@sema-agent/server 7.141.0 → 7.142.0

package/dist/approval-crash-convergence.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { APPROVAL_ASK_AUDIT_DIR, APPROVAL_ASK_AUDIT_LEDGER, FileApprovalAskAuditStore } from "./approval-ask-audit-store.js";
 import { readStoredCardEnvelope } from "./approval-card.js";
 import { APPROVAL_ENDING_CAUSES } from "./approval-deny-reasons.js";
+import { bindParkingAskAtGate } from "./approval-reconciler.js";
 import { writerGoneEvidenceFor } from "./user-input-ledger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 const CONVERGE_PAGE = 500;
@@ -17,57 +18,128 @@ export function openAuditEvidenceForConvergence(live, localDataRoot) {
     const opened = new FileApprovalAskAuditStore(localDataRoot);
     return { audit: opened, release: () => opened.close() };
 }
+async function forEachRowInState(store, state, visit) {
+    const seen = new Set();
+    let stayed = 0;
+    for (;;) {
+        const page = (await store.listByState(state, stayed + CONVERGE_PAGE)).filter((r) => !seen.has(r.askId));
+        if (page.length === 0)
+            return;
+        for (const row of page) {
+            seen.add(row.askId);
+            if (!(await visit(row)))
+                stayed += 1;
+        }
+    }
+}
+function refusingToStart(state, row, err) {
+    return new Error(`approval crash convergence: could not close the previous process's ${state === "STREAM_PENDING" ? "pending" : "parking"} approval ask ${row.askId} (task ${row.taskId}): ` +
+        `${err instanceof Error ? err.message : String(err)} — refusing to start, because serving now would leave a card that nothing waits for ` +
+        "decidable with a 200. Fix the data root (disk full / read-only?) and start again.");
+}
 export async function convergeCrashedAsksAtBoot(input) {
     const now = input.now ?? Date.now;
-    const audited = input.audit?.convergeCrashedAsks() ?? { pending: 0, decided: 0, inconsistent: 0, corruptLines: 0 };
+    const audit = input.audit;
+    const audited = audit?.convergeCrashedAsks() ?? { pending: 0, decided: 0, inconsistent: 0, corruptLines: 0 };
     const asksVoided = { [APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK]: 0, [APPROVAL_ENDING_CAUSES.SHUTDOWN_BEFORE_PARK]: 0 };
     let causeUnreadable = 0;
+    let parkingBound = 0;
     const store = input.askStore;
     if (store !== undefined) {
-        const seen = new Set();
-        for (;;) {
-            const page = (await store.listByState("STREAM_PENDING", CONVERGE_PAGE)).filter((r) => !seen.has(r.askId));
-            if (page.length === 0)
-                break;
-            for (const row of page) {
-                seen.add(row.askId);
+        await forEachRowInState(store, "STREAM_PENDING", async (row) => {
+            const envelope = readStoredCardEnvelope(row.cardJson);
+            if (envelope === undefined) {
+                causeUnreadable += 1;
+                recordFailOpen("server.approval-crash-convergence.cause-unreadable", `ask ${row.askId} (task ${row.taskId}): card envelope unreadable — cause defaulted to ${APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK}`);
+            }
+            const reason = envelope !== undefined && audit !== undefined ? audit.holderGoneVerdict(envelope.approvalId).cause : APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK;
+            let won;
+            try {
+                won = await store.transitionAsk(row.askId, "STREAM_PENDING", "VOID", { endingCause: reason, updatedAtMs: now() });
+            }
+            catch (err) {
+                throw refusingToStart("STREAM_PENDING", row, err);
+            }
+            if (won)
+                asksVoided[reason] += 1;
+            return true;
+        });
+        if (audit !== undefined) {
+            const orphanOf = (row) => {
                 const envelope = readStoredCardEnvelope(row.cardJson);
-                if (envelope === undefined) {
-                    causeUnreadable += 1;
-                    recordFailOpen("server.approval-crash-convergence.cause-unreadable", `ask ${row.askId} (task ${row.taskId}): card envelope unreadable — cause defaulted to ${APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK}`);
+                if (envelope === undefined)
+                    return undefined;
+                const verdict = audit.holderGoneVerdict(envelope.approvalId);
+                return verdict.orphan ? { approvalId: envelope.approvalId, cause: verdict.cause } : undefined;
+            };
+            let voidedSiblings = [];
+            const gate = {
+                askStore: store,
+                checkpoints: input.checkpoints,
+                warn: (event, fields) => input.logger.warn(event, fields),
+                revoke: (_row, askIds) => {
+                    voidedSiblings = askIds;
+                },
+            };
+            await forEachRowInState(store, "PARKING", async (row) => {
+                const orphan = orphanOf(row);
+                if (orphan === undefined)
+                    return false;
+                voidedSiblings = [];
+                let bound;
+                try {
+                    bound = (await bindParkingAskAtGate(gate, row, now())).bound;
                 }
-                const reason = envelope !== undefined && input.audit !== undefined ? input.audit.causeFor(envelope.approvalId) : APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK;
+                catch (err) {
+                    throw refusingToStart("PARKING", row, err);
+                }
+                if (!bound)
+                    return false;
+                parkingBound += 1;
+                input.logger.warn("approval_crash_convergence_park_committed", {
+                    askId: row.askId,
+                    taskId: row.taskId,
+                    approvalId: orphan.approvalId,
+                    voidedSiblings,
+                    note: "the audit ledger saw no settlement for this approval ask (an orphan of the previous process), but its park row had committed — bound PARKED, decidable through the durable approval endpoint; the commit landed in the window between the park commit and its observation. Same-batch siblings still parking were voided as superseded by this park (batch_bound_elsewhere)",
+                });
+                return true;
+            });
+            await forEachRowInState(store, "PARKING", async (row) => {
+                const orphan = orphanOf(row);
+                if (orphan === undefined)
+                    return false;
                 let won;
                 try {
-                    won = await store.transitionAsk(row.askId, "STREAM_PENDING", "VOID", { deniedReason: reason, updatedAtMs: now() });
+                    won = await store.transitionAsk(row.askId, "PARKING", "VOID", { endingCause: orphan.cause, updatedAtMs: now() });
                 }
                 catch (err) {
-                    throw new Error(`approval crash convergence: could not close the previous process's pending approval ask ${row.askId} (task ${row.taskId}): ` +
-                        `${err instanceof Error ? err.message : String(err)} — refusing to start, because serving now would leave a card that nothing waits for ` +
-                        "decidable with a 200. Fix the data root (disk full / read-only?) and start again.");
+                    throw refusingToStart("PARKING", row, err);
                 }
                 if (won)
-                    asksVoided[reason] += 1;
-            }
+                    asksVoided[orphan.cause] += 1;
+                return true;
+            });
         }
     }
-    return { ...audited, asksVoided, causeUnreadable };
+    return { ...audited, asksVoided, causeUnreadable, parkingBound };
 }
 export async function runBootCrashConvergence(ctx) {
     const { backend, runStore, logger } = ctx;
     if (backend === undefined || runStore === undefined || writerGoneEvidenceFor(backend.kind, runStore).kind !== "exclusive_data_root")
         return undefined;
     const evidence = openAuditEvidenceForConvergence(ctx.liveAudit, ctx.localDataRoot);
-    const converged = await convergeCrashedAsksAtBoot({ askStore: backend.approvalAsk(), audit: evidence.audit }).finally(evidence.release);
-    if (converged.pending > 0 || converged.decided > 0 || converged.inconsistent > 0 || converged.corruptLines > 0 || totalAsksVoided(converged) > 0) {
+    const converged = await convergeCrashedAsksAtBoot({ askStore: backend.approvalAsk(), audit: evidence.audit, checkpoints: backend.checkpointReadView(), logger }).finally(evidence.release);
+    if (converged.pending > 0 || converged.decided > 0 || converged.inconsistent > 0 || converged.corruptLines > 0 || totalAsksVoided(converged) > 0 || converged.parkingBound > 0) {
         logger.warn("approval_ask_audit_crash_converged", {
             pending: converged.pending,
             decided: converged.decided,
             inconsistent: converged.inconsistent,
             corruptLines: converged.corruptLines,
             asksVoided: converged.asksVoided,
+            parkingBound: converged.parkingBound,
             causeUnreadable: converged.causeUnreadable,
-            note: "approval asks left pending by the previous process were converged: each such ask is now VOID in the ask ledger (the decision endpoint answers 410 gone.ask with this cause) and is listed under GET /v1/approvals crashConverged when the audit ledger saw it (cause crashed_before_park = the process crashed; cause shutdown_before_park = an orderly shutdown cut the leg off before it closed or before its park committed)",
+            note: "approval asks left by the previous process were converged: each pending ask, and each parking ask the audit ledger judged an orphan, is now VOID in the ask ledger (the decision endpoint answers 410 gone.ask with this cause) and is listed under GET /v1/approvals crashConverged when the audit ledger saw it (cause crashed_before_park = the process crashed; cause shutdown_before_park = the previous process completed its orderly shutdown wind-down while the ask was still unsettled); a parking ask whose park row had committed is bound PARKED instead",
         });
     }
     return converged;

package/dist/approval-deny-reasons.d.ts

@@ -3,10 +3,10 @@
  *
  * ## 它治的病(同一件事、四张词表、一词多义)
  * 一张卡没被人答就结束了,今天有四个读面各说各话:审计 settle 行(`expired` 一词盖 TTL 到期 / run 取消 / run 退出清理 / 广播全灭,批内兄弟被撤卡也是同一个词)、
- * 问账 VOID/DENIED 行(`denied_reason` 列)、晚答 404 的判别位、决断口 409 的码(多种成因借 `approval_binding_mismatch` 一个名)。壳读账写不出「已取消」,
+ * 问账 VOID/DENIED 行(成因列)、晚答 404 的判别位、决断口 409 的码(多种成因借 `approval_binding_mismatch` 一个名)。壳读账写不出「已取消」,
  * 也分不出「重取坐标再决」与「改答案再决」。收成**一张表、一个词、各面同读**:
  *  · 审计 settle 行的 `cause`(非人结局必填,人答缺席;`settle(verdict)` 判别联合逼每个非人调用点点名一个)与活卡结局帧 `tool_approval_complete` 的 additive `cause`(同一个词,同一条律);
- *  · 问账 VOID/DENIED 行的 `denied_reason` 列 → 决断口 410 `gone.ask` 体的 `cause` 与晚答 404 体的 `cause`(读同一列,经唯一读口 {@link causeOfAskRow});
+ *  · 问账 VOID/DENIED 行的 `ending_cause` 列 → 决断口 410 `gone.ask` 体的 `cause` 与晚答 404 体的 `cause`(读同一列,经唯一读口 {@link askRowEndingCause});
  *  · `GET /v1/approvals` `crashConverged[].cause`(本表的 {@link HolderGoneCause} 两词子集);
  *  · 决断口 409 的码:`binding_changed` / `answer_invalid` / `outcome_cell_invalid` 三词各归一个码。`retriable` 不由成因说 —— 三词都出自 core 的
  *    `checkpoint.invalid_outcome`,由 `http/resume-legs.ts` 的 core 码 → 处置一张表派生(一个意思:卡仍 pending、行重新 park)。
@@ -16,8 +16,9 @@
  *  · 成因**只从事实读**:run 行 `errorCode:"cancelled"`、钟到、emit 零接收、停车行 / 问账行的列、`detail.field`;不读拒句散文。
  *  · 「停驻行的格式比本引擎新」**不是**本表的词:它只有 core 一个来源(`checkpoint.unsupported_version` + `detail.reason:"version_newer"`,原码镜像);服务层不从续跑上下文的写者版本推断成因。
  *  · **人答的结局(`allowed` / `denied`)没有 cause**:`cause` 在场 ⇔ 非人结局。
- *  · 落列面:问账行的成因写进 `approval_ask.denied_reason`(VARCHAR(64)),一列按 `state` 承载两种意思 —— VOID / DENIED 行上是**终态成因**,PARKING / PARKED 行上是
- *    **转 park 的触发成因**;读它只经 {@link causeOfAskRow}(按 state 穷举分派,两张读词表只被它读)。列名将在下一个 DDL 窗按意义改名。
+ *  · 落列面:问账行的成因落**两列,一列一义**(各 VARCHAR(64)):`approval_ask.ending_cause` = **终态成因**(这一行为什么没被人答就结束了;到 `VOID` / `DENIED` 的转移带着它写),
+ *    `approval_ask.park_trigger` = **转 park 的触发成因**(这一行为什么被转进投递面;只由那一次 `claimTerminal(expire, { cause })` 写,此后不再被写 —— 终态不覆盖它)。
+ *    两只读口各读一列:{@link askRowEndingCause} / {@link askRowParkTrigger}(两张读词表各只被一只读)。
  *
  * ## 为什么 `routing_failure_fail_closed` 也在表里(归因诚实性)
  * 审计面唯一能证明「超时永不产生 denial」的东西是**终态 + 成因**的组合:人拒恒为 `DECIDED(decision=deny)`,路由失败恒为 `DENIED(routing_failure_fail_closed)`,
@@ -71,11 +72,15 @@ export declare const APPROVAL_ENDING_CAUSES: {
      */
     readonly ROUTING_FAILURE: "routing_failure_fail_closed";
     /**
-     * 启动收敛(`approval-crash-convergence.ts`,local 车道):**承载这一问的进程没了** —— 前世进程崩溃 / 被杀,留下的 `STREAM_PENDING` 行在下一次启动、任何卡能开始之前收成 VOID。
-     * 证据是数据根 `LOCK`(前世写者全死),不是「等够久了」。值与 `GET /v1/approvals` `crashConverged[].cause` 是**同一个词**。
+     * 启动收敛(`approval-crash-convergence.ts`,local 车道):**承载这一问的进程没了** —— 前世进程崩溃 / 被杀,留下的 `STREAM_PENDING` 行与审计判为孤儿的 `PARKING` 行
+     * (停车行没提交)在下一次启动、任何卡能开始之前收成 VOID。证据是数据根 `LOCK`(前世写者全死)+ 审计账的孤儿判定,不是「等够久了」。
+     * 值与 `GET /v1/approvals` `crashConverged[].cause` 是**同一个词**(一处判:审计店的 `holderGoneVerdict`)。
      */
     readonly CRASHED_BEFORE_PARK: "crashed_before_park";
-    /** 同上,但承载它的腿是被**有序关停**截断的(审计账本上有本腿的关停记号;关停收尾没能在宽限窗内把这张卡结清),或有序关停期间这张卡被改路停驻(settle 行的成因)。 */
+    /**
+     * 同上,但前世走完了**有序关停**的审批收尾(审计账本上那一世的进程级关停记录落在这张卡的末事件之后 —— 收尾没能在宽限窗内把它结清;是进程的事实,
+     * 不看承载它的腿在不在追踪视野里),或有序关停期间这张卡被改路停驻(settle 行 / 问账行 PARKING 的触发成因)。
+     */
     readonly SHUTDOWN_BEFORE_PARK: "shutdown_before_park";
     /** 判据 5:任何在 `STREAM_APPROVAL_ORPHAN_TTL_MS` 内仍未收敛的 `PARKING` 行(量 immutable 的 `createdAtMs`,§9 C5)—— 遗孤最终可判的最后兜底,带一条 warn。 */
     readonly ORPHAN_TTL_EXCEEDED: "orphan_ttl_exceeded";
@@ -117,7 +122,7 @@ export declare const SETTLE_CAUSE_WORDS: {
 };
 /** 一个值是不是非人结局的成因词(审计账读盘用这一只判词)。 */
 export declare function isSettleCause(v: unknown): v is SettleCause;
-/** 「承载这一问的进程没了」的两个成因词(启动收敛写进问账行 `denied_reason`,审计收敛行 `cause` 读同一型)。 */
+/** 「承载这一问的进程没了」的两个成因词(启动收敛写进问账行 `ending_cause`(前世的 `STREAM_PENDING` 与审计判孤儿的 `PARKING`),审计收敛行 `cause` 读同一型)。 */
 export type HolderGoneCause = typeof APPROVAL_ENDING_CAUSES.CRASHED_BEFORE_PARK | typeof APPROVAL_ENDING_CAUSES.SHUTDOWN_BEFORE_PARK;
 /** 对账器 `DENIED` 终态的成因(单员:全仓 DENIED 只有一个写点)。 */
 export type ReconcileDenyCause = typeof APPROVAL_ENDING_CAUSES.ROUTING_FAILURE;
@@ -128,7 +133,7 @@ export type ReconcileVoidCause = typeof APPROVAL_ENDING_CAUSES.RUN_CANCELLED | t
  * (取消赢下 VOID ⇒ `run_cancelled` / `run_exited`,兄弟被撤卡 ⇒ `batch_sibling_withdrawn`)。窗到期 / 广播全灭 / 决断类的词只落审计 settle 行或 409 码,不落这一列。
  */
 export type AskRowEndingCause = ReconcileDenyCause | ReconcileVoidCause | HolderGoneCause | typeof APPROVAL_ENDING_CAUSES.RUN_EXITED | typeof APPROVAL_ENDING_CAUSES.BATCH_SIBLING_WITHDRAWN;
-/** 问账行 `denied_reason` 列在 VOID / DENIED 行上的读词表({@link AskRowEndingCause} 的穷举,`satisfies` ⇒ 子集加词而本表没跟 = 编译红)。唯一读者 = {@link causeOfAskRow}。 */
+/** 问账行 `ending_cause` 列的读词表({@link AskRowEndingCause} 的穷举,`satisfies` ⇒ 子集加词而本表没跟 = 编译红)。唯一读者 = {@link askRowEndingCause}。 */
 export declare const ASK_ROW_ENDING_CAUSE_WORDS: {
     readonly routing_failure_fail_closed: true;
     readonly run_cancelled: true;
@@ -142,12 +147,12 @@ export declare const ASK_ROW_ENDING_CAUSE_WORDS: {
     readonly shutdown_before_park: true;
 };
 /**
- * `expire` 终局 claim(窗到期 / 广播全灭 / 有序关停把一张卡转投递面 = `PARKING`)赢下时写进这一行 `denied_reason` 的**触发成因**:这一行此后若走到 `DENIED` / `VOID`,终态成因会覆盖它
- * ({@link AskRowEndingCause});`PARKED` 行的这一格就是「它为什么被转 park」。跨副本的读者(另一进程的悬挂腿轮询、CAS 败方读数)读到 `PARKING` / `PARKED` 时靠它归因,
- * 不替没写的行猜一个词。
+ * `expire` 终局 claim(窗到期 / 广播全灭 / 断连 / 呈不出 / 有序关停把一张卡转投递面 = `PARKING`)赢下时写进这一行 `park_trigger` 的**触发成因**:此后不再被写 ——
+ * 这一行走到 `PARKED` / `DENIED` / `VOID` 之后它仍是「这一行为什么被转 park」(终态成因在另一列,{@link AskRowEndingCause})。跨副本的读者(另一进程的悬挂腿轮询、
+ * CAS 败方读数)读到 `PARKING` / `PARKED` 时靠它归因,不替没写的行猜一个词。
  */
 export type ParkTriggerCause = typeof APPROVAL_ENDING_CAUSES.TTL_EXPIRED | typeof APPROVAL_ENDING_CAUSES.BROADCAST_LOST | typeof APPROVAL_ENDING_CAUSES.STREAM_DISCONNECTED | typeof APPROVAL_ENDING_CAUSES.UNDELIVERABLE | typeof APPROVAL_ENDING_CAUSES.SHUTDOWN_BEFORE_PARK;
-/** 问账行 `denied_reason` 在 `PARKING` / `PARKED` 行上的读词表({@link ParkTriggerCause} 的穷举)。唯一读者 = {@link causeOfAskRow}。 */
+/** 问账行 `park_trigger` 列的读词表({@link ParkTriggerCause} 的穷举)。唯一读者 = {@link askRowParkTrigger}。 */
 export declare const PARK_TRIGGER_CAUSE_WORDS: {
     readonly ttl_expired: true;
     readonly broadcast_lost: true;
@@ -155,25 +160,24 @@ export declare const PARK_TRIGGER_CAUSE_WORDS: {
     readonly undeliverable: true;
     readonly shutdown_before_park: true;
 };
-/** 问账行成因的读数:`kind` 说这一个词在这一行上是哪种意思(终态成因 / 转 park 的触发成因)。 */
-export type AskRowCause = {
-    readonly kind: "ending";
-    readonly cause: AskRowEndingCause;
-} | {
-    readonly kind: "park_trigger";
-    readonly cause: ParkTriggerCause;
-};
 /**
- * 🔴 **问账行成因的唯一读口**:`denied_reason` 一列按 `state` 承载两种意思,本函数按 `state` 穷举分派(加状态 ⇒ 这里编译红),读者不自己先判 state 再查表:
- *  · `VOID` / `DENIED` ⇒ 终态成因({@link AskRowEndingCause};决断口 410、晚答 404、CAS 败方读数、悬挂腿的轮询读这一种);
- *  · `PARKING` / `PARKED` ⇒ 转 park 的触发成因({@link ParkTriggerCause};跨副本的悬挂腿与 CAS 败方读这一种);
- *  · `DECIDED` / `STREAM_PENDING` / `absent`(败方读数的「行不在」)⇒ 无成因。
- * 列值 `null` / 键缺席(没写归因的存量行)或与 state 不配的词(手改 / 将来版本写的词)⇒ `undefined`(读面缺席即缺席,不替没写的行编一个成因)。返回纯数据。
+ * 🔴 **终态成因的唯一读口**(决断口 410、晚答 404、`GET` 读面、CAS 败方读数、悬挂腿的轮询读这一只):只读 `ending_cause` 一列,不看别的列。
+ * 行不变式由本口守:终态成因只在 `VOID` / `DENIED` 上作数(写者只在到这两态的转移上写它;别的态上读到 ⇒ 不是这一行的事实)—— 按 `state` 穷举(加状态 ⇒ 这里编译红)。
+ * 列值 `null` / 键缺席(没写归因的行)、词表外的词(手改 / 将来版本写的词)或与 state 不配 ⇒ `undefined`(读面缺席即缺席,不替没写的行编一个成因)。返回纯数据。
+ */
+export declare function askRowEndingCause(row: {
+    readonly state: AskState;
+    readonly endingCause?: string | null;
+}): AskRowEndingCause | undefined;
+/**
+ * 🔴 **转 park 触发成因的唯一读口**(跨副本的悬挂腿、CAS 败方读数读这一只):只读 `park_trigger` 一列,不看别的列。
+ * 行不变式由本口守:触发成因只在**走过 `PARKING`** 的行上作数 —— `PARKING` / `PARKED`,以及从 `PARKING` 收成的 `DENIED` / `VOID`(终态不覆盖它);
+ * `STREAM_PENDING` / `DECIDED`(状态机上没有经 `PARKING` 到它们的边)上读到 ⇒ `undefined`。其余与 {@link askRowEndingCause} 同律。
  */
-export declare function causeOfAskRow(row: {
-    readonly state: AskState | "absent";
-    readonly deniedReason?: string | null;
-}): AskRowCause | undefined;
+export declare function askRowParkTrigger(row: {
+    readonly state: AskState;
+    readonly parkTrigger?: string | null;
+}): ParkTriggerCause | undefined;
 /** 非人**结局**的成因(审计 settle 行 `cause`、活卡结局帧 `tool_approval_complete.cause`):闭集去掉决断口 409 的三个词({@link DecisionRefusalCause})—— 那三个词不结束一张卡,只拒一次决议。 */
 export type SettleCause = Exclude<ApprovalEndingCause, DecisionRefusalCause>;
 /** 决断口 409 的成因子集(core 的 `detail.field` → 码;每词一个码,见 `http/resume-legs.ts`)。 */

package/dist/approval-deny-reasons.js

@@ -63,22 +63,37 @@ export const PARK_TRIGGER_CAUSE_WORDS = {
 function isParkTriggerCause(v) {
     return Object.hasOwn(PARK_TRIGGER_CAUSE_WORDS, v);
 }
-export function causeOfAskRow(row) {
-    const stored = row.deniedReason;
+export function askRowEndingCause(row) {
+    const stored = row.endingCause;
     switch (row.state) {
         case "VOID":
         case "DENIED":
-            return stored !== null && stored !== undefined && isAskRowEndingCause(stored) ? { kind: "ending", cause: stored } : undefined;
+            return stored !== null && stored !== undefined && isAskRowEndingCause(stored) ? stored : undefined;
         case "PARKING":
         case "PARKED":
-            return stored !== null && stored !== undefined && isParkTriggerCause(stored) ? { kind: "park_trigger", cause: stored } : undefined;
         case "DECIDED":
         case "STREAM_PENDING":
-        case "absent":
             return undefined;
         default: {
             const unhandled = row.state;
-            throw new Error(`causeOfAskRow: unhandled ask row state ${String(unhandled)}`);
+            throw new Error(`askRowEndingCause: unhandled ask row state ${String(unhandled)}`);
+        }
+    }
+}
+export function askRowParkTrigger(row) {
+    const stored = row.parkTrigger;
+    switch (row.state) {
+        case "PARKING":
+        case "PARKED":
+        case "DENIED":
+        case "VOID":
+            return stored !== null && stored !== undefined && isParkTriggerCause(stored) ? stored : undefined;
+        case "DECIDED":
+        case "STREAM_PENDING":
+            return undefined;
+        default: {
+            const unhandled = row.state;
+            throw new Error(`askRowParkTrigger: unhandled ask row state ${String(unhandled)}`);
         }
     }
 }

package/dist/approval-policy-settlement.d.ts

@@ -29,6 +29,6 @@ import type { ParkTriggerCause } from "./approval-deny-reasons.js";
  * `batchId` 必须是**行上**的批(幂等命中的存量行可能是别的政策 / 旧版本铸的整腿批,错 scope 的 claim 如实 `absent`)。
  */
 export declare function settleByPolicy(store: Pick<ApprovalAskStore, "claimTerminal">, row: Pick<AskRow, "askId" | "batchId">, policy: UnattendedApprovalPolicy, 
-/** 转 park 的触发成因(窗到期 / 广播全灭 / 有序关停):`park` 政策的 `expire` 赢下 PARKING 时随同一步写进行(`denied_reason`),跨副本的读者据它归因;`deny` 政策落的是一条决议,不带。 */
+/** 转 park 的触发成因(窗到期 / 广播全灭 / 有序关停):`park` 政策的 `expire` 赢下 PARKING 时随同一步写进行(`park_trigger`),跨副本的读者据它归因;`deny` 政策落的是一条决议,不带。 */
 cause: ParkTriggerCause): Promise<AskTerminalClaimOutcome>;
 //# sourceMappingURL=approval-policy-settlement.d.ts.map

package/dist/approval-reconciler.d.ts

@@ -123,6 +123,17 @@ export declare function classifyGateMatch(ask: AskRow, candidates: readonly Chec
 export declare function selectGateCandidate(ask: AskRow, candidates: readonly CheckpointAskCandidate[]): CheckpointAskCandidate | undefined;
 /** 判据表 v2 的判定(纯函数;顺序 = 设计稿 §9 尾的五臂汇总,注见文件头)。 */
 export declare function decideReconcileAction(input: ReconcileInput): ReconcileAction;
+/** 判据 1 执行体({@link bindParkingAskAtGate})一次尝试的结果。没绑上 ⇒ 交回批的真实态,周期扫据它续判 ②③④⑤。 */
+export type GateBindAttempt = {
+    bound: true;
+    match: GateMatchOutcome;
+} | {
+    bound: false;
+    match?: GateMatchOutcome;
+    batchState: BatchState | "MISSING" | null;
+    batchBoundAskId: string | null;
+    irreversibleBatch: boolean;
+};
 /** 收敛器一次 tick 的产出(可观测 + 测试断言面)。 */
 export interface ReconcileStats {
     /** 段一扫到的 `PARKING` 行数。 */
@@ -202,7 +213,7 @@ export type ApprovalRevokeEmitter = (frame: ApprovalRevokeFrame, target: {
     sessionId: string;
     taskId: string;
 }) => void;
-/** 判据 1 的读口(窄接口,不绑具体 checkpoint 店实现——local 车道的店没有这个面,装配点传 undefined)。 */
+/** 判据 1 的读口(窄接口,不绑具体 checkpoint 店实现;三个后端的 checkpoint 店都有这一面,后端的只读口 `checkpointReadView()` 也交它 —— 起服收敛读那一口)。 */
 export interface ReconcileCheckpointPort {
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;
 }
@@ -245,5 +256,26 @@ export interface ApprovalReconciler {
      *  段级错误由调用方(reaper 腿的 throttled catch)兜。 */
     runOnce(nowMs: number): Promise<ReconcileStats>;
 }
+/**
+ * {@link bindParkingAskAtGate} 的依赖(三个调用方交同一形):批 / 绑两口、判据 1 的候选读口、warn 与撤卡两个出口。
+ */
+export interface GateBindDeps {
+    readonly askStore: Pick<ApprovalAskStore, "getBatch" | "bindBatch">;
+    /** 缺席 ⇒ 候选集恒空 ⇒ 判据 1 恒不命中(诚实降级,与 {@link ApprovalReconcilerDeps.checkpoints} 同一句)。 */
+    readonly checkpoints: ReconcileCheckpointPort | undefined;
+    /** warn 的出口(调用方保证它不抛 —— 可观测面绝不成为故障源)。 */
+    readonly warn: (event: string, fields: Record<string, unknown>) => void;
+    /** 被 `bindBatch` 连坐的兄弟的撤卡帧(帧是通知,真源是行;失败不回滚 CAS)。 */
+    readonly revoke: (row: AskRow, askIds: readonly string[], reason: ApprovalRevokeFrame["reason"], nowMs: number) => void;
+}
+/**
+ * 🔴 **判据 1 的唯一执行体**([ref] 起一只判官;[ref] 起三个调用方):⓪ 批态先读 → 候选读口 → {@link classifyGateMatch} → 命中即 `bindBatch`
+ * (+ 被连坐兄弟的撤卡帧)。调用方:
+ *  · 周期扫(`createApprovalReconciler` 的 `reconcileOne`)—— 不命中 / 绑失败时拿回批的真实态,续判 ②③④⑤;
+ *  · park 提交那一拍(`bindCommittedPark`)—— 只问「这一行此刻能不能收口」,不命中即止(其余臂是周期扫的事);
+ *  · local 车道起服收敛(`approval-crash-convergence.ts`)—— 审计判为孤儿的前世 `PARKING` 行:命中 ⇒ `PARKED`;不命中 ⇒ 调用方收 `VOID`。
+ * 判据、读口、写口一个字都不分叉:事件路径与起服都是本函数的即时调用,不是第二份判据。
+ */
+export declare function bindParkingAskAtGate(deps: GateBindDeps, ask: AskRow, nowMs: number, deadlineMs?: number): Promise<GateBindAttempt>;
 export declare function createApprovalReconciler(deps: ApprovalReconcilerDeps): ApprovalReconciler;
 //# sourceMappingURL=approval-reconciler.d.ts.map

package/dist/approval-reconciler.js

@@ -79,6 +79,45 @@ export function decideReconcileAction(input) {
     void candidates;
     return { kind: "hold" };
 }
+export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
+    const { askStore, checkpoints, warn, revoke } = deps;
+    const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
+    const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
+    let batchState = batchRow?.state ?? "MISSING";
+    let batchBoundAskId = batchRow?.boundAskId ?? null;
+    const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
+    let gateMatch;
+    if (checkpoints && !irreversibleBatch && !expired()) {
+        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
+        gateMatch = classifyGateMatch(ask, candidates);
+        if (gateMatch.kind === "hash_mismatch") {
+            warn("approval_reconcile_hash_mismatch", {
+                askId: ask.askId,
+                taskId: ask.taskId,
+                toolCallId: ask.toolCallId,
+                candidates: gateMatch.candidates,
+                reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
+                    "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
+                    "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
+            });
+        }
+        const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
+        if (match && !expired()) {
+            const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
+                gateToken: match.token,
+                gateBoundCallId: match.boundCallId,
+                gateBoundInputHash: match.boundInputHash,
+            }), "bindBatch");
+            if (res.ok) {
+                revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
+                return { bound: true, match: gateMatch };
+            }
+            batchState = res.batchState;
+            batchBoundAskId = res.boundAskId ?? null;
+        }
+    }
+    return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
+}
 export function createApprovalReconciler(deps) {
     const { askStore, checkpoints, runs, logger, metrics, batchLimit, pendingGraceMs, adhocGraceMs, orphanTtlMs, unattendedPolicy, emitRevoke } = deps;
     const warn = (event, fields) => {
@@ -98,44 +137,8 @@ export function createApprovalReconciler(deps) {
             warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
         }
     };
-    const bindAtGate = async (ask, nowMs, deadlineMs) => {
-        const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
-        const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
-        let batchState = batchRow?.state ?? "MISSING";
-        let batchBoundAskId = batchRow?.boundAskId ?? null;
-        const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
-        let gateMatch;
-        if (checkpoints && !irreversibleBatch && !expired()) {
-            const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
-            gateMatch = classifyGateMatch(ask, candidates);
-            if (gateMatch.kind === "hash_mismatch") {
-                warn("approval_reconcile_hash_mismatch", {
-                    askId: ask.askId,
-                    taskId: ask.taskId,
-                    toolCallId: ask.toolCallId,
-                    candidates: gateMatch.candidates,
-                    reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
-                        "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
-                        "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
-                });
-            }
-            const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
-            if (match && !expired()) {
-                const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
-                    gateToken: match.token,
-                    gateBoundCallId: match.boundCallId,
-                    gateBoundInputHash: match.boundInputHash,
-                }), "bindBatch");
-                if (res.ok) {
-                    revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
-                    return { bound: true, match: gateMatch };
-                }
-                batchState = res.batchState;
-                batchBoundAskId = res.boundAskId ?? null;
-            }
-        }
-        return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
-    };
+    const gate = { askStore, checkpoints, warn, revoke };
+    const bindAtGate = (ask, nowMs, deadlineMs) => bindParkingAskAtGate(gate, ask, nowMs, deadlineMs);
     const reconcileOne = async (ask, nowMs) => {
         const attempt = await bindAtGate(ask, nowMs);
         if (attempt.bound)
@@ -150,11 +153,11 @@ export function createApprovalReconciler(deps) {
                 return { outcome: "held", match: gateMatch };
             }
             case "deny": {
-                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
+                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { endingCause: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
                 return { outcome: won ? "denied" : "held", match: gateMatch };
             }
             case "void": {
-                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
+                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { endingCause: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
                 if (!won)
                     return { outcome: "held", match: gateMatch };
                 if (action.reason === APPROVAL_ENDING_CAUSES.ORPHAN_TTL_EXCEEDED) {

package/dist/auth-bridge.d.ts

@@ -1,4 +1,4 @@
-import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
+import { VerifiedIdentity, type AuthBridgeErrorCode } from "@sema-agent/settings-schema/api/auth-bridge";
 import { type TokenScopeRefusal } from "@sema-agent/settings-schema/api/scopes";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -52,12 +52,13 @@ type BridgeSinks = {
     readonly logger?: Logger | undefined;
     readonly metrics?: Pick<Metrics, "inc"> | undefined;
 };
-/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 是 `unknown` —— 这一位正是边界要判的形,它不信型面
- *  (席是嵌入方可换的:`""` 过得了 `scope: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
+/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 与 `principalInc` 是 `unknown` —— 这两位正是边界要判的形,它不信型面
+ *  (席是嵌入方可换的:`""` 过得了 `scope: string` / `principalInc?: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
 type ReportedOutcome = {
     ok: true;
-    identity: Omit<BridgeIdentity, "scope"> & {
+    identity: Omit<BridgeIdentity, "scope" | "principalInc"> & {
         scope?: unknown;
+        principalInc?: unknown;
     };
 } | {
     ok: false;
@@ -65,8 +66,10 @@ type ReportedOutcome = {
 };
 /**
  * 注入边界:任何验证器(内建 {@link createWebAdminJwtVerifier},或嵌入方注入的 `ServiceDeps.webAdminJwtVerifier`)交来的结局,在这里定「装不装身份」。
- * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次(入参型见 {@link ReportedOutcome})。
- * 读不出 ⇒ 同一只记账口、不交身份(调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
+ * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次;化身号经契约的**同一只**判官 `VerifiedIdentity.shape.principalInc`(= `PrincipalIncarnation.optional()`,
+ * 契约验证器读 `sub_inc` 用的就是它)再判一次(入参型见 {@link ReportedOutcome})。
+ * 读不出 scope ⇒ 记 `readTokenScope` 的拒词;化身号在场而不合形 ⇒ 记 `malformed`(与契约验证器同一条律:声明在场坏形 ⇒ 令牌 malformed)。两种都经同一只记账口、不交身份
+ * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
 /** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */

package/dist/auth-bridge.js

@@ -1,5 +1,5 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
-import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
+import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, VerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { centerJwksFetch } from "./web-admin-client/center-request.js";
@@ -17,12 +17,18 @@ function recordBridgeRefusal(sinks, error, at = {}) {
 export function admitBridgeIdentity(outcome, sinks) {
     if (!outcome.ok)
         return undefined;
-    const scoped = readTokenScope({ scope: outcome.identity.scope });
+    const { scope, principalInc, ...rest } = outcome.identity;
+    const scoped = readTokenScope({ scope });
     if ("refused" in scoped) {
         recordBridgeRefusal(sinks, scoped.refused);
         return undefined;
     }
-    return { ...outcome.identity, scope: scoped.scope };
+    const inc = VerifiedIdentity.shape.principalInc.safeParse(principalInc);
+    if (!inc.success) {
+        recordBridgeRefusal(sinks, "malformed");
+        return undefined;
+    }
+    return { ...rest, scope: scoped.scope, ...(inc.data !== undefined ? { principalInc: inc.data } : {}) };
 }
 export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 export const JWKS_FETCH_TIMEOUT_MS = 10_000;

package/dist/boot/adoption.js

@@ -1,4 +1,5 @@
 import { createAdoptionRunner } from "../adoption/runner.js";
+import { seatText } from "../trace/exit-seat.js";
 export async function runAdoptionBootScan(ctx) {
     const store = ctx.backend?.adoptionLog?.();
     if (!store)
@@ -29,7 +30,7 @@ export async function runAdoptionBootScan(ctx) {
         return reading;
     }
     catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
+        const error = seatText("operator-log-text", err instanceof Error ? err.message : String(err));
         ctx.logger.error?.("adoption_boot_scan_failed", { error });
         return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [], error };
     }

package/dist/boot/budget-tracing.d.ts

@@ -11,6 +11,22 @@ export interface BudgetTracingCtx {
     backend: StoreBackend | undefined;
     breakerState: ReturnType<BreakerStateStore["startRefresh"]> | undefined;
 }
+/**
+ * S9 (SILENT-FALLBACK P0-e): write-behind flush/refresh failures previously vanished in a bare catch —
+ * the fleet silently degrades to per-replica counting (soft limits stop being fleet-wide). Every failure
+ * ticks the counter + streak gauge; warn once per episode (streak hits 3), info on the recovery edge.
+ * `info.error` is the client exception's text (the counter turns the rejection into it) ⇒ the warn's field passes the exit seat.
+ */
+export declare function createCounterDegradeHook({ logger, metrics }: {
+    logger: Pick<Logger, "warn" | "info">;
+    metrics: Pick<Metrics, "setGauge" | "inc">;
+}): (info: {
+    table: string;
+    kind: string;
+    streak: number;
+    prevStreak: number;
+    error?: string;
+}) => void;
 export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     brain: import("@sema-agent/core").Brain;
     degradeRouteWatch: import("../brain.js").DegradeRouteWatch;