@sema-agent/server 7.73.1 → 7.74.0

package/USAGE.md

@@ -974,6 +974,14 @@ curl -s http://<host>:8090/v1/runs/<taskId> -H 'x-agent-principal: user:42'   #
 > (仅 contents/pull-requests 只读)。未知词拒启;`GIT_API_BASEURL` 指向 github.com 族而 kind 仍是
 > gitea 也拒启并指路(Gitea 形状对 GitHub 恒 404,启动即报优于运行时逐调用 404)。
 
+> **⚠️ 升级注记(7.74.0):升级前把未决的 workflow park 决掉。** 本版起引擎对**任何**没有 `parks` 这一位的
+> 历史 workflow run 记录,在派发任何 agent **之前**整条拒绝 `Workflow({resumeFromRunId})`
+> (`workflow.park_truth_unreadable`,`detail.reason: "parks_unreadable"`)。那一位是本版引擎才开始写的,所以
+> 所有**升级前**写下的 workflow run 记录都算数。这是刻意的:把旧记录读成「这条 run 没有 park」会让一只已经
+> 停在人工审批上的子代被**重跑一遍**(付费 + 外部副作用)。**处置**:升级窗内把未决的 park 走
+> `POST /v1/approvals/:sessionId/decide` 决掉,或对那些 run 起一条**新**的 run —— 不要 resume 旧记录。存量行
+> 不需要清理(只在被 resume 时读,拒绝是逐次的、不留残留状态)。**本版不做兼容读腿。**
+
 > **升级注记(7.7.0)**:本版起 `code-review` / `scan` / `discuss`(7.28.0 前叫 `team`)/ `toolset: repo-readonly|none` 的场景改跑
 > 无执行环境的引擎。**升级前**若还有这些场景的 durable 挂起任务(需同时满足:配了 `REMOTE_EXEC`、开了
 > `DURABLE_APPROVAL`、任务已 park),它们在新版上续跑会以 409 `checkpoint.unsupported_version` 响亮失败

package/dist/boot/runner-deps.d.ts

@@ -160,10 +160,6 @@ export interface RunnerDepsCtx {
     /** [ref] per-edited-file rewind history (core `RunnerDeps.fileHistoryStore`; replaces the retired E19
      *  whole-tree snapshot seat — core 94632197 renamed the seat, not a coexistence). WIRING IS THE OPT-IN. */
     fileHistoryStore: ReturnType<StoreBackend["fileHistory"]> | undefined;
-    /** S-1 legacy-epoch discriminant (core `RunnerDeps.legacyRewindBoundaryProbe`): lets the rewind refusal
-     *  distinguish "never existed / reaped" from "exists in the RETIRED whole-tree epoch". Consulted only on
-     *  the refusal path; diagnostic input, never a control input (a bad probe cannot change the outcome). */
-    legacyRewindBoundaryProbe: RunnerDeps["legacyRewindBoundaryProbe"];
     /** [ref] 车二:持久化权限规则店 provider(core `RunnerDeps.permissionRuleStore`)。缺席 ⇒ 引擎的
      *  `permissionRules.storeWired` 如实报 false、`AskRequest.ruleOffers` 不铸(诚实缺席)。 */
     permissionRuleStore: RunnerDeps["permissionRuleStore"];

package/dist/boot/runner-deps.js

@@ -91,7 +91,7 @@ export function createSharedRunnerDeps(ctx) {
     return shared;
 }
 export function createRunnerDeps(ctx) {
-    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, legacyRewindBoundaryProbe, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
+    const { config, logger, metrics, localRoot, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine, sessionCaptureRecords, memorySyncRunner, runtimeCapsResolver, fileHistoryStore, permissionRuleStore, fleetBus, workflowRunStore, workflowJournalStore, workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, getRunStore, sessionShellGateExplicitlyOff, } = ctx;
     const memoryEngineIncident = createMemoryEngineIncidentSink({ logger, metrics });
     const sharedRunnerDeps = createSharedRunnerDeps(ctx);
     const workflowModelAllowlist = workflowModelAllowlistFor(config);
@@ -185,7 +185,6 @@ export function createRunnerDeps(ctx) {
             : undefined,
         runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
         fileHistoryStore: fileHistoryStore ? fileHistoryStore : undefined,
-        legacyRewindBoundaryProbe: legacyRewindBoundaryProbe ? legacyRewindBoundaryProbe : undefined,
         permissionRuleStore: permissionRuleStore ? permissionRuleStore : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
         loadProjectMemory: config.requirePrincipal !== true && config.projectMemoryEnabled ? makeLoadProjectMemory({ logger }) : undefined,

package/dist/boot/session-faces.js

@@ -77,8 +77,6 @@ export function createSessionFaces(ctx) {
                     });
                 }
             }
-            if (backend?.legacySnapshotPurge)
-                await backend.legacySnapshotPurge(sessionId);
             if (workflowCompletionInbox)
                 await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: String(err) }));
             await purgeScratchpadDir(config.localDataRoot ?? localRoot, sessionId);

package/dist/boot/stores.js

@@ -15,6 +15,7 @@ import { PgRosterStore, TiDBRosterStore, ensurePgRosterSchema, ensureTiDBRosterS
 import { LocalTaskAttachmentStore } from "../plugins/local-task-attachment-store.js";
 import { PgTaskAttachmentStore, TiDBTaskAttachmentStore, ensurePgTaskAttachmentSchema, ensureTiDBTaskAttachmentSchema } from "../plugins/task-attachment-store.js";
 import { createSessionStore } from "../plugins/session-store.js";
+import { logOneTimeMigrations } from "../plugins/one-time-migrations.js";
 import { createTaskListLane } from "./task-list-lane.js";
 import { ensurePgTaskListSchema, ensureTiDBTaskListSchema } from "../plugins/task-list-store-sql.js";
 import { assertDeviceAuditRebindEventSchema, ensurePgDeviceSchema, ensureTiDBDeviceSchema } from "../plugins/device-store-sql.js";
@@ -85,23 +86,9 @@ export async function openStores(ctx) {
             await assertFileHistorySchema(async (sql) => ({ rows: (await pgPool.query(sql)).rows }), "pg");
         else if (mysqlPool)
             await assertFileHistorySchema(async (sql) => ({ rows: (await mysqlPool.query(sql))[0] }), "tidb");
-        {
-            const legacyProbeSql = "SELECT 1 FROM snapshot_manifest LIMIT 1";
-            const hasLegacyRows = await (pgPool
-                ? pgPool.query(legacyProbeSql).then((r) => r.rows.length > 0)
-                : mysqlPool
-                    ? mysqlPool.query(legacyProbeSql).then(([rows]) => rows.length > 0)
-                    : Promise.resolve(false)).catch(() => false);
-            if (hasLegacyRows) {
-                logger.warn("legacy_snapshot_epoch_rows_present", {
-                    note: "rows from the RETIRED whole-tree snapshot epoch (snapshot_manifest/snapshot_blob) exist. They are NOT " +
-                        "migrated (whole-tree manifests and per-file history are structurally different); rewind refusals for " +
-                        "legacy-era boundaries name the retired epoch via the boundary probe; the retention lane keeps sweeping " +
-                        "these rows by session, and the maintenance tick GCs their orphaned blob bytes.",
-                });
-            }
-        }
     }
+    if (backend)
+        logOneTimeMigrations(logger, backend.kind, await backend.runOneTimeMigrations());
     if ((process.env.REWIND_SNAPSHOT_MAX_MB ?? "") !== "") {
         logger.warn("rewind_snapshot_max_mb_retired", {
             note: "REWIND_SNAPSHOT_MAX_MB no longer has an effect: the whole-tree snapshot epoch is retired (S-15); per-edited-file history captures only files the agent touches, with no tree walk and no size gate. Remove the env var. Per-blob SQL sizing is governed by SNAPSHOT_BLOB_SQL_MAX_BYTES / object storage as before.",

package/dist/config-types.d.ts

@@ -861,7 +861,7 @@ export interface ServiceConfigFlat {
     dbQueryTimeoutMs?: number;
     /** Object-store offload for the E19/2c file-snapshot BLOBS (clay 2026-06-26). The conversation TRANSCRIPT stays
      *  DB-first; ONLY the snapshot BYTES (binary file content, up to ~64 MiB/file — a perf-suboptimal TiDB blob row) move
-     *  to MinIO. The snapshot MANIFEST (relPath→hash) STAYS in SQL (`snapshot_manifest`), so the transcript hot read never
+     *  to MinIO. The file-history MANIFEST (relPath→hash) STAYS in SQL, so the transcript hot read never
      *  touches MinIO. Built (by the tidb/pg StoreBackend) into a MinioBlobBackend iff MINIO_ENDPOINT + MINIO_ACCESS_KEY +
      *  MINIO_SECRET_KEY are all set — else the file-snapshot stores keep the SQL `snapshot_blob` default (byte-identical to
      *  today). Reuses the SAME MinIO env names as the k8s workspace-snapshot lane (zero remap). */

package/dist/deployment-governance.d.ts

@@ -118,8 +118,10 @@ export declare function createDurableQuestionGate(live: LiveQuestionFace | undef
  *  · **覆盖面(2026-08-08 按 core 5.19.0 [ref] 校正;旧文见下方「历史」段)**:本层只在
  *    `ToolCallRequest.cwd` **缺席**那一形上说话。core 5.19.0 起每条路径解析型守卫按 `req.cwd ?? rootPath`
  *    解析写目标(dist `core/sensitive-path-policy.js`),而 `canonicalizeTarget` 拿到 baseCwd 后会先把
- *    相对形**拼成绝对形**再交给 env(dist `tools/fs/safety.js` 的 `baseCwd && !isAbsolutePathForm(...)`
- *    分支)—— 本层的 `absolutePath` 对绝对形一律报错弃权 ⇒ **有戳时本层自动让位**,由真身那一层
+ *    相对形**拼成绝对形**再交给 env(dist `tools/fs/safety.js` 的 `canonicalizeTarget`,7.17.0 起该分支是
+ *    `baseCwd && !isAbsoluteForFamily(family, spelled) ? joinForFamily(family, baseCwd, spelled) : spelled`
+ *    —— [ref] 把「算不算绝对 / 怎么拼」双双改成**按树的家族**判,旧注引的 `isAbsolutePathForm` 那一行已不是
+ *    这里的实现行;**结论不变**,本层仍是「有戳时自动让位」)—— 本层的 `absolutePath` 对绝对形一律报错弃权 ⇒ **有戳时本层自动让位**,由真身那一层
  *    (沙箱 `DeferredSandboxPathEnv` / host `NodeExecutionEnv`)按活 cwd 裁决,cwd 里的守卫段现在真看得见。
  *    ⇒ 本层今天的射程 = 「引擎没盖戳」的调用:相对形**自身拼写**里带守卫段的那一类(`Write(".env")`、
  *    `Write("cfg/.ssh/id_rsa")`),仍由本层 fail-closed 兜住。**不删臂**:让位与冗余不是一回事——
@@ -137,8 +139,25 @@ export declare function createDurableQuestionGate(live: LiveQuestionFace | undef
  *    [ref],已在 5.19.0 到货**,两条钉按上述翻面完毕。另一条备选收口(守卫集开启即把沙箱 lane 相对写
  *    一律 deny,有真受损方且无对应旋钮)因此作废,无需部署方拍板。
  */
+/**
+ * 沙箱 lane 两层守卫的**显式**分工(core 7.17.1 起必须显式,不能再靠「让 `absolutePath` 失败」隐式弃权):
+ * `createSensitivePathPolicy` 对 canon 失败自 7.17.1 一律 `deny` 并点名 cause(它闭掉的正是本仓 [ref]② 上板的
+ * 自拒形放行洞)。旧形里两层都拿「判不了 ⇒ core 判 allow」当让位:真身层对**缺戳相对形**报错(沙箱 cwd 不是
+ * 门能猜的,[ref] 裁定 1)、词法层对**绝对形**报错 —— 新引擎上两处都翻成硬拒,沙箱 lane 的每一次写都被拒(提货批
+ * 14 格红)。让位与「判不了」是两件事:让位是**本层的**决定,要由本层自己说出来。分工(与两层类注一致,一字未改):
+ *  · 真身层(`DeferredSandboxPathEnv`)判 **绝对形 / 带 `req.cwd` 戳的相对形**(core 按戳解析进真身);
+ *  · 词法层(`RelativeTargetLexicalEnv`)判 **缺戳相对形**(自身拼写里的守卫段,fail-closed);
+ *  两层射程互补、无重叠、无缝隙;各自射程外**显式 allow**(= 让位给另一层),canon 失败留给真的判不了的形
+ *  (UNC/NUL/越根)—— 那正是 7.17.1 要 deny 的。提取写目标用 core 自家 `protectivePathTargetOf` + `pathTargetValue`
+ *  (与 core 守卫策略同一只提取器,零复刻);「算不算绝对」用 core `isAbsoluteForFamily(undefined, …)`(沙箱 lane
+ *  无 root/cwd 声明 ⇒ 家族 undefined ⇒ 只认 `/`-rooted,与引擎同一律)。
+ */
+type WriteTargetForm = "unstamped-relative" | "absolute-or-stamped";
+/** 只在 `form` 那一类写目标上说话,其余显式 allow(让位);非写调用与提不出目标的调用原样交给 policy(它自己判 allow)。 */
+export declare function scopedToWriteTargetForm(policy: ToolPolicy, form: WriteTargetForm): ToolPolicy;
 export declare class RelativeTargetLexicalEnv extends StubExecutionEnv {
-    /** 相对形 → `/<词法归一>`;绝对形 / 空串 / 含 NUL 一律报错(= 弃权,见类注)。 */
+    /** 相对形 → `/<词法归一>`;绝对形 / 空串 / 含 NUL 一律报错(fail-closed 守底:`relativeTargetsOnly` 已把这些形挡在外面,
+     *  这里不会再被绝对形命中;若有人绕过包装直接用本 env,报错在 7.17.1 上读作 deny,方向仍是保守)。 */
     absolutePath(path: string): Promise<Result<string, FileError>>;
     /** 恒「不存在」⇒ core 的 `canonicalizeNewPath` 逐级回退,最终把词法归一形当 canonical key 交给段匹配。
      *  这里绝不能报错:报错会被 core 读成 `unresolvedSymlink` 而对**每一个**相对目标 deny(含普通文件)。 */
@@ -205,4 +224,5 @@ export declare function createDeploymentGovernanceInputs(config: DeploymentGover
  * 本口只按调用方给的形铸策略,绝不替它判「这个部署该不该有门」。
  */
 export declare function createApprovalBaselinePolicy(config: ApprovalBaselineConfigView, durable?: DurableApprovalSeat): ToolPolicy;
+export {};
 //# sourceMappingURL=deployment-governance.d.ts.map

package/dist/deployment-governance.js

@@ -1,5 +1,5 @@
 import { join, posix } from "node:path";
-import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, ok, } from "@sema-agent/core";
+import { FileError, StubExecutionEnv, combinePolicies, createAllowDenyPolicy, createDurableQuestionPolicy, createSensitivePathPolicy, createTranscriptIntegrityPolicy, err, isAbsoluteForFamily, isProtectedWrite, ok, pathTargetValue, protectivePathTargetOf, } from "@sema-agent/core";
 import { createDurableAskPolicy } from "./approval.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "./approval-content-kind.js";
 export function createDurableQuestionGate(live) {
@@ -15,6 +15,27 @@ export function createDurableQuestionGate(live) {
         },
     };
 }
+function writeTargetFormOf(req) {
+    if (!isProtectedWrite(req))
+        return undefined;
+    const pt = protectivePathTargetOf(req);
+    const target = pt === undefined ? undefined : pathTargetValue(req.args, pt);
+    if (typeof target !== "string" || target.length === 0)
+        return undefined;
+    if (req.cwd !== undefined || target.includes("\u0000") || isAbsoluteForFamily(undefined, target))
+        return "absolute-or-stamped";
+    return "unstamped-relative";
+}
+export function scopedToWriteTargetForm(policy, form) {
+    return {
+        async check(req, signal) {
+            const actual = writeTargetFormOf(req);
+            if (actual !== undefined && actual !== form)
+                return { action: "allow" };
+            return policy.check(req, signal);
+        },
+    };
+}
 export class RelativeTargetLexicalEnv extends StubExecutionEnv {
     absolutePath(path) {
         if (path.length === 0 || path.startsWith("/") || path.includes("\u0000")) {
@@ -64,7 +85,7 @@ export function createDeploymentGovernanceInputs(config, pathAdjudication, roots
             const withTranscripts = (p) => (transcriptGuard ? combinePolicies(p, transcriptGuard) : p);
             if (pathAdjudication.cwd !== undefined)
                 return withTranscripts(realTarget);
-            return withTranscripts(combinePolicies(realTarget, createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...dataRootOpt })));
+            return withTranscripts(combinePolicies(scopedToWriteTargetForm(realTarget, "absolute-or-stamped"), scopedToWriteTargetForm(createSensitivePathPolicy({ env: new RelativeTargetLexicalEnv(), patterns: config.sensitiveWritePatterns, ...dataRootOpt }), "unstamped-relative")));
         })()
         : undefined;
     return {

package/dist/env-facts.d.ts

@@ -83,7 +83,14 @@ export declare function ensureScratchpadDir(localDataRoot: string, sessionId: st
  *   - mkdir -p 确保存在(gate 的 canonicalize 与 core 根围栏都要真目录)。
  *  敏感路径的最后一道**不在**写门折叠里([ref] 起搬家):守卫集 `SENSITIVE_WRITE_PATTERNS` 由
  *  governance 拍(boot/resolve-spec.ts → applyRuntimeGovernance)无条件铸成 DENY 基线,经 tightenTaskSpec
- *  与写门 deny-wins 折叠 —— 结论不变(deny 恒赢,本函数放出的 exemptDirs 越不过它),但施加点已换。 */
+ *  与写门 deny-wins 折叠 —— 结论不变(deny 恒赢,本函数放出的 exemptDirs 越不过它),但施加点已换。
+ *
+ *  🔴 **接缝登记(7.74.0 / core 7.17.0 [ref];今日无可达分歧)**:下面那道「绝对路径」闸回答的是「引擎眼里
+ *  这条豁免目录算不算绝对」——引擎自本版起按**树的家族**判(`isAbsoluteForFamily`,家族从树的 root/cwd 拼法
+ *  读,不看宿主 OS),本函数用的是 Node 宿主口径。**posix 家族两者逐字同判**(2026-09-12 实测六形全同),
+ *  而本闸又只在 `hostSemanticsLane` 上场(路径就是这台 worker 自己的盘)⇒ 今天零分歧,不改。**分歧只在 win
+ *  家族的 `/`-开头无盘符那一类**(Node 说绝对、引擎说未完全限定)。判据与坐标属主见 `task-cwd.ts` 的
+ *  {@link import("./task-cwd.js").isValidCwd} 顶注(同一条接缝,那里是唯一成文点,这里不复述第二份)。 */
 export declare function acceptShellScratchpadDir(raw: unknown, opts: {
     requirePrincipal: boolean;
     hostSemanticsLane: boolean;

package/dist/http/route-ctx.d.ts

@@ -16,7 +16,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { HostDecision } from "../host-decision.js";
-import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner, EngineNotice } from "@sema-agent/core";
+import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, RunInternals, Runner, EngineNotice } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
 import type { IdempotencyCache } from "./idempotency.js";
@@ -180,13 +180,14 @@ export interface DriveResumeArgs {
      * 🔴 **TRUSTED**:它绝不是 `TaskSpec` 字段、也绝不是工具参数(模型不能决定一次审批)。唯一的铸点是
      * `/decide` 的第三条车道(判据属主 = `parked-decide.ts` 的 `planWorkflowParkedDecide` 顶注)。
      * 缺席 ⇒ 本位对这条腿是完整 no-op,与本批之前逐字相同。
-     */
-    workflowParkedResume?: ReadonlyArray<{
-        runId: string;
-        token: string;
-        outcome: ResumeOutcome;
-        inheritedGate?: unknown;
-    }>;
+     *
+     * 🔴 **形不手抄:直接是 core 的那一位**(`NonNullable<RunInternals["workflowParkedResume"]>`)。手抄一份
+     * 结构等价的字面(本位 7.73.0 及以前就是)会让 `token: string` / `inheritedGate: unknown` 这种**更宽**的
+     * 形悄悄通过,再靠下游一个 `as NonNullable<RunInternals[...]>` 把它洗进 core 的 branded 位 —— 那个转型
+     * 正是「边界必 schema、禁自铸」要挡的东西(裸 string 当赎回键传进去,编译期一个字都不响)。派生之后
+     * core 改这一位(本版就把 `WorkflowParkedResume.outcome` 改成了可选)在本仓是**编译事件**,不是靠人去
+     * 对表的一行注。 */
+    workflowParkedResume?: NonNullable<RunInternals["workflowParkedResume"]>;
     /** [ref]([ref] Inkglow 案 → [ref]① 定谳):**200 受理语义**——调用方声明「我的消费方按 poll/SSE 跟
      *  终态,别让 HTTP 等模型往返」。在场为 `true` 时本腿在**受理点**(`resumeStream` 解析之后)立刻把
      *  `200 {taskId, status:"resuming", bindingEnforced:true}` 交回调用方,模型腿(流迭代 + 行驱动)继续

package/dist/http/routes/approvals-assistant.js

@@ -1,4 +1,4 @@
-import { screenedStoredGate } from "../../trace/project.js";
+import { screenedGate } from "../../trace/project.js";
 import { personDecision } from "../../host-decision.js";
 import { sameExecutionRecord } from "@sema-agent/core";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
@@ -87,7 +87,7 @@ async function decideIdempotentReplay(cs, args) {
                 return undefined;
             }
         }
-        return screenedStoredGate(first);
+        return screenedGate(first);
     })();
     return {
         status: 200,

package/dist/http/routes/runs.js

@@ -789,7 +789,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 taskId,
                 status: run.status,
                 turnCut: haltReceipt.turnCut,
-                note: "halt accepted — cut + stop: turnCut reports whether THIS call cut a live turn (repeat calls answer turnCut:false once the stop is latched). The run now ends at this boundary as status:\"completed\" with haltedByUser:true — resume by submitting the next objective on the same session. Each real cut is marked by a task.turn_interrupted event with detail.cause:\"user_halt\"; a halt racing the run's natural last moments reports the natural completion, still carrying the haltedByUser seat.",
+                note: "halt accepted — cut + stop: turnCut reports whether THIS call cut a live turn (repeat calls answer turnCut:false once the stop is latched). A halt that CONSUMES (it cut a turn, or stopped the loop at a boundary) ends the run at that boundary as status:\"completed\" with haltedByUser:true — resume by submitting the next objective on the same session. Each real cut is marked by a task.turn_interrupted event with detail.cause:\"user_halt\". A halt racing the run's natural last moments consumes NOTHING: the run's own ending stands (completed with the answer as result, or failed when the model's own abort owns the final) and the result does NOT carry haltedByUser — the only trace of that halt is a task.halt_unconsumed engine notice.",
             });
             return;
         }

package/dist/http/routes/workflows.js

@@ -245,6 +245,9 @@ function projectLegApprovalKeys(agent) {
         ...(approvalWaitedMs !== undefined ? { approvalWaitedMs } : {}),
     };
 }
+function projectParkRow(p) {
+    return { callKey: p.callKey, sessionId: p.sessionId, originRunId: p.originRunId };
+}
 function summarizeWorkflowDetail(run) {
     const isDone = (s) => s === "completed" || s === "failed";
     const durationOf = (a) => a.startedAt === undefined || a.endedAt === undefined ? undefined : a.endedAt - a.startedAt;
@@ -339,6 +342,7 @@ function summarizeWorkflowDetail(run) {
         rev: run.rev,
         ...(run.error !== undefined ? { error: redactErrorMessage(run.error) ?? "" } : {}),
         ...(run.errorCode !== undefined ? { errorCode: run.errorCode } : {}),
+        ...(run.parks !== undefined ? { parks: run.parks.map(projectParkRow) } : {}),
         ...(run.result !== undefined ? { result: redactSecrets(run.result) } : {}),
         phases,
         ...(unphasedView ? { unphased: unphasedView } : {}),

package/dist/http/server.js

@@ -2525,6 +2525,7 @@ const WORKER_SWAP_REDEEMABLE = {
     env_factory_missing: true,
     governed_unwired: true,
     origin_missing: true,
+    seat_retired: true,
     ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,

package/dist/main.js

@@ -277,7 +277,6 @@ async function main() {
         pricing, tracer, outcomeSink, elicitation, question, toolApproval, sessionStore, memoryEngine,
         sessionCaptureRecords,
         memorySyncRunner, toolResultStore: runnerOffloadStore, checkpointStore, sessionPolicyStore, runtimeCapsResolver, fileHistoryStore,
-        legacyRewindBoundaryProbe: backend?.legacyRewindBoundaryProbe ? backend.legacyRewindBoundaryProbe.bind(backend) : undefined,
         permissionRuleStore: permissionRuleProvider,
         executionEnvFactory, lspManager, fleetBus, deploymentHooks, workflowRunStore, workflowJournalStore,
         workflowAgentRegistry, workflowNotifyGate, workflowCompletionInbox, deliverWorkflowCompletion, orgMemoryAdmission,

package/dist/observability/fail-open.d.ts

@@ -19,7 +19,7 @@ export declare const FAIL_OPEN_TAGS: {
     };
     readonly "server.trace.gate-outcome-defective": {
         readonly cls: "F";
-        readonly note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`:写腿 `toolEndEventData` 直用;**三条**耐久读腿(投影回放 `toolResultFieldsOf`,`GET /v1/tasks/:id/turns` 与 `GET /v1/tasks/:id/stream` 共用 / 账本裸回放 `GET /v1/runs/:id/events`,经 `screenedStoredEventData` / `/decide` 幂等回放 `executionOutcome`)经 `screenedStoredGate` 认过退役词旧拼法后同走这一只筛):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集),**或投影期抛出**(S-239:`settlement.note` / `who.approver` 在 ≥2^23 单段上撞 `redactSecrets` 既有的回溯上界 —— 筛子总函数化后同走这一口,而不是逃出去断掉整条账本流)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。";
+        readonly note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`:写腿 `toolEndEventData` 直用;**三条**耐久读腿(投影回放 `toolResultFieldsOf`,`GET /v1/tasks/:id/turns` 与 `GET /v1/tasks/:id/stream` 共用 / 账本裸回放 `GET /v1/runs/:id/events`,经 `screenedStoredEventData` / `/decide` 幂等回放 `executionOutcome`)同走这一只筛,零双读 —— 本服务上一版写下的退役词旧拼法由启动期的一次性迁移在库里原地改完,读腿因此没有第二种读法):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集),**或投影期抛出**(S-239:`settlement.note` / `who.approver` 在 ≥2^23 单段上撞 `redactSecrets` 既有的回溯上界 —— 筛子总函数化后同走这一口,而不是逃出去断掉整条账本流)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。";
     };
     readonly "server.trace.tool-roster-malformed": {
         readonly cls: "F";

package/dist/observability/fail-open.js

@@ -10,7 +10,7 @@ export const FAIL_OPEN_TAGS = {
     },
     "server.trace.gate-outcome-defective": {
         cls: "F",
-        note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`:写腿 `toolEndEventData` 直用;**三条**耐久读腿(投影回放 `toolResultFieldsOf`,`GET /v1/tasks/:id/turns` 与 `GET /v1/tasks/:id/stream` 共用 / 账本裸回放 `GET /v1/runs/:id/events`,经 `screenedStoredEventData` / `/decide` 幂等回放 `executionOutcome`)经 `screenedStoredGate` 认过退役词旧拼法后同走这一只筛):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集),**或投影期抛出**(S-239:`settlement.note` / `who.approver` 在 ≥2^23 单段上撞 `redactSecrets` 既有的回溯上界 —— 筛子总函数化后同走这一口,而不是逃出去断掉整条账本流)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。",
+        note: "S-136(core 7.6.0 design/390 S6-A,`trace/project.ts` 的 `screenedGate`:写腿 `toolEndEventData` 直用;**三条**耐久读腿(投影回放 `toolResultFieldsOf`,`GET /v1/tasks/:id/turns` 与 `GET /v1/tasks/:id/stream` 共用 / 账本裸回放 `GET /v1/runs/:id/events`,经 `screenedStoredEventData` / `/decide` 幂等回放 `executionOutcome`)同走这一只筛,零双读 —— 本服务上一版写下的退役词旧拼法由启动期的一次性迁移在库里原地改完,读腿因此没有第二种读法):一条 `tool_end` / 账本行携带的 `GateOutcome` 过不了 core 的 `screenGateOutcome`(I1–I4 不变量,或某一格词出闭集),**或投影期抛出**(S-239:`settlement.note` / `who.approver` 在 ≥2^23 单段上撞 `redactSecrets` 既有的回溯上界 —— 筛子总函数化后同走这一口,而不是逃出去断掉整条账本流)⇒ **整条 gate 记录不上帧**(report + withhold,core 契约逐字给出的两种响亮形之一;绝不「静默修补」成一条自洽的记录)。放行的最坏后果=这一帧的消费端渲染不出「谁拒的 / 那次等待怎么结束的」,退回到 `isError` + 文案;它**不改变任何裁决**(门早已在 core 里判完,这里只是观测面)。反方向(把一条自相矛盾的记录照发)更坏:消费端按 I2/I3 读出来的结论会是假的。计数让「某个世代的产生者一直在发坏记录」显形。",
     },
     "server.trace.tool-roster-malformed": {
         cls: "F",

package/dist/orchestration/workflow-agent-session-index.d.ts

@@ -1,6 +1,7 @@
 /** 一条索引行:**子会话 id 是主键**(会话 id 全局唯一 ⇒ 读口天然是单行精确查,无分页假阴性)。 */
 export interface WorkflowAgentSessionRow {
-    /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = checkpoint 的 `sourceTaskId`)。 */
+    /** parked 的那只 workflow 子代自己的会话 id(= `WorkflowAgentRun.sessionId` = 那条 checkpoint 行的 `sessionId`;
+     *  **不是** `sourceTaskId` —— 后者在 core 契约上是 ECHO-ONLY、明令不可作门输入)。 */
     sessionId: string;
     /** 它所属的 workflow run(`w*`)。 */
     runId: string;
@@ -49,7 +50,7 @@ export declare const PARKED_IDENTITY_LABEL_MAX = 200;
  * 🔴 **一条 parked 行的「恢复身份」形**(S-192)—— 店层瘦身时**最后才放弃**的那一份。
  *
  * 它是一条**合法的** `WorkflowAgentRun`(core 的必填四位 `label`/`callKey`/`status`/`queuedAt` 齐全),
- * 加上赎回路由要的两位(`sessionId` = checkpoint 的 `sourceTaskId`,`parkedCheckpointToken` = 赎回键)。
+ * 加上赎回路由要的两位(`sessionId` = 那条 checkpoint 行的 `sessionId`,`parkedCheckpointToken` = 赎回键)。
  * 展示载荷(`prompt`/`output`/`activity`/`errorMessage`/`phase`/`model`…)一律不带 —— 那正是被裁掉的东西。
  *
  * 返回的是**普通数据**(build*),消费方是 `plugins/workflow-run-store-sql.ts` 的 `slimOversizeRun`。

package/dist/plugins/approval-ask-store-sql.js

@@ -96,7 +96,7 @@ export const TIDB_APPROVAL_ASK_STATEMENTS = [
     gate_bound_call_id VARCHAR(255) NULL,
     gate_bound_input_hash VARCHAR(255) NULL,
     idempotency_key VARCHAR(255) NULL,
-    -- LONGTEXT 照 image-bake/background-agent 的 pending_steer 先例:重放帧载荷可能超 64K TEXT 墙。
+    -- LONGTEXT 照 image-bake/background-agent 的载荷列先例:重放帧载荷可能超 64K TEXT 墙。
     card_json LONGTEXT NOT NULL,
     -- #363 规则车道素材两列(语义/类型理由逐字见 AskRow.ruleCommand / ruleScopeRoot 的顶注)。
     -- rule_command 与 permission_rule_approval.command 同款 LONGTEXT:命令行没有入口上限,VARCHAR

package/dist/plugins/blob-backend.d.ts

@@ -39,9 +39,8 @@ export interface BlobBackend {
  * dialect twins selected by `dialect`. Keeping the SQL byte-identical means the existing behaviour + the env-gated
  * real-DB integration suite are unchanged when MinIO is unset (the DEFAULT backend the file-snapshot stores construct).
  *
- * NOTE deleteBlobs here is the BYTE delete ONLY — it does NOT do the `NOT IN (SELECT … snapshot_manifest)` orphan
- * filter (that reference check stays in the file-snapshot store, which computes the orphan hash SET from the manifest
- * and hands it here). The grace-window `created_at < cutoff` guard is RETAINED on the delete so a just-written blob
+ * NOTE deleteBlobs here is the BYTE delete ONLY — it does NOT do the reference (`not in the manifest`) filter: that
+ * check stays in the owning store, which computes the orphan hash SET from its own domain's manifest and hands it here. The grace-window `created_at < cutoff` guard is RETAINED on the delete so a just-written blob
  * that a concurrent in-flight snapshot still needs is never byte-deleted (delete-in-use is data loss; under-delete is
  * harmless — the next sweep collects it).
  */
@@ -64,10 +63,10 @@ export declare class SqlBlobBackend implements BlobBackend {
     getBlob(hash: string): Promise<Uint8Array | undefined>;
     /** The subset of `hashes` that exist — a single `blob_hash IN (...)` SELECT (idempotency / reap probe). */
     hasBlobs(hashes: string[]): Promise<Set<string>>;
-    /** Byte-delete the given hashes (the orphan SET is computed by the caller from snapshot_manifest). Retains the
-     *  grace-window guard so a just-written blob a concurrent in-flight snapshot needs is never delete-in-use — VERBATIM
-     *  the tidb/pg stores' gcOrphanBlobs delete, minus the `NOT IN (SELECT … manifest)` clause (the caller already
-     *  excluded referenced hashes). Best-effort: a delete error is swallowed (under-delete is harmless). */
+    /** Byte-delete the given hashes (the orphan SET is computed by the CALLER from its own domain's manifest). Retains
+     *  the grace-window guard so a just-written blob a concurrent in-flight write needs is never delete-in-use — VERBATIM
+     *  the tidb/pg stores' gcOrphanBlobs delete, minus the reference clause (the caller already excluded referenced
+     *  hashes). Best-effort: a delete error is swallowed (under-delete is harmless). */
     deleteBlobs(hashes: string[]): Promise<number>;
 }
 /** SHARED index op(workspace 浏览面 #3,[ref]②)—— per-blob 字节数,读 SQL INDEX 的 `byte_len`

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -369,9 +369,9 @@ export declare const DECIDED_REPLAY_SCAN_CAP = 8;
  *     (plan_review / dry_run_review)的判词,那些门的决议入口不是本腿,回放它们等于跨门作答。
  */
 export declare function approvalDecisionOfWinner(winner: ResolvedOutcome | undefined, boundCallId: string): "approve" | "deny" | null;
-/** `pending_steer` 列承载的两个 CheckpointState 字段(= core `appendPendingSteer` / `readPendingSteerQueue`
- *  的入参形)。列是**唯一**权威(suspend 时写的 blob 从不带它们)。 */
-type SteerColumnState = Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">;
+/** `pending_steer_queue` 列承载的 CheckpointState 字段(= core `appendPendingSteer` / `readPendingSteerQueue`
+ *  的入参形)。列是**唯一**权威(suspend 时写的 blob 从不带它)。 */
+type SteerColumnState = Pick<CheckpointState, "pendingSteerQueue">;
 /** 读列结果。`lossy` = 列里有东西但**没能完整读出来**(JSON 坏 / 条目形不认)。两个调用点对它的处置
  *  刻意相反,见各自的旁注:`get()` 容忍(坏列不许把一条挂起的 run 变成不可 resume),`setPendingSteer`
  *  fail-loud(往一份读不全的队列上追加 = 把别人 park 的指令悄悄写没,正是 [ref] 要消灭的那件事)。 */
@@ -380,14 +380,17 @@ interface SteerColumnRead {
     lossy: boolean;
 }
 /**
- * 两个 steering 列 → `{pendingSteer?, pendingSteerQueue?}`(= core `appendPendingSteer`/`readPendingSteerQueue`
- * 的入参形)。**两列各管一形**,不是一列两形:
- *  · `pending_steer`(旧列,本服务只读不写)—— 裸单座 `{text, trusted}`。来源有二:队列化之前的存量行,
- *    以及**滚动升级窗里仍在跑的旧副本**写下的座。core 的 `readPendingSteerQueue` 把它折成 member 0。
- *  · `pending_steer_queue`(新列)—— `PendingSteerEntry[]`。
- * 任一列有内容却读不出 ⇒ `lossy`(两个调用点对它的处置见 {@link SteerColumnRead})。
+ * steering 列 → `{pendingSteerQueue?}`(= core `appendPendingSteer`/`readPendingSteerQueue` 的入参形)。
+ * **一列一形**:`pending_steer_queue` 存 `PendingSteerEntry[]`。
+ *
+ * 🔴 7.74.0 起只剩这**一**列。队列化之前的裸单座列 `pending_steer` 随它的席位一起退役了(core 7.17.0
+ * [ref] d:引擎对带席的行 PRE-CAS 拒 `seat_retired`),存量列由启动期的一次性迁移删掉
+ * (`plugins/one-time-migrations.ts`:列上还有非空值 ⇒ **响亮拒启**,清空后 `DROP COLUMN`)。
+ * ⇒ 这里刻意**没有**第二条读腿:双读臂的寿命就是那一次迁移,不是永远。
+ *
+ * 列有内容却读不出 ⇒ `lossy`(两个调用点对它的处置见 {@link SteerColumnRead})。
  */
-export declare function readPendingSteerColumns(seatRaw: unknown, queueRaw: unknown): SteerColumnRead;
+export declare function readPendingSteerQueueColumn(queueRaw: unknown): SteerColumnRead;
 /** Dual-dialect durable CheckpointStore. See the file header for the dialect-delta ledger. */
 export declare class SqlCheckpointStore implements CheckpointStore {
     protected readonly db: SqlDriver;

package/dist/plugins/checkpoint-store-sql.js

@@ -210,15 +210,6 @@ function readActorAssertion(v) {
     const issuer = "issuer" in v ? v.issuer : undefined;
     return { id, hostAsserted, ...(typeof issuer === "string" ? { issuer } : {}) };
 }
-function readLegacySeat(v) {
-    if (typeof v !== "object" || v === null)
-        return undefined;
-    const text = "text" in v ? v.text : undefined;
-    const trusted = "trusted" in v ? v.trusted : undefined;
-    if (typeof text !== "string" || typeof trusted !== "boolean")
-        return undefined;
-    return { text, trusted };
-}
 function readQueueEntry(v) {
     if (typeof v !== "object" || v === null)
         return undefined;
@@ -243,7 +234,7 @@ function readQueueEntry(v) {
         ...(priority === "now" || priority === "next" || priority === "later" ? { priority } : {}),
     };
 }
-export function readPendingSteerColumns(seatRaw, queueRaw) {
+export function readPendingSteerQueueColumn(queueRaw) {
     let lossy = false;
     const parse = (raw) => {
         if (raw === null || raw === undefined)
@@ -258,10 +249,6 @@ export function readPendingSteerColumns(seatRaw, queueRaw) {
             return undefined;
         }
     };
-    const seatParsed = parse(seatRaw);
-    const seat = seatParsed === undefined ? undefined : readLegacySeat(seatParsed);
-    if (seatParsed !== undefined && seat === undefined)
-        lossy = true;
     const queueParsed = parse(queueRaw);
     let queue;
     if (queueParsed !== undefined) {
@@ -278,10 +265,7 @@ export function readPendingSteerColumns(seatRaw, queueRaw) {
             }
         }
     }
-    return {
-        state: { ...(seat !== undefined ? { pendingSteer: seat } : {}), ...(queue !== undefined ? { pendingSteerQueue: queue } : {}) },
-        lossy,
-    };
+    return { state: { ...(queue !== undefined ? { pendingSteerQueue: queue } : {}) }, lossy };
 }
 const STEER_CAS_ATTEMPTS = 8;
 const EXECUTION_RECORD_CAS_ATTEMPTS = 8;
@@ -375,7 +359,7 @@ export class SqlCheckpointStore {
         }
     }
     async get(token) {
-        const { rows } = await this.db.query(this.q("SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer, pending_steer_queue, execution_outcome, execution_at_ms FROM checkpoint WHERE token = ?", "SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer, pending_steer_queue, execution_outcome, execution_at_ms FROM checkpoint WHERE token = $1"), [token]);
+        const { rows } = await this.db.query(this.q("SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer_queue, execution_outcome, execution_at_ms FROM checkpoint WHERE token = ?", "SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer_queue, execution_outcome, execution_at_ms FROM checkpoint WHERE token = $1"), [token]);
         const r = rows[0];
         if (!r)
             return null;
@@ -396,13 +380,11 @@ export class SqlCheckpointStore {
             if (r.execution_at_ms != null)
                 cp.executionAtMs = Number(r.execution_at_ms);
         }
-        const steer = readPendingSteerColumns(r.pending_steer, r.pending_steer_queue);
+        const steer = readPendingSteerQueueColumn(r.pending_steer_queue);
         if (steer.lossy) {
             this.logger?.info?.("checkpoint_pending_steer_unreadable", { tokenFp: tokenFingerprint(token) });
         }
         if (cp.state) {
-            if (steer.state.pendingSteer !== undefined)
-                cp.state.pendingSteer = steer.state.pendingSteer;
             if (steer.state.pendingSteerQueue !== undefined)
                 cp.state.pendingSteerQueue = steer.state.pendingSteerQueue;
         }
@@ -454,11 +436,11 @@ export class SqlCheckpointStore {
     async setPendingSteer(token, scope, steer) {
         const clean = validatePendingSteer(steer);
         for (let attempt = 0; attempt < STEER_CAS_ATTEMPTS; attempt++) {
-            const { rows } = await this.db.query(this.q("SELECT status, pending_steer, pending_steer_queue, pending_steer_rev FROM checkpoint WHERE token = ? AND scope = ?", "SELECT status, pending_steer, pending_steer_queue, pending_steer_rev FROM checkpoint WHERE token = $1 AND scope = $2"), [token, scope]);
+            const { rows } = await this.db.query(this.q("SELECT status, pending_steer_queue, pending_steer_rev FROM checkpoint WHERE token = ? AND scope = ?", "SELECT status, pending_steer_queue, pending_steer_rev FROM checkpoint WHERE token = $1 AND scope = $2"), [token, scope]);
             const row = rows[0];
             if (!row || row.status !== "pending")
                 return false;
-            const read = readPendingSteerColumns(row.pending_steer, row.pending_steer_queue);
+            const read = readPendingSteerQueueColumn(row.pending_steer_queue);
             if (read.lossy) {
                 throw new Error(`the parked steering queue on checkpoint ${tokenFingerprint(token)} is unreadable — refusing to append onto it ` +
                     `(appending would silently drop the entries this build cannot parse)`);

package/dist/plugins/file-run-store.d.ts

@@ -284,6 +284,24 @@ export declare class FileRunStore {
     private releaseClaim;
     /** Drop a run entirely (registry + event log + open fd + on-disk dir) — used by deleteBySession. */
     private dropRun;
+    /**
+     * 🔴 **一次性迁移(随 7.75.0 连同 `one-time-migrations.ts` 整删)** —— 退役词旧拼法的账本改写,
+     * SQL 两孪生那条整表 UPDATE 的 local 形。逐条走**同一只**纯改写函数,所以三条车道改出来的字节一致。
+     *
+     * 为什么是 store 上的一只动词、而不是外面一个文件走查:本店的账本有**两份**在场 —— 盘上的 jsonl
+     * 与 hydrate 进来的内存索引。外部走查只改得到前者,读腿读的却是后者(`getEvents` 从 Map 取),
+     * 于是迁移在本次进程里完全不生效、下次重启才"忽然"生效。两份一起改的唯一正确位置就是这里。
+     *
+     * 写盘用整文件原子替换(不是追加):改的是**已有行**,而 `AppendLog` 只会往后写。替换之前把**全部**
+     * append fd 撤掉(rename 之后旧 fd 指向的是被 unlink 的 inode,继续往那儿追加 = 之后的事件全部写进一个
+     * 没人看得见的文件),下一次 `appendEvent` 会按惰性规则重新开。撤 fd 复用**既有的那一只** {@link dispose}
+     * —— 刻意不在这里另写一段 close+catch:那会是本文件第二处同形的兜底臂,而规则要变少不要变多。
+     * 常态下这一撤是空操作:本动词跑在 boot 期,那时一个 append fd 都还没惰性开出来。
+     *
+     * 幂等:零命中 ⇒ 一个字节都不写、一只 fd 都不撤(第二跑零 I/O)。
+     * @returns 被改写的账本**行**数(不是 run 数)。
+     */
+    migrateRetiredAskOriginRows(): Promise<number>;
     /** Release every open event-log fd (called by LocalBackend.close so a graceful restart can re-open the data dir). */
     dispose(): void;
 }

package/dist/plugins/file-run-store.js

@@ -7,6 +7,7 @@ import { terminalProjection } from "@sema-agent/core";
 import { AppendLog, atomicWriteFile, ensureDir, isProcessLive, processFingerprint, readJsonlRecords, sanitizePathComponent, writeThenLink } from "@sema-agent/core";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { notifyRunTerminal } from "../observability/run-terminal-log.js";
+import { migrateRetiredAskOrigin } from "./one-time-migrations.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const CLAIM_TAKEOVER_ATTEMPTS = 3;
 const SAFE_PATH_COMPONENT = /^[A-Za-z0-9_.-]+$/;
@@ -841,6 +842,32 @@ export class FileRunStore {
             }
         }
     }
+    async migrateRetiredAskOriginRows() {
+        const rewrites = new Map();
+        for (const [taskId, list] of this.events) {
+            let touched = 0;
+            const rows = list.map((e) => {
+                const data = migrateRetiredAskOrigin(e.type, e.data);
+                if (data === undefined)
+                    return e;
+                touched++;
+                return { ...e, data };
+            });
+            if (touched > 0)
+                rewrites.set(taskId, { rows, touched });
+        }
+        if (rewrites.size === 0)
+            return 0;
+        this.dispose();
+        let migrated = 0;
+        for (const [taskId, { rows, touched }] of rewrites) {
+            mkdirSync(this.runDir(taskId), { recursive: true });
+            atomicWriteFile(this.tmpDir, this.eventsPath(taskId), rows.map((e) => `${JSON.stringify(e)}\n`).join(""));
+            this.events.set(taskId, rows);
+            migrated += touched;
+        }
+        return migrated;
+    }
     dispose() {
         for (const log of this.eventLogs.values()) {
             try {