@sema-agent/server 7.14.0 → 7.16.0-rc.1

package/dist/http/active-run-conflict.d.ts

@@ -14,6 +14,7 @@
  *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
  */
 import { type Autonomy } from "../runtime-governance.js";
+import { type RunRecord } from "../plugins/store-contracts.js";
 /** #220 归因的部署侧入参(两个治理旋钮;判据属主见 `governanceMandatesShellGateAlways`)。 */
 export interface GovernancePosture {
     autonomy?: Autonomy;
@@ -50,6 +51,42 @@ export declare function resumeEntryForGate(kind: string, ids: {
     sessionId: string;
     taskId: string;
 }): string | null;
+/**
+ * #220:推「这道门是运维治理层下的吗」。判据是**合取**,两半各管一件事:
+ *
+ *   行上的取证格 `gate.riskDescriptor.shellGateDoctrine === "always"`
+ *   ∧ 本部署的治理层本来就要求 always(`governanceMandatesShellGateAlways`,单一判据属主在
+ *     `runtime-governance.ts`,那里写着为什么单看行不够 —— SUP 路由姿态同样产 `"always"`)
+ *
+ * 第一半:core 在 mint 这道门时把「当时活着的 doctrine」如实写进 `riskDescriptor.shellGateDoctrine`
+ * (2026-08-05 取证裁定;`prepare-task` 只在**被 shell 门铸**的 ask 上写它),所以持久行自己带着证据 ——
+ * park 腿天然跨副本、跨重启,活卡腿那张 ALS 标记表在这里结构上够不着。
+ * 第二半:把「有效档 always」收窄到「治理层是真成因」,否则一条 SUP 路由出来的门会被谎报成治理强制。
+ *
+ * ⚠️ 残留(双向失真的窄在场向 + 根治路径)登记在 `governanceMandatesShellGateAlways` 的顶注,别在这里
+ * 复述;本位只承担「分诊提示」的分量,不参与任何门/CAS/resume 判定。
+ *
+ * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
+ * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
+ *
+ * 🔴 **导出的理由 = 单一属主**([3684]②):这条推法此前只服务 409 体,于是 `GET /v1/approvals` /
+ * `/v1/approvals/stream` 两条 durable 读面的行上**没有**出身格 —— 同一道 park 门,从 409 看得见出身、
+ * 从运维队列看不见([3683]-2 实测)。补法**不是**在读面另写一份判据(两份必漂,而这一位恰恰是靠
+ * 「行上取证 ∧ 部署姿态」的合取才不谎报的),而是让三条面共用本函数。
+ *
+ * ⚠️ **askId 为什么不在这里**(#220 的另一半,如实记账):待批 ask 的 `askId` 只活在 `approval_ask` 行上
+ * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
+ * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
+ * `PARKED`;唯一精确的连接键是 ask 行上的 `gate_token`,要按它反查得给店加一个新读口(SQL 面 = 双库集成
+ * 门)。派生 `deriveAskId(...)` 也不行:它吃 `legKey`(= 上一腿 resume token 的摘要)与 `parentToolCallId`,
+ * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
+ * 比缺席坏得多(本文件 `resumeEntryForGate` 的 default 臂是同一条纪律)。故本批诚实缺席。
+ */
+export declare function governanceOriginOf(gate: {
+    riskDescriptor?: {
+        shellGateDoctrine?: "classify" | "always";
+    };
+} | undefined, governance: GovernancePosture | undefined): true | undefined;
 /** token 泛型:真身是 branded CheckpointToken(秘密能力,只在本函数内部流转,绝不进响应体)。 */
 /**
  * SSE 车道的 done 帧 result(拒绝形)。与 409 body **同一铸体处** —— 此前 tasks.ts 在 res.write 里
@@ -67,9 +104,12 @@ export interface ActiveRunConflictDoneResult {
 }
 export declare function toDoneFrameResult(body: ActiveRunConflictBody): ActiveRunConflictDoneResult;
 interface ConflictProbeDeps<TToken> {
+    /** 结构形入参,但 `status` 取 run 行的**闭词表**(合并码重扫):判 park 要走词表属主
+     *  `isParkedRunStatus`,而它的入参是穷举联合 —— 这一格写成开放 `string` 就只能在调用点裸 cast,
+     *  绕开那道编译期执法(core 加一个 park 类成员时本文件不会红)。 */
     runStore?: {
         getRun?: (id: string) => Promise<{
-            status?: string;
+            status?: RunRecord["status"];
         } | null | undefined>;
     } | undefined;
     checkpointStore?: {

package/dist/http/active-run-conflict.js

@@ -14,24 +14,30 @@
  *    test/session-active-conflict-materials.test.ts 的分门用例会红。认不出的 kind ⇒ null(诚实缺席,不铸假门)。
  */
 import { governanceMandatesShellGateAlways } from "../runtime-governance.js";
+import { isParkedRunStatus } from "../plugins/store-contracts.js";
 /** 与 runs.ts/tasks.ts 三个 409 位共享的旧文案(byte-frozen:api-error-text-freeze 门认这句)。 */
 export const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
 /** gate.kind → 它的那一个 resume 入口(sessionId/taskId 寻址,无秘密)。 */
 export function resumeEntryForGate(kind, ids) {
     switch (kind) {
-        // tool_approval / policy_ask 不是 core 现役 kind(wire 集=WIRE_GATE_KINDS 六个,type 门双向等值)——
-        // 这两臂是**耐久历史行容忍**([2373] D 类):旧 core 铸的 checkpoint 行可能带旧 kind 名,店里读出来
-        // 仍要给出真出路;不是对上游新帧的兼容臂,别当 [2354] 清理对象误删。
-        case "tool_approval":
+        // 🔴 tool_approval / policy_ask 历史臂已撤([2373] D 类容忍的翻案,扫描修复批 2026-08-12):
+        // 当年这两臂指 /decide,但 /decide 入口守卫按 APPROVAL_GATE_KINDS 闭集(human/irreversible_ask,
+        // A-002.1 单一属主)判 kind,旧 kind 名打过去必 409 gate_not_tool_approval——指一条会拒绝自己的
+        // 路径,与 needs_review 臂同「铸假门」病族;且 D-D SLA deny-sweep 的 SQL 取行也只选闭集两 kind,
+        // 旧 kind 历史行在系统内已无任何处理臂。诚实缺席(落 default null)> 假指路;若真要救历史行,
+        // 正解是扩 APPROVAL_GATE_KINDS 单一属主(连带 SQL IN/守卫/sweep 全族),不是在这里单独铸路。
         case "human":
         case "irreversible_ask":
-        case "policy_ask":
             return `/v1/approvals/${ids.sessionId}/decide`;
         case "plan_review":
-        // needs_review 与 plan_review 同入口(TASKS-RUNS-8 附注,[2400] 审计补臂):routes/tasks.ts 的
-        // needs_review park 注明文「resumable via /plan_review」——此前缺臂 ⇒ 409 体 pendingGate 丢指引。
-        case "needs_review":
             return `/v1/assistant/tasks/${ids.taskId}/plan_review`;
+        // 🔴 needs_review **gate kind** 刻意无臂([3683]-1 属主定谳,2026-08-12,翻转 [2400] 补臂):
+        // core 三向拆分里 {kind:"needs_review"}(dry-run 拦截)的合法 outcome=dry_run_review,而 server
+        // 生产路由没有 dry_run_review 决议端点、/plan_review 端点守卫会 409 gate_not_plan_review 拒它
+        // ——旧映射把消费端指到一个会拒绝它的端点(铸假门)。[2400] 当年引的 tasks.ts 注明文说的是
+        // run **status** needs_review(plan_review/dry_run 两 gate 共享该 status),被误当 gate **kind**
+        // 语义抄进本表。落 default null=诚实缺席(客户端仍有 activeTaskStatus + cancel 保底真路);
+        // 将来若接 dry-run/shadow profile 的决议端点,在此补臂并同步 wire 契约。
         case "resource_limit":
             return `/v1/assistant/tasks/${ids.taskId}/resume`;
         case "task_done":
@@ -58,6 +64,11 @@ export function resumeEntryForGate(kind, ids) {
  * 🔴 `"classify"` 档**刻意不标**:那一档由 core 的分类器逐调用裁决,一次 shell ask 可能出自分类器(治理)
  * 也可能出自 `APPROVAL_REQUIRE` 这类别的门,行上无从分辨 —— 与活卡腿同一条「宁缺毋假」纪律。
  *
+ * 🔴 **导出的理由 = 单一属主**([3684]②):这条推法此前只服务 409 体,于是 `GET /v1/approvals` /
+ * `/v1/approvals/stream` 两条 durable 读面的行上**没有**出身格 —— 同一道 park 门,从 409 看得见出身、
+ * 从运维队列看不见([3683]-2 实测)。补法**不是**在读面另写一份判据(两份必漂,而这一位恰恰是靠
+ * 「行上取证 ∧ 部署姿态」的合取才不谎报的),而是让三条面共用本函数。
+ *
  * ⚠️ **askId 为什么不在这里**(#220 的另一半,如实记账):待批 ask 的 `askId` 只活在 `approval_ask` 行上
  * (checkpoint 行没有这一列,core 的 `CheckpointGate`/`PendingAction`/`Checkpoint` 顶层都不带它)。反向
  * (checkpoint → ask)今天**没有读口**:两条 list 读口都硬过滤 `state='STREAM_PENDING'`,而 park 完的行是
@@ -66,7 +77,7 @@ export function resumeEntryForGate(kind, ids) {
  * 这两维从 checkpoint 行推不出来,二腿/子代形上会算出一个**错**的 id —— 在「等的谁」这条通道上,错 id
  * 比缺席坏得多(本文件 `resumeEntryForGate` 的 default 臂是同一条纪律)。故本批诚实缺席。
  */
-function governanceOriginOf(gate, governance) {
+export function governanceOriginOf(gate, governance) {
     if (gate?.riskDescriptor?.shellGateDoctrine !== "always")
         return undefined;
     return governanceMandatesShellGateAlways(governance ?? {}) ? true : undefined;
@@ -92,7 +103,10 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
     try {
         const row = await deps.runStore?.getRun?.(activeTaskId);
         const status = row?.status;
-        if (status !== "running" && status !== "suspended" && status !== "needs_review")
+        // 判据取词表属主(合并码重扫):park 是两个词,由 `isParkedRunStatus` 的穷举 switch + `never` 臂看管;
+        // 手抄词表绕开那道编译期执法(core 新增一个 park 类成员时这里会静默判「非 park」⇒ 409 体少 activeTaskStatus
+        // 与 pendingGate 两格指路材料)。`running` 分支照旧单列(它不是 park,文案与出路都不同)。
+        if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
             return base;
         if (status === "running") {
             return {

package/dist/http/routes/approvals-assistant.d.ts

@@ -14,6 +14,7 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
+import { type GovernancePosture } from "../active-run-conflict.js";
 import type { RouteCtx } from "../route-ctx.js";
 export declare const ASSISTANT_PREEMPT_RE: RegExp;
 export declare const ASSISTANT_RESUME_RE: RegExp;
@@ -30,8 +31,12 @@ export declare function handleApprovalsAssistant(req: IncomingMessage, res: Serv
  * for a decided/expired/gone one. Cross-replica BY CONSTRUCTION — the poll reads the SHARED checkpoint table,
  * so a suspend on ANY replica is seen by an operator streaming on a DIFFERENT replica. A transient DB blip
  * heartbeats + retries (never kills the stream); a 15-min cap + req-close end it (parity with streamTaskTrace).
- * Poll-granularity caveat: a pending that resolves AND re-suspends on the same (session,toolCallId) within one
- * interval shows no delta — acceptable (the live snapshot is always eventually correct; no decision is missed).
+ * Poll-granularity caveat (**narrowed** by [3684]②): the delta now re-emits a `pending` frame whenever a key's
+ * WIRE PROJECTION changes (upsert), not only when the key enters — so a same-key re-suspend within one interval
+ * IS visible as long as anything on the row differs. What still shows no delta is the strictly degenerate case:
+ * a resolve + re-suspend on the same (session,toolCallId) whose projection is BYTE-IDENTICAL — indistinguishable
+ * by construction, and harmless (the card the operator sees is the card that is pending). Pins: the two halves of
+ * `test/wire-pairing-approvals-stream.test.ts` S3b (changed ⇒ re-emit with the NEW payload; unchanged ⇒ silence).
  *
  * A-002.19(2026-08-09 亲验定性=设计接受,非欠账):每连接自跑 pollMs 轮询打共享 checkpoint 表,
  * 之所以不建 fan-out/单轮询器基建——①消费方=portal 运营面,并发连接数量级为个位(不是用户面);
@@ -40,5 +45,8 @@ export declare function handleApprovalsAssistant(req: IncomingMessage, res: Serv
  * 数假设若被打破(portal 多开成常态),届时把 poll 收敛为进程内单轮询器多路复用——那是量级触发的
  * 演化,不是现在的缺陷。
  */
-export declare function streamApprovals(req: IncomingMessage, res: ServerResponse, cs: Pick<CheckpointStoreFull, "listPending">, scope: string | undefined, pollMs?: number): Promise<void>;
+export declare function streamApprovals(req: IncomingMessage, res: ServerResponse, cs: Pick<CheckpointStoreFull, "listPending">, scope: string | undefined, 
+/** [3684]②:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席,与 best-effort 同方向)。**位置在
+ *  `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
+governance?: GovernancePosture, pollMs?: number): Promise<void>;
 //# sourceMappingURL=approvals-assistant.d.ts.map

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { verifyDirectDoorProof } from "../../principal-jwt.js";
 import { MAX_APPROVAL_REASON_CHARS } from "../../approval-hmac.js";
@@ -6,6 +7,7 @@ import { fleetRunLabels } from "../../fleet/fleet-bus.js"; // [2069]④ §3 行
 import { sleep } from "../sse-log.js";
 import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_MS } from "../send.js";
 import { gatedPrincipal, explicitOperatorOk, isOperator } from "../principal-gate.js";
+import { governanceOriginOf } from "../active-run-conflict.js";
 // design/80 seam #2 (assistant-scheduler): graceful preempt (durable yield) + resource_limit resume of one task.
 export const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
 export const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
@@ -61,16 +63,17 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             const scope = operator
                 ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
                 : (principal ?? "__none__");
-            await streamApprovals(req, res, cs, scope);
+            await streamApprovals(req, res, cs, scope, deps.config);
             return;
         }
         if (req.method === "GET" && url === "/v1/approvals") {
             const scope = operator
                 ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined) // operator: all (or ?owner)
                 : (principal ?? "__none__"); // non-operator: only its own scope (never others' pending)
-            // #209 件4:行整只上 wire(键集契约不变),但 `riskDescriptor.shadowedRule` 这一格先脱敏 ——
-            // 理由与 `/v1/approvals/stream` 共用同一个投影函数,见 `redactPendingDisclosures` 顶注。
-            sendJson(res, 200, { pending: (await cs.listPending(scope)).map(redactPendingDisclosures) });
+            // #209 件4 + [3684]②:行整只上 wire(键集契约照旧「整只透传、不按键投影」),但两格由投影函数
+            // 负责——`riskDescriptor.shadowedRule` 脱敏、`governanceForced` 归因。与 `/v1/approvals/stream`
+            // **共用同一个** `projectPendingForWire`(两条读面各投各的必漂,见其顶注)。
+            sendJson(res, 200, { pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)) });
             return;
         }
         // exemptions surface — the UI's "本会话不再询问" state (list) + revoke. Same authz shape as
@@ -214,7 +217,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 // so a running/suspended-only filter DROPPED exactly the HITL-gated tasks §3 promises to surface "needs-
                 // attention first" — the operator could never discover the very plan_review tasks §4c says to resolve.
                 // Same class as the inbox leak (handler vs contract drift). needs_review is a non-terminal park → include it.
-                .filter((r) => r.status === "running" || r.status === "suspended" || r.status === "needs_review")
+                // 判据取词表属主(合并码重扫):park 两个词由 `isParkedRunStatus` 穷举,手抄形对 core 加词无编译期钉。
+                .filter((r) => r.status === "running" || isParkedRunStatus(r.status))
                 .map((r) => {
                 const s = byGate.get(r.sessionId);
                 const gate = s ? { kind: s.gateKind, severity: s.severity ?? null, spentMicroUsd: s.spentMicroUsd ?? null, deadline: s.deadline ?? null } : null;
@@ -313,17 +317,43 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 // Durable flag FIRST (only flips a still-running row), abort after — if the run suspended/terminal'd in
                 // the getRun→here window the flag affects 0 rows, so re-read and answer by the ACTUAL state.
-                const flagged = await deps.runStore.requestPreempt(taskId, run.owner); // owner guard: single-DB defense-in-depth (owner-gate already enforced above)
-                if (!flagged) {
+                let flagged = await deps.runStore.requestPreempt(taskId, run.owner); // owner guard: single-DB defense-in-depth (owner-gate already enforced above)
+                // 🔴 抢跑输了(旗打空 0 行)⇒ 按 run 的**真实**状态**三向**重判(重扫二轮红先修;与 `runs.ts` 取消腿
+                // 的孪生臂 `CANCEL_RECLASSIFY_ATTEMPTS` 那一段同源同形)。旧形无论重读到什么都发 202 no-op,于是
+                // **同一条 park 行**:不经这个竞态窗时回 409 `conflict.already_suspended`(前置检查那一支,`403a841`),
+                // 经过它时回 202「task no longer running」。按状态码分支的调度器对同一个状态拿到两种答案,而契约文
+                // §4d 把它写成了绝对规则(parked ⇒ 409 / genuinely terminal ⇒ 202),只成文了其中一种。
+                //  · **park**(判据取词表属主 `isParkedRunStatus`,穷举 switch + never 臂)⇒ 409,`status` 带**行的真词**;
+                //  · **running**(park→running 二次跃迁真实存在:并发 approve 的恢复腿把行翻回来)⇒ **重挂旗**,
+                //    有界重试;行活过来正是该重挂旗的时刻,不是该撒谎的时刻;
+                //  · 真终局 ⇒ 照旧幂等 202 no-op(带真实状态)。
+                // 有界(park↔running 反复跳时不许把请求钉在这):次数用尽仍 running ⇒ 如实 409 让调用方重试,
+                // 码与取消腿的同名情形共用(同一件事:并发决议赢了,它的恢复腿正在跑)。
+                const PREEMPT_RECLASSIFY_ATTEMPTS = 3;
+                for (let attempt = 0; !flagged; attempt++) {
                     const now = await deps.runStore.getRun(taskId);
+                    if (now !== undefined && isParkedRunStatus(now.status)) {
+                        sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: now.status });
+                        return;
+                    }
+                    if (now?.status === "running" && attempt < PREEMPT_RECLASSIFY_ATTEMPTS) {
+                        flagged = await deps.runStore.requestPreempt(taskId, run.owner); // 行又活了 ⇒ 重挂 durable 旗(赢了就走下面的快路)
+                        continue;
+                    }
+                    if (now?.status === "running") {
+                        sendError(res, 409, "conflict.approval_settled", "pending approval was settled concurrently (decided or expired) — re-check the run and retry preempt if it is still active", { taskId, status: now.status });
+                        return;
+                    }
                     sendJson(res, 202, { taskId, status: now?.status ?? "failed", note: "task no longer running — preempt is a no-op" });
                     return;
                 }
                 preemptableRuns.get(taskId)?.abort(); // fast path: preempt landed on the running instance → suspend now
                 sendJson(res, 202, { taskId, status: "preempting", note: "graceful durable yield — the task suspends at the next clean turn boundary if preempt-eligible; resume via POST /v1/assistant/tasks/:id/resume" });
             }
-            else if (run.status === "suspended") {
-                sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: "suspended" });
+            else if (isParkedRunStatus(run.status)) {
+                // 扫描P2 顺带件:park 是两个词(isParkedRunStatus 属主)——needs_review(plan_review/dry-run 门)
+                // 此前掉进 else 被谎报「already terminal — no-op」(无状态破坏,纯指路错)。extras.status 带真词。
+                sendError(res, 409, "conflict.already_suspended", "task is already suspended", { taskId, status: run.status });
             }
             else {
                 sendJson(res, 202, { taskId, status: run.status, note: "task already terminal — preempt is a no-op" });
@@ -687,6 +717,30 @@ function redactPendingDisclosures(row) {
         return row;
     return { ...row, riskDescriptor: { ...rd, shadowedRule: redactSecrets(rd.shadowedRule) } };
 }
+/**
+ * 🔴 [3683]-2 / [3684]②:两条 durable 读面(`GET /v1/approvals` + `/v1/approvals/stream`)的**唯一**
+ * 投影 —— 脱敏(#209 件4)+ 出身归因(#220 的另一半)一次做完。
+ *
+ * 出身格的病灶如实记:`governanceForced` 此前只在 409 体上算(`buildActiveRunConflict`),而运维队列
+ * 的行不算 —— 同一道 park 门,客户端从 409 看得见「这是运维治理层下的」,从队列看不见。它**不是**一个
+ * 落库缺口:判据的两半(行上 `riskDescriptor.shellGateDoctrine` + 本部署的治理姿态)在这条读面上都够得着,
+ * 缺的只是**没有人算**。所以补法 = 让两面共用 `governanceOriginOf` 这一个属主(在读面算的已知失真、
+ * 以及「根治要 core 在 mint 写进行里」的登记,逐字在 `runtime-governance.ts` 那个函数的顶注,不复述)。
+ *
+ * 🔴 `true` 才写键,恒不写 `false` —— 与活卡帧 / 409 体 / `card_json` 同一条纪律:缺席 = 「没有治理来源
+ * 的证据」,不是「这不是治理门」。
+ *
+ * ⚠️ **`delegation` 刻意不在这里**(同批如实登记,禁编造键):park 行上**没有**这条信息 —— core 的
+ * `Checkpoint` / `PendingAction` / `CheckpointGate` 三个面都不带 `{parentToolCallId, depth, agentName}`
+ * (`Checkpoint.state.delegationProvenance` 是 design/180 的内容安全聚合 `{version, coverageStartTurn,
+ * sawExternal, incomplete}`,与 ask 的出处链是两件事)。同步腿的这一格来自 `AskRequest.delegation`,
+ * 那条路 park 时不随行。⇒ 无供给,诚实缺席;要它得先有 core 侧的属主面。
+ */
+function projectPendingForWire(row, governance) {
+    const redacted = redactPendingDisclosures(row);
+    const governanceForced = governanceOriginOf({ riskDescriptor: row.riskDescriptor ?? undefined }, governance);
+    return governanceForced ? { ...redacted, governanceForced } : redacted;
+}
 /**
  * GET /v1/approvals/stream (design/80 native push): SSE — pushes pending-approval deltas so the portal
  * SUBSCRIBES ONCE instead of polling GET /v1/approvals every ~10s (better UX: near-real-time + no client poll
@@ -694,8 +748,12 @@ function redactPendingDisclosures(row) {
  * for a decided/expired/gone one. Cross-replica BY CONSTRUCTION — the poll reads the SHARED checkpoint table,
  * so a suspend on ANY replica is seen by an operator streaming on a DIFFERENT replica. A transient DB blip
  * heartbeats + retries (never kills the stream); a 15-min cap + req-close end it (parity with streamTaskTrace).
- * Poll-granularity caveat: a pending that resolves AND re-suspends on the same (session,toolCallId) within one
- * interval shows no delta — acceptable (the live snapshot is always eventually correct; no decision is missed).
+ * Poll-granularity caveat (**narrowed** by [3684]②): the delta now re-emits a `pending` frame whenever a key's
+ * WIRE PROJECTION changes (upsert), not only when the key enters — so a same-key re-suspend within one interval
+ * IS visible as long as anything on the row differs. What still shows no delta is the strictly degenerate case:
+ * a resolve + re-suspend on the same (session,toolCallId) whose projection is BYTE-IDENTICAL — indistinguishable
+ * by construction, and harmless (the card the operator sees is the card that is pending). Pins: the two halves of
+ * `test/wire-pairing-approvals-stream.test.ts` S3b (changed ⇒ re-emit with the NEW payload; unchanged ⇒ silence).
  *
  * A-002.19(2026-08-09 亲验定性=设计接受,非欠账):每连接自跑 pollMs 轮询打共享 checkpoint 表,
  * 之所以不建 fan-out/单轮询器基建——①消费方=portal 运营面,并发连接数量级为个位(不是用户面);
@@ -704,7 +762,10 @@ function redactPendingDisclosures(row) {
  * 数假设若被打破(portal 多开成常态),届时把 poll 收敛为进程内单轮询器多路复用——那是量级触发的
  * 演化,不是现在的缺陷。
  */
-export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_STREAM_POLL_MS) {
+export async function streamApprovals(req, res, cs, scope, 
+/** [3684]②:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席,与 best-effort 同方向)。**位置在
+ *  `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
+governance, pollMs = APPROVALS_STREAM_POLL_MS) {
     // JSON-encode the (sessionId, toolCallId) pair so distinct pendings can NEVER collide into one Map key,
     // regardless of what a caller-supplied sessionId contains (any single-char delimiter — space OR even NUL — is
     // injectable by an adversarial id, masking/wrong-removing an approval card; adversarial finding). JSON escaping
@@ -720,13 +781,25 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
     const start = Date.now();
     let lastBeat = Date.now();
     let prev = new Map();
+    /**
+     * 🔴 [3684]② / codex 对抗复审 [medium](验真后修):**上一拍每行的 wire 投影字节**。
+     *
+     * 旧 delta 只判「键进/键出」——对一条内容**不变**的 park 行那是对的,而 `governanceForced` 是**派生位**,
+     * 它随 `config.autonomy`(config-center 的 `apply-effective` 就地热改)在**同一条行还挂着**的时候翻面。
+     * 只判键的话,常驻订阅的 portal 会一直渲着旧徽标(最长到 15 分钟 cap 重连),而同一时刻
+     * `GET /v1/approvals` 已经给出另一个答案 —— 两条本该同源的读面当场分家。
+     *
+     * ⇒ 判据改成**投影字节变了就重发**。`pending` 帧对同一 (sessionId, toolCallId) 键因此是 **upsert**
+     * 语义(消费端本来就按这个键建表);重复发一帧是无害的(幂等覆盖),漏发一帧是错的徽标。
+     */
+    let prevFrames = new Map();
     let first = true;
     while (!closed) {
         let pending;
         try {
-            // #209 件4:与 `GET /v1/approvals` **同一个**投影函数 —— 两条 durable 读面各洗各的就会漂
-            // (SSE 那条恰恰是 operator 常驻订阅的那条,漏掉它等于没修)。
-            pending = (await cs.listPending(scope)).map(redactPendingDisclosures);
+            // #209 件4 + [3684]②:与 `GET /v1/approvals` **同一个**投影函数(脱敏 + 出身归因)—— 两条 durable
+            // 读面各投各的就会漂(SSE 那条恰恰是 operator 常驻订阅的那条,漏掉它等于没修)。
+            pending = (await cs.listPending(scope)).map((r) => projectPendingForWire(r, governance));
         }
         catch {
             // a transient TiDB blip must NOT kill the subscription — heartbeat + retry next tick (fail-soft)
@@ -736,22 +809,26 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
             continue;
         }
         const cur = new Map(pending.map((p) => [keyOf(p), p]));
+        // 一行只序列化一次:既是要发的帧体,也是与上一拍比对的判据(两处各算一遍必然漂)。
+        const curFrames = new Map([...cur].map(([k, p]) => [k, JSON.stringify({ type: "pending", ...p })]));
         if (first) {
             // initial snapshot so a freshly-subscribed portal renders the current queue immediately (no first-poll gap)
-            for (const p of pending)
-                res.write(`event: pending\ndata: ${JSON.stringify({ type: "pending", ...p })}\n\n`);
+            for (const frame of curFrames.values())
+                res.write(`event: pending\ndata: ${frame}\n\n`);
             res.write(`event: synced\ndata: ${JSON.stringify({ type: "synced", count: pending.length })}\n\n`);
             first = false;
         }
         else {
-            for (const [k, p] of cur)
-                if (!prev.has(k))
-                    res.write(`event: pending\ndata: ${JSON.stringify({ type: "pending", ...p })}\n\n`); // a new suspend
+            // 新 park **或**同一行的投影内容变了(见 `prevFrames` 顶注:派生位会在行不变时翻面)⇒ upsert 一帧
+            for (const [k, frame] of curFrames)
+                if (prevFrames.get(k) !== frame)
+                    res.write(`event: pending\ndata: ${frame}\n\n`);
             for (const [k, p] of prev)
                 if (!cur.has(k))
                     res.write(`event: resolved\ndata: ${JSON.stringify({ type: "resolved", sessionId: p.sessionId, toolCallId: p.toolCallId })}\n\n`); // decided/expired/gone
         }
         prev = cur;
+        prevFrames = curFrames;
         if (Date.now() - start > SSE_MAX_STREAM_MS) {
             res.write(`event: error\ndata: ${JSON.stringify({ type: "error", errorCode: "STREAM_MAX_DURATION", message: "approvals stream reached its 15-minute cap — reconnect to continue" })}\n\n`);
             break;

package/dist/http/routes/capabilities.js

@@ -1,4 +1,5 @@
-import { DEFAULT_EFFORT_LEVELS } from "@sema-agent/core";
+import { DEFAULT_EFFORT_LEVELS, expandTiers } from "@sema-agent/core";
+import { isModelAllowlisted } from "../../model-select.js";
 import { cwdHonored } from "../../task-cwd.js";
 import { mcpInjectionHonored } from "../../task-mcp.js";
 import { sendJson, sendError } from "../send.js";
@@ -299,6 +300,18 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
                 backend: deps.backend,
                 parkFacility: deps.checkpointStore !== undefined,
             }).active,
+            // #229(设计稿 233 稿B v2 §3):回决**理由**位在本二进制里存在的探测位 —— live
+            // `POST /v1/tool-approvals/:id/respond` 收 `note` + 回执带 `noteRecorded`,durable 回决口的三个回体
+            // 投 `decisionNote`。
+            // 🔴 **恒 true,且必须与 `noteRecorded` 同车**:老 server 对未知请求键**静默忽略 + 照回 200**
+            // (live 腿的 parser 是非 strict 的手写形),所以没有这一位时,「理由记上了」与「这台压根不认识
+            // 这个键」在 wire 上不可判别 —— 壳只能拿一个 200 猜。位在场 ⇒ 按 `noteRecorded` 逐次读结果;
+            // 位缺席 ⇒ 老 server,别渲这一格。
+            // 🔴 谓词**刻意不挂任何设施**(不是 `Boolean(deps.backend)` 之类):本位声明的是「这个二进制认识
+            // 这个键」这件版本事实,**不是**「你的理由一定会被记下」——后者是 per-call 的,由 `noteRecorded`
+            // 逐次如实回答(店缺席/店抖动时它就是 `false`)。把部署条件混进版本位,会让「says yes ⟺ 面真能用」
+            // 这句话在两个不同的问题上各说一半(与 `permissionRulesRevoke` 的存在性信号同族,见其注)。
+            approvalDecisionNote: true,
             // [1469] POST /v1/side-query(core 1.361 Runner.sideQuery 包装):一次性 brain 路由问答,无 session
             // 副作用。恒可用(runner 自带)——探测位供壳判「引擎腿在」而非 trial-by-404。
             sideQuery: true,
@@ -382,6 +395,11 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
     // today = env-derived config.models; later the sema registry (sema-registry). The internal
     // `default` alias is hidden (it's a fallback ref, not a user-pickable model).
     if (req.method === "GET" && url === "/v1/models") {
+        // #233 / A-002.8 读面:名单**在场时**每行补 `atMentionable`(名单缺席/空 ⇒ 整个键不发 —— 缺省形的
+        // 字节逐字不变,消费端"没有这个键"= 这台没开名单治理,而不是"这行不能点")。判定与三个执法点同源
+        // (isModelAllowlisted + 增广目录):壳面板上灰掉的行与服务端真会拒的行永远是同一批。
+        const atCatalog = expandTiers(deps.config.models, deps.config.tiers ?? {}) ?? deps.config.models;
+        const atAllowlist = deps.config.atModelAllowlist ?? [];
         const models = Object.entries(deps.config.models)
             .filter(([name]) => name !== "default")
             .map(([name, m]) => ({
@@ -402,6 +420,7 @@ async function handleCapabilitiesBody(req, res, url, ctx, miss) {
             // model (effort doesn't apply). The accept-set on a request is broader (any core ThinkingLevel) — this is
             // the advertised picker default, not a hard allow-list.
             ...(m.reasoning ? { supportedEffortLevels: [...DEFAULT_EFFORT_LEVELS] } : {}),
+            ...(atAllowlist.length > 0 ? { atMentionable: isModelAllowlisted(name, atCatalog, atAllowlist) } : {}),
         }));
         // [865]③ id/name 撕裂消解:`default` 历史上是 **id 形**(壳面板行 value 却是 name 形,壳侧只能打补丁
         // 拼回)。additive 双给:`default` 保持 id 形字节不动(既有消费者),新 `defaultModel = { id, name }`

package/dist/http/routes/diagnostics.d.ts

@@ -80,5 +80,23 @@ export declare function buildStaticWiringAudit(facts: StaticWiringFacts): Static
 export declare function assertStaticWiringConsistent(facts: StaticWiringFacts, logger: {
     warn: (msg: string, meta?: Record<string, unknown>) => void;
 } | undefined): StaticWiringAudit;
+/**
+ * [3399]③ clay 裁 (b)(2026-08-12,core [3648]④ + cli [3649]① 双背书):**零凭证 turnkey 形**的
+ * loopback 来源门判据(单一属主,端点与测试同吃)。
+ *
+ * 只在「operator 名单空 ∧ 非多租户 ∧ 全局 service-credential 门也不在场(没配 SERVICE_AUTH_TOKEN /
+ * AUTH_TOKENS)」的部署形上判——那正是全局门整个不设、诊断端点此前无认证可读的形。诊断面泄的是装配
+ * 拓扑(store 接线/能力位/治理姿态),对误暴露公网端口的 turnkey 机器构成侦察面。(b) 对本机自用零摩擦
+ * (壳缺省钉 BIND_HOST=127.0.0.1,local curl 照常),对远程侦察 fail-closed;配了 token 的部署远程读
+ * 走认证(全局门),不进本臂。
+ *
+ * 判源=TCP 对端地址(`req.socket.remoteAddress`),**非任何头**——XFF 类头在无反代的 turnkey 形上本就
+ * 是伪造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
+ * 边界由反代+token 承担)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed,安全轴方向)。
+ */
+export declare function zeroCredentialLoopbackDenied(remoteAddress: string | undefined, config: {
+    authToken?: string;
+    authTokens?: Record<string, string>;
+}): boolean;
 export declare function handleDiagnostics(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/http/routes/diagnostics.js

@@ -91,6 +91,28 @@ export function assertStaticWiringConsistent(facts, logger) {
     }
     return audit;
 }
+/**
+ * [3399]③ clay 裁 (b)(2026-08-12,core [3648]④ + cli [3649]① 双背书):**零凭证 turnkey 形**的
+ * loopback 来源门判据(单一属主,端点与测试同吃)。
+ *
+ * 只在「operator 名单空 ∧ 非多租户 ∧ 全局 service-credential 门也不在场(没配 SERVICE_AUTH_TOKEN /
+ * AUTH_TOKENS)」的部署形上判——那正是全局门整个不设、诊断端点此前无认证可读的形。诊断面泄的是装配
+ * 拓扑(store 接线/能力位/治理姿态),对误暴露公网端口的 turnkey 机器构成侦察面。(b) 对本机自用零摩擦
+ * (壳缺省钉 BIND_HOST=127.0.0.1,local curl 照常),对远程侦察 fail-closed;配了 token 的部署远程读
+ * 走认证(全局门),不进本臂。
+ *
+ * 判源=TCP 对端地址(`req.socket.remoteAddress`),**非任何头**——XFF 类头在无反代的 turnkey 形上本就
+ * 是伪造面;有反代的部署必然配 token(反代后 remoteAddress 恒 loopback,门自然放行,语义仍对:该形的
+ * 边界由反代+token 承担)。`remoteAddress` 缺席(socket 已断等边缘)⇒ 判拒(fail-closed,安全轴方向)。
+ */
+export function zeroCredentialLoopbackDenied(remoteAddress, config) {
+    const anyServiceAuth = Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+    if (anyServiceAuth)
+        return false; // 凭证在场 ⇒ 边界归全局 service-credential 门,本判不参与
+    const addr = remoteAddress ?? "";
+    const isLoopback = addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+    return !isLoopback;
+}
 export async function handleDiagnostics(req, res, url, ctx) {
     const miss = { fell: false };
     await handleDiagnosticsBody(req, res, url, ctx, miss);
@@ -122,6 +144,10 @@ async function handleDiagnosticsBody(req, res, url, ctx, miss) {
                 return;
             }
         }
+        else if (zeroCredentialLoopbackDenied(req.socket.remoteAddress, deps.config)) {
+            sendError(res, 403, "auth.loopback_only", "wiring diagnostics on a zero-credential deployment are readable from loopback only — configure SERVICE_AUTH_TOKEN to read remotely");
+            return;
+        }
         // 静态半场是 **composition root 在 boot 算的**(与拒启自检同一份产物,不可能与它不同)。缺席 ⇒ 这个
         // 进程不是由 main.ts 装起来的(测试夹具形),此面诚实地不存在 —— 落到全局 404,而不是回一个空壳 200。
         if (!deps.staticWiring) {