@sema-agent/server 7.147.0 → 7.149.0

package/dist/adoption/runner.d.ts

@@ -1,5 +1,6 @@
 import { type AdoptionLogStore } from "../plugins/adoption-log-sql.js";
 import type { SqlDialect } from "../plugins/sql-driver.js";
+import { type AdoptionWiring } from "./plan.js";
 import { type AdoptionReceipt, type AdoptionRejectCode } from "./wire.js";
 /** 冲突表族的逐项读数(进 409 响应体;运维据此知道**该去清理哪张表**,不是一句「冲突了」)。 */
 export interface AdoptionConflict {
@@ -9,7 +10,9 @@ export interface AdoptionConflict {
     /** 目的地侧与源侧共享同一逻辑键的行对数(>0 即冲突)。 */
     overlapping: number;
 }
-/** 收编弧的三种结局。**回执与拒绝分家**:拒从不产出 200 回执(183 §7.3 拒绝可判别)。 */
+/** 收编弧的四种结局。**回执与拒绝分家**:拒从不产出 200 回执(183 §7.3 拒绝可判别)。
+ *  `tables_missing` 与 `rejected` 的分家:前者是**部署**事实(接线了的可选面在库上缺表),弧**不**落终态 —— 行停在 INTENT、零 UPDATE,补好表之后重发同一请求即续;
+ *  后者是**数据**事实(目的地冲突 / 装不下),落永久终态。 */
 export type AdoptionOutcome = {
     kind: "receipt";
     adoptionId: string;
@@ -25,12 +28,18 @@ export type AdoptionOutcome = {
     adoptionId: string;
     fromPrincipal: string;
     boundTo: string;
+} | {
+    kind: "tables_missing";
+    adoptionId: string;
+    tables: string[];
 };
 export interface AdoptionRunnerDeps {
     store: AdoptionLogStore;
     dialect: SqlDialect;
     /** 注入时钟(测试要确定性;生产传 `Date.now`)。 */
     now: () => number;
+    /** boot 的店接线事实(**必填、无默认值**:忘传 = 编译红)。只用来判「可选表面缺表是不是意外」,见 {@link AdoptionWiring}。 */
+    wiring: AdoptionWiring;
     /** 锁轮询次数/间隔——测试把它调到 1 次好确定性地打到「取不到锁」那条臂。 */
     lockAttempts?: number;
     lockSleepMs?: number;

package/dist/adoption/runner.js

@@ -3,7 +3,8 @@ import { ADOPTION_PHASE, adoptionLockName, } from "../plugins/adoption-log-sql.j
 import { policyKeyFor } from "../stores-sql/session-policy-store-sql.js";
 import { buildRuleOwnerKey } from "../plugins/permission-rule-store-sql.js";
 import { withAdoptionQuiesce } from "./quiesce.js";
-import { AFFECTED_CONFIG_TEMPLATES, MEMORY_PROJECT_SCOPE_PREFIXES, MEMORY_SCOPE_MAX_CHARS, NOT_MIGRATED_BY_DESIGN, REBIND_LEGS, buildVerbatimPair, rewriteMemoryScope, } from "./plan.js";
+import { readLiveColumns } from "../plugins/schema-live-columns.js";
+import { AFFECTED_CONFIG_TEMPLATES, MEMORY_PROJECT_SCOPE_PREFIXES, MEMORY_SCOPE_MAX_CHARS, NOT_MIGRATED_BY_DESIGN, REBIND_LEGS, buildVerbatimPair, planeExpected, rewriteMemoryScope, } from "./plan.js";
 import { buildBlobScanSql, buildBlobWriteSql, buildConflictProbeSql, buildMemoryScopeScanSql, buildResidualCountSql, buildRebindSql, buildRuleOwnerRekeySql, buildSessionPolicyRewriteSql, buildSessionPolicyScanSql, } from "./sql.js";
 import { AdoptionConfigsSchema, AdoptionLegsSchema, AdoptionReceiptSchema, AdoptionRejectDetailSchema, AdoptionReportSchema, } from "./wire.js";
 import { formatUserScope, encodeScopeSegment } from "@sema-agent/core";
@@ -36,11 +37,17 @@ async function resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal)
     return pairs;
 }
 export function createAdoptionRunner(deps) {
-    const { store, dialect, now } = deps;
-    async function unrepresentableScopes(exec, fromPrincipal, toPrincipal) {
+    const { store, dialect, now, wiring } = deps;
+    async function planLegs(exec) {
+        const live = await readLiveColumns(async (sql) => (await exec.query(sql)).rows, dialect);
+        const legs = REBIND_LEGS.filter((leg) => leg.plane === "core" || live.has(leg.table));
+        const missing = [...new Set(REBIND_LEGS.filter((leg) => leg.plane !== "core" && !live.has(leg.table) && planeExpected(leg.plane, wiring)).map((leg) => leg.table))];
+        return { legs, missing };
+    }
+    async function unrepresentableScopes(exec, legs, fromPrincipal, toPrincipal) {
         const bad = [];
         const seen = new Set();
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             if (leg.encoding !== "memory-scope")
                 continue;
             for (const pair of await resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal)) {
@@ -52,9 +59,9 @@ export function createAdoptionRunner(deps) {
         }
         return bad;
     }
-    async function preflight(exec, fromPrincipal, toPrincipal) {
+    async function preflight(exec, legs, fromPrincipal, toPrincipal) {
         const hits = [];
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             if (leg.residualKey === undefined)
                 continue;
             const pairs = await resolveValuePairs(exec, dialect, leg, fromPrincipal, toPrincipal);
@@ -109,9 +116,9 @@ export function createAdoptionRunner(deps) {
         }
         return rows;
     }
-    async function runLegs(exec, fromPrincipal, toPrincipal) {
+    async function runLegs(exec, legs, fromPrincipal, toPrincipal) {
         const out = [];
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             if (leg.kind === "blob-rewrite") {
                 out.push({ store: leg.leg, action: leg.action, rows: await runBlobLeg(exec, leg, fromPrincipal, toPrincipal) });
                 continue;
@@ -163,9 +170,9 @@ export function createAdoptionRunner(deps) {
     function parseConfigs(row) {
         return AdoptionConfigsSchema.parse(JSON.parse(row.configsJson));
     }
-    async function countResidual(exec, fromPrincipal, toPrincipal) {
+    async function countResidual(exec, legs, fromPrincipal, toPrincipal) {
         const byTable = new Map();
-        for (const leg of REBIND_LEGS) {
+        for (const leg of legs) {
             const slot = byTable.get(leg.table) ?? { match: new Set() };
             if (leg.kind === "blob-rewrite")
                 slot.blob = leg;
@@ -177,7 +184,7 @@ export function createAdoptionRunner(deps) {
             byTable.set(leg.table, slot);
         }
         for (const [table, slot] of byTable) {
-            const encodings = new Set(REBIND_LEGS.filter((l) => l.table === table && l.kind !== "blob-rewrite").map((l) => l.encoding));
+            const encodings = new Set(legs.filter((l) => l.table === table && l.kind !== "blob-rewrite").map((l) => l.encoding));
             if (encodings.size > 1) {
                 throw new Error(`adoption: table ${table} carries identity axes in more than one encoding (${[...encodings].sort().join(", ")}) — the residual count binds ONE value pair across the OR'd columns, so it would silently under-report. Split the count per encoding before adding such a leg.`);
             }
@@ -255,7 +262,10 @@ export function createAdoptionRunner(deps) {
         if (row.state === "rejected")
             return rejectedOutcome(row);
         if (row.state === "in_flight" && row.phase === ADOPTION_PHASE.INTENT) {
-            const unrepresentable = await unrepresentableScopes(conn, row.fromPrincipal, row.toPrincipal);
+            const plan = await planLegs(conn);
+            if (plan.missing.length > 0)
+                return { kind: "tables_missing", adoptionId: row.adoptionId, tables: [...plan.missing] };
+            const unrepresentable = await unrepresentableScopes(conn, plan.legs, row.fromPrincipal, row.toPrincipal);
             if (unrepresentable.length > 0) {
                 const detail = JSON.stringify({
                     detail: `the destination principal cannot be represented in every derived key: ${unrepresentable.join("; ")}`,
@@ -264,14 +274,14 @@ export function createAdoptionRunner(deps) {
                 await store.finalizeRejected(row.adoptionId, "adoption.destination_unrepresentable", detail, now(), conn);
                 return rejectedOutcome(await reread());
             }
-            const conflicts = await preflight(conn, row.fromPrincipal, row.toPrincipal);
+            const conflicts = await preflight(conn, plan.legs, row.fromPrincipal, row.toPrincipal);
             if (conflicts.length > 0) {
                 const detail = JSON.stringify({ detail: "destination already holds rows sharing a logical key with the source", conflicts });
                 await store.finalizeRejected(row.adoptionId, "adoption.destination_conflict", detail, now(), conn);
                 return rejectedOutcome(await reread());
             }
             try {
-                await store.rebindOn(conn, row.adoptionId, ADOPTION_PHASE.INTENT, ADOPTION_PHASE.REBOUND, now(), (exec) => runLegs(exec, row.fromPrincipal, row.toPrincipal), (legs) => JSON.stringify(legs));
+                await store.rebindOn(conn, row.adoptionId, ADOPTION_PHASE.INTENT, ADOPTION_PHASE.REBOUND, now(), (exec) => runLegs(exec, plan.legs, row.fromPrincipal, row.toPrincipal), (legs) => JSON.stringify(legs));
             }
             catch (err) {
                 if (!isDupKey(dialect, err))
@@ -315,7 +325,8 @@ export function createAdoptionRunner(deps) {
     }
     async function sweepLate(row, conn) {
         try {
-            const legs = await store.sweepOn(conn, (exec) => runLegs(exec, row.fromPrincipal, row.toPrincipal));
+            const { legs: present } = await planLegs(conn);
+            const legs = await store.sweepOn(conn, (exec) => runLegs(exec, present, row.fromPrincipal, row.toPrincipal));
             const moved = legs.reduce((n, l) => n + (l.rows ?? 0), 0);
             if (moved > 0) {
                 deps.logger?.warn?.("adoption_late_rows_swept", {
@@ -332,7 +343,8 @@ export function createAdoptionRunner(deps) {
     }
     async function residualOf(row, exec = store.reader) {
         try {
-            return await countResidual(exec, row.fromPrincipal, row.toPrincipal);
+            const { legs } = await planLegs(exec);
+            return await countResidual(exec, legs, row.fromPrincipal, row.toPrincipal);
         }
         catch (err) {
             deps.logger?.warn?.("adoption_residual_count_failed", { adoptionId: row.adoptionId, error: msgOf(err) });
@@ -403,6 +415,14 @@ export function createAdoptionRunner(deps) {
                         stalled.push(out.adoptionId);
                         deps.logger?.warn?.("adoption_resume_unexpected_outcome", { adoptionId: out.adoptionId, kind: out.kind });
                         break;
+                    case "tables_missing":
+                        stalled.push(out.adoptionId);
+                        deps.logger?.warn?.("adoption_resume_tables_missing", {
+                            adoptionId: out.adoptionId,
+                            tables: out.tables,
+                            note: "this deployment wires an optional store whose table is absent from the database — restart a replica (its boot creates missing tables) and the arc continues",
+                        });
+                        break;
                     case "receipt":
                         if (out.receipt.status === "adopted")
                             resumed.push(out.adoptionId);

package/dist/approval-card.d.ts

@@ -83,9 +83,9 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"single">;
     rule: z.ZodString;
     match: z.ZodEnum<{
-        host: "host";
         name: "name";
         path: "path";
+        host: "host";
         tool: "tool";
         pattern: "pattern";
         exact: "exact";
@@ -102,9 +102,9 @@ export declare const RuleOfferSchema: z.ZodUnion<readonly [z.ZodObject<{
         kind: z.ZodLiteral<"command">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            host: "host";
             name: "name";
             path: "path";
+            host: "host";
             tool: "tool";
             pattern: "pattern";
             exact: "exact";
@@ -379,7 +379,7 @@ type ToolApprovalPark = Extract<CorePendingAction, {
  *    (成员表取 core 常量;core 的 `resumeStartupCauseOf` 从失败的**码**读出)。读者:`parked-decide.ts` 的 422 `parked_resume.startup_failed` 体(`cause`)。
  *    回执没说 ⇒ 缺席(不计数,「分不出」是一等状态);集外词 / 非串 ⇒ 按缺席(键不上 wire)+ 计一次,与卡上的闭集词同一只计数。
  *  · `differs`(core 7.44.0 [ref])—— **载体是引擎拒 steer 重放那只错的 `detail`**(不是 ask 的三个载体之一),值是 core `STEER_REPLAY_FACETS` 的**非空子集**
- *    (core:「恒非空」;筛 = 本文件 {@link isSteerReplayDiffers},成员表取 core 常量)。读者:`runs.ts` 的 409 `steering.duplicate_input_id` 体(`detail.differs`)。
+ *    (core:「恒非空」;筛 = 本文件 {@link isSteerReplayDiffers},成员表取 core 常量)。读者:`runs.ts` 的 409 `steering.duplicate_input_id` 体(根上的 `differs`)。
  *    集外成员 / 空数组 / 非数组 ⇒ 按缺席(不铸 `detail`,码仍是契约)+ 计一次;detail 只报形名(`differs=<array>` —— 数组从不展开成员,见 {@link outOfSetDetail})。
  *
  * 什么时候经本函数 —— 一句话:**筛点在 core;server 只在「读的是持久层原字节、中间没有 core 投影」的地方亲手调 core 的那一只筛**。
@@ -574,15 +574,15 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
     rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
     approvalCard: z.ZodOptional<z.ZodEnum<{
-        shell: "shell";
-        plan: "plan";
-        skill: "skill";
         question: "question";
+        fetch: "fetch";
         "file-edit": "file-edit";
         "file-write": "file-write";
         "notebook-edit": "notebook-edit";
-        fetch: "fetch";
+        shell: "shell";
+        skill: "skill";
         workflow: "workflow";
+        plan: "plan";
         generic: "generic";
         "computer-access": "computer-access";
         "computer-control": "computer-control";
@@ -590,10 +590,10 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
         member: z.ZodEnum<{
-            hook: "hook";
-            skill: "skill";
-            deployment: "deployment";
             request: "request";
+            deployment: "deployment";
+            skill: "skill";
+            hook: "hook";
             persisted: "persisted";
         }>;
         entries: z.ZodArray<z.ZodString>;
@@ -603,9 +603,9 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         kind: z.ZodLiteral<"single">;
         rule: z.ZodString;
         match: z.ZodEnum<{
-            host: "host";
             name: "name";
             path: "path";
+            host: "host";
             tool: "tool";
             pattern: "pattern";
             exact: "exact";
@@ -622,9 +622,9 @@ export declare const ApprovalCardSchema: z.ZodObject<{
             kind: z.ZodLiteral<"command">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                host: "host";
                 name: "name";
                 path: "path";
+                host: "host";
                 tool: "tool";
                 pattern: "pattern";
                 exact: "exact";
@@ -692,8 +692,8 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
     }, z.core.$strict>>;
-    askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+    askClass: z.ZodOptional<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+    classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
     fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
     sourceSessionId: z.ZodOptional<z.ZodString>;
     agentId: z.ZodOptional<z.ZodString>;
@@ -708,7 +708,7 @@ export declare const ApprovalCardSchema: z.ZodObject<{
         }>;
         words: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
-        by: z.ZodCustom<"org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
+        by: z.ZodCustom<"content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
         words: z.ZodString;
     }, z.core.$strict>]>>>;
     delegation: z.ZodOptional<z.ZodObject<{
@@ -752,15 +752,15 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
         rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
         approvalCard: z.ZodOptional<z.ZodEnum<{
-            shell: "shell";
-            plan: "plan";
-            skill: "skill";
             question: "question";
+            fetch: "fetch";
             "file-edit": "file-edit";
             "file-write": "file-write";
             "notebook-edit": "notebook-edit";
-            fetch: "fetch";
+            shell: "shell";
+            skill: "skill";
             workflow: "workflow";
+            plan: "plan";
             generic: "generic";
             "computer-access": "computer-access";
             "computer-control": "computer-control";
@@ -768,10 +768,10 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
             member: z.ZodEnum<{
-                hook: "hook";
-                skill: "skill";
-                deployment: "deployment";
                 request: "request";
+                deployment: "deployment";
+                skill: "skill";
+                hook: "hook";
                 persisted: "persisted";
             }>;
             entries: z.ZodArray<z.ZodString>;
@@ -781,9 +781,9 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             kind: z.ZodLiteral<"single">;
             rule: z.ZodString;
             match: z.ZodEnum<{
-                host: "host";
                 name: "name";
                 path: "path";
+                host: "host";
                 tool: "tool";
                 pattern: "pattern";
                 exact: "exact";
@@ -800,9 +800,9 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
                 kind: z.ZodLiteral<"command">;
                 rule: z.ZodString;
                 match: z.ZodEnum<{
-                    host: "host";
                     name: "name";
                     path: "path";
+                    host: "host";
                     tool: "tool";
                     pattern: "pattern";
                     exact: "exact";
@@ -870,8 +870,8 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             personalRuleDotsAbsent: z.ZodOptional<z.ZodCustom<AskEvidenceAbsence, AskEvidenceAbsence>>;
         }, z.core.$strict>>;
-        askClass: z.ZodOptional<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
-        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "mode" | "hook" | "org_rule" | "write_protection" | "target_unresolved" | "content_question" | "ask_rule" | "denial_limit_fallback" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "probe" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
+        askClass: z.ZodOptional<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>;
+        classes: z.ZodOptional<z.ZodArray<z.ZodCustom<"hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary", "hook" | "content_question" | "org_rule" | "ask_rule" | "denial_limit_fallback" | "probe" | "mode" | "write_protection" | "target_unresolved" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "rule_unreadable" | "classifier_no_ruling" | "requires_user_interaction" | "cross_boundary" | "operator_forced" | "shell_floor" | "write_protection_on_disk" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "unstated" | "ordinary">>>;
         fromSubagent: z.ZodOptional<z.ZodLiteral<true>>;
         sourceSessionId: z.ZodOptional<z.ZodString>;
         agentId: z.ZodOptional<z.ZodString>;
@@ -886,7 +886,7 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
             }>;
             words: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
-            by: z.ZodCustom<"org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "org_rule" | "org_unavailable" | "content_question" | "plan_review" | "ancestor_marked" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
+            by: z.ZodCustom<"content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy", "content_question" | "plan_review" | "ancestor_marked" | "org_unavailable" | "org_rule" | "rule_store_unavailable" | "ask_rule" | "denial_limit_fallback" | "shell_gate_tighten" | "safety_tighten" | "policy">;
             words: z.ZodString;
         }, z.core.$strict>]>>>;
         delegation: z.ZodOptional<z.ZodObject<{
@@ -1054,7 +1054,7 @@ export declare function adoptStoredLiveFacts(frame: ApprovalRequestLiveFacts, se
 /**
  * [ref] §3.1 的呈卡帧(设计稿 §4.1 逐字)。
  *
- * 🔴 **一条腿一个帧族**:呈卡协议在一条腿上场(腿的审批上下文接了 `emitCard`)⇒ 这条腿上一只 ask 的开卡 / 消卡 / 撤卡只走本族
+ * 🔴 **一条腿一个帧族**:呈卡协议在一条腿上场(腿的审批上下文族词 `approval_request`)⇒ 这条腿上一只 ask 的开卡 / 消卡 / 撤卡只走本族
  * (`approval_request` / {@link ApprovalCompleteFrame} / {@link ApprovalRevokeFrame}),旧族 `tool_approval` / `tool_approval_complete`
  * 一帧都不发;协议未上场的腿只发旧族。同一只 ask 在同一条腿上不再有两种开卡帧,消费方不再按 `approvalId` 去重。
  * 开卡的全部事实因此在本帧上:卡(`card`,耐久信封)+ 活面事实座({@link ApprovalRequestLiveFacts};活铸帧与重放帧同一份,见 {@link APPROVAL_REQUEST_LIVE_FACT_KEYS} 顶注)。
@@ -1096,8 +1096,8 @@ export interface ApprovalRequestFrame extends ApprovalRequestLiveFacts {
  * 不带逐卡终局);本帧是**单卡**的终局(人答 / 窗到期 / park 路由 / 取消 …)。同一只 ask 两帧都可能收到(被撤的兄弟自己的
  * 登记也按 settle 收场)—— 按 `askId` 清卡即可,两帧不冲突。
  *
- * 投递口 = 开卡帧的同一只口(`ToolApprovalRunContext.emitCard`):卡帧在哪,消卡帧就在哪(sync 腿 live + detach 账本,bg / resume 腿账本)。
- * 门 = 这条连接的**开卡帧真的送达过**(没见过开卡帧的连接收到消卡帧就是孤儿 close,与旧族同一条门)。
+ * 投递 = 开卡帧的同一只腿传输(`hitl-delivery.ts`:先本 run 账本、再直写 —— sync 腿有 durable run 行时两只都有,bg / resume 腿只有账本)。
+ * 门 = 这条连接上**接下过开卡帧的那几只 sink**(没见过开卡帧的 sink 收到消卡帧就是孤儿 close,与旧族同一条门;配对在竞速机一处)。
  */
 export interface ApprovalCompleteFrame {
     /** = SSE 具名事件名(同 `approval_request` 约定)。 */
@@ -1124,7 +1124,7 @@ export declare function buildApprovalCompleteFrame(input: {
     parked: boolean;
     nowMs: number;
 }): ApprovalCompleteFrame;
-/** 呈卡腿的单卡帧(开卡 / 消卡)—— `ToolApprovalRunContext.emitCard` 的入参形。 */
+/** 呈卡腿的单卡帧(开卡 / 消卡)—— 呈卡族腿传输收的单卡帧形(另一只是批级撤卡帧)。 */
 export type ApprovalCardLegFrame = ApprovalRequestFrame | ApprovalCompleteFrame;
 /**
  * [ref] §3.3 的**批级撤卡帧**(车6;设计稿 §3 逐字)。
@@ -1134,13 +1134,11 @@ export type ApprovalCardLegFrame = ApprovalRequestFrame | ApprovalCompleteFrame;
  * 那一次原子事务真正翻成 `VOID` 的行集(`expireAsk`/`bindBatch` 的 `voidedSiblings` 返回形),不是
  * 「本批全体」的推断。
  *
- * 🔴 **发射面 = 逐 ctx 分发,durable 腿落账本、sync 腿 live-only**([ref] [ref] 改述;原句「live emit
- * only——reaper/收敛器无 seq 可分配」把**调用点**的约束错安在投递面上):帧恒经 `emitRevokeTo` 交给各
- * ctx 的 `emitRevoke` 钩子,bg/resume 两条 durable 腿的钩子就是本腿账本的 `append`(seq 由腿的 ledger
- * 链步分配,与帧从哪个调用点来无关),于是「卡帧在哪个账本、撤帧就在哪个账本」逐 ctx 自洽;sync 腿的
- * 钩子仍是 live SSE 写(行为零变)。丢帧(ctx 已退场/append 失败)的结构补偿不变 = 172 §3.1 的
- * 「preamble 是壳侧卡集**全量对账基准**,不在基准内的一律清」——壳重连时的 preamble 本身就会让一张
- * 没收到撤卡帧的僵尸卡消失;账本里重放的撤帧只用于时间线渲染,不是卡集基准。
+ * 🔴 **发射面 = 逐 ctx 分发,经该腿那一只传输**(与开卡帧同一条律:先本 run 账本、再直写;账本落不下 ⇒ 这一帧不上直写):
+ * 帧恒经 `emitRevokeTo` 交给各呈卡族 ctx 的传输,seq 由该腿账本链步分配(与帧从哪个调用点来无关),于是「卡帧在哪个账本、撤帧就在
+ * 哪个账本」逐 ctx 自洽;三条腿(sync 腿有 durable run 行时)都落账本。账本里的序 = **入链序**:陈旧快照的竞态窄窗里撤帧可以先于它
+ * 点名的卡行入链 —— 消费方按 `askIds` 幂等应用(`batchId` 不是事件身份:取消对同批每只问各发一帧)。丢帧(ctx 已退场 / 账本写失败)
+ * 的结构补偿不变 = 172 §3.1 的「preamble 是壳侧卡集**全量对账基准**,不在基准内的一律清」;账本里重放的撤帧只用于时间线渲染,不是卡集基准。
  *
  * v1 **不带 per-ask 终态**(§7-4 裁定):中选者另有 `PARKED` 的下行面(410 体 + 重放消失),壳按
  * `askIds` 清卡即可。

package/dist/approval-gate-currency.js

@@ -97,14 +97,15 @@ function isReopenReason(word) {
     return typeof word === "string" && REOPEN_REASONS.includes(word);
 }
 function openReading(checkpoint, gateBoundCallId) {
+    const generation = checkpointRevOf(checkpoint);
     const reason = checkpoint.reopenReason;
     if (!isReopenReason(reason))
-        return { kind: "open" };
+        return { kind: "open", generation };
     const prior = decisionReading(checkpoint, gateBoundCallId);
     const reopened = prior.kind === "decided"
         ? { reason, decision: prior.decision, decidedAtMs: prior.decidedAtMs, ...(prior.decisionNote !== undefined ? { decisionNote: prior.decisionNote } : {}) }
         : { reason };
-    return { kind: "open", reopened };
+    return { kind: "open", generation, reopened };
 }
 export function createParkedGateRead(cs) {
     return async ({ gateToken, gateBoundCallId }) => {

package/dist/approval-leg-origin.d.ts

@@ -0,0 +1,33 @@
+/**
+ * 一条腿的**审批出处两格**:执行车道 + 这条腿的会话此刻的住客令牌(化身,`session-incarnation.ts`)。
+ *
+ * 两格都取自装配点手里**同一只**执行上下文(`http/execution-context.ts` 的 `ExecutionContext`:解析器步 ① 那一次行读的住客 + 由此定的车道)。三条提交腿
+ * (同步 · 后台 · 续跑)与 parked 赎回腿经 {@link approvalLegOriginOf} 一处读、一处展开进 `ToolApprovalRunContext` / `boundAsk` / `boundUnattendedAsk` /
+ * `approverSeatFor` 的身份 —— 出处的新格只在这一处加,不会有哪个装配点漏带。读者:协调器的「本会话放行」进程内表(`tool-approval.ts` `sessionAllowKey`),
+ * 键含 {@link ApprovalLegOrigin.incarnation} ⇒ 会话删了再登记(同一个 id、新的一位住客)之后,上一位住客点的放行读不中。
+ *
+ * 叶模块(只有类型位的 import):装配点的各层模块都从这里取,不经协调器本体,不构成运行时环。
+ */
+import type { ExecutionLane } from "./execution-lane-caps.js";
+export interface ApprovalLegOrigin {
+    /**
+     * 这条腿的执行车道(必填:出处没有车道的问不可表示)—— 每只席的身份都从所在边界的执行上下文铸(`ctx.lane`)。铸入三句:新行 ⇒ 本出处的车道;
+     * 既有行命中 / 收养 ⇒ 行上的车道(派生只对新行有意义,既有行一律采信行上的);无问店的活登记 ⇒ 本出处的车道。
+     */
+    readonly executionLane: ExecutionLane;
+    /**
+     * 这条腿的会话(`sessionId`)此刻的**住客令牌**(化身,`session-incarnation.ts`)—— 装配点写所在边界执行上下文那一读的住客(`ctx.occupant.incarnation`,
+     * 与 {@link executionLane} 同一只上下文、同一次行读;不另读第二次)。出处带化身:「本会话放行」(协调器的进程内授权表)的键含它,读写两点都取这一格
+     * (与 `sessionId` 同源同理由随**出处**走,不取投递连接的)⇒ 会话删了再登记(同一个 id、新的一位住客)之后,上一位住客点的放行读不中。
+     * 缺席 = 这条腿读不出这位住客(会话店不带执行席 / 腿没有会话):这条腿上**不读也不铸**进程内授权(点 `allow_session` 只放行这一次,回执 `rememberApplied:false`)。
+     */
+    readonly incarnation?: string;
+}
+/** 执行上下文 → 这条腿的出处两格({@link ApprovalLegOrigin})。形参只取两样(车道、住客),不依赖 http 层的类型。 */
+export declare function approvalLegOriginOf(execution: {
+    readonly lane: ExecutionLane;
+    readonly occupant?: {
+        readonly incarnation: string;
+    } | undefined;
+}): ApprovalLegOrigin;
+//# sourceMappingURL=approval-leg-origin.d.ts.map

package/dist/approval-leg-origin.js

@@ -0,0 +1,4 @@
+export function approvalLegOriginOf(execution) {
+    return { executionLane: execution.lane, ...(execution.occupant !== undefined ? { incarnation: execution.occupant.incarnation } : {}) };
+}
+//# sourceMappingURL=approval-leg-origin.js.map

package/dist/approval-reconciler.d.ts

@@ -176,19 +176,10 @@ export interface ReconcileStats {
     /**
      * 祖先冻结 approver 层 fold 中途铸点([ref] 件1④):退出硬相等,不是 mismatch 也不是单铸。
      *
-     * 🔴 **今天恒零,而且是结构性的**(扫描P2,2026-08-12 亲读验真;登记而不假称已解):读口
-     * `findCheckpointCandidatesForAsk` 按 `session_id = ask.sessionId` 查,`session_id` 列写的是
-     * `cp.sessionId`,而 core 每个 checkpoint 铸点都填 `sourceSessionId: sessionId`
-     * (`runner/prepare-task.js` 四处;`checkpoint-store.d.ts` 逐字「= sessionId at the mint」)⇒ 读口
-     * 返回的候选恒满足 `c.sourceSessionId === ask.sessionId`;而判据 1 命中要 `c.sourceSessionId ===
-     * ask.sourceSessionId`,祖先层否决要 `ask.sourceSessionId !== ask.sessionId` —— 两者互斥,这一臂在生产
-     * 接线下一次也不会被返回。
-     *
-     * 所以**别把零读数当健康信号**(与 {@link unmatchableNoHash} 的「恒零才是健康态」正相反:那条能非零,
-     * 这条不能)。根因是本文件 `reconcileOne` 里已登记的读口 session 维缺口(委派腿的候选压根进不来),
-     * 修它需要自带判据 + 真 checkpoint 店的宿主/子代双 session 端到端钉,不在扫描批的口径内。
-     * 否决臂**不删**:它是纯减法的安全臂,读口一修好就重新承重。结构事实的钉:
-     * `test/approval-reconciler.test.ts` 的「扫描P2 ④ 结构钉」(翻转钉——读口修好那天它会变红)。
+     * 读口按停车行所在的会话(`ask.sourceSessionId`)查,委派子代那条腿的停车行因此进得了候选集 ⇒ 这一臂在生产接线下**承重**:
+     * 祖先层那一次铸的问(行上 `parent_tool_call_id` 为 NULL、`sourceSessionId` 是子代的会话)读得到子代那只停车行,身份与摘要都可能
+     * 对得上,这里把它拦下(非零读数 = 本来会 bind、被这条裁定拦下的行)。结构事实的钉:`test/approval-reconciler.test.ts` 的
+     * 「扫描P2 ④ 翻面」(真 checkpoint 店:读口喂得出触发它的候选)。
      */
     ancestorFoldMint: number;
     parked: number;

package/dist/approval-reconciler.js

@@ -88,7 +88,7 @@ export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
     const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
     let gateMatch;
     if (checkpoints && !irreversibleBatch && !expired()) {
-        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
+        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sourceSessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
         gateMatch = classifyGateMatch(ask, candidates);
         if (gateMatch.kind === "hash_mismatch") {
             warn("approval_reconcile_hash_mismatch", {
@@ -177,7 +177,7 @@ export function createApprovalReconciler(deps) {
     const bindCommittedPark = async (calls) => {
         const deadlineMs = Date.now() + budgetMs;
         const work = (async () => {
-            const rows = await askStore.listParkingBySession(calls.sessionId);
+            const rows = await askStore.listParkingBySourceSession(calls.sessionId);
             for (const ask of rows) {
                 if (!calls.toolCallIds.includes(ask.toolCallId))
                     continue;

package/dist/approval.d.ts

@@ -151,7 +151,7 @@ export declare function buildForceDurableGateInertNotice(input: {
 export interface DurableAskOptions extends ApprovalListsView {
     autoBudget?: number;
     /** 本会话的「本会话放行」读面(server 的会话豁免店,键 = 会话 × wire 工具名)。缺席 = 这条腿没有会话 / 没有店 ⇒ 名单门照问。 */
-    exemption?: DeploymentListExemption;
+    exemption?: SessionExemptionRead;
 }
 /** 三张运维名单(一只调用由哪一张说话)的入参 —— 名单门与「问的属主」读法同读这一份。 */
 export interface ApprovalListsView {
@@ -181,24 +181,26 @@ export declare function createApprovalListVerdict(lists: ApprovalListsView): (ca
  */
 export declare function deploymentListAsks(config: Pick<GateIntentView, "approvalRequire" | "approvalDeny" | "approvalNeverAuto">, call: Pick<ToolCallRequest, "toolName" | "face">): boolean;
 /**
- * 名单门的「本会话放行」读面:本会话的豁免店读一次 + server 自己的审计行。名单的问是 server 铸的,它的站着的答案记在 server 的
- * 会话豁免店(活卡的 `allow_session` 与耐久 `/decide` 的 `remember:"session"` 写同一只店),名单门在出问**之前**读它。
+ * 策略层「本会话放行」读面:本会话的豁免店读一次 + server 自己的审计行。策略层的两道门 —— 部署名单门与 workflow 问句门 —— 问的都是 server 自己铸的问,
+ * 它们的站着的答案记在 server 的会话豁免店(活卡的 `allow_session` 与耐久 `/decide` 的 `remember:"session"` 写同一只店),两道门都在出问**之前**读它。
  */
-export interface DeploymentListExemption {
-    /** 这只工具(wire 名)在本会话有没有豁免行。有界、fail-closed:读抛 / 超时 ⇒ `false`(照问,人多看一张卡)。 */
+export interface SessionExemptionRead {
+    /** 这只工具(wire 名)在本会话有没有豁免行。有界、fail-closed:读抛 / 超时 / 答非 `true` ⇒ `false`(照问,人多看一张卡)。 */
     readonly has: (toolName: string) => Promise<boolean>;
-    /** 名单门因为豁免行没出问 —— server 自己的审计行(宿主豁免;不是人答的、不是策略代答的、没有记住任何东西)。 */
+    /** 门因为豁免行没出问 —— server 自己的审计行(宿主豁免;不是人答的、不是策略代答的、没有记住任何东西)。 */
     readonly onExempted: (toolName: string) => void;
 }
+/** 策略层读豁免店的读位(闭集;审计行与读失败告警的 `seat` 字段):部署名单门 / workflow 问句门。审批席自己的读不经这只铸点(`seat: "approval_seat"`,见 `tool-approval.ts` 的 `durableGrantHas`)。 */
+export type SessionExemptionReadSeat = "deployment_list" | "workflow_gate";
 /**
- * 名单门豁免读面的**唯一**铸点(HTTP 腿 `resolve-spec` 与 park 赎回腿 `parked-revive-gate` 两处装配都经它):键 = 会话 × wire 工具名
- * (与活卡 `allow_session` / `/decide` remember 写下的键同形)。审计事件名 {@link APPROVAL_EXEMPTED_EVENT},字段只有会话、工具与读位
- * `seat: "deployment_list"`(审批席自己那一行是 `seat: "approval_seat"`)。读的期限与审批席读同一只店的期限同值。
+ * 策略层会话豁免读面的**唯一**铸点(部署名单门的两处装配 —— HTTP 腿 `resolve-spec` 与 park 赎回腿 `parked-revive-gate` —— 与 workflow 问句门都经它):
+ * 键 = 会话 × wire 工具名(与活卡 `allow_session` / `/decide` remember 写下的键同形)。审计事件名 {@link APPROVAL_EXEMPTED_EVENT},字段只有会话、工具与读位 `seat`
+ * ({@link SessionExemptionReadSeat};审批席自己那一行是 `seat: "approval_seat"`)。读的期限与审批席读同一只店的期限同值;判 `=== true`(真值不放行)。
  */
-export declare function createDeploymentListExemption(store: Pick<ApprovalExemptionStore, "has">, sessionId: string, logger: {
+export declare function createSessionExemptionRead(store: Pick<ApprovalExemptionStore, "has">, sessionId: string, logger: {
     info(event: string, fields?: Record<string, unknown>): void;
     warn(event: string, fields?: Record<string, unknown>): void;
-}, leg?: "parked_revive"): DeploymentListExemption;
+}, seat: SessionExemptionReadSeat, leg?: "parked_revive"): SessionExemptionRead;
 /**
  * **每腿自动批额度的审批人名**(本仓闭词;core `AskOutcome.approver` 契约逐字「a closed word the host owns, never a person」)。
  * 结算记录读 `policy_allowed` / `who.party: "policy"` / `who.approver` = 本词 —— 审计读者按它认出「这一次放行是部署的自动批额度答的」,

package/dist/approval.js

@@ -100,7 +100,7 @@ export function createApprovalListVerdict(lists) {
 export function deploymentListAsks(config, call) {
     return createApprovalListVerdict({ requireApproval: config.approvalRequire, deny: config.approvalDeny, neverAuto: config.approvalNeverAuto })(call).list === "require";
 }
-export function createDeploymentListExemption(store, sessionId, logger, leg) {
+export function createSessionExemptionRead(store, sessionId, logger, seat, leg) {
     const where = { sessionId, ...(leg !== undefined ? { leg } : {}) };
     return {
         has: async (toolName) => {
@@ -113,7 +113,7 @@ export function createDeploymentListExemption(store, sessionId, logger, leg) {
                 return (await Promise.race([store.has(sessionId, toolName), deadline])) === true;
             }
             catch (err) {
-                logger.warn("session_grant_read_failed", { ...where, toolName, seat: "deployment_list", error: String(err).slice(0, 200) });
+                logger.warn("session_grant_read_failed", { ...where, toolName, seat, error: String(err).slice(0, 200) });
                 return false;
             }
             finally {
@@ -121,7 +121,7 @@ export function createDeploymentListExemption(store, sessionId, logger, leg) {
                     clearTimeout(timer);
             }
         },
-        onExempted: (toolName) => logger.info(APPROVAL_EXEMPTED_EVENT, { ...where, toolName, seat: "deployment_list" }),
+        onExempted: (toolName) => logger.info(APPROVAL_EXEMPTED_EVENT, { ...where, toolName, seat }),
     };
 }
 function createNameSetMatcher(names) {