@sema-agent/client-core 0.99.0 → 0.101.0

package/dist/hitl/planReviewWire.js

@@ -7,10 +7,12 @@ import { enqueuePlanReviewOutcome } from '../notifications.js';
 import { corruptStoredRowContent, corruptStoredRowWhere } from '../wireErrorTriage.js';
 import { decideFailureNote } from '../decideFailureNote.js';
 import { wireFailureTextsOf } from '../wireFailureShape.js';
-import { readOwnDataNonEmptyString, readOwnDataValue } from '../ownKey.js';
+import { appendOwnElement, readOwnDataNonEmptyString, readOwnDataValue } from '../ownKey.js';
 import { checkpointUnsupportedVersionContent, checkpointUnsupportedVersionFromError, resumeContextUnavailableContent, resumeContextUnavailableFromError } from '../resumeRefusalCopy.js';
 import { REQUEST_FIELD_CONFLICT } from '../engineErrorCodes.js';
 import { refusalDeliveryOf } from './decisionRefusal.js';
+import { directFailureVerdictOf, directSafetyStopOf } from './approvalResolution.js';
+import { __resetDecisionLedgerForTests, decisionInFlightOf, decisionKeyInFlight, decisionLedgerKeysOf, decisionOpsWithKey, decisionReadMark, dropDecisionOp, latestDecisionHandedMark, markLatestDecisionNotApplied, openDecisionOp, planDecisionKey, readMarkOf, settleDecisionOp, settleDecisionOpsOnGateLeft, } from './decisionLedger.js';
 import { denyReasonForWire, isPlanReviewModeAfter } from './hitlBridge.js';
 import { planReviewQuestionId, REOPEN_ID_TAIL, taskIdFromPlanReviewQuestionId } from './gateIdentity.js';
 import { notePlanReviewAnswered, notePlanReviewAnsweredFor, planReviewArmedKeyFor, waitForGateArmedFor, wasGateArmedFor, } from './armedGateRegistry.js';
@@ -25,12 +27,8 @@ export const PLAN_REVIEW_APPROVE_MANUAL_LABEL = 'Yes, and manually approve edits
 const APPROVE_LABEL = PLAN_REVIEW_APPROVE_LABEL;
 const REJECT_LABEL = PLAN_REVIEW_REJECT_LABEL;
 const LEGACY_TWO_CHOICE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT_LABEL]);
-const ALL_KNOWN_LABELS = Object.freeze([
-    PLAN_REVIEW_APPROVE_AUTO_LABEL,
-    PLAN_REVIEW_APPROVE_MANUAL_LABEL,
-    PLAN_REVIEW_APPROVE_LABEL,
-    PLAN_REVIEW_REJECT_LABEL,
-]);
+const THREE_CHOICE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_AUTO_LABEL, PLAN_REVIEW_APPROVE_MANUAL_LABEL, PLAN_REVIEW_REJECT_LABEL]);
+const ANY_CARD_SHAPE_LABELS = Object.freeze([PLAN_REVIEW_APPROVE_AUTO_LABEL, PLAN_REVIEW_APPROVE_MANUAL_LABEL, PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT_LABEL]);
 export function planReviewDecisionFromAnswer(answer, shownLabels = LEGACY_TWO_CHOICE_LABELS) {
     const { choice } = readPlanReviewAnswer(answer, shownLabels);
     if (choice === 'dismissed')
@@ -100,7 +98,7 @@ export function notePlanReviewAnsweredIfDecisive(questionId, answer) {
     notePlanReviewAnsweredIfDecisiveFor(DEFAULT_SESSION_KEY, questionId, answer);
 }
 function notePlanReviewAnsweredIfDecisiveFor(sessionKey, questionId, answer) {
-    if (planReviewDecisionFromAnswer(answer ?? { answers: [] }, ALL_KNOWN_LABELS) === 'dismissed')
+    if (planReviewDecisionFromAnswer(answer ?? { answers: [] }, planReviewShownLabelsOf(questionId) ?? ANY_CARD_SHAPE_LABELS) === 'dismissed')
         return;
     notePlanReviewAnsweredFor(sessionKey, questionId);
     const taskId = typeof questionId === 'string' ? taskIdFromPlanReviewQuestionId(questionId) : undefined;
@@ -275,7 +273,7 @@ function ownElementsOf(v, max) {
     const n = Math.min(v.length, max);
     const out = [];
     for (let i = 0; i < n; i++)
-        out.push(readOwnDataValue(v, String(i)));
+        appendOwnElement(out, readOwnDataValue(v, String(i)));
     return out;
 }
 function offeredModeFromLabels(card) {
@@ -332,6 +330,33 @@ export function planReviewOfferedModeOf(card) {
         return 'unknown';
     }
 }
+export function planReviewShownLabelsOf(questionId) {
+    try {
+        if (typeof questionId !== 'string')
+            return undefined;
+        const recorded = offeredModeByQuestionId.get(questionId);
+        if (recorded !== undefined)
+            return recorded ? THREE_CHOICE_LABELS : LEGACY_TWO_CHOICE_LABELS;
+        for (const t of armedPlanReviewTaskIds) {
+            if (planReviewQuestionId(t) === questionId)
+                return offerModeAfterByTask.get(t) === true ? THREE_CHOICE_LABELS : LEGACY_TWO_CHOICE_LABELS;
+        }
+        if (taskIdFromPlanReviewQuestionId(questionId) === undefined)
+            return undefined;
+        return questionId.includes(REOPEN_ID_TAIL) ? LEGACY_TWO_CHOICE_LABELS : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function planReviewAnswerChoiceOf(questionId, answer) {
+    const shown = planReviewShownLabelsOf(questionId);
+    return shown === undefined ? 'dismissed' : planReviewChoiceFromAnswer(answer, shown);
+}
+export function planReviewAnswerDecisionOf(questionId, answer) {
+    const shown = planReviewShownLabelsOf(questionId);
+    return shown === undefined ? 'dismissed' : planReviewDecisionFromAnswer(answer, shown);
+}
 export function armPlanReviewApproval(result, sessionKey, opts) {
     let armedTaskId;
     try {
@@ -377,10 +402,9 @@ export function armPlanReviewApproval(result, sessionKey, opts) {
             offerModeAfterByTask.delete(taskId);
         const questionId = planReviewQuestionId(taskId);
         const unregister = registerLocalQuestionResponder(questionId, async (_id, answer) => {
+            const choice = planReviewAnswerChoiceOf(questionId, answer);
             unregister();
             armedPlanReviewTaskIds.delete(taskId);
-            const shown = planReviewCardOptions(offerModeAfterByTask.get(taskId) === true).map(o => o.label);
-            const choice = planReviewChoiceFromAnswer(answer, shown);
             if (choice === 'dismissed') {
                 notePlanReviewUserDismissalFor(DEFAULT_SESSION_KEY, taskId, opts?.readGateInstanceKeys, questionId);
                 return { ok: true };
@@ -457,42 +481,21 @@ function usablePlanReviewWireClient(client) {
     return clientHasVerbs(client, [['assistant', 'planReview'], ['runs', 'get']]);
 }
 const PLAN_REVIEW_INJECTED_REPULL_TIMEOUT_MS = 15_000;
-const planReviewDecisionOps = [];
-const MAX_PLAN_REVIEW_DECISION_OPS = 32;
-let planReviewLedgerClock = 0;
-let decideDispatchSeq = 0;
-function planReviewOpsOf(taskId) {
-    return planReviewDecisionOps.filter((op) => op.taskId === taskId);
-}
-function settlePlanReviewDecisionOp(op, by) {
-    if (op.settledAt !== null)
-        return;
-    op.settledAt = ++planReviewLedgerClock;
-    op.settler = by;
-}
-function pushPlanReviewDecisionOp(op) {
-    planReviewDecisionOps.push(op);
-    while (planReviewDecisionOps.length > MAX_PLAN_REVIEW_DECISION_OPS) {
-        let victim = planReviewDecisionOps.findIndex((o) => o.settledAt !== null && !o.ownCallOpen);
-        if (victim < 0)
-            victim = planReviewDecisionOps.findIndex((o) => o !== op && o.phase === 'handed');
-        if (victim < 0)
-            break;
-        planReviewDecisionOps.splice(victim, 1);
-    }
+function planReviewLedgerKeys(taskId) {
+    return taskId === '' ? [planDecisionKey('')] : decisionLedgerKeysOf({ taskId, planTaskId: taskId });
 }
-function dropPlanReviewDecisionOp(op) {
-    const i = planReviewDecisionOps.indexOf(op);
-    if (i >= 0)
-        planReviewDecisionOps.splice(i, 1);
+function planReviewOpsOf(taskId) {
+    return decisionOpsWithKey('plan_review', planDecisionKey(taskId));
 }
+let decideDispatchSeq = 0;
 function claimablePlanReviewDecisionOp(taskId) {
-    const open = planReviewDecisionOps.find((o) => o.taskId === taskId && o.phase === 'handed' && o.settledAt === null);
+    const ops = planReviewOpsOf(taskId);
+    const open = ops.find((o) => o.phase === 'handed' && o.settledAt === null);
     if (open !== undefined)
         return open;
     let leftBehind;
-    for (const o of planReviewDecisionOps) {
-        if (o.taskId !== taskId || o.phase !== 'handed' || o.settler !== 'gate_left')
+    for (const o of ops) {
+        if (o.phase !== 'handed' || o.settler !== 'gate_left')
             continue;
         if (leftBehind === undefined || o.handedAt > leftBehind.handedAt)
             leftBehind = o;
@@ -502,62 +505,47 @@ function claimablePlanReviewDecisionOp(taskId) {
 export function notePlanReviewDecisionHandedOver(taskId) {
     if (typeof taskId !== 'string' || taskId === '')
         return null;
-    if (planReviewDecisionOps.some((op) => op.taskId === taskId && op.settledAt === null))
+    if (planReviewOpsOf(taskId).some((op) => op.settledAt === null))
         return null;
-    const op = { taskId, handedAt: ++planReviewLedgerClock, settledAt: null, settler: null, phase: 'handed', notApplied: false, ownCallOpen: false };
-    pushPlanReviewDecisionOp(op);
+    const op = openDecisionOp('plan_review', planReviewLedgerKeys(taskId), 'handed', false);
     return {
         settle: () => {
             if (op.phase !== 'handed')
                 return;
-            settlePlanReviewDecisionOp(op, 'host');
+            settleDecisionOp(op, 'host');
         },
         revoke: () => {
             if (op.phase !== 'handed' || op.settledAt !== null)
                 return;
-            dropPlanReviewDecisionOp(op);
+            dropDecisionOp(op);
         },
     };
 }
 export function planReviewPendingReadMark() {
-    return ++planReviewLedgerClock;
+    return decisionReadMark();
 }
 export function planReviewDecisionInFlight(taskId, pendingReadStartedAt) {
     if (typeof taskId !== 'string' || taskId === '')
         return false;
-    const mark = typeof pendingReadStartedAt === 'number' && Number.isFinite(pendingReadStartedAt) ? pendingReadStartedAt : undefined;
-    return planReviewDecisionOps.some((op) => op.taskId === taskId && (op.settledAt === null || (mark !== undefined && op.settledAt > mark && !op.notApplied)));
+    return decisionKeyInFlight(planDecisionKey(taskId), readMarkOf(pendingReadStartedAt));
 }
 export function notePlanReviewDecisionNotApplied(taskId) {
     if (typeof taskId !== 'string' || taskId === '')
         return;
-    const ops = planReviewOpsOf(taskId);
-    if (ops.some((op) => op.settledAt === null))
-        return;
-    let latest;
-    for (const op of ops)
-        if (latest === undefined || op.handedAt > latest.handedAt)
-            latest = op;
-    if (latest !== undefined)
-        latest.notApplied = true;
+    markLatestDecisionNotApplied('plan_review', planDecisionKey(taskId));
 }
 export function notePlanReviewGateLeft(taskId) {
     if (typeof taskId !== 'string' || taskId === '')
         return;
-    for (const op of planReviewOpsOf(taskId))
-        settlePlanReviewDecisionOp(op, 'gate_left');
+    settleDecisionOpsOnGateLeft('plan_review', planDecisionKey(taskId));
 }
 export function latestPlanReviewDecisionMark(taskId) {
     if (typeof taskId !== 'string' || taskId === '')
         return null;
-    let mark = null;
-    for (const op of planReviewOpsOf(taskId))
-        if (mark === null || op.handedAt > mark)
-            mark = op.handedAt;
-    return mark;
+    return latestDecisionHandedMark('plan_review', planDecisionKey(taskId));
 }
 export function __resetPlanReviewDecisionLatchForTests() {
-    planReviewDecisionOps.length = 0;
+    __resetDecisionLedgerForTests('plan_review');
 }
 export async function decidePlanReview(taskId, decision, permissionModeAfter, opts) {
     return decidePlanReviewFor(taskId, decision, permissionModeAfter, opts, parkedGateIdentityOf(opts));
@@ -574,22 +562,22 @@ function planReviewSettledVerdict(r) {
     const status = r.postStatus ?? r.bodyStatus;
     const gateMoved = r.gateBefore !== undefined && r.gateAfter !== undefined && r.gateAfter !== r.gateBefore;
     if (r.reparked)
-        return status !== 'completed' && !gateMoved ? { effect: 'still_parked', proven: true } : { effect: 'unconfirmed', proven: false };
+        return status !== 'completed' && !gateMoved ? 'still_parked' : 'unconfirmed';
     if (status === 'completed')
-        return { effect: 'took_effect', proven: false };
+        return 'took_effect';
     const newGateHasCard = () => {
         const leg = durableDecideLegOf({ gateKind: r.gateKindAfter ?? null });
         return leg === 'approval' || leg === 'plan_review';
     };
     if (status === 'suspended' && r.postStatus === 'suspended' && newGateHasCard())
-        return { effect: 'advanced', proven: false };
+        return 'advanced';
     if (status === 'needs_review' && r.postStatus === 'needs_review' && r.gateBefore !== undefined && r.gateAfter !== undefined) {
         if (r.gateAfter === r.gateBefore)
-            return { effect: 'still_parked', proven: true };
+            return 'still_parked';
         if (newGateHasCard())
-            return { effect: 'advanced', proven: false };
+            return 'advanced';
     }
-    return { effect: 'unconfirmed', proven: false };
+    return 'unconfirmed';
 }
 function bodyWordOf(body, key) {
     try {
@@ -609,14 +597,13 @@ function bodySaysReparked(body) {
     }
 }
 async function decidePlanReviewFor(taskId, decision, permissionModeAfter, opts, gateBefore) {
-    if (typeof taskId === 'string' && planReviewDecisionOps.some((op) => op.taskId === taskId && op.phase === 'posting')) {
+    if (typeof taskId === 'string' && planReviewOpsOf(taskId).some((op) => op.phase === 'posting')) {
         hostLog('error', `planReviewWire: decidePlanReview(${decision}) for task ${taskId} REFUSED — a decision for this task is already in flight (duplicate delivery latched)`);
         return;
     }
-    let op = claimablePlanReviewDecisionOp(taskId);
+    let op = typeof taskId === 'string' ? claimablePlanReviewDecisionOp(taskId) : undefined;
     if (op === undefined) {
-        op = { taskId: typeof taskId === 'string' ? taskId : String(taskId), handedAt: ++planReviewLedgerClock, settledAt: null, settler: null, phase: 'posting', notApplied: false, ownCallOpen: true };
-        pushPlanReviewDecisionOp(op);
+        op = openDecisionOp('plan_review', planReviewLedgerKeys(typeof taskId === 'string' ? taskId : String(taskId)), 'posting', true);
     }
     else {
         if (op.settler === 'gate_left') {
@@ -635,7 +622,7 @@ async function decidePlanReviewFor(taskId, decision, permissionModeAfter, opts,
     const settle = (notApplied) => {
         if (notApplied)
             mine.notApplied = true;
-        settlePlanReviewDecisionOp(mine, 'package');
+        settleDecisionOp(mine, 'package');
     };
     const dispatchNo = ++decideDispatchSeq;
     hostLog('debug', `planReviewWire: decidePlanReview dispatch #${dispatchNo} task=${taskId} decision=${decision} mode=${permissionModeAfter ?? '-'}`);
@@ -644,7 +631,7 @@ async function decidePlanReviewFor(taskId, decision, permissionModeAfter, opts,
     }
     finally {
         releaseLatch();
-        settlePlanReviewDecisionOp(mine, 'package');
+        settleDecisionOp(mine, 'package');
         mine.ownCallOpen = false;
     }
 }
@@ -665,7 +652,6 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     let outcome;
     let effect = 'unconfirmed';
     let stillParkedCause;
-    let stillParkedProven = false;
     let statusSeen;
     const wire = opts?.wire;
     const resolved = engineWireFor(clientOnlyView(wire), DEFAULT_SESSION_KEY, usablePlanReviewWireClient);
@@ -708,7 +694,8 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 }
                 catch (e1) {
                     const conflict = e1;
-                    if (mode === 'default' && conflict?.status === 400 && conflict?.errorCode === REQUEST_FIELD_CONFLICT) {
+                    const defaultConflict = mode === 'default' && conflict?.status === 400 && conflict?.errorCode === REQUEST_FIELD_CONFLICT;
+                    if (defaultConflict && !directFailureVerdictOf(e1, directSafetyStopOf(e1)).yields) {
                         hostLog('debug', 'planReviewWire: permissionModeAfter "default" refused as not applicable — re-sending the approval without the key (same meaning)');
                         body = await sendOnce(undefined, () => client.assistant.planReview(taskId, reason !== undefined ? { decision, reason } : { decision }));
                     }
@@ -749,9 +736,7 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 const bodyStatus = bodyWordOf(body, 'status');
                 const effective = postStatus ?? bodyStatus;
                 statusSeen = effective;
-                const verdict = planReviewSettledVerdict({ postStatus, bodyStatus, reparked: bodySaysReparked(body), gateBefore, gateAfter, gateKindAfter });
-                effect = verdict.effect;
-                stillParkedProven = verdict.proven;
+                effect = planReviewSettledVerdict({ postStatus, bodyStatus, reparked: bodySaysReparked(body), gateBefore, gateAfter, gateKindAfter });
                 const code = bodyWordOf(body, 'errorCode');
                 if (effect === 'still_parked' && postStatus === 'needs_review' && !bodySaysReparked(body)) {
                     outcome =
@@ -797,14 +782,13 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                 const noAnswer = typeof status === 'number' || typeof e !== 'object' ? null : noAnswerKindOf(e);
                 if (status === 400 && refusedCode === REQUEST_FIELD_CONFLICT && permissionModeAfter === 'acceptEdits') {
                     hostLog('debug', `planReviewWire: ${decision} + acceptEdits refused (request.field_conflict) — NOT re-sent with a different mode`);
-                    effect = 'still_parked';
-                    stillParkedProven = true;
+                    effect = decision === 'approve' ? 'still_parked' : 'not_applied';
                     outcome =
                         decision === 'approve'
                             ? 'The plan approval was NOT applied: the engine refused "auto-accept edits" for this task (it was not started read-only in plan mode, so that option does not apply). ' +
                                 'Nothing changed engine-side — the plan is still waiting for review. Tell the user plainly, and that approving with "manually approve edits" will go through.'
                             : `The plan ${decision} was NOT applied: the engine refused the post-approval permission mode that was sent with it (request.field_conflict). ` +
-                                'Nothing changed engine-side — the plan is still waiting for review. Tell the user plainly that the decision did not go through.';
+                                'This request changed nothing engine-side. Tell the user plainly that the decision did not go through.';
                 }
                 else if (status === 404 && refusedCode === 'not_found.plan_review') {
                     hostLog('debug', `planReviewWire: ${decision} → 404 not_found.plan_review (no pending plan review any more — an earlier decision likely settled it)`);
@@ -817,7 +801,6 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
                     const cu = checkpointUnsupportedVersionFromError(e);
                     hostLog('debug', `planReviewWire: ${decision} → 409 checkpoint.unsupported_version (the server cannot continue this parked review in its stored form; still pending)`);
                     effect = 'still_parked';
-                    stillParkedProven = true;
                     stillParkedCause = 'stored_form_unsupported';
                     outcome = `This ${decision} was not applied. ${checkpointUnsupportedVersionContent(cu, { parkKind: 'plan_review', runId: taskId })}`;
                 }
@@ -858,9 +841,9 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     const tail = planReviewOutcomeTail(taskId, decision, effect, stillParkedCause);
     const prompt = `<plan-review-outcome>\n${outcome}\n${tail}\n</plan-review-outcome>`;
     const onOutcome = opts?.onOutcome;
-    settle(effect === 'not_sent' || (effect === 'still_parked' && stillParkedProven));
+    settle(effect === 'not_sent' || effect === 'still_parked');
     try {
-        const delivered = enqueuePlanReviewOutcome(prompt, { taskId, dispatchNo, decision, effect });
+        const delivered = enqueuePlanReviewOutcome(prompt, { taskId, dispatchNo, decision, effect, ...(effect === 'still_parked' && stillParkedCause !== undefined ? { cause: stillParkedCause } : {}) });
         if (!delivered) {
             if (onOutcome !== undefined) {
                 hostLog('debug', `planReviewWire: outcome queue port not installed for task ${taskId} — outcome handed to the host's onOutcome callback only`);
@@ -875,7 +858,17 @@ async function decidePlanReviewInner(taskId, decision, permissionModeAfter, disp
     }
     if (onOutcome !== undefined) {
         try {
-            onOutcome({ taskId, dispatchNo, decision, effect, detail: outcome, tail, prompt, ...(statusSeen !== undefined ? { status: statusSeen } : {}) });
+            onOutcome({
+                taskId,
+                dispatchNo,
+                decision,
+                effect,
+                ...(effect === 'still_parked' && stillParkedCause !== undefined ? { cause: stillParkedCause } : {}),
+                detail: outcome,
+                tail,
+                prompt,
+                ...(statusSeen !== undefined ? { status: statusSeen } : {}),
+            });
         }
         catch (e) {
             hostLog('debug', `planReviewWire: onOutcome callback threw for task ${taskId} (ignored): ${String(e)}`);
@@ -912,10 +905,10 @@ function joinReopenFlight(flight, taskId, receiptMs) {
         abortableSleep(Math.max(0, receiptMs), ac.signal).then(() => false),
     ]).then((presented) => {
         ac.abort();
-        return presented ? { reopened: true, firstSight: false } : { reopened: false };
+        return presented ? { reopened: true, firstSight: false } : refusedReopen('not_presented');
     }, () => {
         ac.abort();
-        return { reopened: false };
+        return refusedReopen('not_presented');
     });
 }
 function mintPlanReviewReopen(taskId, opts, sessionKey, receiptMs) {
@@ -955,10 +948,10 @@ function mintPlanReviewReopenCard(taskId, opts, sessionKey, receiptMs) {
     const markBefore = dismissalEntryFor(sessionKey, taskId);
     const settleOnReceipt = (receipt, firstSight) => receipt.then((presented) => {
         if (!presented)
-            return { reopened: false };
+            return refusedReopen('not_presented');
         revokePlanReviewUserDismissal(sessionKey, taskId, markBefore);
         return { reopened: true, firstSight };
-    }, () => ({ reopened: false }));
+    }, () => refusedReopen('not_presented'));
     const canonicalId = planReviewQuestionId(taskId);
     const armedKey = planReviewArmedKeyFor(sessionKey, taskId);
     const firstSight = !wasGateArmedFor(sessionKey, armedKey);
@@ -992,7 +985,7 @@ function mintPlanReviewReopenCard(taskId, opts, sessionKey, receiptMs) {
         if (activeReopenResponders.get(activeKey)?.questionId === questionId) {
             activeReopenResponders.delete(activeKey);
         }
-        const choice = planReviewChoiceFromAnswer(answer, LEGACY_TWO_CHOICE_LABELS);
+        const choice = planReviewAnswerChoiceOf(questionId, answer);
         if (choice === 'dismissed') {
             notePlanReviewUserDismissalFor(sessionKey, taskId, opts?.readGateInstanceKeys, questionId);
             return { ok: true };
@@ -1017,6 +1010,9 @@ function mintPlanReviewReopenCard(taskId, opts, sessionKey, receiptMs) {
     publishQuestionFrameFor(sessionKey, planReviewQuestionFrame(questionId, REOPEN_QUESTION, false, true));
     return settleOnReceipt(receipt, firstSight);
 }
+function refusedReopen(cause) {
+    return { reopened: false, _sema_reopenRefusal: cause };
+}
 function noPresentationSurfaceVerdict(taskId, sessionKey) {
     const verdict = { reopened: false, _sema_noPresentationSurface: true };
     hostLog('debug', `planReviewWire: reopen for task ${taskId} refused — nothing is subscribed to question frames for session ` +
@@ -1039,7 +1035,7 @@ async function reopenAfterDismissalCheck(taskId, opts, sessionKey, receiptMs, ma
                 }
             }
         }
-        const ledgerSaysInFlight = planReviewDecisionInFlight(taskId, recheckReadStart);
+        const ledgerSaysInFlight = decisionInFlightOf({ gate: 'plan_review', taskId }, recheckReadStart);
         if (ledgerSaysInFlight) {
             hostLog('debug', `planReviewWire: reopen for task ${taskId} refused after the dismissal check — a decision for this task went out while the check was reading`);
             return { reopened: false, _sema_decisionInFlight: true };
@@ -1088,24 +1084,26 @@ async function staleDismissalVerdict(current, sessionKey, taskId, receiptMs) {
     const windowEnd = abortableSleep(Math.max(0, receiptMs), ac.signal).then(() => false);
     try {
         let entry = current;
+        let lastWaitPresented;
         for (let round = 0; round < 8; round++) {
             if (entry?.kind === 'decided')
                 return { reopened: false, _sema_decisionInFlight: true };
             if (entry?.kind === 'dismissed')
                 return { reopened: false, dismissedByUser: true };
             if (entry?.kind !== 'reopened' || entry.onScreen === undefined)
-                return { reopened: false };
+                return refusedReopen(entry === undefined && lastWaitPresented === false ? 'not_presented' : 'gate_record_gone');
             const onScreen = await Promise.race([
                 entry.onScreen.then((v) => v === true, () => false),
                 windowEnd,
             ]);
             const now = dismissalEntryFor(sessionKey, taskId);
             if (now === entry) {
-                return onScreen ? { reopened: true, firstSight: !wasGateArmedFor(sessionKey, planReviewArmedKeyFor(sessionKey, taskId)) } : { reopened: false };
+                return onScreen ? { reopened: true, firstSight: !wasGateArmedFor(sessionKey, planReviewArmedKeyFor(sessionKey, taskId)) } : refusedReopen('not_presented');
             }
+            lastWaitPresented = onScreen;
             entry = now;
         }
-        return { reopened: false };
+        return refusedReopen('gate_record_gone');
     }
     finally {
         ac.abort();
@@ -1115,25 +1113,25 @@ export function reopenPlanReviewCard(taskId, opts) {
     const receiptMs = opts?.presentationReceiptMs;
     if (typeof receiptMs !== 'number' || Number.isNaN(receiptMs)) {
         hostLog('debug', `planReviewWire: reopen for task ${String(taskId)} refused — presentationReceiptMs is required (a number of milliseconds); the synchronous form was retired in 0.98.0`);
-        return Promise.resolve({ reopened: false });
+        return Promise.resolve(refusedReopen('invalid_call'));
     }
     try {
         if (typeof taskId !== 'string' || taskId.length === 0) {
-            return Promise.resolve({ reopened: false });
+            return Promise.resolve(refusedReopen('invalid_call'));
         }
         const injected = opts;
         if (opts?.mintFreshQuestionId === false && (injected?.deliverDecision !== undefined || injected?.wire !== undefined || injected?.onOutcome !== undefined)) {
             hostLog('error', `planReviewWire: plan_review reopen for task ${taskId} refused — mintFreshQuestionId:false reuses the armed card's responder and its delivery, ` +
                 'so deliverDecision / wire / onOutcome cannot be given with it; drop mintFreshQuestionId:false to deliver through the injected path');
-            return Promise.resolve({ reopened: false });
+            return Promise.resolve(refusedReopen('invalid_call'));
         }
         const readStart = typeof opts.pendingReadStartedAt === 'number' && Number.isFinite(opts.pendingReadStartedAt) ? opts.pendingReadStartedAt : undefined;
-        if (planReviewDecisionInFlight(taskId, readStart)) {
+        if (decisionInFlightOf({ gate: 'plan_review', taskId }, readStart)) {
             hostLog('debug', `planReviewWire: reopen for task ${taskId} refused — a decision for this task is in flight (its answer is still being delivered)`);
             const refused = { reopened: false, _sema_decisionInFlight: true };
             return Promise.resolve(refused);
         }
-        const guardStartedAt = planReviewPendingReadMark();
+        const guardStartedAt = decisionReadMark();
         const recheckReadStart = readStart === undefined ? guardStartedAt : Math.min(readStart, guardStartedAt);
         const sessionKey = opts.sessionKey ?? DEFAULT_SESSION_KEY;
         if (!hasQuestionOverlayFor(sessionKey)) {
@@ -1144,7 +1142,7 @@ export function reopenPlanReviewCard(taskId, opts) {
                 '而缺省决断投递口(decidePlanReview)今天固定打默认槽的 baseUrl/token/principal。' +
                 '整条链转 keyed 之前,非默认槽要重开请自带 deliverDecision(按本槽投递);' +
                 '此处拒绝而不是照发 —— 照发会把这条会话的决断发到另一个槽上。');
-            return Promise.resolve({ reopened: false });
+            return Promise.resolve(refusedReopen('no_delivery_path'));
         }
         const trigger = opts.trigger === undefined ? undefined : opts.trigger === 'user' ? 'user' : 'automatic';
         if (trigger === 'automatic') {
@@ -1155,6 +1153,6 @@ export function reopenPlanReviewCard(taskId, opts) {
         return mintPlanReviewReopen(taskId, opts, sessionKey, receiptMs);
     }
     catch {
-        return Promise.resolve({ reopened: false });
+        return Promise.resolve(refusedReopen('internal_error'));
     }
 }

package/dist/hitl/resumeRunningCard.d.ts

@@ -26,6 +26,7 @@ export declare function resumeRunningNoUiGuidance(i: {
     taskId: string;
     sessionId?: string | null;
 }): string;
-export declare function resumeAttachReplayDisclosure(taskId: string): string;
+export declare function resumeAttachReplayDisclosure(taskId: string, lane?: CardSentenceLane): string;
+export type CardSentenceLane = 'interactive' | 'print' | 'utility';
 export declare function resumeRunningCancelConfirmedRow(taskId: string): string;
-export declare function resumeRunningCancelUnconfirmedRow(taskId: string): string;
+export declare function resumeRunningCancelUnconfirmedRow(taskId: string, lane?: CardSentenceLane): string;

package/dist/hitl/resumeRunningCard.js

@@ -62,22 +62,28 @@ export function resumeRunningNoUiGuidance(i) {
         `${T} background=do nothing — run ${i.taskId} keeps executing on the engine; this client does not list it (read it with GET /v1/runs/${i.taskId})`,
     ].join('\n');
 }
-export function resumeAttachReplayDisclosure(taskId) {
+export function resumeAttachReplayDisclosure(taskId, lane) {
     return (`sema: attaching to run ${taskId} — sema is replaying it from the engine's ledger, so anything from that ` +
         `turn already shown above will appear again below. There is no resume marker for a run that outlived its shell. ` +
-        `The replayed turns are not billed into this session's cost again either — the engine's own record ` +
-        `(GET /v1/runs/${taskId}) is the authority on what that run really spent.`);
+        `The replayed turns are not billed into this session's cost again either — ` +
+        (interactiveCardLane(lane)
+            ? `the engine's own record of run ${taskId} is the authority on what that run really spent.`
+            : `the engine's own record (GET /v1/runs/${taskId}) is the authority on what that run really spent.`));
 }
-function cancelRow(taskId, confirmed) {
-    return confirmed
-        ? `The engine accepted the cancel for run ${taskId} on your request. A cancel finishes on the engine's side, so that run may need a moment to stop.`
-        : `sema: the cancel for run ${taskId} did not come back confirmed, so that run may still be executing. ` +
-            `This screen does not list it — read its real state on the engine (GET /v1/runs/${taskId}) before ` +
-            `assuming this session is free.`;
+function cancelRow(taskId, confirmed, lane) {
+    if (confirmed)
+        return `The engine accepted the cancel for run ${taskId} on your request. A cancel finishes on the engine's side, so that run may need a moment to stop.`;
+    return (`sema: the cancel for run ${taskId} did not come back confirmed, so that run may still be executing. ` +
+        (interactiveCardLane(lane)
+            ? `This screen does not list it — its real state lives on the engine, under run ${taskId}, so do not assume this session is free.`
+            : `This screen does not list it — read its real state on the engine (GET /v1/runs/${taskId}) before assuming this session is free.`));
+}
+function interactiveCardLane(lane) {
+    return lane !== 'print' && lane !== 'utility';
 }
 export function resumeRunningCancelConfirmedRow(taskId) {
     return cancelRow(taskId, true);
 }
-export function resumeRunningCancelUnconfirmedRow(taskId) {
-    return cancelRow(taskId, false);
+export function resumeRunningCancelUnconfirmedRow(taskId, lane) {
+    return cancelRow(taskId, false, lane);
 }

package/dist/hitl/sessionPolicyDeliverable.d.ts

@@ -1,7 +1,9 @@
 import type { SessionPermissionRules } from '@sema-agent/sdk';
 import type { ToolRosterView } from '../toolRoster.js';
+import type { SessionRulesNamespaceFormsReading } from '../sessionRulesNamespaceFormsCapability.js';
+import type { UiLanguage } from '../env/uiLanguage.js';
 import type { SessionRuleInertReason } from './sessionPolicyWire.js';
-export type SessionPolicyWithheldWhy = 'ask_no_bucket' | 'qualified_deny' | 'peer_wide' | 'wildcard' | 'not_a_tool_name' | 'legacy_tool_name' | 'not_in_roster';
+export type SessionPolicyWithheldWhy = 'ask_no_bucket' | 'qualified_deny' | 'peer_wide' | 'wildcard' | 'not_a_tool_name' | 'legacy_tool_name' | 'not_in_roster' | 'namespace_covering_unconfirmed';
 export declare const SESSION_POLICY_WITHHELD_WHY: readonly SessionPolicyWithheldWhy[];
 export interface SessionPolicyWithheldRule {
     readonly rule: string;
@@ -16,7 +18,8 @@ export interface SessionPolicyDeliverability {
 }
 export interface SessionPolicyDeliverableOptions {
     readonly roster?: ToolRosterView;
+    readonly namespaceForms?: SessionRulesNamespaceFormsReading;
 }
 export declare function sessionPolicyDeliverable(behavior: 'deny' | 'ask', rules: readonly string[], opts?: SessionPolicyDeliverableOptions): SessionPolicyDeliverability;
-export declare function sessionPolicyWithheldNotice(why: SessionPolicyWithheldWhy): string;
+export declare function sessionPolicyWithheldNotice(why: SessionPolicyWithheldWhy, lang?: UiLanguage): string;
 export declare function legacyToolNameFailureNoteOf(code: string | undefined): string | undefined;