@sema-agent/server 7.94.0 → 7.95.1

package/dist/hosted-posture.js

@@ -0,0 +1,76 @@
+import { TASK_WRITE_FACE_ESCALATIONS } from "./config-types.js";
+import { deviceCwdHonored } from "./task-cwd.js";
+export const HOSTED_EVIDENCE_WORDS = ["require-principal", "principal-jwt", "auth-bridge-issuer"];
+export function buildHostedPosture(c) {
+    const evidence = [];
+    if (c.requirePrincipal === true)
+        evidence.push("require-principal");
+    if (c.principalJwtPubkeys.length > 0 || c.principalJwtIss !== undefined || c.principalJwtAud !== undefined)
+        evidence.push("principal-jwt");
+    if (c.authBridgeIssuer !== undefined)
+        evidence.push("auth-bridge-issuer");
+    return { hosted: evidence.length > 0, evidence };
+}
+export const HOSTED_EVIDENCE_ENV_KEYS = ["PRINCIPAL_JWT_PUBKEYS", "PRINCIPAL_JWT_ISS", "PRINCIPAL_JWT_AUD", "AUTH_BRIDGE_ISSUER"];
+export function clearHostedEvidenceEnv() {
+    delete process.env.PRINCIPAL_JWT_PUBKEYS;
+    delete process.env.PRINCIPAL_JWT_ISS;
+    delete process.env.PRINCIPAL_JWT_AUD;
+    delete process.env.AUTH_BRIDGE_ISSUER;
+}
+export function hostedEvidenceNote(e) {
+    switch (e) {
+        case "require-principal":
+            return "REQUIRE_PRINCIPAL=true (this deployment declares itself multi-tenant)";
+        case "principal-jwt":
+            return "PRINCIPAL_JWT_PUBKEYS/ISS/AUD is configured (principal identities are verified against an external issuer — a single-user turnkey box has no issuer)";
+        case "auth-bridge-issuer":
+            return "AUTH_BRIDGE_ISSUER is set explicitly (a second external SSO-JWT issuer; the registry-URL fallback is deliberately NOT read here — that fact is fleet management, not tenancy)";
+    }
+}
+function hostedBecause(facts) {
+    return facts.evidence.map(hostedEvidenceNote).join("; ");
+}
+export function hostedPrincipalRefusal(c) {
+    const facts = buildHostedPosture(c);
+    if (!facts.hosted || c.requirePrincipal === true)
+        return undefined;
+    return (`this deployment looks HOSTED/multi-tenant (${hostedBecause(facts)}) but REQUIRE_PRINCIPAL is not set — ` +
+        `an absent principal takes the single-user "default" amnesty, which would list every ownerless session to every caller ` +
+        `and open the single-user capability grants (settings.hooks / settings.env / cwd / additionalDirectories) to all of them. ` +
+        `Set REQUIRE_PRINCIPAL=true (and OPERATOR_PRINCIPALS for the operator-only routes), or remove the hosted-deployment configuration if this really is a single-user box.`);
+}
+export const HOST_POSTURE_REFUSED_CODE = "request.host_posture_refused";
+function hostPostureDeclarationsHonored(c) {
+    if (deviceCwdHonored(c))
+        return true;
+    return !buildHostedPosture(c).hosted;
+}
+export function taskApproverPostureHonored(c) {
+    return hostPostureDeclarationsHonored(c);
+}
+export function taskWriteFaceRefusal(c) {
+    switch (c.taskWriteFaceEscalation) {
+        case "allow":
+            return undefined;
+        case "refuse":
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+                `Refused because this deployment pins TASK_WRITE_FACE_ESCALATION=refuse (the operator's own declaration — it wins over any request, unconditionally). ` +
+                `Omit permissionMode:"bypassPermissions", or ask the operator for TASK_WRITE_FACE_ESCALATION=allow.`);
+        case undefined:
+            break;
+        default: {
+            const unhandled = c.taskWriteFaceEscalation;
+            return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+                `Refused because this deployment carries an UNRECOGNISED TASK_WRITE_FACE_ESCALATION word (${String(unhandled)}) — a knob this build cannot interpret is never read as permission. ` +
+                `Set TASK_WRITE_FACE_ESCALATION to one of ${TASK_WRITE_FACE_ESCALATIONS.join(" | ")}, or unset it to let the deployment posture decide.`);
+        }
+    }
+    if (hostPostureDeclarationsHonored(c))
+        return undefined;
+    const facts = buildHostedPosture(c);
+    return (`permissionMode:"bypassPermissions" opens the WRITE containment face (TaskSpec.writeFace:"open") — the run could write outside the task root. ` +
+        `Refused because this deployment is HOSTED/multi-tenant (${hostedBecause(facts)}), so the task layer may only TIGHTEN the write face, never open it. ` +
+        `Set TASK_WRITE_FACE_ESCALATION=allow if the DEPLOYMENT permits the task layer to open it, or omit permissionMode:"bypassPermissions".`);
+}
+//# sourceMappingURL=hosted-posture.js.map

package/dist/http/resume-ctx-read.d.ts

@@ -11,10 +11,16 @@
  *  · `absent` —— 行不在(`reapCtx` 按设计在 run 终态后删掉它),**或**读腿抛了一个**不是坏体**的错
  *    (连接 / 超时 / 权限 / 店抖动):证不出它在就当它不在,**这是刻意保守**([ref] 方向锚:
  *    拒绝可重试,搁浅不可)。
- *  · `corrupt` —— 读腿抛了**坏体类**错(属主谓词 `isJsonColumnBodyProblem`:`not-json` / `malformed`)。
+ *  · `corrupt` —— 店给了它的**拒绝契约**(`StoreCorruptError`,`kind:"corrupt"` + 坐标)。
  *    **不折成缺席**:两者的运维动作完全不同(前者去查那一行,后者什么都不用做)。
  *    ⚠️ `not-text`(投影漂 = 我方的码病)**刻意不进这一态**,原样上抛、响亮成 500 —— 不许伪装成
  *    「数据坏了」,更不许折成缺席(那会让一次代码漂看起来像「这条会话没有上下文」)。
+ *
+ * 🔴 **按「店的拒绝形」分类,不按「列错误类」**(S-608,7.95.1:这一句此前反了,整整一版)。修前本口
+ * 认的是属主谓词 `isJsonColumnBodyProblem`(= 一只 `SqlJsonColumnError`),而 SQL 两孪生的 `refusing()`
+ * 早把列错误**折**成了一只普通 `Error` ⇒ 折后的错落进下面那条「店抖动 ⇒ 当缺席」臂,坏体与缺席在
+ * 用户面上仍然同答 409 —— 正是 S-577 第二半要修的那个病,只是它当时只在 local 车道上修成了(那一侧
+ * 恰好没折码,把列错误漏了出来 = 巧合式正确)。两条车道现在同一份拒绝契约,本口只认它。
  */
 import type { CheckpointCtx } from "./route-ctx.js";
 export type ResumeCtxRead = {

package/dist/http/resume-ctx-read.js

@@ -1,12 +1,12 @@
-import { isJsonColumnBodyProblem, SqlJsonColumnError } from "../plugins/sql-json-column.js";
+import { SqlJsonColumnError, StoreCorruptError } from "../plugins/sql-json-column.js";
 export async function readResumeCtx(load) {
     try {
         const ctx = await load;
         return ctx == null ? { kind: "absent" } : { kind: "ok", ctx };
     }
     catch (e) {
-        if (isJsonColumnBodyProblem(e))
-            return { kind: "corrupt", where: e.where };
+        if (e instanceof StoreCorruptError)
+            return { kind: e.kind, where: e.where };
         if (e instanceof SqlJsonColumnError)
             throw e;
         return { kind: "absent" };

package/dist/http/resume-legs.js

@@ -286,20 +286,10 @@ export function createResumeLegs(ctx) {
         if (!ctx)
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return {
-                    status: 409,
-                    body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
-                };
-            }
-            throw e;
-        }
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const pendingTool = cp.pendingAction.toolName;
         if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
             return { status: 400, body: { error: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", errorCode: "request.field_conflict" } };
@@ -333,6 +323,24 @@ export function createResumeLegs(ctx) {
         const spec = await deps.resolveSpec({ ...body, ...ONE_SHOT_HISTORY_STRIP }, req, auth, { leg: "resume", onNotice: (n) => engineNotices.push(n) });
         return { spec, engineNotices };
     };
+    const resolveResumeSpecOrBlocked = async (body, req, auth) => {
+        try {
+            const { spec, engineNotices } = await resolveResumeSpec(body, req, auth);
+            return { ok: true, spec, engineNotices };
+        }
+        catch (e) {
+            if (e instanceof HttpError) {
+                return {
+                    ok: false,
+                    answer: {
+                        status: 409,
+                        body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) },
+                    },
+                };
+            }
+            throw e;
+        }
+    };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
             return await driveResumeLeg(args);
@@ -1041,7 +1049,10 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
@@ -1070,17 +1081,10 @@ export function createResumeLegs(ctx) {
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
         const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
-        let spec;
-        let engineNotices = [];
-        try {
-            ({ spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth));
-        }
-        catch (e) {
-            if (e instanceof HttpError) {
-                return { status: 409, body: { error: `resume blocked by an admission policy change: ${e.message}`, errorCode: "resume_blocked_by_policy", ...(e.code ? { blockedBy: e.code } : {}), ...(e.extra ?? {}) } };
-            }
-            throw e;
-        }
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const hostSpec = { ...spec, objective, sessionId };
         const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
             prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
@@ -1151,7 +1155,10 @@ export function createResumeLegs(ctx) {
             return { status: 409, body: { error: "resume context missing — cannot rebuild task config", errorCode: "conflict.resume_context_unavailable" } };
         const ctx = ctxRead.ctx;
         const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
-        const { spec, engineNotices } = await resolveResumeSpec(ctx.body, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(ctx.body, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         return driveResumeIntoRunLog({
             runner: runnerFor(spec),
@@ -1242,7 +1249,10 @@ export function createResumeLegs(ctx) {
         }
         const approvedMode = decision === "approve" && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
         const resumeBody = approvedMode === undefined ? ctx.body : { ...ctx.body, permissionMode: approvedMode };
-        const { spec, engineNotices } = await resolveResumeSpec(resumeBody, req, auth);
+        const resolved = await resolveResumeSpecOrBlocked(resumeBody, req, auth);
+        if (!resolved.ok)
+            return resolved.answer;
+        const { spec, engineNotices } = resolved;
         const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const outcome = {

package/dist/http/routes/capabilities.js

@@ -3,6 +3,7 @@ import { isModelAllowlisted } from "../../model-select.js";
 import { resolveModelApiKey } from "../../key-resolver.js";
 import { isSealedKeyPoison } from "../../sealed-key.js";
 import { cwdHonored, deviceCwdHonored } from "../../task-cwd.js";
+import { taskApproverPostureHonored, taskWriteFaceRefusal } from "../../hosted-posture.js";
 import { DEVICE_PROTOCOL_VERSION, DEVICE_WS_PATH } from "../../device-ws-protocol.js";
 import { a2aInjectionHonored } from "../../task-a2a.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
@@ -135,6 +136,8 @@ export async function handleCapabilities(req, res, match, ctx) {
                 interactiveTools: true,
                 projectContext: cwdHonored(deps.config),
                 callerCwd: cwdHonored(deps.config) || deviceCwdHonored(deps.config),
+                taskWriteFaceOpen: taskWriteFaceRefusal(deps.config) === undefined,
+                taskApproverPosture: taskApproverPostureHonored(deps.config),
                 executionLane: projectExecutionLaneCapability(deps.config),
                 mcpInjection: mcpInjectionHonored(deps.config),
                 a2a: true,

package/dist/http/wire-types.d.ts

@@ -326,10 +326,19 @@ export interface TaskRequestBody {
      * (且只能收紧、deny-wins),前者只说「谁来答卡」。两者在语义上同族,声明它而不开 `bypassPermissions`
      * 只是对模型说了一句与实际不符的话 —— 见契约文档那一段的「谁受伤」。
      *
-     * 🔴 **本仓零判据、原样过境**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
-     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不加第二道门** —— 在下游再判一次就是
-     * 同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加第二个词就会被静默 400 掉。
-     * 型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     * 🔴 **值域上本仓零判据**(`boot/resolve-spec.ts` 写点):词的拒绝逻辑属引擎
+     * (`refuseInvalidApproverPosture` 响亮拒一个不认识的词),server **不抄词表、不加第二道值域门** ——
+     * 在下游再判一次就是同一语义面的第二个判官(源头修复纪律 [ref]),而且本仓抄一份词表的那天 core 加
+     * 第二个词就会被静默 400 掉。型也从 core 的 `ApproverPosture` 派生(不抄字面联合)。
+     *
+     * 🔴 **但「原样过境」自 7.95.0(S-591 腿③)起不再成立 —— 它有一道**准入**闸**:本键是一句**宿主姿态
+     * 声明**(「这个 run 的审批卡由宿主自己自动答」),而在**托管 / 多租**部署上提交方**不是**宿主。
+     * 所以托管形上它被**忽略 + 留声**(`task_approver_posture_ignored`,`honored:false`),与同族的
+     * `settings.hooks` / `cwd` / `settings.env` 三条逐字同姿势;单用户 turnkey 与 device 车道照旧过境
+     * (射程判据单点 = `src/hosted-posture.ts` 的 `taskApproverPostureHonored`)。
+     * ⚠️ **刻意不是 400/422**:本键零授权,而续跑腿逐字重放盘上的体、调用方删不掉它 ⇒ 拒会把一条 parked
+     * 任务永久砖死(clay 裁定① 2026-09-22;本仓成文结论「砖死 resume 比降级糟」)。
+     * ⇒ 这一条与「值域零判据」**不矛盾**:值域仍归引擎,本仓判的是**这台部署认不认这句声明**。
      */
     approverPosture?: ApproverPosture;
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run

package/dist/plugins/approval-ask-store-sql.js

@@ -262,7 +262,7 @@ function mapAskRow(r) {
         return mapAskRowBody(r, askId);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`approval-ask-store: ${m} — refusing rather than serve an ask row nobody can read`));
+        throw foldJsonColumn(e, (m) => `approval-ask-store: ${m} — refusing rather than serve an ask row nobody can read`);
     }
 }
 function mapAskRowBody(r, askId) {

package/dist/plugins/background-agent-store-sql.js

@@ -15,7 +15,7 @@ function readRecordColumn(v, handle) {
         return decodeJsonColumn(v, readAgentRecordBody, `${BACKGROUND_AGENT_TABLE}.record_json for handle ${handle}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`BackgroundAgentStore: ${m} — refusing rather than serve a hollow agent record`));
+        throw foldJsonColumn(e, (m) => `BackgroundAgentStore: ${m} — refusing rather than serve a hollow agent record`);
     }
 }
 function readUsageColumn(v, handle) {
@@ -23,7 +23,7 @@ function readUsageColumn(v, handle) {
         return decodeNullableJsonColumn(v, readUsageBody, `${BACKGROUND_AGENT_TABLE}.usage_json for handle ${handle}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`BackgroundAgentStore: ${m} — refusing rather than report a usage figure nobody can read`));
+        throw foldJsonColumn(e, (m) => `BackgroundAgentStore: ${m} — refusing rather than report a usage figure nobody can read`);
     }
 }
 const PROJ_COLS = "scope, owner, session_scoped, session_id, parent_session_id, root_session_id, session_anchor, name, agent_type, status, spawned_at_ms, updated_at_ms, settled_at_ms, usage_json, rev, parked_checkpoint_token, park_claim_id, admitted_org_scopes, admitted_org_write_scope, record_json";

package/dist/plugins/checkpoint-store-sql.js

@@ -137,7 +137,7 @@ function refusing(what, read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`SqlCheckpointStore: ${m} — refusing rather than serve ${what}`));
+        throw foldJsonColumn(e, (m) => `SqlCheckpointStore: ${m} — refusing rather than serve ${what}`);
     }
 }
 function readRuleOffersCell(cell) {

package/dist/plugins/device-store-sql.js

@@ -314,7 +314,7 @@ function readAuditDetail(raw, id) {
         return decodeJsonColumn(raw, readJsonObjectColumn, `${DEVICE_AUDIT_TABLE}.detail for audit row ${id}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`device-store: ${m} — refusing rather than serve an audit row whose detail nobody can read`));
+        throw foldJsonColumn(e, (m) => `device-store: ${m} — refusing rather than serve an audit row whose detail nobody can read`);
     }
 }
 function ph(dialect, n) {

package/dist/plugins/image-bake-store-sql.js

@@ -130,7 +130,7 @@ function refusingBakeRow(read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`image-bake-store: ${m} — refusing rather than serve a bake row nobody can read`));
+        throw foldJsonColumn(e, (m) => `image-bake-store: ${m} — refusing rather than serve a bake row nobody can read`);
     }
 }
 export const IMAGE_BAKE_INDEXES = [

package/dist/plugins/image-index-sql.js

@@ -89,7 +89,7 @@ function refusingImageRow(read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`image-index: ${m} — refusing rather than serve an image row nobody can read`));
+        throw foldJsonColumn(e, (m) => `image-index: ${m} — refusing rather than serve an image row nobody can read`);
     }
 }
 export const IMAGE_INDEX_INDEXES = [

package/dist/plugins/leader-run-store-sql.js

@@ -67,7 +67,7 @@ function readResultColumn(text, id) {
         return decodeNullableJsonColumn(text, readNonNullJsonValueColumn, `${LEADER_RUN_TABLE}.result for leader run ${id}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`leader_run: ${m} — refusing rather than serve this run as if it had finished empty-handed`));
+        throw foldJsonColumn(e, (m) => `leader_run: ${m} — refusing rather than serve this run as if it had finished empty-handed`);
     }
 }
 function statusOf(raw, id) {

package/dist/plugins/local-checkpoint-store.js

@@ -7,7 +7,7 @@ import { isApprovalGateKind } from "../tool-approval.js";
 import { FileCheckpointStore, atomicWriteFile, executionVerdict, sanitizePathComponent, } from "@sema-agent/core";
 import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, pendingActionToolCallId, pendingRowPrecedes, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { quarantineUnreadableSidecar } from "./local-sidecar-quarantine.js";
-import { createZodColumnReader, decodeJsonColumn, readStringArrayColumn } from "./sql-json-column.js";
+import { createZodColumnReader, decodeJsonColumn, foldJsonColumn, readStringArrayColumn } from "./sql-json-column.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
 import { assertJsonColumnWritable, createObjectColumnReader } from "./sql-json-column.js";
 function terminalAtOf(cp) {
@@ -36,6 +36,14 @@ function createCtxRecordReader() {
         return { value: { ...envelope.value, ctx: payload.value } };
     };
 }
+function refusingCtx(sessionId, read) {
+    try {
+        return read();
+    }
+    catch (e) {
+        throw foldJsonColumn(e, (m) => `LocalCheckpointStore: ${m} — refusing rather than serve a resume context nobody can read (session ${JSON.stringify(sessionId)})`);
+    }
+}
 export class LocalCheckpointStore {
     retention = UNMANAGED_RETENTION;
     durability = "durable";
@@ -316,7 +324,7 @@ export class LocalCheckpointStore {
         const p = join(this.ctxDir, ctxFileOf(sessionId));
         if (!existsSync(p))
             return null;
-        const rec = decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${ctxFileOf(sessionId)} for session ${JSON.stringify(sessionId)}`);
+        const rec = refusingCtx(sessionId, () => decodeJsonColumn(readFileSync(p, "utf8"), createCtxRecordReader(), `checkpoint-ctx ${ctxFileOf(sessionId)} for session ${JSON.stringify(sessionId)}`));
         return rec.sessionId === sessionId ? rec.ctx : null;
     }
     async reapCtx(cutoff) {

package/dist/plugins/mailbox-store-sql.js

@@ -2,7 +2,7 @@ import { MAILBOX_INVALID_PEER_META_CODE, MAILBOX_TOMBSTONED_RECIPIENT_CODE, Mail
 import { pgHasUnstorable, pgSanitizeText, PgUnstorableError } from "./pg-safe-json.js";
 import { ensureIndexes } from "./ensure-index.js";
 import { escapeLike } from "./sql-escape.js";
-import { decodeNullableJsonColumn, foldJsonColumn, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
+import { decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readStringArrayColumn } from "./sql-json-column.js";
 export const MAILBOX_TABLE = "mailbox";
 export const MAILBOX_MSG_TABLE = "mailbox_message";
 export const MAILBOX_TOMBSTONE_TABLE = "mailbox_tombstone";
@@ -52,7 +52,7 @@ function decodeHopChain(raw, seq) {
         return decodeNullableJsonColumn(raw, readStringArrayColumn, `${MAILBOX_MSG_TABLE}.hop_chain for seq ${String(seq)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`MailboxStore: ${m} — refusing the lease rather than let a message skip peer admission (an absent chain makes core's judgePeerAdmission not run at all)`));
+        throw foldJsonColumn(e, (m) => `MailboxStore: ${m} — refusing the lease rather than let a message skip peer admission (an absent chain makes core's judgePeerAdmission not run at all)`);
     }
 }
 const PEER_META_MAX_BYTES = 60_000;
@@ -73,7 +73,9 @@ function decodePeerMeta(raw, seq) {
     catch (e) {
         if (e instanceof MailboxStoreError)
             throw e;
-        throw foldJsonColumn(e, (m) => new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore: ${m} — refusing the lease rather than read a corrupt typed record as "no metadata"`));
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        throw new MailboxStoreError(MAILBOX_INVALID_PEER_META_CODE, `MailboxStore: ${e.message} — refusing the lease rather than read a corrupt typed record as "no metadata"`);
     }
 }
 const readPeerMetaColumn = (body) => {

package/dist/plugins/memory-engine-pg.js

@@ -51,7 +51,7 @@ function readFrontmatter(cell, id) {
         return decodeJsonColumn(cell, readFrontmatterColumn, `${PG_MEMORY_ENGINE_TABLES.entry}.frontmatter for entry ${String(id)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`));
+        throw foldJsonColumn(e, (m) => `memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`);
     }
 }
 function readEmbedding(cell, id) {

package/dist/plugins/memory-engine-tidb.js

@@ -48,7 +48,7 @@ function readFrontmatter(cell, id) {
         return decodeJsonColumn(cell, readFrontmatterColumn, `${TIDB_MEMORY_ENGINE_TABLES.entry}.frontmatter for entry ${String(id)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`));
+        throw foldJsonColumn(e, (m) => `memory-engine: ${m} — refusing rather than serve a note whose frontmatter (the origin/exposure law carrier) nobody can read`);
     }
 }
 export class TiDBMemoryEngineBackend {

package/dist/plugins/memory-sync-store-pg.js

@@ -34,7 +34,7 @@ export function refusingMemorySyncRow(read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`memory-sync store: ${m} — refusing rather than serve a sync row nobody can read`));
+        throw foldJsonColumn(e, (m) => `memory-sync store: ${m} — refusing rather than serve a sync row nobody can read`);
     }
 }
 function toMs(v) {

package/dist/plugins/permission-rule-store-sql.js

@@ -346,7 +346,7 @@ async function refusingUnreadableColumns(what, fn) {
         return await fn();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`${m} — the ${what} does not carry a readable shape; refusing the whole of it rather than report a partial one`));
+        throw foldJsonColumn(e, (m) => `${m} — the ${what} does not carry a readable shape; refusing the whole of it rather than report a partial one`);
     }
 }
 class SqlDurableRulePartition {
@@ -728,7 +728,7 @@ export class SqlRuleImportTicketStore {
                 outcome = decodeJsonColumn(row.redeemedOutcome, readJsonObjectColumn, `${PERMISSION_RULE_TICKET_TABLE}.redeemed_outcome for ticket ${ticketId}`);
             }
             catch (e) {
-                throw foldJsonColumn(e, (m) => new Error(`${m} — refusing rather than read a settled ticket as still open (which re-runs a redemption that already ran)`));
+                throw foldJsonColumn(e, (m) => `${m} — refusing rather than read a settled ticket as still open (which re-runs a redemption that already ran)`);
             }
             return { state: "settled", outcome };
         }

package/dist/plugins/run-store-sql.js

@@ -22,7 +22,7 @@ function refusing(what, read) {
         return read();
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`SqlRunStore: ${m} — refusing rather than ${what}`));
+        throw foldJsonColumn(e, (m) => `SqlRunStore: ${m} — refusing rather than ${what}`);
     }
 }
 function usageResultBody(v) {

package/dist/plugins/session-event-payload.js

@@ -14,7 +14,7 @@ export function decodeSessionEventPayload(cell, sessionId, rowId) {
         return decodeJsonColumn(cell, readSessionEventPayload, `session_event.payload for session ${sessionId} row ${String(rowId)}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`session storage: ${m} — refusing rather than wake a session from a tree with a node nobody can read`));
+        throw foldJsonColumn(e, (m) => `session storage: ${m} — refusing rather than wake a session from a tree with a node nobody can read`);
     }
 }
 //# sourceMappingURL=session-event-payload.js.map

package/dist/plugins/session-policy-store-sql.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
 import { readSessionPermissionRules, describeSessionPermissionRulesProblem } from "../session-policy-wire.js";
-import { decodeJsonColumn, foldJsonColumn, jsonColumnText } from "./sql-json-column.js";
+import { decodeJsonColumn, isJsonColumnBodyProblem, jsonColumnText } from "./sql-json-column.js";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDeadlockError, isDupKeyError } from "./sql-errors.js";
@@ -17,7 +17,9 @@ function readRulesBody(text, where) {
         return decodeJsonColumn(text, readSessionRulesBody, where);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new SessionPolicyError("corrupt", `${m} — an unreadable rules body served as an EMPTY rule set would silently drop every tightening this session carries`));
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        throw new SessionPolicyError("corrupt", `${e.message} — an unreadable rules body served as an EMPTY rule set would silently drop every tightening this session carries`);
     }
 }
 function rowToStored(r, where) {

package/dist/plugins/sql-json-column.d.ts

@@ -85,8 +85,17 @@ export declare function jsonColumnTextExpr(dialect: SqlDialect, column: string):
 export declare const SQL_JSON_COLUMN_PROBLEMS: readonly ["not-text", "not-json", "malformed"];
 export type SqlJsonColumnProblem = (typeof SQL_JSON_COLUMN_PROBLEMS)[number];
 /**
- * 店层码,**不上 wire**:各店在自己的错误映射里把它折成该店既有的 corrupt 类码(见 {@link foldJsonColumn})。
- * 终局对外码经 7.92.2 的词法门,永不裸穿。
+ * **体**的两形(`not-text` 之外的全部)—— 「数据坏了」这一族。类型从闭集派生,不手抄。
+ * 存在的理由:{@link StoreCorruptError} 要在**类型面**说出「我携带的种别恒非 `not-text`」。
+ */
+export type SqlJsonColumnBodyProblem = Exclude<SqlJsonColumnProblem, "not-text">;
+/**
+ * 店层码,**不上 wire**:店层折码口 {@link foldJsonColumn} 把它折成 {@link StoreCorruptError}
+ * (有自己闭集契约词的店折成自己的码)。终局对外码经 7.92.2 的词法门,永不裸穿。
+ *
+ * 🔴 **它只许在 `not-text` 那一形上穿过店的边界**(S-608):`not-text` 是读腿自己的缺陷(投影漂),
+ * 按 {@link foldJsonColumn} 的规则不折、原样上抛;而体的两形一旦穿出去,上层就得**按列错误类**分类,
+ * 那正是 S-608 的病 —— 读口按列错误分类、店按店拒绝形折码,两层各说各话,坏体于是落进「店抖动」臂。
  */
 export declare class SqlJsonColumnError extends Error {
     readonly problem: SqlJsonColumnProblem;
@@ -133,13 +142,47 @@ export declare function decodeJsonColumn<T>(text: unknown, read: JsonColumnReade
  */
 export declare function decodeNullableJsonColumn<T>(cell: unknown, read: JsonColumnReader<T>, where: string): T | undefined;
 /**
- * 店层折码的**唯一规则**(`catch (e) { throw foldJsonColumn(e, (m) => new XError("corrupt", m)); }`)。
+ * **「这一格耐久载荷读不出来」的店层拒绝**(整仓唯一一只)—— {@link foldJsonColumn} 的**恒定产物**。
+ *
+ * 🔴 为什么它必须是一只**具名类**而不是 `new Error(…)`(S-608 真案,7.95.1):折码的产物是**店交给
+ * 上层的契约**。折成裸 `Error` 之后,「这一行确定性地读不出来」与「店抖了一下」在上层**没有任何判别位**,
+ * 而两者的处置完全相反(前者要人去修那一行,后者重试 / 保守当缺席)。S-577 给续跑上下文修的正是这条
+ * 分家,可它在 SQL 车道上**结构不可达**整整一版:读口按**列错误类**分类,而店早把列错误折成了裸
+ * `Error` ⇒ 坏体一路掉进「店抖动 ⇒ 当缺席」臂,用户拿到的还是那个 409(local 车道答对,只是因为它
+ * 根本没折码、把列错误漏了出来 —— 巧合式正确,不是同一份契约)。
+ * ⇒ 读口只认**店的拒绝契约**,而店的拒绝契约只有这一只。
+ *
+ * 🔴 {@link kind} 逐字就是消费点那只联合里的那个词(`http/resume-ctx-read.ts` 的 `ResumeCtxRead`):
+ * 店说 `corrupt`,读口原样转述,中间**没有第二张翻译表**。
+ *
+ * 有**自己的闭集契约词**的店(`session-policy` 的 `SessionPolicyError("corrupt")`、`mailbox` 的
+ * `MailboxStoreError`)不经本折码口 —— 它们的消费点按**那个码**判,本类的判别位对它们是多余的第二份。
+ * 那两处用属主谓词 {@link isJsonColumnBodyProblem} 自己写那一句(判别仍只有一个写者)。
+ */
+export declare class StoreCorruptError extends Error {
+    /** 消费点的判别词(与 `ResumeCtxRead` 的那一态同字)。 */
+    readonly kind: "corrupt";
+    /** 体的种别(类型面即保证恒非 `not-text` —— 那一形不折,见 {@link foldJsonColumn})。 */
+    readonly problem: SqlJsonColumnBodyProblem;
+    /** 出事的坐标(`<table>.<column> for <identity>`,由 {@link SqlJsonColumnError.where} 原样带过来)——
+     *  进 wire 的 `where` 字段,人按它去找那一行。 */
+    readonly where: string;
+    constructor(cause: SqlJsonColumnError & {
+        readonly problem: SqlJsonColumnBodyProblem;
+    }, sentence: string);
+}
+/**
+ * 店层折码的**唯一规则**(`catch (e) { throw foldJsonColumn(e, (m) => \`XStore: ${m} — refusing …\`); }`)。
+ *
+ * 🔴 回调交出来的是**一句话**,不是一只错误(S-608 按类改):产物恒是 {@link StoreCorruptError},于是
+ * 「折成一只没有判别位的错」在**构造上**写不出来。此前这一格的签名是 `(message) => Error`,21 个调用点
+ * 里 19 个折成了裸 `Error` —— 每一个都是一枚等着下一个消费方来踩的 S-608。
  *
  * 🔴 `not-text` **不折**:它是读腿自己的缺陷(投影漏了),折成「这一行坏了」会把一次代码漂伪装成一次
- * 数据事故 —— 这条判别只写在这里一处,五个店不各写一遍(各写一遍的下场是某天有一处把程序错也折了)。
- * 非本模块的错误原样透出(连接 / 超时 / 权限本来就该照原样上抛)。
+ * 数据事故 —— 这条判别只写在这里一处(与它的容忍侧孪生 {@link isJsonColumnBodyProblem} 共用),
+ * 各店不各写一遍。非本模块的错误原样透出(连接 / 超时 / 权限本来就该照原样上抛)。
  */
-export declare function foldJsonColumn(e: unknown, corrupt: (message: string) => Error): Error;
+export declare function foldJsonColumn(e: unknown, refusing: (message: string) => string): Error;
 /**
  * 折码的**容忍侧孪生**(与 {@link foldJsonColumn} 同一条判别,只写这一处):这一次失败是不是
  * **数据体**的问题(`not-json` / `malformed`)。
@@ -149,7 +192,9 @@ export declare function foldJsonColumn(e: unknown, corrupt: (message: string) =>
  * 调用点原样上抛:一条读腿漏了投影、或库连不上,绝不许被一条「这一格坏了,跳过它」的容忍臂吞掉 ——
  * 那会让一次代码漂 / 一次故障伪装成「几行数据坏了」,而两者的处置完全不同。
  */
-export declare function isJsonColumnBodyProblem(e: unknown): e is SqlJsonColumnError;
+export declare function isJsonColumnBodyProblem(e: unknown): e is SqlJsonColumnError & {
+    readonly problem: SqlJsonColumnBodyProblem;
+};
 /**
  * **写腿的形闸** —— 一个值**序列化之后**还是不是这一列读得回来的形。判据与读腿**共用同一只形读者**,
  * 所以「写得进」与「读得出」在构造上是同一句话。

package/dist/plugins/sql-json-column.js

@@ -49,9 +49,20 @@ export function decodeJsonColumn(text, read, where) {
 export function decodeNullableJsonColumn(cell, read, where) {
     return cell === null ? undefined : decodeJsonColumn(cell, read, where);
 }
-export function foldJsonColumn(e, corrupt) {
-    if (e instanceof SqlJsonColumnError && e.problem !== "not-text")
-        return corrupt(e.message);
+export class StoreCorruptError extends Error {
+    kind = "corrupt";
+    problem;
+    where;
+    constructor(cause, sentence) {
+        super(sentence, { cause });
+        this.name = "StoreCorruptError";
+        this.problem = cause.problem;
+        this.where = cause.where;
+    }
+}
+export function foldJsonColumn(e, refusing) {
+    if (isJsonColumnBodyProblem(e))
+        return new StoreCorruptError(e, refusing(e.message));
     return e instanceof Error ? e : new Error(String(e));
 }
 export function isJsonColumnBodyProblem(e) {

package/dist/plugins/task-list-store-sql.js

@@ -27,7 +27,7 @@ function parseItem(v, where) {
         return decodeJsonColumn(v, readTaskListItemBody, `${TASK_LIST_ITEM_TABLE}.item_json ${where}`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`TaskListStore: ${m} — refusing rather than hand the model a row nobody can read as a task`));
+        throw foldJsonColumn(e, (m) => `TaskListStore: ${m} — refusing rather than hand the model a row nobody can read as a task`);
     }
 }
 function assertListKeyBytes(listKey) {

package/dist/plugins/usage-window-store-sql.js

@@ -18,7 +18,7 @@ function parseRecord(raw, key) {
         return decodeJsonColumn(raw, readUsageWindowRecordBody, `${USAGE_WINDOW_TABLE}.record for key "${key}"`);
     }
     catch (e) {
-        throw foldJsonColumn(e, (m) => new Error(`${m} — refusing to mis-count a governance window`));
+        throw foldJsonColumn(e, (m) => `${m} — refusing to mis-count a governance window`);
     }
 }
 function validateUsageWindowRecord(v) {