@sema-agent/server 7.150.0 → 7.151.0

package/dist/parked-decide.js

@@ -30,36 +30,39 @@ export async function findParkOrigin(sources, cp) {
     if (index === undefined || runStore === undefined)
         return undefined;
     try {
-        const pointers = await index.listByAgentSession(cp.sessionId);
-        if (pointers.length === 0)
-            return undefined;
-        const runs = [];
-        for (const runId of new Set(pointers.map((p) => p.runId))) {
-            const run = await runStore.get(runId);
-            if (run !== null)
-                runs.push(run);
-        }
-        const route = routeWorkflowPark(cp.sessionId, runs);
-        switch (route.kind) {
-            case "held":
-                return route.park.token === cp.token ? { kind: "workflow", runId: route.runId, run: route.run, park: route.park } : undefined;
-            case "forked":
-                return { kind: "workflow_park_forked", runIds: route.runIds };
-            case "unproven":
-                return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
-            case "none":
-                return undefined;
-            default: {
-                const unhandled = route;
-                throw new Error(`unhandled workflow park route: ${JSON.stringify(unhandled)}`);
-            }
-        }
+        return await routeWorkflowOrigin(index, runStore, cp);
     }
     catch (e) {
         quiet(sources.warn, "workflow_park_probe_failed", { error: e instanceof Error ? e.message : String(e) });
         return undefined;
     }
 }
+async function routeWorkflowOrigin(index, runStore, cp) {
+    const pointers = await index.listByAgentSession(cp.sessionId);
+    if (pointers.length === 0)
+        return undefined;
+    const runs = [];
+    for (const runId of new Set(pointers.map((p) => p.runId))) {
+        const run = await runStore.get(runId);
+        if (run !== null)
+            runs.push(run);
+    }
+    const route = routeWorkflowPark(cp.sessionId, runs);
+    switch (route.kind) {
+        case "held":
+            return route.park.token === cp.token ? { kind: "workflow", runId: route.runId, run: route.run, park: route.park } : undefined;
+        case "forked":
+            return { kind: "workflow_park_forked", runIds: route.runIds };
+        case "unproven":
+            return { kind: "workflow_parks_unreadable", runId: route.runId, run: route.run, ...(route.readableHolderRunId !== undefined ? { readableHolderRunId: route.readableHolderRunId } : {}) };
+        case "none":
+            return undefined;
+        default: {
+            const unhandled = route;
+            throw new Error(`unhandled workflow park route: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export async function heldWorkflowParkDecisions(sources, hostSessionId, carried) {
     const entries = [...(carried ?? [])];
     const { workflowParkDecisions: decisions, checkpointStore: cs, workflowAgentSessionIndex: workflowIndex, workflowRunStore } = sources;
@@ -73,20 +76,38 @@ export async function heldWorkflowParkDecisions(sources, hostSessionId, carried)
         for (const row of held.rows) {
             if (own.has(String(row.token)))
                 continue;
-            const card = await cs.get(row.token).then((cp) => ({ cp }), (err) => ({ err }));
-            if ("err" in card) {
-                recordFailOpen("server.workflow-park-decision.card-unreadable", `runId=${row.runId} err=${card.err instanceof Error ? card.err.message : String(card.err)}`);
-                continue;
-            }
-            if (card.cp === null || card.cp.status !== "pending")
-                continue;
-            const origin = await findParkOrigin({ workflowIndex, workflowRunStore }, { token: row.token, scope: card.cp.scope, sessionId: card.cp.sessionId });
-            if (origin?.kind === "workflow")
-                entries.push({ runId: origin.runId, token: row.token, outcome: row.outcome });
+            const deliverable = await deliverableEntryOf({ checkpointStore: cs, workflowAgentSessionIndex: workflowIndex, workflowRunStore }, row);
+            if (deliverable.kind === "deliverable")
+                entries.push(deliverable.entry);
         }
     }
     return entries.length > 0 ? { workflowParkedResume: entries } : {};
 }
+export async function deliverableEntryOf(sources, row) {
+    const unreadable = (step, err) => {
+        recordFailOpen("server.workflow-park-decision.card-unreadable", `step=${step} runId=${row.runId} err=${err instanceof Error ? err.message : String(err)}`);
+        return { kind: "unreadable" };
+    };
+    let cp;
+    try {
+        cp = await sources.checkpointStore.get(row.token);
+    }
+    catch (err) {
+        return unreadable("card", err);
+    }
+    if (cp === null || cp.status !== "pending")
+        return { kind: "not_deliverable" };
+    let origin;
+    try {
+        origin = await routeWorkflowOrigin(sources.workflowAgentSessionIndex, sources.workflowRunStore, { token: row.token, sessionId: cp.sessionId });
+    }
+    catch (err) {
+        return unreadable("holder", err);
+    }
+    if (origin?.kind !== "workflow")
+        return { kind: "not_deliverable" };
+    return { kind: "deliverable", entry: { runId: origin.runId, token: row.token, outcome: row.outcome }, origin, card: { scope: cp.scope, sessionId: cp.sessionId } };
+}
 function quiet(warn, event, fields) {
     try {
         warn?.(event, fields);
@@ -224,63 +245,87 @@ export function planWorkflowParkedDecide(origin, req) {
             },
         };
     }
-    const verdict = req.decision === "approve" ? "APPROVED" : "DENIED";
     return {
         ok: true,
         hostSessionId,
         runId: origin.runId,
         outcome: buildParkedResumeOutcome(req),
-        message: {
-            text: `The human approval that workflow run "${origin.runId}" parked on (agent callKey "${origin.park.callKey}") has been ${verdict}. ` +
-                `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
-                `AND resumeFromRunId: "${origin.runId}" — the decision is already held by the deployment and will be applied to the parked ` +
-                `agent; completed steps replay from the journal. Do not re-issue the original call.`,
-            trusted: true,
-        },
+        message: workflowParkGuidance(origin.runId, origin.park.callKey, req.decision),
     };
 }
+export function workflowParkGuidance(runId, callKey, decision) {
+    const verdict = decision === "approve" ? "APPROVED" : "DENIED";
+    return {
+        text: `The human approval that workflow run "${runId}" parked on (agent callKey "${callKey}") has been ${verdict}. ` +
+            `Resume that run now: re-invoke Workflow with the SAME script source you launched it from (script / name / scriptPath) ` +
+            `AND resumeFromRunId: "${runId}" — the decision is already held by the deployment and will be applied to the parked ` +
+            `agent; completed steps replay from the journal. Do not re-issue the original call.`,
+        trusted: true,
+    };
+}
+export function redeemHere(runId, scope, d) {
+    return redeemWorkflowParks(runId, scope, [{ token: d.token, outcome: d.outcome }]);
+}
 function parkedChildResumedReceipt(taskId, decision, evidence) {
     return { status: 200, body: { taskId, status: "resuming", decision, ...evidence } };
 }
-const LIVE_REDEEM_RECEIPTS = new Map();
-async function runChannelEnded(runId, scope) {
-    const channel = subscribeWorkflow(runId, scope)[Symbol.asyncIterator]();
-    while (!(await channel.next()).done) {
-    }
-}
-function holdLiveReceipt(run, token, fingerprint, answer) {
-    let byToken = LIVE_REDEEM_RECEIPTS.get(run.id);
-    if (byToken === undefined) {
-        byToken = new Map();
-        LIVE_REDEEM_RECEIPTS.set(run.id, byToken);
-        const book = byToken;
-        const drop = () => {
-            if (LIVE_REDEEM_RECEIPTS.get(run.id) === book)
-                LIVE_REDEEM_RECEIPTS.delete(run.id);
-        };
-        void run.ended().then(drop, (err) => {
-            recordFailOpen("server.workflow-live-receipt.channel-unreadable", `runId=${run.id} err=${err instanceof Error ? err.message : String(err)}`);
-            drop();
-        });
+export function answerOfHolderFence(verdict, runId) {
+    switch (verdict) {
+        case "not_held":
+            return { status: 409, body: refusalBody({ errorCode: "decide.gate_moved", message: "the approval gate moved under this decide (re-parked or already settled) — re-check the pending list", facts: { runId } }) };
+        case "restated":
+            return {
+                status: 400,
+                body: refusalBody({
+                    errorCode: "decide.parked_restatement_unsupported",
+                    message: "mcpServers / a2aPeers cannot be applied: the run this approval belongs to is still running, and its waiting step continues with the MCP / A2A tables the run already has — re-issue the decide without them to continue it that way",
+                    facts: { runId },
+                }),
+            };
+        case "other_decision":
+            return {
+                status: 409,
+                body: refusalBody({
+                    errorCode: "decide.claim_lost",
+                    message: "another decision for this approval was already handed to the run that is waiting on it and is being applied — re-check the pending list",
+                    facts: { runId },
+                }),
+            };
+        default: {
+            const unhandled = verdict;
+            throw new Error(`unhandled workflow holder fence verdict: ${String(unhandled)}`);
+        }
     }
-    byToken.set(token, { fingerprint, answer });
 }
-const copyOf = (r) => ({ status: r.status, body: { ...r.body } });
-export async function deliverToHoldingRun(origin, d) {
-    const entry = d.restated ? { token: d.token } : { token: d.token, outcome: d.outcome };
-    const scope = origin.run.scope;
-    return answerOfParkDelivery(await redeemWorkflowParks(origin.runId, scope, [entry]), { id: origin.runId, ended: () => runChannelEnded(origin.runId, scope) }, d);
+export function holderFenceFaultAnswer(runId) {
+    return { status: 503, body: refusalBody({ errorCode: "decide.store_unreachable", message: "the state of this approval could not be read just now, so the run waiting on it kept waiting and nothing was decided — retry", facts: { runId } }) };
 }
-export async function answerOfParkDelivery(delivery, run, d) {
-    const runId = run.id;
+export function answerOfHolderRedeem(delivery, runId, decision) {
+    const receipt = () => parkedChildResumedReceipt(runId, decision, NO_SETTLEMENT_EVIDENCE);
     switch (delivery.kind) {
-        case "live":
-            return { kind: "answered", answer: answerOfLiveResult(delivery.results[0], run, d) };
+        case "live": {
+            const word = delivery.results[0];
+            if (word === undefined)
+                throw new Error(`workflow run ${runId} answered a live delivery without a result for the one decision it was handed`);
+            switch (word) {
+                case "driving":
+                case "already_taken":
+                case "not_parked_here":
+                case "unreadable":
+                    return receipt();
+                case "settled":
+                    return answerOfHolderFence("not_held", runId);
+                case "kept_parked":
+                    throw new Error(`workflow run ${runId} kept a parked call that was handed a decision — the engine keeps a park only on an acknowledgement`);
+                default: {
+                    const unhandled = word;
+                    throw new Error(`unhandled workflow park delivery result: ${String(unhandled)}`);
+                }
+            }
+        }
         case "suspending":
-            await delivery.ended;
-            return { kind: "resume_lane" };
         case "not_active":
-            return { kind: "resume_lane" };
+            return receipt();
         case "not_armed":
             throw new Error(`workflow run ${runId} answered not_armed to a decision for a card it holds — a run without a checkpoint seat cannot have parked one; refusing to guess where the decision goes`);
         default: {
@@ -289,53 +334,44 @@ export async function answerOfParkDelivery(delivery, run, d) {
         }
     }
 }
-function answerOfLiveResult(word, run, d) {
-    const runId = run.id;
-    if (word === undefined)
-        throw new Error(`workflow run ${runId} answered a live delivery without a result for the one decision it was handed`);
-    switch (word) {
-        case "driving": {
-            if (d.restated)
-                throw new Error(`workflow run ${runId} drove a parked call on an acknowledgement — an acknowledgement never authorizes a drive`);
-            const answer = parkedChildResumedReceipt(runId, d.decision, NO_SETTLEMENT_EVIDENCE);
-            holdLiveReceipt(run, d.token, d.fingerprint, answer);
-            return copyOf(answer);
-        }
-        case "already_taken": {
-            const held = LIVE_REDEEM_RECEIPTS.get(runId)?.get(d.token);
-            if (held !== undefined && held.fingerprint === d.fingerprint)
-                return copyOf(held.answer);
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "decide.claim_lost",
-                    message: "another decision for this approval was already handed to the run that is waiting on it and is being applied — re-check the pending list",
-                    facts: { runId },
-                }),
-            };
+export function holderPullDisposition(delivery, runId) {
+    switch (delivery.kind) {
+        case "live": {
+            const word = delivery.results[0];
+            if (word === undefined)
+                throw new Error(`workflow run ${runId} answered a live delivery without a result for the one decision it was handed`);
+            switch (word) {
+                case "driving":
+                case "already_taken":
+                case "settled":
+                    return "delivered";
+                case "not_parked_here":
+                case "unreadable":
+                    return "next_beat";
+                case "kept_parked":
+                    throw new Error(`workflow run ${runId} kept a parked call that was handed a decision — the engine keeps a park only on an acknowledgement`);
+                default: {
+                    const unhandled = word;
+                    throw new Error(`unhandled workflow park delivery result: ${String(unhandled)}`);
+                }
+            }
         }
-        case "settled":
-        case "not_parked_here":
-            return { status: 409, body: refusalBody({ errorCode: "decide.gate_moved", message: "the approval gate moved under this decide (re-parked or already settled) — re-check the pending list", facts: { runId } }) };
-        case "unreadable":
-            return { status: 503, body: refusalBody({ errorCode: "decide.store_unreachable", message: "the state of this approval could not be read just now, so the run waiting on it kept waiting and nothing was decided — retry", facts: { runId } }) };
-        case "kept_parked":
-            if (!d.restated)
-                throw new Error(`workflow run ${runId} kept a parked call that was handed a decision — the engine keeps a park only on an acknowledgement`);
-            return {
-                status: 400,
-                body: refusalBody({
-                    errorCode: "decide.parked_restatement_unsupported",
-                    message: "mcpServers / a2aPeers cannot be applied: the run this approval belongs to is still running, and its waiting step continues with the MCP / A2A tables the run already has — re-issue the decide without them to continue it that way",
-                    facts: { runId },
-                }),
-            };
+        case "suspending":
+        case "not_active":
+            return "left";
+        case "not_armed":
+            throw new Error(`workflow run ${runId} answered not_armed to a decision for a card it holds — a run without a checkpoint seat cannot have parked one`);
         default: {
-            const unhandled = word;
-            throw new Error(`unhandled workflow park delivery result: ${String(unhandled)}`);
+            const unhandled = delivery;
+            throw new Error(`unhandled workflow park delivery: ${JSON.stringify(unhandled)}`);
         }
     }
 }
+export async function runChannelEnded(runId, scope) {
+    const channel = subscribeWorkflow(runId, scope)[Symbol.asyncIterator]();
+    while (!(await channel.next()).done) {
+    }
+}
 function sessionGone(taskId) {
     return {
         status: 409,

package/dist/peer-directory.d.ts

@@ -37,8 +37,8 @@
  *
  * ## scope 轴
  *
- * core 递进来的 `access.scope` = `taskScope` = `internals?.registryScope ?? spec.principal ?? "default"`
- * (core `prepare-task.js`)× server `resolve-spec.ts:701 principal: auth?.principal` ⇒ **裸 principal 串**,
+ * core 递进来的 `access.scope` = 引擎的任务 scope(core 写侧规则与本仓的唯一换算见 `engine-identity.ts` 的 `engineScopeOf` 头注)
+ * × 落点 `taskSpecIdentityOf` 只写人 ⇒ **裸 principal 串**,
  * 无 principal 的部署上是字面量 `"default"`,而同一情形下 `session_meta.owner` 是 SQL NULL ——
  * 这正是窄互认臂(`LEGACY_UNOWNED_AMNESTY_TENANT === "default"`)要接住的那一格,不必另铸编解码。
  *

package/dist/peer-inbound-face.d.ts

@@ -11,8 +11,8 @@
  *    receipt / 投递 / 到期计时都是 core 绑在队列上的 sink(引擎在 run 的 drain 里自己 `configure`,宿主**不**接 sink —— 接了就是第二个写者)。
  *    本面只做两件事:把队列里等人审的卡(见下「只有人能答的卡」)投成 `pending[]` 的 `peer_inbound` 行;把决断口的 approve / deny 原样交给 `settle`。
  *    没有行店、没有落账:一张卡在不在、谁赢了 CAS、结局是什么,全是 core 的读数。
- *  · **属主 = 收信方**:列与决都只在调用方**自己**的信箱 scope 里找队列(`peerHeldQueueIfAny(调用方 scope, …)`;scope 读法与 core 的
- *    `taskScope = spec.principal ?? "default"` 同一条,见 {@link peerBoxScope})—— 别人的卡结构上取不到,决断口答的 404 与「没有这张卡」同码同文。
+ *  · **属主 = 收信方**:列与决都只在调用方**自己**的信箱 scope 里找队列(`peerHeldQueueIfAny(调用方 scope, …)`;core 按收信 run 的任务 scope 开队列,
+ *    调用方那一格只经唯一换算 `engine-identity.ts` 的 `engineScopeOfOwner` 读,路由在调用点换好再交进来)—— 别人的卡结构上取不到,决断口答的 404 与「没有这张卡」同码同文。
  *    显式 operator **没有**额外射程:一封信是收信人的,不是运维治理面(与停驻门「operator 可决任意行」刻意不同,决断口按族分臂)。
  *  · **只有人能答的卡才进审批席**(core `PEER_HELD_REVIEW_CAUSES`:`mode-mismatch` / `no-mode-asserted` / `invalid-mode-attestation` —— 权限档
  *    对等判扣下的信;CC 只对这几个成因开审阅框与到期计时,cli309.js:36111–36116 的句子逐条:`managed-setting` / `repo-setting` / `explicit-setting`
@@ -41,10 +41,6 @@
   */
 import { type PeerHeldEntry, type PeerHeldSettleOutcome } from "@sema-agent/core";
 import { type PeerInboundLane } from "./org-delivery-gate.js";
-/**
- * 调用方 principal 的信箱 scope —— core 写侧 `taskScope = spec.principal ?? "default"` 的同一条读法(无主 ⇒ `"default"`)。列 / 决都按它找队列。
- */
-export declare function peerBoxScope(principal: string | null | undefined): string;
 /** 决断口 id 的坐标(id 是它的唯一拼法,见 {@link peerInboundIdOf})。 */
 export interface PeerInboundCoord {
     readonly sessionId: string;

package/dist/peer-inbound-face.js

@@ -3,9 +3,6 @@ import { PEER_INBOUND_LANES, boxOfLane, laneOfBox } from "./org-delivery-gate.js
 import { PEER_INBOUND_ID_PREFIX } from "./approval-queue-kind.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { seatText } from "./trace/exit-seat.js";
-export function peerBoxScope(principal) {
-    return principal ?? "default";
-}
 export function peerInboundIdOf(c) {
     return `${PEER_INBOUND_ID_PREFIX}${c.sessionId}:${c.lane}:${c.seq}`;
 }

package/dist/permission-mode-admission.d.ts

@@ -1,5 +1,5 @@
 /**
- * **一个调用方交来的权限模式词,本部署收不收、收成什么** —— 唯一的受理判官(规则一处、三只属主各一处、序一处)。
+ * **一个进入 run 的权限模式词(调用方交来的,或停驻 run 的存储体被重放时体上的),本部署收不收、收成什么** —— 唯一的受理判官(规则一处、三只属主各一处、序一处)。
  *
  * ## 一条规则,三只属主,本模块只排序
  *  ① 本任务 settings 的 kill-switch 折叠(`task-settings.ts` `foldDisableAutoMode`:`disableAutoMode` 在 ⇒ `auto` 折 `default`);
@@ -8,12 +8,30 @@
  * ①② 是**入口一步**({@link entryStep}:改词、不拒),③ 是**托管一步**(只拒、不改词)。顺序承重的只有「② 在 ③ 之前」(地板把 bypass 钳成 plan 之后就不开写面,不拒);
  * ① 只动 `auto`、③ 只看开写面的词,两者互不相交。
  *
- * ## 两口的调用形(同一组函数、同一个序;同一个词 × 同一份部署事实 × 同一份任务 settings ⇒ 同一个结果,钉 `test/run-permission-mode-admission.test.ts` 的两口表)
+ * ## 三口的调用形(同一组函数、同一个序;提交口与切档口:同一个词 × 同一份部署事实 × 同一份任务 settings ⇒ 同一个结果,钉 `test/run-permission-mode-admission.test.ts` 的两口表;
+ *    续跑口与它们只差地板的出口词一个事实,钉 `test/entry-permission-mode.test.ts` 的续跑口表)
  *  · 在飞 run 的切档口(`http/routes/run-permission-mode.ts`:`POST /v1/runs/:id/permission-mode` 的 `mode`,本任务 settings 读存储体)调整只判官 {@link admitPermissionModeWord}。
  *  · 提交口(`POST /v1/tasks|/v1/tasks/stream|/v1/runs` 的词 = 顶层 `permissionMode` ?? bundle `settings.permissions.defaultMode`)把两步落在**上一版就在的两处**:
  *    入口一步在受理门盖章({@link stampSubmissionEntryMode},`http/admission.ts`:值形门之后、装配之前 —— 首跑装配与 `buildCheckpointCtx` 读的都是盖过章的体);
  *    托管一步是装配期那一处判(`boot/resolve-spec.ts`,对盖过章的词调同一只 ③;提交腿与续跑重放腿同经)。不把整只判官提前到受理门:那会让托管拒抢在
- *    属主 / 会话 / 执行上下文与装配期其余值判之前答(拒序变了 —— 钉同一文件的拒序组)。续跑重放不再过 ②:地板是**入口**事实,热改只影响之后提交的任务。
+ *    属主 / 会话 / 执行上下文与装配期其余值判之前答(拒序变了 —— 钉同一文件的拒序组)。
+ *  · 续跑口(一条 HTTP 车道停驻 run 的存储体被重放之前;`http/resume-legs.ts` 的 `replayCtxOf`,五个续跑读点同调;leader 车道的行按那条车道「一 run 一读」照写下的体重放,
+ *    规则在 `replayCtxOf` 头注)调 {@link stampReplayEntryMode}:体上的词过与提交口**同一只**入口一步
+ *    ({@link bodyEntry}:同一只折叠、同一只 `entryPermissionMode`、地板读同一份**活** config)、盖同一只章 —— 提交之后运维把 `AUTONOMY` 改严,或体是更早的写者留下的请求原词,
+ *    重放照**现**地板钳;被钳 = 钳到地板放行(与提交口同形,不拒、不新增码),生效词由这条腿的 `wiring_manifest.permissionMode` 说;钳过的体随 CAS 赢点写回,
+ *    存储体仍是这条 run 模式词唯一的源。与提交口只差一个**事实**(不是续跑专用臂,见下一节):体**顶层** `permissionMode` 上写着的是这块地板的出口词({@link floorExitWords})⇒ 原样读。
+ *    托管一步照旧在装配期判。
+ *
+ * ## 为什么地板的出口词在续跑口原样读
+ * 存储体上的模式词有三个写者:提交口(盖过地板)、切档口(盖过地板)、`plan_review` 的批准 / 编辑写回(`http/resume-legs.ts` `drivePlanReview`:把计划带出 plan,
+ * 写 `PLAN_APPROVE_PERMISSION_MODES_AFTER` 里的词 —— 这就是 plan 地板的出口:一个人批了这份计划)。提交口与切档口收的是**调用方**的词,出口词照钳(没有人批过计划);
+ * 续跑口读的是**存储体**的词,出口词是批准写下的 ⇒ 对它也钳 = 每一次挂起→续跑都把批过的计划拉回 plan(上一版撤掉按段重钳模式词的那条理由,`runtime-governance.ts`
+ * `autonomyOverrides` 顶注)。出口词以外的词(`bypassPermissions` / `auto` / `dontAsk` / 缺席)在这块地板下没有任何写者写得出来 —— 只能是更松的地板(改严之前)
+ * 或更早的写者(7.121.x 及以前的请求原词)留下的 ⇒ 照现地板钳。出口写者只写**顶层** `permissionMode`(`drivePlanReview` 的写回;bundle 的 `defaultMode` 不动),
+ * 所以出口判读的是顶层那一格的**原字**(严格读):只在 bundle 拼法里的词、经本任务 kill-switch 折出来的词(顶层 `auto` × `disableAutoMode` ⇒ `default`)、
+ * 词表外的串(重放的宽读把它折成 `default`)都不是出口写下的,照钳。
+ * ⚠️ 射程如实:顶层的出口词本身读不出是谁写的 —— 改严之前提交的顶层 `default` / `acceptEdits`、7.121.x 及以前的同字原词与批准写回逐字相同,原样重放
+ * (MIGRATION 如实写);要分开它们得给行补一个「谁写的」事实,本模块不猜。
  *
  * ## 为什么切档口必须经这只判官(而不是靠引擎的 deny 位)
  * 引擎在根腿上只认两只模式拒位(`RuntimeCaps.bypassPermissions` / `RuntimeCaps.autoMode`,本仓由 center 与本地 kill-switch 写);上面三问
@@ -55,8 +73,8 @@ export type PermissionModeAdmission = {
 export declare function admitPermissionModeWord(word: PermissionMode | undefined, facts: PermissionModeAdmissionFacts): PermissionModeAdmission;
 /**
  * 提交口的入口一步(`http/admission.ts` 唯一调用;直调装配腿的测试夹具也调它 —— 少了这一步的体是部署上到不了的体):
- * 体上的词(顶层 `permissionMode` ?? bundle `settings.permissions.defaultMode`)过 {@link entryStep},本任务的 settings = 体上那一份;
- * 入口词盖进体(`task-settings.ts` `stampEntryPermissionMode`:地板在场时写顶层 `permissionMode`,缺席原物)。不拒 —— 托管一步在装配期判(见顶注「两口的调用形」)。
+ * 体上的词过 {@link bodyEntry};入口词盖进体(`task-settings.ts` `stampEntryPermissionMode`:地板在场时写顶层 `permissionMode`,缺席原物)。
+ * 不拒 —— 托管一步在装配期判(见顶注「三口的调用形」)。
  */
 export declare function stampSubmissionEntryMode<B extends {
     permissionMode?: unknown;
@@ -65,4 +83,22 @@ export declare function stampSubmissionEntryMode<B extends {
     readonly body: B;
     readonly entry: EntryPermissionMode;
 };
+/**
+ * 一块入口地板的**出口词** —— 存储体上由地板自己的出口写下的词(续跑口原样读它们,理由见顶注「为什么地板的出口词在续跑口原样读」)。
+ * 闭集穷尽 switch:引擎的模式词表加一词 ⇒ 编译红,逼着回答「这个词当地板时靠什么出口」。`plan` 的出口是人审(`plan_review` 的批准 / 编辑把计划带出 plan,
+ * 写回的词表 = `task-settings.ts` `PLAN_APPROVE_PERMISSION_MODES_AFTER`,那张表是唯一的源);其余五词今天不是任何档的地板(`runtime-governance.ts` `autonomyModeFloor`
+ * 只答 `plan` 或缺席),当地板也没有出口 ⇒ 空(失效关闭:比它松的词照钳)。
+ */
+export declare function floorExitWords(floor: PermissionMode): readonly PermissionMode[];
+/**
+ * 续跑口的入口一步:一条停驻 run 的存储体被重放之前,体上的词过 {@link bodyEntry}(与提交口同一只,地板读此刻的活 config),入口词盖进体
+ * (同一只 `stampEntryPermissionMode`);体顶层 `permissionMode` 的原字是 `bodyEntry` 读到的那块地板的出口词({@link floorExitWords})⇒ 体**原物**交回
+ * (出口写者只写顶层;那个词已经过了地板)。
+ * 地板缺席 ⇒ 体原物(零字节变化)。不拒:钳到地板放行,与提交口同形(见顶注「三口的调用形」)。
+ * 唯一调用点:`http/resume-legs.ts` 的 `replayCtxOf`(五个续跑读点同调;之后的存体预判、重建、plan_review 的模式词门与驱动段、CAS 赢点的写回读的都是它交回的那一份)。
+ */
+export declare function stampReplayEntryMode<B extends {
+    permissionMode?: unknown;
+    settings?: unknown;
+}>(body: B, deployment: PermissionModeAdmissionFacts["deployment"]): B;
 //# sourceMappingURL=permission-mode-admission.d.ts.map

package/dist/permission-mode-admission.js

@@ -1,6 +1,6 @@
 import { autonomyModeFloor, entryPermissionMode } from "./runtime-governance.js";
 import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal } from "./hosted-posture.js";
-import { foldDisableAutoMode, parseTaskSettings, requestedPermissionMode, stampEntryPermissionMode } from "./task-settings.js";
+import { PLAN_APPROVE_PERMISSION_MODES_AFTER, coercePermissionModeStrict, foldDisableAutoMode, parseTaskSettings, requestedPermissionMode, stampEntryPermissionMode } from "./task-settings.js";
 export const PERMISSION_MODE_ADMISSION_FOLDS = ["entry_floor", "disable_auto_mode"];
 function entryStep(word, facts) {
     const folded = foldDisableAutoMode(word, facts.settings);
@@ -15,9 +15,35 @@ export function admitPermissionModeWord(word, facts) {
         return { kind: "refused", status: 422, code: HOST_POSTURE_REFUSED_CODE, message: why };
     return { kind: "admitted", requested: word, admitted: entry.effective, entry, ...(foldedBy !== undefined ? { foldedBy } : {}) };
 }
-export function stampSubmissionEntryMode(body, deployment) {
+function bodyEntry(body, deployment) {
     const settings = parseTaskSettings(body.settings).settings;
-    const { entry } = entryStep(requestedPermissionMode(body, settings), { deployment, settings });
+    return entryStep(requestedPermissionMode(body, settings), { deployment, settings }).entry;
+}
+export function stampSubmissionEntryMode(body, deployment) {
+    const entry = bodyEntry(body, deployment);
     return { body: stampEntryPermissionMode(body, entry), entry };
 }
+export function floorExitWords(floor) {
+    switch (floor) {
+        case "plan":
+            return PLAN_APPROVE_PERMISSION_MODES_AFTER;
+        case "default":
+        case "acceptEdits":
+        case "auto":
+        case "bypassPermissions":
+        case "dontAsk":
+            return [];
+        default: {
+            const unhandled = floor;
+            throw new Error(`entry floor "${String(unhandled)}" has no exit arm`);
+        }
+    }
+}
+export function stampReplayEntryMode(body, deployment) {
+    const entry = bodyEntry(body, deployment);
+    const top = coercePermissionModeStrict(body.permissionMode);
+    if (entry.floor !== undefined && top !== undefined && floorExitWords(entry.floor).includes(top))
+        return body;
+    return stampEntryPermissionMode(body, entry);
+}
 //# sourceMappingURL=permission-mode-admission.js.map

package/dist/plugins/adoption-log-sql.d.ts

@@ -133,8 +133,10 @@ export declare class SqlAdoptionLogStore implements AdoptionLogStore {
     constructor(db: SqlDriver);
     private q;
     /** 池级只读执行面(phase 0 的 preflight 扫描用——它**零写**,不需要也不该占一条事务连接)。
-     *  写路径一律走 {@link rebindTransaction};把驱动整个暴露出去会让调用方能绕开 phase CAS。 */
+     *  写路径一律走 {@link rebindTransaction};把驱动整个暴露出去会让调用方能绕开 phase CAS。
+     *  交出的是**封过**的执行面(只一个 `query`,出店口:库错只带原码 + 稳定句),不是驱动本身。 */
     get reader(): SqlExec;
+    private sealedReader;
     /**
      * 发起腿的 **insert-or-fetch 原子形**。返回读回的行(可能是别人插的)+ 是否本次插入。
      * 调用方据 `row.toPrincipal !== toPrincipal` 判「同 from 异 to」⇒ typed 409。

package/dist/plugins/adoption-log-sql.js

@@ -3,6 +3,7 @@ import { createHash } from "node:crypto";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { acquireAdvisoryLockWithin, releaseAdvisoryLock } from "./ensure-schema-lock-policy.js";
 import { ensureIndexes } from "./ensure-index.js";
+import { sealStoreClass, sealStoreObject } from "./store-boundary.js";
 export const ADOPTION_LOG_TABLE = "adoption_log";
 export const ADOPTION_PHASE = {
     INTENT: 2,
@@ -105,8 +106,9 @@ export class SqlAdoptionLogStore {
         return this.db.dialect === "mysql" ? mysql : pg;
     }
     get reader() {
-        return this.db;
+        return (this.sealedReader ??= sealStoreObject({ query: (sql, params) => this.db.query(sql, params) }, "sql-adoption-log-reader", { query: "exit" }));
     }
+    sealedReader;
     async ensureAdoption(row) {
         const emptyLegs = "[]";
         const res = await this.db.query(this.q(`INSERT IGNORE INTO ${ADOPTION_LOG_TABLE} (${COLS}) VALUES (?, ?, ?, ?, 'in_flight', ?, ?, NULL, NULL, NULL, ?, ?)`, `INSERT INTO ${ADOPTION_LOG_TABLE} (${COLS}) VALUES ($1, $2, $3, $4, 'in_flight', $5, $6, NULL, NULL, NULL, $7, $8) ON CONFLICT (from_principal) DO NOTHING`), [row.adoptionId, row.fromPrincipal, row.toPrincipal, ADOPTION_PHASE.INTENT, emptyLegs, emptyLegs, row.nowMs, row.nowMs]);
@@ -216,6 +218,10 @@ export class SqlAdoptionLogStore {
         }
     }
 }
+sealStoreClass(SqlAdoptionLogStore, "sql-adoption-log-store", {
+    ensureAdoption: "exit", getById: "exit", getByFrom: "exit", listInFlight: "exit", rebindOn: "exit", sweepOn: "exit", advancePhase: "exit", putConfigs: "exit",
+    finalizeAdopted: "exit", finalizeRejected: "exit", withLock: "exit",
+});
 export class TiDBAdoptionLogStore extends SqlAdoptionLogStore {
     constructor(pool) {
         super(mysqlDriver(pool));

package/dist/plugins/approval-ask-store-file.d.ts

@@ -2,7 +2,7 @@ import { type ExecutionLane } from "../execution-lane-caps.js";
 import { type LocalAskLaneBackfillRefusal } from "./one-time-migrations.js";
 import type { AskState } from "../approval-ask-machine.js";
 import type { SettleCause } from "../approval-deny-reasons.js";
-import type { AskCallCoordinate, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow } from "./approval-ask-store-sql.js";
+import type { AskCallCoordinate, AskDecisionRecord, AskRow, AskTerminalClaimIntent, AskTerminalClaimOpts, AskTerminalClaimOutcome, AskTransitionPatch, ApprovalAskStore, BatchRow, BindGateInput, BindResult, DecideAskInput, DecideResult, EnsureAskResult, ExpireResult, NewAskRow, RecordParkedDecisionResult } from "./approval-ask-store-sql.js";
 /** 数据根下的目录名。**按店命名**,与兄弟 File 店同规(`approval-nonces` / `approval-ask-audit` /
  *  `approval-exemptions` / `resume-anchors` / `checkpoint-ctx` / …)—— 首版写的是族名 `approvals`,而那
  *  正是读者会去找**持久 park 行**的地方(它们其实在 `checkpoint-ctx`),且持久数据面的名字按硬 breaking
@@ -24,7 +24,7 @@ export declare const ASK_JOURNAL_COMPACT_GROWTH = 2;
  * 账本的**动词闭集**([ref] 形)。运行期的词表判定与编译期的穷尽 `switch` 读同一份:
  * 往这里加一个词,{@link FileApprovalAskStore.replayOp} 的 switch 立刻编译红(漏一口不可能发布)。
  */
-declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteBySession", "reapSettledAsks", "reapEmptyBatches"];
+declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "recordParkedDecision", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteBySession", "reapSettledAsks", "reapEmptyBatches"];
 type JournalOpWord = (typeof JOURNAL_OPS)[number];
 /** 运行期词表(上面的数组)与类型面动词维({@link JournalCall})的**双向**对表 —— 任一边加词而另一边
  *  没跟上,这个别名解析成 `never`,{@link JOURNAL_OP_TABLE_GATE} 的赋值当场编译红。 */
@@ -59,6 +59,12 @@ type JournalCall = {
     askId: string;
     batchId: string;
     decision: DecideAskInput;
+}
+/** 停驻形的人决落行。更老的读者不认这个动词 ⇒ 拒启并点名出路(与留存两动词同一条降级纪律)。 */
+ | {
+    op: "recordParkedDecision";
+    askId: string;
+    record: AskDecisionRecord;
 } | {
     op: "claimTerminal";
     askId: string;
@@ -202,6 +208,8 @@ export declare class FileApprovalAskStore implements ApprovalAskStore {
      * (整本账的信封号另算 —— 见顶注「信封版本」)。
      */
     decideAsk(askId: string, batchId: string, owner: string | null, decision: DecideAskInput): Promise<DecideResult>;
+    /** 停驻形的人决落行 —— 出域的一次不落账本(与 {@link decideAsk} 同一条 [ref] 理由),其余落账 → 内核。 */
+    recordParkedDecision(askId: string, owner: string | null, record: AskDecisionRecord): Promise<RecordParkedDecisionResult>;
     claimTerminal(askId: string, batchId: string, intent: AskTerminalClaimIntent, opts?: AskTerminalClaimOpts): Promise<AskTerminalClaimOutcome>;
     expireAsk(askId: string, batchId: string): Promise<ExpireResult>;
     bindBatch(batchId: string, askId: string, gate: BindGateInput): Promise<BindResult>;

package/dist/plugins/approval-ask-store-file.js

@@ -20,6 +20,7 @@ const JOURNAL_OPS = [
     "ensureAsk",
     "transitionAsk",
     "decideAsk",
+    "recordParkedDecision",
     "claimTerminal",
     "claimTerminalRefuse",
     "expireAsk",
@@ -280,6 +281,8 @@ export class FileApprovalAskStore {
                 return this.core.transitionAsk(rec.askId, rec.from, rec.to, rec.patch);
             case "decideAsk":
                 return this.core.decideAsk(rec.askId, rec.batchId, this.core.peekAsk(rec.askId)?.owner ?? null, rec.decision);
+            case "recordParkedDecision":
+                return this.core.recordParkedDecision(rec.askId, this.core.peekAsk(rec.askId)?.owner ?? null, rec.record);
             case "claimTerminal":
                 return this.core.claimTerminal(rec.askId, rec.batchId, rec.intent, rec.cause !== undefined ? { cause: rec.cause } : undefined);
             case "claimTerminalRefuse":
@@ -318,6 +321,11 @@ export class FileApprovalAskStore {
             return this.core.decideAsk(askId, batchId, owner, journalled);
         return this.write({ op: "decideAsk", askId, batchId, decision: journalled }, (c) => this.core.decideAsk(c.askId, c.batchId, owner, c.decision));
     }
+    async recordParkedDecision(askId, owner, record) {
+        if (!askRowCarriesOwner(this.core.peekAsk(askId), owner))
+            return this.core.recordParkedDecision(askId, owner, record);
+        return this.write({ op: "recordParkedDecision", askId, record }, (c) => this.core.recordParkedDecision(c.askId, owner, c.record));
+    }
     async claimTerminal(askId, batchId, intent, opts) {
         switch (intent) {
             case "expire":