@sema-agent/server 7.1.0 → 7.3.0

package/dist/http/wire-types.d.ts

@@ -230,12 +230,27 @@ export interface TaskRequestBody {
     /** [1144]/[1146] (core 1.328 R2): 提示词双形轴——simple(CC 212 短形,引擎缺省)| classic(长形,可按
      *  任务/模型试分)。纯呈现轴无租户门;枚举 fail-loud at submit;缺省不挂键。 */
     promptProfile?: "simple" | "classic";
+    /** [2856]②(core 5.14.0 座已在,`TaskSpec.toolMaterializeStrategy`):deferred 工具在**激活之后**怎么给
+     *  模型供 schema。`static` = 占位符形不变(激活只改可调用性,广告的 schema 仍是空对象);`swap` = 激活
+     *  后下一轮把占位符换成真 schema。
+     *  为什么要上 wire:cli 的 #181 取证表明,忠实跟随广告 schema 解码的 provider(openai-completions 车道)
+     *  在 `static` 下会**无界循环** —— 每轮发 `{}` → invalidArgumentsRejection → 下一轮广告仍空,纠错回路
+     *  结构上无效。core 的缺省是 `spec.toolMaterializeStrategy ?? env ?? "static"`,进程级 env 说不了
+     *  「每个模型」的话(模型目录车道 per-model api 可混),所以必须有一个**按任务**的位子。
+     *  缺省不挂键(交给 core 的 env/缺省链);未知词 400 fail-loud(与 promptProfile/permissionMode 同姿势 ——
+     *  静默折缺省会让调用方以为切了策略却没切)。 */
+    toolMaterializeStrategy?: "static" | "swap";
     /** R4 (CC parity): the LIGHT top-level per-turn permission-mode intent (CC `permissionMode`). The shell sends
-     *  the RAW mode (axis-agnostic, no client-side interpretation); the SERVICE interprets it tighten-only: `plan` ⇒
-     *  read-only hands + `present_plan` (EnterPlanMode parity); `acceptEdits`/`bypassPermissions` LOOSEN → coerced to
-     *  `default` (never honored remotely; the client enforces them on its own machine). Folds onto the SAME tighten-only
-     *  governance as `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path. */
-    permissionMode?: string;
+     *  the RAW mode (axis-agnostic, no client-side interpretation); the SERVICE interprets it tighten-only vs the
+     *  deployment baseline. Post-[816] all FIVE modes are honored as gate-SHAPE choices (`plan` ⇒ read-only hands +
+     *  `present_plan`; `acceptEdits`/`bypassPermissions`/`auto` select how much the mode-derived fs-write ask gate
+     *  asks — they can never subtract from deployment/operator policy, tightenTaskSpec deny-wins; the old "LOOSEN →
+     *  coerced to default" note was pre-[816] doc-rot). Folds onto the SAME tighten-only governance as
+     *  `settings.permissions.defaultMode` (the heavier bundle), so it's a lighter alias, not a second path.
+     *  #157-②: CLOSED enum on the wire — an unknown word 400s at submit (`request.field_invalid`, sibling of
+     *  promptProfile) instead of silently coercing to `default`; resume replay of a stored body stays lenient
+     *  (coercePermissionMode). */
+    permissionMode?: "default" | "acceptEdits" | "plan" | "bypassPermissions" | "auto";
     /** MF-30 memory PAUSE (shell-host contract, option B per-request — clay 2026-06-27): `false` makes THIS run
      *  read-only over long-term memory (`TaskSpec.memory.writeScope:null` — the design/138 memory ENGINE materializes/
      *  reads but its harvest commits nothing). Absent/`true` ⇒ normal read+write. The shell's `/memory` pause carries

package/dist/leader/wire.js

@@ -445,6 +445,10 @@ export function createLeaderRunner(cfg) {
             if (cfg.durable) {
                 const d = cfg.durable;
                 durableSpec = {
+                    // AskUserQuestion 判决:本腿是 resolve-spec `createDurableQuestionGate` 单一属主声明的**登记豁免**
+                    // (复审车B 上抛/属主裁定 2026-08-05)——leader worker 无活体问答面可装(不是 HTTP 活流腿,
+                    // QuestionCoordinator 的 ALS 永不覆盖到这里),core 原形+下方 sentinel 即完整正确语义,且 leader
+                    // 子系统不 import boot 装配层(分层)。⚠️ 若 leader 腿将来接活体面,必须改调该工厂并撤本注。
                     toolPolicy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({ requireApproval: d.requireApproval, ...(d.deny ? { deny: d.deny } : {}), ...(d.autoBudget ? { autoBudget: d.autoBudget } : {}), ...(d.neverAuto ? { neverAuto: d.neverAuto } : {}) })),
                     checkpointStore: d.checkpointStore,
                     durableApproval: { scope: "_leader", ...(d.ttlMs ? { ttlMs: d.ttlMs } : {}) },

package/dist/main.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, combinePolicies, createDurableQuestionPolicy, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend } from "@sema-agent/core";
+import { Runner, TtlSessionStore, uuidv7, defaultTaskRegistry, combinePolicies, createAllowDenyPolicy, workflowsCapability, createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel, probeSearchBackend } from "@sema-agent/core";
 import { createSessionTitler } from "./session-titler.js";
 import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
@@ -37,7 +37,7 @@ import { createHookLlm } from "./hooks/hook-llm.js";
 import { startFleetClientFromEnv } from "./fleet-client.js";
 import { reclaimOrphansAtBoot } from "./boot-reclaim.js";
 import { createConfigCenterRuntime } from "./boot/config-center.js";
-import { createResolveSpec } from "./boot/resolve-spec.js";
+import { createDurableQuestionGate, createResolveSpec } from "./boot/resolve-spec.js";
 import { startReapers } from "./boot/reapers.js";
 import { openStores } from "./boot/stores.js";
 import { createBudgetAndTracing } from "./boot/budget-tracing.js";
@@ -621,10 +621,13 @@ async function main() {
     // count=1,durableMandate=true(host 有 durableApproval 且 durable 车道无 live onAsk 的恒形)。
     // exempt 探针锚 = row.rootSessionId——与 parked decide 的 remember grant 锚同键([1591] 候裁②),
     // 重建链上的豁免语义与原链一致。重建不出(无 root 锚)= 不供席 = core pre-CAS 门诚实拒(现状)。
+    // #152 复审 A2:「同参重建」是本工厂自述的不变式,所以 question 门必须调 resolve-spec 的**同一个**
+    // 工厂并传同一个活体面,不能自折 core 原形——分腿改动只落一侧就是两份拷贝开始漂移的那一刻。
+    // 赎回腿今天无 question ALS ctx(/decide 路由触发,core driveParkedResume 内驱动)⇒ 判 ask,与原形同判。
     const parkedReviveInheritedGate = parkedReviveTool && config.durableApproval
         ? (row) => ({
             parentConstraints: [{
-                    policy: combinePolicies(createDurableQuestionPolicy(), createDurableAskPolicy({
+                    policy: combinePolicies(createDurableQuestionGate(question), createDurableAskPolicy({
                         requireApproval: config.approvalRequire, deny: config.approvalDeny, autoBudget: config.approvalAutoBudget, neverAuto: config.approvalNeverAuto,
                         ...(approvalExemptionStore && row.rootSessionId
                             ? {
@@ -655,7 +658,7 @@ async function main() {
         config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
         rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
-        backgroundAgentStore, mailboxStore,
+        backgroundAgentStore, mailboxStore, toolApproval,
         getRunDenySweep: () => runDenySweep,
     });
     // Optional OTLP/HTTP metrics export (1.37). Periodically pushes the registry to an OTel collector;

package/dist/org-memory-admission.d.ts

@@ -78,7 +78,8 @@ export interface MemoryScopeAdmissionOptions {
     onOutcome?: (outcome: string, details?: Record<string, unknown>) => void;
 }
 /** core 侧「瞬时不可用，重试」契约的载体：一个带 `retryAfterMs`（ms）属性的真 Error 子类，core 据此铸
- *  memory.admission_required 终局码并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
+ *  **瞬时**码 memory.admission_required（503，重试可改判——与终局的 memory.admission_denied 恰好相对）
+ *  并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
 export declare class OrgMemoryAdmissionRetryError extends Error {
     readonly retryAfterMs: number;
     constructor(message: string, retryAfterMs: number);

package/dist/org-memory-admission.js

@@ -131,7 +131,8 @@ export function createOrgMemoryDirectory(opts) {
     };
 }
 /** core 侧「瞬时不可用，重试」契约的载体：一个带 `retryAfterMs`（ms）属性的真 Error 子类，core 据此铸
- *  memory.admission_required 终局码并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
+ *  **瞬时**码 memory.admission_required（503，重试可改判——与终局的 memory.admission_denied 恰好相对）
+ *  并透传该值。子类而非事后挂属性——避免任何宽松断言就能拿到正确类型。 */
 export class OrgMemoryAdmissionRetryError extends Error {
     retryAfterMs;
     constructor(message, retryAfterMs) {
@@ -158,6 +159,11 @@ export function createMemoryScopeAdmission(directory, opts) {
         }
     };
     return async ({ principal, requested, requestedWriteScope }) => {
+        /** 复审 D-3(7.1.0 后修):归因面。判决记录若不带 principal,运维只看得到「某个 org scope 被拒」而
+         *  无从知道**谁**被拒——「per-principal 归因走日志」这句设计承诺(与 CHANGELOG 7.0.0 同款公开陈述)
+         *  此前在代码里没有落点。principal 缺席时**不**塞键:干净 admit 那一路必须保持 `details === undefined`
+         *  (装配点据此判「无事发生不打日志」;塞个 `principal: undefined` 会把每个成功任务变成一行 warn)。 */
+        const attributed = (details) => principal === undefined ? details : { principal, ...details };
         const requestOriginRequested = requested.filter((r) => r.origin === "request");
         const writeIsRequestOrigin = requestedWriteScope?.origin === "request";
         const hasRequestOrigin = requestOriginRequested.length > 0 || writeIsRequestOrigin;
@@ -203,7 +209,7 @@ export function createMemoryScopeAdmission(directory, opts) {
             // audit 模式对「读面通过但 write 未显式授」的判决只记 would-narrow,返回未收窄的全额;
             // enforce 照常收窄。ok:true 分支的 writeScope 恒为 fullWriteScope 或 null(decide 只做这两值)。
             if (opts.mode === "audit" && decision.verdict.ok && decision.verdict.writeScope !== fullWriteScope) {
-                emit("ok", { audited: true, wouldNarrowWriteScope: true });
+                emit("ok", attributed({ audited: true, wouldNarrowWriteScope: true }));
                 return admitFull();
             }
             emit("ok");
@@ -212,10 +218,10 @@ export function createMemoryScopeAdmission(directory, opts) {
         if (opts.mode === "audit") {
             // Zero behavior change: a would-deny (terminal or transient) is overridden to a full, UNNARROWED admit —
             // the real decision is only ever recorded via onOutcome, never enforced.
-            emit(decision.outcome, { ...decision.details, audited: true, wouldDeny: true, ...(decision.kind === "unavailable" ? { retryAfterMs: decision.retryAfterMs } : { reason: decision.reason }) });
+            emit(decision.outcome, attributed({ ...decision.details, audited: true, wouldDeny: true, ...(decision.kind === "unavailable" ? { retryAfterMs: decision.retryAfterMs } : { reason: decision.reason }) }));
             return admitFull();
         }
-        emit(decision.outcome, decision.details);
+        emit(decision.outcome, attributed(decision.details));
         if (decision.kind === "deny")
             return { ok: false, reason: decision.reason };
         throw new OrgMemoryAdmissionRetryError(`org memory directory unavailable (${decision.lookupReason})`, decision.retryAfterMs);

package/dist/parked-decide.js

@@ -79,9 +79,12 @@ export async function decideParkedAgent(deps, req) {
     const pendingTool = req.pendingAction?.toolName;
     if (pendingTool === "AskUserQuestion" && req.decision === "approve" && req.answer === undefined) {
         // RB-459(core 5.7.0,F1/F6 翻案后唯一剩下的 claim 前拒):问题门的 approve 必须携 answer——
-        // parked 腿无 live answering face,core 侧同判(invalid_outcome field:"answer"),但那要消费 claim
-        // 并空跑一次 revive;这里 claim 前拒是同一判据的免损前置,不是 server 另立规则。带 answer 的
+        // parked 腿无 live answering face,消费 claim 后只会空跑一次 revive;claim 前拒是免损前置。带 answer 的
         // approve 与任何 deny 都放行透传,core 是语义权威(header 逐字匹配等)。
+        // 🔴 #152:本判据**不再**有 core 侧同判兜底。core 的 pre-CAS 拒条件是「`taskConfig.onQuestion ??
+        // deps.onQuestion` 为 undefined 或 QUESTION_AWAITS_RESUME」;ASK_QUESTION_ENABLED 部署上 spec 不再 stamp
+        // 哨兵、deps.onQuestion 是 coordinator,条件恒不成立 ⇒ core 放行,赎回腿会拿 coordinator 的空答当人答
+        // 并消费掉 checkpoint。这一手现在是该腿唯一的拒绝点(任务级孪生:src/http/server.ts 的 decide 路由)。
         return { status: 400, body: { error: "pending action is AskUserQuestion — approve requires body.answer (the operator's answers[]); deny needs none", errorCode: "decide.parked_answer_required", taskId: match.handle } };
     }
     if (row.name === undefined) {

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `InMemoryApprovalAskStore` —— #151 车1,`ApprovalAskStore` 的语义真源(twin 对拆基准)+ LOCAL
+ * 车道占位(File 形不在本车,见设计定稿 §7)。单进程内两个 `Map`,方法体全同步(不含 `await` 中断点)——
+ * Node 单线程下这就是天然原子:`Promise.all` 发起的并发调用不会在方法体内部交错执行,与
+ * `approval-ask-store-sql.ts` 的 CAS UPDATE 语义逐字段一致(SQL twin 对拆套件的基准就是这份实现）。
+ *
+ * 行为口径与 `SqlApprovalAskStore` 逐条对齐:
+ *  - ensureAsk 幂等 upsert(ask_id 已在 ⇒ 返回既有行,不改写;batch 行若不存在则以 OPEN 补齐）。
+ *  - transitionAsk 先过 machine 层 `canAskTransition`(非法转移 throw，不返回 false）。
+ *  - decideAsk/expireAsk/bindBatch/abortBatch 的双/三步判定顺序与 SQL twin 的事务步骤一一对应
+ *    (哪一步先判、判什么、失败时是否触碰另一半状态——照抄，不是「反正内存里原子就随便」）。
+ *  - resolveProvisional 故意不经 canAskTransition(同 SQL twin 头注：这是版本化补偿的例外通道）。
+ */
+import { type AskState, type BatchState } from "../approval-ask-machine.js";
+import type { AskDecision, AskRow, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
+export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
+    private readonly asks;
+    private readonly batches;
+    ensureAsk(row: NewAskRow): Promise<AskRow>;
+    transitionAsk(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
+    decideAsk(askId: string, batchId: string, decision: DecideAskInput): Promise<DecideResult>;
+    expireAsk(askId: string, batchId: string): Promise<ExpireResult>;
+    bindBatch(batchId: string, askId: string, gate: BindGateInput): Promise<BindResult>;
+    deferReconcile(askId: string, expectedState: AskState, expectedVersion: number, nowMs: number): Promise<boolean>;
+    abortBatch(batchId: string): Promise<string[]>;
+    listByState(state: AskState, limit: number): Promise<AskRow[]>;
+    /** `signal` 的 twin 语义(车3 刀 3b):同步实现里没有「在飞」这回事,所以能做也只需做**入口复核** ——
+     *  已 abort 就一条都不读、如实抛,与 SQL twin 的第①条语义逐字一致(第②条在这里天然平凡成立)。 */
+    listPendingByTask(taskId: string, signal?: AbortSignal): Promise<AskRow[]>;
+    listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
+    getAsk(askId: string): Promise<AskRow | null>;
+    getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
+    resolveProvisional(askId: string, from: AskState, to: AskState, patch: AskTransitionPatch): Promise<boolean>;
+    deleteByTask(taskId: string): Promise<void>;
+    getBatch(batchId: string): Promise<BatchRow | null>;
+}
+export type { AskDecision, AskState, BatchState };
+//# sourceMappingURL=approval-ask-store-memory.d.ts.map

package/dist/plugins/approval-ask-store-memory.js

@@ -0,0 +1,299 @@
+/**
+ * `InMemoryApprovalAskStore` —— #151 车1,`ApprovalAskStore` 的语义真源(twin 对拆基准)+ LOCAL
+ * 车道占位(File 形不在本车,见设计定稿 §7)。单进程内两个 `Map`,方法体全同步(不含 `await` 中断点)——
+ * Node 单线程下这就是天然原子:`Promise.all` 发起的并发调用不会在方法体内部交错执行,与
+ * `approval-ask-store-sql.ts` 的 CAS UPDATE 语义逐字段一致(SQL twin 对拆套件的基准就是这份实现）。
+ *
+ * 行为口径与 `SqlApprovalAskStore` 逐条对齐:
+ *  - ensureAsk 幂等 upsert(ask_id 已在 ⇒ 返回既有行,不改写;batch 行若不存在则以 OPEN 补齐）。
+ *  - transitionAsk 先过 machine 层 `canAskTransition`(非法转移 throw，不返回 false）。
+ *  - decideAsk/expireAsk/bindBatch/abortBatch 的双/三步判定顺序与 SQL twin 的事务步骤一一对应
+ *    (哪一步先判、判什么、失败时是否触碰另一半状态——照抄，不是「反正内存里原子就随便」）。
+ *  - resolveProvisional 故意不经 canAskTransition(同 SQL twin 头注：这是版本化补偿的例外通道）。
+ */
+import { canAskTransition } from "../approval-ask-machine.js";
+import { assertIdempotencyKeyShape, ApprovalAskReadAbortedError } from "./approval-ask-store-sql.js";
+/** patch 里真出现的字段搬到行上(未出现的字段维持原值)——`transitionAsk`/`resolveProvisional` 共用。 */
+function applyPatch(row, patch) {
+    if (patch.decision !== undefined)
+        row.decision = patch.decision;
+    if (patch.decisionActor !== undefined)
+        row.decisionActor = patch.decisionActor;
+    if (patch.decisionNote !== undefined)
+        row.decisionNote = patch.decisionNote;
+    if (patch.decidedAtMs !== undefined)
+        row.decidedAtMs = patch.decidedAtMs;
+    if (patch.deniedReason !== undefined)
+        row.deniedReason = patch.deniedReason;
+    if (patch.gateToken !== undefined)
+        row.gateToken = patch.gateToken;
+    if (patch.gateBoundCallId !== undefined)
+        row.gateBoundCallId = patch.gateBoundCallId;
+    if (patch.gateBoundInputHash !== undefined)
+        row.gateBoundInputHash = patch.gateBoundInputHash;
+    if (patch.provisional !== undefined)
+        row.provisional = patch.provisional;
+}
+export class InMemoryApprovalAskStore {
+    asks = new Map();
+    batches = new Map();
+    async ensureAsk(row) {
+        if (!this.batches.has(row.batchId)) {
+            this.batches.set(row.batchId, {
+                batchId: row.batchId,
+                taskId: row.taskId,
+                state: "OPEN",
+                boundAskId: null,
+                version: 0,
+                createdAtMs: row.createdAtMs,
+                updatedAtMs: row.createdAtMs,
+            });
+        }
+        const existing = this.asks.get(row.askId);
+        if (existing)
+            return { ...existing };
+        // 🔴 车4 §12-E:`idempotency_key` 已归**回决专用**,`NewAskRow` 的同名字段随之摘除 ⇒ 铸行不再有
+        // 唯一性可撞(列恒 NULL)。原先在这里镜像 UNIQUE 的那段扫描也随之下车;撞键判定搬到 `decideAsk`
+        // (SQL twin 那侧是 `(task_id, idempotency_key)` 索引在库层拒 ⇒ typed `idempotency_conflict`)。
+        const created = {
+            askId: row.askId,
+            taskId: row.taskId,
+            sourceTaskId: row.sourceTaskId,
+            sessionId: row.sessionId,
+            owner: row.owner ?? null,
+            batchId: row.batchId,
+            toolCallId: row.toolCallId,
+            legKey: row.legKey,
+            parentToolCallId: row.parentToolCallId ?? null,
+            boundInputHash: row.boundInputHash ?? null,
+            state: "STREAM_PENDING",
+            provisional: false,
+            version: 0,
+            decision: null,
+            decisionActor: null,
+            decisionNote: null,
+            decidedAtMs: null,
+            deniedReason: null,
+            gateToken: null,
+            gateBoundCallId: null,
+            gateBoundInputHash: null,
+            idempotencyKey: null, // 回决专用列(见上注):铸行恒 NULL,decideAsk 才落。
+            cardJson: row.cardJson,
+            schemaVersion: row.schemaVersion,
+            expiresAtMs: row.expiresAtMs,
+            createdAtMs: row.createdAtMs,
+            updatedAtMs: row.createdAtMs,
+        };
+        this.asks.set(row.askId, created);
+        return { ...created };
+    }
+    async transitionAsk(askId, from, to, patch) {
+        if (!canAskTransition(from, to)) {
+            throw new Error(`approval-ask-store.transitionAsk: illegal ask transition ${from} -> ${to} (askId=${askId})`);
+        }
+        const row = this.asks.get(askId);
+        if (!row || row.state !== from)
+            return false;
+        applyPatch(row, patch);
+        row.state = to;
+        row.version += 1;
+        row.updatedAtMs = patch.updatedAtMs;
+        return true;
+    }
+    async decideAsk(askId, batchId, decision) {
+        if (decision.idempotencyKey != null)
+            assertIdempotencyKeyShape(decision.idempotencyKey); // F2 卫生门(三 twin 同判)
+        const now = Date.now();
+        const batch = this.batches.get(batchId);
+        if (!batch || batch.state !== "OPEN") {
+            const row = this.asks.get(askId);
+            return { ok: false, reason: "batch_closed", row: row ? { ...row } : null };
+        }
+        const ask = this.asks.get(askId);
+        if (!ask || ask.state !== "STREAM_PENDING") {
+            return { ok: false, reason: "ask_not_pending", row: ask ? { ...ask } : null };
+        }
+        // 🔴 UNIQUE `(task_id, idempotency_key)` 的内存镜像(车4 §12-E)——SQL twin 靠索引在库层拒并把方言
+        // 错误翻成 typed 臂;这里必须同答,否则这个店就不是 SQL twin 的语义真源。判定顺序也照抄 SQL:
+        // 批 CAS(已过)→ ask CAS(已过)→ 才轮到撞键 ⇒ 一条非 STREAM_PENDING 的 ask 拿到的仍是
+        // `ask_not_pending` 而不是 `idempotency_conflict`(哪个先判决定了输者看到的 reason)。
+        if (decision.idempotencyKey != null) {
+            for (const [id, r] of this.asks) {
+                if (id !== askId && r.taskId === ask.taskId && r.idempotencyKey === decision.idempotencyKey) {
+                    return { ok: false, reason: "idempotency_conflict", row: { ...ask } };
+                }
+            }
+        }
+        batch.version += 1;
+        batch.updatedAtMs = now;
+        ask.state = "DECIDED";
+        ask.decision = decision.decision;
+        ask.decisionActor = decision.decisionActor ?? null;
+        ask.decisionNote = decision.decisionNote ?? null;
+        ask.decidedAtMs = now;
+        ask.idempotencyKey = decision.idempotencyKey ?? null;
+        ask.version += 1;
+        ask.updatedAtMs = now;
+        return { ok: true, row: { ...ask } };
+    }
+    async expireAsk(askId, batchId) {
+        const now = Date.now();
+        // 批行存在性先判(镜像 SQL twin 死锁修后的步⓪,§6-4c 钉):批行缺席=ensureAsk 从未为它建批
+        // (错配 batchId 的编程错误形),如实不赢——不在半空中把 ask 铸成 PARKING(它真正的批还 OPEN,
+        // 状态会被污染)。批 state 不设谓词,与 SQL twin 一致(ROUTING_UNBOUND 兄弟先到属合法续走)。
+        const batch = this.batches.get(batchId);
+        if (!batch)
+            return { won: false, voidedSiblings: [] };
+        const ask = this.asks.get(askId);
+        if (!ask || ask.state !== "STREAM_PENDING")
+            return { won: false, voidedSiblings: [] };
+        ask.state = "PARKING";
+        ask.version += 1;
+        ask.updatedAtMs = now;
+        if (batch.state === "OPEN") {
+            batch.state = "ROUTING_UNBOUND";
+            batch.version += 1;
+            batch.updatedAtMs = now;
+        }
+        const voided = [];
+        for (const [id, r] of this.asks) {
+            if (r.batchId === batchId && r.state === "STREAM_PENDING" && id !== askId) {
+                r.state = "VOID";
+                r.version += 1;
+                r.updatedAtMs = now;
+                voided.push(id);
+            }
+        }
+        return { won: true, voidedSiblings: voided };
+    }
+    async bindBatch(batchId, askId, gate) {
+        const now = Date.now();
+        const batch = this.batches.get(batchId);
+        // 判别式失败臂逐条对齐 SQL twin(见 `BindResult` 头注):批行缺席 = "MISSING";批态不对 ⇒ 回真实态
+        // (ABORTED / ROUTING_BOUND 两条处置完全相反,调用方靠它分臂)。
+        if (!batch)
+            return { ok: false, batchState: "MISSING" };
+        if (batch.state !== "ROUTING_UNBOUND" || batch.boundAskId !== null) {
+            return { ok: false, batchState: batch.state, ...(batch.boundAskId !== null ? { boundAskId: batch.boundAskId } : {}) };
+        }
+        const ask = this.asks.get(askId);
+        // ask 不在 PARKING ⇒ SQL twin 整事务回滚,批停在 ROUTING_UNBOUND;这里同样一个字节都还没改。
+        if (!ask || ask.state !== "PARKING")
+            return { ok: false, batchState: batch.state };
+        batch.state = "ROUTING_BOUND";
+        batch.boundAskId = askId;
+        batch.version += 1;
+        batch.updatedAtMs = now;
+        ask.state = "PARKED";
+        ask.gateToken = gate.gateToken;
+        ask.gateBoundCallId = gate.gateBoundCallId ?? null;
+        ask.gateBoundInputHash = gate.gateBoundInputHash ?? null;
+        ask.version += 1;
+        ask.updatedAtMs = now;
+        const voidedSiblings = [];
+        for (const [id, r] of this.asks) {
+            if (r.batchId === batchId && r.state === "PARKING" && id !== askId) {
+                r.state = "VOID";
+                r.version += 1;
+                r.updatedAtMs = now;
+                voidedSiblings.push(id);
+            }
+        }
+        return { ok: true, voidedSiblings };
+    }
+    async deferReconcile(askId, expectedState, expectedVersion, nowMs) {
+        // 纯 touch,**不碰 state**,故意不经 canAskTransition(同态转移在转移表上无出边——见接口注)。
+        const row = this.asks.get(askId);
+        if (!row || row.state !== expectedState || row.version !== expectedVersion)
+            return false;
+        row.version += 1;
+        row.updatedAtMs = nowMs;
+        return true;
+    }
+    async abortBatch(batchId) {
+        const now = Date.now();
+        const batch = this.batches.get(batchId);
+        if (!batch || (batch.state !== "OPEN" && batch.state !== "ROUTING_UNBOUND"))
+            return [];
+        batch.state = "ABORTED";
+        batch.version += 1;
+        batch.updatedAtMs = now;
+        const voided = [];
+        for (const [id, r] of this.asks) {
+            if (r.batchId === batchId && r.state === "STREAM_PENDING") {
+                r.state = "VOID";
+                r.version += 1;
+                r.updatedAtMs = now;
+                voided.push(id);
+            }
+        }
+        return voided;
+    }
+    async listByState(state, limit) {
+        // 排序键与 SQL twin 逐字同形:`updated_at_ms ASC, created_at_ms ASC`(队列轮转,见 SQL 侧头注)。
+        return [...this.asks.values()]
+            .filter((r) => r.state === state)
+            .sort((a, b) => a.updatedAtMs - b.updatedAtMs || a.createdAtMs - b.createdAtMs)
+            .slice(0, limit)
+            .map((r) => ({ ...r }));
+    }
+    /** `signal` 的 twin 语义(车3 刀 3b):同步实现里没有「在飞」这回事,所以能做也只需做**入口复核** ——
+     *  已 abort 就一条都不读、如实抛,与 SQL twin 的第①条语义逐字一致(第②条在这里天然平凡成立)。 */
+    async listPendingByTask(taskId, signal) {
+        if (signal?.aborted === true)
+            throw new ApprovalAskReadAbortedError("listPendingByTask");
+        return [...this.asks.values()]
+            .filter((r) => r.taskId === taskId && r.state === "STREAM_PENDING")
+            .sort((a, b) => a.createdAtMs - b.createdAtMs)
+            .map((r) => ({ ...r }));
+    }
+    async listPendingBySession(sessionId, owner, signal) {
+        if (signal?.aborted === true)
+            throw new ApprovalAskReadAbortedError("listPendingBySession");
+        // 租户门与 SQL twin 逐字同语义:`owner` 必填,`null` 只匹配 owner 为 null 的行(不是「不过滤」)。
+        return [...this.asks.values()]
+            .filter((r) => r.sessionId === sessionId && r.state === "STREAM_PENDING" && r.owner === owner)
+            .sort((a, b) => a.createdAtMs - b.createdAtMs)
+            .map((r) => ({ ...r }));
+    }
+    async getAsk(askId) {
+        const r = this.asks.get(askId);
+        return r ? { ...r } : null;
+    }
+    async getByIdempotencyKey(taskId, key) {
+        assertIdempotencyKeyShape(key); // F2 卫生门(三 twin 同判)
+        // 键的两维都要匹配(UNIQUE 已改 `(task_id, idempotency_key)`)——租户门是读口自己的责任。
+        for (const r of this.asks.values()) {
+            if (r.taskId === taskId && r.idempotencyKey === key)
+                return { ...r };
+        }
+        return null;
+    }
+    async resolveProvisional(askId, from, to, patch) {
+        // 🔴 与 SQL twin 同注:故意不经 canAskTransition——版本化补偿的例外通道。
+        const row = this.asks.get(askId);
+        if (!row || !row.provisional || row.state !== from)
+            return false;
+        applyPatch(row, patch);
+        row.state = to;
+        row.provisional = false;
+        row.version += 1;
+        row.updatedAtMs = patch.updatedAtMs;
+        return true;
+    }
+    async deleteByTask(taskId) {
+        for (const [id, r] of this.asks) {
+            if (r.taskId === taskId)
+                this.asks.delete(id);
+        }
+        for (const [id, b] of this.batches) {
+            if (b.taskId === taskId)
+                this.batches.delete(id);
+        }
+    }
+    async getBatch(batchId) {
+        const b = this.batches.get(batchId);
+        return b ? { ...b } : null;
+    }
+}
+//# sourceMappingURL=approval-ask-store-memory.js.map