@sema-agent/server 7.70.0 → 7.71.0

package/dist/plugins/remote-env-ssh.js

@@ -23,6 +23,7 @@ export class RemoteSshExecutionEnv {
     destroyed = false;
     connEpoch = 0;
     inFlight;
+    homeDir;
     cfg;
     injectedConnectOnce;
     constructor(config, deps) {
@@ -41,6 +42,7 @@ export class RemoteSshExecutionEnv {
             hostKey: config.hostKey,
         };
         this.cwd = this.cfg.mountPath;
+        this.homeDir = config.homeDir;
     }
     resolve(p) {
         return path.posix.isAbsolute(p) ? path.posix.normalize(p) : path.posix.normalize(path.posix.join(this.cwd, p));

package/dist/plugins/store-backend.d.ts

@@ -116,6 +116,22 @@ export type ToolResultStoreFull = ToolResultStore & {
 export type BreakerStateStore = TiDBBreakerState | PgBreakerState;
 export type CostQuotaStore = TiDBCostQuota | PgCostQuota;
 export type RateLimiterStore = TiDBRateLimiter | PgRateLimiter;
+/**
+ * S-215 —— capture opt-out **记录载体的按平面取用座**。形与 core 的
+ * `RunnerDeps.memoryCaptureRecordStore`(`(plane: { controlDir }) => SessionCaptureRecordStore`)同构,
+ * 多一个**不指名平面**的缺省臂:`src()` = 「本部署记忆引擎自己那一只平面」。
+ *
+ * 🔴 为什么是工厂而不是一只实例(S-215 codex r1 [high] 验真后改形):core 的记忆平面**不止一个**
+ * (`prepare-memory.js:162` 的 personal 平面自带 `derivePersonalControlDir(engineRoot)`,与 project 平面的
+ * controlDir 不是同一只)。返回单只实例 ⇒ server 把所有平面折到一只目录上,于是升级前落在 personal
+ * 控制面的旧 opt-out 记录在升级后读作**缺席**=采集恢复(隐私面的静默 fail-open)。按平面取用后,
+ * file 载体与 core 的缺省**逐字节同址**,唯一的变化是这个席位现在**被声明了**(core 的能力信号要的就是它)。
+ * SQL 载体**刻意忽略** plane:它按 session_id 键控、跨平面全局 —— opt-out 是**会话**事实而不是平面事实
+ * (逐字理由见 boot/runner-deps.ts 该席的注)。
+ */
+export type SessionCaptureRecordSource = (plane?: {
+    controlDir: string;
+}) => SessionCaptureRecordStore;
 export interface StoreBackend {
     /** Protocol-truth kind (clay 2026-07-06 wording): "mysql" = any MySQL-protocol server (MySQL / TiDB /
      *  MariaDB) behind the one mysql2 pool — the startup summary prints durable(mysql) for all of them. */
@@ -186,19 +202,25 @@ export interface StoreBackend {
      *  「没有行 ⇒ 代码缺省 allow」—— 那是**放宽面**上的静默降级(permissionRule 那条禁令的同一理由)。
      *  File 形候真实的 local+governed 部署需求出现再落(候需求档)。 */
     memoryOptOutGrant(): MemoryOptOutGrantStore | undefined;
-    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2):会话 capture opt-out **记录**的 SQL 载体
-     *  (`session_capture_optout`)—— core `RunnerDeps.memoryCaptureRecordStore` /
-     *  `MemoryEngineOptions.captureRecordStore` 的持久层(Promise 形三腿)。与 §3.1 的**授权表**不是一个轴:
-     *  那张管「谁**可以** opt-out」(operator 写的 verdict),这张管「谁**已经** opt-out」(用户写的一次性
-     *  单向记录)。
+    /** [ref]②([ref] §2.1b,core 7.0.2 [ref] 件2)/ S-215:会话 capture opt-out **记录**的载体 ——
+     *  core `RunnerDeps.memoryCaptureRecordStore` / `MemoryEngineOptions.captureRecordStore` 的持久层。
+     *  与 §3.1 的**授权表**不是一个轴:那张管「谁**可以** opt-out」(operator 写的 verdict),这张管
+     *  「谁**已经** opt-out」(用户写的一次性单向记录)。
+     *
+     *  返回的是**按平面取用的源**({@link SessionCaptureRecordSource}),不是一只实例 —— core 的记忆平面
+     *  不止一只,折平会挪动旧记录的地址(理由全文见该类型的头注)。
+     *  载体按车道分形,但**三条车道都供**(S-215 起):SQL 两支 = 双方言 twin(`session_capture_optout`,
+     *  Promise 形三腿,池即依托 ⇒ 无条件供,`plane` 刻意忽略);`local` = core 的控制面文件三腿
+     *  `fileSessionCaptureRecordStore(controlDir)` 按平面现造,依托是**记忆引擎的控制面目录** ⇒ 记忆面暗的
+     *  部署上该平面不存在,于是这一支**随引擎接线门缺席**(唯一的 `undefined` 成因,逐字理由见 LocalBackend 的实装注)。
      *
-     *  🔴 **可选**(与 memoryOptOutGrant 同族):SQL 后端 = 双方言 twin;`local` 车道 **undefined**,且缺席是
-     *  一个真答案 —— 缺席时 core 用它的控制面文件三腿(`fileSessionCaptureRecordStore`),单机部署上那正是
-     *  重启可存活的正确载体(383 §2.1b:「absent = 文件三腿,单进程/单机字节不变」)。SQL 载体要解决的病
-     *  只在无状态多副本形:文件记录对 resume 副本不可见,「record not found」恰朝**继续采集**方向坏。
-     *  刻意不给 local 一个 SQL/内存 twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差),
-     *  文件形 core 已自带。 */
-    sessionCaptureRecords(): SessionCaptureRecordStore | undefined;
+     *  🔴 修前 local 恒 `undefined` 且注称「缺席是一个真答案」—— 那句话在**事实层面**成立(单机的正确载体
+     *  确实就是文件三腿)、在**接线层面**是假的:core 的 `captureCarrierUnsupported`
+     *  (core 7.13.0 `prepare-task.js:497`)判的是「这个席位在不在」而不是「文件形能不能用」,叠上
+     *  `isRemoteExecutionEnv` 的接口形鸭子判(`remote-env.js:21`)把本仓 host lane 一并算作 remote,
+     *  于是单机默认部署上 `memoryCapture:"off"` 两条 ingress 结构性不可达(B-085)。
+     *  刻意仍不给 local 一个**内存** twin:内存形会在重启时把一条隐私记录静默丢掉(比文件三腿严格更差)。 */
+    sessionCaptureRecords(): SessionCaptureRecordSource | undefined;
     /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): does the RETIRED whole-tree
      *  snapshot epoch hold a boundary for (sessionId, entryId)? Reads the legacy `snapshot_manifest` table.
      *  SQL backends only (local never had a whole-tree epoch table). Diagnostic input on the refusal path —

package/dist/plugins/store-backend.js

@@ -2,6 +2,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { AdoptionError, FileStorageBackend, FileSessionRepo } from "@sema-agent/core";
 import { FileWorkflowJournalStore } from "@sema-agent/core";
+import { fileSessionCaptureRecordStore } from "@sema-agent/core";
 import { TiDBOutcomeLedger, PgOutcomeLedger } from "./outcome-ledger-sql.js";
 import { FileOutcomeSink } from "./file-outcome-sink.js";
 import { TiDBWorkflowRunStore, TiDBWorkflowCompletionInbox, TiDBWorkflowNotifyJournalStore, TiDBWorkflowAgentSessionIndex, PgWorkflowRunStore, PgWorkflowCompletionInbox, PgWorkflowNotifyJournalStore, PgWorkflowAgentSessionIndex } from "./workflow-run-store-sql.js";
@@ -20,6 +21,7 @@ import { TiDBSessionPolicyStore, PgSessionPolicyStore } from "./session-policy-s
 import { TiDBWorkflowJournalStore, PgWorkflowJournalStore } from "./workflow-journal-store-sql.js";
 import { TiDBFileHistoryStore, PgFileHistoryStore, FILE_HISTORY_BLOB_TABLE, FILE_HISTORY_BLOB_KEY_PREFIX } from "./file-history-store-sql.js";
 import { MinioBlobBackend, SqlBlobBackend } from "./blob-backend.js";
+import { fileMemoryControlDirFor } from "../memory-scope.js";
 import { createTidbPool, ensureSchema as ensureTidbSchema } from "./tidb-pool.js";
 import { createPgPool, ensurePgSchema, pgPoolOptions } from "./pg-pool.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
@@ -136,7 +138,8 @@ class TiDBBackend {
     sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
-    sessionCaptureRecords() { return new TiDBSessionCaptureRecordStore(this.pool); }
+    sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
+    captureRecordsInst;
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("tidb", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "tidb", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("tidb", this.pool, sessionId); }
@@ -183,7 +186,8 @@ class PgBackend {
     sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
-    sessionCaptureRecords() { return new PgSessionCaptureRecordStore(this.pool); }
+    sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
+    captureRecordsInst;
     legacyRewindBoundaryProbe(query) { return legacyProbeImpl("pg", this.pool, query); }
     legacySnapshotBlobSweep() { return legacySweepImpl(this.config, "pg", this.pool); }
     legacySnapshotPurge(sessionId) { return legacyPurgeImpl("pg", this.pool, sessionId); }
@@ -259,6 +263,10 @@ class LocalBackend {
         this.sendFileLedgerStore = new FileSendFileLedger(this.fileBackend.root);
         this.workflowJournalStore = new FileWorkflowJournalStore(this.fileBackend.root);
         this.outcomeSinkInst = new FileOutcomeSink(this.fileBackend.root);
+        const ownControlDir = fileMemoryControlDirFor(config);
+        this.captureRecordsSource = ownControlDir === undefined
+            ? undefined
+            : (plane) => fileSessionCaptureRecordStore(plane?.controlDir ?? ownControlDir);
     }
     async ensureSchema() { }
     async close() {
@@ -304,7 +312,8 @@ class LocalBackend {
     sessionPolicy() { return this.fileBackend.sessionPolicyStore; }
     fileHistory() { return this.fileBackend.fileHistoryStore; }
     memoryOptOutGrant() { return undefined; }
-    sessionCaptureRecords() { return undefined; }
+    sessionCaptureRecords() { return this.captureRecordsSource; }
+    captureRecordsSource;
     workflowJournal() { return this.workflowJournalStore; }
     outcomeSink() { return this.outcomeSinkInst; }
     session() { return this.sessionStore; }

package/dist/plugins/store-contracts.d.ts

@@ -108,27 +108,65 @@ export interface RunRecord {
     updatedAt: string;
 }
 /**
- * 「这一行已经走到**终局**了吗」——`RunRecord["status"]`(= `"running" | TaskStatus`)的**穷举**判据,
- * 与类型定义同住一个文件(词表的属主 = 判据的属主)。
+ * `RunRecord["status"]`(= `"running" | TaskStatus`)的**唯一分类表** —— 词表的属主 = 判据的属主,
+ * 与类型定义同住一个文件。四个类:
+ *  · `live` —— 还在跑;
+ *  · `succeeded` —— 成功终局;
+ *  · `unsuccessful` —— **非成功**终局。两个词:`failed`(限额/供应商/中止/无效输出)与 `blocked`
+ *    —— 后者是 core `TerminalCause` 的 `{kind:"blocked", reason}`,d.ts 逐字为「the agent could not
+ *    finish and said why」= **agent 自报的终态**(说完就结束,不等人、不留 checkpoint)。它**不是**
+ *    治理判决:门拒绝那条腿在 core 里走 `paused`/`failed`,永远不铸这个词;
+ *  · `parked` —— 停在门上还能再动(`suspended` 审批/资源门、`needs_review` 评审门)。
  *
- * 🔴 为什么是 `switch` 而不是一张 `ReadonlySet<string>`(2026-08-08,[ref] 二轮扫描 finding):终局词表
- * **真变过**(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 里删了)。而集合形的门对象是 `string`,对词表
- * 两个方向都无钉:
- *   · **增词**(core 新加一个终局态)⇒ 集合不含它 ⇒ 该行被静默判成「非终局」,收敛器会一直等一个
- *     永远不会再动的行;
- *   · **删词** ⇒ 集合里留一个死字面量,没有任何东西会说话。
- * 穷举 `switch` 把两个方向都变成**编译期**问题:core 加成员 ⇒ `default` 臂收不敛到 `never` ⇒ tsc 红,
- * 加成员的人被迫当场回答「这个新态算不算终局」;删成员 ⇒ 对应 `case` 变成不可达字面量、同样红。
- * 这条判据不许再被手抄成第二份 —— 两个消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts`
- * 的取消后复读)都从这里取。
+ * 🔴 为什么是**一张表**而不是三张 switch(S-213③,2026-09-11):`blocked` 这个词此前在本仓有**两个
+ * 独立写者**且答案互斥 —— `observability/run-terminal-log.ts` 判它是「治理判决,不是失败 ⇒ 不打行」,
+ * `fleet/fleet-bus.ts` 判它是「非成功终局(agent 放弃)⇒ failed 桶、行离场」。两处各自穷举、各自正确
+ * 地编译,而一条 `report_blocked` 的 run 在面板上离场、在引擎日志里一个字都没有。三张手抄的 switch
+ * 就是三个写者;收成一张表之后,词的语义只有这一处能改。
  *
- * 词表现状:终局 = completed / failed / blocked;非终局 = running / suspended / needs_review
- * (suspended 与 needs_review 都还能再动,`running` 更不必说)。
+ * 🔴 为什么这**不是**当年被否掉的 `ReadonlySet<string>`([ref] 二轮扫描 finding):那份集合的门对象是
+ * `string`,对词表两个方向都无钉 —— 增词静默判「非终局」、删词留一个死字面量没人说话。本表两个方向
+ * 都是**编译期**问题:`satisfies Readonly<Record<RunRecord["status"], RunStatusClass>>` 要求每个词都有
+ * 一行(core 加成员 ⇒ 缺行 ⇒ tsc 红,加成员的人被迫当场回答「这个新态算哪一类」),而多出一行
+ * core 已经没有的词同样红(超出键)。终局词表真变过(core 5.8.0 把 `"timeout"` 从 `TaskStatus` 删了)。
+ *
+ * 判据不许再被手抄成第二份:消费点(`approval-reconciler.ts` 判据 2、`http/routes/runs.ts` 的取消后
+ * 复读、`observability/run-terminal-log.ts` 的级别判、`fleet/fleet-bus.ts` 的 failed 桶编译钉)都从这里取。
+ */
+export type RunStatusClass = "live" | "succeeded" | "unsuccessful" | "parked";
+export declare const RUN_STATUS_CLASS: {
+    readonly running: "live";
+    readonly completed: "succeeded";
+    readonly failed: "unsuccessful";
+    readonly blocked: "unsuccessful";
+    readonly suspended: "parked";
+    readonly needs_review: "parked";
+};
+/** 表判为「非成功终局」的词——**从表派生**,不是手抄的第二份清单。今天 = `"failed" | "blocked"`。
+ *  消费点(`fleet/fleet-bus.ts` 的 failed 桶)拿它做编译期同源钉:表翻面 ⇒ 那道钉当场红。 */
+export type UnsuccessfulRunStatus = {
+    [K in RunRecord["status"]]: (typeof RUN_STATUS_CLASS)[K] extends "unsuccessful" ? K : never;
+}[RunRecord["status"]];
+/**
+ * 「这一行已经走到**终局**了吗」——终局 = 成功 or 非成功(completed / failed / blocked);
+ * 非终局 = running / suspended / needs_review(后两者都还能再动)。
+ *
+ * 未知词判**非终局**:判成「终局」的代价不可逆 —— `approval-reconciler` 判据 2 会把一张还活着的 ask
+ * 永久打成 DENIED/routing_failure,取消路由也会把这一行当终局上报。
  */
 export declare function isTerminalRunStatus(status: RunRecord["status"]): boolean;
 /**
- * 「这一行**停在门上**(park)了吗」——`RunRecord["status"]` 的第二张穷举判据,与 {@link isTerminalRunStatus}
- * 同住词表属主处(扫描P2,2026-08-12)。
+ * 「这一行的终局是**非成功**的吗」(S-213③ 的共享判据)——`failed` 与 `blocked` 两词。
+ *
+ * 🔴 它回答的问题与 {@link isTerminalRunStatus} **不同**:后者只问「还会不会再动」,本判据问「这次任务
+ * 到底成没成」。凡是「这条 run 该不该在失败面上出声/离场」的判断都读这一条,不许再手抄
+ * `=== "failed" || === "blocked"`(那正是 `blocked` 长出两个互斥读法的成因)。
+ *
+ * 未知词判**不是**非成功:对读不懂的词保持沉默,好过按 error 级刷屏。
+ */
+export declare function isUnsuccessfulRunStatus(status: RunRecord["status"]): boolean;
+/**
+ * 「这一行**停在门上**(park)了吗」(扫描P2,2026-08-12)。
  *
  * 🔴 为什么必须有名字:park 是**两个词**,不是一个 —— `suspended`(tool_approval / policy_ask / human /
  * resource_limit 门)与 `needs_review`(`plan_review` / dry-run 拦截门,写点 = 各 store 的
@@ -139,8 +177,6 @@ export declare function isTerminalRunStatus(status: RunRecord["status"]): boolea
  *
  * 未知词的方向与 {@link isTerminalRunStatus} 同向保守:判**不是** park。理由是消费点会据此做**不可逆**
  * 动作(cancel 的恢复把手会 CAS-expire 一张 checkpoint);对一个本进程读不懂的状态,少动一次远好过错杀。
- * 真正的执法点是下面那条 `never`:core 的 `TaskStatus` 一加成员就 tsc 红,加成员的人必须当场回答
- * 「这个新态算不算 park」。
  */
 export declare function isParkedRunStatus(status: RunRecord["status"]): boolean;
 /** One row of the GET /v1/sessions list (CC /resume picker): a DISTINCT session (sessionId) aggregated from its

package/dist/plugins/store-contracts.js

@@ -1,37 +1,24 @@
 import { parseJsonOr, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
+export const RUN_STATUS_CLASS = {
+    running: "live",
+    completed: "succeeded",
+    failed: "unsuccessful",
+    blocked: "unsuccessful",
+    suspended: "parked",
+    needs_review: "parked",
+};
+function runStatusClassOf(status) {
+    return RUN_STATUS_CLASS[status];
+}
 export function isTerminalRunStatus(status) {
-    switch (status) {
-        case "completed":
-        case "failed":
-        case "blocked":
-            return true;
-        case "running":
-        case "suspended":
-        case "needs_review":
-            return false;
-        default: {
-            const unhandled = status;
-            void unhandled;
-            return false;
-        }
-    }
+    const cls = runStatusClassOf(status);
+    return cls === "succeeded" || cls === "unsuccessful";
+}
+export function isUnsuccessfulRunStatus(status) {
+    return runStatusClassOf(status) === "unsuccessful";
 }
 export function isParkedRunStatus(status) {
-    switch (status) {
-        case "suspended":
-        case "needs_review":
-            return true;
-        case "running":
-        case "completed":
-        case "failed":
-        case "blocked":
-            return false;
-        default: {
-            const unhandled = status;
-            void unhandled;
-            return false;
-        }
-    }
+    return runStatusClassOf(status) === "parked";
 }
 export function mapBakeRow(r) {
     return {

package/dist/plugins/workflow-run-store-sql.d.ts

@@ -59,7 +59,7 @@ import type { Pool as PgPool } from "pg";
 import { summarizeWorkflowRun, type WorkflowRunStore } from "@sema-agent/core";
 import { type WorkflowCompletionInbox, type WorkflowCompletionInboxEntry } from "../orchestration/workflow-completion-inbox.js";
 import type { WorkflowNotifyJournalStore, WorkflowNotifyJournalEntry } from "../orchestration/workflow-notify-journal.js";
-import type { WorkflowAgentSessionIndex, WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
+import { type WorkflowAgentSessionIndex, type WorkflowAgentSessionRow } from "../orchestration/workflow-agent-session-index.js";
 import { type SqlDriver } from "./sql-driver.js";
 type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 /** Row cap guard: a run blob beyond this is NOT stored on update (the prior revision stays) — TiDB's
@@ -68,19 +68,41 @@ type WorkflowRun = Parameters<WorkflowRunStore["put"]>[1];
 export declare const MAX_RUN_BLOB_BYTES: number;
 declare const onWarnType: (msg: string, meta: Record<string, unknown>) => void;
 export type InboxWarn = typeof onWarnType;
-/** Review fix (1.108, lens④ HIGH): an oversize blob must NOT fail the update outright — core's persist chain
- *  treats `false` as a CAS loss and does NOT advance its tracked rev, so once a run outgrows the cap EVERY later
- *  write (including the TERMINAL one) keeps failing → the durable row is stuck `running` forever and the 24h
- *  orphan sweep finalizes a genuinely-completed run as `abandoned`. Instead degrade the PAYLOAD, not the write:
- *  step 1 truncate the two unbounded strings (result/error); step 2 drop the heavy arrays (phases/agents/groups)
- *  with an explicit marker. Returns null only when even the skeleton is oversize (physics — caller keeps the
- *  prior revision, matching the old behavior for that corner). Dialect-neutral (pure JS, no SQL) — shared
- *  verbatim by both twins. */
 /** S-107:workflow_run 行的 `error`(脚本抛出的 `err.message`,core 源头不脱)在**两条写腿**(put / update 常态 + oversize 降级)
  *  同一口脱;`result` 由 core 完成时源头脱。幂等,不抛(超大 ⇒ 占位)。 */
 export declare function withRedactedError<T extends {
     error?: string | undefined;
 }>(run: T): T;
+/** Review fix (1.108, lens④ HIGH): an oversize blob must NOT fail the update outright — core's persist chain
+ *  treats `false` as a CAS loss and does NOT advance its tracked rev, so once a run outgrows the cap EVERY later
+ *  write (including the TERMINAL one) keeps failing → the durable row is stuck `running` forever and the 24h
+ *  orphan sweep finalizes a genuinely-completed run as `abandoned`. Instead degrade the PAYLOAD, not the write.
+ *
+ *  🔴 **S-192(7.71.0):瘦身只裁展示载荷,parked 行的恢复身份是最后才放弃的东西。**
+ *  病(修前逐字):step2 写作 `agents: []` ⇒ 一只 parked 的 workflow 子代的 `callKey` / `sessionId` /
+ *  `parkedCheckpointToken` 随整段消失。server 侧复核「这条 park 仍在此 token 下」的依据**只有这一行**(join 索引
+ *  刻意不存它——它是能力;引擎自己的赎回键另住 resume journal),于是 `/decide` 的 workflow 车道在 `run.agents`
+ *  里找不到那一行 ⇒ 落 legacy 腿拿一个**错因**的 409 `conflict.resume_context_unavailable`,人的批准无处兑付;
+ *  同时 core resume 路径上那道「blob 里 parked 而 journal 缺条目 ⇒ 拒 resume」的防线(`prior.agents`)也随之失明。
+ *
+ *  阶梯 = 一张**按价值排序的放弃清单**,一级一级试到装得下为止(**判据只有一条:恢复身份最后放弃**):
+ *    step 1 —— 两个无界字符串(`result` / `error`)截断带标记;
+ *    step 2 —— `phases` / `groups` 整段丢,`agents` 收敛成**恢复身份行**
+ *              ({@link buildParkedRecoveryIdentities};非 parked 的行不带恢复身份 ⇒ 整行丢,与修前同);
+ *    step 3 —— 顶层**观测载荷**(codex r1-[high],红先复现后修):`effectiveArgs` 与 `resultFull` 整段丢、
+ *              `name` / `description` 先脱后切。core 对 `effectiveArgs` 的成文口径逐字是 OBSERVATION-ONLY
+ *              (never a gate input,never re-read by the engine;resume 的身份由 journal 的 callKey 携带,
+ *              不是这个字段),`resultFull` 同类(取回面),两者都**无界**。修前这一级不存在,于是阶梯
+ *              一边原样留着它们、一边把唯一那条 parked 行删掉盖标记 —— 自己违反了自己那条判据,
+ *              一条本来赎得回的审批被判死(生产上界 4 MiB 上真复现);
+ *    step 4 —— 恢复身份行上的**展示名**(`label`)—— 它是这条行上唯一可弃的展示物,身份四位恒在
+ *              (codex r2-[high],红先复现后修:修前阶梯一边留着每行 200 字符的 label、一边把**全部**身份
+ *              删掉盖标记 —— 同一条判据第二次被自己违反;6000 条 CJK label 的 parked 行在生产上界上
+ *              实测 `agents:[]` + `parks:6000`,而清空 label 后 6000 条身份**全都装得下**);
+ *    step 5 —— 连只剩身份的行都装不下 ⇒ 丢掉它们并落**显式不可恢复标记**({@link PARK_IDENTITY_LOSS_KEY}),
+ *              `/decide` 与 SLA sweep 读到它就**响亮拒**,而不是让一条赎回不了的 park 看起来像普通 miss。
+ *  Returns null only when even the marked skeleton is oversize (physics — caller keeps the prior revision,
+ *  matching the old behavior for that corner). Dialect-neutral (pure JS, no SQL) — shared verbatim by both twins. */
 export declare function slimOversizeRun(run: WorkflowRun & {
     id: string;
     scope: string;

package/dist/plugins/workflow-run-store-sql.js

@@ -1,9 +1,11 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { summarizeWorkflowRun, isTerminalWorkflowStatus, WorkflowRunStoreError } from "@sema-agent/core";
 import { foldKeyFamily, MAX_PENDING_PER_SESSION, PURGE_FENCE_MS, SERVED_FENCE_MS, } from "../orchestration/workflow-completion-inbox.js";
+import { buildParkedRecoveryIdentities, buildParkIdentityLoss, PARK_IDENTITY_LOSS_KEY } from "../orchestration/workflow-agent-session-index.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 export const MAX_RUN_BLOB_BYTES = 4 * 1024 * 1024;
+const SLIM_HEADER_MAX = 200;
 const onWarnType = (msg, meta) => void [msg, meta];
 export function withRedactedError(run) {
     if (typeof run.error !== "string")
@@ -22,8 +24,33 @@ export function slimOversizeRun(run, maxBytes) {
     let blob = JSON.stringify(step1);
     if (Buffer.byteLength(blob) <= maxBytes)
         return blob;
-    const step2 = { ...step1, phases: [], agents: [], groups: [], error: step1.error ? String(step1.error).slice(0, 1000) + MARK : MARK };
+    const identities = buildParkedRecoveryIdentities(run.agents);
+    const shortError = step1.error ? String(step1.error).slice(0, 1000) + MARK : MARK;
+    const step2 = { ...step1, phases: [], agents: identities, groups: [], error: shortError };
     blob = JSON.stringify(step2);
+    if (Buffer.byteLength(blob) <= maxBytes)
+        return blob;
+    const step3 = { ...step2 };
+    delete step3.effectiveArgs;
+    delete step3.resultFull;
+    if (typeof step3.name === "string")
+        step3.name = redactHead(step3.name, SLIM_HEADER_MAX);
+    if (typeof step3.description === "string")
+        step3.description = redactHead(step3.description, SLIM_HEADER_MAX);
+    blob = JSON.stringify(step3);
+    if (Buffer.byteLength(blob) <= maxBytes)
+        return blob;
+    const bareIdentities = buildParkedRecoveryIdentities(run.agents, 0);
+    const step4 = { ...step3, agents: bareIdentities };
+    blob = JSON.stringify(step4);
+    if (Buffer.byteLength(blob) <= maxBytes)
+        return blob;
+    const step5 = {
+        ...step4,
+        agents: [],
+        ...(identities.length > 0 ? { [PARK_IDENTITY_LOSS_KEY]: buildParkIdentityLoss(identities.length) } : {}),
+    };
+    blob = JSON.stringify(step5);
     return Buffer.byteLength(blob) <= maxBytes ? blob : null;
 }
 export class SqlWorkflowRunStore {

package/dist/run-local.js

@@ -19,6 +19,7 @@ import { loadConfig, logConfigDiagnostics, parseNumOrFailNonNegative } from "./c
 import { createConfigProvider } from "./config-provider.js";
 import { applyEffective, applyCenterReadFace, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./config-center/facade.js";
 import { hostExecutionEnvFactory } from "./plugins/remote-env-host.js";
+import { executionLaneHomeDir } from "./execution-lane-caps.js";
 import { makeLoadProjectMemory, makeProbeInstructionSources } from "./project-memory.js";
 import { loadSkills } from "./capabilities/skills.js";
 import { createRepoClient } from "./capabilities/repo-tools.js";
@@ -273,6 +274,7 @@ export async function runLocal(argv, deps = {}) {
     const executionEnvFactory = hostRx
         ? hostExecutionEnvFactory({
             workspaceDir,
+            ...((h) => (h === undefined ? {} : { homeDir: h }))(executionLaneHomeDir(config)),
             backgroundShell: config.requirePrincipal !== true,
             ...(hostRx.commandTimeoutMs != null ? { commandTimeoutMs: hostRx.commandTimeoutMs } : {}),
         })
@@ -369,6 +371,7 @@ export async function runLocal(argv, deps = {}) {
         ],
     });
     const sharedRunnerDeps = createSharedRunnerDeps({
+        metrics,
         config,
         governanceSeams,
         logger,

package/dist/task-a2a.js

@@ -1,4 +1,4 @@
-import { resolveComplianceDenies } from "@sema-agent/core";
+import { resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
 export function a2aInjectionHonored(config) {
@@ -19,7 +19,7 @@ function normalizeA2aPeer(e) {
     if (!e || typeof e !== "object")
         return null;
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 128)
+    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
         return null;
     if (typeof o.url !== "string" || !HTTP_URL_RE.test(o.url))
         return null;

package/dist/task-mcp.js

@@ -1,4 +1,4 @@
-import { mcpInjectionDroppedNotice, resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, resolveComplianceDenies, TOOL_WIRE_NAME_MAX_CHARS } from "@sema-agent/core";
 import { HttpError } from "./security.js";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "./mcp-content-origin.js";
 import { readMcpSourceLabel } from "./mcp-source-label.js";
@@ -26,7 +26,7 @@ function normalizeServer(e, noteBadOrigin) {
     if (!e || typeof e !== "object")
         return bad("entry");
     const o = e;
-    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > 128)
+    if (typeof o.name !== "string" || o.name.length === 0 || o.name.length > TOOL_WIRE_NAME_MAX_CHARS)
         return bad("name");
     const t = o.transport;
     if (!t || typeof t !== "object")

package/dist/task-settings.d.ts

@@ -312,15 +312,28 @@ export interface FsWriteGateWiring {
     /**
      * 🔴 S-177 / codex r2 [high](验真后修)—— **执行环境的 home**(core `PathRuleBases.home`,`~/…` 形的基)。
      *
-     * core 对缺席的 `home` 回落 `os.homedir()` —— 那是**这个 server 进程**的 home。引擎与执行同机时它就是
-     * 对的;**远端车道**(SSH / 容器 / 沙箱)上执行用户的 home 与 server 的 home 是两个目录,于是
-     * `deny Edit(~/.sema/**)` 编译成功、却拿 server 的 home 去匹配远端的目标 ⇒ 一条收紧规则**静默失效**
-     * (与 `taskRoot` 那条哨兵病同族、同方向)。
+     * 🔴 **S-213④ 起本字段在远端车道上也可以有值**:四只远端 adapter 此前一个都不声明 `ExecutionEnv.homeDir`,
+     * 而本字段那时只在 `remoteExec` 整个缺席时才铸 —— 于是**每一条远端部署的 `~/` 规则都恒 422**(接入审计
+     * M13)。修法不是放松下面那道门,而是让部署**真的知道** home:`execution-lane-caps.ts` 的
+     * `executionLaneHomeDir` 是唯一属主,`boot/execution-env.ts` 把它递给 adapter 的 `homeDir` 座、
+     * `boot/resolve-spec.ts` / `boot/parked-revive-gate.ts` 把**同一个值**递成本字段。两处同源是承重的:
+     * 各算一份就会出现「422 门放行而引擎判 unreadable」或反过来。
      *
-     * ⇒ 本字段只在 home **真知道**时在场(引擎与执行同机)。缺席时,`~/` 形的规则由
-     * {@link rejectUnmatchableSettingsNames} **响亮拒**(422),绝不回落到 server 的 home。
-     * ⚠️ 上游缺口如实登记:core 今天没有「这条规则需要哪些 base」的查询口,也不把 `home` 当必答项 ——
-     * 所以「这条规则用了 `~/` 吗」由本仓读**core 自己解析出的规范 command**(`~/` 前缀)来判,不自铸文法。
+     * 🔴 **S-213⑦ 改真话**(亲读 core 7.12.0 `dist/core/permission-rule-model.js:365-372` /
+     * `:340-350`,推翻本注此前的两句):
+     *  · core 对缺席的 `home` **不**回落 `os.homedir()` —— `resolvePathPattern` 走
+     *    `lexicalNormalAbsolutePathOf(baseValueOf("home", bases) ?? "")`,base 缺席 ⇒ `undefined` ⇒ 直接回
+     *    `{missingBase:"home"}`,该调用的射程判 `unreadable`(fail-closed 的 ask,人来清),从不猜一个目录。
+     *    换言之引擎侧本来就没有「拿 server 的 home 去匹配远端目标」这条静默腿(那句旧注是本仓自己的推断)。
+     *  · core **有**「这条规则需要哪些 base」的查询口 —— 根导出的 `ruleBasesNeeded(rule)`
+     *    (`//abs` ⇒ 空、`~/` ⇒ `["home"]`、`/x` ⇒ `["root"]`、其余 ⇒ `["cwd"]`),`resolvePathPattern`
+     *    自己也读它。本仓的判据腿今天读的是 core 解析出的规范 command 前缀,与该查询口**同一分类**、
+     *    不是第二套文法;两者哪天分叉由这条注负责被人看见。
+     *
+     * ⇒ 本字段在**这条部署的执行车道 home 已知**时在场(`executionLaneHomeDir`,见 `execution-lane-caps.ts`)。
+     * 缺席时 `~/` 形规则由 {@link rejectUnmatchableSettingsNames} **响亮拒**(422),而不是让它编译成一条
+     * core 只会判 `unreadable` 的规则 —— 两道门同向(都不猜目录),422 只是把同一个拒挪到更早、更响的地方:
+     * 运维在**下单那一刻**就知道这条规则这条车道读不了,而不是等到跑起来每次都弹一张 ask。
      */
     taskHome?: string;
     /** The session scratchpad dir (envFacts.scratchpadDir, [ref]③) — writes there are always auto-allowed. */

package/dist/task-settings.js

@@ -279,8 +279,8 @@ function rejectUnmatchableSettingsNames(perms, pathBases) {
                 const parsed = parseRuleText(name, behavior);
                 if ("rule" in parsed && ruleToolGrammarOf(parsed.rule.tool) === "path" && parsed.rule.command.startsWith("~/")) {
                     throw new Error(`${field} has a home-relative path rule (${name}) but this deployment cannot resolve the EXECUTION environment's home directory — ` +
-                        `on a remote lane the engine's own home is a different user's directory, so the rule would compile and then match nothing that runs. ` +
-                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), or run the task on a lane whose home this worker knows.`);
+                        `the engine never guesses one: without a home base the rule resolves to "unreadable" and every matching call stops to ask, so it guards nothing. ` +
+                        `Spell the path absolutely (${"Edit(//abs/path/**)"} form), declare the lane's home with REMOTE_EXEC_HOME_DIR, or run the task on a lane whose home this worker knows.`);
                 }
             }
         }