@sema-agent/client-core 0.46.0 → 0.47.0

package/CHANGELOG.md

@@ -28,6 +28,89 @@
 > 不许悄悄漂:豁免登记的 `releasedAt` 与 `FROZEN` 账上 0.36.0 那一行逐字相等;本段(点名版本号
 > `0.36.0` + 关键字「勘误」)必须还在这份头注里 —— 删掉本段而不同批把门侧豁免一起处理,门当场红。
 
+## 0.47.0(2026-08-31)
+
+三件 additive 上收/透传批(#363;取证与定谳出自同批 CLI 提货)。**零 BREAKING**:
+peer 地板不动(`@sema-agent/sdk >=7.2.0` / `@sema-agent/agent-types >=0.2.0`),既有键与文案
+逐字节不变,新增三个运行期导出(公开导出面 787 → **790**)。
+
+- **件① `task_progress` 白名单补 `model`**(`src/adapter/downstream/eventToSdkMessage.ts`)。
+  server ≥**7.52.1** 的投影白名单(`trace/project.js` 的 `taskProgressEventData`)真发这一位 ——
+  子 run 的**模型 id**,core 铸点 `prepared.model.id`;修前本层的闭形白名单把它整键剥掉,
+  与 `workflowRunId`([1616]/[1617]②)是**同形第二例**:上游真发、白名单剥掉、两边代码看着都对。
+  条件与 server 投影**同形**:`string` 且非空才带(空串既不是模型 id 也不是「不知道」)。
+  ⚠️ sdk **7.3.0** 的 `task_progress` 臂尚未声明这一位(与 `requiresRealApproval` / `ruleOffers`
+  同形:server 已真发、SDK 锚未跟)⇒ 本层是**结构视图读**,SDK 补上当天那处 cast 可整条删。
+  同批做了这条白名单的**族扫**并把账写进码与档:server 投影发 13 键、本层转 8 键,
+  **仍被剥掉的五键**(`seq` / `taskType` / `parentTaskId` / `status` / `eventId`)逐条登记了
+  「谁没在读它」,见 `docs/INTEGRATION-CLIENTS.md` §3d。**刻意不静默多透**:透一位的前置条件是
+  说得出谁读它、读来干什么。
+- **件② decide 失败臂透传 `currentPending`**(`src/hitl/hitlBridge.ts` 新读口 +
+  `toolApprovalWire.ts` / `parkResolver.ts` 三个拍平点)。server S-02(≥7.52)在 409
+  `approval_stale` 拒体上铸的 **additive 指路键** —— 本会话**当前**那条 pending 的三件 D-1 坐标
+  (`toolName` / `boundCallId` / `boundInputHash?`),壳拿它**一跳重定位**再 decide,免整队重拉。
+  新增公开读口 `readDecideCurrentPending(e)` + 类型 `GateCurrentPending`;`FsApprovalOutcome`
+  与(包内型)`GateOutcome` 的 `failed` 臂各补一个**可选**位。
+  🔴 **它不参与任何裁决**(server 自己的登记原话:纯指路/便利面,不进任何门/CAS/resume 判定)——
+  缺席是常态且什么都不证明(老 server / 非工具门 / 行读失败 / 本次失败根本不是 stale 臂,四形同形)。
+  🔴 读口是**结构视图读**不是 `instanceof`:decide 出站走的是宿主注入的 client,抛出物的类身份
+  不归本包假设(跨 realm / 双实例 = `HitlSafetyError` 判型契约踩过的同一个坑);而且
+  `ApprovalStaleError.currentPending` 只在 sdk ≥7.3.0 上声明,本包地板是 7.2.0。
+  ⚠️ **可达性如实登记**:sdk 的 `ApprovalDecision` 自 1.0.0 起刻意无 `checkpointToken`,而 server
+  的 stale 臂只在调用方**回显该 token** 时触发 ⇒ **经 SDK client 的 decide 今天拿不到这枚 409**。
+  本位是给「注入自有传输层 / 读别人写的 wire」的宿主与将来上游放行准备的通路,**不是**今天就能
+  在 cli 上观察到的行为改动。
+- **件③ 交互 Esc 停止判定上收**(新模块 `src/interactiveHalt.ts`)。`planInteractiveHalt(...)` +
+  升级码闭集 `RUN_LEVEL_STOP_ERROR_CODES`:「Esc ⇒ 先发 **turn 级** halt;升级成 **run 级** cancel
+  恰有**两格** —— ① 引擎自己回了升级闭集里的 409(它在说「这里没有在飞 turn 可切,run 级停止请用
+  cancel」),或 ② 这一发**连判决都没拿到**且屏上确实挂着审批卡;其余一律不升级」。这条判定 TUI/desktop/web
+  三端都要(都会 Esc、都会撞同一个 parked 格),此前整条住在 cli 壳里。**纯判定**:零 IO、零
+  import、零 module 级状态;发射(裸 fetch / SDK verb)、台账、留痕、UI 反馈仍归各端。
+  不对称是刻意的:判**不**升级 = 用户退回「Session busy」卡再选一次(可恢复);判**错**升级 =
+  拆掉一条其实还活着的 run 并连坐它身上的在飞工具(不可恢复)。
+  🔴 **本批只出口子,壳侧换装不在本批** —— cli 那条「裸 fetch 直拨 interrupt」的网络面豁免,
+  退役条件就是端接上这个口子(见 §7d)。
+
+**异源对抗复审三条 finding 全数采纳并修**:
+- [high] `RUN_LEVEL_STOP_ERROR_CODES` 原本导出成 `ReadonlySet` —— **只在类型面只读**,运行期
+  `.add('interrupt.not_held')` 就能把「不许升级」变成「升级」,把一条**还活着**的 run 不可恢复地
+  拆掉,而模块头注那句「纯判定、零可变态」当场变成假话。改成 `Object.freeze` 的数组
+  (运行期真改不动,公开面与判定源可以安全同物),判据形随之 `.has()` → `.includes()`;
+  门补 G4b 负控:**先真的去改公开面**,再确认判决零漂移。
+- [high] accept-session(`allowSession`)腿的回退臂会**吞掉带 `currentPending` 的 stale 拒绝**,
+  然后用人对**旧卡**给的答案自动重发一次纯 approve(§4d/§4e 铁律禁止的动作),并把首发的指路键
+  顶掉。修:拒体带指路键 ⇒ 立即上抛(只发一次 decide,指路键原样进 outcome);老 server 的
+  400 未知键**照旧回退**,既有兼容腿宽度一字未改。回退臂**更宽的那一半**(404/5xx/无 status 错误
+  仍会回退)是**存量**问题,如实登记为 §7b **P-43**,不在本 additive 批射程内。
+- [medium] §10 / CHANGELOG / README 的总契约句只写了「拿不到判决且 parked 才升级」,漏掉**引擎
+  明确指路**那一格,与同节分支表自相矛盾;端照那句接线会漏接 409 升级分支、让 parked run 留锁。
+  四处文案统一成「升级恰有两格」。
+
+**新增常驻门两道**(`scripts/gates-manifest.json` 同批登记,35 套):
+`run-additive-key-passthrough-test.mjs`(45 checks:白名单键账双向 + §3d 档账对账 + 指路键窄读表
++ durable 两腿真行为 + accept-session 腿真路径 + 三拍平点同形自证)、`run-esc-halt-plan-test.mjs`
+(39 checks:分支表逐格 + 全体负控 + 冻结闭集变异负控 + 纯度/导出形)。两道门各以**单点变异**自证
+判别力(去掉 model 透传 / 只修 allow 不修 deny / 拿掉 ask 腿透传 / 把 parked 闸改恒真 / 拿掉 409
+合取项 / 把闭集改回可变 Set / 拿掉 accept-session 再抛闸 —— 七发全被抓)。
+
+**门侧盲区清账(件③ 换形逼出来的,不是行为改动)**:`RUN_LEVEL_STOP_ERROR_CODES` 改成
+`Object.freeze` 的 `readonly string[]` 之后,singleton 门的枚举器 ⑤ 命中不了它 ——
+`readonly T[]` 在 AST 上是 `TypeOperator(readonly) → ArrayType`,外面那层壳把整条判据挡住了。
+按那道门头注自己的规矩「**扩枚举器 + 同批补清单,别扩豁免**」办:枚举器补一层 readonly 解包
+(自检语料同批加一条),随即浮现 **10 条此前从未被登记**的模块级容器(fleet 四张键清单 /
+headless permissionMode 词表 / seat 四张词表 / `seam.CHROME_ARMS`)—— 全部补登,均 `low`
+(九条是与**已登记** `_TUPLE` 同一个数组对象的只读公开投影,一条是已登记表的一次性 `.map()` 派生)。
+清单 265 → **275** 条,`high` 94 不动。
+
+
+### 已知局限(本版新增)
+
+- 件② 的 `GateOutcome.currentPending`(ask 腿)今天在**包内无消费方**:`GateOutcome` 是包内型、
+  决断结局不出包。它的存在理由是**同形存量清剿**(两条 decide 失败腿一次改齐,不许只修当格),
+  消费条件登记在 `docs/INTEGRATION-CLIENTS.md` §7b。
+- 件① 的 `model` 只**透传**,本包不据它做任何判定/渲染(面板 tick 的事件形没有这一位);
+  端要用就从投影臂上读。
+
 ## 0.46.0(2026-08-30)
 
 两件修复批(#354/#355 双 P0 现网案的 client-core 半场):

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 sema-agent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.46.0
+**Version:** 0.47.0
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -257,6 +257,8 @@ public-surface guard checks that last one).
 | `scripts/run-park-decision-layer-test.mjs` | The decision layer behind the "stuck behind a card" family, shared by every client. A pending row that is **not in the queue** is three states, not one: a bounded, interruptible re-probe loop distinguishes *a decidable row*, *not born yet* (no positive evidence that anything settled — an empty queue proves nothing) and *settled elsewhere*, always probes at least once so a zero budget keeps the pre-fix semantics verbatim, cuts a hung read face off at the window rather than only noticing afterwards, and reports the honest failure when the window is spent instead of inventing a decision. The decision-note reader is likewise three-state: an explicit `noteRecorded: false` outranks an echoed note body, absence renders **no line at all**, and untrusted note text is flattened and bounded before it ever reaches a renderer. Row routing anchors on the deciding quantity — a row carrying `gateKind: "human"` with `toolName: "Write"` is a tool gate, because `human` is the engine's *generic* "someone must decide", not a synonym for a question — and the queue scan refuses to surface a row it cannot positively prove belongs to this session. A chain that fails after the row vanished is split by whether a card was ever presented: decided-elsewhere, or not-its-turn-yet. A row-level single-flight makes "at most one card per pending item" structural rather than incidental. The resume three-way card pins the option **order** (the zero-effect choice sits at index 0, because the frame carries no default-focus field and a stray Enter must not attach or cancel), renders only options the wired verbs can honour, collapses every ambiguous answer to zero action, omits the liveness line entirely when the engine gave no evidence, and — when there is no card lane at all — prints three real routes and exits on a dedicated code rather than reporting success |
 | `scripts/run-selfheal-reopen-test.mjs` | The 409 active-run self-heal decision chain: `governanceForced` narrows on strict `true` only; triage prefers the wire's `pendingGate.kind` and falls back to the status table (an off-table kind is never guessed into a card arm — hands-off plus the honest wording); a first-sight card makes zero closed/reopened claims and a host presentation receipt of `presented: false` demotes the outcome to reopen-failed; park-row ownership is a fail-closed positive proof (own-run ledger or session id — unprovable is not owned); the three gate-identity key literals live in exactly one mint (`hitl/gateIdentity.ts`, AST string-token scan); the armed-gate presentation ledger is per-session; and the `plan_review` reopen arm shares the arm arm's card body, three-state verdict and delivery pipe, consuming the presentation history once a decision is delivered. The same chain also carries the `running` three-way card: both plan-family gate kinds route to the plan arm and all four ask-family kinds to the ask arm (an off-table kind still never gets guessed into either); the card is offered only for verbs that can actually be honoured and a missing presenter means zero action rather than a silent cancel; a steer is sent **exactly once** with its three delivery outcomes worded apart (a `queued` receipt is the wire correcting the triage input, so the named park word decides which card gets reopened, and an unrecognised park word drives neither arm), and a steer failure is split into *provably not delivered* (4xx) and *delivery unknown*, because telling a user to resend a non-idempotent instruction that may already have landed is how duplicates get made. After a user-chosen cancel, "the session is free" is asserted only from a whitelist of terminal states — park states hold the claim, an unrecognised state word is not a release, a failed read is *unknown* rather than a release, and only a 404 counts as one — and the honest timeout line quotes how long it really waited |
 | `scripts/run-terminal-identity-copy-test.mjs` | Terminal-state **identity**, in both lanes where a stop gets a name. A run stopped by this deployment's own governance knobs — the open-set `limits.*` family, `output.invalid`, and the `blocked` contract terminal a ReportBlocked agent produces — is not a provider failure, and labelling it `API Error:` sends the reader to check the network, the key and the quota when the handle is the `--max-turns` they passed themselves. Those terminals now render a neutral row; the reverse direction is guarded just as hard, because asserting "this is *not* an API error" on a code the package does not recognise is the same misfiling pointed the other way — a real `gateway HTTP 502`, a `conflict.session_active_run` and any unknown code all keep the `API Error:` prefix, and the row keeps its `isApiErrorMessage` class flag so brief-mode visibility filtering does not silently drop it. The second half is who the rejected submission belonged to: the self-heal copy told every caller "Your message was NOT sent … send it again", which is three separate untruths for a system injection (a plan-review outcome, a cron wake-up, a task notification) — not the user's message, and not re-sendable, since a host queue marks those non-editable and non-recallable. The injected form says so instead, and the one sentence that promises re-delivery is pinned to the single disposition that earns it: `selfHealSubmissionDisposition` is the same function the host consults before putting the item back on its queue, so the promise and the behaviour cannot drift apart, and the arms where no card could be surfaced state plainly that nothing was delivered and nothing will retry |
+| `scripts/run-additive-key-passthrough-test.mjs` | The one disease shape behind two legs: a **closed whitelist / flattening arm** dropping a fact that is already on the wire, while both sides of the seam look correct. (1) The `task_progress` projection carries a registered **key ledger** — a frame populated with every key the service really projects is pushed through the shipped `eventToSdkMessage`, and the set of wire keys that survive must equal the registered pass-through list **name for name in both directions**, so quietly forwarding one more key is as red as quietly dropping one. `model` (the child run's model id, minted by core as `prepared.model.id` and projected by the server since 7.52.1) is the key this batch adds, with the same conditional the server itself applies: a non-empty string or no key at all — an empty string is neither a model id nor "unknown". The ledger is also checked against the fenced list in `docs/INTEGRATION-CLIENTS.md` §3d, so a doc that still says seven keys while the code forwards eight is red rather than merely stale. (2) The decide-failure arms carry the server's S-02 `currentPending` pointer key from a 409 `approval_stale` refusal onto the outcome the host reads. The reader is structural rather than `instanceof`, because the client is host-injected and the class identity is not this package's to assume; a half triple never mints (half a pointer cannot relocate anything), an empty string is not presence, and `checkpointToken` never transits. Both the allow and the deny leg are driven end to end through the real durable approval path — as is the accept-session leg, where a refusal carrying the pointer key must now re-raise instead of silently re-sending the human's answer for the **old** card as a plain approve (one decide call, pointer preserved), while a legacy 400 still falls back exactly as before — and all three flattening points must call the one shared reader — the same-shape residue check that makes "fixed one arm and left the twin" red instead of invisible |
+| `scripts/run-esc-halt-plan-test.mjs` | The Esc stop decision every client shares: fire the **turn-level** halt first, and escalate to a **run-level** cancel in exactly two cases — the engine itself answered with a 409 from the closed code set (it is saying "there is no in-flight turn here; use cancel for a run-level stop"), or that shot came back with no verdict at all *and* the shell can independently prove a permission card was on screen. Everything else does not escalate. The asymmetry is the whole point and every negative control guards the same direction — deciding *not* to escalate costs the user one more choice on a busy-session card (recoverable), deciding to escalate wrongly tears down a run that was alive and takes every in-flight tool with it (not). So: the closed code set is a **frozen** value, not a `ReadonlySet` — type-level immutability does not stop a consumer's `.add()`, and the guard proves it by really trying to mutate the exported value and then checking the verdict did not drift; the escalation gate is the **conjunction** of that closed set and the 409 status, since honouring the code alone lets a 500 that merely quotes it drive a destructive call; `interrupt.not_held` and `steering.not_running` are deliberately outside the set (the first means *this replica* has no live face — the run may be perfectly alive on another); an unreadable code falls to the no-escalation side; a `parked` flag never overrides a verdict the engine did give, and only strict `true` counts when it did not. The first shot is unconditional by construction — it does not consult `parked`, because the 409 it earns is exactly the verdict the gate wants — and the verdict itself is a closed machine-readable reason word, not display copy |
 
 Each suite carries a floor that only moves up — a refactor that stops executing a group of
 assertions is a failure, not a quieter pass. Guards anchor on the **installed artefact's content**

package/dist/adapter/downstream/eventToSdkMessage.js

@@ -382,9 +382,29 @@ export function eventToSdkMessage(ev, ctx) {
         // NEUTRAL internal `task_progress` arm — NOT a renderable CC SDKMessage. The upstream bridge binds it
         // to the open Task/Agent tool_use card and synthesizes CC-native `progress` messages so CC's own
         // Task-card rollup (tool uses / tokens climbing) animates for an ENGINE-side subagent exactly like a
-        // local AgentTool one. Fields are read DEFENSIVELY: the service wire whitelist (server.ts:1334-1342)
-        // strips `status` + EventIdentity and may omit `name` — mirror what actually rides the wire, not the
-        // richer core-side arm.
+        // local AgentTool one. Fields are read DEFENSIVELY: the service wire whitelist may omit `name` —
+        // mirror what actually rides the wire, not the richer core-side arm.
+        // 🔴 **就地订正**(#363,0.47.0,真字节实证):本句原文写的是「the service wire whitelist
+        //    (server.ts:1334-1342) strips `status` + EventIdentity」—— 那是**错的**,而且方向正好相反:
+        //    server 7.52.1 的 `taskProgressEventData` **发** `status`,`identityFields` 也**发**
+        //    `eventId` + `parentToolCallId`(见下面的族扫账)。剥掉它们的是**本层**,不是 service。
+        //    这句错话正是「两边代码看着都对」的一部分:它把本层自己的白名单说成了上游的缺席。
+        //
+        // ── 🔴 本臂白名单的**族扫账**(#363,0.47.0;真源 = server 7.52.1 `trace/project.js` 的
+        //    `taskProgressEventData` + `identityFields` 真字节,不是推断)────────────────────────────
+        // server 投影**发** 13 键:taskId · seq · taskType · parentTaskId · name · model · status ·
+        //   usage · currentAction · workflowRunId · workflowAgentLabel · eventId · parentToolCallId。
+        // 本臂**转** 8 键:taskId · name · usage · model · currentAction · workflowRunId ·
+        //   workflowAgentLabel · parentToolCallId。
+        // ⇒ **仍被本层剥掉的 5 键**(逐条登记,刻意不静默多透 —— 每一位都要有消费方与语义才配上臂):
+        //   · `taskType` / `status` / `parentTaskId` —— 早已在册的 §7 缺口 **P-1**(lane 归属今天改用
+        //     id 形状 / `workflowRunId` 启发式判,见 `src/adapt/arms.ts`);
+        //   · `seq` —— core #258 的 stop-cycle 代际号(复活即 +1)。fleet 面已有同轴的
+        //     `wireCycleSeq`(0.38.0),tick 这条腿今天**没有**消费方;SDK 7.3.0 的 `task_progress` 臂
+        //     连声明都没有(core/server 两侧都有)。
+        //   · `eventId` —— EventIdentity 的另一半。`status` 臂 2026-08-08 已因跨 lane 状态破坏补齐两键,
+        //     本臂只补了 `parentToolCallId`(lane 判据要它),`eventId` 至今无消费方。
+        // 上面三档的共同纪律:要透哪一位,先说得出**谁读它、读来干什么**,并同批更新 §3d 的键级剥离账。
         case 'task_progress': {
             if (typeof ev.taskId !== 'string')
                 return dropped('malformed', 'task_progress');
@@ -400,11 +420,27 @@ export function eventToSdkMessage(ev, ctx) {
             // 仍剥这两键(server a76bd77 才修,[1619])——真 wire 于 1.273+ 才带,此处先备好通路。
             const workflowRunId = ev.workflowRunId;
             const workflowAgentLabel = ev.workflowAgentLabel;
+            // #363(0.47.0,提货批取证定谳)— `model`:这条 tick 所属子 run 的**模型 id**。
+            // 🔴 上游真字节(不是推断):server 7.52.1 `dist/trace/project.js` 的
+            //    `taskProgressEventData` 白名单里逐字有
+            //    `...(typeof ev.model === "string" && ev.model.length > 0 ? { model: ev.model } : {})`,
+            //    三条腿(bg runs.ts / resume append / 同步 live SSE)共用它;core 铸点 = `prepared.model.id`。
+            //    cli 侧 live 采帧同批实证过一条真帧带 `"model":"deepseek-v4-flash"`。
+            // 🔴 病形与 `workflowRunId` **同形第二例**([1616]/[1617]②):这层白名单是闭形的,于是一条
+            //    **已经在 wire 上**的事实到不了宿主,而两边代码看着都对(「送到了但没人读」的精确坐标
+            //    其实是「没转」)。additive 透传,旧 server 缺席 ⇒ 键不 stamp,形状逐字节不变。
+            // 🔴 **结构视图读**:sdk 7.3.0(今天 npm 上的最新版)的 `task_progress` 臂**尚未声明**这一位
+            //    —— 与 `requiresRealApproval`(#283)/ `ruleOffers`(#334)同形:**server 已真发、SDK 锚未跟**。
+            //    照那两例的先例先追 server 不等 SDK;SDK 补上当天这处 cast 可整条删掉(退役条件)。
+            // 🔴 条件 spread 与 server 投影**同形同条件**:`string` 且非空才带。空串既不是模型 id 也不是
+            //    「不知道」,透下去只会在面板上渲成一个空模型名([honest-absence-not-fabricated-zero])。
+            const model = ev.model;
             return projected(stamp(ctx, armBody({
                 type: 'task_progress',
                 taskId: ev.taskId,
                 ...(ev.name !== undefined ? { name: ev.name } : {}),
                 ...(ev.usage !== undefined ? { usage: ev.usage } : {}),
+                ...(typeof model === 'string' && model.length > 0 ? { model } : {}),
                 ...(typeof currentAction === 'string' && currentAction.length > 0
                     ? { currentAction }
                     : {}),

package/dist/hitl/gateLedger.d.ts

@@ -211,10 +211,31 @@ export interface GateLedger {
      * 「已解决」,吃满 `MAX_GATE_HOPS` 才吐一句 `gate hop limit exceeded` —— 用户白等 24 轮往返,
      * 拿到的还是一句与真因无关的话(真因被预算话术顶掉了)。
      * 消费一次即失效之后:第一次(= 真的重放)照旧救回,第二次就是诚实的 fail-soft。
+     *
+     * ✅ **同形存量已销**(#357,0.47.0):上面这段描述的病形在**身份判据**这一腿由本动词的一次性
+     * 语义关掉,但它的**孪生腿**(`isAlreadyResolvedFailure` 的 code/文案判据)当时没有任何限次 ——
+     * 那一腿在「run 仍 parked 而取件读到空表」的坐标失配态下每轮都命中,照样烧满 24 个 hop。
+     * 闸坐标 = {@link noteAlreadyResolvedGate} + `parkResolver.MAX_ALREADY_RESOLVED_REATTACHES`
+     * (同因连续第 2 次即不再 reattach),主修 = `parkResolver` 的坐标重探臂。
      */
     takeDecided(callId: string): boolean;
     /** 只给 debug 串用的规模位(`[decided so far: N]`)。 */
     decidedCount(): number;
+    /**
+     * 记一次「这张 park 被判成**已解决**」的命中,返回**同一判据源**的连续命中次数(第一次 = 1)。
+     * 判据源换了(`key` 不等)⇒ 从 1 重新计。
+     *
+     * 🔴 为什么闸态放在台账而不是 `resolvePark` 里:`resolvePark` 是**无实例态的纯函数**,而这条闸
+     * 要跨多次 park 才成立 —— 与 `hops` 同源(那也是驱动侧跨 park 累加、经 `ParkResolveCtx` 传进去
+     * 的量)。台账是本 turn 里唯一活得比一次 park 长、且**只有一个写者**的载体。
+     *
+     * 🔴 `key` 必须是**归一化的判据源**(命中它的那个码 / 那个文案子串),不是原始 reason 串 ——
+     * reason 里带着每轮都不一样的尾巴(`decide failed: Error: …`),拿它当键会让「连续」永远不成立,
+     * 闸当场退化成空转([anchor-on-the-deciding-quantity])。
+     */
+    noteAlreadyResolvedGate(key: string): number;
+    /** 判据链上出现了真进展(park 真被决断 / 重探把新坐标的卡呈出去了)⇒ 连续计数归零。 */
+    resetAlreadyResolvedGate(): void;
 }
 /** 造一份 turn 级 gate 台账(**不是单例**,见文件头注)。 */
 export declare function createGateLedger(): GateLedger;

package/dist/hitl/gateLedger.js

@@ -20,6 +20,9 @@ export function createGateLedger() {
     const pendingFsCalls = [];
     const resolvedAnswers = new Map();
     const decidedGates = new Set();
+    /** 「已解决」判据的**同因连续命中**闸(#357):判据源 + 连续次数,见 `noteAlreadyResolvedGate`。 */
+    let alreadyResolvedKey;
+    let alreadyResolvedStreak = 0;
     // ── 批级判据(四样同生共死,退休点见 `retireBatchState` 的两处调用)────────────────────────
     /** 本批 park 属 fs/shell 族的准入证(唯一性兜底的前置)。 */
     let fsOrShellFamilyGate = false;
@@ -266,5 +269,19 @@ export function createGateLedger() {
         decidedCount() {
             return decidedGates.size;
         },
+        noteAlreadyResolvedGate(key) {
+            if (key === alreadyResolvedKey) {
+                alreadyResolvedStreak += 1;
+            }
+            else {
+                alreadyResolvedKey = key;
+                alreadyResolvedStreak = 1;
+            }
+            return alreadyResolvedStreak;
+        },
+        resetAlreadyResolvedGate() {
+            alreadyResolvedKey = undefined;
+            alreadyResolvedStreak = 0;
+        },
     };
 }

package/dist/hitl/hitlBridge.d.ts

@@ -155,6 +155,56 @@ export declare class HitlSafetyError extends Error {
      *  一边加一边不改另一边 = 新码在消费端被静默吞掉(比不加还坏:本地拦住了,判词却丢了)。 */
     code: 'binding_mismatch' | 'no_pending' | 'wrong_gate' | 'bad_plan_edit' | 'empty_answer');
 }
+/**
+ * decide 409 `approval_stale` 拒体上的 **additive 指路键** `currentPending` —— 本会话**当前**那条
+ * pending 的三件 D-1 坐标(#363,0.47.0;server S-02 ≥7.52)。
+ *
+ * ── 它是什么、不是什么 ────────────────────────────────────────────────────────────────────
+ * 是:「你手上那条已经不是当前的了,**当前**这条长这样」——壳拿它**一跳重定位**再 decide,
+ *     免去整队重拉(`GET /v1/approvals`)。
+ * 不是:放行凭据 / CAS 输入 / resume 凭证。server 自己的 fail-open 登记原话逐字:
+ *     「纯指路/便利面,**不参与任何门/CAS/resume 判定**」。⇒ 缺席的代价 = 退回它到货前的行为
+ *     (重拉列表自行重定位),所以本包对它一律**宽读、诚实缺席**,绝不 fail-closed。
+ * 🔴 **恒不含 `checkpointToken`**(server 侧 resume 凭证不外发纪律)——本形也刻意没有那一位:
+ *     多一个位就是给一个「凭证能过境」的错觉。
+ *
+ * ── 为什么本包自铸这个形(记账,不是偷懒)────────────────────────────────────────────────
+ * `@sema-agent/sdk` **7.3.0** 已有逐字同形的 `ApprovalStaleCurrentPending`(`dist/types.d.ts`)+
+ * `ApprovalStaleError.currentPending` 第 5 构造参。但本包的 peer 地板是 **>=7.2.0**,那一版上这两个
+ * 名字都不存在 ⇒ `import type` 会让**装 7.2.0 的端当场编不过**,而抬地板不是 additive(它是对所有
+ * 消费方提要求)。⇒ 与 `RuleOffer`(#334)同款处置:**自铸形 + 记账**,名字刻意**不同名**
+ * (`GateCurrentPending` ≠ `ApprovalStaleCurrentPending`),免得地板线下出现一个与上游同名却不同源的
+ * 形([same-name-different-meaning-crosses-layers])。
+ * 🔴 **退役条件**:本包 peer 地板抬到 `>=7.3.0` 的那一批,把本形改成
+ *    `import type { ApprovalStaleCurrentPending } from '@sema-agent/sdk'` 的别名并删掉这段记账。
+ */
+export interface GateCurrentPending {
+    /** 当前 pending 被门住的工具名(与 pending 行 `toolName` 同源同值)。UNTRUSTED-for-display。 */
+    readonly toolName: string;
+    /** 当前 pending 的 `pendingAction.toolCallId` —— 壳重定位后 decide 要**逐字回显**的 D-1 锚。 */
+    readonly boundCallId: string;
+    /** server 铸的 `boundInputHash`(行上有才带)。🔴 逐字回显,**绝不本地重算**(§9.1 同一条铁律)。 */
+    readonly boundInputHash?: string;
+}
+/**
+ * 从一次 decide 失败(任意抛出物)里读出 {@link GateCurrentPending} —— 读不出即 `undefined`。
+ *
+ * 🔴 **结构视图读,不 `instanceof`**(两条理由,都是承重的):
+ *   ① **供给面**:本包的 decide 出站走的是宿主注入的 `HitlClientLike`(见该型)。抛出来的到底是不是
+ *      SDK 的 `ApprovalStaleError` 由**宿主**决定 —— web/desktop 完全可以注入自己的传输层。拿
+ *      `instanceof` 当闸,等于让「宿主用的是哪一份 SDK 实例」决定一个纯读值的位在不在
+ *      (跨 realm / 双实例 = `HitlSafetyError` 判型契约踩过的同一个坑,见 §4e)。
+ *   ② **类型面**:`ApprovalStaleError.currentPending` 只在 sdk ≥7.3.0 上声明,而本包地板是 7.2.0
+ *      (理由见 {@link GateCurrentPending} 的记账段)。
+ * 🔴 **判据锚在「值本身合不合形」,不锚它骑在哪个类/哪个 errorCode 上**
+ *    ([anchor-on-the-deciding-quantity]):真正决定「壳能不能一跳重定位」的量,是**这个三元组的
+ *    两件必填位在不在且是非空串** —— 而不是错误的类名。宽读在这里是**方向安全**的:本位不参与
+ *    任何裁决(见 {@link GateCurrentPending} 顶注),多读到一次的代价 = 多一条指路;漏读的代价 =
+ *    退回整队重拉。
+ * 🔴 **两件必填位缺一即整只不铸**:半个三元组重定位不了(`decide` 要的是 boundCallId 本体),
+ *    铸一个残形只会让消费点以为「有指路」。`boundInputHash` 是**行上有才带**的可选位,缺席照铸。
+ */
+export declare function readDecideCurrentPending(e: unknown): GateCurrentPending | undefined;
 /** 测试钩:把超时类重试总窗调小(传 undefined 还原缺省)。 */
 export declare function __setDecideTimeoutRetryBudgetForTests(ms?: number): void;
 /**

package/dist/hitl/hitlBridge.js

@@ -53,6 +53,41 @@ export class HitlSafetyError extends Error {
         this.name = 'HitlSafetyError';
     }
 }
+/**
+ * 从一次 decide 失败(任意抛出物)里读出 {@link GateCurrentPending} —— 读不出即 `undefined`。
+ *
+ * 🔴 **结构视图读,不 `instanceof`**(两条理由,都是承重的):
+ *   ① **供给面**:本包的 decide 出站走的是宿主注入的 `HitlClientLike`(见该型)。抛出来的到底是不是
+ *      SDK 的 `ApprovalStaleError` 由**宿主**决定 —— web/desktop 完全可以注入自己的传输层。拿
+ *      `instanceof` 当闸,等于让「宿主用的是哪一份 SDK 实例」决定一个纯读值的位在不在
+ *      (跨 realm / 双实例 = `HitlSafetyError` 判型契约踩过的同一个坑,见 §4e)。
+ *   ② **类型面**:`ApprovalStaleError.currentPending` 只在 sdk ≥7.3.0 上声明,而本包地板是 7.2.0
+ *      (理由见 {@link GateCurrentPending} 的记账段)。
+ * 🔴 **判据锚在「值本身合不合形」,不锚它骑在哪个类/哪个 errorCode 上**
+ *    ([anchor-on-the-deciding-quantity]):真正决定「壳能不能一跳重定位」的量,是**这个三元组的
+ *    两件必填位在不在且是非空串** —— 而不是错误的类名。宽读在这里是**方向安全**的:本位不参与
+ *    任何裁决(见 {@link GateCurrentPending} 顶注),多读到一次的代价 = 多一条指路;漏读的代价 =
+ *    退回整队重拉。
+ * 🔴 **两件必填位缺一即整只不铸**:半个三元组重定位不了(`decide` 要的是 boundCallId 本体),
+ *    铸一个残形只会让消费点以为「有指路」。`boundInputHash` 是**行上有才带**的可选位,缺席照铸。
+ */
+export function readDecideCurrentPending(e) {
+    const raw = e?.currentPending;
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const o = raw;
+    if (typeof o.toolName !== 'string' || o.toolName.length === 0)
+        return undefined;
+    if (typeof o.boundCallId !== 'string' || o.boundCallId.length === 0)
+        return undefined;
+    return {
+        toolName: o.toolName,
+        boundCallId: o.boundCallId,
+        ...(typeof o.boundInputHash === 'string' && o.boundInputHash.length > 0
+            ? { boundInputHash: o.boundInputHash }
+            : {}),
+    };
+}
 // ── decide 出站的瞬断分诊与有界重试(Inkglow-1085 P0a,2026-08-19;[4664] server 定谳后对表)────
 //
 // 病形(案卷 INKGLOW-1085 车1 全链):`approvals.decide` 是**非 submit POST** —— SDK transport 对它

package/dist/hitl/parkResolver.d.ts

@@ -13,6 +13,7 @@
  *    在驱动的消费点上必然显形,而不是被本文件自己吞掉。
  */
 import type { AgentEvent } from '@sema-agent/sdk';
+import { type GateCurrentPending } from './hitlBridge.js';
 import { type QuestionAnswer } from '../liveQuestionStore.js';
 import type { AskAnsweredOutput, GateLedger } from './gateLedger.js';
 import { type AskGateWireDeps, type GatePark } from './frameRouter.js';
@@ -46,6 +47,7 @@ export type GateOutcome = {
     reason: string;
     code?: GateFailureCode | undefined;
     retryExhausted?: true;
+    currentPending?: GateCurrentPending | undefined;
 };
 /**
  * decide 的 `failed` 原因是不是「这个 gate 早就被解决了」(#110 缺陷② c 的判据)。