@sema-agent/server 7.98.0 → 7.100.0

package/dist/tool-approval.d.ts

@@ -1,11 +1,12 @@
 import type { HostDecidedBy, HostSettledBy } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
-import { type AskRequest, type AskOutcome, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
+import { type AskRequest, type AskOutcome, type CheckpointGate, type PendingAction, type ReadRootGrantCandidate, type RuleOffer } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { ApprovalAskAuditSink } from "./approval-ask-audit-store.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
+import { type GovernancePosture } from "./runtime-governance.js";
 /** [ref]:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
  *  此前 7 份手写副本散在两只 checkpoint store 的数组/SQL 字面与 /decide 守卫——core 加审批味 kind 时
  *  全部静默漂移。core 无导出词表(全大写导出面零命中,2026-08-09 亲验),属主落此;SQL IN 片段从
@@ -76,6 +77,87 @@ export type ParkedAskRedeem = (req: ParkedAskRedeemRequest) => Promise<{
     status: number;
     body: Record<string, unknown>;
 }>;
+/**
+ * 一问身上与「站着的答案」有关的三个事实位 —— {@link standingAnswerMayRetire} 的全部入参。
+ *
+ * 🔴 **三格全必填布尔**,刻意不做 `?: true` 的「只记真」形:判据哪天多一位,每个读者都要当场编译红,
+ * 而不是漏传一格被静默读成 `false`(那是安全轴上的 fail-open)。读者各自从自己手里的形折成这三格,
+ * 然后交**同一只** {@link standingAnswerMayRetire}(判据只有一份,折法各归读者):
+ *  · live 读侧取 `req` + 本地治理 peek;live 写侧取 pending 条目;
+ *  · 耐久 `/decide` 腿(S-663 → NP-1,7.100.0)取 park 行,经 {@link parkRowStandingAnswerFacts}(三格全从行上读)。
+ * 本型**不绑** live 条目。
+ */
+export interface StandingAnswerFacts {
+    /** 本仓治理层(`AUTONOMY` / `commandPolicy` / shellGate / `SENSITIVE_WRITE_PATTERNS`)产的门。 */
+    readonly governanceForced: boolean;
+    /** core 闸站盖的「必须真人逐次批」位(连一揽子 `onAsk:"allow"` 席也不得答)。 */
+    readonly requiresRealApproval: boolean;
+    /** core 闸站盖的强制位([ref]):规则清不掉、站着的答案退不掉,只有对**这一次调用**的应答能答。 */
+    readonly mandated: boolean;
+}
+/**
+ * 🔴 **S-660 —— 会话级放行的唯一判据:站着的答案能不能退掉这一问。** 纯谓词,三个读者:
+ *  · **读侧**(`askBroadcast` 的会话授权短路):`true` 才可能由既有 grant 代答,否则往下走真出卡;
+ *  · **写侧**(`finishRespond` 的 `grantable`):`true` 才可能把这张卡上的 `allow_session` 铸成 grant,
+ *    否则只放行这一次、`rememberApplied:false`;
+ *  · **耐久 `/decide` 腿**(NP-1,`http/resume-legs.ts` 的 remember 可记性):入参由 {@link parkRowStandingAnswerFacts}
+ *    从 park 行铸 —— `false` ⇒ 可记工具名 `null` ⇒ 放行本次、不落豁免、回执 `rememberApplied:false`。
+ * 两臂读同一份事实、说同一句话:一问若不许被记住的放行答掉,它的应答也不许变成一条记住的放行 —— 否则
+ * 同一只卡「重跑一遍」就被自己上一次的回答代答(test [ref] U1s-off 的真形)。
+ *
+ * **为什么三位是同一类**(「站着的答案退不掉的一问」):会话授权 = **上一次**应答记下的一揽子放行,不是对
+ * **这一次**调用的应答 —— 与持久 allow 规则同族,只是更短命(`askBroadcast` 短路处的注早已这么定性)。
+ *  · `mandated`:core `PermissionResult` ask 臂 `mandated` 成员的文档。7.29.0 原句「no persisted allow rule and no standing
+ *    posture may retire it, only an answer to THIS call」;**7.30.0 起 d.ts 已落 [ref] 澄清**(S-616 在 7.30.1 装树亲核):
+ *    core `PermissionResult` ask 臂的 `mandated` 成员文档「no persisted allow rule and no STANDING ANSWER (a release remembered
+ *    from an earlier call, at any scope, a session included) may retire it」,`AskRequest.mandated` 孪生句同义 ——
+ *    「从早先某次回答记住的放行,**任何 scope、会话级也算**」都是站着的答案。core `ruleClearanceOf` 的文档
+ *    「Allow rules silence the classifier's questions, never a mandated one」。它**不**绑
+ *    这一次调用的应答者(人、hook、部署的一揽子 `onAsk:"allow"` 席、mandate 表允许的活判定者 —— 同一句 d.ts 逐一点名)——
+ *    那一半本仓不动(见 `mandated` 帧键顶注)。本谓词行为对 7.29.0 零改(文档到货,判据本来就是这么读的)。
+ *  · `requiresRealApproval`([ref]):更强的那条,连一揽子席也不得答,当然也不许记住的放行答。
+ *  · `governanceForced`([ref]):运维治理层的门,客户端表态掀不掉;持久规则车道早已同判(`buildRuleLaneMaterial`)。
+ * 本谓词**不重推** core 的 `ruleClearanceOf` / `ruleMayClear`(core 刻意不导出:闸外重算拿不到同一份标记快照,
+ * 会分叉),只读闸站**盖好**的两位 + 本仓自己的治理标。
+ *
+ * **为什么读侧的行复核(`sessionGrantUncontestedByRow`)不必为 `mandated` 加一次行读**:`mandated` 是 `req`
+ * **自己**的位 —— core 每一次过闸(含 failover / 重启后的重入)都由 `runGateLanes` 里的 `stampAskOrigin`
+ * 重新盖、经同一处的 `carryOf` 带上 `AskRequest`,读侧手里的 `req` 恒是这一次过闸的真值。`governanceForced`
+ * 需要行读,是因为它来自本仓的**进程内**治理标表:failover / 重启后幂等命中既有行时本地表恒空,行上的卡才
+ * 存着落库那一刻的判定。何况行上本来就没有 `mandated`(耐久面不造孪生座)—— 读了也读不到。
+ */
+export declare function standingAnswerMayRetire(facts: StandingAnswerFacts): boolean;
+/**
+ * 🔴 **S-663 → NP-1(7.100.0 合并复审 [ref] 交叉表 #2)—— 耐久 `/decide` 腿的 {@link StandingAnswerFacts}:从 park 行铸三位。**
+ * 纯投影,**不判**:判据是同一只 {@link standingAnswerMayRetire}(唯一读点 = `http/resume-legs.ts` 的 remember 可记性,
+ * `standingAnswerMayRetire(parkRowStandingAnswerFacts(…))`)。修前耐久腿自成一只谓词、只读 `ruleOffersAbsence` 一词,同一行上
+ * core 盖好的 `requiresRealApproval` 与治理出身都不读 ⇒ 那两类卡的 `remember:"session"` 照旧铸会话免询问,而 live 腿对同一张卡
+ * 答 `false`(两腿同一个问题、两份事实覆盖;两腿复审同报)。三格各自的来源(全在**这一条**已属主校验的载入行上,不另读):
+ *  · `governanceForced` —— 行上的治理标:`gate.riskDescriptor.shellGateDoctrine` × 本部署治理姿态,经 **同一只**
+ *    `governanceOriginOf`(`runtime-governance.ts`;运维队列 `projectPendingForWire` / 409 体同一个属主,不另判)。它在
+ *    本读者这里只**收窄**(失真两个方向的代价登记在 `governanceMandatesShellGateAlways` 顶注)。⚠️ 它**只覆盖 shell 门的
+ *    `always` 档** —— live 腿的治理标来自进程内标记表(敏感写路径 / `commandPolicy` / `AUTONOMY` 内层策略 / shellGate 各档),
+ *    park 行上唯一的取证格只有 `riskDescriptor.shellGateDoctrine`(见下方 🚧);
+ *  · `requiresRealApproval` —— 行上 core 铸的那一位,经 `approval-card.ts` 的 {@link readRequiresRealApprovalSeat}(与运维
+ *    队列 `parkRowFacts` 同一只读法,`=== true`)。刻意**不**经 `parkRowFacts` 本身:那只展示投影顺手对 `ruleOffersAbsence`
+ *    的集外词计展示面 F 类 tag,而本读者对同一格是 fail-closed(S-663 codex r1 钉「权限面不计展示面 tag」);
+ *  · `mandated` —— 行上**没有**这一位(core 7.30.1 `PendingAction` 无 `mandated`,#1079 候 7.31.0),只读得到强制的子集:
+ *    `ruleOffersAbsence` 经三态窄读 {@link readRuleOffersAbsenceSeat},`"mandated"` **或读不出**(集外词 / 非串值,世代差)
+ *    ⇒ `true`(fail-closed 不变:一个本仓不认识的新词可能正是一种强制因由)。
+ *
+ * 🚧 **剩余不对称两处**(耐久腿读得到的事实比 live 腿少,读不到的一律照旧可记):
+ *  ① **`mandated` 孪生位(候 core #1079)**:一张强制卡若行上词为 `shadowed` / 缺席、又无 `requiresRealApproval` 与治理出身
+ *    (非 Bash 工具 / 车道未武装 / 匿名部署上的规则强制 —— core 只在「车道武装 ∧ `Bash` ∧ 有 principal」时铸那一词,且
+ *    `ruleClearanceOf` 的词序让 `persistedRuleShadowed` / `matchedAskRule` 先得 `"shadowed"`),本折法读不到它的强制。#1079 到货后
+ *    改的**只是 `mandated` 这一格**(改读行上那一位),谓词与调用点零改(`test/approval-exemption-http.test.ts` 的 🚧 格按 #1079
+ *    行形钉着);
+ *  ② **非 shell 治理(候 S-707)**:治理位经 `governanceOriginOf` 只覆盖 shell 门 `always` 档;敏感写路径
+ *    (`SENSITIVE_WRITE_PATTERNS`)、`commandPolicy`、`AUTONOMY` 内层策略产的门与 shellGate `classify` 档,park 行上没有取证格
+ *    (live 腿靠进程内标记表,跨副本 / 重启后够不着),本折法读不到它们的治理出身。
+ */
+export declare function parkRowStandingAnswerFacts(pending: Extract<PendingAction, {
+    kind: "tool_approval";
+}>, gate: CheckpointGate, governance: GovernancePosture | undefined): StandingAnswerFacts;
 /** A live approval frame delivered to whoever tails this run's stream. `type` IS the SSE event name (named-event
  *  convention, same as question). The shell renders `tool_approval` as the CC three-choice card and dismisses on
  *  `tool_approval_complete`. */
@@ -142,6 +224,8 @@ export interface ToolApprovalFrame {
      * 车道**有什么可给,而那条车道对它不说话的工具、**没接规则店的部署**(本仓的 live-only 形)、装不下规则的
      * 任务都是结构性沉默 —— 它的缺席**不是**断言。本键是这一问**自己**的属性,凡强制皆在场。读错的代价 core
      * 实测过:同一条根外读命令在 shell 工具上是强制问、在 monitor 工具上看起来是普通问。
+     * (唯一例外是**手里没有本键**的那条腿:耐久 `/decide` 腿只有 park 行,S-663 / NP-1 只读那一词的**在场**、从不读它的
+     * 缺席 —— 见 {@link parkRowStandingAnswerFacts},子集与剩余不对称写在那里。live 腿恒读本键。)
      *
      * 🔴 **它不是 `requiresRealApproval`**:强制只说「没有规则能清掉」,**不**说「没有应答者可以答」——
      * 一个人、一只 hook、一张一揽子 `onAsk:"allow"` 席照常答得了强制卡。两键别互推。
@@ -150,7 +234,10 @@ export interface ToolApprovalFrame {
      * 「不是强制」「老引擎」「这是一张从 park 行上重铸的耐久卡」三形 —— **耐久面上本仓不造孪生座**:core 的
      * 寄存行(`PendingAction`)没有这一位(KL-997a 亲读登记),行上强制表现为 `ruleOffersAbsence:"mandated"`
      * 且无 `ruleOffers`;在 `card_json` 侧自铸一个就是本仓成了这个事实的第二个源(而 park 那侧根本没有输入)。
-     * 🔴 echo-only:server 不据它做任何裁决(强制的判定属主在 core 的闸站)。
+     * 🔴 **server 不判「是不是强制」**(判定属主在 core 的闸站),只**读**闸站盖好的这一位 —— 读者恰一个:
+     * S-660 起的会话级放行判据 {@link standingAnswerMayRetire}(会话授权是**上一次**应答记下的站着的答案,
+     * 不是对这一次调用的应答 ⇒ 强制卡上既不被既有 grant 代答、也不铸 grant)。上一段「一揽子 `onAsk:"allow"`
+     * 席照常答得了」说的是**这一次调用的应答者**,本仓不改它。
      */
     mandated?: true;
     /**
@@ -637,6 +724,29 @@ export type RespondSettledBy = Extract<HostSettledBy, HostDecidedBy>;
  * (`config.ts` 的解析腿,[ref] A 档)。
  */
 export type UnattendedApprovalPolicy = "park" | "deny";
+/**
+ * S-689 —— `deny` 政策下「无人可答」交给 core 的形:core `AskOutcome` 对象臂的**部署政策拒**
+ * (`settledBy:"policy"` ⇒ core 结算 `policy_refused`、`who.party:"none"`,模型读的是策略句)。
+ *
+ * 修前这里交**裸 `false`** —— 而在 core 的 onAsk 契约里裸 `false` 就是「一个人拒了」:结算记
+ * `human_refused` / `who.party:"person"`,模型被告知「用户不想继续,停下来等他」,run 以
+ * `haltedOnUserRejection` 收束。可这台部署自己声明了没有人会来 —— 拒的是它的政策。
+ *
+ * 型从 core 的 `AskOutcome` 对象臂**收窄**而不是另写一份(`settledBy` 取 core 那一格词表里的 `"policy"`:
+ * core 哪天退役这个词,这里编译期先红)。`reason` 必填:core 以 `policy note` 围栏把它交给模型,内容见
+ * {@link unattendedRefusalReason}。
+ */
+export type UnattendedPolicyRefusal = Extract<AskOutcome, {
+    allow: boolean;
+}> & {
+    allow: false;
+    settledBy: Extract<HostSettledBy, "policy">;
+    reason: string;
+};
+/** 「无人可答」终局的**闭集** —— core `AskOutcome` 联合里只有这两臂由 {@link ToolApprovalCoordinator.unattendedOutcome}
+ *  铸:park 政策的路由答 `"unavailable"`,deny 政策的 {@link UnattendedPolicyRefusal}。没有布尔臂(S-689:裸 `false`
+ *  是人的拒绝,这个口从不替人说话)。 */
+export type UnattendedAskOutcome = Extract<AskOutcome, "unavailable"> | UnattendedPolicyRefusal;
 /**
  * [ref] 车3 刀 3b —— 「流内审批协议到底上不上场」的**单一谓词**(设计稿 §2.3 注入 / §2.4 能力面 /
  * §8.4 park 设施自检,三处同一份判据)。
@@ -959,6 +1069,10 @@ export declare class ToolApprovalCoordinator {
     /**
      * [ref] R-13 C —— 「**无人可答**」这一类终局的**唯一**成形口(park 路由 vs deny 政策)。
      *
+     * 终局形(S-689):park ⇒ `"unavailable"`;deny ⇒ {@link UnattendedPolicyRefusal}
+     * `{allow:false, settledBy:"policy", reason}`(core 记 `policy_refused`)。**从不**交裸 `false`:那在 core 的
+     * onAsk 契约里是「一个人拒了」,而本口的全部臂都是「没有人能答」。
+     *
      * 五臂(设计稿 §1 的表)全部读它,`unattendedPolicy` 因此是一处施加、五处消费:
      *  (a) 有店窗到期 `expireAsk` 赢 CAS / (b) 无店窗到期(D1)/ (c) 有店但 `expireAsk` 报错
      *  —— 三条走 `windowRouteUnavailable` 标志,在 {@link shapeOutcome}(askBroadcast 内)成形;
@@ -976,12 +1090,17 @@ export declare class ToolApprovalCoordinator {
      * **身份不确定**的处置(与「有没有人」无关),且背后可能正躺着一条真行。于是 `deny` 部署上仍可能落
      * 极少数 park(店抖动期),已知且有意的残余,成文在 config-types 的域注。
      *
-     * ⚠️ **`deny` 部署上持久行仍会经 PARKING 记账**(codex R1-F1 的另一半,验真后**不采纳**其「给 deny
-     * 造一条原子 deny 终态转移」的建议):那是店语义变更(新转移 + 批内兄弟连坐语义 + 真双库套件),且与
-     * 已裁的设计稿(§2:(a) 在 deny 下只改交给 core 的终局)相左。**危害亲验为零**:收敛器判据①的
-     * `bindBatch` 只把 PARKING 行绑到**已经存在的 core checkpoint** 上,而 `deny` 部署里 core 从不 park
-     * ⇒ 结构上绑不上,该行按判据②/④/⑤ 自行收敛成 DENIED/VOID,不会凭空生出一张 park 或幻影 gate。
-     * 残余 = 那类行的归因会记成 `routing_failure`(其实是政策 deny),归因精化登记为候件。
+     * 🔴 **`deny` 部署上政策结算当场落行**(NP-2,7.100.0 合并复审 [ref] 交叉表 #4;codex R1-F1 当年**不采纳**的那一半
+     * 「给 deny 造一条原子 deny 终态转移」在这里收了):窗到期 / emit 全灭两臂在 deny 政策下的终局 claim 是
+     * `refuse` 意图(见 {@link unattendedClaimIntent})—— STREAM_PENDING→DECIDED(deny) + `settled_by = "policy"`,**按 ask
+     * 作用域**(不碰批、不连坐兄弟)。落的来源词与本口交给 core 的是**同一个常量**(`POLICY_REFUSAL_DECISION`),于是
+     * 同 ask 重入 / 收敛后重入由 `outcomeOfDecidedRow` 读回同一个对象。当年「危害为零」的论证(PARKING 行绑不上、
+     * 自行收敛成 DENIED/VOID)在 S-689 之后不再成立:首判交 `{allow:false, settledBy:"policy"}`,行停 PARKING 的回放
+     * 却交裸 `false`(收敛后 DENIED 无来源)—— core 当成人拒、可停批,两次判决第一次可被观测地分家。
+     * 仍按 PARKING 记账的只剩两形(都不是本进程这一次政策结算):别的写者(park 政策副本 / 切换政策之前)推进过的行,
+     * 与崩溃后收敛器孤儿腿代打 expire 的行 —— 前者重入走本口(`replayed_parked`),后者登记在收车档的未闭环项。
+     * deny 政策下批仍是**单 ask 批**(见 {@link batchIdFor}):`refuse` 本来就不碰批,单 ask 批让新行与存量整腿批行
+     * 的差别只剩「批 id 是谁」,结算语义一致。
      */
     private unattendedOutcome;
     /** 政策**读**口(不是终局铸口)—— 回答「这台部署把无人可答翻成 park 吗」。
@@ -990,6 +1109,22 @@ export declare class ToolApprovalCoordinator {
      *  纯粹的**政策查询**(`unattendedOutcome() !== false`)会和同一只 ask 的真终局各记一条遥测 ——
      *  「一只 ask 一条线」当场不成立。读口不落日志,铸口落;谁也不兼职。 */
     private get unattendedRoutesToPark();
+    /**
+     * 一只 ask 落在**哪只批**里 —— 批作用域随政策(S-689 codex R1-F1,判据全文见 {@link deriveAskScopedBatchId})。
+     *  · park 路由 ⇒ 整腿一批(`deriveBatchId`):窗到期赢家整批转投递面、兄弟连坐,core 随后 park,腿就此结束;
+     *  · deny 政策 ⇒ 单 ask 批:没有 park 路由,腿在一次部署政策拒之后继续跑 —— 整腿一批会让首只到期把批关掉,
+     *    同腿后续的卡人批不动(`decideAsk` batch_closed ⇒ 404),兄弟还被连坐成 VOID、以裸 `false` 交 core(人拒)。
+     * 读的是政策**读**口(不落遥测)。
+     */
+    private batchIdFor;
+    /**
+     * 窗到期 / emit 全灭两臂的**终局 claim 意图**(NP-2)—— 与 {@link batchIdFor} 读同一个政策读口:
+     *  · park 路由 ⇒ `expire`(行进投递面、批转 ROUTING_UNBOUND、兄弟连坐,core 随后 park);
+     *  · deny 政策 ⇒ `refuse`(按 ask 作用域当场落 DECIDED(deny) + `settled_by="policy"`,与 {@link unattendedOutcome}
+     *    交给 core 的那一只同一个来源词 —— 回放 / 收敛后重入读回同一个对象;不碰批、不连坐兄弟,存量整腿批行同判)。
+     * 两臂之外的终局 claim(取消臂 `cancel`)与政策无关,不读本口。
+     */
+    private get unattendedClaimIntent();
     /** {@link unattendedOutcome} 的**公开**口:`windowZero` 的 immediate-unavailable 闭包长在装配层
      *  (`http/routes/tasks.ts` 的 sync 腿),它必须与协调器内五臂读**同一个**旋钮值,而不是各算一遍。
      *  出处随调用方给(那条腿知道自己是哪一只 ask)。 */
@@ -997,7 +1132,7 @@ export declare class ToolApprovalCoordinator {
         taskId?: string;
         owner?: string | null;
         toolName?: string;
-    }): "unavailable" | false;
+    }): UnattendedAskOutcome;
     /**
      * [ref] 车3 刀 3b —— [ref] §3.3 / 设计稿 §0 X-2 的**写侧准入门**。
      *

package/dist/tool-approval.js

@@ -7,10 +7,11 @@ import { hasBidiControls } from "./text-bidi.js";
 import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerprint.js";
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
-import { deriveAskId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
-import { projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
+import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
+import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readReadRootCandidate, readRuleEvidence, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readRequiresRealApprovalSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
+import { governanceOriginOf } from "./runtime-governance.js";
 const defaultLogger = createLogger();
 export const APPROVAL_GATE_KINDS = ["human", "irreversible_ask"];
 export function isApprovalGateKind(k) {
@@ -79,6 +80,27 @@ function sessionAllowCategory(toolName) {
 function sessionAllowKey(owner, sessionId, category) {
     return JSON.stringify([owner, sessionId, category]);
 }
+export function standingAnswerMayRetire(facts) {
+    return !facts.governanceForced && !facts.requiresRealApproval && !facts.mandated;
+}
+export function parkRowStandingAnswerFacts(pending, gate, governance) {
+    const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
+    return {
+        governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
+        requiresRealApproval: readRequiresRealApprovalSeat(pending),
+        mandated: mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
+    };
+}
+function mandatedFromSeat(seat) {
+    switch (seat.state) {
+        case "word":
+            return seat.word === "mandated";
+        case "unreadable":
+            return true;
+        case "absent":
+            return false;
+    }
+}
 export const PERSIST_RULE_TEXT_ERROR = `persistRule.rule must be a non-empty string of at most ${MAX_RULE_TEXT_CHARS} characters`;
 export const PERSIST_RULE_EDITED_FLAG_ERROR = "persistRule.edited must be a boolean when present";
 export const PERSIST_RULE_BATCH_INDEX_ERROR = "persistRule.batchOfferIndex must be a non-negative integer when present";
@@ -149,6 +171,10 @@ export function parseToolApprovalResponse(body) {
     }
     return { ok: false, error: 'decision must be one of "allow" | "allow_session" | "deny"' };
 }
+function unattendedRefusalReason(arm) {
+    return ("UNATTENDED_APPROVAL_POLICY=deny: this deployment declares that no one attends its approvals, so an approval " +
+        `request no one can answer is refused here instead of being parked for a person (arm: ${arm}).`);
+}
 function isChildAsk(req) {
     return req.fromSubagent === true;
 }
@@ -318,11 +344,26 @@ export class ToolApprovalCoordinator {
         this.askAudit = opts?.askAudit;
     }
     unattendedOutcome(site) {
-        const outcome = this.unattendedPolicy === "deny" ? false : "unavailable";
+        let outcome;
+        let outcomeWord;
+        switch (this.unattendedPolicy) {
+            case "park":
+                outcome = "unavailable";
+                outcomeWord = "unavailable";
+                break;
+            case "deny":
+                outcome = { allow: false, settledBy: POLICY_REFUSAL_DECISION.settledBy, reason: unattendedRefusalReason(site.arm) };
+                outcomeWord = "deny";
+                break;
+            default: {
+                const unreachable = this.unattendedPolicy;
+                throw new Error(`unattendedOutcome: unknown UNATTENDED_APPROVAL_POLICY word ${String(unreachable)}`);
+            }
+        }
         defaultLogger.warn("approver_unavailable", {
             arm: site.arm,
             policy: this.unattendedPolicy,
-            outcome: outcome === false ? "deny" : "unavailable",
+            outcome: outcomeWord,
             owner: site.owner ?? null,
             taskId: site.taskId ?? null,
             toolName: site.toolName ?? null,
@@ -333,6 +374,12 @@ export class ToolApprovalCoordinator {
     get unattendedRoutesToPark() {
         return this.unattendedPolicy !== "deny";
     }
+    batchIdFor(askId, sourceTaskId, runId, legKey) {
+        return this.unattendedRoutesToPark ? deriveBatchId(sourceTaskId, runId, legKey) : deriveAskScopedBatchId(askId);
+    }
+    get unattendedClaimIntent() {
+        return this.unattendedRoutesToPark ? "expire" : "refuse";
+    }
     unattendedAskOutcome(site) {
         return this.unattendedOutcome({
             arm: "window_zero",
@@ -829,8 +876,7 @@ export class ToolApprovalCoordinator {
         }
         const primary = aliveCtxs[0];
         const governanceForced = (this.governanceAskMarks ?? governanceAskMarksFor(this.streamKey(origin.owner, origin.sessionId, origin.taskId))).isMarked(req.toolCallId);
-        if (!governanceForced &&
-            req.requiresRealApproval !== true &&
+        if (standingAnswerMayRetire({ governanceForced, requiresRealApproval: req.requiresRealApproval === true, mandated: req.mandated === true }) &&
             origin.sessionId &&
             this.allowAllSessions.has(sessionAllowKey(origin.owner, origin.sessionId, sessionAllowCategory(req.toolName))) &&
             (await this.sessionGrantUncontestedByRow(origin, req))) {
@@ -915,7 +961,7 @@ export class ToolApprovalCoordinator {
             const runId = origin.taskId;
             const legKey = origin.legKey;
             askId = deriveAskId(sourceTaskId, runId, req.toolCallId, legKey, req.delegation?.parentToolCallId);
-            batchId = deriveBatchId(sourceTaskId, runId, legKey);
+            batchId = this.batchIdFor(askId, sourceTaskId, runId, legKey);
             try {
                 const existingOrCreated = await this.withStoreDeadline(this.askStore.ensureAsk({
                     askId,
@@ -938,6 +984,7 @@ export class ToolApprovalCoordinator {
                     if (abandonedEnsure && lateEnsuredAskId !== undefined)
                         voidAbandonedRow(lateEnsuredAskId);
                 });
+                batchId = existingOrCreated.row.batchId;
                 if (existingOrCreated.row.state !== "STREAM_PENDING") {
                     releaseAdmission();
                     const replayed = replayTerminalAskRow(existingOrCreated.row);
@@ -999,7 +1046,10 @@ export class ToolApprovalCoordinator {
                 let indeterminate = true;
                 for (let attempt = 0; attempt <= DURABLE_CONVERGE_BACKOFF_MS.length; attempt++) {
                     try {
-                        confirmedRowExists = (await this.withStoreDeadline(this.askStore.getAsk(askId), "getAsk(ensureAsk-confirm)")) !== null;
+                        const confirmedRow = await this.withStoreDeadline(this.askStore.getAsk(askId), "getAsk(ensureAsk-confirm)");
+                        confirmedRowExists = confirmedRow !== null;
+                        if (confirmedRow !== null)
+                            batchId = confirmedRow.batchId;
                         indeterminate = false;
                         break;
                     }
@@ -1042,7 +1092,7 @@ export class ToolApprovalCoordinator {
         let selfEntry;
         let hostSettled;
         let denyReasonSettled;
-        const shapeDeny = () => {
+        const shapeDeny = (bare) => {
             if (hostSettled !== undefined || (denyReasonSettled !== undefined && denyReasonSettled !== "")) {
                 return {
                     allow: false,
@@ -1050,18 +1100,17 @@ export class ToolApprovalCoordinator {
                     ...(denyReasonSettled !== undefined && denyReasonSettled !== "" ? { reason: denyReasonSettled } : {}),
                 };
             }
-            return false;
+            return bare;
         };
         const shapeOutcome = (settled) => {
             if (windowRouteUnavailable) {
-                return this.unattendedOutcome({ arm: "window_expired", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability }) === false
-                    ? shapeDeny()
-                    : "unavailable";
+                const unattended = this.unattendedOutcome({ arm: "window_expired", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
+                return unattended === "unavailable" ? unattended : shapeDeny(unattended);
             }
             if (settled.allowed) {
                 return settled.updatedInput !== undefined ? { allow: true, updatedInput: settled.updatedInput } : true;
             }
-            return shapeDeny();
+            return shapeDeny(false);
         };
         const settle = (allowed, outcome, updatedInput, hostSettledBy, denyReason) => {
             if (done)
@@ -1266,10 +1315,11 @@ export class ToolApprovalCoordinator {
                 const store = this.askStore;
                 const pinnedAskId = askId;
                 const pinnedBatchId = batchId;
+                const claimIntent = this.unattendedClaimIntent;
                 await resolveLocalOutcome({
                     intent: "expire",
                     storeLabel: "claimTerminal(window)",
-                    claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, "expire"), "claimTerminal(window)", timeoutMs, (late) => {
+                    claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, claimIntent), "claimTerminal(window)", timeoutMs, (late) => {
                         if (!late.claimed) {
                             lateClaimLossSettle(late.current, "expire");
                             return;
@@ -1385,6 +1435,7 @@ export class ToolApprovalCoordinator {
             ...(ruleLaneMaterial !== undefined ? { ruleLane: ruleLaneMaterial } : {}),
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
+            ...(req.mandated === true ? { mandated: true } : {}),
             ...(askId !== undefined && batchId !== undefined ? { askId, batchId } : {}),
         };
         selfEntry = pendingEntry;
@@ -1447,6 +1498,7 @@ export class ToolApprovalCoordinator {
                     const store = this.askStore;
                     const pinnedAskId = askId;
                     const pinnedBatchId = batchId;
+                    const claimIntent = this.unattendedClaimIntent;
                     const settleUnreachable = () => {
                         if (done)
                             return;
@@ -1456,7 +1508,7 @@ export class ToolApprovalCoordinator {
                     await resolveLocalOutcome({
                         intent: "unreachable",
                         storeLabel: "claimTerminal(emit-failed)",
-                        claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, "expire"), "claimTerminal(emit-failed)", timeoutMs, (late) => {
+                        claim: (timeoutMs) => boundedClaim(() => store.claimTerminal(pinnedAskId, pinnedBatchId, claimIntent), "claimTerminal(emit-failed)", timeoutMs, (late) => {
                             if (!late.claimed) {
                                 lateClaimLossSettle(late.current, "unreachable");
                                 return;
@@ -1962,7 +2014,11 @@ export class ToolApprovalCoordinator {
     }
     finishRespond(id, entry, parsed, opts) {
         let rememberApplied;
-        const grantable = entry.requiresRealApproval !== true && entry.governanceForced !== true;
+        const grantable = standingAnswerMayRetire({
+            governanceForced: entry.governanceForced === true,
+            requiresRealApproval: entry.requiresRealApproval === true,
+            mandated: entry.mandated === true,
+        });
         if (parsed.value === "allow_session")
             rememberApplied = Boolean(entry.sessionId) && grantable;
         if (parsed.value === "allow_session" && entry.sessionId && grantable) {

package/dist/trace/core-keyset-guard.d.ts

@@ -25,7 +25,7 @@ import type { ToolApprovalFrame } from "../tool-approval.js";
  *  `type X<T extends never> = T`(抄一份就是第二个写者,两处哪天分岔谁都发现不了)。
  *  本文件只有类型、不产 JS,所以被 `import type` 引用不新增任何运行期边。 */
 export type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId" | "error" | "errorCode" | "apiFailure" | "agentMessage" | "_sema_provenance" | "spawnName" | "handback" | "compaction" | "resupplied" | "attempt";
 type NotificationExcluded = (typeof import("./wire-projection-faces.js").WIRE_PROJECTION_FACES)["task_notification"]["excluded"][number];
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected | NotificationExcluded>>;
 type _GuardNotificationReverse = AssertAllKeysHandled<Exclude<NotificationProjected | NotificationExcluded, keyof TaskNotificationPayload>>;
@@ -59,8 +59,8 @@ type _GuardMailboxReverse = AssertAllKeysHandled<Exclude<MailboxProjected, keyof
 type MailboxAppendProjected = "from" | "content" | "sentAt" | "hopChain" | "peerMeta";
 type _GuardMailboxAppend = AssertAllKeysHandled<Exclude<keyof MailboxAppendMessage, MailboxAppendProjected>>;
 type _GuardMailboxAppendReverse = AssertAllKeysHandled<Exclude<MailboxAppendProjected, keyof MailboxAppendMessage>>;
-type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection";
-type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny";
+type WiringSectionProjected = "schemaVersion" | "leg" | "ask" | "question" | "interaction" | "elicit" | "parkLane" | "session" | "fleet" | "permissionRules" | "modelGate" | "autoMode" | "mcp" | "tools" | "hooks" | "lsp" | "writeProtection" | "teamRole";
+type WiringSectionExcluded = "governance" | "configFingerprint" | "autoConsolidation" | "readDeny" | "peerPresence";
 type _GuardWiringSections = AssertAllKeysHandled<Exclude<keyof WiringManifest, WiringSectionProjected | WiringSectionExcluded>>;
 type _GuardWiringSectionsReverse = AssertAllKeysHandled<Exclude<WiringSectionProjected | WiringSectionExcluded, keyof WiringManifest>>;
 type WiringSection<K extends keyof WiringManifest> = NonNullable<WiringManifest[K]>;
@@ -135,10 +135,10 @@ type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "prev
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;
 type TaskSpecWired = "objective" | "principal" | "images" | "sessionId" | "requireExistingSession" | "oneShot" | "clientContext" | "resumeAt" | "resumeAtMode" | "model" | "compactionModel" | "thinking" | "systemPrompt" | "appendSystemPrompt" | "promptProvider" | "memory" | "suggestNextPrompts" | "restoreFiles" | "acceptPartialRestore" | "rewindFilesTo" | "tools" | "excludeTools" | "deferTools" | "toolMaterializeStrategy" | "promptProfile" | "toolPolicy" | "onAsk" | "onQuestion" | "hooks" | "durableApproval" | "resourceSuspend" | "resilience" | "finalVerification" | "checkpointStore" | "handsReadOnly" | "memoryPersistenceCapable" | "additionalDirectories" | "additionalReadDirectories" | "enablePlanMode" | "interactiveTools" | "enableFork" | "shellGate" | "writeFace" | "mcp" | "a2a" | "skills" | "backgroundScope" | "envFacts" | "limits" | "configOverrides" | "forwardSubagentEvents" | "retainSubagentSessions" | "retainBackgroundProcesses" | "outputSchema" | "outputRetries" | "compaction" | "attachments" | "selfOrchestration" | "getApiKeyAndHeaders" | "interactionPosture" | "agents" | "approverPosture" | "taskId" | "signal" | "preemptSignal" | "modelRole" | "enableBlockedReport" | "maxSuspends" | "autoModeRequested" | "skillListingBudgetFraction" | "skillListingMaxDescChars" | "excludeAllTools";
-type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars";
+type TaskSpecUnwired = "actor" | "roles" | "lspManager" | "tracer" | "readFace" | "readDenyPatterns" | "interactiveQuestionFallback" | "alwaysLoadTools" | "restoreGatedTools" | "deferSelfResolve" | "basePolicyForResumeEdit" | "lspDiagnostics" | "streamingToolExecution" | "toolResultThresholdChars" | "peerPresence";
 type _GuardTaskSpec = AssertAllKeysHandled<Exclude<keyof TaskSpec, TaskSpecWired | TaskSpecUnwired>>;
 type _GuardTaskSpecReverse = AssertAllKeysHandled<Exclude<TaskSpecWired | TaskSpecUnwired, keyof TaskSpec>>;
-type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel";
+type TaskResultForwarded = "taskId" | "runId" | "sessionId" | "terminal" | "model" | "effectiveReasoning" | "result" | "salvagedOutput" | "remoteEnvFailures" | "apiFailure" | "retryAfterMs" | "degraded" | "structuredOutput" | "rewindNotes" | "haltedOnUserRejection" | "haltedByUser" | "strandedHumanAnswers" | "pendingApproval" | "approvalWaitedMs" | "effectiveReadFace" | "effectiveReadDenyPatterns" | "effectiveWriteFace" | "effectiveMemoryScopes" | "stats" | "editedFiles" | "responseModel" | "compaction";
 type TaskResultStripped = never;
 type _GuardTaskResult = AssertAllKeysHandled<Exclude<keyof TaskResult, TaskResultForwarded | TaskResultStripped>>;
 type _GuardTaskResultReverse = AssertAllKeysHandled<Exclude<TaskResultForwarded | TaskResultStripped, keyof TaskResult>>;

package/dist/trace/ledger-sink.js

@@ -1,7 +1,7 @@
 import {} from "@sema-agent/core";
 import { outwardPlane } from "../terminal.js";
 import { modelTextEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, turnEndEventData, contextUsageEventData } from "./project.js";
-import { NotifiedKeys, taskNotificationStreamKey } from "../orchestration/workflow-completion-inbox.js";
+import { NotifiedKeys, taskNotificationStreamKeyOf } from "../orchestration/workflow-completion-inbox.js";
 import { isParkLedgerEventType } from "./ledger-events.js";
 import { isModelSegmentBoundary, reasoningDeltaBytes, reasoningSegmentEventId } from "./model-segment.js";
 export function createSerialLedgerAppend(appendEvent, startSeq) {
@@ -119,7 +119,7 @@ export function createLedgerSink(opts) {
                 break;
             case "task_notification": {
                 const tn = ev.notification;
-                const tnKey = tn?.task_id ? taskNotificationStreamKey({ task_type: tn.task_type, task_id: tn.task_id, status: String(tn.status), seq: tn.seq }) : undefined;
+                const tnKey = taskNotificationStreamKeyOf(tn);
                 const tnPrior = tnKey !== undefined ? keys.get(tnKey) : undefined;
                 if (tnPrior === undefined || !(await tnPrior)) {
                     const write = append("task_notification", taskNotificationEventData(ev));

package/dist/trace/project.d.ts

@@ -422,6 +422,17 @@ export declare function taskNotificationEventData(ev: {
          *  `kind` 过闭集(`trace/sema-provenance.ts` 单点,park 半场同一判据);`agentType` 本 mount 恒缺席(工具无
          *  agent-type 席),在场即透传(fleet spawn 帧按 taskId 可 join 时上游给)。 */
         _sema_provenance?: SemaProvenanceInput;
+        /** core 7.30.0 [ref] S1 / #1034 / #1036(S-616):委派终态帧三枚 facet + 重供两键 —— 判据单点在
+         *  `trace/task-notification-facets.ts`(与 park 半场同一只;入参按 `unknown` 收、判过形才成 typed)。 */
+        spawnName?: string;
+        handback?: string;
+        compaction?: {
+            passes: number;
+            breakerOpen: boolean;
+            kind?: string;
+        };
+        resupplied?: boolean;
+        attempt?: number;
     };
     eventId?: string;
     parentToolCallId?: string;
@@ -840,6 +851,8 @@ export declare function compactedEventData(ev: {
      *  的数、post 恒是结构和 + 固定提示词开销,两者的差混坐标,实测在普通 run 上是负数)。本仓的处置因此
      *  是**三条都逐字透传、一条都不合成**:谁要画上下文表就读 `freedTokens`,读不到就渲染 unknown。 */
     freedTokens?: number;
+    /** core 7.30.0 #1036(S-616):这一次压缩**摘要掉**了几条之前已交给模型的跨会话消息(在场 iff ≥1)。 */
+    summarizedCrossSessionMessages?: number;
     durationMs?: number;
     phaseDurations?: {
         prepareMs?: number;

package/dist/trace/project.js

@@ -1,10 +1,12 @@
 import { redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
-import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
 import { injectionTierOrAbsent } from "./injection-tier.js";
 import { semaProvenanceOrAbsent } from "./sema-provenance.js";
+import { resupplyFields, terminalFrameFacetFields } from "./task-notification-facets.js";
+import { dropProjectedFace } from "./projection-drop.js";
 export async function appendModelUsageDelta(append, modelUsage, taskId) {
     const delta = modelUsage?.drain(taskId);
     if (delta) {
@@ -229,10 +231,6 @@ export function toolEndEventData(ev) {
         ...identityFields(ev),
     };
 }
-const dropProjectedFace = (what) => {
-    recordFailOpen("server.trace.projection-input-malformed", what);
-    return undefined;
-};
 export function toolProgressEventData(ev) {
     const id = typeof ev.toolCallId === "string" && ev.toolCallId !== "" ? ev.toolCallId : undefined;
     const name = typeof ev.toolName === "string" && ev.toolName !== "" ? ev.toolName : undefined;
@@ -326,6 +324,8 @@ export function taskNotificationEventData(ev) {
             const p = semaProvenanceOrAbsent(n._sema_provenance);
             return p !== undefined ? { _sema_provenance: p } : {};
         })(),
+        ...terminalFrameFacetFields(n),
+        ...resupplyFields(n),
         ...(() => {
             const tier = injectionTierOrAbsent(ev.priority);
             return tier !== undefined ? { priority: tier } : {};
@@ -535,9 +535,17 @@ export function wiringManifestEventData(ev) {
         return { targetView };
     })();
     const mcp = projectWiringManifestMcpRows(m.mcp);
+    const teamRole = (() => {
+        if (m.teamRole === undefined)
+            return undefined;
+        if (!TEAM_ROLES.includes(m.teamRole))
+            return dropProjectedFace("wiring_manifest.teamRole is outside core TEAM_ROLES");
+        return m.teamRole;
+    })();
     return {
         ...(num(m.schemaVersion) !== undefined ? { schemaVersion: m.schemaVersion } : {}),
         ...(str(legIn.kind) !== undefined ? { leg: { kind: legIn.kind } } : {}),
+        ...(teamRole !== undefined ? { teamRole } : {}),
         ...(ask !== undefined ? { ask } : {}),
         ...(question !== undefined ? { question } : {}),
         ...(str(interactionIn.posture) !== undefined ? { interaction: { posture: interactionIn.posture } } : {}),
@@ -676,6 +684,15 @@ export function compactedEventData(ev) {
         ...(num(ev.tokensAfter) !== undefined ? { tokensAfter: num(ev.tokensAfter) } : {}),
         ...(num(ev.triggerTokensBefore) !== undefined ? { triggerTokensBefore: num(ev.triggerTokensBefore) } : {}),
         ...(num(ev.freedTokens) !== undefined ? { freedTokens: num(ev.freedTokens) } : {}),
+        ...(() => {
+            const v = ev.summarizedCrossSessionMessages;
+            if (v === undefined)
+                return {};
+            if (Number.isInteger(v) && v >= 1)
+                return { summarizedCrossSessionMessages: v };
+            dropProjectedFace("compacted.summarizedCrossSessionMessages is not an integer >= 1");
+            return {};
+        })(),
         ...(num(ev.durationMs) !== undefined ? { durationMs: num(ev.durationMs) } : {}),
         ...(phaseDurations !== undefined ? { phaseDurations } : {}),
     };

package/dist/trace/projection-drop.d.ts

@@ -0,0 +1,2 @@
+export declare function dropProjectedFace(what: string): undefined;
+//# sourceMappingURL=projection-drop.d.ts.map

package/dist/trace/projection-drop.js

@@ -0,0 +1,6 @@
+import { recordFailOpen } from "../observability/fail-open.js";
+export function dropProjectedFace(what) {
+    recordFailOpen("server.trace.projection-input-malformed", what);
+    return undefined;
+}
+//# sourceMappingURL=projection-drop.js.map

package/dist/trace/sema-provenance.d.ts

@@ -26,8 +26,11 @@ export declare const SEMA_PROVENANCE_KINDS: readonly ["agent_message"];
  *    (core-keyset-guard.ts ① 的同名排除键)一同候 [ref] 表态。放进 EXCLUDED 而不是 PROJECTED,是**沿用**上一行的
  *    裁定而不是新增特判:表态未出前放行一个 lane 词,等于替它预先声明一种 cli 渲染形。表态落定那天三处(本簿、
  *    载体键、①-nested 的 `peerMeta`)同批翻。
+ *  · `inbox_notice` —— core 7.30.0 #1036(S-616 提货;本闭集当拍真红出它)。**同一条车道的第三个载体**(收件箱通告,
+ *    `crossSessionMessage` / `crossSessionNotice` 之后),同一个 session-box drain 铸;载体键 `inboxNotice` 在
+ *    core-keyset-guard.ts ① 同批进 EXCLUDED。沿用上两行的裁定,不是新判据:[ref] 表态落定那天四处同批翻。
  */
-export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message", "cross_session_notice"];
+export declare const SEMA_PROVENANCE_KINDS_EXCLUDED: readonly ["cross_session_message", "cross_session_notice", "inbox_notice"];
 /** 本仓两条腿入参的**形**(不是 core 类型:入参是运行期载荷,`kind` 先当 string 收、经闭集才成 typed)。 */
 export interface SemaProvenanceInput {
     kind: string;