@sema-agent/server 7.133.0 → 7.134.0

package/dist/session-sync-kernel.d.ts

@@ -6,10 +6,11 @@
  * symbols WITHOUT touching the orchestration module — session-sync.ts value-imports StoreBackend and type-imports
  * security's OwnerAwareSessionStore, so importing it from security.ts formed the repo's only true type cycle
  * (security ↔ session-sync; lens2 §B/§E). This file imports nothing from the repo but TYPES from leaves (core types, and
- * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. session-sync.ts re-exports everything here, so existing import sites
+ * the session-face type from `session-incarnation.ts`, itself a leaf) — a leaf, same shape as session-sync-content.ts. Its one VALUE import is
+ * core's `SessionError` class (the closed-set store error the three adapters already throw). session-sync.ts re-exports everything here, so existing import sites
  * keep working unchanged.
  */
-import type { SessionTreeEntry } from "@sema-agent/core";
+import { SessionError, type SessionTreeEntry } from "@sema-agent/core";
 import type { SessionFace } from "./session-incarnation.js";
 /**
  * P1d-β (PUSH streaming, sema-internal server/docs/DESIGN-session-sync.md §15 + the persistence synthesis) — a TWO-PHASE STAGED import
@@ -23,8 +24,9 @@ import type { SessionFace } from "./session-incarnation.js";
  * Invariants the implementations uphold:
  *  - The staging rows live under `stagingId = ${realSessionId}#stg-${token}` (the `#` is illegal in a real uuidv7, so
  *    it can NEVER collide with a real session id) and have NO `session_meta` row → they are INVISIBLE to wake / ownerOf
- *    / listSessions (the existing orphan invariant) until `commit` writes the real session_meta LAST as the sole
- *    commit point. A crash before commit leaves only collectable orphan staging rows, never a half-session.
+ *    / listSessions (the existing orphan invariant) until `commit`'s transaction COMMITs the real session_meta row together
+ *    with the swap (the sole commit point; a fresh push claims that row first inside the same txn, invisible to everyone else
+ *    until COMMIT). A crash before commit leaves only collectable orphan staging rows, never a half-session.
  *  - `appendBatch` is IDEMPOTENT (INSERT … ON DUPLICATE KEY / ON CONFLICT DO NOTHING on the `(session_id, entry_id)`
  *    uk), so a re-streamed batch (a resumed Phase B) is a no-op.
  *  - `commit` re-classifies the relation IN-TXN against the dst's CURRENT entry ids (closing the Phase-A plan→commit
@@ -38,23 +40,48 @@ export interface StagingHandle {
     /** Append a bounded batch of entries to the staging id, re-seq'd dense from a running counter held in the handle.
      *  Idempotent (ON DUPLICATE KEY / ON CONFLICT DO NOTHING) — a re-streamed batch is a no-op. One txn per batch. */
     appendBatch(entries: SessionTreeEntry[]): Promise<void>;
-    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): in-txn re-classify (TOCTOU close) → purge dst
-     *  → row-key rename staging→real → session_meta LAST (the commit point). `owner` is re-stamped (§9). Throws
-     *  {@link SyncConflictError} on an unconsented fork/stale flip. Returns the committed relation **and the settled session
+    /** ATOMICALLY swap the staged rows into the real session id (ONE txn): owner CAS ({@link StagedCommitOptions.expectedOwner},
+     *  before anything about the row is classified or reported, so a refused commit reveals nothing about a row it did not judge — no
+     *  placement, no relation, no entry ids) → in-txn re-classify
+     *  (TOCTOU close) → purge dst → row-key rename staging→real → session_meta settled; COMMIT is the commit point. `owner` is re-stamped (§9).
+     *  Throws {@link StagedCommitOwnerChangedError} when the owner cell is not the one the import's gate judged, and
+     *  {@link SyncConflictError} on an unconsented fork/stale flip — both after rolling back. Returns the committed relation **and the settled session
      *  face** — the occupant (owner + incarnation) the commit left in the real session id, read INSIDE the same txn (the local
      *  store: the same hold of the session's write lock), never re-read afterwards. The post-commit replays conditioned on the
      *  occupant (the session row's two bits) write on exactly this face — a session deleted and re-created after the commit,
      *  even by the same owner, is a different occupant and is not written. A row without an incarnation is refused at that read
      *  (`sessionFaceFromRow`, the same law as every face read). */
-    commit(owner: string | null, opts?: {
-        resolution?: "overwrite-dst";
-    }): Promise<{
+    commit(owner: string | null, opts: StagedCommitOptions): Promise<{
         relation: SyncRelation["relation"];
         face: SessionFace;
     }>;
     /** Drop the staging rows (Phase B aborted before commit) — DELETE the staging-id session_event rows. Idempotent. */
     abort(): Promise<void>;
 }
+/**
+ * What a staged commit is conditioned on (S-1938 — one gate predicate, two phases). `expectedOwner` = the owner cell the import's gate
+ * judged when it opened the staging, in the `ownerOf` reading: `undefined` = no such session (a fresh push), `null` = ownerless, a string =
+ * that owner. The route judges `mayTouch` on that cell at Phase A and again on the session's current cell right before Phase B commits; the
+ * commit itself lands only on that same cell — each store compares it inside the commit txn (local: inside the session's write lock) and, when
+ * the cell differs, rolls back and throws {@link StagedCommitOwnerChangedError} without writing a byte. The compare is on the owner cell, not
+ * on the incarnation: the gate's predicate reads only the owner (plus placement, which the commit gate refuses on its own), so a same-owner
+ * re-create is judged the same and is not a reason to refuse.
+ */
+export interface StagedCommitOptions {
+    readonly expectedOwner: string | null | undefined;
+    readonly resolution?: "overwrite-dst";
+}
+/**
+ * The staged commit's owner CAS did not hold: the session's owner cell at commit time is not the one the import's gate judged (another replica
+ * deleted / re-created / claimed / created the session while the import streamed). Code = core's closed-set `conflict` (wire: the import face's
+ * row in `session-error-wire.ts`, 409); thrown after the commit txn rolled back — the destination is untouched. The three stores throw this one
+ * class (one sentence, minted here).
+ */
+export declare class StagedCommitOwnerChangedError extends SessionError {
+    constructor(sessionId: string);
+}
+/** The owner-cell comparison of {@link StagedCommitOptions.expectedOwner} against a store's own `ownerOf`-shaped read (`undefined` = no row). */
+export declare function ownerCellIs(expectedOwner: string | null | undefined, actual: string | null | undefined): boolean;
 /** A session store that can stage a streamed import (P1d-β). The 3 backends implement it; the in-memory dev store
  *  does not → the method is optional (the route 501s when absent, parity with the other §0.5 optional seams). */
 export type ImportStagingStore = {

package/dist/session-sync-kernel.js

@@ -1,3 +1,13 @@
+import { SessionError } from "@sema-agent/core";
+export class StagedCommitOwnerChangedError extends SessionError {
+    constructor(sessionId) {
+        super("conflict", `session ${sessionId}: owner changed while the import streamed — the staged commit was rolled back`);
+        this.name = "StagedCommitOwnerChangedError";
+    }
+}
+export function ownerCellIs(expectedOwner, actual) {
+    return expectedOwner === undefined ? actual === undefined : actual !== undefined && (actual ?? null) === expectedOwner;
+}
 export function stagingIdFor(realSessionId, token) {
     return `${realSessionId}#stg-${token}`;
 }

package/dist/task-a2a.js

@@ -1,7 +1,8 @@
-import { readToolAxes, resolveComplianceDenies } from "@sema-agent/core";
+import { resolveComplianceDenies } from "@sema-agent/core";
 import { isUsableWireName } from "@sema-agent/settings-schema";
 import { HttpError } from "./security.js";
 import { readPlainStringRecord } from "./plain-string-record.js";
+import { readRequestToolAxes } from "./request-tool-axes.js";
 import { echoKeyName } from "./request-key-closure.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 export const MAX_REQUEST_A2A_PEERS = 32;
@@ -45,12 +46,12 @@ function normalizeA2aPeer(e, leg, storedToolAxes) {
     if (Array.isArray(o.allowSkills))
         spec.allowSkills = o.allowSkills;
     if (o.toolAxes !== undefined) {
-        const axes = readToolAxes(o.toolAxes, "a2a");
+        const axes = readRequestToolAxes(o.toolAxes, "a2a");
         if (!axes.ok && storedToolAxes !== undefined) {
             const before = storedToolAxes.a2a(o.toolAxes);
             if (before === null)
                 return dropped;
-            const again = readToolAxes(before, "a2a");
+            const again = readRequestToolAxes(before, "a2a");
             if (!again.ok)
                 return dropped;
             if (again.toolAxes !== undefined)

package/dist/task-mcp.d.ts

@@ -158,10 +158,10 @@ export interface RequestMcpRefusal {
  *  ② **键名**:条目层、或 `transport` 按 `kind` 那一形的键闭集之外的键 ⇒ `400 request.body_shape`,拒体带 `unknownKeys`(拼错的键被悄悄不读,同样读起来像生效了)。
  *  ③ **身份头的键组合**(`principalHeader` 与 `assertionHeader` 同设 / `assertionHeader` 非串)⇒ {@link requestEntryIdentityRefusal}(同设那一句对契约包解析期原句逐字)。
  *  ④ **受理键的值** ⇒ 逐键问判官表 {@link ENTRY_KEY_JUDGES},`400 request.field_invalid`,拒句点名 `mcpServers[i].<键路径>`、server 名与**该键判官的原因句**({@link entryFieldRefusal})。
- *     判官**就是读器用的那一只**,不是第二份:`toolAxes` = 引擎根导出的 `readMcpToolAxes`;`toolFaces` = `readMcpToolFaces`;`contentOrigin` = `isContentOriginWord`;`source` = `isMcpSourceLabel`;
+ *     判官**就是读器用的那一只**,不是第二份:`toolAxes` = {@link readRequestToolAxes}(引擎根导出的 `readToolAxes` + 请求腿不收 `boundaryFlow`);`toolFaces` = 引擎根导出的 `readToolFaces`;
+ *     `startupTimeoutMs` = 引擎根导出的 `mcpStartupTimeoutMs`(坏值抛 `config.mcp_startup_timeout_invalid`,本门把那一句作原因句);`contentOrigin` = `isContentOriginWord`;`source` = `isMcpSourceLabel`;
  *     `name` = `isUsableWireName`;`allowTools` / `transport.args` = {@link isStringArray};`transport.env` / `headers` = 契约包读器 {@link readRequestMcpTransport} 的纯数据记录读法;`elicitation` = {@link isElicitationFlag};
  *     `transport` 的硬字段(`kind` / `command` / `url`)与软字段(`args` / `env` / `headers` / `principalHeader`)= {@link readRequestMcpTransport}(读器投影 transport 的那一只函数,门读它报的 `lost`;读器在契约包,本仓只据 `lost[0]` 拒、据 `lost` 在重放腿逐处点名)。
- *     判官只在引擎里、包根没给读口的键(今天只有 `startupTimeoutMs`)不在这里判,原样过境、由引擎在拨号时按 server 拒(不写第二份判据;到货读口即换)。
  * 于是判官受理的条目,读器({@link normalizeServer})交回的就是申报本身(只差判官自己的合法归一:空容器 / `skillScopeEligible:false` 折成缺席、`toolAxes` 取引擎的拷贝)——
  * 探测口拨的那一份因此就是提交腿会挂的那一份,不另比一遍(另比就是第二只回答者)。唯一按门分的后果是「声明了 `assertionHeader`」这一个事实(引擎尚无座,
  * 承载、不发送):新提交照挂 + 运维 info,探测口整条拒 —— 判据是同一只谓词 `specWithholdsMcpAssertionHeader`(开关 `MCP_ASSERTION_HEADER_SENT` 假时「声明了」即「被扣下」),不是第二份判法(见 `readMcpProbeBody`)。

package/dist/task-mcp.js

@@ -1,11 +1,11 @@
-import { mcpInjectionDroppedNotice, readMcpToolAxes, resolveComplianceDenies } from "@sema-agent/core";
+import { mcpInjectionDroppedNotice, mcpStartupTimeoutMs, readToolFaces, resolveComplianceDenies } from "@sema-agent/core";
 import { MCP_CONTENT_ORIGINS, describeBadContentOrigin, describeBadWireName, describeNotStringArray, describeValueShape, isContentOriginWord, isStringArray, isUsableWireName, readRequestMcpTransport, stripControlAndBidi, } from "@sema-agent/settings-schema";
 import { HttpError, createCodedHttpError } from "./security.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
 import { MCP_SOURCE_LABEL_MAX, isMcpSourceLabel, readMcpSourceLabel } from "./mcp-source-label.js";
 import { describeMcpAssertionHeaderNotAString, describeMcpIdentityHeadersConflict, mcpIdentityHeadersIssue, noteMcpAssertionHeaderIgnored, noteMcpAssertionHeaderNotSent, specWithholdsMcpAssertionHeader, toCoreMcpServerSpec } from "./mcp-assertion-header.js";
 import { MAX_KEY_ECHO, echoKeyName, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
-import { readMcpToolFaces } from "./mcp-tool-faces.js";
+import { readRequestToolAxes } from "./request-tool-axes.js";
 export const MAX_REQUEST_MCP_SERVERS = 32;
 export const MAX_REQUEST_MCP_DROP_NAMES = MAX_REQUEST_MCP_SERVERS;
 export const MCP_SERVER_ENTRY_KEYS = ["allowTools", "contentOrigin", "elicitation", "name", "source", "startupTimeoutMs", "toolAxes", "toolFaces", "transport"];
@@ -48,11 +48,11 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     }
     if (isElicitationFlag(o.elicitation))
         spec.elicitation = o.elicitation;
-    const axes = readMcpToolAxes(o.toolAxes);
+    const axes = readRequestToolAxes(o.toolAxes, "mcp");
     let judged = axes;
     let toolAxesReread;
     if (!axes.ok && storedToolAxes !== undefined) {
-        const again = readMcpToolAxes(storedToolAxes.mcp(o.toolAxes));
+        const again = readRequestToolAxes(storedToolAxes.mcp(o.toolAxes), "mcp");
         if (again.ok) {
             judged = again;
             toolAxesReread = stripControlAndBidi(axes.problem);
@@ -71,7 +71,7 @@ function normalizeServer(e, noteBadOrigin, storedToolAxes) {
     Object.assign(spec, readMcpSourceLabel(spec.name, o.source));
     if (o.startupTimeoutMs !== undefined)
         spec.startupTimeoutMs = o.startupTimeoutMs;
-    const faces = readMcpToolFaces(o.toolFaces);
+    const faces = readToolFaces(o.toolFaces);
     if (!faces.ok)
         return bad("toolFaces");
     if (faces.faces !== undefined)
@@ -188,13 +188,25 @@ const ENTRY_KEY_JUDGES = {
     source: (o) => o.source === undefined || isMcpSourceLabel(o.source)
         ? undefined
         : { path: "source", reason: `must be a non-empty string of at most ${MCP_SOURCE_LABEL_MAX} characters (a display label) — got ${describeValueShape(o.source)}` },
-    startupTimeoutMs: () => undefined,
+    startupTimeoutMs: (o) => {
+        if (o.startupTimeoutMs === undefined)
+            return undefined;
+        try {
+            mcpStartupTimeoutMs({ name: typeof o.name === "string" ? o.name : "", startupTimeoutMs: o.startupTimeoutMs });
+            return undefined;
+        }
+        catch (e) {
+            if (e.code !== "config.mcp_startup_timeout_invalid")
+                throw e;
+            return { path: "startupTimeoutMs", reason: e instanceof Error ? e.message : String(e) };
+        }
+    },
     toolAxes: (o) => {
-        const read = readMcpToolAxes(o.toolAxes);
+        const read = readRequestToolAxes(o.toolAxes, "mcp");
         return read.ok ? undefined : { path: "toolAxes", reason: read.problem };
     },
     toolFaces: (o) => {
-        const read = readMcpToolFaces(o.toolFaces);
+        const read = readToolFaces(o.toolFaces);
         return read.ok ? undefined : { path: "toolFaces", reason: read.problem };
     },
     transport: (o) => {

package/dist/task-settings.d.ts

@@ -289,11 +289,15 @@ export declare function settingsPermissionBucketIssue(perms: unknown): SettingsP
  *  的座位表(位置、条目律、去处都由那张表说),读入在 {@link parseTaskSettings},投影在 {@link applyTaskSettings} / {@link deriveSettingsPolicy}。这四个键不是 CC settings 键
  *  (sdk 的 `SemaSettings` 尚未声明 —— 对账门 `test/task-settings-sdk-key-parity.test.ts` 的「server 先于 sdk」登记表记着它们)。
  *
+ *  🔴 `approvalFrameFamilies`(S-1914)= 这条 run 的客户端**声明**渲染得了哪些审批开卡帧族 —— 不进引擎,不是 CC settings 键。消费点 = 三条执行腿的审批装配
+ *  (`tool-approval.ts` 的唯一读者 `declaredApprovalFrameFamilies` → `resolveApprovalLeg`),判官 `approvalFrameFamiliesIssue`(fresh 受理 400 与宽容读者同一只)。
+ *  `parseTaskSettings` 刻意不读它(它管的是落到 `TaskSpec` 的设置)。sdk 型面待声明(对账门的「server 先于 sdk」登记表记着)。
+ *
  *  🔴 两个 `skillListing*`([ref],7.77.0)= **CC settings 同名键**,值域抄 CC 的 schema 声明
  *  (`skillListingBudgetFraction` 是 `gt(0).lte(1)`、`skillListingMaxDescChars` 是 `int().positive()`);
  *  消费点 = 本文件的 parse + `boot/resolve-spec.ts` 的 `TaskSpec` 透传。语义(预算怎么花、描述怎么裁、
  *  溢出怎么退成 name-only)整个归引擎,本仓一个字节都不渲染,也**不复刻默认值**——缺席即整键不写。 */
-export declare const TASK_SETTINGS_KEYS: readonly ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export declare const TASK_SETTINGS_KEYS: readonly ["approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 /** 本 service 消费的 `settings.permissions` 子键 —— 闭集(值形校验另有既有门,本门只判键名)。 */
 export declare const TASK_SETTINGS_PERMISSION_KEYS: readonly ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 /** CC/SDK 合约里合法、本 service **不接线**的顶层键。词表外的 CC 键落 `unknown` —— 两列都是 400,标签只影响

package/dist/task-settings.js

@@ -154,7 +154,7 @@ export function settingsPermissionBucketIssue(perms) {
 function acceptedRuleList(v) {
     return Array.isArray(v) && v.length > 0 ? v.slice() : undefined;
 }
-export const TASK_SETTINGS_KEYS = ["complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
+export const TASK_SETTINGS_KEYS = ["approvalFrameFamilies", "complianceAdditionalDenies", "env", "hooks", "model", "outputStyle", "permissions", "readDenyPatterns", "skillListingBudgetFraction", "skillListingMaxDescChars", "ultracode", "webSearch", "writeProtectedExtra"];
 export const TASK_SETTINGS_PERMISSION_KEYS = ["allow", "ask", "defaultMode", "deny", "disableAutoMode", "neverAuto"];
 export const TASK_SETTINGS_UNSUPPORTED_KEYS = ["apiKeyHelper", "crossSessionInbound", "dialogExpiry", "sandbox", "statusLine"];
 export const TASK_SETTINGS_UNSUPPORTED_PERMISSION_KEYS = ["additionalDirectories", "disableBypassPermissionsMode"];

package/dist/tool-approval.d.ts

@@ -60,6 +60,7 @@ import { type ApprovalDecidedBy, type HostSettledBy, type RetiredDecisionKeyFact
 import type { IncomingMessage } from "node:http";
 import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundGrantAbsence, type BoundSkillGrants, type ToolApprovalCard } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
+import type { GateCurrencyStore } from "./approval-gate-currency.js";
 import { type AllowRuleShadowProjection, type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type ApprovalCardLegFrame, type ApprovalCompleteFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
@@ -114,9 +115,9 @@ export type NotPendingCause = AskRowEndingCause | typeof NOT_PENDING_UNKNOWN_CAU
 /**
  * `GET /v1/tool-approvals/:approvalId` 应答体 `state` 的**闭集**(一只 ask 此刻在哪一态;读法与应答口逐条同源):
  *  · `pending` —— 本副本上有在等它的活登记(应答口此刻收得下);
- *  · `decided` —— 行 `DECIDED`(有人 / 有策略决过;回执三键同晚答回放体);
- *  · `parked`  —— 行 `PARKING` / `PARKED`(转后台候批;应答口走迟到受理,耐久回决口照收);
- *  · `void`    —— 行 `DENIED` / `VOID`(没有人决过它,答案无处兑现;`cause` 同晚答 404)。
+ *  · `decided` —— 行 `DECIDED`(有人 / 有策略决过;回执三键同晚答回放体),**或**行 `PARKED` 而它的门已被决(S-1915:checkpoint 已结算,见 {@link ParkedGateReading});
+ *  · `parked`  —— 行 `PARKING`,或行 `PARKED` 且门仍是该会话当前待决的审批门(转后台候批;应答口走迟到受理,耐久回决口照收);
+ *  · `void`    —— 行 `DENIED` / `VOID`(没有人决过它,答案无处兑现;`cause` 同晚答 404),**或**行 `PARKED` 而它的门已过期 / 被取代(含停驻 run 被取消;此时 `cause` 缺席)。
  */
 export declare const TOOL_APPROVAL_READ_STATES: readonly ["pending", "decided", "parked", "void"];
 export type ToolApprovalReadState = (typeof TOOL_APPROVAL_READ_STATES)[number];
@@ -226,6 +227,37 @@ export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<{
     status: number;
     body: Record<string, unknown>;
 }>;
+/**
+ * 按问读口对一张 `PARKED` 卡的**门读法**(S-1915;判官的唯一属主 = `approval-gate-currency.ts`,协调器本身不认识 checkpoint 的形):
+ *  · `open` —— 这张卡的门仍是该会话当前待决的审批门(应答口收得下)⇒ 读口说 `parked`;
+ *  · `decided` —— 门已被决:方向 / 时刻 / 理由取自 checkpoint 上的结算赢家 ⇒ 读口说 `decided`;
+ *  · `void` —— 门已过期 / 被取代(含停驻 run 被取消:取消先把门 expire)⇒ 读口说 `void`(没有人决过它,答案无处兑现);
+ *  · `unknown` —— 说不出可信的话:`row_absent` = checkpoint 行没了;`decision_unreadable` = 门已结算却读不出可用的决议(行的 status 词或结算种类不在闭集表里 / 结算记录过不了 core 的
+ *    门记录筛 / 方向或时刻读不出)⇒ 读口答 404 `tool_approval.not_pending`(坏行不包装成首决;应答口并不同判:它的 PARKED 臂只对 checkpoint 行没了答 404,已结算的门答 409 `approval_stale`),
+ *    并记一行 error:`defects` 是读不出的那几处(非空),日志带首句 + 计数。
+ */
+export type ParkedGateReading = {
+    readonly kind: "open";
+} | {
+    readonly kind: "decided";
+    readonly decision: "allow" | "deny";
+    readonly decidedAtMs: number;
+    readonly decisionNote?: string;
+} | {
+    readonly kind: "void";
+} | {
+    readonly kind: "unknown";
+    readonly why: "row_absent";
+} | {
+    readonly kind: "unknown";
+    readonly why: "decision_unreadable";
+    readonly defects: readonly [string, ...string[]];
+};
+/** 门读席:入参 = 问账行上的 gate 坐标(PARKED 行恒带 `gateToken`)。读不出(店抛错)⇒ 抛,协调器按店故障姿势处置(见 `readParkedGate`)。 */
+export type ParkedGateRead = (row: {
+    readonly gateToken: string;
+    readonly gateBoundCallId: string | null;
+}) => Promise<ParkedGateReading>;
 /** 阶梯里**重发**一把 claim 的墙钟上限(ms;首把用 `DURABLE_CALL_TIMEOUT_MS`)。🔴 codex 交叉复审 C5
  *  (2026-08-06 真缺陷):只数重试次数是**不够**的 —— 次数只约束「已经返回或已经 reject 的调用」,一次
  *  **挂住不返回**的店调用(DB 连接黑洞、池饿死)会让整个退避循环连一格都走不完,`onAsk` 的 promise 于是永久
@@ -588,7 +620,7 @@ export interface ToolApprovalFrame {
      *  `approval_request` 帧([ref] 呈卡帧)同名同义:`expiresAtMs` = 本 ask 的绝对到期墙钟
      *  (有店=行上一次铸定的 `expiresAtMs`,与卡帧/落库同值;无店 D1=注册时刻算定的同名初值),
      *  `serverNowMs` = **帧铸造时刻**(cli [ref] 锚定语义:倒计时锚=帧到手时刻的服务器钟),
-     *  `expiresInMs` = `max(0, expiresAtMs - serverNowMs)` 现算。三键同生同缺(windowZero 腿不发帧,
+     *  `expiresInMs` = `max(0, expiresAtMs - serverNowMs)` 现算。三键同生同缺(没有活审批通道的腿不发帧,
      *  发出的帧恒带);旧消费端无感,新壳借此给旧族帧补倒计时([ref] Q2 那类 77 分钟死卡的根治半场)。 */
     expiresAtMs?: number;
     expiresInMs?: number;
@@ -1078,16 +1110,17 @@ export type SessionGrantStore = Pick<ApprovalExemptionStore, "has" | "grant">;
  * `StoreBackend.approvalAsk()` 的接口契约上(那条注 + `wiring-governance-operator.test.ts` 的三腿机器钉)——
  * 它是**装配面**的事实,而本谓词能看见的只有 `kind`,拿 `kind` 当持久性的代理正是这次要拆掉的那层间接。
  */
-export type StreamApprovalGate = {
+export type StreamApprovalGate<TStore extends GateCurrencyStore = GateCurrencyStore> = {
     active: true;
     askStore: ApprovalAskStore;
+    checkpointStore: TStore;
 } | {
     active: false;
     reason: "no_tool_approval" | "protocol_disabled" | "no_backend" | "no_park_facility";
 };
 /** {@link resolveStreamApprovalGate} 的入参。`backend` 用**结构形**(不 import `StoreBackend`):本模块是
  *  协调器的家,不该为一个布尔判据把整棵 store 依赖树拖进类型面。 */
-export interface StreamApprovalGateInput {
+export interface StreamApprovalGateInput<TStore extends GateCurrencyStore = GateCurrencyStore> {
     toolApprovalEnabled: boolean;
     /** 协议总开关。⚠️ 调用点一律写 `config.streamApproval?.enabled === true` —— **可选链的缺席臂折算
      *  false**(段整段缺席 ⇒ 协议不上场)。
@@ -1101,14 +1134,16 @@ export interface StreamApprovalGateInput {
         readonly kind: "mysql" | "pg" | "local";
         approvalAsk(): ApprovalAskStore;
     } | undefined;
-    /** park 设施在场性。本仓真码里 `checkpointStore` 的构造条件本身就是
-     *  `backend?.checkpoint !== undefined && config.durableApproval`(main.ts),所以设计 §8.4 那条析取式的
+    /** park 设施 = checkpoint 店本身:在场(非 `undefined`)即设施在场,上场时它随 `active` 臂交出去(与 `askStore` 同形)—— 在场性与实例是一个事实,调用点不必另持一份布尔再断言实例非空。
+     *  类型只收店的形({@link GateCurrencyStore}:协调器读它的那两个口),`backend.checkpoint` 这种工厂方法过不了 tsc —— 全进程的店只有 stage-06 铸的那一只,装配点喂的是它,不是再造一只。
+     *  本仓真码里 `checkpointStore` 的构造条件本身就是
+     *  `backend?.checkpoint !== undefined && config.durableApproval`,所以设计 §8.4 那条析取式的
      *  「safety 词表非空」一支在**装配时刻**结构上不可达(core 的 irreversible/egress 集合来自 **per-task**
      *  的 `spec.tools[].irreversibility/egress`,composition root 看不到)——两条缺失形因此在本仓收敛成
      *  同一个 `no_park_facility`(D-5/D-6 两钉打的是两种**输入**形,不是两个 reason)。 */
-    parkFacility: boolean;
+    checkpointStore: TStore | undefined;
 }
-export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput): StreamApprovalGate;
+export declare function resolveStreamApprovalGate<TStore extends GateCurrencyStore>(input: StreamApprovalGateInput<TStore>): StreamApprovalGate<TStore>;
 /**
  * 审批开卡帧的**帧族词表**(闭集)—— wire 上一只 ask 的开卡帧可能属于的族:
  *  · `tool_approval`:旧族(活卡帧 `tool_approval` / 消卡帧 `tool_approval_complete`);
@@ -1122,6 +1157,63 @@ export declare function resolveStreamApprovalGate(input: StreamApprovalGateInput
  */
 export declare const APPROVAL_FRAME_FAMILIES: readonly ["tool_approval", "approval_request"];
 export type ApprovalFrameFamily = (typeof APPROVAL_FRAME_FAMILIES)[number];
+/**
+ * 这台 worker **呈卡用的那一个族**(活卡协调器在场时)—— 全仓唯一的映射,两个读者:能力位 `approvalFrameFamilies`(`capability-facts.ts`,
+ * 壳读它决定声明什么)与 {@link resolveApprovalLeg}(腿判「这条 run 声明了没有」)。两处各写一份三元式 = 壳照一份声明、服务端照另一份判,
+ * 那正是 S-1914 要封的「两边各说各话」。入参 = {@link resolveStreamApprovalGate} 的 `active`。
+ */
+export declare function presentedApprovalFrameFamily(streamApprovalOn: boolean): ApprovalFrameFamily;
+/** 坏声明的拒体(fresh 受理面 400 `request.field_invalid`):一句话 + 机读位,形与 S-1351 座位族 / S-904 三桶的 `bad_entry` 同。 */
+export interface ApprovalFrameFamiliesIssue {
+    readonly message: string;
+    readonly fields: {
+        readonly field: "settings.approvalFrameFamilies";
+        readonly reason: "bad_entry";
+        readonly index?: number;
+    };
+}
+/**
+ * S-1914 —— 请求面声明 `settings.approvalFrameFamilies` 的**唯一判官**:这条 run 的客户端渲染得了哪些审批开卡帧族。
+ * 合法 = 数组,每项是 {@link APPROVAL_FRAME_FAMILIES} 里的词、各出现一次(空数组合法 = 一个族都不渲染,与缺席同读)。非数组 / 词表外 / 重复 ⇒ 拒体点名坐标。
+ * 两个读者:fresh 受理门(`http/admission.ts`,400)与宽容读者 {@link declaredApprovalFrameFamilies}(续跑重放读存体)。入参是 `body.settings`
+ * 本身(非对象 / 缺席 ⇒ 本判官不判,留给 `settings` 自己的形门)。拒句不回显调用方的字节,只报坐标与词表。
+ */
+export declare function approvalFrameFamiliesIssue(settings: unknown): ApprovalFrameFamiliesIssue | null;
+/**
+ * S-1914 —— 一条 run 声明的帧族集合(三条执行腿读的**唯一**读者;读的是这条 run 的请求体 `settings`:sync = 本次请求、bg = 受理过的提交体、
+ * resume / wake = 持久化体 —— 声明随体重放,不另存)。缺席 ⇒ 空集。判官说不合法 ⇒ 空集:只有绕过受理门的存体走得到这一形,
+ * 空集 = 这条腿没有活审批通道(问当场交无人值守政策口)—— 失效方向是不呈卡,不是猜一个族去呈。
+ */
+export declare function declaredApprovalFrameFamilies(settings: unknown): ReadonlySet<ApprovalFrameFamily>;
+/** 一条腿**没有活审批通道**的成因(见 {@link ApprovalLegAssembly.unattended});`frame_family_undeclared` 带上缺的那个族。 */
+export type LegUnattended = {
+    readonly arm: "window_zero";
+} | {
+    readonly arm: "frame_family_undeclared";
+    readonly family: ApprovalFrameFamily;
+};
+/** {@link resolveApprovalLeg} 的入参(sync / bg / resume 三腿 + 开流 preamble 共用一份形)。 */
+export interface ApprovalLegInput {
+    /** = `resolveStreamApprovalGate(...).active`(协议在本 worker 上场没有)。 */
+    streamApprovalOn: boolean;
+    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。
+     *  🔴 [ref]:`undefined` = **这份装配没有 `streamApproval` 段**(只出现在只填被测键的 stub-harness ——
+     *  真实 boot 无条件铸该段,见 `config.ts`)。此前三个调用点各写 `?? 0` 把这一形折成「0」,在旧语义下
+     *  是死代码(`windowZero` 那时挂在 `streamApprovalOn` 后面,协议关就恒 false);[ref] 让 `0` 在协议关的
+     *  腿上也真生效之后,那个折算会把一台**什么都没配**的 harness 判成「运维显式关窗」。故本字段收成
+     *  `number | undefined`,由每个调用点如实交出「有没有这个值」,不许再就地编一个。 */
+    windowMs: number | undefined;
+    /** `config.streamAskWindowMarginMs`(`STREAM_ASK_WINDOW_MARGIN_MS`)。 */
+    windowMarginMs: number;
+    /** `spec.limits.maxWalltimeMs`。缺席 = 没有 walltime 墙 ⇒ 第三源不参与(**缺席 ≠ 0**)。 */
+    legWalltimeMs?: number;
+    /** 本腿**开始执行的时刻**的 `performance.now()`。取值点绝不能挪到腿启动之后:误差方向必须是
+     *  「窗偏短」(安全侧,§7.3 的误差方向论证)。 */
+    nowMonotonicMs: number;
+    /** S-1914:这条 run 声明的帧族(唯一读者 {@link declaredApprovalFrameFamilies},读本 run 的请求体 / 存体)。必填 —— 漏传的装配点编译红,
+     *  不许有「没传 ⇒ 当作声明了」的默认。 */
+    declaredFamilies: ReadonlySet<ApprovalFrameFamily>;
+}
 /**
  * [ref] 车3 刀 3b —— **一条执行腿的审批装配裁定**(sync / bg / resume **三腿共用**)。
  *
@@ -1140,14 +1232,19 @@ export type ApprovalFrameFamily = (typeof APPROVAL_FRAME_FAMILIES)[number];
  * `prepare-task.js` 的 durableMandate/contentMandate 与 durableQuestionFace 等),
  * 故不在本函数内。
  *
- * 🔴 **[ref](半接线旋钮族)**:`windowZero` 的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在
+ * 🔴 **[ref](半接线旋钮族)**:关窗的第一源(`STREAM_ASK_WINDOW_MS=0`)自此**不再挂在
  * `streamApprovalOn` 后面** —— 那是部署级旋钮,它的语义不该因为这台机器有没有 durable ask 账而改变
- * (`ApprovalLegAssembly.windowZero` 顶注写了那条病)。第三源(贴 deadline)照旧只在协议上场时参与。
+ * (`ApprovalLegAssembly.unattended` 顶注写了那条病)。第三源(贴 deadline)照旧只在协议上场时参与。
+ *
+ * 🔴 **S-1914**:「这条腿有没有活审批通道」多一个成因 —— 这条 run 没声明本 worker 呈卡用的族。它与关窗是**同一件事**(不呈卡、问当场交政策口),
+ * 所以进同一个字段(`unattended` 的成因词),三条腿零新分支;判据读 {@link presentedApprovalFrameFamily}(能力位读同一只)。
+ * 判据**不**放进 {@link resolveStreamApprovalGate}:那是 worker 级谓词(协调器注入 / 能力位 / 回决 501 都没有 run),且它为假时腿退回旧族 `emit` ——
+ * 正是「回退发 `tool_approval`」。
  *
- * **`windowZero` 的两件事必须同时做**(调用方契约):不包 ALS **且**注入 immediate-unavailable 闭包。
- * 只做一件另一条路仍会呈卡。⚠️ [ref] 起**三腿都有** per-task `spec.onAsk` 装配点(sync=routes/tasks.ts,
- * bg=runs.ts,resume=server.ts driveResumeLeg),windowZero 的第二件在三腿都是显式闭包 —— 旧文「bg/
- * resume 无装配点,不包 ALS 即等价」的缺席论证已退役,别再据它推断「少装一件也行」。
+ * **没有活审批通道的两件事必须同时做**(调用方契约):不包 ALS **且** `spec.onAsk` = {@link ToolApprovalCoordinator.boundUnattendedAsk}(带成因)。
+ * 只做一件另一条路仍会呈卡(ALS 腿是 `deps.onAsk` 的到达路;不包 ALS 也让这条腿不进 broker 活流集合 = 不是别的腿的卡的投递目标)。
+ * ⚠️ [ref] 起**三腿都有** per-task `spec.onAsk` 装配点(sync=routes/tasks.ts,bg=runs.ts,resume=http/resume-legs.ts),第二件在三腿都是显式闭包 ——
+ * 旧文「bg/resume 无装配点,不包 ALS 即等价」的缺席论证已退役,别再据它推断「少装一件也行」。
  */
 export interface ApprovalLegAssembly {
     /** 协议在本腿上是否上场。false ⇒ **既不包 ALS、也不接** `emitCard`/`emitRevoke`/`legKey`/
@@ -1157,16 +1254,17 @@ export interface ApprovalLegAssembly {
      *  同 (owner, session) 活流呈活卡(sync 腿 [ref] 起本就如此;bg/resume 的这条行为差 = [ref] CHANGELOG
      *  披露的行为面变更)。旧文「本腿逐字保持协议之前的行为」只对协议件成立,别再把它读成「协议关 = 零呈卡」。 */
     active: boolean;
-    /** §8.3 窗=0 恒 park。
-     *  🔴 **[ref] 起它与 `active` 解耦**(旧文「`active` 为假时恒 false —— 协议都没上场,谈不上关窗」已
-     *  作废):`STREAM_ASK_WINDOW_MS` 是**部署级**旋钮,`0` 的语义(运维显式关窗 ⇒ 恒走
-     *  {@link ToolApprovalCoordinator.unattendedAskOutcome},连卡都不发)在两条车道上必须是同一个意思。
-     *  旧形下 local 车道(S-384 之前的「账不持久」臂)/ 无 park 设施 / 显式关协议的部署配了 `0`,拿到的是一张
-     *  等满 5min 的活卡 —— 与它自己的域注正好相反,且没有任何一行说出来。
-     *  ⚠️ 「窗**缺席**」(`windowMs: undefined` = 这份装配根本没有 streamApproval 段,只出现在 stub-harness)
-     *  **不是**关窗:那时逐字保持活卡腿。 */
-    windowZero: boolean;
-    /** §7.3 本 leg 的 walltime deadline(`performance.now()` 单调基)。只在 `active ∧ ¬windowZero ∧
+    /** **这条腿没有活审批通道**(在场 ⇒ 不包 ALS、不是任何卡的投递目标、`spec.onAsk` 是 {@link ToolApprovalCoordinator.boundUnattendedAsk}
+     *  席 —— 每只问当场交无人值守政策口,臂 = 本值)。缺席 ⇒ 这条腿按 {@link presentedApprovalFrameFamily} 的族呈卡。成因闭集两个,先后即判序:
+     *  · `window_zero`(§8.3)—— 运维关窗(`STREAM_ASK_WINDOW_MS=0`),或协议上场时本腿剩余 walltime 撑不住安全余量。
+     *    🔴 [ref] 起与 `active` 解耦:`0` 是**部署级**旋钮,在两条车道上是同一个意思(旧形下关协议的部署配了 `0` 拿到的是等满 5min 的活卡)。
+     *    ⚠️ 「窗**缺席**」(`windowMs: undefined` = 这份装配根本没有 streamApproval 段,只出现在 stub-harness)**不是**关窗。
+     *    排在声明之前:那时谁都不呈卡,缺的不是客户端的声明。
+     *  · `frame_family_undeclared`(S-1914)—— 这条 run 的请求没有声明本 worker 呈卡用的族(`settings.approvalFrameFamilies`)。判据对两个族同一条:
+     *    不回退发另一族、不双发、没有「键缺席 ⇒ 视作旧族」的默认。
+     *  三条腿只问「在场没有」,成因随席交给唯一铸点(遥测臂 + deny 政策的拒因句)。 */
+    unattended?: LegUnattended;
+    /** §7.3 本 leg 的 walltime deadline(`performance.now()` 单调基)。只在 `active ∧ 有活审批通道 ∧
      *  有 walltime 墙` 时在场 —— 关着时供值会把既有 5min 活卡窗按三元公式缩短(§7.2 真行为变更)。 */
     legDeadlineMonotonic?: number;
 }
@@ -1196,24 +1294,14 @@ export declare function createApprovalCardEmitter(sinks: {
     /** live SSE 口。**已死的流应当由调用方判成缺席或让它抛**,不要写一个静默 no-op —— 那正是本 finding。 */
     writeLive?: (frame: ApprovalCardLegFrame) => void | Promise<void>;
 }): (frame: ApprovalCardLegFrame, registration: string) => Promise<void>;
-export declare function resolveApprovalLeg(input: {
-    /** = `resolveStreamApprovalGate(...).active`(协议在本 worker 上场没有)。 */
-    streamApprovalOn: boolean;
-    /** `config.streamApproval.windowMs`(`STREAM_ASK_WINDOW_MS`)。
-     *  🔴 [ref]:`undefined` = **这份装配没有 `streamApproval` 段**(只出现在只填被测键的 stub-harness ——
-     *  真实 boot 无条件铸该段,见 `config.ts`)。此前三个调用点各写 `?? 0` 把这一形折成「0」,在旧语义下
-     *  是死代码(`windowZero` 那时挂在 `streamApprovalOn` 后面,协议关就恒 false);[ref] 让 `0` 在协议关的
-     *  腿上也真生效之后,那个折算会把一台**什么都没配**的 harness 判成「运维显式关窗」。故本字段收成
-     *  `number | undefined`,由每个调用点如实交出「有没有这个值」,不许再就地编一个。 */
-    windowMs: number | undefined;
-    /** `config.streamAskWindowMarginMs`(`STREAM_ASK_WINDOW_MARGIN_MS`)。 */
-    windowMarginMs: number;
-    /** `spec.limits.maxWalltimeMs`。缺席 = 没有 walltime 墙 ⇒ 第三源不参与(**缺席 ≠ 0**)。 */
-    legWalltimeMs?: number;
-    /** 本腿**开始执行的时刻**的 `performance.now()`。取值点绝不能挪到腿启动之后:误差方向必须是
-     *  「窗偏短」(安全侧,§7.3 的误差方向论证)。 */
-    nowMonotonicMs: number;
-}): ApprovalLegAssembly;
+export declare function resolveApprovalLeg(input: ApprovalLegInput): ApprovalLegAssembly;
+/**
+ * 🔴 **开流 preamble 往本连接投卡与否的唯一判据**(S-1914 / H5)—— 两条 preamble 共用:sync 腿(`routes/tasks.ts`,入参的声明读本次请求的 `settings`)与耐久事件流
+ * (`routes/runs.ts`,声明读这条 run 的持久化体,见 `http/run-declared-families.ts`)。preamble 也是往本连接投卡:只在本腿**有活审批通道**时重放、订消卡 ——
+ * 协议在本 worker 上场、没关窗、这条 run 声明了本 worker 呈卡用的族;与本腿呈不呈卡是同一只装配({@link resolveApprovalLeg}),不在 preamble 一侧另写一份合取式。
+ * 为假 ⇒ 零帧且零 ask 账读(与「协议未上场」同形)。时钟不参与这一判:`nowMonotonicMs` 只喂 `legDeadlineMonotonic`(窗长三元),不进 `unattended` 的三个成因。
+ */
+export declare function approvalPreambleReplays(input: Omit<ApprovalLegInput, "nowMonotonicMs">): boolean;
 /** 一条 **DECIDED 行**能交还给引擎的全部形(`AskOutcome` 减掉 park 路由那一臂 —— 一条有决议的行
  *  从定义上不是「投递面拿走了它」)。{@link ToolApprovalCoordinator.notifyExternalDecision} 收的就是它。 */
 export type DecidedAskOutcome = Exclude<AskOutcome, "unavailable">;
@@ -1360,6 +1448,9 @@ export declare class ToolApprovalCoordinator {
      *  构造之后才装配;同款 holder 先例 = main.ts 的 `getRunDenySweep`)。取到 undefined ⇒ 该臂逐字回落
      *  修前 404,partial 部署安全。 */
     private readonly parkedRedeem;
+    /** S-1915:按问读口对 `PARKED` 卡的门读席(见 {@link ParkedGateRead})。缺席(没有 checkpoint 店的部署 / 只装 ask 账的嵌入)⇒ 读口只能说行说的话(`parked`)。
+     *  不是晚绑取值口:checkpoint 店在协调器构造之前就装好了(`boot/stage-06`),与 `parkCommits` 同一只店。 */
+    private readonly parkedGate;
     /** [ref] 裁 (c):local 车道的 File ask **审计** sink(在场 ⇔ `DB_BACKEND=local` ∧ 审批面开着,装配点
      *  `boot/coordinators.ts`)。三个挂线点:铸造(askBroadcast register 后)/ 决议(`settle()` 公共咽喉)/
      *  腿闭(`runWithContext` finally)。**纯观察面**:sink 自己吞写失败并 `recordFailOpen`,任何一次审计
@@ -1401,6 +1492,8 @@ export declare class ToolApprovalCoordinator {
         ruleScopeRootFor?: (sessionId: string | undefined) => string | undefined;
         /** [ref]:PARKED 臂赎回席的**晚绑取值口**(见 {@link ToolApprovalCoordinator.parkedRedeem})。 */
         parkedRedeem?: () => ParkedAskRedeem | undefined;
+        /** S-1915:按问读口的门读席(见 {@link ToolApprovalCoordinator.parkedGate})。 */
+        parkedGate?: ParkedGateRead;
         /** [ref]:受理回执表两道界(缺省见 {@link DEFAULT_PARK_REDEMPTION_MAX}/{@link DEFAULT_PARK_REDEMPTION_TTL_MS})。
          *  不是部署旋钮(不接 env),可注入只为让「有界」这件事被判据观测得到。 */
         parkRedemptionMax?: number;
@@ -1428,7 +1521,7 @@ export declare class ToolApprovalCoordinator {
      * 五臂(设计稿 §1 的表)全部读它,`unattendedPolicy` 因此是一处施加、五处消费:
      *  (a) 有店窗到期 `expireAsk` 赢 CAS / (b) 无店窗到期(D1)/ (c) 有店但 `expireAsk` 报错
      *  —— 三条走 `windowRouteUnavailable` 标志,在 {@link shapeOutcome}(askBroadcast 内)成形;
-     *  (d) `windowZero`(装配层短路)与无 ALS 上下文的 headless 腿 —— 走本方法/{@link ask};
+     *  (d) 没有活审批通道的腿(装配层短路:关窗 / 未声明呈卡族,S-1914)与无 ALS 上下文的 headless 腿 —— 走本方法/{@link ask};
      *  (e) 断连 `forceParkNow` / emit 全灭 / 写侧准入超限 —— 走本方法。
      *
      * **持久回放的两个口也归它管**(codex R1-F1 验真后收口,红先钉在
@@ -1473,10 +1566,9 @@ export declare class ToolApprovalCoordinator {
      * 读的是政策**读**口(不落遥测)。
      */
     private batchIdFor;
-    /** {@link unattendedOutcome} 的**公开**口:`windowZero` 的 immediate-unavailable 闭包长在装配层
-     *  (`http/routes/tasks.ts` 的 sync 腿),它必须与协调器内五臂读**同一个**旋钮值,而不是各算一遍。
-     *  出处随调用方给(那条腿知道自己是哪一只 ask)。 */
-    unattendedAskOutcome(site: {
+    /** {@link unattendedOutcome} 的**公开**口:没有活审批通道的腿({@link ApprovalLegAssembly.unattended})的席长在装配层,它必须与协调器内
+     *  五臂读**同一个**政策值,而不是各算一遍。成因(`why`)与出处随调用方给(那条腿知道自己为什么不呈卡、是哪一只 ask)。 */
+    unattendedAskOutcome(site: LegUnattended & {
         taskId?: string;
         owner?: string | null;
         toolName?: string;
@@ -1685,8 +1777,9 @@ export declare class ToolApprovalCoordinator {
      *  问已经发出去了)。 */
     private durableGrantHas;
     /**
-     * 🔴 **S-877 候裁 16 —— 窗 0 席**:本席**不呈卡**,但在报「无人可答」之前先问站着的答案。装配点 = 三条腿的 `windowZero` 席
-     * (sync `http/routes/tasks.ts`、bg `runs.ts`、resume `http/resume-legs.ts`)。修前三处是装配层的就地闭包 `() => unattendedAskOutcome(...)`
+     * 🔴 **S-877 候裁 16 —— 无通道席**(旧名「窗 0 席」):本席**不呈卡**,但在报「无人可答」之前先问站着的答案。装配点 = 三条腿上没有活审批通道
+     * 的那一支({@link ApprovalLegAssembly.unattended} 在场;sync `http/routes/tasks.ts`、bg `runs.ts`、resume `http/resume-legs.ts`),成因 `why`
+     * 随席交给唯一铸点(遥测臂 + deny 政策的拒因句;S-1914 起两个成因:关窗 / 这条 run 没声明呈卡族)。修前三处是装配层的就地闭包 `() => unattendedAskOutcome(...)`
      * —— 不读授权,引擎那一问(模式写门 / 形状层)在窗 0 部署上 remember 恒无效。改形后:授权命中 ⇒ `true`;否则逐字走
      * {@link unattendedAskOutcome} 这**一个**政策口(五臂一处施加,[ref] R-13 C 不变)。
      * parked 赎回腿的继承条目席**不**改:那条腿上到席的问全是继承问(core 盖 `mandated`),本席依约不退役,改了也兑现不了任何东西 ——
@@ -1697,7 +1790,7 @@ export declare class ToolApprovalCoordinator {
         owner: string | null;
         taskId: string;
         sessionId?: string;
-    }) => ((req: AskRequest) => Promise<AskOutcome>);
+    }, why: LegUnattended) => ((req: AskRequest) => Promise<AskOutcome>);
     /**
      * 🔴 session grant 短路前的**持久出处复核**([ref] 的 codex R1-[high] 补丁;[ref] 换判据;S-944 / SN-C1 换读口)。
      *
@@ -1991,6 +2084,12 @@ export declare class ToolApprovalCoordinator {
     private readAdopted;
     /** {@link readApproval} 的读行半场。 */
     private readAskRowState;
+    /**
+     * `PARKED` 行的门读法(S-1915):问判官「这张卡的门此刻还是不是该会话当前待决的审批门」。行是终态、不随赎回 / 取消改写,所以只有 checkpoint 知道。
+     * 没有门读席 / 行上没有 gate token ⇒ `open`(读口只能说行说的话;应答口对同一张卡的 PARKED 臂此时也答不了受理,不另有第二个答案)。
+     * 读不出(店故障 / 超时)⇒ 按本协调器的店故障姿势(D5:记账 + 一次 warn)退回 `open` —— 这一臂只影响**展示**,应答口对同一张卡仍按自己的判官 fail-closed。
+     */
+    private readParkedGate;
     /** 一条行 → 按问读口的答案(行态六态穷举:新增 `AskState` 而不在此表态 = **编译错**)。 */
     private readStateOfRow;
     /**