@sema-agent/server 7.54.0 → 7.56.0

package/dist/tool-approval.js

@@ -1,3 +1,4 @@
+import { contentKindOf } from "./approval-content-kind.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { uuidv7, MAX_RULE_TEXT_CHARS } from "@sema-agent/core";
 import { precheckCardRuleText } from "./rules-consent.js";
@@ -8,6 +9,7 @@ import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
 import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readProbeCause, readRuleEvidence, readRuleOffersAbsence, } from "./approval-card.js";
+import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
@@ -21,8 +23,6 @@ const DEFAULT_UNREACHED_ASK_TTL_MS = 60 * 60_000;
 const SUSPENDED_POLL_MAX_PER_TICK = 64;
 const SUSPENDED_POLL_BUDGET_MS = 5_000;
 const EDITED_DECISION_MARK_CAP_MS = 10_000;
-const ABANDONED_EDIT_TOMBSTONE_TTL_MS = 10 * 60_000;
-const ABANDONED_EDIT_TOMBSTONE_MAX = 256;
 const DEFAULT_WINDOW_MARGIN_MS = 10_000;
 const MAX_ALLOW_SESSIONS = 4096;
 const DEFAULT_ADMIT_MAX_PER_TASK = 32;
@@ -43,9 +43,12 @@ function durableRuleMaterial(material) {
     return { ruleCommand: material.command, ruleScopeRoot: material.scopeRoot ?? null };
 }
 export const ASK_DECISION_CONSUMER_ABSENT = "absent";
+const MAX_INFLIGHT_TERMINAL_CLAIMS = 2;
 const DURABLE_CONVERGE_BACKOFF_MS = [50, 100, 200, 400, 800, 1600];
 const DURABLE_CONVERGE_READ_TIMEOUT_MS = 2_000;
 const DURABLE_CALL_TIMEOUT_MS = 5_000;
+const TERMINAL_LADDER_WALL_MS = DURABLE_CALL_TIMEOUT_MS + DURABLE_CONVERGE_READ_TIMEOUT_MS + DURABLE_CONVERGE_BACKOFF_MS.reduce((a, b) => a + b, 0);
+const TERMINAL_CLAIM_CAP_POLL_MS = 50;
 function ambiguousCasFailOpenTag(intent) {
     switch (intent) {
         case "expire":
@@ -228,6 +231,30 @@ function settleArgsOf(outcome) {
 export class ToolApprovalCoordinator {
     als = new AsyncLocalStorage();
     pending = new Map();
+    terminalClaimsInFlight = new Map();
+    admitTerminalClaim(askId) {
+        const n = this.terminalClaimsInFlight.get(askId) ?? 0;
+        if (n >= MAX_INFLIGHT_TERMINAL_CLAIMS)
+            return undefined;
+        this.terminalClaimsInFlight.set(askId, n + 1);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const cur = this.terminalClaimsInFlight.get(askId) ?? 0;
+            if (cur <= 1)
+                this.terminalClaimsInFlight.delete(askId);
+            else
+                this.terminalClaimsInFlight.set(askId, cur - 1);
+        };
+    }
+    terminalClaimsInFlightCount(askId) {
+        return this.terminalClaimsInFlight.get(askId) ?? 0;
+    }
+    terminalClaimsInFlightForTest(askId) {
+        return this.terminalClaimsInFlightCount(askId);
+    }
     pendingByAskId = new Map();
     allowAllSessions = new Set();
     streams = new Map();
@@ -241,7 +268,6 @@ export class ToolApprovalCoordinator {
     admitByOwner = new Map();
     suspendedPollOffset = 0;
     editedDecisionsInFlight = new Map();
-    abandonedEditedDecisions = new Map();
     storeErrorWarned = false;
     storeErrorTally = 0;
     governanceAskMarks;
@@ -253,6 +279,7 @@ export class ToolApprovalCoordinator {
     parkTombstoneTtlMs;
     parkTombstonePerPrincipalMax;
     parkedRedeem;
+    askAudit;
     constructor(opts) {
         this.ruleConsent = opts?.ruleConsent;
         this.ruleScopeRootFor = opts?.ruleScopeRootFor;
@@ -268,6 +295,7 @@ export class ToolApprovalCoordinator {
         this.parkTombstoneMax = opts?.parkTombstoneMax ?? DEFAULT_PARK_TOMBSTONE_MAX;
         this.parkTombstoneTtlMs = opts?.parkTombstoneTtlMs ?? DEFAULT_PARK_TOMBSTONE_TTL_MS;
         this.parkTombstonePerPrincipalMax = opts?.parkTombstonePerPrincipalMax ?? DEFAULT_PARK_TOMBSTONE_PER_PRINCIPAL_MAX;
+        this.askAudit = opts?.askAudit;
     }
     unattendedOutcome() {
         return this.unattendedPolicy === "deny" ? false : "unavailable";
@@ -454,23 +482,30 @@ export class ToolApprovalCoordinator {
             return false;
         }
     }
-    async readRowForRecovery(askId, where) {
-        if (!this.askStore)
-            return { kind: "absent" };
+    async probeRowWhileYielding(askId, budgetMs) {
+        if (!this.askStore || budgetMs <= 0)
+            return { kind: "none" };
+        const release = this.admitTerminalClaim(askId);
+        if (release === undefined)
+            return { kind: "denied" };
+        const raw = this.askStore.getAsk(askId);
+        void raw.then(release, release);
         let row;
         try {
-            row = await this.withStoreDeadline(this.askStore.getAsk(askId), `getAsk(${where})`, DURABLE_CONVERGE_READ_TIMEOUT_MS);
+            row = await this.withStoreDeadline(raw, "getAsk(yield-probe)", Math.min(DURABLE_CONVERGE_READ_TIMEOUT_MS, budgetMs));
         }
         catch (err) {
-            this.noteStoreError(err, `getAsk(${where})`);
-            return { kind: "unreadable" };
+            this.noteStoreError(err, "getAsk(yield-probe)");
+            return { kind: "none" };
         }
-        if (row === null)
+        if (row === null || row.state === "STREAM_PENDING")
+            return { kind: "none" };
+        return { kind: "row", current: projectAskTerminalClaimTruth(row) };
+    }
+    classifyClaimLoss(askId, current, _where) {
+        if (current.state === "absent")
             return { kind: "absent" };
-        if (row.state === "STREAM_PENDING") {
-            return this.editedDecisionInFlight(askId) ? { kind: "edit-in-flight" } : { kind: "pending" };
-        }
-        const replayed = settleArgsOf(this.guardRowDerivedApprove(askId, replayTerminalAskRow(row), where));
+        const replayed = settleArgsOf(replayTerminalAskRow(current));
         if (replayed === "unavailable")
             return { kind: "parked" };
         if (!replayed.allowed)
@@ -571,10 +606,6 @@ export class ToolApprovalCoordinator {
         const entries = this.pendingByAskId.get(askId);
         if (!entries)
             return { settled: 0 };
-        if (allowed && updatedInput === undefined) {
-            if (this.guardRowDerivedApprove(askId, true, "notify-external-decision") === "unavailable")
-                return { settled: 0 };
-        }
         let settled = 0;
         for (const entry of [...entries]) {
             entry.settle(allowed, allowed ? "allowed" : "denied", updatedInput);
@@ -631,6 +662,7 @@ export class ToolApprovalCoordinator {
                     if (p.targetCtxs?.has(ctx))
                         p.onTargetGone?.(ctx);
                 }
+                this.askAudit?.noteLegClosed(ctx.taskId);
             }
         }));
     }
@@ -782,7 +814,7 @@ export class ToolApprovalCoordinator {
                 });
                 if (existingOrCreated.row.state !== "STREAM_PENDING") {
                     releaseAdmission();
-                    const replayed = this.guardRowDerivedApprove(askId, replayTerminalAskRow(existingOrCreated.row), "ensure-ask-idempotent-replay");
+                    const replayed = replayTerminalAskRow(existingOrCreated.row);
                     return replayed === "unavailable" ? this.unattendedOutcome() : replayed;
                 }
                 const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.row.cardJson);
@@ -923,111 +955,159 @@ export class ToolApprovalCoordinator {
             releaseAdmission();
             if (selfEntry)
                 selfEntry.settledOutcome = outcome;
+            this.askAudit?.recordSettle({
+                approvalId: wireApprovalId,
+                outcome,
+                ...(windowRouteUnavailable ? { parkRouted: true } : {}),
+                ...(hostSettledBy !== undefined ? { settledBy: hostSettledBy } : {}),
+                settledAtMs: Date.now(),
+            });
             resolveAllowed({ allowed, ...(allowed && updatedInput !== undefined ? { updatedInput } : {}) });
         };
-        const convergeFromDurableState = async (where) => {
-            if (!this.askStore || askId === undefined)
+        const broadcastClaimTruth = (read) => {
+            if (askId === undefined)
                 return;
-            const pinnedAskId = askId;
-            for (let attempt = 0; attempt <= DURABLE_CONVERGE_BACKOFF_MS.length; attempt++) {
-                if (done)
+            switch (read.kind) {
+                case "approved":
+                    this.notifyExternalDecision(askId, true, read.updatedInput);
                     return;
-                const read = await this.readRowForRecovery(pinnedAskId, `converge:${where}`);
-                if (done)
+                case "denied":
+                    this.notifyExternalDecision(askId, false);
                     return;
-                switch (read.kind) {
-                    case "absent":
-                        settle(false, "expired");
-                        return;
-                    case "pending":
-                    case "edit-in-flight":
-                    case "unreadable":
-                        if (attempt < DURABLE_CONVERGE_BACKOFF_MS.length)
-                            await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
-                        continue;
-                    case "parked":
-                        windowRouteUnavailable = true;
-                        settle(false, "expired");
-                        return;
-                    case "approved":
-                        settle(true, "allowed", read.updatedInput);
-                        return;
-                    case "denied":
-                        settle(false, "denied");
-                        return;
-                    default: {
-                        const unreachable = read;
-                        throw new Error(`convergeFromDurableState: unknown recovery read ${String(unreachable)}`);
-                    }
+                case "parked":
+                    this.settleSameAskIdParkRoute(askId);
+                    return;
+                case "absent":
+                case "edit-in-flight":
+                    return;
+                default: {
+                    const unreachable = read;
+                    throw new Error(`broadcastClaimTruth: unknown recovery read ${String(unreachable)}`);
                 }
             }
-            if (!done) {
-                if (this.editedDecisionInFlight(pinnedAskId)) {
+        };
+        const settleFromClaimLoss = (read) => {
+            switch (read.kind) {
+                case "approved":
+                    settle(true, "allowed", read.updatedInput);
+                    broadcastClaimTruth(read);
+                    return true;
+                case "denied":
+                    settle(false, "denied");
+                    broadcastClaimTruth(read);
+                    return true;
+                case "parked":
                     windowRouteUnavailable = true;
                     settle(false, "expired");
-                }
-                else {
-                    settle(false, "expired");
+                    broadcastClaimTruth(read);
+                    return true;
+                case "absent":
+                case "edit-in-flight":
+                    return false;
+                default: {
+                    const unreachable = read;
+                    throw new Error(`settleFromClaimLoss: unknown recovery read ${String(unreachable)}`);
                 }
             }
         };
-        const recoverFromUnknownStore = async (arm, casStillInFlight) => {
+        const lateClaimLossSettle = (current, intent) => {
+            if (askId === undefined)
+                return;
+            const read = this.classifyClaimLoss(askId, current, `late:${intent}`);
+            if (done) {
+                broadcastClaimTruth(read);
+                return;
+            }
+            settleFromClaimLoss(read);
+        };
+        const boundedClaim = (mk, label, timeoutMs, late) => {
+            const release = this.admitTerminalClaim(askId ?? wireApprovalId);
+            if (release === undefined)
+                return undefined;
+            const raw = mk();
+            void raw.then(release, release);
+            return this.withStoreDeadline(raw, label, timeoutMs, late);
+        };
+        const resolveLocalOutcome = async (arm) => {
             if (askId === undefined) {
                 arm.settleByIntent();
                 return;
             }
             const pinnedAskId = askId;
-            for (let attempt = 0; attempt <= DURABLE_CONVERGE_BACKOFF_MS.length; attempt++) {
+            let lastLoss;
+            const ladderStartedAt = Date.now();
+            const remainingMs = () => ladderStartedAt + TERMINAL_LADDER_WALL_MS - Date.now();
+            const nap = async (ms) => {
+                const slice = Math.min(ms, remainingMs());
+                if (slice > 0)
+                    await new Promise((r) => setTimeout(r, slice).unref?.());
+            };
+            let attempt = 0;
+            let claimsIssued = 0;
+            let rejects = 0;
+            while (attempt <= DURABLE_CONVERGE_BACKOFF_MS.length && remainingMs() > 0) {
                 if (done)
                     return;
-                const read = await this.readRowForRecovery(pinnedAskId, `recovery:${arm.intent}`);
-                if (done)
-                    return;
-                switch (read.kind) {
-                    case "approved":
-                        settle(true, "allowed", read.updatedInput);
-                        return;
-                    case "denied":
-                        settle(false, "denied");
+                const backoffAfter = attempt < DURABLE_CONVERGE_BACKOFF_MS.length ? DURABLE_CONVERGE_BACKOFF_MS[attempt] : 0;
+                if (attempt > 0 && this.editedDecisionInFlight(pinnedAskId)) {
+                    const probed = await this.probeRowWhileYielding(pinnedAskId, remainingMs());
+                    if (done)
                         return;
-                    case "parked":
-                        windowRouteUnavailable = true;
-                        settle(false, "expired");
-                        return;
-                    case "pending": {
-                        if (casStillInFlight) {
-                            arm.settleByIntent();
-                            return;
-                        }
-                        let result;
-                        try {
-                            result = await arm.cas();
-                        }
-                        catch (err) {
-                            this.noteStoreError(err, arm.storeLabel);
-                            arm.settleByIntent();
-                            return;
-                        }
-                        if (arm.won(result)) {
-                            arm.onWon(result);
+                    if (probed.kind === "denied") {
+                        await nap(TERMINAL_CLAIM_CAP_POLL_MS);
+                        continue;
+                    }
+                    if (probed.kind === "row") {
+                        const read = this.classifyClaimLoss(pinnedAskId, probed.current, `yield-probe:${arm.intent}`);
+                        if (settleFromClaimLoss(read))
                             return;
-                        }
-                        await convergeFromDurableState(arm.where);
-                        return;
+                        if (read.kind === "edit-in-flight")
+                            lastLoss = probed.current;
                     }
-                    case "absent":
-                        arm.settleByIntent();
-                        return;
-                    case "edit-in-flight":
-                    case "unreadable":
-                        if (attempt < DURABLE_CONVERGE_BACKOFF_MS.length)
-                            await new Promise((r) => setTimeout(r, DURABLE_CONVERGE_BACKOFF_MS[attempt]).unref?.());
+                    else if (this.terminalClaimsInFlightCount(pinnedAskId) > 0) {
+                        await nap(TERMINAL_CLAIM_CAP_POLL_MS);
                         continue;
-                    default: {
-                        const unreachable = read;
-                        throw new Error(`recoverFromUnknownStore: unknown recovery read ${String(unreachable)}`);
                     }
+                    await nap(backoffAfter);
+                    attempt++;
+                    continue;
                 }
+                const inFlight = arm.claim(Math.min(attempt === 0 ? DURABLE_CALL_TIMEOUT_MS : DURABLE_CONVERGE_READ_TIMEOUT_MS, remainingMs()));
+                if (inFlight === undefined) {
+                    await nap(TERMINAL_CLAIM_CAP_POLL_MS);
+                    continue;
+                }
+                claimsIssued++;
+                let outcome;
+                try {
+                    outcome = await inFlight;
+                }
+                catch (err) {
+                    this.noteStoreError(err, arm.storeLabel);
+                    rejects++;
+                    await nap(backoffAfter);
+                    attempt++;
+                    continue;
+                }
+                if (outcome.claimed) {
+                    arm.onWon(outcome);
+                    return;
+                }
+                arm.onLostTruth?.(outcome.current);
+                const read = this.classifyClaimLoss(pinnedAskId, outcome.current, `claim:${arm.intent}`);
+                if (done) {
+                    broadcastClaimTruth(read);
+                    return;
+                }
+                if (settleFromClaimLoss(read))
+                    return;
+                if (read.kind === "absent") {
+                    arm.settleByIntent();
+                    return;
+                }
+                lastLoss = outcome.current;
+                await nap(backoffAfter);
+                attempt++;
             }
             if (done)
                 return;
@@ -1036,24 +1116,10 @@ export class ToolApprovalCoordinator {
                 settle(false, "expired");
                 return;
             }
-            recordFailOpen(ambiguousCasFailOpenTag(arm.intent), `askId=${pinnedAskId} reads=${DURABLE_CONVERGE_BACKOFF_MS.length + 1}`);
-            arm.settleByIntent();
-        };
-        const resolveLocalOutcome = async (arm) => {
-            let result;
-            try {
-                result = await arm.cas();
-            }
-            catch (err) {
-                this.noteStoreError(err, arm.storeLabel);
-                await recoverFromUnknownStore(arm, err instanceof ApprovalStoreDeadlineError);
+            if (lastLoss !== undefined && settleFromClaimLoss(this.classifyClaimLoss(pinnedAskId, lastLoss, `claim-tail:${arm.intent}`)))
                 return;
-            }
-            if (arm.won(result)) {
-                arm.onWon(result);
-                return;
-            }
-            await convergeFromDurableState(arm.where);
+            recordFailOpen(ambiguousCasFailOpenTag(arm.intent), `askId=${pinnedAskId} attempts=${attempt} claims=${claimsIssued} rejects=${rejects} elapsedMs=${Date.now() - ladderStartedAt}`);
+            arm.settleByIntent();
         };
         const settleParkRouteIfUnsettled = (hostSettledBy) => {
             if (done)
@@ -1072,22 +1138,22 @@ export class ToolApprovalCoordinator {
                 const pinnedBatchId = batchId;
                 await resolveLocalOutcome({
                     intent: "expire",
-                    storeLabel: "expireAsk",
-                    where: "windowExpired",
-                    cas: () => this.withStoreDeadline(store.expireAsk(pinnedAskId, pinnedBatchId), "expireAsk(window)", DURABLE_CALL_TIMEOUT_MS, (late) => {
-                        if (!late.won)
+                    storeLabel: "claimTerminal(window)",
+                    claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, "expire"), "claimTerminal(window)", timeoutMs, (late) => {
+                        if (!late.claimed) {
+                            lateClaimLossSettle(late.current, "expire");
                             return;
+                        }
                         this.settleSameAskIdParkRoute(pinnedAskId);
                         this.settleVoidedSiblings(late.voidedSiblings);
-                        this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, late.voidedSiblings, "superseded_by_park", Date.now()));
+                        this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, late.voidedSiblings, "superseded_by_park", Date.now(), origin.taskId));
                     }),
-                    won: (res) => res.won,
                     onWon: (res) => {
                         windowRouteUnavailable = true;
                         settle(false, "expired");
                         this.settleSameAskIdParkRoute(pinnedAskId);
                         this.settleVoidedSiblings(res.voidedSiblings);
-                        this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, res.voidedSiblings, "superseded_by_park", Date.now()));
+                        this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, res.voidedSiblings, "superseded_by_park", Date.now(), origin.taskId));
                     },
                     settleByIntent: () => settleParkRouteIfUnsettled(hostSelfReport),
                 });
@@ -1116,24 +1182,31 @@ export class ToolApprovalCoordinator {
             const store = this.askStore;
             const pinnedAskId = askId;
             const pinnedBatchId = batchId;
+            const cancelLostTruth = (current) => {
+                if (current.state !== "VOID")
+                    return;
+                this.recordParkTombstone(wireApprovalId, { kind: "voidBridge", askId: pinnedAskId, batchId: pinnedBatchId, owner: origin.owner, parkedAtMs: Date.now() });
+            };
             await resolveLocalOutcome({
                 intent: "cancel",
-                storeLabel: "transitionAsk(cancel)",
-                where: "runCancel",
-                cas: () => this.withStoreDeadline(store.transitionAsk(pinnedAskId, "STREAM_PENDING", "VOID", { updatedAtMs: Date.now() }), "transitionAsk(cancel)", DURABLE_CALL_TIMEOUT_MS, (lateWon) => {
-                    if (!lateWon)
+                storeLabel: "claimTerminal(cancel)",
+                claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, "cancel"), "claimTerminal(cancel)", timeoutMs, (late) => {
+                    if (!late.claimed) {
+                        cancelLostTruth(late.current);
+                        lateClaimLossSettle(late.current, "cancel");
                         return;
+                    }
                     this.settleVoidedSiblings([pinnedAskId]);
                     this.recordParkTombstone(wireApprovalId, { kind: "voidBridge", askId: pinnedAskId, batchId: pinnedBatchId, owner: origin.owner, parkedAtMs: Date.now() });
-                    this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, [pinnedAskId], "aborted", Date.now()));
+                    this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, [pinnedAskId], "aborted", Date.now(), origin.taskId));
                 }),
-                won: (won) => won,
                 onWon: () => {
                     settle(false, "expired");
                     this.settleVoidedSiblings([pinnedAskId]);
                     this.recordParkTombstone(wireApprovalId, { kind: "voidBridge", askId: pinnedAskId, batchId: pinnedBatchId, owner: origin.owner, parkedAtMs: Date.now() });
-                    this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, [pinnedAskId], "aborted", Date.now()));
+                    this.emitRevokeTo(aliveCtxs, buildRevokeFrame(pinnedBatchId, [pinnedAskId], "aborted", Date.now(), origin.taskId));
                 },
+                onLostTruth: cancelLostTruth,
                 settleByIntent: () => settle(false, "expired"),
             });
         };
@@ -1193,6 +1266,18 @@ export class ToolApprovalCoordinator {
             }
             siblings.add(pendingEntry);
         }
+        this.askAudit?.recordAsk({
+            approvalId: wireApprovalId,
+            taskId: origin.taskId,
+            ...(req.sourceTaskId !== undefined ? { sourceTaskId: req.sourceTaskId } : {}),
+            ...(origin.sessionId !== undefined ? { sessionId: origin.sessionId } : {}),
+            owner: origin.owner,
+            toolName: req.toolName,
+            toolCallId: req.toolCallId,
+            legTracked: !child && aliveCtxs.some((c) => c.taskId === origin.taskId),
+            expiresAtMs: persistedExpiresAtMs,
+            mintedAtMs: Date.now(),
+        });
         const cardFrame = askId !== undefined && cardForFrame !== undefined
             ? buildApprovalRequestFrame({ askId, taskId: origin.taskId, approvalId: wireApprovalId, card: cardForFrame, expiresAtMs: persistedExpiresAtMs, nowMs: Date.now() })
             : undefined;
@@ -1239,15 +1324,15 @@ export class ToolApprovalCoordinator {
                     };
                     await resolveLocalOutcome({
                         intent: "unreachable",
-                        storeLabel: "expireAsk(emit-failed)",
-                        where: "emitFailed",
-                        cas: () => this.withStoreDeadline(store.expireAsk(pinnedAskId, pinnedBatchId), "expireAsk(emit-failed)", DURABLE_CALL_TIMEOUT_MS, (late) => {
-                            if (!late.won)
+                        storeLabel: "claimTerminal(emit-failed)",
+                        claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, "expire"), "claimTerminal(emit-failed)", timeoutMs, (late) => {
+                            if (!late.claimed) {
+                                lateClaimLossSettle(late.current, "unreachable");
                                 return;
+                            }
                             this.settleSameAskIdParkRoute(pinnedAskId);
                             this.settleVoidedSiblings(late.voidedSiblings);
                         }),
-                        won: (res) => res.won,
                         onWon: (res) => {
                             settleUnreachable();
                             this.settleSameAskIdParkRoute(pinnedAskId);
@@ -1768,6 +1853,7 @@ export class ToolApprovalCoordinator {
         for (const [id, e] of this.pending) {
             if (scope !== undefined && e.owner !== scope)
                 continue;
+            const contentKind = contentKindOf(e.toolName);
             rows.push({
                 approvalId: id,
                 toolName: e.toolName,
@@ -1777,6 +1863,7 @@ export class ToolApprovalCoordinator {
                 ...(e.requiresRealApproval ? { requiresRealApproval: true } : {}),
                 ...(e.governanceForced ? { governanceForced: true } : {}),
                 ...(e.originTaskId !== undefined ? { fromSubagent: true, originTaskId: e.originTaskId } : {}),
+                ...(contentKind !== undefined ? { contentKind } : {}),
             });
         }
         return rows;
@@ -1841,13 +1928,6 @@ export class ToolApprovalCoordinator {
         }
         return { polled, settled, backlog, truncated };
     }
-    liveConsumerCount(askId) {
-        let n = 0;
-        for (const e of this.pendingByAskId.get(askId) ?? [])
-            if (e.settledOutcome === undefined)
-                n++;
-        return n;
-    }
     markEditedDecisionInFlight(askId) {
         this.editedDecisionsInFlight.set(askId, (this.editedDecisionsInFlight.get(askId) ?? 0) + 1);
         let released = false;
@@ -1866,12 +1946,6 @@ export class ToolApprovalCoordinator {
             if (released)
                 return;
             defaultLogger.warn("approval_edited_decision_mark_expired", { askId, capMs: EDITED_DECISION_MARK_CAP_MS });
-            this.abandonedEditedDecisions.set(askId, Date.now() + ABANDONED_EDIT_TOMBSTONE_TTL_MS);
-            if (this.abandonedEditedDecisions.size > ABANDONED_EDIT_TOMBSTONE_MAX) {
-                const oldest = this.abandonedEditedDecisions.keys().next();
-                if (!oldest.done)
-                    this.dropAbandonedEditTombstone(oldest.value, "capacity");
-            }
             drop();
         }, EDITED_DECISION_MARK_CAP_MS);
         watchdog.unref?.();
@@ -1883,47 +1957,9 @@ export class ToolApprovalCoordinator {
     editedDecisionInFlight(askId) {
         return (this.editedDecisionsInFlight.get(askId) ?? 0) > 0;
     }
-    abandonedEditedDecisionPending(askId) {
-        const until = this.abandonedEditedDecisions.get(askId);
-        if (until === undefined)
-            return false;
-        if (Date.now() > until) {
-            this.dropAbandonedEditTombstone(askId, "ttl");
-            return true;
-        }
-        return true;
-    }
-    guardRowDerivedApprove(askId, outcome, where) {
-        if (outcome !== true || askId === undefined)
-            return outcome;
-        if (!this.abandonedEditedDecisionPending(askId))
-            return outcome;
-        defaultLogger.warn("approval_row_derived_approve_parked_after_abandoned_edit", { askId, where });
-        this.settleSameAskIdParkRoute(askId);
-        return "unavailable";
-    }
-    dropAbandonedEditTombstone(askId, why) {
-        const stillWaiting = this.liveConsumerCount(askId);
-        if (stillWaiting > 0) {
-            defaultLogger.warn("approval_abandoned_edit_tombstone_dropped_parking_consumers", { askId, why, parked: stillWaiting });
-            this.settleSameAskIdParkRoute(askId);
-        }
-        this.abandonedEditedDecisions.delete(askId);
-    }
     expireEditedDecisionMarkForTest(askId) {
-        this.abandonedEditedDecisions.set(askId, Date.now() + ABANDONED_EDIT_TOMBSTONE_TTL_MS);
         this.editedDecisionsInFlight.delete(askId);
     }
-    forceAbandonedEditTombstoneExpiryForTest(askId) {
-        if (!this.abandonedEditedDecisions.has(askId))
-            return;
-        this.abandonedEditedDecisions.set(askId, Date.now() - 1);
-        this.abandonedEditedDecisionPending(askId);
-    }
-    setAbandonedEditTombstoneDeadlineForTest(askId, atMs) {
-        if (this.abandonedEditedDecisions.has(askId))
-            this.abandonedEditedDecisions.set(askId, atMs);
-    }
     pendingCount() {
         return this.pending.size;
     }

package/dist/trace/ledger-events.d.ts

@@ -38,6 +38,15 @@ export type LedgerEventType = "reasoning" | "text" | "tool_start" | "tool_end" |
  | "elicitation" | "elicitation_complete" | "question" | "question_complete" | "tool_approval" | "tool_approval_complete"
 /** [ref] §4.3 新协议的呈卡帧(与上面两只 tool_approval 帧同一条投递面)。 */
  | "approval_request"
+/**
+ * [ref]([ref]):批级撤卡帧在 **bg/resume 两条 durable 腿**的账本落行(与呈卡帧同口
+ * `append(type, rest)`,seq 由腿自己的 ledger 链步分配)。此前成文「reaper/收敛器无 seq 可分配故
+ * live-only」只对**调用点**成立,不对 ctx 的投递口成立——帧经 `emitRevokeTo` 交给各 ctx 的
+ * `emitRevoke`,durable 腿的那只钩子自己就是账本写口。sync 腿维持 live-only(行为零变,
+ * `routes/tasks.ts` 装配点注)。重放语义:同一账本里卡帧(`approval_request`)在前、撤帧在后,
+ * 全量重读恒同序 ⇒ 幂等诚实;不投影成 trace 2.3 帧(`LEDGER_TYPES_NOT_PROJECTED` 登记)。
+ */
+ | "approval_revoke"
 /** 异步 workflow 完成的入箱 drain(`emitPendingWorkflowCompletions` 两个字面型之一)。 */
  | "workflow_complete"
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.54.0",
+  "version": "7.56.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -55,7 +55,7 @@
   },
   "dependencies": {
     "@sema-agent/core": "7.1.0",
-    "@sema-agent/settings-schema": "1.3.0",
+    "@sema-agent/settings-schema": "1.4.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
     "mysql2": "^3.22.4",
@@ -69,7 +69,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "7.4.0",
+    "@sema-agent/sdk": "8.1.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",