@sema-agent/server 7.43.0 → 7.44.0

package/dist/plugins/memory-origin-law.js

@@ -1,204 +1,32 @@
-/**
- * #307 件6(core 5.46.0 提货批,design/336 §2.3-2)—— **external-origin 标记不可变律**的 SQL 孪生实现。
- *
- * ## 这条法是什么、为什么落在本仓
- *
- * design/336 slice 1 给「已暴露会话」的普通记忆写打上引擎铸的 `frontmatter.origin` 标记(taint +
- * 成因闭集 + 铸造时刻),取代 design/178 那种「整条隔离」的全禁。标记的全部价值来自**不可洗白**:
- * 一旦某个 id 的**已提交**状态带了标记,之后**任何**写法(update / 裸 add / `guard:"absent"` add /
- * 同批 delete+re-add)都必须把它 DEEP-EQUAL 地带下去,否则拒绝。合法出口只有一个 —— **已提交的**
- * 墓碑(上一批真的 delete 掉了),那之后这个 id 开始一段未标记的新生命。
- *
- * core 5.46.0 把这条法写进了**记忆后端契约试剂盒**
- * (`dist/core/memory-engine/memory-backend-contract.js`,新增一条必跑条目),而该契约**压在本仓身上**:
- * core 只养 File backend,Pg / TiDB 两方言归 server。提货当天真双库实跑的红读数(A-002.21 教训的
- * 直接兑现,不是自我声明「本批无 SQL 面」):
- *   `[engine=tidb] contract case "design/336: origin marker round-trips; …":
- *    an origin-stripping update must not apply — 1 !== 0`
- * ⇒ 两只 SQL 孪生此前**没有**这条法:一条被标记为外部来源的记忆条目,可以被后续一次普通 update
- * 悄悄抹掉标记(洗白),而 File backend 会拒。这是安全轴上的真缺口,不是「新契约还没接」。
- *
- * ## 为什么是一个共享模块而不是两处各写一遍
- *
- * 本仓的成文教训(`key-resolver.ts` 顶注「链只有一条,重复实现就会长出半条链的偏差」;
- * `memory-key-guards.ts` 同族先例):两支方言各写一份判据,迟早在某一支上漏掉一个 op 拼写 ——
- * 而漏掉的那一支**没有任何报错面**,表现只是「这台机器上的标记可以被洗掉」。判据函数与批次基线
- * 记录器都在这里,两支后端只负责在自己的 I/O 点上调用。
- *
- * ## 判据的两半(缺一不可)
- *
- * ① **判据本身**({@link originWhitewashRefusal}):`committedOriginOf` / `originEquals` 都用 core 的
- *    导出实现,**不重写** —— 它们要处理 `frontmatter.origin` 与「保留在 `extra` 里的 origin 形字节块」
- *    两种承载形(legacy / 外来),自己写一份近似的等于给洗白留一条后门。
- * ② **批次基线**({@link rememberBatchOrigin}):两支 SQL 后端逐条 patch 直打真库(没有 File backend
- *    那种「先规划整批再落盘」的阶段),所以同批 `delete` 之后再 `add` 时,库里已经没有那一行了 ——
- *    只看当下的库会把它误判成合法新生命。基线 map 按**本批第一次触碰**记下该 id 的已提交 origin,
- *    之后同批的任何 op 都按那一份判。⇒「同批 delete+re-add 拒 / 已提交墓碑后 add 放」这条分界
- *    (core 契约逐字要求的那条)才成立。
- */
 import { ambiguousOriginRepresentation, committedDistilledOf, committedOriginOf, distilledEquals, originEquals } from "@sema-agent/core";
-/**
- * #319 增量(sema-comms [4768] 勘误 + core 仓 `1a5ebaa1`,conformance 30→31)—— **歧义 origin 表示**
- * 的拒绝门,与不可变律同批、同一个写路径上。
- *
- * ## 病
- *
- * 同一条目**同时**携带 typed `frontmatter.origin` 与一个**冲突的** origin 形 `extra` 块(或多个彼此
- * 冲突的 extra 块)时:不可变律的比较器走 `committedOriginOf`,而它在 typed 在场时优先读 typed ——
- * 于是那枚 typed 满足「标记原样带下去」,冲突的块却照样进了存储。任何一次**重解析**(File 的投影
- * 往返 / sync 对拍 / bundle 校验)都可能答出**另一枚**标记 ⇒ 成员改写的载具。不可变律本身没漏,
- * 漏的是「根本不该收下这种表示」这一步。
- *
- * ## 钥匙在 DISAGREEMENT,不在载体数
- *
- * 载体彼此**一致**的多载形(typed 旁边一个逐成员相等的 extra 形)是合法的 legacy 承载,必须照收 ——
- * 那正是序列化闭合(同一条记录在 File 投影里往返一圈就长这样)。「见到 extra 就拒」会把正常的
- * legacy 条目全部打死。
- *
- * ## 判据禁手抄
- *
- * 谓词一律用 core 导出的 {@link ambiguousOriginRepresentation}:它要解 `extra` 里的 origin 形块
- * (跨块字段组合、解析期块重排都算歧义),自己写一份近似的等于给洗白开后门 —— 这条在 #307 就写死过。
- * core 5.47.0 起该谓词进公开导出面([4698] 请托兑现),本仓的「撤除条件钉」也因此在 5.47 提货当天
- * 准时翻红,本批就是那条钉指定的兑现动作。
- *
- * ## 文案与 File 逐字同
- *
- * 拒绝文案照抄 core `file-backend.ts` 的 `planOne`(亲读 `1a5ebaa1` 前后两版确认未变),因为
- * 契约按 `/representation conflict|malformed patch refused/` 匹配,而**跨后端同一输入必须同一答复**
- * —— 消费方按 reason 分类处置,两支方言各写各的文案就等于让同一件事在不同部署上分叉。
- *
- * ## 判位
- *
- * 与 File 同precedence:**表示合法性先于状态比较** —— 排在 id/键形守卫之后、add/update 分支
- * (guard 算术、跨 scope 拒、白洗判据、rev CAS)之前,且在**任何 I/O 之前**(零写拒)。
- */
 export function ambiguousOriginRefusal(fm) {
     if (!ambiguousOriginRepresentation(fm))
         return undefined;
     return "external-origin marker representation conflict: the entry carries conflicting or duplicated origin representations (malformed patch refused)";
 }
-/**
- * #319(core 5.47/5.48 契约冻结面,design/336 §5.2)—— **头面 exposure 事实**的同一份归一化。
- *
- * 契约逐字:`listHeaders` 与 `search` 两个头面都要携带 `exposure`,且**同一条归一化**
- * (`committedOriginOf`:typed `frontmatter.origin` 与 legacy 的 `extra` origin 形字节块两种承载,
- * 一次判、两面同答)。这是**数据事实**不是模式:后端恒报库里存着什么,读侧怎么处置(不透明句柄/
- * 横幅/两带序)归引擎层的 provenance 模式。缺席 ⇔ 没标记(不等于「证明干净」)。
- *
- * 为什么与不可变律同住一个模块:两者读的是**同一个** committed origin。判据(白洗拒)与事实
- * (exposure 携带)分家写,迟早在某一支方言上一边认得 extra 形、另一边只认 typed 形 —— 那时
- * 「洗不掉的标记」在检索面**看不见**,而两支后端谁都不会报错。
- */
 export function exposureCarriage(fm) {
     return committedOriginOf(fm) !== undefined ? { exposure: "external" } : {};
 }
-/**
- * 两带序的带号:未标记 = 0(**先**),已标记 = 1。
- *
- * 契约的载荷理由(core r1-9,逐字转述):两带序必须落在**截断之前** —— 一页 limit 全是带标条目时,
- * 排在 limit+1 位的干净条目会被饿死,而工具层**无法**从一页已截断的结果里把它捞回来。
- * `exposureBands` 缺席/false ⇒ 单带序,与 pre-336 逐字节同(`provenance:"off"` 的读面)。
- */
 export function exposureBandOf(header) {
     return header.exposure === "external" ? 1 : 0;
 }
-/**
- * `committedOriginOf` 的**下推形**:同一条判据的 SQL 写法,给「排序与截断都发生在 SQL 里」的那一档
- * (Pg 的原生 pgvector 档)用。
- *
- * ## 为什么非要下推(不能只在进程里排)
- *
- * 原生档 `ORDER BY … LIMIT n` 是**库里**排完就截断的:进程拿到的已经是一页 n 行,被截掉的那条干净
- * 条目在页里根本不存在,重排救不回来 —— 而「带序必须先于截断」正是这条契约的载荷所在。所以带号
- * 必须进 ORDER BY,也就必须有一份 SQL 侧的判据。
- *
- * ## 为什么写成逐元素的行首正则(codex 对抗复审 R1-[high] 的直接产物)
- *
- * 初版图省事写的是 `frontmatter->>'extra' LIKE '%origin:%'`,自称「只多认不漏认」。**错了**,两个方向
- * 都不成立:`['origin :']`(冒号前有空格)是 core 认的合法承载形,而 LIKE 漏掉它 —— 一条**带标记**的
- * 条目被排进干净带,占掉的正是干净条目的位置;反过来 `['prefix origin: suffix']` 被 LIKE 误认,一条
- * **干净**条目沉进后带、可能被截断饿死。两个方向的结局是同一个:干净条目被饿死,而这正是本条款要拒的。
- *
- * 现形逐元素跑 core 那条行首正则(`/^\s*origin\s*:/`)。真库实测 10 种拼写(裸 / 冒号前空格 / 前导
- * 空格 / 制表 / 全角空格 U+3000 / 行中出现 / originx: / 非 origin 行 …)与 JS 判据**逐条同答**。
- *
- * ## 这份「第二实现」的同步义务
- *
- * 两份实现同表一个语义 = 本仓明令的危险形,所以它带**机器对表**:
- * `test/memory-engine-db-integration.test.ts` 的钉6 拿同一组拼写在**真 PG** 上让本谓词与
- * `committedOriginOf` 逐条对答,不一致当场红(离线格做不了这件事:被测的正是 PG 自己的正则引擎)。
- * core 改那条正则时,红的是对表格 —— 不是某台部署上悄悄跑偏的排序。
- *
- * ## 字符类为什么是**穷举码点**而不是 `[[:space:]]`(codex 第二轮 R2-[medium],采纳)
- *
- * PG 的 POSIX 字符类**跟着数据库 LC_CTYPE 走**:同一条 SQL 在 C locale 与某个 UTF-8 locale 下认的
- * 空白集合可以不一样(例如 U+0085 NEL —— JS 的 `\s` **不**含它)。而本谓词的正确性判据是「与 JS 的
- * `\s` 逐字同」,一条依赖部署 locale 的判据等于把同一条记忆在两台机器上排进不同的带 —— 而带号错了
- * 就会在 LIMIT 那一刀上不可恢复地截掉本该入页的干净条目。所以这里**不用**任何 locale 敏感构造,把
- * ECMAScript `\s` 的码点逐个写死(PG 的 ARE 支持 `\uXXXX` 转义,已在真库上验过);对表格里同时钉了
- * U+0085 这条**反例**(JS 不认 ⇒ SQL 也必须不认),locale 一旦重新混进来它当场红。
- */
-/** ⚠️ 本常量**只准写 ASCII**:那些 unicode 空白必须以 `\\uXXXX` 的**字面反斜杠形**交给 PG 的 ARE
- *  自己解析(已在真库上验过)。把真字符敲进源码会同时踩两条线 —— 源码卫生门(不可见字节)与
- *  U+2028/U+2029(它们在 JS 源码里就是换行，会把这一行劈开)。 */
 const SQL_JS_WHITESPACE_CLASS = "[\\u0009\\u000a\\u000b\\u000c\\u000d\\u0020\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000\\ufeff]";
-/** core `/^\s*origin\s*:/`(`extraOriginCarriers` 的开块判据)的 SQL 孪生。 */
 export const ORIGIN_CARRIER_LINE_SQL_REGEX = `^${SQL_JS_WHITESPACE_CLASS}*origin${SQL_JS_WHITESPACE_CLASS}*:`;
-/**
- * 「这一行带 committed origin 标记」的 SQL 布尔式(两种承载形同判,与 {@link exposureCarriage} 同源)。
- * `column` = 该表 frontmatter 列的表达式(调用方自己保证它是列名/限定名,**不接受外来串**)。
- */
 export function originMarkedSqlPredicate(column) {
     return (`(${column}->'origin' IS NOT NULL OR (jsonb_typeof(${column}->'extra') = 'array' AND EXISTS (` +
         `SELECT 1 FROM jsonb_array_elements_text(${column}->'extra') AS origin_line(line) ` +
         `WHERE origin_line.line ~ '${ORIGIN_CARRIER_LINE_SQL_REGEX}')))`);
 }
-/** 新建一只批次基线(每次 `applyPatches` 一只;跨批次**不得**复用 —— 已提交的墓碑正是靠「换批清零」放行)。 */
 export function createBatchCommittedBaseline() {
     return new Map();
 }
-/**
- * 记下(或取回)某 id 在**本批开始时**的已提交 frontmatter。
- *
- * `committedFm` = 这一次 I/O 真的从库里读到的已提交 frontmatter(没有行就传 `undefined`)。
- * **首次触碰写入,之后只读** —— 同批里后面的 op 看到的必须还是批开始那一份,否则本批自己的写会把
- * 基线推走(delete 之后 re-add 就又变成「库里没有 ⇒ 未标记」)。
- */
 export function rememberBatchCommitted(baseline, id, committedFm) {
     if (baseline.has(id))
         return baseline.get(id);
     baseline.set(id, committedFm);
     return committedFm;
 }
-/**
- * 不可变律的判据。返回 `undefined` = 放行;返回字符串 = 该字符串就是 `PatchReport.conflicts[].reason`。
- *
- * 文案与 core File backend 的两处**逐字同形**(`external-origin marker whitewash refused: the
- * {add,update} strips or rewrites the origin marker of a marked entry (malformed patch refused)`):
- * 契约试剂盒按 `/malformed patch refused/` 匹配,而跨后端同一输入必须给同一个答复 —— 消费方(引擎的
- * harvest 腿、sync 对拍)按 reason 分类处置,两支方言各写各的文案就等于让同一件事在不同部署上分叉。
- *
- * 未标记的已提交条目(`committed === undefined`)一律放行:本法只约束**已经**带标记的那些 id,
- * 「给未标记条目加标记」是引擎写路径自己的事(server 不铸 origin,见台账的 skip 行)。
- */
-/** `NotePatch.op` 的运行期闭集(与 core 的联合逐字同)。 */
 const PATCH_OPS = new Set(["add", "update", "delete"]);
-/**
- * 未知 op 拼写的**前置**拒绝(codex R1-[high],验真后采纳;**既有**缺口,不是本批引入)。
- *
- * 病:两支 SQL 后端的 `applyOne` 形状是「`if (op === "add") {…}` → 落到 update/delete 段」,而段内
- * 的两道白洗守卫(repo_file provenance / 本模块的 origin 不可变律)都写成 `if (patch.op === "update")`。
- * ⇒ 一个**词表外**的 op(`"upsert"` / 打错的字 / 将来 core 加的新词)会:跳过两道守卫 → 走到 update
- * 的 SQL → 把行改掉 → 在 `report.applied` 里报成一次 update。TypeScript 的联合型是**编译期**的,
- * 拦不住任何运行期调用方(sync 腿、嵌入方自建的调用点、future core)。
- *
- * 今日可达性(如实):本仓唯一的调用点 `src/memory-sync.ts` 自己铸 op(基线有 ⇒ update、无 ⇒ add),
- * 词表外的值到不了。所以这条是**加固**而不是在修一次已发生的事故 —— 但它落在安全轴(白洗守卫的
- * 有效性完全依赖「op 只有三种」这个未被检查的前提),按 CLAUDE.md #157「闭集 + 不可避免的运行期
- * miss 臂必须说出来」补一道显式拒绝:未知 op **零写**,报 `malformed patch refused`(与本仓既有的
- * id-mismatch 拒绝同族文案,消费方按同一条正则分类)。
- */
 export function unknownPatchOpRefusal(op) {
     if (PATCH_OPS.has(op))
         return undefined;
@@ -212,15 +40,6 @@ export function originWhitewashRefusal(op, committedFm, next) {
         return undefined;
     return `external-origin marker whitewash refused: the ${op} strips or rewrites the origin marker of a marked entry (malformed patch refused)`;
 }
-/**
- * #337(core 5.55.0 conformance c36/c37,design/339)—— **distilled 血统不可变律**的判据,与 origin
- * 律同族同基线同判位:一旦某 id 的已提交状态带 `frontmatter.distilled` 块(consolidation 蒸馏产物的
- * 血统:planId/at/carrierRev/inputs),任何 update / 裸 add / guard add / 同批 delete+re-add 都必须把
- * 它 DEEP-EQUAL 地带下去,否则拒 —— 合法出口只有已提交的墓碑(c36 逐字)。判序:**先于 rev CAS**
- * (c37:骑着 stale baseRev 的 strip 也必须答 malformed refusal,不是 rev mismatch)。
- * 判据用 core 导出的 {@link committedDistilledOf} / {@link distilledEquals},不手抄(F1b);文案与
- * core File backend 两处逐字同形,契约按 `/malformed patch refused/` 匹配。
- */
 export function distilledWhitewashRefusal(op, committedFm, next) {
     const committed = committedFm !== undefined ? committedDistilledOf(committedFm) : undefined;
     if (committed === undefined)
@@ -229,12 +48,6 @@ export function distilledWhitewashRefusal(op, committedFm, next) {
         return undefined;
     return `distilled lineage whitewash refused: the ${op} strips or rewrites the distilled block of a consolidation product (malformed patch refused)`;
 }
-/**
- * #337(conformance c38)—— **distilled 事实的头面携带**,与 {@link exposureCarriage} 同住同因:
- * `listHeaders` 与 `search` 两个头面都携带 `{ carrierRev, supersedes }` 投影(supersedes = inputs 中
- * `superseded === true` 的行,形状与 core File backend 的 header 投影逐字同);无块条目两面都不携带。
- * 蒸馏产物的「取代了哪些输入行」必须在检索面可见,否则被取代的旧行与蒸馏产物在读侧无从判序。
- */
 export function distilledCarriage(fm) {
     const d = fm.distilled;
     if (d === undefined)

package/dist/plugins/memory-resume-anchor-store.js

@@ -1,16 +1,6 @@
-/**
- * In-memory resume-at anchor map — the LOCAL (DB-less) twin of {@link TiDBResumeAnchorStore}/{@link PgResumeAnchorStore}
- * (E18 resume-at; clay seamless local↔cloud). The shell holds the live E2 `eventId` (core never persists it);
- * core's `TaskSpec.resumeAt` takes a persisted `SessionTreeEntry.id`. This store is the service-owned translation
- * ("a deployment that holds eventIds owns the eventId→entryId map", core types). resume-at works LOCALLY (it needs
- * only the session tree + this map, no cloud-only checkpoint), so this is PRESENT on the local backend (a singleton,
- * like MemoryRunStore) — not omitted like the cloud-only stores. Process-local + ephemeral (lost on restart, same
- * blast radius as MemoryRunStore; the file-backed follow-on persists it alongside run history).
- */
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryResumeAnchorStore {
     bySession = new Map();
-    /** Record/overwrite the anchor for one settled message boundary (idempotent upsert; parity with the SQL ON DUPLICATE/CONFLICT). */
     async put(sessionId, eventId, entryId, owner) {
         let m = this.bySession.get(sessionId);
         if (!m) {
@@ -19,15 +9,10 @@ export class MemoryResumeAnchorStore {
         }
         m.set(eventId, { entryId, owner });
     }
-    /** Resolve a shell-supplied eventId → the persisted SessionTreeEntry.id for TaskSpec.resumeAt; undefined = unknown
-     *  anchor (the route 4xx's before handing core a bad id). owner null-safe guard = the SQL `owner <=> ?` defense-in-depth. */
     async resolve(sessionId, eventId, owner) {
         const e = this.bySession.get(sessionId)?.get(eventId);
         return e && ownerEq(e.owner, owner) ? e.entryId : undefined;
     }
-    /** 2c session-sync: ALL anchors for a session (every eventId→entryId + its owner), UNFILTERED — a cross-backend
-     *  session EXPORT bundles the whole anchor map so the importer can re-key owner to the target principal (§9). Twin of
-     *  the SQL/file stores; kept on all three backends so the ResumeAnchorStore union shares a single contract. */
     async listBySession(sessionId) {
         const m = this.bySession.get(sessionId);
         if (!m)
@@ -37,8 +22,6 @@ export class MemoryResumeAnchorStore {
             out.push({ eventId, entryId: e.entryId, owner: e.owner });
         return out;
     }
-    /** E21 (§0.5 delete) — purge ALL anchors for a session, scoped by session_id ALONE (the route already proved session
-     *  ownership; a per-row owner guard would orphan rows stored under a divergent per-run principal). Idempotent (count). */
     async deleteBySession(sessionId) {
         const removed = this.bySession.get(sessionId)?.size ?? 0;
         this.bySession.delete(sessionId);

package/dist/plugins/memory-run-store.js

@@ -1,27 +1,10 @@
-/**
- * In-memory async run registry + replayable event log — the LOCAL (DB-less) twin of {@link TiDBRunStore}/
- * {@link PgRunStore} (clay 2026-06-25: the seamless local↔cloud switch — a locally-run HTTP service must serve the
- * SAME contract a cloud worker does, incl. `/v1/runs` async runs + the trace event log). Behaviourally identical to
- * the SQL twins (the shared `storeBehaviorSuite` keeps them in lock-step), but process-local + ephemeral: a restart
- * loses run history (file-backed durability is the immediate follow-on; the conversation HISTORY + checkpoints DO
- * persist via core's FileStorageBackend). Single-process, so the cross-replica/durable reapers degrade — see below.
- *
- * Mirrors the SQL semantics exactly: the `task_active` single-active-run claim (a Map keyed by sessionId), the
- * NON-terminal suspend/needs_review parks that KEEP the claim, the markResuming CAS that resets cancel/preempt, the
- * owner null-safe guard on the flag/heartbeat paths (`<=>` → JS `(a??null)===(b??null)`), and the keyset list order.
- */
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-/** Null-safe owner equality — the JS twin of the SQL `owner <=> ?` guard (a legacy null-owner run matches owner=null). */
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 export class MemoryRunStore {
     runs = new Map();
-    /** sessionId → taskId — the single-active-run claim (the `task_active` table). */
     active = new Map();
-    /** taskId → events (kept seq-sorted on read). */
     events = new Map();
-    /** [868] the checkpoint-table stand-in (see {@link RunStoreCheckpointProbe}); absent ⇒ reapers NO-OP. */
     checkpointProbe;
-    /** [868] wire the checkpoint probe (backend assembly, where checkpoint + run store are built together). */
     setCheckpointProbe(probe) {
         this.checkpointProbe = probe;
     }
@@ -42,7 +25,6 @@ export class MemoryRunStore {
             updatedAt: r.updatedAt.toISOString(),
         };
     }
-    /** Create a run iff the session has no active run (the task_active unique-key claim). */
     async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
         const claimed = this.active.get(sessionId);
         if (claimed !== undefined)
@@ -97,12 +79,8 @@ export class MemoryRunStore {
     }
     async appendEvent(taskId, seq, type, data) {
         const list = this.events.get(taskId) ?? [];
-        // Mirror the (task_id, seq) PK: a duplicate seq is a caller bug (callers use ++seq); ignore a re-append of the
-        // same seq rather than corrupt the log (the SQL twin would throw ER_DUP_ENTRY — callers never hit it).
         if (list.some((e) => e.seq === seq))
             return;
-        // Deep-clone `data` on WRITE so the stored event is isolated from later caller mutation — the SQL twin
-        // JSON.stringify's it into the column, giving the same write-isolation (parity oracle).
         list.push({ seq, type, data: data == null ? null : structuredClone(data), ts: new Date().toISOString() });
         this.events.set(taskId, list);
     }
@@ -116,19 +94,14 @@ export class MemoryRunStore {
     }
     async getEvents(taskId, afterSeq) {
         const list = this.events.get(taskId) ?? [];
-        // Deep-clone `data` on READ so each call yields a fresh, mutation-isolated object — the SQL twin re-parses the
-        // JSON column per read (parity oracle); a shallow `{...e}` would alias `data` into the stored Map (review footgun).
         return list
             .filter((e) => e.seq > afterSeq)
             .sort((a, b) => a.seq - b.seq)
             .map((e) => ({ ...e, data: e.data == null ? null : structuredClone(e.data) }));
     }
-    /** [888] FIRST terminal writer wins(SQL 孪生同款正向 CAS on running/suspended/needs_review,
-     *  [1.207 codex M1] 负向形漏 blocked/timeout);claim 释放保持无条件(幂等)。 */
     async setTerminal(taskId, status, result, error) {
         const r = this.runs.get(taskId);
         if (!r) {
-            // [2255]③ file 孪生同判据(parity oracle):行缺席时终局动词仍放锁(反查 active)。
             for (const [sessionId, tid] of this.active)
                 if (tid === taskId) {
                     this.active.delete(sessionId);
@@ -143,11 +116,9 @@ export class MemoryRunStore {
             r.errorCode = result?.errorCode ?? null;
             r.updatedAt = new Date();
         }
-        // Release the single-active-run claim (DELETE FROM task_active WHERE task_id = ?).
         if (this.active.get(r.sessionId) === taskId)
             this.active.delete(r.sessionId);
     }
-    /** Durable F4: park NON-terminal `suspended`, KEEP the task_active claim. CAS on running/suspended (reaper-revert guard). */
     async setSuspended(taskId) {
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "suspended")) {
@@ -155,7 +126,6 @@ export class MemoryRunStore {
             r.updatedAt = new Date();
         }
     }
-    /** design/80 D-B: park NON-terminal `needs_review`, KEEP the claim. CAS on running/needs_review. */
     async setNeedsReview(taskId) {
         const r = this.runs.get(taskId);
         if (r && (r.status === "running" || r.status === "needs_review")) {
@@ -163,7 +133,6 @@ export class MemoryRunStore {
             r.updatedAt = new Date();
         }
     }
-    /** Durable F4 resume: flip suspended/needs_review → running (CAS) + reset cancel/preempt flags. */
     async markResuming(taskId) {
         const r = this.runs.get(taskId);
         if (!r || (r.status !== "suspended" && r.status !== "needs_review"))
@@ -181,33 +150,27 @@ export class MemoryRunStore {
         const r = this.runs.get(taskId);
         return r ? this.toRecord(r) : undefined;
     }
-    /** Runs newest-first, keyset on (createdAt, taskId) DESC; optional exact-match filters (owner is exact, like the SQL). */
     async listRuns(opts) {
-        // 夜测 N1(2026-07-09,LOW):a non-date cursor.createdAt made the four backends diverge (PG threw a raw
-        // DB error; the other three returned an empty page). HTTP's decodeCursor pre-validates, so this is
-        // defence-in-depth for direct store callers — normalize ALL backends to the empty page.
         if (opts.cursor && Number.isNaN(Date.parse(opts.cursor.createdAt)))
             return [];
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.createdAt) : undefined;
         const rows = [...this.runs.values()]
             .filter((r) => (opts.status ? r.status === opts.status : true))
-            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true)) // "" is a valid exact jobId, not "no filter" (B10)
-            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true)) // "" is a valid exact source, not "no filter" (B10)
-            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true)) // exact (SQL `owner = ?`): "" is a valid exact owner, not "no filter" (B10)
+            .filter((r) => (opts.jobId !== undefined ? r.jobId === opts.jobId : true))
+            .filter((r) => (opts.source !== undefined ? r.source === opts.source : true))
+            .filter((r) => (opts.owner !== undefined ? r.owner === opts.owner : true))
             .filter((r) => {
             if (cursorAt === undefined)
                 return true;
             const t = r.createdAt.getTime();
-            return t < cursorAt || (t === cursorAt && r.taskId < opts.cursor.taskId); // keyset: strictly older, ties by taskId
+            return t < cursorAt || (t === cursorAt && r.taskId < opts.cursor.taskId);
         })
             .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
         return rows.slice(0, opts.limit).map((r) => this.toRecord(r));
     }
-    /** DISTINCT sessions newest-first by last activity (the CC /resume picker): latest run's preview/status + first/last/count. */
     async listSessions(opts) {
         const bySession = new Map();
         for (const r of this.runs.values()) {
-            // exact owner filter (SQL `owner = ?`); "" is a valid exact owner (B10). `includeUnowned` = [4198] 窄臂第三条件(SQL `OR owner IS NULL`)。
             if (opts.owner !== undefined && r.owner !== opts.owner && !(opts.includeUnowned === true && r.owner === null))
                 continue;
             const arr = bySession.get(r.sessionId) ?? [];
@@ -215,12 +178,11 @@ export class MemoryRunStore {
             bySession.set(r.sessionId, arr);
         }
         const cursorAt = opts.cursor ? Date.parse(opts.cursor.lastActivityAt) : undefined;
-        const qlc = opts.q?.toLowerCase(); // ?q= search: any-run preview match (the in-memory twin of the SQL EXISTS)
+        const qlc = opts.q?.toLowerCase();
         const summaries = [];
         for (const [sessionId, arr] of bySession) {
             if (qlc && !arr.some((r) => r.objectivePreview?.toLowerCase().includes(qlc)))
                 continue;
-            // rn=1 = latest run (createdAt DESC, taskId DESC) → preview/status/owner.
             const sorted = [...arr].sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime() || (a.taskId < b.taskId ? 1 : a.taskId > b.taskId ? -1 : 0));
             const latest = sorted[0];
             const times = arr.map((r) => r.createdAt.getTime());
@@ -234,8 +196,8 @@ export class MemoryRunStore {
                 runCount: arr.length,
                 objectivePreview: latest.objectivePreview,
                 lastStatus: latest.status,
-                lastRunId: latest.taskId, // K-5c: latest run id = the live-tail re-attach anchor
-                title: null, // honest degrade (no session_meta on the memory twin)
+                lastRunId: latest.taskId,
+                title: null,
             });
         }
         return summaries
@@ -248,19 +210,8 @@ export class MemoryRunStore {
             .sort((a, b) => Date.parse(b.lastActivityAt) - Date.parse(a.lastActivityAt) || (a.sessionId < b.sessionId ? 1 : a.sessionId > b.sessionId ? -1 : 0))
             .slice(0, opts.limit);
     }
-    /**
-     * E21 (§0.5 delete) — purge the runs ledger for one session, scoped by `session_id` ALONE (per-row owner is the
-     * submitting principal and diverges from the session owner — full 判据 see the SQL twin's head-note, F-A);
-     * aborts (returns {active}) if a run is live.
-     *
-     * `expectedSessionOwner` 是 SQL 双生的**化身围栏**入参(事务内复核 `session_meta.owner`,防「A 验权后 A' 删完、
-     * 别人用同一 uuid 重新登记」那一形)。本孪生**执行不了**它:local 车道的会话表在另一只店里,这只账本没有
-     * session_meta 可读 —— 参数只作契约对齐(签名不齐会让 RunStore 联合类型的调用点直接不可调)。local 的替代
-     * 围栏是两条:①协调器在本调用**紧前**复读一次 canonical owner(不齐即整条中止);②数据根的独占 BootLock
-     * 保证一个数据根恒一个进程,交错只可能发生在同进程的 await 缝里。这条不对称是**明写**的,不是遗漏。
-     */
     async deleteBySession(sessionId, expectedSessionOwner) {
-        void expectedSessionOwner; // 见上:本孪生无 session_meta 可复核,围栏在协调器那一侧
+        void expectedSessionOwner;
         const claimed = this.active.get(sessionId);
         if (claimed !== undefined)
             return { active: claimed };
@@ -274,7 +225,6 @@ export class MemoryRunStore {
         }
         return { removed };
     }
-    /** 用量扫窗——in-memory 腿:遍历窗内行,投影同 usage-analytics 纯函数(SQL 孪生 parity)。 */
     async usageScan(fromMs, toMs, opts) {
         const limit = Math.min(opts?.limit ?? USAGE_SCAN_LIMIT, USAGE_SCAN_LIMIT);
         const all = [];
@@ -295,14 +245,13 @@ export class MemoryRunStore {
         for (const r of this.runs.values()) {
             if (r.createdAt.getTime() < sinceMs)
                 continue;
-            const key = JSON.stringify([r.source, r.status]); // collision-proof + keeps NULL distinct from "" (SQL GROUP BY parity)
+            const key = JSON.stringify([r.source, r.status]);
             const cur = counts.get(key) ?? { source: r.source, status: r.status, count: 0 };
             cur.count += 1;
             counts.set(key, cur);
         }
         return [...counts.values()];
     }
-    /** Fail stale `running` rows (crashed-run backstop) + release task_active for any now-terminal row. */
     async reapStale(olderThanMs) {
         const cutoff = Date.now() - olderThanMs;
         let reaped = 0;
@@ -314,20 +263,15 @@ export class MemoryRunStore {
                 reaped += 1;
             }
         }
-        // Release the claim for TERMINAL rows only (suspended/needs_review intentionally keep it).
         this.releaseTerminalClaims();
         return reaped;
     }
-    /** [868] shared tail of both suspended-run reapers: flip one parked row → failed('approval.expired'), the
-     *  in-memory twin of the SQL UPDATE (`error`/`error_code` set directly — no result blob to derive from). */
     failExpiredPark(r) {
         r.status = "failed";
         r.error = "approval expired before decision";
         r.errorCode = "approval.expired";
         r.updatedAt = new Date();
     }
-    /** Release the claim for TERMINAL rows only — suspended/needs_review keep it (the `DELETE ta … WHERE tr.status
-     *  NOT IN ('running','suspended','needs_review')` twin, shared by reapStale + the [868] suspended reapers). */
     releaseTerminalClaims() {
         for (const [sessionId, taskId] of [...this.active]) {
             const r = this.runs.get(taskId);
@@ -335,22 +279,12 @@ export class MemoryRunStore {
                 this.active.delete(sessionId);
         }
     }
-    /**
-     * [868] Durable F4 expiry — the local twin of TiDBRunStore.reapSuspended, driven by the injected checkpoint
-     * probe instead of a SQL JOIN (formerly a NO-OP, which was one of the five closed doors in the "suspended run
-     * locks the session forever" incident). Semantics verbatim from the SQL twin: suspended ∧ updatedAt < cutoff
-     * ∧ NOT probe.hasPending(session) → failed 'approval expired before decision' / error_code 'approval.expired'
-     * + release the task_active claim. The NOT-pending clause is the design/80 D-D adversarial-blocker guard
-     * (SQL 孪生现在的真身:`run-store-sql.ts` 的 `reapSuspended`;`tidb-run-store.ts` 该壳文件已删(5.0.0)): a row whose checkpoint is STILL pending belongs to the checkpoint-state
-     * sweeps (SLA deny-sweep / failSuspendedWithExpiredCheckpoint) — time-reaping it here would orphan a model
-     * leg on a now-unlocked session. Probe absent ⇒ honest NO-OP (never kill a park without the guard).
-     */
     async reapSuspended(olderThanMs) {
         const probe = this.checkpointProbe;
         if (!probe) {
             this.releaseTerminalClaims();
             return 0;
-        } // [2255]③ claim 不变式维护不跟 probe 走
+        }
         const cutoff = Date.now() - olderThanMs;
         let reaped = 0;
         for (const r of this.runs.values()) {
@@ -358,10 +292,7 @@ export class MemoryRunStore {
                 continue;
             const snap = r.updatedAt.getTime();
             if (await probe.hasPending(r.sessionId))
-                continue; // D-D guard: a still-pending checkpoint owns this row
-            // codex H2:probe 的 await 让出事件循环——markResuming(approve 恢复)/cancel/新一轮 park 可能已改行。
-            // 复核与改写之间无 await(Node 单线程 ⇒ 原子);状态或 updatedAt 变了就放手,绝不覆盖一条已被别腿
-            // 认领的行(SQL 孪生靠单条条件 UPDATE 天然原子,这里的 snap 复核就是它的本地等价)。
+                continue;
             if (r.status !== "suspended" || r.updatedAt.getTime() !== snap)
                 continue;
             this.failExpiredPark(r);
@@ -370,19 +301,12 @@ export class MemoryRunStore {
         this.releaseTerminalClaims();
         return reaped;
     }
-    /**
-     * [868] design/80 §3 inv#3 crash-safe backstop — the local twin of TiDBRunStore.failSuspendedWithExpiredCheckpoint
-     * (checkpoint-STATE-driven, not time-driven; runs UNCONDITIONALLY every reaper tick, no APPROVAL_TIMEOUT_SEC gate).
-     * Semantics verbatim from the SQL twin: (suspended ∨ needs_review) ∧ probe.hasExpired(session) ∧ NOT
-     * probe.hasPending(session) → same fail + claim release. The NOT-pending clause covers a re-suspended session
-     * that minted a NEW pending gate (wq64gmm5e: an abandoned needs_review park leaks exactly like a suspended one).
-     */
     async failSuspendedWithExpiredCheckpoint() {
         const probe = this.checkpointProbe;
         if (!probe) {
             this.releaseTerminalClaims();
             return 0;
-        } // [2255]③ claim 不变式维护不跟 probe 走
+        }
         let reaped = 0;
         for (const r of this.runs.values()) {
             if (r.status !== "suspended" && r.status !== "needs_review")
@@ -393,7 +317,6 @@ export class MemoryRunStore {
                 continue;
             if (await probe.hasPending(r.sessionId))
                 continue;
-            // codex H2 同款 snap 复核(两个 await 窗都盖住):行被别腿改过就放手。
             if (r.status !== parkedAs || r.updatedAt.getTime() !== snap)
                 continue;
             this.failExpiredPark(r);

package/dist/plugins/memory-session-policy-store.js

@@ -1,17 +1,3 @@
-/**
- * In-memory SessionPolicyStore + the service's `deleteBySession` extension (E21 purge / 2c overwrite-dst wipe).
- *
- * WHY THIS EXISTS (and not core's `InMemorySessionPolicyStore`): core's in-memory/file policy stores implement only
- * the core interface (getRules/putRules/listBySession) — they have NO deletion seam, so neither the E21 session purge
- * nor the 2c `overwrite-dst` subsystem wipe can remove policy rows on a backend that uses them (the SQL twins carry
- * `deleteBySession` as a service extension; see session-policy-store-sql.ts). This store is the delete-capable
- * in-memory twin. The seam itself is also requested upstream (core: optional `deleteBySession?` on the interface +
- * the File/InMemory impls) — if core lands it, this class can retire in favor of core's.
- *
- * BYTE-MATCH DISCIPLINE: getRules/putRules/listBySession replicate core's `InMemorySessionPolicyStore` semantics
- * exactly (same key shape, same CAS `conflict` on expectedRev mismatch, same tighten-only `loosen_forbidden` gate via
- * core's exported `normalizeRules`/`loosenReasons`/`stripRev`, same rev start/bump). Any divergence is a bug here.
- */
 import { normalizeRules, loosenReasons, stripRev, SessionPolicyError, } from "@sema-agent/core";
 export class MemorySessionPolicyStore {
     map = new Map();
@@ -48,9 +34,6 @@ export class MemorySessionPolicyStore {
         }
         return out;
     }
-    /** Purge ALL policy rows for a session, across every principal. Scoped by session_id alone — the caller
-     *  (E21 route / importSession overwrite-dst) already proved ownership. Shape = core 1.423's optional
-     *  `SessionPolicyStore.deleteBySession?` seam (`Promise<void>` — the count was incidental; nothing consumed it). */
     async deleteBySession(sessionId) {
         for (const k of [...this.map.keys()]) {
             const [sid] = JSON.parse(k);