@sema-agent/server 7.132.0 → 7.134.0

package/dist/approval-ask-retention.d.ts

@@ -0,0 +1,136 @@
+/**
+ * **审批账本的留存律**(一处成文;问账三形 + local 审计账同一条)。
+ *
+ * ## 律
+ * 一问一旦**结了**,且它**最后一次动静**早于 `now − APPROVAL_ASK_RETENTION_MS`,它在审批账本里的全部记录就在维护拍上**整问**删掉;
+ * 没结的问永不按龄删;删只删整问,从不改写留下的记录;每次真删了东西都有读数。`APPROVAL_ASK_RETENTION_MS=0` = 不删(永久保留)。
+ *
+ * **「结了」= 该问在它那本账里到了终局,且它挂靠的东西都不再能动**。后半句对两本账同一条:
+ *  · **挂靠**:问行 / 审计组上的三格 —— 发起它的 run(`task_id`)、宿主会话(`session_id`)、发问那条腿的会话(`source_task_id`);
+ *  · **还能动**:run 账上 `RUN_STATUS_CLASS` 的 live / parked 两类(跑着、停驻在门上);后台子代账上 running / parked 的子代(子代的问
+ *    记在**宿主** run 与宿主会话名下 —— 继承链闭包携宿主身份 —— 而子代可以比宿主 run 活得久,所以子代的宿主 run、宿主会话与它自己的会话
+ *    都算挂靠);以及 checkpoint 店里**每一只待决的 checkpoint**(停驻不论是谁的 —— run、后台子代、workflow 子代 —— 都是一只待决 checkpoint,
+ *    它的会话 = 停驻那条腿的会话 = 那条腿上问行的 `source_task_id`):一个来源盖住所有停驻,不必逐个枚举会停驻的东西。
+ * 还能动的东西会回读或续写它挂靠的问 —— 会话授权的争议判据按「这次调用在这条腿上有没有行」读问账(没有行 = 从没问过 ⇒ 一揽子放行可以
+ * 代答;拒绝行若被删,就成了代答),停驻问的迟到结算要审计账里那一问的前置事实。所以一次清扫先列出还能动的东西的挂靠集
+ * ({@link collectMovableAnchors}),两本账都把挂靠在集里的问整只跳过。
+ * 前半句各账一句,判据都住在各自的属主里(本文件不复述,只排期与读数):
+ *  · 问账(Memory / File / SQL 三形同两只动词,各是一条语句):`reapSettledAsks` —— 行在终态(`ASK_TERMINAL`)且不是 provisional
+ *    (版本化补偿还能改它)∧ `updatedAtMs` 早于 cutoff ∧ run 不在还能动的集里;`reapEmptyBatches` —— 批是问的容器,批里已经没有问
+ *    ∧ 批自己的 `updatedAtMs` 也早于 cutoff 才删。
+ *  · 审计账(`FileApprovalAskAuditStore.rotateOlderThan`,local 车道):这一问不再欠下一次起服收敛一个答案(起服收敛的判官此刻不会把它收成孤儿)
+ *    ∧ run 不在还能动的集里 ∧ 该问所有记录里最晚的时刻早于 cutoff ⇒ 整问的行一起离开文件,留下的行逐字节不变。
+ *
+ * ## 为什么挂在维护 tick 上、而不是托管留存车道
+ * 那条车道(`boot/retention-lane.ts`)只认 SQL 后端、缺省关,在 local 上根本不存在 —— 用它就做不到「File 与 SQL 同一条律、缺省生效」。
+ * 维护 tick 是所有按龄删行的腿的宿主(多副本各扫各的、幂等):问账的删除谓词是纯行谓词,两副本同扫只是一方删到零行。
+ *
+ * ## 节律
+ * 一次清扫至多每 {@link APPROVAL_ASK_RETENTION_PASS_MS} 一次(首拍即跑):窗以天计,清扫的迟到以小时计,无关紧要;而一次清扫的成本
+ * (SQL 上按状态扫终态行、local 上重读并重写审计账)不该每分钟付一次。问账一批至多 {@link APPROVAL_ASK_REAP_BATCH} 只,一次清扫内连删到
+ * 不满一批为止(积压按批渐进清空,每条语句都短)。
+ *
+ * ## 读数
+ * 每条语句(一次店动词调用)要么删了并交回删掉的行数、要么一行没删就抛 —— 读数按语句累计、计数器按语句当场加,一次清扫半途失败时
+ * 已经删掉的照样进 `approval_ask_retention_swept`(带 `incomplete: true`),错误再抛给维护 tick 的节流 catch。删掉的行没有第二次读数的机会。
+ */
+import type { ApprovalAskStore } from "./plugins/approval-ask-store-sql.js";
+import type { FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
+import type { Logger } from "./observability/logger.js";
+import type { Metrics } from "./observability/metrics.js";
+import type { BackgroundAgentRecord } from "@sema-agent/core";
+/** 缺省保留窗:30 天。 */
+export declare const APPROVAL_ASK_RETENTION_DEFAULT_MS: number;
+/**
+ * 正值的下限:1 天(低于即钳到 1 天并点名)。还能动的 run 的问本来就不删(见文件头);下限管的是**刚结束**的 run:
+ * 客户端在 run 结束后还可能对它的卡做幂等重试 / 晚答(决断口回放首决、晚答口回 409 / 410 而不是 404),一天吸收这一段。
+ */
+export declare const APPROVAL_ASK_RETENTION_FLOOR_MS = 86400000;
+/** 两次清扫之间的最短间隔(见文件头「节律」)。 */
+export declare const APPROVAL_ASK_RETENTION_PASS_MS = 3600000;
+/** 问账一批至多删多少只问(批行同界);列 run 账时的一页也取这个数。 */
+export declare const APPROVAL_ASK_REAP_BATCH = 500;
+/**
+ * 「还能动」的 run 状态词 —— 从 `RUN_STATUS_CLASS` 派生(parked 类在前、live 类在后),不手抄词表:run 账加一个词,它当场归一类。
+ * 🔴 **次序是承重的**(codex 验证轮 V2 / 验证二轮 W2):run 账按状态一词一查,两次查询之间 run 可以换态。停驻 → 跑着 → 再停驻:
+ * 途中被**续跑**(parked → live)的 run 在跑着那一查里在;续跑**失败退回**停驻(parked → live → parked,`resume-legs` 的可重试拒臂把 run 放回
+ * suspended、checkpoint 不换)在末一查里在。只在途中「跑着 → 停驻 → 跑着」两头都漏 —— 它无害:停驻之后的问只会更新(停驻那一刻的问比
+ * cutoff 新),早于 cutoff 的旧问属于已经结束的腿(续跑换新 legKey,争议判据按腿读),迟到决议也早在那些腿续跑时就受理过了;停驻本身另由
+ * 待决 checkpoint 那一源盖住。漏一条还要途中换三次态以上。
+ */
+export declare const MOVABLE_RUN_STATUSES: readonly string[];
+/** 审计账一次轮转的读数:删掉的问数 / 删掉的行数(含无主的腿记录)/ 留下的行数。 */
+export interface AuditRotationReading {
+    droppedAsks: number;
+    droppedRecords: number;
+    keptRecords: number;
+}
+/** 一次清扫的读数(进 `approval_ask_retention_swept` 行)。 */
+export interface ApprovalAskRetentionReading {
+    cutoffMs: number;
+    asks: number;
+    batches: number;
+    auditAsks: number;
+    auditRecords: number;
+}
+/** 问账 / 审计账 / run 账各自的窄口(测试用字面量驱动同一段生产代码;生产传整只店)。 */
+export type ApprovalAskReapPort = Pick<ApprovalAskStore, "reapSettledAsks" | "reapEmptyBatches">;
+export type AuditRotationPort = Pick<FileApprovalAskAuditStore, "rotateOlderThan">;
+export interface MovableRunPort {
+    listRuns(opts: {
+        status?: string;
+        limit: number;
+        cursor?: {
+            createdAt: string;
+            taskId: string;
+        };
+    }): Promise<ReadonlyArray<{
+        taskId: string;
+        sessionId: string;
+        createdAt: string;
+    }>>;
+}
+/** checkpoint 店的窄口:每一只待决 checkpoint 的会话(不按门型过滤 —— 运维队列 `listPending` 会藏起门型读不出、却仍能被决的行)。 */
+export interface MovableCheckpointPort {
+    listPendingSessionIds(): Promise<readonly string[]>;
+}
+/** 后台子代账的窄口(core `BackgroundAgentStore` 的两只运维面)。 */
+export interface MovableBackgroundAgentPort {
+    listScopes?(): Promise<string[]>;
+    listByScope(scope: string): Promise<ReadonlyArray<{
+        owner: string;
+        sessionId?: string;
+        parentSessionId?: string;
+        rootSessionId?: string;
+        status: BackgroundAgentRecord["status"];
+    }>>;
+}
+/**
+ * 还能动的东西的**挂靠集**(见文件头):run 账上每个 {@link MOVABLE_RUN_STATUSES} 词按 `listRuns` 的键集游标翻页列全,收 run id 与它的会话;
+ * 后台子代账逐 scope 一次列全(不带状态过滤 ⇒ 每个 scope 一次快照,子代在两种能动态之间换不会漏),能动的子代收它的 owner(task 作用域 =
+ * 宿主 run;会话作用域 = 会话)、宿主会话两格与它自己的会话;checkpoint 店的待决行一次列全,收它的会话。任一账读不出 ⇒ 抛 ⇒ 这次清扫
+ * 一行不删(证不出哪些不能动,就不删);
+ * 子代账在场却枚举不了 scope(缺 `listScopes`)同样抛。列与删之间新起的东西,它的问都比 cutoff 新,不会被删;终局不会回到能动。
+ */
+export declare function collectMovableAnchors(input: {
+    runs: MovableRunPort;
+    backgroundAgents: MovableBackgroundAgentPort | undefined;
+    /** 缺席 = 本部署没有后端(没有可列的停驻;后端在场就一定交得出读口 —— `StoreBackend.checkpointReadView` 必选,没有 checkpoint 店的后端交恒空读口)。调用方取后端自己的那只读口,不看这一世开没开 durable 停驻 —— 前世 / 别的副本留下的停驻照样在店里。 */
+    checkpoints: MovableCheckpointPort | undefined;
+}): Promise<ReadonlySet<string>>;
+/**
+ * 一次清扫:先列还能动的东西的挂靠集,再用同一个 cutoff 与同一只集敲问账(问 / 批各按批删到不满一批)、再轮转审计账。每条语句的删除数当场进计数
+ * `approval_ask_retention_rows_deleted_total{ledger}`;真删了东西 ⇒ 一行 `approval_ask_retention_swept`(半途失败也打,带 `incomplete: true`,
+ * 然后把错误原样抛给调用方 —— 维护 tick 的具名节流 catch 接住,连败即 warn)。
+ */
+export declare function runApprovalAskRetentionPass(input: {
+    askStore: ApprovalAskReapPort | undefined;
+    audit: AuditRotationPort | undefined;
+    runs: MovableRunPort;
+    backgroundAgents: MovableBackgroundAgentPort | undefined;
+    checkpoints: MovableCheckpointPort | undefined;
+    cutoffMs: number;
+    logger: Pick<Logger, "info">;
+    metrics: Pick<Metrics, "inc">;
+}): Promise<ApprovalAskRetentionReading>;
+//# sourceMappingURL=approval-ask-retention.d.ts.map

package/dist/approval-ask-retention.js

@@ -0,0 +1,102 @@
+import { RUN_STATUS_CLASS } from "./plugins/store-contracts.js";
+export const APPROVAL_ASK_RETENTION_DEFAULT_MS = 30 * 86_400_000;
+export const APPROVAL_ASK_RETENTION_FLOOR_MS = 86_400_000;
+export const APPROVAL_ASK_RETENTION_PASS_MS = 3_600_000;
+export const APPROVAL_ASK_REAP_BATCH = 500;
+export const MOVABLE_RUN_STATUSES = [
+    ...Object.entries(RUN_STATUS_CLASS).filter(([, cls]) => cls === "parked"),
+    ...Object.entries(RUN_STATUS_CLASS).filter(([, cls]) => cls === "live"),
+    ...Object.entries(RUN_STATUS_CLASS).filter(([, cls]) => cls === "parked"),
+].map(([status]) => status);
+const BACKGROUND_AGENT_MOVABLE = {
+    running: true,
+    parked: true,
+    completed: false,
+    failed: false,
+    killed: false,
+};
+export async function collectMovableAnchors(input) {
+    const anchors = new Set();
+    for (const status of MOVABLE_RUN_STATUSES) {
+        let cursor;
+        for (;;) {
+            const page = await input.runs.listRuns({ status, limit: APPROVAL_ASK_REAP_BATCH, ...(cursor !== undefined ? { cursor } : {}) });
+            for (const r of page) {
+                anchors.add(r.taskId);
+                anchors.add(r.sessionId);
+            }
+            const last = page[page.length - 1];
+            if (page.length < APPROVAL_ASK_REAP_BATCH || last === undefined)
+                break;
+            cursor = { createdAt: last.createdAt, taskId: last.taskId };
+        }
+    }
+    const agents = input.backgroundAgents;
+    if (agents !== undefined) {
+        if (agents.listScopes === undefined) {
+            throw new Error("approval ledger retention: the background-agent store cannot enumerate its scopes (no listScopes) — cannot prove which delegated children can no longer move, so nothing is aged out this pass");
+        }
+        for (const scope of await agents.listScopes()) {
+            for (const row of await agents.listByScope(scope)) {
+                if (!BACKGROUND_AGENT_MOVABLE[row.status])
+                    continue;
+                for (const anchor of [row.owner, row.sessionId, row.parentSessionId, row.rootSessionId])
+                    if (anchor !== undefined)
+                        anchors.add(anchor);
+            }
+        }
+    }
+    if (input.checkpoints !== undefined)
+        for (const sessionId of await input.checkpoints.listPendingSessionIds())
+            anchors.add(sessionId);
+    return anchors;
+}
+export async function runApprovalAskRetentionPass(input) {
+    const { askStore, audit, runs, backgroundAgents, checkpoints, cutoffMs, logger, metrics } = input;
+    const reading = { cutoffMs, asks: 0, batches: 0, auditAsks: 0, auditRecords: 0 };
+    const count = (ledger, n) => {
+        if (n > 0)
+            metrics.inc("approval_ask_retention_rows_deleted_total", { ledger }, n);
+    };
+    const report = (incomplete) => {
+        if (reading.asks === 0 && reading.batches === 0 && reading.auditRecords === 0)
+            return;
+        logger.info("approval_ask_retention_swept", {
+            ...reading,
+            ...(incomplete ? { incomplete: true } : {}),
+            note: "settled approval asks quiet for longer than APPROVAL_ASK_RETENTION_MS, with nothing they hang off (their run, host session or asking leg's session) still able to move, were deleted whole from the approval ledgers (ask rows, emptied batches, and their audit-ledger records); records that remain are byte-for-byte unchanged. Set APPROVAL_ASK_RETENTION_MS=0 to keep everything.",
+        });
+    };
+    try {
+        const movable = await collectMovableAnchors({ runs, backgroundAgents, checkpoints });
+        if (askStore !== undefined) {
+            for (;;) {
+                const n = await askStore.reapSettledAsks(cutoffMs, APPROVAL_ASK_REAP_BATCH, movable);
+                reading.asks += n;
+                count("asks", n);
+                if (n < APPROVAL_ASK_REAP_BATCH)
+                    break;
+            }
+            for (;;) {
+                const n = await askStore.reapEmptyBatches(cutoffMs, APPROVAL_ASK_REAP_BATCH);
+                reading.batches += n;
+                count("batches", n);
+                if (n < APPROVAL_ASK_REAP_BATCH)
+                    break;
+            }
+        }
+        if (audit !== undefined) {
+            const rotated = audit.rotateOlderThan(cutoffMs, movable);
+            reading.auditAsks += rotated.droppedAsks;
+            reading.auditRecords += rotated.droppedRecords;
+            count("audit", rotated.droppedRecords);
+        }
+    }
+    catch (err) {
+        report(true);
+        throw err;
+    }
+    report(false);
+    return reading;
+}
+//# sourceMappingURL=approval-ask-retention.js.map

package/dist/approval-card.d.ts

@@ -23,6 +23,8 @@
 import { z } from "zod";
 import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type ResumeStartupCause, type RuleOffer, type RuleOffersAbsence as CoreRuleOffersAbsence, type SteerReplayFacet } from "@sema-agent/core";
 import type { AskRow } from "./plugins/approval-ask-store-sql.js";
+import type { SettleCause, SettleOutcome } from "./approval-deny-reasons.js";
+import type { ToolApprovalFrame } from "./tool-approval.js";
 /** 模型自由文本(`sourceAgentName` / `delegation.agentName`)的限长(设计稿 §6.2)。设计 §3.1 把
  *  「限长 + 脱敏」写成 **server 新增责任**(引擎无此层):spawning model 挑的名字是自由文本,
  *  不能指望壳去截——一条 100KB 的 agentName 在 server 侧就该被拒,而不是变成一张撑爆呈卡面的卡。 */
@@ -82,8 +84,8 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     rule: z.ZodString;
     match: z.ZodEnum<{
         name: "name";
-        path: "path";
         host: "host";
+        path: "path";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
@@ -99,8 +101,8 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
             name: "name";
-            path: "path";
             host: "host";
+            path: "path";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
@@ -167,8 +169,8 @@ export declare const RuleOfferRawSchema: z.ZodUnion<readonly [z.ZodObject<{
     rule: z.ZodString;
     match: z.ZodEnum<{
         name: "name";
-        path: "path";
         host: "host";
+        path: "path";
         exact: "exact";
         prefix: "prefix";
         wildcard: "wildcard";
@@ -184,8 +186,8 @@ export declare const RuleOfferRawSchema: z.ZodUnion<readonly [z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
             name: "name";
-            path: "path";
             host: "host";
+            path: "path";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
@@ -631,8 +633,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         rule: z.ZodString;
         match: z.ZodEnum<{
             name: "name";
-            path: "path";
             host: "host";
+            path: "path";
             exact: "exact";
             prefix: "prefix";
             wildcard: "wildcard";
@@ -648,8 +650,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             rule: z.ZodString;
             match: z.ZodEnum<{
                 name: "name";
-                path: "path";
                 host: "host";
+                path: "path";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
@@ -715,8 +717,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceTaskId: z.ZodOptional<z.ZodString>;
     sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -728,10 +730,13 @@ export declare const ApprovalCardSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type ApprovalCard = z.infer<typeof ApprovalCardSchema>;
 /**
- * `approval_ask.card_json` 里真正存的东西(设计稿 §6.2)。存**信封**而不是裸卡的理由:重放帧要回填
- * 车2 铸的 `approvalId`(wire 面的回决通道桥 + 消费端与并行 `tool_approval` 帧的去重键),而它不属于
- * 「卡的内容」——放进卡里会让 schema 的语义边界糊掉。`schemaVersion` 是形的版本闩(与行上的
+ * `approval_ask.card_json` 里真正存的东西(设计稿 §6.2)。`schemaVersion` 是形的版本闩(与行上的
  * `schema_version` 列同值,列供 SQL 侧过滤,信封里这份供读面在解出内容**之前**判形)。
+ *
+ * `approvalId` = 这张卡**呈出时**的 wire 身份。7.133.0 起它恒等于行的键 `askId`(一只 ask 一只 wire 身份),本服务的活读者(重放帧 /
+ * 应答口 / 读口)一律读行的键、不读这一格;写它是给滚动升级窗里上一版的副本(它们的 strict 信封 schema 要求这一格并照它重放)。
+ * 唯一读这一格的是 local 车道的启动收敛 —— 拿它去审计账里查前世这只 ask 的成因:审计行记的就是当时呈出的那个 id
+ * (更早写下的行上是当年的登记本地 id)。
  */
 export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
@@ -766,8 +771,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             rule: z.ZodString;
             match: z.ZodEnum<{
                 name: "name";
-                path: "path";
                 host: "host";
+                path: "path";
                 exact: "exact";
                 prefix: "prefix";
                 wildcard: "wildcard";
@@ -783,8 +788,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 rule: z.ZodString;
                 match: z.ZodEnum<{
                     name: "name";
-                    path: "path";
                     host: "host";
+                    path: "path";
                     exact: "exact";
                     prefix: "prefix";
                     wildcard: "wildcard";
@@ -850,8 +855,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceTaskId: z.ZodOptional<z.ZodString>;
         sourceAgentName: z.ZodOptional<z.ZodString>;
@@ -958,16 +963,33 @@ export declare function buildApprovalRequestFrame(input: {
     card: ApprovalCard;
     expiresAtMs: number;
     nowMs: number;
+    live: ApprovalRequestLiveFacts;
 }): ApprovalRequestFrame;
 /**
- * [ref] §3.1 的呈卡帧(设计稿 §4.1 逐字)。
+ * 🔴 **呈卡帧的活面事实座**(呈卡腿上旧族退役之后,开卡帧的全部事实都由本族承载)。
+ *
+ * 这十个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位:
+ * 卡外的事实此前只骑活卡帧,呈卡腿的消费方靠「两帧按 approvalId 合读」拿到它们。呈卡腿自此只发本族帧 ⇒ 它们挪到**活铸**的
+ * 呈卡帧顶层,同名同型同值 —— 值取自同一只帧对象(活卡帧的那一次铸定,`tool-approval.ts` 的 `askBroadcast`),本仓不另算一遍。
  *
- * 与既有 `tool_approval` 帧是**并行加帧、不替换**(§4.2):存量壳只认旧帧,新帧是闭集加员;两帧同带
- * `approvalId`,消费端据它去重。
+ * 在场面与它们在活卡帧上的在场面**逐字相同**:只在活铸的帧上,断连重放帧({@link buildReplayFrame},从 `card_json` 回读)上恒缺席 ——
+ * 活卡帧从来不重放,卡外事实也从来不在重放面上;是否把其中某几位收进卡(耐久、随重放)是另一件事,各自要过 `.strict()` 信封的回滚窗判断
+ * (`readRootCandidate` 有不进卡的硬理由:耐久面兑现不了它,见活卡帧该座顶注)。
  *
- * 🔴 铸造/发射**不在刀 3c**(那是 3b 的域)。本文件只出「持久行 → 帧」的重放投影 `buildReplayFrame`。
+ * `requiresRealApproval` 不在表里:卡上 `risk.requiresRealApproval` 是同一个事实(铸卡第三参就是它),一个事实一个读法。
  */
-export interface ApprovalRequestFrame {
+export declare const APPROVAL_REQUEST_LIVE_FACT_KEYS: readonly ["mandated", "mandate", "origin", "boundGrantDigest", "boundGrants", "classifierNoRuling", "boundGrantAbsence", "approvalCard", "readRootCandidate", "probeReason"];
+/** 呈卡帧活面事实座的类型面 = 活卡帧同名座的 `Pick`(同型由构造保证,不手抄)。 */
+export type ApprovalRequestLiveFacts = Pick<ToolApprovalFrame, (typeof APPROVAL_REQUEST_LIVE_FACT_KEYS)[number]>;
+/**
+ * [ref] §3.1 的呈卡帧(设计稿 §4.1 逐字)。
+ *
+ * 🔴 **一条腿一个帧族**:呈卡协议在一条腿上场(腿的审批上下文接了 `emitCard`)⇒ 这条腿上一只 ask 的开卡 / 消卡 / 撤卡只走本族
+ * (`approval_request` / {@link ApprovalCompleteFrame} / {@link ApprovalRevokeFrame}),旧族 `tool_approval` / `tool_approval_complete`
+ * 一帧都不发;协议未上场的腿只发旧族。同一只 ask 在同一条腿上不再有两种开卡帧,消费方不再按 `approvalId` 去重。
+ * 开卡的全部事实因此在本帧上:卡(`card`,耐久信封)+ 活面事实座({@link ApprovalRequestLiveFacts},只在活铸的帧上)。
+ */
+export interface ApprovalRequestFrame extends ApprovalRequestLiveFacts {
     /** = SSE 具名事件名(与 `tool_approval` 同约定)。 */
     type: "approval_request";
     schemaVersion: 1;
@@ -984,12 +1006,50 @@ export interface ApprovalRequestFrame {
     expiresAtMs: number;
     serverNowMs: number;
     /**
-     * server 扩(不在设计字面):车4 落地前的**回决通道桥**——现行
-     * `POST /v1/tool-approvals/:id/respond` 的 id。也是消费端把本帧与并行的 `tool_approval` 帧去重的键。
-     * 车4 上线后仍保留(旧壳过渡窗)。
+     * server 扩(不在设计字面):`POST /v1/tool-approvals/:id/respond` / `GET /v1/tool-approvals/:id` 的 id —— **恒等于 `askId`**(行的键就是这只 ask
+     * 唯一的 wire 身份;本族的消卡帧({@link ApprovalCompleteFrame})同带它)。
      */
     approvalId: string;
 }
+/**
+ * 呈卡族的**单卡消卡帧**(`approval_complete`)—— 一只 ask 落定时发给每一条**收到过它的呈卡帧**的呈卡腿连接。
+ *
+ * 语义与旧族 `tool_approval_complete` 逐字同一件事(同一次 settle 的同一份判决:`outcome` 三词、非人结局的 `cause`、park 路由的
+ * `parked`),只是它属于本族:键与开卡帧对位(`askId` / `taskId` / `approvalId`,开卡帧上有的身份这里都有),消卡按开卡那一帧的键。
+ * 与 {@link ApprovalRevokeFrame} 的分工:撤卡帧是**批级**的(兄弟被赢家连坐成 `VOID` 的那一批,名单 = 那一次原子事务的行集,
+ * 不带逐卡终局);本帧是**单卡**的终局(人答 / 窗到期 / park 路由 / 取消 …)。同一只 ask 两帧都可能收到(被撤的兄弟自己的
+ * 登记也按 settle 收场)—— 按 `askId` 清卡即可,两帧不冲突。
+ *
+ * 投递口 = 开卡帧的同一只口(`ToolApprovalRunContext.emitCard`):卡帧在哪,消卡帧就在哪(sync 腿 live + detach 账本,bg / resume 腿账本)。
+ * 门 = 这条连接的**开卡帧真的送达过**(没见过开卡帧的连接收到消卡帧就是孤儿 close,与旧族同一条门)。
+ */
+export interface ApprovalCompleteFrame {
+    /** = SSE 具名事件名(同 `approval_request` 约定)。 */
+    type: "approval_complete";
+    schemaVersion: 1;
+    askId: string;
+    taskId: string;
+    approvalId: string;
+    /** 这只 ask 怎么落定 —— 与审计 settle 行 `outcome` 同三词(`allowed` / `denied` = 一次决议;`expired` = 非人结局)。 */
+    outcome: SettleOutcome;
+    /** 非人结局的成因(与审计 settle 行 `cause` 同一个词);人答缺席。缺席不是证据。 */
+    cause?: SettleCause;
+    /** 这只 ask 按 park 路由收尾(行已转 PARKING / PARKED、迟到回决可达)。缺席 = 无证据,禁读作真拒。 */
+    parked?: true;
+    serverNowMs: number;
+}
+/** 单卡消卡帧的纯构造(`build*`:纯数据)。可选座只在有值时写键。 */
+export declare function buildApprovalCompleteFrame(input: {
+    askId: string;
+    taskId: string;
+    approvalId: string;
+    outcome: SettleOutcome;
+    cause?: SettleCause;
+    parked: boolean;
+    nowMs: number;
+}): ApprovalCompleteFrame;
+/** 呈卡腿的单卡帧(开卡 / 消卡)—— `ToolApprovalRunContext.emitCard` 的入参形。 */
+export type ApprovalCardLegFrame = ApprovalRequestFrame | ApprovalCompleteFrame;
 /**
  * [ref] §3.3 的**批级撤卡帧**(车6;设计稿 §3 逐字)。
  *

package/dist/approval-card.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, STEER_REPLAY_FACETS, isAskClass, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { capText } from "./caller-text-echo.js";
 import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
-import { PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS } from "./permission-rule-vocab.js";
 export const MAX_AGENT_NAME = 200;
 const MAX_IDENT = 200;
 export const MAX_RULE_OFFERS = 4;
@@ -450,11 +450,6 @@ const RiskAxesEnvelopeSchema = z.object({
     })
         .optional(),
 });
-function clip(s, max) {
-    if (s === undefined)
-        return undefined;
-    return s.length > max ? s.slice(0, max) : s;
-}
 export function buildApprovalCard(source, req, requiresRealApproval) {
     const axes = RiskAxesEnvelopeSchema.safeParse(req);
     const riskAxes = axes.success ? axes.data.riskAxes : undefined;
@@ -463,13 +458,13 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
     const ruleOffersAbsence = readRuleOffersAbsence(req);
     const denialLimitFallback = readDenialLimitFallback(req);
     const askClassPair = readAskClassPair(source);
-    const toolCallId = clip(source.toolCallId, MAX_IDENT);
-    const sourceTaskId = clip(source.sourceTaskId, MAX_IDENT);
-    const sourceAgentName = clip(source.sourceAgentName, MAX_AGENT_NAME);
+    const toolCallId = capText(source.toolCallId, MAX_IDENT);
+    const sourceTaskId = capText(source.sourceTaskId, MAX_IDENT);
+    const sourceAgentName = capText(source.sourceAgentName, MAX_AGENT_NAME);
     const allowRuleShadowed = readAllowRuleShadowed(req);
     return {
-        toolName: clip(source.toolName, MAX_IDENT) ?? "",
-        message: clip(source.message, MAX_MESSAGE) ?? "",
+        toolName: capText(source.toolName, MAX_IDENT) ?? "",
+        message: capText(source.message, MAX_MESSAGE) ?? "",
         ...(source.argsOmitted === true ? { argsOmitted: true } : source.args !== undefined ? { args: source.args } : {}),
         ...(toolCallId !== undefined ? { toolCallId } : {}),
         risk: {
@@ -493,9 +488,9 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
         ...(source.delegation
             ? {
                 delegation: {
-                    parentToolCallId: clip(source.delegation.parentToolCallId, MAX_IDENT) ?? "",
+                    parentToolCallId: capText(source.delegation.parentToolCallId, MAX_IDENT) ?? "",
                     depth: source.delegation.depth,
-                    ...(source.delegation.agentName !== undefined ? { agentName: clip(source.delegation.agentName, MAX_AGENT_NAME) ?? "" } : {}),
+                    ...(source.delegation.agentName !== undefined ? { agentName: capText(source.delegation.agentName, MAX_AGENT_NAME) ?? "" } : {}),
                 },
             }
             : {}),
@@ -532,6 +527,41 @@ export function buildApprovalRequestFrame(input) {
         expiresInMs: Math.max(0, input.expiresAtMs - input.nowMs),
         serverNowMs: input.nowMs,
         approvalId: input.approvalId,
+        ...pickApprovalRequestLiveFacts(input.live),
+    };
+}
+export const APPROVAL_REQUEST_LIVE_FACT_KEYS = [
+    "mandated",
+    "mandate",
+    "origin",
+    "boundGrantDigest",
+    "boundGrants",
+    "classifierNoRuling",
+    "boundGrantAbsence",
+    "approvalCard",
+    "readRootCandidate",
+    "probeReason",
+];
+function pickApprovalRequestLiveFacts(src) {
+    const out = {};
+    for (const key of APPROVAL_REQUEST_LIVE_FACT_KEYS) {
+        const v = src[key];
+        if (v !== undefined)
+            out[key] = v;
+    }
+    return out;
+}
+export function buildApprovalCompleteFrame(input) {
+    return {
+        type: "approval_complete",
+        schemaVersion: 1,
+        askId: input.askId,
+        taskId: input.taskId,
+        approvalId: input.approvalId,
+        outcome: input.outcome,
+        ...(input.cause !== undefined ? { cause: input.cause } : {}),
+        ...(input.parked ? { parked: true } : {}),
+        serverNowMs: input.nowMs,
     };
 }
 export function buildRevokeFrame(batchId, askIds, reason, serverNowMs, originTaskId) {
@@ -551,7 +581,7 @@ export function buildReplayFrame(row, nowMs) {
         expiresAtMs: row.expiresAtMs,
         expiresInMs: Math.max(0, row.expiresAtMs - nowMs),
         serverNowMs: nowMs,
-        approvalId: parsed.approvalId,
+        approvalId: row.askId,
     };
 }
 export function storedCardDemandsAPerson(cardJson) {

package/dist/approval-content-kind.d.ts

@@ -32,8 +32,11 @@ export interface ParkedGateFace {
     readonly approvalCard?: unknown;
 }
 /**
- * 停驻行的卡 = core `summarizeCheckpoint` 投给 `CheckpointSummary.approvalCard` 的那一个词:只在审批门(门型的寄存臂是
- * `tool_approval`,读 core `PAUSE_REGISTRY`)上读,词经 {@link readApprovalCard}。非审批门(计划审阅 / 资源 / 收尾)恒无卡。
+ * 停驻行的卡 —— 读法只有引擎那一只:core 包根导出 `parkedApprovalCardOf(gate)`(core 7.54.0 #1468 K2;审批门 = 门型的寄存臂是 `tool_approval`,
+ * 只在那里读卡,只有闭集成员算卡)。四态逐一处置(穷举 `switch`:core 加一态 ⇒ 编译红):`card` ⇒ 那个词;`no_card` / `not_approval` ⇒ 无卡;
+ * `unknown_word`(引擎交回**未经筛**的存储原值)⇒ 无卡 + 响亮:计一次 `server.approval-card.closed-word-out-of-set`(与 {@link readApprovalCard} 同一只计数、
+ * 同一只回显口径 —— 截 40、脱敏,对象只报形名)。修前本函数自己判「是不是审批门」(读 `PAUSE_REGISTRY` 的寄存臂)再交 {@link readApprovalCard},
+ * 与引擎的 `summarizeCheckpoint` 是两份读法。
  */
 export declare function parkedApprovalCard(gate: ParkedGateFace | undefined): ToolApprovalCard | undefined;
 /**

package/dist/approval-content-kind.js

@@ -1,5 +1,5 @@
 export { ASK_USER_QUESTION_TOOL_NAME } from "@sema-agent/core";
-import { PAUSE_REGISTRY, TOOL_APPROVAL_CARDS, facetOf, isGateKind } from "@sema-agent/core";
+import { TOOL_APPROVAL_CARDS, facetOf, isGateKind, parkedApprovalCardOf } from "@sema-agent/core";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { redactSecrets } from "./trace/redact.js";
 export function readApprovalCard(raw) {
@@ -13,9 +13,22 @@ export function readApprovalCard(raw) {
     return undefined;
 }
 export function parkedApprovalCard(gate) {
-    if (gate === undefined || !isGateKind(gate.kind) || PAUSE_REGISTRY[gate.kind].pending !== "tool_approval")
+    if (gate === undefined)
         return undefined;
-    return readApprovalCard(gate.approvalCard);
+    const reading = parkedApprovalCardOf({ kind: gate.kind, approvalCard: gate.approvalCard });
+    switch (reading.kind) {
+        case "card":
+            return reading.card;
+        case "no_card":
+        case "not_approval":
+            return undefined;
+        case "unknown_word":
+            return readApprovalCard(reading.word);
+        default: {
+            const unreachable = reading;
+            throw new Error(`unhandled parked approval card reading: ${JSON.stringify(unreachable)}`);
+        }
+    }
 }
 export function parkedFacetOf(gate) {
     return gate !== undefined && isGateKind(gate.kind) ? facetOf({ kind: gate.kind, approvalCard: gate.approvalCard }) : undefined;

package/dist/approval-deny-reasons.d.ts

@@ -46,7 +46,7 @@ export declare const APPROVAL_ENDING_CAUSES: {
     /** 承载这张卡的流没了:断连强转 park(`parkOpenAsksForTask`,断连臂的事实 = 这个 wire run 的承载流断了;卡曾送达过,只是不会再有人从那条流上答它)。 */
     readonly STREAM_DISCONNECTED: "stream_disconnected";
     /**
-     * 这张卡呈不出去:兜底臂(行不可用 / 身份不定 / 悬挂无行,`unattendedOutcome` 的 `persisted_row_unusable` / `ensure_indeterminate` / `unreached_no_row`)—— 持久行证不出属主或读不成,
+     * 这张卡呈不出去:兜底臂(行不可用 / 身份不定 / 无行且无旧族腿可呈,`unattendedOutcome` 的 `persisted_row_unusable` / `ensure_indeterminate` / `no_row_no_presenter`)—— 持久行证不出属主或读不成,
      * 本次登记根本没把卡呈到任何投递面;同 askId 的其余本地登记按这个词随行收场。与 `broadcast_lost`(emit 零接收)是两个事实。
      */
     readonly UNDELIVERABLE: "undeliverable";