (core口径). */
 export declare function tokens(s: string): string[];
-/** Meaningful tokens: ≥3 chars, not a stopword (core口径). */
 export declare function significant(s: string): string[];
 /** Per-scope view for the 2-week handoff back to search AI. */
 export interface ScopeRecurrence {

package/dist/plan-cache-probe.js

@@ -8,12 +8,30 @@ const STOP = new Set([
     "of", "to", "in", "on", "is", "it", "or", "as", "at", "by", "be", "do", "if", "so", "no", "up", "we",
 ]);
 /** Lowercased word tokens (core口径). */
+/** core 5.49 G2(CJK 检索修)同形:拉丁/数字按非字母数字切段 + CJK 按单字与相邻二元组入集
+ *  (core `memory-vector.termSet` 逐字搬)。旧形 `match(/[a-z0-9]+/g)` 对纯中文任务名恒空 ⇒
+ *  probe 测出的 recurrence 与 plan-cache 真命中脱钩——同源钉(plan-cache-probe.test.ts)就是
+ *  为这次换形红的。 */
+const CJK_RUN = /[぀-ヿㇰ-ㇿ㐀-䶿一-鿿가-힣豈-﫿]+/g;
 export function tokens(s) {
-    return s.toLowerCase().match(/[a-z0-9]+/g) ?? [];
+    const lower = s.toLowerCase();
+    const out = new Set();
+    for (const run of lower.split(/[^a-z0-9]+/))
+        if (run)
+            out.add(run);
+    for (const m of lower.matchAll(CJK_RUN)) {
+        const chars = [...m[0]];
+        for (const c of chars)
+            out.add(c);
+        for (let i = 0; i + 1 < chars.length; i++)
+            out.add(chars[i] + chars[i + 1]);
+    }
+    return [...out];
 }
-/** Meaningful tokens: ≥3 chars, not a stopword (core口径). */
+/** CJK 词条豁免长度/停词判(core 5.49 `CJK_LEAD` 同形:单字即显著);拉丁保持 ≥3 且非停词。 */
+const CJK_LEAD = /^[぀-ヿㇰ-ㇿ㐀-䶿一-鿿가-힣豈-﫿]/;
 export function significant(s) {
-    return tokens(s).filter((t) => t.length >= 3 && !STOP.has(t));
+    return tokens(s).filter((t) => (CJK_LEAD.test(t) ? true : t.length >= 3 && !STOP.has(t)));
 }
 const RING = 1000; // most-recent completed tasks per scope (= search AI's N=1000)
 const MAX_SCOPES = 2000; // LRU cap on tracked scopes — bounds memory under high tenant cardinality
@@ -38,12 +56,16 @@ export class PlanCacheProbe {
         const scope = scopeRaw && scopeRaw.length > 0 ? scopeRaw : "anon";
         const qSig = significant(objective);
         const st = this.touch(scope);
-        // Hit = some historical (completed) task's full token set ⊇ this task's significant tokens.
+        // Hit = some historical (completed) task's full token set ⊇ this task's significant tokens,
+        // OR(core 5.49 compileStrategyQuery 的 legacy acceptance 臂,合并窗重扫 medium)⊇ 其拉丁/数字
+        // 子集 qAlnum(非空时)——changelog 原句 "old hits preserved via a legacy acceptance arm"。
+        // 少这条臂时「CJK 团不全匹配但拉丁标识符全匹配」的真命中被判 miss ⇒ recurrence 系统性低估。
         // qSig empty → never a hit (mirrors find()'s `qSig.length===0 → []`, no injection).
         let hit = false;
         if (qSig.length > 0) {
+            const qAlnum = qSig.filter((t) => !CJK_LEAD.test(t));
             for (const hist of st.ring) {
-                if (qSig.every((t) => hist.has(t))) {
+                if (qSig.every((t) => hist.has(t)) || (qAlnum.length > 0 && qAlnum.every((t) => hist.has(t)))) {
                     hit = true;
                     break;
                 }

package/dist/plugins/caching-session-store.d.ts

@@ -1,6 +1,7 @@
-import type { AcquiredSession, RetentionDeclaration, SessionStore, SessionTreeEntry } from "@sema-agent/core";
+import type { AcquiredSession, PlacedSessionRow, RetentionDeclaration, SessionPlacementRecord, SessionStore, SessionTreeEntry } from "@sema-agent/core";
 import type { SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
+import { type PlacementAcquireOpts } from "./session-placement.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
@@ -105,10 +106,25 @@ export declare class CachingSessionStore implements SessionStore {
      * 构造期常量,一个会变的声明本身就是缺陷。缺席则不设(保持 fail-closed 的缺席读法)。
      */
     readonly retention?: RetentionDeclaration;
+    /**
+     * #292 C18 —— 内层店的 **placement 声明**转发。
+     *
+     * 🔴 这一格与 {@link retention} 是同一条教训的同一族(而且更狠):生产默认 `SESSION_CACHE_TTL_SEC=300`
+     * 把真店包进本类,于是 boot 递给 core 的就是**包装层**。core 的铸造门判「row store ∧ **session 店声明**」
+     * ⇒ 不转发 = 整条 subagent 转录持久化在默认部署上**静默不生效**(placement 参数被合法忽略、子代转录
+     * 退回普通会话、声明的 durable tier 变成一句空话),而且没有任何一处会报错。
+     * 只读快照而非 getter:声明是店的构造期常量(会变的声明本身就是缺陷)。
+     */
+    readonly placements?: SessionStore["placements"];
+    /** #292:placed 分区的两只读面(reap 分区腿 / 准入探针)——同款转发理由:reaper 与准入判据拿到的
+     *  是包装层,不转发 = 分区腿静默不可用、暖命中的 claim 关门静默失效。缺席则不设(诚实降级)。 */
+    readonly listPlaced?: (kind: "subagent", opts?: {
+        olderThanMs?: number;
+        scope?: string;
+    }) => Promise<PlacedSessionRow[]>;
+    readonly placementOf?: (sessionId: string) => Promise<SessionPlacementRecord | undefined>;
     constructor(inner: SessionStore, opts: CachingOptions);
-    acquire(sessionId?: string, opts?: {
-        requireExisting?: boolean;
-    }): Promise<AcquiredSession>;
+    acquire(sessionId?: string, opts?: PlacementAcquireOpts): Promise<AcquiredSession>;
     touch(sessionId: string): Promise<void>;
     release(sessionId: string): Promise<void>;
     /** Drop a session from the warm cache (e.g. after a cross-instance write conflict). */

package/dist/plugins/caching-session-store.js

@@ -1,3 +1,4 @@
+import { assertPlacementAdmission } from "./session-placement.js";
 /**
  * Warm/sticky cache in front of a durable {@link SessionStore} (Option A).
  *
@@ -79,12 +80,34 @@ export class CachingSessionStore {
      * 构造期常量,一个会变的声明本身就是缺陷。缺席则不设(保持 fail-closed 的缺席读法)。
      */
     retention;
+    /**
+     * #292 C18 —— 内层店的 **placement 声明**转发。
+     *
+     * 🔴 这一格与 {@link retention} 是同一条教训的同一族(而且更狠):生产默认 `SESSION_CACHE_TTL_SEC=300`
+     * 把真店包进本类,于是 boot 递给 core 的就是**包装层**。core 的铸造门判「row store ∧ **session 店声明**」
+     * ⇒ 不转发 = 整条 subagent 转录持久化在默认部署上**静默不生效**(placement 参数被合法忽略、子代转录
+     * 退回普通会话、声明的 durable tier 变成一句空话),而且没有任何一处会报错。
+     * 只读快照而非 getter:声明是店的构造期常量(会变的声明本身就是缺陷)。
+     */
+    placements;
+    /** #292:placed 分区的两只读面(reap 分区腿 / 准入探针)——同款转发理由:reaper 与准入判据拿到的
+     *  是包装层,不转发 = 分区腿静默不可用、暖命中的 claim 关门静默失效。缺席则不设(诚实降级)。 */
+    listPlaced;
+    placementOf;
     constructor(inner, opts) {
         this.inner = inner;
         this.ttlMs = Math.max(0, opts.ttlSec) * 1000;
         const declared = inner.retention;
         if (declared !== undefined)
             this.retention = declared;
+        // #292:声明 + 两只读面逐字转发(理由见各自的字段注)。
+        if (inner.placements !== undefined)
+            this.placements = inner.placements;
+        if (typeof inner.listPlaced === "function")
+            this.listPlaced = (kind, o) => inner.listPlaced(kind, o);
+        const innerPlacementOf = inner.placementOf;
+        if (typeof innerPlacementOf === "function")
+            this.placementOf = (id) => innerPlacementOf.call(inner, id);
         const ownerAware = inner;
         if (ownerAware.ownerOf)
             this.ownerOf = ownerAware.ownerOf.bind(inner);
@@ -187,6 +210,13 @@ export class CachingSessionStore {
             return fresh;
         }
         const hit = this.cache.get(sessionId);
+        // 🔴 #292 义务 6(claim 关门)在**暖命中**上的半场:一次 claim 形 acquire 撞上缓存里的 placed 会话,
+        // 若按下面的「命中即返回」放行,包装层就成了义务的一个**旁路**——同一条 id 在冷缓存上被拒、在暖
+        // 缓存上被接受,而生产默认恰恰是暖的。判据仍吃**持久化元组**(一次 PK 探针,只在声明了分区的内层
+        // 店 + 非 requireExisting 的形上付),绝不用缓存里的影子事实当准入依据。
+        if (hit && opts?.requireExisting !== true && this.placements !== undefined && this.placementOf !== undefined) {
+            assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
+        }
         if (hit) {
             // A warm cache hit means the session EXISTS → it satisfies `requireExisting` (no need to re-open the durable
             // log). design/114 Phase3: the fail-loud only ever fires on a genuinely-missing (uncached) session below.
@@ -208,8 +238,19 @@ export class CachingSessionStore {
             return a;
         }
         const inflight = this.pending.get(sessionId);
-        if (inflight)
-            return inflight;
+        if (inflight) {
+            // 🔴 #292(codex 对抗复审 R1-[high],验真后修):**in-flight 合并也要逐调用者复判**准入。
+            // 病:两个并发调用一冷一后到,后到者直接拿走**首个**调用者的 promise —— 于是
+            //  · 可信 placement 创建先到 + claim 形后到 ⇒ 后者当场附着到一条 placed 转录上(义务 6 被绕过);
+            //  · 顺序反过来 ⇒ placement 创建方拿到一只**普通**会话(镜像方向的 squat 判本该拒,却被合并吞掉)。
+            // 内层 SQL 店自己有逐调用者复判(它的 pending 分支同款),但**默认生产形是本包装层**,而本层在
+            // 到达内层之前就把第二个调用者截断了 —— 判据被一层缓存挡在门外,正是本类反复吃过的那一类亏。
+            const acquired = await inflight;
+            if (this.placements !== undefined && this.placementOf !== undefined) {
+                assertPlacementAdmission(sessionId, await this.placementOf(sessionId), opts);
+            }
+            return acquired;
+        }
         const p = this.inner
             .acquire(sessionId, opts)
             .then((a) => {

package/dist/plugins/fork-routing-session-store.d.ts

@@ -23,7 +23,12 @@
  * 路由表 LRU 上限 {@link ROUTE_MAX}:满额逐最老(refresh-on-use);被逐后下次 `acquire` 按上述规则重derive
  * (requireExisting 的 host-first 重试仍落对店),中途 touch/noteTaskRun 缺路由=落 transient(no-op 级)。
  */
-import type { SessionStore, AcquiredSession, SessionStoreSummary } from "@sema-agent/core";
+import { type SessionStore, type AcquiredSession, type SessionStoreSummary, type SessionPlacement, type PlacedSessionRow } from "@sema-agent/core";
+/** acquire 选项形(core 5.48 SessionStore 契约):#292 placement=受信 spawner 的分区建会话声明。 */
+type AcquireOpts = {
+    requireExisting?: boolean;
+    placement?: SessionPlacement;
+};
 export declare class ForkRoutingSessionStore implements SessionStore {
     private readonly host;
     private readonly transient;
@@ -35,12 +40,28 @@ export declare class ForkRoutingSessionStore implements SessionStore {
      *  亲读),逐出后 transient-first 的 requireExisting 会把陈旧快照端回给 revive。本集不逐出(上界=
      *  parked 子代数,天然小);pick/acquire 首查。 */
     private readonly promoted;
+    /** #292 placement 半场:placed id 名册(与 promoted 同姿势——不随路由 LRU 逐出)。placed 会话的
+     *  真居所恒=host(分区在 durable 店),任何形的 acquire/touch/release 都不得落 transient——
+     *  否则 transient 的 claim-create 会铸出同 id 影子会话,requireExisting 的 transient-first 顺序
+     *  会让影子遮蔽真转录(F-7 顺序对 placed 反向成害)。 */
+    private readonly placed;
+    /** #292:host 店的 placements 声明透传(声明制——包装层不 duck-type,host 声明了才武装 placed
+     *  路由;host 不声明时本店全行为与 5.47 前逐字节同)。 */
+    readonly placements?: SessionStore["placements"];
+    /** #292:分区枚举透传(host 有才有——恒在的空实现会把「不能枚举」谎报成「没有 placed 会话」)。 */
+    readonly listPlaced?: (kind: "subagent", opts?: {
+        olderThanMs?: number;
+        scope?: string;
+    }) => Promise<PlacedSessionRow[]>;
     constructor(host: SessionStore, transient: SessionStore);
     private remember;
     private pick;
-    acquire(sessionId?: string, opts?: {
-        requireExisting?: boolean;
-    }): Promise<AcquiredSession>;
+    /** #292:host 声明分区时的冷缓存判位探针。判据=host `requireExisting` acquire 的 `SessionMetadata.placement`
+     *  (5.48 additive,File/SQL/Ttl 三形都带——比 `placementOf` 面更普适:Ttl 缓存层不透传 placementOf)。
+     *  placed 命中把 acquired 会话一并交回(调用方正需要它时零二次 acquire);非 placed/absent 的探针
+     *  acquire 一律 **forget** 收尾([4743] 义务①:验存在的 acquire 禁 release——release(placed)=真删)。 */
+    private hostPlacedProbe;
+    acquire(sessionId?: string, opts?: AcquireOpts): Promise<AcquiredSession>;
     touch(sessionId: string): void | Promise<void>;
     release(sessionId: string): Promise<void>;
     forget(sessionId: string): void | Promise<void>;
@@ -70,4 +91,5 @@ export declare class ForkRoutingSessionStore implements SessionStore {
     get size(): number;
     dispose(): void | Promise<void>;
 }
+export {};
 //# sourceMappingURL=fork-routing-session-store.d.ts.map

package/dist/plugins/fork-routing-session-store.js

@@ -1,3 +1,30 @@
+/**
+ * ForkRoutingSessionStore — the subRunner's session backing after core 1.350's fork 终修([1364]①/[1367]①).
+ *
+ * 问题形:core 的 `hostSessionFork` 在 HOST runner 的店里 fork,fork 子任务带 `requireExistingSession:true`
+ * 在 opts.runner(subRunner)上执行——subRunner 拆店时子任务查不到刚 fork 出的会话,响亮失败
+ * `resume.session_not_found`(cli 真机复现)。
+ *
+ * 但把 host durable 店**整个**给 subRunner(第一版修)被 codex 判两 high:普通子任务(council 镜头/
+ * team/子代理)会把每次运行都铸成 committed durable 会话——sweepStagingSessions 只扫**无 session_meta**
+ * 的 staging 弃置行,committed 子会话没有 reaper=无界增长;且进 owner 过滤的会话枚举(零 run 的内部
+ * 会话污染 /v1/sessions)。
+ *
+ * 此包装店按**会话的真居所**路由,两边语义都保住:
+ *  - `acquire(id, {requireExisting})`(fork 子 + retained-child resume 的形)→ **host 店优先**,miss 落
+ *    transient(retained 瞬态子的 resume 仍走私店);两边都 miss=抛 host 侧错误(fail-loud 原语义)。
+ *  - `acquire()`(无 id=普通子任务铸新会话)→ **transient**(throwaway 姿势保留:council/team 子会话
+ *    不落 durable、不进枚举、TTL 自清)。
+ *  - `acquire(id)`(带 id 不 requireExisting)→ 已有路由按路由走;未知 id 落 transient(claim-create
+ *    绝不打到 durable 店——那是 authorizer 的职权)。
+ *  - `fork(sourceId)` → 源在哪店在哪店 fork(路由未知时 host 先试,null 再 transient);新 id 记路由。
+ *  - `list`/`size`/`dispose` = transient 侧(host 店归 main runner 所有;不双列、不双清)。
+ *
+ * 路由表 LRU 上限 {@link ROUTE_MAX}:满额逐最老(refresh-on-use);被逐后下次 `acquire` 按上述规则重derive
+ * (requireExisting 的 host-first 重试仍落对店),中途 touch/noteTaskRun 缺路由=落 transient(no-op 级)。
+ */
+import { SessionError } from "@sema-agent/core";
+import { recordFailOpen } from "../observability/fail-open.js";
 const ROUTE_MAX = 8192;
 export class ForkRoutingSessionStore {
     host;
@@ -10,9 +37,26 @@ export class ForkRoutingSessionStore {
      *  亲读),逐出后 transient-first 的 requireExisting 会把陈旧快照端回给 revive。本集不逐出(上界=
      *  parked 子代数,天然小);pick/acquire 首查。 */
     promoted = new Set();
+    /** #292 placement 半场:placed id 名册(与 promoted 同姿势——不随路由 LRU 逐出)。placed 会话的
+     *  真居所恒=host(分区在 durable 店),任何形的 acquire/touch/release 都不得落 transient——
+     *  否则 transient 的 claim-create 会铸出同 id 影子会话,requireExisting 的 transient-first 顺序
+     *  会让影子遮蔽真转录(F-7 顺序对 placed 反向成害)。 */
+    placed = new Set();
+    /** #292:host 店的 placements 声明透传(声明制——包装层不 duck-type,host 声明了才武装 placed
+     *  路由;host 不声明时本店全行为与 5.47 前逐字节同)。 */
+    placements;
+    /** #292:分区枚举透传(host 有才有——恒在的空实现会把「不能枚举」谎报成「没有 placed 会话」)。 */
+    listPlaced;
     constructor(host, transient) {
         this.host = host;
         this.transient = transient;
+        // #292 声明/枚举面:host 声明什么透传什么(transient 永不声明 placements——分区住 durable 店)。
+        if (host.placements !== undefined)
+            this.placements = host.placements;
+        const hostListPlaced = host.listPlaced;
+        if (typeof hostListPlaced === "function") {
+            this.listPlaced = (kind, o) => hostListPlaced.call(host, kind, o);
+        }
         // backlog(hasSessionFork 恒真):两 backing 都无 fork 面时,包装店的 fork 方法**摘除**——core 的
         // fork 门(hasSessionFork(opts.runner.sessions))才能诚实报 fork.unavailable,而不是放行后折叠成
         // 误导性的「source not found」。现三 backing 均有 fork,此臂为接入无 fork durable backend 备。
@@ -30,29 +74,71 @@ export class ForkRoutingSessionStore {
         }
     }
     pick(id) {
-        if (this.promoted.has(id))
-            return this.host; // [1593] 晋升名册优先(路由可被 LRU 逐出,名册不逐)
+        if (this.promoted.has(id) || this.placed.has(id))
+            return this.host; // 名册优先(路由可被 LRU 逐出,名册不逐;placed 同姿势 #292)
         const r = this.route.get(id);
         if (r !== undefined)
             this.remember(id, r); // refresh recency
         return r === "host" ? this.host : this.transient;
     }
+    /** #292:host 声明分区时的冷缓存判位探针。判据=host `requireExisting` acquire 的 `SessionMetadata.placement`
+     *  (5.48 additive,File/SQL/Ttl 三形都带——比 `placementOf` 面更普适:Ttl 缓存层不透传 placementOf)。
+     *  placed 命中把 acquired 会话一并交回(调用方正需要它时零二次 acquire);非 placed/absent 的探针
+     *  acquire 一律 **forget** 收尾([4743] 义务①:验存在的 acquire 禁 release——release(placed)=真删)。 */
+    async hostPlacedProbe(id) {
+        if (this.placed.has(id)) {
+            const acquired = await this.host.acquire(id, { requireExisting: true });
+            return { state: "placed", acquired };
+        }
+        if (this.placements?.subagent === undefined)
+            return { state: "absent" };
+        let acquired;
+        try {
+            acquired = await this.host.acquire(id, { requireExisting: true });
+        }
+        catch (err) {
+            // not_found=常态(绝大多数 id 非 placed),静默折 absent;**真故障**(host 不可达/读错)同样折
+            // absent 但计数留痕(#191 门②:F 类兜底必走 recordFailOpen)——放行的是 transient 腿在 host
+            // 故障窗内保持独立可用,代价与恢复路径见 tag 注册表。
+            if (!(err instanceof SessionError && err.code === "not_found")) {
+                recordFailOpen("server.fork-routing.placed-probe-host-error", err instanceof Error ? err.message : String(err));
+            }
+            return { state: "absent" };
+        }
+        const meta = await acquired.session.getMetadata();
+        if (meta.placement !== undefined) {
+            this.placed.add(id);
+            return { state: "placed", acquired };
+        }
+        await this.host.forget?.(id); // 只为验居所:丢缓存引用,内容不动(禁 release)
+        return { state: "unplaced" };
+    }
     async acquire(sessionId, opts) {
         if (sessionId === undefined) {
-            const a = await this.transient.acquire();
+            const a = await this.transient.acquire(undefined, opts);
             this.remember(a.sessionId, "transient");
             return a;
         }
-        if (this.promoted.has(sessionId)) {
+        // #292 建会话入分区形(受信 spawner:带 placement、不 requireExisting)——分区住 host durable 店;
+        // host 不声明 placements 时按旧行为落 transient(core 铸造门本就不会给这种部署铸 placement,
+        // 这臂只是防御性一致)。
+        if (opts?.placement !== undefined && opts.requireExisting !== true && this.placements?.subagent !== undefined) {
+            const a = await this.host.acquire(sessionId, opts);
+            this.placed.add(sessionId);
+            this.remember(sessionId, "host");
+            return a;
+        }
+        if (this.promoted.has(sessionId) || this.placed.has(sessionId)) {
             // [1593] 晋升名册:恒走 host——绝不能让 transient-first 把 forget 后仍活在私店 repo 里的陈旧
-            // 快照端给 revive(探针 Finding A)。
+            // 快照端给 revive(探针 Finding A)。placed 名册同规则(#292:影子遮蔽真转录的反向 F-7)。
             const a = await this.host.acquire(sessionId, opts);
             this.remember(sessionId, "host");
             return a;
         }
         const routed = this.route.get(sessionId);
-        if (routed !== undefined) {
-            const a = await this.pick(sessionId).acquire(sessionId, opts);
+        if (routed === "host") {
+            const a = await this.host.acquire(sessionId, opts);
+            this.remember(sessionId, "host");
             return a;
         }
         if (opts?.requireExisting) {
@@ -60,9 +146,19 @@ export class ForkRoutingSessionStore {
             // transient(miss)→ fallback host 命中,语义不变。顺序反转封住 F-7 组合链:同 id 在两店并存时
             // (child uuid 被同租户误提交到主 API 而 host 店 claim-create 出空壳),真子会话(transient)赢,
             // 空壳不遮蔽。双 miss 抛 host 侧错误(响亮,fail-closed 到「真不存在」)。
+            // #292 例外:transient 命中且 host 声明分区时,还要过一次 placed 判位——同 id 若在 host 是 placed
+            // 会话,transient 那份是影子(claim-create 铸的),真转录必须赢(F-7 顺序对 placed 反向成害)。
             let transientErr;
             try {
                 const a = await this.transient.acquire(sessionId, opts);
+                if (this.placements?.subagent !== undefined) {
+                    const probe = await this.hostPlacedProbe(sessionId);
+                    if (probe.state === "placed" && probe.acquired !== undefined) {
+                        await this.transient.forget?.(sessionId); // 影子只丢引用(私店 repo 行本就 sweep 不到,名册是真防线)
+                        this.remember(sessionId, "host");
+                        return probe.acquired;
+                    }
+                }
                 this.remember(sessionId, "transient");
                 return a;
             }
@@ -71,6 +167,20 @@ export class ForkRoutingSessionStore {
             }
             try {
                 const a = await this.host.acquire(sessionId, opts);
+                // 顺手:host 端回的会话若带 placement 元组,入名册(后续零探针直达)。只在声明分区的部署上读
+                // (非声明形零行为差),且 meta 读失败不阻断 acquire(名册只是省探针的缓存,不是判定)。
+                if (this.placements?.subagent !== undefined) {
+                    try {
+                        const meta = await a.session.getMetadata();
+                        if (meta.placement !== undefined)
+                            this.placed.add(sessionId);
+                    }
+                    catch (err) {
+                        // 名册只是省探针的缓存,不是判定——缺一条=该 id 下次多付一次 hostPlacedProbe,正确性零影响;
+                        // 计数留痕(#191 门②)让「meta 一直读失败」的环境病在遥测显形。
+                        recordFailOpen("server.fork-routing.placed-roster-meta-unreadable", err instanceof Error ? err.message : String(err));
+                    }
+                }
                 this.remember(sessionId, "host");
                 return a;
             }
@@ -80,6 +190,17 @@ export class ForkRoutingSessionStore {
             }
         }
         // 带 id 但不要求已存在:claim-create 只允许落 transient(durable 店的 claim-create 是 authorizer 的职权)。
+        // #292 claim closure(义务⑥过墙形):id 若已是 host 分区的 placed 会话,claim-create 落 transient 会
+        // 铸同 id 影子——委托给 host claim 形,让其 placement_refused 响亮拒(绝不静默铸影子)。
+        if (this.placements?.subagent !== undefined) {
+            const probe = await this.hostPlacedProbe(sessionId);
+            if (probe.state === "placed") {
+                await this.host.forget?.(sessionId); // 探针引用丢弃(refusal 路径不把会话交出)
+                const a = await this.host.acquire(sessionId, opts); // claim 形打声明店 ⇒ placement_refused(义务⑥)
+                this.remember(sessionId, "host");
+                return a; // 不可达(上一行必抛);保留形以防 host 语义演化时静默吞
+            }
+        }
         const a = await this.transient.acquire(sessionId, opts);
         this.remember(sessionId, "transient");
         return a;
@@ -151,7 +272,9 @@ export class ForkRoutingSessionStore {
         catch {
             // 私店无此会话:可能已在 host(直查确认=幂等),否则如实抛(host 侧错误响亮上浮)
             const probe = await this.host.acquire(sessionId, { requireExisting: true });
-            await this.host.release(probe.sessionId);
+            // #292 preflight 纪律([4743] 义务①):**只为验存在**的 acquire 收尾一律 forget —— host 店的
+            // release 对 placed 会话是真删除(core 5.48 义务 4),用它给一次探活收尾就是拿删除当探针。
+            await this.host.forget?.(probe.sessionId);
             this.promoted.add(sessionId);
             this.remember(sessionId, "host");
             return;
@@ -179,7 +302,9 @@ export class ForkRoutingSessionStore {
                 throw new Error(`session "${sessionId}" promotion verification failed (leaf mismatch after import)`);
         }
         finally {
-            await this.host.release(sessionId);
+            // #292:晋升写完只需**丢引用**(内容必须留下,那正是晋升的目的)⇒ forget,不是 release
+            // (同上:release 对 placed 会话已是真删除,而这条 finally 连失败路径都会走)。
+            await this.host.forget?.(sessionId);
         }
         try {
             await this.transient.forget?.(sessionId);

package/dist/plugins/memory-engine-pg.d.ts

@@ -64,6 +64,7 @@ export declare class PgMemoryEngineBackend implements MemoryBackend {
     getByIds(ids: readonly string[]): Promise<MemoryEntry[]>;
     search(query: string, scopes: readonly string[], opts?: {
         limit?: number;
+        exposureBands?: boolean;
     }): Promise<ScoredMemoryEntry[]>;
     applyPatches(patches: readonly NotePatch[]): Promise<PatchReport>;
     private applyOne;