@sema-agent/server 7.48.0 → 7.49.0

package/dist/approval-card.d.ts

@@ -13,7 +13,7 @@
  * 合法、语义上空」的卡。`safeParse` 让这种行**当场落地为「跳过 + 一次 warn」**(§5.3)。
  *
  * schema 属主裁定(设计稿 §12-2,属主 §14 裁 (a) 变体):v1 的 schema 属主 = server 本仓,server 加
- * **zod 直依赖**(此前 zod 只经 `@sema-agent/registry-core` 传递到场)。抽进 `@sema-agent/registry-core`
+ * **zod 直依赖**(此前 zod 只经 `@sema-agent/settings-schema` 传递到场)。抽进 `@sema-agent/settings-schema`
  * 的时机 = 出现第二个**运行期**消费者(cli 呈卡校验排期时)——届时是「属主迁移」而不是「复制形状」,
  * 不违单一属主宪法;此刻抽包 = 为不存在的消费者发一轮 registry-core 版本 + floor bump,零收益。
  *

package/dist/auth-bridge.d.ts

@@ -1,7 +1,7 @@
-import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/registry-core/api/auth-bridge";
+import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
-export type { VerifiedIdentity } from "@sema-agent/registry-core/api/auth-bridge";
+export type { VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
 export interface RegistryJwtVerifierOptions {
     /** R4 — 期望 iss(registry 的 SSO_ISSUER;默认=SEMA_REGISTRY_URL,双侧去尾斜杠比较)。 */
     issuer: string;

package/dist/auth-bridge.js

@@ -1,5 +1,5 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
-import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/registry-core/api/auth-bridge";
+import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 const MAX_JWKS_BYTES = 256 * 1024;
 const MAX_TOKEN_CHARS = 16 * 1024;

package/dist/boot/config-center.js

@@ -2,8 +2,8 @@ import { createHash } from "node:crypto";
 import { readFile as fsReadFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { loadRemoteExec } from "@sema-agent/registry-core/node";
-import { skillContentHash } from "@sema-agent/registry-core";
+import { loadRemoteExec } from "@sema-agent/settings-schema/node";
+import { skillContentHash } from "@sema-agent/settings-schema";
 import { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, } from "@sema-agent/core";
 import { buildPricing } from "../budget.js";
 import { applyCenterPlugins } from "../capabilities/center-plugins.js";

package/dist/boot/runner-deps.d.ts

@@ -175,8 +175,10 @@ export type SharedRunnerDepsCtx = Pick<RunnerDepsCtx, "config" | "brain" | "pric
  *  1. **日志(全族,逐字保留)** —— 上面那段契约一个字节不变:任何 code、detail 原样、缺 detail 不铸键。
  *     运维观察面零回退是本腿的硬前提(wire 半场是**增量**,不是搬家)。
  *  2. **wire(白名单 + sessionId 路由)** —— `router.route(notice)`:码在
- *     {@link import("../trace/engine-notice-wire.js").ENGINE_NOTICE_WIRE_CODES} 内**且** `detail.sessionId`
- *     在场时,投给那条会话的 run 腿(SSE + durable 账本);否则一帧不出。判据整条住在
+ *     {@link import("../trace/engine-notice-wire.js").ENGINE_NOTICE_WIRE_CODES} 内**且**归属键在场时,
+ *     投给那条会话的 run 腿(SSE + durable 账本);否则一帧不出。归属键 = 顶层 `EngineNotice.sessionId`
+ *     **优先**、缺席回落 `detail.sessionId`(单点 `engineNoticeSessionId`;此前这一行只写了 detail 那一半,
+ *     顶层键 core 5.46+ 就到了)。判据整条住在
  *     `src/trace/engine-notice-wire.ts`(白名单/归属/消毒/隔离四件同源),这里只负责**先日志后分流**的次序。
  *
  * 🔴 次序是承重的:日志在前 ⇒ 即便 wire 半场整条坏掉(路由抛、口抛),事实仍然完整落在运维面。

package/dist/config-center/apply-effective.js

@@ -1,5 +1,5 @@
 import { isThinkingLevel } from "@sema-agent/core";
-import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/registry-core";
+import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/settings-schema";
 import { sealedKeyPoison } from "../sealed-key.js";
 import { applyAutoCompactWindow, findUnmatchableToolNames, formatUnmatchableToolNames, parseAutonomy } from "../config.js";
 import { validateCommandRules } from "../runtime-governance.js";

package/dist/config-center/http-client.d.ts

@@ -1,4 +1,4 @@
-import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
+import { type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a

package/dist/config-center/http-client.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/registry-core";
+import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
 export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
     const scheme = new URL(baseUrl).protocol;

package/dist/config-center/restart-signal.js

@@ -1,4 +1,4 @@
-import { resolveActiveTiers } from "@sema-agent/registry-core";
+import { resolveActiveTiers } from "@sema-agent/settings-schema";
 import { RUNTIME_GATE_KEYS, HOT_RUNTIME_GATE_KEYS, runtimeGatePresent, resolveDefaultModelName } from "./apply-effective.js";
 const RESTART_SLICES = ["skills", "mcp", "a2a", "scenarios", "runtime-gates", "models-tiers", "degrade-route", "read-face"];
 function stableStringify(v) {

package/dist/config-center/skills-mcp.js

@@ -1,4 +1,4 @@
-import { skillContentHash } from "@sema-agent/registry-core";
+import { skillContentHash } from "@sema-agent/settings-schema";
 import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } from "../mcp-content-origin.js";
 import { fetchSkillContent } from "./http-client.js";
 import { SHA256_HEX_RE } from "../digest-form.js";

package/dist/config-provider.d.ts

@@ -1,5 +1,5 @@
-import { FileConfigStore } from "@sema-agent/registry-core/node";
-import { type EffectiveConfig as AgentConfigEffective } from "@sema-agent/registry-core";
+import { FileConfigStore } from "@sema-agent/settings-schema/node";
+import { type EffectiveConfig as AgentConfigEffective } from "@sema-agent/settings-schema";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
 /** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).

package/dist/config-provider.js

@@ -1,6 +1,6 @@
 import { createHmac, randomBytes } from "node:crypto";
-import { FileConfigStore } from "@sema-agent/registry-core/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/registry-core";
+import { FileConfigStore } from "@sema-agent/settings-schema/node";
+import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";

package/dist/config-types.d.ts

@@ -1471,7 +1471,7 @@ export interface ServiceConfigFlat {
         worker?: string;
     };
     /** Dual-mode config SOURCE (DUAL-MODE-DESIGN §4): "remote" (sema-registry HTTP) | "local" (.env + config.d
-     *  via @sema-agent/registry-core FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set, else pure-env.
+     *  via @sema-agent/settings-schema FileConfigStore) | unset → remote if SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is set, else pure-env.
      *  Env: CONFIG_PROVIDER. The same resolver/EffectiveConfig either way (can't drift). */
     configProvider?: string;
     /** Root dir holding `config.d/<domain>.json` for the local config source. Env: CONFIG_LOCAL_DIR. */

package/dist/config.js

@@ -3,7 +3,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, compileReadDeny, resolveReadDenyBuiltins, CODE_AGENT_PROMPT, formatUserScope, isThinkingLevel, PROTOCOL_TABLE, protocolOf, RECOMMENDED_SENSITIVE_PATTERNS, RETIRED_TOOL_NAMES, resolveLockedKeys, validatePermissionRules } from "@sema-agent/core";
-import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/registry-core";
+import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
 import { isV2ScopeKey } from "./memory-scope.js";

package/dist/fleet-client.d.ts

@@ -12,7 +12,7 @@
  *    向前合并不会双计 —— 只延迟,不丢量)。
  *  - 全部 fire-and-forget + swallow-guarded:fleet 面是运维旁路,绝不影响任务面;网络错误只 warn 一次/连败类。
  */
-import { UsageReport } from "@sema-agent/registry-core/fleet";
+import { UsageReport } from "@sema-agent/settings-schema/fleet";
 /** Bound on distinct principal×model keys per window — a runaway/multi-tenant burst collapses into
  *  `__other__` instead of growing unbounded (same posture as budget.ts cardinalityGuard). */
 export declare const FLEET_USAGE_KEY_CAP = 1024;

package/dist/fleet-client.js

@@ -1,4 +1,4 @@
-import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/registry-core/fleet";
+import { InstanceAnnouncement, UsageReport, DEFAULT_HEARTBEAT_MS } from "@sema-agent/settings-schema/fleet";
 export const FLEET_USAGE_KEY_CAP = 1024;
 export const FLEET_CLIENT_FETCH_TIMEOUT_MS = 5000;
 export class FleetUsageAccumulator {

package/dist/fleet-lease.d.ts

@@ -23,7 +23,7 @@
  * - 409 判别靠 center 返回的结构化 code(两端常量);center 侧变更时此处同步。
  * - 全部 swallow-guarded:lease 面绝不 fault 任务提交路径。
  */
-import { QuotaLease } from "@sema-agent/registry-core/fleet";
+import { QuotaLease } from "@sema-agent/settings-schema/fleet";
 /** 负缓存 TTL:非 lease-enforced 的 principal 多久后再问一次 center(entitlement 升级为 lease 的收敛上界)。 */
 export declare const NOT_LEASE_TTL_MS: number;
 /** center 判 budget exhausted 后,多久内的重复提交直接拒绝而不再打 center(防 per-request 打爆)。 */

package/dist/fleet-lease.js

@@ -1,4 +1,4 @@
-import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/registry-core/fleet";
+import { QuotaLease, leaseExhausted, shouldRenewLease } from "@sema-agent/settings-schema/fleet";
 export const NOT_LEASE_TTL_MS = 10 * 60 * 1000;
 export const EXHAUSTED_RETRY_MS = 30 * 1000;
 export const LEASE_PRINCIPAL_CAP = 4096;

package/dist/hooks/hook-runner.d.ts

@@ -1,4 +1,4 @@
-import { HooksConfig } from "@sema-agent/registry-core/hooks";
+import { HooksConfig } from "@sema-agent/settings-schema/hooks";
 import type { Hooks } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
 import type { HookNoticeObservation } from "../fleet/fleet-bus.js";

package/dist/hooks/hook-runner.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { hostShell, resolveHostShell } from "../plugins/host-platform.js";
-import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, } from "@sema-agent/registry-core/hooks";
+import { HooksConfig, DEFAULT_HOOK_TIMEOUT_SECONDS, HOOK_EVENT_OWNER, } from "@sema-agent/settings-schema/hooks";
 import { boundedNoticeText } from "../fleet/fleet-bus.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets } from "../trace/redact.js";

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
 import { principalFrom, decodeCheckpointScope, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../../security.js";
 import { verifyDirectDoorProof } from "../../principal-jwt.js";
@@ -30,6 +31,52 @@ export function isQuestionAnswer(v) {
             (note === undefined || typeof note === "string"));
     });
 }
+async function decideIdempotentReplay(cs, args) {
+    const { sessionId, out, binding, decision, payload, deciderPrincipal, explicitOperator, warn } = args;
+    if (out.status !== 404 || out.body.errorCode !== "not_found.approval")
+        return undefined;
+    const boundCallId = binding.boundCallId;
+    if (boundCallId === undefined)
+        return undefined;
+    if (typeof cs.findDecidedApprovalsForBinding !== "function")
+        return undefined;
+    const rows = await cs.findDecidedApprovalsForBinding(sessionId, boundCallId);
+    if (rows.length === 0)
+        return undefined;
+    if (rows.length >= DECIDED_REPLAY_SCAN_CAP) {
+        warn("decide_replay_scan_cap_hit", { sessionId, rows: rows.length });
+        return undefined;
+    }
+    const requestFp = approvalPayloadFingerprint(payload);
+    if (requestFp === null)
+        return undefined;
+    for (const row of rows) {
+        if (row.decision === null)
+            return undefined;
+        if (!explicitOperator) {
+            const owner = decodeCheckpointScope(row.scope);
+            if (owner !== undefined && owner !== deciderPrincipal) {
+                warn("decide_replay_scope_mismatch", { sessionId });
+                return undefined;
+            }
+        }
+        if (row.boundInputHash !== (binding.boundInputHash ?? null))
+            return undefined;
+        if (row.decision !== decision)
+            return undefined;
+        if (row.payloadFp === null || row.payloadFp !== requestFp)
+            return undefined;
+    }
+    return {
+        status: 200,
+        body: {
+            sessionId,
+            idempotent: true,
+            decision,
+            bindingEnforced: true,
+        },
+    };
+}
 export async function handleApprovalsAssistant(req, res, url, ctx) {
     const miss = { fell: false };
     await handleApprovalsAssistantBody(req, res, url, ctx, miss);
@@ -440,6 +487,24 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 }
                 : undefined;
             const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true);
+            const replay = await decideIdempotentReplay(cs, {
+                sessionId,
+                out,
+                binding,
+                decision,
+                payload: {
+                    ...(decision === "approve" && binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
+                    ...(answer !== undefined ? { answer } : {}),
+                    ...(body.reason ? { reason: body.reason } : {}),
+                },
+                deciderPrincipal,
+                explicitOperator,
+                warn: (event, fields) => deps.logger?.warn?.(event, fields),
+            });
+            if (replay !== undefined) {
+                sendResumeOutcome(res, replay, deps.logger);
+                return;
+            }
             sendResumeOutcome(res, out, deps.logger, remember && deps.approvalExemptionStore ? { rememberApplied } : undefined);
             return;
         }

package/dist/http/routes/notify-wake.js

@@ -83,7 +83,7 @@ async function handleNotifyWakeBody(req, res, url, ctx, miss) {
         const liveStream = liveTaskId !== undefined && liveTaskId !== null ? steerableRuns.get(liveTaskId) : undefined;
         if (liveStream) {
             try {
-                await liveStream.notify(payload);
+                await liveStream.notify(payload, { priority: "next" });
                 sendJson(res, 200, { sessionId: notifySession, delivery: "live" });
                 return;
             }

package/dist/http/routes/runs.d.ts

@@ -13,7 +13,7 @@
  * `cancelledViaVerb` first-writer-wins 判别、`steerableRuns` 活流句柄、`wakeParkMints` park 铸造闩)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { ActorAssertionWire } from "@sema-agent/registry-core";
+import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import type { RouteCtx, PreparedTaskSubmission } from "../route-ctx.js";
 export declare const RUN_ID_RE: RegExp;
 export declare const RUN_CANCEL_RE: RegExp;

package/dist/http/routes/runs.js

@@ -23,7 +23,7 @@ import { buildActiveRunConflict } from "../active-run-conflict.js";
 import { clearTurnActivity, readTurnActivityMs } from "../../turn-activity.js";
 import { buildCrossSliceUsage, readResourceWindow, recordResourceWindow } from "../../resource-window.js";
 import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
-import { ActorAssertionWire } from "@sema-agent/registry-core";
+import { ActorAssertionWire } from "@sema-agent/settings-schema";
 import { RUN_NOT_FOUND_MESSAGE, runNotFoundMessage } from "../route-ctx.js";
 export const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
 export const RUN_CANCEL_RE = /^\/v1\/runs\/([^/]+)\/cancel$/;

package/dist/http/routes/tasks.js

@@ -336,7 +336,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         sseData(res, { type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) });
                                     }
                                 },
-                                onTaskNotification: (n) => {
+                                onTaskNotification: (n, opts) => {
                                     if (n.task_type === "workflow")
                                         return;
                                     defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -348,13 +348,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                     const parked = !deliverable && Boolean(deps.workflowCompletionInbox && prepared.spec.sessionId);
                                     deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
                                     if (parked) {
-                                        void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                        void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                                     }
                                     else if (deliverable) {
                                         const key = taskNotificationStreamKey(n);
                                         if (syncNotifiedKeys.get(key) === undefined) {
                                             syncNotifiedKeys.set(key, Promise.resolve(true));
-                                            sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n }) });
+                                            sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
                                         }
                                     }
                                 },

package/dist/http/server.js

@@ -16,7 +16,7 @@ import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId,
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
-import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
+import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { HANDS_BAND_TOOL_NAMES } from "../capabilities/hands-lane.js";
@@ -1249,7 +1249,7 @@ export function createHttpServer(rawDeps) {
                                 void verifySink.appendStatus(e).catch((err) => deps.logger?.warn?.("status_event_append_failed", { route: "resume-verify", taskId, err: err instanceof Error ? err.message : String(err) }));
                             }
                         },
-                        onTaskNotification: (n) => {
+                        onTaskNotification: (n, opts) => {
                             if (n.task_type === "workflow")
                                 return;
                             defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -1260,12 +1260,12 @@ export function createHttpServer(rawDeps) {
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             deps.logger?.info?.("task_notification_observed", { route: "resume-verify", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
                                 const key = taskNotificationStreamKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
-                                    resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n })).then(() => true, () => false));
+                                    resumeNotifiedKeys.set(key, vAppend("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
                             }
                         },
@@ -1376,7 +1376,7 @@ export function createHttpServer(rawDeps) {
                                 void append("tool_end", toolEndEventData(e)).catch(warnAppend(t));
                             }
                         },
-                        onTaskNotification: (n) => {
+                        onTaskNotification: (n, opts) => {
                             if (n.task_type === "workflow")
                                 return;
                             defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -1387,12 +1387,12 @@ export function createHttpServer(rawDeps) {
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
                                 const key = taskNotificationStreamKey(n);
                                 if (resumeNotifiedKeys.get(key) === undefined) {
-                                    resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n })).then(() => true, () => false));
+                                    resumeNotifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                                 }
                             }
                         },

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,3 +1,4 @@
+import type { SystemInjectionPriority } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
  *  redacted + length-bounded by core's notifier seam (see {@link WorkflowCompletionPayload}). */
@@ -262,7 +263,17 @@ export declare function taskNotificationInboxEntry(sessionId: string, owner: str
 /** lead-b (dual-ID audit): the PARENT run's durable taskId (the uuid the shell's footer rows
  *  key on) — rides the drained frame so a consumer can bind the a*-keyed child notification to its uuid-keyed
  *  parent row without a side lookup. */
-parentTaskId?: string): WorkflowCompletionInboxEntry;
+parentTaskId?: string, 
+/**
+ * design/373 §3.6(core 5.61.0,#366 / codex R1[high]):core 在 `onTaskNotification` 的**第二参**上报的
+ * 投递档位。park 是**跨 run** 的那条投递路径 —— 不带过去,档位就在最常走的一条路上恒缺席。
+ *
+ * 🔴 只在 core **真的给了**档位时传:缺席原样缺席(与 live 投影同一条「缺席≠later」纪律)。
+ * 闭集之外的值当作缺席(下面的 `INJECTION_TIERS` 守卫)——durable 载荷更不该出现引擎从没发过的词。
+ * ⚠️ 本仓自己铸的 park(`POST /v1/sessions/:id/notify` 的 idle 半场)**不传**这一位:那条 park 是
+ * 纯展示帧,没有任何引擎侧的档位承诺,填一个词就是凭空铸一条投递声明。
+ */
+priority?: SystemInjectionPriority): WorkflowCompletionInboxEntry;
 /**
  * Resolve WHERE a workflow completion routes (core 1.208): the SESSION comes straight off
  * `originatingSessionId` (the Runner closes over it at RunWorkflow mount — lookup-free). The OWNER comes from,

package/dist/orchestration/workflow-completion-inbox.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readFileSync, existsSync, openSync, writeSync, fsyncSync, closeSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
+import { injectionTierOrAbsent } from "../trace/injection-tier.js";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -288,10 +289,14 @@ export async function emitPendingWorkflowCompletions(inbox, sessionId, callerPri
         }
     }
 }
-export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, parentTaskId) {
+export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, parentTaskId, priority) {
     const cap = (s, max) => (s.length > max ? `${s.slice(0, max)}…[+${s.length - max} chars]` : s);
     const extras = {
         task_type: n.task_type,
+        ...(() => {
+            const tier = injectionTierOrAbsent(priority);
+            return tier !== undefined ? { priority: tier } : {};
+        })(),
         ...(parentTaskId ? { parentTaskId } : {}),
         ...(n.sessionId ? { sessionId: n.sessionId } : {}),
         ...(n.toolUseId ? { toolUseId: n.toolUseId } : {}),

package/dist/org-memory-admission.js

@@ -1,4 +1,4 @@
-import { PrincipalOrgMemoryWire } from "@sema-agent/registry-core";
+import { PrincipalOrgMemoryWire } from "@sema-agent/settings-schema";
 import { assertPrincipalShape } from "./security.js";
 const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const ORG_SCOPE_RE = /^org:\S+$/;

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,6 +1,6 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import { type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
+import { type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
 import { type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDriver } from "./sql-driver.js";
 /**
@@ -175,6 +175,80 @@ export interface CheckpointAskCandidate {
     /** 在场 ⇒ 这行读不出(blob 版本超前 / JSON 坏)。收敛器视同不匹配;**从不是** false,缺席即可读。 */
     unparseable?: true;
 }
+/**
+ * #368 件1 —— legacy `/v1/approvals/:sessionId/decide` 腿的**幂等回放**判别行(窄读,非凭据面)。
+ *
+ * 刻意**不带 token**:回放只需要「这条已决的行归谁、绑的是哪一次调用、判词是什么」三件,而 token 是
+ * resume 凭据(§12-C「checkpointToken 从不外发」;`CheckpointAskCandidate` 带它是因为收敛器要拿它去
+ * `bindBatch`,本口没有那个用途 ⇒ 不给)。
+ */
+export interface DecidedApprovalRecord {
+    /** 行的属主 scope 列(`encodeCheckpointScope` 的产物:principal 或匿名哨兵 `"_"`)。回放属主门的输入。 */
+    scope: string;
+    /** 行上的 D-1 入参摘要(`bound_input_hash` 列);pre-D-1 行为 null。 */
+    boundInputHash: string | null;
+    /**
+     * 这条已决行的**工具审批判词**,或 `null` = **判别不出**(codex R1-[medium] 四的收敛形):
+     * outcome 读不出 / 没有 winner / winner 绑的是**另一个** callId / 判词是 REVIEW 门那三个词。
+     *
+     * 🔴 `null` **不是**「无所谓」:调用方必须把它当「这条命中的行我读不懂」⇒ **整次回放拒绝**。
+     * 一条读不懂的已决行与一条判词相反的已决行在风险上同级 —— 都意味着这只 callId 上的持久事实
+     * 不是本次回放能如实复述的。
+     */
+    decision: "approve" | "deny" | null;
+    /**
+     * 判词**之外**的决议载荷指纹(codex R2-[high] 一,验真后补):`updatedInput` / `answer` / `reason`
+     * 三件都在 core 的持久 winner 里,而**同判词不等于同决议** —— 「approve + 编辑后的实参 A」与
+     * 「approve + 实参 B」是两次不同的放行,只比判词就会把后者谎报成「你的请求已被处理」(而 B 从未执行)。
+     * 调用方按**同一份请求重发**的语义要求它与本次请求的同三件逐字相等。
+     * `null` = 算不出(载荷序列化不了)⇒ 与 `decision: null` 同判:整次拒绝。
+     * 铸法见 {@link approvalPayloadFingerprint}(两条车道共用同一只,免得指纹口径漂)。
+     */
+    payloadFp: string | null;
+}
+/**
+ * #368 件1(codex R2-[high] 一)—— 决议载荷的比对指纹:`[updatedInput, answer, reason]` 三件的规范串。
+ *
+ * 为什么是指纹而不是把三件原样交出来:`updatedInput` 可能携人写的命令原文/密钥形字节,而本读口的
+ * 契约是「窄读、非凭据面」—— 交指纹够比对,也不给任何调用点把它误投上 wire 的机会。
+ *
+ * 🔴 **必须是 canonical(键序无关)**,不是裸 `JSON.stringify`(codex R3-[high] 二,验真后修):行侧那份
+ * 载荷是从 `JSON`/`JSONB` 列**回读**的,而 **PG 的 jsonb 不保留输入键序**(它按自己的规则重排)⇒ 客户端
+ * 逐字重发原 body 时,请求侧按原键序、行侧按库的键序,裸 stringify 出来的两串不等 ⇒ 一次**合法重试**
+ * 被误拒成 404。方向虽保守(不是谎报成功),但那正是本件要修的那个场景,所以指纹按**递归键排序 +
+ * 数组保序**铸(见 {@link canonicalFingerprintJson})。
+ *
+ * 缺席一律折 `null` 哨兵(不是省位):`{updatedInput: undefined}` 与「没有这个键」在本比对里是同一件事。
+ * ⚠️ 调用方**必须**按 outcome 铸点的在场规则喂参(`updatedInput` 只在 approve 上、`reason` 走真值判)——
+ * 铸点丢掉的字节行上就没有,请求侧多喂一件会把一次合法重试误判成「不同的决议」。
+ * 序列化失败(循环引用/BigInt 等)⇒ `null` = 判别不出,调用方据此拒绝回放(fail-closed)。
+ */
+export declare function approvalPayloadFingerprint(v: {
+    updatedInput?: unknown;
+    answer?: unknown;
+    reason?: string;
+}): string | null;
+/**
+ * #368 件1 —— {@link SqlCheckpointStore.findDecidedApprovalsForBinding} 的扫描上界。
+ *
+ * 🔴 它**同时是判据**,不只是一道 LIMIT:调用方按「命中集里每条判词都一致才回放」判,而一次被截断的
+ * 集合可能把分歧藏在第 N+1 行 ⇒ 消费点约定「**回满 = 判别不出**」,整次拒绝回放(回落 404)。现网正常形
+ * 恒 0 或 1 行,回满只可能是数据异常。
+ */
+export declare const DECIDED_REPLAY_SCAN_CAP = 8;
+/**
+ * #368 件1 —— core 的 `ResolvedOutcome` → 本腿(工具审批 decide)的二值词表。**闭集穷举**(#157):
+ * core 哪天给 `ResolvedOutcome.decision` 加员,下面的 `never` 当场编译期红,而不是让一个新判词被
+ * 静默折成 `deny` 或漏成「没有决议」。
+ *
+ * 三条判据,缺一即 `null`(= 不回放,调用方逐字回落修前 404 —— **绝不**把 not-found 洗成成功):
+ *  ① 有 winner —— `resource_limit` / `wake` / `task_done` 的 resolve 不记 winner(core 契约),那些行
+ *     不是「一次人给的工具审批」,没有可回放的判词;
+ *  ② winner 绑的正是这次请求回显的那个 `boundCallId` —— 身份第二锚(列谓词是第一锚),两锚同意才算同一件事;
+ *  ③ 判词属于**工具审批**那两个词(`allow`/`deny`)—— `approve`/`reject`/`edit` 是 REVIEW 门
+ *     (plan_review / dry_run_review)的判词,那些门的决议入口不是本腿,回放它们等于跨门作答。
+ */
+export declare function approvalDecisionOfWinner(winner: ResolvedOutcome | undefined, boundCallId: string): "approve" | "deny" | null;
 /** `pending_steer` 列承载的两个 CheckpointState 字段(= core `appendPendingSteer` / `readPendingSteerQueue`
  *  的入参形)。列是**唯一**权威(suspend 时写的 blob 从不带它们)。 */
 type SteerColumnState = Pick<CheckpointState, "pendingSteer" | "pendingSteerQueue">;
@@ -431,6 +505,39 @@ export declare class SqlCheckpointStore implements CheckpointStore {
      * 维,列命中行结构上也必须解 blob 才拿得到它。
      */
     findCheckpointCandidatesForAsk(scope: string, sessionId: string, toolCallId: string, sinceMs: number): Promise<CheckpointAskCandidate[]>;
+    /**
+     * #368 件1 —— 「这条会话上的这一次工具调用,**是不是已经被决过了**?」的窄读口(legacy `/decide`
+     * 腿的幂等回放判别器;返回形见 {@link DecidedApprovalRecord})。
+     *
+     * 为什么必须有这一口(而不是复用 `findPendingTokenBySession`):后者硬 `status='pending'`,首决之后
+     * 恒 null ⇒ 重试与「压根没有这条审批」在 wire 上同形(404)。而合规客户端的重试体里**没有**
+     * checkpointToken(它只回显二元组),所以既有的 `approval_stale` 409 那条判别路对它结构性不可达。
+     *
+     * 四条口径,逐条都是判据:
+     *  · **谓词 = (session_id, tool_call_id, status='resolved')**:`tool_call_id` 列是 `put()` 从
+     *    `pendingAction.toolCallId` 盖下来的权威投影,也正是 listPending 交给客户端回显的 `boundCallId`
+     *    ⇒ 客户端手里那把与库里这一列同源。`(session_id, status)` 是既有索引 `idx_checkpoint_session_status`
+     *    的前缀,不新增索引面。
+     *  · **只认 `resolved`**:`expired`(窗到期被 reaper 抹掉)**不是**一次决议 —— 把它回放成
+     *    「已决」等于把「没人来得及答」谎报成「有人答过」。那一形照旧落 404(诚实缺席)。
+     *  · **`decided_at_ms IS NOT NULL`**:与 respond 腿 `decidedRowIsAuthoritative` 的合取项③同判据
+     *    (「这条决议真的被结算腿落过」的印记);顺带消掉 MySQL/PG 对 `ORDER BY … DESC` 里 NULL 排序
+     *    方向不同这个方言差(MySQL NULL 最后、PG NULL 最前)—— 谓词先滤掉,排序就不含 NULL。
+     *  · **不带 scope 谓词、由调用方判属主**:与本类 `findPendingTokenBySession` 同姿势(读口不做租户
+     *    判决,判决在调用点)。回放腿据返回的 `scope` 做与 pending 那道**逐字同判**的属主门,非属主
+     *    拿到的仍是 404(不给存在性谕示)。
+     *
+     * 🔴 **返回的是全部命中行,不是「最近那一条」**(codex R1-[medium] 四,验真后改向):本口原先按
+     * `decided_at_ms DESC LIMIT 1` 取「最近一次决议」,而 local 孪生手里根本没有这个时间戳(core 的
+     * `Checkpoint` 上没有 decidedAt 字段),它只能按 `createdAt` 排 —— 两条车道于是可能对**同一批行**给出
+     * **不同**的判词(创建序与决议序相反时)。判据因此改成一条与排序**无关**的:调用方要求**全部命中行
+     * 判词一致**才回放,分歧即拒。同毫秒并列、两方言 NULL 排序差、跨车道排序键不同 —— 三个问题一起消失,
+     * 而现网正常形(恒 0 或 1 行)一个字节不变。上限 8 行足够:超过它的形已经不是「重试」而是数据异常。
+     *
+     * 坏 `outcome` cell **不抛**:回放是一条锦上添花的腿,让一条读不出的 JSON 把一次 decide 重试变成 500
+     * 比 404 更坏。留痕后交出 `decision: null`(= 判别不出),由调用方按「整次拒绝」处置。
+     */
+    findDecidedApprovalsForBinding(sessionId: string, boundCallId: string): Promise<DecidedApprovalRecord[]>;
     /**
      * The owner SCOPE of a session's pending checkpoint (the multi-tenant key === the owner principal in the
      * BFF/non-operator flow, the same key listPending filters by). For the /decide owner-gate: a non-operator

package/dist/plugins/checkpoint-store-sql.js

@@ -4,10 +4,12 @@ import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendi
 import { redactDeep, redactSecrets } from "../trace/redact.js";
 import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema } from "../approval-card.js";
 import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
+import { createLogger } from "../observability/logger.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 import { MANAGED_RETENTION } from "./retention-store-sql.js";
+const fingerprintLogger = createLogger();
 const MAX_TOOL_INPUT_CHARS = 8192;
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, (Number.isFinite(Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS)) ? Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) : 0) || 30 * 86_400_000);
 export const TERMINAL_GRACE_MS = 3_600_000;
@@ -79,6 +81,48 @@ export function boundedToolInput(args) {
         return { truncated: true, bytes: json.length };
     return redacted;
 }
+function canonicalFingerprintJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(canonicalFingerprintJson).join(",")}]`;
+    const entries = Object.entries(v)
+        .filter(([, val]) => val !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, val]) => `${JSON.stringify(k)}:${canonicalFingerprintJson(val)}`).join(",")}}`;
+}
+export function approvalPayloadFingerprint(v) {
+    try {
+        const fp = canonicalFingerprintJson([v.updatedInput ?? null, v.answer ?? null, v.reason ?? null]);
+        return fp;
+    }
+    catch (e) {
+        fingerprintLogger.warn("approval decision payload is not serializable — idempotent replay refused", { error: e instanceof Error ? e.message : String(e) });
+        return null;
+    }
+}
+export const DECIDED_REPLAY_SCAN_CAP = 8;
+export function approvalDecisionOfWinner(winner, boundCallId) {
+    if (winner === undefined)
+        return null;
+    if (winner.boundCallId !== boundCallId)
+        return null;
+    switch (winner.decision) {
+        case "allow":
+            return "approve";
+        case "deny":
+            return "deny";
+        case "approve":
+        case "reject":
+        case "edit":
+            return null;
+        default: {
+            const unhandled = winner.decision;
+            void unhandled;
+            return null;
+        }
+    }
+}
 function pendingActionToolCallId(blob) {
     let parsed;
     try {
@@ -429,6 +473,27 @@ export class SqlCheckpointStore {
         }
         return out;
     }
+    async findDecidedApprovalsForBinding(sessionId, boundCallId) {
+        const { rows } = await this.db.query(this.q("SELECT scope, bound_input_hash, outcome FROM checkpoint " +
+            `WHERE session_id=? AND tool_call_id=? AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`, "SELECT scope, bound_input_hash, outcome FROM checkpoint " +
+            `WHERE session_id=$1 AND tool_call_id=$2 AND status='resolved' AND decided_at_ms IS NOT NULL ORDER BY decided_at_ms DESC LIMIT ${DECIDED_REPLAY_SCAN_CAP}`), [sessionId, boundCallId]);
+        return rows.map((r) => {
+            let winner;
+            try {
+                const outcome = parseJson(r.outcome);
+                winner = outcome ? winnerFromOutcome(outcome) : undefined;
+            }
+            catch (e) {
+                this.logger?.info?.("checkpoint_decided_outcome_unreadable", { sessionId, error: e instanceof Error ? e.message : String(e) });
+            }
+            return {
+                scope: String(r.scope),
+                boundInputHash: r.bound_input_hash == null ? null : String(r.bound_input_hash),
+                decision: approvalDecisionOfWinner(winner, boundCallId),
+                payloadFp: winner === undefined ? null : approvalPayloadFingerprint(winner),
+            };
+        });
+    }
     async peekPendingScope(sessionId) {
         const { rows } = await this.db.query(this.q("SELECT scope FROM checkpoint WHERE session_id=? AND status='pending' LIMIT 1", "SELECT scope FROM checkpoint WHERE session_id=$1 AND status='pending' LIMIT 1"), [sessionId]);
         if (!rows[0])

package/dist/plugins/local-checkpoint-store.d.ts

@@ -1,5 +1,5 @@
 import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ReopenReason, type ResolveExpectation, type ResumeOutcome, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
-import { type PendingCheckpoint } from "./checkpoint-store-sql.js";
+import { type DecidedApprovalRecord, type PendingCheckpoint } from "./checkpoint-store-sql.js";
 export interface LocalCheckpointStoreOptions {
     /** taskId join for the pending card (the local FileRunStore's `getActiveTaskId`). Absent ⇒ `taskId: null`. */
     getActiveTaskId?: (sessionId: string) => Promise<string | undefined>;
@@ -91,6 +91,19 @@ export declare class LocalCheckpointStore {
      *  索引里,其 expired 对本探针不可见(core File store 的 listByScope 是 pending-only,无法枚举历史行回填)。
      *  旧存量锁死的恢复把手 = cancel verb([868]①,不依赖本索引);增量行全覆盖。 */
     hasExpiredBySession(sessionId: string): Promise<boolean>;
+    /**
+     * #368 件1 —— SQL 孪生 `findDecidedApprovalsForBinding` 的本地形(判据、词表、失败方向逐条同源;
+     * 那处顶注是唯一真源,这里只记两处**本地形自己的**差别)。
+     *
+     *  · 枚举面走 [868] 的 `sessionTokens` 索引 —— 与 `hasExpiredBySession` 同一条路(core 的 File store
+     *    只能 pending-only 枚举,跨态读只有 `get(token)`),所以它那条**存量限制**在这里逐字同样成立:
+     *    索引建立之前 park 的老行对本口不可见 ⇒ 回放判别不出 ⇒ 调用方逐字回落 404(保守方向)。
+     *  · **没有排序**:本口交出全部命中行,由调用方按「判词一致才回放」判(理由见 SQL 孪生顶注的
+     *    codex R1-[medium] 四段——正是为了消掉「local 只有 createdAt、SQL 有 decided_at_ms」这条排序键
+     *    分岔)。同理回放的 wire 形**刻意不投** `decidedAtMs`:core 的 `Checkpoint` 上没有那个字段,
+     *    投了就是「SQL 车道有、local 车道没有」的键集分岔。
+     */
+    findDecidedApprovalsForBinding(sessionId: string, boundCallId: string): Promise<DecidedApprovalRecord[]>;
     /** `undefined` = no pending row; else the owner scope (local scopes are always strings — never null). */
     peekPendingScope(sessionId: string): Promise<string | null | undefined>;
     /**

package/dist/plugins/local-checkpoint-store.js

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSyn
 import { join } from "node:path";
 import { isApprovalGateKind } from "../tool-approval.js";
 import { FileCheckpointStore, atomicWriteFile, sanitizePathComponent, } from "@sema-agent/core";
-import { boundedRuleOffers, boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
+import { approvalDecisionOfWinner, approvalPayloadFingerprint, boundedRuleOffers, boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 import { UNMANAGED_RETENTION } from "./retention-store-sql.js";
 function terminalAtOf(cp) {
     return Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS);
@@ -195,6 +195,27 @@ export class LocalCheckpointStore {
         }
         return false;
     }
+    async findDecidedApprovalsForBinding(sessionId, boundCallId) {
+        const tokens = this.sessionTokens.get(sessionId);
+        if (!tokens)
+            return [];
+        const out = [];
+        for (const t of [...tokens]) {
+            const cp = await this.inner.get(t);
+            if (!cp || cp.status !== "resolved")
+                continue;
+            const pa = cp.pendingAction;
+            if (pa?.toolCallId !== boundCallId)
+                continue;
+            out.push({
+                scope: cp.scope,
+                boundInputHash: pa?.boundInputHash ?? null,
+                decision: approvalDecisionOfWinner(cp.resolvedOutcome, boundCallId),
+                payloadFp: cp.resolvedOutcome === undefined ? null : approvalPayloadFingerprint(cp.resolvedOutcome),
+            });
+        }
+        return out;
+    }
     async peekPendingScope(sessionId) {
         for (const { cp } of await this.pendings())
             if (cp.sessionId === sessionId)

package/dist/plugins/scheduler-support.d.ts

@@ -1,6 +1,6 @@
 import { SchedulerError } from "@sema-agent/core";
 import type { SchedulerCapability, ScheduledIntent, SchedulerContext, ScheduledTaskId, ScheduledTaskSummary } from "@sema-agent/core";
-import type { SchedulerRecord } from "@sema-agent/registry-core/scheduler-store";
+import type { SchedulerRecord } from "@sema-agent/settings-schema/scheduler-store";
 export type { SchedulerRecord };
 /** core `Result<T,E>` shape (harness/types) — `{ok:true,value} | {ok:false,error}`. */
 type Result<T, E> = {

package/dist/plugins/scheduler-support.js

@@ -2,7 +2,7 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { randomBytes, createHash } from "node:crypto";
 import { SchedulerError, isValidCronExpr } from "@sema-agent/core";
-import { loadSchedulerStore, saveSchedulerStore } from "@sema-agent/registry-core/node";
+import { loadSchedulerStore, saveSchedulerStore } from "@sema-agent/settings-schema/node";
 const ok = (value) => ({ ok: true, value });
 const err = (error) => ({ ok: false, error });
 export const DEFAULT_SCHEDULER_CAPS = {

package/dist/run-local.js

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
-import { loadRemoteExec } from "@sema-agent/registry-core/node";
+import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { Runner, uuidv7, parseModelMention, AdoptionError, FileStorageBackend, NodeExecutionEnv, NodeLspManager, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore } from "@sema-agent/core";
 import { hasOperatorGateIntent } from "./approval.js";
 import { createBrain } from "./brain.js";

package/dist/runs.js

@@ -252,7 +252,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                         }
                     }
                 },
-                onTaskNotification: (n) => {
+                onTaskNotification: (n, opts) => {
                     if (n.task_type === "workflow")
                         return;
                     defaultSubagentTailBus.forgetHandleContentMode(n.task_id);
@@ -263,12 +263,12 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                     const parked = !legLive && Boolean(workflowCompletionInbox && spec.sessionId);
                     completionDiagLog?.("task_notification_observed", { route: "bg-run-start", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive, parkedDurable: parked });
                     if (parked) {
-                        void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                        void workflowCompletionInbox.enqueue(taskNotificationInboxEntry(spec.sessionId, elicitOwner ?? owner, n, Date.now(), taskId, opts?.priority)).catch((err) => completionDiagLog?.("park_enqueue_failed", { route: "bg-run-start", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                     }
                     else if (legLive) {
                         const key = taskNotificationStreamKey(n);
                         if (notifiedKeys.get(key) === undefined) {
-                            notifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n })).then(() => true, () => false));
+                            notifiedKeys.set(key, append("task_notification", taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) })).then(() => true, () => false));
                         }
                     }
                 },

package/dist/runtime-caps-resolver.d.ts

@@ -27,7 +27,7 @@
  * this seam feeds the ENGINE, and `allowUltracode` is enforced at the service settings-resolution layer, not here.
  */
 import type { RuntimeCaps } from "@sema-agent/core";
-import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
+import type { EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./config-center/facade.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
 import type { ServiceConfig } from "./config-types.js";

package/dist/runtime-governance.d.ts

@@ -1,6 +1,6 @@
 /**
  * Runtime governance compiler — the "second baton" (center §10, core 1.114.0): turn the
- * operator's declarative `runtime.autonomy` + `runtime.commandPolicy` (`@sema-agent/registry-core`,
+ * operator's declarative `runtime.autonomy` + `runtime.commandPolicy` (`@sema-agent/settings-schema`,
  * carried to the service via sema-registry `EffectiveConfig.runtime`) into TIGHTEN-ONLY overrides on the
  * per-task `TaskSpec`. Pure so it is unit-testable in isolation (the spec is otherwise assembled inside
  * main.ts's `resolveSpec`).

package/dist/task-settings.d.ts

@@ -36,7 +36,7 @@
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
 import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider } from "@sema-agent/core";
-import type { HooksConfig } from "@sema-agent/registry-core/hooks";
+import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
 /** The permission MODE a client may request (SDK `SettingsPermissions.defaultMode`), the [820]/[822] five-word
  *  table. ⚠️ This is a DELIBERATE deployment set, NOT a copy of any CC set (A-065 P2-1 corpus check): CC's own
  *  full enum is SIX words (= ours + `dontAsk`), CC's managed/remote form accepts FOUR (= ours − `bypassPermissions`,

package/dist/trace/engine-notice-wire.d.ts

@@ -1,10 +1,20 @@
 /**
- * 上 wire 的通告码 —— **显式闭集常量表**(设计稿 ①,起步三码)。
+ * 上 wire 的通告码 —— **显式闭集常量表**(设计稿 ①,起步三码;今天九码)。
  *
- * 三码同族:都是「这条 session 的记忆姿态」的披露,resume 之后仍然相关 ⇒ 也进 durable 账本
+ * 起步的那六码同族:都是「这条 session 的记忆姿态」的披露,resume 之后仍然相关 ⇒ 也进 durable 账本
  * (cli 断连补看走既有 events 重放腿,[4634](ii))。
+ *
+ * ⚠️ **自 #366(core 5.61.0)起本表不再是单一族**:`task.turn_interrupted` 与 `task.user_*_undrained`
+ * 两族是前三条**非记忆面**的成员(前者=一次插话真的切断了在飞的 turn;后两者=用户的输入被彻底丢弃)。
+ * 判据没有变(受众 × 投递可行性 × 去重单位三条合取,见顶注),变的只是「碰巧六条都是记忆码」这个
+ * 事实——别再把「是不是记忆姿态码」当成入册的隐性第四条判据。这条隐性判据正是 `task.user_*_undrained`
+ * 两码在明拒表里陈腐多时的帮凶之一(见它们的键注)。
+ *
+ * 🔴 **表长了就得同步三处**(#366 实测,少一处即门红):`test/engine-notice-wire.test.ts` 的闭集 pin、
+ * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
+ * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "task.user_steer_undrained", "task.user_followup_undrained"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -7,6 +7,9 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "memory.hold_opened",
     "memory.hold_released",
     "memory.hold_disposed",
+    "task.turn_interrupted",
+    "task.user_steer_undrained",
+    "task.user_followup_undrained",
 ];
 const WIRE_CODES = new Set(ENGINE_NOTICE_WIRE_CODES);
 export function isEngineNoticeWireCode(code) {

package/dist/trace/injection-tier.d.ts

@@ -0,0 +1,33 @@
+/**
+ * design/373 注入档位(core 5.61.0)的**闭集单点**(#366)。
+ *
+ * ## 为什么本仓要自己留一份词表
+ * 理想写法是复用 core 的谓词 `isSystemInjectionPriority` / 数据表 `SYSTEM_INJECTION_PRIORITIES`。
+ * 但 core 5.61.0 **没有把它们放进根 barrel**(`dist/index.d.ts` 只导出了 `SystemInjectionPriority`
+ * 这个**类型**),而 `@sema-agent/core` 的 `package.json#exports` 只开了 `.` / `./bench` / `./fixtures`
+ * 三口 ⇒ 深导入被 exports map 关死,结构上够不着运行期的那份。
+ *
+ * 于是用本仓既有的**双向锚**姿势(`http/routes/notify-wake.ts` 的 `NOTIFY_STATUSES` 先例):
+ *  · `satisfies` 管「表内不许有词表外的词」—— core 删/改档位 ⇒ 编译红;
+ *  · 穷举断言管「词表不许有表外的词」—— core 加档位 ⇒ 编译红。
+ * 两条合起来 = 上游任何一侧的增删都在编译期被逼着处置,而不是运行时静默漂。
+ *
+ * ## 为什么单独一个叶子模块
+ * 消费点有两个且分属两条依赖链:`trace/project.ts`(wire 投影)与
+ * `orchestration/workflow-completion-inbox.ts`(durable park 载荷)。手抄两份就是值拷贝漂移源
+ * (本仓 [1532] 起的老病族);把它挂在任一方又会在两条链之间拉一条没必要的边。零依赖叶子最干净。
+ *
+ * 🔴 上游哪天补了根导出:删掉本文件,两处改成一行谓词调用。
+ */
+import type { SystemInjectionPriority } from "@sema-agent/core";
+/** 三档闭集,与 core `SystemInjectionPriority` 双向锚(见顶注)。 */
+export declare const INJECTION_TIERS: readonly ["now", "next", "later"];
+/**
+ * 边界守卫 —— 闭集内的值原样返回,**其余一律 `undefined`**(= 缺席)。
+ *
+ * 🔴 方向是**丢键**而不是补默认:core 的键注逐字写着「ABSENT is a fact, not a default …… never read
+ * absence as `"later"`」。一个闭集外的值意味着上游发了一个我们不认识的档位,这时候把它原样推上 wire
+ * 是在替上游对消费端做承诺,补一个默认则是把「不可知」洗成一条断言 —— 两者都比「说没有」更坏。
+ */
+export declare function injectionTierOrAbsent(value: unknown): SystemInjectionPriority | undefined;
+//# sourceMappingURL=injection-tier.d.ts.map

package/dist/trace/injection-tier.js

@@ -0,0 +1,7 @@
+export const INJECTION_TIERS = ["now", "next", "later"];
+const _injectionTierExhaustive = true;
+void _injectionTierExhaustive;
+export function injectionTierOrAbsent(value) {
+    return typeof value === "string" && INJECTION_TIERS.includes(value) ? value : undefined;
+}
+//# sourceMappingURL=injection-tier.js.map

package/dist/trace/project.d.ts

@@ -12,7 +12,7 @@
  * old session-join `toolOutput` hook is gone, there's a real source now); `eventId`/`parentToolCallId` (§E2) ride
  * each content event, additive / tolerate-absent.
  */
-import type { ApprovalSettledBy, TaskResult } from "@sema-agent/core";
+import type { ApprovalSettledBy, TaskResult, SystemInjectionPriority } from "@sema-agent/core";
 import { type AskDenyResolution } from "@sema-agent/core";
 import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
@@ -212,6 +212,10 @@ export declare function taskNotificationEventData(ev: {
     };
     eventId?: string;
     parentToolCallId?: string;
+    /** design/373 §3.6(core 5.61.0,additive):本帧**投出去时的注入档位**。见下方投影处的键注 —— 它是
+     *  **事件顶层**键,不是 {@link TaskNotificationPayload} 的键,所以只有把整只 core 事件交给本投影的腿
+     *  拿得到它;只拿到载荷的 park-drain 腿结构上没有这一位。 */
+    priority?: SystemInjectionPriority;
 }): Record<string, unknown>;
 /** The `compacted` payload — EXPLICIT WHITELIST shared by all three legs (bg runs.ts + resume append + the sync
  *  live SSE frame; the 1.72 task_progress lesson: never `{...ev}`). trigger/tokensBefore (MF-18) verbatim;

package/dist/trace/project.js

@@ -1,5 +1,6 @@
 import { isApprovalSettledBy, isAskDenyResolution } from "@sema-agent/core";
 import { redactSecrets, redactDeep } from "./redact.js";
+import { injectionTierOrAbsent } from "./injection-tier.js";
 export async function appendModelUsageDelta(append, modelUsage, taskId) {
     const delta = modelUsage?.drain(taskId);
     if (delta) {
@@ -141,6 +142,10 @@ export function taskNotificationEventData(ev) {
         ...(n.result !== undefined ? { result: redactSecrets(n.result) } : {}),
         ...(n.output_file !== undefined ? { output_file: redactSecrets(n.output_file) } : {}),
         ...(n.usage !== undefined ? { usage: n.usage } : {}),
+        ...(() => {
+            const tier = injectionTierOrAbsent(ev.priority);
+            return tier !== undefined ? { priority: tier } : {};
+        })(),
         ...identityFields(ev),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.48.0",
+  "version": "7.49.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,8 +54,8 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.60.1",
-    "@sema-agent/registry-core": "^0.19.0",
+    "@sema-agent/core": "^5.61.0",
+    "@sema-agent/settings-schema": "^1.0.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",