@sema-agent/server 7.51.0 → 7.52.0

package/dist/boot/execution-env.d.ts

@@ -15,7 +15,7 @@ import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
  * ── 为什么围栏不是可选的(codex R1-F1,判真)────────────────────────────────────────────────────
  * 这两张表只按 `sessionId` 键控。在 host lane 上那是安全的:那条车道的闸带 `requirePrincipal !== true`,
  * 整台机器就一个用户。**device lane 把这个前提撤掉了** —— 它的闸(`deviceCwdHonored`)刻意不要求单用户
- * (员工各连各的设备)。于是一条真实的越权路径出现了:
+ * (员工各连各的设备)。于是一条真实的超范围路径出现了:
  *   ① sessionId 由**调用方自选**,而且 `DELETE /v1/sessions/:id` 之后可以被**别人** `register` 重新登记
  *      (`boot/session-faces.ts` 的化身围栏注逐字写着这件事);
  *   ② 会话删除的级联删的是库里的行,**够不着这两张进程内的表**;

package/dist/boot/governance-seams.d.ts

@@ -75,7 +75,7 @@ export interface GovernanceSeamsCtx {
      * #270 车1 —— **本 build 是否真的接了留存执行器**(sweep lane;车2 的 `startRetentionLane()`)。
      * 缺席 = `false`。
      *
-     * 🔴 为什么这一位必须存在(codex 对抗复审 R2-[critical],验真后修):core 的
+     * 🔴 为什么这一位必须存在(codex 交叉复审 R2-[critical],验真后修):core 的
      * `assertRetentionCapability` 只读**店的声明位**。#270 车1 让三只 SQL 店如实声明了 `"managed"`
      * (它们的行确实由托管留存删),于是那道门从此**放行** locked policy —— 可执行器还在车2 手里。
      * 两者之间的窗口如果什么都不做,后果正是本仓最忌的那种:部署自述「策略已受管」、审计与能力面
@@ -96,7 +96,7 @@ export declare function assertLockAssemblable(input: {
     deploymentMcpConfigured: boolean;
 }): void;
 /**
- * 治理面的**装配相容性**总判据(codex 对抗复审 R2-F2 起扩面)——锁与合规档位在这条轴上是同一件事:
+ * 治理面的**装配相容性**总判据(codex 交叉复审 R2-F2 起扩面)——锁与合规档位在这条轴上是同一件事:
  * 两者都可能把「本部署自己的装配」判成 core 门口的违规,而那不是「配得更严」,是**这台从此每条腿必失败**。
  *
  * 合规半场的判据来自亲核 core 的 prepare 门(`prepare-task` 的 compliance 段):被否决的能力若**已在

package/dist/boot/leader.d.ts

@@ -40,7 +40,7 @@ export interface LeaderCtx {
  */
 export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider: string | undefined, hasS3: boolean): string[] | null;
 /**
- * #193 车4 件2 的**能力面**门(codex 对抗复审 R1-high①,验真后修)。
+ * #193 车4 件2 的**能力面**门(codex 交叉复审 R1-high①,验真后修)。
  *
  * config 层的门②判的是 `DB_BACKEND` 的字面值 —— 那句话回答的是「运维要没要 durable」。它回答不了
  * 「这次启动**真的拿到**了 durable 吗」:`openStoreBackendWithFallback` 在 `SESSION_BACKEND=auto`

package/dist/boot/memory-boundary.d.ts

@@ -2,8 +2,8 @@
  * #214 记忆边界不变式(板 [3492]② 立案,[3521] 裁1 与 core #151 同窗)—— 启动期把「结构性写不进的记忆
  * 部署形」说出来。
  *
- * 病根(test 仓 [3479] 实测,[3490]② 定位):core 的记忆工具面是 `memory_search`/`memory_get` 两只**只读**
- * 工具;**写**记忆没有专用工具 —— 模型用 fs 工具往记忆根写文件,harvest 再从那里收编。于是整条链的成立
+ * 根本问题(test 仓 [3479] 实测,[3490]② 定位):core 的记忆工具面是 `memory_search`/`memory_get`/
+ * `memory_index`(#493 第五单起第三只,枚举面,仍只读)三只**只读**工具;**写**记忆没有专用工具 —— 模型用 fs 工具往记忆根写文件,harvest 再从那里收编。于是整条链的成立
  * 条件是「记忆根落在该次任务的 fs 授权边界之内」。server 把根交给 core(`RunnerDeps.memoryEngineDir`)
  * 之后,没有任何一处保证这一点,也没有任何一处说过「这台部署的记忆写面够不着」。默认根是
  * `~/.ai-agent`(或 `AGENT_DATA_DIR`),默认围栏是任务 cwd —— 两者天然不相交:用户说「记住 X」,模型照

package/dist/boot/memory-consolidation.d.ts

@@ -31,7 +31,7 @@ export interface ConsolidationDriverSeat {
  */
 export declare function resolveConsolidationDriverSeat(deps: MemoryConsolidationDriverDeps): ConsolidationDriverSeat;
 /**
- * **每 scope 单飞**(codex 对抗复审 [high],验真后修)—— 同一 scope 上在飞的那一轮被后来者**并入**,
+ * **每 scope 单飞**(codex 交叉复审 [high],验真后修)—— 同一 scope 上在飞的那一轮被后来者**并入**,
  * 而不是各起一轮。`create*`:返回带状态的活对象。
  *
  * ## 病(不是理论)
@@ -47,7 +47,7 @@ export declare function resolveConsolidationDriverSeat(deps: MemoryConsolidation
  * 本仓没有 —— 同 §遗留 遗-1 的那条基建缺口)。今天够得着这条阀门的部署形态是 file 记忆后端,那种部署
  * 实际上是单副本,所以进程内单飞覆盖了真实的失败形;但话按**它真正保证的**说,不按它常常够用说。
  *
- * 单飞**不是缓存**:那一轮落定(无论成败)即刻放行下一轮 —— 否则一次失败会把这个 scope 永久钉死。
+ * 单飞**不是缓存**:那一轮落定(无论成败)即刻放行下一轮 —— 否则一次失败会把这个 scope 永久卡住。
  */
 export declare function createPerScopeSingleFlight<T>(): (scope: string, run: () => Promise<T>) => Promise<T>;
 /**
@@ -80,7 +80,7 @@ export declare function assertConsolidationDriverWirable(input: {
     provenance?: "off" | "carry";
 }): void;
 /**
- * 阀门上了场之后的**可达性**告警两条(自查 + codex 对抗复审;姿态=warn 不拒启)。
+ * 阀门上了场之后的**可达性**告警两条(自查 + codex 交叉复审;姿态=warn 不拒启)。
  *
  * ## 病(结构性,而且**只在**这条阀门够得着的那种部署上成立)
  *
@@ -114,11 +114,11 @@ export declare function buildConsolidationValveAudit(input: {
     }>;
 };
 /**
- * 停因诊断行的**运维日志**投影(codex 对抗复审 R2-[medium],验真后修)。`build*`:纯数据。
+ * 停因诊断行的**运维日志**投影(codex 交叉复审 R2-[medium],验真后修)。`build*`:纯数据。
  *
  * `stopDetail` 已经不上 wire(`routes/memory-consolidation.ts` 的同名段:core 的 `driver_failed` 支把
  * 模型座抛出的 `Error.message` 逐字拼进去)。但**落日志同样要有信任边界** —— 集中式日志是人读的,
- * 而一段来路不明的文本混在自家诊断里,既可能夹带凭据,也可能把攻击者写的"操作建议"摆成本服务的口吻。
+ * 而一段来路不明的文本混在自家诊断里,既可能夹带凭据,也可能把不当调用方写的"操作建议"摆成本服务的口吻。
  * 三件:
  *  ① 字段名 `untrustedDetail` **自陈**(一个叫 `detail` 的键会被下一个读日志的人当成本服务自己的诊断);
  *  ② `redactSecrets` 脱敏(与审批卡片面同一只属主函数,不在本层另写一份模式表);
@@ -159,7 +159,7 @@ export interface MemoryConsolidationFaces {
  *
  * 本仓**没有**一个长命的 `MemoryEngine` 实例:`boot/stores.ts` 装配出来的 `memoryEngine` 是
  * `{ backend, root }` 二元组,真引擎由 core 的 Runner **每任务现构**。HTTP 面要一个引擎就得自己构。
- * 两只引擎不会各说各话:控制面由后端钉死(`backend.controlPlaneRoot`),gate / run 账 / plan 归档
+ * 两只引擎不会各说各话:控制面由后端写死(`backend.controlPlaneRoot`),gate / run 账 / plan 归档
  * 全住在那里,所以操作面引擎与每任务引擎看的是**同一本**账。
  *
  * ## `consolidation: {}` = 出厂缺省,**显式在场**

package/dist/boot/org-memory.d.ts

@@ -35,7 +35,7 @@ export interface OrgMemoryAdmissionWiring {
      * 🔴 A-057.40:这一席**故意**留快照,不跟 `config.projects` 的热应用走,理由是 core 根本不优先吃它:
      * 本仓每个请求都在 `boot/resolve-spec.ts` 现读 `config.projects[...].defaultScopes`(热加的项目当场
      * 进 spec),并在 `memory-scope.ts` 按 `originPolicy.multiTenant` 给每个 `org:` 键**盖章**;core 的
-     * `memory-admission` 先看盖章、只有没盖章时才查这张表 ⇒ 单用户部署下热注册项目的 org 键恒被盖成
+     * `memory-admission` 先看盖章、只有没盖章时才查这张表 ⇒ 单用户部署下热注册项目的 org 键恒被覆盖为
      * `deployment`,这张表陈旧只会让 `governed` / `orgGovernedProvenance` 两个布尔偏保守,**不产生拒绝**。
      * 需要跟着热应用走的是另一个消费点(共享记忆读面)—— 见 {@link deploymentMemoryScopesLive}。
      */

package/dist/boot/parked-revive-gate.d.ts

@@ -23,7 +23,7 @@ export interface ParkedReviveGateDeps {
      * 部署级活体审批席 —— `RunnerDeps.onAsk` 的**同源铸法**(main.ts 递 `createRunnerDepsOnAsk(toolApproval)`,
      * 单一属主同 boot/runner-deps.ts)。
      *
-     * ⚠️ **本仓确有 per-task `spec.onAsk` 装配点**(codex 对抗复审 R1-中1 验真纠正 —— 别照抄
+     * ⚠️ **本仓确有 per-task `spec.onAsk` 装配点**(codex 交叉复审 R1-中1 验真纠正 —— 别照抄
      * `createRunnerDepsOnAsk` 头注那句「bg/resume 两条腿没有 per-task 装配点」,那句话的射程只是那两条腿):
      * `http/routes/tasks.ts` 的宿主 sync/stream 腿在装配点写 `spec.onAsk = toolApproval.boundAsk({owner,
      * taskId, sessionId, legKey…})`(windowZero 形则写一个恒返 `"unavailable"` 的闭包)。core 冻的是
@@ -72,7 +72,7 @@ export interface ParkedReviveGateDeps {
 /**
  * core 1.396 的父约束席位形(`parkedResume.inheritedGate`)—— 从**载体自己的签名位推导**,绝不手写。
  *
- * 🔴 手写这个形状会**藏住轴**(codex 对抗复审 R1-高2 的真回归):第一版在这里手抄了一个只有
+ * 🔴 手写这个形状会**藏住轴**(codex 交叉复审 R1-高2 的真回归):第一版在这里手抄了一个只有
  * `parentConstraints` 的接口,于是 core 载体上那个 `shellGate` 槽在类型层面根本看不见,「shellGate 轴
  * 也要交回」这件事就无声地漏了一整刀。推导形让「core 又加了一条能收紧的轴」变成本仓的编译期/钉子面
  * 事件(载体键集钉见 test/parked-revive-gate-wiring.test.ts)。
@@ -124,7 +124,7 @@ export type RebuiltParentConstraint = NonNullable<RebuiltInheritedGate["parentCo
  *    (test/parked-revive-e2e.test.ts);真 settings→park→赎回的端到端钉未建(候件,随收口件一起)。
  */
 /**
- * 🔴 A-057.44 第二半(codex 对抗复审 medium,验真后采纳)—— 席位多收一位**权威 principal**。
+ * 🔴 A-057.44 第二半(codex 交叉复审 medium,验真后采纳)—— 席位多收一位**权威 principal**。
  *
  * 为什么不能只看 `row.scope`:`principal ?? "default"` 这套约定在那一列上是**有损**的(匿名与一个真名叫
  * `default` 的租户同形),而匿名别名匹配(见 `parked-decide.ts` 的 `backgroundScopesForCheckpointScope`)

package/dist/boot/reapers.d.ts

@@ -69,7 +69,7 @@ export interface ReapersCtx {
     rateLimiter: RateLimiter | RateLimiterStore | undefined;
     costQuota: CostQuota | CostQuotaStore | undefined;
     toolResultStore: ToolResultStoreFull | undefined;
-    fileSnapshotStore: ReturnType<StoreBackend["fileSnapshot"]> | undefined;
+    fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
     imageBakes: ImageBake | undefined;
     worktreeReap: (() => Promise<void>) | undefined;
@@ -154,7 +154,7 @@ interface ReapSessionsInputs {
  *    的 id 会回落 transient(进程内 no-op),那会让 core 数出一次**从未发生**的 release
  *    (`orphanPlacedReleased` 当场变成谎)而字节还在库里。故先按**持久化元组**判(一次 PK 探针),
  *    placed 走 host 店的真删除;其余 id 原样保留 [1522] 裁定的双店语义。
- *  · 🔴 探针本身失败 ⇒ **响亮抛**(codex 对抗复审 R1-[medium],验真后修:本函数的初版把探针错误
+ *  · 🔴 探针本身失败 ⇒ **响亮抛**(codex 交叉复审 R1-[medium],验真后修:本函数的初版把探针错误
  *    改写成 `undefined` 再落路由店 —— 而重启后路由店不认识 placed id ⇒ transient no-op,core 却因为
  *    release 正常 resolve 而 `orphanPlacedReleased++`。间歇性 DB 故障于是被**伪装成 GC 成功**:监控
  *    报着「收掉了 N 条孤儿」,durable 字节一条没动。这正是本函数顶注要防的那个形,初版自己踩了。

package/dist/boot/reapers.js

@@ -56,7 +56,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, getRunDenySweep, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, rateLimiter, costQuota, toolResultStore, fileHistoryStore, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, getRunDenySweep, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -85,7 +85,8 @@ export function startReapers(ctx) {
     const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
     const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
     const toolResultReapOlderThanGuard = createThrottledReaperCatch("tool_result_reap_older_than", logger);
-    const fileSnapshotSweepOrphanBlobsGuard = createThrottledReaperCatch("file_snapshot_sweep_orphan_blobs", logger);
+    const fileHistorySweepOrphanBlobsGuard = createThrottledReaperCatch("file_history_sweep_orphan_blobs", logger);
+    const legacySnapshotBlobSweepGuard = createThrottledReaperCatch("legacy_snapshot_blob_sweep", logger);
     const attachmentReapUnboundGuard = createThrottledReaperCatch("attachment_reap_unbound", logger);
     const sessionSweepStagingGuard = createThrottledReaperCatch("session_sweep_staging", logger);
     const imageBakesReapStaleGuard = createThrottledReaperCatch("image_bakes_reap_stale", logger);
@@ -100,6 +101,8 @@ export function startReapers(ctx) {
     const leaderRunStore = config.leaderEnabled ? backend?.leaderRun?.() : undefined;
     const scratchpadSweepStaleGuard = createThrottledReaperCatch("scratchpad_sweep_stale", logger);
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
+    const approvalSuspendedPollGuard = createThrottledReaperCatch("approval_suspended_poll", logger);
+    let approvalSuspendedPollInFlight = false;
     const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
     let permissionRuleReapInFlight = false;
     let approvalReconcileInFlight = false;
@@ -220,9 +223,12 @@ export function startReapers(ctx) {
         leg(toolResultStore
             ?.reapOlderThan?.(Date.now() - config.toolResultTtlSec * 1000)
             ?.then(() => toolResultReapOlderThanGuard.onSuccess(), toolResultReapOlderThanGuard.onError));
-        leg(fileSnapshotStore
+        leg(fileHistoryStore
             ?.sweepOrphanBlobs?.()
-            .then(() => fileSnapshotSweepOrphanBlobsGuard.onSuccess(), fileSnapshotSweepOrphanBlobsGuard.onError));
+            .then(() => fileHistorySweepOrphanBlobsGuard.onSuccess(), fileHistorySweepOrphanBlobsGuard.onError));
+        leg(backend?.legacySnapshotBlobSweep?.()
+            .then(reapCount("legacy_snapshot_blobs_swept_total", {}))
+            .then(() => legacySnapshotBlobSweepGuard.onSuccess(), legacySnapshotBlobSweepGuard.onError));
         leg(taskAttachmentStore
             ?.reapUnbound(Date.now() - config.attachmentUnboundTtlMs)
             .then(reapCount("attachments_reaped_total", {}))
@@ -295,6 +301,13 @@ export function startReapers(ctx) {
                 .then(() => approvalReconcileGuard.onSuccess(), approvalReconcileGuard.onError)
                 .finally(() => (approvalReconcileInFlight = false)));
         }
+        if (toolApproval && !approvalSuspendedPollInFlight) {
+            approvalSuspendedPollInFlight = true;
+            leg(toolApproval
+                .pollSuspendedDecisions()
+                .then(() => approvalSuspendedPollGuard.onSuccess(), approvalSuspendedPollGuard.onError)
+                .finally(() => (approvalSuspendedPollInFlight = false)));
+        }
         if (!permissionRuleReapInFlight) {
             permissionRuleReapInFlight = true;
             leg(permissionRuleStores

package/dist/boot/resolve-spec.d.ts

@@ -18,6 +18,7 @@ import type { StoreBackend } from "../plugins/store-backend.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import { type createPrincipalEntitlementsClient } from "../runtime-caps-resolver.js";
 import { type OwnerAwareSessionStore } from "../security.js";
+import type { RunnerDepsOnAsk } from "./runner-deps.js";
 type PrincipalCaps = ReturnType<typeof createPrincipalEntitlementsClient>;
 /** `resolveSpec` 原先从 `main()` 闭包里拿到的全部 boot 局部量。 */
 export interface ResolveSpecCtx {
@@ -68,6 +69,17 @@ export interface ResolveSpecCtx {
      *  ASK_QUESTION_ENABLED)时 durable question 门按活流上下文分腿、spec 不再 stamp QUESTION_AWAITS_RESUME
      *  (否则 spec.onQuestion 恒遮蔽 RunnerDeps.onQuestion 的活人腿);缺席时行为与旧形逐字一致。 */
     liveQuestionFace: LiveQuestionFace | undefined;
+    /**
+     * S-46 件C —— 部署级**活体审批席**(`RunnerDeps.onAsk` 的同源铸法,main.ts 递
+     * `createRunnerDepsOnAsk(toolApproval)`;单一属主同 `boot/runner-deps.ts`,与 `parked-revive-gate.ts`
+     * 的 `approverSeat` 是同一格)。
+     *
+     * 本域**只**用于逐腿 `interactionPosture` 判据(见下方 `declaresInteractivePosture`),不参与任何
+     * 装配 —— spec 上的 per-task `onAsk` 由 `http/routes/tasks.ts` 在 resolveSpec **之后**写(bound 席),
+     * 而 core 的 posture 门读的是 `spec.onAsk ?? deps.onAsk`,两个装配点是**同一个条件**的两种表达
+     * (spec 位只在 `deps.toolApproval` 在场时才写,且写的也是函数)⇒ 拿 deps 位判「席位形」恒等。
+     */
+    approverSeat: RunnerDepsOnAsk | undefined;
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     singleUserAutoAcceptBaseline: boolean;
     checkpointStore: ReturnType<NonNullable<StoreBackend["checkpoint"]>> | undefined;

package/dist/boot/resolve-spec.js

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, expandTiers, tightenTaskSpec } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, resolveAskSeamForm, tightenTaskSpec } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -13,6 +13,7 @@ import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApp
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
+import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isModelAllowlisted, matchCatalogModel, modelSupportsImages, resolveTaskModel, terminalCatalogName } from "../model-select.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
@@ -35,21 +36,25 @@ import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, isSandboxPathAdjudicationLane, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
 import { effectiveMemoryPersistenceCapable } from "./memory-boundary.js";
 export function createResolveSpec(ctx) {
-    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, lockedKeys, } = ctx;
+    const { config, logger, metrics, localRoot, scenarios, principalCaps, centerRuntimeCapsResolver, handsLanes, getCenterPrompts, getKeyResolver, taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv, fenceSessionOwner, hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec, selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage, sessionEnvSelection, liveQuestionFace, approverSeat, lockedKeys, } = ctx;
     assertGuardPatternsUsable(config);
     const onlySensitiveBaseline = buildOnlySensitiveBaselineWarning(config, { durableEnabled, singleUserAutoAcceptBaseline });
     if (onlySensitiveBaseline)
         logger.warn(onlySensitiveBaseline.event, onlySensitiveBaseline.fields);
-    const resolveSpec = async (body, _req, auth, opts) => {
+    const resolveSpec = async (body, req, auth, opts) => {
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
             assertRequestMcpContentOrigin(body.mcpServers);
+        const rawMemoryCapture = body.memoryCapture;
+        if (rawMemoryCapture !== undefined && rawMemoryCapture !== "off") {
+            throw new HttpError(400, "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)", { code: "request.field_invalid" });
+        }
         assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, effMode, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
-        const spec = assembleSpecLiteral(body, auth, opts, { ...gated, ...lane, ...anchors }, effMode);
+        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors }, effMode);
         const folded = await foldGovernanceAndSettings(body, auth, spec, gated, effMode);
         const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
             scenarioName: gated.scenarioName,
@@ -228,7 +233,21 @@ export function createResolveSpec(ctx) {
         const s4DefaultScopes = s4ProjectId ? config.projects[s4ProjectId]?.defaultScopes : undefined;
         return { resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes };
     };
-    const assembleSpecLiteral = (body, auth, opts, parts, effMode) => {
+    const declaresInteractivePosture = (body, req, opts) => {
+        if (opts?.liveStream !== true)
+            return false;
+        if (body.verify === true || body.cascade === true)
+            return false;
+        if (liveQuestionFace === undefined)
+            return false;
+        if (body.interactiveTools === false)
+            return false;
+        if (headerStr(req?.headers["x-detach-on-disconnect"]) === "true")
+            return false;
+        const askForm = resolveAskSeamForm({}, approverSeat !== undefined ? { onAsk: approverSeat } : {});
+        return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
+    };
+    const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
         const { scenarioName, cap, hands, centerDecls, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
@@ -251,7 +270,9 @@ export function createResolveSpec(ctx) {
             requireExistingSession: body.requireExistingSession === true ? true : undefined,
             enableFork: enableForkFromBody(body, config, Boolean(centerRuntimeCapsResolver)),
             suggestNextPrompts: normalizeSuggestNextPrompts(body.suggestNextPrompts),
-            rewindFiles: body.rewindFiles === true ? true : undefined,
+            restoreFiles: body.restoreFiles === true ? true : undefined,
+            acceptPartialRestore: body.acceptPartialRestore === true ? true : undefined,
+            ...(body.rewindFiles === true ? { rewindFiles: true } : {}),
             rewindFilesTo: rewindFilesToEntryId,
             additionalDirectories,
             additionalReadDirectories,
@@ -271,6 +292,7 @@ export function createResolveSpec(ctx) {
             ...(typeof body.interactiveTools === "boolean"
                 ? { interactiveTools: body.interactiveTools }
                 : {}),
+            ...(declaresInteractivePosture(body, req, opts) ? { interactionPosture: "interactive" } : {}),
             ...(typeof body.oneShot === "boolean" ? { oneShot: body.oneShot } : {}),
             resilience: normalizeResilience(body.resilience, explicitOperatorOk(auth?.principal, config.operatorPrincipals)),
             finalVerification: cap.finalVerification === true || body.finalVerification === true ? true : undefined,
@@ -337,7 +359,7 @@ export function createResolveSpec(ctx) {
                 return { ...(Object.keys(merged).length > 0 ? { limits: merged } : {}), ...(declarations.length > 0 ? { configOverrides: declarations } : {}) };
             })(),
             ...(config.requirePrincipal !== true ? { backgroundScope: "session" } : {}),
-            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }) : undefined,
+            memory: memoryEngine ? memorySpecForRequest(auth?.memoryScope, body.memoryWrite, s4DefaultScopes, { multiTenant: config.requirePrincipal === true }, body.memoryCapture) : undefined,
             ...((v) => (v !== undefined ? { memoryPersistenceCapable: v } : {}))(effectiveMemoryPersistenceCapable(config)),
             tools: ((base) => {
                 const extra = [...(selectEnvTool ? [selectEnvTool] : []), ...(sendUserFileToolSpec ? [sendUserFileToolSpec] : [])];

package/dist/boot/retention-lane.d.ts

@@ -21,7 +21,7 @@
  *  ③ 模式分家(§4):`audit-only` 只调 `previewRetention` 记 `audit_only` 行,**一条破坏性方法都不调**;
  *     `enforce` 才调三方法。两支在代码里**物理分开**(不是同一段带 `if` 的调用序)—— 自审判据「grep 三个
  *     方法名只出现在 enforce 臂」靠的就是这个形。
- *  ④ 单 domain 失败 ⇒ 记 `failed` 行 + **继续下一 domain**(一个坏租户不钉死整轮);同 domain 连败
+ *  ④ 单 domain 失败 ⇒ 记 `failed` 行 + **继续下一 domain**(一个坏租户不卡住整轮);同 domain 连败
  *     ≥ {@link RETENTION_SWEEP_STUCK_THRESHOLD} ⇒ `retention_sweep_stuck` 指标 + **一次性** warn。
  *
  * ── 破坏性审计行的属主(§6 F5)────────────────────────────────────────────────────────────────
@@ -181,7 +181,7 @@ export interface RetentionLaneCtx extends RetentionSweepCtx {
 /**
  * 起飞后的 lane 控制器(`create*` 形:有行为有状态)。
  *
- * 🔴 `stop()` 为什么必须**可等**(codex 对抗复审 R1-[high],验真后加):`clearInterval` 只挡住**新** tick,
+ * 🔴 `stop()` 为什么必须**可等**(codex 交叉复审 R1-[high],验真后加):`clearInterval` 只挡住**新** tick,
  * 它不等当前这一轮。旧形的收尾链停表之后紧跟着就让租 ⇒ 新副本立刻接租,而旧副本还在删同一个域的
  * 数据 —— 一个由**正常** SIGTERM/SIGINT 稳定触发的双执行者窗口(比任何竞态都好复现)。
  * 正确的次序是:停表 → **等在飞那一轮落地** → 让租 → 关连接池。

package/dist/boot/runner-deps.d.ts

@@ -29,10 +29,14 @@ import type { MemorySyncRunner } from "../memory-sync-client.js";
 /**
  * `RunnerDeps.onAsk` 的装配(#168 件4:从内联闭包提为具名导出,**纯 testability 重构、零行为变化**)。
  *
- * 为什么值得有名字:bg / resume 两条腿**没有** per-task `spec.onAsk` 装配点(routes/runs.ts 只递 ALS 与
- * 两个窗旋钮),它们唯一的审批接缝就是这一格。端到端测试此前只能把这一行**照抄**一份,再靠一条读源码
+ * 为什么值得有名字(历史理由,#168 当时):bg / resume 两条腿彼时没有 per-task `spec.onAsk` 装配点,
+ * 它们唯一的审批接缝就是这一格。端到端测试此前只能把这一行**照抄**一份,再靠一条读源码
  * 的正则当漂移告警 —— 那种锚只抓得到「这一行没了/改名了」,抓不到任何语义变化,而且抄件与真件从此是两
  * 份实现。提成导出之后,测试直接取本函数,接缝与 production 是**同一个符号**。
+ * ⚠️ S-52 起**三腿都装** per-task `spec.onAsk = boundAsk`(sync=routes/tasks.ts、bg=runs.ts、
+ * resume=server.ts driveResumeLeg;core `resolveAsk` 取 `spec.onAsk ?? deps.onAsk` ⇒ 这三条腿及其继承链
+ * 子代不再落到本格)—— 本格现役的到达面 = 没有 per-task 装配的腿(headless/durable-submit、协调器在场
+ * 但 taskId 缺席的退化 resume 腿)与任何未来新腿的缺省兜底,fail-direction 不变(零 ctx ⇒ 政策口)。
  *
  * 命名(CLAUDE.md 工厂命名律):返回的是一个闭包(活对象)⇒ `create*`。
  *
@@ -74,11 +78,11 @@ export interface RunnerDepsCtx {
     memorySyncRunner: MemorySyncRunner | undefined;
     /** design/170 件A(#148 件3③):org 记忆准入两 seam 的装配产物(boot/org-memory.ts)。进**共享
      *  基座**——主/sub 两 Runner 必须同源:委托子代的 prepare 同样跑准入(委托冻结的重判腿),漏挂
-     *  subRunner=子代平面绕过目录判决。 */
+     *  subRunner=子代平面跳过目录判决。 */
     orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
     /** design/170 件B/C/D(#252 件1):三个部署治理座席的装配产物(boot/governance-seams.ts)。进**共享
      *  基座** —— 合规否决与锁定层必须同样管住委托子代那条腿(子代 prepare 走同一套 preflight;漏挂
-     *  subRunner = 子代平面绕过档位与锁,与件A 同一个理由)。`retentionPolicy` 是纯声明,同源携带。 */
+     *  subRunner = 子代平面跳过档位与锁,与件A 同一个理由)。`retentionPolicy` 是纯声明,同源携带。 */
     governanceSeams: import("./governance-seams.js").GovernanceSeams;
     /** design/177 —— org 共享记忆库的供给面(core `RunnerDeps.sharedMemoryStores`)。在场即挂载
      *  `memory_list`/`memory_read` 两只工具(core 没有 TaskSpec 伴生旋钮:dep 的在场**就是**部署意图);
@@ -88,7 +92,13 @@ export interface RunnerDepsCtx {
     toolResultStore: ToolResultStoreFull | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     runtimeCapsResolver: RunnerDeps["runtimeCapsResolver"];
-    fileSnapshotStore: ReturnType<StoreBackend["fileSnapshot"]> | undefined;
+    /** S-15 per-edited-file rewind history (core `RunnerDeps.fileHistoryStore`; replaces the retired E19
+     *  whole-tree snapshot seat — core 94632197 renamed the seat, not a coexistence). WIRING IS THE OPT-IN. */
+    fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
+    /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): lets the rewind refusal
+     *  distinguish "never existed / reaped" from "exists in the RETIRED whole-tree epoch". Consulted only on
+     *  the refusal path; diagnostic input, never a control input (a bad probe cannot change the outcome). */
+    legacyRewindBoundaryProbe: RunnerDeps["legacyRewindBoundaryProbe"];
     /** #154 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleOffers` 不铸(诚实缺席)。 */
     permissionRuleStore: RunnerDeps["permissionRuleStore"];
@@ -126,7 +136,7 @@ export interface RunnerDepsCtx {
 }
 /** design/158 A10 留档发现②:main runner `RunnerDeps` 与 main.ts subRunner 字面量之间此前手工重复
  * 的 ~15 个键,类型标注见 {@link createSharedRunnerDeps} 头注。 */
-export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "delegationEntryCaps" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
+export type SharedRunnerDeps = Pick<RunnerDeps, "brain" | "readFace" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "memoryDelegationEvidence" | "memoryProvenance" | "memoryCapturePolicy" | "delegationEntryCaps" | "models" | "roles" | "tiers" | "pricing" | "tracer" | "promptSource" | "executionEnvFactory" | "lspManager" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "hooks" | "toolResultStore" | "hands" | "sessionPolicyStore" | "usageWindows" | "usageWindowStore" | "memoryScopeAdmission" | "deploymentMemoryScopes" | "sharedMemoryStores" | "compliancePostureResolver" | "lockedConfig" | "retentionPolicy" | "onNotice" | "mcpRevocations">;
 /**
  * design/158 A10 留档发现②(review 2026-07-29,[1543]§三族A 同源修补的延续):main runner 的
  * `RunnerDeps` 字面量(下方 `createRunnerDeps`)与 `main.ts` 里 subRunner 的 `new Runner({...})`
@@ -194,7 +204,7 @@ export declare function createEngineNoticeForwarder(logger: {
 }, router?: EngineNoticeRouter): NonNullable<RunnerDeps["onNotice"]>;
 /**
  * `onNotice` **席**的装配判据本身 —— 「`warn` 真在场才铸席」这一条从此是**一个可直接调用的函数**,
- * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 对抗复审 R1-[medium],验真后修)。
+ * 不是散在装配点、只能靠扫源码文本去猜的一行三元(codex 交叉复审 R1-[medium],验真后修)。
  *
  * 病(实测):把 leader 的门写成 `cfg.logger ? ((m, x) => cfg.logger?.warn?.(m, x)) : undefined` 时,
  * 「装配点切片里出现过 `warn` 这个词」这类**源码文本**判据一律照绿 —— 而只装了 `info` 的部署会拿到一个

package/dist/boot/runner-deps.js

@@ -41,6 +41,7 @@ export function createSharedRunnerDeps(ctx) {
         readDenyBuiltinExclude: ctx.config.readDenyBuiltinExclude ?? undefined,
         memoryDelegationEvidence: ctx.config.memoryDelegationEvidence ?? undefined,
         memoryProvenance: ctx.config.memoryProvenance ?? undefined,
+        memoryCapturePolicy: ctx.config.memoryCapturePolicy ?? undefined,
         delegationEntryCaps: ctx.config.delegationEntryCaps ?? undefined,
         executionEnvFactory: ctx.executionEnvFactory ? ctx.executionEnvFactory : undefined,
         lspManager: ctx.lspManager ? ctx.lspManager : undefined,
@@ -64,7 +65,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileSnapshotStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, } = ctx;
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
     const selfOrchestrationDeps = config.selfOrchestrationEnabled
@@ -160,7 +161,8 @@ export function createRunnerDeps(ctx) {
             }
             : undefined,
         runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
-        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
+        legacyRewindBoundaryProbe: legacyRewindBoundaryProbe ? legacyRewindBoundaryProbe : undefined,
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
         loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled ? makeLoadProjectMemory({ logger }) : undefined,

package/dist/boot/runtime-caps.d.ts

@@ -9,10 +9,33 @@
  */
 import type { ServiceConfig } from "../config.js";
 import type { Logger } from "../observability/logger.js";
+import { type MemoryOptOutVerdictSource } from "../runtime-caps-resolver.js";
 export interface RuntimeCapsCtx {
     config: ServiceConfig;
     logger: Logger;
+    /** design/383 S-2:`RuntimeCaps.allowMemoryOptOut` 的本地 verdict 源(`backend.memoryOptOutGrant()`;
+     *  SQL 后端在场才有,local 车道 undefined)。缺席 ⇒ 本键不合成(零行为差)。 */
+    memoryOptOutGrant?: MemoryOptOutVerdictSource | undefined;
 }
+/**
+ * design/383 §3.1(S-49 S-1b)—— `MEMORY_CAPTURE_POLICY=governed` 的**半配置拒启**(`boot/memory-consolidation.ts`
+ * D1 / `boot/retention-lane.ts` 同姿态:安全/合规控件不得半开)。
+ *
+ * governed 的语义是「per-principal verdict **必答**」:core 对 verdict 缺席一律**拒跑**(fail-closed,部署显式
+ * 选的方向)。而 verdict 只能来自一个源 —— 本批唯一源 = SQL 后端上的 `memory_optout_grant` 表(三层折叠后
+ * 恒答显式 boolean)。governed 而无源 ⇒ 每一个 `capture:"off"` 声明都被 core 以
+ * `memory.capture_optout_denied` 拒掉,而运维看到的只是一台「启动成功、opt-out 全拒」的机器 —— 正是
+ * 「阀门开着而配不出来 ⇒ 悄悄读成别的」那一形。所以在**启动期**点名:要么接 SQL 后端(表随中央
+ * ensureSchema 建),要么改姿态。`open`/`capture-required`/缺席 不依赖源(前者故障放行、后者全拒,
+ * 都不问 verdict)。
+ *
+ * ⚠️ center 键 `EntitlementRuntimeCaps.allowMemoryOptOut` 是 settings-schema 的独立小件(S-50 §四 开放问题①),
+ * 到货前**不算源**;到货后本断言加一条「center 在场」析取臂即可,判据不变。
+ */
+export declare function assertMemoryCapturePolicyWirable(input: {
+    policy: ServiceConfig["memoryCapturePolicy"];
+    grantSourceWired: boolean;
+}): void;
 export declare function createRuntimeCaps(ctx: RuntimeCapsCtx): {
     principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
     centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;

package/dist/boot/runtime-caps.js

@@ -1,6 +1,21 @@
-import { applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker } from "../runtime-caps-resolver.js";
+import { applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, scopedTokenNeedsWorker, } from "../runtime-caps-resolver.js";
+export function assertMemoryCapturePolicyWirable(input) {
+    if (input.policy !== "governed")
+        return;
+    if (input.grantSourceWired)
+        return;
+    throw new Error(`MEMORY_CAPTURE_POLICY=governed requires a per-principal memory opt-out verdict source, and this deployment wires NONE ` +
+        `— under "governed" core REFUSES every session memory-capture opt-out whose verdict is absent (fail-closed, the posture's ` +
+        `own contract), so a governed worker without a source would refuse every \`memory.capture:"off"\` declaration and the ` +
+        `refusal would read as an entitlement denial rather than the misconfiguration it is. The only verdict source in this ` +
+        `version is the \`memory_optout_grant\` table on a SQL store backend (DB_BACKEND=mysql|pg; the table is created by the ` +
+        `central ensureSchema and administered through /v1/admin/memory-optout). Wire a SQL backend, or set ` +
+        `MEMORY_CAPTURE_POLICY=open (opt-outs take effect; only an explicit per-principal false denies) or ` +
+        `MEMORY_CAPTURE_POLICY=capture-required (every opt-out declaration refused, no source consulted).`);
+}
 export function createRuntimeCaps(ctx) {
     const { config, logger } = ctx;
+    assertMemoryCapturePolicyWirable({ policy: config.memoryCapturePolicy, grantSourceWired: ctx.memoryOptOutGrant !== undefined });
     if (config.configCenter && !config.configCenter.dryRun && scopedTokenNeedsWorker(config.configCenter.token, config.configCenter.worker)) {
         logger.warn("runtime_caps_scoped_token_no_worker", {
             reason: "SEMA_REGISTRY_TOKEN is a worker-scoped wpt_ token but SEMA_REGISTRY_WORKER is unset → center 403s per-principal caps → ALL workflow self-orchestration will be fail-closed denied. Set SEMA_REGISTRY_WORKER (the orchestrator normally injects it) or use the full SERVICE_PULL_TOKEN.",
@@ -15,11 +30,18 @@ export function createRuntimeCaps(ctx) {
         })
         : undefined;
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
-    const runtimeCapsResolver = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
+    const withObservers = applyObserverEnvOptIn(centerRuntimeCapsResolver, {
         experimentalObserverAgents: config.experimentalObserverAgents,
         requirePrincipal: config.requirePrincipal,
         warn: (msg, fields) => logger.warn(msg, fields),
     });
+    const runtimeCapsResolver = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
+        onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
+            principal,
+            err: String(err),
+            effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
+        }),
+    });
     return { principalCaps, centerRuntimeCapsResolver, runtimeCapsResolver };
 }
 //# sourceMappingURL=runtime-caps.js.map

package/dist/boot/session-faces.d.ts

@@ -23,7 +23,7 @@ export interface SessionFacesCtx {
     approvalExemptionStore: ReturnType<StoreBackend["approvalExemption"]> | undefined;
     sessionPolicyStore: ReturnType<StoreBackend["sessionPolicy"]> | undefined;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    fileSnapshotStore: ReturnType<StoreBackend["fileSnapshot"]> | undefined;
+    fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
     workflowCompletionInbox: WorkflowCompletionInbox | undefined;
     /** #318:会话级任务清单车道(E21 级联的一条腿)。缺席 = 装配未接本车道 ⇒ 无清单可删。 */
     taskListLane: TaskListLane | undefined;

package/dist/boot/session-faces.js

@@ -6,7 +6,7 @@ import { setLeafAdvanceListener } from "../session-leaf-bus.js";
 import { SessionWatchRegistry, posIntEnv } from "../session-watch.js";
 import { defaultTaskRegistry } from "@sema-agent/core";
 export function createSessionFaces(ctx) {
-    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileSnapshotStore, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, } = ctx;
+    const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryStore, workflowCompletionInbox, taskListLane, deviceStore, dropSessionScoped, } = ctx;
     const mysqlPool = backend?.mysqlPool();
     const auditPgPool = backend?.pgPool();
     const auditLocalRoot = backend?.kind === "local" ? (config.localDataRoot ?? localRoot) : undefined;
@@ -66,8 +66,19 @@ export function createSessionFaces(ctx) {
             if (deviceStore)
                 await deviceStore.deleteByRootSession(sessionId);
             dropSessionScoped?.(sessionId);
-            if (fileSnapshotStore?.deleteBySession)
-                await fileSnapshotStore.deleteBySession(sessionId);
+            if (fileHistoryStore) {
+                if (typeof fileHistoryStore.deleteBySession === "function")
+                    await fileHistoryStore.deleteBySession(sessionId);
+                else {
+                    await fileHistoryStore.reap(sessionId, []);
+                    logger.warn("session_file_history_baselines_retained", {
+                        sessionId,
+                        note: "the local file-history store has no whole-scope purge verb; boundaries were reaped but v1 baselines (original file bytes) remain under the data root until the upstream purge seam lands — recorded as an open deletion-rights gap, not silent",
+                    });
+                }
+            }
+            if (backend?.legacySnapshotPurge)
+                await backend.legacySnapshotPurge(sessionId);
             if (workflowCompletionInbox)
                 await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: String(err) }));
             await purgeScratchpadDir(config.localDataRoot ?? localRoot, sessionId);