@sema-agent/server 7.99.0 → 7.100.0

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -1,5 +1,5 @@
 import { type SemaProvenanceInput } from "../trace/sema-provenance.js";
-import type { SystemInjectionPriority } from "@sema-agent/core";
+import { type SystemInjectionPriority, type TaskNotificationPayload } from "@sema-agent/core";
 import type { LedgerEventType } from "../trace/ledger-events.js";
 /** One pending completion, scoped to the session that must be told about it. `summary` is ALREADY
  *  redacted + length-bounded by core's notifier seam (see {@link WorkflowCompletionPayload}). */
@@ -76,7 +76,7 @@ export declare const SERVED_FENCE_MS: number;
  *  三路复审修1(MED):status 保留 RAW,不再归一 completed/failed —— 归一让同 id 无 seq 的两条 external
  *  通知(先 `event` 后 `cancelled`)折叠成同一把 `…:failed` 键,inbox map 里第二条 REPLACE 第一条,drain
  *  只吐一条(entry 的存储 status 列仍归一,那是账本的双终态列,不动;RAW status 本就随 payload extras
- *  透传)。这与 {@link taskNotificationStreamKey} 的 RAW 语义对齐(stream 侧早已保 RAW)。
+ *  透传)。这与流侧去重键(core `taskNotificationDedupKey`,见 {@link taskNotificationStreamKeyOf})的 RAW 语义对齐(stream 侧早已保 RAW)。
  *
  *  编码=防碰撞元组:域/taskId/status 走 JSON 数组(调用方自由串自造不了分隔符);`#seq` 尾折在 JSON 之外
  *  ——JSON 段恒以 `"]` 结尾,`#digits` 尾无歧义,于是 {@link foldKeyFamily} 的剥尾语义 AND SQL 双生子
@@ -92,33 +92,30 @@ export declare function taskNotificationFoldKey(n: {
     status: string;
     seq?: number;
 }): string;
-/** [ref] stream 侧去重键(core [ref]④a + codex 1.189 前双审 F2)= `域:taskId:status[#seq]`。
- *  与 {@link taskNotificationFoldKey} 同族,域二分也一致(codex F2 HIGH:external 通知的 task_id 是
- *  POST /v1/sessions/:id/notify 调用方自由串——同一条腿上,drain 出的 external 帧可与内部任务帧同形
- *  `task_id:status:seq` 撞键互吞,per-leg 键集并不豁免这个面,旧注释「没有跨调用方预占面」判错);
- *  仍与 fold key 有意不同的一点:status 保留 RAW(killed/cancelled/event 不归一 failed)——归一会让同
- *  task 的 Monitor event 批与 failed 终态在一条腿上互吞;wire 去重要的是逐帧身份,不是 inbox 的双终态列。
- *  `seq` 折入 = 停→唤→停的第二周期同 status 帧各自成键(core 1.283 起 background_agent 四腿 notify 铸
- *  cycleSeq;缺 seq 时旧键曾把二周期 completed 帧在 observer 臂反向吞掉——core [ref]④a);无 seq 的帧
- *  (bash/monitor terminal/retain 降级)保持单周期旧键=同键第二帧吞,诚实语义。[ref]B-10:core 4.0.0 起
- *  task_type 是必填闭合枚举——`task_type?` 可选性**不再对应旧 core 帧**,它活着只为家族前缀构造
- *  (server.ts fleet 腿 `taskNotificationFoldKey({task_id,status})` 同款用法);缺席归 "task" 域的语义
- *  只在前缀用途下生效。external 帧三来源齐备(notify 端点 core 铸 / inbox entry extras 存 / drain 帧
- *  spread 复原),不会漏域。observer 臂 / stream 臂 / turn-open drain 登记三处必须用本函数
- *  构键且都传 task_type,键形漂移=去重永 miss。 */
-export declare function taskNotificationStreamKey(n: {
-    task_type?: string;
-    task_id: string;
-    status: string;
-    seq?: number;
-}): string;
+/** 一帧里组成流侧去重键的那几个字段 —— 投影后的 wire 帧(drain 出帧 / stream 事件的 `notification`)与 core 载荷同形读。
+ *  型取 core 载荷的那五位(`Partial`:帧上任一位都可能缺,缺了就不成键,见 {@link taskNotificationStreamKeyOf})。 */
+export type TaskNotificationKeyFields = Partial<Pick<TaskNotificationPayload, "task_type" | "task_id" | "status" | "seq" | "attempt">>;
+/**
+ * **唯一**从一帧上读键字段的地方(S-616 按类修):此前七个调用点各自手抄 `{ task_type, task_id, status, seq }` 四字段投影,
+ * core 给帧身份加一个分量(本版的 `attempt`)时,每一处手抄都得有人记得补 —— 漏一处就是那一腿的重供帧被吞。现在调用点
+ * 把整只帧交过来,键字段只在这里读。
+ *
+ * 🔴 **键 = core `taskNotificationDedupKey` 的输出**(NP-6,7.100.0 合并复审 [ref] 交叉表 #8,opus A3;[ref]):本仓流侧键此前
+ * 是 core 那只注入去重键的手抄孪生(`域:id:status[#seq]`),S-616 又逐字抄了它的 `:a<attempt>` 尾 —— core 改一次键规则,
+ * 这里就得有人记得跟。键只活在进程内(每腿 {@link NotifiedKeys},不落盘、不上 wire),换成 core 的输出零迁移面。
+ * core 那只键同样按车道分域(external 车道 `external:<id>`,其余裸 id —— codex F2 的「external 帧不许与内部帧撞键」照旧成立)、
+ * status 保 RAW、`seq` 折入、`attempt` 缺席 / 1 时字节不变。调用点手里已有 core 载荷的(observer 臂)直接调 core 函数。
+ * 成不了键 ⇒ `undefined`(该帧不进去重账,照写 —— at-least-once,壳按键去重兜底):`task_id` 缺席 / 空串(与旧形
+ * `f.task_id &&` 同判)、`task_type` / `status` 缺席(core 4.0.0 起两者在载荷上必填,缺了只能是坏帧 / 前 4.0 的存量 inbox 行)。
+ */
+export declare function taskNotificationStreamKeyOf(n: TaskNotificationKeyFields | undefined): string | undefined;
 /** Per-leg notified-key ledger cap (codex 1.189 前双审 F3):一条超长腿(海量互异 bg 通知)不许把键集
  *  撑到无界——超出删最老插入(Map 迭代序=插入序)。远高于任何真实 per-leg 通知量;被逐键的老通知
  *  最坏情形=同键晚到帧多写一次(at-least-once,shell 按键 dedup 兜底),绝不吞新帧。 */
 export declare const NOTIFIED_KEYS_MAX = 4096;
 /**
  * Per-leg delivered-notification ledger(codex 1.189 前双审 F1 HIGH 的修位)。
- * 键 = {@link taskNotificationStreamKey};值 = 「认领这把键的那次写是否真落盘」的 promise(true=成功)。
+ * 键 = {@link taskNotificationStreamKeyOf} / core `taskNotificationDedupKey`(同一只);值 = 「认领这把键的那次写是否真落盘」的 promise(true=成功)。
  * 为什么是 Map<string, Promise<boolean>> 而不是 Set:bg/resume 腿的 observer 臂是 fire-and-forget append
  * (`void append(...)`)——旧 Set 下 append 失败(SQL blip)时键已被占而盘上无帧,core pend-drain 把同
  * payload 重放到 stream 臂时被键吞 = 通知永丢。现在 stream 臂对已见键 `await` 认领方的真实结果,false 则
@@ -268,6 +265,17 @@ export declare function taskNotificationInboxEntry(sessionId: string, owner: str
         body: string;
     };
     _sema_provenance?: SemaProvenanceInput;
+    /** S-616(core 7.30.0 [ref] S1 / #1034 / #1036):委派终态帧三枚 facet + 重供两键 —— 判据与 live 腿同一只
+     *  (`trace/task-notification-facets.ts`,入参按 `unknown` 收、判过形才成 typed)。 */
+    spawnName?: string;
+    handback?: string;
+    compaction?: {
+        passes: number;
+        breakerOpen: boolean;
+        kind?: string;
+    };
+    resupplied?: boolean;
+    attempt?: number;
 }, enqueuedAt: number, 
 /** lead-b (dual-ID audit): the PARENT run's durable taskId (the uuid the shell's footer rows
  *  key on) — rides the drained frame so a consumer can bind the a*-keyed child notification to its uuid-keyed

package/dist/orchestration/workflow-completion-inbox.js

@@ -3,6 +3,8 @@ import { join } from "node:path";
 import { redactSecrets } from "../trace/redact.js";
 import { injectionTierOrAbsent } from "../trace/injection-tier.js";
 import { semaProvenanceOrAbsent } from "../trace/sema-provenance.js";
+import { resupplyFields, terminalFrameFacetFields } from "../trace/task-notification-facets.js";
+import { taskNotificationDedupKey } from "@sema-agent/core";
 export const MAX_PENDING_PER_SESSION = 100;
 export const COMPACT_EVERY = 512;
 export const PURGE_FENCE_MS = 10 * 60 * 1000;
@@ -11,9 +13,10 @@ export function taskNotificationFoldKey(n) {
     const domain = n.task_type === "external" ? "external" : "task";
     return `${JSON.stringify([domain, n.task_id, n.status])}${n.seq !== undefined ? `#${n.seq}` : ""}`;
 }
-export function taskNotificationStreamKey(n) {
-    const domain = n.task_type === "external" ? "external" : "task";
-    return `${domain}:${n.task_id}:${n.status}${n.seq !== undefined ? `#${n.seq}` : ""}`;
+export function taskNotificationStreamKeyOf(n) {
+    if (n === undefined || typeof n.task_id !== "string" || n.task_id.length === 0 || n.task_type === undefined || n.status === undefined)
+        return undefined;
+    return taskNotificationDedupKey({ task_type: n.task_type, task_id: n.task_id, status: n.status, seq: n.seq, attempt: n.attempt });
 }
 export const NOTIFIED_KEYS_MAX = 4096;
 export class NotifiedKeys {
@@ -322,6 +325,8 @@ export function taskNotificationInboxEntry(sessionId, owner, n, enqueuedAt, pare
             const p = semaProvenanceOrAbsent(n._sema_provenance);
             return p !== undefined ? { _sema_provenance: p } : {};
         })(),
+        ...terminalFrameFacetFields(n),
+        ...resupplyFields(n),
     };
     return {
         sessionId,

package/dist/plugins/approval-ask-store-file.d.ts

@@ -21,7 +21,7 @@ export declare const ASK_JOURNAL_COMPACT_GROWTH = 2;
  * 账本的**动词闭集**([ref] 形)。运行期的词表判定与编译期的穷尽 `switch` 读同一份:
  * 往这里加一个词,{@link FileApprovalAskStore.replayOp} 的 switch 立刻编译红(漏一口不可能发布)。
  */
-declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteByTask"];
+declare const JOURNAL_OPS: readonly ["ensureAsk", "transitionAsk", "decideAsk", "claimTerminal", "claimTerminalRefuse", "expireAsk", "bindBatch", "abortBatch", "deferReconcile", "resolveProvisional", "deleteByTask"];
 type JournalOpWord = (typeof JOURNAL_OPS)[number];
 /** 运行期词表(上面的数组)与类型面动词维({@link JournalCall})的**双向**对表 —— 任一边加词而另一边
  *  没跟上,这个别名解析成 `never`,{@link JOURNAL_OP_TABLE_GATE} 的赋值当场编译红。 */
@@ -29,6 +29,18 @@ type JournalOpTableIsExhaustive = (JournalCall["op"] extends JournalOpWord ? (Jo
 /** 上面那条对表的**执法位**(占位常量形,`core-keyset-guard.ts` 的占位元组同精神):运行期无用,
  *  存在的唯一理由是让「词表与类型面分家」在编译期就红,而不是等到某条记录重放不出来。 */
 export declare const JOURNAL_OP_TABLE_GATE: JournalOpTableIsExhaustive;
+/**
+ * 老动词 `claimTerminal` 下**只许**出现的两个意图(NP-9,7.100.0 合并复审 gpt-6 验修腿 [medium])。
+ *
+ * 🔴 **为什么终局 claim 的新意图必须记成新动词**:已发布的读者(7.99.0 及以前)的内核按 `intent === "expire" ? … : <cancel 臂>`
+ * 分叉 —— 它不认识的意图**不会被拒,而是被当成 cancel 重放**(行 VOID)。所以一个新意图若记在老动词下,回滚到老版本时
+ * 那条结算会**静默**改判(真读者复现:`refuse` ⇒ `VOID/null/null`,零拒绝记录)。老读者对**闭集外动词**是拒启并点名出路
+ * (「a DOWNGRADE: a newer server wrote it」)⇒ 新意图记成新动词 = 降级时响亮拒启,而不是静默误读。
+ * 规则:`AskTerminalClaimIntent` 每加一个意图,就在 {@link JournalCall} 里加一个动词、在 {@link FileApprovalAskStore.claimTerminal}
+ * 的穷尽 switch 里给它一臂(漏了 ⇒ 编译红);本型永远只有这两个词。本版读者对老动词下的其它意图同样**拒启**(不按某一臂重放)。
+ */
+declare const JOURNAL_V1_CLAIM_INTENTS: readonly ["expire", "cancel"];
+type JournalV1ClaimIntent = (typeof JOURNAL_V1_CLAIM_INTENTS)[number];
 /** 一次写调用的实参(动词维判别式)——盘上记的就是它,重放时原样喂回内核。 */
 type JournalCall = {
     op: "ensureAsk";
@@ -48,7 +60,13 @@ type JournalCall = {
     op: "claimTerminal";
     askId: string;
     batchId: string;
-    intent: AskTerminalClaimIntent;
+    intent: JournalV1ClaimIntent;
+}
+/** NP-2 的部署政策拒(`claimTerminal(…, "refuse")`)—— 新动词而不是老动词带新意图,理由见 {@link JOURNAL_V1_CLAIM_INTENTS}。 */
+ | {
+    op: "claimTerminalRefuse";
+    askId: string;
+    batchId: string;
 } | {
     op: "expireAsk";
     askId: string;

package/dist/plugins/approval-ask-store-file.js

@@ -1,6 +1,7 @@
 import { closeSync, copyFileSync, openSync, readSync, statSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { AppendLog, atomicWriteFile, ensureDir, readJsonlRecords } from "@sema-agent/core";
+import { createSkippedRecordSink } from "../observability/corrupt-read-seat.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { StoreBootRefusalError } from "./store-contracts.js";
 import { InMemoryApprovalAskStore, encodeDecideUpdatedInput, encodeStoreJsonPayload } from "./approval-ask-store-memory.js";
@@ -13,6 +14,7 @@ const JOURNAL_OPS = [
     "transitionAsk",
     "decideAsk",
     "claimTerminal",
+    "claimTerminalRefuse",
     "expireAsk",
     "bindBatch",
     "abortBatch",
@@ -22,6 +24,8 @@ const JOURNAL_OPS = [
 ];
 const JOURNAL_OP_WORDS = new Set(JOURNAL_OPS);
 export const JOURNAL_OP_TABLE_GATE = true;
+const JOURNAL_V1_CLAIM_INTENTS = ["expire", "cancel"];
+const JOURNAL_V1_CLAIM_INTENT_WORDS = new Set(JOURNAL_V1_CLAIM_INTENTS);
 function endsAtRecordBoundary(path) {
     const size = statSync(path).size;
     if (size === 0)
@@ -54,10 +58,10 @@ export class FileApprovalAskStore {
         this.path = join(dir, APPROVAL_ASK_JOURNAL_FILE);
         this.core = new InMemoryApprovalAskStore({ now: () => this.clockRead() });
         const tornTail = existsSync(this.path) && !endsAtRecordBoundary(this.path);
-        const records = readJsonlRecords(this.path, (info) => {
+        const records = readJsonlRecords(this.path, createSkippedRecordSink((info) => {
             this.corruptLineCount += 1;
             recordFailOpen("server.approval-ask-journal.corrupt-record-skipped", `path=${info.path} reason=${info.reason}`);
-        });
+        }));
         for (const rec of records)
             this.replayRecord(rec);
         this.records = records.length;
@@ -156,6 +160,8 @@ export class FileApprovalAskStore {
             refuse("verb outside this build's closed set (a DOWNGRADE: a newer server wrote it)");
         if (typeof probe.t !== "number" || !Number.isFinite(probe.t))
             refuse("call record without a clock reading");
+        if (probe.op === "claimTerminal" && !JOURNAL_V1_CLAIM_INTENT_WORDS.has(String(raw.intent)))
+            refuse("claimTerminal intent outside this build's journal set (a newer server wrote it)");
         const rec = raw;
         this.pinnedNow = rec.t;
         try {
@@ -180,6 +186,8 @@ export class FileApprovalAskStore {
                 return this.core.decideAsk(rec.askId, rec.batchId, rec.decision);
             case "claimTerminal":
                 return this.core.claimTerminal(rec.askId, rec.batchId, rec.intent);
+            case "claimTerminalRefuse":
+                return this.core.claimTerminal(rec.askId, rec.batchId, "refuse");
             case "expireAsk":
                 return this.core.expireAsk(rec.askId, rec.batchId);
             case "bindBatch":
@@ -209,7 +217,17 @@ export class FileApprovalAskStore {
         return this.write({ op: "decideAsk", askId, batchId, decision: journalled }, (c) => this.core.decideAsk(c.askId, c.batchId, c.decision));
     }
     async claimTerminal(askId, batchId, intent) {
-        return this.write({ op: "claimTerminal", askId, batchId, intent }, (c) => this.core.claimTerminal(c.askId, c.batchId, c.intent));
+        switch (intent) {
+            case "expire":
+            case "cancel":
+                return this.write({ op: "claimTerminal", askId, batchId, intent }, (c) => this.core.claimTerminal(c.askId, c.batchId, c.intent));
+            case "refuse":
+                return this.write({ op: "claimTerminalRefuse", askId, batchId }, (c) => this.core.claimTerminal(c.askId, c.batchId, "refuse"));
+            default: {
+                const unreachable = intent;
+                throw new Error(`FileApprovalAskStore.claimTerminal: unknown intent ${String(unreachable)}`);
+            }
+        }
     }
     async expireAsk(askId, batchId) {
         return this.write({ op: "expireAsk", askId, batchId }, (c) => this.core.expireAsk(c.askId, c.batchId));

package/dist/plugins/approval-ask-store-memory.d.ts

@@ -82,6 +82,8 @@ export declare class InMemoryApprovalAskStore implements ApprovalAskStore {
      * 既有 verb(expire ⇒ `this.expireAsk`;cancel ⇒ `this.transitionAsk(STREAM_PENDING→VOID)`)——律 2
      * 「一台机器」在本 twin 的落笔处是**字面同一个函数做写**(零第二套谓词);委托也让测试对 verb 的
      * 实例级故障注入(`store.expireAsk = throwing` 等)对 claim 恒有效,注入面不因原语换名而漂移。
+     * `refuse`(NP-2)没有可委托的既有 verb(`decideAsk` 要批 OPEN —— 人答臂的语义),就地写;对它的故障注入走
+     * `store.claimTerminal` 本身。
      * 原子性:方法体的判定与读回之间唯一的 await 是对**同步体** verb 的调用(本店头注的单线程天然原子
      * 论证);await 后读到的行 ≥ CAS 线性化点,而非 pending 态无回边 ⇒ 败方读数自足(与 SQL 侧同一条
      * 单调性论证)。

package/dist/plugins/approval-ask-store-memory.js

@@ -1,5 +1,5 @@
 import { canAskTransition } from "../approval-ask-machine.js";
-import { assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
+import { assertDecideSettledBy, assertIdempotencyKeyShape, assertIntegralEpochMs, ApprovalAskReadAbortedError, claimTargetState, POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./approval-ask-store-sql.js";
 function applyPatch(row, patch) {
     if (patch.decision !== undefined)
         row.decision = patch.decision;
@@ -153,18 +153,44 @@ export class InMemoryApprovalAskStore {
         return { ok: true, row: { ...ask } };
     }
     async claimTerminal(askId, batchId, intent) {
-        if (intent === "expire") {
-            const res = await this.expireAsk(askId, batchId);
-            if (res.won)
-                return { claimed: true, voidedSiblings: res.voidedSiblings };
-        }
-        else {
-            const scoped = this.asks.get(askId);
-            if (scoped !== undefined && scoped.batchId !== batchId)
-                return { claimed: false, current: { state: "absent" } };
-            const won = await this.transitionAsk(askId, "STREAM_PENDING", "VOID", { updatedAtMs: this.now() });
-            if (won)
-                return { claimed: true, voidedSiblings: [] };
+        switch (intent) {
+            case "expire": {
+                const res = await this.expireAsk(askId, batchId);
+                if (res.won)
+                    return { claimed: true, voidedSiblings: res.voidedSiblings };
+                break;
+            }
+            case "cancel": {
+                const scoped = this.asks.get(askId);
+                if (scoped !== undefined && scoped.batchId !== batchId)
+                    return { claimed: false, current: { state: "absent" } };
+                const won = await this.transitionAsk(askId, "STREAM_PENDING", "VOID", { updatedAtMs: this.now() });
+                if (won)
+                    return { claimed: true, voidedSiblings: [] };
+                break;
+            }
+            case "refuse": {
+                assertDecideSettledBy(POLICY_REFUSAL_DECISION);
+                const to = claimTargetState(intent);
+                if (!canAskTransition("STREAM_PENDING", to))
+                    throw new Error(`InMemoryApprovalAskStore.claimTerminal: illegal terminal claim STREAM_PENDING -> ${to} (askId=${askId})`);
+                const ask = this.asks.get(askId);
+                if (ask !== undefined && ask.state === "STREAM_PENDING" && ask.batchId === batchId) {
+                    const now = this.now();
+                    ask.state = to;
+                    ask.decision = POLICY_REFUSAL_DECISION.decision;
+                    ask.settledBy = POLICY_REFUSAL_DECISION.settledBy;
+                    ask.decidedAtMs = now;
+                    ask.rev += 1;
+                    ask.updatedAtMs = now;
+                    return { claimed: true, voidedSiblings: [] };
+                }
+                break;
+            }
+            default: {
+                const unreachable = intent;
+                throw new Error(`InMemoryApprovalAskStore.claimTerminal: unknown intent ${String(unreachable)}`);
+            }
         }
         const cur = this.asks.get(askId);
         return { claimed: false, current: projectAskTerminalClaimTruth(cur !== undefined && cur.batchId === batchId ? { ...cur } : null) };

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -302,13 +302,32 @@ export interface ExpireResult {
 }
 /**
  * [ref](DEBTS [ref]-R1 终局;core [ref] §4.4「@server 对表键形」,黑板 [ref] 认领):终局 claim 的
- * 意图。ask 行的 TERMINAL 对儿只有两员 —— `expire`(窗到期 / emit 全灭共用:STREAM_PENDING→PARKING +
- * 批转投递面 + 兄弟撤卡,与 `expireAsk` 同一台 CAS 机器)与 `cancel`(取消臂:STREAM_PENDING→VOID)。
+ * 意图。ask 行的本地终局 claim 有三员:
+ *  · `expire` —— 窗到期 / emit 全灭在 **park 政策**下:STREAM_PENDING→PARKING + 批转投递面 + 兄弟撤卡,与
+ *    `expireAsk` 同一台 CAS 机器(批是 park 路由的单位);
+ *  · `cancel` —— 取消臂:STREAM_PENDING→VOID;
+ *  · `refuse` —— 同两臂在 **deny 政策**下(NP-2,7.100.0 合并复审 [ref] 交叉表 #4):STREAM_PENDING→DECIDED,
+ *    决议 = {@link POLICY_REFUSAL_DECISION}(deny + 结算来源 `policy`),**按 ask 作用域** —— 不碰批、不连坐兄弟
+ *    (deny 政策下没有 park 路由,批不是任何东西的单位;存量整腿批行因此同判)。存在理由:部署政策拒交给 core 的
+ *    是 `{allow:false, settledBy:"policy"}`,行若停 PARKING,收敛后成 DENIED 且无来源 ⇒ 同 ask 重入回放裸 `false`
+ *    (core 契约里那是「一个人拒了」)。行落的来源与交出去的来源是同一个词,回放由 `outcomeOfDecidedRow` 读回同一个对象。
  * **人答臂(decide)不入本枚举**:`decideAsk` 带决议载荷与回决幂等键,其失败臂本就携行读数(384 §4.4
- * 表「decideAsk(人答臂)」格的「视现有 CAS 形」裁定)——三 verb 的「一台机器义务」(384 §4.3-2)由共享
- * WHERE 谓词 {@link pendingClaimWhere} 兑现,不是把三个不同 verb 塞进一个函数。
+ * 表「decideAsk(人答臂)」格的「视现有 CAS 形」裁定)——终局 verb 的「一台机器义务」(384 §4.3-2)由共享
+ * WHERE 谓词 {@link pendingClaimWhere} 兑现,不是把不同 verb 塞进一个函数。
  */
-export type AskTerminalClaimIntent = "expire" | "cancel";
+export type AskTerminalClaimIntent = "expire" | "cancel" | "refuse";
+/**
+ * `refuse` 意图落行的决议(NP-2)—— **部署政策拒**:deny + 结算来源 `policy`。来源词的型取 core 的 `HostSettledBy`
+ * (core 改词 / 退词 ⇒ 这里 tsc 红);协调器交给 core 的那一只(`tool-approval.ts` 的 `UnattendedPolicyRefusal`)读的是
+ * **同一个**常量,于是「行上记的来源」与「首判交出去的来源」在构造上是一个词。三 twin 落行前都过 {@link assertDecideSettledBy}
+ * (settled_by 的唯一形门:长度 ≤ 列宽、只与 deny 同行)。
+ */
+export declare const POLICY_REFUSAL_DECISION: {
+    readonly decision: "deny";
+    readonly settledBy: Extract<HostSettledBy, "policy">;
+};
+/** 终局 claim 意图 → 本次 CAS 的目标态(穷举 switch:意图闭集加一个词 ⇒ 这里编译期先红)。 */
+export declare function claimTargetState(intent: AskTerminalClaimIntent): AskState;
 /**
  * 败方读数:行上终局相关列的一致投影(status 词表 = 行自己的 `AskState`,零新值域 —— 384 §4.2 的
  * 「reuse the row's own vocabulary」)。

package/dist/plugins/approval-ask-store-sql.js

@@ -52,6 +52,21 @@ async function withReadSignal(op, signal, where) {
             signal.removeEventListener("abort", onAbort);
     }
 }
+export const POLICY_REFUSAL_DECISION = { decision: "deny", settledBy: "policy" };
+export function claimTargetState(intent) {
+    switch (intent) {
+        case "expire":
+            return "PARKING";
+        case "cancel":
+            return "VOID";
+        case "refuse":
+            return "DECIDED";
+        default: {
+            const unreachable = intent;
+            throw new Error(`approval-ask-store: unknown terminal claim intent ${String(unreachable)}`);
+        }
+    }
+}
 export function projectAskTerminalClaimTruth(row) {
     if (row === null || row.state === "STREAM_PENDING")
         return { state: "absent" };
@@ -484,10 +499,12 @@ export class SqlApprovalAskStore {
         return { ok: true, row };
     }
     async claimTerminal(askId, batchId, intent) {
-        const to = intent === "expire" ? "PARKING" : "VOID";
+        const to = claimTargetState(intent);
         if (!canAskTransition("STREAM_PENDING", to)) {
             throw new Error(`approval-ask-store.claimTerminal: illegal terminal claim STREAM_PENDING -> ${to} (askId=${askId})`);
         }
+        if (intent === "refuse")
+            assertDecideSettledBy(POLICY_REFUSAL_DECISION);
         const now = Date.now();
         const dialect = this.db.dialect;
         const conn = await this.db.connect();
@@ -500,13 +517,20 @@ export class SqlApprovalAskStore {
                     return { claimed: false, current: { state: "absent" } };
                 }
             }
-            const askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state = ${ph(dialect, 1)}, rev = rev + 1, updated_at_ms = ${ph(dialect, 2)} WHERE ${pendingClaimWhere(dialect, 3)}`, [to, now, askId, batchId]);
+            const askRes = intent === "refuse"
+                ? await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state = ${ph(dialect, 1)}, decision = ${ph(dialect, 2)}, settled_by = ${ph(dialect, 3)}, decided_at_ms = ${ph(dialect, 4)}, rev = rev + 1, updated_at_ms = ${ph(dialect, 5)} WHERE ${pendingClaimWhere(dialect, 6)}`, [to, POLICY_REFUSAL_DECISION.decision, POLICY_REFUSAL_DECISION.settledBy, now, now, askId, batchId])
+                : await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state = ${ph(dialect, 1)}, rev = rev + 1, updated_at_ms = ${ph(dialect, 2)} WHERE ${pendingClaimWhere(dialect, 3)}`, [
+                    to,
+                    now,
+                    askId,
+                    batchId,
+                ]);
             if (askRes.affected !== 1) {
                 const sel = await conn.query(`SELECT ${askCols(dialect)} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ${ph(dialect, 1)} AND batch_id = ${ph(dialect, 2)} FOR UPDATE`, [askId, batchId]);
                 await conn.rollback();
                 return { claimed: false, current: projectAskTerminalClaimTruth(sel.rows[0] ? mapAskRow(sel.rows[0]) : null) };
             }
-            if (intent === "cancel") {
+            if (intent !== "expire") {
                 await conn.commit();
                 return { claimed: true, voidedSiblings: [] };
             }

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -1,7 +1,7 @@
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type ExecutionOutcomeRecordWord, type GateOutcome, type Checkpoint, type CheckpointGate, type CheckpointState, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type PendingSteerInput, type ResumeOutcome, type ResolvedOutcome, type ResolveExpectation, type ReopenReason, type RiskDescriptor, type StoreDurability, type StoreFidelity } from "@sema-agent/core";
-import { type RuleOfferProjection } from "../approval-card.js";
+import { type ParkRowFacts, type RuleOfferProjection } from "../approval-card.js";
 import { type SqlDialect, type SqlDriver } from "./sql-driver.js";
 export { approvalPayloadFingerprint } from "./approval-payload-fingerprint.js";
 /**
@@ -30,8 +30,12 @@ export declare const TERMINAL_GRACE_MS = 3600000;
  * resume-read-path log we emit a stable, non-reversible fingerprint instead, enough to correlate get↔resolve.
  */
 export declare function tokenFingerprint(token: string): string;
-/** Non-secret view of a pending checkpoint for the operator approval queue — deliberately NO token. */
-export interface PendingCheckpoint {
+/** Non-secret view of a pending checkpoint for the operator approval queue — deliberately NO token.
+ *
+ *  🔴 S-700:行**顶层**另带 {@link ParkRowFacts}(`requiresRealApproval` / `ruleOffersAbsence`,真才带、缺席 ≠ false)——
+ *  型与值都只有一个来源:`approval-card.ts` 的 {@link parkRowFacts}(两只店各读自己手里的那只寄存行 `pendingAction`,
+ *  交给它、原样展开)。继承而不是在这里逐键再写一遍:core 给这一臂再加一位同类事实时,改的只有那张 Pick 表。 */
+export interface PendingCheckpoint extends ParkRowFacts {
     sessionId: string;
     scope: string;
     toolName: string | null;
@@ -109,6 +113,8 @@ export interface PendingCheckpoint {
      * (`PendingAction.hasBidiControls`,core [ref]),`put()` 在铸行
      * 这一刻反范式成 `checkpoint.has_bidi_controls` 列(同行 `tool_input` / `bound_input_hash` / `gate_kind` /
      * `risk_descriptor` / `rule_suggestions` 五列同一条「铸行时一格、读口零 blob」先例),server 不重算。
+     * (S-700 起本读口**确实**逐行读 blob —— 只为 {@link ParkRowFacts} 那几位,且是按「本仓不发 ALTER TABLE、
+     * 加列 = 删库丢在飞 park」裁出来的代价,见 `listPending` 那一段;本位与五列的「铸行时一格」形不变。)
      *
      * 🔴 `true` **或缺席,恒不写 `false`/`null`**(core d.ts 的 OMIT 契约逐字点名 BFF:「never null, never
      * present-but-undefined, never false」):缺席 = **没检出**(干净 / core 的有界扫描没够着 / 本列诞生前

package/dist/plugins/checkpoint-store-sql.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { APPROVAL_GATE_KINDS_SQL_IN } from "../tool-approval.js";
 import { CheckpointError, MAX_RULE_TEXT_CHARS, validatePendingSteer, appendPendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION, ExecutionOutcomeConflictError, executionRecordDisposition, executionVerdict, } from "@sema-agent/core";
 import { redactDeep, redactSecrets } from "../trace/redact.js";
-import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat } from "../approval-card.js";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, RuleOfferRawSchema, backfillLegacyBatchMemberKind, parkRowFacts, screenUncoveredDetailSeat } from "../approval-card.js";
 import { assertJsonColumnWritable, createObjectColumnReader, decodeJsonColumn, decodeNullableJsonColumn, foldJsonColumn, isJsonColumnBodyProblem, jsonColumnText, readJsonArrayColumn, readJsonObjectColumn, readNonNullJsonValueColumn, } from "./sql-json-column.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { mysqlDriver, pgDriver, dialectProtocolJsonEncoder } from "./sql-driver.js";
@@ -168,6 +168,21 @@ function readRiskDescriptorCell(cell) {
         return null;
     }
 }
+function readParkRowFactsCell(cell) {
+    let pendingAction;
+    try {
+        pendingAction = decodeNullableJsonColumn(cell, readPendingActionMemberBody, "checkpoint.checkpoint $.pendingAction (operator queue row)");
+    }
+    catch (e) {
+        if (!isJsonColumnBodyProblem(e))
+            throw e;
+        recordFailOpen("server.approvals.park-row-blob-unreadable");
+        return {};
+    }
+    return parkRowFacts(pendingAction);
+}
+const PARK_ROW_PENDING_ACTION = { key: "pendingAction", as: "pending_action" };
+const readPendingActionMemberBody = createObjectColumnReader();
 export function boundedToolInput(args) {
     if (args === undefined)
         return null;
@@ -516,7 +531,8 @@ export class SqlCheckpointStore {
     async listPending(scope) {
         const d = this.db.dialect;
         const base = `SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, ${jsonColumnText(d, "tool_input")}, c.bound_input_hash, ` +
-            `${jsonColumnText(d, "risk_descriptor")}, ${jsonColumnText(d, "rule_suggestions")}, c.has_bidi_controls, c.created_at_ms, c.deadline, c.gate_kind, ta.task_id ` +
+            `${jsonColumnText(d, "risk_descriptor")}, ${jsonColumnText(d, "rule_suggestions")}, c.has_bidi_controls, c.created_at_ms, c.deadline, c.gate_kind, ta.task_id, ` +
+            `${jsonColumnText(d, "checkpoint", PARK_ROW_PENDING_ACTION)} ` +
             "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
         const { rows } = scope
             ? await this.db.query(`${base}${this.q(" AND c.scope=?", " AND c.scope=$1")} ORDER BY c.created_at_ms ASC`, [scope])
@@ -543,6 +559,7 @@ export class SqlCheckpointStore {
                 ...(ruleOffers !== undefined ? { ruleOffers } : {}),
                 ...(Number(r.has_bidi_controls) === 1 ? { hasBidiControls: true } : {}),
                 ...(contentKindOf(toolName) !== undefined ? { contentKind: "content_ask" } : {}),
+                ...readParkRowFactsCell(r[PARK_ROW_PENDING_ACTION.as]),
             };
         });
         return out.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);

package/dist/plugins/local-checkpoint-store.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { ASK_USER_QUESTION_TOOL_NAME, contentKindOf } from "../approval-content-kind.js";
+import { parkRowFacts } from "../approval-card.js";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
@@ -184,6 +185,7 @@ export class LocalCheckpointStore {
                 })(),
                 ...(pa?.hasBidiControls === true ? { hasBidiControls: true } : {}),
                 ...(contentKindOf(pa?.toolName ?? null) !== undefined ? { contentKind: "content_ask" } : {}),
+                ...parkRowFacts(cp.pendingAction),
             });
         }
         return rows.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);

package/dist/plugins/mailbox-store-sql.d.ts

@@ -12,8 +12,10 @@
  *     2026-07-25)起不再与 drop 同句**:reap 是收件人活着时的龄扫,**清箱保高水位**(删消息、清租约、盒行与
  *     next_seq 留着)——本文件 2026-09-03(车BF,codex r1 [high])才跟上;此前 reap 删盒行 ⇒ 下一条 append 从 1
  *     重铸,陈旧 ack 可删掉一条没人见过的新消息。跨进程试剂盒明钉此条。
- *  3. **ack 无 owner 守卫**(信任 claim 赢者链):`seq <= upToSeq` 删行;lease 的 `maxSeq <= upToSeq`
- *     时顺带清 lease(全量 ack = 释放)。
+ *  3. **ack 带 owner 围栏**(MB1,core 1.452 起;原「无守卫、信任 claim 赢者链」已被推翻):当前持租者才删
+ *     `seq <= upToSeq` 的行;lease 的 `maxSeq <= upToSeq` 时顺带清 lease(全量 ack = 释放)。**围栏的判决报出来**
+ *     (core 7.30.0 #1036,S-616):放行 ⇒ `{ acked: true }`(删 0 行也是 true —— 契约是「围栏放行」不是「删了几行」),
+ *     盒不在 / 无人持租 / 非持租者 ⇒ `{ acked: false }`;逐格与 core `InMemoryMailboxStore.ack` 同答。
  *  4. **lease 过期判 = 严格 `expiresAt > now` 才挡**;`releaseLease` 只在 owner 匹配时清。
  *  5. `peekCount` 含已 lease 消息(可见性 ≠ lease 态);空盒 claim = null(box 行在而消息 0 也 null)。
  *  6. **reap = SQL 全量真扫**(core File 实现只扫已加载盒 = 进程内 backstop,[ref] 确认 SQL 是全量
@@ -44,7 +46,7 @@
  */
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { MailboxAppendMessage, MailboxLease, MailboxStore } from "@sema-agent/core";
+import type { MailboxAckResult, MailboxAppendMessage, MailboxLease, MailboxStore } from "@sema-agent/core";
 import { type IndexSpec } from "./ensure-index.js";
 import type { MailboxRecipientLifecycle, MailboxRecipientTombstone } from "./mailbox-recipient-lifecycle.js";
 export declare const MAILBOX_TABLE = "mailbox";
@@ -82,7 +84,7 @@ export declare class TiDBMailboxStore implements MailboxStore, MailboxRecipientL
     private tx;
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
-    ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<void>;
+    ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<MailboxAckResult>;
     releaseLease(scope: string, handle: string, owner: string): Promise<void>;
     peekCount(scope: string, handle: string): Promise<number>;
     drop(scope: string, handle: string): Promise<void>;
@@ -108,7 +110,7 @@ export declare class PgMailboxStore implements MailboxStore, MailboxRecipientLif
     private assertIdentity;
     append(scope: string, handle: string, msg: MailboxAppendMessage): Promise<number>;
     claimLease(scope: string, handle: string, owner: string, ttlMs: number, now?: number): Promise<MailboxLease | null>;
-    ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<void>;
+    ack(scope: string, handle: string, owner: string, upToSeq: number): Promise<MailboxAckResult>;
     releaseLease(scope: string, handle: string, owner: string): Promise<void>;
     peekCount(scope: string, handle: string): Promise<number>;
     drop(scope: string, handle: string): Promise<void>;

package/dist/plugins/mailbox-store-sql.js

@@ -263,13 +263,14 @@ export class TiDBMailboxStore {
         });
     }
     async ack(scope, handle, owner, upToSeq) {
-        await this.tx(async (c) => {
+        return this.tx(async (c) => {
             const [rows] = (await c.query(`SELECT lease_owner FROM ${MAILBOX_TABLE} WHERE scope_key = ? AND handle = ? FOR UPDATE`, [scope, handle]));
             if (rows.length === 0 || rows[0].lease_owner == null || bufToStr(rows[0].lease_owner) !== owner)
-                return;
+                return { acked: false };
             await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = ? AND handle = ? AND seq <= ?`, [scope, handle, upToSeq]);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL
          WHERE scope_key = ? AND handle = ? AND lease_max_seq IS NOT NULL AND lease_max_seq <= ?`, [scope, handle, upToSeq]);
+            return { acked: true };
         });
     }
     async releaseLease(scope, handle, owner) {
@@ -410,13 +411,14 @@ export class PgMailboxStore {
         });
     }
     async ack(scope, handle, owner, upToSeq) {
-        await this.tx(async (c) => {
+        return this.tx(async (c) => {
             const r = (await c.query(`SELECT lease_owner FROM ${MAILBOX_TABLE} WHERE scope_key = $1 AND handle = $2 FOR UPDATE`, [scope, handle]));
             if (r.rows.length === 0 || r.rows[0].lease_owner == null || bufToStr(r.rows[0].lease_owner) !== owner)
-                return;
+                return { acked: false };
             await c.query(`DELETE FROM ${MAILBOX_MSG_TABLE} WHERE scope_key = $1 AND handle = $2 AND seq <= $3`, [scope, handle, upToSeq]);
             await c.query(`UPDATE ${MAILBOX_TABLE} SET lease_owner = NULL, lease_expires_at_ms = NULL, lease_max_seq = NULL
          WHERE scope_key = $1 AND handle = $2 AND lease_max_seq IS NOT NULL AND lease_max_seq <= $3`, [scope, handle, upToSeq]);
+            return { acked: true };
         });
     }
     async releaseLease(scope, handle, owner) {

package/dist/plugins/permission-rule-store-file.js

@@ -5,6 +5,7 @@ import { performance } from "node:perf_hooks";
 import { FileDurableRulePartitionProvider, AppendLog, ensureDir, readJsonlRecords, } from "@sema-agent/core";
 import { z } from "zod";
 import { buildRulePayloadHash } from "./permission-rule-store-sql.js";
+import { createSkippedRecordSink } from "../observability/corrupt-read-seat.js";
 import { EDITED_RULE_BREADTH_WARNING_CODES, RULE_APPROVAL_RECORD_SCHEMA, UNCOVERED_SEGMENT_REASONS } from "../permission-rule-vocab.js";
 import { RULE_BEHAVIORS } from "@sema-agent/core";
 const RuleScopeSchema = z.union([
@@ -140,7 +141,7 @@ export class FileRuleApprovalRecordStore {
         ensureDir(dir);
         const path = join(dir, "approvals.jsonl");
         this.gate = new CorruptionGate("permission-rule approval log", path, onError);
-        for (const raw of readJsonlRecords(path, (info) => this.gate.trip(info.reason))) {
+        for (const raw of readJsonlRecords(path, createSkippedRecordSink((info) => this.gate.trip(info.reason)))) {
             const parsed = ApprovalLineSchema.safeParse(raw);
             if (!parsed.success) {
                 const stale = StaleApprovalLineSchema.safeParse(raw);
@@ -209,7 +210,7 @@ export class FileRuleImportTicketStore {
         ensureDir(dir);
         const path = join(dir, "import-tickets.jsonl");
         this.gate = new CorruptionGate("permission-rule import-ticket log", path, onError);
-        for (const raw of readJsonlRecords(path, (info) => this.gate.trip(info.reason))) {
+        for (const raw of readJsonlRecords(path, createSkippedRecordSink((info) => this.gate.trip(info.reason)))) {
             const parsed = TicketLineSchema.safeParse(raw);
             if (!parsed.success) {
                 this.gate.trip(`a replayed record does not carry a readable shape: ${parsed.error.message}`);